security(scan): Go 1.26.5 (crypto/tls CVE), x/sys bump, Slowloris timeouts

go.mod

@@ -1,6 +1,6 @@
 module github.com/tzone85/vortex-dispatch
 
-go 1.26.4
+go 1.26.5
 
 require (
 	github.com/charmbracelet/bubbletea v1.3.10
@@ -11,7 +11,7 @@ require (
 	github.com/mattn/go-sqlite3 v1.14.34
 	github.com/oklog/ulid/v2 v2.1.1
 	github.com/spf13/cobra v1.10.2
-	golang.org/x/sys v0.36.0
+	golang.org/x/sys v0.44.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 

go.sum

@@ -83,8 +83,8 @@ golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
 golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k=
-golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
+golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
 golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

internal/cli/figma.go

@@ -11,7 +11,7 @@ import (
 
 // figmaTokenSettingsURL is where a personal access token is created. Printed,
 // never auto-opened — the operator clicks it themselves.
-const figmaTokenSettingsURL = "https://www.figma.com/settings"
+const figmaTokenSettingsURL = "https://www.figma.com/settings" // #nosec G101 -- public settings URL printed for the operator, not a credential
 
 // figmaAPIBase overrides the Figma API base URL in tests ("" = production).
 var figmaAPIBase = ""

internal/engine/design_context.go

@@ -65,7 +65,7 @@ func copyDesignDir(repoDir, worktreePath string) {
 			log.Printf("[figma] copy %s: %v", e.Name(), err)
 			continue
 		}
-		if err := os.WriteFile(filepath.Join(dst, e.Name()), data, 0o600); err != nil {
+		if err := os.WriteFile(filepath.Join(dst, e.Name()), data, 0o600); err != nil { // #nosec G703 -- e.Name() is an os.ReadDir base name from our own design dir; it cannot contain path separators
 			log.Printf("[figma] write %s to worktree: %v", e.Name(), err)
 		}
 	}

internal/figma/token.go

@@ -9,7 +9,7 @@ import (
 
 // TokenEnvVar is the environment variable checked first for a Figma
 // personal access token.
-const TokenEnvVar = "FIGMA_TOKEN"
+const TokenEnvVar = "FIGMA_TOKEN" // #nosec G101 -- env var NAME, not a credential value
 
 // tokenFileName under the vxd state dir (mode 0o600).
 const tokenFileName = "figma.token"

internal/memory/server.go

@@ -90,7 +90,8 @@ func (s *Server) Start(ctx context.Context) error {
 		BootstrapNonce: nonce,
 	})(s.Handler())
 
-	s.httpServer = &http.Server{Handler: handler}
+	// ReadHeaderTimeout bounds header dribble (Slowloris defence, gosec G112).
+	s.httpServer = &http.Server{Handler: handler, ReadHeaderTimeout: 10 * time.Second}
 
 	url := fmt.Sprintf("http://%s", addr)
 	browserURL := fmt.Sprintf("%s/?%s=%s", url, web.NonceQueryParam, nonce)

internal/web/server.go

@@ -135,7 +135,10 @@ func (s *Server) Start(ctx context.Context) error {
 	handler := authMw(mux)
 	s.rotator = rotator
 
-	s.httpServer = &http.Server{Handler: handler}
+	// ReadHeaderTimeout bounds how long a client may dribble request headers
+	// (Slowloris defence, gosec G112). 10s is generous for a localhost/LAN
+	// dashboard while still shedding stuck connections.
+	s.httpServer = &http.Server{Handler: handler, ReadHeaderTimeout: 10 * time.Second}
 
 	// Pidfile + bootstrap-file: written BEFORE Serve starts so any caller
 	// that probed /health and got 200 is guaranteed to find the artifacts