Sourced from mysql2's releases.

v3.19.1

3.19.1 (2026-03-09)

Security Bug Fixes

• bound null-terminated string read to packet end (fixes a potential OOB read reported by Doruk Tan Ozturk (peaktwilight)) (#4161) (91c5229)
• handle malformed geometry payloads (fixes a potential DoS vulnerability reported by Doruk Tan Ozturk (peaktwilight)) (#4164) (1869215)
• prevent query param override of URL-defined connection options (fixes a potential config injection vulnerability reported by Doruk Tan Ozturk (peaktwilight)) (#4162) (3123b4e)
• validate buffer bounds in geometry parser (fixes a potential DoS vulnerability reported by Doruk Tan Ozturk (peaktwilight)) (#4159) (7c2ae00)

Sourced from mysql2's changelog.

3.19.1 (2026-03-09)

Bug Fixes

• bound null-terminated string read to packet end (fixes a potential OOB read reported by Doruk Tan Ozturk (peaktwilight)) (#4161) (91c5229)
• handle malformed geometry payloads (fixes a potential DoS vulnerability reported by Doruk Tan Ozturk (peaktwilight)) (#4164) (1869215)
• prevent query param override of URL-defined connection options (fixes a potential config injection vulnerability reported by Doruk Tan Ozturk (peaktwilight)) (#4162) (3123b4e)
• validate buffer bounds in geometry parser (fixes a potential DoS vulnerability reported by Doruk Tan Ozturk (peaktwilight)) (#4159) (7c2ae00)

• fa06903 chore(master): release 3.19.1 (#4160)
• 1869215 fix: handle malformed geometry payloads (fixes a potential DoS vulnerability ...
• 3123b4e fix: prevent query param override of URL-defined connection options (fixes ...
• 91c5229 fix: bound null-terminated string read to packet end (fixes a potential OOB...
• 7c2ae00 fix: validate buffer bounds in geometry parser (fixes a potential DoS vulnera...
• 1490783 build(deps-dev): bump @​types/node from 25.3.3 to 25.3.5 in /website (#4157)
• 9708848 build(deps-dev): bump @​types/node from 25.3.3 to 25.3.5 (#4155)
• d8d69c4 build(deps-dev): bump poku from 3.0.2 to 4.0.0 in /website (#4158)
• d207686 ci: define a timeout for tests (#4154)
• See full diff in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)