Payara 7.2026.7 upgrade plus multiple library updates

doc/release-notes/12493-payara7-2026.7plus.md

@@ -0,0 +1,76 @@
+This release updates to the recommended Payara-7.2026.7 release and updates many of the third-party libraries Dataverse uses.
+
+### Upgrade from Payara 7.2026.2 to Payara 7.2026.7
+
+The instructions below describe the upgrade procedure based on moving your existing Payara 7.2026.2 domain directory into the new Payara 7.2026.7 distribution. We recommend this method because it is the easiest way to recreate your current configuration and preserve your data.
+
+1. Stop Payara:
+
+   ```shell
+   sudo service payara stop
+   ```
+
+2. Move the current Payara 7.2026.2 directory out of the way:
+
+   ```shell
+   mv /usr/local/payara7 /usr/local/payara7-2026.2
+   ```
+
+3. Download the new Payara version 7.2026.7, and unzip it in its place:
+
+   ```shell
+   cd /usr/local
+   curl -L -O https://nexus.payara.fish/repository/payara-community/fish/payara/distributions/payara/7.2026.7/payara-7.2026.7.zip
+   unzip payara-7.2026.7.zip
+   mv payara-7.2026.7 payara7
+   ```
+
+4. Replace the brand new `payara7/glassfish/domains/domain1` with your old, preserved domain1:
+
+   ```shell
+   mv /usr/local/payara7/glassfish/domains/domain1 /usr/local/payara7/glassfish/domains/domain1_DIST
+   cp -ar /usr/local/payara7-2026.2/glassfish/domains/domain1 /usr/local/payara7/glassfish/domains/
+   ```
+
+5. Remove the cache directories:
+
+   ```shell
+   rm -rf /usr/local/payara7/glassfish/domains/domain1/generated/
+   rm -rf /usr/local/payara7/glassfish/domains/domain1/osgi-cache/
+   ```
+
+6. Update configuration files in the moved domain:
+
+   The file `glassfish-acc.xml` is replaced with the new `payara-acc.xml`, and `default-logging.properties` has been updated in the new Payara distribution. We recommend copying these new files from the distribution domain into your reused domain.
+
+   ```shell
+   rm /usr/local/payara7/glassfish/domains/domain1/config/glassfish-acc.xml
+   cp /usr/local/payara7/glassfish/domains/domain1_DIST/config/payara-acc.xml /usr/local/payara7/glassfish/domains/domain1/config/
+   cp /usr/local/payara7/glassfish/domains/domain1_DIST/config/default-logging.properties /usr/local/payara7/glassfish/domains/domain1/config/
+   ```
+
+7. Update JVM options in **domain.xml**:
+
+   Edit `payara7/glassfish/domains/domain1/config/domain.xml` to add the following JVM option to the `server-config` section:
+
+   ```xml
+   <jvm-options>--add-opens=java.base/java.lang.reflect=ALL-UNNAMED</jvm-options>
+   ```
+
+   Also, check for any JVM options that reference the old Payara path (e.g., `/usr/local/payara7-2026.2`) and update them to the new path (`/usr/local/payara7`).
+
+8. (Optional): If you use a dedicated service account like `dataverse`, update the ownership permissions:
+
+   ```shell
+   sudo chown -R dataverse /usr/local/payara7/glassfish/domains/domain1
+   ```
+
+9. Start Payara:
+
+   ```shell
+   sudo service payara start
+   ```
+
+
+
+

doc/sphinx-guides/source/api/changelog.rst

@@ -26,6 +26,7 @@ v6.12
   - **/api/admin/index/perms/{id}**
 
 - Dataset creation API calls may now behave differently when neither a license nor terms are provided, depending on the new :ref:`dataverse.feature.do-not-assume-default-license` feature flag.
+- Whether file extensions are included in the "Content-disposition" header returned when downloading auxiliary files depends on whether the relevant format is one of the content types supported in Tika. A recent update to the version of Tika has added new content types, including "text/markdown", and auxiliary files with these types now have a a file extension included (e.g. ".md" in this case) in the header.
 
 v6.11
 -----

doc/sphinx-guides/source/installation/prerequisites.rst

@@ -44,7 +44,7 @@ On RHEL/derivative you can make Java 21 the default with the ``alternatives`` co
 Payara
 ------
 
-Payara 7.2026.2 is recommended. Newer versions might work fine. Regular updates are recommended.
+Payara 7.2026.7 is recommended. Newer versions might work fine. Regular updates are recommended.
 
 Installing Payara
 =================
@@ -55,8 +55,8 @@ Installing Payara
 
 - Download and install Payara (installed in ``/usr/local/payara7`` in the example commands below)::
 
-	# wget https://nexus.payara.fish/repository/payara-community/fish/payara/distributions/payara/7.2026.2/payara-7.2026.2.zip
-	# unzip payara-7.2026.2.zip
+	# wget https://nexus.payara.fish/repository/payara-community/fish/payara/distributions/payara/7.2026.7/payara-7.2026.7.zip
+	# unzip payara-7.2026.7.zip
 	# mv payara7 /usr/local
 
 If nexus.payara.fish is ever down for maintenance, Payara distributions are also available from https://repo1.maven.org/maven2/fish/payara/distributions/payara/

modules/dataverse-parent/pom.xml

@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="UTF-8"?>
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd;">
     <modelVersion>4.0.0</modelVersion>
@@ -149,12 +150,12 @@
         <argLine>-Duser.timezone=${project.timezone} -Dfile.encoding=${project.build.sourceEncoding} -Duser.language=${project.language} -Duser.region=${project.region}</argLine>
 
         <!-- Major system components and dependencies -->
-        <payara.version>7.2026.2</payara.version>
+        <payara.version>7.2026.7</payara.version>
         <postgresql.version>42.7.12</postgresql.version>
         <solr.version>9.8.0</solr.version>
         <postgresql.server.version>16</postgresql.server.version>
-        <aws.version>2.33.0</aws.version>
-        <google.library.version>26.30.0</google.library.version>
+        <aws.version>2.51.3</aws.version>
+        <google.library.version>26.69.0</google.library.version>
 
         <!-- Basic libs, logging -->
         <slf4j.version>1.7.35</slf4j.version>
@@ -173,7 +174,7 @@
         <smallrye-mpconfig.version>3.7.1</smallrye-mpconfig.version>
         <junit.jupiter.version>5.10.2</junit.jupiter.version>
         <mockito.version>5.11.0</mockito.version>
-        
+
         <checkstyle.version>9.3</checkstyle.version>
 
         <!-- Official Maven Plugins -->
@@ -199,16 +200,16 @@
         <pomchecker-maven-plugin.version>1.7.0</pomchecker-maven-plugin.version>
         <sonar.version>5.7.0.6970</sonar.version>
         <maven-jacoco-plugin.version>0.8.14</maven-jacoco-plugin.version>
-        
+
         <!-- Container related -->
         <fabric8-dmp.version>0.48.0</fabric8-dmp.version>
-        
+
         <!-- SonarQube Code Quality related -->
         <sonar.host.url>https://sonarcloud.io</sonar.host.url>
         <sonar.organization>iqss</sonar.organization>
         <sonar.projectKey>IQSS_dataverse</sonar.projectKey>
         <sonar.moduleKey>${project.groupId}:${project.artifactId}</sonar.moduleKey>
-        <sonar.java.coveragePlugin>jacoco</sonar.java.coveragePlugin>   
+        <sonar.java.coveragePlugin>jacoco</sonar.java.coveragePlugin>
     </properties>
 
     <pluginRepositories>
@@ -431,7 +432,7 @@
         <repository>
             <id>unidata-all</id>
             <name>Unidata All</name>
-            <url>https://artifacts.unidata.ucar.edu/repository/unidata-all/</url>
+            <url>https://artifacts.unidata.ucar.edu/repository/unidata-all</url>
             <snapshots>
                 <enabled>false</enabled>
             </snapshots>

pom.xml

@@ -33,13 +33,13 @@
         <!-- This will be switched within the container profile! -->
         <packaging.type>war</packaging.type>
 
-        <reload4j.version>1.2.18.4</reload4j.version>
-        <flyway.version>10.19.0</flyway.version>
+        <reload4j.version>1.2.26</reload4j.version>
+        <flyway.version>12.9.0</flyway.version>
         <auto-service.version>1.1.1</auto-service.version>
         <jhove.version>1.20.1</jhove.version>
-        <poi.version>5.4.0</poi.version>
-        <tika.version>3.2.2</tika.version>
-        <netcdf.version>5.9.1</netcdf.version>
+        <poi.version>5.5.1</poi.version>
+        <tika.version>3.3.2</tika.version>
+        <netcdf.version>5.10.0</netcdf.version>
 
         <openapi.infoTitle>Dataverse API</openapi.infoTitle>
         <openapi.infoVersion>${project.version}</openapi.infoVersion>
@@ -111,7 +111,7 @@
             <dependency>
                 <groupId>org.apache.james</groupId>
                 <artifactId>apache-mime4j-dom</artifactId>
-                <version>0.8.7</version>
+                <version>0.8.14</version>
             </dependency>
             <dependency>
                 <groupId>xerces</groupId>
@@ -218,7 +218,7 @@
         <dependency>
           <groupId>com.apicatalog</groupId>
           <artifactId>titanium-json-ld</artifactId>
-          <version>1.4.0</version>
+          <version>1.7.0</version>
         </dependency>
         <dependency>
             <groupId>com.google.code.gson</groupId>
@@ -407,7 +407,7 @@
         <dependency>
             <groupId>commons-validator</groupId>
             <artifactId>commons-validator</artifactId>
-            <version>1.7</version>
+            <version>1.10.1</version>
         </dependency>
 
         <dependency>
@@ -466,6 +466,9 @@
             <version>${poi.version}</version>
         </dependency>
         <dependency>
+            <!-- jhove 1.34 currently includes an old version of apache commons-compress
+                 if we update, the commons-compress dependency below needs to go above this
+                 (or an exclude is needed) -->
             <groupId>org.openpreservation.jhove</groupId>
             <artifactId>jhove-core</artifactId>
             <version>${jhove.version}</version>
@@ -499,7 +502,7 @@
         <dependency>
             <groupId>edu.ucsb.nceas</groupId>
             <artifactId>ezid</artifactId>
-            <version>1.0.0</version>
+            <version>1.0.3</version>
             <type>jar</type>
             <exclusions>
                 <exclusion>
@@ -527,7 +530,7 @@
         <dependency>
             <groupId>org.javaswift</groupId>
             <artifactId>joss</artifactId>
-            <version>0.10.0</version>
+            <version>0.10.4</version>
         </dependency>
         <dependency>
             <groupId>org.apache.commons</groupId>
@@ -544,7 +547,7 @@
         <dependency>
             <groupId>com.nimbusds</groupId>
             <artifactId>oauth2-oidc-sdk</artifactId>
-            <version>11.22.1</version>
+            <version>11.30.1</version>
         </dependency>
         <!-- Caching library, current main use case is for OIDC authentication -->
         <dependency>
@@ -1160,7 +1163,7 @@
                 <artifactId>maven-checkstyle-plugin</artifactId>
                 <configuration>
                     <configLocation>${project.basedir}/src/maven/checkstyle.xml</configLocation>
-                    <encoding>UTF-8</encoding>
+                    <inputEncoding>UTF-8</inputEncoding>
                     <consoleOutput>true</consoleOutput>
                 </configuration>
             </plugin>

src/main/java/edu/harvard/iq/dataverse/DataFileServiceBean.java

@@ -505,7 +505,7 @@ public DataFile findCheapAndEasy(Long id) {
             return null;
         }
 
-        Integer file_id = (Integer) result[0];
+        Integer file_id = ((Number) result[0]).intValue();
 
         dataFile = new DataFile();
         dataFile.setMergeable(false);

src/main/java/edu/harvard/iq/dataverse/GuestbookResponseServiceBean.java

@@ -176,7 +176,7 @@ public List<Object[]> getGuestbookResults(Long dataverseId, Long guestbookId ){
 
     public StringBuilder convertGuestbookResponsesToCSV ( Map<Integer, Object> customQandAs, Map<Integer, String> datasetTitles, Object[] result) throws IOException {
 
-            Integer guestbookResponseId = (Integer)result[0];
+            Integer guestbookResponseId = ((Number)result[0]).intValue();
 
             StringBuilder sb = new StringBuilder();
 
@@ -190,7 +190,7 @@ public StringBuilder convertGuestbookResponsesToCSV ( Map<Integer, Object> custo
 
 
             // Dataset name: 
-            Integer datasetId = (Integer) result[2];
+            Integer datasetId = ((Number) result[2]).intValue();
             String datasetTitle = datasetTitles.get(datasetId);
             sb.append(datasetTitle == null ? "" : StringEscapeUtils.escapeCsv(datasetTitle));
             sb.append(SEPARATOR);
@@ -396,7 +396,7 @@ private Map<Integer, Object> selectCustomQuestionAnswers(Long dataverseId, Long
 
         if (customResponses != null) {
             for (Object[] response : customResponses) {
-                Integer responseId = (Integer) response[2];
+                Integer responseId = ((Number) response[2]).intValue();
 
                 if (asString) {
                     // as combined strings of comma-separated question and answer values
@@ -967,7 +967,7 @@ public Map<Integer, String> mapDatasetTitles(Long dataverseId) {
 
         if (titleResults != null) {
             for (Object[] titleObj : titleResults) {
-                Integer datasetId = (Integer) titleObj[1];
+                Integer datasetId = ((Number) titleObj[1]).intValue();
                 String datasetTitle = (String) titleObj[0];
 
                 ret.put(datasetId, datasetTitle);

src/main/java/edu/harvard/iq/dataverse/UserServiceBean.java

@@ -125,7 +125,7 @@ public List<AuthenticatedUser> getAuthenticatedUserList(String searchTerm,
     private AuthenticatedUser createAuthenticatedUserForView (Object[] dbRowValues, String roles, int rowNum){
         AuthenticatedUser user = new AuthenticatedUser();
 
-        user.setId(new Long((int)dbRowValues[0]));
+        user.setId(((Number)dbRowValues[0]).longValue());
         user.setUserIdentifier((String)dbRowValues[1]);
         user.setLastName(UserUtil.getStringOrNull(dbRowValues[2]));
         user.setFirstName(UserUtil.getStringOrNull(dbRowValues[3]));
@@ -157,7 +157,7 @@ private AuthenticatedUser createAuthenticatedUserForView (Object[] dbRowValues,
      * Attempt to retrieve all the user roles in 1 query
      * Consider putting limits on this -- e.g. no more than 1,000 user identifiers or something similar
      * 
-     * @param userIdentifierList
+     * @param userObjectList
      * @return
      */
     private HashMap<String, List<String>> retrieveRolesForUsers(List<Object[]> userObjectList){
@@ -170,7 +170,7 @@ private HashMap<String, List<String>> retrieveRolesForUsers(List<Object[]> userO
                                        ;
 
         List<Integer> databaseIds = userObjectList.stream()
-                                        .map(userInfo -> (Integer)userInfo[0])
+                                        .map(userInfo -> ((Number)userInfo[0]).intValue())
                                         .collect(Collectors.toList());
 
         if ((userIdentifierList==null)||(userIdentifierList.isEmpty())){

src/main/java/edu/harvard/iq/dataverse/api/DownloadInstanceWriter.java

@@ -642,7 +642,7 @@ private boolean isAuxiliaryObjectCached(StorageIO storageIO, String auxiliaryTag
         }
     }
 
-    // TODO: Return ".md" for "text/markdown" as well as other extensions in MimeTypeDetectionByFileExtension.properties
+    // TODO: Return file extensions for extensions in MimeTypeDetectionByFileExtension.properties and not supported by Tika
     private String getFileExtension(AuxiliaryFile auxFile) {
         String fileExtension = "";
         if (auxFile == null) {

src/main/java/edu/harvard/iq/dataverse/export/ddi/DdiExportUtil.java

@@ -2021,7 +2021,7 @@ public static void datasetHtmlDDI(InputStream datafile, OutputStream outputStrea
             Document document = builder.parse(datafile);
 
             // Use a Transformer for output
-            TransformerFactory tFactory = TransformerFactory.newInstance();
+            TransformerFactory tFactory = TransformerFactory.newDefaultInstance();
             // Set secure processing feature
             tFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
             tFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");

src/main/java/edu/harvard/iq/dataverse/mydata/MyDataFinder.java

@@ -22,7 +22,6 @@
 import java.util.logging.Logger;
 
 import edu.harvard.iq.dataverse.util.json.JsonUtil;
-import jakarta.json.Json;
 import jakarta.json.JsonArrayBuilder;
 import jakarta.json.JsonObjectBuilder;
 import org.apache.commons.lang3.StringUtils;
@@ -518,8 +517,7 @@ private boolean runStep2DirectAssignments(){
         // Iterate through assigned objects
         // -----------------------------------------------
         for (Object[] ra : results) {
-            dvIdAsInteger = (Integer)ra[0];     // ?? Why?
-            dvId = new Long(dvIdAsInteger);
+            dvId = ((Number)ra[0]).longValue();
             dtype = (String)ra[1];
             parentId = (Long)ra[2];
 
@@ -596,8 +594,7 @@ private boolean runStep3FilePermsAssignedAtDataverse(){
         // Iterate through object list
         //
         for (Object[] ra : results) {
-            dvIdAsInteger = (Integer)ra[0];     // ?? Why?
-            dvId = new Long(dvIdAsInteger);
+            dvId = ((Number)ra[0]).longValue();
             dtype = (String)ra[1];
             parentId = (Long)ra[2];
 

src/main/java/edu/harvard/iq/dataverse/util/xml/XmlPrinter.java

@@ -18,7 +18,7 @@ public class XmlPrinter {
 
     static public String prettyPrintXml(String xml) {
         try {
-            TransformerFactory tf = TransformerFactory.newInstance();
+            TransformerFactory tf = TransformerFactory.newDefaultInstance();
             // Set secure processing feature
             tf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
 

src/test/java/edu/harvard/iq/dataverse/api/AuxiliaryFilesIT.java

@@ -258,9 +258,8 @@ public void testUploadAuxFiles() throws IOException {
         // Download Markdown aux file.
         Response downloadAuxFileMd = UtilIT.downloadAuxFile(fileId, formatTagMd, formatVersionMd, apiToken);
         downloadAuxFileMd.then().assertThat().statusCode(OK.getStatusCode());
-        // No file extenstion here because Tika's getDefaultMimeTypes doesn't include "text/markdown".
-        // Note: browsers seem to add ".bin" ("myfile.bin") rather than no extension ("myfile").
-        assertEquals("attachment; filename=\"data.tab.README_0.1\"", downloadAuxFileMd.header("Content-disposition"));
+        // Tika's getDefaultMimeTypes includes "text/markdown" so ".md" is appended.
+        assertEquals("attachment; filename=\"data.tab.README_0.1.md\"", downloadAuxFileMd.header("Content-disposition"));
 
         // Download Markdown aux file with no MIME type given
         Response downloadAuxFileNoMime1 = UtilIT.downloadAuxFile(fileId, formatTagNoMimeType1, formatVersionNoMimeType1, apiToken);