build(deps): batch Dependabot bumps (#101–#107)

[ThomasK33]

Batches today's Dependabot Go-module bumps into a single PR, per the repo's dependency policy. None of them is a security fix: the repo has no open Dependabot alerts.

Bumps

Module	Dependency	Old → New	Dependabot PR
state/redis	github.com/alicebob/miniredis/v2	v2.39.0 → v2.40.0	#101, #107
state/redis	github.com/redis/go-redis/v9	v9.22.0 → v9.23.0	#102, #106
examples/slack-redis-state	github.com/redis/go-redis/v9	v9.22.0 → v9.23.0	#102, #104
state/nats	github.com/nats-io/nats-server/v2	v2.15.0 → v2.15.1	#103, #105

Indirect changes that come with these bumps:

Module(s)	Dependency	Old → New	From
state/nats, state/postgres, state/redis, examples/slack-nats-state	github.com/klauspost/compress	v1.20.0 → v1.20.1	nats-server
state/postgres, state/redis	github.com/stretchr/testify	v1.11.1 → v1.12.1	go-redis
state/postgres, state/redis	gopkg.in/yaml.v3 v3.0.1 → go.yaml.in/yaml/v3 v3.0.5	replaced	testify v1.12.1
state/redis, examples/slack-redis-state	go.uber.org/atomic	v1.11.0 → v1.12.0	go-redis

examples/slack-postgres-state/go.sum changes only because the state modules it uses changed. The go.mod and go.sum lines in this PR are exactly the union of the lines in #101–#107: no line is missing or extra, and no module version has a different hash.

Changelog review

I read the upstream release notes for all three bumps. Nothing in them changes behavior for this repo. These are the items worth knowing:

1. go-redis v9.23.0 (release):
   • The minimum Go version is now 1.26 (its go.mod says go 1.26.0). Our modules already require 1.26.3.
   • Every Client now has its own pipeline connection pool by default (PipelinePoolSize = 10). Only Pipeline, TxPipeline and autopipeline calls use it. state/redis makes none of these calls outside its tests. A caller who passes their own client and pipelines on it can open up to 10 more connections. PipelinePoolSize: -1 turns the pool off.
   • ParseURL now returns an error for a bad skip_verify value (for example skip_verify=yes). Before, it silently used false. examples/slack-redis-state parses REDIS_URL with ParseURL, so such a URL now fails at startup.
   • It removes some autopipeline and client-side-cache options that we do not use. go vet passes.
2. nats-server v2.15.1 (release): only state/nats/nats_test.go imports it, to run an embedded server. The release drops the legacy $GR. gateway reply prefix (servers older than v2.1.2) and contains JetStream, leafnode and auth fixes. None of these affect the embedded test server.
3. miniredis v2.40.0 (release): only state/redis/redis_test.go imports it. The release adds testing/synctest support and the ZMPOP, BZMPOP and LMPOP commands, and fixes RENAME, SetError, LPOS COUNT and HRANDFIELD.

How it was produced

1. Branched from origin/main at 3c26d1f.
2. Ran go get for each bump in each affected module, with Go 1.27.1 (the mise pin): miniredis and go-redis in state/redis, go-redis in examples/slack-redis-state, and nats-server in state/nats.
3. Ran go mod tidy in all 7 workspace modules, then go work sync. Repeated until nothing changed (2 passes).
4. Only go.mod/go.sum files change. The root module and go.work.sum are untouched.

Validation

• mise run vet: pass. go.work.sum stayed unchanged.
• go test -race in every workspace module: pass. The state modules ran with -v (embedded NATS server, and Postgres and Redis through Testcontainers): postgres 5, redis 10, nats 6 tests passed, 0 skipped.
• GOWORK=off go build ./... in state/nats, state/postgres and state/redis: pass.
• One root-module test, adapters/linear TestRateLimitDeadlineReturnsTypedRateLimited, failed once in the first GOFLAGS=-race mise run test run (context deadline exceeded). This PR does not change the root module's go.mod or go.sum. The test then passed 10 of 10 runs with -race -count=10, and the full root module passed with -race. I treat it as a timing flake on main.

Batch policy

Bot PRs are not merged one by one. They go into one batch PR that passes the standard gate: green CI, clean Codex code and security reviews, no unresolved threads. Dependabot then closes its PRs by itself, because main satisfies them.

Closes #101
Closes #102
Closes #103
Closes #104
Closes #105
Closes #106
Closes #107

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high

[ThomasK33]

@codex review

[ThomasK33]

@codex security review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-13T18:45:10.551655Z	7a54a80	Manual request
🔒 Security Review	✅ Completed 2026-10-13T18:46:26.862571Z	7a54a80	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: 7a54a80bfb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 7a54a80bfb

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.