Bump github.com/kataras/pg from 1.0.12-0.20251023123148-39cf20618fe4 to 1.0.13 in /pg

[dependabot]

Bumps github.com/kataras/pg from 1.0.12-0.20251023123148-39cf20618fe4 to 1.0.13.

Release notes

Sourced from github.com/kataras/pg's releases.

v1.0.13

A security and correctness pass over the whole library, a set of helper APIs driven by what a real application kept re-implementing on top of pg, and a book.

Ten of the fixes below are security issues, two of them SQL injection through a channel name. Three more are bugs that lost data or crashed the process rather than returning an error: a failed COMMIT that reported success, an ON CONFLICT DO NOTHING that emitted an update, and a nil dereference in the ListenTable goroutine that an empty pg_notify payload was enough to trigger. If you use LISTEN/NOTIFY or transactions, this release is worth taking.

Everything was reviewed independently of the change that produced it, and the full suite runs against a live PostgreSQL 16 server.

go get github.com/kataras/pg@v1.0.13

One breaking change

DB.UpsertSingle takes the conflict expression second now, matching Repository[T].UpsertSingle, which always did:

// before
err := db.UpsertSingle(ctx, &customer, &id, "customers_email_key")
// after
err := db.UpsertSingle(ctx, "customers_email_key", &customer, &id)

Every method in the family now takes its conflict specification straight after ctx: Upsert, UpsertMany, UpsertSingle, InsertOnConflict and InsertSingleOnConflict. The three variadic ones could never put it anywhere else, since values ...T has to come last, so the single-row methods moved to match. The break is compile-time. Passing the old order fails to build rather than doing something surprising at runtime.

The import path is unchanged. No /v2.

Security

• SQL injection in DB.Listen, which concatenated the channel name straight into LISTEN. Channel names go through QuoteIdentifier now, which also settles the mismatch where a mixed-case channel folded differently in LISTEN than in pg_notify.
• SQL injection in PrepareListenTable and ListenTable. The caller's channel name was interpolated inside a single-quoted PL/pgSQL literal, so one quote character could append arbitrary code to a trigger that fires on every write to the table. Channel, function and table names are validated against ^[A-Za-z_][A-Za-z0-9_$]*$ before any DDL is built.
• DB.UpdateJSONB never validated its column argument. The column is resolved through the table descriptor and rejected when unknown; table, column and primary key are quoted.

... (truncated)

Changelog

Sourced from github.com/kataras/pg's changelog.

[1.0.13] - 2026-08-16

A security, correctness and documentation pass over the whole library, plus a large set of additive helper APIs and a book. Every fix below was reviewed independently and the full test suite runs green against a live PostgreSQL 16 server.

Breaking

• DB.UpsertSingle's parameter order changed to UpsertSingle(ctx, forceOnConflictExpr string, value any, idPtr any). It previously took the conflict expression last, while Repository[T].UpsertSingle took it first, so the same call read differently on the two types. Every method in the family now takes its conflict specification immediately after ctx: Upsert, UpsertMany, UpsertSingle, InsertOnConflict and InsertSingleOnConflict. The three variadic methods could never put it anywhere else, since values ...T has to come last, so the single-row methods moved to match. The break is compile-time: passing the old order fails to build rather than misbehaving.

Security

• Fixed SQL injection in DB.Listen, which concatenated the channel name directly into LISTEN. Channel names now go through QuoteIdentifier, which also makes mixed-case channels behave consistently between LISTEN and pg_notify.
• Fixed SQL injection in PrepareListenTable and ListenTable. The caller-supplied channel was interpolated inside a single-quoted PL/pgSQL literal, so a quote character could append arbitrary code to a trigger that runs on every write. Channel, function and table names are now validated against ^[A-Za-z_][A-Za-z0-9_$]*$ before any DDL is built.
• Fixed an unvalidated column name in DB.UpdateJSONB. The column is now resolved through the table descriptor and rejected when unknown; table, column and primary key are quoted.
• Stopped leaking the connection string. A failed Open embedded the full DSN, password included, in the returned error; the code generator printed it to stdout. Both now omit it.
• Identifier validation at registration. ConvertStructToTable rejects table, column and unique-index names outside the safe character set, so an unsafe name from a struct tag or a name mapper cannot reach a query builder.
• Correct SQL identifier quoting. The builders used strconv.Quote, which is Go string quoting: it escapes an embedded quote as \" where PostgreSQL requires "", and mangles non-ASCII. They now use pgx's identifier sanitizer.
• Quoted the remaining DDL sinks: DeleteSchema, DisableAutoVacuum, DisableTableAutoVacuum, and the select, delete and authentication queries. The search path is validated before CREATE SCHEMA.
• PasswordAlg is validated against an allowlist (bf, md5, xdes, des) before it is interpolated into gen_salt(...), on the insert, bulk-insert and update paths.
• Added WithLoggerLevel. WithLogger installs pgx tracelog at trace level, which logs every statement and every bind argument, passwords included; its documentation now says so.
• Hardened the code generator: generated files are 0644 and directories 0755 instead of world-writable 0777, and table names that are not safe as file names are rejected before filepath.Join, closing a path-traversal route from a hostile database.

Fixed

• InTransaction silently discarded commit errors. The result was unnamed, so the deferred

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}