Automated Review — mysql:9.7.0 → mysql:9.7.1

Diff reviewed: Single-line change in stacks/mysql.Dockerfile updating the MySQL Docker image tag and digest. No PII/secret exposure concerns.

Upstream release notes (MySQL 9.7.1, 2026-06-16):

• Critical security patch fixing 8 CVEs (3 critical, CVSS 9.6–9.9, remotely exploitable without authentication).
• No changes to replication protocol, binlog format, or CDC-relevant behavior.
• No known regressions reported for 9.7.1.

Risk to PeerDB: Low. This is a security-only patch with no behavioral changes affecting binlog-based CDC replication.

Verdict: Bump reviewed and looks clean. Recommended to merge promptly given the critical CVE fixes.

🤖 Generated with Claude Code

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

Upstream release notes check (per REVIEW.md):

MySQL 9.7.1 (released 2026-06-16) is a Critical Security Patch Update tied to the Oracle Critical Security Patch Update Advisory for June 2026. Key findings:

• Security-only release: Fixes multiple CVEs, including critical ones (CVSS 9.6–9.9) that are remotely exploitable without authentication. This makes the upgrade important from a security perspective.
• No replication/binlog/CDC behavioral changes: No changes to replication protocol, binary log format, or CDC-relevant behavior — relevant since PeerDB uses MySQL's binlog-based CDC with ROW format and GTID mode.
• No known regressions or breaking changes: Patch release within the 9.7.x series with no deprecations noted.

This PR is safe to merge.

Claude Code Review — reviewed and looks clean.

What changed: stacks/mysql.Dockerfile bumps mysql:9.7.0 → mysql:9.7.1 with a pinned image digest.

Upstream check (per REVIEW.md):

• MySQL 9.7.1 (2026-06-16) is an Oracle Critical Security Patch Update (CPU) — security fixes only, no feature changes.
• The upstream Docker library commit shows only version string updates in versions.json and Dockerfile.oracle — no configuration, script, entrypoint, or default changes.
• The image digest is pinned (sha256:ad88e1c8...), ensuring reproducibility.
• The Oracle CPU advisory page was access-restricted (HTTP 403), so individual CVEs could not be enumerated, but CPU releases are security-only patches with minimal regression risk.

PII/Secrets check: No secrets or sensitive data introduced. ✅

No issues found.