Is "Tomcat 7 JDBC Connection Pool" good enough for production? And how is it compare to BoneCP?

I'm one of the authors of HikariCP. That said, the "new" Tomcat pool is among the best we've tested. It has a lot of options, so if you plan to use it in production make sure you understand them to get a reliable configuration.

Do not confuse the new Tomcat pool with Apache DBCP, which I would avoid.

We are starting the process of abuse testing various pools, including HikariCP, with tests such as bouncing the DB underneath the pool and measuring the resulting recovery. Check out site for results in the coming weeks.

EDIT: Re: HikariCP being too young. Young though it may be it has had several billion transactions run through it. As with anything, I would suggest you try it in a pre-production environment before deployment. But the same goes for any pool you might choose.

UPDATE 2015-06-01: I want to revise my statement above somewhat, it seems that Apache Commons DBCP is active once again, and has taken over for the dedicated/forked Tomcat DBCP. The refactors in Commons DBCP appear at first glance to be significant, and positive. However, due to their magnitude and despite being under the old Commons DBCP banner, I would characterize the pool as less mature than HikariCP at this point.

BoneCP is not discontinued, but consider it @Deprecated now that HikariCP is around; there's little point contributing significant resources to it now that something radically better is on the horizon. This is open-source, so let's all work collectively towards the best solution. Source: me (BoneCP author)

Tomcat DBCP is production ready - its simply an evolution of commons DBCP.

DB conn pools are pretty simple beasts - I wouldnt regard its use as being particularly risky.