Update go.mod dependencies #42
Open
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hi team,
Context: I realize this repository only holds the contract for development purposes, but some vulnerability scanners - such as Snyk - light up when scanning this, and updating the contract seemed like the more future proof solution than asking everyone to set these warnings to ignore independently.
This PR updates pgx/v5 from v5.2.0 to v5.7.6. This addresses the following vulnerabilities:
GO-2024-2606: SQL injection in github.com/jackc/pgproto3 and github.com/jackc/pgx - resolved in v.5.5.3
GO-2024-2567: Panic in Pipeline when PgConn is busy or closed in github.com/jackc/pgx - resolved in v.5.5.1
It also updates the transitive dependencies. Highlights:
Finally, it updates from go 1.18 to 1.24.