Skip to content

chore(deps): bump github.com/jackc/pgx/v5 from 5.5.5 to 5.9.0#16283

Merged
renovate[bot] merged 1 commit into
release-2.7from
renovate/release-2.7-go-github.com-jackc-pgx-v5-vulnerability
Apr 20, 2026
Merged

chore(deps): bump github.com/jackc/pgx/v5 from 5.5.5 to 5.9.0#16283
renovate[bot] merged 1 commit into
release-2.7from
renovate/release-2.7-go-github.com-jackc-pgx-v5-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Apr 16, 2026

This PR contains the following updates:

Package Type Change Age Adoption
github.com/jackc/pgx/v5 require v5.5.5v5.9.0 age adoption

Memory-safety vulnerability in github.com/jackc/pgx/v5.

CVE-2026-33816 / GHSA-9jj7-4m8r-rfcm / GO-2026-4772

More information

Details

Memory-safety vulnerability in github.com/jackc/pgx/v5.

Severity

  • CVSS Score: 9.8 / 10 (Critical)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).


CVE-2026-33815 in github.com/jackc/pgx

CVE-2026-33815 / GHSA-xgrm-4fwx-7qm8 / GO-2026-4771

More information

Details

Memory-safety vulnerability in github.com/jackc/pgx/v5.

Severity

Unknown

References

No references.

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).


CVE-2026-33816 in github.com/jackc/pgx

CVE-2026-33816 / GHSA-9jj7-4m8r-rfcm / GO-2026-4772

More information

Details

Memory-safety vulnerability in github.com/jackc/pgx/v5.

Severity

Unknown

References

No references.

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).


Release Notes

jackc/pgx (github.com/jackc/pgx/v5)

v5.9.0

Compare Source

v5.8.0

Compare Source

v5.7.6

Compare Source

v5.7.5

Compare Source

v5.7.4

Compare Source

v5.7.3

Compare Source

v5.7.2

Compare Source

v5.7.1

Compare Source

v5.7.0

Compare Source

v5.6.0

Compare Source


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate renovate Bot added the area/security Related to security issues, fixes, or improvements label Apr 16, 2026
@renovate renovate Bot requested a review from a team as a code owner April 16, 2026 14:07
@renovate renovate Bot added dependencies Pull requests that update a dependency file release-2.7 labels Apr 16, 2026
@renovate renovate Bot requested review from Automaat and bartsmykla April 16, 2026 14:07
@renovate renovate Bot enabled auto-merge (squash) April 16, 2026 14:07
@renovate
Copy link
Copy Markdown
Contributor Author

renovate Bot commented Apr 16, 2026

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 2 additional dependencies were updated

Details:

Package Change
github.com/jackc/pgservicefile v0.0.0-20231201235250-de7065d80cb9 -> v0.0.0-20240606120523-5a60cdf6a761
github.com/jackc/puddle/v2 v2.2.1 -> v2.2.2

@renovate renovate Bot merged commit 33191e1 into release-2.7 Apr 20, 2026
18 checks passed
@renovate renovate Bot deleted the renovate/release-2.7-go-github.com-jackc-pgx-v5-vulnerability branch April 20, 2026 07:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/security Related to security issues, fixes, or improvements dependencies Pull requests that update a dependency file release-2.7

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant