critical pymysql security vulnerability

[birkin]

I think we're using mysqlclient instead in prod -- but it's still installed on prod so I (birkin) will upgrade the package.