build(deps): Bump golang.org/x/term from 0.44.0 to 0.45.0

[dependabot]

Bumps golang.org/x/term from 0.44.0 to 0.45.0.

Commits

• 9f69229 go.mod: update golang.org/x dependencies
• See full diff in compare view

[lklimek]

Dependency Security Review — golang.org/x/term 0.44.0 → 0.45.0

Verdict: SAFE to merge.

What actually changed

x/term v0.44.0→v0.45.0 contains zero Go code changes — the single upstream commit touches only go.mod/go.sum to bump x/sys. All 10 .go files are byte-identical. The entire substance of this PR is the transitive golang.org/x/sys v0.46.0 → v0.47.0 bump (5 commits, all via Gerrit with Google reviewers + LUCI TryBot):

Commit	Change	Relevance here
9e7e939d	cpu: handle vendor suffixes in parseRelease	Correctness fix, bounds-safe. Unused.
f6fb8a1e	unix: use epoll_pwait rather than epoll_wait	Functionally equivalent; only a caveat for seccomp allowlists. unix.EpollWait not called here.
f3eeabfc	windows: avoid length overflow in NewNTString (golang/go#80103)	The one security-shaped change — uint16 length truncation for strings > 0xFFFF (CWE-190/CWE-681), now rejected with EINVAL. Windows-only, NewNTString unused here.
3cb66475	unix: update glibc to 2.43	Regenerated constants (MS_NOUSER sign fix). Unused.
c507910b	windows: document TrusteeValue	Docs only.

Known vulnerabilities

Module	OSV	GitHub Advisory DB	Go vuln DB
golang.org/x/term @ 0.44.0 & 0.45.0	none ever	none ever	none
golang.org/x/sys @ 0.46.0 & 0.47.0	only CVE-2022-29526 (fixed 2022)	same	GO-2022-0493, same

No advisory applies to either the old or new versions. Note f3eeabfc was filed upstream as an ordinary bug, not a security issue — an effectively unregistered security-relevant fix, invisible to govulncheck/OSV. Impact for this repo is nil.

Codebase impact

• x/term — exactly 2 call sites, both in cmd/tenderdash/commands/gen_node_key.go (term.IsTerminal, term.ReadPassword for the interactive BIP39 passphrase prompt). CLI-only, not on any network/consensus path. Unaffected (no code change).
• x/sys — single site, libs/os/perms.go (unix.Access, unix.R_OK/W_OK/X_OK). Untouched by all 5 commits.
• None of the changed APIs (NewNTString, TrusteeValue*, EpollWait, cpu.parseRelease) is referenced anywhere in the repo. No breaking changes.

Supply chain

go mod verify → all modules verified; both new h1:/go.mod hashes match sum.golang.org exactly; go mod tidy produces no diff.

CI note — the govulncheck failure is not caused by this PR

The gating govulncheck job fails with GO-2026-5856 / CVE-2026-42505 (Encrypted Client Hello privacy leak in crypto/tls@go1.26.4) — a Go toolchain issue, already fixed on v1.6-dev by #1395 (Go 1.26.5). This PR is behind base; requesting @dependabot rebase next so it picks that up. All other 15 checks pass.

Heads-up: v1.6-dev itself currently also trips GO-2026-6061 / GHSA-hrxh-6v49-42gf (google.golang.org/grpc@v1.82.0, reachable via abci/types/types.pb.go) — that is the only genuine reachable vulnerability in the tree, and #1392 (grpc → v1.82.1) fixes it. Worth prioritising.

Also: #1384 (standalone x/sys 0.46.0→0.47.0) is subsumed by this PR and can be closed once this merges.

_{🤖 Co-authored by Claudius the Magnificent AI Agent}

[lklimek]

@dependabot rebase

[lklimek]

@dependabot rebase

[lklimek]

@dependabot rebase

[lklimek]

@dependabot rebase

[dependabot]

Looks like golang.org/x/term is up-to-date now, so this is no longer needed.