[methane]

Prepare mysqlclient 2.3.1 with a fix for SQL injection through Python set query parameters when NO_BACKSLASH_ESCAPES is enabled: GHSA-m9c3-99x3-77g6.

Update the version and release notes, deprecate Set2Str, and route set/frozenset escaping through the connection. This also includes tag-triggered Trusted Publishing for Windows wheels and the sdist, its Actions lockfile updates, and the release procedure.

Validation:

• MySQL 8.0.46 / Python 3.12.3: all 161 tests passed, including SQLAlchemy tests.
• Real SQL checks for set/frozenset values under default and NO_BACKSLASH_ESCAPES modes, with utf8mb4 and latin1; the legacy injection path reproduced and the fixed path rejected the injected condition.
• Built the sdist and Linux aarch64 wheel; both passed twine check.
• Ruff, actionlint, and Actions lockfile verification passed.

Summary by CodeRabbit

• Bug Fixes
  • Improved escaping for set and frozenset query parameters, accounting for the connection’s character set and SQL mode.
  • Fixed connection-attribute lookups for non-string names and strings containing lone surrogates.
  • Updated Connection.literal() handling for built-in types and subclasses.
• Deprecations
  • Deprecated MySQLdb.converters.Set2Str; sets are no longer registered for automatic conversion.
• Release
  • Updated the package version to 2.3.1.

[coderabbitai]

Caution

Review failed

The pull request is closed.

Walkthrough

The pull request updates SQL literal conversion, sets the package version to 2.3.1, adds release notes and a release procedure, and adds tag-triggered Windows artifact publishing to PyPI.

Changes: 2.3.1 release

Layer / File(s)	Summary
SQL literal conversion src/MySQLdb/connections.py, src/MySQLdb/converters.py, HISTORY.rst	Connection.literal() now dispatches on exact built-in types and handles sets and frozensets through a helper that rejects non-string elements. Set2Str emits a deprecation warning and is removed from the conversion mapping. The release notes describe these changes and connection-attribute lookup fixes.
Release version and procedure src/MySQLdb/release.py, HISTORY.rst, notes/release.md	The package version changes to 2.3.1. The history adds the release entry, and the release guide documents version updates, checks, tagging, and artifact verification.
Windows publishing workflow .github/workflows/windows.yaml	The workflow runs on v* tag pushes with read-only contents permission. Its publish job downloads and merges build artifacts, then publishes them to PyPI with attestations. Artifact upload fails if no files are found.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant Actions as GitHub Actions
  participant Build as build job
  participant Artifacts as workflow artifacts
  participant Publish as publish job
  participant PyPI
  Actions->>Build: run on v* tag push
  Build->>Artifacts: upload Windows artifacts
  Actions->>Publish: run after build for a newly created v tag
  Publish->>Artifacts: download and merge win-wheels-* artifacts
  Publish->>PyPI: publish artifacts with attestations

Loading

Possibly related PRs

• PyMySQL/mysqlclient#811: Adds and verifies the Actions dependency lockfile used by the workflow changes.
• PyMySQL/mysqlclient#810: Fixes connection-attribute lookups that the 2.3.1 release notes also describe.

Suggested reviewers: djailla

Merge Risk: Moderate · up to a5776

Registered set converters can be ignored, changing query values or causing errors. Fix this and the Windows source-build configuration before release; the tagging instructions also need a usable remote.

- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[codecov]

Codecov Report

❌ Patch coverage is 56.25000% with 7 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.81%. Comparing base (e2a908b) to head (a577609).
⚠️ Report is 60 commits behind head on main.

Files with missing lines	Patch %	Lines
src/MySQLdb/connections.py	58.33%	5 Missing ⚠️
src/MySQLdb/converters.py	0.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #813      +/-   ##
==========================================
+ Coverage   88.86%   90.81%   +1.94%     
==========================================
  Files           7        7              
  Lines         548      686     +138     
==========================================
+ Hits          487      623     +136     
- Misses         61       63       +2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.