[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
PyMySQL (changelog)	==1.2.3 → ==1.2.4

---

Release Notes

PyMySQL/PyMySQL (PyMySQL)

v1.2.4

Compare Source

Release date: 2026-11-09

Fixed a SQL injection vulnerability caused by incorrect escaping of string values
inside tuple, list, set, or frozenset query parameters when the
NO_BACKSLASH_ESCAPES SQL mode is enabled.

Sequence items are now escaped through Connection.escape() so they respect
the connection's SQL mode.

See also: https://github.com/PyMySQL/PyMySQL/security/advisories/GHSA-m75w-33c4-7v8q

Other changes

• ssl_verify_identity=True now requires server certificate verification,
  even when ssl_verify_cert=False. (#​1282)
• Fix a missing return value in caching_sha2_password authentication. (#​1275)
• Fix escaped percent signs in executemany() query postfixes, such as
  ON DUPLICATE KEY UPDATE clauses. (#​1276)
• Require a decimal point before fractional seconds and reject trailing input
  when converting date/time values. (#​1280)
• Add MUST_CHANGE_PASSWORD and MUST_CHANGE_PASSWORD_LOGIN error codes. (#​1278)
• Deprecate pymysql.converters.escape_sequence(). Use Connection.escape()
  instead. The default converter mapping no longer supports tuple, list,
  set, or frozenset.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.