Investigate MyBatis 3.3.x and MyBatis-Spring 1.2.x

[ikeyat]

Description

MyBatis 3.3.1 and MyBatis-Spring 1.2.5 have been released.
https://github.com/mybatis/mybatis-3/releases/tag/mybatis-3.3.1
https://github.com/mybatis/spring/releases/tag/mybatis-spring-1.2.5

We need to investigate which we should catch up emergently or not. (critical bugs or vulnerability)

Possible Solutions

TBD

Affects Version/s

• 5.1.0.RELEASE
• 5.0.2.RELEASE

Fix Version/s

(write later)

Issue Links

#555

[btkawakamitor]

@ikeyat @sasakitsy
There is a fix of MyBatis 3.3.1 it looks important.
mybatis/mybatis-3#492

The issue says "Oracle returns null RS in certain cases", I can not be specific the "certain cases" from Issue description. So I think it should be confirm. The other, there is no important fixes.

[kazuki43zoo]

So I think it should be confirm.

I think so, too. 👍

[ikeyat]

@btkawakamitor
Please continue to confirm deeply. We need to decide to update or not for 5.1.1.RELEASE.

[btkawakamitor]

https://github.com/mybatis/mybatis-3/blob/610e55290768d80ee6cb5401db2fe7ae81987709/src/main/java/org/apache/ibatis/executor/resultset/DefaultResultSetHandler.java#L120

There is a possibility that At this line, CallableStatement#getObject(int parameterIndex) return null in certain cases.
@kazuki43zoo asks specific conditions for this error to issue auther.

But I think If CallableStatement#getObject(int parameterIndex) return null in spite of parameterIndex is valid, this occur in normal use.
Even if The "specific conditions" is rare case, it's better to update.
Other issues for MyBatis 3.3.1 are minor fixes.

How is it?

[btkawakamitor]

@ikeyat @sasakitsy

I investigated MyBatis 3.4.0.
https://github.com/mybatis/mybatis-3/milestones/3.4.0

MyBatis 3.4.0 have a fix that it looks critical.
mybatis/mybatis-3#542

Issue at the time of using org.apache.ibatis.datasource.pooled.PooledDataSource.
There is no description in the development guideline, but it might be used.

And there is no fixes in MyBatis 3.4.0 that affects the use of existing functionality.
If functional test is successful completion, I think it's no problem to update to MyBatis 3.4.0.

[kazuki43zoo]

To : @btkawakamitor
Cc : @sasakitsy @ikeyat

MyBatis 3.4.1 has been released.
Can you confirm include or not critical issues that need to backport to 3.3 line ?

https://github.com/mybatis/mybatis-3/releases/tag/mybatis-3.4.1

[btkawakamitor]

@kazuki43zoo @ikeyat @sasakitsy

There are no critical fix for MyBatis 3.3.x on use in accordance with the Development Guideline.

But this issue need attention.
mybatis/mybatis-3#706

In specific application server, application not start caused by javassist packed in MyBatis.

[btkawakamitor]

This is an additional information.
MyBatis 3.3.1 & 3.4.0 has update javassist 3.18 to 3.20-GA.
So I think MyBatis 3.3.1 is affected this issue In the same manner as the MyBatis 3.4.0.

[ikeyat]

Keep attention the update of MyBatyis 3.3.x line for 5.2.x and 5.1.x.

[kazuki43zoo]

@sasakitsy

Please triage.

[yoshikawaa]

Done at #279 .