build(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0

[dependabot]

Bumps golang.org/x/sys from 0.46.0 to 0.47.0.

Commits

• 9e7e939 cpu: handle vendor suffixes in parseRelease
• f6fb8a1 unix: use epoll_pwait rather than epoll_wait
• f3eeabf windows: avoid length overflow in NewNTString
• 3cb6647 unix: update glibc to 2.43
• c507910 windows: document safe usage of TrusteeValue
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 11, 2026, 8:57 AM ET / 12:57 UTC.

Summary
Bumps golang.org/x/sys from v0.46.0 to v0.47.0 in go.mod and updates the corresponding go.sum checksums.

Reproducibility: not applicable. this is routine dependency maintenance rather than a reported runtime defect.

Review metrics: 2 noteworthy metrics.

• Dependency diff: 2 files; 3 additions, 3 deletions. The branch is limited to the requested module-version and checksum update.
• Head checks: 10 passed, 0 failed. The exact PR head passed all reported build, test, lint, release, dependency, and security checks.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• none.

Next step before merge

• [P2] No repair is needed; this PR is ready for ordinary check-gated merge handling.

Security
Cleared: The official Go module and checksum-only update introduces no concrete supply-chain, permissions, secrets, lifecycle-hook, or security-boundary concern.

Review details

Best possible solution:

Merge the narrow dependency update through the repository’s normal exact-head, check-gated dependency workflow.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this is routine dependency maintenance rather than a reported runtime defect.

Is this the best way to solve the issue?

Yes; updating go.mod and go.sum is the narrow supported solution, and the exact PR head passes all reported repository checks.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against d91dcdb22870.

Label changes

Label changes:

• add P3: This is low-risk routine dependency maintenance with no reported user-facing regression.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The external-contributor proof gate does not apply to this Dependabot-authored PR; exact-head CI provides the appropriate validation evidence.

Label justifications:

• P3: This is low-risk routine dependency maintenance with no reported user-facing regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The external-contributor proof gate does not apply to this Dependabot-authored PR; exact-head CI provides the appropriate validation evidence.

Evidence reviewed

What I checked:

• Still needed on current main: Current main declares golang.org/x/sys v0.46.0, so the requested v0.47.0 update has not already landed. (go.mod:11, d91dcdb22870)
• Focused dependency diff: The branch changes only the direct module version and its two checksum records; git diff --check reports no whitespace errors. (go.mod:11, e8624ae7a947)
• Exact-head validation: The live PR is cleanly mergeable and all 10 reported checks passed, including tests, race tests, lint, dependency checks, snapshot release build, Docker, CodeQL, and secret scanning. (.github/workflows/ci.yml:70, e8624ae7a947)
• Upstream compatibility: The official golang.org/x/sys v0.47.0 tag resolves to upstream commit 9e7e939 and declares Go 1.25.0, below this repository's Go 1.26.5 requirement. (go.mod:3, e8624ae7a947)
• Dependency ownership history: The current module manifest was prepared by steipete in release commit 6dbb9e2, and steipete also merged the preceding x/sys v0.45.0 update. (go.mod:11, 6dbb9e2c5e8e)

Likely related people:

• steipete: Authored the current module manifest during v0.11.5 preparation and merged the recent golang.org/x/sys v0.45.0 dependency update. (role: recent dependency merger and release contributor; confidence: high; commits: 6dbb9e2c5e8e, ee7d7d866bfd; files: go.mod, go.sum)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[steipete]

Maintainer verification on exact head e8624ae7a947e14c9826ecca78ef1dd3993c72fd against current origin/main:

• go mod verify passed: all modules verified.
• GOWORK=off go test ./... passed across all packages.
• Cross-builds passed for GOOS=linux GOARCH=amd64 and GOOS=windows GOARCH=amd64.
• Real Unix integration example: GOWORK=off go run /private/tmp/discrawl-xsys-proof.go exercised the same nonblocking unix.Flock and PID liveness primitives used by Discrawl and reported contention=true pid_alive=true.
• .agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main --stream-engine-output reported no accepted/actionable findings (0.98 confidence).
• Existing exact-head hosted checks are green; no user-visible contract changed, so no changelog entry is needed.

No merge performed; land-ready.