Upgrade commons libraries and javax/jakarta dependencies to fix security vulnerabilities

[NicoPiel]

Bump commons-beanutils (1.9.4→1.11.0), commons-codec (1.16.0→1.21.0),
commons-compress (1.24.0→1.28.0), commons-configuration2 (2.8.0→2.13.0),
commons-fileupload (1.5→1.6.0), commons-io (2.13.0→2.21.0),
commons-logging (1.2→1.3.5) across all applicable modules.

Upgrade javax.activation (1.2.0→jakarta.activation 1.2.1) and
javax.mail (1.5.0→jakarta.mail 1.6.7) to satisfy commons-email 1.6.0
dependency chain. Same javax.* package namespace — no code changes needed.

Fixes#218

edited from original description to reflect expanded scope

[tonygermano]

There are references that need to be updated in /server/build.xml and /manager/ant-build.xml. Some of these libraries get added to the manifests of the launcher jars. I'm less concerned about /manager since we don't ship that, and it's probably going to be rewritten at some point, but since you are already updating the jars, you should probably update the build file to match.

Also, the /generator project should probably be kept up to date. That doesn't run on every build, but it is what creates https://github.com/OpenIntegrationEngine/engine/blob/main/server/lib/mirth-vocab.jar

I'd want to see the results of some people testing these changes and check if there are any documented compatibility issues with newer versions before we merge.

[NicoPiel]

There are references that need to be updated in /server/build.xml and /manager/ant-build.xml.

Done!

Also, the /generator project should probably be kept up to date.

Also Done!

[mgaffigan]

Old versions referenced in:

• donkey/.classpath
• donkey/lib/commons/commons-beanutils-1.9.4.jar
• donkey/lib/commons/commons-lang3-3.13.0.jar
• command/.classpath

[mgaffigan]

Are there libraries we ship that are depending on the three that are updated in this PR? Can we get those up to date at the same time? Approving regardless, since I don't see a downside to shipping as is.

[Copilot]

Pull request overview

This PR addresses security vulnerabilities by upgrading three Apache Commons libraries across all modules in the Mirth Connect project. The upgrades bring the project up to date with security patches while maintaining consistent versions across the entire multi-module codebase.

Key changes:

• Upgraded commons-lang3 from 3.13.0 to 3.18.0
• Upgraded commons-beanutils from 1.9.4 to 1.11.0
• Upgraded commons-configuration2 from 2.8.0 to 2.10.1

Reviewed changes

Copilot reviewed 8 out of 38 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
server/build.xml	Updated Class-Path manifest attribute with new library versions
server/.classpath	Updated Eclipse classpath entries for upgraded commons libraries
manager/ant-build.xml	Updated Class-Path manifest attribute with new library versions
manager/.classpath	Updated Eclipse classpath entries for upgraded commons libraries
generator/.classpath	Updated commons-lang3 classpath entry
donkey/.classpath	Updated commons-lang3 and commons-beanutils classpath entries
command/.classpath	Updated commons-lang3 and commons-configuration2 classpath entries
client/.classpath	Updated all three commons libraries classpath entries

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[NicoPiel]

@tonygermano Do you want me to bump the versions further?

[github-actions]

Test Results

105 files ±0 202 suites ±0 7m 5s ⏱️ + 1m 18s
633 tests ±0 633 ✅ ±0 0 💤 ±0 0 ❌ ±0 
1 266 runs ±0 1 266 ✅ ±0 0 💤 ±0 0 ❌ ±0 

Results for commit d663cd4. ± Comparison against base commit 7c85593.

[github-actions]

Test Results

105 files ±0 202 suites ±0 7m 0s ⏱️ + 1m 13s
633 tests ±0 633 ✅ ±0 0 💤 ±0 0 ❌ ±0 
1 266 runs ±0 1 266 ✅ ±0 0 💤 ±0 0 ❌ ±0 

Results for commit 07111f9. ± Comparison against base commit 7fd767d.

♻️ This comment has been updated with latest results.

[tonygermano]

@tonygermano Do you want me to bump the versions further?

@NicoPiel Can you bump to the following?

lib	version
commons-configuration2	2.13.0
commons-beanutils	1.11.0	(completed in previous commit in this PR)
commons-logging	1.3.5
commons-codec	1.21.0
commons-fileupload	1.6.0
commons-io	2.21.0
commons-compress	1.28.0
commons-email	1.5	depends on javax.mail 1.5.6
javax.mail	1.5.6	adds new dependency javax.activation:activation:jar:1.1:compile

See attached pom.xml to help you download them. Drop it in a new dir and mvn clean package. It will download everything to the ./lib dir.

Running mvn dependency:tree -Dverbose with that pom produces

[INFO] +- org.apache.commons:commons-configuration2:jar:2.13.0:compile
[INFO] | +- (org.apache.commons:commons-lang3:jar:3.20.0:compile - omitted for duplicate)
[INFO] | +- (org.apache.commons:commons-text:jar:1.14.0:compile - omitted for conflict with 1.15.0)
[INFO] | \- (commons-logging:commons-logging:jar:1.3.5:compile - omitted for duplicate)
[INFO] +- commons-beanutils:commons-beanutils:jar:1.11.0:compile
[INFO] | +- (commons-logging:commons-logging:jar:1.3.5:compile - omitted for duplicate)
[INFO] | \- (commons-collections:commons-collections:jar:3.2.2:compile - omitted for duplicate)
[INFO] +- commons-logging:commons-logging:jar:1.3.5:compile
[INFO] +- commons-codec:commons-codec:jar:1.21.0:compile
[INFO] +- commons-fileupload:commons-fileupload:jar:1.6.0:compile
[INFO] | \- (commons-io:commons-io:jar:2.19.0:compile - omitted for conflict with 2.21.0)
[INFO] +- commons-io:commons-io:jar:2.21.0:compile
[INFO] +- org.apache.commons:commons-compress:jar:1.28.0:compile
[INFO] | +- (commons-codec:commons-codec:jar:1.19.0:compile - omitted for conflict with 1.21.0)
[INFO] | +- (commons-io:commons-io:jar:2.20.0:compile - omitted for conflict with 2.21.0)
[INFO] | \- (org.apache.commons:commons-lang3:jar:3.18.0:compile - omitted for conflict with 3.20.0)
[INFO] +- org.apache.commons:commons-email:jar:1.5:compile
[INFO] | \- (com.sun.mail:javax.mail:jar:1.5.6:compile - omitted for duplicate)
[INFO] +- com.sun.mail:javax.mail:jar:1.5.6:compile
[INFO] | \- javax.activation:activation:jar:1.1:compile
[INFO] +- org.apache.commons:commons-vfs2:jar:2.10.0:compile
[INFO] | +- (commons-logging:commons-logging:jar:1.3.4:compile - omitted for conflict with 1.3.5)
[INFO] | +- (org.apache.commons:commons-lang3:jar:3.17.0:compile - omitted for conflict with 3.20.0)
[INFO] | \- (commons-io:commons-io:jar:2.18.0:compile - omitted for conflict with 2.21.0)
[INFO] +- commons-collections:commons-collections:jar:3.2.2:provided (scope not updated to compile)
[INFO] +- org.apache.commons:commons-lang3:jar:3.20.0:provided (scope not updated to compile)
[INFO] \- org.apache.commons:commons-text:jar:1.15.0:provided (scope not updated to compile)
[INFO] \- (org.apache.commons:commons-lang3:jar:3.20.0:provided - omitted for duplicate)

[tonygermano]

I pushed a commit with the following changes,

• Restore log4j references to 2.25.3 in command/build.xml (was accidentally downgraded to 2.17.2)
• Upgrade javax.activation-1.2.0 to jakarta.activation-1.2.1 and javax.mail-1.5.6 to jakarta.mail-1.6.7 (same javax.* package namespace, satisfies commons-email 1.6.0 dependencies)
• Restore commons-email-1.6.0 on server (was unintentionally downgraded to 1.5)
• Remove jars that were added to modules where they did not previously exist (commons-email, commons-fileupload, javax.mail, commons-vfs2, commons-configuration2 in client/command/donkey)

I had a mistake in my previous comment. I did not intend to downgrade any libraries. I was working off a vulnerability scanner report that a user had created against the previous release. I did not realize that commons-email had already been upgraded to 1.6.0 since then. However, when it was upgraded, its dependencies were not, so I corrected that.

Also confusing was that the artifact name changed from activation -> javax.activation -> jakarta.activation. I originally avoided moving up to the jakarta versions because I thought they changed package names from javax -> jakarta, but they don't actually do that until the next major version bump.

I tested sending emails with the SMTP sender, and all seems fine with these versions.

The missing DCO is on my last commit. Rather than pushing again, I'll fix it when I squash the PR before committing.

[gibson9583]

thanks for the work on this one both of you