[adlio]

Resolves the 17 open Dependabot security alerts on this repo and adds .github/dependabot.yml so future advisories raise update PRs automatically instead of silently accumulating.

Dependency bumps

Dependency	Before	After	Alerts cleared
golang.org/x/crypto	v0.50.0	v0.52.0	13 (7 critical, 2 high, 4 medium) — all SSH-subsystem advisories
github.com/moby/sys/user	v0.4.0	v0.4.1	1 medium
github.com/opencontainers/runc	v1.2.8	v1.3.6	1 medium

The x/crypto criticals are all in the SSH subsystem (golang.org/x/crypto/ssh). pgxschema is a Postgres schema-migration library with no SSH usage, so there's no reachable exploitation path in this codebase — bumping clears the alerts regardless.

runc was pinned to v1.3.6 (the minimal version satisfying the advisory's >1.3.5 fix) rather than the current latest (v1.5.2), because v1.5.2 removed the libcontainer/user package that ory/dockertest's docker/pkg/homedir (a test-only transitive dependency) still imports, which breaks go mod tidy. v1.3.6 keeps the package and is already past the vulnerable threshold.

Not bumped — no fix exists in this major version

• github.com/jackc/pgx/v4 (GHSA-j88v-2chj-qfwx, SQL injection via placeholder confusion): the GitLab advisory for the v4 module states "there is no solution available" — the fix landed only in pgx v5.9.2+. v4 is EOL/archived; v4.18.3 (already pinned) is the latest release on that line. Migrating to v5 is an API-breaking change out of scope for this dependency-bump PR.
• github.com/jackc/pgproto3/v2 (GHSA-jqcq-xjh3-6g23, DoS via negative field length panic): same situation — this is an archived dependency of pgx v4; the fix exists only in pgx v5's internal (non-modularized) pgproto3. v2.3.3 (already pinned) is the latest release of the standalone /v2 module.

Both would require a pgx v4→v5 migration to resolve, which changes pgxschema's public API surface. Flagging for a separate, deliberate migration decision rather than forcing here.

New: .github/dependabot.yml

Weekly gomod + github-actions update checks, so version-update PRs are raised automatically going forward instead of alerts silently piling up with no action.

Verification

• go build ./... — pass
• go vet ./... — pass
• go test ./... — pass (14.2s; dockertest provisions its own Postgres container, no external DB needed)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (f91c815) to head (907c6f0).

Additional details and impacted files

@@            Coverage Diff            @@
##              main       #12   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            7         7           
  Lines          216       216           
=========================================
  Hits           216       216           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.