Recommended action

Update github.com/jackc/pgx/v5 to 5.9.0 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

pgx contains memory-safety vulnerability affects github.com/jackc/pgx/v5 (go). Severity is critical. [pgx](github.com/jackc/pgx/v5) is a pure Go driver and toolkit for PostgreSQL. pgx prior to v5.9.0 contains a memory-safety vulnerability.

AI coding agents often install or upgrade packages automatically in go. A critical vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software

Fixed versions are reported by the source feed; confirm compatibility before updating.

Evidence and references

Recommended action

Update github.com/jackc/pgx/v5 to 5.9.0 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

pgx contains memory-safety vulnerability affects github.com/jackc/pgx/v5 (go). Severity is critical. [pgx](github.com/jackc/pgx/v5) is a pure Go driver and toolkit for PostgreSQL. pgx prior to v5.9.0 contains a memory-safety vulnerability.

AI coding agents often install or upgrade packages automatically in go. A critical vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software

Fixed versions are reported by the source feed; confirm compatibility before updating.

Evidence and references