Move golang.org/x/sys to v0.44.0, so the dependency set carries no open advisory (#175)

[iderex]

For #175, the VulnerabilitiesID class of the supply-chain analysis, which stands at one open alert on this board:

$ gh api 'repos/Flowfin/hub/code-scanning/alerts?state=open' --jq '.[] | select(.rule.id=="VulnerabilitiesID") | "\(.number)\t\(.state)\t\(.most_recent_instance.message.text)"'
10	open	score is 9: 1 existing vulnerabilities detected:
Warn: Project is vulnerable to: https://osv.dev/GO-2026-5024
Click Remediation section below to solve this issue

Read 2026-09-07. The advisory is filed against golang.org/x/sys below v0.44.0, and this tree requires v0.34.0 indirectly through chromedp:

$ curl -sS https://api.osv.dev/v1/vulns/GO-2026-5024 | python -c "import json,sys; d=json.load(sys.stdin); print(d['id'], d['summary']); [print(a['package']['name'], [r['events'] for r in a['ranges']]) for a in d['affected']]"
GO-2026-5024 Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows
golang.org/x/sys [[{'introduced': '0'}, {'fixed': '0.44.0'}]]
$ go mod why -m golang.org/x/sys
# golang.org/x/sys
flowfin.dev/hub/internal/keyboard
flowfin.dev/hub/internal/keyboard.test
github.com/chromedp/chromedp
github.com/gobwas/ws/wsutil
github.com/gobwas/pool/pbytes
golang.org/x/sys/unix

What changes

go get golang.org/x/sys@v0.44.0 and go mod tidy, and nothing else by hand. Two files move, and the OSV index answers differently for the two versions:

$ git diff --stat origin/main...HEAD
 go.mod | 4 ++--
 go.sum | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)
$ for v in 0.34.0 0.44.0; do printf "%s: " $v; curl -sS -X POST https://api.osv.dev/v1/query -d "{\"package\":{\"name\":\"golang.org/x/sys\",\"ecosystem\":\"Go\"},\"version\":\"$v\"}" | python -c "import json,sys; d=json.load(sys.stdin); print([v['id'] for v in d.get('vulns',[])])"; done
0.34.0: ['GO-2026-5024']
0.44.0: []

The affected symbol is NewNTUnicodeString under golang.org/x/sys/windows, which nothing in this tree calls, so the bump changes no behaviour here. What it changes is the requirement set the analysis reads.

The go directive moves from go 1.25 to go 1.25.0 in the same diff. That is not a choice: go mod tidy under the current toolchain rewrites the two-part form to the three-part one, and restoring go 1.25 and running tidy again reproduces the rewrite. I tried exactly that before committing.

What I ran

$ go build ./... ; echo "exit=$?"
exit=0
$ go test ./... -count=1
ok  	flowfin.dev/hub/internal/contrast	0.894s
(... 25 packages, all ok ...)
ok  	flowfin.dev/hub/manifest	0.894s
$ go run . gate
gate examined 14 of 14 legs.
  build                            passed
  test                             passed
  format                           passed
  editorconfig                     passed
  tests-reach-nothing              passed
  no-hardcoded-names               passed
  site-fetches-nothing-outside     passed
  site-links-resolve               passed
  coverage                         passed
  site-declares-its-language       passed
  install-address-is-answered      passed
  colour-stands-off-every-surface  passed
  page-matches-the-token-file      passed
  pr-hygiene                       passed

Run on Windows against bf9ba13. The harness did not run, which every gate run says of itself; no leg depends on it.

What this does not close by itself

The issue's Done-when is the class at zero open alerts on the Security tab, and that reading is produced by the next Scorecard run, which .github/workflows/scorecard.yml runs on push to main and never on a pull request. So this request does not carry a closing keyword. Once merged, the alert is re-read from the API after that run and pasted onto #175, and the issue closes on that reading and not on this merge.

The planning issue for the class on the operations tracker is erawright/operations#2175.