fix: requirements-docbuild.txt to reduce vulnerabilities

The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-REQUESTS-6928867 - https://snyk.io/vuln/SNYK-PYTHON-URLLIB3-7267250
Merge pull request #905 from percona/release-v3.7.0
2025-12-12 02:00:49 +08:00 · 2024-12-23 13:19:51 +00:00 · 2024-12-23 16:19:03 +03:00 · 2024-12-20 18:16:54 +05:30 · 2024-12-20 15:09:45 +05:30 · 2024-12-19 20:25:46 +03:00
53 changed files with 250 additions and 118 deletions
--- a/8
+++ b/8
@@ -1,5 +1,13 @@
 Changelog for Percona Toolkit

+v3.7.0 released 2024-12-23
+
+* Feature PT-2340: Support MySQL 8.4
+* Improvement PT-2347: Improper use of sha256 hash algorithm in percona-toolkit/src/go/pt-secure-collect /encrypt.go
+* Improvement PR-862:  Fixed flaky tests (Thanks to Henning Pöttker for the contribution)
+* Improvement PR-839:  Update pt-mysql-summary (Thanks to GOKUL S for the contribution)
+* Fixed bug PT-2371: pt-summary errors out with "STATUS_THP_SYSTEM: unbound variable" (Thanks to Jason Ng for the contribution)
+
 v3.6.0 released 2024-06-12

 * Feature PR-754: Port improved pt-pmp (Thanks to Alexey Stroganov for the contribution)
--- a/Makefile.PL
+++ b/Makefile.PL
@@ -11,7 +11,7 @@ MAKE_GOTOOLS

 WriteMakefile(
    NAME      => 'Percona::Toolkit',
-    VERSION   => '3.6.0',
+    VERSION   => '3.7.0',
    EXE_FILES => [
      map {
         (my $name = $_) =~ s/^bin.//;
--- a/bin/pt-align
+++ b/bin/pt-align
@@ -1364,6 +1364,6 @@ Place, Suite 330, Boston, MA  02111-1307  USA.

 =head1 VERSION

-pt-align 3.6.0
+pt-align 3.7.0

 =cut
--- a/bin/pt-archiver
+++ b/bin/pt-archiver
@@ -45,7 +45,7 @@ BEGIN {
 {
 package Percona::Toolkit;

-our $VERSION = '3.6.0';
+our $VERSION = '3.7.0';

 use strict;
 use warnings FATAL => 'all';
@@ -8964,6 +8964,6 @@ Place, Suite 330, Boston, MA  02111-1307  USA.

 =head1 VERSION

-pt-archiver 3.6.0
+pt-archiver 3.7.0

 =cut
--- a/bin/pt-config-diff
+++ b/bin/pt-config-diff
@@ -43,7 +43,7 @@ BEGIN {
 {
 package Percona::Toolkit;

-our $VERSION = '3.6.0';
+our $VERSION = '3.7.0';

 use strict;
 use warnings FATAL => 'all';
@@ -6038,6 +6038,6 @@ Place, Suite 330, Boston, MA  02111-1307  USA.

 =head1 VERSION

-pt-config-diff 3.6.0
+pt-config-diff 3.7.0

 =cut
--- a/bin/pt-deadlock-logger
+++ b/bin/pt-deadlock-logger
@@ -42,7 +42,7 @@ BEGIN {
 {
 package Percona::Toolkit;

-our $VERSION = '3.6.0';
+our $VERSION = '3.7.0';

 use strict;
 use warnings FATAL => 'all';
@@ -5815,6 +5815,6 @@ Place, Suite 330, Boston, MA  02111-1307  USA.

 =head1 VERSION

-pt-deadlock-logger 3.6.0
+pt-deadlock-logger 3.7.0

 =cut
--- a/bin/pt-diskstats
+++ b/bin/pt-diskstats
@@ -38,7 +38,7 @@ BEGIN {
 {
 package Percona::Toolkit;

-our $VERSION = '3.6.0';
+our $VERSION = '3.7.0';

 use strict;
 use warnings FATAL => 'all';
@@ -5696,6 +5696,6 @@ Place, Suite 330, Boston, MA  02111-1307  USA.

 =head1 VERSION

-pt-diskstats 3.6.0
+pt-diskstats 3.7.0

 =cut
--- a/bin/pt-duplicate-key-checker
+++ b/bin/pt-duplicate-key-checker
@@ -39,7 +39,7 @@ BEGIN {
 {
 package Percona::Toolkit;

-our $VERSION = '3.6.0';
+our $VERSION = '3.7.0';

 use strict;
 use warnings FATAL => 'all';
@@ -5834,6 +5834,6 @@ Place, Suite 330, Boston, MA  02111-1307  USA.

 =head1 VERSION

-pt-duplicate-key-checker 3.6.0
+pt-duplicate-key-checker 3.7.0

 =cut
--- a/bin/pt-eustack-resolver
+++ b/bin/pt-eustack-resolver
@@ -252,6 +252,6 @@ Place, Suite 330, Boston, MA  02111-1307  USA.
   
 =head1 VERSION

-pt-eustack-resolver 3.6.0
+pt-eustack-resolver 3.7.0

 =cut
--- a/bin/pt-fifo-split
+++ b/bin/pt-fifo-split
@@ -1719,6 +1719,6 @@ Place, Suite 330, Boston, MA  02111-1307  USA.

 =head1 VERSION

-pt-fifo-split 3.6.0
+pt-fifo-split 3.7.0

 =cut
--- a/bin/pt-find
+++ b/bin/pt-find
@@ -35,7 +35,7 @@ BEGIN {
 {
 package Percona::Toolkit;

-our $VERSION = '3.6.0';
+our $VERSION = '3.7.0';

 use strict;
 use warnings FATAL => 'all';
@@ -5247,6 +5247,6 @@ Place, Suite 330, Boston, MA  02111-1307  USA.

 =head1 VERSION

-pt-find 3.6.0
+pt-find 3.7.0

 =cut
--- a/bin/pt-fingerprint
+++ b/bin/pt-fingerprint
@@ -2271,6 +2271,6 @@ Place, Suite 330, Boston, MA  02111-1307  USA.

 =head1 VERSION

-pt-fingerprint 3.6.0
+pt-fingerprint 3.7.0

 =cut
--- a/bin/pt-fk-error-logger
+++ b/bin/pt-fk-error-logger
@@ -37,7 +37,7 @@ BEGIN {
 {
 package Percona::Toolkit;

-our $VERSION = '3.6.0';
+our $VERSION = '3.7.0';

 use strict;
 use warnings FATAL => 'all';
@@ -4802,6 +4802,6 @@ Place, Suite 330, Boston, MA  02111-1307  USA.

 =head1 VERSION

-pt-fk-error-logger 3.6.0
+pt-fk-error-logger 3.7.0

 =cut
--- a/bin/pt-heartbeat
+++ b/bin/pt-heartbeat
@@ -44,7 +44,7 @@ BEGIN {
 {
 package Percona::Toolkit;

-our $VERSION = '3.6.0';
+our $VERSION = '3.7.0';

 use strict;
 use warnings FATAL => 'all';
@@ -7737,6 +7737,6 @@ Place, Suite 330, Boston, MA  02111-1307  USA.

 =head1 VERSION

-pt-heartbeat 3.6.0
+pt-heartbeat 3.7.0

 =cut
--- a/bin/pt-index-usage
+++ b/bin/pt-index-usage
@@ -45,7 +45,7 @@ BEGIN {
 {
 package Percona::Toolkit;

-our $VERSION = '3.6.0';
+our $VERSION = '3.7.0';

 use strict;
 use warnings FATAL => 'all';
@@ -7764,6 +7764,6 @@ Place, Suite 330, Boston, MA  02111-1307  USA.

 =head1 VERSION

-pt-index-usage 3.6.0
+pt-index-usage 3.7.0

 =cut
--- a/bin/pt-ioprofile
+++ b/bin/pt-ioprofile
@@ -1149,7 +1149,7 @@ Place, Suite 330, Boston, MA  02111-1307  USA.

 =head1 VERSION

-pt-ioprofile 3.6.0
+pt-ioprofile 3.7.0

 =cut

--- a/bin/pt-kill
+++ b/bin/pt-kill
@@ -47,7 +47,7 @@ BEGIN {
 {
 package Percona::Toolkit;

-our $VERSION = '3.6.0';
+our $VERSION = '3.7.0';

 use strict;
 use warnings FATAL => 'all';
@@ -8924,6 +8924,6 @@ Place, Suite 330, Boston, MA  02111-1307  USA.

 =head1 VERSION

-pt-kill 3.6.0
+pt-kill 3.7.0

 =cut
--- a/bin/pt-mext
+++ b/bin/pt-mext
@@ -825,7 +825,7 @@ Place, Suite 330, Boston, MA  02111-1307  USA.

 =head1 VERSION

-pt-mext 3.6.0
+pt-mext 3.7.0

 =cut

--- a/bin/pt-mysql-summary
+++ b/bin/pt-mysql-summary
@@ -3444,7 +3444,7 @@ Place, Suite 330, Boston, MA  02111-1307  USA.

 =head1 VERSION

-pt-mysql-summary 3.6.0
+pt-mysql-summary 3.7.0

 =cut

--- a/bin/pt-online-schema-change
+++ b/bin/pt-online-schema-change
@@ -56,7 +56,7 @@ BEGIN {
 {
 package Percona::Toolkit;

-our $VERSION = '3.6.0';
+our $VERSION = '3.7.0';

 use strict;
 use warnings FATAL => 'all';
@@ -14199,6 +14199,6 @@ Place, Suite 330, Boston, MA  02111-1307  USA.

 =head1 VERSION

-pt-online-schema-change 3.6.0
+pt-online-schema-change 3.7.0

 =cut
--- a/bin/pt-pmp
+++ b/bin/pt-pmp
@@ -1042,7 +1042,7 @@ Place, Suite 330, Boston, MA  02111-1307  USA.

 =head1 VERSION

-pt-pmp 3.6.0
+pt-pmp 3.7.0

 =cut

--- a/bin/pt-query-digest
+++ b/bin/pt-query-digest
@@ -64,7 +64,7 @@ BEGIN {
 {
 package Percona::Toolkit;

-our $VERSION = '3.6.0';
+our $VERSION = '3.7.0';

 use strict;
 use warnings FATAL => 'all';
@@ -17145,6 +17145,6 @@ Place, Suite 330, Boston, MA  02111-1307  USA.

 =head1 VERSION

-pt-query-digest 3.6.0
+pt-query-digest 3.7.0

 =cut
--- a/bin/pt-replica-find
+++ b/bin/pt-replica-find
@@ -4777,6 +4777,6 @@ Place, Suite 330, Boston, MA  02111-1307  USA.

 =head1 VERSION

-pt-replica-find 3.6.0
+pt-replica-find 3.7.0

 =cut
--- a/bin/pt-replica-restart
+++ b/bin/pt-replica-restart
@@ -41,7 +41,7 @@ BEGIN {
 {
 package Percona::Toolkit;

-our $VERSION = '3.6.0';
+our $VERSION = '3.7.0';

 use strict;
 use warnings FATAL => 'all';
@@ -6472,6 +6472,6 @@ Place, Suite 330, Boston, MA  02111-1307  USA.

 =head1 VERSION

-pt-replica-restart 3.6.0
+pt-replica-restart 3.7.0

 =cut
--- a/bin/pt-show-grants
+++ b/bin/pt-show-grants
@@ -2725,6 +2725,6 @@ Place, Suite 330, Boston, MA  02111-1307  USA.

 =head1 VERSION

-pt-show-grants 3.6.0
+pt-show-grants 3.7.0

 =cut
--- a/bin/pt-sift
+++ b/bin/pt-sift
@@ -1266,7 +1266,7 @@ Place, Suite 330, Boston, MA  02111-1307  USA.

 =head1 VERSION

-pt-sift 3.6.0
+pt-sift 3.7.0

 =cut

--- a/bin/pt-slave-delay
+++ b/bin/pt-slave-delay
@@ -41,7 +41,7 @@ BEGIN {
 {
 package Percona::Toolkit;

-our $VERSION = '3.6.0';
+our $VERSION = '3.7.0';

 use strict;
 use warnings FATAL => 'all';
@@ -5286,6 +5286,6 @@ Place, Suite 330, Boston, MA  02111-1307  USA.

 =head1 VERSION

-pt-slave-delay 3.6.0
+pt-slave-delay 3.7.0

 =cut
--- a/bin/pt-stalk
+++ b/bin/pt-stalk
@@ -2607,7 +2607,7 @@ Place, Suite 330, Boston, MA  02111-1307  USA.

 =head1 VERSION

-pt-stalk 3.6.0
+pt-stalk 3.7.0

 =cut

--- a/bin/pt-summary
+++ b/bin/pt-summary
@@ -2808,7 +2808,7 @@ Place, Suite 330, Boston, MA  02111-1307  USA.

 =head1 VERSION

-pt-summary 3.6.0
+pt-summary 3.7.0

 =cut

--- a/bin/pt-table-checksum
+++ b/bin/pt-table-checksum
@@ -58,7 +58,7 @@ BEGIN {
 {
 package Percona::Toolkit;

-our $VERSION = '3.6.0';
+our $VERSION = '3.7.0';

 use strict;
 use warnings FATAL => 'all';
@@ -14429,6 +14429,6 @@ Place, Suite 330, Boston, MA  02111-1307  USA.

 =head1 VERSION

-pt-table-checksum 3.6.0
+pt-table-checksum 3.7.0

 =cut
--- a/bin/pt-table-sync
+++ b/bin/pt-table-sync
@@ -55,7 +55,7 @@ BEGIN {
 {
 package Percona::Toolkit;

-our $VERSION = '3.6.0';
+our $VERSION = '3.7.0';

 use strict;
 use warnings FATAL => 'all';
@@ -13416,6 +13416,6 @@ Place, Suite 330, Boston, MA  02111-1307  USA.

 =head1 VERSION

-pt-table-sync 3.6.0
+pt-table-sync 3.7.0

 =cut
--- a/bin/pt-table-usage
+++ b/bin/pt-table-usage
@@ -3952,7 +3952,7 @@ my $unquoted_ident = qr/
 my $ident_alias = qr/
  \s+                                 # space before alias
  (?:(AS)\s+)?                        # optional AS keyword
-  ((?>$quoted_ident|$unquoted_ident)) # alais
+  ((?>$quoted_ident|$unquoted_ident)) # alias
 /xi;

 my $table_ident = qr/(?:
@@ -8622,6 +8622,6 @@ Place, Suite 330, Boston, MA  02111-1307  USA.

 =head1 VERSION

-pt-table-usage 3.6.0
+pt-table-usage 3.7.0

 =cut
--- a/bin/pt-upgrade
+++ b/bin/pt-upgrade
@@ -61,7 +61,7 @@ BEGIN {
 {
 package Percona::Toolkit;

-our $VERSION = '3.6.0';
+our $VERSION = '3.7.0';

 use strict;
 use warnings FATAL => 'all';
@@ -11555,6 +11555,6 @@ Place, Suite 330, Boston, MA  02111-1307  USA.

 =head1 VERSION

-pt-upgrade 3.6.0
+pt-upgrade 3.7.0

 =cut
--- a/bin/pt-variable-advisor
+++ b/bin/pt-variable-advisor
@@ -44,7 +44,7 @@ BEGIN {
 {
 package Percona::Toolkit;

-our $VERSION = '3.6.0';
+our $VERSION = '3.7.0';

 use strict;
 use warnings FATAL => 'all';
@@ -6415,6 +6415,6 @@ Place, Suite 330, Boston, MA  02111-1307  USA.

 =head1 VERSION

-pt-variable-advisor 3.6.0
+pt-variable-advisor 3.7.0

 =cut
--- a/bin/pt-visual-explain
+++ b/bin/pt-visual-explain
@@ -4241,6 +4241,6 @@ Place, Suite 330, Boston, MA  02111-1307  USA.

 =head1 VERSION

-pt-visual-explain 3.6.0
+pt-visual-explain 3.7.0

 =cut
--- a/config/scripts/pt_builder.sh
+++ b/config/scripts/pt_builder.sh
@@ -165,7 +165,7 @@ install_go() {
    #rm -rf /usr/local/go /usr/local/go1.8 /usr/local/go1.9
    #mv go1.9 /usr/local/
    #ln -s /usr/local/go1.9 /usr/local/go
-    GO_VERSION=1.22.4
+    GO_VERSION=1.23.4
    if [ x"$ARCH" = "xx86_64" ]; then
      GO_ARCH="amd64"
    elif [ x"$ARCH" = "xaarch64" ]; then
@@ -398,7 +398,7 @@ build_rpm(){
    ARCH=$(echo $(uname -m) | sed -e 's:i686:i386:g')
    echo "RHEL=${RHEL}" >> percona-toolkit.properties
    echo "ARCH=${ARCH}" >> percona-toolkit.properties
-    rpmbuild --target=x86_64 --define "version $VERSION" --define "VERSION $VERSION" --define "dist .el${RHEL}" --define "release $RPM_RELEASE.el${RHEL}" --define "_topdir ${WORKDIR}/rpmbuild" --rebuild rpmbuild/SRPMS/${SRC_RPM}
+    rpmbuild --target=${ARCH} --define "version $VERSION" --define "VERSION $VERSION" --define "dist .el${RHEL}" --define "release $RPM_RELEASE.el${RHEL}" --define "_topdir ${WORKDIR}/rpmbuild" --rebuild rpmbuild/SRPMS/${SRC_RPM}

    return_code=$?
    if [ $return_code != 0 ]; then
--- a/config/sphinx-build/conf.py
+++ b/config/sphinx-build/conf.py
@@ -48,9 +48,9 @@ copyright = u'2024, Percona LLC and/or its affiliates'
 # built documents.
 #
 # The short X.Y version.
-version = '3.6'
+version = '3.7'
 # The full version, including alpha/beta/rc tags.
-release = '3.6.0'
+release = '3.7.0'

 # The language for content autogenerated by Sphinx. Refer to documentation
 # for a list of supported languages.
--- a/docs/percona-toolkit.pod
+++ b/docs/percona-toolkit.pod
@@ -607,6 +607,6 @@ Place, Suite 330, Boston, MA  02111-1307  USA.

 =head1 VERSION

-Percona Toolkit v3.6.0 released 2024-06-12
+Percona Toolkit v3.7.0 released 2024-12-19

 =cut
--- a/docs/release_notes.rst
+++ b/docs/release_notes.rst
@@ -1,6 +1,26 @@
 Release Notes
 ***************

+v3.7.0 released 2024-12-23
+==============================
+
+New Feature
+------------------------------------------------------------
+
+* :jirabug:`PT-2340`: Support MySQL 8.4
+
+Improvements
+------------------------------------------------------------
+
+* :jirabug:`PT-2347`: Improper use of sha256 hash algorithm in percona-toolkit/src/go/pt-secure-collect /encrypt.go. Note that this improvement is an **incompatible change**. pt-secure-collect now uses KDF to encrypt and decrypt user passwords. As a result, pt-secure-collect v3.7.0 cannot decrypt data collected by earlier versions and vice versa.
+* `PR-862`: Fixed flaky tests (Thanks to Henning Pöttker for the contribution)
+* `PR-839`: Update pt-mysql-summary (Thanks to GOKUL S for the contribution)
+
+Bugs Fixed
+------------
+
+* :jirabug:`PT-2371`: pt-summary errors out with "STATUS_THP_SYSTEM: unbound variable" (Thanks to Jason Ng for the contribution)
+
 v3.6.0 released 2024-06-12
 ==============================

--- a/go.mod
+++ b/go.mod
@@ -1,13 +1,13 @@
 module github.com/percona/percona-toolkit

-go 1.22.4
+go 1.23.4

 require (
 	github.com/AlekSi/pointer v1.2.0
 	github.com/Ladicle/tabwriter v1.0.0
 	github.com/Masterminds/semver v1.5.0
 	github.com/alecthomas/kingpin v2.2.6+incompatible
-	github.com/alecthomas/kong v1.5.0
+	github.com/alecthomas/kong v1.6.0
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
 	github.com/go-ini/ini v1.67.0
 	github.com/golang/mock v1.6.0
@@ -27,12 +27,12 @@ require (
 	github.com/stretchr/testify v1.10.0
 	github.com/xlab/treeprint v1.2.0
 	go.mongodb.org/mongo-driver v1.17.1
-	golang.org/x/crypto v0.29.0
+	golang.org/x/crypto v0.31.0
 	golang.org/x/exp v0.0.0-20230321023759-10a507213a29
 	gopkg.in/mgo.v2 v2.0.0-20190816093944-a6b53ec6cb22
 	gopkg.in/yaml.v2 v2.4.0
-	k8s.io/api v0.31.3
-	k8s.io/utils v0.0.0-20240711033017-18e509b52bc8
+	k8s.io/api v0.32.0
+	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738
 )

 require (
@@ -46,6 +46,7 @@ require (
 	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/klauspost/compress v1.16.3 // indirect
+	github.com/kr/text v0.2.0 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.19 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
@@ -59,15 +60,16 @@ require (
 	github.com/xdg-go/stringprep v1.0.4 // indirect
 	github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
 	github.com/yusufpapurcu/wmi v1.2.2 // indirect
-	golang.org/x/net v0.26.0 // indirect
-	golang.org/x/sync v0.9.0 // indirect
-	golang.org/x/sys v0.27.0 // indirect
-	golang.org/x/term v0.26.0 // indirect
-	golang.org/x/text v0.20.0 // indirect
+	golang.org/x/net v0.33.0 // indirect
+	golang.org/x/sync v0.10.0 // indirect
+	golang.org/x/sys v0.28.0 // indirect
+	golang.org/x/term v0.27.0 // indirect
+	golang.org/x/text v0.21.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/apimachinery v0.31.3 // indirect
+	k8s.io/apimachinery v0.32.0 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
-	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
+	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.4.2 // indirect
+	sigs.k8s.io/yaml v1.4.0 // indirect
 )
--- a/go.sum
+++ b/go.sum
@@ -8,8 +8,8 @@ github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8v
 github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
 github.com/alecthomas/kingpin v2.2.6+incompatible h1:5svnBTFgJjZvGKyYBtMB0+m5wvrbUHiqye8wRJMlnYI=
 github.com/alecthomas/kingpin v2.2.6+incompatible/go.mod h1:59OFYbFVLKQKq+mqrL6Rw5bR0c3ACQaawgXx0QYndlE=
-github.com/alecthomas/kong v1.5.0 h1:pvJ7ucmgyBrGcdHVYD3xc9rqbcnVNRQ63mYv6KNrwYs=
-github.com/alecthomas/kong v1.5.0/go.mod h1:p2vqieVMeTAnaC83txKtXe8FLke2X07aruPWXyMPQrU=
+github.com/alecthomas/kong v1.6.0 h1:mwOzbdMR7uv2vul9J0FU3GYxE7ls/iX1ieMg5WIM6gE=
+github.com/alecthomas/kong v1.6.0/go.mod h1:p2vqieVMeTAnaC83txKtXe8FLke2X07aruPWXyMPQrU=
 github.com/alecthomas/repr v0.4.0 h1:GhI2A8MACjfegCPVq9f1FLvIBS+DrQ2KQBFZP1iFzXc=
 github.com/alecthomas/repr v0.4.0/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751 h1:JYp7IbQjafoB+tBA3gMyHYHrpOtNuDiK/uB5uXxq5wM=
@@ -17,6 +17,7 @@ github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuy
 github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137 h1:s6gZFSlWYmbqAuRjVTiNNhvNRfY2Wxp9nhfyel4rklc=
 github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137/go.mod h1:OMCwj8VM1Kc9e19TLln2VL61YJF0x1XFtfdL4JdbSyE=
 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
@@ -130,8 +131,8 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.29.0 h1:L5SG1JTTXupVV3n6sUqMTeWbjAyfPwoda2DLX8J8FrQ=
-golang.org/x/crypto v0.29.0/go.mod h1:+F4F4N5hv6v38hfeYwTdx20oUvLLc+QfrE9Ax9HtgRg=
+golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
+golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
 golang.org/x/exp v0.0.0-20230321023759-10a507213a29 h1:ooxPy7fPvB4kwsA2h+iBNHkAbp/4JxTSwCmvdjEYmug=
 golang.org/x/exp v0.0.0-20230321023759-10a507213a29/go.mod h1:CxIveKay+FTh1D0yPZemJVgC/95VzuuOLq5Qi4xnoYc=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
@@ -145,15 +146,17 @@ golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwY
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.26.0 h1:soB7SVo0PWrY4vPW/+ay0jKDNScG2X9wFeYlXIvJsOQ=
-golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE=
+golang.org/x/net v0.30.0 h1:AcW1SDZMkb8IpzCdQUaIq2sP4sZ4zw+55h6ynffypl4=
+golang.org/x/net v0.30.0/go.mod h1:2wGyMJ5iFasEhkwi13ChkO/t1ECNC4X4eBKkVFyYFlU=
+golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I=
+golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.9.0 h1:fEo0HyrW1GIgZdpbhCRO0PkJajUS5H9IFUztCgEo2jQ=
-golang.org/x/sync v0.9.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
+golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -169,18 +172,18 @@ golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.27.0 h1:wBqf8DvsY9Y/2P8gAfPDEYNuS30J4lPHJxXSb/nJZ+s=
-golang.org/x/sys v0.27.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
+golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.26.0 h1:WEQa6V3Gja/BhNxg540hBip/kkaYtRg3cxg4oXSw4AU=
-golang.org/x/term v0.26.0/go.mod h1:Si5m1o57C5nBNQo5z1iq+XDijt21BDBDp2bK0QI8e3E=
+golang.org/x/term v0.27.0 h1:WP60Sv1nlK1T6SupCHbXzSaN0b9wUmsPoRS9b61A23Q=
+golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
-golang.org/x/text v0.20.0 h1:gK/Kv2otX8gz+wn7Rmb3vT96ZwuoxnQlY+HlJVj7Qug=
-golang.org/x/text v0.20.0/go.mod h1:D4IsuqiFMhST5bX19pQ9ikHC2GsaKyk/oF+pn3ducp4=
+golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
+golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
@@ -199,23 +202,22 @@ gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/mgo.v2 v2.0.0-20190816093944-a6b53ec6cb22 h1:VpOs+IwYnYBaFnrNAeB8UUWtL3vEUnzSCL1nVjPhqrw=
 gopkg.in/mgo.v2 v2.0.0-20190816093944-a6b53ec6cb22/go.mod h1:yeKp02qBN3iKW1OzL3MGk2IdtZzaj7SFntXj72NppTA=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/api v0.31.3 h1:umzm5o8lFbdN/hIXbrK9oRpOproJO62CV1zqxXrLgk8=
-k8s.io/api v0.31.3/go.mod h1:UJrkIp9pnMOI9K2nlL6vwpxRzzEX5sWgn8kGQe92kCE=
-k8s.io/apimachinery v0.31.3 h1:6l0WhcYgasZ/wk9ktLq5vLaoXJJr5ts6lkaQzgeYPq4=
-k8s.io/apimachinery v0.31.3/go.mod h1:rsPdaZJfTfLsNJSQzNHQvYoTmxhoOEofxtOsF3rtsMo=
+k8s.io/api v0.32.0 h1:OL9JpbvAU5ny9ga2fb24X8H6xQlVp+aJMFlgtQjR9CE=
+k8s.io/api v0.32.0/go.mod h1:4LEwHZEf6Q/cG96F3dqR965sYOfmPM7rq81BLgsE0p0=
+k8s.io/apimachinery v0.32.0 h1:cFSE7N3rmEEtv4ei5X6DaJPHHX0C+upp+v5lVPiEwpg=
+k8s.io/apimachinery v0.32.0/go.mod h1:GpHVgxoKlTxClKcteaeuF1Ul/lDVb74KpZcxcmLDElE=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 h1:pUdcCO1Lk/tbT5ztQWOBi5HBgbBP1J8+AsQnQCKsi8A=
-k8s.io/utils v0.0.0-20240711033017-18e509b52bc8/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
-sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
-sigs.k8s.io/structured-merge-diff/v4 v4.4.1 h1:150L+0vs/8DA78h1u02ooW1/fFq/Lwr+sGiqlzvrtq4=
-sigs.k8s.io/structured-merge-diff/v4 v4.4.1/go.mod h1:N8hJocpFajUSSeSJ9bOZ77VzejKZaXsTtZo4/u7Io08=
+k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 h1:M3sRQVHv7vB20Xc2ybTt7ODCeFj6JSWYFzOFnYeS6Ro=
+k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 h1:/Rv+M11QRah1itp8VhT6HoVx1Ray9eB4DBr+K+/sCJ8=
+sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3/go.mod h1:18nIHnGi6636UCz6m8i4DhaJ65T6EruyzmoQqI2BVDo=
+sigs.k8s.io/structured-merge-diff/v4 v4.4.2 h1:MdmvkGuXi/8io6ixD5wud3vOLwc1rj0aNqRlpuvjmwA=
+sigs.k8s.io/structured-merge-diff/v4 v4.4.2/go.mod h1:N8f93tFZh9U6vpxwRArLiikrE5/2tiu1w1AGfACIGE4=
 sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
 sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
--- a/lib/Percona/Toolkit.pm
+++ b/lib/Percona/Toolkit.pm
@@ -18,7 +18,7 @@
 # ###########################################################################
 package Percona::Toolkit;

-our $VERSION = '3.6.0';
+our $VERSION = '3.7.0';

 use strict;
 use warnings FATAL => 'all';
--- a/lib/SQLParser.pm
+++ b/lib/SQLParser.pm
@@ -59,7 +59,7 @@ my $unquoted_ident = qr/
 my $ident_alias = qr/
  \s+                                 # space before alias
  (?:(AS)\s+)?                        # optional AS keyword
-  ((?>$quoted_ident|$unquoted_ident)) # alais
+  ((?>$quoted_ident|$unquoted_ident)) # alias
 /xi;

 # A table is identified by 1 or 2 identifiers separated by a period
--- a/requirements-docbuild.txt
+++ b/requirements-docbuild.txt
@@ -17,7 +17,6 @@ certifi>=2024.7.4 # not directly required, pinned by Snyk to avoid a vulnerabili
 jinja2>=3.1.4 # not directly required, pinned by Snyk to avoid a vulnerability
 pygments>=2.15.0 # not directly required, pinned by Snyk to avoid a vulnerability
 requests>=2.32.2 # not directly required, pinned by Snyk to avoid a vulnerability
-setuptools>=70.0.0 # not directly required, pinned by Snyk to avoid a vulnerability
-urllib3>=2.2.2 # not directly required, pinned by Snyk to avoid a vulnerability
-zipp>=3.19.1 # not directly required, pinned by Snyk to avoid a vulnerability
+setuptools>=65.5.1 # not directly required, pinned by Snyk to avoid a vulnerability
 idna>=3.7 # not directly required, pinned by Snyk to avoid a vulnerability
+urllib3>=2.2.2 # not directly required, pinned by Snyk to avoid a vulnerability
--- a/sandbox/servers/8.0/my.sandbox.cnf
+++ b/sandbox/servers/8.0/my.sandbox.cnf
@@ -40,3 +40,6 @@ binlog_format              = STATEMENT
 #performance-schema-instrument='wait/lock/metadata/sql/mdl=ON'
 #performance-schema-instrument='transaction=ON'
 secure-file-priv           =
+
+# wait_for_replica buggy on multi-threaded replica
+slave-parallel-workers=0
--- a/sandbox/servers/8.4/my.sandbox.cnf
+++ b/sandbox/servers/8.4/my.sandbox.cnf
@@ -40,3 +40,6 @@ binlog_format              = STATEMENT
 #performance-schema-instrument='wait/lock/metadata/sql/mdl=ON'
 #performance-schema-instrument='transaction=ON'
 secure-file-priv           =
+
+# wait_for_replica buggy on multi-threaded replica
+replica-parallel-workers=0
--- a/src/go/pt-secure-collect/collect.go
+++ b/src/go/pt-secure-collect/collect.go
@@ -3,7 +3,6 @@ package main
 import (
 	"archive/tar"
 	"compress/gzip"
-	"crypto/sha256"
 	"fmt"
 	"io"
 	"io/ioutil"
@@ -49,10 +48,14 @@ func collectData(opts *cliOptions) error {
 	}

 	if !*opts.NoEncrypt && *opts.EncryptPassword != "" {
-		password := sha256.Sum256([]byte(*opts.EncryptPassword))
+		key, err := deriveKey(*opts.EncryptPassword)
+		if err != nil {
+			return errors.WithStack(err)
+		}
+
 		encryptedFile := tarFile + ".aes"
 		log.Infof("Encrypting %q file into %q", tarFile, encryptedFile)
-		encrypt(tarFile, encryptedFile, password)
+		encrypt(tarFile, encryptedFile, key)
 	}

 	return nil
--- a/src/go/pt-secure-collect/ecncrypt_test.go
+++ b/src/go/pt-secure-collect/ecncrypt_test.go
@@ -0,0 +1,56 @@
+package main
+
+import (
+	"os"
+	"testing"
+
+	"github.com/AlekSi/pointer"
+	"github.com/stretchr/testify/require"
+)
+
+func TestEncrypt(t *testing.T) {
+	data := []byte("The quick brown fox jumps over the lazy dog")
+
+	input, err := os.CreateTemp(".", "*-input")
+	require.NoError(t, err)
+	t.Cleanup(func() { os.Remove(input.Name()) })
+
+	err = os.WriteFile(input.Name(), data, 0o600)
+	require.NoError(t, err)
+
+	output, err := os.CreateTemp(".", "*-output")
+	require.NoError(t, err)
+	t.Cleanup(func() { os.Remove(output.Name()) })
+
+	encrypted, err := os.CreateTemp(".", "*-encrypted")
+	require.NoError(t, err)
+	t.Cleanup(func() { os.Remove(encrypted.Name()) })
+
+	err = encryptorCmd(&cliOptions{
+		Command:         "encrypt",
+		EncryptPassword: pointer.ToString("password"),
+		EncryptInFile:   pointer.ToString(input.Name()),
+		EncryptOutFile:  pointer.ToString(encrypted.Name()),
+	})
+	require.NoError(t, err)
+
+	encryptedData, err := os.ReadFile(encrypted.Name())
+	require.NoError(t, err)
+
+	// Check that the encrypted data is different from the original data
+	require.NotEqual(t, data, encryptedData)
+
+	err = encryptorCmd(&cliOptions{
+		Command:         "decrypt",
+		EncryptPassword: pointer.ToString("password"),
+		DecryptInFile:   pointer.ToString(encrypted.Name()),
+		DecryptOutFile:  pointer.ToString(output.Name()),
+	})
+	require.NoError(t, err)
+
+	decryptedData, err := os.ReadFile(output.Name())
+	require.NoError(t, err)
+
+	// Check that the decrypted data is the same as the original data
+	require.Equal(t, data, decryptedData)
+}
--- a/src/go/pt-secure-collect/encrypt.go
+++ b/src/go/pt-secure-collect/encrypt.go
@@ -11,10 +11,50 @@ import (

 	"github.com/pkg/errors"
 	log "github.com/sirupsen/logrus"
+	"golang.org/x/crypto/hkdf"
 )

+var (
+	// hkdfInfo used as the context info for HKDF.
+	hkdfInfo = []byte("Percona Toolkit")
+
+	// salt is a random 256-byte array used as a salt for HKDF.
+	salt = [256]byte{
+		0x33, 0xc5, 0xc5, 0x5f, 0x3e, 0x81, 0xf6, 0x8d, 0x51, 0xd8, 0x18, 0xb9, 0xb7, 0x09, 0x70, 0x51,
+		0xc3, 0x60, 0x66, 0xef, 0xd4, 0x97, 0x2e, 0xdf, 0x11, 0x59, 0x34, 0x94, 0x47, 0xab, 0xd4, 0x44,
+		0xac, 0x2e, 0x89, 0x81, 0x85, 0xd5, 0x83, 0xbd, 0x2d, 0xb5, 0x43, 0xdd, 0xd7, 0x6c, 0x1b, 0xa7,
+		0x6d, 0x8f, 0xb7, 0x84, 0x33, 0x1a, 0x5e, 0x31, 0x76, 0x4b, 0x5d, 0x3b, 0x98, 0x38, 0xe3, 0x93,
+		0x28, 0xcc, 0x91, 0x30, 0x37, 0xb6, 0x06, 0xd2, 0xab, 0xdc, 0x9a, 0x14, 0xab, 0xb7, 0xd2, 0x90,
+		0xd6, 0x1f, 0x1c, 0xc1, 0x74, 0x2c, 0xc2, 0x08, 0x27, 0x68, 0x7a, 0xdd, 0xef, 0x6e, 0xb9, 0x59,
+		0xb0, 0x2f, 0x76, 0x36, 0xba, 0xd8, 0x55, 0x22, 0xba, 0x95, 0xd6, 0xfa, 0xa1, 0x69, 0xab, 0x95,
+		0x94, 0x1f, 0x61, 0x7f, 0x56, 0x34, 0xaa, 0x17, 0x78, 0xf8, 0xbb, 0xa0, 0x4e, 0x61, 0xad, 0xee,
+		0x51, 0x1c, 0x42, 0xa7, 0x07, 0x44, 0xd5, 0xa6, 0x16, 0x72, 0x1b, 0x05, 0x4e, 0xd4, 0xbf, 0x32,
+		0x7d, 0xec, 0x8d, 0x4b, 0x19, 0xd2, 0x32, 0x50, 0x3d, 0x1f, 0x2a, 0x51, 0xc9, 0x62, 0x22, 0x75,
+		0xb5, 0xde, 0x0d, 0x58, 0x2b, 0x3a, 0xf8, 0x0e, 0xfc, 0x43, 0x07, 0xc3, 0x60, 0x65, 0x83, 0x3d,
+		0xa9, 0x84, 0x02, 0x3a, 0x13, 0x85, 0x3e, 0x8d, 0x87, 0x04, 0xee, 0x58, 0x8d, 0x9a, 0xbc, 0xc0,
+		0xec, 0xdd, 0x92, 0xf3, 0x96, 0x03, 0x86, 0xbe, 0x51, 0xb8, 0x96, 0xd5, 0x38, 0xed, 0x03, 0x7b,
+		0x18, 0x77, 0x26, 0xaf, 0x15, 0x94, 0x60, 0x25, 0x1b, 0x3f, 0x57, 0xa7, 0xe4, 0xe6, 0x63, 0xf8,
+		0xe2, 0xca, 0x15, 0x3d, 0xa3, 0xee, 0xcb, 0xef, 0xb3, 0x23, 0x41, 0x54, 0xd4, 0xaa, 0x93, 0xb4,
+		0x48, 0xd3, 0x97, 0x7c, 0x39, 0x5e, 0x1d, 0x05, 0x93, 0x34, 0x70, 0xdf, 0xd6, 0xf0, 0x30, 0xc7,
+	}
+)
+
+// deriveKey derives a cryptographically strong key from password.
+func deriveKey(password string) ([]byte, error) {
+	hkdf := hkdf.New(sha256.New, []byte(password), salt[:], hkdfInfo)
+	key := make([]byte, 32)
+	if _, err := io.ReadFull(hkdf, key); err != nil {
+		return nil, errors.Wrap(err, "Cannot derive key from password")
+	}
+
+	return key, nil
+}
+
 func encryptorCmd(opts *cliOptions) (err error) {
-	password := sha256.Sum256([]byte(*opts.EncryptPassword))
+	key, err := deriveKey(*opts.EncryptPassword)
+	if err != nil {
+		return errors.WithStack(err)
+	}

 	switch opts.Command {
 	case "decrypt":
@@ -22,19 +62,18 @@ func encryptorCmd(opts *cliOptions) (err error) {
 			*opts.DecryptOutFile = strings.TrimSuffix(filepath.Base(*opts.DecryptInFile), ".aes")
 		}
 		log.Infof("Decrypting file %q into %q", *opts.DecryptInFile, *opts.DecryptOutFile)
-		err = decrypt(*opts.DecryptInFile, *opts.DecryptOutFile, password)
+		err = decrypt(*opts.DecryptInFile, *opts.DecryptOutFile, key)
 	case "encrypt":
 		if *opts.EncryptOutFile == "" {
 			*opts.EncryptOutFile = filepath.Base(*opts.EncryptInFile) + ".aes"
 		}
 		log.Infof("Encrypting file %q into %q", *opts.EncryptInFile, *opts.EncryptOutFile)
-		err = encrypt(*opts.EncryptInFile, *opts.EncryptOutFile, password)
+		err = encrypt(*opts.EncryptInFile, *opts.EncryptOutFile, key)
 	}
 	return
 }

-func encrypt(infile, outfile string, pass [32]byte) error {
-	key := pass[:]
+func encrypt(infile, outfile string, key []byte) error {
 	inFile, err := os.Open(infile)
 	if err != nil {
 		return errors.Wrapf(err, "Cannot open input file %q", infile)
@@ -64,8 +103,7 @@ func encrypt(infile, outfile string, pass [32]byte) error {
 	return nil
 }

-func decrypt(infile, outfile string, pass [32]byte) error {
-	key := pass[:]
+func decrypt(infile, outfile string, key []byte) error {
 	inFile, err := os.Open(infile)
 	if err != nil {
 		return errors.Wrapf(err, "Cannot open %q for reading", infile)
--- a/t/pt-table-checksum/chunk_size.t
+++ b/t/pt-table-checksum/chunk_size.t
@@ -104,7 +104,7 @@ unlike(
   $output,
   qr/Cannot checksum table/,
   "Very small --chunk-time doesn't cause zero --chunk-size"
-);
+) or diag($output);
 }
 # #############################################################################
 # Bug 921700: pt-table-checksum doesn't add --where to chunk-oversize test
--- a/t/pt-table-checksum/pt-1616.t
+++ b/t/pt-table-checksum/pt-1616.t
@@ -12,7 +12,7 @@ use English qw(-no_match_vars);
 use Test::More;

 #if ( !$ENV{SLOW_TESTS} ) { 
-#   plan skip_all => "pt-table-checksum/replication_filters.t is one of the top slowest files; set SLOW_TESTS=1 to enable it.";
+#   plan skip_all => "pt-table-checksum/pt-1616.t is one of the top slowest files; set SLOW_TESTS=1 to enable it.";
 #}

 use PerconaTest;
@@ -105,6 +105,5 @@ unlike(
 # Done.
 # #############################################################################
 $sb->wipe_clean($dbh);
-$sb->wait_for_replicas();
 ok($sb->ok(), "Sandbox servers") or BAIL_OUT(__FILE__ . " broke the sandbox");
 exit;
--- a/t/pt-table-checksum/resume.t
+++ b/t/pt-table-checksum/resume.t
@@ -127,7 +127,7 @@ is_deeply(
      [qw( sakila city          )],
   ],
   "Checksum results for 1/4 of sakila singles"
-);
+) or diag(Dumper($row));

 $output = output(
   sub { pt_table_checksum::main(@args, qw(-d sakila --resume --chunk-size 10000)) },
--- a/t/pt-table-sync/safety_checks.t
+++ b/t/pt-table-sync/safety_checks.t
@@ -146,9 +146,8 @@ like(

 $replica1_dbh->do("STOP ${replica_name}");
 $replica1_dbh->do("CHANGE ${source_change} TO ${source_name}_port=12345, ${source_name}_user='msandbox'");
-$replica1_dbh->do("START ${replica_name}");
-$replica1_dbh->do("STOP ${replica_name}");
-$replica1_dbh->do("CHANGE ${source_change} TO ${source_name}_port=12345, ${source_name}_user='msandbox'");
+$source_dbh->do("RESET ${source_reset}");
+$replica1_dbh->do("RESET ${replica_name}");
 $replica1_dbh->do("START ${replica_name}");

 # #############################################################################
Author	SHA1	Message	Date
snyk-bot	7b417bf37d	fix: requirements-docbuild.txt to reduce vulnerabilities The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-REQUESTS-6928867 - https://snyk.io/vuln/SNYK-PYTHON-URLLIB3-7267250	2024-12-23 13:19:51 +00:00
Sveta Smirnova	4a8e83d136	Merge pull request #905 from percona/release-v3.7.0 Release v3.7.0	2024-12-23 16:19:03 +03:00
Surabhi Bhat	8eced865d3	Update build script for PT arm packages	2024-12-20 18:16:54 +05:30
Surabhi Bhat	1f33ae4f3c	Update go version to 1.23.4	2024-12-20 15:09:45 +05:30
Sveta Smirnova	3f46642bee	Merge pull request #899 from alina-derkach-oaza/PT-2406-3.7.0 PT-2406 Release notes for Percona Toolkit version 3.7.0	2024-12-19 20:25:46 +03:00
Sveta Smirnova	08a7a62b13	Update docs/release_notes.rst	2024-12-19 20:25:34 +03:00
Alina Derkach	eb803d49d6	PT-2406 Release notes for Percona Toolkit version 3.7.0 modified: docs/release_notes.rst	2024-12-19 18:12:53 +01:00
Sveta Smirnova	3e37fd25f0	Release 3.7.0 - Updated release date	2024-12-19 18:50:11 +03:00
Sveta Smirnova	02ada0ddc9	Release 3.7.0 - Updated version	2024-12-19 18:41:01 +03:00
Sveta Smirnova	8fc5f6c2f3	Release 3.7.0 - Updated version of the golang.org/x/net package to 0.33.0	2024-12-19 17:52:10 +03:00
Sveta Smirnova	4d2cdcf50a	Release 3.7.0 - Updated version of Go in go.mod to 1.23.4	2024-12-19 17:48:06 +03:00
Sveta Smirnova	e9fb4101fd	Merge branch '3.x' into release-v3.7.0	2024-12-19 17:42:43 +03:00
Sveta Smirnova	64a05713f2	Merge branch 'Changelog' into release-v3.7.0	2024-12-19 17:42:11 +03:00
Sveta Smirnova	d86389077b	Release 3.7.0	2024-12-19 17:40:01 +03:00
Sveta Smirnova	010f05200e	Merge pull request #898 from percona/fix-typos Fix typos	2024-12-19 17:33:56 +03:00
Sveta Smirnova	f81373e583	Merge branch '3.x' into release-v3.7.0	2024-12-18 20:40:21 +03:00
Sveta Smirnova	c019ecfb8a	Merge pull request #896 from percona/PT-2347-kdf PT-2347 Use KDF instead of hash	2024-12-18 20:39:00 +03:00
Artem Gavrilov	c4260e5d7a	Fix typos	2024-12-18 16:11:27 +02:00
Artem Gavrilov	91fec36bac	PT-2347 Refactoring	2024-12-18 15:27:16 +02:00
Artem Gavrilov	d661be484c	PT-2347 Add test	2024-12-18 15:18:30 +02:00
Artem Gavrilov	3dd1f7da83	PT-2347 Update collect.go	2024-12-18 00:54:15 +02:00
Artem Gavrilov	78f2030485	PT-2347 Use KDF instead of hash	2024-12-17 23:00:25 +02:00
Sveta Smirnova	118c9e0855	Merge branch '3.x' into release-v3.7.0	2024-12-16 15:24:53 +03:00
Sveta Smirnova	754c40628d	Merge pull request #894 from percona/dependabot/go_modules/golang.org/x/crypto-0.31.0 build(deps): bump golang.org/x/crypto from 0.29.0 to 0.31.0	2024-12-16 15:24:19 +03:00
dependabot[bot]	6b367b4a7a	build(deps): bump golang.org/x/crypto from 0.29.0 to 0.31.0 Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.29.0 to 0.31.0. - [Commits](https://github.com/golang/crypto/compare/v0.29.0...v0.31.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>	2024-12-16 12:23:53 +00:00
Sveta Smirnova	1a0265bc1b	Merge pull request #893 from percona/dependabot/go_modules/golang.org/x/crypto-0.30.0 build(deps): bump golang.org/x/crypto from 0.29.0 to 0.30.0	2024-12-16 15:23:06 +03:00
Sveta Smirnova	dea8e1e573	Merge branch '3.x' into dependabot/go_modules/golang.org/x/crypto-0.30.0	2024-12-16 15:22:52 +03:00
Sveta Smirnova	cac0e6b083	Merge pull request #892 from percona/dependabot/go_modules/github.com/alecthomas/kong-1.6.0 build(deps): bump github.com/alecthomas/kong from 1.5.0 to 1.6.0	2024-12-16 15:21:53 +03:00
Sveta Smirnova	5f31e57a84	Merge pull request #895 from percona/dependabot/go_modules/k8s.io/api-0.32.0 build(deps): bump k8s.io/api from 0.31.3 to 0.32.0	2024-12-16 15:21:40 +03:00
Sveta Smirnova	9f1e50cb58	PT-2340 - Support MySQL 8.4 - Changed replica_parallel_workers in configuration for 8.0 and 8.4 to o, because wiat_for_replicas is buggy for multi-threaded slaves (cherry picked from commit `d9b0219d9e`) - Minor tests diagnostic and cleanup	2024-12-16 13:23:41 +03:00
dependabot[bot]	8212b87188	build(deps): bump k8s.io/api from 0.31.3 to 0.32.0 Bumps [k8s.io/api](https://github.com/kubernetes/api) from 0.31.3 to 0.32.0. - [Commits](https://github.com/kubernetes/api/compare/v0.31.3...v0.32.0) --- updated-dependencies: - dependency-name: k8s.io/api dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2024-12-16 09:17:29 +00:00
dependabot[bot]	71bf9d6e19	build(deps): bump golang.org/x/crypto from 0.29.0 to 0.30.0 Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.29.0 to 0.30.0. - [Commits](https://github.com/golang/crypto/compare/v0.29.0...v0.30.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2024-12-09 09:47:04 +00:00
dependabot[bot]	569a3e0540	build(deps): bump github.com/alecthomas/kong from 1.5.0 to 1.6.0 Bumps [github.com/alecthomas/kong](https://github.com/alecthomas/kong) from 1.5.0 to 1.6.0. - [Commits](https://github.com/alecthomas/kong/compare/v1.5.0...v1.6.0) --- updated-dependencies: - dependency-name: github.com/alecthomas/kong dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2024-12-09 09:47:00 +00:00