Skip to content

Conversation

HectorMalot
Copy link

Hi team,

Context: I realize this repository only holds the contract for development purposes, but some vulnerability scanners - such as Snyk - light up when scanning this, and updating the contract seemed like the more future proof solution than asking everyone to set these warnings to ignore independently.

This PR updates pgx/v5 from v5.2.0 to v5.7.6. This addresses the following vulnerabilities:

GO-2024-2606: SQL injection in github.com/jackc/pgproto3 and github.com/jackc/pgx - resolved in v.5.5.3
GO-2024-2567: Panic in Pipeline when PgConn is busy or closed in github.com/jackc/pgx - resolved in v.5.5.1

It also updates the transitive dependencies. Highlights:

  • golang.org/x/crypt from v0.0.0-20220829220503-c86fa9a7ed90 to v0.42.0 . This addresses
    • GO-2023-2402: Man-in-the-middle attacker can compromise integrity of secure channel in golang.org/x/crypto
    • GO-2024-3321: Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto
    • GO-2025-3487: Potential denial of service in golang.org/x/crypto
  • Introduces github.com/stretchr/testify as a dependency, required for the updated version of pgx/v5
  • Removes go.uber.org/atomic as a dependency (no longer required)

Finally, it updates from go 1.18 to 1.24.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant