Golang Crypto Vulnerability - Minor Package Update

[BrainBuzzer]

Describe the bug
We use this library in production for some critical workflows, and we want to ensure everything is secure. I understand that this doesn't affect the library in any way, but to comply with security requirements we need this. It seems in the #2189 this has been resolved already. But there is no minor update to the library to publish this, hence we can't use it. It would be great to get 5.7.2 update with fix for this vulnerability.

[drakkan]

You should ask your vendor scanner why they report such obvious false positives, when the public vulnerability database includes package and symbol information. govulncheck is an example of a scanner that won't report that false positive.

https://github.com/golang/vulndb/blob/71259c6095afe08ddb01e45142c674502056db6c/data/reports/GO-2024-3321.yaml#L8-L10

[jackc]

As mentioned above, this is a false positive for pgx. However, this update is included in the just released v5.7.2.