Skip to content

Conversation

@NicoPiel
Copy link
Contributor

@NicoPiel NicoPiel commented Dec 5, 2025

Updates several Apache Commons dependencies across modules to newer patch releases to fix security vulnerabilities.

Fixes #218

Notably upgrades
commons-lang3 (3.13.0 → 3.18.0),
commons-beanutils (1.9.4 → 1.11.0) and
commons-configuration2 (2.8.0 → 2.10.1), replacing old JARs with the updated artifacts.

Updates several Apache Commons dependencies across modules to newer patch releases to fix security vulnerabilities.

Fixes OpenIntegrationEngine#218

Notably upgrades commons-lang3 (3.13.0 → 3.18.0), commons-beanutils (1.9.4 → 1.11.0) and commons-configuration2 (2.8.0 → 2.10.1), replacing old JARs with the updated artifacts.

Signed-off-by: Nico Piel <nico.piel@hotmail.de>
Copy link
Member

@tonygermano tonygermano left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There are references that need to be updated in /server/build.xml and /manager/ant-build.xml. Some of these libraries get added to the manifests of the launcher jars. I'm less concerned about /manager since we don't ship that, and it's probably going to be rewritten at some point, but since you are already updating the jars, you should probably update the build file to match.

Also, the /generator project should probably be kept up to date. That doesn't run on every build, but it is what creates https://github.com/OpenIntegrationEngine/engine/blob/main/server/lib/mirth-vocab.jar

I'd want to see the results of some people testing these changes and check if there are any documented compatibility issues with newer versions before we merge.

Updates several bundled library versions referenced in application manifests to newer releases

Signed-off-by: Nico Piel <nico.piel@hotmail.de>
Bumps the Commons Lang library

Signed-off-by: Nico Piel <nico.piel@hotmail.de>
@NicoPiel
Copy link
Contributor Author

NicoPiel commented Dec 5, 2025

There are references that need to be updated in /server/build.xml and /manager/ant-build.xml.

Done!

Also, the /generator project should probably be kept up to date.

Also Done!

Copy link
Contributor

@mgaffigan mgaffigan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Old versions referenced in:

  • donkey/.classpath
  • donkey/lib/commons/commons-beanutils-1.9.4.jar
  • donkey/lib/commons/commons-lang3-3.13.0.jar
  • command/.classpath

Bumps several third-party Commons libraries to newer releases

Signed-off-by: Nico Piel <nico.piel@hotmail.de>
Signed-off-by: Nico Piel <nico.piel@hotmail.de>
@mgaffigan
Copy link
Contributor

Are there libraries we ship that are depending on the three that are updated in this PR? Can we get those up to date at the same time? Approving regardless, since I don't see a downside to shipping as is.

@tonygermano tonygermano requested review from a team, jonbartels, kayyagari, ssrowe and tonygermano and removed request for a team December 8, 2025 04:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[SECURITY] Vulnerability in Apache Commons Libraries

3 participants