Fix govulncheck failure by removing lib/pq from default builds - #4566
Merged
Conversation
govulncheck fails on seven unpatched lib/pq vulnerabilities (GO-2026-6166 through GO-2026-6171). All of them are reported with 'Fixed in: N/A', so bumping the dependency cannot fix the check. The sqlc binary itself never uses lib/pq; the module only linked it in two places that govulncheck's default (untagged) scan could see: - internal/sqltest/postgres.go registered the lib/pq driver, but its helpers (PostgreSQL, CreatePostgreSQLDatabase) have no callers left, so delete the file and move the id() helper to mysql.go, which still uses it. - examples/ondeck/postgresql generated code imports lib/pq for pq.Array. Its tests are already build-tagged 'examples', so set build_tags: examples for the package in sqlc.json and regenerate, putting the generated files behind the same tag as the tests that exercise them. With no lib/pq import left in the default build, govulncheck reports zero called vulnerabilities; lib/pq remains a module requirement for the examples-tagged tests, which is informational only. Verified with govulncheck ./... (0 findings), go build/vet with and without the examples tag, and the example test suites against live PostgreSQL and MySQL. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011mXrXXbgLobj5jpsyzJqB8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
vuln_checkCI job fails on sevengithub.com/lib/pqvulnerabilities (GO-2026-6166 through GO-2026-6171), all reported as Fixed in: N/A — there is no upstream release to bump to, so the only fix is to stop linkinglib/pqinto the code govulncheck scans.The sqlc binary never uses
lib/pq; only two spots in the module pulled it into the default (untagged) build that govulncheck analyzes:internal/sqltest/postgres.goregistered thelib/pqdriver, but its helpers (sqltest.PostgreSQL,sqltest.CreatePostgreSQLDatabase) no longer have any callers — everything moved tosqltest/local, which uses pgx. Deleted the file and moved theid()helper intomysql.go, which still uses it.examples/ondeck/postgresqlgenerated code importslib/pqforpq.Array. Its tests are already behind theexamplesbuild tag, so this sets"build_tags": "examples"for that package insqlc.jsonand regenerates, putting the generated files behind the same tag as the tests that exercise them. The regenerated diff is exactly the//go:build examplesheader on five files.lib/pqstays ingo.modfor the--tags=examplestest build; govulncheck now reports it only as a required-but-uncalled module, which is informational and doesn't fail the check.Verification
govulncheck ./...(with go1.26.6): 0 called vulnerabilities (was 7)go build ./...andgo vet ./...pass with and without-tags=examplesgo mod tidyis a no-opexamples/ondeck(postgresql, mysql, sqlite),authors,booktest,batchexample tests, plusTestExamples,TestExamplesVet/ondeck,TestJsonSchema, and the config package tests🤖 Generated with Claude Code
https://claude.ai/code/session_011mXrXXbgLobj5jpsyzJqB8
Generated by Claude Code