[dependabot]

Updates the requirements on pymysql to permit the latest version.

Release notes

Sourced from pymysql's releases.

v1.2.3

Full Changelog: PyMySQL/PyMySQL@v1.2.2...v1.2.3

Changelog

Sourced from pymysql's changelog.

v1.2.3

Release date: 2026-09-17

Restored the ability to import pymysql.converters.escape_bytes_prefixed for compatibility with aiomysql.

Use pymysql.converters at your own risk. It's internal functions. No backward compatibility are guaranteed.

v1.2.2

Release date: 2026-09-17

Restored the ability to import pymysql.converters.escape_dict for compatibility with aiomysql. This function does not escape dictionaries and is entirely unnecessary. Unless you use aiomysql, there is no need to upgrade from v1.2.1.

v1.2.1 (security fix)

Release date: 2026-09-17

Fixed a SQL injection vulnerability caused by incorrect escaping of bytes parameters when using the big5, gbk, sjis, cp932, or gb18030 character sets. This vulnerability also occurs when strings decoded from bytes using surrogateescape are passed as query parameters.

See also: https://github.com/PyMySQL/PyMySQL/security/advisories/GHSA-x4f8-9hx9-hpp9

• Queries are now encoded using the strict error handler instead of surrogateescape. Queries that cannot be encoded using the connection encoding can no longer be sent.

• bytes parameters are now always sent as hexadecimal literals, such as X'636174'. Note that this increases the number of bytes sent.

• The binary_prefix parameter of connect() is deprecated. The _binary prefix is no longer sent.

These changes address the confirmed SQL injection vulnerabilities related to character encoding. However, we strongly recommend using UTF-8 (utf8mb4). Other character sets are not thoroughly tested, and their limited use means that problems may go unreported. In the 2020s, encodings other than UTF-8 should be considered legacy.

v1.2.0

... (truncated)

Commits

• c990e86 v1.2.3
• c93fd97 add escape_bytes_prefixed. do not use it.
• dea8954 release v1.2.2
• 4f953ba fix: add escape_dict alias for aiomysql compatibility
• e13a28f ruff format
• 26a031d Prepare 1.2.1 security release
• a1547f5 Merge commit from fork
• 10739bc fix pymysql authentication state machine issue (#1271)
• 0fa39e9 agent: document local MySQL test setup (#1270)
• 55c604c perf: optimize packet reading and parsing (#1268)
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.