[!WARNING]
This release fixes a vulnerability (CVE-2024-36039).
All users are recommended to update to this version.
If you can not update soon, check the input value from
untrusted source has an expected type. Only dict input
from untrusted source can be an attack vector.
Prohibit dict parameter for Cursor.execute(). It didn't produce valid SQL
and might cause SQL injection. (CVE-2024-36039)
Cursor.fetchall() returns empty list instead of tuple (#1115). Note that Cursor.fetchmany() still return empty tuple after reading all rows for compatibility with Django.
New connection always send "SET NAMES charset [COLLATE collation]" query. (#1119)
Since collation table is vary on MySQL server versions, collation in handshake is fragile.
