*: bump jwt (#12343) #12346

ti-chi-bot · 2025-09-28T07:02:23Z

This is an automated cherry-pick of #12343

What problem does this PR solve?

Issue Number: close #12340 ref #12249

What is changed and how it works?

Check List

Tests

Unit test
Integration test

Questions

Will it cause performance regression or break compatibility?

Do you need to update user documentation, design documentation or monitoring documentation?

Release note

`None`.

Signed-off-by: ti-chi-bot <[email protected]>

ti-chi-bot · 2025-09-28T07:02:27Z

This cherry pick PR is for a release branch and has not yet been approved by triage owners.
Adding the do-not-merge/cherry-pick-not-approved label.

To merge this cherry pick:

It must be approved by the approvers firstly.
AFTER it has been approved by approvers, please wait for the cherry-pick merging approval from triage owners.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

ti-chi-bot · 2025-09-28T07:02:27Z

@wk989898 This PR has conflicts, I have hold it.
Please resolve them or ask others to resolve them, then comment /unhold to remove the hold label.

ti-chi-bot · 2025-09-28T07:02:29Z

@ti-chi-bot: ## If you want to know how to resolve it, please read the guide in TiDB Dev Guide.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the ti-community-infra/tichi repository.

ti-chi-bot · 2025-09-28T07:02:38Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign lichunzhu for approval. For more information see the Code Review Process.
Please ensure that each of them provides their approval before proceeding.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

gemini-code-assist · 2025-09-28T07:02:39Z

Summary of Changes

Hello @ti-chi-bot, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces a new OAuth2 server component, which is crucial for handling authentication and authorization flows. Concurrently, it updates various Go module dependencies across the project, ensuring that the system benefits from the latest features, bug fixes, and security patches, particularly for the JWT and OAuth2 related libraries. This change aims to enhance the project's authentication capabilities and maintain up-to-date external library usage.

Highlights

New OAuth2 Server Implementation: A new Go file, cmd/oauth2-server/main.go, has been added to introduce a functional OAuth2 server component. This server is configured to handle authorization, token issuance, and OpenID Connect discovery.
JWT Library Integration: The newly implemented OAuth2 server leverages the github.com/golang-jwt/jwt/v5 library for generating JSON Web Tokens (JWTs) as access tokens, enhancing secure authentication.
Dependency Updates: Numerous Go module dependencies have been updated to their latest versions. Key updates include github.com/go-oauth2/oauth2/v4, github.com/aws/aws-sdk-go, github.com/gin-gonic/gin, and github.com/go-mysql-org/go-mysql, ensuring the project benefits from recent improvements and security fixes.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request aims to update JWT dependencies and introduces a new OAuth2 server, likely for testing purposes. However, the go.mod and go.sum files contain merge conflict markers, which is a critical issue that will break the build and must be resolved. Additionally, the new server implementation in cmd/oauth2-server/main.go has some issues, including a misconfigured command-line flag, a potential security weakness, and incorrect usage of the http.ResponseWriter API. My review includes suggestions to fix these problems.

gemini-code-assist · 2025-09-28T07:03:47Z

go.mod

+<<<<<<< HEAD
 	github.com/aws/aws-sdk-go v1.44.259
+=======
+	github.com/apache/pulsar-client-go v0.13.0
+	github.com/aws/aws-sdk-go v1.55.5
+	github.com/aws/aws-sdk-go-v2 v1.38.1
+	github.com/aws/aws-sdk-go-v2/config v1.27.37
+	github.com/aws/aws-sdk-go-v2/credentials v1.17.35
+>>>>>>> 4b7fe4b517 (*: bump jwt (#12343))


This file contains merge conflict markers (<<<<<<<, =======, >>>>>>>) which will break the build. Please resolve these conflicts, likely by rebasing your branch onto the target branch and resolving the conflicts locally before pushing again.

gemini-code-assist · 2025-09-28T07:03:48Z

cmd/oauth2-server/main.go

+		"SJhX36_KapYSybBtJq35lxX_Brr4LRURSkm7QmXJGmy8pUFW9EIOcVQPsykz9-jj", "Secret to sign token")
+	cmd.Flags().StringVar(&serverConfig.clientID, "client-id", "1234", "Client ID of oauth2")
+	cmd.Flags().StringVar(&serverConfig.clientSecret, "client-secret", "e0KVlA2EiBfjoN13olyZd2kv1KL", "Client secret of oauth2")
+	cmd.Flags().IntVar(&serverConfig.port, "log-file", 9096, "log file path")


The command-line flag for setting the server port is incorrectly named log-file and has a misleading description log file path. This should be corrected to avoid confusion and accurately reflect its purpose.

Suggested change

cmd.Flags().IntVar(&serverConfig.port, "log-file", 9096, "log file path")

cmd.Flags().IntVar(&serverConfig.port, "port", 9096, "Port for the server to listen on")

gemini-code-assist · 2025-09-28T07:03:48Z

cmd/oauth2-server/main.go

+	manager.MapClientStorage(clientStore)
+
+	srv := server.NewDefaultServer(manager)
+	srv.SetAllowGetAccessRequest(true)


Allowing GET requests for access tokens (SetAllowGetAccessRequest(true)) is discouraged by the OAuth 2.0 specification (RFC 6749, Section 3.2). It can lead to access tokens being leaked via browser history, server logs, and referrer headers. It's recommended to only allow POST requests for the token endpoint by removing this line, as the default is false.

gemini-code-assist · 2025-09-28T07:03:48Z

cmd/oauth2-server/main.go

+		_, _ = w.Write([]byte(fmt.Sprintf(openIDConfiguration, serverConfig.port, serverConfig.port, serverConfig.port)))
+		w.WriteHeader(200)


The WriteHeader function is called after Write. The first call to w.Write() implicitly sends a 200 OK status header, making the subsequent w.WriteHeader(200) call redundant and ineffective. The correct order is to set headers, then write the body. Also, it's good practice to set the Content-Type header for JSON responses.

Suggested change

_, _ = w.Write([]byte(fmt.Sprintf(openIDConfiguration, serverConfig.port, serverConfig.port, serverConfig.port)))

w.WriteHeader(200)

w.Header().Set("Content-Type", "application/json")

_, _ = w.Write([]byte(fmt.Sprintf(openIDConfiguration, serverConfig.port, serverConfig.port, serverConfig.port)))

ti-chi-bot · 2025-09-28T07:13:25Z

@ti-chi-bot: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-verify	`fcfaa34`	link	true	`/test pull-verify`
pull-cdc-integration-storage-test	`fcfaa34`	link	true	`/test pull-cdc-integration-storage-test`
pull-cdc-integration-kafka-test	`fcfaa34`	link	true	`/test pull-cdc-integration-kafka-test`
pull-dm-integration-test	`fcfaa34`	link	true	`/test pull-dm-integration-test`
pull-cdc-integration-mysql-test	`fcfaa34`	link	true	`/test pull-cdc-integration-mysql-test`
pull-dm-compatibility-test	`fcfaa34`	link	true	`/test pull-dm-compatibility-test`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

This is an automated cherry-pick of pingcap#12343

fcfaa34

Signed-off-by: ti-chi-bot <[email protected]>

ti-chi-bot mentioned this pull request Sep 28, 2025

*: bump jwt #12343

Merged

ti-chi-bot bot added the do-not-merge/cherry-pick-not-approved label Sep 28, 2025

ti-chi-bot assigned wk989898 Sep 28, 2025

ti-chi-bot bot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Sep 28, 2025

gemini-code-assist bot reviewed Sep 28, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

*: bump jwt (#12343) #12346

*: bump jwt (#12343) #12346

ti-chi-bot commented Sep 28, 2025

Uh oh!

ti-chi-bot bot commented Sep 28, 2025

Uh oh!

ti-chi-bot commented Sep 28, 2025

Uh oh!

ti-chi-bot bot commented Sep 28, 2025

Uh oh!

ti-chi-bot bot commented Sep 28, 2025

Uh oh!

gemini-code-assist bot commented Sep 28, 2025

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

gemini-code-assist bot Sep 28, 2025

Uh oh!

gemini-code-assist bot Sep 28, 2025

Uh oh!

gemini-code-assist bot Sep 28, 2025

Uh oh!

gemini-code-assist bot Sep 28, 2025

Uh oh!

ti-chi-bot bot commented Sep 28, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	cmd.Flags().IntVar(&serverConfig.port, "log-file", 9096, "log file path")
	cmd.Flags().IntVar(&serverConfig.port, "port", 9096, "Port for the server to listen on")

		_, _ = w.Write([]byte(fmt.Sprintf(openIDConfiguration, serverConfig.port, serverConfig.port, serverConfig.port)))
		w.WriteHeader(200)

*: bump jwt (#12343) #12346

Are you sure you want to change the base?

*: bump jwt (#12343) #12346

Conversation

ti-chi-bot commented Sep 28, 2025

What problem does this PR solve?

What is changed and how it works?

Check List

Tests

Questions

Will it cause performance regression or break compatibility?

Do you need to update user documentation, design documentation or monitoring documentation?

Release note

Uh oh!

ti-chi-bot bot commented Sep 28, 2025

Uh oh!

ti-chi-bot commented Sep 28, 2025

Uh oh!

ti-chi-bot bot commented Sep 28, 2025

Uh oh!

ti-chi-bot bot commented Sep 28, 2025

Uh oh!

gemini-code-assist bot commented Sep 28, 2025

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Sep 28, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Sep 28, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Sep 28, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Sep 28, 2025

Choose a reason for hiding this comment

Uh oh!

ti-chi-bot bot commented Sep 28, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants