Bump the go_modules group across 1 directory with 4 updates

[dependabot]

Bumps the go_modules group with 1 update in the /blog/2022/postgresql_insert_performance/go directory: github.com/jackc/pgx/v4.

Updates github.com/jackc/pgx/v4 from 4.16.1 to 4.18.2

Changelog

Sourced from github.com/jackc/pgx/v4's changelog.

4.18.2 (March 4, 2024)

Fix CVE-2024-27289

SQL injection can occur when all of the following conditions are met:

1. The non-default simple protocol is used.
2. A placeholder for a numeric value must be immediately preceded by a minus.
3. There must be a second placeholder for a string value after the first placeholder; both must be on the same line.
4. Both parameter values must be user-controlled.

Thanks to Paul Gerste for reporting this issue.

Fix CVE-2024-27304

SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control.

Thanks to Paul Gerste for reporting this issue.

• Fix *dbTx.Exec not checking if it is already closed

4.18.1 (February 27, 2023)

• Fix: Support pgx v4 and v5 stdlib in same program (Tomáš Procházka)

4.18.0 (February 11, 2023)

• Upgrade pgconn to v1.14.0
• Upgrade pgproto3 to v2.3.2
• Upgrade pgtype to v1.14.0
• Fix query sanitizer when query text contains Unicode replacement character
• Fix context with value in BeforeConnect (David Harju)
• Support pgx v4 and v5 stdlib in same program (Vitalii Solodilov)

4.17.2 (September 3, 2022)

• Fix panic when logging batch error (Tom Möller)

4.17.1 (August 27, 2022)

• Upgrade puddle to v1.3.0 - fixes context failing to cancel Acquire when acquire is creating resource which was introduced in v4.17.0 (James Hartig)
• Fix atomic alignment on 32-bit platforms

4.17.0 (August 6, 2022)

• Upgrade pgconn to v1.13.0
• Upgrade pgproto3 to v2.3.1
• Upgrade pgtype to v1.12.0

... (truncated)

Commits

• 14690df Update changelog
• 779548e Update required Go version to 1.17
• 80e9662 Update github.com/jackc/pgconn to v1.14.3
• 0bf9ac3 Fix erroneous test case
• f94eb0e Always wrap arguments in parentheses in the SQL sanitizer
• 826a892 Fix SQL injection via line comment creation in simple protocol
• 7d882f9 Fix *dbTx.Exec not checking if it is already closed
• 1d07b8b go mod tidy
• 13468eb Release v4.18.1
• 7fed69b simplify duplicate pgx registration guard
• Additional commits viewable in compare view

Updates github.com/jackc/pgproto3/v2 from 2.3.0 to 2.3.3

Commits

• 945c212 Backport fixes from pgx v5
• 0c0f7b0 Add pgx v5 note
• f59ff94 UnmarshalJSON: removing hex decode
• fd427c0 Don't panic when receiving zero bytes with "slice bounds out of range"
• See full diff in compare view

Updates golang.org/x/crypto from 0.0.0-20210711020723-a769d52b0f97 to 0.20.0

Commits

• See full diff in compare view

Updates golang.org/x/text from 0.3.7 to 0.14.0

Commits

• 6c97a16 all: update go directive to 1.18
• f488e19 unicode/norm: fix function name on comment
• fb697c0 cmd/gotext: actually use -dir flag
• f3e69ed cmd/gotext: fix misbehaviors
• ab07ad1 all: remove repetitive words
• e503480 encoding/japanese, language: shorten very long sub-test names
• 2df65d7 all: regenerate for Unicode 15.0.0
• e3c038a all: prepare for Unicode 15.0.0
• 3a7a255 internal/export/idna: make more space for mapping index
• d61dd50 go.mod: delete repeated "indirect"
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[secure-code-warrior-for-github]

Micro-Learning Topic: SQL injection (Detected by phrase)

Matched on "SQL injection"

What is this? (2min video)

This is probably one of the two most exploited vulnerabilities in web applications and has led to a number of high profile company breaches. It occurs when an application fails to sanitize or validate input before using it to dynamically construct a statement. An attacker that exploits this vulnerability will be able to gain access to the underlying database and view or modify data without permission.

Try a challenge in Secure Code Warrior

Helpful references

• PHP SQL Injection Page - A detailed page on SQL injection in the online PHP manual.
• OWASP SQL Injection Prevention Cheat Sheet - This article is focused on providing clear, simple, actionable guidance for preventing SQL Injection flaws in your applications.
• OWASP SQL Injection - OWASP community page with comprehensive information about SQL injection, and links to various OWASP resources to help detect or prevent it.
• OWASP Query Parameterization Cheat Sheet - A derivative work of the OWASP SQL Injection Prevention Cheat Sheet focused on SQL query parameterization.
• Preventing SQL Injection Attacks With Python - A tutorial on crafting parameterized queries, SQL composition and safe query execution in Python.

[difflens]

View changes in DiffLens

[difflens]

View changes in DiffLens

[difflens]

View changes in DiffLens