Upgrade to MySQL 8.3.0

[trcoelho]

Even updated to version 3.2.2-SNAPSHOT version, this version uses MySQL driver 8.1.0 when we have a new one available (8.2.0) https://mvnrepository.com/artifact/com.mysql/mysql-connector-j/8.2.0 .

Any chance to use 8.2.0 version on 3.2.2 Spring boot version?

Thanks in advance.

[wilkinsona]

Generally speaking, we don't upgrade to a new minor version of a dependency in a maintenance version of Spring Boot. At this time, it's not clear if 8.1.0 is completely end of life so I don't think an exception to this policy is warranted at the moment. We have already upgraded to MySQL driver 8.2.0 for this month's 3.3.0-M1 release. You can use 8.2.0 with Spring Boot 3.2 by overriding the mysql.version property in your pom.xml or build.gradle file.

[bclozel]

Duplicates #38423

[trcoelho]

Hi @bclozel , I ask that as we have a security vulnerability in 8.1.0 version as follows:

https://security.snyk.io/vuln/SNYK-JAVA-COMMYSQL-6075938

Which is recommended upgrade to 8.2.0.

[bclozel]

Reopening for team discussion. I'm wondering if we should adopt the same approach as #38901 because the official website says:

Version 8.2.0 is a new GA release version of the MySQL Connector/J. MySQL Connector/J 8.2.0 supersedes the 8.1 series and is recommended for use on production systems.

It sounds like the CVE fix will not be backported and we shouldn't expect maintenance versions in the 8.2.x line.

[lzysuqianqiu]

MySQL 8.3.0 is out !

[bclozel]

We can't consider this now as the release notes state:

Version 8.3.0 has no release notes, or they have not been published because the product version has not been released.

[lzysuqianqiu]

https://repo1.maven.org/maven2/com/mysql/mysql-connector-j/8.3.0/

[wilkinsona]

The release appearing on Maven Central doesn't invalidate what Brian has said. We can't consider an upgrade to 8.3.0 until it has been announced, its content including any CVE fixes has been described, and information about whether or not it supersedes 8.2 has been provided.

[bclozel]

The page is now updated:

Version 8.3.0 is a new GA release version of the MySQL Connector/J. MySQL Connector/J 8.3.0 supersedes 8.2 and is recommended for use on production systems. This release can be used against MySQL Server version 8.0 and beyond. It supports the Java Database Connectivity (JDBC) 4.2 API, and implements the X DevAPI.