Upgrade to Payara 7 and Java 21

.github/workflows/container_app_pr.yml

@@ -25,7 +25,7 @@ jobs:
                   ref: 'refs/pull/${{ github.event.client_payload.pull_request.number }}/merge'
             - uses: actions/setup-java@v5
               with:
-                  java-version: "17"
+                  java-version: "21"
                   distribution: 'adopt'
             - uses: actions/cache@v4
               with:

.github/workflows/deploy_beta_testing.yml

@@ -19,7 +19,7 @@ jobs:
       - uses: actions/setup-java@v5
         with:
           distribution: 'zulu'
-          java-version: '17'
+          java-version: '21'
 
       - name: Enable API Session Auth feature flag
         working-directory: src/main/resources/META-INF
@@ -79,11 +79,11 @@ jobs:
           envs: INPUT_WAR_FILE
           script: |
             APPLICATION_NAME=dataverse-backend
-            ASADMIN='/usr/local/payara6/bin/asadmin --user admin'
+            ASADMIN='/usr/local/payara7/bin/asadmin --user admin'
             $ASADMIN undeploy $APPLICATION_NAME
             #$ASADMIN stop-domain
-            #rm -rf /usr/local/payara6/glassfish/domains/domain1/generated
-            #rm -rf /usr/local/payara6/glassfish/domains/domain1/osgi-cache
+            #rm -rf /usr/local/payara7/glassfish/domains/domain1/generated
+            #rm -rf /usr/local/payara7/glassfish/domains/domain1/osgi-cache
             #$ASADMIN start-domain
             $ASADMIN deploy --name $APPLICATION_NAME $INPUT_WAR_FILE
             #$ASADMIN stop-domain

.github/workflows/maven_unit_test.yml

@@ -29,7 +29,7 @@ jobs:
         strategy:
             fail-fast: false
             matrix:
-                jdk: [ '17' ]
+                jdk: [ '21' ]
                 experimental: [false]
                 status:  ["Stable"]
         continue-on-error: ${{ matrix.experimental }}
@@ -87,7 +87,7 @@ jobs:
         strategy:
             fail-fast: false
             matrix:
-                jdk: [ '17' ]
+                jdk: [ '21' ]
                 experimental: [ false ]
                 status: [ "Stable" ]
                 #
@@ -140,7 +140,7 @@ jobs:
           - uses: actions/checkout@v6
           - uses: actions/setup-java@v5
             with:
-                java-version: '17'
+                java-version: '21'
                 distribution: temurin
                 cache: maven
 

.github/workflows/spi_release.yml

@@ -40,7 +40,7 @@ jobs:
             - uses: actions/checkout@v6
             - uses: actions/setup-java@v5
               with:
-                  java-version: '17'
+                  java-version: '21'
                   distribution: 'adopt'
                   server-id: central
                   server-username: MAVEN_USERNAME
@@ -66,7 +66,7 @@ jobs:
             -   uses: actions/checkout@v6
             -   uses: actions/setup-java@v5
                 with:
-                    java-version: '17'
+                    java-version: '21'
                     distribution: 'adopt'
             -   uses: actions/cache@v4
                 with:
@@ -78,7 +78,7 @@ jobs:
             -   name: Set up Maven Central Repository
                 uses: actions/setup-java@v5
                 with:
-                    java-version: '17'
+                    java-version: '21'
                     distribution: 'adopt'
                     server-id: central
                     server-username: MAVEN_USERNAME

conf/jhove/jhove.conf

@@ -3,7 +3,7 @@
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xmlns="http://hul.harvard.edu/ois/xml/ns/jhove/jhoveConfig"
  xsi:schemaLocation="http://hul.harvard.edu/ois/xml/ns/jhove/jhoveConfig
-                     file:///usr/local/payara6/glassfish/domains/domain1/config/jhoveConfig.xsd">
+                     file:///usr/local/payara7/glassfish/domains/domain1/config/jhoveConfig.xsd">
  <jhoveHome>/usr/local/src/jhove</jhoveHome>
  <defaultEncoding>utf-8</defaultEncoding>
  <tempDirectory>/tmp</tempDirectory>

doc/release-notes/12020-Payara-and-Java-updates.md

@@ -0,0 +1,36 @@
+### Payara 7.x and Java 21 support
+
+This version of Dataverse has a minimal requirement of Payara 7.2026.1 and Java 21. (Later versions may work.)
+
+#### Update Instructions:
+
+In addition to the standard Payara update instructions and instructions related to Java 21 (do we say more than install Java 21 following standard guidance for your OS?):
+
+Either update to put Payara in a /usr/local/payara7 dir or perhaps drop to just /usr/local/payara (at QDR /usr/local/payara is a symbolic link so we can change versions easily)
+Any reference to payara6 has to change, e.g. if counter-processor is deployed, the paths in counter-processor-config.yaml and counter_daily.sh have to be updated. 
+
+Copy the following files from the distributed domain.xml version to your domain. I don't know if all of these are required but we don't edit these by default and they have changed over time.
+As with the 6.9 release, at least updating the *.p12 files is important (to get new root certs).
+cacerts.p12
+default-web.xml
+glassfish-acc.xml
+javaee.server.policy
+keyfile
+keystore.p12
+login.conf
+restrict.server.policy
+server.policy
+wss-server-config-1.0.xml
+wss-server-config-2.0.xml
+
+Make the following changes to your domain.xml file:
+
+In the <config name="server-config"> element (and optionally again in the <config name="default-config"> element):
+
+1) Change
+<jacc-provider policy-provider="fish.payara.security.jacc.provider.PolicyProviderImpl" name="default" policy-configuration-factory-provider="fish.payara.security.jacc.provider.PolicyConfigurationFactoryImpl"></jacc-provider>
+to 
+<jacc-provider policy-provider="org.glassfish.exousia.modules.def.DefaultPolicy" name="default" policy-configuration-factory-provider="org.glassfish.exousia.modules.def.DefaultPolicyConfigurationFactory"></jacc-provider>
+
+2) Add the jvm option:
+<jvm-options>-Djakarta.security.jacc.PolicyFactory.provider=org.glassfish.exousia.modules.def.DefaultPolicyFactory</jvm-options>

doc/sphinx-guides/source/_static/admin/counter-processor-config.yaml

@@ -1,8 +1,8 @@
 # currently no other option but to have daily logs and have year-month-day format in the name with
 # 4-digit year and 2-digit month and day
-# /usr/local/payara6/glassfish/domains/domain1/logs/counter_2019-01-11.log
+# /usr/local/payara7/glassfish/domains/domain1/logs/counter_2019-01-11.log
 #log_name_pattern: sample_logs/counter_(yyyy-mm-dd).log
-log_name_pattern: /usr/local/payara6/glassfish/domains/domain1/logs/mdc/counter_(yyyy-mm-dd).log
+log_name_pattern: /usr/local/payara7/glassfish/domains/domain1/logs/mdc/counter_(yyyy-mm-dd).log
 
 # path_types regular expressions allow matching to classify page urls as either an investigation or request
 # based on specific URL structure for your system.

doc/sphinx-guides/source/_static/installation/files/etc/init.d/payara.init.root

@@ -4,7 +4,7 @@
 
 set -e
 
-ASADMIN=/usr/local/payara6/bin/asadmin
+ASADMIN=/usr/local/payara7/bin/asadmin
 
 case "$1" in
   start)

doc/sphinx-guides/source/_static/installation/files/etc/init.d/payara.init.service

@@ -3,7 +3,7 @@
 # description: Payara App Server
 set -e
 
-ASADMIN=/usr/local/payara6/bin/asadmin
+ASADMIN=/usr/local/payara7/bin/asadmin
 APP_SERVER_USER=dataverse
 
 case "$1" in

doc/sphinx-guides/source/_static/installation/files/etc/systemd/payara.service

@@ -4,9 +4,9 @@ After = syslog.target network.target
 
 [Service]
 Type = forking
-ExecStart = /usr/bin/java -jar /usr/local/payara6/glassfish/lib/client/appserver-cli.jar start-domain
-ExecStop = /usr/bin/java -jar /usr/local/payara6/glassfish/lib/client/appserver-cli.jar stop-domain
-ExecReload = /usr/bin/java -jar /usr/local/payara6/glassfish/lib/client/appserver-cli.jar restart-domain
+ExecStart = /usr/bin/java -jar /usr/local/payara7/glassfish/lib/client/appserver-cli.jar start-domain
+ExecStop = /usr/bin/java -jar /usr/local/payara7/glassfish/lib/client/appserver-cli.jar stop-domain
+ExecReload = /usr/bin/java -jar /usr/local/payara7/glassfish/lib/client/appserver-cli.jar restart-domain
 User=dataverse
 LimitNOFILE=32768
 Environment="LANG=en_US.UTF-8"

doc/sphinx-guides/source/_static/util/clear_timer.sh

@@ -8,7 +8,7 @@
 # if you'd like to avoid that.
 
 # directory where Payara is installed
-PAYARA_DIR=/usr/local/payara6
+PAYARA_DIR=/usr/local/payara7
 
 # directory within Payara (defaults)
 DV_DIR=${PAYARA_DIR}/glassfish/domains/domain1

doc/sphinx-guides/source/_static/util/counter_daily.sh

@@ -2,7 +2,7 @@
 #counter_daily.sh
 
 COUNTER_PROCESSOR_DIRECTORY="/usr/local/counter-processor-1.06"
-MDC_LOG_DIRECTORY="/usr/local/payara6/glassfish/domains/domain1/logs/mdc"
+MDC_LOG_DIRECTORY="/usr/local/payara7/glassfish/domains/domain1/logs/mdc"
 COUNTER_PROCESSOR_TMP_DIRECTORY="/tmp"
 # If you wish to keep the logs, use a directory that is not periodically cleaned, e.g.
 #COUNTER_PROCESSOR_TMP_DIRECTORY="/usr/local/counter-processor-1.06/tmp"

doc/sphinx-guides/source/admin/harvestclients.rst

@@ -45,16 +45,16 @@ For example:
 
 .. code-block:: bash
 
-  sudo touch /usr/local/payara6/glassfish/domains/domain1/logs/stopharvest_bigarchive.70916
-  sudo chown dataverse /usr/local/payara6/glassfish/domains/domain1/logs/stopharvest_bigarchive.70916
+  sudo touch /usr/local/payara7/glassfish/domains/domain1/logs/stopharvest_bigarchive.70916
+  sudo chown dataverse /usr/local/payara7/glassfish/domains/domain1/logs/stopharvest_bigarchive.70916
 
 Note: If the application server is stopped and restarted, any running harvesting jobs will be killed but may remain marked as in progress in the database. We thus recommend using the mechanism here to stop ongoing harvests prior to a server restart.
 
 
 What if a Run Fails?
 ~~~~~~~~~~~~~~~~~~~~
 
-Each harvesting client run logs a separate file per run to the app server's default logging directory (``/usr/local/payara6/glassfish/domains/domain1/logs/`` unless you've changed it). Look for filenames in the format  ``harvest_TARGET_YYYY_MM_DD_timestamp.log`` to get a better idea of what's going wrong.
+Each harvesting client run logs a separate file per run to the app server's default logging directory (``/usr/local/payara7/glassfish/domains/domain1/logs/`` unless you've changed it). Look for filenames in the format  ``harvest_TARGET_YYYY_MM_DD_timestamp.log`` to get a better idea of what's going wrong.
 
 Note that you'll want to run a minimum of Dataverse Software 4.6, optimally 4.18 or beyond, for the best OAI-PMH interoperability.
 

doc/sphinx-guides/source/admin/make-data-count.rst

@@ -72,7 +72,7 @@ Enable or Disable Display of Make Data Count Metrics
 
 By default, when MDC logging is enabled (when ``:MDCLogPath`` is set), your Dataverse installation will display MDC metrics instead of it's internal (legacy) metrics. You can avoid this (e.g. to collect MDC metrics for some period of time before starting to display them) by setting ``:DisplayMDCMetrics`` to false.
 
-The following discussion assumes ``:MDCLogPath`` has been set to ``/usr/local/payara6/glassfish/domains/domain1/logs/mdc``
+The following discussion assumes ``:MDCLogPath`` has been set to ``/usr/local/payara7/glassfish/domains/domain1/logs/mdc``
 You can also decide to display MDC metrics along with Dataverse's traditional download counts from the time before MDC was enabled. To do this, set the :ref:`:MDCStartDate` to when you started MDC logging.
 
 Configure Counter Processor
@@ -103,7 +103,7 @@ Soon we will be setting up a cron job to run nightly but we start with a single
 
 * If you are running Counter Processor for the first time in the middle of a month, you will need create blank log files for the previous days. e.g.:
 
-  * ``cd /usr/local/payara6/glassfish/domains/domain1/logs/mdc``
+  * ``cd /usr/local/payara7/glassfish/domains/domain1/logs/mdc``
 
   * ``touch counter_2019-02-01.log``
 

doc/sphinx-guides/source/admin/troubleshooting.rst

@@ -53,13 +53,13 @@ Long-Running Ingest Jobs Have Exhausted System Resources
 
 Ingest is both CPU- and memory-intensive, and depending on your system resources and the size and format of tabular data files uploaded, may render your Dataverse installation unresponsive or nearly inoperable. It is possible to cancel these jobs by purging the ingest queue.
 
-``/usr/local/payara6/mq/bin/imqcmd -u admin query dst -t q -n DataverseIngest`` will query the DataverseIngest destination. The password, unless you have changed it, matches the username.
+``/usr/local/payara7/mq/bin/imqcmd -u admin query dst -t q -n DataverseIngest`` will query the DataverseIngest destination. The password, unless you have changed it, matches the username.
 
-``/usr/local/payara6/mq/bin/imqcmd -u admin purge dst -t q -n DataverseIngest`` will purge the DataverseIngest queue, and prompt for your confirmation.
+``/usr/local/payara7/mq/bin/imqcmd -u admin purge dst -t q -n DataverseIngest`` will purge the DataverseIngest queue, and prompt for your confirmation.
 
 Finally, list destinations to verify that the purge was successful:
 
-``/usr/local/payara6/mq/bin/imqcmd -u admin list dst``
+``/usr/local/payara7/mq/bin/imqcmd -u admin list dst``
 
 .. _troubleshooting-payara:
 
@@ -71,7 +71,7 @@ Payara
 Finding the Payara Log File
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-``/usr/local/payara6/glassfish/domains/domain1/logs/server.log`` is the main place to look when you encounter problems (assuming you installed Payara in the default directory). Hopefully an error message has been logged. If there's a stack trace, it may be of interest to developers, especially they can trace line numbers back to a tagged version or commit. Send more of the stack trace (the entire file if possible) to developers who can help (see "Getting Help", below) and be sure to say which version of the Dataverse Software you have installed.
+``/usr/local/payara7/glassfish/domains/domain1/logs/server.log`` is the main place to look when you encounter problems (assuming you installed Payara in the default directory). Hopefully an error message has been logged. If there's a stack trace, it may be of interest to developers, especially they can trace line numbers back to a tagged version or commit. Send more of the stack trace (the entire file if possible) to developers who can help (see "Getting Help", below) and be sure to say which version of the Dataverse Software you have installed.
 
 .. _increase-payara-logging:
 

doc/sphinx-guides/source/container/dev-usage.rst

@@ -216,7 +216,7 @@ Note that using this method, you may redeploy a complete WAR or single methods.
 Redeploying WARs supports swapping and adding classes and non-code materials, but is slower (still faster than rebuilding containers).
 Hotswapping methods requires using JDWP (Debug Mode), but does not allow switching non-code material or adding classes.
 
-#. | Download the version of Payara shown in :ref:`install-payara-dev` and unzip it to a reasonable location such as ``/usr/local/payara6``.
+#. | Download the version of Payara shown in :ref:`install-payara-dev` and unzip it to a reasonable location such as ``/usr/local/payara7``.
    | - Note that Payara can also be downloaded from `Maven Central <https://mvnrepository.com/artifact/fish.payara.distributions/payara>`_.
    | - Note that another way to check the expected version of Payara is to run this command:
    |   ``mvn help:evaluate -Dexpression=payara.version -q -DforceStdout``
@@ -247,7 +247,7 @@ Hotswapping methods requires using JDWP (Debug Mode), but does not allow switchi
    .. tabs::
      .. group-tab:: Netbeans
 
-        Launch Netbeans and click "Tools" and then "Servers". Click "Add Server" and select "Payara Server" and set the installation location to ``/usr/local/payara6`` (or wherever you unzipped Payara). Choose "Remote Domain". Use the settings in the screenshot below. Most of the defaults are fine.
+        Launch Netbeans and click "Tools" and then "Servers". Click "Add Server" and select "Payara Server" and set the installation location to ``/usr/local/payara7`` (or wherever you unzipped Payara). Choose "Remote Domain". Use the settings in the screenshot below. Most of the defaults are fine.
 
         Under "Common", the username and password should be "admin". Make sure "Enable Hot Deploy" is checked.
 
@@ -423,4 +423,4 @@ as the endpoint. Here are links to the most common IDEs docs on remote debugging
 Building Your Own Base Image
 ----------------------------
 
-If you find yourself tasked with upgrading Payara, you will need to create your own base image before running the :ref:`container-dev-quickstart`. For instructions, see :doc:`base-image`.
+If you find yourself tasked with upgrading Payara (or reviewing or testing such an upgrade), you will need to create your own base image before running the :ref:`container-dev-quickstart`. For instructions, see :ref:`base-image-build-instructions` under :doc:`base-image`.

doc/sphinx-guides/source/developers/classic-dev-env.rst

@@ -37,7 +37,7 @@ Windows is gaining support through Docker as described in the :doc:`windows` sec
 Install Java
 ~~~~~~~~~~~~
 
-The Dataverse Software requires Java 17.
+The Dataverse Software requires Java 21.
 
 We suggest downloading OpenJDK from https://adoptopenjdk.net
 
@@ -93,17 +93,17 @@ On Linux, install ``jq`` from your package manager or download a binary from htt
 Install Payara
 ~~~~~~~~~~~~~~
 
-Payara 6.2025.10 or higher is required.
+Payara 7.2026.1 or higher is required.
 
 To install Payara, run the following commands:
 
 ``cd /usr/local``
 
-``sudo curl -O -L https://nexus.payara.fish/repository/payara-community/fish/payara/distributions/payara/6.2025.10/payara-6.2025.10.zip``
+``sudo curl -O -L https://nexus.payara.fish/repository/payara-community/fish/payara/distributions/payara/7.2026.1/payara-7.2026.1.zip``
 
-``sudo unzip payara-6.2025.10.zip``
+``sudo unzip payara-7.2026.1.zip``
 
-``sudo chown -R $USER /usr/local/payara6``
+``sudo chown -R $USER /usr/local/payara7``
 
 If nexus.payara.fish is ever down for maintenance, Payara distributions are also available from https://repo1.maven.org/maven2/fish/payara/distributions/payara/
 
@@ -113,7 +113,7 @@ Install Service Dependencies Directly on localhost
 Install PostgreSQL
 ^^^^^^^^^^^^^^^^^^
 
-The Dataverse Software has been tested with PostgreSQL versions up to 17. PostgreSQL version 10+ is required.
+The Dataverse Software has been tested with PostgreSQL versions up to 21. PostgreSQL version 10+ is required.
 
 On Mac, go to https://www.postgresql.org/download/macosx/ and choose "Interactive installer by EDB" option. Note that version 16 is used in the command line examples below, but the process should be similar for other versions. When prompted to set a password for the "database superuser (postgres)" just enter "password".
 

doc/sphinx-guides/source/developers/dev-environment.rst

@@ -12,7 +12,7 @@ These instructions are oriented around Docker but the "classic" instructions we
 Quickstart
 ----------
 
-First, install Java 17, Maven, and Docker.
+First, install Java 21, Maven, and Docker.
 
 After cloning the `dataverse repo <https://github.com/IQSS/dataverse>`_, run this:
 
@@ -32,9 +32,9 @@ Detailed Steps
 Install Java
 ~~~~~~~~~~~~
 
-The recommended version is Java 17 because it's the version we test with. See https://github.com/IQSS/dataverse/pull/9764.
+The recommended version is Java 21 because it's the version we test with. See https://github.com/IQSS/dataverse/pull/12043.
 
-On Mac and Windows, we suggest using `SDKMAN <https://sdkman.io>`_ to install Temurin (Eclipe's name for its OpenJDK distribution). Type ``sdk install java 17`` and then hit the "tab" key until you get to a version that ends with ``-tem`` and then hit enter.
+On Mac and Windows, we suggest using `SDKMAN <https://sdkman.io>`_ to install Temurin (Eclipe's name for its OpenJDK distribution). Type ``sdk install java 21`` and then hit the "tab" key until you get to a version that ends with ``-tem`` and then hit enter. If you don't set this version as the default, you will need to type ``sdk use java 21`` and then hit the tab to autocomplete the version.
 
 Alternatively you can download Temurin from https://adoptium.net (formerly `AdoptOpenJDK <https://adoptopenjdk.net>`_).