[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/ClickHouse/ch-go	v0.61.5 → v0.65.0

---

CVE-2025-1386- Query smuggling in ch-go library

CVE-2025-1386 / GHSA-m454-3xv7-qj85

More information

Details

Impact

When using the ch-go library, under a specific condition when the query includes a large, uncompressed malicious external data, it is possible for an attacker in control of such data to smuggle another query packet into the connection stream.

Patches

If you are using ch-go library, we recommend you to update to at least version 0.65.0.

Credit

This issue was found by lixts and reported through our bugcrowd program.

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/ClickHouse/ch-go/security/advisories/GHSA-m454-3xv7-qj85
• https://nvd.nist.gov/vuln/detail/CVE-2025-1386
• https://github.com/ClickHouse/ch-go/commit/0e835663df32b09b828528c07a5507686e6d975e
• https://pkg.go.dev/vuln/GO-2025-3603
• https://github.com/advisories/GHSA-m454-3xv7-qj85

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

ClickHouse/ch-go (github.com/ClickHouse/ch-go)

v0.65.0

Compare Source

What's Changed

• perf(compress.writer): allow creating a compress.writer with custom supported methods by @​pablomatiasgomez in #​1039
• perf(compressor): reduce memory by using new compression code by @​SpencerTorres in #​1040
• fix(compressor): fixing an overflow that could potentially smuggle query in from data by @​santrancisco in #​1041

Breaking change if you were manually using the Writer from the compress package.

New Contributors

• @​pablomatiasgomez made their first contribution in #​1039
• @​santrancisco made their first contribution in #​1041

Full Changelog: ClickHouse/ch-go@v0.64.1...v0.65.0

v0.64.1

Compare Source

What's Changed

• docs: add LowCardinality(String) example by @​ernado in #​1036
• fix: expose underlying string column for json by @​SpencerTorres in #​1037

Full Changelog: ClickHouse/ch-go@v0.64.0...v0.64.1

v0.64.0

Compare Source

What's Changed

• ci: upd version list by @​ernado in #​938
• feat: col_datetime add appendraw method by @​lzf575 in #​957
• ci: update version list by @​ernado in #​1035
• feat: json string column by @​SpencerTorres in #​1034

New Contributors

• @​lzf575 made their first contribution in #​957
• @​SpencerTorres made their first contribution in #​1034

Full Changelog: ClickHouse/ch-go@v0.63.1...v0.64.0

v0.63.1

Compare Source

What's Changed

• fix(proto): properly handle Enum8 and Enum8(...) in conflicts checker by @​tdakkota in #​438

Full Changelog: ClickHouse/ch-go@v0.63.0...v0.63.1

v0.63.0

Compare Source

What's Changed

• feat(proto): add go1.23 iterators over ColMap and ColArr by @​tdakkota in #​406
• Fix client default read timeout setting by @​kobrineli in #​415
• chore: use stable/oldstable versions of Go to test by @​tdakkota in #​426
• feat(ch): use writev when possible by @​tdakkota in #​413
• perf(proto): improve ColStr writing performance for small strings by @​tdakkota in #​428
• implement Exception.Unwrap method by @​husio in #​342
• feat: infer Decimal by @​serprex in #​434
• Fix typo in README by @​serprex in #​431
• perf: use strings.Cut, also strings.IndexByte more by @​serprex in #​432
• perf(col_low_cardinality): use small value. by @​zdyj3170101136 in #​425
• fix: infer Nullable/Array/LowCardinality with reflection by @​serprex in #​433
• fix: column type conflicts by @​serprex in #​435

New Contributors

• @​kobrineli made their first contribution in #​415
• @​husio made their first contribution in #​342
• @​serprex made their first contribution in #​434
• @​zdyj3170101136 made their first contribution in #​425

Full Changelog: ClickHouse/ch-go@v0.62.0...v0.63.0

v0.62.0

Compare Source

What's Changed

• feat(compress): add lz4hc support by @​tomershafir in #​401
• fix(query): always close client.conn in cancelQuery (issue #​405) by @​charredlot in #​409

New Contributors

• @​tomershafir made their first contribution in #​401
• @​charredlot made their first contribution in #​409

Full Changelog: ClickHouse/ch-go@v0.61.5...v0.62.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: apps/api/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 2 additional dependencies were updated

Details:

Package	Change
github.com/hashicorp/go-version	v1.6.0 -> v1.7.0
github.com/pierrec/lz4/v4	v4.1.21 -> v4.1.22