Skip to content

Commit f08842a

Browse files
committed
Fix govulncheck failure by removing lib/pq from default builds
govulncheck fails on seven unpatched lib/pq vulnerabilities (GO-2026-6166 through GO-2026-6171). All of them are reported with 'Fixed in: N/A', so bumping the dependency cannot fix the check. The sqlc binary itself never uses lib/pq; the module only linked it in two places that govulncheck's default (untagged) scan could see: - internal/sqltest/postgres.go registered the lib/pq driver, but its helpers (PostgreSQL, CreatePostgreSQLDatabase) have no callers left, so delete the file and move the id() helper to mysql.go, which still uses it. - examples/ondeck/postgresql generated code imports lib/pq for pq.Array. Its tests are already build-tagged 'examples', so set build_tags: examples for the package in sqlc.json and regenerate, putting the generated files behind the same tag as the tests that exercise them. With no lib/pq import left in the default build, govulncheck reports zero called vulnerabilities; lib/pq remains a module requirement for the examples-tagged tests, which is informational only. Verified with govulncheck ./... (0 findings), go build/vet with and without the examples tag, and the example test suites against live PostgreSQL and MySQL. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011mXrXXbgLobj5jpsyzJqB8
1 parent 537ffa7 commit f08842a

8 files changed

Lines changed: 27 additions & 117 deletions

File tree

examples/ondeck/postgresql/city.sql.go

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

examples/ondeck/postgresql/db.go

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

examples/ondeck/postgresql/models.go

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

examples/ondeck/postgresql/querier.go

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

examples/ondeck/postgresql/venue.sql.go

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

examples/ondeck/sqlc.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
"rules": [
2121
"sqlc/db-prepare"
2222
],
23+
"build_tags": "examples",
2324
"emit_json_tags": true,
2425
"emit_prepared_queries": true,
2526
"emit_interface": true

internal/sqltest/mysql.go

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,15 +3,31 @@ package sqltest
33
import (
44
"database/sql"
55
"fmt"
6+
"math/rand"
67
"os"
78
"path/filepath"
89
"testing"
10+
"time"
911

1012
_ "github.com/go-sql-driver/mysql"
1113

1214
"github.com/sqlc-dev/sqlc/internal/sql/sqlpath"
1315
)
1416

17+
func init() {
18+
rand.Seed(time.Now().UnixNano())
19+
}
20+
21+
var letterRunes = []rune("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ")
22+
23+
func id() string {
24+
b := make([]rune, 10)
25+
for i := range b {
26+
b[i] = letterRunes[rand.Intn(len(letterRunes))]
27+
}
28+
return string(b)
29+
}
30+
1531
func MySQL(t *testing.T, migrations []string) (*sql.DB, func()) {
1632
// For each test, pick a new database name at random.
1733
name := "sqltest_mysql_" + id()

internal/sqltest/postgres.go

Lines changed: 0 additions & 117 deletions
This file was deleted.

0 commit comments

Comments
 (0)