Bump the go-dependencies group across 1 directory with 2 updates

[dependabot]

Bumps the go-dependencies group with 2 updates in the / directory: github.com/jackc/pgx/v5 and github.com/riverqueue/river/rivershared.

Updates github.com/jackc/pgx/v5 from 5.9.1 to 5.9.2

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.9.2 (April 18, 2026)

Fix SQL Injection via placeholder confusion with dollar quoted string literals (GHSA-j88v-2chj-qfwx)

SQL injection can occur when:

1. The non-default simple protocol is used.
2. A dollar quoted string literal is used in the SQL query.
3. That query contains text that would be would be interpreted outside as a placeholder outside of a string literal.
4. The value of that placeholder is controllable by the attacker.

e.g.

attackValue := `$tag$; drop table canary; --`
_, err = tx.Exec(ctx, `select $tag$ $1 $tag$, $1`, pgx.QueryExecModeSimpleProtocol, attackValue)

This is unlikely to occur outside of a contrived scenario.

Commits

• 0aeabbc Release v5.9.2
• 60644f8 Fix SQL sanitizer bugs with dollar-quoted strings and placeholder overflow
• a5680bc Merge pull request #2531 from dolmen-go/godoc-add-links
• e34e452 doc: Add godoc links
• 08c9bb1 Fix Stringer types encoded as text instead of numeric value in composite fields
• 96b4dbd Remove unstable test
• acf88e0 Merge pull request #2526 from abrightwell/abrightwell-min-proto
• 2f81f1f Update max_protocol_version and min_protocol_version defaults
• See full diff in compare view

Updates github.com/riverqueue/river/rivershared from 0.34.0 to 0.35.0

Release notes

Sourced from github.com/riverqueue/river/rivershared's releases.

v0.35.0

Changed

• Ignore errors like tls: failed to send closeNotify alert (but connection was closed anyway) when closing listeners. [PR #1216](riverqueue/river#1216).

Fixed

• Fixed leader election to track explicit database-issued leadership terms, reducing handoff flakiness and same-client reacquisition edge cases while making reelection and resign target the current leadership lease instead of a stale one. [PR #1213](riverqueue/river#1213).

Changelog

Sourced from github.com/riverqueue/river/rivershared's changelog.

[0.35.0] - 2026-04-18

Changed

• Ignore errors like tls: failed to send closeNotify alert (but connection was closed anyway) when closing listeners. [PR #1216](riverqueue/river#1216).

Fixed

• Fixed leader election to track explicit database-issued leadership terms, reducing handoff flakiness and same-client reacquisition edge cases while making reelection and resign target the current leadership lease instead of a stale one. [PR #1213](riverqueue/river#1213).

Commits

• 0a60446 Prepare release 0.35.0 (#1217)
• b8165b8 Ignore TLS error when closing listener from the notifier (#1216)
• e3fc3c2 refactor leader election around DB-issued terms (#1213)
• 6543473 Rename baseservice.NowUTC to Now (#1215)
• 4efc979 stabilize client reindexer test (#1212)
• 5f19fc7 Make leaderResignedChan buffered to protect against hang (#1205)
• 3c62677 Reindexer: Mock reindex function to reduce parallel contention (#1210)
• 4155660 fix race condition in batch completer stats (#1208)
• 27259a1 Bump the go-dependencies group across 3 directories with 3 updates (#1209)
• 9eaea33 Guarantee output order in batch insertion example (#1206)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions