Closed anilsenay closed 2 months ago
govulncheck
also highlights a security issue in a dependency which is fixed on the latest master
branch commit, but not in the tag v1.5.7
. Could we please release a new version?
Vulnerability #1: GO-2024-2606
SQL injection in github.com/jackc/pgproto3 and github.com/jackc/pgx
More info: https://pkg.go.dev/vuln/GO-2024-2606
Module: github.com/jackc/pgx/v5
Found in: github.com/jackc/pgx/v5@v5.4.3
Fixed in: github.com/jackc/pgx/v5@v5.5.4
@jinzhu @a631807682 👆
the author seems to be very unresponsive (for weeks now).
Just released a new version. Sorry for the delay, but I have been quite busy over the past month.
Your Question
Is there any planning of creating new version tag for
postgres
package? Latest one, v.1.5.7, is from Mar 9, 2024 and there are some commits after that, including mine.The document you expected this should be explained
Expected answer
I was wondering If there is any planning or a schedule of versioning.