From 2db93727d6501bfd6ce169401977b183c6ad858b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 11 Sep 2026 18:33:18 +0000 Subject: [PATCH 1/4] Bump mysql2 from 3.24.3 to 3.24.4 Bumps [mysql2](https://github.com/sidorares/node-mysql2) from 3.24.3 to 3.24.4. - [Release notes](https://github.com/sidorares/node-mysql2/releases) - [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md) - [Commits](https://github.com/sidorares/node-mysql2/compare/v3.24.3...v3.24.4) --- updated-dependencies: - dependency-name: mysql2 dependency-version: 3.24.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 14fc213b1..da110bb29 100644 --- a/package-lock.json +++ b/package-lock.json @@ -8477,9 +8477,9 @@ "license": "ISC" }, "node_modules/mysql2": { - "version": "3.24.3", - "resolved": "https://registry.npmjs.org/mysql2/-/mysql2-3.24.3.tgz", - "integrity": "sha512-OKfWHkMAg9v06neq8FmSyhbxPQKABN9PAW5G9/bDTXzJBO5xXtkKL0V27vju7HQWk9UD4Od5BZsvCtBTB1CPEw==", + "version": "3.24.4", + "resolved": "https://registry.npmjs.org/mysql2/-/mysql2-3.24.4.tgz", + "integrity": "sha512-A2olluVlj0mvgyIRRISMEzXc51m+21mRtcMVjJyIpt2GG98+XrC9m9HzsqcMsX2LcnfccJvY5NB22g8fENBnOA==", "license": "MIT", "dependencies": { "aws-ssl-profiles": "^1.1.2", From c3f19c83f17a6a37780ae23c32c9716fff404b8d Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 11 Sep 2026 18:39:05 +0000 Subject: [PATCH 2/4] Document mysql2 patch update Co-authored-by: jainakanksha-msft <181211853+jainakanksha-msft@users.noreply.github.com> --- ChangeLog.md | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog.md b/ChangeLog.md index 57354faa5..380c91855 100644 --- a/ChangeLog.md +++ b/ChangeLog.md @@ -6,6 +6,7 @@ General: +- Updated lockfile-resolved `mysql2` from 3.24.3 to 3.24.4 for upstream patch fixes; no Azurite code changes were required. - Fixed `--oauth` without a value crashing during startup and unsupported OAuth levels being silently ignored. Azurite now reports the supported OAuth levels across all command-line entrypoints while treating the VS Code extension's empty default as unconfigured. (issue #2525) - Updated `actions/checkout` from 4.4.0 to 7.0.1 and `actions/setup-node` from 4.4.0 to 7.0.0 so the CI workflows use the actions' Node.js 24 runtimes (workflow `node-version` settings are unchanged). - Fixed SharedKey/SharedKeyLite authentication failing when both `date` and `x-ms-date` request headers are present. Blob and Queue now sign an empty `Date` field and Table signs the `x-ms-date` value, matching Azure Storage. (issue #1385) From e02cf800dc1fb35edd4584db15a6d6a43a77d120 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 21 Sep 2026 06:49:31 +0000 Subject: [PATCH 3/4] Consolidate mysql2 changelog entries Co-authored-by: jainakanksha-msft <181211853+jainakanksha-msft@users.noreply.github.com> --- ChangeLog.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/ChangeLog.md b/ChangeLog.md index 380c91855..54969900f 100644 --- a/ChangeLog.md +++ b/ChangeLog.md @@ -6,7 +6,7 @@ General: -- Updated lockfile-resolved `mysql2` from 3.24.3 to 3.24.4 for upstream patch fixes; no Azurite code changes were required. +- Updated lockfile-resolved `mysql2` from 3.23.4 to 3.24.4 to correct three-byte length-coded parameter encoding, improve SQL metadata-store performance, include an unrelated `PoolCluster` typings fix (not used by Azurite), and pick up upstream patch fixes; added SQL pool regression coverage for large bound parameters. - Fixed `--oauth` without a value crashing during startup and unsupported OAuth levels being silently ignored. Azurite now reports the supported OAuth levels across all command-line entrypoints while treating the VS Code extension's empty default as unconfigured. (issue #2525) - Updated `actions/checkout` from 4.4.0 to 7.0.1 and `actions/setup-node` from 4.4.0 to 7.0.0 so the CI workflows use the actions' Node.js 24 runtimes (workflow `node-version` settings are unchanged). - Fixed SharedKey/SharedKeyLite authentication failing when both `date` and `x-ms-date` request headers are present. Blob and Queue now sign an empty `Date` field and Table signs the `x-ms-date` value, matching Azure Storage. (issue #1385) @@ -18,11 +18,9 @@ General: - Bumped `morgan` from `^1.11.0` to `^1.12.0` (lockfile resolved to 1.12.0) to remediate CVE-2026-15603 (log forging via Unicode line separators in access log tokens). - Updated lockfile-resolved `@typescript-eslint/eslint-plugin` and `@typescript-eslint/parser` versions from 8.67.0 through 8.69.0 for bug fixes and rule updates. - Updated the lockfile-resolved `picomatch` version from 4.0.5 to 4.0.7 to fix glob scanning and terminal globstars in parenthesized patterns. -- Updated lockfile-resolved `mysql2` from 3.23.4 to 3.24.2 to correct three-byte length-coded parameter encoding and improve SQL metadata-store performance; added SQL pool regression coverage for large bound parameters. - Updated lockfile-resolved `eslint` from 10.9.0 to 10.10.0 for linting fixes (including the trailing-decimal `no-loss-of-precision` false-positive fix); added package-scripts coverage to confirm Azurite still runs `eslint` on `"src/**/*.ts"`. - Removed npm and its transitive dependencies from the Linux Docker runtime image while retaining Node.js and all existing JavaScript entrypoints, addressing the npm-related vulnerability reports in issue #2758. - Updated lockfile-resolved `qs` from 6.15.3 to 6.16.0 for query-string parsing fixes. -- Updated lockfile-resolved `mysql2` from 3.24.2 to 3.24.3 for an unrelated `PoolCluster` typings fix (not used by Azurite). - Updated the lockfile-resolved `@types/vscode` dev dependency from 1.134.0 to 1.136.0 for current VS Code API declarations; added `tests/common/vscStatusBarItem.test.ts` covering the extension status bar transitions against the updated typings. - Updated the lockfile-resolved `globals` dev dependency from 17.11.0 to 17.12.0 for a refreshed list of environment global identifiers used by ESLint config. - Updated lockfile-resolved transitive `js-yaml` versions (4.3.1 -> 4.3.2 and 5.2.3 -> 5.4.1) for upstream parser/security fixes. From b8f19b1ae94b93ca18f7af0ac32dda2c990bf61e Mon Sep 17 00:00:00 2001 From: Akanksha Jain Date: Mon, 21 Sep 2026 12:26:27 +0530 Subject: [PATCH 4/4] Update Changelog --- ChangeLog.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog.md b/ChangeLog.md index 54969900f..165678d5f 100644 --- a/ChangeLog.md +++ b/ChangeLog.md @@ -6,7 +6,7 @@ General: -- Updated lockfile-resolved `mysql2` from 3.23.4 to 3.24.4 to correct three-byte length-coded parameter encoding, improve SQL metadata-store performance, include an unrelated `PoolCluster` typings fix (not used by Azurite), and pick up upstream patch fixes; added SQL pool regression coverage for large bound parameters. +- Updated lockfile-resolved `mysql2` from 3.23.4 to 3.24.4 to correct three-byte length-coded parameter encoding. - Fixed `--oauth` without a value crashing during startup and unsupported OAuth levels being silently ignored. Azurite now reports the supported OAuth levels across all command-line entrypoints while treating the VS Code extension's empty default as unconfigured. (issue #2525) - Updated `actions/checkout` from 4.4.0 to 7.0.1 and `actions/setup-node` from 4.4.0 to 7.0.0 so the CI workflows use the actions' Node.js 24 runtimes (workflow `node-version` settings are unchanged). - Fixed SharedKey/SharedKeyLite authentication failing when both `date` and `x-ms-date` request headers are present. Blob and Queue now sign an empty `Date` field and Table signs the `x-ms-date` value, matching Azure Storage. (issue #1385)