lgtm,codescanning
* SQL injection sinks from the `pg-promise` library are now recognized.