Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
github.com/ameerbrar/pgx/v4
pgx is a pure Go driver and toolkit for PostgreSQL.
pgx aims to be low-level, fast, and performant, while also enabling PostgreSQL-specific features that the standard database/sql
package does not allow for.
The driver component of pgx can be used alongside the standard database/sql
package.
The toolkit component is a related set of packages that implement PostgreSQL functionality such as parsing the wire protocol and type mapping between PostgreSQL and Go. These underlying packages can be used to implement alternative drivers, proxies, load balancers, logical replication clients, etc.
The current release of pgx v4
requires Go modules. To use the previous version, checkout and vendor the v3
branch.
package main
import (
"context"
"fmt"
"os"
"github.com/jackc/pgx/v4"
)
func main() {
conn, err := pgx.Connect(context.Background(), os.Getenv("DATABASE_URL"))
if err != nil {
fmt.Fprintf(os.Stderr, "Unable to connect to database: %v\n", err)
os.Exit(1)
}
defer conn.Close(context.Background())
var name string
var weight int64
err = conn.QueryRow(context.Background(), "select name, weight from widgets where id=$1", 42).Scan(&name, &weight)
if err != nil {
fmt.Fprintf(os.Stderr, "QueryRow failed: %v\n", err)
os.Exit(1)
}
fmt.Println(name, weight)
}
See the getting started guide for more information.
It is recommended to use the pgx interface if:
database/sql
are in use.The pgx interface is faster and exposes more features.
The database/sql
interface only allows the underlying driver to return or receive the following types: int64
,
float64
, bool
, []byte
, string
, time.Time
, or nil
. Handling other types requires implementing the
database/sql.Scanner
and the database/sql/driver/driver.Valuer
interfaces which require transmission of values in text format. The binary format can be substantially faster, which is what the pgx interface uses.
pgx supports many features beyond what is available through database/sql
:
log15adapter
, logrus
, zap
, and zerolog
inet
and cidr
PostgreSQL types to net.IPNet
and net.IP
database/sql.Scanner
and database/sql/driver.Valuer
interfaces for custom typesThere are three areas in particular where pgx can provide a significant performance advantage over the standard
database/sql
interface and other drivers:
For prepared queries with small sets of simple data types, all drivers will have have similar performance. However, if prepared statements aren't being explicitly used, pgx can have a significant performance advantage due to automatic statement preparation. pgx also can perform better when using PostgreSQL-specific data types or query batching. See go_db_bench for some database driver benchmarks.
database/sql
pq is exclusively used with database/sql
. go-pg does not use database/sql
at all. pgx supports database/sql
as well as
its own interface.
go-pg is a PostgreSQL client and ORM. It includes many features that traditionally sit above the database driver, such as ORM, struct mapping, soft deletes, schema migrations, and sharding support.
pgx is "closer to the metal" and such abstractions are beyond the scope of the pgx project, which first and foremost, aims to be a performant driver and toolkit.
pgx tests naturally require a PostgreSQL database. It will connect to the database specified in the PGX_TEST_DATABASE
environment
variable. The PGX_TEST_DATABASE
environment variable can either be a URL or DSN. In addition, the standard PG*
environment
variables will be respected. Consider using direnv to simplify environment variable
handling.
Connect to your PostgreSQL server and run:
create database pgx_test;
Connect to the newly-created database and run:
create domain uint64 as numeric(20,0);
Now, you can run the tests:
PGX_TEST_DATABASE="host=/var/run/postgresql database=pgx_test" go test ./...
In addition, there are tests specific for PgBouncer that will be executed if PGX_TEST_PGBOUNCER_CONN_STRING
is set.
pgx supports the same versions of Go and PostgreSQL that are supported by their respective teams. For Go that is the two most recent major releases and for PostgreSQL the major releases in the last 5 years. This means pgx supports Go 1.13 and higher and PostgreSQL 9.5 and higher.
pgx follows semantic versioning for the documented public API on stable releases. v4
is the latest stable major version.
pgx is the head of a family of PostgreSQL libraries. Many of these can be used independently. Many can also be accessed from pgx for lower-level control.
pgconn
is a lower-level PostgreSQL database driver that operates at nearly the same level as the C library libpq
.
pgxpool
is a connection pool for pgx. pgx is entirely decoupled from its default pool implementation. This means that pgx can be used with a different pool. or without any pool at all.
This is a database/sql
compatibility layer for pgx. pgx can be used as a normal database/sql
driver, but at any time, the native interface can be acquired for more performance or PostgreSQL specific functionality.
Over 70 PostgreSQL types are supported including uuid
, hstore
, json
, bytea
, numeric
, interval
, inet
, and arrays. These types support database/sql
interfaces and are usable outside of pgx. They are fully tested in pgx and pq. They also support a higher performance interface when used with the pgx driver.
pgproto3 provides standalone encoding and decoding of the PostgreSQL v3 wire protocol. This is useful for implementing very low level PostgreSQL tooling.
pglogrepl provides functionality to act as a client for PostgreSQL logical replication.
pgmock offers the ability to create a server that mocks the PostgreSQL wire protocol. This is used internally to test pgx by purposely inducing unusual errors. pgproto3 and pgmock together provide most of the foundational tooling required to implement a PostgreSQL proxy or MitM (such as for a custom connection pooler).
tern is a stand-alone SQL migration system.
pgerrcode contains constants for the PostgreSQL error codes.
Library for scanning data from a database into Go structs and more.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.