## Overview

Workflow Engine 23.0.1 updates MySqlConnector to 2.6.2 to address a database password disclosure vulnerability affecting
MySQL connections under specific TLS settings. It also keeps NuGet audit warnings visible without blocking repository
builds, including builds of [Workflow Engine Web API](https://docs.workflowengine.io/evaluate/workflow-engine-features/http-api/).

## Why update

### MySQL connection security

Workflow Engine upgrades MySqlConnector from 2.4.0 to 2.6.2, addressing
[GHSA-473q-m89c-ghf8][mysql-advisory]. Versions before 2.6.1 can disclose a non-empty database password to a
man-in-the-middle when `SslMode` is `VerifyCA` or `VerifyFull` and no CA certificate is configured through `SslCa`.
The password can be sent before certificate verification rejects the connection. See the advisory for the full
exposure conditions.

### Non-blocking NuGet audit warnings

Workflow Engine repository builds keep NuGet audit enabled and report `NU1900` through `NU1905` as warnings even when
`TreatWarningsAsErrors` is enabled. Newly published advisories no longer stop these builds solely because an audit
warning is promoted to an error. Other warnings-as-errors policies remain in effect.

## Update instructions

- Update Workflow Engine packages to **23.0.1**, including the MySQL provider and MySQL Web API integration where used.
- If your application references MySqlConnector directly or pins it centrally, reconcile that reference with version
  **2.6.2** and check the resolved dependency after restoring packages.
- Rebuild your application and verify MySQL connectivity with your deployment's TLS settings.
- When upgrading from an earlier major or minor release, also review the
  [Workflow Engine 23.0.0 update instructions](https://docs.workflowengine.io/release-notes/23.0.0/#update-instructions).

The NuGet audit policy applies to Workflow Engine repository builds. Applications consuming the packages retain their
own build policies. Making audit warnings non-blocking does not remediate a vulnerable dependency; the MySqlConnector
upgrade addresses this advisory.

## Release changelog

Workflow Engine 23.0.1 includes the following dependency and build fixes.

### Security fixes

- MySQL provider: updated MySqlConnector from **2.4.0** to **2.6.2** to address password disclosure under the TLS
  conditions described in [GHSA-473q-m89c-ghf8][mysql-advisory]. The MySQL Web API integration references this provider.

### Build fixes

- Repository builds: added `NU1900` through `NU1905` to `WarningsNotAsErrors` while keeping NuGet audit enabled and
  preserving other warnings-as-errors settings. This addresses the audit warning promotion that blocked the MySQL
  Web API build and, consequently, API reference generation.

## Frequently asked questions

**Which MySqlConnector version does Workflow Engine 23.0.1 use?**

Workflow Engine 23.0.1 pins MySqlConnector 2.6.2. The advisory identifies 2.6.1 as the first patched version.

**Which MySQL connections are affected by GHSA-473q-m89c-ghf8?**

The advisory concerns MySqlConnector versions before 2.6.1 using `VerifyCA` or `VerifyFull`, no configured `SslCa`,
and a non-empty password. A man-in-the-middle can capture the password before certificate verification fails.

**Does Workflow Engine 23.0.1 disable NuGet vulnerability checks?**

NuGet audit remains enabled in Workflow Engine repository builds. Audit findings remain visible as warnings, so
developers must still review them and update affected dependencies.

**Do the NuGet audit changes apply to applications using Workflow Engine packages?**

The repository build settings do not configure a consuming application's warning policy. Review your application's
resolved MySqlConnector version and its own NuGet audit configuration when upgrading.

[mysql-advisory]: https://github.com/advisories/GHSA-473q-m89c-ghf8