[dependabot]

Bumps the database-clients group with 2 updates: mariadb and mongoose.

Updates mariadb from 3.5.4 to 3.5.5

Release notes

Sourced from mariadb's releases.

MariaDB Connector/Node.js 3.5.5

3.5.5 (Oct 2026)

Full Changelog

Notable changes

• CONJS-373: Each release ships a signed CycloneDX 1.6 software bill of materials, listing the package's dependencies for supply-chain audits
• CONJS-377: Faster queries: client-side parsing of the query and decoding of DATE, DATETIME and ASCII values in text protocol results take less time
• CONJS-382: Faster text protocol queries with large string parameters: a string with nothing to escape is encoded natively, 3x faster at 128 characters and 10x and more from 512
• CONJS-383: Faster execute() on large result sets: binary protocol rows no longer allocate a buffer per row, 40% faster on a 1000-row result set

Issues Fixed

• A pool that fails to create a connection now reports it through the logger when the application registers no error listener; the failure used to be silently dropped by a default listener (#180)
• CONJS-371: changeUser() failed with ER_SELF_SIGNED_SHA256 for a caching_sha2_password user after a self-signed TLS handshake, although the connection was already authenticated (report by fg0x0)
• CONJS-378: Pool.escape() returned a backslash-escaped value under NO_BACKSLASH_ESCAPES when every connection of the pool was in use, leaving the value injectable (report by buxuwa)
• CONJS-379: SQL injection through a Buffer parameter under the big5 client charset: the five lead bytes 0xFA-0xFE, single bytes for the server, were not escaped (report by fg0x0)
• CONJS-380: SQL injection through a string parameter or escape() under the big5, gbk, sjis and cp932 client charsets, ordinary characters encoding to sequences the server reads as single bytes (report by fg0x0)
• CONJS-381: A connection configured with a charset the server does not support, such as gb18030 on MariaDB, silently stayed on utf8mb4 while parameters were escaped for the requested charset; the connection is now refused by the server (report by fg0x0)
• CONJS-388: The meta property of a result could not be deleted, which made every Sequelize raw query fail with "Cannot delete property 'meta'" (#234)
• CONJS-389: connection.destroy() did not kill the running query on a TLS connection with certificate validation: the kill connection, opened on the server IP, failed hostname verification; the query promise also never settled when that connection could not be opened (#304)
• SqlError lost its constructor shape through a namespace import, so err instanceof SqlError was false (#356 thanks to GiHoon1123)
• CONJS-386: A query issued while the connection was still sending a previous command, such as a large insert or a streamed parameter, could be silently dropped and its promise never settled, including when the connection failed (#358 thanks to GiHoon1123)
• Type definitions: StreamCallback was declared as a value it never exports
• CONJS-385: Type definitions: TypeScript users can now pass bitOneIsBoolean, jsonStrings, fullResult, restrictedAuth, permitConnectionWhenExpired, permitRedirect, charsetNumber, enableKeepAlive and keepAliveInitialDelay, a function or logParam for logger, without a cast; the unused logPackets option and the internal ConnectionInfo.collation are no longer declared; the pool's error event and SqlError.cause are declared

Changelog

Sourced from mariadb's changelog.

3.5.5 (Oct 2026)

Full Changelog

Notable changes

• CONJS-373: Each release ships a signed CycloneDX 1.6 software bill of materials, listing the package's dependencies for supply-chain audits
• CONJS-377: Faster queries: client-side parsing of the query and decoding of DATE, DATETIME and ASCII values in text protocol results take less time
• CONJS-382: Faster text protocol queries with large string parameters: a string with nothing to escape is encoded natively, 3x faster at 128 characters and 10x and more from 512
• CONJS-383: Faster execute() on large result sets: binary protocol rows no longer allocate a buffer per row, 40% faster on a 1000-row result set

Issues Fixed

• A pool that fails to create a connection now reports it through the logger when the application registers no error listener; the failure used to be silently dropped by a default listener (#180)
• CONJS-371: changeUser() failed with ER_SELF_SIGNED_SHA256 for a caching_sha2_password user after a self-signed TLS handshake, although the connection was already authenticated (report by fg0x0)
• CONJS-378: Pool.escape() returned a backslash-escaped value under NO_BACKSLASH_ESCAPES when every connection of the pool was in use, leaving the value injectable (report by buxuwa and Kaya Emre Arikan)
• CONJS-379: SQL injection through a Buffer parameter under the big5 client charset: the five lead bytes 0xFA-0xFE, single bytes for the server, were not escaped (report by fg0x0)
• CONJS-380: SQL injection through a string parameter or escape() under the big5, gbk, sjis and cp932 client charsets, ordinary characters encoding to sequences the server reads as single bytes (report by fg0x0)
• CONJS-381: A connection configured with a charset the server does not support, such as gb18030 on MariaDB, silently stayed on utf8mb4 while parameters were escaped for the requested charset; the connection is now refused by the server (report by fg0x0)
• CONJS-388: The meta property of a result could not be deleted, which made every Sequelize raw query fail with "Cannot delete property 'meta'" (#234)
• CONJS-389: connection.destroy() did not kill the running query on a TLS connection with certificate validation: the kill connection, opened on the server IP, failed hostname verification; the query promise also never settled when that connection could not be opened (#304)
• SqlError lost its constructor shape through a namespace import, so err instanceof SqlError was false (#356 thanks to GiHoon1123)
• CONJS-386: A query issued while the connection was still sending a previous command, such as a large insert or a streamed parameter, could be silently dropped and its promise never settled, including when the connection failed (#358 thanks to GiHoon1123)
• Type definitions: StreamCallback was declared as a value it never exports
• CONJS-385: Type definitions: TypeScript users can now pass bitOneIsBoolean, jsonStrings, fullResult, restrictedAuth, permitConnectionWhenExpired, permitRedirect, charsetNumber, enableKeepAlive and keepAliveInitialDelay, a function or logParam for logger, without a cast; the unused logPackets option and the internal ConnectionInfo.collation are no longer declared; the pool's error event and SqlError.cause are declared

3.4.8 (Oct 2026)

Full Changelog

Issues Fixed

• CONJS-378: Pool.escape() escaped with backslashes under NO_BACKSLASH_ESCAPES when every connection of the pool was in use (report by buxuwa)
• CONJS-379: Fixed SQL injection in Buffer parameter escaping under big5 client charset: lead bytes 0xFA-0xFE are single bytes for the server (report by fg0x0)
• CONJS-380: Fixed SQL injection in string parameter and escape() escaping under big5, gbk, sjis and cp932 client charsets, the escape being applied before encoding (report by fg0x0)
• CONJS-381: A configured collation is always set with SET NAMES, so that a charset the server does not support (gb18030 on MariaDB) is refused instead of silently ignored (report by fg0x0)

3.3.5 (Oct 2026)

Full Changelog

Issues Fixed

• CONJS-378: Pool.escape() escaped with backslashes under NO_BACKSLASH_ESCAPES when every connection of the pool was in use (report by buxuwa)
• CONJS-379: Fixed SQL injection in Buffer parameter escaping under big5 client charset: lead bytes 0xFA-0xFE are single bytes for the server (report by fg0x0)
• CONJS-380: Fixed SQL injection in string parameter and escape() escaping under big5, gbk, sjis and cp932 client charsets, the escape being applied before encoding (report by fg0x0)
• CONJS-381: A configured collation is always set with SET NAMES, so that a charset the server does not support (gb18030 on MariaDB) is refused instead of silently ignored (report by fg0x0)

3.2.6 (Oct 2026)

Full Changelog

Issues Fixed

• CONJS-378: Pool.escape() escaped with backslashes under NO_BACKSLASH_ESCAPES when every connection of the pool was in use (report by buxuwa)
• CONJS-379: Fixed SQL injection in Buffer parameter escaping under big5 client charset: lead bytes 0xFA-0xFE are single bytes for the server (report by fg0x0)
• CONJS-380: Fixed SQL injection in string parameter and escape() escaping under big5, gbk, sjis and cp932 client charsets, the escape being applied before encoding (report by fg0x0)

... (truncated)

Commits

• a9bf77d [misc] release workflow started by hand only
• bf7807a [CONJS-389] test: destroyed query is rejected when no kill connection can be ...
• cd9add9 [CONJS-385] restore pool 'enqueue' event
• 3e307f8 [misc] updating changelog
• 6348198 [CONJS-389] destroy() kill connection fails hostname verification with TLS
• 221532e [CONJS-388] Result meta property can be deleted #234
• 3078fc2 [misc] Pool connection failures are silently dropped when the application has...
• 9daaa72 Merge branch 'develop'
• b5af03b Merge pull request #360 from mariadb-corporation/dependabot/npm_and_yarn/sour...
• f8e5b97 Merge pull request #359 from mariadb-corporation/dependabot/npm_and_yarn/brac...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mariadb since your current version.

Updates mongoose from 9.11.4 to 9.12.0

Release notes

Sourced from mongoose's releases.

9.12.0 / 2026-11-04

• feat: upgrade to mongodb driver 7.8 #16772 #16667
• perf: improve for document arrays: cache paths with defaults and schemas with select paths; avoid unnecessary $isModified() lookup #16595
• fix: make recompileSchema recompute derived caches and delay _preCompile() until an actual model is compiled (not subdocs or doc arrays) #16595
• fix(array): compare UUIDs by value in indexOf() so pull() and addToSet() work #16606 luantaraschi
• docs(query): remove unused use$geoWithin docs and property #16589 #16583

Changelog

Sourced from mongoose's changelog.

9.12.0 / 2026-11-04

• feat: upgrade to mongodb driver 7.8 #16772 #16667
• perf: improve for document arrays: cache paths with defaults and schemas with select paths; avoid unnecessary $isModified() lookup #16595
• fix: make recompileSchema recompute derived caches and delay _preCompile() until an actual model is compiled (not subdocs or doc arrays) #16595
• fix(array): compare UUIDs by value in indexOf() so pull() and addToSet() work #16606 luantaraschi
• docs(query): remove unused use$geoWithin docs and property #16589 #16583

9.11.5 / 2026-11-03

• fix(query): pass explain verbosity to the driver cursor in find() #16635 jasontd92
• fix(map): support ObjectId keys in MongooseMap#has() NgoQuocViet2001
• fix(schema): clear enumValues when enum validator is removed with enum(false) #16631 Enesuygurs
• fix: respect disabled updatedAt in pipeline updates #16642 #16641 ItsM0rty
• fix: make schema clone() copy $timestamps #16651 #16650 Oleksii-Pavliuk
• fix(model): preserve WriteError instances in insertMany() writeErrors #16608 #16607 Majny
• fix: bump sift -> 17.1.4 rishabhnehra
• docs(production): add production indexes guide #16627
• docs(ask-ai): send session cookie and continue stored conversations #16652 nlarew

8.24.8 / 2026-11-02

• fix(schema): remove map paths cleanly, including maps under nested paths (backport to 8.x) #16625 #16461 #16457 mrityunjay-pandey
• fix(schema): keep the map value schematype a single object when cloning (backport to 8.x) #16624 #16473 mrityunjay-pandey
• fix(map): support ObjectId keys in MongooseMap#has() (backport to 8.x #16634 mrityunjay-pandey
• fix(hydration): use the doc model for looking up a ref (backport to 8.x) #16623 #16453 mrityunjay-pandey
• fix(document): replace {MODEL} in custom cast error messages from document validation (backport to 8.x) #16622 #16480 mrityunjay-pandey
• fix(schema): run setters declared on the union path itself (backport to 8.x) #16621 #16528 mrityunjay-pandey

Commits

• be57670 chore: release 9.12.0
• 0f620fa Merge pull request #16675 from Automattic/9.12
• 2a92806 fix: make recompileSchema recompute derived caches and delay _preCompile() un...
• f8d4fd8 Merge pull request #16672 from Automattic/vkarpov15/20261103/gh-16667
• 21ad530 feat: upgrade to mongodb 7.8
• b8a882a Merge branch 'master' into 9.12
• 157c8fb chore: release 9.11.5
• c032c07 Merge pull request #16608 from Majny/fix/insertmany-preserve-writeerror
• 028a295 Fix WriteError index assignment in error handling
• 2702238 Merge branch '8.x'
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, engine. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	mariadb@​3.5.4 ⏵ 3.5.5				+5
	mongoose@​9.11.4 ⏵ 9.12.0	+1			+1

View full report