[Snyk] Security upgrade org.apache.hive:hive-metastore from 2.3.4 to 4.2.0

[snyk-io]

Snyk has created this PR to fix 1 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• pom.xml

---

This is a high-risk upgrade, spanning two major versions from 2.3.4 to 4.2.0. It includes breaking API changes, data migration requirements, and deprecation of core features. Both the Hive 2.x and 3.x release lines are now End-of-Life (EOL).

Highlights:

• Metastore Client API (v4.x): The ThriftHiveMetastore.Client has breaking changes. Methods like delete_table_column_statistics and delete_partition_column_statistics now require a new mandatory engine parameter, which will cause compilation or runtime errors.
• Data Migration (v3.x): The default warehouse directory has changed, and non-ACID managed tables are converted to external tables. All transactional tables must be compacted before upgrading from 2.x.
• Streaming API (v3.x): The original Streaming Data Ingest API was deprecated in Hive 3.0 and replaced by a V2 API; the mutation API was removed.

Source: Apache Hive documentation
Recommendation: This upgrade requires a multi-step migration. First, follow a Hive 2.x to 3.x migration guide to handle data and table structure changes. Then, update client code to support the new Metastore API in version 4.x. Thorough testing is essential.

Notice 🤖: This content was generated using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

---

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	LDAP Injection SNYK-JAVA-ORGAPACHEDERBY-6069877	101	org.apache.hive:hive-metastore: 2.3.4 -> 4.2.0 Major version upgrade No Path Found No Known Exploit

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 LDAP Injection

[snyk-io]

⛔ Snyk checks have failed. 48 issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (48)
✅	Open Source Security	0	33	0	0	33 issues
⛔	Licenses	0	15	0	0	15 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.