fix(deps): update dependency mysql2 to v3.9.8 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
mysql2 (source)	3.2.0 -> 3.9.8

GitHub Vulnerability Alerts

CVE-2024-21507

Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the keyFromFields function, resulting in cache poisoning. An attacker can inject a colon : character within a value of the attacker-crafted key.

CVE-2024-21509

Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in text_parser.js and binary_parser.js.

CVE-2024-21508

Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings values.

CVE-2024-21511

Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function.

CVE-2024-21512

Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when using nestTables.

---

Release Notes

sidorares/node-mysql2 (mysql2)

v3.9.8

Compare Source

Bug Fixes

• security: sanitize fields and tables when using nestTables (#​2702) (efe3db5)
• support deno + caching_sha2_password FULL_AUTHENTICATION_PACKET flow (#​2704) (2e03694)
• typings: typo from jonServerPublicKey to onServerPublicKey (#​2699) (8b5f691)

v3.9.7

Compare Source

Bug Fixes

• security: sanitize timezone parameter value to prevent code injection (#​2608) (7d4b098)

v3.9.6

Compare Source

Bug Fixes

• binary parser sometimes reads out of packet bounds when results contain null and typecast is false (#​2601) (705835d)

v3.9.5

Compare Source

Bug Fixes

• revert breaking change in results creation (#​2591) (f7c60d0)

v3.9.4

Compare Source

Bug Fixes

• docs: improve the contribution guidelines (#​2552) (8a818ce)
• security: improve results object creation (#​2574) (4a964a3)
• security: improve supportBigNumbers and bigNumberStrings sanitization (#​2572) (74abf9e)

v3.9.3

Compare Source

Bug Fixes

• security: improve cache key formation (#​2424) (0d54b0c)
  • Fixes a potential parser cache poisoning attack vulnerability reported by Vsevolod Kokorin (Slonser) of Solidlab
• update Amazon RDS SSL CA cert (#​2131) (d9dccfd)

v3.9.2

Compare Source

Bug Fixes

• stream: premature close when it is paused (#​2416) (7c6bc64)
• types: expose TypeCast types (#​2425) (336a7f1)

v3.9.1

Compare Source

Bug Fixes

• types: support encoding for string type cast (#​2407) (1dc2011)

v3.9.0

Compare Source

Features

• introduce typeCast for execute method (#​2398) (baaa92a)

v3.8.0

Compare Source

Features

• perf: cache iconv decoder (#​2391) (b95b3db)

Bug Fixes

• stream: premature close when using for await (#​2389) (af47148)
• The removeIdleTimeoutConnectionsTimer did not clean up when the … (#​2384) (18a44f6)
• types: add missing types to TypeCast (#​2390) (78ce495)

v3.7.1

Compare Source

Bug Fixes

• add condition which allows code in callback to be reachable (#​2376) (8d5b903)

v3.7.0

Compare Source

Features

• docs: release documentation website (#​2339) (c0d77c0)

v3.6.5

Compare Source

Bug Fixes

• add decodeuricomponent to parse uri encoded special characters in host, username, password and datbase keys (#​2277) (fe573ad)

v3.6.4

Compare Source

Bug Fixes

• malformed FieldPacket (#​2280) (8831e09)
• move missing options to ConnectionOptions (#​2288) (5cd7639)

v3.6.3

Compare Source

Bug Fixes

• correctly pass values when used with sql-template-strings library (#​2266) (6444f99)

v3.6.2

Compare Source

Bug Fixes

• sql-template-strings/tag compatibility (#​2238) (f2efe5a)

v3.6.1

Compare Source

Bug Fixes

• EventEmitter on method signatures to use spread syntax (#​2200) (5d21b81)

v3.6.0

Compare Source

Features

• add conn-level infileStreamFactory option (#​2159) (5bed0f8)

v3.5.2

Compare Source

Bug Fixes

• Update events that are propagated from pool cluster to include remove (#​2114) (927d209)

v3.5.1

Compare Source

Bug Fixes

• improvements to allow to use Bun and tls (#​2119) (fd44a2a)
• missing ResultSetHeader[] to query and execute (f649486)

v3.5.0

Compare Source

Features

• improved inspection of columns (#​2112) (69277aa)

v3.4.5

Compare Source

Bug Fixes

• handle prepare response with actual number of parameter definition less than reported in the prepare header. Fixes #​2052 (b658be0)

v3.4.4

Compare Source

Bug Fixes

• add ProcedureCallPacket to execute overloads (3566ef7)
• add ProcedureCallPacket to query overloads (352c3bc)
• add ProcedureCallPacket to promise-based execute overloads (8292416)
• add ProcedureCallPacket to promise-based query overloads (0f31a41)
• create ProcedureCallPacket typings (09ad1d2)

v3.4.3

Compare Source

Bug Fixes

• remove acquireTimeout invalid option (#​2095) (eb311db)

v3.4.2

Compare Source

Bug Fixes

• changing type files to declaration type files (98e6f3a)

v3.4.1

Compare Source

Bug Fixes

• createPool uri overload (98623dd)
• PoolCluster typings (3902ca6)
• create promise-based PoolCluster typings (7f38496)
• missing parserCache in promise.js (7f35cf5)
• missing constants in promise.js (4ce2c70)
• missing keys for Types constant (86655ec)
• missing typings for Charsets constants (01f77a0)
• missing typings for CharsetToEncoding constants (609229a)
• missing typings for parserCache (891a523)
• missing typings for Types constant (04601dd)
• rename file of typings Charsets constants (51c4196)

v3.4.0

Compare Source

Features

• support STATE_GTIDS session track information (2b1520f)

v3.3.5

Compare Source

Bug Fixes

• createPool promise as PromisePool (#​2060) (ff3c36c)
• keepAliveInitialDelay not taking effect (#​2043) (585911c)

v3.3.4

Compare Source

Bug Fixes

• PromisePoolConnection import name (76db54a)
• releaseConnection types and promise (4aac9d6)

v3.3.3

Compare Source

Bug Fixes

• add package.json to exports (#​2026) (09fd305)

v3.3.2

Compare Source

Bug Fixes

• respect enableKeepAlive option (#​2016) (f465c3e)

v3.3.1

Compare Source

Bug Fixes

• LRU constructor (#​2004) (fd3d117)
• Missing types in "mysql" import (#​1995) (b8c79d0)

v3.3.0

Compare Source

Features

• Added updated/new error codes gathered from MySQL 8.0 source code (#​1990) (85dc6e5)

v3.2.4

Compare Source

Bug Fixes

• server: Added missing encoding argument to server-handshake (#​1976) (a4b6b22)

v3.2.3

Compare Source

Bug Fixes

• types: add decimalNumbers to createConnection/createPool typings. fixes #​1803 (#​1817) (bb48462)

v3.2.2

Compare Source

Bug Fixes

• ConnectionOptions conflict between mysql and mysql/promise (#​1955) (eca8bda)

v3.2.1

Compare Source

Bug Fixes

• Add typings for Connection.promise(). (#​1949) (e3ca310)
• PoolConnection redundancy when extending Connection interface in TypeScript (7c62d11)

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.