getting rid of Jetty 6 from hbase 1.2.5

Question

I am using hbase 1.2.5 which depends on Jetty 6. I would like to get past Jetty 6- which has security vulnerabilities.

I would rather not move to hbase 2.x (not yet...) Is there a hbase 1.x version that uses a higher version on Jetty ?

Answer 1

The latest hbase 1.x release is 1.2.11 (released 15-Feb-2019) built against Jetty 6.1.26

For hbase 1.x to support a current/stable release of Jetty would require code changes, as the Jetty project moved from codehaus/mortbay to the Eclipse Foundation, causing a large java package namespace move in the process.

I was unable to find a statement of what status hbase 1.x is (I suspect it's in maintenance mode, meaning only security fixes are being applied), but since the project has moved on to another major version release hbase 2.x, there's probably little desire to make the code changes to hbase 1.x to support jetty 9.x.

See: https://issues.apache.org/jira/browse/HBASE-12894

But being that hbase is an open source project, you might have some luck submitting a pull request/patch against hbase 1.x that implements Jetty 9.x support.