Skip to content
Eclipse Open Integration Engine™ Free. Open Source. Trusted.

← All news

OIE 4.7.0 Released

Eclipse Open Integration Engine 4.7.0 is now generally available and recommended for production use.

Download v4.7.0 from GitHub

Welcome to our new contributors

A sincere thank you to the people who made their first contribution in this release.

Breaking changes to know before you upgrade

  • New installs no longer start with admin/admin. Set server.initialadminpassword before the database is first initialized, or read the generated password from the server log of the first startup. Existing databases keep their credentials. Update unattended install and provisioning scripts.
  • New password defaults. The packaged configuration now sets a 15-character minimum, a retry limit of 100 and a one-hour lockout. Existing configuration files are not rewritten.
  • XML containing a DOCTYPE is rejected in XSLT steps, XML batch splitting and the strict HL7 v2 XML parser. Integrations that send DTDs or entity declarations there need to send self-contained XML.
  • The SQL Server driver now checks certificates. The bundled Microsoft JDBC driver moves to 10.2.4, which encrypts by default and validates the server’s certificate. Connections that worked without a trusted certificate can fail, and an engine whose own database is on SQL Server can stop at startup with PKIX path building failed. Connections through jTDS are not affected.
  • Installers with a bundled Java now ship Eclipse Temurin 21 instead of Azul Zulu 17. Java 17 is still the minimum.
  • The Administrator checks for JavaFX at startup and stops with a message if the javafx.graphics module is missing.
  • oieserver.ps1 is removed. Use the oieserver launcher.
  • Custom code and API clients: custom metadata filters must name configured columns exactly, selectLimit is deprecated and ignored, and the standalone extension JNLP endpoint is gone. The release notes list the rest.

New features

  • HTTP Sender can bind outgoing connections to a chosen local address, and HTTP Listener has a configurable maximum request-header size.
  • Recent message-search filters. Reuse up to ten recent filters per channel. They stay in the Administrator’s memory rather than being saved to local preferences.
  • Batch submission returns every message ID through the new batchMessagesWithObj API endpoint.
  • A Docker build in the repository that takes its startup configuration, including database and JVM settings, from environment variables and mounted secrets. This release does not publish an image.

Notable fixes

  • JDBC drivers in custom resources load again on Java 9 and later, so a channel can use a driver version other than the one shipped with the server. Originally reported in Mirth Connect discussion #5079. Thanks to @paul-hristea.
  • Oracle JDBC batch inserts no longer fail on statements closed too early.
  • Server plugins that implement more than one extension interface start and stop once.
  • The CLI no longer hangs on authentication or connection failures, and returns meaningful nonzero exit codes.
  • channelName is available to channel postprocessor scripts.
  • An undefined preprocessor result no longer replaces the message.

Security

This release fixes three CVEs in engine code: SQL injection in the Database Connector API’s table metadata lookup (CVE-2026-82583), and XML external entity expansion in XSLT transformer input (CVE-2026-78224) and in XPath-based XML batch processing (CVE-2026-82578). The CVE records list Mirth Connect 4.7.1 and earlier as affected. Those are Mirth version numbers, and OIE 4.7.0 includes the fixes.

Dependency upgrades address 45 more CVEs in bundled components, including Netty, Log4j, Jackson, Jakarta Mail, and the PostgreSQL and SQL Server JDBC drivers. The release notes also list five known advisories that remain in the bundled PostgreSQL JDBC and Jackson Core libraries, and the configurations each one affects.

The full release notes, including every CVE and upgrade consideration, are on GitHub: v4.7.0 release notes.