build(deps): batch Dependabot bumps (#77–#78)

[ThomasK33]

Summary

Consolidates Dependabot PRs #77 and #78 into one dependency batch from b5826f2.
Both propose NATS Server v2.15.0. Only state/nats directly requires the server;
#77 is the workspace-wide twin, not a root go.mod requirement.

Modules (go.mod requirements)	Dependency	Old → new
examples/slack-nats-state, state/nats, state/postgres, state/redis	github.com/klauspost/compress	v1.19.2 → v1.20.0
examples/slack-nats-state, state/nats, state/postgres, state/redis	golang.org/x/crypto	v0.55.0 → v0.57.0
examples/slack-nats-state, examples/slack-redis-state, state/nats, state/postgres, state/redis	golang.org/x/sys	v0.47.0 → v0.48.0
examples/slack-postgres-state, state/postgres	golang.org/x/sync	v0.22.0 → v0.23.0
examples/slack-postgres-state, state/postgres	golang.org/x/text	v0.41.0 → v0.42.0
state/nats	github.com/nats-io/nats-server/v2	v2.14.6 → v2.15.0
state/nats	github.com/antithesishq/antithesis-sdk-go	v0.7.2-default-no-op → v0.8.0-default-no-op
state/nats	golang.org/x/time	v0.15.0 → v0.16.0

All seven modules were tidied, including all three examples that reference sibling modules.
go work sync and per-module tidy reached a fixpoint on pass 3. Corresponding
checksums were refreshed, including example checksums for transitive/test dependencies.
The root module and go.work/go.work.sum are unchanged. Scope: 12 dependency files,
80 additions and 80 deletions; no source changes or build artifacts.

Batch policy

Do not merge the bot PRs individually. This batch satisfies both proposed bumps;
Dependabot should close its PRs after main contains the update. No additional bot
updates are included.

Validation

• mise run vet
• GOFLAGS=-race mise run test across all seven workspace modules (embedded NATS; Postgres/Redis Testcontainers)
• GOWORK=off go build ./... in state/nats
• Repeated per-module go mod tidy + go work sync: stable fixpoint
• git diff --check and dependency-file-only footprint check

Go/compiler 1.26.3 and CGO=1 were verified in a process-local environment that removes
the host's stale GOROOT and /opt/mise PATH entries.

Review gate

Merge only after green CI, clean code and security Codex verdicts for the current
head, and zero unresolved review threads.

---

Generated with mux • Model: coder:bedrock-mantle-us-west-2/openai.gpt-6-astra • Thinking: high

[ThomasK33]

@codex review

[ThomasK33]

@codex security review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-21T22:54:37.606886Z	59c7586	Manual request
🔒 Security Review	✅ Completed 2026-09-21T22:56:19.833277Z	59c7586	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[ThomasK33]

Embedded NATS dogfood evidence

Fresh CLI execution: go test -race -count=1 -v -run '^TestNewRejectsBucketTTLChange$' . from state/nats, with the scrubbed Go 1.26.3 environment. Module output confirms NATS Server v2.15.0. Native test exit: 0.

This recording was captured before commit, on the uncommitted dependency batch based on b5826f2. It is not an exact-commit capture of 59c7586. The video renders the fresh raw terminal capture with recorded timing; it is test evidence, not a live Slack integration demo.

dogfood.webm

---

Generated with mux • Model: coder:bedrock-mantle-us-west-2/openai.gpt-6-astra • Thinking: high

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: 59c75868cd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 59c75868cd

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[ThomasK33]

Final dependency-steward record

• Reviewed head: 59c75868cd0b018a616e14bd83a255da8245aa23.
• Squash merge on main: 34976032083df533dbb4c2a8d10f46ce63f21523; landed tree exactly matches reviewed tree.
• Local vet, all-workspace race tests, standalone GOWORK=off NATS build, and tidy/sync fixpoint passed. PR CI and post-merge main CI passed.
• Review count: two completed assessments (one code, one security); exactly one explicit request each. Both clean on 59c75868cd; zero review threads or findings.
• Independent readiness auditor: ready, with bot closure verification as the only follow-up. Advisor: proceed. Stopped review because all gates were met and no findings remained.
• Dependabot automatically closed build(deps): bump github.com/nats-io/nats-server/v2 from 2.14.6 to 2.15.0 #77 at 23:00:34 UTC and build(deps): bump github.com/nats-io/nats-server/v2 from 2.14.6 to 2.15.0 in /state/nats #78 at 23:00:44 UTC on 2026-09-21. Closure actors verified as dependabot[bot]; no manual closures needed.
• No additional open Dependabot PRs at final verification. No deferred fixes.

---

Generated with mux • Model: coder:bedrock-mantle-us-west-2/openai.gpt-6-astra • Thinking: high