Mirth Connect Open Source 4.5 Test Partner drop. #5931
Replies: 11 comments 14 replies
-
|
9/22/2023 - 4.5.b2954 drop contains the following fixes: Updated Apache Xerces to 2.12.2We've updated Apache Xerces from version 2.9.1 to 2.12.2. This update addresses the following vulnerabilities: We've also updated Apache xml-apis from version 1.0.b2 to 1.4.01. There are no vulnerabilities associated with this library, but it is a dependency of Xerces, and it was required to update it. Updated Jackson to 2.14.3We've updated several Jackson libraries from version 2.11.3 to 2.14.3. This update addresses the following vulnerabilities: Updated Netty to 4.1.97We've updated Netty from version 4.1.53 to 4.1.97. This update addresses the following vulnerabilities:
We have also updated the Netty NIO client to 2.20.140 and Netty reactive streams to 2.0.8. |
Beta Was this translation helpful? Give feedback.
-
|
Will jSch be updated in 4.5? #5608 |
Beta Was this translation helpful? Give feedback.
-
|
@jonbartels Yes, we have it targeted for a drop in late December right before our Jan 2024 GR of 4.5. |
Beta Was this translation helpful? Give feedback.
-
|
While looking into this issue I noticed that |
Beta Was this translation helpful? Give feedback.
-
|
@tonygermano the team took a look at the issue you reference as it related to the Jar you reference and concluded those don't appear to be connected in any way. As for the jax-rt-2.3.0.2.jar file is not an item we have planned to address in the upcoming releases. That being said we are still in the beginning phase, and it could still come up as needing to be updated once we get into the other tasks. |
Beta Was this translation helpful? Give feedback.
-
|
Is the 4.5 beta derived directly from the main The commits seem to align with the stated library updates https://github.com/nextgenhealthcare/connect/commits/development/ |
Beta Was this translation helpful? Give feedback.
-
|
@jonbartels it is from the development branch - we wanted to make it easy for people to grab it in an installable state. |
Beta Was this translation helpful? Give feedback.
-
|
I looked at the release notes for:
@ARShelleyNextGen two topics for you and your team:
I am currently fiddling with my container builds to try out MC 4.5 betas. Thank you again for doing this in the open. |
Beta Was this translation helpful? Give feedback.
-
|
@jonbartels Thank You for taking the time to review these changes and providing your feedback. A few answers for you:
|
Beta Was this translation helpful? Give feedback.
-
|
I see that Lisa updated Velocity today also. Release notes: https://velocity.apache.org/engine/devel/changes.html
Emphasis mine. This is a category of change where the NextGen devs/leads do need to think about the updates. Is Mirth passing any properties to velocity that should or should-not use these backwards compatible flags? I am not sure if this matters for Velocity specifically. I present it here as an example of what to watch for when updating libraries. Make an active choice to run in backwards compatible modes or not. Something in the release notes to the effect of, "Users using advanced Velocity mappings should review these release notes and test their code. Typical, simple Velocity substitutions are unaffected." Velocity Tools Release Notes: https://velocity.apache.org/tools/3.1/changes.html This was just 3.0 to 3.1. The deprecations might matter but I don't see Mirth using Velocity in an advanced way that would be affected. |
Beta Was this translation helpful? Give feedback.
-
|
@jonbartels Thank you for the feedback I have brought your feedback to the Engineers attention as to what to keep in mind when making these changes. This is exactly the type of feedback we are looking to achieve by experimenting with our Test Partner drops. |
Beta Was this translation helpful? Give feedback.
-
|
the development team had dealt with the hyphen issue three years ago when upgrading the velocity library to 2.1. the connect project doesn't use the preserve_literals flag internally. I like the release notes warning. |
Beta Was this translation helpful? Give feedback.
-
|
Are there any plans to update the jersey client and switch to jakarta instead of javax? |
Beta Was this translation helpful? Give feedback.
-
|
A Jersey update is on the 4.5.0 schedule but at this time we have no plans to switch to jakarta. |
Beta Was this translation helpful? Give feedback.
-
|
@ARShelleyNextGen since you're upgrading libraries, would 4.5 also be a good chance to address this issue requesting an SBOM? #5852 |
Beta Was this translation helpful? Give feedback.
-
|
@jonbartels I thought I responded 2 weeks ago to this ask. My bad. I had passed along your feedback to the Product Manager for prioritization as well as passed it along to Engineers to see if they are aware of anywhere in our current build process that could generate a SBOM. |
Beta Was this translation helpful? Give feedback.
-
|
Hello Again Mirth Community ! The NextGen Team has updated the Beta drop folder with a new drop: 4.5.b2974. This drop is cumulative of what was available in the last one on 9/22/2023. 10/18/2023 - 4.5.b2974 drop contains the following fixes: Updated Apache commons-beanutils to 1.9.4We've updated Apache commons-beanutils from version 1.9.3 to 1.9.4. This update addresses the following vulnerability: Added Apache commons-digester3 3.2We've added the Apache commons-digester3-3.2 library. We've removed the Apache commons-digester-2.0 library from all components. If you are referencing this library in your code, please refer to the commons-digester3-3.2 library instead. This change addresses the following vulnerabilities: Updated Apache commons-fileupload to 1.5We've updated Apache commons-fileupload from version 1.4 to 1.5. This update addresses the following vulnerability: Updated Apache commons-io to 2.13.0We've updated Apache commons-io from version 2.6 to 2.13.0. This update addresses the following vulnerability: Updated Apache commons-lang3 to 3.13.0We've updated Apache commons-lang3 from version 3.9 to 3.13.0. There are no vulnerabilities associated with this library. We've removed the Apache commons-lang-2.6 library from all components. If you are referencing this library in your code, please refer to the commons-lang3-3.13.0 library instead. Updated Apache Velocity Engine to 2.3We've updated Apache velocity-engine-core from version 2.2 to 2.3. This update addresses the following vulnerabilities: Updated Apache Velocity Tools to 3.1We've updated Apache velocity-tools-generic from version 3.0 to 3.1. This update addresses the following vulnerabilities: Installation Recommendations for Beta Drops:
Here is where you can access these drops: Again, we Thank you for your help and feedback. |
Beta Was this translation helpful? Give feedback.
-
|
Hello Again Mirth Community ! The NextGen Team has updated the Beta drop folder with a new drop: 4.5.b2974. This drop is cumulative of what was available in the last one on 10/18/2023. 11/15/2023 - 4.5.0.b2988 drop contains the following fixes: Updated Apache commons-compress to 1.24.0 CVE-2019-12402 Updated Apache Derby to 10.14.2.0 Removed Jasypt Library Updated MySQL JDBC Driver to 8.1.0 Updated PostgreSQL JDBC Driver to 42.6.0 CVE-2022-41946 Updated SQLite JDBC Driver to 3.43.2.1 CVE-2017-10989 Here is where you can access these drops: Installation Recommendations for Beta Drops: Here are some recommended installation procedures: 1.Set up in a "fresh" environment - starting from scratch. Again, we Thank you for your help and feedback. |
Beta Was this translation helpful? Give feedback.
-
That was a new one to me. It hasn't been updated since 2019! Good call :D
The various JDBC updates are good ones. We see a few questions in Slack where newer installations need newer JDBC drivers and options to work, notably on cloud based DBs that require stricter authentication mechanisms.
Users with DIRECT or XDM connections running through Mirth might want to pay attention to this one. As I recall the bundle standard for XDM and DIRECT is to construct a ZIP attachment with a certain structure. This ZIP is likely generated using commons-compress. I would generaly expect the Apache updates to be well behaved and not-breaking; trust but verify. |
Beta Was this translation helpful? Give feedback.
-
|
@jonbartels Thank You for your comments. Its looking like maybe 1 or 2 more drop before our GR candidate will be ready for final testing. Have a wonderful holiday and thanks again for taking the time to provide feedback. |
Beta Was this translation helpful? Give feedback.
-
|
https://forums.mirthproject.io/forum/mirth-connect/support/18801-new-feature-mirth-logging-replacement/page3#post184269 - Good example of a developer who was able to use the beta-drop to improve a widely used logging tool for Mirth. |
Beta Was this translation helpful? Give feedback.
-
|
@jonbartels Thank for posting. We are very pleased that our beta drop was able to help. MC 4.5 has a lot of new library updates, and our intent is to ensure the Mirth Community is ahead of the game once the GR of 4.5 is available. |
Beta Was this translation helpful? Give feedback.
-
|
how about bcprov-jdk18on-177.jar ? |
Beta Was this translation helpful? Give feedback.
-
|
@linxd We did have MyBatis targeted for the 4.5 but that didn't make it - we do plan on that getting pushed to the 4.6 timeline. No plans for the other libraries mentioned above. Question back to you - What on those libraries are you concerned with that you feel they need to raise to the top of the priority list? Please give me some more info of the value they will bring to you and your organization, and I will see if we can move them up based upon that additional information you provide. |
Beta Was this translation helpful? Give feedback.
-
|
Hello Mirth Community ! The NextGen Team has completed its final Development sprint, and we are heading into regression testing with this build. This will be our final Test Partner build prior to being GR. You can find the latest in the Beta drop folder with this version in the name: 4.5.b3010. This drop is cumulative of what was available in the last one on 11/15/2023. 01/12/2024 - 4.5.0.b3010 drop contains the following fixes: Core Mirth ConnectFixed DefectsUpdated Ports in UseWe fixed an issue where the Updated Reprocess Attachment Handler to Always Include AttachmentsWe fixed an issue which failed to include an attachment when reprocessing a multipart message. This affects messages where the attachment is not embedded within the raw message but is included in a separate boundary within the multipart message. Fixed API Endpoint for Web Service Connector ServicesWe fixed a null pointer exception that occurred when the SSL Plugin was installed but the destination web service connector was not utilizing the SSL Manager.
Security ImprovementsLibrary UpdatesReverted Apache Derby to 10.10.2.0In a previous beta release, we upgrade Apache Derby to 10.14.2.0, but we've since found compatibility errors when upgrading, so we've reverted the library. Updated JDOM to JDOM2 2.0.6.1We've updated the JDOM library from version 1.1.1 to JDOM2 version 2.0.6.1. This update addresses the following vulnerabilities: Updated Jetty to 9.4.53We've updated several Jetty libraries from version 9.4.44 to 9.4.53. We've also updated several Jetty library dependencies (javax and asm). This update addresses the following vulnerabilities:
Replaced JSch Library with mwiede's ImplementationWe've replaced the official JSch library with the most recent version of mwiede's implementation which is a drop-in replacement. The official library is no longer maintained, while mwiede's library is actively maintained with bug fixes and security updates. Thanks to jonbartels for submitting the community issue and the pull request. Updated Quartz Scheduler to 2.3.2We've updated Quartz Scheduler from version 2.1.7 to 2.3.2. This update addresses the following vulnerability: Removed SoapUI and XMLBeans LibrariesWe've removed the SoapUI and XMLBeans libraries. This update addresses the following vulnerability in XMLBeans, which is a dependency of SoapUI: Removed woodstox-core and stax2-api LibrariesWe've removed the woodstox-core and stax2-api libraries. This update addresses the following vulnerability: Updated XStream to 1.4.20We've updated XStream from version 1.4.19 to 1.4.20. This update addresses the following vulnerabilities: Here is where you can access these drops: Installation Recommendations for Beta Drops: Please keep in mind that these are "Test Partner" drops and should not be applied to any Production-level setting. It's crucial to understand this and deploy these drops in a playground or development environment to avoid any impact on the existing setup. Here are some recommended installation procedures: 1.Set up in a "fresh" environment - starting from scratch. Again, we Thank you for your help and feedback. |
Beta Was this translation helpful? Give feedback.
-
Hello Mirth Community !
The NextGen Healthcare Mirth Connect team is excited to announce the commencement of our work on the upcoming release of Mirth Connect OSS version 4.5. In this iteration, we are focusing on updating numerous dependent libraries to their latest versions.
Over the next four months, our strategy involves sharing periodic "Test Partner” drops of version 4.5 with the community. These "Test Partner” releases are designed to enable the community to explore and test your channels and workflow prior to the final general release (GR) version of 4.5, which is scheduled for the end of January 2024.
We will use this communication channel to keep you informed about new drops and offer high-level documentation detailing the libraries incorporated in each drop. Your assistance in testing this version in your playground/development environments is greatly appreciated. It's important to note that these "Test Partner” drops are strictly for testing purposes and should not be deployed in production environments until the final GR version is officially released in January 2024.
While you explore and assess these drops, we encourage you to utilize this GitHub discussion thread to provide feedback. Our team will be actively monitoring the thread for updates. If you encounter any issues, please promptly update this thread with your findings. We will evaluate these issues and work towards resolving them in upcoming drops or future versions, taking into consideration their severity and impact on our users' business operations. Your feedback is invaluable in ensuring the quality and reliability of Mirth Connect version 4.5.
Installation Recommendations for Beta Drops:
Please keep in mind that these are "Test Partner" drops and should not be applied to any Production-level setting. It's crucial to understand this and deploy these drops in a playground or development environment to avoid any impact on the existing setup. Here are some recommended installation procedures:
2a.We highly advise creating a backup or clone of your current environment before proceeding with the upgrade. This ensures you can revert to the previous state if needed.
Here is where you can access these drops:
4.5 Beta Drops
Again, we Thank you for your help and feedback.
If you have any specific question or concerns please feel free to contact myself Alan Shelley ( [email protected] ) Mirth connect Engineering Manager or Jackie Knight ( [email protected] ) Mirth Connect Product Manager or just post a comment to this thread.
Thank You.
Beta Was this translation helpful? Give feedback.
All reactions