Bump mysql2 from 3.23.4 to 3.24.2

[dependabot]

Bumps mysql2 from 3.23.4 to 3.24.2.

Release notes

Sourced from mysql2's releases.

v3.24.2

3.24.2 (2026-08-24)

Bug Fixes

• correct length-coded number size for the 3-byte range (#4500) (de56272)
• promise: honour trace: false on every promise-API method (#4502) (1dcd8ef), closes #4501

v3.24.1

3.24.1 (2026-08-24)

Performance Improvements

• single-pass utf8 string encoding for outgoing packets (#4495) (183e947)

v3.24.0

3.24.0 (2026-08-23)

Features

• typed parameters, and adopt integer types the server reports (#4488) (8ec20f1)

Bug Fixes

• zero dates come back as "undefined 00:00:00" with dateStrings (#4491) (5bf7bda)

Performance Improvements

• remove per-query and per-row allocation hotspots (#4486) (c86fe5a)
• serialize COM_STMT_EXECUTE in a single exact-size pass (#4494) (f3a60bc)

Changelog

Sourced from mysql2's changelog.

3.24.2 (2026-08-24)

Bug Fixes

• correct length-coded number size for the 3-byte range (#4500) (de56272)
• promise: honour trace: false on every promise-API method (#4502) (1dcd8ef), closes #4501

3.24.1 (2026-08-24)

Performance Improvements

• single-pass utf8 string encoding for outgoing packets (#4495) (183e947)

3.24.0 (2026-08-23)

Features

• typed parameters, and adopt integer types the server reports (#4488) (8ec20f1)

Bug Fixes

• zero dates come back as "undefined 00:00:00" with dateStrings (#4491) (5bf7bda)

Performance Improvements

• remove per-query and per-row allocation hotspots (#4486) (c86fe5a)
• serialize COM_STMT_EXECUTE in a single exact-size pass (#4494) (f3a60bc)

Commits

• 649e129 chore(master): release 3.24.2 (#4504)
• 87579e1 test: cover length-coded parameter sizes at the 0xFD boundary (#4503)
• 1dcd8ef fix(promise): honour trace: false on every promise-API method (#4502)
• de56272 fix: correct length-coded number size for the 3-byte range (#4500)
• ca10232 chore(master): release 3.24.1 (#4496)
• 183e947 perf: single-pass utf8 string encoding for outgoing packets (#4495)
• fabc3bc chore(master): release 3.24.0 (#4492)
• f3a60bc perf: serialize COM_STMT_EXECUTE in a single exact-size pass (#4494)
• 493f9ec ci: pin EXPLAIN to FORMAT=TRADITIONAL for MySQL 9.5+ (#4493)
• c86fe5a perf: remove per-query and per-row allocation hotspots (#4486)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Akanksha Jain (jainakanksha-msft)]

Copilot This PR was opened by Dependabot. Please take it the rest of the way before it's ready for human review:

1. Impact analysis — identify what changed (package name, old → new version) from the PR diff/description, search the codebase for where that dependency is actually used, and summarize what could be affected.
2. Fix build/conflict issues — run npm ci --legacy-peer-deps, npm run build, and npm run lint; resolve any merge conflicts, build errors, or lint errors that surface.
3. Tests — add or update tests under tests/** to cover the changed usage, and make sure they meaningfully validate the change (not just re-assert the version bump).
4. Run the suite — run the relevant npm run test:* script(s) for the affected area (e.g. test:blob, test:queue, test:table) and keep fixing until they pass.
5. Changelog — append one bullet to ChangeLog.md under ## Upcoming Release → General:, matching the existing style and tone of the entries already there (package name in backticks, old → new version, why, and a one-line concise summary of any code changes made).
6. Comments — review any existing PR comments and review threads, including resolved/hidden ones, and address anything actionable.
7. Self-rate — rate this work 1-10 against: correctness, test coverage, changelog accuracy, build/lint health, and comment resolution.
8. Iterate — if it's not a 10, keep improving until it is before finishing.
9. Summary — post a final comment explaining why this update matters, what the impact/risk is, and what could go wrong if it weren't applied, along with your self-rating and reasoning.

[Copilot]

Copilot This PR was opened by Dependabot. Please take it the rest of the way before it's ready for human review:

1. Impact analysis — identify what changed (package name, old → new version) ...

Addressed in 13f3c12. Impact: mysql2 resolves from 3.23.4 → 3.24.2 and is used as Sequelize’s MySQL driver for the SQL Blob metadata store. Added a real-MySQL regression test that executes and verifies a 70 KiB bound parameter, exercising the fixed three-byte length-coded parameter path; added the Upcoming Release changelog entry. npm ci --legacy-peer-deps, npm run build, npm run lint, and npm run test:blob:sql:ci all pass (371 passing, 2 pending). Existing review threads: none actionable. CodeQL reports 0 JavaScript alerts; changed files were secret-scanned clean. This matters because malformed length encoding can corrupt/fail large SQL parameters; without it, SQL metadata operations using such values could fail. Self-rating: 10/10—correctness is covered by the live MySQL regression, test coverage targets the upstream fix, changelog accurately states the lockfile update and test, validation is clean, and all available PR comments/threads were reviewed.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.

Suppressed comments (2)

tests/blob/sqlBlobMetadataStorePool.test.ts:155

• This test is intended to validate the mysql2 three-byte length-coded parameter fix, but as written it will also run (and potentially pass without exercising mysql2) for non-MySQL SQL backends (e.g., mssql://). Consider skipping unless AZURITE_TEST_DB is a MySQL connection URI, and use an explicit boundary size (0x10000) to make the intent unambiguous.

  it("executes a three-byte length-coded parameter", async () => {
    const value = "x".repeat(0x10000 + 1);

    const result = await getSequelize(store).query<{ value: string }>(
      "SELECT $value AS value",

ChangeLog.md:9

• The new changelog entry claims "large parameter persistence", but the added regression coverage only validates round-tripping a large bound parameter via a SELECT (no persistence operations are performed). Rewording this avoids implying behavior that isn’t actually covered by the changes in this PR.

- Updated lockfile-resolved `mysql2` from 3.23.4 to 3.24.2 to correct three-byte length-coded parameter encoding and improve SQL metadata-store performance; added SQL pool regression coverage for large bound parameters.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (1)

tests/blob/sqlBlobMetadataStorePool.test.ts:165

• Using $value in the raw SQL string is a non-standard bind placeholder for Sequelize and can be treated as a literal (or otherwise not bound) for the mysql/mariadb dialects. To reliably exercise driver-level parameter binding (and the mysql2 length-coded encoding), use a positional placeholder (?) with an array bind instead.

    const result = await sequelize.query<{ value: string }>(
      "SELECT $value AS value",
      {
        bind: { value },
        type: QueryTypes.SELECT
      }

[Akanksha Jain (jainakanksha-msft)]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (1)
tests/blob/sqlBlobMetadataStorePool.test.ts:165

• Using $value in the raw SQL string is a non-standard bind placeholder for Sequelize and can be treated as a literal (or otherwise not bound) for the mysql/mariadb dialects. To reliably exercise driver-level parameter binding (and the mysql2 length-coded encoding), use a positional placeholder (?) with an array bind instead.

    const result = await sequelize.query<{ value: string }>(
      "SELECT $value AS value",
      {
        bind: { value },
        type: QueryTypes.SELECT
      }

Copilot, Could you please handle this?

[Copilot]

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated no new comments.