Bump mysql2 from 3.22.5 to 3.23.1 in the npm_and_yarn group across 1 directory

[dependabot]

Bumps the npm_and_yarn group with 1 update in the / directory: mysql2.

Updates mysql2 from 3.22.5 to 3.23.1

Release notes

Sourced from mysql2's releases.

v3.23.1

3.23.1 (2026-07-19)

Bug Fixes

• security: fix unbounded decompression of server-supplied compressed packets, reported by alanturing881 (7c48343)
• parser: call typeCast for NULL values in the binary protocol (#4394) (01f1092)

v3.23.0

3.23.0 (2026-07-13)

Features

• return unsafe integers inside JSON columns as exact strings with supportBigNumbers (#4388) (a26ff14)
• sql-escaper: add Temporal support when escaping values (#4392) (6b933f6)
• support MariaDB data types (UUID, INET4, INET6, VECTOR, JSON) via extended type metadata; run CI against MariaDB (#4373) (5034e57)

v3.22.6

3.22.6 (2026-07-07)

Bug Fixes

• sql-escaper: resolve multi statement and expand object regressions (#4380) (1b927a9)

Changelog

Sourced from mysql2's changelog.

3.23.1 (2026-07-19)

Bug Fixes

• security: fix unbounded decompression of server-supplied compressed packets, reported by alanturing881 (7c48343)
• parser: call typeCast for NULL values in the binary protocol (#4394) (01f1092)

3.23.0 (2026-07-13)

Features

• return unsafe integers inside JSON columns as exact strings with supportBigNumbers (#4388) (a26ff14)
• sql-escaper: add Temporal support when escaping values (#4392) (6b933f6)
• support MariaDB data types (UUID, INET4, INET6, VECTOR, JSON) via extended type metadata; run CI against MariaDB (#4373) (5034e57)

3.22.6 (2026-07-07)

Bug Fixes

• sql-escaper: resolve multi statement and expand object regressions (#4380) (1b927a9)

Commits

• 3de28fb chore(master): release 3.23.1 (#4408)
• 01f1092 fix(parser): call typeCast for NULL values in the binary protocol (#3368) (#4...
• 534c552 build(deps): bump lucide-react from 1.24.0 to 1.25.0 in /website (#4407)
• 7c48343 Merge commit from fork
• 3e13d7b docs: establish security charter (#4404)
• 26c135b build(deps): bump websocket-driver from 0.7.4 to 0.7.5 in /website (#4403)
• f86cfb1 chore(master): release 3.23.0 (#4387)
• 6316492 build(deps): bump the docusaurus group in /website with 2 updates (#4396)
• 6b933f6 feat(sql-escaper): add Temporal support when escaping values (#4392)
• 457c316 build(deps): bump lucide-react from 1.23.0 to 1.24.0 in /website (#4391)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[diffy-bot]

Summary

• Updated apps/server dependency: mysql2 bumped from ^3.14.1 to ^3.23.1.
• Updated pnpm lockfile to reflect that bump and many transitive dependency updates (mostly patch/minor bumps across Babel, browserslist/caniuse, iconv-lite, node-releases, sql-escaper, and others).
• Added new lockfile entries and snapshots for updated package versions and small metadata changes (including a deprecation note for xmldom@0.8.13).

TL;DR: mysql2 upgraded in server package.json; pnpm-lock.yaml refreshed with many small dependency version bumps and a deprecation notice for xmldom.

Files changed

• apps/server/package.json
  • Dependency: mysql2 ^3.14.1 -> ^3.23.1
• pnpm-lock.yaml
  • Many resolution and snapshot updates to match the new dependency graph.

Key changes in pnpm-lock.yaml

• Directly impacted packages

  • mysql2: 3.22.5 -> 3.23.1 (specifier ^3.14.1 -> ^3.23.1)
  • @types/node: 24.13.2 -> 24.13.3
  • iconv-lite: 0.7.2 -> 0.7.3
  • sql-escaper: 1.3.3 -> 1.5.1
  • lru.min: 1.1.4 -> 1.1.5
  • node-releases: 2.0.50 -> 2.0.54
  • baseline-browser-mapping: 2.10.40 -> 2.11.20
  • browserslist: 4.28.4 -> 4.28.8
  • caniuse-lite: 1.0.30001799 -> 1.0.30001810
  • electron-to-chromium: 1.5.380 -> 1.5.420
  • update-browserslist-db: 1.2.3 -> 1.3.2
  • @jridgewell/sourcemap-codec: 1.5.5 -> 1.6.0
  • Several @babel packages bumped from 7.29.7 -> 7.29.8 (generator, parser, traverse, types, etc.)

• Snapshots and dependency graph updates

  • Babel snapshots updated to reference new 7.29.8 variants.
  • mysql2 snapshot now pins to (@types/node@24.13.3) and updated transitive deps (iconv-lite 0.7.3, lru.min 1.1.5, sql-escaper 1.5.1).
  • Many snapshot entries replaced to point at the newer versions listed above.

• Metadata change

  • '@xmldom/xmldom@0.8.13' now includes:
    • deprecated: this version has critical issues, please update to the latest version

Notable effects & considerations

• Compatibility/testing

  • bumping mysql2 (minor/patch) usually safe, but run server tests and integration tests that interact with MySQL to ensure no regressions.
  • @types/node bumped to 24.13.3 — check TypeScript toolchain compatibility if you pin types/node or rely on specific Node.js typings.
  • Several babel-related packages updated; run build pipeline to ensure no toolchain regressions.

• Security/maintenance

  • xmldom@0.8.13 marked deprecated with "critical issues" — this is potentially a security risk. Identify which package depends on xmldom and upgrade to a secure version or apply mitigation.
  • Run a dependency vulnerability scan (e.g., npm audit / pnpm audit / Snyk) after installing to surface any security advisories introduced or addressed by these bumps.

• Lockfile hygiene

  • Lockfile contains many small bumps — expected when updating a dependency that pulls newer transitive versions. Ensure you commit the updated pnpm-lock.yaml with the corresponding package.json change.

Suggestions

• Run:
  • pnpm install (to update node_modules)
  • Full test suite and integration tests (DB interactions) to validate mysql2 bump.
  • pnpm audit or other vulnerability scanner to confirm xmldom and other packages are safe.
• Investigate xmldom deprecation:
  • Find which package depends on '@xmldom/xmldom@0.8.13' and upgrade to a fixed version or replace the dependency.
• Confirm TypeScript setup:
  • Verify @types/node 24.13.3 works with your TS version and any toolchain CI settings.
• If any native modules or binaries are affected, rebuild or reinstall in CI (though mysql2 is JS-only, other transitive deps might require it).

You can generate a new summary by commenting @diffy-bot.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	mysql2@​3.22.5 ⏵ 3.23.1		+2		+2

View full report