Skip to content

feat(deps): Bump mysql2 from 3.19.1 to 3.23.2 - #23263

Open
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/mysql2-3.23.2
Open

feat(deps): Bump mysql2 from 3.19.1 to 3.23.2#23263
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/mysql2-3.23.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 11, 2026

Copy link
Copy Markdown
Contributor

Bumps mysql2 from 3.19.1 to 3.23.2.

Release notes

Sourced from mysql2's releases.

v3.23.2

3.23.2 (2026-07-27)

Bug Fixes

  • correct connectAttributes typo in ChangeUser packet (#4423) (f64ce07), closes #2140
  • don't leave a failed execute as the active command (#4425) (fbd64b6)

v3.23.1

3.23.1 (2026-07-19)

Bug Fixes

  • security: fix unbounded decompression of server-supplied compressed packets, reported by alanturing881 (7c48343)
  • parser: call typeCast for NULL values in the binary protocol (#4394) (01f1092)

v3.23.0

3.23.0 (2026-07-13)

Features

  • return unsafe integers inside JSON columns as exact strings with supportBigNumbers (#4388) (a26ff14)
  • sql-escaper: add Temporal support when escaping values (#4392) (6b933f6)
  • support MariaDB data types (UUID, INET4, INET6, VECTOR, JSON) via extended type metadata; run CI against MariaDB (#4373) (5034e57)

v3.22.6

3.22.6 (2026-07-07)

Bug Fixes

  • sql-escaper: resolve multi statement and expand object regressions (#4380) (1b927a9)

v3.22.5

3.22.5 (2026-06-06)

Bug Fixes

  • keep 00:00:00 time for TIMESTAMP in binary protocol with dateStrings (#4327) (2af33a1)

v3.22.4

3.22.4 (2026-05-24)

Bug Fixes

... (truncated)

Changelog

Sourced from mysql2's changelog.

3.23.2 (2026-07-27)

Bug Fixes

  • correct connectAttributes typo in ChangeUser packet (#4423) (f64ce07), closes #2140
  • don't leave a failed execute as the active command (#4425) (fbd64b6)

3.23.1 (2026-07-19)

Bug Fixes

  • security: fix unbounded decompression of server-supplied compressed packets, reported by alanturing881 (7c48343)
  • parser: call typeCast for NULL values in the binary protocol (#4394) (01f1092)

3.23.0 (2026-07-13)

Features

  • return unsafe integers inside JSON columns as exact strings with supportBigNumbers (#4388) (a26ff14)
  • sql-escaper: add Temporal support when escaping values (#4392) (6b933f6)
  • support MariaDB data types (UUID, INET4, INET6, VECTOR, JSON) via extended type metadata; run CI against MariaDB (#4373) (5034e57)

3.22.6 (2026-07-07)

Bug Fixes

  • sql-escaper: resolve multi statement and expand object regressions (#4380) (1b927a9)

3.22.5 (2026-06-06)

Bug Fixes

  • keep 00:00:00 time for TIMESTAMP in binary protocol with dateStrings (#4327) (2af33a1)

3.22.4 (2026-05-26)

Bug Fixes

3.22.3 (2026-04-24)

Bug Fixes

... (truncated)

Commits
  • a987302 chore(master): release 3.23.2 (#4424)
  • 6c0cbc6 build(deps): bump postcss from 8.5.15 to 8.5.23 in /website (#4437)
  • 2aec892 build(deps): bump lucide-react from 1.26.0 to 1.27.0 in /website (#4436)
  • 4f7a589 build(deps): bump sass from 1.101.7 to 1.102.0 in /website (#4435)
  • 992adc5 build(deps): bump lucide-react from 1.25.0 to 1.26.0 in /website (#4431)
  • 26c956b build(deps): bump sass from 1.101.6 to 1.101.7 in /website (#4432)
  • e6a1cf7 build(deps): bump sass from 1.101.3 to 1.101.6 in /website (#4427)
  • 3f240ce build(deps): bump fast-uri from 3.1.2 to 3.1.4 in /website (#4422)
  • 28ad315 build(deps): bump immutable from 5.1.5 to 5.1.9 in /website (#4421)
  • 67821f8 build(deps): bump svgo from 3.3.3 to 3.3.4 in /website (#4420)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mysql2 since your current version.


@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 11, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner August 11, 2026 09:00
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 11, 2026
@dependabot
dependabot Bot requested review from mydea and removed request for a team August 11, 2026 09:00
@dependabot dependabot Bot added the javascript Pull requests that update javascript code label Aug 11, 2026
@dependabot
dependabot Bot requested a review from JPeer264 August 11, 2026 09:00

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit a933b86. Configure here.

"mongoose": "^6.13.10",
"mysql": "^2.18.1",
"mysql2": "^3.19.1",
"mysql2": "^3.23.2",

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bump breaks pre-3.20 mysql2 tests

Medium Severity

Bumping mysql2 from 3.19.1 to 3.23.2 crosses the 3.20.0 instrumentation boundary. The mysql2 suite expects the orchestrion path (auto.db.mysql2, legacy semconv attrs, unsanitized literals), but >= 3.20.0 uses native diagnostics channels (auto.db.mysql2.diagnostic_channel) instead. Orchestrion is gated to < 3.20.0, and the >= 3.20.0 path is already covered by mysql2-tracing-channel via additionalDependencies.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit a933b86. Configure here.

@JPeer264

Copy link
Copy Markdown
Member

@dependabot rebase

Bumps [mysql2](https://github.com/sidorares/node-mysql2) from 3.19.1 to 3.23.2.
- [Release notes](https://github.com/sidorares/node-mysql2/releases)
- [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md)
- [Commits](sidorares/node-mysql2@v3.19.1...v3.23.2)

---
updated-dependencies:
- dependency-name: mysql2
  dependency-version: 3.23.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/mysql2-3.23.2 branch from a933b86 to c174bc5 Compare August 11, 2026 14:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant