release-8.5: add dependency security fixes to v8.5.8 release notes - #23710
release-8.5: add dependency security fixes to v8.5.8 release notes#23710qiancai wants to merge 7 commits into
Conversation
ti-chi-bot
Bot
added
missing-translation-status
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe TiDB 8.5.8 release notes add security-related dependency-upgrade entries for TiCDC, TiKV, and DM. The DM section appears under Tools between BR and TiCDC. ChangesRelease notes updates
Estimated code review effort: 1 (Trivial) | ~3 minutes Merge Risk: 🔵 Low · up to The release notes add dependency security updates, but the TiCDC item is placed under Improvements and the DM item does not explicitly identify the update as security-related. These are bounded documentation and discoverability issues; the PR is mergeable with explicit owner follow-up. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Description checkExplanation The description covers the required change, affected version, reference links, AI involvement, and change classifications. The first-time contributor checklist is omitted, which is allowed for non-first-time contributors. Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.) ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Team
Run ID: 4e09c158-b2c3-41ae-a08e-417e7461d1a8
📒 Files selected for processing (1)
releases/release-8.5.8.md
Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.
|
|
||
| + TiCDC | ||
|
|
||
| - Upgrade TiDB, `golang.org/x/crypto`, AWS SDK, and other dependencies to mitigate known vulnerabilities in TiCDC [#12775](https://github.com/pingcap/tiflow/issues/12775) [#5827](https://github.com/pingcap/ticdc/issues/5827) [#5693](https://github.com/pingcap/ticdc/issues/5693) [#5445](https://github.com/pingcap/ticdc/issues/5445) @[asddongmen](https://github.com/asddongmen) @[wk989898](https://github.com/wk989898) <!-- component: cdc --> <!-- pr: https://github.com/pingcap/tiflow/pull/12776 --> <!-- pr: https://github.com/pingcap/ticdc/pull/5829 --> <!-- pr: https://github.com/pingcap/ticdc/pull/5700 --> |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Move this TiCDC entry under Bug fixes.
This entry addresses known dependency security vulnerabilities. It is a security fix, not a stability, performance, or feature enhancement. Keeping it under Improvements separates it from the related TiKV and DM security fixes and reduces discoverability. The release-note guide distinguishes bug fixes from improvements on this basis. (github.com)
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
releases/release-8.5.8.md (1)
92-92: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winCall out security vulnerabilities explicitly in the DM entry.
This entry describes a dependency security update, but it says only
potential vulnerabilities. Addsecurityto identify the risk type and match the TiCDC and TiKV entries.As per path instructions, preserve established terminology and make the smallest necessary Markdown change.
Committable replacement
- - Fix potential vulnerabilities in DM by upgrading the OpenTelemetry and `kin-openapi` dependencies [`#12637`](https://github.com/pingcap/tiflow/issues/12637) @[GMHDBJD](https://github.com/GMHDBJD) <!-- component: dm --> <!-- pr: https://github.com/pingcap/tiflow/pull/12784 --> + - Fix potential security vulnerabilities in DM by upgrading the OpenTelemetry and `kin-openapi` dependencies [`#12637`](https://github.com/pingcap/tiflow/issues/12637) @[GMHDBJD](https://github.com/GMHDBJD) <!-- component: dm --> <!-- pr: https://github.com/pingcap/tiflow/pull/12784 -->Source: Path instructions
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Team
Run ID: c4899e20-65d7-4446-8d6b-3565f393eeb6
📒 Files selected for processing (1)
releases/release-8.5.8.md
Included review availability: Your plan provides up to 4 included reviews per hour; 1 remains after this review.
[LGTM Timeline notifier]Timeline:
|
|
@hbisheng: adding LGTM is restricted to approvers and reviewers in OWNERS files. DetailsIn response to this: Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
@asddongmen: adding LGTM is restricted to approvers and reviewers in OWNERS files. DetailsIn response to this: Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
4 participants
What is changed, added or deleted? (Required)
Which TiDB version(s) do your changes apply to? (Required)
What is the related PR or file link(s)?
AI agent involvement
Do your changes match any of the following descriptions?
Summary by CodeRabbit
golang.org/x/crypto, and the AWS SDK, to address known vulnerabilities.kin-openapi, to address potential security issues.