{"id":13848374,"url":"https://github.com/swaldman/c3p0","last_synced_at":"2026-10-19T14:09:55.127Z","repository":{"id":3272805,"uuid":"4312278","full_name":"swaldman/c3p0","owner":"swaldman","description":"a mature, highly concurrent JDBC Connection pooling library, with support for caching and reuse of PreparedStatements.","archived":false,"fork":false,"pushed_at":"2026-10-10T04:13:31.000Z","size":5467,"stargazers_count":1318,"open_issues_count":74,"forks_count":343,"subscribers_count":100,"default_branch":"0.15.x","last_synced_at":"2026-10-12T16:24:20.519Z","etag":null,"topics":["connection-management","connection-pool","connection-pooling","java","jdbc"],"latest_commit_sha":null,"homepage":"http://www.mchange.com/projects/c3p0","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/swaldman.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"claude":null,"gemini":null,"cursor":null,"copilot":null,"dco":null,"cla":null,"disclosure":null}},"created_at":"2012-05-13T05:20:50.000Z","updated_at":"2026-10-10T04:13:35.000Z","dependencies_parsed_at":"2026-09-23T04:45:25.815Z","dependency_job_id":null,"html_url":"https://github.com/swaldman/c3p0","commit_stats":{"total_commits":528,"total_committers":8,"mean_commits":66.0,"dds":"0.12878787878787878","last_synced_commit":"1d23f73c348d12cdba643996d017acaf9183129b"},"previous_names":[],"tags_count":84,"template":false,"template_full_name":null,"purl":"pkg:github/swaldman/c3p0","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/swaldman%2Fc3p0","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/swaldman%2Fc3p0/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/swaldman%2Fc3p0/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/swaldman%2Fc3p0/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/swaldman","download_url":"https://codeload.github.com/swaldman/c3p0/tar.gz/refs/heads/0.15.x","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/swaldman%2Fc3p0/sbom","scorecard":{"id":861531,"data":{"date":"2025-08-11","repo":{"name":"github.com/swaldman/c3p0","commit":"b2d6a1b72487ab823f4c601b628bc4e3d6a772db"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":4.3,"checks":[{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Token-Permissions","score":-1,"reason":"No tokens found","details":null,"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Maintained","score":10,"reason":"22 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Dangerous-Workflow","score":-1,"reason":"no workflows found","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Code-Review","score":0,"reason":"Found 1/29 approved changesets -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Pinned-Dependencies","score":-1,"reason":"no dependencies found","details":null,"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"License","score":9,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Warn: project license file does not contain an FSF or OSI license."],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch '0.11.x'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 2 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-24T01:26:44.840Z","repository_id":3272805,"created_at":"2025-08-24T01:26:44.841Z","updated_at":"2025-08-24T01:26:44.841Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":343843146,"owners_count":38269344,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-10-03T21:59:58.778Z","status":"online","status_checked_at":"2026-10-13T02:00:04.984Z","response_time":52,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["connection-management","connection-pool","connection-pooling","java","jdbc"],"created_at":"2024-08-04T19:00:47.871Z","updated_at":"2026-10-19T14:09:55.120Z","avatar_url":"https://github.com/swaldman.png","language":"Java","funding_links":[],"categories":["Java","数据库开发"],"sub_categories":[],"readme":"# c3p0\n\n```plaintext\n _____________________________________\n   .................................\n   ..(c3p0).........................\n   ............a.........fresh......\n   ....coat.......of........stucco..\n   .........over.......that.....old.\n   ...jdbc........driver............\n   .................................\n -------------------------------------\n```\n\n\u003e [!WARNING]\n\u003e c3p0 and its dependencies have been used as [deserialization gadgets](https://medium.com/@dub-flow/deserialization-what-the-heck-actually-is-a-gadget-chain-1ea35e32df69).\n\u003e Please see [the docs](https://www.mchange.com/projects/c3p0/#security-note) for more information.\n\u003e The vulnerabilities that enable this are addressed as of c3p0-0.12.0.\n\u003e\n\u003e c3p0-0.13.0 eliminates from c3p0's `CLASSPATH`\n\u003e the `javax.naming.Reference` \u0026rarr; Java serialization pipeline that makes possible the mischief.\n\u003e\n\u003e c3p0-0.14.0 further hardens JNDI and serialization-related utilities, and prevents attacks that\n\u003e rely on JavaBeans-related libraries triggering `getConnection()` or `getPooledConnection()`\n\u003e on maliciously constructed `DataSource` instances.\n\u003e\n\u003e Please update your applications!\n\nc3p0 is a mature, highly concurrent JDBC Connection pooling library, with\nsupport for caching and reuse of `PreparedStatement` objects.\n\nc3p0 is available as managed dependency on Maven Central,\n\u003ccode\u003e[groupId: com.mchange, artifactId: c3p0]\u003c/code\u003e For available versions, look [here](https://oss.sonatype.org/content/repositories/releases/com/mchange/c3p0/).\n\nPlease see the [documentation](http://www.mchange.com/projects/c3p0/) for more.\n\nFrom the current *development snapshot*, here is the latest [CHANGELOG](CHANGELOG).\n\nPlease address comments and questions to the [library author](mailto:swaldman@mchange.com).\n\nHowever, please keep in mind he is an abysmal correspondent and basically an asshole.\n\nDespite that, your feedback is very much appreciated. Pull requests are gratefully accepted. You may also open issues.\n\nThank you for your interest in c3p0. I do hope that you find it useful!\n\n### Building c3p0\n\nFor now (v0.15.0), c3p0 is built under a Java 11 VM, targetting JDK 7 classfiles for continued compatibility with legacy apps.\n\nc3p0 relies on the excellent build tool [`mill`](https://mill-build.com/).\n\nYou do not need to install it. `./mill`, the launcher in this repository, fetches the version\nthe build pins; a `mill` on your PATH may be too old to parse `build.mill`. Within this\nrepository directory, run\n\n```plaintext\n$ ./mill jar\n```\n\nYou'll find the raw as library `out/jar.dest/out.jar`.\n\nIf you maintain a local ivy repository, You can customize `publishVersion` in [`build.mill`](build.mill), then run\n\n```plaintext\n$ ./mill publishLocal\n```\n\nTo build the documentation\n\n```plaintext\n$ ./mill doc.docroot\n```\n\nYou can then open in your browser `out/doc/docroot.dest/index.html`\n\n### Build freshness\n\nMuch of c3p0 is generated during the build: a `Debug` class per package beneath `src`, JavaBean base\nclasses from the `beangen-xml` files, explicit `BeanInfo`s reflected off those compiled beans, and the\nJDBC proxies. You should never need `./mill clean` to get a correct jar out of that. To verify it:\n\n```plaintext\n$ ./checkBuildFreshness\n```\n\nIt perturbs a build input of each kind — a new package under `src`, a new property in a\n`beangen-xml`, a change to generator code — and checks that an incremental build afterwards matches\na clean build of the same sources, that the perturbation really did move the output, and that\nreverting restores the artifacts bit for bit. It takes well under a minute, exits nonzero on\nfailure, and leaves your working tree as it found it.\n\n### Reproducible builds\n\nc3p0 supports reproducible builds of its binary and source jar files.\n(It does not yet support reproducible builds of doc jars.)\n\nTo prevent everchanging timestamps, set the environment variable\n[`SOURCE_DATE_EPOCH`](https://reproducible-builds.org/docs/source-date-epoch/)\nwhen building.\n\nThe build reads `SOURCE_DATE_EPOCH` from the environment of the `./mill` command you invoke, and\ntreats it as a build input, so changing it is itself a reason to regenerate. Neither the `-i` flag\nnor a clean build is required. So, for example\n\n```plaintext\n$ export SOURCE_DATE_EPOCH=1234567890\n$ ./mill jar\n$ ./mill sourceJar\n```\n\nThe files `out/jar.dest/out.jar` and `out/sourceJar.dest/out.jar` will have been deterministically and reproducibly built.\n\n### Testing c3p0\n\nBy default the tests expect to find a database at `jdbc:postgresql://localhost:5432/c3p0`.\nAs you can see, I usually test against a local postgres database. You can change this by\nsetting `C3P0_TEST_JDBC_URL` in the environment — see [Test configuration](#test-configuration) below.\n\nc3p0's testing is, um, embarrassingly informal. There is a junit test suite, but it covers a\nvery small fraction of c3p0 functionality. To run that, it's just\n\n```plaintext\n$ ./mill test\n```\n\nMostly c3p0 is tested by running a few test applications, and varying config _ad hoc_ to see how things work.\n\n_If you think c3p0 could/should be tested more professionally and automatically, me too! I'd love a pull request._\n\n[`build.mill`](build.mill) contains a lot of test applications, but the most important are\n\n```plaintext\n$ ./mill test.c3p0Benchmark\n```\n\nThis is c3p0 most basic, common, test-of-first-resort.\nIt runs through and times a bunch of different c3p0 operations, and puts the library through pretty good exercise\n\n```plaintext\n$ ./mill test.c3p0Load\n```\n\nThis one puts c3p0 under load of a 100 thread performing 1000 database operations each,\nthen terminates.\n\n```plaintext\n$ ./mill test.c3p0PSLoad\n```\n\nThis one puts c3p0 under load of a 100 thread performing database operations indefinitely.\nIt uses `PreparedStatement` for its database operations, so is a good way of exercising the\nstatement cache.\n\n#### Test configuration\n\nYou can observe (most of) the config of your c3p0 `DataSource` when you test, because c3p0 logs it at `INFO`\nupon the first `Connection` checkout attempt. When testing, verify that you are working with the configuration\nyou expect!\n\nTests are configured by a `c3p0.properties` file and by environment variables.\nTo play with different configurations, edit [`test/resources-local/c3p0.properties`](test/resources-local/c3p0.properties).\n\nTest runs are configured from the environment rather than by editing [`build.mill`](build.mill).\nSince these affect only how tests run, switching between setups rebuilds nothing:\n\n| Variable | Effect |\n| --- | --- |\n| `C3P0_TEST_CONFIG` | `local` (the default) or `rough`, selecting which `c3p0.properties` the tests see |\n| `C3P0_TEST_JDBC_URL` | overrides the default URL, `jdbc:postgresql://localhost:5432/c3p0` |\n| `C3P0_TEST_USER` | sets `-Dc3p0.user`, when present |\n| `C3P0_TEST_PASSWORD` | sets `-Dc3p0.password`, when present (may be empty) |\n| `C3P0_TEST_JVM_ARGS` | whitespace-separated extra JVM args, appended last; may define c3p0 properties such as `-Dc3p0.maxStatements=100` |\n\nSometimes you want to put the library through its paces with pathological configuration.\nA baseline pathological configuration is defined in [`test/resources-local-rough/c3p0.properties`](test/resources-local-rough/c3p0.properties).\nTo give this effect:\n\n```bash\n$ C3P0_TEST_CONFIG=rough ./mill test.c3p0Load\n```\n\nThen of course you can edit [`test/resources-local-rough/c3p0.properties`](test/resources-local-rough/c3p0.properties).\n\nTest environment changes that, in versions of c3p0 prior to 0.15.0, you would have uncommented in the `forkArgs()` task of `build.mill` now go in `C3P0_TEST_JVM_ARGS`.\nFor example:\n\n```bash\n$ C3P0_TEST_JVM_ARGS='-ea -Dc3p0.maxStatements=100' ./mill test.c3p0PSLoad\n```\n\nRunning against hsqldb rather than postgres additionally requires uncommenting `Dependency.Hsqldb`\nin the test module's `mvnDeps`. That one stays a source edit deliberately: the test module is\npublished, and an environment-conditional dependency would make the published pom depend on the\nenvironment it happened to be published from.\n\n#### Test logging\n\nOften you will want to focus logging on a class or feature you are testing. By default, c3p0 tests\nare configured to use `java.util.logging.`, and be configured by the file [`test/conf-logging/logging.properties`](test/conf-logging/logging.properties).\n\nOf course you can change the config (in `c3p0.properties`) to use another logging library if you'd like,\nbut you may need to modify the build to bring third-party logging libraries in, and configure those libraries\nin their own ways.\n\n#### Testing under other JVM versions\n\nThe build insists on a particular JVM version (currently Java 11), but you may want to try tests, with\nall the necessary dependencies and the same config, under other JVM versions. To support this,\nfirst, in the build's required JVM version, run\n\n```plaintext\n% ./mill test.printExternalCommandBase\n```\n\nThat will print a long String, beginning with \"java\" and typically ending with a very long `CLASSPATH`.\n\nNow you can change your environment (usually reset the `JAVA_HOME` environment variable) so you run a different JVM version.\n\nPaste the long output mill printed for you onto a command line, and then append the fully qualified name of one of c3p0's\ntest applications, usually one of...\n\n* `com.mchange.v2.c3p0.test.C3P0BenchmarkApp`\n* `com.mchange.v2.c3p0.test.LoadPoolBackedDataSource`\n* `com.mchange.v2.c3p0.test.PSLoadPoolBackedDataSource`\n* `com.mchange.v2.c3p0.test.StatsTest`\n* `com.mchange.v2.c3p0.test.ProxyWrappersTest`\n* `com.mchange.v2.c3p0.test.RawConnectionOpTest`\n* `com.mchange.v2.c3p0.test.InterruptedBatchTest`\n* `com.mchange.v2.c3p0.test.ConnectionDispersionTest`\n* `com.mchange.v2.c3p0.test.OneThreadRepeatedInsertOrQueryTest`\n* `com.mchange.v2.c3p0.test.TestRefSerStuff`\n* `com.mchange.v2.c3p0.test.JavaBeanRefTest`\n* `com.mchange.v2.c3p0.test.DynamicPreparedStatementTest`\n* `com.mchange.v2.c3p0.test.StatementStateTest`\n\n### Developer documentation\n\nIn addition to this `README.md`, please see...\n\n* [Adding properties](adding-properties.md)\n* [The c3p0 Statement Cache: structures and invariants](src/com/mchange/v2/c3p0/stmt/statement-cache-internals.md)\n* [The statement cache auditor, and the harnesses around it](test/src/com/mchange/v2/c3p0/stmt/statement-cache-auditor.md)\n\n### Building c3p0-loom\n\nBecause c3p0 currently builds under Java 11, but c3p0-loom requires Java 21, c3p0 loom is a\n[separate project](https://github.com/swaldman/c3p0-loom).\n\nIt is just a parallel mill project.\nThe instructions above apply (except `c3p0-loom` does not have independent documentation to build).\n\n### License\n\nc3p0 is licensed under [LGPL v.2.1](LICENSE-LGPL) or [EPL v.1.0](LICENSE-EPL), at your option. You may also\nopt to license c3p0 under any version of LGPL higher than v.2.1.\n\n---\n\n**Note:** c3p0 has had a good experience with reporting of a security vulnerability via Sonatype's _Central Security Project_.\nIf you find a c3p0 security issue, do consider reporting it via https://hackerone.com/central-security-project\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fswaldman%2Fc3p0","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fswaldman%2Fc3p0","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fswaldman%2Fc3p0/lists"}