RockteMQ-AI commented on issue #3103: URL: https://github.com/apache/rocketmq-dashboard/issues/3103#issuecomment-5535977170
**Issue Evaluation** Category: `bug` | Status: **Confirmed** Thank you for the thorough analysis. The cross-instance configuration update defect is a valid and serious bug. **Root Cause:** After registry-based discovery was introduced, Broker rows from `listRegistryClusters()` retain their registry cluster identity but not their source instance identity. Configuration actions (preview/update/diff) read `selectedInstanceIdRef.current` from the route, which may differ from the actual instance owning the registry row. This causes configuration updates to be sent to the wrong RocketMQ instance. **Impact:** - Silent configuration changes to the wrong production cluster - Can affect flush mode, auto-create settings, queue counts, message size limits, retention, permissions - Successful response does not reveal the target mismatch - High severity (P1) - data safety and operational correctness at risk **Severity:** High (silent control-plane write to wrong instance) **Next Steps:** The suggested acceptance criteria (canonicalizing full instance identity per registry row and failing closed when ownership is ambiguous) is the correct approach. An automated fix proposal will be generated. Reply `/approve` to proceed with PR generation. --- *Automated evaluation by RockteMQ-AI* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
