Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update dependency mysql-connector-python to v9 [SECURITY] #184

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Oct 24, 2024

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
mysql-connector-python (changelog) ~8.0.33 -> ~9.1.0 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2024-21272

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that are affected are 9.0.0 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).


Release Notes

mysql/mysql-connector-python (mysql-connector-python)

v9.1.0

Compare Source

======

  • WL#16452: Bundle all installable authentication plugins when building the C-extension
  • WL#16444: Drop build support for DEB packages
  • WL#16442: Upgrade gssapi version to 1.8.3
  • WL#16411: Improve wheel metadata information for Classic and XDevAPI connectors
  • WL#16341: OpenID Connect (Oauth2 - JWT) Authentication Support
  • WL#16307: Remove Python 3.8 support
  • WL#16306: Add support for Python 3.13
  • BUG#37055435: Connection fails during the TLS negotiation when specifying TLSv1.3 ciphers
  • BUG#37013057: mysql-connector-python Parameterized query SQL injection
  • BUG#36765200: python mysql connector 8.3.0 raise %-.100s:%u when input a wrong host
  • BUG#36577957: Update charset/collation description indicate this is 16 bits

v9.0.0

Compare Source

======

  • WL#16350: Update dnspython version
  • WL#16318: Deprecate Cursors Prepared Raw and Named Tuple
  • WL#16284: Update the Python Protobuf version
  • WL#16283: Remove OpenTelemetry Bundled Installation
  • BUG#36664998: Packets out of order error is raised while changing user in aio
  • BUG#36611371: Update dnspython required versions to allow latest 2.6.1
  • BUG#36570707: Collation set on connect using C-Extension is ignored
  • BUG#36476195: Incorrect escaping in pure Python mode if sql_mode includes NO_BACKSLASH_ESCAPES
  • BUG#36289767: MySQLCursorBufferedRaw does not skip conversion

v8.4.0

Compare Source

======

  • WL#16203: GPL License Exception Update
  • WL#16173: Update allowed cipher and cipher-suite lists
  • WL#16164: Implement support for new vector data type
  • WL#16127: Remove the FIDO authentication mechanism
  • WL#16053: Support GSSAPI/Kerberos authentication on Windows using authentication_ldap_sasl_client plug-in for C-extension
  • BUG#36227964: Improve OpenTelemetry span coverage
  • BUG#36167880: Massive memory leak mysqlx native Protobuf adding to collection

v8.3.0

Compare Source

======

  • WL#16015: Remove use of removed COM_ commands
  • WL#15985: Support GSSAPI/Kerberos authentication on Windows using authentication_ldap_sasl_client plug-in for Pure Python
  • WL#15983: Stop using mysql_ssl_set api
  • WL#15982: Remove use of mysql_shutdown
  • WL#15950: Support query parameters for prepared statements
  • WL#15942: Improve type hints and standardize byte type handling
  • WL#15836: Split mysql and mysqlx into different packages
  • WL#15523: Support Python DB API asynchronous execution
  • BUG#35912790: Binary strings are converted when using prepared statements
  • BUG#35832148: Fix Django timezone.utc deprecation warning
  • BUG#35710145: Bad MySQLCursor.statement and result when query text contains code comments
  • BUG#21390859: STATEMENTS GET OUT OF SYNCH WITH RESULT SETS

v8.2.0

Compare Source

======

  • WL#15664: Add support for Python 3.12
  • WL#15623: Improve the authentication module
  • WL#15218: Support WebAuthn authentication
  • BUG#35755852: Django config raise_on_warnings is ignored without isolation_level
  • BUG#35733608: Server stmt spans right after the cnx aren't related to the connector's cnx span
  • BUG#35547876: C/Python 8.1.0 type check build fails in the pb2 branch
  • BUG#35544123: Kerberos unit tests configuration is outdated
  • BUG#35503506: Query on information_schema.columns returns bytes
  • BUG#35503377: First connected to server v8, then any v5 connections fail with utf8mb4 charset
  • BUG#35141645: Memory leak in the mysqlx C extension

v8.1.0

Compare Source

======

  • WL#15749: Remove DMG and MSI support
  • WL#15672: Upgrade Python Protobuf version to 4.21.12
  • WL#15630: Remove Python 3.7 support
  • WL#15629: Add OpenTelemetry tracing
  • WL#15591: Improve the network module
  • BUG#35425076: Fix deallocating None error
  • BUG#35349093: Compression doesn't work with C extension API
  • BUG#35338384: PIP installs incompatible Connector/Python packages
  • BUG#35318413: Fix charset mapping for MySQL 8.1.0
  • BUG#35278365: Fix UnicodeDecodeError with a long field name alias (c-ext)
  • BUG#35212199: Check for identifier quotes in the database name
  • BUG#35140271: Regex split hanging in cursor.execute(..., multi=True) for complex queries
  • BUG#29115406: CONTRIBUTION - FIX RECV COMPRESS BUG

Configuration

📅 Schedule: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested review from a team, paulomach, taurus-forever, shayancanonical and carlcsaposs-canonical and removed request for a team October 24, 2024 19:27
Copy link
Contributor Author

renovate bot commented Oct 24, 2024

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: poetry.lock
Updating dependencies
Resolving dependencies...

Creating virtualenv charm-88ziTglk-py3.13 in /home/ubuntu/.cache/pypoetry/virtualenvs

The current project's supported Python range (>=3.8.1,<4.0.0) is not compatible with some of the required packages Python requirement:
  - mysql-connector-python requires Python >=3.9, so it will not be satisfied for Python >=3.8.1,<3.9

Because mysql-connector-python (9.1.0) requires Python >=3.9
 and no versions of mysql-connector-python match >9.1.0,<9.2.0, mysql-connector-python is forbidden.
So, because charm depends on mysql-connector-python (~9.1.0), version solving failed.

  • Check your dependencies Python requirement: The Python requirement can be specified via the `python` or `markers` properties
    
    For mysql-connector-python, a possible solution would be to set the `python` property to ">=3.9,<4.0.0"

    https://python-poetry.org/docs/dependency-specification/#python-restricted-dependencies,
    https://python-poetry.org/docs/dependency-specification/#using-environment-markers

@renovate renovate bot force-pushed the renovate/pypi-mysql-connector-python-vulnerability branch from 9a73fde to 4c9baf9 Compare November 29, 2024 00:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants