Skip to content

Bump the uv-minor-patch group across 1 directory with 2 updates - #24

Merged
aaronelliotross merged 1 commit into
mainfrom
dependabot/uv/uv-minor-patch-411a2075bc
Sep 29, 2026
Merged

aaronelliotross merged 1 commit into
mainfrom
dependabot/uv/uv-minor-patch-411a2075bc

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 28, 2026

Copy link
Copy Markdown
Contributor

Bumps the uv-minor-patch group with 2 updates in the / directory: pymysql and sentry-sdk.

Updates pymysql from 1.2.0 to 1.2.3

Release notes

Sourced from pymysql's releases.

v1.2.3

Full Changelog: PyMySQL/PyMySQL@v1.2.2...v1.2.3

v1.2.2

Restored the ability to import pymysql.converters.escape_dict for compatibility with aiomysql. This function does not escape dictionaries and is entirely unnecessary. Unless you use aiomysql, there is no need to upgrade from v1.2.1.

Full Changelog: PyMySQL/PyMySQL@v1.2.1...v1.2.2

v1.2.1

What's Changed

New Contributors

Full Changelog: PyMySQL/PyMySQL@v1.2.0...v1.2.1

Changelog

Sourced from pymysql's changelog.

v1.2.3

Release date: 2026-09-17

Restored the ability to import pymysql.converters.escape_bytes_prefixed for compatibility with aiomysql.

Use pymysql.converters at your own risk. It's internal functions. No backward compatibility are guaranteed.

v1.2.2

Release date: 2026-09-17

Restored the ability to import pymysql.converters.escape_dict for compatibility with aiomysql. This function does not escape dictionaries and is entirely unnecessary. Unless you use aiomysql, there is no need to upgrade from v1.2.1.

v1.2.1 (security fix)

Release date: 2026-09-17

Fixed a SQL injection vulnerability caused by incorrect escaping of bytes parameters when using the big5, gbk, sjis, cp932, or gb18030 character sets. This vulnerability also occurs when strings decoded from bytes using surrogateescape are passed as query parameters.

See also: https://github.com/PyMySQL/PyMySQL/security/advisories/GHSA-x4f8-9hx9-hpp9

  • Queries are now encoded using the strict error handler instead of surrogateescape. Queries that cannot be encoded using the connection encoding can no longer be sent.

  • bytes parameters are now always sent as hexadecimal literals, such as X'636174'. Note that this increases the number of bytes sent.

  • The binary_prefix parameter of connect() is deprecated. The _binary prefix is no longer sent.

These changes address the confirmed SQL injection vulnerabilities related to character encoding. However, we strongly recommend using UTF-8 (utf8mb4). Other character sets are not thoroughly tested, and their limited use means that problems may go unreported. In the 2020s, encodings other than UTF-8 should be considered legacy.

Commits

Updates sentry-sdk from 2.68.1 to 2.69.2

Release notes

Sourced from sentry-sdk's releases.

2.69.2

Bug Fixes 🐛

Documentation 📚

Internal Changes 🔧

Huggingface Hub

Pydantic Ai

Other

Other

2.69.1

New Features ✨

Bug Fixes 🐛

... (truncated)

Changelog

Sourced from sentry-sdk's changelog.

2.69.2

Bug Fixes 🐛

Documentation 📚

Internal Changes 🔧

Huggingface Hub

Pydantic Ai

Other

Other

2.69.1

New Features ✨

Bug Fixes 🐛

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the uv-minor-patch group with 2 updates in the / directory: [pymysql](https://github.com/PyMySQL/PyMySQL) and [sentry-sdk](https://github.com/getsentry/sentry-python).


Updates `pymysql` from 1.2.0 to 1.2.3
- [Release notes](https://github.com/PyMySQL/PyMySQL/releases)
- [Changelog](https://github.com/PyMySQL/PyMySQL/blob/main/CHANGELOG.md)
- [Commits](PyMySQL/PyMySQL@v1.2.0...v1.2.3)

Updates `sentry-sdk` from 2.68.1 to 2.69.2
- [Release notes](https://github.com/getsentry/sentry-python/releases)
- [Changelog](https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md)
- [Commits](getsentry/sentry-python@2.68.1...2.69.2)

---
updated-dependencies:
- dependency-name: pymysql
  dependency-version: 1.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-minor-patch
- dependency-name: sentry-sdk
  dependency-version: 2.69.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 28, 2026
@aaronelliotross
aaronelliotross merged commit b944708 into main Sep 29, 2026
1 check passed
@dependabot
dependabot Bot deleted the dependabot/uv/uv-minor-patch-411a2075bc branch September 29, 2026 09:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant