HIVE-29000: Upgrade nimbus-jose-jwt to 10.4.2 to resolve CVE

[arorasimran0309]

What changes were proposed in this pull request?

Upgrading nimbus-jose-jwt to resolve CVEs

Why are the changes needed?

Due to CVEs

Does this PR introduce any user-facing change?

No

How was this patch tested?

Existing tests, dependency tree

[Aggarwal-Raghav]

@arorasimran0309 , I can still see nimbus older version in iceberg/patched-iceberg-core/pom.xml

[INFO] |  +- org.apache.hadoop:hadoop-auth:jar:3.4.1:compile (optional)
[INFO] |  |  +- com.nimbusds:nimbus-jose-jwt:jar:9.37.2:compile (optional)
[INFO] |  |  |  \- com.github.stephenc.jcip:jcip-annotations:jar:1.0-1:compile (optional)

Also, this is a major version change, please check for any incompatiblities in api's (from release notes). As we are forcing hadoop 3.4.1 to work with 10.3 instead of 9.37.2

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.
Feel free to reach out on the dev@hive.apache.org list if the patch is in need of reviews.

[saihemanth-cloudera]

Please add the same exclusion here as well: https://github.com/apache/hive/blob/master/standalone-metastore/metastore-common/pom.xml#L77 to avoid 9.37.3 completely from the dependency tree

[arorasimran0309]

Addressed these changes, please review

[saihemanth-cloudera]

LGTM +1, Pending green Jenkins tests.

[sonarqubecloud]

Quality Gate passed

Issues
28 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[arorasimran0309]

@arorasimran0309 , I can still see nimbus older version in iceberg/patched-iceberg-core/pom.xml

[INFO] |  +- org.apache.hadoop:hadoop-auth:jar:3.4.1:compile (optional)
[INFO] |  |  +- com.nimbusds:nimbus-jose-jwt:jar:9.37.2:compile (optional)
[INFO] |  |  |  \- com.github.stephenc.jcip:jcip-annotations:jar:1.0-1:compile (optional)

Also, this is a major version change, please check for any incompatiblities in api's (from release notes). As we are forcing hadoop 3.4.1 to work with 10.3 instead of 9.37.2

@Aggarwal-Raghav
older version from iceberg/patched-iceberg-core/pom.xml is handled now.
Also, checked release notes for 9.37.2 → 10.4.2 and confirmed no usage of features impacted by notable changes (null‑claim serialization, HS384/HS512 key length enforcement, RSA‑OAEP mode fix). The full build/test suite passes.

[saihemanth-cloudera]

Waiting for @Aggarwal-Raghav's approval to merge this patch

[Aggarwal-Raghav]

Dependency tree looks good, packaing also contains onty nimbus-jose-jwt-10.4.2.jar.
LGTM +1