Skip to content

Bump mysql2 from 3.16.3 to 3.19.1#2

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/mysql2-3.19.1
Open

Bump mysql2 from 3.16.3 to 3.19.1#2
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/mysql2-3.19.1

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Mar 15, 2026

Bumps mysql2 from 3.16.3 to 3.19.1.

Release notes

Sourced from mysql2's releases.

v3.19.1

3.19.1 (2026-03-09)

Security Bug Fixes

  • bound null-terminated string read to packet end (fixes a potential OOB read reported by Doruk Tan Ozturk (peaktwilight)) (#4161) (91c5229)
  • handle malformed geometry payloads (fixes a potential DoS vulnerability reported by Doruk Tan Ozturk (peaktwilight)) (#4164) (1869215)
  • prevent query param override of URL-defined connection options (fixes a potential config injection vulnerability reported by Doruk Tan Ozturk (peaktwilight)) (#4162) (3123b4e)
  • validate buffer bounds in geometry parser (fixes a potential DoS vulnerability reported by Doruk Tan Ozturk (peaktwilight)) (#4159) (7c2ae00)

v3.19.0

3.19.0 (2026-03-05)

Features

  • use server's preferred auth method to eliminate auth switch roundtrip (#4140) (b57c671)

Bug Fixes

  • fix precision loss for large decimal values (#4135) (099beea)

v3.18.2

3.18.2 (2026-02-26)

Bug Fixes

  • types: add supportBigNumbers, bigNumberStrings, dateStrings, and timezone options to QueryOptions (#4127) (b274e72)
  • types: extend QueryValues to callback-based methods (#4129) (2ad5f0b)
  • types: improve ExecuteValues "nested" params (#4133) (3f94950)
  • types: support Raw and Uint8Array params (#4132) (bde9aec)

v3.18.1

3.18.1 (2026-02-25)

Bug Fixes

  • types: ensure optional params in query and execute methods (#4123) (3f4bbca)

v3.18.0

3.18.0 (2026-02-23)

Features

  • add Symbol.dispose and Symbol.asyncDispose support for Connections, Pools, and Pool Clusters (#4112) (1e612dc)

... (truncated)

Changelog

Sourced from mysql2's changelog.

3.19.1 (2026-03-09)

Bug Fixes

  • bound null-terminated string read to packet end (fixes a potential OOB read reported by Doruk Tan Ozturk (peaktwilight)) (#4161) (91c5229)
  • handle malformed geometry payloads (fixes a potential DoS vulnerability reported by Doruk Tan Ozturk (peaktwilight)) (#4164) (1869215)
  • prevent query param override of URL-defined connection options (fixes a potential config injection vulnerability reported by Doruk Tan Ozturk (peaktwilight)) (#4162) (3123b4e)
  • validate buffer bounds in geometry parser (fixes a potential DoS vulnerability reported by Doruk Tan Ozturk (peaktwilight)) (#4159) (7c2ae00)

3.19.0 (2026-03-05)

Features

  • use server's preferred auth method to eliminate auth switch roundtrip (#4140) (b57c671)

Bug Fixes

  • fix precision loss for large decimal values (#4135) (099beea)

3.18.2 (2026-02-26)

Bug Fixes

  • types: add supportBigNumbers, bigNumberStrings, dateStrings, and timezone options to QueryOptions (#4127) (b274e72)
  • types: extend QueryValues to callback-based methods (#4129) (2ad5f0b)
  • types: improve ExecuteValues "nested" params (#4133) (3f94950)
  • types: support Raw and Uint8Array params (#4132) (bde9aec)

3.18.1 (2026-02-25)

Bug Fixes

  • types: ensure optional params in query and execute methods (#4123) (3f4bbca)

3.18.0 (2026-02-23)

Features

  • add Symbol.dispose and Symbol.asyncDispose support for Connections, Pools, and Pool Clusters (#4112) (1e612dc)

3.17.5 (2026-02-23)

Bug Fixes

... (truncated)

Commits
  • fa06903 chore(master): release 3.19.1 (#4160)
  • 1869215 fix: handle malformed geometry payloads (fixes a potential DoS vulnerability ...
  • 3123b4e fix: prevent query param override of URL-defined connection options (fixes ...
  • 91c5229 fix: bound null-terminated string read to packet end (fixes a potential OOB...
  • 7c2ae00 fix: validate buffer bounds in geometry parser (fixes a potential DoS vulnera...
  • 1490783 build(deps-dev): bump @​types/node from 25.3.3 to 25.3.5 in /website (#4157)
  • 9708848 build(deps-dev): bump @​types/node from 25.3.3 to 25.3.5 (#4155)
  • d8d69c4 build(deps-dev): bump poku from 3.0.2 to 4.0.0 in /website (#4158)
  • d207686 ci: define a timeout for tests (#4154)
  • bb74a52 chore(master): release 3.19.0 (#4139)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot @github
Copy link
Author

dependabot bot commented on behalf of github Mar 15, 2026

Labels

The following labels could not be found: dependencies, security. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot bot requested a review from GVN2307 as a code owner March 15, 2026 07:38
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/mysql2-3.19.1 branch from b1caa3e to 02b90f3 Compare March 15, 2026 08:18
Bumps [mysql2](https://github.com/sidorares/node-mysql2) from 3.16.3 to 3.19.1.
- [Release notes](https://github.com/sidorares/node-mysql2/releases)
- [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md)
- [Commits](sidorares/node-mysql2@v3.16.3...v3.19.1)

---
updated-dependencies:
- dependency-name: mysql2
  dependency-version: 3.19.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/mysql2-3.19.1 branch from 02b90f3 to 37f2687 Compare March 15, 2026 08:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants