[GOOD FIRST ISSUE] Update mysql2 to >= 3.9.7 to fix critical RCE vulnerability in appsync examples

[ulises-jeremias]

Task

Update mysql2 to >= 3.9.7 in the two affected serverless AppSync examples to fix a critical Remote Code Execution (RCE) vulnerability. This is a focused dependency-only change.

---

Vulnerability

Advisory	Severity	Description
GHSA-mqr2-w7wj-jjgr	Critical	RCE via the readCodeFor function — malformed server responses can trigger code execution
GHSA-pxvg-2qj5-37jq	Critical	Cache poisoning via predictable sequence numbers

Open Dependabot alerts: 10 (4 critical, 2 high, 4 medium)

---

Affected Examples

mysql2 is pulled in by serverless-appsync-simulator (used to simulate a local MySQL data source for AppSync resolvers):

Example	Path	Current version
examples/serverless-appsync-node-typescript	package-lock.json	< 3.9.7
examples/serverless-appsync-python	package-lock.json	< 3.9.7

---

Steps

1. Fork this repository
2. For each affected example:

   cd examples/serverless-appsync-node-typescript
   npm ls mysql2          # confirm current version

3. Check if mysql2 is a direct dependency or transitive:

   cat package.json | grep mysql2

4. If direct, update it:

   npm install mysql2@^3.9.7 --save

   If transitive only, add an override in package.json:

   "overrides": {
     "mysql2": "^3.9.7"
   }

5. Run npm install and verify:

   npm ls mysql2           # should show >= 3.9.7
   npm audit | grep mysql2 # should return 0

6. Repeat for examples/serverless-appsync-python
7. Open a single PR with both changes

---

Validation

# In each affected example:
npm audit --json | python3 -c "
import json, sys
d = json.load(sys.stdin)
mysql = {k: v for k, v in d.get('vulnerabilities', {}).items() if 'mysql2' in k}
print('mysql2 vulnerabilities remaining:', len(mysql))
"
# Expected: mysql2 vulnerabilities remaining: 0

---

Out of Scope

• Do not change any AppSync resolver logic
• Do not update other unrelated packages
• Do not migrate to Serverless v4 in this PR (tracked separately)

---

References

• GHSA-mqr2-w7wj-jjgr — mysql2 RCE
• mysql2 changelog
• npm overrides docs