Skip to content

Conversation

@ihalatci
Copy link
Collaborator

@ihalatci ihalatci commented Dec 24, 2025

DESCRIPTION:
🚀 Motivation

  • Upgrade mitmproxy (12.2.1) to address CVEs and enable downstream dependency refreshes tied to security bulletins.
  • Refresh Python packages used by the regression proxy harness, so they remain compatible with the upgraded mitmproxy API and current patch levels.
  • Keep the [check-pytest] infrastructure resilient on both SSL-enabled and SSL-less PostgreSQL builds encountered in CI and local development.

🔄 Summary of Changes

  1. Mitmproxy Upgrade & Harness Adaptation
  • Bumped mitmproxy to 12.2.1, which replaces the legacy TCP mode with the new reverse:tcp:// listener and requires explicit connection strategy flags.
  • Updated pg_regress_multi.pl and the Python proxy scripts to:
    -- Use the reverse:tcp:// endpoint format.
    -- Pass [--set connection_strategy=lazy]so new connections are accepted after mitmproxy’s change in default behavior.
    -- Handle ResetHandler cleanup differences introduced in mitmproxy 12 (guard when the client socket is already closed).
  • Adjusted columnar tests to accept the new psycopg EOF message variants surfaced once mitmproxy’s forwarding changed, ensuring the failure expectations still match.
  1. Python Dependency Refresh
  • Synchronized requirements.txt/Pipenv lockfiles to versions compatible with mitmproxy 12 and recent security patches.
  • Ensured pytest plugins referenced in regression tests remain up to date (pytest 9, pytest-xdist 3.8, etc.), matching our supported Python 3.12 toolchain.
  1. Pytest Harness Hardening
  • Added runtime detection in [common.py] to determine whether PostgreSQL was compiled with SSL ([pg_config --configure]
  • If SSL support is absent (as in our CI images), we now skip writing ssl = on into postgresql.conf and omit hostssl entries in pg_hba.conf.
  • This prevents pg_ctl from failing with “SSL is not supported by this build” when the tests restart cluster nodes.

@ihalatci ihalatci marked this pull request as draft December 24, 2025 12:31
@codecov
Copy link

codecov bot commented Dec 24, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.78%. Comparing base (55eb366) to head (7a21daf).

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #8422      +/-   ##
==========================================
- Coverage   88.79%   88.78%   -0.01%     
==========================================
  Files         287      287              
  Lines       63237    63001     -236     
  Branches     7927     7895      -32     
==========================================
- Hits        56151    55938     -213     
- Misses       4751     4820      +69     
+ Partials     2335     2243      -92     
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

- run mitmdump in plain TCP mode with lazy upstream connection strategy so failure schedules keep passing
- guard ResetHandler when the client socket isn’t exposed (mitmproxy ≥ 12)
- allow “SSL SYSCALL error: EOF detected” in columnar recovery test expectations
@ihalatci ihalatci marked this pull request as ready for review January 5, 2026 14:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants