Why: govulncheck flagged two reachable vulnerabilities: GO-2026-5004 (SQL injection via placeholder confusion with dollar-quoted literals in pgx v5.7.6, reached through pgx.Conn.Exec sanitize path on Postgres deployments) and GO-2026-5970 (infinite loop on invalid input in golang.org/x/text v0.24.0, reached through pgx.Connect normalization). Follow-up to the 2026-09-30 dependency CVE inventory task.
Evidence: golang.org/x/text v0.24.0 => v0.39.0 and github.com/jackc/pgx/v5 v5.7.6 => v5.9.2 (both at or past the fixed versions); CGO_ENABLED=0 go build ./... and go test -count=1 ./... green; govulncheck ./... now reports 0 reachable vulnerabilities (was 2).
Impact: go.mod/go.sum dependency bumps only; no code change; the remaining 20 module-level advisories are not called by our code (informational).
Refs: Dev-side task fix/dep-vuln-bumps (gitlink pin follows after combined verification)
weichen