8.0.34 client lib change in behavior/output - new warning - breaking apps

[Nathan Neulinger]

The introduction of this warning output in a MINOR version/security update is completely inappropriate, regardless of it's validity. A minor version update of a package should NEVER change fundamental behavior

    WARNING: MYSQL_OPT_RECONNECT is deprecated and will be removed in a future version.

Any application (particularly web applications) that depended on mysql client library are now broken due to this additional warning being just dumped into the output of the app, such a API endpoints producing JSON.

Please produce a newer build that does output the warning.

I am not arguing for or against the change in functionality/defaults on the MYSQL_OPT_RECONNECT -- only about the zero-warning introduction of new warning level output in a dependent library.

If this were a "hey we just found a major security problem, and we see you are using the function in a way that triggers it, so we are going to spew out an _ERROR_ level warning", that might be justifiable. Spewing out a new warning to say "Your app MIGHT break in the future." when the new effect is "We're going to break it NOW!" is not.

8.0.33-0ubuntu0.20.04.4 is last working
8.0.34-0ubuntu0.20.04.1 is when the BUG was introduced.

[Nathan Neulinger (nneul-0)]

Related discussion:

https://stackoverflow.com/questions/76875569/warning-mysql-opt-reconnect-is-deprecated-and-will-be-removed-in-a-future-versi

[Nathan Neulinger (nneul-0)]

https://github.com/perl5-dbi/DBD-mysql/issues/354

[Nathan Neulinger (nneul-0)]

Please note - while DBD::mysql needs to fix the code for the future - the BUG is the introduction of this warning message where no output was ever previously produced.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Nathan Neulinger (nneul-0)]

https://bugs.mysql.com/bug.php?id=112089

[Bill MacAllister (oill)]

This is also broken on 22.04.

Broken: 8.0.34-0ubuntu0.22.04.1
Working: 8.0.28-0ubuntu4

[Marc Deslauriers (mdeslaur)]

This was introduced by the following upstream commit:

https://github.com/mysql/mysql-server/commit/7ce1877b2f79af24bc3c58b5f4ad7e583cd17c49

[Marc Deslauriers (mdeslaur)]

Possible fix for libdbd-mysql-perl:

https://github.com/aorr436/DBD-mysql/commit/7a5c9efbcf7d055f8586f4e678df3509c7cb645f

[Marc Deslauriers (mdeslaur)]

I am preparing libdbd-mysql-perl packages that prevent the warning into the security team PPA here:

https://launchpad.net/~ubuntu-security-proposed/+archive/ubuntu/ppa/+packages

Once the packages have finished building, please test them, and if they fix the issue in your environment, please leave a comment and I will release them ASAP.

Thanks!

[Nathan Neulinger (nneul-0)]

Confirmed that this addresses the problem on my test case scripts on 20.04 that were erroring with 8.0.34 libmysqlclient21 library.

[Launchpad Janitor (janitor)]

This bug was fixed in the package libdbd-mysql-perl - 4.050-3ubuntu0.2

---------------
libdbd-mysql-perl (4.050-3ubuntu0.2) focal-security; urgency=medium

  * Fix compatibility with MySQL 8.0.34 (LP: #2031548)
    - debian/patches/fix-mysql-8034-compat.patch: don't set
      MYSQL_OPT_RECONNECT as it is deprecated and spews an error message.
  * Fix compatibility with MySQL 8.0.24
    - debian/patches/fix-mysql-8024-compat.patch: fix change in behaviour
      causing rt85919-fetch-lost-connection.t test to fail.

 -- Marc Deslauriers <email address hidden> Thu, 17 Aug 2023 09:36:04 -0400

[Marc Deslauriers (mdeslaur)]

Thanks for testing, I'm releasing the updates now.

[Launchpad Janitor (janitor)]

This bug was fixed in the package libdbd-mysql-perl - 4.050-5ubuntu0.23.04.1

---------------
libdbd-mysql-perl (4.050-5ubuntu0.23.04.1) lunar-security; urgency=medium

  * Fix compatibility with MySQL 8.0.34 (LP: #2031548)
    - debian/patches/fix-mysql-8034-compat.patch: don't set
      MYSQL_OPT_RECONNECT as it is deprecated and spews an error message.

 -- Marc Deslauriers <email address hidden> Thu, 17 Aug 2023 09:32:15 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package libdbd-mysql-perl - 4.050-5ubuntu0.22.04.1

---------------
libdbd-mysql-perl (4.050-5ubuntu0.22.04.1) jammy-security; urgency=medium

  * Fix compatibility with MySQL 8.0.34 (LP: #2031548)
    - debian/patches/fix-mysql-8034-compat.patch: don't set
      MYSQL_OPT_RECONNECT as it is deprecated and spews an error message.

 -- Marc Deslauriers <email address hidden> Thu, 17 Aug 2023 09:35:24 -0400

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Max Barry (max-maxbarry)]

Now fixed for me on 22.04 with libdbd-mysql-perl 4.050-5ubuntu0.22.04.1 - thank you!

[David Cook (dcook2020)]

pali, the second biggest contributor to DBD::mysql, seems to be suggesting that the above fix isn't enough and has provided an alternative set of patches.

See https://github.com/perl5-dbi/DBD-mysql/issues/354#issuecomment-1687166360 for more details

[Marc Deslauriers (mdeslaur)]

Yes, pali's fix is more future-proof, and will likely work better with MariaDB updates. We'll switch it when it's required.

[Launchpad Janitor (janitor)]

This bug was fixed in the package libdbd-mysql-perl - 4.050-5ubuntu1

---------------
libdbd-mysql-perl (4.050-5ubuntu1) mantic; urgency=medium

  * Fix compatibility with MySQL 8.0.34 (LP: #2031548)
    - debian/patches/fix-mysql-8034-compat.patch: don't set
      MYSQL_OPT_RECONNECT as it is deprecated and spews an error message.

 -- Marc Deslauriers <email address hidden> Thu, 17 Aug 2023 09:32:15 -0400

[jk (jkdev1000)]

There is similar problem on APR-util (Ubuntu 22.04):

libaprutil1 1.6.1-5ubuntu4.22.04.1
libaprutil1-dbd-mysql 1.6.1-5ubuntu4.22.04.1

Apache error logs are flooded with warnings of the deprecated option when using Apache mod_dbd
module that uses APR for MySQL connections.

This needs similar patch as libdbd-mysql-perl.

Proposed fix here:
https://github.com/apache/apr/pull/45
https://github.com/apache/apr/pull/45/commits/f7d4c2561debcd92b96491e3adff53ef9a7e7525

[Paride Legovini (paride)]

@Security: will you also handle the src:apr-util case, as you did for libdbd-mysql-perl?

[Leonidas S. Barbosa (leosilvab)]

Hi @paride, I'll issue a update and ask for tests from this bug side asap. thanks.

[Leonidas S. Barbosa (leosilvab)]

I'm prepared updates addressing this issue in apr-util, could you do a quick test to check if it fix the issue?
You can find them in proposed: https://launchpad.net/~ubuntu-security-proposed/+archive/ubuntu/ppa/+packages , soon it is tested i'll publish it next week.

Thanks.

[jk (jkdev1000)]

Confirming version 1.6.1-5ubuntu4.22.04.2 libaprutil1 / libaprutil1-dbd-mysql fixes the problem on 22.04 - many thanks!

[Launchpad Janitor (janitor)]

This bug was fixed in the package apr-util - 1.6.1-5ubuntu4.22.04.2

---------------
apr-util (1.6.1-5ubuntu4.22.04.2) jammy-security; urgency=medium

  * Fix compatibility with MySQL 8.0.34 (LP: #2031548)
    - debian/patches/fix-mysql-8034-compat.patch: don't set
      MYSQL_OPT_RECONNECT as it is deprecated and spews and error message.

 -- Leonidas Da Silva Barbosa <email address hidden> Thu, 31 Aug 2023 11:24:22 -0300

[Launchpad Janitor (janitor)]

This bug was fixed in the package apr-util - 1.6.1-4ubuntu2.2

---------------
apr-util (1.6.1-4ubuntu2.2) focal-security; urgency=medium

  * Fix compatibility with MySQL 8.0.34 (LP: #2031548)
    - debian/patches/fix-mysql-8034-compat.patch: don't set
      MYSQL_OPT_RECONNECT as it is deprecated and spews and error message.

 -- Leonidas Da Silva Barbosa <email address hidden> Thu, 31 Aug 2023 14:57:06 -0300

[Launchpad Janitor (janitor)]

This bug was fixed in the package apr-util - 1.6.3-1ubuntu1.1

---------------
apr-util (1.6.3-1ubuntu1.1) lunar-security; urgency=medium

  * Fix compatibility with MySQL 8.0.34 (LP: #2031548)
    - debian/patches/fix-mysql-8034-compat.patch: don't set
      MYSQL_OPT_RECONNECT as it is deprecated and spews and error message.

 -- Leonidas Da Silva Barbosa <email address hidden> Thu, 31 Aug 2023 11:27:43 -0300

[William R. Edgington (wedgingt)]

I have libdbd-mysql-perl 4.050-3 and am still seeing the new output on Ubuntu 20.04.6 LTS.
Any ideas? Other packages I should check?

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Marc Deslauriers (mdeslaur)]

@wedgingt: You need to install the (4.050-3ubuntu0.2) package update.

[William R. Edgington (wedgingt)]

@mdeslaur: I have installed that package update and I'm still getting the new warning.

$ apt -a list libdbd-mysql-perl
Listing...
libdbd-mysql-perl/focal-updates,focal-security,now 4.050-3ubuntu0.2 amd64 [installed]
libdbd-mysql-perl/focal 4.050-3 amd64

$ apt list --upgradable
Listing...
cups-bsd/focal-updates,focal-security 2.3.1-9ubuntu1.5 amd64 [upgradable from: 2.3.1-9ubuntu1.4]
cups-client/focal-updates,focal-security 2.3.1-9ubuntu1.5 amd64 [upgradable from: 2.3.1-9ubuntu1.4]
cups-common/focal-updates,focal-updates,focal-security,focal-security 2.3.1-9ubuntu1.5 all [upgradable from: 2.3.1-9ubuntu1.4]
cups-core-drivers/focal-updates,focal-security 2.3.1-9ubuntu1.5 amd64 [upgradable from: 2.3.1-9ubuntu1.4]
cups-daemon/focal-updates,focal-security 2.3.1-9ubuntu1.5 amd64 [upgradable from: 2.3.1-9ubuntu1.4]
cups-ipp-utils/focal-updates,focal-security 2.3.1-9ubuntu1.5 amd64 [upgradable from: 2.3.1-9ubuntu1.4]
cups-ppdc/focal-updates,focal-security 2.3.1-9ubuntu1.5 amd64 [upgradable from: 2.3.1-9ubuntu1.4]
cups-server-common/focal-updates,focal-updates,focal-security,focal-security 2.3.1-9ubuntu1.5 all [upgradable from: 2.3.1-9ubuntu1.4]
cups/focal-updates,focal-security 2.3.1-9ubuntu1.5 amd64 [upgradable from: 2.3.1-9ubuntu1.4]
flac/focal-updates,focal-security 1.3.3-1ubuntu0.2 amd64 [upgradable from: 1.3.3-1ubuntu0.1]
ghostscript-x/focal-updates,focal-security 9.50~dfsg-5ubuntu4.10 amd64 [upgradable from: 9.50~dfsg-5ubuntu4.9]
ghostscript/focal-updates,focal-security 9.50~dfsg-5ubuntu4.10 amd64 [upgradable from: 9.50~dfsg-5ubuntu4.9]
gnome-software-common/focal-updates,focal-updates 3.36.1-0ubuntu0.20.04.1 all [upgradable from: 3.36.1-0ubuntu0.20.04.0]
libcups2/focal-updates,focal-security 2.3.1-9ubuntu1.5 amd64 [upgradable from: 2.3.1-9ubuntu1.4]
libcupsimage2/focal-updates,focal-security 2.3.1-9ubuntu1.5 amd64 [upgradable from: 2.3.1-9ubuntu1.4]
libflac8/focal-updates,focal-security 1.3.3-1ubuntu0.2 amd64 [upgradable from: 1.3.3-1ubuntu0.1]
libgs9-common/focal-updates,focal-updates,focal-security,focal-security 9.50~dfsg-5ubuntu4.10 all [upgradable from: 9.50~dfsg-5ubuntu4.9]
libgs9/focal-updates,focal-security 9.50~dfsg-5ubuntu4.10 amd64 [upgradable from: 9.50~dfsg-5ubuntu4.9]

[William R. Edgington (wedgingt)]

I'm still seeing this new warning but I've modified my application to pass testing despite it.

[Francis Devereux (frankoid)]

Will this be fixed in libmysqlclient21 (for example by adding an Ubuntu patch to revert https://github.com/mysql/mysql-server/commit/7ce1877b2f79af24bc3c58b5f4ad7e583cd17c49)?

I maintain an old C++ application that sets MYSQL_OPT_RECONNECT to true and since applying the libmysqlclient21 8.0.34-0ubuntu0.20.04.1 security update we are getting lots of unwanted deprecation warnings in our logs.

[Marc Deslauriers (mdeslaur)]

We have no plans to diverge from the upstream MySQL code for now. It is quite possible that one of the next MySQL versions may remove MYSQL_OPT_RECONNECT completely and using it will result in an error instead of a warning.

[Francis Devereux (frankoid)]

Even for focal security updates? It was surprising to me that a security update introduced this new stderr output and it would be even more surprising if a security update removed a feature (unless doing so was necessary to fix a security problem).

[MichielBeijen (michiel-beijen)]

Oracle does not really have 'security updates'. They provide 'patch level' releases which contain bug fixes, sometimes new features, and also security fixes. However, between patch level versions they should not be making API changes that break your app. In this case, generating a warning is not really an API level change but it can cause things perceived as 'breakage' in many scenarios.

I wanted to emphasize that upstream, Oracle has accepted the bug report about the deprecation warning being introduced in a patch level release. https://bugs.mysql.com/bug.php?id=112089

If this means that they might revert this behavior again in an upcoming patch level release or maybe keep it as a 'known issue', I'm not sure.

[Francis Devereux (frankoid)]

Given that Oracle 'patch level' releases contain other things in addition to security fixes one option would be for Ubuntu to cherry pick only the security fixes to be packaged in security updates. I understand this would be extra work though.

[Marc Deslauriers (mdeslaur)]

While we used to backport security patches to MySQL a long time ago, Oracle now no longer provides information on what and where the security issues are, so distros are no longer able to do so.

[Toby Chiang (davinci5566)]

Hi, our ubuntu system version is Ubuntu 20.04.2 LTS, we run into the same situation with William.
Though the packages were updated, the warning messages are still coming up.
If we downgrade libmysqlclient21 to 8.0.34-0ubuntu0.20.04.1, the messages disappeared.
Is there anything else we can check? Thanks!

$ dpkg -l | grep mysql
ii libdbd-mysql-perl:amd64 4.050-3ubuntu0.2 amd64 Perl5 database interface to the MariaDB/MySQL database
ii libmysqlclient-dev 8.0.34-0ubuntu0.20.04.1 amd64 MySQL database development files
ii libmysqlclient21:amd64 8.0.34-0ubuntu0.20.04.1 amd64 MySQL database client library

[David Hillman (davidahillman)]

I appreciate Toby and William commenting that they are still seeing this warming. All of my physical Ubuntu boxes are as well, despite having all of the specified upgrades performed. I thought perhaps I was losing my mind, but not quite yet.

I even removed all of the mysql and mariadb related packages, reset, and re-installed just the current revisions -- and still the warning persists.

However, I spun up a fresh Ubuntu 22 virtual machine and installed the mysql client packages, and that virtual system produces no warnings. All of the package versions are identical to those on the machines on which the warnings are still produced -- which doesn't make any sense, but there you go.

Machine A:
user@machineA:~/Code/db$ ./connect.pl
WARNING: MYSQL_OPT_RECONNECT is deprecated and will be removed in a future version.
$VAR1 = bless( {}, 'DBI::db' );
user@machineA:~/Code/db$ ./versions.sh
ii libdbd-mysql-perl:amd64 4.050-5ubuntu0.22.04.1 amd64 Perl5 database interface to the MariaDB/MySQL database
ii libmysqlclient21:amd64 8.0.34-0ubuntu0.22.04.1 amd64 MySQL database client library
ii mysql-common 5.8+1.0.8 all MySQL database common files, e.g. /etc/mysql/my.cnf
ii libdbd-mysql-perl:amd64 4.050-5ubuntu0.22.04.1 amd64 Perl5 database interface to the MariaDB/MySQL database
ii libmariadb-dev 1:10.6.12-0ubuntu0.22.04.1 amd64 MariaDB database development files
ii libmariadb3:amd64 1:10.6.12-0ubuntu0.22.04.1 amd64 MariaDB database client library
ii mariadb-client-10.6 1:10.6.12-0ubuntu0.22.04.1 amd64 MariaDB database client binaries
ii mariadb-client-core-10.6 1:10.6.12-0ubuntu0.22.04.1 amd64 MariaDB database core client binaries
ii mariadb-common 1:10.6.12-0ubuntu0.22.04.1 all MariaDB common configuration files

Machine B:
user@machineB:~/Code/db$ ./connect.pl
$VAR1 = bless( {}, 'DBI::db' );
user@machineB:~/Code/db$ ./versions.sh
ii libdbd-mysql-perl:amd64 4.050-5ubuntu0.22.04.1 amd64 Perl5 database interface to the MariaDB/MySQL database
ii libmysqlclient21:amd64 8.0.34-0ubuntu0.22.04.1 amd64 MySQL database client library
ii mysql-common 5.8+1.0.8 all MySQL database common files, e.g. /etc/mysql/my.cnf
ii libdbd-mysql-perl:amd64 4.050-5ubuntu0.22.04.1 amd64 Perl5 database interface to the MariaDB/MySQL database
ii libmariadb-dev 1:10.6.12-0ubuntu0.22.04.1 amd64 MariaDB database development files
ii libmariadb3:amd64 1:10.6.12-0ubuntu0.22.04.1 ...

[William R. Edgington (wedgingt)]

On seeing more reports that still have this new warning, I did some quick searching.

$ locate libmysqlclient | egrep '^/usr/lib/'
/usr/lib/x86_64-linux-gnu/libmysqlclient.a
/usr/lib/x86_64-linux-gnu/libmysqlclient.so
/usr/lib/x86_64-linux-gnu/libmysqlclient.so.21
/usr/lib/x86_64-linux-gnu/libmysqlclient.so.21.2.34
$ strings /usr/lib/x86_64-linux-gnu/libmysqlclient.a | fgrep MYSQL_OPT_RECONNECT
WARNING: MYSQL_OPT_RECONNECT is deprecated and will be removed in a future version.
wedgingt@wedgingt:~/backups$ strings /usr/lib/x86_64-linux-gnu/libmysqlclient.so | fgrep MYSQL_OPT_RECONNECT
WARNING: MYSQL_OPT_RECONNECT is deprecated and will be removed in a future version.
$ dpkg -S /usr/lib/x86_64-linux-gnu/libmysqlclient.a
libmysqlclient-dev: /usr/lib/x86_64-linux-gnu/libmysqlclient.a
$ dpkg -S /usr/lib/x86_64-linux-gnu/libmysqlclient.so
libmysqlclient-dev: /usr/lib/x86_64-linux-gnu/libmysqlclient.so
$ apt list libmysqlclient-dev
Listing... Done
libmysqlclient-dev/focal-updates,focal-security,now 8.0.34-0ubuntu0.20.04.1 amd64 [installed]
libmysqlclient-dev/focal-updates,focal-security 8.0.34-0ubuntu0.20.04.1 i386

[MichielBeijen (michiel-beijen)]

Hi William,

libmysqlclient.so is the C client library used by DBD::mysql, the perl DBD client to connect MySQL.
This client library contains the deprecation message and this library and the message are not changed by the packagers. What they changed, is the Perl dbimp.c code where when connecting the MYSQL_OPT_RECONNECT is now no longer set when making the connection.

This is also why Francis in comment #35 who runs a C++ application still sees the error message, the MySQL C client library did not change, only the Perl use of said library. So the only way _he_ can get rid of the error is by patching his C++ code which connects to MySQL.

Indeed an alternative solution would have been to apply a patch to libmysqlclient, which is the software that introduced the warning. it would save the need to patch all software using said client.

[William R. Edgington (wedgingt)]

OK, I see how this makes sense for the C++ case ... but I'm still getting the warning from my Perl applications despite not needing or wanting the reconnect option.

Is libmysqlclient printing the new warning even when mysql_auto_reconnect and AutoReconnect are not given?

And my /usr/lib/x86_64-linux-gnu/perl5/5.30/DBD/mysql.pm still has:

  if ($this && ($ENV{MOD_PERL} || $ENV{GATEWAY_INTERFACE})) {
    $this->{mysql_auto_reconnect} = 1;
  }

... from libdbd-mysql-perl/focal-update,focal-security,now 4.050-3ubuntu0.2 amd64 [installed]

[Brian Murray (brian-murray)]

Ubuntu 23.04 (Lunar Lobster) has reached end of life, so this bug will not be fixed for that specific release.