Prep for Postgres v18

CLAUDE.md

@@ -26,7 +26,7 @@ go test -v ./...
 ```
 
 - Tests use `testify` (`assert`/`require`).
-- Postgres store tests spin up a `postgres:14` container via `ory/dockertest` (`database/postgres/test`), so Docker must be running for the full suite. Memory store tests need nothing.
+- Postgres store tests spin up a `postgres:18` container via `ory/dockertest` (`database/postgres/test`), so Docker must be running for the full suite. Memory store tests need nothing.
 - Some stores (currency exchange/reserve/holder, messaging) are DynamoDB-backed; their tests use `database/dynamodb/test`.
 
 ### Building

database/postgres/client.go

@@ -62,11 +62,11 @@ func NewWithUsernameAndPassword(username, password, hostname, port, dbname strin
 	// IMPORTANT: Supported by Aurora Serverless clusters
 
 	// Use password based authentication
-	dsn := fmt.Sprintf("postgres://%s:%s@%s:%s/%s?sslmode=disable",
+	dsn := fmt.Sprintf("postgres://%s:%s@%s:%s/%s?sslmode=prefer",
 		username, password, hostname, port, dbname,
 	)
 
-	// TODO: either switch to IAM (non-serverless only) or enable SSL (download the db cert)
+	// TODO: either switch to IAM (non-serverless only) or use sslmode=verify-full (download the db cert)
 	// (https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraPostgreSQL.Security.html)
 
 	// Try to open a connection pool using the "pgx" driver (instead of "postgres")

database/postgres/test/util.go

@@ -18,7 +18,7 @@ import (
 
 const (
 	containerName     = "postgres"
-	containerVersion  = "14.24"
+	containerVersion  = "18.6"
 	containerAutoKill = 120 // seconds
 
 	port     = 5432