chore(deps): bump the go-deps group in /backend/libs/pkg with 4 updates by dependabot[bot] · Pull Request #174 · stjosephsplacements/AetherCode

dependabot · 2026-11-09T00:36:17Z

Bumps the go-deps group in /backend/libs/pkg with 4 updates: github.com/jackc/pgx/v5, github.com/testcontainers/testcontainers-go, github.com/testcontainers/testcontainers-go/modules/nats and github.com/testcontainers/testcontainers-go/modules/postgres.

Updates github.com/jackc/pgx/v5 from 5.11.0 to 5.12.0

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.12.0 (October 30, 2026)

This release fixes two security vulnerabilities with narrow triggering conditions but serious impact. Affected applications should upgrade to v5.12.0; see Security Fixes below.

It also adds batched transaction startup, client certificate policy controls, and per-query batch timing, and improves connection pool cancellation and type handling. Custom implementations of BatchResults, including mocks, must add the new Tx method.

Security Fixes

SQL injection in simple-protocol batches (GHSA-j38q-h3ph-jjpq, high severity). In pgx v5 before v5.12.0, SendBatch using the non-default simple protocol could allow arbitrary SQL execution with the application's database privileges when a queued query ends in a -- comment without a newline and the next query has an attacker-controlled string argument on its first line. Batched queries are now separated by a newline to end such comments. Extended-protocol modes are unaffected. Reported by Igor Kupczyński (@igor-kupczynski).

Bypass of require_auth and channel_binding=require (GHSA-95fj-3fxw-g62g, high severity). In pgx v5.9.0 through v5.11.0, applications relying on these settings without verifying the server's identity with sslmode=verify-full (or equivalent TLS verification) could accept an impersonating server that skips authentication. The attacker could read queries and parameters and return fabricated results. pgx now enforces authentication completion and required channel binding before accepting the connection. This vulnerability does not bypass TLS server certificate verification. Reported by @president-xd.

Features

Add Batch.BeginTx and BatchResults.Tx to begin a transaction as the first query of a batch, saving the round trip for BeginTx. Call Batch.BeginTx before queuing any queries, consume the begin query's result first, and close the batch before using the transaction. With pgxpool.Pool.SendBatch, the connection remains acquired until the transaction is committed or rolled back. Add FailedBatchResults for wrappers that fail before sending a batch (Timo Furrer)

Add TraceBatchQueryData.ReadStartTime and per-query durations to tracelog batch query entries. These measure result consumption, including application time spent reading rows, rather than server execution alone (Yasser-Ameur)

pgconn: support the sslcertmode connection parameter, PGSSLCERTMODE environment variable, and Config.SSLCertMode. The default, allow, sends an available client certificate when requested; disable prevents sending one and skips loading certificate/key files; require fails unless the server requests and receives a certificate. require does not guarantee server-side certificate validation, disables TLS session resumption, and stops further host or TLS fallbacks when the certificate requirement fails (k-zshiba)

pgtype: add support for PostgreSQL 19's oid8 and oid8[] (k-zshiba)

Changes

pgxpool: background attempts to satisfy MinConns and MinIdleConns now have a 60-second timeout, including connection hooks. Initial background connections preserve the constructor context's values but ignore its cancellation and deadline.

pgxpool: canceling Acquire during a health-check ping now returns promptly and lets a successful ping return

... (truncated)

Commits

b2ef08b Update changelog for v5.12.0
8199015 Merge commit from fork
5b1a6a0 Merge commit from fork
65a4125 Merge pull request #2697 from b84330808/windows-default-servicefile
f2701a0 pgconn: only fall back when Windows service file is missing
db95468 Merge pull request #2696 from k-zshiba/support-oid8
fa2327d Start each query on a new line when joining a simple protocol batch
2283b85 pgconn: read the default service file from %APPDATA%\postgresql on Windows
efc0b74 Merge upstream master into support-oid8
5a17450 pgconn: require AuthenticationOk before ReadyForQuery
Additional commits viewable in compare view

Updates github.com/testcontainers/testcontainers-go from 0.44.0 to 0.45.0

Release notes

Sourced from github.com/testcontainers/testcontainers-go's releases.

v0.45.0

What's Changed

⚠️ Breaking Changes

chore(modules)!: extract CockroachDB and Dex client adapters (#4087) @mdelapenya

Client SDK dependencies have moved into separate examples modules. For CockroachDB, ConnectionConfig is now available through cockroachdbexamples.NewContainer(c) in modules/cockroachdb/examples. The parent’s ConnectionString and MustConnectionString now return PostgreSQL URLs instead of registered pgx handles, and importing the parent no longer registers the pgx SQL driver. Use the examples adapter to retain the previous SDK behavior, or configure the driver yourself.

For Dex, AddClient, RemoveClient, AddUser, and RemoveUser have moved from *dex.Container to dexexamples.NewAdminClient(c) in modules/dex/examples. Static configuration through WithClient and WithUser is unchanged.

chore(modules)!: isolate client examples across ten modules (#4081) @mdelapenya

For Cosmos DB, ContainerPolicy and NewContainerPolicy have moved from modules/azure/cosmosdb to modules/azure/examples/cosmosdb. Update the adapter import; its constructor still accepts the parent container. Run, Container, and ConnectionString remain unchanged in the parent module.

🔒 Security

security(deps): upgrade otel log sdk to v0.21.0 (#4047) @mdelapenya

🚀 Features

feat(sbx): configure sandbox startup with Go options (#4057) @mdelapenya

feat: add Docker Sandboxes runtime provider (#3987) @mdelapenya

feat(garage): add single-node S3-compatible storage module (#3950) @kanjih

feat: register runtime providers and introduce the Podman module (#3946) @mdelapenya

feat: add the ability to configure the provider type in the properties file or as an env var (#3494) @mkeeler

feat(kafka): add TLS support (#3917) @RuslanKarabalin

🐛 Bug Fixes

fix(wait): fail fast when logs are unavailable on a stopped container (#3898) @skartikey

fix(wait): retry HostPortStrategy external check on connect timeout (#4055) @pujitha24

fix: handle OCI registry manifests and isolate k3s platform test (#4059) @mdelapenya

fix: setup ExposeHostPorts forward on container start hook (#3200) @mdelapenya

fix(wait): support non-pointer strategies in ForAny/ForAll nil checks (#4052) @mdelapenya

fix(rabbitmq): pass the node config from memory instead of a shared temp file (#3881) @manduinca

fix: dial the sshd container on the Docker daemon host (#3877) @timofurrer

fix: validate the configured session ID (#3849) @mdelapenya

📖 Documentation

docs: show cumulative clones and unique cloners (#4082) @mdelapenya

chore(metrics): update github clones for 2026-10 (#4079) @github-actions[bot]

chore: update usage metrics (2026-11) (#4077) @github-actions[bot]

docs: fix dead links in module docs and comments (#4071) @sarankumar1325

chore(docs): move Python tooling out of the Go module (#3942) @mikey923

docs: update Podman guide for the provider module (#4038) @mdelapenya

🧹 Housekeeping

... (truncated)

Commits

b4fe821 chore: use new version (v0.45.0) in modules and examples
d40be72 chore(deps): bump github.com/go-jose/go-jose/v4 in /modules/dex/examples (#4088)
0d12cc6 chore(modules): finish test client isolation and document examples modules (#...
9cc89fd chore(modules): isolate eight remaining compatible client SDKs (#4086)
9ec5407 chore(modules)!: extract CockroachDB and Dex client adapters (#4087)
5c9480f chore(modules): isolate client examples across eleven more modules (#4084)
6aaef66 fix(ci): initialize sbx network policy before tests (#4085)
55f58fe chore(modules): isolate client examples across eleven modules (#4083)
ea5a2e8 chore(deps): bump go.mongodb.org/mongo-driver (#4075)
60b08c4 docs: show cumulative clones and unique cloners (#4082)
Additional commits viewable in compare view

Updates github.com/testcontainers/testcontainers-go/modules/nats from 0.44.0 to 0.45.0

Release notes

Sourced from github.com/testcontainers/testcontainers-go/modules/nats's releases.

v0.45.0

What's Changed

⚠️ Breaking Changes

chore(modules)!: extract CockroachDB and Dex client adapters (#4087) @mdelapenya

Client SDK dependencies have moved into separate examples modules. For CockroachDB, ConnectionConfig is now available through cockroachdbexamples.NewContainer(c) in modules/cockroachdb/examples. The parent’s ConnectionString and MustConnectionString now return PostgreSQL URLs instead of registered pgx handles, and importing the parent no longer registers the pgx SQL driver. Use the examples adapter to retain the previous SDK behavior, or configure the driver yourself.

For Dex, AddClient, RemoveClient, AddUser, and RemoveUser have moved from *dex.Container to dexexamples.NewAdminClient(c) in modules/dex/examples. Static configuration through WithClient and WithUser is unchanged.

chore(modules)!: isolate client examples across ten modules (#4081) @mdelapenya

For Cosmos DB, ContainerPolicy and NewContainerPolicy have moved from modules/azure/cosmosdb to modules/azure/examples/cosmosdb. Update the adapter import; its constructor still accepts the parent container. Run, Container, and ConnectionString remain unchanged in the parent module.

🔒 Security

security(deps): upgrade otel log sdk to v0.21.0 (#4047) @mdelapenya

🚀 Features

feat(sbx): configure sandbox startup with Go options (#4057) @mdelapenya

feat: add Docker Sandboxes runtime provider (#3987) @mdelapenya

feat(garage): add single-node S3-compatible storage module (#3950) @kanjih

feat: register runtime providers and introduce the Podman module (#3946) @mdelapenya

feat: add the ability to configure the provider type in the properties file or as an env var (#3494) @mkeeler

feat(kafka): add TLS support (#3917) @RuslanKarabalin

🐛 Bug Fixes

fix(wait): fail fast when logs are unavailable on a stopped container (#3898) @skartikey

fix(wait): retry HostPortStrategy external check on connect timeout (#4055) @pujitha24

fix: handle OCI registry manifests and isolate k3s platform test (#4059) @mdelapenya

fix: setup ExposeHostPorts forward on container start hook (#3200) @mdelapenya

fix(wait): support non-pointer strategies in ForAny/ForAll nil checks (#4052) @mdelapenya

fix(rabbitmq): pass the node config from memory instead of a shared temp file (#3881) @manduinca

fix: dial the sshd container on the Docker daemon host (#3877) @timofurrer

fix: validate the configured session ID (#3849) @mdelapenya

📖 Documentation

docs: show cumulative clones and unique cloners (#4082) @mdelapenya

chore(metrics): update github clones for 2026-10 (#4079) @github-actions[bot]

chore: update usage metrics (2026-11) (#4077) @github-actions[bot]

docs: fix dead links in module docs and comments (#4071) @sarankumar1325

chore(docs): move Python tooling out of the Go module (#3942) @mikey923

docs: update Podman guide for the provider module (#4038) @mdelapenya

🧹 Housekeeping

... (truncated)

Commits

b4fe821 chore: use new version (v0.45.0) in modules and examples
d40be72 chore(deps): bump github.com/go-jose/go-jose/v4 in /modules/dex/examples (#4088)
0d12cc6 chore(modules): finish test client isolation and document examples modules (#...
9cc89fd chore(modules): isolate eight remaining compatible client SDKs (#4086)
9ec5407 chore(modules)!: extract CockroachDB and Dex client adapters (#4087)
5c9480f chore(modules): isolate client examples across eleven more modules (#4084)
6aaef66 fix(ci): initialize sbx network policy before tests (#4085)
55f58fe chore(modules): isolate client examples across eleven modules (#4083)
ea5a2e8 chore(deps): bump go.mongodb.org/mongo-driver (#4075)
60b08c4 docs: show cumulative clones and unique cloners (#4082)
Additional commits viewable in compare view

Updates github.com/testcontainers/testcontainers-go/modules/postgres from 0.44.0 to 0.45.0

Release notes

Sourced from github.com/testcontainers/testcontainers-go/modules/postgres's releases.

v0.45.0

What's Changed

⚠️ Breaking Changes

chore(modules)!: extract CockroachDB and Dex client adapters (#4087) @mdelapenya

Client SDK dependencies have moved into separate examples modules. For CockroachDB, ConnectionConfig is now available through cockroachdbexamples.NewContainer(c) in modules/cockroachdb/examples. The parent’s ConnectionString and MustConnectionString now return PostgreSQL URLs instead of registered pgx handles, and importing the parent no longer registers the pgx SQL driver. Use the examples adapter to retain the previous SDK behavior, or configure the driver yourself.

For Dex, AddClient, RemoveClient, AddUser, and RemoveUser have moved from *dex.Container to dexexamples.NewAdminClient(c) in modules/dex/examples. Static configuration through WithClient and WithUser is unchanged.

chore(modules)!: isolate client examples across ten modules (#4081) @mdelapenya

For Cosmos DB, ContainerPolicy and NewContainerPolicy have moved from modules/azure/cosmosdb to modules/azure/examples/cosmosdb. Update the adapter import; its constructor still accepts the parent container. Run, Container, and ConnectionString remain unchanged in the parent module.

🔒 Security

security(deps): upgrade otel log sdk to v0.21.0 (#4047) @mdelapenya

🚀 Features

feat(sbx): configure sandbox startup with Go options (#4057) @mdelapenya

feat: add Docker Sandboxes runtime provider (#3987) @mdelapenya

feat(garage): add single-node S3-compatible storage module (#3950) @kanjih

feat: register runtime providers and introduce the Podman module (#3946) @mdelapenya

feat: add the ability to configure the provider type in the properties file or as an env var (#3494) @mkeeler

feat(kafka): add TLS support (#3917) @RuslanKarabalin

🐛 Bug Fixes

fix(wait): fail fast when logs are unavailable on a stopped container (#3898) @skartikey

fix(wait): retry HostPortStrategy external check on connect timeout (#4055) @pujitha24

fix: handle OCI registry manifests and isolate k3s platform test (#4059) @mdelapenya

fix: setup ExposeHostPorts forward on container start hook (#3200) @mdelapenya

fix(wait): support non-pointer strategies in ForAny/ForAll nil checks (#4052) @mdelapenya

fix(rabbitmq): pass the node config from memory instead of a shared temp file (#3881) @manduinca

fix: dial the sshd container on the Docker daemon host (#3877) @timofurrer

fix: validate the configured session ID (#3849) @mdelapenya

📖 Documentation

docs: show cumulative clones and unique cloners (#4082) @mdelapenya

chore(metrics): update github clones for 2026-10 (#4079) @github-actions[bot]

chore: update usage metrics (2026-11) (#4077) @github-actions[bot]

docs: fix dead links in module docs and comments (#4071) @sarankumar1325

chore(docs): move Python tooling out of the Go module (#3942) @mikey923

docs: update Podman guide for the provider module (#4038) @mdelapenya

🧹 Housekeeping

... (truncated)

Commits

b4fe821 chore: use new version (v0.45.0) in modules and examples
d40be72 chore(deps): bump github.com/go-jose/go-jose/v4 in /modules/dex/examples (#4088)
0d12cc6 chore(modules): finish test client isolation and document examples modules (#...
9cc89fd chore(modules): isolate eight remaining compatible client SDKs (#4086)
9ec5407 chore(modules)!: extract CockroachDB and Dex client adapters (#4087)
5c9480f chore(modules): isolate client examples across eleven more modules (#4084)
6aaef66 fix(ci): initialize sbx network policy before tests (#4085)
55f58fe chore(modules): isolate client examples across eleven modules (#4083)
ea5a2e8 chore(deps): bump go.mongodb.org/mongo-driver (#4075)
60b08c4 docs: show cumulative clones and unique cloners (#4082)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Summary by cubic

Bumps github.com/jackc/pgx/v5 to 5.12.0 and testcontainers-go (core, NATS, and Postgres modules) to 0.45.0 in backend/libs/pkg.

The pgx update fixes two high-severity vulnerabilities: SQL injection in simple-protocol batches and bypass of require_auth and channel_binding=require.

Migration

Custom BatchResults implementations, including mocks, must add the new Tx method.

^{Written for commit 5c25dcc. Summary will update on new commits.}

Bumps the go-deps group in /backend/libs/pkg with 4 updates: [github.com/jackc/pgx/v5](https://github.com/jackc/pgx), [github.com/testcontainers/testcontainers-go](https://github.com/testcontainers/testcontainers-go), [github.com/testcontainers/testcontainers-go/modules/nats](https://github.com/testcontainers/testcontainers-go) and [github.com/testcontainers/testcontainers-go/modules/postgres](https://github.com/testcontainers/testcontainers-go). Updates `github.com/jackc/pgx/v5` from 5.11.0 to 5.12.0 - [Release notes](https://github.com/jackc/pgx/releases) - [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md) - [Commits](jackc/pgx@v5.11.0...v5.12.0) Updates `github.com/testcontainers/testcontainers-go` from 0.44.0 to 0.45.0 - [Release notes](https://github.com/testcontainers/testcontainers-go/releases) - [Commits](testcontainers/testcontainers-go@v0.44.0...v0.45.0) Updates `github.com/testcontainers/testcontainers-go/modules/nats` from 0.44.0 to 0.45.0 - [Release notes](https://github.com/testcontainers/testcontainers-go/releases) - [Commits](testcontainers/testcontainers-go@v0.44.0...v0.45.0) Updates `github.com/testcontainers/testcontainers-go/modules/postgres` from 0.44.0 to 0.45.0 - [Release notes](https://github.com/testcontainers/testcontainers-go/releases) - [Commits](testcontainers/testcontainers-go@v0.44.0...v0.45.0) --- updated-dependencies: - dependency-name: github.com/jackc/pgx/v5 dependency-version: 5.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/testcontainers/testcontainers-go dependency-version: 0.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/testcontainers/testcontainers-go/modules/nats dependency-version: 0.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/testcontainers/testcontainers-go/modules/postgres dependency-version: 0.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added the dependencies Pull requests that update a dependency file label Nov 9, 2026

github-actions Bot enabled auto-merge (squash) November 9, 2026 00:36

github-actions Bot added the size/s label Nov 9, 2026

Navigation Menu

Repository navigation

chore(deps): bump the go-deps group in /backend/libs/pkg with 4 updates - #174

chore(deps): bump the go-deps group in /backend/libs/pkg with 4 updates#174
dependabot[bot] wants to merge 1 commit into
developmentfrom
dependabot/go_modules/backend/libs/pkg/development/go-deps-148bdbad6d

dependabot Bot commented on behalf of github Nov 9, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 9, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

5.12.0 (October 30, 2026)

Security Fixes

Features

Changes

v0.45.0

What's Changed

⚠️ Breaking Changes

🔒 Security

🚀 Features

🐛 Bug Fixes

📖 Documentation

🧹 Housekeeping

v0.45.0

What's Changed

⚠️ Breaking Changes

🔒 Security

🚀 Features

🐛 Bug Fixes

📖 Documentation

🧹 Housekeeping

v0.45.0

What's Changed

⚠️ Breaking Changes

🔒 Security

🚀 Features

🐛 Bug Fixes

📖 Documentation

🧹 Housekeeping

Summary by cubic

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Nov 9, 2026 •

edited by cubic-dev-ai Bot

Loading