feat: Add Druid 37.0.0 (#1535)

* chore(druid) Remove 34.0.0

* feat(druid) Add 37.0.0

* chore: Update changelog

* chore(druid): Add more patches

* chore(druid/37.0.0): Combine two patches.

Previously 0002 introduced --no-default-hadoop. The arg is not valid anymore, and was removed in a later patch 0011. Now it's all done in 0002.

Author: NickLarsenNZ

CHANGELOG.md

@@ -18,6 +18,7 @@ All notable changes to this project will be documented in this file.
 - zookeeper: Add `3.9.5` ([#1515]).
 - hadoop: Add `3.5.0` and `3.4.3` ([#1511]).
 - airflow: Add `3.2.1` ([#1519]).
+- druid: Add `37.0.0` ([#1535]).
 
 ### Changed
 
@@ -45,6 +46,7 @@ All notable changes to this project will be documented in this file.
 - nifi: Remove `1.28.1`, deprecate `2.7.2` ([#1520]).
 - opa: Remove `1.8.0` ([#1509]).
 - spark-k8s: Remove `3.5.7` and `4.0.1` ([#1525]).
+- druid: Remove `34.0.0` ([#1535]).
 
 [#1446]: https://github.com/stackabletech/docker-images/pull/1446
 [#1452]: https://github.com/stackabletech/docker-images/pull/1452
@@ -72,6 +74,7 @@ All notable changes to this project will be documented in this file.
 [#1524]: https://github.com/stackabletech/docker-images/pull/1524
 [#1525]: https://github.com/stackabletech/docker-images/pull/1525
 [#1533]: https://github.com/stackabletech/docker-images/pull/1533
+[#1535]: https://github.com/stackabletech/docker-images/pull/1535
 
 ## [26.3.0] - 2026-03-16
 

druid/boil-config.toml

@@ -1,7 +1,7 @@
 [metadata.registries]
 "oci.stackable.tech" = { namespace = "sdp" }
 
-# LTS since 24.11
+# Deprecated since 26.7
 [versions."30.0.1".local-images]
 # https://druid.apache.org/docs/30.0.1/operations/java/
 java-base = "17"
@@ -11,22 +11,24 @@ java-devel = "17"
 [versions."30.0.1".build-arguments]
 authorizer-version = "0.7.0"
 
-[versions."34.0.0".local-images]
-# https://druid.apache.org/docs/34.0.0/operations/java/
-java-base = "17"
-java-devel = "17"
-"hadoop/hadoop" = "3.4.2" # TODO: Bump to 3.4.3
-
-# Deprecated since 26.3
-[versions."34.0.0".build-arguments]
-authorizer-version = "0.7.0"
-
-# Supported
+# Deprecated since 26.7
 [versions."35.0.1".local-images]
 # https://druid.apache.org/docs/35.0.1/operations/java/
 java-base = "21"
 java-devel = "21"
-"hadoop/hadoop" = "3.4.2" # TODO: Bump to 3.4.3
+"hadoop/hadoop" = "3.4.3"
 
 [versions."35.0.1".build-arguments]
 authorizer-version = "0.7.0"
+
+# LTS since 26.7
+[versions."37.0.0".local-images]
+# https://druid.apache.org/docs/37.0.0/operations/java/
+java-base = "21"
+java-devel = "21"
+"hadoop/hadoop" = "3.4.3"
+
+[versions."37.0.0".build-arguments]
+# We don't need to bump this if no code changed in https://github.com/stackabletech/druid-opa-authorizer
+# But a PR still needs to be raised to add/remove versions and ensure it still builds.
+authorizer-version = "0.7.0"

druid/stackable/patches/34.0.0/0007-Update-CycloneDX-plugin.patch

@@ -1,4 +1,4 @@
-From 515da2a96db1835133e2b367d4c006ce4fcf8a3a Mon Sep 17 00:00:00 2001
+From 319acbb818938c36b27f875e243c157dfc32fff4 Mon Sep 17 00:00:00 2001
 From: xeniape <xenia.fischer@stackable.tech>
 Date: Mon, 22 Sep 2025 14:20:53 +0200
 Subject: Removes all traces of the druid ranger extension
@@ -9,27 +9,27 @@ Subject: Removes all traces of the druid ranger extension
  2 files changed, 3 deletions(-)
 
 diff --git a/distribution/pom.xml b/distribution/pom.xml
-index f7e9766494..7c2573fbd4 100644
+index a1b2da00d3..51ce7563ea 100644
 --- a/distribution/pom.xml
 +++ b/distribution/pom.xml
-@@ -460,8 +460,6 @@
-                                         <argument>org.apache.druid.extensions.contrib:druid-rabbit-indexing-service</argument>
+@@ -448,8 +448,6 @@
                                          <argument>-c</argument>
                                          <argument>org.apache.druid.extensions.contrib:grpc-query</argument>
--                                        <argument>-c</argument>
+                                         <argument>-c</argument>
 -                                        <argument>org.apache.druid.extensions.contrib:druid-ranger-security</argument>
+-                                        <argument>-c</argument>
+                                         <argument>org.apache.druid.extensions.contrib:druid-exact-count-bitmap</argument>
                                      </arguments>
                                  </configuration>
-                             </execution>
 diff --git a/pom.xml b/pom.xml
-index 35ebdfdc34..829ddbd9e7 100644
+index 614ab31c09..6548d3a661 100644
 --- a/pom.xml
 +++ b/pom.xml
-@@ -260,7 +260,6 @@
+@@ -266,7 +266,6 @@
          <module>extensions-contrib/druid-deltalake-extensions</module>
          <module>extensions-contrib/spectator-histogram</module>
          <module>extensions-contrib/rabbit-stream-indexing-service</module>
 -        <module>extensions-contrib/druid-ranger-security</module>
          <!-- distribution packaging -->
          <module>distribution</module>
-         <!-- Revised integration tests -->
+         <!-- more test stuff -->

druid/stackable/patches/34.0.0/0008-Fix-CVE-2024-36114.patch

@@ -1,17 +1,17 @@
-From c836d04ca08c6f341817096dcca7d8231c25ed66 Mon Sep 17 00:00:00 2001
+From 9b08e71ee25e9d47818f7a8dd3a741027d19d667 Mon Sep 17 00:00:00 2001
 From: xeniape <xenia.fischer@stackable.tech>
 Date: Mon, 22 Sep 2025 14:23:11 +0200
 Subject: Include Prometheus emitter in distribution
 
 ---
- distribution/pom.xml | 46 ++++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 46 insertions(+)
+ distribution/pom.xml | 45 ++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 45 insertions(+)
 
 diff --git a/distribution/pom.xml b/distribution/pom.xml
-index 7c2573fbd4..21954e8fb4 100644
+index 51ce7563ea..28dc3f6a5f 100644
 --- a/distribution/pom.xml
 +++ b/distribution/pom.xml
-@@ -468,6 +468,52 @@
+@@ -457,5 +457,50 @@
                  </plugins>
              </build>
          </profile>
@@ -50,7 +50,6 @@ index 7c2573fbd4..21954e8fb4 100644
 +                                        <argument>${project.parent.version}</argument>
 +                                        <argument>-l</argument>
 +                                        <argument>${settings.localRepository}</argument>
-+                                        <argument>--no-default-hadoop</argument>
 +                                        <argument>-c</argument>
 +                                        <argument>org.apache.druid.extensions.contrib:prometheus-emitter</argument>
 +                                    </arguments>
@@ -61,6 +60,5 @@ index 7c2573fbd4..21954e8fb4 100644
 +                </plugins>
 +            </build>
 +        </profile>
-         <profile>
-             <id>integration-test</id>
-             <activation>
+     </profiles>
+ </project>

…aces-of-the-druid-ranger-extension.patch …aces-of-the-druid-ranger-extension.patchdruid/stackable/patches/34.0.0/0001-Removes-all-traces-of-the-druid-ranger-extension.patch renamed to druid/stackable/patches/37.0.0/0001-Removes-all-traces-of-the-druid-ranger-extension.patch druid/stackable/patches/34.0.0/0001-Removes-all-traces-of-the-druid-ranger-extension.patch renamed to druid/stackable/patches/37.0.0/0001-Removes-all-traces-of-the-druid-ranger-extension.patch

@@ -1,4 +1,4 @@
-From 8a1e8f9c4eaa419bb59825e645cbacd0b4ec7d34 Mon Sep 17 00:00:00 2001
+From de614889d64315022c6f4bd1e96d211accd5061e Mon Sep 17 00:00:00 2001
 From: xeniape <xenia.fischer@stackable.tech>
 Date: Tue, 23 Sep 2025 09:31:00 +0200
 Subject: Stop building unused extensions.
@@ -11,19 +11,21 @@ extensions from the build.
  1 file changed, 29 deletions(-)
 
 diff --git a/pom.xml b/pom.xml
-index 829ddbd9e7..369550e166 100644
+index 6548d3a661..d252009bc4 100644
 --- a/pom.xml
 +++ b/pom.xml
-@@ -229,37 +229,8 @@
-         <module>extensions-core/testing-tools</module>
+@@ -235,37 +235,8 @@
+         <module>extensions-core/druid-testcontainers</module>
          <!-- Community extensions -->
          <module>extensions-contrib/compressed-bigdecimal</module>
 -        <module>extensions-contrib/influx-extensions</module>
 -        <module>extensions-contrib/cassandra-storage</module>
 -        <module>extensions-contrib/dropwizard-emitter</module>
 -        <module>extensions-contrib/cloudfiles-extensions</module>
+-        <module>extensions-contrib/consul-extensions</module>
 -        <module>extensions-contrib/graphite-emitter</module>
 -        <module>extensions-contrib/distinctcount</module>
+-        <module>extensions-contrib/druid-exact-count-bitmap</module>
 -        <module>extensions-contrib/statsd-emitter</module>
 -        <module>extensions-contrib/time-min-max</module>
 -        <module>extensions-contrib/virtual-columns</module>
@@ -33,8 +35,6 @@ index 829ddbd9e7..369550e166 100644
          <module>extensions-contrib/kafka-emitter</module>
 -        <module>extensions-contrib/redis-cache</module>
 -        <module>extensions-contrib/opentsdb-emitter</module>
--        <module>extensions-contrib/materialized-view-maintenance</module>
--        <module>extensions-contrib/materialized-view-selection</module>
 -        <module>extensions-contrib/momentsketch</module>
 -        <module>extensions-contrib/moving-average-query</module>
 -        <module>extensions-contrib/tdigestsketch</module>
@@ -51,4 +51,4 @@ index 829ddbd9e7..369550e166 100644
 -        <module>extensions-contrib/rabbit-stream-indexing-service</module>
          <!-- distribution packaging -->
          <module>distribution</module>
-         <!-- Revised integration tests -->
+         <!-- more test stuff -->

…Prometheus-emitter-in-distribution.patch …Prometheus-emitter-in-distribution.patchdruid/stackable/patches/34.0.0/0002-Include-Prometheus-emitter-in-distribution.patch renamed to druid/stackable/patches/37.0.0/0002-Include-Prometheus-emitter-in-distribution.patch druid/stackable/patches/34.0.0/0002-Include-Prometheus-emitter-in-distribution.patch renamed to druid/stackable/patches/37.0.0/0002-Include-Prometheus-emitter-in-distribution.patch

@@ -1,4 +1,4 @@
-From 602c632042726fb4f71302d18144b540df8b42e9 Mon Sep 17 00:00:00 2001
+From 5ac5b65cf47f4ab2f45d4e0123b3c1ccb0d3cb24 Mon Sep 17 00:00:00 2001
 From: xeniape <xenia.fischer@stackable.tech>
 Date: Tue, 23 Sep 2025 09:42:41 +0200
 Subject: Include jackson-dataformat-xml dependency.
@@ -12,12 +12,12 @@ build.
  1 file changed, 5 insertions(+)
 
 diff --git a/server/pom.xml b/server/pom.xml
-index fbe2a2a480..f099199c01 100644
+index 06f26c6da6..79e0dafe5f 100644
 --- a/server/pom.xml
 +++ b/server/pom.xml
-@@ -218,6 +218,11 @@
+@@ -212,6 +212,11 @@
+             <groupId>org.checkerframework</groupId>
              <artifactId>checker-qual</artifactId>
-             <version>${checkerframework.version}</version>
          </dependency>
 +        <dependency>
 +          <!-- This is an optional dependency of log4j which is needed to use XmlLayout -->

…03-Stop-building-unused-extensions.patch …03-Stop-building-unused-extensions.patchdruid/stackable/patches/34.0.0/0003-Stop-building-unused-extensions.patch renamed to druid/stackable/patches/37.0.0/0003-Stop-building-unused-extensions.patch druid/stackable/patches/34.0.0/0003-Stop-building-unused-extensions.patch renamed to druid/stackable/patches/37.0.0/0003-Stop-building-unused-extensions.patch

@@ -1,4 +1,4 @@
-From 781c8de56f5b6f0d050133f268cff7f9a1bceec9 Mon Sep 17 00:00:00 2001
+From bf9e0cce3d73dca46905dcaed733ceb090dc91a1 Mon Sep 17 00:00:00 2001
 From: xeniape <xenia.fischer@stackable.tech>
 Date: Tue, 23 Sep 2025 09:42:51 +0200
 Subject: Stop building the tar.gz distribution.
@@ -10,7 +10,7 @@ again. So, instead we just skip the compression step entirely.
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/distribution/src/assembly/assembly.xml b/distribution/src/assembly/assembly.xml
-index ff8e0d2fdd..f9daa49e21 100644
+index 2b510ea85d..0fe10032ca 100644
 --- a/distribution/src/assembly/assembly.xml
 +++ b/distribution/src/assembly/assembly.xml
 @@ -23,7 +23,7 @@

…-jackson-dataformat-xml-dependency.patch …-jackson-dataformat-xml-dependency.patchdruid/stackable/patches/34.0.0/0005-Include-jackson-dataformat-xml-dependency.patch renamed to druid/stackable/patches/37.0.0/0004-Include-jackson-dataformat-xml-dependency.patch druid/stackable/patches/34.0.0/0005-Include-jackson-dataformat-xml-dependency.patch renamed to druid/stackable/patches/37.0.0/0004-Include-jackson-dataformat-xml-dependency.patch

@@ -0,0 +1,22 @@
+From 29b11c3292df341dda8216587faa4972cb3000b8 Mon Sep 17 00:00:00 2001
+From: Nick Larsen <nick.larsen@stackable.tech>
+Date: Tue, 16 Jun 2026 13:18:46 +0200
+Subject: Update CycloneDX plugin
+
+---
+ pom.xml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/pom.xml b/pom.xml
+index d252009bc4..a4a8f0e1e8 100644
+--- a/pom.xml
++++ b/pom.xml
+@@ -1969,7 +1969,7 @@
+             <plugin>
+                 <groupId>org.cyclonedx</groupId>
+                 <artifactId>cyclonedx-maven-plugin</artifactId>
+-                <version>2.7.9</version>
++                <version>2.9.1</version>
+                 <executions>
+                     <execution>
+                         <phase>package</phase>