build(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0

[dependabot]

Bumps golang.org/x/sys from 0.45.0 to 0.46.0.

Commits

• d58dcfa unix: add GPIO constants and structs
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang.org/​x/​sys@​v0.45.0 ⏵ v0.46.0	+1

View full report

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed June 14, 2026, 9:19 AM ET / 13:19 UTC.

Summary
The PR updates the direct Go dependency golang.org/x/sys from v0.45.0 to v0.46.0 and refreshes its go.sum checksums.

Reproducibility: not applicable. this is a dependency maintenance PR rather than a user-reported bug. Source inspection, upstream diff review, and PR checks are the relevant validation signals.

Review metrics: 3 noteworthy metrics.

• Dependency files changed: 2 files changed, 3 additions, 3 deletions. The diff is limited to the Go module requirement and checksum entries.
• Upstream dependency delta: 1 upstream commit. The small golang/sys delta keeps compatibility and supply-chain review bounded.
• Status checks: 12 successful check runs. CI, CodeQL, secret scanning, Docker, release-check, deps, and Socket signals are already green on the PR head.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• none.

Next step before merge

• No automated repair is needed; this clean dependency bump should proceed through ordinary maintainer review and merge policy.

Security
Cleared: No concrete security or supply-chain concern was found in the dependency-only diff; the upstream delta is one golang/sys commit and PR security checks are green.

Review details

Best possible solution:

Merge the dependency bump through normal PR policy if maintainers are comfortable with the small upstream golang/sys delta and the already-green checks.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a dependency maintenance PR rather than a user-reported bug. Source inspection, upstream diff review, and PR checks are the relevant validation signals.

Is this the best way to solve the issue?

Yes; updating go.mod and go.sum is the narrowest maintainable path for this dependency bump, and current main does not already provide the requested v0.46.0 update.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against 1da64f583db6.

Label changes

Label justifications:

• P3: This is a routine dependency maintenance PR with a small module-file diff and no reported user-facing regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a Dependabot bot dependency PR, so the external contributor real-behavior-proof gate does not apply.

Evidence reviewed

What I checked:

• Current main still has the old dependency: Current main declares golang.org/x/sys v0.45.0, so the requested bump is not already implemented on main. (go.mod:11, 1da64f583db6)
• PR diff is narrow: The PR patch changes only go.mod and go.sum, with 3 insertions and 3 deletions replacing v0.45.0 requirement/checksums with v0.46.0. (go.mod:11, 984e1bd51863)
• x/sys usage surface is bounded: Source search found golang.org/x/sys imports only in the Unix and Windows sync-lock helpers, including unix.Flock and Windows process/lock calls. (internal/cli/sync_lock_unix.go:12, 1da64f583db6)
• Upstream dependency delta is small: The golang/sys v0.45.0...v0.46.0 comparison is one upstream commit, d58dcfa8a74514c0ef0fc401259156c5e2fc9ff5, adding Linux GPIO constants and structs. (d58dcfa8a745)
• GitHub reports clean mergeability and green checks: GitHub reports the PR mergeable, with successful ci, CodeQL, secret scanning, Docker, release-check, deps, and Socket checks. (984e1bd51863)
• Feature-history provenance: git blame ties the current x/sys declaration and related sync-lock implementation to the v0.11.0 release commit by Peter Steinberger. (go.mod:11, 37a9338fdcdb)

Likely related people:

• Peter Steinberger: git blame ties the current go.mod x/sys declaration and x/sys-backed sync-lock helpers to the v0.11.0 release commit. (role: introduced dependency and adjacent implementation; confidence: high; commits: 37a9338fdcdb; files: go.mod, go.sum, internal/cli/sync_lock_unix.go)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.