fix(deps): update module github.com/uptrace/bun/driver/pgdriver to v1.2.15 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/uptrace/bun/driver/pgdriver	v1.1.14 → v1.2.15

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

uptrace pgdriver SQL injection vulnerability

CVE-2024-44906 / GHSA-h4h6-vccr-44h2

More information

Details

uptrace pgdriver v1.2.1 was discovered to contain a SQL injection vulnerability via the appendArg function in /pgdriver/format.go. The maintainer has stated that the issue is fixed in v1.2.15.

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-44906
• https://github.com/uptrace/bun/blob/1573ae7c2fffad1a7f72fd2d205e924b2fd4043b/driver/pgdriver/format.go#L62
• https://github.com/uptrace/bun/tree/master/driver/pgdriver
• https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20Paul%20Gerste%20-%20SQL%20Injection%20Isn%27t%20Dead%20Smuggling%20Queries%20at%20the%20Protocol%20Level.pdf
• https://www.sonarsource.com/blog/double-dash-double-trouble-a-subtle-sql-injection-flaw
• https://github.com/uptrace/bun/issues/1224
• https://github.com/uptrace/bun/commit/8067a8f13f8d22fb57b76d6800f7aefc12b044cd
• https://github.com/uptrace/bun/blob/v1.2.15/CHANGELOG.md
• https://github.com/advisories/GHSA-h4h6-vccr-44h2

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

uptrace/bun (github.com/uptrace/bun/driver/pgdriver)

v1.2.15

Compare Source

Bug Fixes

• data race in db clone stats (e92d910)
• db: data race in db clone stats (a78f382)
• db: move DBStats to noCopyState (c646241)
• return "custom" for unknown dialects instead of "invalid" (#​1280) (106cc08), closes #​1276
• revert CreateChannel rename (#​1248) (a5b2ac6)
• sql injection #​1228 (#​1263) (c12edf0)
• update SelectQuery.Clone to properly handle non-nil empty arg slices (#​1299) (b499cce), closes #​1298

Features

• add Context to ConnResolver.ResolveConn (#​1275) (d9f273f)
• add materialize cte support (#​1260) (16ebb09)
• add SetValues (#​1252) (9556d3c)
• add SortDir type to safely build order queries (#​1284) (2ad0521)
• add WithQueryHook and deprecated AddQueryHook (#​1272) (f662c1e)
• migrate: add BeforeMigration and AfterMigration (#​1273) (042b10a)
• pgdialect: add support for RETURNING clause in MERGE statements (#​1258) (6f4c688)

v1.2.14

Compare Source

Please refer to CHANGELOG.md for details

v1.2.13

Compare Source

Please refer to CHANGELOG.md for details

v1.2.12

Compare Source

Please refer to CHANGELOG.md for details

v1.2.11

Compare Source

Please refer to CHANGELOG.md for details

v1.2.10

Compare Source

Please refer to CHANGELOG.md for details

v1.2.9

Compare Source

Please refer to CHANGELOG.md for details

v1.2.8

Compare Source

Please refer to CHANGELOG.md for details

v1.2.7

Compare Source

Please refer to CHANGELOG.md for details

v1.2.6

Compare Source

Please refer to CHANGELOG.md for details

v1.2.5

Compare Source

Please refer to CHANGELOG.md for details

v1.2.3

Compare Source

Please refer to CHANGELOG.md for details

v1.2.2

Compare Source

Please refer to CHANGELOG.md for details

v1.2.1

Compare Source

Bug Fixes

• handle []byte and [N]byte in Tuple, separate List from Tuple imp… (#​1340) (bec98b9)
• validate parenthesized content in ReadIdentifier to prevent ?(?, ?) misparse (#​1338) (b8da15b), closes #​1337

v1.2.0

Compare Source

Please refer to CHANGELOG.md for details

v1.1.17

Compare Source

Please refer to CHANGELOG.md for details

v1.1.16

Compare Source

Bug Fixes

• embedding of scanonly fields (ed6ed74)
• table: allow alt annotation (#​956) (8a0397b)
• transactional migration file extension (#​959) (921b15b)

Features

• Allow overriding of Warn and Deprecated loggers (#​952) (0e9d737)
• enable SNI (#​953) (4071ffb)
• idb: add NewMerge method to IDB (#​966) (664e2f1)

1.1.17 (2024-01-11)

Features

• add CreateTxSQLMigrations function (#​916) (c68ec7c)
• add Join to UpdateQuery (#​908) (8c4d8be)
• bunslog.QueryHook for Bun logging using log/slog (#​904) (4953367)
• dbfixture.New to accept IDB interface (#​900) (2dee174)

1.1.16 (2023-09-16)

Reverts

• Revert "fix: "model does not have column" error (#​850)" (387228e), closes #​850

1.1.15 (2023-09-10)

Bug Fixes

• "model does not have column" error (#​850) (16367aa)
• alloc when mounting (#​891) (f2256f1)
• index hints have to be specified following a table name (4a2ae85)
• make Rows.Close to drain messages (5ceba07)
• run hooks on Rows (#​892) (f652b3d)
• scan error #​709 (#​837) (b82afa5)

Features

• add bun.NullZero (786bb6b)
• bunotel: add options for set otel providers (#​836) (806e632)

1.1.14 (2023-05-24)

Bug Fixes

• enable CompositeIn for MySQL (9f377b5)

1.1.13 (2023-05-06)

Bug Fixes

• bunbig.Int.Scan typo (7ddabb8)
• compare full MySQL version (096fabe)
• enable delete table alias for MySQL >= 8.0.16 (77a600b)
• incorrect table relationship panic message #​791 (ad41888)
• should rollback if migrate using transaction and got an err (thanks @​bayshark) (e7a119b)

Features

• add option to customize Go migration template (f31bf73)
• expose Exec(…) method for RawQuery (11192c8)
• prefix migration files with 1 upto 14 digits (b74b671)
• rename option (9353a3f)

1.1.12 (2023-02-20)

1.1.11 (2023-02-01)

Bug Fixes

• add support for inserting values with Unicode encoding for mssql dialect (e98c6c0)
• fix relation tag (a3eedff)

1.1.10 (2023-01-16)

Bug Fixes

• allow QueryEvent to better detect operations in raw queries (8e44735)
• append default VARCHAR length instead of hardcoding it in the type definition (e5079c7)
• prevent panic when use pg array with custom database type (67e4412)
• properly return sql.ErrNoRows when scanning []byte (996fead)

Features

• mssql output support for update or delete query (#​718) (08876b4)
• add Err method to query builder (c722c90)
• add support for time.Time array in Postgres (3dd6f3b)
• mssql and pg merge query (#​723) (deea764)
• setError on attempt to set non-positive .Varchar() (3335e0b)

Reverts

• go 1.18 (67a4488)

1.1.9 (2022-11-23)

Bug Fixes

• adding dialect override for append-bool (#​695) (338f2f0)
• don't call hooks twice for whereExists (9057857)
• don't lock migrations when running Migrate and Rollback (69a7354)
• query: make WhereDeleted compatible with ForceDelete (299c3fd), closes #​673
• relation join soft delete SQL generate (a98f4e9)

Features

• add migrate.Exec (d368bbe)
• update: "skipupdate" while bulk (1a32b2f)
• zerolog: added zerolog hook (9d2267d)

1.1.8 (2022-08-29)

Bug Fixes

• bunotel: handle option attributes (#​656) (9f1e0bd)
• driver.Valuer returns itself causes stackoverflow (c9f51d3), closes #​657
• pgdriver: return FATAL and PANIC errors immediately (4595e38)
• quote m2m table name fixes #​649 (61a634e)
• support multi-level embed column (177ec4c), closes #​643

Features

• conditions not supporting composite in (e5d78d4)
• idb: support raw query (be4e688)
• migrate: add MissingMigrations (42567d0)
• pgdriver: implement database/sql/driver.SessionResetter (bda298a)
• pgdriver: provide access to the underlying net.Conn (d07ea0e)

1.1.7 (2022-07-29)

Bug Fixes

• change ScanAndCount without a limit to select all rows (de5c570)

1.1.6 (2022-07-10)

Bug Fixes

• bunotel add set attributes to query metrics (dae82cc)
• db.ScanRows: ensure rows.Close is called (9ffbc6a)
• merge apply (3081849)
• migrate: close conn/tx on error (7b168ea)
• migrate: type Migration should be used as a value rather than a pointer (fb43935)
• migrate: type MigrationGroup should be used as a value rather than a pointer (649da1b)
• mssql cursor pagination (#​589) (b34ec97)

Features

• "skipupdate" model field tag (#​565) (9288294)
• add pgdriver write error to log (5ddda3d)
• add query string representation (520da7e)
• add relation condition with tag (fe5bbf6)
• add support for ON UPDATE and ON DELETE rules on belongs-to relationships from struct tags (#​533) (a327b2a)
• add tx methods to IDB (#​587) (feab313)
• added raw query calls (#​596) (127644d)
• bunotel: add option to enable formatting of queries (#​547) (b9c768c)
• config.go: add sslrootcert support to DSN parameters (3bd5d69)
• create an extra module for newrelic (#​599) (6c676ce)
• migrate: add WithMarkAppliedOnSuccess (31b2cc4)
• pgdialect: add hstore support (66b44f7)
• pgdialect: add identity support (646251e)
• pgdriver: expose pgdriver.ParseTime (405a7d7)

1.1.5 (2022-05-12)

Bug Fixes

• driver/sqliteshim: make it work with recent version of modernc sqlite (2360584)

1.1.4 (2022-04-20)

Bug Fixes

• automatically set nullzero when there is default:value option (72c44ae)
• fix ForceDelete on live/undeleted rows (1a33250)
• fix OmitZero and value overriding (087ea07)
• rename Query to QueryBuilder (98d111b)

Features

• add ApplyQueryBuilder (582eca0)
• config.go: add connect_timeout to DSN parsable params (998b04d), closes #​505

v1.1.15

Compare Source

Please refer to CHANGELOG.md for details

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -t ./...
go: downloading github.com/rs/zerolog v1.34.0
go: downloading github.com/uptrace/bun v1.2.15
go: downloading github.com/gofiber/fiber/v2 v2.52.13
go: downloading github.com/uptrace/bun/driver/pgdriver v1.2.15
go: downloading go.opentelemetry.io/otel v1.37.0
go: downloading github.com/rs/xid v1.6.0
go: downloading github.com/vmihailenco/msgpack/v5 v5.4.1
go: downloading golang.org/x/text v0.27.0
go: downloading golang.org/x/sync v0.16.0
go: downloading golang.org/x/mod v0.25.0
go: downloading go.opentelemetry.io/otel/trace v1.37.0
go: downloading github.com/stretchr/testify v1.10.0
go: downloading golang.org/x/sys v0.34.0
go: downloading github.com/mattn/go-colorable v0.1.14
go: downloading golang.org/x/tools v0.34.0
go: downloading mellium.im/sasl v0.3.2
go: downloading go.opentelemetry.io/otel/metric v1.37.0
go: downloading github.com/go-logr/logr v1.4.3
go: downloading golang.org/x/crypto v0.40.0
go: downloading github.com/puzpuzpuz/xsync/v3 v3.5.1
go: downloading go.opentelemetry.io/auto/sdk v1.1.0
go: downloading golang.org/x/net v0.41.0
go: downloading go.opentelemetry.io/otel v1.45.0
go: downloading go.opentelemetry.io v0.1.0
go: downloading go.opentelemetry.io/otel/exporters/otlp v0.20.1
go: exusiai.dev/backend-next/internal/server/httpserver imports
	go.opentelemetry.io/otel/exporters/otlp/otlptrace imports
	go.opentelemetry.io/otel/exporters/otlp/internal: cannot find module providing package go.opentelemetry.io/otel/exporters/otlp/internal
go: exusiai.dev/backend-next/internal/server/httpserver imports
	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc imports
	go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/otlpconfig imports
	go.opentelemetry.io/otel/exporters/otlp/internal/envconfig: cannot find module providing package go.opentelemetry.io/otel/exporters/otlp/internal/envconfig
go: module go.opentelemetry.io/otel/exporters/jaeger is deprecated: This module is no longer supported.

[renovate]

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.