chore(deps): bump pgx/v5 from 5.7.5 to 5.9.2 in software_value

[mbani01]

Resolves 9 open critical Dependabot alerts on services/apps/git_integration/src/crowdgit/services/software_value/go.mod in one bump, replacing Dependabot PR #4049 (which couldn't touch the go directive):

Changes

• github.com/jackc/pgx/v5 5.7.5 → 5.9.2 — GHSA-9jj7-4m8r-rfcm (CVE-2026-33816), GHSA-xgrm-4fwx-7qm8 (CVE-2026-33815). 5.9.2 chosen over the advisory minimum 5.9.0 because 5.9.1 fixed a data-corruption regression in 5.9.0's SendBatch decode path.
• golang.org/x/crypto removed entirely — pgx 5.9.x dropped its x/crypto dependency, so go mod tidy eliminates it, resolving all 7 x/crypto GHSAs on this manifest (CVE-2026-46595, CVE-2026-42508, CVE-2026-39830..39834) by removal rather than bump to 0.52.0.
• go directive 1.24.0 → 1.25.0 (required by pgx 5.9.x; matches the golang:1.25-alpine builder in Dockerfile.git_integration).

Validation

• Bumps applied inside golang:1.25-alpine (the pinned builder image), no host toolchain.
• Full git-integration-dev image build green — compiles the software_value binary from this go.mod/go.sum on the real toolchain (repo CI does not gate this worker).

Dependabot PR #4049 can be closed once this merges. The remaining critical alerts on git_integration are pgx in vulnerability_scanner (#4057) and grpc (#4552, needs rebase).

[cursor]

PR Summary

Medium Risk
Upgrades the Postgres driver and Go toolchain for a production worker; behavior should be equivalent but connection/batch paths merit smoke validation after deploy.

Overview
Dependency and toolchain refresh for the software_value Go worker: bumps github.com/jackc/pgx/v5 from 5.7.5 to 5.9.2 (security fixes; 5.9.2 avoids a known 5.9.0 batch-decode regression), raises the module go directive to 1.25.0, and drops the pinned toolchain line.

Indirect modules are tidied: golang.org/x/crypto is removed from the manifest because pgx 5.9.x no longer pulls it in, and golang.org/x/sync / golang.org/x/text (plus stretchr/testify in go.sum) are updated to match the resolved graph. No application source changes—only go.mod / go.sum.

^{Reviewed by Cursor Bugbot for commit 9e24c83. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

• feat: add user authentication (CM-123)
• feat: add user authentication (IN-123)

Projects:

• CM: Community Data Platform
• IN: Insights

Please add a Jira issue key to your PR title.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[Copilot]

Pull request overview

Updates the software_value Go module to pgx/v5 5.9.2 and Go 1.25.

Changes:

• Removes x/crypto.
• Refreshes dependency checksums.
• Updates module metadata and versions.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
services/apps/git_integration/src/crowdgit/services/software_value/go.sum	Refreshes dependency checksums.
services/apps/git_integration/src/crowdgit/services/software_value/go.mod	Updates Go and pgx versions.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.