[dependabot]

Bumps github.com/jackc/pgx/v5 from 5.11.0 to 5.12.0.

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.12.0 (October 30, 2026)

This release fixes two security vulnerabilities with narrow triggering conditions but serious impact. Affected applications should upgrade to v5.12.0; see Security Fixes below.

It also adds batched transaction startup, client certificate policy controls, and per-query batch timing, and improves connection pool cancellation and type handling. Custom implementations of BatchResults, including mocks, must add the new Tx method.

Security Fixes

• SQL injection in simple-protocol batches (GHSA-j38q-h3ph-jjpq, high severity). In pgx v5 before v5.12.0, SendBatch using the non-default simple protocol could allow arbitrary SQL execution with the application's database privileges when a queued query ends in a -- comment without a newline and the next query has an attacker-controlled string argument on its first line. Batched queries are now separated by a newline to end such comments. Extended-protocol modes are unaffected. Reported by Igor Kupczyński (@​igor-kupczynski).
• Bypass of require_auth and channel_binding=require (GHSA-95fj-3fxw-g62g, high severity). In pgx v5.9.0 through v5.11.0, applications relying on these settings without verifying the server's identity with sslmode=verify-full (or equivalent TLS verification) could accept an impersonating server that skips authentication. The attacker could read queries and parameters and return fabricated results. pgx now enforces authentication completion and required channel binding before accepting the connection. This vulnerability does not bypass TLS server certificate verification. Reported by @​president-xd.

Features

• Add Batch.BeginTx and BatchResults.Tx to begin a transaction as the first query of a batch, saving the round trip for BeginTx. Call Batch.BeginTx before queuing any queries, consume the begin query's result first, and close the batch before using the transaction. With pgxpool.Pool.SendBatch, the connection remains acquired until the transaction is committed or rolled back. Add FailedBatchResults for wrappers that fail before sending a batch (Timo Furrer)
• Add TraceBatchQueryData.ReadStartTime and per-query durations to tracelog batch query entries. These measure result consumption, including application time spent reading rows, rather than server execution alone (Yasser-Ameur)
• pgconn: support the sslcertmode connection parameter, PGSSLCERTMODE environment variable, and Config.SSLCertMode. The default, allow, sends an available client certificate when requested; disable prevents sending one and skips loading certificate/key files; require fails unless the server requests and receives a certificate. require does not guarantee server-side certificate validation, disables TLS session resumption, and stops further host or TLS fallbacks when the certificate requirement fails (k-zshiba)
• pgtype: add support for PostgreSQL 19's oid8 and oid8[] (k-zshiba)

Changes

• pgxpool: background attempts to satisfy MinConns and MinIdleConns now have a 60-second timeout, including connection hooks. Initial background connections preserve the constructor context's values but ignore its cancellation and deadline.
• pgxpool: canceling Acquire during a health-check ping now returns promptly and lets a successful ping return

... (truncated)

Commits

• b2ef08b Update changelog for v5.12.0
• 8199015 Merge commit from fork
• 5b1a6a0 Merge commit from fork
• 65a4125 Merge pull request #2697 from b84330808/windows-default-servicefile
• f2701a0 pgconn: only fall back when Windows service file is missing
• db95468 Merge pull request #2696 from k-zshiba/support-oid8
• fa2327d Start each query on a new line when joining a simple protocol batch
• 2283b85 pgconn: read the default service file from %APPDATA%\postgresql on Windows
• efc0b74 Merge upstream master into support-oid8
• 5a17450 pgconn: require AuthenticationOk before ReadyForQuery
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)