Update dependency pymysql to v1.2.3

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
pymysql (changelog)	==1.1.1 → ==1.2.3

---

Release Notes

PyMySQL/PyMySQL (pymysql)

v1.2.3

Compare Source

Release date: 2026-09-17

Restored the ability to import pymysql.converters.escape_bytes_prefixed for
compatibility with aiomysql.

Use pymysql.converters at your own risk.
It's internal functions. No backward compatibility are guaranteed.

v1.2.2

Compare Source

Release date: 2026-09-17

Restored the ability to import pymysql.converters.escape_dict for
compatibility with aiomysql.
This function does not escape dictionaries and is entirely unnecessary.
Unless you use aiomysql, there is no need to upgrade from v1.2.1.

v1.2.1

Compare Source

Release date: 2026-09-17

Fixed a SQL injection vulnerability caused by incorrect escaping of bytes
parameters when using the big5, gbk, sjis, cp932, or gb18030 character sets.
This vulnerability also occurs when strings decoded from bytes using
surrogateescape are passed as query parameters.

See also: https://github.com/PyMySQL/PyMySQL/security/advisories/GHSA-x4f8-9hx9-hpp9

• Queries are now encoded using the strict error handler instead of
  surrogateescape.
  Queries that cannot be encoded using the connection encoding can no longer be sent.

• bytes parameters are now always sent as hexadecimal literals, such as
  X'636174'. Note that this increases the number of bytes sent.

• The binary_prefix parameter of connect() is deprecated. The _binary
  prefix is no longer sent.

These changes address the confirmed SQL injection vulnerabilities related to
character encoding.
However, we strongly recommend using UTF-8 (utf8mb4).
Other character sets are not thoroughly tested, and their limited use means
that problems may go unreported. In the 2020s, encodings other than UTF-8
should be considered legacy.

v1.2.0

Compare Source

Release date: 2026-05-19

Breaking changes

• Connection.ping() change the default to not reconnect and deprecate reconnect argument.
  Create a new connection if you want to reconnect. (#​1241)

• Error classes in Cursor class are removed. (#​1240)

• connect() arguments db and passwd now emit DeprecationWarning.
  Use database and password instead. (#​1240)

• Reorganize TLS connection behavior.

  • PyMySQL uses TLS by default when server supports it.
    Use ssl_disabled=True to prohibit SSL. (#​1213)

  • When ssl_verify_cert=True, ssl_verify_identity=True, an ssl.SSLContext is passed,
    or when any other SSL option is configured, the connection requires SSL and raises
    OperationalError (CR_SSL_CONNECTION_ERROR) if the server doesn't support it. (#​1234)

Other changes

• Support MySQL 8 row/column alias syntax in executemany INSERT regex. (#​1235)
• Expose SQLSTATE on MySQL protocol exceptions without changing exception formatting. (#​1236)
• Reject non-finite decimal.Decimal query parameters (NaN, sNaN, ±Infinity). (#​1237)
• Connection.set_charset(charset) now emits DeprecationWarning.

v1.1.3

Compare Source

Release date: 2026-05-01

Security

• Fix Cursor.callproc() didn't escape procedure name. (#​1206)
  There was a possibility of SQL injection when calling a procedure with a string received from an untrusted source as the procedure name.

  NOTICE: This change may cause backward compatibility issues. If you specified a procedure name like "dbname.funcname", the previous version called CALL dbname.funcname, but from this version, it will call CALL `dbname.funcname` so you cannot specify procedure name with database name anymore.

v1.1.2

Compare Source

What's Changed

• Prevent UnboundLocalError on MySQLResult initialization during SystemExit by @​palm002 in #​1174
• remove mention of runtests.py by @​cfbolz in #​1182
• make sure to also close connection._rfile in Connection._force_close by @​cfbolz in #​1184
• Added MariaDB in readme description (#​1180) by @​theneuralcraftsman in #​1186
• chore(deps): update dependency sphinx-rtd-theme to v3 by @​renovate[bot] in #​1189
• chore(deps): update dependency sphinx to v8 by @​renovate[bot] in #​1179
• Add support for Python 3.13 by @​Cycloctane in #​1190
• Resolve UTF8 charset case-insensitively by @​ek247 in #​1195
• update ci versions by @​methane in #​1196
• use KILL instead of COM_KILL for MySQL 8.4 support by @​methane in #​1197
• disable VERIFY_X509_STRICT for Python 3.13 support by @​methane in #​1198
• chore(deps): update codecov/codecov-action action to v5 by @​renovate[bot] in #​1191
• add MariaDB to README.md by @​robertsilen in #​1181
• refactor: use defer_connect instead of mock by @​methane in #​1199
• ci: use astral-sh/ruff-action by @​methane in #​1201
• fix auth_switch_request handling by @​methane in #​1200
• ci: update test matrix by @​methane in #​1215
• ci: do not drop MySQL 5.7 test for now by @​methane in #​1216
• update README by @​methane in #​1217
• prepare v1.1.2 by @​methane in #​1218

New Contributors

• @​palm002 made their first contribution in #​1174
• @​cfbolz made their first contribution in #​1182
• @​theneuralcraftsman made their first contribution in #​1186
• @​Cycloctane made their first contribution in #​1190
• @​ek247 made their first contribution in #​1195
• @​robertsilen made their first contribution in #​1181

Full Changelog: PyMySQL/PyMySQL@v1.1.1...v1.1.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.