diff --git a/hbase-http/src/main/java/org/apache/hadoop/hbase/http/HttpServer.java b/hbase-http/src/main/java/org/apache/hadoop/hbase/http/HttpServer.java
index f3f6025ecbd9..9b910c1676e8 100644
--- a/hbase-http/src/main/java/org/apache/hadoop/hbase/http/HttpServer.java
+++ b/hbase-http/src/main/java/org/apache/hadoop/hbase/http/HttpServer.java
@@ -108,7 +108,10 @@ public class HttpServer implements FilterContainer {
   private static final Logger LOG = LoggerFactory.getLogger(HttpServer.class);
   private static final String EMPTY_STRING = "";
 
-  private static final int DEFAULT_MAX_HEADER_SIZE = 64 * 1024; // 64K
+  // Jetty's max header size is Character.MAX_VALUE - 1, See ArrayTernaryTrie for more details
+  // And in newer jetty version, they add a check when creating a server so we must follow this
+  // limitation otherwise the UTs will fail
+  private static final int DEFAULT_MAX_HEADER_SIZE = Character.MAX_VALUE - 1;
 
   static final String FILTER_INITIALIZERS_PROPERTY
       = "hbase.http.filter.initializers";
diff --git a/hbase-http/src/main/java/org/apache/hadoop/hbase/util/JSONBean.java b/hbase-http/src/main/java/org/apache/hadoop/hbase/util/JSONBean.java
index def2611b3a5f..98af1609984a 100644
--- a/hbase-http/src/main/java/org/apache/hadoop/hbase/util/JSONBean.java
+++ b/hbase-http/src/main/java/org/apache/hadoop/hbase/util/JSONBean.java
@@ -57,7 +57,7 @@ public class JSONBean {
   private static final String COMMA = ",";
   private static final String ASTERICK = "*";
   private static final Logger LOG = LoggerFactory.getLogger(JSONBean.class);
-  private static final Gson GSON = GsonUtil.createGson().create();
+  private static final Gson GSON = GsonUtil.createGsonWithDisableHtmlEscaping().create();
 
   /**
    * Use dumping out mbeans as JSON.
diff --git a/hbase-protocol-shaded/pom.xml b/hbase-protocol-shaded/pom.xml
index 26be663e2f91..7af6236229f8 100644
--- a/hbase-protocol-shaded/pom.xml
+++ b/hbase-protocol-shaded/pom.xml
@@ -33,8 +33,8 @@
     <maven.javadoc.skip>true</maven.javadoc.skip>
     <!--Version of protobuf that hbase uses internally (we shade our pb)
          Must match what is out in hbase-thirdparty include.
-           -->
-    <internal.protobuf.version>3.11.4</internal.protobuf.version>
+    -->
+    <internal.protobuf.version>3.21.1</internal.protobuf.version>
   </properties>
   <build>
     <plugins>
diff --git a/hbase-thrift/src/main/java/org/apache/hadoop/hbase/thrift/Constants.java b/hbase-thrift/src/main/java/org/apache/hadoop/hbase/thrift/Constants.java
index 930dfe45800d..fcb7651fc332 100644
--- a/hbase-thrift/src/main/java/org/apache/hadoop/hbase/thrift/Constants.java
+++ b/hbase-thrift/src/main/java/org/apache/hadoop/hbase/thrift/Constants.java
@@ -26,7 +26,10 @@
 public final class Constants {
   private Constants(){}
 
-  public static final int DEFAULT_HTTP_MAX_HEADER_SIZE = 64 * 1024; // 64k
+  // Jetty's max header size is Character.MAX_VALUE - 1, See ArrayTernaryTrie for more details
+  // And in newer jetty version, they add a check when creating a server so we must follow this
+  // limitation otherwise the UTs will fail
+  public static final int DEFAULT_HTTP_MAX_HEADER_SIZE = Character.MAX_VALUE - 1;
 
   public static final String SERVER_TYPE_CONF_KEY =
       "hbase.regionserver.thrift.server.type";
diff --git a/pom.xml b/pom.xml
index f0d4bf02c6a2..1e905ac9ebb4 100755
--- a/pom.xml
+++ b/pom.xml
@@ -512,6 +512,7 @@
       <timezone>+8</timezone>
     </developer>
   </developers>
+<<<<<<< HEAD
   <build>
     <extensions>
       <extension>
@@ -1452,8 +1453,8 @@
     <httpclient.version>4.5.3</httpclient.version>
     <httpcore.version>4.4.13</httpcore.version>
     <metrics-core.version>3.2.6</metrics-core.version>
-    <jackson.version>2.10.1</jackson.version>
-    <jackson.databind.version>2.10.1</jackson.databind.version>
+    <jackson.version>2.13.3</jackson.version>
+    <jackson.databind.version>2.13.3</jackson.databind.version>
     <jaxb-api.version>2.3.1</jaxb-api.version>
     <servlet.api.version>3.1.0</servlet.api.version>
     <wx.rs.api.version>2.1.1</wx.rs.api.version>
@@ -1510,7 +1511,7 @@
     <surefire.version>3.0.0-M4</surefire.version>
     <wagon.ssh.version>2.12</wagon.ssh.version>
     <xml.maven.version>1.0.1</xml.maven.version>
-    <hbase-thirdparty.version>3.5.1</hbase-thirdparty.version>
+    <hbase-thirdparty.version>4.1.1</hbase-thirdparty.version>
     <!-- Intraproject jar naming properties -->
     <!-- TODO this is pretty ugly, but works for the moment.
       Modules are pretty heavy-weight things, so doing this work isn't too bad. -->