Update pymysql requirement from >=1.2.0 to >=1.2.3

[dependabot]

Updates the requirements on pymysql to permit the latest version.

Release notes

Sourced from pymysql's releases.

v1.2.3

Full Changelog: PyMySQL/PyMySQL@v1.2.2...v1.2.3

Changelog

Sourced from pymysql's changelog.

v1.2.3

Release date: 2026-09-17

Restored the ability to import pymysql.converters.escape_bytes_prefixed for compatibility with aiomysql.

Use pymysql.converters at your own risk. It's internal functions. No backward compatibility are guaranteed.

v1.2.2

Release date: 2026-09-17

Restored the ability to import pymysql.converters.escape_dict for compatibility with aiomysql. This function does not escape dictionaries and is entirely unnecessary. Unless you use aiomysql, there is no need to upgrade from v1.2.1.

v1.2.1 (security fix)

Release date: 2026-09-17

Fixed a SQL injection vulnerability caused by incorrect escaping of bytes parameters when using the big5, gbk, sjis, cp932, or gb18030 character sets. This vulnerability also occurs when strings decoded from bytes using surrogateescape are passed as query parameters.

See also: https://github.com/PyMySQL/PyMySQL/security/advisories/GHSA-x4f8-9hx9-hpp9

• Queries are now encoded using the strict error handler instead of surrogateescape. Queries that cannot be encoded using the connection encoding can no longer be sent.

• bytes parameters are now always sent as hexadecimal literals, such as X'636174'. Note that this increases the number of bytes sent.

• The binary_prefix parameter of connect() is deprecated. The _binary prefix is no longer sent.

These changes address the confirmed SQL injection vulnerabilities related to character encoding. However, we strongly recommend using UTF-8 (utf8mb4). Other character sets are not thoroughly tested, and their limited use means that problems may go unreported. In the 2020s, encodings other than UTF-8 should be considered legacy.

v1.2.0

... (truncated)

Commits

• c990e86 v1.2.3
• c93fd97 add escape_bytes_prefixed. do not use it.
• dea8954 release v1.2.2
• 4f953ba fix: add escape_dict alias for aiomysql compatibility
• e13a28f ruff format
• 26a031d Prepare 1.2.1 security release
• a1547f5 Merge commit from fork
• 10739bc fix pymysql authentication state machine issue (#1271)
• 0fa39e9 agent: document local MySQL test setup (#1270)
• 55c604c perf: optimize packet reading and parsing (#1268)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

PR을 열어주셔서 감사합니다. 첫 PR이네요. 리뷰 후 피드백 남기겠습니다.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.