Skip to content

bugfix : upgrade vulnerable MySQL Connector/J references from distribution#8119

Open
LegendPei wants to merge 9 commits into
apache:2.xfrom
LegendPei:security/ghsa-m6vm-37g8-gqvh-cleanup
Open

bugfix : upgrade vulnerable MySQL Connector/J references from distribution#8119
LegendPei wants to merge 9 commits into
apache:2.xfrom
LegendPei:security/ghsa-m6vm-37g8-gqvh-cleanup

Conversation

@LegendPei
Copy link
Copy Markdown
Contributor

@LegendPei LegendPei commented May 31, 2026

Ⅰ. Describe what this PR did

This PR upgrade the vulnerable MySQL Connector/J references from Seata's dependency and distribution packaging configuration.

Main changes:

  • Replace the managed MySQL Connector/J dependency from mysql:mysql-connector-java to com.mysql:mysql-connector-j.
  • Remove the release/image packaging logic that copied MySQL driver jars into the Seata server distribution.
  • Remove obsolete MySQL driver version properties used only by the removed copy strategy.
  • Update test-scoped MySQL Connector/J usages to the new coordinates.
  • Update affected test imports from legacy MySQL 5 internal classes to MySQL Connector/J 8 classes.
  • Update NOTICE and changelog entries.

This keeps the change scoped to the GHSA/CVE cleanup and aligns with the point that the distributed binary package should not have a hard dependency on the MySQL driver.

Ⅱ. Does this pull request fix one issue?

fixes #8101

Ⅲ. Why don't you add test cases (unit test/integration test)?

No new unit or integration test is added because this PR mainly removes packaging-time dependency copying and updates dependency coordinates. The behavioral code path is unchanged.

Existing test compilation was updated where the MySQL Connector/J upgrade exposed references to legacy MySQL 5 internal classes.

Ⅳ. Describe how to verify it

Ⅴ. Special notes for reviews

The remaining mysql-connector-java matches are only historical changelog entries. Existing com.mysql.jdbc.Driver string defaults are kept for compatibility and are not bundled driver dependencies.

@codecov
Copy link
Copy Markdown

codecov Bot commented May 31, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.94%. Comparing base (a741d4b) to head (85b4df7).

Additional details and impacted files
@@             Coverage Diff              @@
##                2.x    #8119      +/-   ##
============================================
+ Coverage     72.79%   72.94%   +0.15%     
  Complexity      883      883              
============================================
  Files          1327     1327              
  Lines         50719    50719              
  Branches       6049     6049              
============================================
+ Hits          36919    36997      +78     
+ Misses        10803    10721      -82     
- Partials       2997     3001       +4     

see 18 files with indirect coverage changes

Impacted file tree graph

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@LegendPei LegendPei changed the title bugfix : Remove vulnerable MySQL Connector/J references from distribution bugfix : upgrade vulnerable MySQL Connector/J references from distribution Jun 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

CVE-2023-22102:8.9/10 :MySQL Connectors takeover vulnerability

1 participant