Fix/bump pgx CVE 2026 33815 33816

[RlakkamGitHub]

Problem

pgx v5.7.5 (currently required in go.mod) has two Critical-severity (CVSS 9.8) memory-safety vulnerabilities in its binary protocol decoders — missing bounds validation on server-controlled length/count fields when parsing responses from a Postgres server (arrays, hstore, multirange, and protocol messages like Bind):

• GHSA-xgrm-4fwx-7qm8 / CVE-2026-33815
• GHSA-9jj7-4m8r-rfcm / CVE-2026-33816

Both are network-exploitable, no auth/user-interaction required, with impact rated across confidentiality, integrity, and availability — not just a crash. Since pgschema connects to whatever Postgres server it's pointed at, this is directly reachable any time it's run against an untrusted or compromised server.

Fix

Bump github.com/jackc/pgx/v5 to v5.9.2, which resolves both CVEs above and, as a bonus, a Low-severity SQL-injection issue also fixed in that release (CVE-2026-41889).

This requires bumping go.mod's Go version to 1.25.0, and .github/workflows/ci-test.yml's go-version: "1.24" accordingly — not an incidental choice, but a hard requirement: pgx v5.9.2 itself declares go 1.25.0 as its own minimum. There's no way to take the CVE fix while staying on Go 1.24.

Two other dependencies moved as a direct consequence of the bump: golang.org/x/text (indirect, v0.24.0 → v0.29.0), and github.com/stretchr/testify (test-only, v1.10.0 → v1.11.1). Notably, golang.org/x/crypto — previously an indirect dependency carrying its own separate set of unrelated CVEs (SSH-related, unreachable in pgschema's actual code) — is dropped from the dependency tree entirely by this bump.

Bonus fix (second commit, unrelated to the CVE)

While validating this on Windows, found that core.autocrlf=true converts checked-in .sql test fixtures to CRLF on checkout, while runtime dump/diff output stays LF-only — causing spurious test failures unrelated to any actual bug. Normalized CRLF to LF in the three comparison functions that lacked it (cmd/dump/dump_integration_test.go's normalizeSchemaOutput, internal/diff/diff_test.go's normalizeSQL, cmd/include_integration_test.go's compareFileContents) — kept as a separate commit since it's unrelated to the pgx fix.

Testing

go build ./... — clean. go test ./... — the two integration suites that exercise real plan/apply round-trips against a live Postgres instance (cmd/plan, cmd/apply) pass, as does internal/diff and cmd's TestIncludeIntegration (both fixed by the CRLF commit). Three cmd/dump multi-file tests still fail on Windows due to a separate, pre-existing path-separator bug (\ vs / in generated \i include directives) — unrelated to either change here, left out of scope.

No source logic changed for the CVE fix itself — that commit is dependency-manifest-only (go.mod/go.sum).

[greptile-apps]

Greptile Summary

This PR upgrades pgx and related dependencies, raises the module’s minimum Go version to 1.25, and makes integration-test comparisons insensitive to Windows CRLF checkout behavior.

• Upgrades github.com/jackc/pgx/v5 from v5.7.5 to v5.9.2 and refreshes transitive dependency metadata.
• Raises the module Go version to 1.25.0, although repository build configurations remain pinned to Go 1.24.
• Normalizes line endings in dump, include, and diff test comparison helpers.

Confidence Score: 4/5

The PR appears safe to merge, but its non-blocking Go build-configuration mismatch should be corrected to avoid implicit toolchain downloads and misleading build declarations.

The dependency and newline-normalization changes appear compatible, with the only accepted concern being that repository CI, release, and Docker configurations still select Go 1.24 after the module minimum moved to Go 1.25.

Files Needing Attention: go.mod

Important Files Changed

Filename	Overview
go.mod	Upgrades pgx, testify, and x/text and raises the Go minimum to 1.25, but leaves repository build environments configured for Go 1.24.
go.sum	Refreshes checksums consistently with the dependency changes in go.mod.
cmd/dump/dump_integration_test.go	Normalizes CRLF dump fixtures before existing schema-output normalization and comparison.
cmd/include_integration_test.go	Compares include fixtures and generated dumps after converting CRLF to LF.
internal/diff/diff_test.go	Extends existing trailing-whitespace normalization to remove carriage returns from CRLF fixtures.

_{Reviews (1): Last reviewed commit: "Fix CRLF/LF comparison mismatch in test ..." | Re-trigger Greptile}

[greptile-apps]

Build Versions Remain Misaligned

The module now requires Go 1.25, but CI, release workflows, and the Docker builder still select Go 1.24. If automatic toolchain downloads are unavailable or disabled, these builds will fail; otherwise, the configured versions no longer describe the compiler actually used. Please align .github/workflows/ci-test.yml, .github/workflows/release.yml, .github/workflows/docker-latest.yml, and the Docker builder image with Go 1.25.

[Copilot]

🟡 Changes recommended

Build, release, Docker, Nix, and documentation configurations still reference Go 1.24 despite the new Go 1.25 requirement.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Updates pgx to address security vulnerabilities and normalizes CRLF line endings in tests.

Changes:

• Bumps pgx and related dependencies, requiring Go 1.25.
• Makes SQL fixture comparisons platform-independent.

File summaries

File	Description
go.mod	Updates Go and dependencies.
go.sum	Refreshes dependency checksums.
internal/diff/diff_test.go	Normalizes CRLF in diff fixtures.
cmd/include_integration_test.go	Normalizes line endings during comparisons.
cmd/dump/dump_integration_test.go	Normalizes dump fixture line endings.

Review details

• Files reviewed: 4/5 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.