"ERROR 1524 (HY000): Plugin 'mysql_native_password' is not loaded" on ubuntu-latest (Ubuntu 26.04): MySQL 8.4 on the runner, and the ways out
The runner images come with MySQL installed but stopped. On ubuntu-24.04 it is MySQL 8.0.46; on ubuntu-26.04, which ubuntu-latest moves to during November 2026, it is MySQL 8.4.11 (the runner image READMEs). MySQL's documentation says the mysql_native_password plugin is deprecated as of 8.0.34, disabled by default in 8.4 and removed in 9.0.0. A step that switches a user to that plugin, common in WordPress and other PHP test setups, now fails on every job, even though nothing in the repository changed.
What it looks like
Run sudo systemctl start mysql mysql -h 127.0.0.1 --port 3306 -u root --password=root -e "ALTER USER 'root'@'localhost' IDENTIFIED WITH mysql_native_password BY 'root';" ERROR 1524 (HY000) at line 1: Plugin 'mysql_native_password' is not loaded
(tarosky/workflows #145, where the failing jobs showed Image: ubuntu-26.04 and the passing ones the day before Image: ubuntu-24.04.) The same step failed in convertkit-wordpress #1270, pantheon-hud #267, eventespresso/actions #77 and flarum #5273 between October 22 and November 4, 2026.
The ways out
- Drop the switch if your client does not need it. eventespresso/actions #77 found that PHP 7.4.4 and later log in with
caching_sha2_password, the MySQL 8 default, and flarum #5273 now runs theALTER USERonly for its PHP 7.3 jobs. If you still need to set the password, set it with the default plugin:ALTER USER 'root'@'localhost' IDENTIFIED BY 'root';(pantheon-hud #267). - For a client that only speaks
mysql_native_password, turn the plugin on before MySQL starts. MySQL's documentation givesmysql_native_password=ONin the[mysqld]section. convertkit-wordpress #1270 adds this step beforesudo systemctl start mysql.service:printf '[mysqld]\nloose-mysql_native_password=ON\n' | sudo tee /etc/mysql/mysql.conf.d/native-password.cnf
Theloose-prefix makes MySQL 8.0 on ubuntu-24.04 ignore the option instead of refusing to start, so the same workflow runs on both. - To buy time, pin
runs-on: ubuntu-24.04, which keeps MySQL 8.0 (tarosky/workflows #145). Ubuntu 24.04 is not being retired with this change, but the pin only postpones the move. - A
mysql:9ormysql:latestservice container has nomysql_native_passwordat all, so only the first way works there.
Check which MySQL you are talking to
tarosky/workflows #145 also found that its services.mysql container (mysql:8.0) had never been used: with ports: - 3306/tcp, Docker gives the container a random host port, such as 32768, and the tests on 127.0.0.1:3306 reached the runner's own MySQL instead. Map it with - 3306:3306, or read the port from job.services.mysql.ports['3306'], and do not start the runner's MySQL in the same job.
mysql -h 127.0.0.1 -P 3306 -u root -proot -e "SELECT VERSION(), @@hostname;"
Telling it apart
- The job uses PostgreSQL and fails with "unrecognized configuration parameter "transaction_timeout"": pg_dump 18 on Ubuntu 26.04.
- Other tools that changed with the image: what changes when ubuntu-latest moves to Ubuntu 26.04.
See failed jobs from IntelliJ IDEA
Pipeline Inbox for GitHub Actions Workflows, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, lists the runs of all your repositories in an IDE tool window, with their jobs and steps, so the database step that started failing across your repositories after the image change is easy to spot, and your current branch's runs are in the status bar. Reading is free; re-running failed jobs, cancelling, running workflows and reviewing deployments are Pro (US$1.50 a month, with a 30-day trial).
Get it on JetBrains Marketplace
GitHub and GitHub Actions are trademarks of GitHub, Inc.; MySQL is a trademark of Oracle and/or its affiliates; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with, sponsored or endorsed by GitHub, Inc., Oracle or JetBrains.
More: pg_dump 18 on Ubuntu 26.04 · "The ubuntu-latest label will migrate to Ubuntu 26" · GitHub Actions plugins for IntelliJ IDEA compared · 日本語