deps(deps): bump golang.org/x/sys from 0.41.0 to 0.42.0

[dependabot]

Bumps golang.org/x/sys from 0.41.0 to 0.42.0.

Commits

• eaaaaee windows/registry: correct KeyInfo.ModTime calculation
• 942780b cpu: darwin/arm64 feature detection
• acef388 unix/linux: Prefixmsg and PrefixCacheinfo structs
• 3687fbd cpu: better defaults on darwin ARM64
• 48062e9 plan9: change Note to alias syscall.Note
• 4f23f80 windows: change Signal to alias syscall.Signal
• 7548802 all: upgrade go directive to at least 1.25.0 [generated]
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dlevy-msft-sql]

@dependabot recreate

[dlevy-msft-sql]

@copilot Fix the failing GitHub Actions job 67263409668 in run 23153971419 (PR #716) in microsoft/go-sqlcmd.

What’s failing

The Security Scanning workflow (.github/workflows/security.yml) runs govulncheck ./... using Go 1.25.7 and fails with exit code 3 due to standard library vulnerabilities:

• GO-2026-4899 (stdlib os) — found in os@go1.25.7, fixed in os@go1.25.8
  • Example trace: pkg/sqlcmd/sqlcmd.go:331:25 sqlcmd.Sqlcmd.ConnectDb → user.Current → os.ReadDir
• GO-2026-4601 (stdlib net/url) — found in net/url@go1.25.7, fixed in net/url@go1.25.8
  • Example traces:
    • pkg/sqlcmd/azure_auth.go:30:33 sqlcmd.GetTokenBasedConnection → url.Parse
    • pkg/sqlcmd/sqlcmd.go:316:23 sqlcmd.Sqlcmd.ConnectDb → sql.OpenDB → url.ParseRequestURI
    • internal/http/http.go:10:24 http.UrlExists → http.Head → url.URL.Parse

These are not application-code bugs; they come from the Go standard library. The fix is to upgrade the Go toolchain used by CI (and the module’s go version) to Go 1.25.8 or newer.

Required changes

1. In .github/workflows/security.yml, update the actions/setup-go@v6 step from:

go-version: '1.25.7'

to:

go-version: '1.25.8'

2. In go.mod, update:

go 1.25.7

to:

go 1.25.8

3. Run go mod tidy (with Go 1.25.8+) and commit any resulting go.mod / go.sum changes.

Acceptance criteria

• The Security Scanning / Go Vulnerability Check job passes on PR deps(deps): bump golang.org/x/sys from 0.41.0 to 0.42.0 #716.
• govulncheck ./... no longer reports stdlib vulns fixed in Go 1.25.8.
• All existing tests/build steps continue to pass.

[Copilot]

@dlevy-msft-sql I've opened a new pull request, #717, to work on those changes. Once the pull request is ready, I'll request review from you.

[dlevy-msft-sql]

@dependabot recreate

[dlevy-msft-sql]

@dependabot rebase

[dependabot]

Looks like this PR is already up-to-date with main! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[dlevy-msft-sql]

@copilot Use this prompt (paste it into Copilot Chat / an agent) to update the workflow:

In the microsoft/go-sqlcmd repo, update the GitHub Actions workflow .github/workflows/security.yml so that it uses the Go version from go.mod (source of truth) instead of a hard-coded patch version.

Specifically, in the govulncheck job, replace the actions/setup-go@v6 step that currently sets go-version: '1.25.7' with go-version-file: go.mod. Keep the rest of the workflow unchanged.

Then ensure the workflow still runs on push/pull_request to main, on the weekly cron, and via workflow_dispatch.

[Copilot]

@dlevy-msft-sql I've opened a new pull request, #721, to work on those changes. Once the pull request is ready, I'll request review from you.

[dlevy-msft-sql]

@dependabot rebase

[dependabot]

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[dlevy-msft-sql]

@dependabot recreate