Skip to content

fix: update postgrex to v0.22.4 - #2078

Merged
leandrocp merged 3 commits into
mainfrom
lp-up-postgrex-cve
Aug 7, 2026
Merged

fix: update postgrex to v0.22.4#2078
leandrocp merged 3 commits into
mainfrom
lp-up-postgrex-cve

Conversation

@leandrocp

Copy link
Copy Markdown
Member

Diff

https://hex.pm/diff/postgrex/0.22.3..0.22.4

CVE

Advisories:
postgrex 0.22.3 - EEF-CVE-2026-66838 (MEDIUM)
aka: CVE-2026-66838, GHSA-3gww-3f36-2388
SQL injection via the :comment option in Postgrex.stream/4
https://osv.dev/vulnerability/EEF-CVE-2026-66838

### Diff
https://hex.pm/diff/postgrex/0.22.3..0.22.4

### CVE
Advisories:
  postgrex 0.22.3 - EEF-CVE-2026-66838 (MEDIUM)
    aka: CVE-2026-66838, GHSA-3gww-3f36-2388
    SQL injection via the :comment option in Postgrex.stream/4
    https://osv.dev/vulnerability/EEF-CVE-2026-66838
@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

CRAP Score Report

Summary: files=229 functions=1141 scored=1141 worst_score=15944.76

** (Mix) CRAP threshold failed: max_score=30.00
High scores: 29
  lib/extensions/postgres_cdc_rls/subscription_manager.ex Extensions.PostgresCdcRls.SubscriptionManager.handle_info/2 score=37.16
  lib/realtime/adapters/postgres/oid_database.ex Realtime.Adapters.Postgres.OidDatabase.name_for_type_id/1 score=15944.76
  lib/realtime/application.ex Realtime.Application.setup_region_mapping/0 score=47.11
  lib/realtime/nodes.ex Realtime.Nodes.default_region_mapping/1 score=157.20
  lib/realtime/operations.ex Realtime.Operations.rebalance/0 score=42.00
  lib/realtime/operations.ex Realtime.Operations.kill_connections_to_tenant_id/2 score=90.00
  lib/realtime/tenants/connect.ex Realtime.Tenants.Connect.handle_info/2 score=40.25
  lib/realtime_web/channels/auth/jwt_verification.ex RealtimeWeb.JwtVerification.generate_signer/3 score=31.09
  lib/realtime_web/channels/realtime_channel.ex RealtimeWeb.RealtimeChannel.handle_info/2 score=62.45
  lib/realtime_web/channels/realtime_channel.ex RealtimeWeb.RealtimeChannel.handle_in/3 score=132.36
  lib/realtime_web/dashboard/feature_flags.ex RealtimeWeb.Dashboard.FeatureFlags.handle_event/3 score=702.00
  lib/realtime_web/dashboard/node_info.ex RealtimeWeb.Dashboard.NodeInfo.fetch_node_data/2 score=42.00
  lib/realtime_web/dashboard/recon_trace.ex RealtimeWeb.Dashboard.ReconTrace.handle_event/3 score=552.00
  lib/realtime_web/dashboard/recon_trace.ex RealtimeWeb.Dashboard.ReconTrace.handle_info/2 score=210.00
  lib/realtime_web/dashboard/recon_trace.ex RealtimeWeb.Dashboard.ReconTrace.render_value/2 score=42.00
  lib/realtime_web/dashboard/recon_trace.ex RealtimeWeb.Dashboard.ReconTrace.load_module_functions/1 score=42.00
  lib/realtime_web/dashboard/recon_trace.ex RealtimeWeb.Dashboard.ReconTrace.parse_and_start/2 score=110.00
  lib/realtime_web/dashboard/recon_trace.ex RealtimeWeb.Dashboard.ReconTrace.format_value/1 score=702.00
  lib/realtime_web/dashboard/recon_trace.ex RealtimeWeb.Dashboard.ReconTrace.sort_entries/2 score=42.00
  lib/realtime_web/dashboard/recon_trace.ex RealtimeWeb.Dashboard.ReconTrace.parse_module/1 score=90.00
  lib/realtime_web/dashboard/sql_inspector.ex RealtimeWeb.Dashboard.SqlInspector.handle_event/3 score=72.00
  lib/realtime_web/dashboard/sql_inspector.ex RealtimeWeb.Dashboard.SqlInspector.execute_read_only/1 score=72.00
  lib/realtime_web/dashboard/sql_inspector.ex RealtimeWeb.Dashboard.SqlInspector.mask_sensitive_columns/1 score=42.00
  lib/realtime_web/dashboard/sql_inspector.ex RealtimeWeb.Dashboard.SqlInspector.compare_cells/2 score=42.00
  lib/realtime_web/dashboard/sql_inspector.ex RealtimeWeb.Dashboard.SqlInspector.format_cell/1 score=72.00
  lib/realtime_web/dashboard/tenant_migrations.ex RealtimeWeb.Dashboard.TenantMigrations.handle_info/2 score=118.65
  lib/realtime_web/dashboard/tenant_migrations.ex RealtimeWeb.Dashboard.TenantMigrations.run_pgdelta/2 score=61.39
  lib/realtime_web/live/inspector_live/event_log_component.ex RealtimeWeb.InspectorLive.EventLogComponent.category_variant/1 score=50.88
  lib/realtime_web/live/status_live/index.ex RealtimeWeb.StatusLive.Index.handle_event/3 score=42.00

@leandrocp
leandrocp merged commit d80141d into main Aug 7, 2026
39 checks passed
@leandrocp
leandrocp deleted the lp-up-postgrex-cve branch August 7, 2026 16:41
@realtime-release-bot

Copy link
Copy Markdown

🎉 This PR is included in version 2.124.2 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants