4.0.0

Changelog

This release contains only updated dependencies. It enables to fix security issues that should have a limited impact on projects:

• Jackson security issues (DoS and gadget issues: https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062)
• H2 security issue, though H2 is only used for tests in Plume

Upgrade instructions from 3.x to 4.x

• H2 has migrated to the V2 version. The main impacts observed is that SQL scripts that contains reserved keywords (user, type, value, etc.) in table/column names must be escaped: SELECT * FROM user => SELECT * FROM "user". More details are available on http://www.h2database.com/html/migration-to-v2.html. A side effect is that Flyway scripts used with H2 may be broken... whereas they already have been executed on other environments: In that case, Flyway checksums should be updated on other environments manually or using a temporary fix (until every environments are updated) by replacing flyway.migrate() by flyway.repair(); flyway.migrate(), for more information see https://flywaydb.org/documentation/command/repair
• For H2, table/column names are now escaped in QueryDSL: most of the time it should not be an issue, but for tests, when H2 is set to MYSQL mode, the QueryDSL dialect must be set to MYSQL too. It means that if the test config file contains something similar to this db.hikari."dataSource.url"="jdbc:h2:mem:test;MODE=MYSQL", then db.dialect="MYSQL" should be used (and not H2)
• Simple Mail Java has been updated to the V7 version. No impact have been noticed. More details are available on https://github.com/bbottema/simple-java-mail#whats-new
• Flyway has been upgraded to the V8 version: details are available on flyway/flyway#3247. The main impact observed is that project using MySQL/MariaDB and Flyway must now add this dependency in their pom.xml file:

<dependency>
  <groupId>org.flywaydb</groupId>
  <artifactId>flyway-mysql</artifactId>
</dependency>

• Swagger UI has been updated to version 4.1.2, links to Swagger must be updated, for example in src/main/resources/statics/index.html:

<a href="webjars/swagger-ui/4.1.2/index.html?url=/api/swagger">
  webjars/swagger-ui/4.1.2/index.html?url=/api/swagger
</a>

• Java 9+ dependencies are now part of Plume dependencies, so these dependencies can be removed from the pom.xml file:

<!-- jdk9+ non included Java libraries required for Jersey -->
<dependency>
  <groupId>javax.xml.bind</groupId>
  <artifactId>jaxb-api</artifactId>
</dependency>
<dependency>
  <groupId>com.sun.xml.bind</groupId>
  <artifactId>jaxb-core</artifactId>
</dependency>
<dependency>
  <groupId>com.sun.xml.bind</groupId>
  <artifactId>jaxb-impl</artifactId>
</dependency>
<dependency>
  <groupId>javax.activation</groupId>
  <artifactId>javax.activation-api</artifactId>
</dependency>
<dependency>
  <groupId>javax.annotation</groupId>
  <artifactId>javax.annotation-api</artifactId>
</dependency>

• In QuerydslGenerator, to keep the toString() method on generated beans, replace exporter.setBeanSerializer(new IdBeanSerializer().setUseJacksonAnnotation(true)); by:

IdBeanSerializer beanSerializer = new IdBeanSerializer().setUseJacksonAnnotation(true);
beanSerializer.setAddToString(true);
exporter.setBeanSerializer(beanSerializer);