chore(deps): bump the go-deps group in /backend/libs/pkg with 4 updates

DE
5h ago
+37-34

Bumps the go-deps group in /backend/libs/pkg with 4 updates: github.com/jackc/pgx/v5, github.com/testcontainers/testcontainers-go, github.com/testcontainers/testcontainers-go/modules/nats and github.com/testcontainers/testcontainers-go/modules/postgres.

Updates github.com/jackc/pgx/v5 from 5.11.0 to 5.12.0

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.12.0 (October 30, 2026)

This release fixes two security vulnerabilities with narrow triggering conditions but serious impact. Affected applications should upgrade to v5.12.0; see Security Fixes below.

It also adds batched transaction startup, client certificate policy controls, and per-query batch timing, and improves connection pool cancellation and type handling. Custom implementations of BatchResults, including mocks, must add the new Tx method.

Security Fixes

  • SQL injection in simple-protocol batches (GHSA-j38q-h3ph-jjpq, high severity). In pgx v5 before v5.12.0, SendBatch using the non-default simple protocol could allow arbitrary SQL execution with the application's database privileges when a queued query ends in a -- comment without a newline and the next query has an attacker-controlled string argument on its first line. Batched queries are now separated by a newline to end such comments. Extended-protocol modes are unaffected. Reported by Igor Kupczyński (@​igor-kupczynski).
  • Bypass of require_auth and channel_binding=require (GHSA-95fj-3fxw-g62g, high severity). In pgx v5.9.0 through v5.11.0, applications relying on these settings without verifying the server's identity with sslmode=verify-full (or equivalent TLS verification) could accept an impersonating server that skips authentication. The attacker could read queries and parameters and return fabricated results. pgx now enforces authentication completion and required channel binding before accepting the connection. This vulnerability does not bypass TLS server certificate verification. Reported by @​president-xd.

Features

  • Add Batch.BeginTx and BatchResults.Tx to begin a transaction as the first query of a batch, saving the round trip for BeginTx. Call Batch.BeginTx before queuing any queries, consume the begin query's result first, and close the batch before using the transaction. With pgxpool.Pool.SendBatch, the connection remains acquired until the transaction is committed or rolled back. Add FailedBatchResults for wrappers that fail before sending a batch (Timo Furrer)
  • Add TraceBatchQueryData.ReadStartTime and per-query durations to tracelog batch query entries. These measure result consumption, including application time spent reading rows, rather than server execution alone (Yasser-Ameur)
  • pgconn: support the sslcertmode connection parameter, PGSSLCERTMODE environment variable, and Config.SSLCertMode. The default, allow, sends an available client certificate when requested; disable prevents sending one and skips loading certificate/key files; require fails unless the server requests and receives a certificate. require does not guarantee server-side certificate validation, disables TLS session resumption, and stops further host or TLS fallbacks when the certificate requirement fails (k-zshiba)
  • pgtype: add support for PostgreSQL 19's oid8 and oid8[] (k-zshiba)

Changes

  • pgxpool: background attempts to satisfy MinConns and MinIdleConns now have a 60-second timeout, including connection hooks. Initial background connections preserve the constructor context's values but ignore its cancellation and deadline.
  • pgxpool: canceling Acquire during a health-check ping now returns promptly and lets a successful ping return

... (truncated)

Commits
  • b2ef08b Update changelog for v5.12.0
  • 8199015 Merge commit from fork
  • 5b1a6a0 Merge commit from fork
  • 65a4125 Merge pull request #2697 from b84330808/windows-default-servicefile
  • f2701a0 pgconn: only fall back when Windows service file is missing
  • db95468 Merge pull request #2696 from k-zshiba/support-oid8
  • fa2327d Start each query on a new line when joining a simple protocol batch
  • 2283b85 pgconn: read the default service file from %APPDATA%\postgresql on Windows
  • efc0b74 Merge upstream master into support-oid8
  • 5a17450 pgconn: require AuthenticationOk before ReadyForQuery
  • Additional commits viewable in compare view

Updates github.com/testcontainers/testcontainers-go from 0.44.0 to 0.45.0

Release notes

Sourced from github.com/testcontainers/testcontainers-go's releases.

v0.45.0

What's Changed

⚠️ Breaking Changes

Client SDK dependencies have moved into separate examples modules. For CockroachDB, ConnectionConfig is now available through cockroachdbexamples.NewContainer(c) in modules/cockroachdb/examples. The parent’s ConnectionString and MustConnectionString now return PostgreSQL URLs instead of registered pgx handles, and importing the parent no longer registers the pgx SQL driver. Use the examples adapter to retain the previous SDK behavior, or configure the driver yourself.

For Dex, AddClient, RemoveClient, AddUser, and RemoveUser have moved from *dex.Container to dexexamples.NewAdminClient(c) in modules/dex/examples. Static configuration through WithClient and WithUser is unchanged.

For Cosmos DB, ContainerPolicy and NewContainerPolicy have moved from modules/azure/cosmosdb to modules/azure/examples/cosmosdb. Update the adapter import; its constructor still accepts the parent container. Run, Container, and ConnectionString remain unchanged in the parent module.

🔒 Security

🚀 Features

🐛 Bug Fixes

📖 Documentation

🧹 Housekeeping

... (truncated)

Commits
  • b4fe821 chore: use new version (v0.45.0) in modules and examples
  • d40be72 chore(deps): bump github.com/go-jose/go-jose/v4 in /modules/dex/examples (#4088)
  • 0d12cc6 chore(modules): finish test client isolation and document examples modules (#...
  • 9cc89fd chore(modules): isolate eight remaining compatible client SDKs (#4086)
  • 9ec5407 chore(modules)!: extract CockroachDB and Dex client adapters (#4087)
  • 5c9480f chore(modules): isolate client examples across eleven more modules (#4084)
  • 6aaef66 fix(ci): initialize sbx network policy before tests (#4085)
  • 55f58fe chore(modules): isolate client examples across eleven modules (#4083)
  • ea5a2e8 chore(deps): bump go.mongodb.org/mongo-driver (#4075)
  • 60b08c4 docs: show cumulative clones and unique cloners (#4082)
  • Additional commits viewable in compare view

Updates github.com/testcontainers/testcontainers-go/modules/nats from 0.44.0 to 0.45.0

Release notes

Sourced from github.com/testcontainers/testcontainers-go/modules/nats's releases.

v0.45.0

What's Changed

⚠️ Breaking Changes

Client SDK dependencies have moved into separate examples modules. For CockroachDB, ConnectionConfig is now available through cockroachdbexamples.NewContainer(c) in modules/cockroachdb/examples. The parent’s ConnectionString and MustConnectionString now return PostgreSQL URLs instead of registered pgx handles, and importing the parent no longer registers the pgx SQL driver. Use the examples adapter to retain the previous SDK behavior, or configure the driver yourself.

For Dex, AddClient, RemoveClient, AddUser, and RemoveUser have moved from *dex.Container to dexexamples.NewAdminClient(c) in modules/dex/examples. Static configuration through WithClient and WithUser is unchanged.

For Cosmos DB, ContainerPolicy and NewContainerPolicy have moved from modules/azure/cosmosdb to modules/azure/examples/cosmosdb. Update the adapter import; its constructor still accepts the parent container. Run, Container, and ConnectionString remain unchanged in the parent module.

🔒 Security

🚀 Features

🐛 Bug Fixes

📖 Documentation

🧹 Housekeeping

... (truncated)

Commits
  • b4fe821 chore: use new version (v0.45.0) in modules and examples
  • d40be72 chore(deps): bump github.com/go-jose/go-jose/v4 in /modules/dex/examples (#4088)
  • 0d12cc6 chore(modules): finish test client isolation and document examples modules (#...
  • 9cc89fd chore(modules): isolate eight remaining compatible client SDKs (#4086)
  • 9ec5407 chore(modules)!: extract CockroachDB and Dex client adapters (#4087)
  • 5c9480f chore(modules): isolate client examples across eleven more modules (#4084)
  • 6aaef66 fix(ci): initialize sbx network policy before tests (#4085)
  • 55f58fe chore(modules): isolate client examples across eleven modules (#4083)
  • ea5a2e8 chore(deps): bump go.mongodb.org/mongo-driver (#4075)
  • 60b08c4 docs: show cumulative clones and unique cloners (#4082)
  • Additional commits viewable in compare view

Updates github.com/testcontainers/testcontainers-go/modules/postgres from 0.44.0 to 0.45.0

Release notes

Sourced from github.com/testcontainers/testcontainers-go/modules/postgres's releases.

v0.45.0

What's Changed

⚠️ Breaking Changes

Client SDK dependencies have moved into separate examples modules. For CockroachDB, ConnectionConfig is now available through cockroachdbexamples.NewContainer(c) in modules/cockroachdb/examples. The parent’s ConnectionString and MustConnectionString now return PostgreSQL URLs instead of registered pgx handles, and importing the parent no longer registers the pgx SQL driver. Use the examples adapter to retain the previous SDK behavior, or configure the driver yourself.

For Dex, AddClient, RemoveClient, AddUser, and RemoveUser have moved from *dex.Container to dexexamples.NewAdminClient(c) in modules/dex/examples. Static configuration through WithClient and WithUser is unchanged.

For Cosmos DB, ContainerPolicy and NewContainerPolicy have moved from modules/azure/cosmosdb to modules/azure/examples/cosmosdb. Update the adapter import; its constructor still accepts the parent container. Run, Container, and ConnectionString remain unchanged in the parent module.

🔒 Security

🚀 Features

🐛 Bug Fixes

📖 Documentation

🧹 Housekeeping

... (truncated)

Commits
  • b4fe821 chore: use new version (v0.45.0) in modules and examples
  • d40be72 chore(deps): bump github.com/go-jose/go-jose/v4 in /modules/dex/examples (#4088)
  • 0d12cc6 chore(modules): finish test client isolation and document examples modules (#...
  • 9cc89fd chore(modules): isolate eight remaining compatible client SDKs (#4086)
  • 9ec5407 chore(modules)!: extract CockroachDB and Dex client adapters (#4087)
  • 5c9480f chore(modules): isolate client examples across eleven more modules (#4084)
  • 6aaef66 fix(ci): initialize sbx network policy before tests (#4085)
  • 55f58fe chore(modules): isolate client examples across eleven modules (#4083)
  • ea5a2e8 chore(deps): bump go.mongodb.org/mongo-driver (#4075)
  • 60b08c4 docs: show cumulative clones and unique cloners (#4082)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Summary by cubic

Bumps github.com/jackc/pgx/v5 to 5.12.0 and testcontainers-go (core, NATS, and Postgres modules) to 0.45.0 in backend/libs/pkg.

The pgx update fixes two high-severity vulnerabilities: SQL injection in simple-protocol batches and bypass of require_auth and channel_binding=require.

Migration

  • Custom BatchResults implementations, including mocks, must add the new Tx method.