chore: bump github.com/jackc/pgx/v5 from 5.9.0 to 5.9.2 in /apps/backend in the go_modules group across 1 directory

[dependabot]

Bumps the go_modules group with 1 update in the /apps/backend directory: github.com/jackc/pgx/v5.

Updates github.com/jackc/pgx/v5 from 5.9.0 to 5.9.2

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.9.2 (April 18, 2026)

Fix SQL Injection via placeholder confusion with dollar quoted string literals (GHSA-j88v-2chj-qfwx)

SQL injection can occur when:

1. The non-default simple protocol is used.
2. A dollar quoted string literal is used in the SQL query.
3. That query contains text that would be would be interpreted outside as a placeholder outside of a string literal.
4. The value of that placeholder is controllable by the attacker.

e.g.

attackValue := `$tag$; drop table canary; --`
_, err = tx.Exec(ctx, `select $tag$ $1 $tag$, $1`, pgx.QueryExecModeSimpleProtocol, attackValue)

This is unlikely to occur outside of a contrived scenario.

5.9.1 (March 22, 2026)

• Fix: batch result format corruption when using cached prepared statements (reported by Dirkjan Bussink)

Commits

• 0aeabbc Release v5.9.2
• 60644f8 Fix SQL sanitizer bugs with dollar-quoted strings and placeholder overflow
• a5680bc Merge pull request #2531 from dolmen-go/godoc-add-links
• e34e452 doc: Add godoc links
• 08c9bb1 Fix Stringer types encoded as text instead of numeric value in composite fields
• 96b4dbd Remove unstable test
• acf88e0 Merge pull request #2526 from abrightwell/abrightwell-min-proto
• 2f81f1f Update max_protocol_version and min_protocol_version defaults
• 4e4eaed Release v5.9.1
• 6273188 Fix batch result format corruption when using cached prepared statements
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[claude]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.

[greptile-apps]

Greptile Summary

This PR bumps github.com/jackc/pgx/v5 from 5.9.0 to 5.9.2, picking up a security fix (GHSA-j88v-2chj-qfwx — SQL injection via dollar-quoted string placeholder confusion when using the simple protocol) and a bug fix for batch result format corruption with cached prepared statements. The go.mod and go.sum changes are correct and minimal.

Confidence Score: 5/5

Safe to merge — standard dependency bump with security and bug fixes, no code changes.

Only go.mod and go.sum are changed, the version bump is correct, and it closes a known CVE. No application logic is modified.

No files require special attention.

Important Files Changed

Filename	Overview
apps/backend/go.mod	Bumps github.com/jackc/pgx/v5 from 5.9.0 to 5.9.2 — correct single-line version change
apps/backend/go.sum	Replaces pgx v5.9.0 checksums with v5.9.2 checksums — expected lockfile update

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[pgx v5.9.0] -->|bump| B[pgx v5.9.2]
    B --> C[Fix: SQL injection via dollar-quoted string\nGHSA-j88v-2chj-qfwx]
    B --> D[Fix: batch result format corruption\nwith cached prepared statements]
    C --> E[go.mod updated]
    D --> E
    E --> F[go.sum checksums updated]

Loading

_{Reviews (1): Last reviewed commit: "chore: bump github.com/jackc/pgx/v5" | Re-trigger Greptile}