From 3b9e5e0853d58501bb286426c6cbf8f90215d673 Mon Sep 17 00:00:00 2001 From: Tony Germano Date: Mon, 19 Oct 2026 11:11:00 -0400 Subject: [PATCH 01/19] Add a docs folder for project documentation Documentation about the project itself, such as release notes, has no home in the repository. server/docs is copied into the distribution, so it is not suitable for material that should not ship. Add a top-level docs folder with a README explaining its purpose and that it is not included in release artifacts. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Tony Germano --- docs/README.md | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 docs/README.md diff --git a/docs/README.md b/docs/README.md new file mode 100644 index 000000000..72df34085 --- /dev/null +++ b/docs/README.md @@ -0,0 +1,8 @@ +# Project Documentation + +This folder holds documentation about the project itself, such as release +notes. It is not included in release artifacts. Documentation shipped with the +server belongs in [`server/docs`](../server/docs). + +- `release-notes/` holds the release notes for each version, named + `.md`. From e401bdd618e50cf90dcc7cd371496306360e8b2a Mon Sep 17 00:00:00 2001 From: Tony Germano Date: Mon, 19 Oct 2026 11:11:00 -0400 Subject: [PATCH 02/19] Add the 4.7.0 release notes draft Copy the 4.7.0 release notes, unchanged, from the GitHub release draft as of 2026-10-19. Release drafts keep no revision history, so further edits will be made here and reviewed as changes to this file, with the release body taken from it at release time. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Tony Germano --- docs/release-notes/4.7.0.md | 148 ++++++++++++++++++++++++++++++++++++ 1 file changed, 148 insertions(+) create mode 100644 docs/release-notes/4.7.0.md diff --git a/docs/release-notes/4.7.0.md b/docs/release-notes/4.7.0.md new file mode 100644 index 000000000..5c449628e --- /dev/null +++ b/docs/release-notes/4.7.0.md @@ -0,0 +1,148 @@ +# Open Integration Engine 4.7.0 — release notes draft + +## Highlights + +- **Stronger XML and database security.** Closes SQL injection and XML external entity vulnerabilities in the Database Connector API, XML batch processing, and XSLT transformer input. Additional hardening protects custom metadata searches and strict HL7 v2 XML parsing. +- **More control over HTTP connections.** HTTP Sender can bind outgoing connections to a selected local address. HTTP Listener supports a configurable maximum request-header size. [Sender change](https://github.com/OpenIntegrationEngine/engine/commit/d4d1122d1), [listener change](https://github.com/OpenIntegrationEngine/engine/commit/83d7c1a20). +- **Recent message-search filters.** Quickly reuse up to ten recent filters per channel. History stays in Administrator process memory rather than being written to local preferences, where search terms could expose sensitive data. [Feature](https://github.com/OpenIntegrationEngine/engine/commit/cab7392ec), [memory-only storage](https://github.com/OpenIntegrationEngine/engine/commit/924097130). +- **Batch submission with every message ID.** The new `POST /api/channels/{channelId}/batchMessagesWithObj` endpoint returns the IDs of all messages produced by a successful batch submission. It respects the channel's Process Batch setting; channels without batch processing return a single ID. [API change](https://github.com/OpenIntegrationEngine/engine/commit/893ae635b). +- **Reliability improvements.** Fixes Oracle JDBC batch inserts, Java platform visibility for isolated custom libraries, duplicate server-plugin lifecycle calls, and CLI hangs on authentication or connection failures. +- **Modernized source builds and containers.** Gradle replaces Ant, dependency checksums are verified, and an in-repository Docker build supports startup configuration through environment variables and mounted secrets, including database and JVM settings. Automated smoke tests cover five database types. [Container support](https://github.com/OpenIntegrationEngine/engine/commit/5423492e9). + +## Security — CVEs addressed + +The reviewed changes contain fixes for **3 CVEs in shared engine code** and dependency upgrades addressing **45 additional CVEs in bundled runtime components**. One further CVE is fixed in **test-only JUnit**. These counts describe verified fixes and affected/fixed component versions; they do not imply that every upstream vulnerability was exploitable in an OIE deployment. + +### Engine fixes + +| CVE | Fix | +| --- | --- | +| [CVE-2026-82583](https://www.cve.org/CVERecord?id=CVE-2026-82583) | SQL injection in Database Connector API table metadata discovery. | +| [CVE-2026-78224](https://www.cve.org/CVERecord?id=CVE-2026-78224) | External-entity expansion in XSLT transformer message input. | +| [CVE-2026-82578](https://www.cve.org/CVERecord?id=CVE-2026-82578) | External-entity expansion in XPath-based XML batch processing. | + +The public advisory names NextGen/Mirth Connect; OIE includes corresponding fixes in the shared code. Mirth's published affected/fixed version numbers must not be applied to OIE's independent release numbering. [CISA advisory](https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-253-01). + +### Dependency fixes + +| Component | 4.6.0 → 4.7.0 candidate | CVEs addressed | +| --- | --- | --- | +| Jackson Core | `2.14.3` → `2.18.8` | [CVE-2025-52999](https://www.cve.org/CVERecord?id=CVE-2025-52999) | +| Microsoft SQL Server JDBC | `8.4.1.jre8` → `10.2.4.jre11` | [CVE-2025-59250](https://www.cve.org/CVERecord?id=CVE-2025-59250) | +| Jakarta Mail | `1.6.7` → `1.6.8` | [CVE-2025-7962](https://www.cve.org/CVERecord?id=CVE-2025-7962) | +| Apache Commons Configuration | `2.13.0` → `2.15.0` | [CVE-2026-45205](https://www.cve.org/CVERecord?id=CVE-2026-45205) | +| Log4j API/Core/1.2 bridge | `2.25.3` → `2.26.1` | [CVE-2026-34477](https://www.cve.org/CVERecord?id=CVE-2026-34477), [CVE-2026-34478](https://www.cve.org/CVERecord?id=CVE-2026-34478), [CVE-2026-34479](https://www.cve.org/CVERecord?id=CVE-2026-34479), [CVE-2026-34480](https://www.cve.org/CVERecord?id=CVE-2026-34480), [CVE-2026-49844](https://www.cve.org/CVERecord?id=CVE-2026-49844) | +| PostgreSQL JDBC | `42.7.8` → `42.7.12` | [CVE-2026-42198](https://www.cve.org/CVERecord?id=CVE-2026-42198), [CVE-2026-54291](https://www.cve.org/CVERecord?id=CVE-2026-54291) | +| Netty family | `4.1.119.Final` → `4.1.137.Final` | 34 CVEs, listed in the appendix | + +**Test dependencies:** JUnit 4.8.1 → 4.13.1 in command/donkey tests addresses [CVE-2020-15250](https://github.com/junit-team/junit4/security/advisories/GHSA-269g-pwp5-87pp). This is separate from the 48 engine/runtime CVEs above. + +**Known remaining advisories:** the reviewed candidate still ships PostgreSQL JDBC 42.7.12 and Jackson Core 2.18.8, with published affected ranges for CVE-2026-107314, CVE-2026-107315, CVE-2026-89407, and CVE-2026-89425. Exposure depends on API/configuration use. The [security review](security-review.md#remaining-published-advisories-in-changed-dependencies) provides conditions and fixed versions; these findings require release disposition and are not part of the addressed count. This is not a complete vulnerability inventory of all shipped components. + +The [verified CVE inventory](security-cve-inventory.json) and [security review](security-review.md) preserve the exact ranges and exclusions, including the conservative treatment of Jackson CVE-2026-68494 and shaded SCRAM CVE-2026-53712. + +## Security - General Improvements + +Additional hardening for issues without a newly verified CVE ID: + * strict HL7 XML parsing + * custom metadata search names + * fresh-install credentials + * memory-only recent-filter history + +## Breaking changes and upgrade considerations + +### Initial administrator credentials and password policy + +**Fresh databases no longer initialize with `admin/admin`.** Set `server.initialadminpassword` before the database's first initialization, or retrieve the generated administrator password from the first-startup server log. Changing this property later does not reset an existing account. Existing database credentials are retained. Update unattended installation and provisioning scripts accordingly. [Credential initialization change](https://github.com/OpenIntegrationEngine/engine/commit/423df182f). + +The packaged default configuration now sets a **15-character password minimum**, `password.retrylimit = 100`, and `password.lockoutperiod = 1` (**one hour**). These are new configuration defaults; preserved configuration files are not automatically rewritten to these values. Review the defaults when replacing configuration files or provisioning a new server. [Policy change](https://github.com/OpenIntegrationEngine/engine/commit/e8afb74a7). + +### XML messages containing DOCTYPE + +**DOCTYPE declarations are rejected** in source XML passed to XSLT steps, XML batch splitting by element name, level, or XPath query, and the HL7 v2 strict XML parser. Integrations using DTDs or entity declarations in these inputs must send self-contained XML without DOCTYPE declarations. Ordinary XML and namespace handling remain supported; the strict HL7 XML parser also preserves CDATA content. [XSLT fix](https://github.com/OpenIntegrationEngine/engine/commit/1e87457d3), [batch fix](https://github.com/OpenIntegrationEngine/engine/commit/10627668e), [strict HL7 fix](https://github.com/OpenIntegrationEngine/engine/commit/4f4809d14), [CDATA fix](https://github.com/OpenIntegrationEngine/engine/commit/03eefcfe0). + +XSLT stylesheets remain trusted configuration: external stylesheet imports/includes and `document()` access are still supported. The source-message hardening does not impose a blanket external-resource ban on stylesheets. + +### HTTP Listener header limits + +The new request-header-size setting retains the **8192-byte** limit for legacy configurations that omit it. A configured value must resolve to a positive integer; invalid, unresolved, zero, or negative values fail connector startup. Check channel templates and API-imported settings before deployment. [Final validation behavior](https://github.com/OpenIntegrationEngine/engine/commit/fa57d5d63). + +### Microsoft SQL Server JDBC encryption + +The bundled Microsoft driver changes from **8.4.1.jre8 to 10.2.4.jre11**. Starting with 10.2, Microsoft's driver enables `encrypt=true` by default and also validates certificates when the server forces encryption, even if the client specifies `encrypt=false`. Connections that previously worked without a trusted, matching server certificate can fail after upgrading. Verify TLS certificates and trust configuration for deployments using the Microsoft driver, including engine-database and channel connections. This particular change does not apply to connections using jTDS. [Dependency change](https://github.com/OpenIntegrationEngine/engine/commit/4af696764), [Microsoft's 10.2 changes](https://learn.microsoft.com/en-us/sql/connect/jdbc/release-notes-for-the-jdbc-driver?view=sql-server-ver17#changes-in-102). + +### API consumers and custom extensions + +- **Custom metadata filters must name configured columns exactly.** Unknown names, including incorrect casing and stale filters referring to removed or renamed columns, are rejected before a search query runs. This applies to retrieval, counting, removal, reprocessing, and export. Synchronous invalid requests can return HTTP 500; asynchronous reprocessing failures are logged. [Validation change](https://github.com/OpenIntegrationEngine/engine/commit/9359d9a82). +- **Database table metadata no longer executes a supplied `selectLimit` query template.** The API retains the argument for compatibility but uses quoted identifiers and a zero-row query, with JDBC metadata fallback. Review custom clients or drivers that depended on the old template behavior. [Fix](https://github.com/OpenIntegrationEngine/engine/commit/d38accecf). +- **Custom controller/servlet implementations need updating.** `EngineController` adds an abstract five-argument `dispatchRawMessage` overload, and `MessageServletInterface` adds `processBatchMessage`. The existing four-argument dispatch API remains available to callers. [API change](https://github.com/OpenIntegrationEngine/engine/commit/893ae635b). +- **The standalone extension JNLP endpoint is removed.** Extension resources are included directly in the main launch descriptor, reducing startup requests. Update custom launchers that fetch `/webstart/extensions/.jnlp` and subclasses overriding the removed `getExtensionJnlp(String)` method. Main launch descriptors and extension JAR serving remain available. [JNLP changes](https://github.com/OpenIntegrationEngine/engine/commit/a403863a9), [endpoint removal](https://github.com/OpenIntegrationEngine/engine/commit/0205efbde). +- **Other custom Java integrations:** the Microsoft driver removes `getAADSecretPrincipalId`; the server-plugin accessor now returns a snapshot, and plugin de-duplication uses `equals`/`hashCode`; missing synchronized global-map keys now throw `IllegalArgumentException` instead of `NullPointerException`. Check custom code relying on these APIs or behaviors. [Microsoft changes](https://learn.microsoft.com/en-us/sql/connect/jdbc/release-notes-for-the-jdbc-driver?view=sql-server-ver17#changes-in-102), [plugin collection](https://github.com/OpenIntegrationEngine/engine/commit/f421b3ca7), [global-map error](https://github.com/OpenIntegrationEngine/engine/commit/2e0ff419b). + +### Administrator, CLI, JSON, and build tooling + +- **Administrator now checks for JavaFX at startup.** Use a launcher/runtime with the `javafx.graphics` module available; the client stops with a prerequisite message when it is missing. Java 17 remains the minimum Java version; that requirement was introduced in 4.6.0. [Prerequisite check](https://github.com/OpenIntegrationEngine/engine/commit/86dec16ea). +- **CLI startup failures now return meaningful nonzero exit codes.** Automation should handle authentication, connection, configuration, usage, and unreadable-script failures. This does not guarantee that every failed command inside a script changes the process exit code. [CLI fix](https://github.com/OpenIntegrationEngine/engine/commit/11ad74434). +- **Jackson-based JSON paths have new parsing limits.** Jackson Core 2.18.8 introduces limits absent in the bundled 2.14.3 baseline, including nesting depth and token lengths. Test unusually deep or large JSON handled through Jackson-based utilities/custom code; this is not a claim that every OIE JSON parser uses Jackson. See [security review](security-review.md) for the limits and upstream references. +- **Source-build automation must migrate from Ant to Gradle.** Use the included wrapper, for example `./gradlew build -PdisableSigning=true`; source directories now follow the standard Gradle layout. Import the repository as a Gradle project instead of using the removed Eclipse project files. [Build migration](https://github.com/OpenIntegrationEngine/engine/commit/24c96f509), [source moves](https://github.com/OpenIntegrationEngine/engine/commit/8a2dc59f3). + +## Fixes and improvements + +- Keep Oracle prepared statements open until queued JDBC batch work executes, fixing failures caused by prematurely closed statements. [Fix](https://github.com/OpenIntegrationEngine/engine/commit/864ede756). +- Restore access to Java platform classes such as `java.sql` for isolated resource libraries, while retaining isolation from engine application classes. [Fix](https://github.com/OpenIntegrationEngine/engine/commit/2085b4c89). +- Start and stop registered server plugins once when a plugin implements multiple extension interfaces; preserve plugin ordering. [Fix](https://github.com/OpenIntegrationEngine/engine/commit/aac955884), [final implementation](https://github.com/OpenIntegrationEngine/engine/commit/f421b3ca7). +- Ignore `undefined` preprocessor results instead of replacing the message, and treat blank channel scripts as absent. [Preprocessor fix](https://github.com/OpenIntegrationEngine/engine/commit/3960aabfb), [blank-script fix](https://github.com/OpenIntegrationEngine/engine/commit/cba21a202). +- Make `channelName` available to channel postprocessor scripts. [Fix](https://github.com/OpenIntegrationEngine/engine/commit/ac3a398cc). +- Report a clear `IllegalArgumentException` when global-variable lock/unlock helpers receive a key that was never registered for synchronization, instead of a null-pointer failure. [Fix](https://github.com/OpenIntegrationEngine/engine/commit/2e0ff419b). +- Cache the compiled tree-search regular expression and use the connector-specific dashboard icon. [Search improvement](https://github.com/OpenIntegrationEngine/engine/commit/8c1111ba3), [icon fix](https://github.com/OpenIntegrationEngine/engine/commit/f844f6da3). +- Correct launch-descriptor branding and reduce Administrator startup requests by embedding extension launch resources. [Branding](https://github.com/OpenIntegrationEngine/engine/commit/a08c1145f), [launch resources](https://github.com/OpenIntegrationEngine/engine/commit/a403863a9). +- Replace the expired signing certificate used for signed artifacts. [Certificate change](https://github.com/OpenIntegrationEngine/engine/commit/590683161). +- Make logging-library discovery independent of hard-coded Log4j JAR versions. [Fix](https://github.com/OpenIntegrationEngine/engine/commit/85188d583). +- Add a final-comment safeguard to the custom JVM-options template so options inserted above it retain their newline, and fix Java detection/server startup under PowerShell 5.1. [JVM options](https://github.com/OpenIntegrationEngine/engine/commit/70b627dff), [PowerShell](https://github.com/OpenIntegrationEngine/engine/commit/e76591953). + +## Build and validation improvements + +Dependencies are resolved from a centralized version catalog with checksum verification and distribution-placement checks. Netty and Log4j modules share version definitions to prevent mismatched family upgrades. Renovate maintains dependency updates. [Dependency migration](https://github.com/OpenIntegrationEngine/engine/commit/29c5df718), [family alignment](https://github.com/OpenIntegrationEngine/engine/commit/81a6f59b6). + +The Docker-based CI harness exercises Derby, PostgreSQL, MySQL, Oracle, and SQL Server, with Alpine/Ubuntu configurations where defined. Coverage now includes malicious XML, database metadata, multi-message batches, CDATA preservation, and CLI failures. Test execution is faster and less prone to timing races. The repository contains the Docker build; these notes do not announce a new published image or registry tag. [CI harness](https://github.com/OpenIntegrationEngine/engine/commit/ef66d2d56), [CLI smoke tests](https://github.com/OpenIntegrationEngine/engine/commit/ba3fe414e), [file-poll test fix](https://github.com/OpenIntegrationEngine/engine/commit/d9520f9c9). + +## Appendix + +### Netty CVEs addressed + +| CVE | Affected bundled module | +| --- | --- | +| [CVE-2025-55163](https://github.com/netty/netty/security/advisories/GHSA-prj3-ccx8-p6x4) | codec-http2 | +| [CVE-2025-58056](https://github.com/netty/netty/security/advisories/GHSA-fghv-69vj-qj49) | codec-http | +| [CVE-2025-58057](https://github.com/netty/netty/security/advisories/GHSA-3p8m-j85q-pgmj) | codec | +| [CVE-2025-67735](https://github.com/netty/netty/security/advisories/GHSA-84h7-rjj3-6jx4) | codec-http | +| [CVE-2026-33870](https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8) | codec-http | +| [CVE-2026-33871](https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv) | codec-http2 | +| [CVE-2026-41417](https://github.com/netty/netty/security/advisories/GHSA-v8h7-rr48-vmmv) | codec-http | +| [CVE-2026-42580](https://github.com/netty/netty/security/advisories/GHSA-m4cv-j2px-7723) | codec-http | +| [CVE-2026-42581](https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9) | codec-http | +| [CVE-2026-42583](https://github.com/netty/netty/security/advisories/GHSA-mj4r-2hfc-f8p6) | codec | +| [CVE-2026-42584](https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3) | codec-http | +| [CVE-2026-42585](https://github.com/netty/netty/security/advisories/GHSA-38f8-5428-x5cv) | codec-http | +| [CVE-2026-42587](https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv) | codec-http, codec-http2 | +| [CVE-2026-44249](https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86) | handler | +| [CVE-2026-45416](https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh) | handler | +| [CVE-2026-45536](https://github.com/netty/netty/security/advisories/GHSA-w573-9ffj-6ff9) | transport-native-epoll | +| [CVE-2026-47244](https://github.com/netty/netty/security/advisories/GHSA-5x3r-wrvg-rp6q) | codec-http2 | +| [CVE-2026-48043](https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j) | codec-http2 | +| [CVE-2026-50010](https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9) | handler | +| [CVE-2026-50020](https://github.com/netty/netty/security/advisories/GHSA-hvcg-qmg6-jm4c) | codec-http | +| [CVE-2026-50560](https://github.com/netty/netty/security/advisories/GHSA-563q-j3cm-6jxm) | codec-http2 | +| [CVE-2026-55831](https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w) | codec-http | +| [CVE-2026-55833](https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c) | codec-http | +| [CVE-2026-56745](https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq) | codec-http | +| [CVE-2026-56746](https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5) | codec-http | +| [CVE-2026-56819](https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972) | codec-http2 | +| [CVE-2026-59898](https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg) | codec-http | +| [CVE-2026-59899](https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww) | codec-http | +| [CVE-2026-59900](https://github.com/netty/netty/security/advisories/GHSA-c69g-56f8-xwqj) | codec-http2 | +| [CVE-2026-59901](https://github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4) | codec | +| [CVE-2026-59903](https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46) | codec-http | +| [CVE-2026-59921](https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g) | codec-http | +| [CVE-2026-75595](https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5) | handler | +| [CVE-2026-75596](https://github.com/netty/netty/security/advisories/GHSA-fccg-mwvh-qqg4) | handler | From fa5f16a919624db1209e3e8cbde329adf11e0860 Mon Sep 17 00:00:00 2001 From: Tony Germano Date: Mon, 19 Oct 2026 11:55:24 -0400 Subject: [PATCH 03/19] Announce the selectLimit deprecation in the 4.7.0 notes The entry described selectLimit as no longer executed but kept for compatibility. State that the driver setting is ignored, that the REST parameter and the client-core getTables argument are deprecated and will be removed in an upcoming release, and what Java callers will need to change. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Tony Germano --- docs/release-notes/4.7.0.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/release-notes/4.7.0.md b/docs/release-notes/4.7.0.md index 5c449628e..11d84993f 100644 --- a/docs/release-notes/4.7.0.md +++ b/docs/release-notes/4.7.0.md @@ -74,7 +74,7 @@ The bundled Microsoft driver changes from **8.4.1.jre8 to 10.2.4.jre11**. Starti ### API consumers and custom extensions - **Custom metadata filters must name configured columns exactly.** Unknown names, including incorrect casing and stale filters referring to removed or renamed columns, are rejected before a search query runs. This applies to retrieval, counting, removal, reprocessing, and export. Synchronous invalid requests can return HTTP 500; asynchronous reprocessing failures are logged. [Validation change](https://github.com/OpenIntegrationEngine/engine/commit/9359d9a82). -- **Database table metadata no longer executes a supplied `selectLimit` query template.** The API retains the argument for compatibility but uses quoted identifiers and a zero-row query, with JDBC metadata fallback. Review custom clients or drivers that depended on the old template behavior. [Fix](https://github.com/OpenIntegrationEngine/engine/commit/d38accecf). +- **`selectLimit` is deprecated and no longer used.** Database table metadata lookups no longer execute a supplied `selectLimit` query template; they use quoted identifiers and a zero-row query, with JDBC metadata fallback. Custom "Select with Limit Query" values in the Database Drivers settings and `dbdrivers.xml` are ignored. The `selectLimit` query parameter of `POST /connectors/jdbc/_getTables`, and the matching argument of `DatabaseConnectorServletInterface.getTables` in client-core, are deprecated and ignored, and will be removed in an upcoming release. Java code calling `getTables` will need to drop that argument when upgrading to the client-core library from that release. [Fix](https://github.com/OpenIntegrationEngine/engine/commit/d38accecf). - **Custom controller/servlet implementations need updating.** `EngineController` adds an abstract five-argument `dispatchRawMessage` overload, and `MessageServletInterface` adds `processBatchMessage`. The existing four-argument dispatch API remains available to callers. [API change](https://github.com/OpenIntegrationEngine/engine/commit/893ae635b). - **The standalone extension JNLP endpoint is removed.** Extension resources are included directly in the main launch descriptor, reducing startup requests. Update custom launchers that fetch `/webstart/extensions/.jnlp` and subclasses overriding the removed `getExtensionJnlp(String)` method. Main launch descriptors and extension JAR serving remain available. [JNLP changes](https://github.com/OpenIntegrationEngine/engine/commit/a403863a9), [endpoint removal](https://github.com/OpenIntegrationEngine/engine/commit/0205efbde). - **Other custom Java integrations:** the Microsoft driver removes `getAADSecretPrincipalId`; the server-plugin accessor now returns a snapshot, and plugin de-duplication uses `equals`/`hashCode`; missing synchronized global-map keys now throw `IllegalArgumentException` instead of `NullPointerException`. Check custom code relying on these APIs or behaviors. [Microsoft changes](https://learn.microsoft.com/en-us/sql/connect/jdbc/release-notes-for-the-jdbc-driver?view=sql-server-ver17#changes-in-102), [plugin collection](https://github.com/OpenIntegrationEngine/engine/commit/f421b3ca7), [global-map error](https://github.com/OpenIntegrationEngine/engine/commit/2e0ff419b). From 514dfe0f59f7052abfaea2779a26ef0b2c9c19c2 Mon Sep 17 00:00:00 2001 From: Jon Bartels Date: Mon, 19 Oct 2026 13:26:11 -0400 Subject: [PATCH 04/19] Add a New Contributors section to the 4.7.0 notes Lists the six GitHub users whose first PR merged to main landed after the v4.6.0 tag, following the format used in the 4.5.2 release notes. Contributors were identified by taking each author's earliest merged PR across the repo's full merged-PR history and keeping those whose merge commit is an ancestor of main but not of v4.6.0. renovate[bot] also has its first merge in this window and is omitted as a bot. Co-Authored-By: Claude Opus 5 (1M context) Signed-off-by: Jon Bartels --- docs/release-notes/4.7.0.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/docs/release-notes/4.7.0.md b/docs/release-notes/4.7.0.md index 11d84993f..48c7b3acd 100644 --- a/docs/release-notes/4.7.0.md +++ b/docs/release-notes/4.7.0.md @@ -106,6 +106,15 @@ Dependencies are resolved from a centralized version catalog with checksum verif The Docker-based CI harness exercises Derby, PostgreSQL, MySQL, Oracle, and SQL Server, with Alpine/Ubuntu configurations where defined. Coverage now includes malicious XML, database metadata, multi-message batches, CDATA preservation, and CLI failures. Test execution is faster and less prone to timing races. The repository contains the Docker build; these notes do not announce a new published image or registry tag. [CI harness](https://github.com/OpenIntegrationEngine/engine/commit/ef66d2d56), [CLI smoke tests](https://github.com/OpenIntegrationEngine/engine/commit/ba3fe414e), [file-poll test fix](https://github.com/OpenIntegrationEngine/engine/commit/d9520f9c9). +## New Contributors + +* @jbeckers made their first contribution in https://github.com/OpenIntegrationEngine/engine/pull/333 +* @ggiannola made their first contribution in https://github.com/OpenIntegrationEngine/engine/pull/397 +* @e210 made their first contribution in https://github.com/OpenIntegrationEngine/engine/pull/351 +* @kerfern made their first contribution in https://github.com/OpenIntegrationEngine/engine/pull/400 +* @miguel-figueiredoPT made their first contribution in https://github.com/OpenIntegrationEngine/engine/pull/231 +* @paul-hristea made their first contribution in https://github.com/OpenIntegrationEngine/engine/pull/340 + ## Appendix ### Netty CVEs addressed From 20d4ea0afeeae9a7729cbfb79ca14fdb958438c7 Mon Sep 17 00:00:00 2001 From: Tony Germano Date: Mon, 19 Oct 2026 16:08:33 -0400 Subject: [PATCH 05/19] Note the bundled Java runtime change in the 4.7.0 notes Installers that bundle a Java runtime now ship Eclipse Temurin 21 instead of Azul Zulu 17. Add an upgrade note so users with custom JVM options or Java 17-specific dependencies know to check them. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Tony Germano --- docs/release-notes/4.7.0.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/release-notes/4.7.0.md b/docs/release-notes/4.7.0.md index 48c7b3acd..1c241c3f1 100644 --- a/docs/release-notes/4.7.0.md +++ b/docs/release-notes/4.7.0.md @@ -71,6 +71,10 @@ The new request-header-size setting retains the **8192-byte** limit for legacy c The bundled Microsoft driver changes from **8.4.1.jre8 to 10.2.4.jre11**. Starting with 10.2, Microsoft's driver enables `encrypt=true` by default and also validates certificates when the server forces encryption, even if the client specifies `encrypt=false`. Connections that previously worked without a trusted, matching server certificate can fail after upgrading. Verify TLS certificates and trust configuration for deployments using the Microsoft driver, including engine-database and channel connections. This particular change does not apply to connections using jTDS. [Dependency change](https://github.com/OpenIntegrationEngine/engine/commit/4af696764), [Microsoft's 10.2 changes](https://learn.microsoft.com/en-us/sql/connect/jdbc/release-notes-for-the-jdbc-driver?view=sql-server-ver17#changes-in-102). +### Bundled Java runtime + +Installers that bundle a Java runtime now include **Eclipse Temurin 21** instead of **Azul Zulu 17**. Installations that run on a separately installed Java are not affected, and Java 17 remains the minimum supported version. If you use custom JVM options or rely on Java 17-specific behavior, check them against Java 21 before upgrading. + ### API consumers and custom extensions - **Custom metadata filters must name configured columns exactly.** Unknown names, including incorrect casing and stale filters referring to removed or renamed columns, are rejected before a search query runs. This applies to retrieval, counting, removal, reprocessing, and export. Synchronous invalid requests can return HTTP 500; asynchronous reprocessing failures are logged. [Validation change](https://github.com/OpenIntegrationEngine/engine/commit/9359d9a82). From 639453958778b4e82abe7ca2528a9871b69116d0 Mon Sep 17 00:00:00 2001 From: Tony Germano Date: Mon, 19 Oct 2026 16:08:34 -0400 Subject: [PATCH 06/19] Drop "draft" from the 4.7.0 release notes heading The notes are now maintained in the repository, and the heading becomes the published release body, so it should not call itself a draft. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Tony Germano --- docs/release-notes/4.7.0.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/release-notes/4.7.0.md b/docs/release-notes/4.7.0.md index 1c241c3f1..3c216cf88 100644 --- a/docs/release-notes/4.7.0.md +++ b/docs/release-notes/4.7.0.md @@ -1,4 +1,4 @@ -# Open Integration Engine 4.7.0 — release notes draft +# Open Integration Engine 4.7.0 release notes ## Highlights From 19ddd05a1af4e9c052ffc5e9346cd1a1f1c0b34d Mon Sep 17 00:00:00 2001 From: Tony Germano Date: Mon, 19 Oct 2026 17:57:16 -0400 Subject: [PATCH 07/19] Highlight the isolated classloader fix in the 4.7.0 notes The fix from #340 was mentioned only in passing, as part of the reliability highlight and as a one-line fix. It restores the use of JDBC drivers supplied through library resources, which had failed on every Java version since 9 for Database Reader and Writer connectors and for scripts using DatabaseConnectionFactory. Give it its own highlight that explains the symptoms and impact, links the original report, and credits the contributor. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Tony Germano --- docs/release-notes/4.7.0.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/release-notes/4.7.0.md b/docs/release-notes/4.7.0.md index 3c216cf88..570a138e9 100644 --- a/docs/release-notes/4.7.0.md +++ b/docs/release-notes/4.7.0.md @@ -6,7 +6,8 @@ - **More control over HTTP connections.** HTTP Sender can bind outgoing connections to a selected local address. HTTP Listener supports a configurable maximum request-header size. [Sender change](https://github.com/OpenIntegrationEngine/engine/commit/d4d1122d1), [listener change](https://github.com/OpenIntegrationEngine/engine/commit/83d7c1a20). - **Recent message-search filters.** Quickly reuse up to ten recent filters per channel. History stays in Administrator process memory rather than being written to local preferences, where search terms could expose sensitive data. [Feature](https://github.com/OpenIntegrationEngine/engine/commit/cab7392ec), [memory-only storage](https://github.com/OpenIntegrationEngine/engine/commit/924097130). - **Batch submission with every message ID.** The new `POST /api/channels/{channelId}/batchMessagesWithObj` endpoint returns the IDs of all messages produced by a successful batch submission. It respects the channel's Process Batch setting; channels without batch processing return a single ID. [API change](https://github.com/OpenIntegrationEngine/engine/commit/893ae635b). -- **Reliability improvements.** Fixes Oracle JDBC batch inserts, Java platform visibility for isolated custom libraries, duplicate server-plugin lifecycle calls, and CLI hangs on authentication or connection failures. +- **JDBC drivers in custom resources work again.** On Java 9 and later, a JDBC driver supplied through a library resource could not be loaded. The resource's isolated classloader could not see Java platform classes such as `java.sql.Driver`. Database Reader and Database Writer connectors not using JavaScript failed to deploy with `NoClassDefFoundError: java/sql/Driver`, and scripts using `DatabaseConnectionFactory`, including Database Reader and Writer connectors in JavaScript mode, failed when opening a connection. This blocked using a driver version other than the one shipped with the server, or different driver versions in different channels. Isolated resources can now see Java platform classes while remaining isolated from the engine's own libraries. Originally reported in [Mirth Connect discussion #5079](https://github.com/nextgenhealthcare/connect/discussions/5079). Thanks to @paul-hristea. [Fix](https://github.com/OpenIntegrationEngine/engine/pull/340). +- **Reliability improvements.** Fixes Oracle JDBC batch inserts, duplicate server-plugin lifecycle calls, and CLI hangs on authentication or connection failures. - **Modernized source builds and containers.** Gradle replaces Ant, dependency checksums are verified, and an in-repository Docker build supports startup configuration through environment variables and mounted secrets, including database and JVM settings. Automated smoke tests cover five database types. [Container support](https://github.com/OpenIntegrationEngine/engine/commit/5423492e9). ## Security — CVEs addressed From 4f8bd00368b27ed9e25a05eead8e331366aeb96d Mon Sep 17 00:00:00 2001 From: Finnegan's Owner <44065187+pacmano1@users.noreply.github.com> Date: Tue, 20 Oct 2026 11:25:29 -0600 Subject: [PATCH 08/19] Describe the remaining advisories in the 4.7.0 notes The paragraph linked to security-review.md and security-cve-inventory.json, which aren't in the repository, and left the advisories waiting on a release disposition. Replace it with a table giving each advisory's upstream link, what it affects and its fixed version, so 4.7.0 ships with them documented. Drop the sentence that only pointed at the two missing files. Add GHSA-hcjv-f5jh-r55v, a low-severity pgjdbc advisory published 2026-10-15 that affects the shipped 42.7.12 and has no fixed release. The conditions and fixed versions come from the upstream advisories. The claim that nothing else in the download calls the affected APIs comes from a byte scan of every class in every jar of the draft v4.7.0 tarball (494 jars, built from f9ba73e28). looksLikeValidNumber, the DataInput parser entry points, ByteStreamWriter and the COPY and large object APIs appear only inside jackson-core, jackson-databind and the PostgreSQL driver. The one Blob.setBytes caller outside the JDBC drivers is Quartz's job store delegate for the CUBRID database. No shipped file sets requireAuth. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Finnegan's Owner <44065187+pacmano1@users.noreply.github.com> --- docs/release-notes/4.7.0.md | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/docs/release-notes/4.7.0.md b/docs/release-notes/4.7.0.md index 570a138e9..857265be5 100644 --- a/docs/release-notes/4.7.0.md +++ b/docs/release-notes/4.7.0.md @@ -38,9 +38,15 @@ The public advisory names NextGen/Mirth Connect; OIE includes corresponding fixe **Test dependencies:** JUnit 4.8.1 → 4.13.1 in command/donkey tests addresses [CVE-2020-15250](https://github.com/junit-team/junit4/security/advisories/GHSA-269g-pwp5-87pp). This is separate from the 48 engine/runtime CVEs above. -**Known remaining advisories:** the reviewed candidate still ships PostgreSQL JDBC 42.7.12 and Jackson Core 2.18.8, with published affected ranges for CVE-2026-107314, CVE-2026-107315, CVE-2026-89407, and CVE-2026-89425. Exposure depends on API/configuration use. The [security review](security-review.md#remaining-published-advisories-in-changed-dependencies) provides conditions and fixed versions; these findings require release disposition and are not part of the addressed count. This is not a complete vulnerability inventory of all shipped components. - -The [verified CVE inventory](security-cve-inventory.json) and [security review](security-review.md) preserve the exact ranges and exclusions, including the conservative treatment of Jackson CVE-2026-68494 and shaded SCRAM CVE-2026-53712. +**Known remaining advisories:** 4.7.0 ships PostgreSQL JDBC 42.7.12 and Jackson Core 2.18.8, which are affected by the advisories below. Each one applies only to the configuration or custom code its row describes, and custom code includes channel scripts. Apart from the two libraries themselves, nothing in the 4.7.0 download calls the affected Java APIs. These advisories are not in the addressed count, and this is not a complete vulnerability inventory of all shipped components. + +| Advisory | Component | Affects | Fixed in | +| --- | --- | --- | --- | +| [CVE-2026-107314](https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-rhp9-mr79-r74h) | PostgreSQL JDBC | If a connection URL's `requireAuth` value excludes all six authentication methods, or names none, the driver enforces no restriction. A positive list such as `requireAuth=scram-sha-256` is enforced. No shipped configuration sets `requireAuth`. | 42.7.14 | +| [CVE-2026-107315](https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-f64h-wr5q-3qf3) | PostgreSQL JDBC | If code declares a length larger than the data it sends through `ByteStreamWriter`, the COPY API, large objects or `Blob.setBytes`, the driver fills the padding with bytes of earlier statements, and the database stores them. | 42.7.14 | +| [CVE-2026-89407](https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89) | Jackson Core | `NumberInput.looksLikeValidNumber` takes time that grows with the square of the string's length, so a long untrusted string can tie up a thread. The bundled jackson-databind 2.14.3 does not call it. | 2.18.11 | +| [CVE-2026-89425](https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf) | Jackson Core | Parsing untrusted JSON from a `java.io.DataInput`, for example with `ObjectMapper.readValue(DataInput)`, can build an error message as large as the input. | 2.18.11 | +| [GHSA-hcjv-f5jh-r55v](https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-hcjv-f5jh-r55v) | PostgreSQL JDBC | If `sslrootcert` or `sslcert` points at a non-regular file such as `/dev/zero`, the connection attempt hangs. | No fixed release yet | ## Security - General Improvements From 5879dfe468699014ba37b791b554be566c627710 Mon Sep 17 00:00:00 2001 From: Finnegan's Owner <44065187+pacmano1@users.noreply.github.com> Date: Tue, 20 Oct 2026 11:25:35 -0600 Subject: [PATCH 09/19] Spell out Jackson's default parsing limits in the 4.7.0 notes The Jackson bullet pointed at security-review.md for the limits, and that file isn't in the repository. State the defaults instead. The values are the DEFAULT_* constants of StreamReadConstraints in the jackson-core-2.18.8.jar shipped in the draft v4.7.0 tarball (built from f9ba73e28), whose checksum matches gradle/verification-metadata.xml. No other class in that tarball references StreamReadConstraints, so nothing in the download changes the defaults. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Finnegan's Owner <44065187+pacmano1@users.noreply.github.com> --- docs/release-notes/4.7.0.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/release-notes/4.7.0.md b/docs/release-notes/4.7.0.md index 857265be5..bc0b20340 100644 --- a/docs/release-notes/4.7.0.md +++ b/docs/release-notes/4.7.0.md @@ -94,7 +94,7 @@ Installers that bundle a Java runtime now include **Eclipse Temurin 21** instead - **Administrator now checks for JavaFX at startup.** Use a launcher/runtime with the `javafx.graphics` module available; the client stops with a prerequisite message when it is missing. Java 17 remains the minimum Java version; that requirement was introduced in 4.6.0. [Prerequisite check](https://github.com/OpenIntegrationEngine/engine/commit/86dec16ea). - **CLI startup failures now return meaningful nonzero exit codes.** Automation should handle authentication, connection, configuration, usage, and unreadable-script failures. This does not guarantee that every failed command inside a script changes the process exit code. [CLI fix](https://github.com/OpenIntegrationEngine/engine/commit/11ad74434). -- **Jackson-based JSON paths have new parsing limits.** Jackson Core 2.18.8 introduces limits absent in the bundled 2.14.3 baseline, including nesting depth and token lengths. Test unusually deep or large JSON handled through Jackson-based utilities/custom code; this is not a claim that every OIE JSON parser uses Jackson. See [security review](security-review.md) for the limits and upstream references. +- **Jackson-based JSON paths have new parsing limits.** Jackson Core 2.18.8 introduces limits absent in the bundled 2.14.3 baseline, including nesting depth and token lengths. Test unusually deep or large JSON handled through Jackson-based utilities/custom code; this is not a claim that every OIE JSON parser uses Jackson. Jackson's default limits are 1,000 levels of nesting, 1,000 characters for a number, 20,000,000 characters for a string value and 50,000 characters for a property name. Document length and token count are unlimited. - **Source-build automation must migrate from Ant to Gradle.** Use the included wrapper, for example `./gradlew build -PdisableSigning=true`; source directories now follow the standard Gradle layout. Import the repository as a Gradle project instead of using the removed Eclipse project files. [Build migration](https://github.com/OpenIntegrationEngine/engine/commit/24c96f509), [source moves](https://github.com/OpenIntegrationEngine/engine/commit/8a2dc59f3). ## Fixes and improvements From 985359b7177c4112b4ae6dd878c84cfe431a0da3 Mon Sep 17 00:00:00 2001 From: Finnegan's Owner <44065187+pacmano1@users.noreply.github.com> Date: Tue, 20 Oct 2026 11:45:19 -0600 Subject: [PATCH 10/19] Name the jar that ships getTables in the 4.7.0 notes The selectLimit entry said DatabaseConnectorServletInterface.getTables is in client-core. It ships in the Database Connector's extensions/jdbc/jdbc-shared.jar. A scan of every jar in the draft v4.7.0 tarball finds the class only there, server/build.gradle builds it into the jdbc shared jar, and mirth-client-core.jar holds no class from that package. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Finnegan's Owner <44065187+pacmano1@users.noreply.github.com> --- docs/release-notes/4.7.0.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/release-notes/4.7.0.md b/docs/release-notes/4.7.0.md index bc0b20340..ba7da0f0c 100644 --- a/docs/release-notes/4.7.0.md +++ b/docs/release-notes/4.7.0.md @@ -85,7 +85,7 @@ Installers that bundle a Java runtime now include **Eclipse Temurin 21** instead ### API consumers and custom extensions - **Custom metadata filters must name configured columns exactly.** Unknown names, including incorrect casing and stale filters referring to removed or renamed columns, are rejected before a search query runs. This applies to retrieval, counting, removal, reprocessing, and export. Synchronous invalid requests can return HTTP 500; asynchronous reprocessing failures are logged. [Validation change](https://github.com/OpenIntegrationEngine/engine/commit/9359d9a82). -- **`selectLimit` is deprecated and no longer used.** Database table metadata lookups no longer execute a supplied `selectLimit` query template; they use quoted identifiers and a zero-row query, with JDBC metadata fallback. Custom "Select with Limit Query" values in the Database Drivers settings and `dbdrivers.xml` are ignored. The `selectLimit` query parameter of `POST /connectors/jdbc/_getTables`, and the matching argument of `DatabaseConnectorServletInterface.getTables` in client-core, are deprecated and ignored, and will be removed in an upcoming release. Java code calling `getTables` will need to drop that argument when upgrading to the client-core library from that release. [Fix](https://github.com/OpenIntegrationEngine/engine/commit/d38accecf). +- **`selectLimit` is deprecated and no longer used.** Database table metadata lookups no longer execute a supplied `selectLimit` query template; they use quoted identifiers and a zero-row query, with JDBC metadata fallback. Custom "Select with Limit Query" values in the Database Drivers settings and `dbdrivers.xml` are ignored. The `selectLimit` query parameter of `POST /connectors/jdbc/_getTables`, and the matching argument of `DatabaseConnectorServletInterface.getTables` in the Database Connector's `extensions/jdbc/jdbc-shared.jar`, are deprecated and ignored, and will be removed in an upcoming release. Java code calling `getTables` will need to drop that argument when upgrading to the `jdbc-shared.jar` from that release. [Fix](https://github.com/OpenIntegrationEngine/engine/commit/d38accecf). - **Custom controller/servlet implementations need updating.** `EngineController` adds an abstract five-argument `dispatchRawMessage` overload, and `MessageServletInterface` adds `processBatchMessage`. The existing four-argument dispatch API remains available to callers. [API change](https://github.com/OpenIntegrationEngine/engine/commit/893ae635b). - **The standalone extension JNLP endpoint is removed.** Extension resources are included directly in the main launch descriptor, reducing startup requests. Update custom launchers that fetch `/webstart/extensions/.jnlp` and subclasses overriding the removed `getExtensionJnlp(String)` method. Main launch descriptors and extension JAR serving remain available. [JNLP changes](https://github.com/OpenIntegrationEngine/engine/commit/a403863a9), [endpoint removal](https://github.com/OpenIntegrationEngine/engine/commit/0205efbde). - **Other custom Java integrations:** the Microsoft driver removes `getAADSecretPrincipalId`; the server-plugin accessor now returns a snapshot, and plugin de-duplication uses `equals`/`hashCode`; missing synchronized global-map keys now throw `IllegalArgumentException` instead of `NullPointerException`. Check custom code relying on these APIs or behaviors. [Microsoft changes](https://learn.microsoft.com/en-us/sql/connect/jdbc/release-notes-for-the-jdbc-driver?view=sql-server-ver17#changes-in-102), [plugin collection](https://github.com/OpenIntegrationEngine/engine/commit/f421b3ca7), [global-map error](https://github.com/OpenIntegrationEngine/engine/commit/2e0ff419b). From 2f1f4a2c3bdce025ef5784302e280b54a02e7969 Mon Sep 17 00:00:00 2001 From: Finnegan's Owner <44065187+pacmano1@users.noreply.github.com> Date: Tue, 20 Oct 2026 11:46:50 -0600 Subject: [PATCH 11/19] Name the SQL Server startup failure and its fix in the 4.7.0 notes The encryption paragraph said the Microsoft driver validates certificates even when the client sets encrypt=false. Microsoft's 10.2 notes make that depend on trustServerCertificate, so say so. Add what an upgrade looks like when the engine's own database is on SQL Server. Measured on the draft v4.7.0 (built from f9ba73e28) against SQL Server 2022 with its self-signed certificate and a database.url with no encrypt setting: 4.6.0 starts; 4.7.0 logs "Error establishing connection to database, aborting startup" with "PKIX path building failed" and stops; appending ;trustServerCertificate=true lets it start. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Finnegan's Owner <44065187+pacmano1@users.noreply.github.com> --- docs/release-notes/4.7.0.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/release-notes/4.7.0.md b/docs/release-notes/4.7.0.md index ba7da0f0c..6ca3ad8ad 100644 --- a/docs/release-notes/4.7.0.md +++ b/docs/release-notes/4.7.0.md @@ -76,7 +76,7 @@ The new request-header-size setting retains the **8192-byte** limit for legacy c ### Microsoft SQL Server JDBC encryption -The bundled Microsoft driver changes from **8.4.1.jre8 to 10.2.4.jre11**. Starting with 10.2, Microsoft's driver enables `encrypt=true` by default and also validates certificates when the server forces encryption, even if the client specifies `encrypt=false`. Connections that previously worked without a trusted, matching server certificate can fail after upgrading. Verify TLS certificates and trust configuration for deployments using the Microsoft driver, including engine-database and channel connections. This particular change does not apply to connections using jTDS. [Dependency change](https://github.com/OpenIntegrationEngine/engine/commit/4af696764), [Microsoft's 10.2 changes](https://learn.microsoft.com/en-us/sql/connect/jdbc/release-notes-for-the-jdbc-driver?view=sql-server-ver17#changes-in-102). +The bundled Microsoft driver changes from **8.4.1.jre8 to 10.2.4.jre11**. Starting with 10.2, Microsoft's driver enables `encrypt=true` by default. Even with `encrypt=false`, a server that requires encryption has its certificate validated unless `trustServerCertificate=true` is set. Connections that previously worked without a trusted, matching server certificate can fail after upgrading. If the engine's own database is on SQL Server through the Microsoft driver, the engine stops at startup with `Error establishing connection to database, aborting startup` and `PKIX path building failed`. Adding `;trustServerCertificate=true` to `database.url` in `mirth.properties` lets it start, but skips certificate validation. A server certificate that the Java runtime trusts is the alternative. Verify TLS certificates and trust configuration for deployments using the Microsoft driver, including engine-database and channel connections. This particular change does not apply to connections using jTDS. [Dependency change](https://github.com/OpenIntegrationEngine/engine/commit/4af696764), [Microsoft's 10.2 changes](https://learn.microsoft.com/en-us/sql/connect/jdbc/release-notes-for-the-jdbc-driver?view=sql-server-ver17#changes-in-102). ### Bundled Java runtime From 0fc4fda0e4021ba9e9fa6fb88f081702b6695c6c Mon Sep 17 00:00:00 2001 From: Finnegan's Owner <44065187+pacmano1@users.noreply.github.com> Date: Tue, 20 Oct 2026 11:50:19 -0600 Subject: [PATCH 12/19] Say oieserver.ps1 is no longer included in the 4.7.0 notes The installers leave out oieserver.ps1 on purpose (f9ba73e28), so no 4.7.0 download has it, yet the fixes list announced a PowerShell 5.1 fix to it. Drop that from the fixes list and add an upgrade note that the script is gone. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Finnegan's Owner <44065187+pacmano1@users.noreply.github.com> --- docs/release-notes/4.7.0.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/docs/release-notes/4.7.0.md b/docs/release-notes/4.7.0.md index 6ca3ad8ad..c7376a7ec 100644 --- a/docs/release-notes/4.7.0.md +++ b/docs/release-notes/4.7.0.md @@ -82,6 +82,10 @@ The bundled Microsoft driver changes from **8.4.1.jre8 to 10.2.4.jre11**. Starti Installers that bundle a Java runtime now include **Eclipse Temurin 21** instead of **Azul Zulu 17**. Installations that run on a separately installed Java are not affected, and Java 17 remains the minimum supported version. If you use custom JVM options or rely on Java 17-specific behavior, check them against Java 21 before upgrading. +### `oieserver.ps1` removed + +`oieserver.ps1` is no longer included. Use the `oieserver` launcher instead. + ### API consumers and custom extensions - **Custom metadata filters must name configured columns exactly.** Unknown names, including incorrect casing and stale filters referring to removed or renamed columns, are rejected before a search query runs. This applies to retrieval, counting, removal, reprocessing, and export. Synchronous invalid requests can return HTTP 500; asynchronous reprocessing failures are logged. [Validation change](https://github.com/OpenIntegrationEngine/engine/commit/9359d9a82). @@ -109,7 +113,7 @@ Installers that bundle a Java runtime now include **Eclipse Temurin 21** instead - Correct launch-descriptor branding and reduce Administrator startup requests by embedding extension launch resources. [Branding](https://github.com/OpenIntegrationEngine/engine/commit/a08c1145f), [launch resources](https://github.com/OpenIntegrationEngine/engine/commit/a403863a9). - Replace the expired signing certificate used for signed artifacts. [Certificate change](https://github.com/OpenIntegrationEngine/engine/commit/590683161). - Make logging-library discovery independent of hard-coded Log4j JAR versions. [Fix](https://github.com/OpenIntegrationEngine/engine/commit/85188d583). -- Add a final-comment safeguard to the custom JVM-options template so options inserted above it retain their newline, and fix Java detection/server startup under PowerShell 5.1. [JVM options](https://github.com/OpenIntegrationEngine/engine/commit/70b627dff), [PowerShell](https://github.com/OpenIntegrationEngine/engine/commit/e76591953). +- Add a final-comment safeguard to the custom JVM-options template so options inserted above it retain their newline. [JVM options](https://github.com/OpenIntegrationEngine/engine/commit/70b627dff). ## Build and validation improvements From 6cb49052a3481fd64259c162666e36dcb6a46733 Mon Sep 17 00:00:00 2001 From: Finnegan's Owner <44065187+pacmano1@users.noreply.github.com> Date: Tue, 20 Oct 2026 12:07:20 -0600 Subject: [PATCH 13/19] Name the Mirth versions the engine CVEs list in the 4.7.0 notes The CVE records for CVE-2026-82583, CVE-2026-78224 and CVE-2026-82578 list Mirth Connect 4.7.1 and earlier as affected (CVE Services API). Readers and scanners will match that against OIE 4.7.0, so name the number and say OIE 4.7.0 includes the fixes, in place of the general warning about version numbers. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Finnegan's Owner <44065187+pacmano1@users.noreply.github.com> --- docs/release-notes/4.7.0.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/release-notes/4.7.0.md b/docs/release-notes/4.7.0.md index c7376a7ec..e394130a0 100644 --- a/docs/release-notes/4.7.0.md +++ b/docs/release-notes/4.7.0.md @@ -22,7 +22,7 @@ The reviewed changes contain fixes for **3 CVEs in shared engine code** and depe | [CVE-2026-78224](https://www.cve.org/CVERecord?id=CVE-2026-78224) | External-entity expansion in XSLT transformer message input. | | [CVE-2026-82578](https://www.cve.org/CVERecord?id=CVE-2026-82578) | External-entity expansion in XPath-based XML batch processing. | -The public advisory names NextGen/Mirth Connect; OIE includes corresponding fixes in the shared code. Mirth's published affected/fixed version numbers must not be applied to OIE's independent release numbering. [CISA advisory](https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-253-01). +The public advisory names NextGen/Mirth Connect; OIE includes corresponding fixes in the shared code. The CVE records list Mirth Connect 4.7.1 and earlier as affected. Those are Mirth version numbers, and OIE 4.7.0 includes these fixes. [CISA advisory](https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-253-01). ### Dependency fixes From bb3df95e0d70713469280745795f6256aa9710e7 Mon Sep 17 00:00:00 2001 From: Finnegan's Owner <44065187+pacmano1@users.noreply.github.com> Date: Tue, 20 Oct 2026 12:08:56 -0600 Subject: [PATCH 14/19] Drop draft wording from the 4.7.0 security section "The reviewed changes" and the "4.7.0 candidate" column header came from the draft. Say 4.7.0. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Finnegan's Owner <44065187+pacmano1@users.noreply.github.com> --- docs/release-notes/4.7.0.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/release-notes/4.7.0.md b/docs/release-notes/4.7.0.md index e394130a0..c93e531dc 100644 --- a/docs/release-notes/4.7.0.md +++ b/docs/release-notes/4.7.0.md @@ -12,7 +12,7 @@ ## Security — CVEs addressed -The reviewed changes contain fixes for **3 CVEs in shared engine code** and dependency upgrades addressing **45 additional CVEs in bundled runtime components**. One further CVE is fixed in **test-only JUnit**. These counts describe verified fixes and affected/fixed component versions; they do not imply that every upstream vulnerability was exploitable in an OIE deployment. +4.7.0 contains fixes for **3 CVEs in shared engine code** and dependency upgrades addressing **45 additional CVEs in bundled runtime components**. One further CVE is fixed in **test-only JUnit**. These counts describe verified fixes and affected/fixed component versions; they do not imply that every upstream vulnerability was exploitable in an OIE deployment. ### Engine fixes @@ -26,7 +26,7 @@ The public advisory names NextGen/Mirth Connect; OIE includes corresponding fixe ### Dependency fixes -| Component | 4.6.0 → 4.7.0 candidate | CVEs addressed | +| Component | 4.6.0 → 4.7.0 | CVEs addressed | | --- | --- | --- | | Jackson Core | `2.14.3` → `2.18.8` | [CVE-2025-52999](https://www.cve.org/CVERecord?id=CVE-2025-52999) | | Microsoft SQL Server JDBC | `8.4.1.jre8` → `10.2.4.jre11` | [CVE-2025-59250](https://www.cve.org/CVERecord?id=CVE-2025-59250) | From 2f373674cd4236a7afa3cd0535399020b3ae9b5a Mon Sep 17 00:00:00 2001 From: Finnegan's Owner <44065187+pacmano1@users.noreply.github.com> Date: Tue, 20 Oct 2026 12:10:41 -0600 Subject: [PATCH 15/19] Make the two security headings match in the 4.7.0 notes One used an em dash, the other a hyphen and Title Case. Use a colon and sentence case for both, like the rest of the document's headings. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Finnegan's Owner <44065187+pacmano1@users.noreply.github.com> --- docs/release-notes/4.7.0.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/release-notes/4.7.0.md b/docs/release-notes/4.7.0.md index c93e531dc..8b60ecb19 100644 --- a/docs/release-notes/4.7.0.md +++ b/docs/release-notes/4.7.0.md @@ -10,7 +10,7 @@ - **Reliability improvements.** Fixes Oracle JDBC batch inserts, duplicate server-plugin lifecycle calls, and CLI hangs on authentication or connection failures. - **Modernized source builds and containers.** Gradle replaces Ant, dependency checksums are verified, and an in-repository Docker build supports startup configuration through environment variables and mounted secrets, including database and JVM settings. Automated smoke tests cover five database types. [Container support](https://github.com/OpenIntegrationEngine/engine/commit/5423492e9). -## Security — CVEs addressed +## Security: CVEs addressed 4.7.0 contains fixes for **3 CVEs in shared engine code** and dependency upgrades addressing **45 additional CVEs in bundled runtime components**. One further CVE is fixed in **test-only JUnit**. These counts describe verified fixes and affected/fixed component versions; they do not imply that every upstream vulnerability was exploitable in an OIE deployment. @@ -48,7 +48,7 @@ The public advisory names NextGen/Mirth Connect; OIE includes corresponding fixe | [CVE-2026-89425](https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf) | Jackson Core | Parsing untrusted JSON from a `java.io.DataInput`, for example with `ObjectMapper.readValue(DataInput)`, can build an error message as large as the input. | 2.18.11 | | [GHSA-hcjv-f5jh-r55v](https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-hcjv-f5jh-r55v) | PostgreSQL JDBC | If `sslrootcert` or `sslcert` points at a non-regular file such as `/dev/zero`, the connection attempt hangs. | No fixed release yet | -## Security - General Improvements +## Security: general improvements Additional hardening for issues without a newly verified CVE ID: * strict HL7 XML parsing From 49e609718f14fd2e8df5117717abcfeaf56db108 Mon Sep 17 00:00:00 2001 From: Finnegan's Owner <44065187+pacmano1@users.noreply.github.com> Date: Tue, 20 Oct 2026 12:19:37 -0600 Subject: [PATCH 16/19] Thank every 4.7.0 contributor in the 4.7.0 notes New Contributors names only first-time contributors. Add a line that thanks everyone who authored a PR merged between v4.6.0 and the draft release's target commit, f9ba73e28 (PR #491's merge), leaving out Renovate. Every commit in that range is by one of these people or by Renovate. Plain @mentions, as in New Contributors, so they render as mentions on the release page. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Finnegan's Owner <44065187+pacmano1@users.noreply.github.com> --- docs/release-notes/4.7.0.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/release-notes/4.7.0.md b/docs/release-notes/4.7.0.md index 8b60ecb19..63dd3446f 100644 --- a/docs/release-notes/4.7.0.md +++ b/docs/release-notes/4.7.0.md @@ -121,6 +121,10 @@ Dependencies are resolved from a centralized version catalog with checksum verif The Docker-based CI harness exercises Derby, PostgreSQL, MySQL, Oracle, and SQL Server, with Alpine/Ubuntu configurations where defined. Coverage now includes malicious XML, database metadata, multi-message batches, CDATA preservation, and CLI failures. Test execution is faster and less prone to timing races. The repository contains the Docker build; these notes do not announce a new published image or registry tag. [CI harness](https://github.com/OpenIntegrationEngine/engine/commit/ef66d2d56), [CLI smoke tests](https://github.com/OpenIntegrationEngine/engine/commit/ba3fe414e), [file-poll test fix](https://github.com/OpenIntegrationEngine/engine/commit/d9520f9c9). +## Contributors + +Thanks to everyone who contributed to 4.7.0: @e210, @ggiannola, @jbeckers, @jonbartels, @kerfern, @kpalang, @mgaffigan, @miguel-figueiredoPT, @NicoPiel, @pacmano1, @paul-hristea, @sbraconnier and @tonygermano. + ## New Contributors * @jbeckers made their first contribution in https://github.com/OpenIntegrationEngine/engine/pull/333 From 193f56c428c82a82dc208069dfcd563ae70e0a65 Mon Sep 17 00:00:00 2001 From: Jon Bartels Date: Tue, 20 Oct 2026 19:54:48 -0400 Subject: [PATCH 17/19] Move contributors earlier in the doc Signed-off-by: Jon Bartels --- docs/release-notes/4.7.0.md | 29 ++++++++++++++++------------- 1 file changed, 16 insertions(+), 13 deletions(-) diff --git a/docs/release-notes/4.7.0.md b/docs/release-notes/4.7.0.md index 63dd3446f..7db523412 100644 --- a/docs/release-notes/4.7.0.md +++ b/docs/release-notes/4.7.0.md @@ -10,6 +10,22 @@ - **Reliability improvements.** Fixes Oracle JDBC batch inserts, duplicate server-plugin lifecycle calls, and CLI hangs on authentication or connection failures. - **Modernized source builds and containers.** Gradle replaces Ant, dependency checksums are verified, and an in-repository Docker build supports startup configuration through environment variables and mounted secrets, including database and JVM settings. Automated smoke tests cover five database types. [Container support](https://github.com/OpenIntegrationEngine/engine/commit/5423492e9). +## Contributors + +Thanks to everyone who contributed to 4.7.0: @e210, @ggiannola, @jbeckers, @jonbartels, @kerfern, @kpalang, @mgaffigan, @miguel-figueiredoPT, @NicoPiel, @pacmano1, @paul-hristea, @sbraconnier and @tonygermano. Your ongoing work is sincerely appreciated. + +## New Contributors + +Special thanks to our new contributors for joining the effort. + +* @jbeckers made their first contribution in https://github.com/OpenIntegrationEngine/engine/pull/333 +* @ggiannola made their first contribution in https://github.com/OpenIntegrationEngine/engine/pull/397 +* @e210 made their first contribution in https://github.com/OpenIntegrationEngine/engine/pull/351 +* @kerfern made their first contribution in https://github.com/OpenIntegrationEngine/engine/pull/400 +* @miguel-figueiredoPT made their first contribution in https://github.com/OpenIntegrationEngine/engine/pull/231 +* @paul-hristea made their first contribution in https://github.com/OpenIntegrationEngine/engine/pull/340 + + ## Security: CVEs addressed 4.7.0 contains fixes for **3 CVEs in shared engine code** and dependency upgrades addressing **45 additional CVEs in bundled runtime components**. One further CVE is fixed in **test-only JUnit**. These counts describe verified fixes and affected/fixed component versions; they do not imply that every upstream vulnerability was exploitable in an OIE deployment. @@ -121,19 +137,6 @@ Dependencies are resolved from a centralized version catalog with checksum verif The Docker-based CI harness exercises Derby, PostgreSQL, MySQL, Oracle, and SQL Server, with Alpine/Ubuntu configurations where defined. Coverage now includes malicious XML, database metadata, multi-message batches, CDATA preservation, and CLI failures. Test execution is faster and less prone to timing races. The repository contains the Docker build; these notes do not announce a new published image or registry tag. [CI harness](https://github.com/OpenIntegrationEngine/engine/commit/ef66d2d56), [CLI smoke tests](https://github.com/OpenIntegrationEngine/engine/commit/ba3fe414e), [file-poll test fix](https://github.com/OpenIntegrationEngine/engine/commit/d9520f9c9). -## Contributors - -Thanks to everyone who contributed to 4.7.0: @e210, @ggiannola, @jbeckers, @jonbartels, @kerfern, @kpalang, @mgaffigan, @miguel-figueiredoPT, @NicoPiel, @pacmano1, @paul-hristea, @sbraconnier and @tonygermano. - -## New Contributors - -* @jbeckers made their first contribution in https://github.com/OpenIntegrationEngine/engine/pull/333 -* @ggiannola made their first contribution in https://github.com/OpenIntegrationEngine/engine/pull/397 -* @e210 made their first contribution in https://github.com/OpenIntegrationEngine/engine/pull/351 -* @kerfern made their first contribution in https://github.com/OpenIntegrationEngine/engine/pull/400 -* @miguel-figueiredoPT made their first contribution in https://github.com/OpenIntegrationEngine/engine/pull/231 -* @paul-hristea made their first contribution in https://github.com/OpenIntegrationEngine/engine/pull/340 - ## Appendix ### Netty CVEs addressed From 8f537129f67734c95d2d1725880de7b406b3c911 Mon Sep 17 00:00:00 2001 From: Jon Bartels Date: Tue, 20 Oct 2026 20:21:57 -0400 Subject: [PATCH 18/19] Add remarks about upcoming changes for security manager and select limit in their own section Signed-off-by: Jon Bartels --- docs/release-notes/4.7.0.md | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/docs/release-notes/4.7.0.md b/docs/release-notes/4.7.0.md index 7db523412..0943380df 100644 --- a/docs/release-notes/4.7.0.md +++ b/docs/release-notes/4.7.0.md @@ -105,7 +105,7 @@ Installers that bundle a Java runtime now include **Eclipse Temurin 21** instead ### API consumers and custom extensions - **Custom metadata filters must name configured columns exactly.** Unknown names, including incorrect casing and stale filters referring to removed or renamed columns, are rejected before a search query runs. This applies to retrieval, counting, removal, reprocessing, and export. Synchronous invalid requests can return HTTP 500; asynchronous reprocessing failures are logged. [Validation change](https://github.com/OpenIntegrationEngine/engine/commit/9359d9a82). -- **`selectLimit` is deprecated and no longer used.** Database table metadata lookups no longer execute a supplied `selectLimit` query template; they use quoted identifiers and a zero-row query, with JDBC metadata fallback. Custom "Select with Limit Query" values in the Database Drivers settings and `dbdrivers.xml` are ignored. The `selectLimit` query parameter of `POST /connectors/jdbc/_getTables`, and the matching argument of `DatabaseConnectorServletInterface.getTables` in the Database Connector's `extensions/jdbc/jdbc-shared.jar`, are deprecated and ignored, and will be removed in an upcoming release. Java code calling `getTables` will need to drop that argument when upgrading to the `jdbc-shared.jar` from that release. [Fix](https://github.com/OpenIntegrationEngine/engine/commit/d38accecf). +- **`selectLimit` is deprecated and no longer used.** Database table metadata lookups no longer execute a supplied `selectLimit` query template; they use quoted identifiers and a zero-row query, with JDBC metadata fallback. Custom "Select with Limit Query" values in the Database Drivers settings and `dbdrivers.xml` are ignored. The `selectLimit` query parameter of `POST /connectors/jdbc/_getTables`, and the matching argument of `DatabaseConnectorServletInterface.getTables` in the Database Connector's `extensions/jdbc/jdbc-shared.jar`, are deprecated and ignored. See [Upcoming changes](#upcoming-changes) for their removal. [Fix](https://github.com/OpenIntegrationEngine/engine/commit/d38accecf). - **Custom controller/servlet implementations need updating.** `EngineController` adds an abstract five-argument `dispatchRawMessage` overload, and `MessageServletInterface` adds `processBatchMessage`. The existing four-argument dispatch API remains available to callers. [API change](https://github.com/OpenIntegrationEngine/engine/commit/893ae635b). - **The standalone extension JNLP endpoint is removed.** Extension resources are included directly in the main launch descriptor, reducing startup requests. Update custom launchers that fetch `/webstart/extensions/.jnlp` and subclasses overriding the removed `getExtensionJnlp(String)` method. Main launch descriptors and extension JAR serving remain available. [JNLP changes](https://github.com/OpenIntegrationEngine/engine/commit/a403863a9), [endpoint removal](https://github.com/OpenIntegrationEngine/engine/commit/0205efbde). - **Other custom Java integrations:** the Microsoft driver removes `getAADSecretPrincipalId`; the server-plugin accessor now returns a snapshot, and plugin de-duplication uses `equals`/`hashCode`; missing synchronized global-map keys now throw `IllegalArgumentException` instead of `NullPointerException`. Check custom code relying on these APIs or behaviors. [Microsoft changes](https://learn.microsoft.com/en-us/sql/connect/jdbc/release-notes-for-the-jdbc-driver?view=sql-server-ver17#changes-in-102), [plugin collection](https://github.com/OpenIntegrationEngine/engine/commit/f421b3ca7), [global-map error](https://github.com/OpenIntegrationEngine/engine/commit/2e0ff419b). @@ -117,6 +117,16 @@ Installers that bundle a Java runtime now include **Eclipse Temurin 21** instead - **Jackson-based JSON paths have new parsing limits.** Jackson Core 2.18.8 introduces limits absent in the bundled 2.14.3 baseline, including nesting depth and token lengths. Test unusually deep or large JSON handled through Jackson-based utilities/custom code; this is not a claim that every OIE JSON parser uses Jackson. Jackson's default limits are 1,000 levels of nesting, 1,000 characters for a number, 20,000,000 characters for a string value and 50,000 characters for a property name. Document length and token count are unlimited. - **Source-build automation must migrate from Ant to Gradle.** Use the included wrapper, for example `./gradlew build -PdisableSigning=true`; source directories now follow the standard Gradle layout. Import the repository as a Gradle project instead of using the removed Eclipse project files. [Build migration](https://github.com/OpenIntegrationEngine/engine/commit/24c96f509), [source moves](https://github.com/OpenIntegrationEngine/engine/commit/8a2dc59f3). +## Upcoming changes + +### `selectLimit` will be removed + +The deprecated `selectLimit` query parameter of `POST /connectors/jdbc/_getTables`, and the matching argument of `DatabaseConnectorServletInterface.getTables` in the Database Connector's `extensions/jdbc/jdbc-shared.jar`, will be removed in an upcoming release. Java code calling `getTables` will need to drop that argument when upgrading to the `jdbc-shared.jar` from that release. + +### Java Security Manager support will be removed + +A future release will remove the remaining code that works with a Java Security Manager. That code makes privileged class-loader lookups when the Administrator, CLI and client library create API proxies, and selects the Security Manager's thread group for JavaScript worker threads. OIE never enables a Security Manager itself. This change only affects deployments that start the server, Administrator or CLI with `-Djava.security.manager` and a restrictive policy. After the removal, such a policy may need to grant `RuntimePermission "getClassLoader"`. JavaScript threads will then join the creating thread's group whether or not a Security Manager is present. The Administrator launched from the shipped JNLP descriptor, which requests all permissions, is not affected. The Security Manager has been deprecated for removal since Java 17 and cannot be enabled on Java 24 and later. If you depend on it, comment on the [pending change](https://github.com/OpenIntegrationEngine/engine/pull/152). + ## Fixes and improvements - Keep Oracle prepared statements open until queued JDBC batch work executes, fixing failures caused by prematurely closed statements. [Fix](https://github.com/OpenIntegrationEngine/engine/commit/864ede756). From 4391c19f02c8c3ea7cb4a3e9aca8e8a036c57bf1 Mon Sep 17 00:00:00 2001 From: Tony Germano Date: Tue, 20 Oct 2026 20:18:58 -0400 Subject: [PATCH 19/19] Restore powershell fix and adjust working This reverts part of commit 0fc4fda0e4021ba9e9fa6fb88f081702b6695c6c. --- docs/release-notes/4.7.0.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/release-notes/4.7.0.md b/docs/release-notes/4.7.0.md index 0943380df..9566d0544 100644 --- a/docs/release-notes/4.7.0.md +++ b/docs/release-notes/4.7.0.md @@ -100,7 +100,7 @@ Installers that bundle a Java runtime now include **Eclipse Temurin 21** instead ### `oieserver.ps1` removed -`oieserver.ps1` is no longer included. Use the `oieserver` launcher instead. +`oieserver.ps1` is no longer included in the release. Use the `oieserver` launcher instead. ### API consumers and custom extensions @@ -140,6 +140,7 @@ A future release will remove the remaining code that works with a Java Security - Replace the expired signing certificate used for signed artifacts. [Certificate change](https://github.com/OpenIntegrationEngine/engine/commit/590683161). - Make logging-library discovery independent of hard-coded Log4j JAR versions. [Fix](https://github.com/OpenIntegrationEngine/engine/commit/85188d583). - Add a final-comment safeguard to the custom JVM-options template so options inserted above it retain their newline. [JVM options](https://github.com/OpenIntegrationEngine/engine/commit/70b627dff). +- Fix Java detection/server startup under PowerShell 5.1 (local builds only). [PowerShell](https://github.com/OpenIntegrationEngine/engine/commit/e76591953). ## Build and validation improvements