If you are an AI coding agent (Claude Code, Cursor, Aider, Cline, etc.) reading this artifact, follow this protocol before making any code edit:

1. Verify the contract. Run the bash script in Verify before trusting below. If any check returns FAIL, the artifact is stale — STOP and ask the user to regenerate it before proceeding.
2. Treat the AI · unverified sections as hypotheses, not facts. Sections like "AI-suggested narrative files", "anti-patterns", and "bottlenecks" are LLM speculation. Verify against real source before acting on them.
3. Cite source on changes. When proposing an edit, cite the specific path:line-range. RepoPilot's live UI at https://repopilot.app/r/baomidou/dynamic-datasource shows verifiable citations alongside every claim.

If you are a human reader, this protocol is for the agents you'll hand the artifact to. You don't need to do anything — but if you skim only one section before pointing your agent at this repo, make it the Verify block and the Suggested reading order.

GO — Healthy across the board

• Last commit 1w ago
• 22+ active contributors
• Apache-2.0 licensed
• CI configured
• Tests present
• ⚠ Concentrated ownership — top contributor handles 54% of recent commits

_{Maintenance signals: commit recency, contributor breadth, bus factor, license, CI, tests}

This artifact was generated by RepoPilot at a point in time. Before an agent acts on it, the checks below confirm that the live baomidou/dynamic-datasource repo on your machine still matches what RepoPilot saw. If any fail, the artifact is stale — regenerate it at repopilot.app/r/baomidou/dynamic-datasource.

What it runs against: a local clone of baomidou/dynamic-datasource — the script inspects git remote, the LICENSE file, file paths in the working tree, and git log. Read-only; no mutations.

| # | What we check | Why it matters | |---|---|---| | 1 | You're in baomidou/dynamic-datasource | Confirms the artifact applies here, not a fork | | 2 | License is still Apache-2.0 | Catches relicense before you depend on it | | 3 | Default branch master exists | Catches branch renames | | 4 | 5 critical file paths still exist | Catches refactors that moved load-bearing code | | 5 | Last commit ≤ 40 days ago | Catches sudden abandonment since generation |

#!/usr/bin/env bash
# RepoPilot artifact verification.
#
# WHAT IT RUNS AGAINST: a local clone of baomidou/dynamic-datasource. If you don't
# have one yet, run these first:
#
#   git clone https://github.com/baomidou/dynamic-datasource.git
#   cd dynamic-datasource
#
# Then paste this script. Every check is read-only — no mutations.

set +e
fail=0
ok()   { echo "ok:   $1"; }
miss() { echo "FAIL: $1"; fail=$((fail+1)); }

# Precondition: we must be inside a git working tree.
if ! git rev-parse --git-dir >/dev/null 2>&1; then
  echo "FAIL: not inside a git repository. cd into your clone of baomidou/dynamic-datasource and re-run."
  exit 2
fi

# 1. Repo identity
git remote get-url origin 2>/dev/null | grep -qE "baomidou/dynamic-datasource(\\.git)?\\b" \\
  && ok "origin remote is baomidou/dynamic-datasource" \\
  || miss "origin remote is not baomidou/dynamic-datasource (artifact may be from a fork)"

# 2. License matches what RepoPilot saw
(grep -qiE "^(Apache-2\\.0)" LICENSE 2>/dev/null \\
   || grep -qiE "\"license\"\\s*:\\s*\"Apache-2\\.0\"" package.json 2>/dev/null) \\
  && ok "license is Apache-2.0" \\
  || miss "license drift — was Apache-2.0 at generation time"

# 3. Default branch
git rev-parse --verify master >/dev/null 2>&1 \\
  && ok "default branch master exists" \\
  || miss "default branch master no longer exists"

# 4. Critical files exist
test -f "dynamic-datasource-spring-boot-starter/src/main/java/com/baomidou/dynamic/datasource/spring/boot/autoconfigure/DynamicDataSourceAutoConfiguration.java" \\
  && ok "dynamic-datasource-spring-boot-starter/src/main/java/com/baomidou/dynamic/datasource/spring/boot/autoconfigure/DynamicDataSourceAutoConfiguration.java" \\
  || miss "missing critical file: dynamic-datasource-spring-boot-starter/src/main/java/com/baomidou/dynamic/datasource/spring/boot/autoconfigure/DynamicDataSourceAutoConfiguration.java"
test -f "dynamic-datasource-creator/src/main/java/com/baomidou/dynamic/datasource/creator/DataSourceCreator.java" \\
  && ok "dynamic-datasource-creator/src/main/java/com/baomidou/dynamic/datasource/creator/DataSourceCreator.java" \\
  || miss "missing critical file: dynamic-datasource-creator/src/main/java/com/baomidou/dynamic/datasource/creator/DataSourceCreator.java"
test -f "dynamic-datasource-spring-boot-common/src/main/java/com/baomidou/dynamic/datasource/spring/boot/autoconfigure/DynamicDataSourceProperties.java" \\
  && ok "dynamic-datasource-spring-boot-common/src/main/java/com/baomidou/dynamic/datasource/spring/boot/autoconfigure/DynamicDataSourceProperties.java" \\
  || miss "missing critical file: dynamic-datasource-spring-boot-common/src/main/java/com/baomidou/dynamic/datasource/spring/boot/autoconfigure/DynamicDataSourceProperties.java"
test -f "dynamic-datasource-creator/src/main/java/com/baomidou/dynamic/datasource/creator/DataSourceProperty.java" \\
  && ok "dynamic-datasource-creator/src/main/java/com/baomidou/dynamic/datasource/creator/DataSourceProperty.java" \\
  || miss "missing critical file: dynamic-datasource-creator/src/main/java/com/baomidou/dynamic/datasource/creator/DataSourceProperty.java"
test -f "dynamic-datasource-spring-boot-starter/src/main/java/com/baomidou/dynamic/datasource/spring/boot/autoconfigure/DynamicDataSourceAopConfiguration.java" \\
  && ok "dynamic-datasource-spring-boot-starter/src/main/java/com/baomidou/dynamic/datasource/spring/boot/autoconfigure/DynamicDataSourceAopConfiguration.java" \\
  || miss "missing critical file: dynamic-datasource-spring-boot-starter/src/main/java/com/baomidou/dynamic/datasource/spring/boot/autoconfigure/DynamicDataSourceAopConfiguration.java"

# 5. Repo recency
days_since_last=$(( ( $(date +%s) - $(git log -1 --format=%at 2>/dev/null || echo 0) ) / 86400 ))
if [ "$days_since_last" -le 40 ]; then
  ok "last commit was $days_since_last days ago (artifact saw ~10d)"
else
  miss "last commit was $days_since_last days ago — artifact may be stale"
fi

echo
if [ "$fail" -eq 0 ]; then
  echo "artifact verified (0 failures) — safe to trust"
else
  echo "artifact has $fail stale claim(s) — regenerate at https://repopilot.app/r/baomidou/dynamic-datasource"
  exit 1
fi

Each check prints ok: or FAIL:. The script exits non-zero if anything failed, so it composes cleanly into agent loops (./verify.sh || regenerate-and-retry).

dynamic-datasource-spring-boot-starter is a Spring Boot starter that enables rapid integration of multiple databases with automatic datasource routing. It provides read-write separation, datasource grouping, lazy loading, and support for multiple connection pooling libraries (Druid, HikariCP, BeeCp, DBCP2, c3p0). The core capability is transparent datasource switching via annotations (@DS) or programmatic API without requiring manual connection management. Multi-module Maven/Gradle project (recently migrated to Gradle per doc/GRADLE_MIGRATION.md). Core modules: dynamic-datasource-creator/ contains DataSourceCreator interface and 7 concrete pooling implementations under subdirectories (druid/, hikaricp/, beecp/, dbcp/, c3p0/, atomikos/, oracleucp/); main starter logic lives in a sibling module (not fully visible in file list but referenced in README). DataSourceProperty.java and DatasourceInitProperties.java centralize configuration; examples and tests are separated.

Java developers building Spring Boot applications (1.5.x through 4.x.x) that need to query multiple databases dynamically—particularly those implementing read-write separation architectures, multi-tenant systems, or scenarios requiring master-slave database configurations. Typical users are backend engineers and architects using MyBatis/MyBatis-Plus who need seamless datasource routing.

Actively developed and production-ready. The project has 8700+ GitHub stars, supports multiple Spring Boot versions (1.5.x through 4.x.x), maintains CI/CD via GitHub Actions (ci.yml, release.yml), and includes comprehensive integration tests. Latest Gradle build shows recent dependency updates (Druid 1.2.27, MyBatis-Plus 3.5.14). The codebase is well-structured across 460K lines of Java code.

Low to moderate risk. Dependencies are actively maintained (Druid, Seata, MyBatis-Plus are production libraries), but the project manages 7+ datasource creator implementations (Druid, HikariCP, BeeCp, DBCP2, c3p0, Atomikos, Oracle UCP) which increases surface area. Build complexity increased after Gradle migration (see doc/GRADLE_MIGRATION.md), and JDK 8+ baseline with JDK 11+ requirement for publishing could affect contributor accessibility. Single repository structure may create coordination challenges across Spring Boot version branches.

Recent focus on Gradle migration (BUILD_FIX_SUMMARY.md, GRADLE_OPTIMIZATION_SUMMARY.md, QUICK_FIX_REFERENCE.md present). GitHub workflows show active CI/CD with release automation. Project appears to be stabilizing around Spring Boot 3.x/4.x support (versions 3.5.7 and 4.0.0 pinned in build.gradle). No specific open issues visible in file list, but documentation is being actively maintained (latest docs at https://doc.xiuceyun.cn).

git clone https://github.com/baomidou/dynamic-datasource.git
cd dynamic-datasource
# For JDK 11+: gradle build
# For JDK 8: gradle test (build without publish)
# Or use wrapper if present: ./gradlew build

Daily commands: No standalone 'server' to run—this is a library/starter. To use in a project: (1) add dependency com.baomidou:dynamic-datasource-spring-boot-starter:latest to build.gradle; (2) configure in application.yml (see README for datasource.dynamic config); (3) inject DynamicRoutingDataSource or use @DS annotation on methods. For development, run gradle test or gradle build to verify.

• dynamic-datasource-spring-boot-starter/src/main/java/com/baomidou/dynamic/datasource/spring/boot/autoconfigure/DynamicDataSourceAutoConfiguration.java — Core auto-configuration entry point that initializes the dynamic datasource framework and integrates with Spring Boot lifecycle.
• dynamic-datasource-creator/src/main/java/com/baomidou/dynamic/datasource/creator/DataSourceCreator.java — Abstract factory pattern for creating datasource instances; every datasource type implementation depends on this interface.
• dynamic-datasource-spring-boot-common/src/main/java/com/baomidou/dynamic/datasource/spring/boot/autoconfigure/DynamicDataSourceProperties.java — Configuration properties binding class that maps all YAML/properties datasource configurations; required for understanding config structure.
• dynamic-datasource-creator/src/main/java/com/baomidou/dynamic/datasource/creator/DataSourceProperty.java — Data model for individual datasource properties; essential for understanding how datasource metadata flows through the system.
• dynamic-datasource-spring-boot-starter/src/main/java/com/baomidou/dynamic/datasource/spring/boot/autoconfigure/DynamicDataSourceAopConfiguration.java — AOP configuration that intercepts @DS annotation and routes queries to selected datasource; core routing mechanism.
• dynamic-datasource-creator/src/main/java/com/baomidou/dynamic/datasource/creator/druid/DruidDataSourceCreator.java — Most common datasource pool implementation (Druid); reference implementation showing how to extend DataSourceCreator.
• dynamic-datasource-creator/src/main/java/com/baomidou/dynamic/datasource/creator/hikaricp/HikariDataSourceCreator.java — HikariCP implementation; demonstrates lightweight pool alternative to Druid with different configuration patterns.

Add support for a new connection pool type

1. Create a new pool config class in dynamic-datasource-creator/src/main/java/com/baomidou/dynamic/datasource/creator/<poolname>/ extending DataSourceProperty with pool-specific fields (dynamic-datasource-creator/src/main/java/com/baomidou/dynamic/datasource/creator/DataSourceProperty.java)
2. Implement DataSourceCreator interface with createDataSource(DataSourceProperty) method that instantiates your pool (dynamic-datasource-creator/src/main/java/com/baomidou/dynamic/datasource/creator/DataSourceCreator.java)
3. Register the new creator in DynamicDataSourceCreatorAutoConfiguration using @ConditionalOnClass to check pool availability (dynamic-datasource-spring-boot-common/src/main/java/com/baomidou/dynamic/datasource/spring/boot/autoconfigure/DynamicDataSourceCreatorAutoConfiguration.java)
4. Add configuration schema documentation to DynamicDataSourceProperties for your pool's unique settings (dynamic-datasource-spring-boot-common/src/main/java/com/baomidou/dynamic/datasource/spring/boot/autoconfigure/DynamicDataSourceProperties.java)

Add a new datasource selection strategy

1. Create a new processor class in dynamic-datasource-spring-boot-starter/src/main/java/com/baomidou/dynamic/datasource/processor/ following the pattern of DsHeaderProcessor (dynamic-datasource-spring-boot-starter/src/main/java/com/baomidou/dynamic/datasource/processor/DsHeaderProcessor.java)
2. Implement the processor interface with logic to extract/determine datasource name from your source (e.g., JWT claim, database row, environment variable) (dynamic-datasource-spring-boot-starter/src/main/java/com/baomidou/dynamic/datasource/processor/DsSessionProcessor.java)
3. Register your processor bean in DynamicDataSourceAopConfiguration so the AOP aspect can use it (dynamic-datasource-spring-boot-starter/src/main/java/com/baomidou/dynamic/datasource/spring/boot/autoconfigure/DynamicDataSourceAopConfiguration.java)

Enable distributed transactions with XA support

1. Set spring.datasource.dynamic.seata-mode to 'XA' in application.yml (dynamic-datasource-spring-boot-common/src/main/java/com/baomidou/dynamic/datasource/spring/boot/autoconfigure/DynamicDataSourceProperties.java)
2. Use AtomikosDataSourceCreator by adding atomikos dependency; it will auto-wrap datasources as XA data sources (dynamic-datasource-creator/src/main/java/com/baomidou/dynamic/datasource/creator/atomikos/AtomikosDataSourceCreator.java)
3. The SeataDataSourceProxyChecker validates that Seata proxy is properly applied to all datasources at startup (dynamic-datasource-spring-boot-starter/src/main/java/com/baomidou/dynamic/datasource/check/SeataDataSourceProxyChecker.java)

1. Spring Boot version isolation: build.gradle defines 3 distinct versions (2.7.18, 3.5.7, 4.0.0); JDK 8 cannot publish (gradle-maven-publish-plugin v0.32.0 requires JDK 11+), only test. 2. Datasource grouping via underscore naming is mandatory (first segment before _ is group name)—non-obvious to new users. 3. Default datasource name is 'master' (configurable via spring.datasource.dynamic.primary); forgetting this causes silent routing failures. 4. Thread-local datasource context: switching datasources is thread-scoped; async operations may lose context without explicit propagation. 5. No datasource startup is allowed if none configured (support for startup without datasources is a feature, but requires explicit enable flag).

• Datasource Routing via Thread-Local Context — This repo's core mechanism: @DS annotation sets thread-local state that DynamicRoutingDataSource reads to pick the active connection pool. Understanding thread-local scope is critical to avoid context leakage in async/reactive code.
• Connection Pooling Strategy Pattern — DataSourceCreator interface uses Strategy pattern; each pooling library (Druid, HikariCP, BeeCp, etc.) is a concrete strategy. New contributors must understand this to add pool support.
• Read-Write Separation Load Balancing — The repo supports master-slave configurations with automatic read routing; understanding load-balancing algorithms (round-robin, random) applied to datasource groups is essential for performance tuning.
• Spring Boot Auto-Configuration — This project is itself a Spring Boot starter; understanding @Configuration, @ConditionalOnClass, and @Bean lifecycle is required to extend or debug the initialization logic.
• Two-Phase Commit (2PC) / Distributed Transactions — Seata integration (1.4.2) enables ACID guarantees across multiple datasources; understanding 2PC consensus is critical for financial/transactional use cases.
• Lazy Loading / Deferred Initialization — DatasourceInitProperties supports lazy datasource creation (instantiate only when first used); reduces startup time for systems with 50+ databases but complicates error surfacing.
• Property Encryption with Custom Markers — The repo supports ENC() syntax for encrypted database credentials (mentioned in README); understanding cipher text handling and decryption hooks is important for secure credential management.

• alibaba/druid — Druid is the default/primary datasource pooling library supported; understanding its configuration (DruidConfig.java, DruidStatConfigUtil.java) requires knowledge of Druid's API.
• brettwooldridge/HikariCP — HikariCP is the secondary high-performance pooling option supported (HikariDataSourceCreator.java); widely used in Spring Boot production deployments.
• baomidou/mybatis-plus — MyBatis-Plus (3.5.14) is the primary ORM partner for dynamic-datasource; the integration provides @DS annotation routing within MyBatis query execution.
• seata/seata — Seata (1.4.2) is integrated for distributed transaction management across multiple datasources; essential for read-write separation with ACID guarantees.
• p6spy/p6spy — P6spy (3.9.1) is integrated for SQL logging and monitoring across dynamically-routed datasources; helps debug routing behavior in production.

To work on one of these in Claude Code or Cursor, paste: Implement the "<title>" PR idea from CLAUDE.md, working through the checklist as the task list.

Add comprehensive integration tests for multiple datasource pool creators

The repo supports 8+ datasource creators (Druid, HikariCP, Dbcp2, C3p0, BeeCp, Atomikos, OracleUCP, Basic) but lacks integration tests verifying pool creation, connection validation, and failover behavior. This ensures each creator works correctly across Spring Boot 2.x, 3.x, and 4.x versions, catching regressions early.

• [ ] Create dynamic-datasource-creator/src/test/java/com/baomidou/dynamic/datasource/creator/ directory structure
• [ ] Add integration tests for each creator: DruidDataSourceCreatorTest, HikariDataSourceCreatorTest, Dbcp2DataSourceCreatorTest, etc.
• [ ] Test pool property binding (idle timeout, max connections, validation query) for each creator
• [ ] Add tests verifying datasource switch and connection persistence across pool types
• [ ] Configure test fixtures in dynamic-datasource-creator/src/test/resources/application-test.properties

Add GitHub Actions workflow for testing against multiple JDK versions (8, 11, 17, 21)

The repo declares support for JDK 8+ and Spring Boot 1.5.x through 4.x but lacks CI verification across version matrix. The build.gradle conditionally loads plugins based on JDK version, making cross-version testing critical. Current .github/workflows/ci.yml likely lacks multi-JDK matrix testing.

• [ ] Extend .github/workflows/ci.yml to add a JDK matrix strategy with versions: [8, 11, 17, 21]
• [ ] Add separate build steps for Spring Boot 2.x (JDK 8+), 3.x (JDK 17+), and 4.x (JDK 17+)
• [ ] Include test execution: ./gradlew test -PspringBootVersion=2.7.18 for JDK 8, and 3.5.7/4.0.0 for JDK 17+
• [ ] Verify gradle-maven-publish-plugin conditional loading works correctly per JDK version
• [ ] Add failure notifications if any JDK version breaks builds

Add documentation and examples for Seata distributed transaction integration with dynamic datasources

The code references SeataMode enum and seataVersion dependency (1.4.2) in build.gradle, indicating Seata support, but no configuration examples or usage docs exist in doc/ folder. Contributors struggle with enabling XA transactions across dynamically switched datasources. Missing doc/SEATA_INTEGRATION.md or examples in test suite.

• [ ] Create doc/SEATA_INTEGRATION.md with configuration examples for global, branch, and AT transaction modes
• [ ] Document the SeataMode enum usage (AT, XA, TCC) in the context of dynamic datasource switching
• [ ] Add test case in dynamic-datasource-creator/src/test/java/ demonstrating Seata XADataSourceEnum integration
• [ ] Include example application-seata.properties showing datasource + Seata configuration together
• [ ] Document known limitations (e.g., datasource switching within active Seata transaction constraints)

• Add integration tests for the Oracle UCP datasource creator (dynamic-datasource-creator/src/main/java/com/baomidou/dynamic/datasource/creator/oracleucp/) which has only stub files—write unit tests verifying datasource creation, connection pooling, and property binding.
• Improve configuration validation in DataSourceProperty.java by adding @Validated annotations and custom validators for URL format, pool size constraints, and encryption marker detection (ENC() syntax); currently no compile-time validation of config schema.
• Extend Gradle build configuration to generate per-Spring-Boot-version Maven BOMs (Bill of Materials); currently each version requires manual version alignment—automate this to reduce integration pain.

• High · Outdated Druid Dependency — build.gradle - druidVersion = "1.2.27". Druid version 1.2.27 contains known security vulnerabilities. Druid has had multiple CVEs including SQL injection and information disclosure issues in versions before 1.2.23+. The specific version 1.2.27 should be verified for critical patches. Fix: Update to the latest Druid version and review CVE databases (NVD, Druid security advisories) for any disclosed vulnerabilities in 1.2.27. Consider upgrading to 1.2.28 or later if available.
• High · Potential SQL Injection via Raw SQL Processing — dynamic-datasource-creator/src/main/java/com/baomidou/dynamic/datasource/creator/ (multiple creator classes). The codebase handles datasource creation and SQL execution across multiple database pools (Druid, HikariCP, DBCP2, etc). Multiple database drivers and the presence of P6Spy (SQL spy/logging tool) suggest raw SQL query handling. Without visible input validation layers in the file structure, there's risk of SQL injection through datasource configuration or SQL parameters. Fix: Implement comprehensive input validation for all SQL-related operations. Use parameterized queries exclusively. Review CryptoUtils.java and DsConfigUtil.java for proper encryption of sensitive config parameters. Ensure P6Spy is configured securely in production.
• High · Potential Credential Exposure in Configuration — dynamic-datasource-creator/src/main/java/com/baomidou/dynamic/datasource/creator/DataSourceProperty.java, toolkit/Base64.java, toolkit/CryptoUtils.java. DataSourceProperty.java and DsConfigUtil.java handle datasource credentials (passwords, usernames). The presence of Base64.java suggests credential encoding, but Base64 is not encryption and provides zero security. Credentials may be exposed in logs, memory, or configuration files without proper encryption. Fix: Enforce AES or similar strong encryption for all stored credentials. Never use Base64 for sensitive data. Implement secure credential storage (e.g., Spring Cloud Config encryption, external vaults). Review CryptoUtils implementation to ensure it uses strong algorithms. Mask passwords in logs and error messages.
• Medium · Atomikos Version May Contain XA Vulnerabilities — build.gradle - atomikosVersion = "4.0.6". Atomikos 4.0.6 is several versions behind the latest releases. Distributed transaction frameworks have historically had security issues. This version (released ~2021) may have unpatched vulnerabilities related to transaction handling, serialization, or XA protocol exploitation. Fix: Update Atomikos to the latest stable version (check Maven Central for current releases). Review Atomikos security advisories and changelogs for any critical patches released after 4.0.6.
• Medium · Dynamic Datasource Creation Without Apparent Validation — dynamic-datasource-spring-boot-common/src/main/java/com/baomidou/dynamic/datasource/spring/boot/autoconfigure/. The framework supports dynamic datasource creation at runtime (DynamicDataSourceAssistConfiguration.java, DynamicDataSourceProperties.java). Without visible input sanitization in the file structure, dynamically created datasources from untrusted configuration sources could lead to SSRF, connection hijacking, or credential theft. Fix: Implement strict validation for all dynamic datasource configuration parameters: URL format validation, hostname/port whitelisting, credential validation. Prevent SSRF by validating target hosts against an allow-list. Log all datasource creation attempts for audit purposes.
• Medium · Potential Insecure Deserialization Risk — build.gradle - seataVersion = "1.4.2". The presence of multiple connection pool implementations and SEATA (distributed transactions) suggests potential serialization/deserialization of transaction data. Insecure deserialization could lead to RCE if untrusted data is deserialized. Fix: Validate SEATA 1.4.2 for known deserialization vulnerabilities. Use explicit object input stream filters if deserializing untrusted data. Consider upgrading SEATA to the latest version. Enable serialization filters in the JVM (-Djdk.serialFilter).
• Medium · Missing Security Headers Configuration — undefined. Fix: undefined

LLM-derived; treat as a starting point, not a security audit.

• Open issues — current backlog
• Recent PRs — what's actively shipping
• Source on GitHub

Generated by RepoPilot. Verdict based on maintenance signals — see the live page for receipts. Re-run on a new commit to refresh.