release-8.5: add dependency security fixes to v8.5.8 release notes

[qiancai]

What is changed, added or deleted? (Required)

• Add TiKV, TiCDC, and DM dependency security updates to the TiDB 8.5.8 release notes
• Add the TiCDC Grafana build information fix
• Group related TiCDC dependency updates into one user-facing entry while preserving the source issue and PR references

Which TiDB version(s) do your changes apply to? (Required)

• master (the latest development version)
• v8.5 (TiDB 8.5 versions)
• v8.4 (TiDB 8.4 versions)
• v8.3 (TiDB 8.3 versions)
• v8.2 (TiDB 8.2 versions)
• v8.1 (TiDB 8.1 versions)
• v7.5 (TiDB 7.5 versions)
• v7.1 (TiDB 7.1 versions)
• v6.5 (TiDB 6.5 versions)

What is the related PR or file link(s)?

• This PR is translated from: release-8.5: add dependency security fixes to v8.5.8 release notes docs#23710
• Other reference link(s):
  • [release-8.5] *: upgrade vulnerable Rust dependencies tikv/tikv#19933
  • deps(all): update TiDB and vulnerable dependencies tiflow#12776
  • deps(dm): update vulnerable dependencies on release-8.5 tiflow#12784
  • deps: update TiFlow, TiDB, and vulnerable modules ticdc#5829
  • *: bump crypto and aws-sdk-go-v2 (#5699) ticdc#5700
  • metrics: fix build info metric (#5648) ticdc#5756

AI agent involvement

• The changes in this PR were primarily made by an AI agent on behalf of the PR author.

Do your changes match any of the following descriptions?

• Delete files
• Change aliases
• Need modification after applied to another branch
• Might cause conflicts after applied to another branch

Summary by CodeRabbit

• 改进提升

  • TiCDC 更新相关依赖，降低潜在安全风险。

• 错误修复

  • TiKV 更新 Rust 依赖，修复潜在安全漏洞。
  • DM 更新相关依赖，修复潜在安全漏洞。
  • 修复 PD 指标查询接口可能导致的 SSRF 安全漏洞（Update dispatch.yml (#11072) #11081）。

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign hfxsd for approval. For more information see the Code Review Process.
Please ensure that each of them provides their approval before proceeding.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: 053336bb-d0c1-4e76-bc84-d32bfe082fc8

📥 Commits

Reviewing files that changed from the base of the PR and between f889a99 and 2b72b78.

📒 Files selected for processing (1)

• releases/release-8.5.8.md

Included review availability: Your plan provides up to 4 included reviews per hour; 1 remains after this review.

---

📝 Walkthrough

Walkthrough

TiDB 8.5.8 发布说明新增 TiCDC、TiKV 和 DM 的依赖安全修复条目，并为 PD 的指标接口 SSRF 修复补充 issue 编号。

Changes

8.5.8 发布说明

Layer / File(s)	Summary
依赖安全修复条目 releases/release-8.5.8.md	在 TiCDC、TiKV 和 DM 部分新增依赖升级及安全漏洞修复说明，并在 PD 修复条目中补充 issue 编号 #11081。

Estimated code review effort: 1（简单）| ~2 分钟

Merge Risk: 🔵 Low · up to 2b72b

本次发布说明包含安全修复信息，但 TiCDC 条目分类不当且遗漏 Grafana build information 修复记录，可能降低用户发现相关修复的能力。完成这两项文档调整后即可合并。

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	标题准确概括了本次变更的主要内容，即为 TiDB 8.5.8 发布说明补充依赖安全修复信息。
Description check	✅ Passed	描述包含变更内容、适用版本、相关链接、AI 参与情况和特殊变更检查项。首次贡献者协议清单未提供，但该部分按模板说明可在非首次贡献时删除，不影响整体完整性。
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: 67883ab7-1960-450a-a378-dd4f6d1a8272

📥 Commits

Reviewing files that changed from the base of the PR and between 70a923c and 82aac7e.

📒 Files selected for processing (1)

• releases/release-8.5.8.md

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.