terrymanu commented on PR #39628: URL: https://github.com/apache/shardingsphere/pull/39628#issuecomment-5538681711
### Result **Review Result: Mergeable** Single-line dependency version bump (`mariadb-java-client.version` 2.4.2 → 2.7.14 in `pom.xml`, head `8d25c96`, 1 file, +1/-1) that correctly fixes CVE-2026-55856/#131, CVE-2026-55857/#132, and CVE-2026-55858/#133; no repository-owned code change, compatibility verified through class-name comparison, the official changelog, and 36 local unit tests, with no blocking findings. ### Evidence - Version-range match: all three advisories affect `< 2.7.14` with patched version 2.7.14, so the bump exits every affected range; a GitHub Advisory Database query for `affects=org.mariadb.jdbc:[email protected]` returned empty. - Compatibility (facts verified during this review): every reference to the driver in the repository is 4 string literals (`MariaDbConnection`, `MariaXaConnection(MariaDbConnection)`, `MariaDbDataSource`, the `jdbc:mariadb:` prefix) plus test imports, with no compile-time API dependency; all of these classes exist in the 2.7.14 jar (`MariaXaConnection` is byte-identical in size to 2.4.2). Running `database/connector/dialect/mariadb`, `jdbc-dialect/mariadb`, `proxy/dialect/mariadb`, and `kernel/transaction/type/xa/core` locally against 2.7.14: BUILD SUCCESS, 36 tests, 0 failures (the XA reflection path executes for real). - Official changelog (2.4.2→2.7.14): no removals or signature changes; the `DatabaseMetaData.getColumns` TINYINT(x>1)→BIT regression existed only in 2.5.0–2.7.3 (fixed by CONJ-893 in 2.7.4), and this jump skips that window entirely; the only known behavior change is CONJ-1317 (post-initialization charset changes to non-utf8/utf8mb3/utf8mb4 now fail the connection — the CVE fix itself), plus several correctness-oriented metadata/protocol fixes (CONJ-850, CONJ-842, CONJ-834, CONJ-810, CONJ-825). - No new tests required: zero repository code change; the existing suites already cover the affected paths. ### Coverage - Reviewed scope: PR #39628 latest head `8d25c96` (targeting master), GitHub changed-file list of 1 file (`pom.xml`, +1/-1), an automated security update with no linked issue; 1 behavior cluster (managed dependency version). - All three discovery lenses completed with Finding Proof Gate classification; 1 non-blocking observation: the charset fail-fast behavior change is worth a release-note sentence (a local release-note entry has been drafted separately). - Uncovered gap: MariaDB-specific E2E was skipped by path filtering in this PR's CI and did not actually run; it does not change the blocker set, but is worth watching post-merge. This is a Code Correctness Review, code scope only; CI state was not part of the review. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
