[adlio]

Closes #17

What changed

Migrates the jackc/pgx driver dependency from v4 to v5.

Import paths:

• github.com/jackc/pgx/v4 -> github.com/jackc/pgx/v5
• github.com/jackc/pgx/v4/pgxpool -> github.com/jackc/pgx/v5/pgxpool
• github.com/jackc/pgconn (standalone v4 module) -> github.com/jackc/pgx/v5/pgconn (now vendored inside pgx/v5)

Public signatures changed (breaking surface): the Connection, Queryer, and Transactor interfaces in pgxschema.go are unchanged in shape, but their method signatures now reference pgx/v5 types instead of pgx/v4 types:

• Queryer.Exec(...) (pgconn.CommandTag, error) — pgconn.CommandTag is now github.com/jackc/pgx/v5/pgconn.CommandTag
• Queryer.Query(...) (pgx.Rows, error) — pgx.Rows is now the v5 interface
• Transactor.Begin(...) (pgx.Tx, error) — pgx.Tx is now the v5 interface

No method names, parameter counts, or return shapes changed — only the underlying package versions of the pgx types involved.

Test-only changes: test helper call sites updated from pgxpool.Connect(...) to pgxpool.New(...) (renamed in pgx v5), and the pashagolub/pgxmock test dependency bumped from v1 (pgx/v4-based) to v4 (pgx/v5-based).

Why this clears the dependabot alerts

• GHSA-jqcq-xjh3-6g23 (pgproto3/v2 DoS via negative field length): pgx v5 no longer depends on the standalone github.com/jackc/pgproto3/v2 module at all — confirmed absent from go.mod/go.sum after this change.
• GHSA-j88v-2chj-qfwx (pgx/v4 SQL injection via dollar-quoted string placeholder confusion): fixed upstream in pgx v5.9.2+. This PR pins github.com/jackc/pgx/v5 v5.10.0.

(pgx v5.11.0 is also available but was intentionally avoided — see note below.)

This is a BREAKING change

Any consumer of pgxschema that passes a pgx.Conn, pgxpool.Pool, or pgx.Tx into Migrator.Apply() or Migrator.GetAppliedMigrations() must update their own imports from pgx v4 to pgx v5 types, since those types no longer satisfy pgxschema's interfaces otherwise. This warrants a minor release (v1.3.0) once merged — not bumped or tagged here per instructions.

Migration for consumers

// Before
import (
    "github.com/jackc/pgx/v4"
    "github.com/jackc/pgx/v4/pgxpool"
)

db, err := pgxpool.Connect(ctx, dsn)

// After
import (
    "github.com/jackc/pgx/v5"
    "github.com/jackc/pgx/v5/pgxpool"
)

db, err := pgxpool.New(ctx, dsn)

Build / test results

go build ./...   -> PASS
go vet ./...     -> PASS
go test ./...    -> PASS (all tests, including the dockertest-provisioned
                    postgres:11 / postgres:12 / postgres:latest suites)

Note on pgx/v5 version pin (v5.10.0, not latest v5.11.0)

pgx v5.11.0 added a TypeMap() method to the pgx.Rows interface. The current pashagolub/pgxmock/v4 release (v4.9.0, built against pgx v5.7.4) does not implement it yet on its mock Rows, which breaks go vet/compilation of the test suite against v5.11.0 (tracked upstream: pashagolub/pgxmock#288). v5.10.0 satisfies the ">= 5.9.2" requirement for both advisory fixes and is fully compatible with the current pgxmock release. Worth revisiting once pgxmock adds TypeMap() support.

Dependabot alert count

Alerts are evaluated against the default branch, so the count won't drop until this merges. Verified locally instead:

• go list -m github.com/jackc/pgx/v5 -> v5.10.0 (>= the 5.9.2 fix version)
• grep -rn 'pgx/v4' --include='*.go' . -> no matches
• grep -i pgproto3 go.sum -> no matches (module no longer in the dependency graph)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (907c6f0) to head (0fcf0ee).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff            @@
##              main       #18   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            7         7           
  Lines          216       216           
=========================================
  Hits           216       216           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.