Bump golang.org/x/sys and golang.org/x/text past their advisories

[jeremy]

Clears the three open code-scanning alerts on go.mod:

• Trivy #89 — CVE-2026-56852 in golang.org/x/text v0.34.0 (fixed in 0.39.0)
• Trivy #88 — CVE-2026-39824 in golang.org/x/sys v0.41.0 (fixed in 0.44.0)
• Scorecard #79 — Vulnerabilities: GO-2026-5024 (x/sys) and GO-2026-5970 (x/text)

Both modules are indirect, and govulncheck ./... under go1.26.6 (the declared toolchain) reports neither as reachable from this code — GO-2026-5024 is the Windows-only NewNTUnicodeString overflow. This is a scanner-clearing bump, not a fix for an exploitable path. Taken to the current releases (x/sys v0.48.0, x/text v0.42.0); x/sync moved with them through go mod tidy.

make check passes and govulncheck ./... is clean.

---

Summary by cubic

Bumps indirect golang.org/x/sys and golang.org/x/text past their advisories, clearing the three open code-scanning alerts on go.mod. govulncheck reports none of these are reachable from this code, so this is a scanner-clearing bump, not a fix for an exploitable path.

• x/sys goes from v0.41.0 to v0.48.0, x/text from v0.34.0 to v0.42.0.
• x/sync moves to v0.23.0 via go mod tidy.
• make check passes and govulncheck ./... is clean.

^{Written for commit 07075de. Summary will update on new commits.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-09T22:51:05.575210Z	07075de	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🟢 Approval recommended

The dependency versions are valid, Go-compatible, and consistently reflected in the module files.

Pull request overview

Updates indirect Go dependencies beyond known vulnerability advisories while remaining compatible with Go 1.26.6.

Changes:

• Upgrades x/sys, x/text, and related x/sync.
• Refreshes corresponding module checksums.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File summaries

File	Description
go.mod	Updates indirect dependency versions.
go.sum	Refreshes checksums for the resolved module graph.

Review details

• Files reviewed: 1/2 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.