⬆️ Bump h2 from 1.4.200 to 2.0.206

[dependabot]

Bumps h2 from 1.4.200 to 2.0.206.

Release notes

Sourced from h2's releases.

Version 2.0.206

Critical security issue with H2 console is fixed.

Also important changes included:

Version 2.0.204

Multilple regression fixes discovered after 2.0.202 release,

There are no persistence changes between 2.0.202 and 2.0.204, so jar file swap is enough, if database had been upgraded to 2.0.202 already, otherwise please read the message below:

Between version 1.4.200 and version 2.0.202 there have been considerable changes, such that a simple update is not possible. The official way to upgrade is to do a BACKUP of your existing database USING YOUR CURRENT VERSION OF H2. Then create a fresh database USING THE NEW VERSION OF H2, then perform a SCRIPT to load your data.

Version 2.0.202

Besides many dozens of fixed bugs, performance improvements, more adherence to a standard SQL syntax and type system, there are

Some new features:

• Complete re-work of INFORMATION_SCHEMA to be more in-line with the standard
• Support for new types: ARRAY, ROW, JAVA_OBJECT
• Numerous bit, string, array and system functions implemented
• Standard-based access to generated keys
• JDBC 4.2 compliance
• Support for JDK 7 is dropped
• PageStore is discontinued

MVStore changes:

• Descending MVMap and TransactionMap cursor
• Disk space reclamation algorithm improvements

Between version 1.4.200 and version 2.0.202 there have been considerable changes, such that a simple update is not possible. The official way to upgrade is to do a BACKUP of your existing database USING YOUR CURRENT VERSION OF H2. Then create a fresh database USING THE NEW VERSION OF H2, then perform a SCRIPT to load your data.

Commits

• 3d957a0 Release 2.0.206 preparation
• 2b6e303 Update changelog
• b24aa46 Check URL scheme
• 4a2e677 Get data types directly from linked tables from H2
• 69aff24 Fix ValueVarcharIgnoreCase.equals()
• 0ebf142 Fix group-sorted optimization for data types with different equal values
• 8aca5f4 Correct Date and Time part in tutorial.html
• 4bfd6f0 Add support of H2 2.0+ to source.html and sourceError.html
• 927c830 Update copyright years
• abac6c8 Next development version
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
0.0% Duplication

[yipkhenlai]

Hi @treo, the dependabot suggests us to update the h2 to the latest version due to security vulnerability, is that ok to do so?

[treo]

Between version 1.4.200 and version 2.0.202 there have been considerable changes, such that a simple update is not possible. The official way to upgrade is to do a BACKUP of your existing database USING YOUR CURRENT VERSION OF H2. Then create a fresh database USING THE NEW VERSION OF H2, then perform a SCRIPT to load your data.

This means we can't just update it without an additional migration step.

I think this may be a good opportunity to factor out the migration parts of the application into its own tool, otherwise we will need to hold on to old versions of things forever.

On the topic of the security vulnerability: As far as I'm aware, classifai uses H2 only in embedded mode, so the Console isn't active, therefore it isn't directly affected by it. We still should update, but it isn't quite as urgent.

[yipkhenlai]

Between version 1.4.200 and version 2.0.202 there have been considerable changes, such that a simple update is not possible. The official way to upgrade is to do a BACKUP of your existing database USING YOUR CURRENT VERSION OF H2. Then create a fresh database USING THE NEW VERSION OF H2, then perform a SCRIPT to load your data.

This means we can't just update it without an additional migration step.

I think this may be a good opportunity to factor out the migration parts of the application into its own tool, otherwise we will need to hold on to old versions of things forever.

On the topic of the security vulnerability: As far as I'm aware, classifai uses H2 only in embedded mode, so the Console isn't active, therefore it isn't directly affected by it. We still should update, but it isn't quite as urgent.

Thank you @treo for your explanation, now I understood the issue. I will put this task on hold first and will seek your advice again when we come back to classifai backend.

[dependabot]

Superseded by #544.