Mirth Connect/OpenJDK compatibility

[Coooz]

Hi,

A customer of ours uses Mirth Connect 4.1 and OpenJDK 18.0.2, both of which have critical vulnerabilities. Currently we upgrade Mirth Connect with our customers to 4.4.2 and OpenJDK 17- so doing so with this customer would mean downgrading OpenJDK. We do not want to do that.
Some research (https://jdk.java.net/22, https://openjdk.org/groups/vulnerability/advisories/2022-10-18) reveals that OpenJDK 22 would be the version to install, but how can I be sure that Mirth Connect 4.4.2 will work fine with this version? There aren't any lists of known compatibility issues between Mirth Connect versions and OpenJDK versions as far as I know. Googling this produces no results.

Or can I simply assume that any OpenJDK version will always work with any Mirth Connect version?
Thanks,

[jonbartels]

For production use on the server you probably want either 17 or 21 as the LTS versions then ensure you're keeping up with the latest patches within those major versions.

For production use on the desktop for the Mirth Admin Client and Launcher the same rule applies except for MacOS you'll want the Zulu JRE with JavaFX.

[tonygermano]

I wouldn't worry too much about "downgrading" to 17. Mirth itself does not use any java features higher than java 8. There was almost nothing added to java 18 that could have been utilized by bleeding edge plugins or javascript code.

Java 18 does enforce UTF-8 as the default character encoding, which is likely to be different than java 17 only if mirth is running on Windows. In any case, you can add -Dfile.encoding=UTF-8 to your .vmoptions file to enforce the same behavior in Java 17.

Mirth should run on java 21 with no issues, but at this time, java 17 is more thoroughly tested, and you should still be able to get security and bug fix updates for it for a while.

You might want to run on java 21 in a test environment first before you load it on a customer's production system.

[Coooz]

Thanks for replying, @jonbartels and @tonygermano . In short: sticking with OpenJDK 17 should be fine (and 21 probably is fine as well). However, https://openjdk.org/groups/vulnerability/advisories/2022-10-18 seems to suggest that 17 is an affected version when it comes to certain vulnerabilities. Can I safely ignore that?

[pacmano1]

I am using 21 on a few engines.

[jonbartels]

Surely a patch version of JDK 17 has fixed a bug from 2022

[Coooz]

Thanks all for contributing. We'll stick to OpenJDK 17 for the time being, and downgrade when customers somehow have got version 18.