chore(deps): bump the security-updates group with 22 updates#155
chore(deps): bump the security-updates group with 22 updates#155dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the security-updates group with 22 updates: | Package | From | To | | --- | --- | --- | | [github.com/BurntSushi/toml](https://github.com/BurntSushi/toml) | `1.5.0` | `1.6.0` | | [github.com/gin-gonic/gin](https://github.com/gin-gonic/gin) | `1.11.0` | `1.12.0` | | [github.com/go-sql-driver/mysql](https://github.com/go-sql-driver/mysql) | `1.9.2` | `1.10.0` | | [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.22.0` | `1.23.2` | | [github.com/redis/go-redis/v9](https://github.com/redis/go-redis) | `9.19.0` | `9.20.0` | | [go.etcd.io/etcd/api/v3](https://github.com/etcd-io/etcd) | `3.5.21` | `3.6.12` | | [go.etcd.io/etcd/client/v3](https://github.com/etcd-io/etcd) | `3.5.21` | `3.6.12` | | [go.etcd.io/etcd/server/v3](https://github.com/etcd-io/etcd) | `3.5.21` | `3.6.12` | | [go.opentelemetry.io/contrib/propagators/autoprop](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.63.0` | `0.69.0` | | [go.opentelemetry.io/contrib/samplers/jaegerremote](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.37.0` | `0.37.1` | | [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) | `1.43.0` | `1.44.0` | | [go.opentelemetry.io/otel/bridge/opentracing](https://github.com/open-telemetry/opentelemetry-go) | `1.36.0` | `1.44.0` | | [go.opentelemetry.io/otel/exporters/jaeger](https://github.com/open-telemetry/opentelemetry-go) | `1.16.0` | `1.17.0` | | [go.opentelemetry.io/otel/exporters/otlp/otlptrace](https://github.com/open-telemetry/opentelemetry-go) | `1.38.0` | `1.44.0` | | [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc](https://github.com/open-telemetry/opentelemetry-go) | `1.38.0` | `1.44.0` | | [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp](https://github.com/open-telemetry/opentelemetry-go) | `1.36.0` | `1.44.0` | | [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) | `1.43.0` | `1.44.0` | | [go.opentelemetry.io/otel/trace](https://github.com/open-telemetry/opentelemetry-go) | `1.43.0` | `1.44.0` | | [go.uber.org/zap](https://github.com/uber-go/zap) | `1.27.0` | `1.28.0` | | [golang.org/x/sys](https://github.com/golang/sys) | `0.42.0` | `0.45.0` | | [gorm.io/gorm](https://github.com/go-gorm/gorm) | `1.30.0` | `1.31.1` | | [k8s.io/client-go](https://github.com/kubernetes/client-go) | `0.34.1` | `0.36.1` | Updates `github.com/BurntSushi/toml` from 1.5.0 to 1.6.0 - [Release notes](https://github.com/BurntSushi/toml/releases) - [Commits](BurntSushi/toml@v1.5.0...v1.6.0) Updates `github.com/gin-gonic/gin` from 1.11.0 to 1.12.0 - [Release notes](https://github.com/gin-gonic/gin/releases) - [Changelog](https://github.com/gin-gonic/gin/blob/master/CHANGELOG.md) - [Commits](gin-gonic/gin@v1.11.0...v1.12.0) Updates `github.com/go-sql-driver/mysql` from 1.9.2 to 1.10.0 - [Release notes](https://github.com/go-sql-driver/mysql/releases) - [Changelog](https://github.com/go-sql-driver/mysql/blob/master/CHANGELOG.md) - [Commits](go-sql-driver/mysql@v1.9.2...v1.10.0) Updates `github.com/prometheus/client_golang` from 1.22.0 to 1.23.2 - [Release notes](https://github.com/prometheus/client_golang/releases) - [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md) - [Commits](prometheus/client_golang@v1.22.0...v1.23.2) Updates `github.com/redis/go-redis/v9` from 9.19.0 to 9.20.0 - [Release notes](https://github.com/redis/go-redis/releases) - [Changelog](https://github.com/redis/go-redis/blob/master/RELEASE-NOTES.md) - [Commits](redis/go-redis@v9.19.0...v9.20.0) Updates `go.etcd.io/etcd/api/v3` from 3.5.21 to 3.6.12 - [Release notes](https://github.com/etcd-io/etcd/releases) - [Commits](etcd-io/etcd@v3.5.21...v3.6.12) Updates `go.etcd.io/etcd/client/v3` from 3.5.21 to 3.6.12 - [Release notes](https://github.com/etcd-io/etcd/releases) - [Commits](etcd-io/etcd@v3.5.21...v3.6.12) Updates `go.etcd.io/etcd/server/v3` from 3.5.21 to 3.6.12 - [Release notes](https://github.com/etcd-io/etcd/releases) - [Commits](etcd-io/etcd@v3.5.21...v3.6.12) Updates `go.opentelemetry.io/contrib/propagators/autoprop` from 0.63.0 to 0.69.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go-contrib@zpages/v0.63.0...zpages/v0.69.0) Updates `go.opentelemetry.io/contrib/samplers/jaegerremote` from 0.37.0 to 0.37.1 - [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go-contrib@zpages/v0.37.0...samplers/jaegerremote/v0.37.1) Updates `go.opentelemetry.io/otel` from 1.43.0 to 1.44.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.43.0...v1.44.0) Updates `go.opentelemetry.io/otel/bridge/opentracing` from 1.36.0 to 1.44.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.36.0...v1.44.0) Updates `go.opentelemetry.io/otel/exporters/jaeger` from 1.16.0 to 1.17.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.16.0...v1.17.0) Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace` from 1.38.0 to 1.44.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.38.0...v1.44.0) Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc` from 1.38.0 to 1.44.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.38.0...v1.44.0) Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp` from 1.36.0 to 1.44.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.36.0...v1.44.0) Updates `go.opentelemetry.io/otel/sdk` from 1.43.0 to 1.44.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.43.0...v1.44.0) Updates `go.opentelemetry.io/otel/trace` from 1.43.0 to 1.44.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.43.0...v1.44.0) Updates `go.uber.org/zap` from 1.27.0 to 1.28.0 - [Release notes](https://github.com/uber-go/zap/releases) - [Changelog](https://github.com/uber-go/zap/blob/master/CHANGELOG.md) - [Commits](uber-go/zap@v1.27.0...v1.28.0) Updates `golang.org/x/sys` from 0.42.0 to 0.45.0 - [Commits](golang/sys@v0.42.0...v0.45.0) Updates `gorm.io/gorm` from 1.30.0 to 1.31.1 - [Release notes](https://github.com/go-gorm/gorm/releases) - [Commits](go-gorm/gorm@v1.30.0...v1.31.1) Updates `k8s.io/client-go` from 0.34.1 to 0.36.1 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](kubernetes/client-go@v0.34.1...v0.36.1) --- updated-dependencies: - dependency-name: github.com/BurntSushi/toml dependency-version: 1.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: github.com/gin-gonic/gin dependency-version: 1.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: github.com/go-sql-driver/mysql dependency-version: 1.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: github.com/prometheus/client_golang dependency-version: 1.23.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: github.com/redis/go-redis/v9 dependency-version: 9.20.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.etcd.io/etcd/api/v3 dependency-version: 3.6.12 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.etcd.io/etcd/client/v3 dependency-version: 3.6.12 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.etcd.io/etcd/server/v3 dependency-version: 3.6.12 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.opentelemetry.io/contrib/propagators/autoprop dependency-version: 0.69.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.opentelemetry.io/contrib/samplers/jaegerremote dependency-version: 0.37.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: security-updates - dependency-name: go.opentelemetry.io/otel dependency-version: 1.44.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.opentelemetry.io/otel/bridge/opentracing dependency-version: 1.44.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.opentelemetry.io/otel/exporters/jaeger dependency-version: 1.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace dependency-version: 1.44.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc dependency-version: 1.44.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp dependency-version: 1.44.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.opentelemetry.io/otel/sdk dependency-version: 1.44.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.opentelemetry.io/otel/trace dependency-version: 1.44.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.uber.org/zap dependency-version: 1.28.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: golang.org/x/sys dependency-version: 0.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: gorm.io/gorm dependency-version: 1.31.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: k8s.io/client-go dependency-version: 0.36.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
|
📝 WalkthroughWalkthroughThis pull request updates the Go module file to use Go 1.26.0 and refreshes all direct and indirect dependencies. Direct dependencies including Gin, MySQL driver, Prometheus client, Redis client, etcd, OpenTelemetry suite, gRPC, and GORM are bumped to newer versions. Indirect dependencies are comprehensively updated, including a migration from golang-jwt v4 to v5 and advanced versions of gRPC gateway/middleware modules, Prometheus packages, and OpenTelemetry instrumentation libraries. ChangesDependency ecosystem upgrade
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | 0 |
| Duplication | 0 |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
go.mod (1)
170-170:⚠️ Potential issue | 🔴 Critical | ⚡ Quick winRemove (or bump) the gRPC
replacepin to v1.63.2
go.modrequiresgoogle.golang.org/grpc v1.81.1, butreplace google.golang.org/grpc => google.golang.org/grpc v1.63.2(line 170) downgrades it to a version in the CRITICAL authorization-bypass range (< 1.79.3, first patched1.79.3).Recommended actions:
- Remove the
replacedirective so the dependency stays atv1.81.1.- If the
replaceis required, update it togoogle.golang.org/grpc v1.79.3(or newer, ideallyv1.81.1)—don’t keepv1.63.2.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@go.mod` at line 170, The go.mod currently forces google.golang.org/grpc to v1.63.2 via the replace directive, which downgrades the module into a vulnerable range; remove the "replace google.golang.org/grpc => google.golang.org/grpc v1.63.2" directive so the module uses the declared v1.81.1, or if a replace is required update it to at least v1.79.3 (preferably v1.81.1) to eliminate the authorization-bypass vulnerability—edit the replace entry in go.mod accordingly.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 95: go.mod currently resolves github.com/jackc/pgx/v5 to v5.6.0 via
gorm.io/driver/postgres; update dependencies so pgx/v5 resolves to >= v5.9.2
(prefer v5.10.0) by either bumping gorm.io/driver/postgres to a version that
pulls pgx v5.9.2+ or adding an explicit require for github.com/jackc/pgx/v5
v5.9.2 (or v5.10.0) in go.mod and then run go get github.com/jackc/pgx/v5@v5.9.2
(or `@v5.10.0`) and go mod tidy to ensure transitive resolution, verify with go
list -m all that github.com/jackc/pgx/v5 now resolves to v5.9.2+.
---
Outside diff comments:
In `@go.mod`:
- Line 170: The go.mod currently forces google.golang.org/grpc to v1.63.2 via
the replace directive, which downgrades the module into a vulnerable range;
remove the "replace google.golang.org/grpc => google.golang.org/grpc v1.63.2"
directive so the module uses the declared v1.81.1, or if a replace is required
update it to at least v1.79.3 (preferably v1.81.1) to eliminate the
authorization-bypass vulnerability—edit the replace entry in go.mod accordingly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: d2cc7190-a2c2-4557-ab26-7b661a3814d1
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
| github.com/hashicorp/go-version v1.6.0 // indirect | ||
| github.com/jackc/pgpassfile v1.0.0 // indirect | ||
| github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect | ||
| github.com/jackc/pgx/v5 v5.6.0 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Find parent dependency and check for pgx/v5 updates
# Find which direct dependency requires pgx/v5
go mod graph | grep 'jackc/pgx/v5'
# Check for available newer versions
go list -m -versions github.com/jackc/pgx/v5
# Check security advisories
gh api graphql -f query='
{
securityVulnerabilities(first: 10, ecosystem: GO, package: "github.com/jackc/pgx") {
nodes {
advisory {
summary
severity
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'Repository: kubeservice-stack/common
Length of output: 2303
🌐 Web query:
What is the latest patched version of github.com/jackc/pgx/v5 that fixes CVE-2026-33815 and GHSA-j88v-2chj-qfwx?
💡 Result:
The latest patched version of github.com/jackc/pgx/v5 that addresses the specified vulnerabilities is v5.9.2 or later [1][2]. Regarding the specific identifiers: - CVE-2026-33815 (also tracked as GHSA-xgrm-4fwx-7qm8 and GO-2026-4771) is a memory-safety vulnerability fixed in version 5.9.0 [3][4][5]. - GHSA-j88v-2chj-qfwx (associated with CVE-2026-41889) is an SQL injection vulnerability fixed in version 5.9.2 [2][6]. Since version 5.9.2 includes fixes for both issues (and subsequent versions like v5.10.0 contain all prior security patches), upgrading to v5.9.2 or the latest available version (v5.10.0 as of June 2026) is recommended [7][1][2].
Citations:
- 1: https://github.com/jackc/pgx/blob/master/CHANGELOG.md
- 2: GHSA-j88v-2chj-qfwx
- 3: https://pkg.go.dev/vuln/GO-2026-4771
- 4: GHSA-xgrm-4fwx-7qm8
- 5: https://osv.dev/vulnerability/GO-2026-4771
- 6: https://osv.dev/vulnerability/GHSA-j88v-2chj-qfwx
- 7: https://pkg.go.dev/github.com/jackc/pgx/v5
🌐 Web query:
GHSA-9jj7-4m8r-rfcm github.com/jackc/pgx/v5 affected versions fixed version
💡 Result:
The vulnerability GHSA-9jj7-4m8r-rfcm (also identified as CVE-2026-33816) is a critical memory-safety vulnerability affecting the github.com/jackc/pgx/v5 package [1][2]. Affected versions include all versions before 5.9.0 [1][2]. The fixed version is 5.9.0 or later [1][2].
Citations:
🌐 Web query:
CVE-2026-33815 github.com/jackc/pgx/v5 fixed in which version affected range
💡 Result:
CVE-2026-33815 is a memory-safety vulnerability in the github.com/jackc/pgx/v5/pgproto3 package [1][2]. It was caused by improper validation of an array index in the Bind.Decode() function, which could allow an attacker to trigger unexpected memory access or a client-side panic by sending specially crafted input with a negative parameter length [2]. The affected range is all versions of github.com/jackc/pgx/v5 prior to v5.9.0 [3][4]. The vulnerability was fixed in version 5.9.0 [1][2].
Citations:
- 1: https://osv.dev/vulnerability/GO-2026-4771
- 2: https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMJACKCPGXV5PGPROTO3-15923580
- 3: GHSA-xgrm-4fwx-7qm8
- 4: https://pkg.go.dev/vuln/GO-2026-4771
🌐 Web query:
CVE-2026-33816 github.com/jackc/pgx/v5 fixed in which version affected range
💡 Result:
CVE-2026-33816 is a critical memory-safety vulnerability (specifically a use-after-free flaw) identified in the github.com/jackc/pgx/v5 Go library [1][2][3]. This vulnerability has been fixed in version 5.9.0 [1][4][3]. Any version of github.com/jackc/pgx/v5 released prior to 5.9.0 is affected [1][3]. Users are advised to upgrade to version 5.9.0 or later to mitigate the risk [2].
Citations:
- 1: https://nvd.nist.gov/vuln/detail/CVE-2026-33816
- 2: https://www.sentinelone.com/vulnerability-database/cve-2026-33816/
- 3: https://pkg.go.dev/vuln/GO-2026-4772
- 4: https://test.osv.dev/vulnerability/CVE-2026-33816
🌐 Web query:
GHSA-j88v-2chj-qfwx github.com/jackc/pgx/v5 fixed in which version affected range
💡 Result:
The vulnerability GHSA-j88v-2chj-qfwx, also tracked as CVE-2026-41889, is a SQL injection issue affecting the github.com/jackc/pgx/v5 Go package [1][2]. The affected range is all versions prior to 5.9.2 (< 5.9.2) [1][3]. The issue was fixed in version 5.9.2 [1][4]. The vulnerability can occur specifically when the non-default simple protocol (pgx.QueryExecModeSimpleProtocol) is used in conjunction with a dollar-quoted string literal that contains content which would be interpreted as a query placeholder outside of that string literal, and the value of that placeholder is controllable by an attacker [1][5].
Citations:
- 1: GHSA-j88v-2chj-qfwx
- 2: https://cve.circl.lu/cve/GHSA-j88v-2chj-qfwx
- 3: https://cve.circl.lu/cve/CVE-2026-41889
- 4: https://osv.dev/vulnerability/GHSA-j88v-2chj-qfwx
- 5: https://www.resolvedsecurity.com/vulnerability-catalog/GHSA-j88v-2chj-qfwx
CRITICAL: Upgrade transitive github.com/jackc/pgx/v5 from v5.6.0 to >= v5.9.2.
go.mod has github.com/jackc/pgx/v5 v5.6.0 // indirect (pulled by gorm.io/driver/postgres v1.6.0). v5.6.0 is affected by:
- Memory-safety issues: GHSA-9jj7-4m8r-rfcm / CVE-2026-33815 / CVE-2026-33816 — fixed in v5.9.0+
- SQL injection (placeholder confusion): GHSA-j88v-2chj-qfwx / CVE-2026-41889 — fixed in v5.9.2+
Update gorm.io/driver/postgres (or the dependency that pins pgx) so pgx/v5 resolves to v5.9.2 or later (v5.10.0 is available).
🧰 Tools
🪛 OSV Scanner (2.3.8)
[CRITICAL] 95-95: github.com/jackc/pgx/v5 5.6.0: CVE-2026-33815 in github.com/jackc/pgx
(GO-2026-4771)
[CRITICAL] 95-95: github.com/jackc/pgx/v5 5.6.0: CVE-2026-33816 in github.com/jackc/pgx
(GO-2026-4772)
[CRITICAL] 95-95: github.com/jackc/pgx/v5 5.6.0: Memory-safety vulnerability in github.com/jackc/pgx/v5.
[CRITICAL] 95-95: github.com/jackc/pgx/v5 5.6.0: pgx: SQL Injection via placeholder confusion with dollar quoted string literals
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 95, go.mod currently resolves github.com/jackc/pgx/v5 to
v5.6.0 via gorm.io/driver/postgres; update dependencies so pgx/v5 resolves to >=
v5.9.2 (prefer v5.10.0) by either bumping gorm.io/driver/postgres to a version
that pulls pgx v5.9.2+ or adding an explicit require for github.com/jackc/pgx/v5
v5.9.2 (or v5.10.0) in go.mod and then run go get github.com/jackc/pgx/v5@v5.9.2
(or `@v5.10.0`) and go mod tidy to ensure transitive resolution, verify with go
list -m all that github.com/jackc/pgx/v5 now resolves to v5.9.2+.
|
Looks like these dependencies are updatable in another way, so this is no longer needed. |
dependabot
Bot
deleted the
dependabot/go_modules/main/security-updates-dc7efa4fdc
branch
1 participant
Bumps the security-updates group with 22 updates:
1.5.01.6.01.11.01.12.01.9.21.10.01.22.01.23.29.19.09.20.03.5.213.6.123.5.213.6.123.5.213.6.120.63.00.69.00.37.00.37.11.43.01.44.01.36.01.44.01.16.01.17.01.38.01.44.01.38.01.44.01.36.01.44.01.43.01.44.01.43.01.44.01.27.01.28.00.42.00.45.01.30.01.31.10.34.10.36.1Updates
github.com/BurntSushi/tomlfrom 1.5.0 to 1.6.0Release notes
Sourced from github.com/BurntSushi/toml's releases.
Commits
5253492Enable TOML 1.1 by default (#457)e954445Reject duplicate arrays (#455)6b16cbdUpdate toml-test test cases from upstream (#456)011fa2bEnsure constant format strings in wf calls4b439bfRemove itemNila473c12Add test for out of range float64b535ff8Add some boring tests for lex.go6011ef0Remove unreachable condition in lexTableNameStartc8ca9e6Remove unreachable condition1121f81Make tomlv read from stdinUpdates
github.com/gin-gonic/ginfrom 1.11.0 to 1.12.0Release notes
Sourced from github.com/gin-gonic/gin's releases.
... (truncated)
Changelog
Sourced from github.com/gin-gonic/gin's changelog.
Commits
73726dcdocs: update documentation to reflect Go version changes (#4552)e292e5cdocs: document and finalize Gin v1.12.0 release (#4551)ae3f524ci: update Go version support to 1.25+ across CI and docs (#4550)38534e2chore(deps): bump golang.org/x/net from 0.50.0 to 0.51.0 (#4548)472d086fix(tree): panic in findCaseInsensitivePathRec with RedirectFixedPath (#4535)fb25834test(context): use http.StatusContinue constant instead of magic number 100 (...6f1d5fetest(render): add comprehensive error handling tests (#4541)5c00df8fix(render): write content length in Data.Render (#4206)db30908chore(logger): allow skipping query string output (#4547)ba093d1chore(binding): upgrade bson dependency to mongo-driver v2 (#4549)Updates
github.com/go-sql-driver/mysqlfrom 1.9.2 to 1.10.0Release notes
Sourced from github.com/go-sql-driver/mysql's releases.
... (truncated)
Changelog
Sourced from github.com/go-sql-driver/mysql's changelog.
Commits
a065b60release v1.10.0 (#1765)09e4187modernize (#1764)6c44a9aEnhance interpolateParams to correctly handle placeholders (#1732)688ce56Update supported Go version to 1.24–1.26 (#1763)118d07fBump filippo.io/edwards25519 from 1.1.1 to 1.2.0 (#1756)d6b2d3eConsolidate Dependabot update noise by grouping weekly dependency PRs (#1762)037dfd8Fix getSystemVar buffer reuse (#1754)900f330Bump actions/checkout from 4 to 6 (#1758)ab9e380fix staticcheck error (#1761)f298c66Bump actions/setup-go from 5 to 6 (#1757)Updates
github.com/prometheus/client_golangfrom 1.22.0 to 1.23.2Release notes
Sourced from github.com/prometheus/client_golang's releases.
... (truncated)
Changelog
Sourced from github.com/prometheus/client_golang's changelog.
Commits
8179a56Cut v1.23.2 (#1870)4142b59Merge pull request #1869 from prometheus/arve/upgrade-common4ff40f0Cut v1.23.1 (#1867)989b029Upgrade to prometheus/common v0.66 (#1866)e4b2208Cut v1.23.0 (#1848)d9492afcut v1.23.0-rc.1 (#1842)aeae8a0Cut v1.23.0-rc.0 (#1837)b157309Update common Prometheus files (#1832)a704e28build(deps): bump the github-actions group with 3 updates (#1826)c774311Fix errNotImplemented reference (#1835)Updates
github.com/redis/go-redis/v9from 9.19.0 to 9.20.0Release notes
Sourced from github.com/redis/go-redis/v9's releases.
... (truncated)
Changelog
Sourced from github.com/redis/go-redis/v9's changelog.
... (truncated)
Details
Description has been truncatedSummary by CodeRabbit