chore: upgrade dependencies

[pan93412]

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[opencodezebra]

Review Council started (round 1).

Baseline:

• Scope: 5 files changed (+201/−344)
• CI/checks: pending (0 contexts) at aaca7c8

The council is reviewing this pull request; the verdict will follow as a separate comment when the round closes.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: aaca7c8616

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[opencodezebra]

LGTM ✅ — Routine dependency upgrades with SHA-pinned CI actions; no behavioral or security concerns.
Reviewed at aaca7c8 (round 1)

What This PR Does

Bumps Go modules, Nix flake inputs, and GitHub Actions pins to their latest patch/minor releases. The anthropic-sdk-go dependency is promoted from indirect to direct (reflecting the actual import graph), and several stale transitive entries are removed from go.sum, resulting in a net line-count decrease.

How It Works

• .github/workflows/tests.yml: updates determinate-nix-action and flakehub-cache-action SHA pins from v3.21.8 to v3.21.9 across all four jobs.
• flake.lock / flake.nix: bumps nixpkgs to a newer revision and updates vendorHash to match the new Go dependency set.
• go.mod / go.sum: upgrades ~30 direct and transitive Go dependencies (eino, buildkit, otel, grpc, aws-sdk, docker, protobuf, etc.) to latest stable versions.

Findings

ID	Severity	Finding	Location
F1	🟢	Actions remain SHA-pinned; workflow permissions and commands unchanged (raised by: rev-codex)	.github/workflows/tests.yml
F2	🟢	Go lock integrity intact — all upgrades, no downgrades, checksums retained (raised by: rev-codex)	go.mod
F3	🟢	Nix inputs remain revision- and hash-pinned (raised by: rev-codex)	flake.lock

Finding Details

🟢 F1: CI action pins verified

Both DeterminateSystems Actions remain pinned to full 40-char commit SHAs matching their v3.21.9 releases. No permission changes, no new secret references, no untrusted-code execution paths introduced.

🟢 F2: Go dependency upgrades verified

All changes are version bumps with retained integrity hashes. The promotion of anthropic-sdk-go to a direct dependency reflects the resolved import graph — no application code or credential handling changed.

🟢 F3: Nix flake lock integrity

nixpkgs input updated to a newer revision with a verified narHash. vendorHash in flake.nix updated to match the new Go module set.

What's Good (🟢)

• All GitHub Actions remain SHA-pinned to immutable commits with version comments for auditability.
• Clean dependency hygiene: stale go.sum entries removed, net −143 lines.
• No code changes — purely declarative version bumps reducing attack surface from known-fixed upstream issues.
• Nix reproducibility preserved via hash-pinned inputs.

Baseline Check

• Main already has: full CI pipeline (lint, unit tests, integration tests, Nix build, CodeQL).
• Net-new value: brings dependencies current, picking up upstream bug/security fixes.
• CI was still running at review time; mergeable_state was "unstable" (pending checks).

Review Metadata

• Reviewers: rev-codex (approve), rev-claude (unavailable — internal error)
• Consensus: approve
• Absent reviewers: rev-claude (agent error: organization disabled Claude subscription access)

---

🔴×0 🟡×0 🟢×3 · 💬 Comment @opencodezebra <question> for a follow-up · 🔁 Push new commits or comment @opencodezebra review <fix notes> to re-run the council · ✋ Disagree with a finding? @opencodezebra dismiss F1 <why it is not a defect>

[opencodezebra]

Council approve — 🔴0 🟡0 🟢3. Reviewed at aaca7c8. Full report: #15 (comment)

[opencodezebra]

Review Council started (round 2).

Baseline:

• Scope: 5 files changed (+201/−344)
• CI/checks: pending (0 contexts) at 7670994

The council is reviewing this pull request; the verdict will follow as a separate comment when the round closes.

[opencodezebra]

LGTM ✅ — Dependency-only upgrades remain clean on the new head; no security or correctness concerns.
Reviewed at 7670994 (round 2)

Delta since aaca7c8

• Head advanced from aaca7c8 to 7670994; the diff shape and file set are unchanged (5 files, dependency bumps only).
• No new code, permissions, or secret references introduced between rounds.
• CI checks (Lint, Unit tests, Nix build, Integration tests, CodeQL) triggered on the new head and were in-progress at review time.

Findings

Resolved	Severity	Finding	Fixed in

(No findings required resolution — round 1 had only 🟢 observations.)

Outstanding	Severity	Finding	Location

(None.)

New	Severity	Finding	Location
F1	🟢	CI action pins verified — SHA-pinned to immutable commits, no permission changes (raised by: rev-codex)	.github/workflows/tests.yml
F2	🟢	Go dependency integrity intact — upgrades with retained checksums, no replace directives (raised by: rev-codex)	go.mod
F3	🟢	Nix flake lock integrity — revision/narHash/vendorHash all pinned (raised by: rev-codex)	flake.lock

Finding Details

🟢 F1: CI action pins verified

DeterminateSystems actions (determinate-nix-action, flakehub-cache-action) remain pinned to full 40-char commit SHAs matching v3.21.9 releases. Workflow commands, permissions, and secret usage are unchanged from main.

🟢 F2: Go dependency integrity intact

All changes are version bumps with corresponding go.sum integrity hashes. anthropic-sdk-go promoted from indirect to direct (matching actual import graph). No replace directives or new untrusted module sources introduced.

🟢 F3: Nix flake lock integrity

nixpkgs input updated to a newer revision with verified narHash. vendorHash in flake.nix updated to match the new Go module set. Reproducibility preserved.

What's Good (🟢)

• All GitHub Actions remain SHA-pinned to immutable commits with version comments for auditability.
• Clean dependency hygiene: stale go.sum entries removed, net −143 lines.
• No code changes — purely declarative version bumps.
• Nix reproducibility preserved via hash-pinned inputs.
• Consistent with round 1 findings on the prior head.

Baseline Check

• Main already has: full CI pipeline (lint, unit tests, integration tests, Nix build, CodeQL).
• Net-new value: brings dependencies current, picking up upstream bug/security fixes.
• Round 1 approved at aaca7c8; this round re-verifies on the updated head 7670994.
• CI checks in progress at review time.

Review Metadata

• Reviewers: rev-codex (approve)
• Consensus: approve
• Absent reviewers: rev-claude (agent error: organization disabled Claude subscription access)

---

🔴×0 🟡×0 🟢×3 · 💬 Comment @opencodezebra <question> for a follow-up · 🔁 Push new commits or comment @opencodezebra review <fix notes> to re-run the council · ✋ Disagree with a finding? @opencodezebra dismiss F1 <why it is not a defect>

[opencodezebra]

Council approve — 🔴0 🟡0 🟢3. Reviewed at 7670994. Full report: #15 (comment)