build(deps): bump pymysql from 1.2.0 to 1.2.3

[dependabot]

Bumps pymysql from 1.2.0 to 1.2.3.

Release notes

Sourced from pymysql's releases.

v1.2.3

Full Changelog: PyMySQL/PyMySQL@v1.2.2...v1.2.3

v1.2.2

Restored the ability to import pymysql.converters.escape_dict for compatibility with aiomysql. This function does not escape dictionaries and is entirely unnecessary. Unless you use aiomysql, there is no need to upgrade from v1.2.1.

Full Changelog: PyMySQL/PyMySQL@v1.2.1...v1.2.2

v1.2.1

What's Changed

• Bump codecov/codecov-action from 6 to 7 in the all-dependencies group by @​dependabot[bot] in PyMySQL/PyMySQL#1250
• Bump actions/checkout from 6 to 7 in the all-dependencies group by @​dependabot[bot] in PyMySQL/PyMySQL#1253
• Bump the all-dependencies group with 2 updates by @​dependabot[bot] in PyMySQL/PyMySQL#1254
• Bump astral-sh/ruff-action from 4.0.0 to 4.1.0 in the all-dependencies group by @​dependabot[bot] in PyMySQL/PyMySQL#1255
• Fix typos in comments: charaset -> charset by @​maxtaran2010 in PyMySQL/PyMySQL#1256
• Bump the all-dependencies group with 3 updates by @​dependabot[bot] in PyMySQL/PyMySQL#1258
• Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 in the all-dependencies group by @​dependabot[bot] in PyMySQL/PyMySQL#1261
• Fix escape_timedelta for negative values by @​dngr2 in PyMySQL/PyMySQL#1262
• fix ruff errors by @​methane in PyMySQL/PyMySQL#1263
• Refactor LOAD LOCAL INFILE handling by @​methane in PyMySQL/PyMySQL#1264
• perf: optimize packet reading and parsing by @​methane in PyMySQL/PyMySQL#1268
• agent: document local MySQL test setup by @​methane in PyMySQL/PyMySQL#1270
• fix pymysql authentication state machine issue by @​methane in PyMySQL/PyMySQL#1271

New Contributors

• @​maxtaran2010 made their first contribution in PyMySQL/PyMySQL#1256
• @​dngr2 made their first contribution in PyMySQL/PyMySQL#1262

Full Changelog: PyMySQL/PyMySQL@v1.2.0...v1.2.1

Changelog

Sourced from pymysql's changelog.

v1.2.3

Release date: 2026-09-17

Restored the ability to import pymysql.converters.escape_bytes_prefixed for compatibility with aiomysql.

Use pymysql.converters at your own risk. It's internal functions. No backward compatibility are guaranteed.

v1.2.2

Release date: 2026-09-17

Restored the ability to import pymysql.converters.escape_dict for compatibility with aiomysql. This function does not escape dictionaries and is entirely unnecessary. Unless you use aiomysql, there is no need to upgrade from v1.2.1.

v1.2.1 (security fix)

Release date: 2026-09-17

Fixed a SQL injection vulnerability caused by incorrect escaping of bytes parameters when using the big5, gbk, sjis, cp932, or gb18030 character sets. This vulnerability also occurs when strings decoded from bytes using surrogateescape are passed as query parameters.

See also: https://github.com/PyMySQL/PyMySQL/security/advisories/GHSA-x4f8-9hx9-hpp9

• Queries are now encoded using the strict error handler instead of surrogateescape. Queries that cannot be encoded using the connection encoding can no longer be sent.

• bytes parameters are now always sent as hexadecimal literals, such as X'636174'. Note that this increases the number of bytes sent.

• The binary_prefix parameter of connect() is deprecated. The _binary prefix is no longer sent.

These changes address the confirmed SQL injection vulnerabilities related to character encoding. However, we strongly recommend using UTF-8 (utf8mb4). Other character sets are not thoroughly tested, and their limited use means that problems may go unreported. In the 2020s, encodings other than UTF-8 should be considered legacy.

Commits

• c990e86 v1.2.3
• c93fd97 add escape_bytes_prefixed. do not use it.
• dea8954 release v1.2.2
• 4f953ba fix: add escape_dict alias for aiomysql compatibility
• e13a28f ruff format
• 26a031d Prepare 1.2.1 security release
• a1547f5 Merge commit from fork
• 10739bc fix pymysql authentication state machine issue (#1271)
• 0fa39e9 agent: document local MySQL test setup (#1270)
• 55c604c perf: optimize packet reading and parsing (#1268)
• Additional commits viewable in compare view

[codspeed]

Merging this PR will degrade performance by 10.2%

❌ 1 regressed benchmark
✅ 97 untouched benchmarks

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
❌	test_get_column_name_from_alias_book[10000]	51.2 ms	57 ms	-10.2%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing dependabot/pip/pymysql-1.2.3 (5ecb0b9) with master (325d6ad)}