fix(deps): batch security update — 2 vulnerabilities - #42173
Conversation
github-actions
Bot
added
Bug
appsmith-smithes
Bot
added
the
hacktron-exclude
Failed server tests
|
|
Fixed in c8c7888. Root cause: Fix: Generate Local verification: regression test failed before the fix and passed after it; all 34 non-container MySQL plugin tests passed; Spotless passed; the plugin package build passed. Full container/Cypress verification is now running in CI. |
|
Follow-up fix in e83bbd0. The first fresh Cypress pass confirmed the The follow-up excludes the server-provided Reactor Netty and Netty base classes from the plugin, while retaining aligned 4.1.136 macOS DNS native artifacts. A clean package inspection confirms the plugin now contains 0 |
|
✅ Final verification complete on e83bbd0.
Run: https://github.com/appsmithorg/appsmith/actions/runs/33268309168 |
There was a problem hiding this comment.
Reviewed the behavioral side of this bump (it is not quite version-bumps-only — the URL scheme change alters runtime connection-factory construction). Verified clean, so nobody needs to re-check these:
- Both alerts are fixed at exactly 1.4.1 (CVE-2026-55859, CVE-2026-55860), and no other plugin depends on r2dbc-mariadb.
- Connection pooling is unaffected: the
pool:prefix never engaged r2dbc-pool (the code buildsMariadbConnectionFactorydirectly and wraps it inConnectionPoolingetNewConnectionPool), so dropping it changes nothing about pooling. - SSL modes survive the bump:
SslMode.fromacceptsrequiredas a TRUST alias identically in 1.1.4 and 1.4.1 (checked both jars). - The new netty/reactor-netty exclusions are covered by green server-unit-tests (real testcontainers connections) and the full Cypress run.
One real gap (inline comment on MySqlDatasourceUtils.java): the fix covers only the endpoints branch; stored URL-based datasources carrying the old r2dbc:pool:mariadb:// format now fail under 1.4.1.
Two smaller things while this pom is open:
- The
r2dbc-poolversion comment warns about incompatibility withr2dbc-mysql 0.8.2.RELEASE, which is no longer a dependency of this plugin. It will misdirect the next person doing a CVE bump on r2dbc-pool — please update or delete it. - The three
<version>${netty.version}</version>tags are redundant with the inherited Spring Boot BOM pin (arangoDBPlugin declares its netty deps without versions). Optional.
Description nits: Resolves #730 / #731 uses Dependabot alert numbers, which GitHub links to two unrelated 2020 issues in this repo — better to reference the alert URLs. And the "No code changes — version bumps only" line is now stale given the MySqlDatasourceUtils change and new test.
| urlBuilder.append(datasourceConfiguration.getUrl()); | ||
| } else { | ||
| urlBuilder.append("r2dbc:pool:mariadb://"); | ||
| urlBuilder.append("r2dbc:mariadb://"); |
There was a problem hiding this comment.
This fixes the endpoints branch, but the getUrl() branch two lines up still passes stored URLs through verbatim into the same ConnectionFactoryOptions.parse -> MariadbConnectionConfiguration.fromOptions path.
Why that now breaks: 1.4.1's fromOptions reads ConnectionFactoryOptions.PROTOCOL and feeds it to Builder.haMode(...) (1.1.4 ignored PROTOCOL entirely — verified in both jars), and HaMode.from("mariadb") throws IllegalArgumentException("Wrong argument value 'mariadb' for HaMode"). So a datasource stored with the previously-valid r2dbc:pool:mariadb://host:3306/db URL — API-created or git-imported; the UI form has no URL field — parses to DRIVER=pool, PROTOCOL=mariadb and fails on every datasourceCreate after this upgrade.
Suggest normalizing a leading pool: segment (or forcing the mariadb driver option) at the common parse point below, so both branches are covered.
There was a problem hiding this comment.
Fixed in 77ea5be. getBuilder now normalizes only a leading r2dbc:pool:mariadb:// immediately before the common parse point. The stored-URL regression test failed before the fix with Wrong argument value 'mariadb' for HaMode and passes after normalization.
| @Test | ||
| public void testStandardConnectionOptionsAreCompatibleWithMariaDbDriver() { | ||
| DatasourceConfiguration dsConfig = getDatasourceConfigurationWithStandardConnectionMethod(); | ||
| ConnectionFactoryOptions options = |
There was a problem hiding this comment.
I checked that this test fails without the URL change (DRIVER comes back as pool), so it does cover the fix. Two gaps worth closing while here:
- Multi-endpoint:
getBuildercomma-joins hosts intor2dbc:mariadb://h1:3306,h2:3306/db, and with PROTOCOL now absent it is unverified that 1.4.1 parses that host list the way 1.1.4 did. A two-endpoint variant of this test would pin it down. - The URL branch (
datasourceConfiguration.getUrl()) has no coverage at all — see the comment onMySqlDatasourceUtils.java; a test withurlset and endpoints empty would document the intended behavior under 1.4.1.
Also consider driving getNewConnectionPool(...) here instead of hand-rolling fromOptions, so addSslOptionsToBuilder and allowPublicKeyRetrieval(true) are exercised against future driver bumps too.
There was a problem hiding this comment.
Covered in 77ea5be. Added a two-endpoint test that builds MariadbConnectionConfiguration and asserts both host/port pairs survive parsing, plus stored-URL coverage. Kept these at getBuilder level to isolate URL parsing; existing plugin tests exercise pool construction. Locally: 14/14 focused tests pass, Spotless passes, and the plugin packages successfully.
2 participants
Summary
Updates
org.mariadb:r2dbc-mariadbto 1.4.1 and keeps MySQL datasource construction compatible with the upgraded driver.Resolved alerts
org.mariadb:r2dbc-mariadb1.4.1 (medium)org.mariadb:r2dbc-mariadb1.4.1 (medium)Compatibility changes
r2dbc:mariadb://URLs while retaining the plugin's explicit connection pool.r2dbc:pool:mariadb://URLs before MariaDB driver configuration.Impact on existing instances
Automation
/ok-to-test tags="@tag.All"
Tip
🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉
Workflow run: https://github.com/appsmithorg/appsmith/actions/runs/33876793418
Commit: 77ea5be
Cypress dashboard.
Tags:
@tag.AllSpec:
Fri, 04 Sep 2026 14:25:12 UTC
Fixes https://linear.app/appsmith/issue/APP-15930/fixdeps-batch-security-update-r2dbc-mariadb-141-cve-2026-55859-cve