build(deps): Bump golang.org/x/sync from 0.21.0 to 0.22.0

[dependabot]

Bumps golang.org/x/sync from 0.21.0 to 0.22.0.

Commits

• 1eb64d4 semaphore: panic on negative weights
• See full diff in compare view

[lklimek]

Dependency Security Review — golang.org/x/sync 0.21.0 → 0.22.0

Verdict: SAFE ✅

Change Summary

Exactly one commit between the tags: 1eb64d4 "semaphore: panic on negative weights" — touching only semaphore/semaphore.go (+13/-4) and semaphore/semaphore_test.go (+34). It adds if n < 0 { panic("semaphore: n < 0") } guards to Weighted.Acquire, TryAcquire, and Release, plus doc-comment wording. Previously a negative weight silently corrupted the internal counter (inflating capacity, i.e. a latent unbounded-concurrency bug); now it fails loudly.

• errgroup is byte-identical — zero commits touch it.
• No new transitive dependencies — the /go.mod hash in go.sum is identical across both versions (9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=).
• Provenance verified — sum.golang.org returns exactly the two go.sum lines in this PR; the proxy .info origin hash matches the reviewed commit, tagged by Gopher Robot on go.googlesource.com. No supply-chain anomaly.

Vulnerability Scan

Source	Result
OSV.dev (both versions + all-versions query)	None, ever, for any version of golang.org/x/sync
GitHub Advisory DB (ecosystem=go)	Empty
Go vuln DB	No entry

Codebase Impact

go list -deps ./... resolves only golang.org/x/sync/errgroup into the tenderdash build — the unchanged package. semaphore is reachable solely via tools -> bufbuild/buf -> protocompile, a build-time codegen path never linked into the node binary. Our three errgroup call sites (internal/mempool/mempool.go:789, internal/inspect/inspect.go:103, scripts/keymigrate/migrate.go:637) use only Group/SetLimit/WithContext and are unaffected.

Functional impact on tenderdash: zero.

Note on the red govulncheck check

The failure here is not caused by this bump. It is GO-2026-5856 / CVE-2026-42505 — an ECH privacy leak in the Go stdlib crypto/tls@go1.26.4, fixed in 1.26.5. It reproduced identically on #1384, #1385 and #1386. The toolchain bump (#1395) has now been merged to v1.6-dev, so a rebase will pick it up and should clear this check.

_{🤖 Co-authored by Claudius the Magnificent AI Agent}

[lklimek]

@dependabot rebase

[lklimek]

Post-rebase CI status

Rebased onto v1.6-dev (head is now c0e594c). The Go toolchain bump landed as expected — go.mod is go 1.26.5 and the workflows pin 1.26.5, so GO-2026-5856 (crypto/tls ECH leak) is cleared.

However govulncheck is still red on a different, newly-published advisory — again unrelated to this bump:

Vulnerability #1: GO-2026-6061
  Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2
  transport server implementation in google.golang.org/grpc
  Found in: google.golang.org/grpc@v1.82.0
  Fixed in: google.golang.org/grpc@v1.82.1

15 reachable traces via abci/types/types.pb.go, abci/client/grpc_client.go, abci/server/grpc_server.go, internal/p2p/transport_mconn.go and cmd/priv_val_server/main.go.

The fix already has a PR open: #1392 (grpc 1.82.0 -> 1.82.1). Merging that to v1.6-dev first, then rebasing this PR again, should turn govulncheck green.

Not re-triggering a rebase here — this one is blocked on #1392, not on anything in the x/sync diff. The security verdict on golang.org/x/sync 0.21.0 -> 0.22.0 stands: SAFE.

_{🤖 Co-authored by Claudius the Magnificent AI Agent}

[lklimek]

@dependabot rebase