Skip to content

Fixes for mysql mirror db#1494

Merged
TheLastCicada merged 11 commits into
developfrom
v2-rc2
Feb 13, 2026
Merged

Fixes for mysql mirror db#1494
TheLastCicada merged 11 commits into
developfrom
v2-rc2

Conversation

@TheLastCicada

Copy link
Copy Markdown
Contributor

No description provided.

…iffer

The v2Mirror config and prepareV2Db() were appending '_v2' to the
configured DB_NAME, causing connection failures when the MySQL user
only had grants on the database name specified in config.yaml.

Remove the suffix so the exact DB_NAME from config is used (matching
V1 behavior). Add validation that V1 and V2 mirror DB names are
different to prevent accidental data collision.
Extract validateMirrorDbNames() into a standalone exported function
and add 17 tests covering: identical names throw, different names
pass, and edge cases (null, undefined, empty, missing config sections).
Add OrganizationsV2Mirror model and wire up safeMirrorDbHandlerV2 calls
in OrganizationsV2 create/bulkCreate/update/upsert/destroy so that
organization data is mirrored to MySQL alongside all other V2 tables.
Include organizations in the startup backfill. Also add a corrective
migration to shorten two AEF index names that exceeded MySQL's
64-character identifier limit (ER_TOO_LONG_IDENT).
…ompat

Update the original T5 and T2 AEF migrations to use explicit short
index names for columns that exceed MySQL's 64-char identifier limit
(authorization_date, incorporation_country, cooperative_approach_id).
Wrap each addIndex in try/catch so partial re-runs from previous
failures can complete the remaining indexes. Also update the corrective
migration to handle incorporation_country and be idempotent on fresh
installs.
Add OrganizationsV2Mirror assertions to smoke-models, v2-models-loading,
and v2-models-import specs. Include organizations table in the backfill
source table check. Add organizations to mysql-mirror-helpers TYPE_TO_TABLE
and TYPE_TO_PRIMARY_KEY maps for live API mirror verification.
@socket-security

socket-security Bot commented Feb 12, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updated@​yao-pkg/​pkg@​6.12.0 ⏵ 6.13.194100100 +194 +2100
Updatedmysql2@​3.16.3 ⏵ 3.17.09810010096 +2100

View full report

@socket-security

socket-security Bot commented Feb 12, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn Low
Potential code anomaly (AI signal): npm @yao-pkg/pkg is 90.0% likely to have a medium risk anomaly

Notes: This module is a legitimate-looking build tool that downloads Node binaries, verifies checksums, generates a SEA blob from a provided entrypoint, and injects that blob into Node executables for distribution. The code itself does not contain clear malware (no data exfiltration, no hard-coded credentials, no reverse shell). However it performs high-impact actions: downloading and extracting executables, executing shell commands with interpolated, potentially unescaped paths, and injecting arbitrary blobs into binaries. These behaviors present supply-chain and command-injection risks if inputs (targets, nodePath, entryPoint, opts) or the downloaded resources are attacker-controlled or untrusted. Use requires trusting the blob generation inputs, target definitions, and the remote hosts providing Node binaries and checksums. Recommend validating and sanitizing all inputs used in shell commands and pinning trusted sources for binaries and checksums; prefer using execFile/spawn with argument arrays or proper escaping to avoid shell injection.

Confidence: 0.90

Severity: 0.60

From: package-lock.jsonnpm/@yao-pkg/pkg@6.13.1

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yao-pkg/pkg@6.13.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Ignoring alerts on:

  • esbuild@0.25.12

View full report

@TheLastCicada

Copy link
Copy Markdown
Contributor Author

@SocketSecurity ignore npm/esbuild@0.25.12

TheLastCicada and others added 5 commits February 13, 2026 12:56
The mysql-mirror-helpers.js test helper was appending '_v2' to the
DB_NAME from config, but the CADT application uses DB_NAME as-is.
This caused mirror verification to check an empty database instead
of the one CADT actually writes to.
fix(V2): use correct mirror DB name in test verification helper
The mirror check task ensures mirrors exist for org_uid, registry_id,
and data_model_version_store_id but was missing the file_store. When
the initial mirror creation during org creation fails (e.g. wallet
temporarily unsynced), the file_store mirror was never retried.

Add file_store mirror creation to both V1 and V2 mirror check tasks
so it is retried on the periodic schedule like all other stores.
fix: add file_store mirror to periodic mirror check
The delete-mirrors step fails when the wallet temporarily loses sync
after on-chain transactions from the test suite. Add a pre-check that
waits up to 5 minutes for wallet sync, then retry the deletion up to
3 times with 60-second waits between attempts for re-sync.
@TheLastCicada TheLastCicada merged commit 0fabee6 into develop Feb 13, 2026
20 checks passed
@TheLastCicada TheLastCicada deleted the v2-rc2 branch February 13, 2026 22:44
@TheLastCicada TheLastCicada restored the v2-rc2 branch February 18, 2026 22:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant