[kwisatzh]

Summary

Signed and DCO-signed replacement for Dependabot #89, carrying pgx v5.11.0 to v5.12.0 and go.yaml.in/yaml/v3 v3.0.5 to v3.0.6.

Claude's pre-merge check: PASS on final head d1981cd4, forwarded by Vijay on November 10, 2026. The reviewed database-runtime gate is satisfied. No release, tag or settings changes; this ships with the next fleetdiff release.

Runtime Review Before Re-pinning

• Read the v5.12.0 changelog and pgconn/pgproto3/pgtype source delta. Authentication completion and required SCRAM channel binding are hardened. SCRAM preserves the PostgreSQL Unicode-3.2 raw-password fallback. New client-certificate policy defaults preserve the existing behavior.
• The adapter still requires verify-full TLS for remote hosts, constructs its own verified TLS configuration and removes fallbacks. All inherited PG* settings are stripped, including new PGSSLCERTMODE, now explicitly covered by a regression. URL parameters remain allowlisted; home pgpass/service/certificate files cannot supply credentials. Credentials remain limited to the dedicated environment variable or an owned 0600 file.
• pgproto3 is unchanged. pgtype changes concern codecs, bounds and allocation paths, not outbound networking. pgpassfile and pgservicefile versions/parsers are unchanged; pgconn's Windows service-file default lookup changes do not add a credential source through this adapter.
• Production go list -deps comparison: 267 packages before and after, no added/removed package, the same eight pgx runtime packages and two existing jackc helper packages. No new dial/lookup path; DialContext and LookupHost remain the approved adapter/pgconn boundary.
• The pre-pin production guard failed only on the eight expected module-pin mismatches. No new jackc package or forbidden network call appeared.
• govulncheck v1.6.0 on Go 1.26.10: No vulnerabilities found.

Database Verification Before Re-pinning

The single hosted pre-pin review job passed:
https://github.com/llm-measurement/fleetdiff/actions/runs/42815668200/job/129828005482

It verifies real TLS positive/negative cases, credential permissions/source isolation, read-only snapshots and byte-identical native exports against the canonical psql recipe across formats, routing, usage details, daily counters and request tags. It ran 76 tests with seven documented opt-in skips, including the multi-GB 10M-row case.

That review ran with the old capability pin still in place. The ordinary CI job therefore retained the expected pin-only failure; it was not relabeled as a passing run. The temporary branch-only review job was then removed and the normal CI workflow restored byte for byte. All signed review and main-refresh commits remain in history; no rewrite.

Final Delta and Checks

Only after the above passed, update the exact eight-package module pin and the release SBOM expectation to v5.12.0. Keep the capability allowlist unchanged.

Local post-pin network guard, full Go tests and go vet pass. Normal hosted checks on the final PR head must pass before merge. Local Docker and cluster checks were not run; the real database oracle ran on GitHub-hosted infrastructure, leaving the active local testbed untouched.

Security Advisories And Reviewed Reachability

pgx v5.12.0 fixes GHSA-j38q-h3ph-jjpq and GHSA-95fj-3fxw-g62g. Both are high-severity advisories published in the pgx repository on October 31, 2026.

Claude's reviewed fleetdiff v0.14.0 path reaches neither: it never imports the pgx root package, so it cannot call SendBatch; it never sets require_auth or channel_binding; and remote hosts require verify-full. The URL allowlist is unchanged. neutralConfig strips every inherited PG* variable by prefix, and the replacement verify-full TLSConfig carries no client certificate, so the new sslcertmode default has no certificate to send. The PGSSLCERTMODE isolation regression is retained.