chore(deps): bump the gomod-patch-and-minor group across 1 directory with 3 updates

[dependabot]

Bumps the gomod-patch-and-minor group with 3 updates in the / directory: github.com/jackc/pgx/v5, modernc.org/sqlite and github.com/charmbracelet/x/ansi.

Updates github.com/jackc/pgx/v5 from 5.9.1 to 5.9.2

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.9.2 (April 18, 2026)

Fix SQL Injection via placeholder confusion with dollar quoted string literals (GHSA-j88v-2chj-qfwx)

SQL injection can occur when:

1. The non-default simple protocol is used.
2. A dollar quoted string literal is used in the SQL query.
3. That query contains text that would be would be interpreted outside as a placeholder outside of a string literal.
4. The value of that placeholder is controllable by the attacker.

e.g.

attackValue := `$tag$; drop table canary; --`
_, err = tx.Exec(ctx, `select $tag$ $1 $tag$, $1`, pgx.QueryExecModeSimpleProtocol, attackValue)

This is unlikely to occur outside of a contrived scenario.

Commits

• 0aeabbc Release v5.9.2
• 60644f8 Fix SQL sanitizer bugs with dollar-quoted strings and placeholder overflow
• a5680bc Merge pull request #2531 from dolmen-go/godoc-add-links
• e34e452 doc: Add godoc links
• 08c9bb1 Fix Stringer types encoded as text instead of numeric value in composite fields
• 96b4dbd Remove unstable test
• acf88e0 Merge pull request #2526 from abrightwell/abrightwell-min-proto
• 2f81f1f Update max_protocol_version and min_protocol_version defaults
• See full diff in compare view

Updates modernc.org/sqlite from 1.48.2 to 1.49.1

Commits

• fe575e4 doc.go: update SQLite version
• 3ccb9ca upgrade to SQLite 3.53.0
• See full diff in compare view

Updates github.com/charmbracelet/x/ansi from 0.11.6 to 0.11.7

Commits

• 6921c75 fix(ansi): width: always use grapheme finder for width calculation
• 266cf5a chore(deps): bump the all group across 1 directory with 2 updates (#836)
• ad0b1ae chore(scripts): update builds script to use codecov v6 and dependabot/fetch-m...
• b18aac2 chore(deps): bump golang.org/x/image in /vttest in the all group (#840)
• ffd2a07 chore(deps): bump golang.org/x/image in /mosaic in the all group (#839)
• 7664402 chore(deps): bump golang.org/x/sys in /input in the all group (#833)
• 44f725f chore(deps): bump github.com/mattn/go-runewidth (#838)
• ac9fd4b chore(deps): bump github.com/mattn/go-runewidth (#837)
• e969fb5 chore(deps): bump golang.org/x/sys in /termios in the all group (#828)
• acb1aa7 chore(deps): bump golang.org/x/crypto in /sshkey in the all group (#835)
• Additional commits viewable in compare view