fix(deps): batch security update — 2 vulnerabilities - #42173
fix(deps): batch security update — 2 vulnerabilities#42173appsmith-smithes[bot] wants to merge 3 commits into
Conversation
github-actions
Bot
added
Bug
appsmith-smithes
Bot
added
the
hacktron-exclude
Failed server tests
|
1 similar comment
Failed server tests
|
|
Fixed in c8c7888. Root cause: Fix: Generate Local verification: regression test failed before the fix and passed after it; all 34 non-container MySQL plugin tests passed; Spotless passed; the plugin package build passed. Full container/Cypress verification is now running in CI. |
|
Follow-up fix in e83bbd0. The first fresh Cypress pass confirmed the The follow-up excludes the server-provided Reactor Netty and Netty base classes from the plugin, while retaining aligned 4.1.136 macOS DNS native artifacts. A clean package inspection confirms the plugin now contains 0 |
|
✅ Final verification complete on e83bbd0.
Run: https://github.com/appsmithorg/appsmith/actions/runs/33268309168 |
There was a problem hiding this comment.
Reviewed the behavioral side of this bump (it is not quite version-bumps-only — the URL scheme change alters runtime connection-factory construction). Verified clean, so nobody needs to re-check these:
- Both alerts are fixed at exactly 1.4.1 (CVE-2026-55859, CVE-2026-55860), and no other plugin depends on r2dbc-mariadb.
- Connection pooling is unaffected: the
pool:prefix never engaged r2dbc-pool (the code buildsMariadbConnectionFactorydirectly and wraps it inConnectionPoolingetNewConnectionPool), so dropping it changes nothing about pooling. - SSL modes survive the bump:
SslMode.fromacceptsrequiredas a TRUST alias identically in 1.1.4 and 1.4.1 (checked both jars). - The new netty/reactor-netty exclusions are covered by green server-unit-tests (real testcontainers connections) and the full Cypress run.
One real gap (inline comment on MySqlDatasourceUtils.java): the fix covers only the endpoints branch; stored URL-based datasources carrying the old r2dbc:pool:mariadb:// format now fail under 1.4.1.
Two smaller things while this pom is open:
- The
r2dbc-poolversion comment warns about incompatibility withr2dbc-mysql 0.8.2.RELEASE, which is no longer a dependency of this plugin. It will misdirect the next person doing a CVE bump on r2dbc-pool — please update or delete it. - The three
<version>${netty.version}</version>tags are redundant with the inherited Spring Boot BOM pin (arangoDBPlugin declares its netty deps without versions). Optional.
Description nits: Resolves #730 / #731 uses Dependabot alert numbers, which GitHub links to two unrelated 2020 issues in this repo — better to reference the alert URLs. And the "No code changes — version bumps only" line is now stale given the MySqlDatasourceUtils change and new test.
| urlBuilder.append(datasourceConfiguration.getUrl()); | ||
| } else { | ||
| urlBuilder.append("r2dbc:pool:mariadb://"); | ||
| urlBuilder.append("r2dbc:mariadb://"); |
There was a problem hiding this comment.
This fixes the endpoints branch, but the getUrl() branch two lines up still passes stored URLs through verbatim into the same ConnectionFactoryOptions.parse -> MariadbConnectionConfiguration.fromOptions path.
Why that now breaks: 1.4.1's fromOptions reads ConnectionFactoryOptions.PROTOCOL and feeds it to Builder.haMode(...) (1.1.4 ignored PROTOCOL entirely — verified in both jars), and HaMode.from("mariadb") throws IllegalArgumentException("Wrong argument value 'mariadb' for HaMode"). So a datasource stored with the previously-valid r2dbc:pool:mariadb://host:3306/db URL — API-created or git-imported; the UI form has no URL field — parses to DRIVER=pool, PROTOCOL=mariadb and fails on every datasourceCreate after this upgrade.
Suggest normalizing a leading pool: segment (or forcing the mariadb driver option) at the common parse point below, so both branches are covered.
| @Test | ||
| public void testStandardConnectionOptionsAreCompatibleWithMariaDbDriver() { | ||
| DatasourceConfiguration dsConfig = getDatasourceConfigurationWithStandardConnectionMethod(); | ||
| ConnectionFactoryOptions options = |
There was a problem hiding this comment.
I checked that this test fails without the URL change (DRIVER comes back as pool), so it does cover the fix. Two gaps worth closing while here:
- Multi-endpoint:
getBuildercomma-joins hosts intor2dbc:mariadb://h1:3306,h2:3306/db, and with PROTOCOL now absent it is unverified that 1.4.1 parses that host list the way 1.1.4 did. A two-endpoint variant of this test would pin it down. - The URL branch (
datasourceConfiguration.getUrl()) has no coverage at all — see the comment onMySqlDatasourceUtils.java; a test withurlset and endpoints empty would document the intended behavior under 1.4.1.
Also consider driving getNewConnectionPool(...) here instead of hand-rolling fromOptions, so addSslOptionsToBuilder and allowPublicKeyRetrieval(true) are exercised against future driver bumps too.
1 participant
Summary
Batch security update via resolutions/version bumps.
Resolved alerts
text. #730 — org.mariadb:r2dbc-mariadb → 1.4.1 (medium)No code changes — version bumps only.
/ok-to-test tags="@tag.All"
Tip
🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉
Workflow run: https://github.com/appsmithorg/appsmith/actions/runs/33268309168
Commit: e83bbd0
Cypress dashboard.
Tags:
@tag.AllSpec:
Sat, 29 Aug 2026 19:36:17 UTC