[WIP] HIVE-29000: Upgrade nimbus-jose-jwt

[arorasimran0309]

What changes were proposed in this pull request?

Upgrading nimbus-jose-jwt to resolve CVEs

Why are the changes needed?

Due to CVEs

Does this PR introduce any user-facing change?

No

How was this patch tested?

Existing tests

[Aggarwal-Raghav]

@arorasimran0309 , I can still see nimbus older version in iceberg/patched-iceberg-core/pom.xml

[INFO] |  +- org.apache.hadoop:hadoop-auth:jar:3.4.1:compile (optional)
[INFO] |  |  +- com.nimbusds:nimbus-jose-jwt:jar:9.37.2:compile (optional)
[INFO] |  |  |  \- com.github.stephenc.jcip:jcip-annotations:jar:1.0-1:compile (optional)

Also, this is a major version change, please check for any incompatiblities in api's (from release notes). As we are forcing hadoop 3.4.1 to work with 10.3 instead of 9.37.2

[sonarqubecloud[bot]]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions[bot]]

This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Feel free to reach out on the [email protected] list if the patch is in need of reviews.

[sonarqubecloud[bot]]

Quality Gate passed

Issues
28 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[arorasimran0309]

@arorasimran0309 , I can still see nimbus older version in iceberg/patched-iceberg-core/pom.xml

[INFO] |  +- org.apache.hadoop:hadoop-auth:jar:3.4.1:compile (optional)
[INFO] |  |  +- com.nimbusds:nimbus-jose-jwt:jar:9.37.2:compile (optional)
[INFO] |  |  |  \- com.github.stephenc.jcip:jcip-annotations:jar:1.0-1:compile (optional)

Also, this is a major version change, please check for any incompatiblities in api's (from release notes). As we are forcing hadoop 3.4.1 to work with 10.3 instead of 9.37.2

@Aggarwal-Raghav older version from iceberg/patched-iceberg-core/pom.xml is handled now. Also, checked release notes for 9.37.2 → 10.4.2 and confirmed no usage of features impacted by notable changes (null‑claim serialization, HS384/HS512 key length enforcement, RSA‑OAEP mode fix). The full build/test suite passes.

[saihemanth-cloudera]

Waiting for @Aggarwal-Raghav's approval to merge this patch

[Aggarwal-Raghav]

Dependency tree looks good, packaing also contains onty nimbus-jose-jwt-10.4.2.jar. LGTM +1