Workflow Engine 23.0.1
Release date: October 29, 2026
Overview
Workflow Engine 23.0.1 updates MySqlConnector to 2.6.2 to address a database password disclosure vulnerability affecting MySQL connections under specific TLS settings. It also keeps NuGet audit warnings visible without blocking repository builds, including builds of Workflow Engine Web API.
Why update
MySQL connection security
Workflow Engine upgrades MySqlConnector from 2.4.0 to 2.6.2, addressing GHSA-473q-m89c-ghf8. Versions before 2.6.1 can disclose a non-empty database password to a man-in-the-middle when SslMode is VerifyCA or VerifyFull and no CA certificate is configured through SslCa. The password can be sent before certificate verification rejects the connection. See the advisory for the full exposure conditions.
Non-blocking NuGet audit warnings
Workflow Engine repository builds keep NuGet audit enabled and report NU1900 through NU1905 as warnings even when TreatWarningsAsErrors is enabled. Newly published advisories no longer stop these builds solely because an audit warning is promoted to an error. Other warnings-as-errors policies remain in effect.
Update instructions
- Update Workflow Engine packages to 23.0.1, including the MySQL provider and MySQL Web API integration where used.
- If your application references MySqlConnector directly or pins it centrally, reconcile that reference with version 2.6.2 and check the resolved dependency after restoring packages.
- Rebuild your application and verify MySQL connectivity with your deployment's TLS settings.
- When upgrading from an earlier major or minor release, also review the Workflow Engine 23.0.0 update instructions.
The NuGet audit policy applies to Workflow Engine repository builds. Applications consuming the packages retain their own build policies. Making audit warnings non-blocking does not remediate a vulnerable dependency; the MySqlConnector upgrade addresses this advisory.
Release changelog
Workflow Engine 23.0.1 includes the following dependency and build fixes.
Security fixes
- MySQL provider: updated MySqlConnector from 2.4.0 to 2.6.2 to address password disclosure under the TLS conditions described in GHSA-473q-m89c-ghf8. The MySQL Web API integration references this provider.
Build fixes
- Repository builds: added
NU1900throughNU1905toWarningsNotAsErrorswhile keeping NuGet audit enabled and preserving other warnings-as-errors settings. This addresses the audit warning promotion that blocked the MySQL Web API build and, consequently, API reference generation.
Frequently asked questions
Which MySqlConnector version does Workflow Engine 23.0.1 use?
Workflow Engine 23.0.1 pins MySqlConnector 2.6.2. The advisory identifies 2.6.1 as the first patched version.
Which MySQL connections are affected by GHSA-473q-m89c-ghf8?
The advisory concerns MySqlConnector versions before 2.6.1 using VerifyCA or VerifyFull, no configured SslCa, and a non-empty password. A man-in-the-middle can capture the password before certificate verification fails.
Does Workflow Engine 23.0.1 disable NuGet vulnerability checks?
NuGet audit remains enabled in Workflow Engine repository builds. Audit findings remain visible as warnings, so developers must still review them and update affected dependencies.
Do the NuGet audit changes apply to applications using Workflow Engine packages?
The repository build settings do not configure a consuming application's warning policy. Review your application's resolved MySqlConnector version and its own NuGet audit configuration when upgrading.