fix: bump mysql:mysql-connector-java to 8.0.13 (CVE-2018-3258) - #36

Automated dependency fix — CVE-2018-3258

Package: mysql:mysql-connector-java 5.1.41 → 8.0.13
Severity: high
Lane: advised-bump

Assessment

• Exploitability: Exploitation requires an authenticated attacker with network access to leverage the Connector/J flaw, and no public weaponized exploit is widely available (EPSS ~3.7%).
• Business impact: Successful exploitation could allow takeover of the MySQL Connector/J component, potentially compromising data integrity and availability of the application's database layer.
• Confidence: 0.9
• Rationale: This is a well-known Oracle CPU CVE in a direct, reachable dependency with a clear fixed version (8.0.13), making it a legitimate and safely automatable upgrade. Severity remains high due to the outdated 5.1.x branch and direct usage, though real-world exploitability is moderate.

Advisory

• Breaking-change risk: high
• Bumps mysql-connector-java from 5.1.41 to 8.0.13 to remediate CVE-2018-3258. This is a major version upgrade (5.x → 8.x) that includes driver class renaming (com.mysql.jdbc.Driver → com.mysql.cj.jdbc.Driver), stricter SSL/timezone defaults, and JDBC URL changes, so please verify database connectivity and configuration before merging.

Validation

• Patched branch installs, but the test suite fails.

Opened by the vulnerability management platform after human approval.