What the developer wrote
Authored by ziggie
lnd: bump pgx to v5.9.2
What changed, and why it matters
This commit simply updates the version of a third-party PostgreSQL database driver library (pgx) used by LND from version 5.7.4 to 5.9.2. The change only affects dependency files (go.mod and go.sum). There is no direct code change shown, and the commit message does not say why the update was made or whether it fixes any security issue. It could be a routine maintenance update, or it could be pulling in bug or security fixes from the upstream library, but that is not stated in the materials provided.
Treat as a routine dependency update unless additional context shows the upstream pgx release fixes a security issue affecting LND. Review the pgx v5.7.4 to v5.9.2 release notes and changelog for security fixes. If any fix is relevant to LND's Postgres usage, consider backporting or noting it in release notes; otherwise no immediate action is required beyond normal dependency hygiene.
Security signals we found
Dependency version bump of a database driver that handles SQL parsing, connection state, and wire protocol
No commit-level explanation of security or bug rationale
No direct code changes or security-relevant diff content visible
Evidence from the diff
The diff is a dependency bump of github.com/jackc/pgx/v5 from v5.7.4 to v5.9.2 in go.mod and go.sum. pgx is the PostgreSQL driver used by LND’s Postgres-backed database option. No LND source code is modified. The commit message gives no rationale. Without inspecting the upstream pgx changelog or release notes, we cannot determine whether this bump addresses a known vulnerability, bug, or feature need. The supplied references contain no vendor or upstream security disclosure.
Changed components
go.modgo.sumgithub.com/jackc/pgx/v5 dependency (PostgreSQL driver)Inspect captured patch +3 / −3
diff --git a/go.mod b/go.mod
index 0a0baeb..f93c382 100644
--- a/go.mod
+++ b/go.mod
@@ -23,7 +23,7 @@ require (
github.com/grpc-ecosystem/go-grpc-middleware v1.3.0
github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0
github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0
- github.com/jackc/pgx/v5 v5.7.4
+ github.com/jackc/pgx/v5 v5.9.2
github.com/jackpal/gateway v1.0.5
github.com/jackpal/go-nat-pmp v0.0.0-20170405195558-28a68d0c24ad
github.com/jedib0t/go-pretty/v6 v6.2.7
diff --git a/go.sum b/go.sum
index ce8cc7e..03ef1a8 100644
--- a/go.sum
+++ b/go.sum
@@ -238,8 +238,8 @@ github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsI
github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
-github.com/jackc/pgx/v5 v5.7.4 h1:9wKznZrhWa2QiHL+NjTSPP6yjl3451BX3imWDnokYlg=
-github.com/jackc/pgx/v5 v5.7.4/go.mod h1:ncY89UGWxg82EykZUwSpUKEfccBGGYq1xjrOpsbsfGQ=
+github.com/jackc/pgx/v5 v5.9.2 h1:3ZhOzMWnR4yJ+RW1XImIPsD1aNSz4T4fyP7zlQb56hw=
+github.com/jackc/pgx/v5 v5.9.2/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
github.com/jackpal/gateway v1.0.5 h1:qzXWUJfuMdlLMtt0a3Dgt+xkWQiA5itDEITVJtuSwMc=
Why this scored 25/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.