fix(deps): update dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
eslint (source)	9.39.2 → 9.39.5
mocha (source)	11.7.5 → 11.7.6
mysql2 (source)	3.16.0 → 3.23.0

---

Release Notes

eslint/eslint (eslint)

v9.39.5

Compare Source

Bug Fixes

• 253be16 fix: handle unavailable require cache (backport of #​20812 to v9.x) (#​21065) (Eric)

Documentation

• 74930ed docs: switch build to Node.js 24 (#​20894) (Milos Djermanovic)
• eaec8bb docs: Add ESLint v9.x EOL notice (#​20828) (Milos Djermanovic)

Chores

• 458205f chore: update @eslint/eslintrc and @eslint/js for v9.39.5 (#​21077) (Francesco Trotta)
• 202117b chore: package.json update for @​eslint/js release (Jenkins)
• d9eb6ed test: disable warning for vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER (#​21074) (Francesco Trotta)
• 7b431a7 chore: override re2 dependency for @metascraper/helpers (#​21068) (Milos Djermanovic)
• daf7791 chore: pin fflate@​0.8.2 (#​20895) (Milos Djermanovic)
• daee8ba ci: use pnpm in eslint-flat-config-utils type integration test (#​20829) (Milos Djermanovic)
• 116d4be ci: unpin Node.js 25.x in CI (#​20619) (Copilot)

v9.39.4

Compare Source

Bug Fixes

• f18f6c8 fix: update dependency minimatch to ^3.1.5 (#​20564) (Milos Djermanovic)
• a3c868f fix: update dependency @​eslint/eslintrc to ^3.3.4 (#​20554) (Milos Djermanovic)
• 234d005 fix: minimatch security vulnerability patch for v9.x (#​20549) (Andrej Beles)
• b1b37ee fix: update ajv to 6.14.0 to address security vulnerabilities (#​20538) (루밀LuMir)

Documentation

• 4675152 docs: add deprecation notice partial (#​20520) (Milos Djermanovic)

Chores

• b8b4eb1 chore: update dependencies for ESLint v9.39.4 (#​20596) (Francesco Trotta)
• 71b2f6b chore: package.json update for @​eslint/js release (Jenkins)
• 1d16c2f ci: pin Node.js 25.6.1 (#​20563) (Milos Djermanovic)

v9.39.3

Compare Source

Bug Fixes

• 791bf8d fix: restore TypeScript 4.0 compatibility in types (#​20504) (sethamus)

Chores

• 8594a43 chore: upgrade @​eslint/js@​9.39.3 (#​20529) (Milos Djermanovic)
• 9ceef92 chore: package.json update for @​eslint/js release (Jenkins)
• af498c6 chore: ignore /docs/v9.x in link checker (#​20453) (Milos Djermanovic)

mochajs/mocha (mocha)

v11.7.6

Compare Source

🩹 Fixes

• make describe().timeout() work (aafe6fd)
• test: replace wmic usage with native Windows API (#​5694) (73ebdfa)

🧹 Chores

• format all code (#​5629) (0696784)
• remove Netlify (#​5630) (8d01d33)

sidorares/node-mysql2 (mysql2)

v3.23.0

Compare Source

Features

• return unsafe integers inside JSON columns as exact strings with supportBigNumbers (#​4388) (a26ff14)
• sql-escaper: add Temporal support when escaping values (#​4392) (6b933f6)
• support MariaDB data types (UUID, INET4, INET6, VECTOR, JSON) via extended type metadata; run CI against MariaDB (#​4373) (5034e57)

v3.22.6

Compare Source

Bug Fixes

• sql-escaper: resolve multi statement and expand object regressions (#​4380) (1b927a9)

v3.22.5

Compare Source

Bug Fixes

• keep 00:00:00 time for TIMESTAMP in binary protocol with dateStrings (#​4327) (2af33a1)

v3.22.4

Compare Source

Bug Fixes

• pool: reject queued requests on end (#​4291) (fbff09c)

v3.22.3

Compare Source

Bug Fixes

• allow resetOnRelease in connection config validation (#​4278) (e72f923)

v3.22.2

Compare Source

Bug Fixes

• promise: point rejection stacks at caller for promise API (#​4267) (c79a3f3)

v3.22.1

Compare Source

Bug Fixes

• async stack traces not pointing to correct source, regression introduced by #​4257 (#​4265) (5b6206c)
• packet: return INVALID_DATE for zero dates with numeric timezone offset (#​1019) (#​4258) (cb5adcc)

v3.22.0

Compare Source

Features

• disable mysql_clear_password plugin by default (#​4236) (884bec5), closes #​1617
• implement COM_RESET_CONNECTION with pool integration (#​4148) (49a64cc)

Performance Improvements

• defer Error object creation to error handlers in promise wrappers (#​4257) (ab131de)

v3.21.1

Compare Source

Bug Fixes

• limit client flags to server capabilities (#​4227) (e1930b8)
• use Number.isSafeInteger for supportBigNumbers boundary check (#​4225) (295264b)

v3.21.0

Compare Source

Features

• add support for query attributes (#​4223) (d732f78)
• types: export ExecuteValues and QueryValues from entry point (9fafd6f)

v3.20.0

Compare Source

Features

• add TracingChannel support for native APM instrumentation (#​4178) (c06afc2)

Bug Fixes

• explicitly specify in auth plugins (#​4175) (#​4187) (5ac5563)
• prevent double release from corrupting the connection pool (#​4186) (7e57db6)
• restore PoolConnection as subclass of Connection (#​4183) (97855a6)

v3.19.1

Compare Source

Bug Fixes

• bound null-terminated string read to packet end (fixes a potential OOB read reported by Doruk Tan Ozturk (peaktwilight)) (#​4161) (91c5229)
• handle malformed geometry payloads (fixes a potential DoS vulnerability reported by Doruk Tan Ozturk (peaktwilight)) (#​4164) (1869215)
• prevent query param override of URL-defined connection options (fixes a potential config injection vulnerability reported by Doruk Tan Ozturk (peaktwilight)) (#​4162) (3123b4e)
• validate buffer bounds in geometry parser (fixes a potential DoS vulnerability reported by Doruk Tan Ozturk (peaktwilight)) (#​4159) (7c2ae00)

v3.19.0

Compare Source

Features

• use server's preferred auth method to eliminate auth switch roundtrip (#​4140) (b57c671)

Bug Fixes

• fix precision loss for large decimal values (#​4135) (099beea)

v3.18.2

Compare Source

Bug Fixes

• types: add supportBigNumbers, bigNumberStrings, dateStrings, and timezone options to QueryOptions (#​4127) (b274e72)
• types: extend QueryValues to callback-based methods (#​4129) (2ad5f0b)
• types: improve ExecuteValues "nested" params (#​4133) (3f94950)
• types: support Raw and Uint8Array params (#​4132) (bde9aec)

v3.18.1

Compare Source

Bug Fixes

• types: ensure optional params in query and execute methods (#​4123) (3f4bbca)

v3.18.0

Compare Source

Features

• add Symbol.dispose and Symbol.asyncDispose support for Connections, Pools, and Pool Clusters (#​4112) (1e612dc)

v3.17.5

Compare Source

Bug Fixes

• add missing charset encoding for UTF8MB4_0900_BIN (#​3855) (c9a0dcd)
• deps: include @types/node as a peer dependency (#​4108) (5f8ac97)
• fix wrong length number write to packet (#​3177) (0e06e02)
• pool: resolve potential memory leak (#​4111) (8aa2052)

v3.17.4

Compare Source

Bug Fixes

• types for query values (#​3985) (a9c8d09)

v3.17.3

Compare Source

Bug Fixes

• fix PoolConnection.end callback and promise resolution (#​3937) (18ff2c6)

v3.17.2

Compare Source

Bug Fixes

• distinguish delimiters in queries from SQL comments (#​4084) (454ba10)
• pool: discard connection on error 1290 (Aurora read-only failure) (#​4075) (9188963)
• pool: handle all read-only errors during Aurora failover (#​4082) (ce98d8e)

v3.17.1

Compare Source

Bug Fixes

• expand object params after ON DUPLICATE KEY UPDATE preceded by SET (#​4076) (4d2b930)

v3.17.0

Compare Source

Bug Fixes

• security: resolve a potential SQL injection bypass through objects (#​4054) (7f133cc)

v3.16.3

Compare Source

Bug Fixes

• constants: remove unsupported CLIENT_DEPRECATE_EOF flag from constants (#​4033) (46c3f60)

v3.16.2

Compare Source

Bug Fixes

• types: add missing ConnectionState type to Promise Connection interface (#​4034) (2927949)

v3.16.1

Compare Source

Bug Fixes

• named-placeholders: improve handling of mixed/nested quotes in query parsing (#​4011) (3e00cd7)

---

Configuration

📅 Schedule: (in timezone Asia/Calcutta)

• Branch creation
  • "before 3am on the first day of the month"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud