Repository navigation
Track the 4.7.0 release notes in the repository - #503
Open
tonygermano wants to merge 19 commits into
Open
tonygermano wants to merge 19 commits into
tonygermano wants to merge 19 commits into
Conversation
Documentation about the project itself, such as release notes, has no home in the repository. server/docs is copied into the distribution, so it is not suitable for material that should not ship. Add a top-level docs folder with a README explaining its purpose and that it is not included in release artifacts. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Tony Germano <tony@germano.name>
Copy the 4.7.0 release notes, unchanged, from the GitHub release draft as of 2026-10-19. Release drafts keep no revision history, so further edits will be made here and reviewed as changes to this file, with the release body taken from it at release time. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Tony Germano <tony@germano.name>
The entry described selectLimit as no longer executed but kept for compatibility. State that the driver setting is ignored, that the REST parameter and the client-core getTables argument are deprecated and will be removed in an upcoming release, and what Java callers will need to change. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Tony Germano <tony@germano.name>
tonygermano
requested review from
a team,
gibson9583,
jonbartels,
kayyagari,
kpalang,
mgaffigan,
pacmano1 and
ssrowe
October 19, 2026 16:32
Contributor
|
I don't think release notes should live in the engine repo. |
Contributor
Why not? |
Lists the six GitHub users whose first PR merged to main landed after the v4.6.0 tag, following the format used in the 4.5.2 release notes. Contributors were identified by taking each author's earliest merged PR across the repo's full merged-PR history and keeping those whose merge commit is an ancestor of main but not of v4.6.0. renovate[bot] also has its first merge in this window and is omitted as a bot. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Jon Bartels <jonathan.bartels@gmail.com>
jonbartels
force-pushed
the
docs/release-notes-folder
branch
from
October 19, 2026 17:30
800e2e0 to
514dfe0
Compare
jonbartels
previously approved these changes
Oct 19, 2026
Contributor
|
This seems like a heavy solution to what could be a google doc or delegation. Not everything needs bureaucracy and consensus. The risk here seems negligible. |
NicoPiel
previously approved these changes
Oct 19, 2026
Member
Author
|
I'm fine with closing the PR without merging when we are finished, but this allows for
The purpose of this PR is to track changes and open items while we are still working on the draft. It doesn't matter to me if the notes end up in the repo or not, but I don't think it would harm anything if they did. I know what we had been doing was not working very well, so I came up with a solution that I thought would be simple for everyone to use. |
Installers that bundle a Java runtime now ship Eclipse Temurin 21 instead of Azul Zulu 17. Add an upgrade note so users with custom JVM options or Java 17-specific dependencies know to check them. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Tony Germano <tony@germano.name>
The notes are now maintained in the repository, and the heading becomes the published release body, so it should not call itself a draft. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Tony Germano <tony@germano.name>
The fix from #340 was mentioned only in passing, as part of the reliability highlight and as a one-line fix. It restores the use of JDBC drivers supplied through library resources, which had failed on every Java version since 9 for Database Reader and Writer connectors and for scripts using DatabaseConnectionFactory. Give it its own highlight that explains the symptoms and impact, links the original report, and credits the contributor. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Tony Germano <tony@germano.name>
jonbartels
previously approved these changes
Oct 20, 2026
The paragraph linked to security-review.md and security-cve-inventory.json, which aren't in the repository, and left the advisories waiting on a release disposition. Replace it with a table giving each advisory's upstream link, what it affects and its fixed version, so 4.7.0 ships with them documented. Drop the sentence that only pointed at the two missing files. Add GHSA-hcjv-f5jh-r55v, a low-severity pgjdbc advisory published 2026-10-15 that affects the shipped 42.7.12 and has no fixed release. The conditions and fixed versions come from the upstream advisories. The claim that nothing else in the download calls the affected APIs comes from a byte scan of every class in every jar of the draft v4.7.0 tarball (494 jars, built from f9ba73e). looksLikeValidNumber, the DataInput parser entry points, ByteStreamWriter and the COPY and large object APIs appear only inside jackson-core, jackson-databind and the PostgreSQL driver. The one Blob.setBytes caller outside the JDBC drivers is Quartz's job store delegate for the CUBRID database. No shipped file sets requireAuth. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Finnegan's Owner <44065187+pacmano1@users.noreply.github.com>
The Jackson bullet pointed at security-review.md for the limits, and that file isn't in the repository. State the defaults instead. The values are the DEFAULT_* constants of StreamReadConstraints in the jackson-core-2.18.8.jar shipped in the draft v4.7.0 tarball (built from f9ba73e), whose checksum matches gradle/verification-metadata.xml. No other class in that tarball references StreamReadConstraints, so nothing in the download changes the defaults. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Finnegan's Owner <44065187+pacmano1@users.noreply.github.com>
The selectLimit entry said DatabaseConnectorServletInterface.getTables is in client-core. It ships in the Database Connector's extensions/jdbc/jdbc-shared.jar. A scan of every jar in the draft v4.7.0 tarball finds the class only there, server/build.gradle builds it into the jdbc shared jar, and mirth-client-core.jar holds no class from that package. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Finnegan's Owner <44065187+pacmano1@users.noreply.github.com>
The encryption paragraph said the Microsoft driver validates certificates even when the client sets encrypt=false. Microsoft's 10.2 notes make that depend on trustServerCertificate, so say so. Add what an upgrade looks like when the engine's own database is on SQL Server. Measured on the draft v4.7.0 (built from f9ba73e) against SQL Server 2022 with its self-signed certificate and a database.url with no encrypt setting: 4.6.0 starts; 4.7.0 logs "Error establishing connection to database, aborting startup" with "PKIX path building failed" and stops; appending ;trustServerCertificate=true lets it start. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Finnegan's Owner <44065187+pacmano1@users.noreply.github.com>
The installers leave out oieserver.ps1 on purpose (f9ba73e), so no 4.7.0 download has it, yet the fixes list announced a PowerShell 5.1 fix to it. Drop that from the fixes list and add an upgrade note that the script is gone. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Finnegan's Owner <44065187+pacmano1@users.noreply.github.com>
The CVE records for CVE-2026-82583, CVE-2026-78224 and CVE-2026-82578 list Mirth Connect 4.7.1 and earlier as affected (CVE Services API). Readers and scanners will match that against OIE 4.7.0, so name the number and say OIE 4.7.0 includes the fixes, in place of the general warning about version numbers. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Finnegan's Owner <44065187+pacmano1@users.noreply.github.com>
"The reviewed changes" and the "4.7.0 candidate" column header came from the draft. Say 4.7.0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Finnegan's Owner <44065187+pacmano1@users.noreply.github.com>
One used an em dash, the other a hyphen and Title Case. Use a colon and sentence case for both, like the rest of the document's headings. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Finnegan's Owner <44065187+pacmano1@users.noreply.github.com>
New Contributors names only first-time contributors. Add a line that thanks everyone who authored a PR merged between v4.6.0 and the draft release's target commit, f9ba73e (PR #491's merge), leaving out Renovate. Every commit in that range is by one of these people or by Renovate. Plain @mentions, as in New Contributors, so they render as mentions on the release page. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Finnegan's Owner <44065187+pacmano1@users.noreply.github.com>
jonbartels
previously approved these changes
Oct 21, 2026
Signed-off-by: Jon Bartels <jonathan.bartels@gmail.com>
jonbartels
force-pushed
the
docs/release-notes-folder
branch
from
October 21, 2026 00:07
0889e0b to
193f56c
Compare
…mit in their own section Signed-off-by: Jon Bartels <jonathan.bartels@gmail.com>
This reverts part of commit 0fc4fda.
jonbartels
approved these changes
Oct 21, 2026
gibson9583
approved these changes
Oct 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GitHub release drafts keep no revision history, so the 4.7.0 notes are moving into the repository where changes can be reviewed and attributed.
docs/folder for project documentation that isn't shipped.server/docsis copied into the distribution.docs/release-notes/4.7.0.md, copied unchanged from the GitHub release draft as of 2026-10-19.selectLimitentry to announce its deprecation and removal in an upcoming release (see Remove the disused selectLimit metadata query #462).Please don't edit the GitHub release draft any more. Push commits to this branch or suggest changes in review instead. At release time the draft body will be replaced with this file.
Known open items before release:
security-review.mdandsecurity-cve-inventory.json(in the security section and the Jackson entry) point to files that aren't in the repository. I've asked the author of that section for the missing content.Drafted with Claude Code