From 99c0f973318124b119e62e4824197d0b943775cc Mon Sep 17 00:00:00 2001 From: Nico Piel Date: Thu, 29 Oct 2026 19:37:25 +0100 Subject: [PATCH 1/3] Bump HikariCP to 7.1.0 2.5.1 is from 2016. 7.1.0 is the current release and runs on Java 11+; it needs only slf4j-api at runtime, which the build already ships (the metrics and javassist dependencies are optional and unused here). The calls in HikariConnectionPool are unchanged in 7.x: a connectionTimeout of 0 still means wait indefinitely, and ProxyConnection.unwrap(Connection.class) still returns the driver's connection. Behavior that does change comes from upstream defaults, such as idle connections now being pinged every two minutes (keepaliveTime) and SQLTimeoutException no longer evicting a connection. Signed-off-by: Nico Piel --- gradle/libs.versions.toml | 2 +- gradle/verification-metadata.xml | 10 +++++----- server/docs/thirdparty/THIRD-PARTY-README.txt | 2 +- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 1b7f550d8..d24b7c95a 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -115,7 +115,7 @@ hamcrest = { module = "org.hamcrest:hamcrest", version = "2.2" } hapi-structures-v27 = { module = "ca.uhn.hapi:hapi-structures-v27", version.ref = "hapi" } hapi-structures-v28 = { module = "ca.uhn.hapi:hapi-structures-v28", version.ref = "hapi" } hapi-structures-v281 = { module = "ca.uhn.hapi:hapi-structures-v281", version.ref = "hapi" } -hikaricp = { module = "com.zaxxer:HikariCP", version = "2.5.1" } +hikaricp = { module = "com.zaxxer:HikariCP", version = "7.1.0" } hk2-aopalliance-repackaged = { module = "org.glassfish.hk2.external:aopalliance-repackaged", version.ref = "hk2" } hk2-api = { module = "org.glassfish.hk2:hk2-api", version.ref = "hk2" } hk2-javax-inject = { module = "org.glassfish.hk2.external:javax.inject", version.ref = "hk2" } diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml index 42ef5a89d..eb9b7a6b4 100644 --- a/gradle/verification-metadata.xml +++ b/gradle/verification-metadata.xml @@ -745,12 +745,12 @@ - - - + + + - - + + diff --git a/server/docs/thirdparty/THIRD-PARTY-README.txt b/server/docs/thirdparty/THIRD-PARTY-README.txt index e8a549a15..9092cd753 100644 --- a/server/docs/thirdparty/THIRD-PARTY-README.txt +++ b/server/docs/thirdparty/THIRD-PARTY-README.txt @@ -27,7 +27,7 @@ The following are distributed under the terms of the Apache License version 2.0 Google Code Prettify (https://github.com/google/code-prettify) Guava 32.0.1 [incl. CLI] (https://github.com/google/guava) Guice 4.1 (https://github.com/google/guice) - HikariCP 2.5.1 + HikariCP 7.1.0 J2ObjC Annotations 1.3 (https://github.com/google/j2objc/) Jackson Project [incl. CLI] (https://github.com/FasterXML/jackson) Java Native Access (JNA) 4.5.2 (https://github.com/java-native-access/jna) From b8f3058c010081f6090586633db8ec6d9bb7f975 Mon Sep 17 00:00:00 2001 From: Nico Piel Date: Thu, 29 Oct 2026 19:39:17 +0100 Subject: [PATCH 2/3] Bump commons-pool2 to 2.13.1 2.3 is from 2015, and commons-dbcp2 releases from 2.10 on need a recent pool2. 2.x has stayed source and binary compatible for the pool calls in KeyEncryptor and FileConnector, which still compile against 2.13.1; the millisecond setters FileConnector uses are deprecated in favor of Duration ones but behave the same. commons-parent 34 was only the parent of pool2 2.3, so its checksum entry is dropped too. Signed-off-by: Nico Piel --- gradle/libs.versions.toml | 2 +- gradle/verification-metadata.xml | 15 +++++---------- 2 files changed, 6 insertions(+), 11 deletions(-) diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index d24b7c95a..41b76e1d9 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -92,7 +92,7 @@ commons-lang3 = { module = "org.apache.commons:commons-lang3", version = "3.20.0 commons-logging = { module = "commons-logging:commons-logging", version = "1.3.5" } commons-math3 = { module = "org.apache.commons:commons-math3", version = "3.0" } commons-net = { module = "commons-net:commons-net", version = "3.9.0" } -commons-pool2 = { module = "org.apache.commons:commons-pool2", version = "2.3" } +commons-pool2 = { module = "org.apache.commons:commons-pool2", version = "2.13.1" } commons-text = { module = "org.apache.commons:commons-text", version = "1.15.0" } commons-vfs2 = { module = "org.apache.commons:commons-vfs2", version = "2.10.0" } derby = { module = "org.apache.derby:derby", version.ref = "derby" } diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml index eb9b7a6b4..0e48ff4cb 100644 --- a/gradle/verification-metadata.xml +++ b/gradle/verification-metadata.xml @@ -1522,11 +1522,6 @@ - - - - - @@ -1620,12 +1615,12 @@ - - - + + + - - + + From 83622e2e8598a1cfbd6fca8ab30bea4e53286f03 Mon Sep 17 00:00:00 2001 From: Nico Piel Date: Thu, 29 Oct 2026 23:42:02 +0100 Subject: [PATCH 3/3] Bump mybatis to 3.5.19 3.1.1 is from 2012. 3.5.19 is the last Java 8 release of the 3.5 line. 3.6.0 is only days old, so this stays on 3.5. OGNL and javassist are still shaded inside the mybatis jar, and nothing else is needed at runtime. The 3.5 line binds a simple parameterType's type handler from the declared type. User.selectPreferencesForUser declared java.lang.String but is called with the Integer user id, so it now declares java.lang.Integer in every database's mapper. Upstream Mirth made the same change when it moved to 3.5.15. The other String and Integer parameterTypes match what their callers pass. mybatis-parent 15 was only the parent of 3.1.1, so its checksum entry is dropped too. Signed-off-by: Nico Piel --- gradle/libs.versions.toml | 2 +- gradle/verification-metadata.xml | 16 ++++++++-------- server/dbconf/derby/derby-user.xml | 2 +- server/dbconf/mysql/mysql-user.xml | 2 +- server/dbconf/oracle/oracle-user.xml | 2 +- server/dbconf/postgres/postgres-user.xml | 2 +- server/dbconf/sqlserver/sqlserver-user.xml | 2 +- server/docs/thirdparty/THIRD-PARTY-README.txt | 8 ++++++-- 8 files changed, 20 insertions(+), 16 deletions(-) diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 41b76e1d9..663cac543 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -210,7 +210,7 @@ mimepull = { module = "org.jvnet.mimepull:mimepull", version = "1.9.7" } mockito-core = { module = "org.mockito:mockito-core", version.ref = "mockito" } mockito-inline = { module = "org.mockito:mockito-inline", version.ref = "mockito" } mssql-jdbc = { module = "com.microsoft.sqlserver:mssql-jdbc", version = "10.2.4.jre11" } -mybatis = { module = "org.mybatis:mybatis", version = "3.1.1" } +mybatis = { module = "org.mybatis:mybatis", version = "3.5.19" } mysql-connector-j = { module = "com.mysql:mysql-connector-j", version = "8.4.0" } netty-buffer = { module = "io.netty:netty-buffer", version.ref = "netty" } netty-codec = { module = "io.netty:netty-codec", version.ref = "netty" } diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml index 0e48ff4cb..7bfc8ea4a 100644 --- a/gradle/verification-metadata.xml +++ b/gradle/verification-metadata.xml @@ -2801,17 +2801,17 @@ - - - + + + - - + + - - - + + + diff --git a/server/dbconf/derby/derby-user.xml b/server/dbconf/derby/derby-user.xml index 19f534711..8ba8ce9ca 100644 --- a/server/dbconf/derby/derby-user.xml +++ b/server/dbconf/derby/derby-user.xml @@ -154,7 +154,7 @@ {call SYSCS_UTIL.SYSCS_COMPRESS_TABLE('APP', 'PERSON', 0)} - SELECT NAME AS "key", VALUE AS "value" FROM PERSON_PREFERENCE WHERE PERSON_ID = #{value} diff --git a/server/dbconf/mysql/mysql-user.xml b/server/dbconf/mysql/mysql-user.xml index 1b0ea623d..48888ab1b 100644 --- a/server/dbconf/mysql/mysql-user.xml +++ b/server/dbconf/mysql/mysql-user.xml @@ -145,7 +145,7 @@ SET LOGGED_IN = FALSE - SELECT NAME AS "key", VALUE AS "value" FROM PERSON_PREFERENCE WHERE PERSON_ID = #{value} diff --git a/server/dbconf/oracle/oracle-user.xml b/server/dbconf/oracle/oracle-user.xml index 26aa1b9ee..7c288e395 100644 --- a/server/dbconf/oracle/oracle-user.xml +++ b/server/dbconf/oracle/oracle-user.xml @@ -146,7 +146,7 @@ SET LOGGED_IN = 0 - SELECT NAME "key", VALUE "value" FROM PERSON_PREFERENCE WHERE PERSON_ID = #{value} diff --git a/server/dbconf/postgres/postgres-user.xml b/server/dbconf/postgres/postgres-user.xml index aad9ebece..8a7f194e7 100644 --- a/server/dbconf/postgres/postgres-user.xml +++ b/server/dbconf/postgres/postgres-user.xml @@ -131,7 +131,7 @@ SET LOGGED_IN = FALSE - SELECT NAME AS "key", VALUE AS "value" FROM PERSON_PREFERENCE WHERE PERSON_ID = #{value} diff --git a/server/dbconf/sqlserver/sqlserver-user.xml b/server/dbconf/sqlserver/sqlserver-user.xml index e68c201ee..8dbef7f21 100644 --- a/server/dbconf/sqlserver/sqlserver-user.xml +++ b/server/dbconf/sqlserver/sqlserver-user.xml @@ -145,7 +145,7 @@ SET LOGGED_IN = 0 - SELECT NAME AS "key", VALUE AS "value" FROM PERSON_PREFERENCE WHERE PERSON_ID = #{value} diff --git a/server/docs/thirdparty/THIRD-PARTY-README.txt b/server/docs/thirdparty/THIRD-PARTY-README.txt index 9092cd753..a5517bb2b 100644 --- a/server/docs/thirdparty/THIRD-PARTY-README.txt +++ b/server/docs/thirdparty/THIRD-PARTY-README.txt @@ -34,7 +34,7 @@ The following are distributed under the terms of the Apache License version 2.0 Jetty 9.4.57 Joda-Time 2.9.9 JSR305 Annotations for Findbugs 3.0.2 (http://findbugs.sourceforge.net/) - MyBatis 3.1.1 + MyBatis 3.5.19 Netty 4.1.137 Not-Going-To-Be-Commons-SSL 0.3.18 Quartz Scheduler 2.3.2 @@ -81,6 +81,10 @@ terms. Javassist 3.26.0 [incl. CLI] (source code can be downloaded at: https://github.com/jboss-javassist/javassist/tree/rel_3_26_0_ga) + Javassist 3.30.2-GA, included within the MyBatis 3.5.19 library (source + code can be downloaded at: + https://github.com/jboss-javassist/javassist/tree/rel_3_30_2_ga) + -------------------------------------------------------------------------------- @@ -717,7 +721,7 @@ ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. The license below pertains to OGNL (Object-Graph Navigation Language), which is -included within the MyBatis 3.1.1 library. +included within the MyBatis 3.5.19 library. =================== Beginning of License ===================