Consolidate dependabot updates (2026-03-23)

[wesm]

Summary

• Bump cachix/install-nix-action from 31.10.1 to 31.10.2 (build(deps): bump cachix/install-nix-action from 31.10.1 to 31.10.2 #561)
• Bump codecov/codecov-action from 5.5.2 to 5.5.3 (build(deps): bump codecov/codecov-action from 5.5.2 to 5.5.3 #562)
• Bump modernc.org/sqlite from 1.46.2 to 1.47.0 (build(deps): bump modernc.org/sqlite from 1.46.2 to 1.47.0 #563)
• Bump github.com/jackc/pgx/v5 from 5.8.0 to 5.9.1 (build(deps): bump github.com/jackc/pgx/v5 from 5.8.0 to 5.9.1 #564)
• Update nix vendorHash for Go dependency changes

🤖 Generated with Claude Code

[roborev-ci]

roborev: Combined Review (bc9b668)

Synthesis unavailable. Showing individual review outputs.

codex — default (done)

Inspecting the dependency bump diff and the affected manifests to check for compatibility or release-management issues.
No issues found.

Summary: This change only updates pinned CI actions, bumps pgx and modernc.org/sqlite module versions, and refreshes the Nix vendorHash, with no obvious correctness or regression risks visible in the diff.

---

codex — security (done)

Summary: Reviewed the dependency and CI pin updates in .github/workflows/ci.yml, go.mod, and flake.nix. The diff only bumps existing third-party dependencies and GitHub Actions to newer pinned versions; it does not introduce new input-handling paths, auth decisions, secret material, filesystem access patterns, or expanded workflow permissions. The GitHub Actions remain pinned to full commit SHAs, so the existing supply-chain hardening posture is preserved.

No issues found.

---

gemini — default (done)

Summary: Bumps GitHub action versions and Go dependencies (pgx, sqlite) along with the corresponding Nix vendorHash.

Review Findings:
No issues found.