build: bump pgx to v5.9.2

[ziggie1984]

This updates github.com/jackc/pgx/v5 from v5.7.4 to v5.9.2 across the modules that import or require pgx:

• sqldb
• sqldb/v2
• kvdb
• root lnd module

The change addresses govulncheck package findings GO-2026-4771 and GO-2026-4772, both fixed in pgx v5.9.0. The requested remediation version is v5.9.2.

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request performs a necessary security update for the pgx library across the repository's modules. By bumping the version to v5.9.2, the project remediates specific vulnerability findings identified by govulncheck. The changes include updates to go.mod and go.sum files to ensure consistent dependency management and security compliance.

Highlights

• Dependency Update: Updated github.com/jackc/pgx/v5 from v5.7.4 to v5.9.2 across all relevant modules to address security vulnerabilities.
• Security Remediation: Resolved govulncheck findings GO-2026-4771 and GO-2026-4772 by upgrading to the recommended pgx version.
• Dependency Maintenance: Updated various golang.org/x/ dependencies and bumped github.com/stretchr/testify to v1.11.1 in affected modules.

New Features

🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request updates the github.com/jackc/pgx/v5 dependency from v5.7.4 to v5.9.2 across the root, kvdb, sqldb, and sqldb/v2 modules. It also upgrades github.com/stretchr/testify to v1.11.1 in the sqldb modules, alongside several indirect Go sub-repository dependencies. No review comments were provided, and there is no further feedback on these dependency updates.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[github-actions]

🟠 PR Severity: HIGH

Dependency update (go.mod/go.sum) | 8 files | 59 lines changed

🟠 High (6 files)

• kvdb/go.mod - dependency update in kvdb/* package (HIGH: kvdb/*)
• kvdb/go.sum - dependency lock file in kvdb/* package
• sqldb/go.mod - dependency update in sqldb/* package (HIGH: sqldb/*)
• sqldb/go.sum - dependency lock file in sqldb/* package
• sqldb/v2/go.mod - dependency update in sqldb/* package (HIGH: sqldb/*)
• sqldb/v2/go.sum - dependency lock file in sqldb/* package

🟡 Medium (2 files)

• go.mod - root module dependency update
• go.sum - root module lock file

Analysis

This PR updates Go module dependencies across multiple sub-modules (kvdb, sqldb, sqldb/v2) and the root module. The presence of kvdb/go.mod and sqldb/go.mod changes places this in the HIGH severity tier, as both kvdb/* and sqldb/* are high-sensitivity packages dealing with database and key-value store infrastructure.

The changes are purely dependency version bumps (go.mod/go.sum), with no source code modifications. However, dependency updates to these packages warrant careful review to ensure no breaking changes or security issues are introduced via updated transitive dependencies.

No severity bump was applied: the PR touches 8 files (well below the 20-file threshold) with 59 total lines changed (well below the 500-line threshold).

---

_{To override, add a severity-override-{critical,high,medium,low} label.}
<!-- pr-severity-bot -->

[github-actions]

⚠️ Severity changed: HIGH → MEDIUM (override label severity-override-medium applied)

🟡 PR Severity: MEDIUM (override)

Override label applied | 8 files | 96 lines changed

🟠 High (4 files — overridden)

• sqldb/go.mod - dependency update in sqldb/* package (HIGH tier)
• sqldb/go.sum - dependency lockfile in sqldb/* package (HIGH tier)
• sqldb/v2/go.mod - dependency update in sqldb/v2/* package (HIGH tier)
• sqldb/v2/go.sum - dependency lockfile in sqldb/v2/* package (HIGH tier)

🟡 Medium (4 files)

• go.mod - root dependency update
• go.sum - root dependency lockfile
• kvdb/go.mod - dependency update in kvdb/* package (MEDIUM tier)
• kvdb/go.sum - dependency lockfile in kvdb/* package (MEDIUM tier)

Analysis

All 8 changed files are Go module dependency files (go.mod/go.sum). This is a pure dependency bump PR with no logic changes. The natural classification would be HIGH because sqldb/* files appear in the HIGH tier, but the severity-override-medium label has been applied, overriding the classification to MEDIUM.

The override is reasonable here: despite the sqldb/* path prefix, these are only module dependency manifests — no Go source code, migrations, or schema changes are included. A MEDIUM-level review is appropriate for dependency bumps of this nature.

---

_{To override, add a severity-override-{critical,high,medium,low} label.}
<!-- pr-severity-bot -->