npm / mysql2
mysql2
What changed in mysql2 3, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-17.
4 breaking6 security10 new APIs and options7 performance3 behavior and defaults44 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initmysql2 374 changes
Breaking changes 4
Zero dates with a numeric timezone offset now return INVALID_DATE.
The mysql_clear_password plugin is disabled by default, changing the default authentication behavior.
Query parameters can no longer override connection options defined by the URL, preventing potential configuration injection.
The unsupported CLIENT_DEPRECATE_EOF flag was removed from constants.
Security 6
MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS
MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials
Buffer bounds are validated in the geometry parser to fix a potential denial-of-service vulnerability.
Malformed geometry payloads are handled to fix a potential denial-of-service vulnerability.
Reads are bounded to the packet end, preventing a potential out-of-bounds read.
Resolves a potential SQL injection bypass through objects.
New APIs and options 10
Supports MariaDB UUID, INET4, INET6, VECTOR, and JSON data types via extended type metadata.
COM_RESET_CONNECTION is implemented with pool integration, enabling connection resets in pooled connections.
Exports ExecuteValues from the entry point for use by developers.
Adds support for query attributes.
Exports QueryValues from the entry point for use by developers.
Adds TracingChannel support for native APM instrumentation.
Adds supportBigNumbers, bigNumberStrings, dateStrings, and timezone options to QueryOptions.
Connections, Pools, and Pool Clusters now support Symbol.asyncDispose for asynchronous disposal.
Connections, Pools, and Pool Clusters now support Symbol.dispose for disposal.
BaseConnection adds a getter to track connection lifecycle state.
Performance 7
Performance improvements affect per-query overhead, local dates, short strings, TLS context, and compression.
TLS sessions are reused across connections to the same server.
Outgoing packets use single-pass UTF-8 string encoding, improving performance.
Serializes COM_STMT_EXECUTE in a single exact-size pass.
Removes per-query and per-row allocation hotspots.
Error object creation is deferred to error handlers in promise wrappers, improving performance.
Uses the server's preferred authentication method to eliminate an authentication switch roundtrip.
Behavior and default changes 3
Parameters are typed, and integer types reported by the server are adopted.
When supportBigNumbers is enabled, unsafe integers in JSON columns are returned as exact strings.
The SQL escaper supports Temporal values when escaping values.
Fixes and other changes 44
A new LOCAL INFILE terminator packet is allocated per write.
IPv6 hosts in a connection URI have their brackets stripped.
PoolCluster node events now type nodeId as a string.
Corrects the size used for length-coded numbers in the 3-byte range.
The promise API now honours trace: false on every method.
Fixes zero dates being returned as "undefined 00:00:00" when dateStrings is enabled.
Callback Pool and PoolConnection types now align with runtime behavior.
Leading zeros in TIME fractional seconds are now preserved.
The connection timeout remains active until the handshake completes.
Query-level namedPlaceholders: false is now honored.
Each pooled connection gets its own config copy.
Pool query dispatch errors are propagated instead of thrown.
Corrects the connectAttributes typo in the ChangeUser packet.
A failed execute is no longer left as the active command.
Calls typeCast for NULL values in the binary protocol.
Resolves regressions involving multiple statements and object expansion in the SQL escaper.
Preserves 00:00:00 for TIMESTAMP values in the binary protocol when dateStrings is enabled.
Queued requests are rejected when the pool is ended.
Connection config validation now allows resetOnRelease.
Rejection stacks for the promise API now point at the caller.
Async stack traces now point to the correct source.
Client flags are limited to the capabilities supported by the server.
The boundary check for supportBigNumbers uses Number.isSafeInteger.
Prevents double release from corrupting the connection pool.
Restores PoolConnection as a subclass of Connection.
Fixes precision loss when handling large decimal values.
Improves support for nested parameters in ExecuteValues.
Extends QueryValues to callback-based methods.
Adds support for Raw and Uint8Array parameters.
Adds support for Raw and Uint8Array parameters.
Optional parameters in the query and execute methods are now ensured in the types.
Resolves a potential memory leak in the pool.
Fixes writing the wrong length number to a packet.
Includes @types/node as a peer dependency.
Adds the missing charset encoding for UTF8MB4_0900_BIN.
Fixes types for query values.
Fixes callback and promise resolution for PoolConnection.end.
The pool discards a connection when error 1290 occurs, addressing Aurora read-only failures.
The pool handles all read-only errors during Aurora failover.
Formatting now distinguishes query delimiters from SQL comments, preventing delimiters in comments from being treated as query delimiters.
Object parameters are now expanded after ON DUPLICATE KEY UPDATE preceded by SET.
Adds the missing ConnectionState type to the Promise Connection interface.
Improves handling of mixed and nested quotes in query parsing.
SNI is skipped for IP addresses in TLS connections.