build(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0

[dependabot]

Bumps golang.org/x/sys from 0.46.0 to 0.47.0.

Commits

• 9e7e939 cpu: handle vendor suffixes in parseRelease
• f6fb8a1 unix: use epoll_pwait rather than epoll_wait
• f3eeabf windows: avoid length overflow in NewNTString
• 3cb6647 unix: update glibc to 2.43
• c507910 windows: document safe usage of TrusteeValue
• See full diff in compare view

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 12, 2026, 1:36 PM ET / 17:36 UTC.

Summary
This PR updates the direct Go dependency golang.org/x/sys from v0.46.0 to v0.47.0 in go.mod and go.sum.

Reproducibility: not applicable. This PR is dependency maintenance rather than a reported behavioral defect.

Review metrics: 2 noteworthy metrics.

• Patch scope: 2 files, 3 added, 3 removed. The branch is limited to one direct module version and its matching checksum entries.
• Upstream delta: 5 upstream commits. The version increment is small and its official upstream contents are identifiable and reviewable.

Merge readiness
Overall: 🦞 diamond lobster
Proof: 🦞 diamond lobster
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Risk before merge

• [P1] The latest head still has an in-progress macOS Go check, so maintainers should wait for the required exact-head checks to settle before merging.

Maintainer options:

1. Decide the mitigation before merge
   Merge the exact reviewed dependency-only head through the normal maintainer path once all required platform checks complete successfully.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

• [P2] No repair or product decision is needed; the PR only needs routine maintainer handling after the remaining required check completes.

Security
Cleared: The branch advances an official golang.org module tag and checksums without adding package sources, workflows, permissions, lifecycle hooks, or downloaded executables.

Review details

Best possible solution:

Merge the exact reviewed dependency-only head through the normal maintainer path once all required platform checks complete successfully.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR is dependency maintenance rather than a reported behavioral defect.

Is this the best way to solve the issue?

Yes. Updating only the declared module version and matching checksums is the narrowest maintainable solution, with existing platform CI providing the appropriate validation.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against fc31bc798547.

Label changes

Label justifications:

• P3: This is a low-risk routine dependency update with a minimal, dependency-only diff and no demonstrated user-facing urgency.
• rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot-authored dependency-only PR is exempt from the external-contributor real-setup proof gate; exact-head platform checks are the appropriate evidence.

Evidence reviewed

What I checked:

• Current main does not contain the update: Current main still declares golang.org/x/sys v0.46.0, while the exact PR head declares v0.47.0, so the requested change remains necessary. (go.mod:14, fc31bc798547)
• Exact-head patch is narrowly scoped: The branch changes only go.mod and go.sum, with three additions and three deletions limited to the module version and matching checksums. (go.mod:14, 8cecdad1eb6e)
• Dependency has a concrete current-main use: The repository imports golang.org/x/sys/windows for Windows child-process job control, so platform compilation is relevant validation for this bump. (internal/cli/git_process_windows.go:11, fc31bc798547)
• Feature-history provenance: Git blame and log attribute the direct dependency declaration and Windows process-control implementation to commit cc14a88 by vincentkoc. (internal/cli/git_process_windows.go:11, cc14a88c49b4)
• Official upstream provenance: The official golang/sys repository resolves tag v0.47.0 to commit 9e7e939dcafac07e8ab4cffa6e5fc74908413f00 and reports five reviewed upstream commits since v0.46.0. (9e7e939dcafa)
• Latest live check state: The exact head is mergeable; Ubuntu, Docker, secret scanning, and Socket checks succeeded, CodeQL completed neutrally, and the macOS Go check remains in progress. (8cecdad1eb6e)

Likely related people:

• vincentkoc: Current-main history shows Vincent Koc introduced and recently maintained both the direct x/sys declaration and its Windows process-control call site. (role: recent area contributor; confidence: high; commits: cc14a88c49b4; files: go.mod, go.sum, internal/cli/git_process_windows.go)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (3 earlier review cycles)

• reviewed 2026-07-09T18:48:26.605Z sha 2395079 :: needs maintainer review before merge. :: none
• reviewed 2026-07-12T10:56:27.486Z sha 71175a7 :: needs maintainer review before merge. :: none
• reviewed 2026-07-12T11:00:50.411Z sha 71175a7 :: needs maintainer review before merge. :: none

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang.org/​x/​sys@​v0.46.0 ⏵ v0.47.0

View full report