Why: govulncheck flagged two reachable vulnerabilities: GO-2026-5004 (SQL injection via placeholder confusion with dollar-quoted literals in pgx v5.7.6, reached through pgx.Conn.Exec sanitize path on Postgres deployments) and GO-2026-5970 (infinite loop on invalid input in golang.org/x/text v0.24.0, reached through pgx.Connect normalization). Follow-up to the 2026-09-30 dependency CVE inventory task.
Evidence: golang.org/x/text v0.24.0 => v0.39.0 and github.com/jackc/pgx/v5 v5.7.6 => v5.9.2 (both at or past the fixed versions); CGO_ENABLED=0 go build ./... and go test -count=1 ./... green; govulncheck ./... now reports 0 reachable vulnerabilities (was 2).
Impact: go.mod/go.sum dependency bumps only; no code change; the remaining 20 module-level advisories are not called by our code (informational).
Refs: Dev-side task fix/dep-vuln-bumps (gitlink pin follows after combined verification)
weichen
merged commit 41cebd3b65 into main2026-09-30 16:45:33 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
GO-2026-5004 (pgx SQL injection via placeholder confusion, reached via Exec sanitize path) and GO-2026-5970 (x/text infinite loop, reached via pgx.Connect) — bumps to v5.9.2 / v0.39.0; build+test green; govulncheck now 0 reachable. Dev gitlink pin follows.