build(deps): bump github.com/jackc/pgx/v5 from 5.9.1 to 5.9.2 #284

Open

dependabotbot_placeholder_mon8rt wants to merge 1 commit from dependabot/go_modules/github.com/jackc/pgx/v5-5.9.2 into main

dependabotbot_placeholder_mon8rt commented

2026-04-20 14:54:29 +00:00

(Migrated from git.csit.sgu.ru)

Bumps github.com/jackc/pgx/v5 from 5.9.1 to 5.9.2.

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.9.2 (April 18, 2026)

Fix SQL Injection via placeholder confusion with dollar quoted string literals (GHSA-j88v-2chj-qfwx)

SQL injection can occur when:

The non-default simple protocol is used.

A dollar quoted string literal is used in the SQL query.

That query contains text that would be would be interpreted outside as a placeholder outside of a string literal.

The value of that placeholder is controllable by the attacker.

e.g.
attackValue := `$tag$; drop table canary; --`
_, err = tx.Exec(ctx, `select $tag$ $1 $tag$, $1`, pgx.QueryExecModeSimpleProtocol, attackValue)
This is unlikely to occur outside of a contrived scenario.

Commits

0aeabbc Release v5.9.2
60644f8 Fix SQL sanitizer bugs with dollar-quoted strings and placeholder overflow
a5680bc Merge pull request #2531 from dolmen-go/godoc-add-links
e34e452 doc: Add godoc links
08c9bb1 Fix Stringer types encoded as text instead of numeric value in composite fields
96b4dbd Remove unstable test
acf88e0 Merge pull request #2526 from abrightwell/abrightwell-min-proto
2f81f1f Update max_protocol_version and min_protocol_version defaults
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) from 5.9.1 to 5.9.2. <details> <summary>Changelog</summary> Sourced from <a href="https://github.com/jackc/pgx/blob/master/CHANGELOG.md">github.com/jackc/pgx/v5's changelog</a>. <blockquote> <h1>5.9.2 (April 18, 2026)</h1> Fix SQL Injection via placeholder confusion with dollar quoted string literals (GHSA-j88v-2chj-qfwx) SQL injection can occur when: <ol> <li>The non-default simple protocol is used.</li> <li>A dollar quoted string literal is used in the SQL query.</li> <li>That query contains text that would be would be interpreted outside as a placeholder outside of a string literal.</li> <li>The value of that placeholder is controllable by the attacker.</li> </ol> e.g. <pre lang="go"><code>attackValue := `$tag$; drop table canary; --` _, err = tx.Exec(ctx, `select $tag$ $1 $tag$, $1`, pgx.QueryExecModeSimpleProtocol, attackValue) </code></pre> This is unlikely to occur outside of a contrived scenario. </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jackc/pgx/commit/0aeabbcf11d859229c1f0b20e710d3596c76bf27"><code>0aeabbc</code></a> Release v5.9.2</li> <li><a href="https://github.com/jackc/pgx/commit/60644f84918a8af66d14a4b0d865d4edafd955da"><code>60644f8</code></a> Fix SQL sanitizer bugs with dollar-quoted strings and placeholder overflow</li> <li><a href="https://github.com/jackc/pgx/commit/a5680bc945aa7c6ebac2778d859ee7b4ba86db60"><code>a5680bc</code></a> Merge pull request <a href="https://redirect.github.com/jackc/pgx/issues/2531">#2531</a> from dolmen-go/godoc-add-links</li> <li><a href="https://github.com/jackc/pgx/commit/e34e4524007062710c6a4fb9c8655b75a486b5cd"><code>e34e452</code></a> doc: Add godoc links</li> <li><a href="https://github.com/jackc/pgx/commit/08c9bb1f0d8fa6cc10ed8c713e68b1baa64dfe2c"><code>08c9bb1</code></a> Fix Stringer types encoded as text instead of numeric value in composite fields</li> <li><a href="https://github.com/jackc/pgx/commit/96b4dbdfd0458cb425bf8454d292a23978872cc8"><code>96b4dbd</code></a> Remove unstable test</li> <li><a href="https://github.com/jackc/pgx/commit/acf88e0065682e8948696d26fa6438669c4cabee"><code>acf88e0</code></a> Merge pull request <a href="https://redirect.github.com/jackc/pgx/issues/2526">#2526</a> from abrightwell/abrightwell-min-proto</li> <li><a href="https://github.com/jackc/pgx/commit/2f81f1fc03bef99593e92c64ad9cac954c00e8e6"><code>2f81f1f</code></a> Update <code>max_protocol_version</code> and <code>min_protocol_version</code> defaults</li> <li>See full diff in <a href="https://github.com/jackc/pgx/compare/v5.9.1...v5.9.2">compare view</a></li> </ul> </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/jackc/pgx/v5&package-manager=go_modules&previous-version=5.9.1&new-version=5.9.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin dependabot/go_modules/github.com/jackc/pgx/v5-5.9.2:dependabot/go_modules/github.com/jackc/pgx/v5-5.9.2

git switch dependabot/go_modules/github.com/jackc/pgx/v5-5.9.2

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff dependabot/go_modules/github.com/jackc/pgx/v5-5.9.2

git switch dependabot/go_modules/github.com/jackc/pgx/v5-5.9.2

git rebase main

git switch main

git merge --ff-only dependabot/go_modules/github.com/jackc/pgx/v5-5.9.2

git switch dependabot/go_modules/github.com/jackc/pgx/v5-5.9.2

git rebase main

git switch main

git merge --no-ff dependabot/go_modules/github.com/jackc/pgx/v5-5.9.2

git switch main

git merge --squash dependabot/go_modules/github.com/jackc/pgx/v5-5.9.2