# What changed in mysql2

> 74 changes in mysql2 3 from its official release notes, upgrade guides and advisories: 4 breaking, 6 security, 10 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/mysql2/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## mysql2 3

### Breaking changes

- Zero dates with a numeric timezone offset now return INVALID_DATE. (3.22.1) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.22.1)
- The mysql_clear_password plugin is disabled by default, changing the default authentication behavior. (3.22.0) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.22.0)
- Query parameters can no longer override connection options defined by the URL, preventing potential configuration injection. (3.19.1) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.19.1)
- The unsupported CLIENT_DEPRECATE_EOF flag was removed from constants. (3.16.3) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.16.3)

### Security

- MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS (3.23.1) — [security advisory](https://github.com/advisories/GHSA-RGWJ-5XJ2-C3M3), [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.23.1)
- MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials (3.22.0) — [security advisory](https://github.com/advisories/GHSA-3F6P-5WW8-9RCR)
- Buffer bounds are validated in the geometry parser to fix a potential denial-of-service vulnerability. (3.19.1) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.19.1)
- Malformed geometry payloads are handled to fix a potential denial-of-service vulnerability. (3.19.1) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.19.1)
- Reads are bounded to the packet end, preventing a potential out-of-bounds read. (3.19.1) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.19.1)
- Resolves a potential SQL injection bypass through objects. (3.17.0) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.17.0)

### New APIs and options

- Supports MariaDB UUID, INET4, INET6, VECTOR, and JSON data types via extended type metadata. (3.23.0) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.23.0)
- COM_RESET_CONNECTION is implemented with pool integration, enabling connection resets in pooled connections. (3.22.0) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.22.0)
- Exports ExecuteValues from the entry point for use by developers. (3.21.0) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.21.0)
- Adds support for query attributes. (3.21.0) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.21.0)
- Exports QueryValues from the entry point for use by developers. (3.21.0) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.21.0)
- Adds TracingChannel support for native APM instrumentation. (3.20.0) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.20.0)
- Adds supportBigNumbers, bigNumberStrings, dateStrings, and timezone options to QueryOptions. (3.18.2) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.18.2)
- Connections, Pools, and Pool Clusters now support Symbol.asyncDispose for asynchronous disposal. (3.18.0) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.18.0)
- Connections, Pools, and Pool Clusters now support Symbol.dispose for disposal. (3.18.0) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.18.0)
- BaseConnection adds a getter to track connection lifecycle state. (3.16.0) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.16.0)

### Performance

- Performance improvements affect per-query overhead, local dates, short strings, TLS context, and compression. (3.24.4) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.24.4)
- TLS sessions are reused across connections to the same server. (3.24.4) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.24.4)
- Outgoing packets use single-pass UTF-8 string encoding, improving performance. (3.24.1) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.24.1)
- Serializes COM_STMT_EXECUTE in a single exact-size pass. (3.24.0) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.24.0)
- Removes per-query and per-row allocation hotspots. (3.24.0) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.24.0)
- Error object creation is deferred to error handlers in promise wrappers, improving performance. (3.22.0) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.22.0)
- Uses the server's preferred authentication method to eliminate an authentication switch roundtrip. (3.19.0) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.19.0)

### Behavior and default changes

- Parameters are typed, and integer types reported by the server are adopted. (3.24.0) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.24.0)
- When supportBigNumbers is enabled, unsafe integers in JSON columns are returned as exact strings. (3.23.0) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.23.0)
- The SQL escaper supports Temporal values when escaping values. (3.23.0) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.23.0)

### Fixes and other changes

- A new LOCAL INFILE terminator packet is allocated per write. (3.24.6) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.24.6)
- IPv6 hosts in a connection URI have their brackets stripped. (3.24.5) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.24.5)
- PoolCluster node events now type nodeId as a string. (3.24.3) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.24.3)
- Corrects the size used for length-coded numbers in the 3-byte range. (3.24.2) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.24.2)
- The promise API now honours trace: false on every method. (3.24.2) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.24.2)
- Fixes zero dates being returned as "undefined 00:00:00" when dateStrings is enabled. (3.24.0) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.24.0)
- Callback Pool and PoolConnection types now align with runtime behavior. (3.23.4) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.23.4)
- Leading zeros in TIME fractional seconds are now preserved. (3.23.4) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.23.4)
- The connection timeout remains active until the handshake completes. (3.23.3) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.23.3)
- Query-level namedPlaceholders: false is now honored. (3.23.3) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.23.3)
- Each pooled connection gets its own config copy. (3.23.3) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.23.3)
- Pool query dispatch errors are propagated instead of thrown. (3.23.3) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.23.3)
- Corrects the connectAttributes typo in the ChangeUser packet. (3.23.2) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.23.2)
- A failed execute is no longer left as the active command. (3.23.2) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.23.2)
- Calls typeCast for NULL values in the binary protocol. (3.23.1) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.23.1)
- Resolves regressions involving multiple statements and object expansion in the SQL escaper. (3.22.6) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.22.6)
- Preserves 00:00:00 for TIMESTAMP values in the binary protocol when dateStrings is enabled. (3.22.5) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.22.5)
- Queued requests are rejected when the pool is ended. (3.22.4) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.22.4)
- Connection config validation now allows resetOnRelease. (3.22.3) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.22.3)
- Rejection stacks for the promise API now point at the caller. (3.22.2) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.22.2)
- Async stack traces now point to the correct source. (3.22.1) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.22.1)
- Client flags are limited to the capabilities supported by the server. (3.21.1) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.21.1)
- The boundary check for supportBigNumbers uses Number.isSafeInteger. (3.21.1) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.21.1)
- Prevents double release from corrupting the connection pool. (3.20.0) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.20.0)
- Restores PoolConnection as a subclass of Connection. (3.20.0) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.20.0)
- Fixes precision loss when handling large decimal values. (3.19.0) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.19.0)
- Improves support for nested parameters in ExecuteValues. (3.18.2) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.18.2)
- Extends QueryValues to callback-based methods. (3.18.2) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.18.2)
- Adds support for Raw and Uint8Array parameters. (3.18.2) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.18.2)
- Adds support for Raw and Uint8Array parameters. (3.18.2) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.18.2)
- Optional parameters in the query and execute methods are now ensured in the types. (3.18.1) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.18.1)
- Resolves a potential memory leak in the pool. (3.17.5) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.17.5)
- Fixes writing the wrong length number to a packet. (3.17.5) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.17.5)
- Includes @types/node as a peer dependency. (3.17.5) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.17.5)
- Adds the missing charset encoding for UTF8MB4_0900_BIN. (3.17.5) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.17.5)
- Fixes types for query values. (3.17.4) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.17.4)
- Fixes callback and promise resolution for PoolConnection.end. (3.17.3) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.17.3)
- The pool discards a connection when error 1290 occurs, addressing Aurora read-only failures. (3.17.2) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.17.2)
- The pool handles all read-only errors during Aurora failover. (3.17.2) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.17.2)
- Formatting now distinguishes query delimiters from SQL comments, preventing delimiters in comments from being treated as query delimiters. (3.17.2) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.17.2)
- Object parameters are now expanded after ON DUPLICATE KEY UPDATE preceded by SET. (3.17.1) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.17.1)
- Adds the missing ConnectionState type to the Promise Connection interface. (3.16.2) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.16.2)
- Improves handling of mixed and nested quotes in query parsing. (3.16.1) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.16.1)
- SNI is skipped for IP addresses in TLS connections. (3.15.3) — [release notes](https://github.com/sidorares/node-mysql2/releases/tag/v3.15.3)