chore(deps): update dependency mysql2 to v3.9.4 [security] #523

renovate · 2024-04-12T19:58:39Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
mysql2 (source)	`3.6.1` -> `3.9.4`

GitHub Vulnerability Alerts

CVE-2024-21507

Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the keyFromFields function, resulting in cache poisoning. An attacker can inject a colon : character within a value of the attacker-crafted key.

CVE-2024-21509

Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in text_parser.js and binary_parser.js.

CVE-2024-21508

Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings values.

Release Notes

sidorares/node-mysql2 (mysql2)

`v3.9.4`

Compare Source

Bug Fixes

docs: improve the contribution guidelines (#2552) (8a818ce)
security: improve results object creation (#2574) (4a964a3)
security: improve supportBigNumbers and bigNumberStrings sanitization (#2572) (74abf9e)

`v3.9.3`

Compare Source

Bug Fixes

security: improve cache key formation (#2424) (0d54b0c)
- Fixes a potential parser cache poisoning attack vulnerability reported by Vsevolod Kokorin (Slonser) of Solidlab
update Amazon RDS SSL CA cert (#2131) (d9dccfd)

`v3.9.2`

Compare Source

Bug Fixes

stream: premature close when it is paused (#2416) (7c6bc64)
types: expose TypeCast types (#2425) (336a7f1)

`v3.9.1`

Compare Source

Bug Fixes

types: support encoding for string type cast (#2407) (1dc2011)

`v3.9.0`

Compare Source

Features

introduce typeCast for execute method (#2398) (baaa92a)

`v3.8.0`

Compare Source

Features

perf: cache iconv decoder (#2391) (b95b3db)

Bug Fixes

stream: premature close when using for await (#2389) (af47148)
The removeIdleTimeoutConnectionsTimer did not clean up when the … (#2384) (18a44f6)
types: add missing types to TypeCast (#2390) (78ce495)