Commit f08842a
committed
Fix govulncheck failure by removing lib/pq from default builds
govulncheck fails on seven unpatched lib/pq vulnerabilities
(GO-2026-6166 through GO-2026-6171). All of them are reported with
'Fixed in: N/A', so bumping the dependency cannot fix the check.
The sqlc binary itself never uses lib/pq; the module only linked it in
two places that govulncheck's default (untagged) scan could see:
- internal/sqltest/postgres.go registered the lib/pq driver, but its
helpers (PostgreSQL, CreatePostgreSQLDatabase) have no callers left,
so delete the file and move the id() helper to mysql.go, which still
uses it.
- examples/ondeck/postgresql generated code imports lib/pq for
pq.Array. Its tests are already build-tagged 'examples', so set
build_tags: examples for the package in sqlc.json and regenerate,
putting the generated files behind the same tag as the tests that
exercise them.
With no lib/pq import left in the default build, govulncheck reports
zero called vulnerabilities; lib/pq remains a module requirement for
the examples-tagged tests, which is informational only.
Verified with govulncheck ./... (0 findings), go build/vet with and
without the examples tag, and the example test suites against live
PostgreSQL and MySQL.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011mXrXXbgLobj5jpsyzJqB81 parent 537ffa7 commit f08842a
8 files changed
Lines changed: 27 additions & 117 deletions
File tree
- examples/ondeck
- postgresql
- internal/sqltest
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
20 | 20 | | |
21 | 21 | | |
22 | 22 | | |
| 23 | + | |
23 | 24 | | |
24 | 25 | | |
25 | 26 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
3 | 3 | | |
4 | 4 | | |
5 | 5 | | |
| 6 | + | |
6 | 7 | | |
7 | 8 | | |
8 | 9 | | |
| 10 | + | |
9 | 11 | | |
10 | 12 | | |
11 | 13 | | |
12 | 14 | | |
13 | 15 | | |
14 | 16 | | |
| 17 | + | |
| 18 | + | |
| 19 | + | |
| 20 | + | |
| 21 | + | |
| 22 | + | |
| 23 | + | |
| 24 | + | |
| 25 | + | |
| 26 | + | |
| 27 | + | |
| 28 | + | |
| 29 | + | |
| 30 | + | |
15 | 31 | | |
16 | 32 | | |
17 | 33 | | |
| |||
This file was deleted.
0 commit comments