Skip to content

Fix/bump pgx CVE 2026 33815 33816 #605

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
RlakkamGitHub wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Fix/bump pgx CVE 2026 33815 33816 #605

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c97f079
Bump github.com/jackc/pgx/v5 to v5.9.2
rlakkam-gzn Sep 16, 2026
01df811
Fix CRLF/LF comparison mismatch in test fixtures (bonus, unrelated to…
rlakkam-gzn Sep 17, 2026
4b42478
Bump remaining Go 1.24 references to 1.25 across CI/build/docs
rlakkam-gzn Sep 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/ci-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ jobs:
- name: Set up Go
uses: actions/setup-go@v6
with:
go-version: "1.24"
go-version: "1.25"

- name: Run tests
run: go test -v ./...
2 changes: 1 addition & 1 deletion .github/workflows/docker-latest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ jobs:
- name: Set up Go
uses: actions/setup-go@v6
with:
go-version: "1.24"
go-version: "1.25"

- name: Run integration tests
run: go test -v ./...
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ jobs:
- name: Set up Go
uses: actions/setup-go@v6
with:
go-version: "1.24"
go-version: "1.25"

- name: Run tests (PostgreSQL ${{ matrix.pg-version }})
env:
Expand All @@ -53,7 +53,7 @@ jobs:
- name: Set up Go
uses: actions/setup-go@v6
with:
go-version: "1.24"
go-version: "1.25"

- name: Read version
id: version
Expand Down
2 changes: 1 addition & 1 deletion CLAUDE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
- **Plan**: Compare desired state with current database and generate migration plan
- **Apply**: Execute the migration with safety features like concurrent change detection, transaction-adaptive execution, and lock timeout control

The tool is written in Go 1.24.0 (toolchain go1.24.7) and uses:
The tool is written in Go 1.25.0 and uses:

- Cobra for CLI commands
- embedded-postgres v1.33.0 for plan command (temporary instances) and testing (no Docker required)
Expand Down
4 changes: 4 additions & 0 deletions cmd/dump/dump_integration_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -660,6 +660,10 @@ var tzOffsetRe = regexp.MustCompile(`(\d{2}:\d{2}:\d{2})[-+]\d{2}(:\d{2})?`)
// normalizeSchemaOutput removes version-specific lines and normalizes
// timezone offsets in partition bounds for cross-platform comparison.
func normalizeSchemaOutput(output string) string {
// Normalize CRLF to LF so checked-in fixtures that git converted to CRLF
// on checkout (e.g. Windows with core.autocrlf=true) compare equal to
// LF-only runtime output.
output = strings.ReplaceAll(output, "\r\n", "\n")
lines := strings.Split(output, "\n")
var normalizedLines []string

Expand Down
12 changes: 9 additions & 3 deletions cmd/include_integration_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -293,9 +293,15 @@ func compareFileContents(t *testing.T, sourceFilePath, dumpFilePath, displayName
return
}

if string(sourceContent) != string(dumpContent) {
// Normalize CRLF to LF so checked-in source fixtures that git converted to
// CRLF on checkout (e.g. Windows with core.autocrlf=true) compare equal to
// LF-only runtime dump output.
normalizedSource := strings.ReplaceAll(string(sourceContent), "\r\n", "\n")
normalizedDump := strings.ReplaceAll(string(dumpContent), "\r\n", "\n")

if normalizedSource != normalizedDump {
t.Errorf("Content mismatch for %s", displayName)
t.Logf("\n\nExpected:\n%s\n\n", string(sourceContent))
t.Logf("\n\nActual:\n%s\n\n", string(dumpContent))
t.Logf("\n\nExpected:\n%s\n\n", normalizedSource)
t.Logf("\n\nActual:\n%s\n\n", normalizedDump)
}
}
4 changes: 2 additions & 2 deletions docs/installation.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -231,7 +231,7 @@ docker run --rm --network host \

## Go Install

If you have Go 1.24.0 or later installed, you can install pgschema directly:
If you have Go 1.25.0 or later installed, you can install pgschema directly:

```bash
go install github.com/pgplex/pgschema@latest
Expand Down Expand Up @@ -262,4 +262,4 @@ go build -v -o pgschema .
sudo mv pgschema /usr/local/bin/
```

<Note>Building from source requires Go 1.24.0 or later.</Note>
<Note>Building from source requires Go 1.25.0 or later.</Note>
12 changes: 6 additions & 6 deletions docs/workflow/gitops.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -125,7 +125,7 @@ The typical workflow follows a review-then-apply pattern that ensures all schema

- uses: actions/setup-go@v5
with:
go-version: '1.24'
go-version: '1.25'

- name: Install pgschema
run: go install github.com/pgplex/pgschema@latest
Expand Down Expand Up @@ -212,7 +212,7 @@ The typical workflow follows a review-then-apply pattern that ensures all schema

- uses: actions/setup-go@v5
with:
go-version: '1.24'
go-version: '1.25'

- name: Install pgschema
run: go install github.com/pgplex/pgschema@latest
Expand Down Expand Up @@ -290,7 +290,7 @@ variables:
# Plan job - runs on merge requests and main branch
pgschema-plan:
stage: plan
image: golang:1.24
image: golang:1.25
script:
- go install github.com/pgplex/pgschema@latest
- |
Expand Down Expand Up @@ -331,7 +331,7 @@ pgschema-plan:
# Apply job - manual trigger on main branch
pgschema-apply:
stage: apply
image: golang:1.24
image: golang:1.25
needs: ["pgschema-plan"]
dependencies:
- pgschema-plan
Expand Down Expand Up @@ -399,7 +399,7 @@ stages:
steps:
- task: GoTool@0
inputs:
version: '1.24'
version: '1.25'

- script: |
go install github.com/pgplex/pgschema@latest
Expand Down Expand Up @@ -449,7 +449,7 @@ stages:
steps:
- task: GoTool@0
inputs:
version: '1.24'
version: '1.25'

- script: |
go install github.com/pgplex/pgschema@latest
Expand Down
11 changes: 4 additions & 7 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,18 +1,16 @@
module github.com/pgplex/pgschema

go 1.24.0

toolchain go1.24.7
go 1.25.0

@greptile-apps greptile-apps Bot Sep 17, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Build Versions Remain Misaligned

The module now requires Go 1.25, but CI, release workflows, and the Docker builder still select Go 1.24. If automatic toolchain downloads are unavailable or disabled, these builds will fail; otherwise, the configured versions no longer describe the compiler actually used. Please align .github/workflows/ci-test.yml, .github/workflows/release.yml, .github/workflows/docker-latest.yml, and the Docker builder image with Go 1.25.


require (
github.com/BurntSushi/toml v1.5.0
github.com/fergusstrange/embedded-postgres v1.33.0
github.com/google/go-cmp v0.7.0
github.com/jackc/pgx/v5 v5.7.5
github.com/jackc/pgx/v5 v5.9.2
github.com/joho/godotenv v1.5.1
github.com/lib/pq v1.10.9
github.com/spf13/cobra v1.9.1
github.com/stretchr/testify v1.10.0
github.com/stretchr/testify v1.11.1
golang.org/x/sync v0.17.0
)

Expand All @@ -26,7 +24,6 @@ require (
github.com/rogpeppe/go-internal v1.14.1 // indirect
github.com/spf13/pflag v1.0.6 // indirect
github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
golang.org/x/crypto v0.37.0 // indirect
golang.org/x/text v0.24.0 // indirect
golang.org/x/text v0.29.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
)
14 changes: 6 additions & 8 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,8 @@ github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsI
github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
github.com/jackc/pgx/v5 v5.7.5 h1:JHGfMnQY+IEtGM63d+NGMjoRpysB2JBwDr5fsngwmJs=
github.com/jackc/pgx/v5 v5.7.5/go.mod h1:aruU7o91Tc2q2cFp5h4uP3f6ztExVpyVv88Xl/8Vl8M=
github.com/jackc/pgx/v5 v5.9.2 h1:3ZhOzMWnR4yJ+RW1XImIPsD1aNSz4T4fyP7zlQb56hw=
github.com/jackc/pgx/v5 v5.9.2/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
Expand All @@ -38,18 +38,16 @@ github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 h1:nIPpBwaJSVYIxUFsDv3M8ofmx9yWTog9BfvIu0q41lo=
github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8/go.mod h1:HUYIGzjTL3rfEspMxjDjgmT5uz5wzYJKVo23qUhYTos=
go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE=
golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc=
golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0=
golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU=
golang.org/x/text v0.29.0 h1:1neNs90w9YzJ9BocxfsQNHKuAT4pkghyXc4nhZ6sJvk=
golang.org/x/text v0.29.0/go.mod h1:7MhJOA9CD2qZyOKYazxdYMF85OwPdEr9jTtBpO7ydH4=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
Expand Down
6 changes: 4 additions & 2 deletions internal/diff/diff_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -232,8 +232,10 @@ func normalizeSQL(sql string) string {
var normalizedLines []string

for _, line := range lines {
// Preserve leading whitespace (indentation) but trim trailing whitespace
trimmed := strings.TrimRight(line, " \t")
// Preserve leading whitespace (indentation) but trim trailing whitespace.
// Includes \r so CRLF fixtures (e.g. checked out on Windows with
// core.autocrlf=true) compare equal to LF-only runtime output.
trimmed := strings.TrimRight(line, " \t\r")
if trimmed != "" {
normalizedLines = append(normalizedLines, trimmed)
}
Expand Down
2 changes: 1 addition & 1 deletion ir/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -150,7 +150,7 @@ go test -short -v ./...

## Compatibility

- **Go**: 1.24.0+
- **Go**: 1.25.0+
- **PostgreSQL**: 14, 15, 16, 17, 18

## License
Expand Down
4 changes: 2 additions & 2 deletions nix/pgschema.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,8 +10,8 @@ pkgs.buildGoModule {
inherit version;

src = lib.cleanSource ../.;
# Prefer Go 1.24 when available; fall back to the closest newer toolchain.
go = if pkgs ? go_1_24 then pkgs.go_1_24 else pkgs.go_1_25;
# Prefer Go 1.25 when available; fall back to the closest newer toolchain.
go = if pkgs ? go_1_25 then pkgs.go_1_25 else pkgs.go_1_26;
subPackages = [ "." ];
proxyVendor = true;
# buildGoModule runs `go test ./...` by default; disable checks because
Expand Down