Skip to content

fix(deps): vuln unstable upgrades — 10 packages (unstable: 2 · minor: 8) [sticker-award]#254

Closed
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit intomainfrom
engraver-auto-version-upgrade/unstable/go/sticker-award/0-1776935578
Closed

fix(deps): vuln unstable upgrades — 10 packages (unstable: 2 · minor: 8) [sticker-award]#254
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit intomainfrom
engraver-auto-version-upgrade/unstable/go/sticker-award/0-1776935578

Conversation

@gh-worker-campaigns-3e9aa4
Copy link
Copy Markdown

Summary: Critical-severity security update — 10 packages upgraded (UNSTABLE changes included)

Manifests changed:

  • sticker-award (go)

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.


Updates

Package From To Type Dep Type Vulnerabilities Fixed
github.com/jackc/pgx/v5 v5.7.5 v5.9.2 minor Transitive 4 CRITICAL, 1 LOW
github.com/testcontainers/testcontainers-go v0.38.0 v0.42.0 unstable Direct -
github.com/testcontainers/testcontainers-go/modules/postgres v0.38.0 v0.42.0 unstable Direct -
github.com/cenkalti/backoff/v4 v4.2.1 v4.3.0 minor Transitive -
github.com/lib/pq v1.10.9 v1.12.3 minor Transitive -
github.com/shirou/gopsutil/v4 v4.25.8-0.20250809033336-ffcdc2b7662f v4.26.3 minor Transitive -
go.opentelemetry.io/auto/sdk v1.1.0 v1.2.1 minor Transitive -
go.opentelemetry.io/otel v1.38.0 v1.43.0 minor Transitive -
go.opentelemetry.io/otel/metric v1.38.0 v1.43.0 minor Transitive -
go.opentelemetry.io/otel/trace v1.38.0 v1.43.0 minor Transitive -

Packages marked with "-" are updated due to dependency constraints.


Security Details

🚨 Critical & High Severity (4 fixed)
Package CVE Severity Summary Unsafe Version Fixed In
github.com/jackc/pgx/v5 GO-2026-4771 CRITICAL CVE-2026-33815 in github.com/jackc/pgx v5.7.5 5.9.0
github.com/jackc/pgx/v5 GHSA-xgrm-4fwx-7qm8 CRITICAL pgx contains memory-safety vulnerability v5.7.5 -
github.com/jackc/pgx/v5 GO-2026-4772 CRITICAL CVE-2026-33816 in github.com/jackc/pgx v5.7.5 5.9.0
github.com/jackc/pgx/v5 GHSA-9jj7-4m8r-rfcm CRITICAL Memory-safety vulnerability in github.com/jackc/pgx/v5. v5.7.5 5.9.0
ℹ️ Other Vulnerabilities (1)
Package CVE Severity Summary Unsafe Version Fixed In
github.com/jackc/pgx/v5 GHSA-j88v-2chj-qfwx LOW pgx: SQL Injection via placeholder confusion with dollar quoted string literals v5.7.5 5.9.2
⚠️ Dependencies that have Reached EOL (1)
Dependency Unsafe Version EOL Date New Version Path
github.com/cenkalti/backoff/v4 v4.2.1 Apr 17, 2026 v4.3.0 sticker-award/go.mod
📅 Dependencies Nearing EOL (1)
Dependency Unsafe Version EOL Date New Version Path
github.com/lib/pq v1.10.9 Apr 26, 2026 v1.12.3 sticker-award/go.mod

Review Checklist

Standard review:

  • Review changes for compatibility with your code
  • Check for breaking changes in release notes
  • Run tests locally or wait for CI
  • Approve and merge this PR

Update Mode: Vulnerability Remediation (Critical)

🤖 Generated by DataDog Automated Dependency Management System

@campaigner-prod
Copy link
Copy Markdown
Contributor

Release Notes

github.com/jackc/pgx/v5 (v5.7.5 → v5.9.2) — Changelog

Fix SQL Injection via placeholder confusion with dollar quoted string literals (GHSA-j88v-2chj-qfwx)

SQL injection can occur when:

  1. The non-default simple protocol is used.
  2. A dollar quoted string literal is used in the SQL query.
  3. That query contains text that would be would be interpreted outside as a placeholder outside of a string literal.
  4. The value of that placeholder is controllable by the attacker.

e.g.

attackValue := `$tag$; drop table canary; --`
_, err = tx.Exec(ctx, `select $tag$ $1 $tag$, $1`, pgx.QueryExecModeSimpleProtocol, attackValue)

This is unlikely to occur outside of a contrived scenario.

github.com/testcontainers/testcontainers-go (v0.38.0 → v0.42.0) — GitHub Release

v0.42.0

What's Changed

⚠️ Breaking Changes

🔒 Security

🐛 Bug Fixes

🧹 Housekeeping

📦 Dependency updates

(truncated)

v0.41.0

What's Changed

🚀 Features

🐛 Bug Fixes

📖 Documentation

🧹 Housekeeping

(truncated — see source for full notes)

github.com/testcontainers/testcontainers-go/modules/postgres (v0.38.0 → v0.42.0) — GitHub Release

v0.42.0

What's Changed

⚠️ Breaking Changes

🔒 Security

🐛 Bug Fixes

🧹 Housekeeping

📦 Dependency updates

(truncated)

v0.41.0

What's Changed

🚀 Features

🐛 Bug Fixes

📖 Documentation

🧹 Housekeeping

(truncated — see source for full notes)

github.com/lib/pq (v1.10.9 → v1.12.3) — GitHub Release

v1.12.3

v1.12.2

v1.12.1

v1.12.0

  • The next release may change the default sslmode from require to prefer. See [https://github.com/Change default sslmode from "require" to "prefer" lib/pq#1271] for details.

  • CopyIn() and CopyInToSchema() have been marked as deprecated. These are simple query builders and not needed for COPY [..] FROM STDIN support (which is not deprecated). ([https://github.com/Mark CopyIn() and CopyInSchema() as deprecated lib/pq#1279])

    // Old
    tx.Prepare(CopyIn("temp", "num", "text", "blob", "nothing"))
    
    // Replacement
    tx.Prepare(`copy temp (num, text, blob, nothing) from stdin`)
    

Features

Fixes

[https://github.com/lib/pq/issues/1267]:

(truncated)

v1.11.2

This fixes two regressions:

v1.11.1

This fixes two regressions present in the v1.11.0 release:

v1.11.0

This version of pq requires Go 1.21 or newer.

pq now supports only maintained PostgreSQL releases, which is PostgreSQL 14 and newer. Previously PostgreSQL 8.4 and newer were supported.

Features

(truncated — see source for full notes)

github.com/shirou/gopsutil/v4 (v4.25.8-0.20250809033336-ffcdc2b7662f → v4.26.3) — GitHub Release

v4.26.3

Important Notice

The temporary opt-out option WillBeDeletedOptOutMemAvailableCalc, introduced in v4.25.8, has been removed in this release.

Code that relied on this option may fail to build. If so, please update your code to work with the current VirtualMemoryStat.Used calculation, as the opt-out mechanism is no longer available.

What's Changed

cpu

disk

host

load

mem

(truncated)

v4.26.2

What's Changed

disk

host

process

Other Changes

New Contributors

Full Changelog: shirou/gopsutil@v4.26.1...v4.26.2

v4.26.1

What's Changed

disk

host

mem

process

sensor

New Contributors

Full Changelog: shirou/gopsutil@v4.25.12...v4.26.1

v4.25.12

What's Changed

cpu

disk

host

mem

process

(truncated — see source for full notes)

go.opentelemetry.io/auto/sdk (v1.1.0 → v1.2.1) — Changelog

Fixed

go.opentelemetry.io/otel (v1.38.0 → v1.43.0) — GitHub Release

v1.43.0

Added

Changed

  • Introduce the EMPTY Type in go.opentelemetry.io/otel/attribute to reflect that an empty value is now a valid value, with INVALID remaining as a deprecated

(truncated)

v1.42.0

Added

Changed

Fixed

Removed

What's Changed

(truncated)

v1.41.0

This release is the last to support Go 1.24. The next release will require at least Go 1.25.

Added

Fixed

What's Changed

(truncated — see source for full notes)

go.opentelemetry.io/otel/metric (v1.38.0 → v1.43.0) — GitHub Release

v1.43.0

Added

Changed

  • Introduce the EMPTY Type in go.opentelemetry.io/otel/attribute to reflect that an empty value is now a valid value, with INVALID remaining as a deprecated

(truncated)

v1.42.0

Added

Changed

Fixed

Removed

What's Changed

(truncated)

v1.41.0

This release is the last to support Go 1.24. The next release will require at least Go 1.25.

Added

Fixed

What's Changed

(truncated — see source for full notes)

go.opentelemetry.io/otel/trace (v1.38.0 → v1.43.0) — GitHub Release

v1.43.0

Added

Changed

  • Introduce the EMPTY Type in go.opentelemetry.io/otel/attribute to reflect that an empty value is now a valid value, with INVALID remaining as a deprecated

(truncated)

v1.42.0

Added

Changed

Fixed

Removed

What's Changed

(truncated)

v1.41.0

This release is the last to support Go 1.24. The next release will require at least Go 1.25.

Added

Fixed

What's Changed

(truncated — see source for full notes)


Generated by ADMS Sources: 7 GitHub Releases, 2 Changelogs, 1 not available.

@seberm-6
Copy link
Copy Markdown

Hey, sorry for the noise. This was caused by a bug in our automated dependency update system that incorrectly included upstream changelog content in PR comments, triggering notifications to external contributors. The feature flag has been turned off and we're working on a fix. Sorry about that again.

@campaigner-prod campaigner-prod Bot closed this Apr 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant