From 3665530ee51d226a67bc7136c7041b8634521724 Mon Sep 17 00:00:00 2001 From: Nico Piel Date: Tue, 10 Nov 2026 11:33:58 +0100 Subject: [PATCH 1/3] Bump HikariCP to 7.1.0 2.5.1 is from 2016. 7.1.0 is the current release and runs on Java 11+; it needs only slf4j-api at runtime, which the build already ships (the metrics and javassist dependencies are optional and unused here). The calls in HikariConnectionPool are unchanged in 7.x: a connectionTimeout of 0 still means wait indefinitely, and ProxyConnection.unwrap(Connection.class) still returns the driver's connection. Behavior that does change comes from upstream defaults, such as idle connections now being pinged every two minutes (keepaliveTime) and SQLTimeoutException no longer evicting a connection. Signed-off-by: Nico Piel --- gradle/libs.versions.toml | 2 +- gradle/verification-metadata.xml | 10 +++++----- server/docs/thirdparty/THIRD-PARTY-README.txt | 2 +- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 66e6117a0..3119e277c 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -126,7 +126,7 @@ hamcrest = { module = "org.hamcrest:hamcrest", version = "2.2" } hapi-structures-v27 = { module = "ca.uhn.hapi:hapi-structures-v27", version.ref = "hapi" } hapi-structures-v28 = { module = "ca.uhn.hapi:hapi-structures-v28", version.ref = "hapi" } hapi-structures-v281 = { module = "ca.uhn.hapi:hapi-structures-v281", version.ref = "hapi" } -hikaricp = { module = "com.zaxxer:HikariCP", version = "2.5.1" } +hikaricp = { module = "com.zaxxer:HikariCP", version = "7.1.0" } hk2-aopalliance-repackaged = { module = "org.glassfish.hk2.external:aopalliance-repackaged", version.ref = "hk2" } hk2-api = { module = "org.glassfish.hk2:hk2-api", version.ref = "hk2" } hk2-javax-inject = { module = "org.glassfish.hk2.external:javax.inject", version.ref = "hk2" } diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml index 04c10db54..f8b4917ad 100644 --- a/gradle/verification-metadata.xml +++ b/gradle/verification-metadata.xml @@ -704,12 +704,12 @@ - - - + + + - - + + diff --git a/server/docs/thirdparty/THIRD-PARTY-README.txt b/server/docs/thirdparty/THIRD-PARTY-README.txt index ae76828ea..b104cff3b 100644 --- a/server/docs/thirdparty/THIRD-PARTY-README.txt +++ b/server/docs/thirdparty/THIRD-PARTY-README.txt @@ -26,7 +26,7 @@ The following are distributed under the terms of the Apache License version 2.0 Google Code libphonenumber (https://github.com/google/libphonenumber) Google Code Prettify (https://github.com/google/code-prettify) Guava 32.0.1 [incl. CLI] (https://github.com/google/guava) - HikariCP 2.5.1 + HikariCP 7.1.0 J2ObjC Annotations 1.3 (https://github.com/google/j2objc/) Jackson Project [incl. CLI] (https://github.com/FasterXML/jackson) Java Native Access (JNA) 4.5.2 (https://github.com/java-native-access/jna) From 8e45774295fcfebd007fc69e4c6691369a6cf6fe Mon Sep 17 00:00:00 2001 From: Nico Piel Date: Tue, 10 Nov 2026 11:33:58 +0100 Subject: [PATCH 2/3] Bump commons-pool2 to 2.13.1 2.3 is from 2015. 2.x has stayed source and binary compatible for the pool calls in KeyEncryptor and FileConnector, which still compile against 2.13.1; the millisecond setters FileConnector uses are deprecated in favor of Duration ones but behave the same. commons-parent 34 was only the parent of pool2 2.3, so its checksum entry is dropped too. Signed-off-by: Nico Piel --- gradle/libs.versions.toml | 2 +- gradle/verification-metadata.xml | 15 +++++---------- 2 files changed, 6 insertions(+), 11 deletions(-) diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 3119e277c..4eb0b083f 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -104,7 +104,7 @@ commons-lang3 = { module = "org.apache.commons:commons-lang3", version = "3.20.0 commons-logging = { module = "commons-logging:commons-logging", version = "1.3.5" } commons-math3 = { module = "org.apache.commons:commons-math3", version = "3.0" } commons-net = { module = "commons-net:commons-net", version = "3.9.0" } -commons-pool2 = { module = "org.apache.commons:commons-pool2", version = "2.3" } +commons-pool2 = { module = "org.apache.commons:commons-pool2", version = "2.13.1" } commons-text = { module = "org.apache.commons:commons-text", version = "1.15.0" } commons-vfs2 = { module = "org.apache.commons:commons-vfs2", version = "2.10.0" } derby = { module = "org.apache.derby:derby", version.ref = "derby" } diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml index f8b4917ad..b39aa8da2 100644 --- a/gradle/verification-metadata.xml +++ b/gradle/verification-metadata.xml @@ -1481,11 +1481,6 @@ - - - - - @@ -1579,12 +1574,12 @@ - - - + + + - - + + From 1af925054b06a8523ec91f532302450b4bf93b2b Mon Sep 17 00:00:00 2001 From: Nico Piel Date: Tue, 10 Nov 2026 11:33:59 +0100 Subject: [PATCH 3/3] Bump mybatis to 3.5.19 3.1.1 is from 2012. 3.5.19 is the last Java 8 release of the 3.5 line. 3.6.0 is only days old, so this stays on 3.5. OGNL and javassist are still shaded inside the mybatis jar, and nothing else is needed at runtime. The 3.5 line binds a simple parameterType's type handler from the declared type. User.selectPreferencesForUser declared java.lang.String but is called with the Integer user id, so it now declares java.lang.Integer in every database's mapper. Upstream Mirth made the same change when it moved to 3.5.15. The other String and Integer parameterTypes match what their callers pass, except DebugUsage.deleteDebugUsageStatistics, which declares java.lang.String but receives a DebugUsage bean. That still works on 3.5: there is no type handler for DebugUsage, so #{serverId} is read from the bean. The checksum entry for mybatis-parent 15, the parent of 3.1.1, is replaced by one for mybatis-parent 48, the parent of 3.5.19. Signed-off-by: Nico Piel --- gradle/libs.versions.toml | 2 +- gradle/verification-metadata.xml | 16 ++++++++-------- server/dbconf/derby/derby-user.xml | 2 +- server/dbconf/mysql/mysql-user.xml | 2 +- server/dbconf/oracle/oracle-user.xml | 2 +- server/dbconf/postgres/postgres-user.xml | 2 +- server/dbconf/sqlserver/sqlserver-user.xml | 2 +- server/docs/thirdparty/THIRD-PARTY-README.txt | 8 ++++++-- 8 files changed, 20 insertions(+), 16 deletions(-) diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 4eb0b083f..d1bf2f8d7 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -215,7 +215,7 @@ mimepull = { module = "org.jvnet.mimepull:mimepull", version = "1.9.7" } mockito-core = { module = "org.mockito:mockito-core", version.ref = "mockito" } mockito-inline = { module = "org.mockito:mockito-inline", version.ref = "mockito" } mssql-jdbc = { module = "com.microsoft.sqlserver:mssql-jdbc", version = "10.2.4.jre11" } -mybatis = { module = "org.mybatis:mybatis", version = "3.1.1" } +mybatis = { module = "org.mybatis:mybatis", version = "3.5.19" } mysql-connector-j = { module = "com.mysql:mysql-connector-j", version = "8.4.0" } netty-buffer = { module = "io.netty:netty-buffer", version.ref = "netty" } netty-codec = { module = "io.netty:netty-codec", version.ref = "netty" } diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml index b39aa8da2..ed10943a4 100644 --- a/gradle/verification-metadata.xml +++ b/gradle/verification-metadata.xml @@ -2781,17 +2781,17 @@ - - - + + + - - + + - - - + + + diff --git a/server/dbconf/derby/derby-user.xml b/server/dbconf/derby/derby-user.xml index 19f534711..8ba8ce9ca 100644 --- a/server/dbconf/derby/derby-user.xml +++ b/server/dbconf/derby/derby-user.xml @@ -154,7 +154,7 @@ {call SYSCS_UTIL.SYSCS_COMPRESS_TABLE('APP', 'PERSON', 0)} - SELECT NAME AS "key", VALUE AS "value" FROM PERSON_PREFERENCE WHERE PERSON_ID = #{value} diff --git a/server/dbconf/mysql/mysql-user.xml b/server/dbconf/mysql/mysql-user.xml index 1b0ea623d..48888ab1b 100644 --- a/server/dbconf/mysql/mysql-user.xml +++ b/server/dbconf/mysql/mysql-user.xml @@ -145,7 +145,7 @@ SET LOGGED_IN = FALSE - SELECT NAME AS "key", VALUE AS "value" FROM PERSON_PREFERENCE WHERE PERSON_ID = #{value} diff --git a/server/dbconf/oracle/oracle-user.xml b/server/dbconf/oracle/oracle-user.xml index 26aa1b9ee..7c288e395 100644 --- a/server/dbconf/oracle/oracle-user.xml +++ b/server/dbconf/oracle/oracle-user.xml @@ -146,7 +146,7 @@ SET LOGGED_IN = 0 - SELECT NAME "key", VALUE "value" FROM PERSON_PREFERENCE WHERE PERSON_ID = #{value} diff --git a/server/dbconf/postgres/postgres-user.xml b/server/dbconf/postgres/postgres-user.xml index aad9ebece..8a7f194e7 100644 --- a/server/dbconf/postgres/postgres-user.xml +++ b/server/dbconf/postgres/postgres-user.xml @@ -131,7 +131,7 @@ SET LOGGED_IN = FALSE - SELECT NAME AS "key", VALUE AS "value" FROM PERSON_PREFERENCE WHERE PERSON_ID = #{value} diff --git a/server/dbconf/sqlserver/sqlserver-user.xml b/server/dbconf/sqlserver/sqlserver-user.xml index e68c201ee..8dbef7f21 100644 --- a/server/dbconf/sqlserver/sqlserver-user.xml +++ b/server/dbconf/sqlserver/sqlserver-user.xml @@ -145,7 +145,7 @@ SET LOGGED_IN = 0 - SELECT NAME AS "key", VALUE AS "value" FROM PERSON_PREFERENCE WHERE PERSON_ID = #{value} diff --git a/server/docs/thirdparty/THIRD-PARTY-README.txt b/server/docs/thirdparty/THIRD-PARTY-README.txt index b104cff3b..342255d67 100644 --- a/server/docs/thirdparty/THIRD-PARTY-README.txt +++ b/server/docs/thirdparty/THIRD-PARTY-README.txt @@ -33,7 +33,7 @@ The following are distributed under the terms of the Apache License version 2.0 Jetty 9.4.57 Joda-Time 2.9.9 JSR305 Annotations for Findbugs 3.0.2 (http://findbugs.sourceforge.net/) - MyBatis 3.1.1 + MyBatis 3.5.19 Netty 4.1.137 Not-Going-To-Be-Commons-SSL 0.3.18 Quartz Scheduler 2.3.2 @@ -80,6 +80,10 @@ terms. Javassist 3.26.0 [incl. CLI] (source code can be downloaded at: https://github.com/jboss-javassist/javassist/tree/rel_3_26_0_ga) + Javassist 3.30.2-GA, included within the MyBatis 3.5.19 library (source + code can be downloaded at: + https://github.com/jboss-javassist/javassist/tree/rel_3_30_2_ga) + -------------------------------------------------------------------------------- @@ -706,7 +710,7 @@ ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. The license below pertains to OGNL (Object-Graph Navigation Language), which is -included within the MyBatis 3.1.1 library. +included within the MyBatis 3.5.19 library. =================== Beginning of License ===================