Merge remote-tracking branch 'origin/develop' into fb_mail_transport_via_graph

Author: labkey-bpatel

CLAUDE.md

@@ -0,0 +1,112 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+LabKey Server is a large Java web application platform for biomedical research data management. It uses a modular monolith architecture with 150+ Gradle modules, built on Spring Boot 4 / Spring Framework 7 with embedded Tomcat 11. It targets Java 25 and supports both PostgreSQL and MS SQL Server databases.
+
+## Build Commands
+
+```bash
+# Configure IntelliJ IDEA project files
+./gradlew ijConfigure
+
+# Select database (populates application.properties from templates)
+./gradlew pickPg          # PostgreSQL
+./gradlew pickMssql       # MS SQL Server
+
+# Build and deploy to embedded Tomcat
+./gradlew deployApp
+
+# Build a specific module
+./gradlew :server:modules:platform:core:build
+
+# Build with a predefined module set
+./gradlew -PmoduleSet=community build
+
+# Exclude test modules for faster builds
+./gradlew -PexcludeTestModules build
+
+# Build a distribution
+./gradlew -PmoduleSet=distributions :distributions:base:dist
+```
+
+## Running Tests
+
+**Unit tests** are static `TestCase` inner classes within production source files. They are registered via the module's `getUnitTests()` method and run within the server JVM.
+
+**Integration tests** require a running server and database. They are registered via `getIntegrationTests()`.
+
+**Selenium UI tests** (in `server/testAutomation/`):
+```bash
+./gradlew :server:testAutomation:initProperties    # Generate test.properties
+./gradlew :server:testAutomation:uiTests -Psuite=DRT   # Run a test suite
+```
+UI tests require a running LabKey server, a browser driver (ChromeDriver or Geckodriver) on PATH, and configured `test.properties`.
+
+## Architecture
+
+### Module System
+
+Each module lives under `server/modules/` and contains:
+- `module.properties` — metadata including `ModuleClass`, `SchemaVersion`, `SupportedDatabases`
+- `build.gradle` — uses `org.labkey.build.module` plugin
+- A module class extending `SpringModule` (which extends `DefaultModule` implementing `Module`)
+
+Module lifecycle methods in order: `init()` → `versionUpdate()` → `afterUpdate()` → `startup()` → `startupAfterSpringConfig()` → `startBackgroundThreads()` → `destroy()`
+
+In `init()`, modules register controllers via `addController("name", Controller.class)` and set up service implementations. Controllers follow the pattern `*Controller.java`.
+
+### Core Platform Modules (`server/modules/platform/`)
+
+The `api` module provides the core framework (Module interface, SpringModule base class, services, utilities). Other key platform modules: `core` (auth, security, admin), `query` (SQL engine), `experiment`, `study`, `assay`, `pipeline` (job processing), `search`, `audit`, `visualization`.
+
+### Entry Point
+
+`server/embedded/src/org/labkey/embedded/LabKeyServer.java` — a `@SpringBootApplication` that configures embedded Tomcat, SSL/TLS, Content Security Policy, and Log4J2.
+
+### Database
+
+Dual database support (PostgreSQL and MS SQL Server). Configuration lives in `server/configs/application.properties`, populated by `pickPg`/`pickMssql` tasks from `pg.properties`/`mssql.properties` templates. Each module declares its `SchemaVersion` in `module.properties` and manages its own schema migrations.
+
+### Frontend
+
+Mix of JSPs, React (via `@labkey/components`), and ExtJS. Modules with JavaScript/TypeScript have their own `package.json` and use npm builds. Node.js and npm versions are pinned in `gradle.properties` and downloaded during build.
+
+### Distributions
+
+The `distributions/` directory defines 60+ distribution configurations that select which modules to package. Distributions inherit from each other (most inherit from `:distributions:base`). Distribution directory names must not collide with module names.
+
+### Dependency Management
+
+All external library versions are centralized in `gradle.properties` (200+ version properties). The root `build.gradle` forces consistent versions across all modules via `resolutionStrategy`. Always consult before adding, removing, or updating a third-party dependency.
+
+## Coding Conventions
+
+- **Java Streams**: Prefer `Stream` API over traditional for-loops for collection processing.
+- **Resources**: Use try-with-resources for automatic resource management.
+- **Nullability**: Use `org.jetbrains.annotations.NotNull` and `@Nullable`. Be explicit in public API signatures.
+- **Logging**: Use Log4J2. Name the static logger `LOG`, initialized via `LogHelper.getLogger()`:
+  ```java
+  private static final Logger LOG = LogHelper.getLogger(MyClass.class, "optional description");
+  ```
+- **Unit tests**: Create a static `TestCase` inner class extending `Assert` in the same file as production code. Use JUnit 4 annotations (`@Test`). Register new test classes in the owning module's `getUnitTests()`.
+- **Selenium tests**: Subclass `BaseWebDriverTest`. Use a `@BeforeClass` for setup and override `doCleanup()` for cleanup. See `SecurityTest` as an example.
+- **Formatting**: Follow IntelliJ IDEA project settings in `.idea/codeStyles/Project.xml`.
+
+## Key Build Properties (`gradle.properties`)
+
+- `sourceCompatibility`/`targetCompatibility`: Java 25
+- `buildFromSource`: true (build modules from source vs. pulling artifacts)
+- `useLocalBuild`: use locally built artifacts
+- `moduleSet`: select a predefined set of modules (e.g., `community`, `all`, `distributions`)
+- `excludedModules`: comma-separated list of modules to exclude
+
+## Search Tips
+
+When searching for Java method usages, always include `*.jsp` and `*.jspf` files in addition to `*.java`. JSP files contain inline Java code and are significant callers of API methods (especially anything in `JspBase`).
+
+## Pull Request Format
+
+PRs should include sections for: **Rationale** (why the change is needed), **Related Pull Requests**, and **Changes** (notable items).

gradle.properties

@@ -44,7 +44,7 @@ buildFromSource=true
 
 # The default version for LabKey artifacts that are built or that we depend on.
 # override in an individual module's gradle.properties file as necessary 
-labkeyVersion=26.2-SNAPSHOT
+labkeyVersion=26.3-SNAPSHOT
 labkeyClientApiVersion=7.1.0
 
 # Version numbers for the various binary artifacts that are included when
@@ -60,7 +60,7 @@ windowsProteomicsBinariesVersion=1.0
 artifactoryPluginVersion=5.2.5
 gradleNodePluginVersion=7.1.0
 gradlePluginsVersion=7.3.0
-owaspDependencyCheckPluginVersion=12.1.9
+owaspDependencyCheckPluginVersion=12.2.0
 
 # Versions of node and npm to use during the build. If set, these versions
 # will be downloaded and used. If not set, the existing local installations will be used
@@ -97,35 +97,35 @@ mockitoVersion=5.14.2
 
 annotationsVersion=15.0
 
-antVersion=1.10.13
+antVersion=1.10.15
 
 antlrST4Version=4.3.4
 
 #Unifying version used by DISCVR and Premium
 apacheDirectoryVersion=2.1.7
 #Transitive dependency of Apache directory: 2.0.18 contains some regressions
-apacheMinaVersion=2.2.4
+apacheMinaVersion=2.2.5
 
 # Usually matches the version specified as a Spring Boot dependency (see springBootVersion below)
-apacheTomcatVersion=11.0.15
+apacheTomcatVersion=11.0.18
 
 # (mothership) -> json-path -> json-smart -> accessor-smart
 # (core) -> graalvm
 # tika
-asmVersion=9.9
+asmVersion=9.9.1
 
 # Apache Batik -- Batik version needs to be compatible with Apache FOP, but we need to pull in batik-codec separately
 batikVersion=1.19
 
 # sync with Tika version (or later)
-bouncycastlePgpVersion=1.82
-bouncycastleVersion=1.82
+bouncycastlePgpVersion=1.83
+bouncycastleVersion=1.83
 
 cglibNodepVersion=2.2.3
 
-checkerQualVersion=3.31.0
+checkerQualVersion=3.53.0
 
-commonmarkVersion=0.27.0
+commonmarkVersion=0.27.1
 
 # the beanutils version is not the default version brought from commons-validator and/or commons-digester
 # in the :server:api module but is required for some of our code to compile
@@ -147,9 +147,9 @@ commonsTextVersion=1.15.0
 commonsValidatorVersion=1.10.1
 commonsVfs2Version=2.10.0
 
-datadogVersion=1.56.3
+datadogVersion=1.58.2
 
-dom4jVersion=2.1.4
+dom4jVersion=2.2.0
 
 ehcacheCoreVersion=2.6.8
 eigenbasePropertiesVersion=1.1.6
@@ -163,10 +163,10 @@ fopVersion=2.11
 
 # Force latest for consistency
 googleApiVersion=2.47.0
-googleAuthVersion=1.33.0
+googleAuthVersion=1.40.0
 googleAutoValueAnnotationsVersion=1.10.4
-googleErrorProneAnnotationsVersion=2.45.0
-googleHttpClientVersion=2.0.2
+googleErrorProneAnnotationsVersion=2.46.0
+googleHttpClientVersion=2.1.0
 googleOauthClientVersion=1.39.0
 googleProtocolBufVersion=3.25.8
 
@@ -176,7 +176,7 @@ googleProtocolBufVersion=3.25.8
 # "java.lang.NoSuchMethodError: 'void com.google.gson.internal.ConstructorConstructor.<init>(java.util.Map)'" errors
 gsonVersion=2.8.9
 
-grpcVersion=1.77.0
+grpcVersion=1.78.0
 
 guavaVersion=33.5.0-jre
 
@@ -192,8 +192,8 @@ hamcrestVersion=2.2
 # Note: if changing this, we might need to match with the picard version in the SequenceAnalysis module build.gradle
 htsjdkVersion=4.3.0
 
-httpclient5Version=5.5.1
-httpcore5Version=5.3.6
+httpclient5Version=5.5.2
+httpcore5Version=5.4
 
 # Not used directly, but these are widely used transitive dependencies
 httpclientVersion=4.5.14
@@ -202,12 +202,12 @@ httpcoreVersion=4.4.16
 intellijKotlinVersion=1.9.10
 
 # Update the three Jackson dependency versions below in tandem, unless one gets a patch release out-of-sync with the others
-jacksonVersion=2.20.1
-jacksonDatabindVersion=2.20.1
-jacksonJaxrsBaseVersion=2.20.1
+jacksonVersion=2.21.0
+jacksonDatabindVersion=2.21.0
+jacksonJaxrsBaseVersion=2.21.0
 
 # Note the inconsistent version numbering for "annotations"... it no longer matches the above
-jacksonAnnotationsVersion=2.20
+jacksonAnnotationsVersion=2.21
 
 # The Jakarta Activation API version that Angus Activation implements. Keep in sync with angusActivationVersion (above).
 jakartaActivationApiVersion=2.1.4
@@ -224,7 +224,7 @@ jaxbOldVersion=2.3.3
 
 # All other direct and indirect uses of JAXB use the current, jakarta-packaged versions
 jaxbApiVersion=4.0.4
-jaxbVersion=4.0.5
+jaxbVersion=4.0.6
 
 jaxrpcVersion=1.1
 
@@ -240,9 +240,9 @@ jodaTimeVersion=2.14.0
 # brought in transitively by Cloud, FileTransfer, SequenceAnalysis, etc. Need to resolve consistently
 jsr305Version=3.0.2
 
-orgJsonVersion=20250517
+orgJsonVersion=20251224
 
-jsoupVersion=1.21.2
+jsoupVersion=1.22.1
 
 junitVersion=4.13.2
 
@@ -272,8 +272,7 @@ poiVersion=5.4.0
 
 pollingWatchVersion=0.2.0
 
-# Newer versions of the driver have a perf degradation that's important for us. https://github.com/pgjdbc/pgjdbc/issues/3505
-postgresqlDriverVersion=42.7.8
+postgresqlDriverVersion=42.7.9
 
 quartzVersion=2.5.2
 
@@ -296,17 +295,17 @@ slf4jLog4jApiVersion=2.0.17
 snappyJavaVersion=1.1.10.8
 
 # Also, update apacheTomcatVersion above to match Spring Boot's Tomcat dependency version
-springBootVersion=4.0.1
+springBootVersion=4.0.2
 # This usually matches the Spring Framework version dictated by springBootVersion
-springVersion=7.0.2
+springVersion=7.0.3
 springAiVersion=1.1.2
 
 sqliteJdbcVersion=3.51.1.0
 
 # NLP and SAML bring stax2-api in as a transitive dependency but with very different versions. We force the later version.
 stax2ApiVersion=4.2.2
 
-thumbnailatorVersion=0.4.20
+thumbnailatorVersion=0.4.21
 
 # used for tika-core in API and tika-parsers in search
 tikaVersion=3.2.3

gradle/wrapper/gradle-wrapper.jar

@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.3.0-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.3.1-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME