Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
gopkg.in/jackc/pgx.v2
Pgx is a pure Go database connection library designed specifically for PostgreSQL. Pgx is different from other drivers such as pq because, while it can operate as a database/sql compatible driver, pgx is primarily intended to be used directly. It offers a native interface similar to database/sql that offers better performance and more features.
Pgx supports many additional features beyond what is available through database/sql.
Pgx performs roughly equivalent to pq and go-pg for selecting a single column from a single row, but it is substantially faster when selecting multiple entire rows (6893 queries/sec for pgx vs. 3968 queries/sec for pq -- 73% faster).
See this gist for the underlying benchmark results or checkout go_db_bench to run tests for yourself.
Import the github.com/jackc/pgx/stdlib
package to use pgx as a driver for
database/sql. It is possible to retrieve a pgx connection from database/sql on
demand. This allows using the database/sql interface in most places, but using
pgx directly when more performance or PostgreSQL specific features are needed.
pgx includes extensive documentation in the godoc format. It is viewable online at godoc.org.
pgx supports multiple connection and authentication types. Setting up a test environment that can test all of them can be cumbersome. In particular, Windows cannot test Unix domain socket connections. Because of this pgx will skip tests for connection types that are not configured.
To setup the normal test environment, first install these dependencies:
go get github.com/jackc/fake
go get github.com/shopspring/decimal
go get gopkg.in/inconshreveable/log15.v2
Then run the following SQL:
create user pgx_md5 password 'secret';
create user " tricky, ' } "" \ test user " password 'secret';
create database pgx_test;
create user pgx_replication with replication password 'secret';
Connect to database pgx_test and run:
create extension hstore;
Next open conn_config_test.go.example and make a copy without the .example. If your PostgreSQL server is accepting connections on 127.0.0.1, then you are done.
Complete the normal test environment setup and also do the following.
Run the following SQL:
create user pgx_none;
create user pgx_pw password 'secret';
Add the following to your pg_hba.conf:
If you are developing on Unix with domain socket connections:
local pgx_test pgx_none trust
local pgx_test pgx_pw password
local pgx_test pgx_md5 md5
If you are developing on Windows with TCP connections:
host pgx_test pgx_none 127.0.0.1/32 trust
host pgx_test pgx_pw 127.0.0.1/32 password
host pgx_test pgx_md5 127.0.0.1/32 md5
Add a replication user:
create user pgx_replication with replication password 'secret';
Add a replication line to your pg_hba.conf:
host replication pgx_replication 127.0.0.1/32 md5
Change the following settings in your postgresql.conf:
wal_level=logical
max_wal_senders=5
max_replication_slots=5
pgx follows semantic versioning for the documented public API on stable releases. Branch v2
is the latest stable release. master
can contain new features or behavior that will change or be removed before being merged to the stable v2
branch (in practice, this occurs very rarely).
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.