[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/jackc/pgx/v5	v5.2.0 → v5.9.2

---

pgx SQL Injection via Protocol Message Size Overflow

CVE-2024-27304 / GHSA-mrww-27vc-gghv

More information

Details

Impact

SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control.

Patches

The problem is resolved in v4.18.2 and v5.5.4.

Workarounds

Reject user input large enough to cause a single query or bind message to exceed 4 GB in size.

Severity

• CVSS Score: 8.1 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

References

• https://github.com/jackc/pgproto3/security/advisories/GHSA-7jwh-3vrq-q3m8
• https://github.com/jackc/pgx/security/advisories/GHSA-mrww-27vc-gghv
• https://github.com/jackc/pgproto3/commit/945c2126f6db8f3bea7eeebe307c01fe92bca007
• https://github.com/jackc/pgx/commit/adbb38f298c76e283ffc7c7a3f571036fea47fd4
• https://github.com/jackc/pgx/commit/c543134753a0c5d22881c12404025724cb05ffd8
• https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df
• https://nvd.nist.gov/vuln/detail/CVE-2024-27304
• https://www.youtube.com/watch?v=Tfg1B8u1yvE
• https://github.com/advisories/GHSA-mrww-27vc-gghv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Panic in Pipeline when PgConn is busy or closed in github.com/jackc/pgx

GHSA-fqpg-rq76-99pq

More information

Details

Pipeline can panic when PgConn is busy or closed.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/jackc/pgx/commit/dfd198003a03dbb96e4607b0d3a0bb9a7398ccb7
• https://github.com/advisories/GHSA-fqpg-rq76-99pq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Memory-safety vulnerability in github.com/jackc/pgx/v5.

CVE-2026-33816 / GHSA-9jj7-4m8r-rfcm

More information

Details

Memory-safety vulnerability in github.com/jackc/pgx/v5.

Severity

• CVSS Score: 9.8 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-33816
• https://pkg.go.dev/vuln/GO-2026-4772
• https://github.com/advisories/GHSA-9jj7-4m8r-rfcm

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pgx: SQL Injection via placeholder confusion with dollar quoted string literals

CVE-2026-41889 / GHSA-j88v-2chj-qfwx

More information

Details

Impact

SQL Injection can occur when:

1. The non-default simple protocol is used.
2. A dollar quoted string literal is used in the SQL query.
3. That string literal contains text that would be would be interpreted as a placeholder outside of a string literal.
4. The value of that placeholder is controllable by the attacker.

e.g.

attackValue := `$tag$; drop table canary; --`
_, err = tx.Exec(ctx, `select $tag$ $1 $tag$, $1`, pgx.QueryExecModeSimpleProtocol, attackValue)

This is unlikely to occur outside of a contrived scenario.

Patches

The problem is resolved in v5.9.2.

Workarounds

Do not use the simple protocol to execute queries matching all the above conditions.

Severity

• CVSS Score: 2.3 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/jackc/pgx/security/advisories/GHSA-j88v-2chj-qfwx
• https://github.com/jackc/pgx/commit/60644f84918a8af66d14a4b0d865d4edafd955da
• https://github.com/jackc/pgx/releases/tag/v5.9.2
• https://nvd.nist.gov/vuln/detail/CVE-2026-41889
• https://github.com/advisories/GHSA-j88v-2chj-qfwx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pgx contains memory-safety vulnerability

CVE-2026-33815 / GHSA-xgrm-4fwx-7qm8

More information

Details

pgx is a pure Go driver and toolkit for PostgreSQL. pgx prior to v5.9.0 contains a memory-safety vulnerability.

Severity

• CVSS Score: 9.8 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-33815
• https://pkg.go.dev/vuln/GO-2026-4771
• https://github.com/jackc/pgx/issues/2519
• https://github.com/jackc/pgx/issues/2530
• https://github.com/jackc/pgx/commit/6dbad4cafdb8a4daab7ff79c858c95da4b6109e8
• https://github.com/advisories/GHSA-xgrm-4fwx-7qm8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

jackc/pgx (github.com/jackc/pgx/v5)

v5.9.2

Compare Source

v5.9.1

Compare Source

v5.9.0

Compare Source

v5.8.0

Compare Source

v5.7.6

Compare Source

v5.7.5

Compare Source

v5.7.4

Compare Source

v5.7.3

Compare Source

v5.7.2

Compare Source

v5.7.1

Compare Source

v5.7.0

Compare Source

v5.6.0

Compare Source

v5.5.5

Compare Source

v5.5.4

Compare Source

v5.5.3

Compare Source

v5.5.2

Compare Source

v5.5.1

Compare Source

v5.5.0

Compare Source

v5.4.3

Compare Source

v5.4.2

Compare Source

v5.4.1

Compare Source

v5.4.0

Compare Source

v5.3.1

Compare Source

v5.3.0

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: pkgs/database/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 2 additional dependencies were updated

Details:

Package	Change
golang.org/x/crypto	v0.6.0 -> v0.17.0
golang.org/x/text	v0.7.0 -> v0.14.0

[renovate]

ℹ️ Artifact update notice

File name: pkgs/database/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Details:

Package	Change
github.com/jackc/pgservicefile	v0.0.0-20221227161230-091c0ba34f0a -> v0.0.0-20240606120523-5a60cdf6a761

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 173c3157-aa5d-475a-a0dc-db571f069035

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: ac2e68ad-1ba3-4f71-b219-eddb8618083e

📥 Commits

Reviewing files that changed from the base of the PR and between fcb1c98 and b877181.

⛔ Files ignored due to path filters (2)

• pkgs/database/go.sum is excluded by !**/*.sum
• pkgs/import/go.sum is excluded by !**/*.sum

📒 Files selected for processing (2)

• pkgs/database/go.mod
• pkgs/import/go.mod

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 2 remain after this review.

📝 Walkthrough

Both Go modules now require Go 1.25.0. The changes also update several dependencies and make github.com/lib/pq a direct dependency in the import module.

Changes: Go module updates

Layer / File(s)	Summary
Module versions and dependencies pkgs/database/go.mod, pkgs/import/go.mod	Both modules now require Go 1.25.0. The database module updates pgx/v5, pgservicefile, and golang.org/x/text. The import module updates these dependencies, golang.org/x/sync, and lists github.com/lib/pq as a direct dependency.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to b8771

No new merge-blocking issue is established by these dependency updates. The import module’s pinned Nix build remains incompatible with its Go requirement and needs a separate fix.

Architecture risk: 🔵 Low · up to b8771

The change affects 1 system.

Changed systems: pkgs

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — pkgs (service) was modified; 2 changed files map to changed impact.

Before / after behavior

• observed — Modified behavior in pkgs/database/go.mod: The module’s Go version requirement changes from 1.21.3 to 1.25.0. pgx/v5 is upgraded from v5.2.0 to v5.9.2, pgservicefile from its 2022 pseudo-version to its 2024 pseudo-version, and golang.org/x/text from v0.7.0 to v0.29.0; the other listed dependencies remain unchanged.
• observed — Modified behavior in pkgs/import/go.mod: The Go version changes from 1.21.3 to 1.25.0, and github.com/lib/pq v1.10.9 moves from the indirect dependency list to the direct requirements.
• observed — Modified behavior in pkgs/import/go.mod: The indirect dependencies pgservicefile and pgx/v5 are upgraded to newer versions.
• observed — Modified behavior in pkgs/import/go.mod: The indirect golang.org/x/sync and golang.org/x/text dependencies are upgraded; golang.org/x/sys remains at v0.15.0.

Pre-merge checks: 5

Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the primary change: updating github.com/jackc/pgx/v5 to v5.9.2 for security fixes. This matches the pull request objectives.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}