Bohan Jiang be54e79f38 fix: upgrade github.com/jackc/pgx/v5 to 5.9.2 (#3192) ...

Remediates two pgx security advisories in a single bump:
- CVE-2026-33816 (fixed in 5.9.0) — pgproto3 memory-safety DoS from
  malformed messages sent by a malicious server.
- GHSA-j88v-2chj-qfwx / CVE-2026-41889 (fixed in 5.9.2) — SQL injection
  via placeholder confusion with dollar-quoted literals under
  QueryExecModeSimpleProtocol. Not reachable in this codebase (no
  simple-protocol callers), but pinned to clear future scanner runs.

No source changes needed: pgx 5.9.x adds no breaking APIs over 5.8.x
(adds PG protocol 3.2 support, SCRAM-SHA-256-PLUS, OAuth, plus
pgtype/pgconn bug fixes). Minimum Go bumped to 1.25 in 5.9.0; repo
already on 1.26.1.

MUL-2597

Co-authored-by: multica-agent <github@multica.ai>

2026-05-25 14:06:56 +08:00

14 KiB

Raw Permalink Blame History

View Raw