diff --git a/dev/deps/spark-deps-hadoop-palantir b/dev/deps/spark-deps-hadoop-palantir
index 1ef24cebb2ed2..bc2d9f1ec3103 100644
--- a/dev/deps/spark-deps-hadoop-palantir
+++ b/dev/deps/spark-deps-hadoop-palantir
@@ -1,5 +1,5 @@
 HikariCP-java7-2.4.12.jar
-RoaringBitmap-0.6.43.jar
+RoaringBitmap-0.7.16.jar
 activation-1.1.1.jar
 aircompressor-0.10.jar
 antlr4-runtime-4.7.jar
@@ -26,7 +26,7 @@ classmate-1.1.0.jar
 commons-beanutils-1.9.3.jar
 commons-beanutils-core-1.8.0.jar
 commons-cli-1.2.jar
-commons-codec-1.10.jar
+commons-codec-1.11.jar
 commons-collections-3.2.2.jar
 commons-compiler-3.0.9.jar
 commons-compress-1.8.1.jar
@@ -34,13 +34,13 @@ commons-configuration-1.6.jar
 commons-crypto-1.0.0.jar
 commons-digester-1.8.jar
 commons-httpclient-3.1.jar
-commons-io-2.4.jar
+commons-io-2.6.jar
 commons-lang-2.6.jar
-commons-lang3-3.5.jar
+commons-lang3-3.8.jar
 commons-logging-1.2.jar
-commons-math3-3.4.1.jar
-commons-net-3.1.jar
-compress-lzf-1.0.3.jar
+commons-math3-3.6.1.jar
+commons-net-3.6.jar
+compress-lzf-1.0.4.jar
 core-1.1.2.jar
 curator-client-2.7.1.jar
 curator-framework-2.7.1.jar
@@ -86,22 +86,22 @@ htrace-core4-4.1.0-incubating.jar
 httpclient-4.5.6.jar
 httpcore-4.4.10.jar
 ivy-2.4.0.jar
-jackson-annotations-2.9.5.jar
-jackson-core-2.9.5.jar
+jackson-annotations-2.9.6.jar
+jackson-core-2.9.6.jar
 jackson-core-asl-1.9.13.jar
-jackson-databind-2.9.5.jar
-jackson-dataformat-cbor-2.9.5.jar
-jackson-dataformat-yaml-2.9.5.jar
-jackson-datatype-guava-2.9.5.jar
-jackson-datatype-jdk8-2.9.5.jar
-jackson-datatype-joda-2.9.5.jar
-jackson-datatype-jsr310-2.9.5.jar
+jackson-databind-2.9.6.jar
+jackson-dataformat-cbor-2.9.6.jar
+jackson-dataformat-yaml-2.9.6.jar
+jackson-datatype-guava-2.9.6.jar
+jackson-datatype-jdk8-2.9.6.jar
+jackson-datatype-joda-2.9.6.jar
+jackson-datatype-jsr310-2.9.6.jar
 jackson-jaxrs-1.9.13.jar
 jackson-mapper-asl-1.9.13.jar
-jackson-module-afterburner-2.9.5.jar
-jackson-module-jaxb-annotations-2.9.5.jar
-jackson-module-paranamer-2.9.5.jar
-jackson-module-scala_2.11-2.9.5.jar
+jackson-module-afterburner-2.9.6.jar
+jackson-module-jaxb-annotations-2.9.6.jar
+jackson-module-paranamer-2.9.6.jar
+jackson-module-scala_2.11-2.9.6.jar
 jackson-xc-1.9.13.jar
 janino-3.0.9.jar
 javassist-3.20.0-GA.jar
@@ -125,15 +125,15 @@ jersey-server-2.25.1.jar
 jetty-6.1.26.jar
 jetty-sslengine-6.1.26.jar
 jetty-util-6.1.26.jar
-jetty-util-9.4.8.v20171121.jar
-joda-time-2.9.9.jar
+jetty-util-9.4.12.v20180830.jar
+joda-time-2.10.jar
 json-smart-1.3.1.jar
 json4s-ast_2.11-3.5.3.jar
 json4s-core_2.11-3.5.3.jar
 json4s-jackson_2.11-3.5.3.jar
 json4s-scalap_2.11-3.5.3.jar
 jsp-api-2.1.jar
-jsr305-3.0.1.jar
+jsr305-3.0.2.jar
 jtransforms-2.4.0.jar
 jul-to-slf4j-1.7.25.jar
 kafka-clients-0.11.0.0.jar
@@ -142,24 +142,24 @@ kubernetes-client-3.0.0.jar
 kubernetes-model-2.0.0.jar
 leveldbjni-all-1.8.jar
 log4j-1.2.17.jar
-logging-interceptor-3.9.1.jar
-lz4-java-1.4.0.jar
+logging-interceptor-3.11.0.jar
+lz4-java-1.4.1.jar
 machinist_2.11-0.6.1.jar
 macro-compat_2.11-1.1.1.jar
-metrics-core-3.2.5.jar
-metrics-graphite-3.2.5.jar
+metrics-core-3.2.6.jar
+metrics-graphite-3.2.6.jar
 metrics-influxdb-1.2.2.jar
-metrics-json-3.2.5.jar
-metrics-jvm-3.2.5.jar
+metrics-json-3.2.6.jar
+metrics-jvm-3.2.6.jar
 minlog-1.3.0.jar
 mssql-jdbc-6.2.1.jre7.jar
 netty-3.10.6.Final.jar
-netty-all-4.1.17.Final.jar
+netty-all-4.1.29.Final.jar
 nimbus-jose-jwt-4.41.1.jar
-objenesis-2.5.1.jar
+objenesis-2.6.jar
 okhttp-2.7.5.jar
-okhttp-3.9.1.jar
-okio-1.13.0.jar
+okhttp-3.11.0.jar
+okio-1.15.0.jar
 opencsv-2.3.jar
 orc-core-1.5.2-nohive.jar
 orc-mapreduce-1.5.2-nohive.jar
@@ -185,12 +185,12 @@ shapeless_2.11-2.3.2.jar
 slf4j-api-1.7.25.jar
 slf4j-log4j12-1.7.25.jar
 snakeyaml-1.18.jar
-snappy-java-1.1.7.1.jar
+snappy-java-1.1.7.2.jar
 spire-macros_2.11-0.13.0.jar
 spire_2.11-0.13.0.jar
 stax-api-1.0-2.jar
 stax2-api-3.1.4.jar
-stream-2.7.0.jar
+stream-2.9.6.jar
 univocity-parsers-2.7.3.jar
 validation-api-1.1.0.Final.jar
 woodstox-core-5.0.3.jar
@@ -199,4 +199,4 @@ xmlenc-0.52.jar
 xz-1.5.jar
 zjsonpatch-0.3.0.jar
 zookeeper-3.4.6.jar
-zstd-jni-1.3.2-2.jar
+zstd-jni-1.3.5-3.jar
diff --git a/dev/sbt-checkstyle b/dev/sbt-checkstyle
index 8821a7c0e4ccf..1fb913d1f4805 100755
--- a/dev/sbt-checkstyle
+++ b/dev/sbt-checkstyle
@@ -21,6 +21,7 @@
 # with failure (either resolution or compilation); the "q" makes SBT quit.
 ERRORS=$(echo -e "q\n" \
     | build/sbt \
+        -Phadoop-palantir \
         -Pkinesis-asl \
         -Pmesos \
         -Pkafka-0-8 \
diff --git a/pom.xml b/pom.xml
index 8d762e92f5339..8458a8742045e 100644
--- a/pom.xml
+++ b/pom.xml
@@ -132,20 +132,17 @@
     <hive.version.short>1.2.1</hive.version.short>
     <derby.version>10.12.1.1</derby.version>
     <parquet.version>1.10.1-palantir.3</parquet.version>
-    <feign.version>8.18.0</feign.version>
-    <okhttp3.version>3.9.1</okhttp3.version>
+    <okhttp3.version>3.11.0</okhttp3.version>
     <okhttp.version>2.7.5</okhttp.version>
-    <okio.version>1.13.0</okio.version>
-    <retrofit.version>2.3.0</retrofit.version>
-    <bouncycastle.version>1.58</bouncycastle.version>
-    <jetty.version>9.4.8.v20171121</jetty.version>
+    <okio.version>1.15.0</okio.version>
+    <jetty.version>9.4.12.v20180830</jetty.version>
     <orc.version>1.5.2</orc.version>
     <orc.classifier>nohive</orc.classifier>
     <javaxservlet.version>3.1.0</javaxservlet.version>
     <chill.version>0.9.3</chill.version>
     <ivy.version>2.4.0</ivy.version>
     <oro.version>2.0.8</oro.version>
-    <codahale.metrics.version>3.2.5</codahale.metrics.version>
+    <dropwizard.metrics.version>3.2.6</dropwizard.metrics.version>
     <dropwizard.version>1.0.0</dropwizard.version>
     <spark-influx-sink.version>0.4.0</spark-influx-sink.version>
     <avro.version>1.8.2</avro.version>
@@ -162,33 +159,33 @@
     <commons.httpcore.version>4.4.10</commons.httpcore.version>
     <!--  commons-httpclient/commons-httpclient-->
     <httpclient.classic.version>3.1</httpclient.classic.version>
-    <commons.math3.version>3.4.1</commons.math3.version>
+    <commons.math3.version>3.6.1</commons.math3.version>
     <!-- managed up from 3.2.1 for SPARK-11652 -->
     <commons.collections.version>3.2.2</commons.collections.version>
     <scala.version>2.11.12</scala.version>
     <scala.binary.version>2.11</scala.binary.version>
     <codehaus.jackson.version>1.9.13</codehaus.jackson.version>
-    <fasterxml.jackson.version>2.9.5</fasterxml.jackson.version>
-    <fasterxml.jackson.databind.version>2.9.5</fasterxml.jackson.databind.version>
-    <snappy.version>1.1.7.1</snappy.version>
+    <fasterxml.jackson.version>2.9.6</fasterxml.jackson.version>
+    <fasterxml.jackson.databind.version>2.9.6</fasterxml.jackson.databind.version>
+    <snappy.version>1.1.7.2</snappy.version>
     <netlib.java.version>1.1.2</netlib.java.version>
     <calcite.version>1.2.0-incubating</calcite.version>
-    <commons-codec.version>1.10</commons-codec.version>
-    <commons-io.version>2.4</commons-io.version>
+    <commons-codec.version>1.11</commons-codec.version>
+    <commons-io.version>2.6</commons-io.version>
     <!-- org.apache.commons/commons-lang/-->
     <commons-lang2.version>2.6</commons-lang2.version>
     <!-- org.apache.commons/commons-lang3/-->
-    <commons-lang3.version>3.5</commons-lang3.version>
+    <commons-lang3.version>3.8</commons-lang3.version>
     <commons-compress.version>1.8.1</commons-compress.version>
     <commons-pool.version>1.6</commons-pool.version>
     <datanucleus-core.version>3.2.10</datanucleus-core.version>
     <javax-activation.version>1.1.1</javax-activation.version>
-    <objenesis.version>2.5.1</objenesis.version>
+    <objenesis.version>2.6</objenesis.version>
     <janino.version>3.0.9</janino.version>
     <jersey.version>2.25.1</jersey.version>
-    <joda.version>2.9.9</joda.version>
+    <joda.version>2.10</joda.version>
     <jodd.version>3.5.2</jodd.version>
-    <jsr305.version>3.0.1</jsr305.version>
+    <jsr305.version>3.0.2</jsr305.version>
     <libthrift.version>0.9.3</libthrift.version>
     <antlr4.version>4.7</antlr4.version>
     <antlr.version>3.4</antlr.version>
@@ -369,61 +366,6 @@
         <artifactId>okhttp</artifactId>
         <version>${okhttp.version}</version>
       </dependency>
-
-      <dependency>
-        <groupId>com.squareup.retrofit2</groupId>
-        <artifactId>retrofit</artifactId>
-        <version>${retrofit.version}</version>
-        <exclusions>
-          <exclusion>
-            <groupId>com.fasterxml.jackson.core</groupId>
-            <artifactId>jackson-core</artifactId>
-          </exclusion>
-          <exclusion>
-            <groupId>com.fasterxml.jackson.core</groupId>
-            <artifactId>jackson-databind</artifactId>
-          </exclusion>
-          <exclusion>
-            <groupId>com.fasterxml.jackson.core</groupId>
-            <artifactId>jackson-annotations</artifactId>
-          </exclusion>
-        </exclusions>
-      </dependency>
-      <dependency>
-        <groupId>com.squareup.retrofit2</groupId>
-        <artifactId>converter-jackson</artifactId>
-        <version>${retrofit.version}</version>
-        <exclusions>
-          <exclusion>
-            <groupId>com.fasterxml.jackson.core</groupId>
-            <artifactId>jackson-core</artifactId>
-          </exclusion>
-          <exclusion>
-            <groupId>com.fasterxml.jackson.core</groupId>
-            <artifactId>jackson-databind</artifactId>
-          </exclusion>
-          <exclusion>
-            <groupId>com.fasterxml.jackson.core</groupId>
-            <artifactId>jackson-annotations</artifactId>
-          </exclusion>
-        </exclusions>
-      </dependency>
-      <dependency>
-        <groupId>com.squareup.retrofit2</groupId>
-        <artifactId>converter-scalars</artifactId>
-        <version>${retrofit.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>org.bouncycastle</groupId>
-        <artifactId>bcpkix-jdk15on</artifactId>
-        <version>${bouncycastle.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>org.bouncycastle</groupId>
-        <artifactId>bcprov-jdk15on</artifactId>
-        <!-- brought in by jets3t; see SPARK-22634 -->
-        <version>${bouncycastle.version}</version>
-      </dependency>
       <!-- This artifact is a shaded version of ASM 6.x. The POM that was used to produce this
            is at https://github.com/apache/geronimo-xbean/tree/trunk/xbean-asm6-shaded
            For context on why we shade ASM, see SPARK-782 and SPARK-6152. -->
@@ -666,7 +608,7 @@
       <dependency>
         <groupId>com.ning</groupId>
         <artifactId>compress-lzf</artifactId>
-        <version>1.0.3</version>
+        <version>1.0.4</version>
       </dependency>
       <dependency>
         <groupId>org.xerial.snappy</groupId>
@@ -676,17 +618,17 @@
       <dependency>
         <groupId>org.lz4</groupId>
         <artifactId>lz4-java</artifactId>
-        <version>1.4.0</version>
+        <version>1.4.1</version>
       </dependency>
       <dependency>
         <groupId>com.github.luben</groupId>
         <artifactId>zstd-jni</artifactId>
-        <version>1.3.2-2</version>
+        <version>1.3.5-3</version>
       </dependency>
       <dependency>
         <groupId>com.clearspring.analytics</groupId>
         <artifactId>stream</artifactId>
-        <version>2.7.0</version>
+        <version>2.9.6</version>
         <exclusions>
           <!-- Only HyperLogLogPlus is used, which doesn't depend on fastutil -->
           <exclusion>
@@ -709,17 +651,17 @@
       <dependency>
         <groupId>org.roaringbitmap</groupId>
         <artifactId>RoaringBitmap</artifactId>
-        <version>0.6.43</version>
+        <version>0.7.16</version>
       </dependency>
       <dependency>
         <groupId>commons-net</groupId>
         <artifactId>commons-net</artifactId>
-        <version>3.1</version>
+        <version>3.6</version>
       </dependency>
       <dependency>
         <groupId>io.netty</groupId>
         <artifactId>netty-all</artifactId>
-        <version>4.1.17.Final</version>
+        <version>4.1.29.Final</version>
       </dependency>
       <dependency>
         <groupId>io.netty</groupId>
@@ -734,27 +676,27 @@
       <dependency>
         <groupId>io.dropwizard.metrics</groupId>
         <artifactId>metrics-core</artifactId>
-        <version>${codahale.metrics.version}</version>
+        <version>${dropwizard.metrics.version}</version>
       </dependency>
       <dependency>
         <groupId>io.dropwizard.metrics</groupId>
         <artifactId>metrics-jvm</artifactId>
-        <version>${codahale.metrics.version}</version>
+        <version>${dropwizard.metrics.version}</version>
       </dependency>
       <dependency>
         <groupId>io.dropwizard.metrics</groupId>
         <artifactId>metrics-json</artifactId>
-        <version>${codahale.metrics.version}</version>
+        <version>${dropwizard.metrics.version}</version>
       </dependency>
       <dependency>
         <groupId>io.dropwizard.metrics</groupId>
         <artifactId>metrics-ganglia</artifactId>
-        <version>${codahale.metrics.version}</version>
+        <version>${dropwizard.metrics.version}</version>
       </dependency>
       <dependency>
         <groupId>io.dropwizard.metrics</groupId>
         <artifactId>metrics-graphite</artifactId>
-        <version>${codahale.metrics.version}</version>
+        <version>${dropwizard.metrics.version}</version>
       </dependency>
       <dependency>
         <groupId>io.dropwizard</groupId>
@@ -3138,15 +3080,6 @@
       </modules>
     </profile>
 
-    <!--
-      The cloud profile enables the cloud module.
-      It does not declare the hadoop-* artifacts which
-      the cloud module pulls in; these are delegated to
-      the hadoop-x.y protocols, so permitting different
-      hadoop versions to declare different include/exclude
-      rules (especially transient dependencies).
-
-     -->
     <profile>
       <id>hadoop-cloud</id>
       <modules>
diff --git a/sql/hive-thriftserver/src/main/java/org/apache/hive/service/cli/thrift/ThriftHttpCLIService.java b/sql/hive-thriftserver/src/main/java/org/apache/hive/service/cli/thrift/ThriftHttpCLIService.java
index 341a7fdbb59b8..a10245b372d71 100644
--- a/sql/hive-thriftserver/src/main/java/org/apache/hive/service/cli/thrift/ThriftHttpCLIService.java
+++ b/sql/hive-thriftserver/src/main/java/org/apache/hive/service/cli/thrift/ThriftHttpCLIService.java
@@ -19,7 +19,6 @@
 package org.apache.hive.service.cli.thrift;
 
 import java.util.Arrays;
-import java.util.concurrent.ExecutorService;
 import java.util.concurrent.SynchronousQueue;
 import java.util.concurrent.ThreadPoolExecutor;
 import java.util.concurrent.TimeUnit;
@@ -65,7 +64,7 @@ public void run() {
       // Server thread pool
       // Start with minWorkerThreads, expand till maxWorkerThreads and reject subsequent requests
       String threadPoolName = "HiveServer2-HttpHandler-Pool";
-      ExecutorService executorService = new ThreadPoolExecutor(minWorkerThreads, maxWorkerThreads,
+      ThreadPoolExecutor executorService = new ThreadPoolExecutor(minWorkerThreads, maxWorkerThreads,
           workerKeepAliveTime, TimeUnit.SECONDS, new SynchronousQueue<Runnable>(),
           new ThreadFactoryWithGarbageCleanup(threadPoolName));
       ExecutorThreadPool threadPool = new ExecutorThreadPool(executorService);