Skip to content

chore(deps): bump pymysql from 1.2.3 to 1.2.4 - #1274

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/pymysql-1.2.4
Open

dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/pymysql-1.2.4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 12, 2026

Copy link
Copy Markdown
Contributor

Bumps pymysql from 1.2.3 to 1.2.4.

Release notes

Sourced from pymysql's releases.

v1.2.4

What's Changed

New Contributors

Full Changelog: PyMySQL/PyMySQL@v1.2.3...v1.2.4

Changelog

Sourced from pymysql's changelog.

v1.2.4 (security fix)

Release date: 2026-11-09

Fixed a SQL injection vulnerability caused by incorrect escaping of string values inside tuple, list, set, or frozenset query parameters when the NO_BACKSLASH_ESCAPES SQL mode is enabled.

Sequence items are now escaped through Connection.escape() so they respect the connection's SQL mode.

See also: https://github.com/PyMySQL/PyMySQL/security/advisories/GHSA-m75w-33c4-7v8q

Other changes

  • ssl_verify_identity=True now requires server certificate verification, even when ssl_verify_cert=False. (#1282)
  • Fix a missing return value in caching_sha2_password authentication. (#1275)
  • Fix escaped percent signs in executemany() query postfixes, such as ON DUPLICATE KEY UPDATE clauses. (#1276)
  • Require a decimal point before fractional seconds and reject trailing input when converting date/time values. (#1280)
  • Add MUST_CHANGE_PASSWORD and MUST_CHANGE_PASSWORD_LOGIN error codes. (#1278)
  • Deprecate pymysql.converters.escape_sequence(). Use Connection.escape() instead. The default converter mapping no longer supports tuple, list, set, or frozenset.
Commits
  • 7b9584f Release v1.2.4
  • 60eae5c Fix sequence escaping under NO_BACKSLASH_ESCAPES
  • 68eccae ci: adopt GitHub Actions workflow lockfile (#1289)
  • bb71c8d ci: Bump the all-dependencies group with 2 updates (#1285)
  • f56e2d1 ci: replace Python 3.9 with 3.15 in test matrix (#1288)
  • fad3c6f Update security vulnerability reporting to use GitHub
  • 1aff0a8 ci: Bump the all-dependencies group across 1 directory with 2 updates (#1284)
  • 4399e30 Check the server certificate when ssl_verify_identity is set (#1282)
  • 31126a3 Require a decimal point for fractional seconds (#1280)
  • bb7059e Add two password-change error codes to constants/ER.py (#1278)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [pymysql](https://github.com/PyMySQL/PyMySQL) from 1.2.3 to 1.2.4.
- [Release notes](https://github.com/PyMySQL/PyMySQL/releases)
- [Changelog](https://github.com/PyMySQL/PyMySQL/blob/main/CHANGELOG.md)
- [Commits](PyMySQL/PyMySQL@v1.2.3...v1.2.4)

---
updated-dependencies:
- dependency-name: pymysql
  dependency-version: 1.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Nov 12, 2026
@sonarqubecloud

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants