go

A missing done-sentinel in logicalQuery.Select() causes an infinite loop when any boolean XPath expression evaluating to true is used as a node selector, affecting antchfx/xmlquery, htmlquery, and jsonquery.

A vacuous bounds check in github.com/jackc/pgproto3 v2.3.3 allows a malicious PostgreSQL server to crash any connected Go client process with a single malformed DataRow message.