Releases: Innovar-Healthcare/BridgeLink
v26.3.0
🛡️ Security Updates
Upgraded dependencies to address the following CVEs:
- CVE-2024-1597
- CVE-2022-46337
- CVE-2015-1832
- CVE-2018-1313
- CVE-2022-41852
- CVE-2022-40159
- CVE-2022-40160
- CVE-2019-19919
- CVE-2021-23369
- CVE-2021-23383
- CVE-2023-25330
- CVE-2020-26945
- CVE-2023-39017
- CVE-2025-6965
⚠️ Note: BridgeLink now requires Java 17 or greater. Jetty has been upgraded from 9.4.x to 12.0.x — this is a major version upgrade.
✨ Improvements
- HTTP Listener connector now exposes a configurable Request Header Size field, allowing users to increase the header buffer beyond the default for environments that send large HTTP headers (e.g., long JWT tokens, verbose cookie headers).
- Username enumeration fix (issue #125): Resolved a security vulnerability where an attacker could determine valid usernames by observing different error responses when account lockout is enabled. A new property
password.allowusernameenumeration = false(default) ensures consistent error responses regardless of whether a username exists. - log4j2.properties fix:
dir.logsrenamed toproperty.logs— corrects a Log4j 2.x property lookup syntax error that prevented the log directory variable from resolving correctly.
🐛 Bug Fixes
- Fixed an issue on the login screen where the username field would insert a period when trailing spaces were typed quickly.
- Added a show/hide password toggle on the login screen.
- Improved login screen validation messages and default server field behavior.
🚀 New Features
Configurable SMTP OAuth 2.0 Authentication
BridgeLink 26.3.0 introduces OAuth 2.0 authentication for SMTP email sending (client credentials / XOAUTH2), in addition to the existing None and Basic options. This applies to both the global SMTP server settings and the SMTP Sender connector.
- Three-way auth selection: None / Basic / OAuth radio buttons in Server Settings and SMTP Sender connector
- OAuth fields: Client ID, Client Secret, Token Endpoint URL, and Scope
- Token caching: Access tokens are fetched and cached; proactively refreshed 60 seconds before expiry
- Verified working: Microsoft 365 / Azure AD via
smtp.office365.com:587(STARTTLS + XOAUTH2) - Backward compatible: Existing Basic/None configurations are preserved; the legacy
smtpAuthboolean is kept in sync automatically
Note: Google/GCP client credentials flow is not supported by Google. Microsoft 365 with Azure AD app registration is the primary verified provider.
Version History — Now Built Into Core
The Version History plugin (formerly a separate plugin) has been merged into the BridgeLink core product. All users now get built-in Git-backed version control for channels, code templates, and global scripts — no separate plugin installation required.
- Change tracking: Automatically records who changed what and when for channels, code templates, and global scripts
- Version comparison: Side-by-side diff view to compare any two versions of a channel or code template
- Rollback / restore: Revert a channel or code template to any prior version
- Git integration: Push and pull changes to/from a remote Git repository (GitHub, GitLab, Bitbucket)
- Selective push: View local changes, select specific items, and push them to the remote repository in a single commit
- Search on import: Search and filter when importing channels or code templates from the repository
- Code templates organized by library: Code templates are grouped by library in the repository and on the import screen
- Multi-select code template imports: Import multiple code templates at once with correct index sorting
- Improved commit messages: Channel name and server ID are now included in auto-commit messages; blank commit prompts fall back to the configured default message
- Performance improvements: Resolved UI freezing/delays when opening channels with large version histories — history now loads in the background
⚙️ Configuration File Changes
mirth.properties
- Added
password.allowusernameenumeration = false— prevents username enumeration when lockout is enabled - Updated version to
26.3.0
log4j2.properties
- Fixed property declaration:
dir.logsrenamed toproperty.logs
🔄 Dependency Updates
| Library | Previous | Updated |
|---|---|---|
| Jetty | 9.4.57.v20241219 | 12.0.32 |
| javax.mail | 1.5.0 | 1.6.2 |
| log4j | 2.17.2 | 2.25.3 |
| slf4j-api | 1.7.30 | 2.0.16 |
| SLF4J binding | slf4j-log4j12-1.7.30 | log4j-slf4j2-impl-2.25.3 |
| Apache Derby | 10.10.2.0 | 10.16.1.1 |
| PostgreSQL JDBC | 42.6.0 | 42.7.10 |
| SQLite JDBC | 3.43.2.1 | 3.51.2.0 |
| Oracle JDBC | ojdbc8-12.2.0.1 | ojdbc11-23.7.0.25.01 |
| Quartz | 2.3.2 | 2.5.2 |
| MyBatis | 3.1.1 | 3.5.16 |
| Commons Logging | 1.2 | 1.3.3 |
| Commons BeanUtils | 1.9.4 | 1.11.0 |
| Commons Configuration2 | 2.8.0 | 2.10.1 |
| Commons Lang3 | 3.13.0 | 3.18.0 |
| Commons Text | 1.10.0 | 1.12.0 |
| handlebars.js | 4.0.5 | 4.7.8 |
| apache-el / apache-jsp | 8.5.70 (org.mortbay.jasper) | 9.0.102 |
🗄️ Database Migration
Version 26.3.0 includes a schema migration to add OAuth authentication fields to the SMTP server settings. This migration runs automatically on first startup.
Downloads
| OS | Arch | Download Link |
|---|---|---|
| x64 | Installer | |
| x64 | Zip | |
| x64 | RPM | |
| x64 | Tar.gz | |
| x64 | Installer | |
| ARM | Installer | |
| ARM | Tar.gz |
v4.6.1
BridgeLink 4.6.1 – Release Notes
🚀 Updated Feature: Dynamic Lookup Gateway v2.1.0
This release delivers major enhancements to the Dynamic Lookup Gateway (DLG), improving flexibility, performance, and usability:
- Added support for JSON data types and JSON index creation
- Introduced a JSON Tree Viewer and Editor
- Advanced key/value search, with support for Boolean, String, and Number data types
- Export Javascript code snippet of the advanced search on JSON objects
- Added an option to disable lookup statistics by group
- Fixed server crashes when calling
getMatching("group", "%")on very large groups
⚠️ Note
Apache Derby database does NOT support the JSON data type.
JSON-related features are only available when using databases that provide native JSON support.
🚀 New Features
-
Support for the Innovar OIDC Plugin (OpenID Connect) — Commercial plugin
-
Support for custom BridgeLink Launcher icons in:
- Windows toolbar
- macOS Dock
Note: Please use the compatible BridgeLink Launcher v1.2.0
🐛 Bug Fixes
- Loosened database settings during upgrade from 4.6.0 → 4.6.1
[#74](#74) — @Innovarzweng - Fixed usage of Channel ID and Channel Name in destination mappings for JavaScript Writer
[#101](#101) — @Innovarzweng
Downloads
| OS | Arch | Download Link |
|---|---|---|
| x64 | Installer | |
| x64 | Zip | |
| x64 | RPM | |
| x64 | Tar.gz | |
| x64 | Installer | |
| ARM | Installer | |
| ARM | Tar.gz |
v4.6.0
BridgeLink 4.6.0 – Release Notes
Potentially Breaking Changes
If you are using the source map variables for "mirth_source" or "mirth_type", those have been replaced with "message_source" and "message_type, respectively.
🚀 New Feature: Message Trends
BridgeLink 4.6.0 introduces the Message Trend, A powerful new addition to BridgeLink 4.6 that provides time-series analytics and visualization of message traffic. This feature delivers critical insight into message volumes, processing patterns, and system performance, previously unavailable in the platform.
- Time-bucketed message statistics tracking (received, filtered, queued, sent, error)
- Configurable time resolution (1-minute, 5-minute, 15-minute, hourly, daily)
- Historical data retention with tiered storage policies
- Dashboard visualization with interactive charts
- Comprehensive REST API for external access
- Support for channel-level, connector-level, and server-level statistics
🚀 Updated Feature: Dynamic Lookup Gateway v2
This release introduces major enhancements to the Dynamic Lookup Gateway (DLG), delivering improved performance, data consistency, and developer productivity. DLG now offers fine-grained control over caching, atomic operations for distributed environments, and better data interoperability across systems.
- Support for fractional TTL (< 1 hour) for precise cache expiration.
- Extended JavaScript LookupHelper API including:
- deleteValue(group, key)
- createGroup(group)
- deleteGroup(group)
- deleteAllValues(group)
- importValues(group, data)
- Atomic operations for concurrency safety:
- putIfAbsent(group, key, value) – Atomic key creation
- compareAndSwap(group, key, expectedValue, newValue) – Compare and set
- updateValueByDelta(group, key, delta) – Atomic increment/decrement
- Display total number of key-value pairs across all groups.
- Automatic creation of default DLG lookup tables on initialization.
- CSV export in UTF-8 format for improved compatibility.
- Support for NVARCHAR in MS SQL Server to enhance multilingual data handling.
- DLG Audit History – Comprehensive logging of create, update, and delete operations.
- Disable Caching Option – Added support to toggle caching behavior for dynamic lookups.
- CSV Import Missing Data – Fixed an issue where some CSV files with a large number of rows failed to import all data.
- Action Column Resizing – Enforced a minimum size for the action column to prevent buttons from disappearing when the window is too small.
- Enlarged Value Field – The “Value” field on the edit screen has been expanded for easier editing.
✨ Improvements
- Introduced a Message Trends Dashboard for monitoring message flow and activity.
- Implemented new Message Trends Controller (moved logic from plugin to controller).
- #56, #58 — @thaitraninnovar
- Added support for forwarded protocol information in the web server.
- Enables accurate handling of client-forwarded headers when operating behind reverse proxies.
- #57 — @Innovarzweng
- Implemented Dynamic Lookup Gateway for real-time, flexible data lookups.
- Allows dynamic configuration of lookup rules and mappings.
- #64 — @thaitraninnovar
- Updated BridgeLink logo and branding across the application interface for a refreshed look.
🐛 Bug Fixes
- Fixed a crash when calling
LookupHelper.getMatching()on SQLServer.
#60 — @Seimax - Resolved issue where the web dashboard would fail to load after Jetty upgrade.
#67 — @joshmc82 - Fixed SQL session initialization issue in
DefaultConfigurationController.
#70 — @Innovarzweng
🧩 Related Issues
BridgeLink Repository
- [#49] BL service starts automatically after install even when unchecked
- [#45] Undocumented breaking variable name changes
- [#40] 404 Not Found when clicking “View User API”
- [#38] Enable support for forwarded protocol information in MirthWebServer
MirthConnect Repository
- [nextgenhealthcare#5875]
destinationSet.removeAllExceptdoesn’t remove destinations if no match is found
🧪 Testing & Code Quality
- Unit test coverage increased by 2% (from 18% → 20%).
- Expanded testing across key modules:
DefaultAlertControllerTest.javaDefaultChannelControllerTest.javaDefaultUserControllerTest.javaCompiledScriptCacheTest.javaGlobalChannelVariableStoreTest.javaGlobalVariableStoreTest.javaListRangeIteratorTest.javaServerUUIDGeneratorTest.javaUserSessionCacheTest.java
- Code Cleanup:
- Removed deprecated MirthCorp URL from
server/src/com/mirth/connect/client/core/ConnectServiceUtil.java
- Removed deprecated MirthCorp URL from
👋 New Contributor
Full Changelog: v4.5.4 → v4.6.0
Downloads
| OS | Arch | Download Link |
|---|---|---|
| x64 | Installer | |
| x64 | Zip | |
| x64 | RPM | |
| x64 | Tar.gz | |
| x64 | Installer | |
| ARM | Installer | |
| ARM | Tar.gz |
v4.5.4
BridgeLink 4.5.4 – Release Notes
🛡️ Security Updates
Upgraded dependencies to address the following CVEs:
- CVE-2024-22201
- CVE-2024-6763
- CVE-2024-8184
- CVE-2021-47621
- CVE-2018-1294
- CVE-2017-9801
- CVE-2025-27553
- CVE-2023-2976
- CVE-2020-8908
- CVE-2023-44487
- CVE-2025-25193
- CVE-2021-37533
- CVE-2020-15250
- CVE-2023-22102
The following JARs are included in the upgrade:
client/lib/commons-vfs2-2.10.0.jar
client/lib/guava-32.0.1-jre.jar
client/lib/jetty-util-9.4.57.v20241219.jarcommand/lib/commons-vfs2-2.10.0.jar
command/lib/guava-32.0.1-jre.jar
command/lib/jetty-util-9.4.57.v20241219.jardonkey/lib/database/mysql-connector-j-8.4.0.jar
donkey/lib/guava/guava-32.0.1-jre.jarmanager/lib/guava-32.0.1-jre.jarserver/lib/aws/ext/netty/netty-buffer-4.1.119.Final.jar
server/lib/aws/ext/netty/netty-codec-4.1.119.Final.jar
server/lib/aws/ext/netty/netty-codec-http2-4.1.119.Final.jar
server/lib/aws/ext/netty/netty-codec-http-4.1.119.Final.jar
server/lib/aws/ext/netty/netty-common-4.1.119.Final.jar
server/lib/aws/ext/netty/netty-handler-4.1.119.Final.jar
server/lib/aws/ext/netty/netty-resolver-4.1.119.Final.jar
server/lib/aws/ext/netty/netty-transport-4.1.119.Final.jar
server/lib/aws/ext/netty/netty-transport-native-epoll-4.1.119.Final-linux-x86_64.jar
server/lib/aws/ext/netty/netty-transport-native-unix-common-4.1.119.Final.jar
server/lib/commons/commons-email-1.6.0.jar
server/lib/commons/commons-net-3.9.0.jar
server/lib/commons/commons-vfs2-2.10.0.jar
server/lib/database/mysql-connector-j-8.4.0.jar
server/lib/jetty/jsp/apache-jsp-9.4.57.v20241219-sources.jar
server/lib/jetty/jetty-jndi-9.4.57.v20241219.jar
server/lib/jetty/jetty-plus-9.4.57.v20241219.jar
server/lib/jetty/jetty-security-9.4.57.v20241219.jar
server/lib/jetty/jetty-http-9.4.57.v20241219.jar
server/lib/jetty/jetty-util-ajax-9.4.57.v20241219.jar
server/lib/jetty/jetty-rewrite-9.4.57.v20241219.jar
server/lib/jetty/jetty-server-9.4.57.v20241219.jar
server/lib/jetty/jetty-annotations-9.4.57.v20241219.jar
server/lib/jetty/jetty-webapp-9.4.57.v20241219.jar
server/lib/jetty/jetty-util-9.4.57.v20241219.jar
server/lib/jetty/jetty-xml-9.4.57.v20241219.jar
server/lib/jetty/jetty-continuation-9.4.57.v20241219.jar
server/lib/jetty/jetty-io-9.4.57.v20241219.jar
server/lib/jetty/jetty-servlet-9.4.57.v20241219.jar
server/lib/classgraph-4.8.179.jar
⚠️ Note: BridgeLink now requires Java 17 or greater.
✨ Improvements
- Maintain consistent element order in exports (nextgenhealthcare#5791)
- Add two variables to the alert template variable list (nextgenhealthcare#6262)
- "Report Issue" button now links to the Issues page on the BridgeLink GitHub repository
- "Help" button now links to the Discussions page on the BridgeLink GitHub repository
🐛 Bug Fixes
- Fixed an issue where the User API page would not load correctly on macOS
🚀 New Feature
Dynamic Lookup Gateway
BridgeLink 4.5.4 introduces the Dynamic Lookup Gateway, which centralizes key-value mapping logic. It enables interface developers and administrators to:
- Create, manage, and deploy lookup tables that can be updated independently of code.
- Programmatically access lookups from channels, templates, and scripts.
- Improve maintainability, scalability, and performance by consolidating mapping logic into a unified, governed system.
This feature significantly reduces duplication and manual effort across interfaces, enhancing overall operational efficiency.
Downloads
| OS | Arch | Download Link |
|---|---|---|
| x86 | Installer | |
| x86 | Zip | |
| x64 | Installer | |
| x64 | Zip | |
| x64 | RPM | |
| x64 | Tar.gz | |
| x64 | Installer | |
| ARM | Installer | |
| ARM | Tar.gz |