release-8.5: add dependency security fixes to v8.5.8 release notes (#23710)

[ti-chi-bot]

This is an automated cherry-pick of #23710

What is changed, added or deleted? (Required)

• Add TiKV, TiCDC, and DM dependency security updates to the TiDB 8.5.8 release notes
• Add the TiCDC Grafana build information fix
• Group related TiCDC dependency updates into one user-facing entry while preserving the source issue and PR references

Which TiDB version(s) do your changes apply to? (Required)

• master (the latest development version)
• v8.5 (TiDB 8.5 versions)
• v8.4 (TiDB 8.4 versions)
• v8.3 (TiDB 8.3 versions)
• v8.2 (TiDB 8.2 versions)
• v8.1 (TiDB 8.1 versions)
• v7.5 (TiDB 7.5 versions)
• v7.1 (TiDB 7.1 versions)
• v6.5 (TiDB 6.5 versions)

What is the related PR or file link(s)?

• This PR is translated from:
• Other reference link(s):
  • [release-8.5] *: upgrade vulnerable Rust dependencies tikv/tikv#19933
  • deps(all): update TiDB and vulnerable dependencies tiflow#12776
  • deps(dm): update vulnerable dependencies on release-8.5 tiflow#12784
  • deps: update TiFlow, TiDB, and vulnerable modules ticdc#5829
  • *: bump crypto and aws-sdk-go-v2 (#5699) ticdc#5700
  • metrics: fix build info metric (#5648) ticdc#5756

AI agent involvement

• The changes in this PR were primarily made by an AI agent on behalf of the PR author.

Do your changes match any of the following descriptions?

• Delete files
• Change aliases
• Need modification after applied to another branch
• Might cause conflicts after applied to another branch

Summary by CodeRabbit

• Documentation
  • Added release notes for TiDB 8.5.8, released August 27, 2026.
  • Included quick-access links and a summary of changes from the previous release.
  • Documented optimizer and TiCDC improvements.
  • Listed bug fixes across TiDB, TiKV, PD, TiFlash, Backup & Restore, DM, TiCDC, and TiDB Lightning.
  • Covered fixes for DDL backfill, query planning, statistics, SQL infrastructure, transactions, resource control, security, and replication.

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign hfxsd for approval. For more information see the Code Review Process.
Please ensure that each of them provides their approval before proceeding.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR adds TiDB 8.5.8 release notes with release metadata, TiDB and TiCDC improvements, bug fixes across core components and tools, and a link to the code changes from v8.5.7.

Changes

TiDB 8.5.8 release notes

Layer / File(s)	Summary
Release metadata and improvements releases/release-8.5.8.md	Adds the release date, version information, documentation links, and improvement entries for TiDB and TiCDC.
Core component bug fixes releases/release-8.5.8.md	Lists bug fixes for TiDB, TiKV, PD, and TiFlash.
Tools fixes and release reference releases/release-8.5.8.md	Lists fixes for BR, DM, TiCDC, and TiDB Lightning, and links to code changes between v8.5.7 and v8.5.8.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Merge Risk: 🔵 Low · up to eb13a

The 8.5.8 release notes do not tell users about the TiCDC Grafana build-information fix, creating a limited documentation gap with low merge risk.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the release branch, the dependency security fixes, and the affected v8.5.8 release notes. It matches the primary change.
Description check	✅ Passed	The description covers the required change summary, affected TiDB version, related references, AI involvement, and applicable change categories. It is sufficiently complete for this documentation upda…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: af863347-ebc4-449e-8223-f95b64c91c2f

📥 Commits

Reviewing files that changed from the base of the PR and between e734689 and eb13a4a.

📒 Files selected for processing (1)

• releases/release-8.5.8.md

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

[coderabbitai]

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Document the TiCDC Grafana build information fix.

The PR objective requires a user-facing entry for this fix, but the TiCDC subsection contains no Grafana-related item. Add the fix with its source issue and pull request references before merging. Exact references are not provided here, so a committable suggestion would risk inventing release metadata.