fix: update base image and dependencies to remediate vulnerabilities

[tembleking]

Bumps the sysdig-mini-ubi9 base image digest and updates Go dependencies to pull in fixed coreutils, glib2, and libxml2 packages, resolving CVE-2026-56392, CVE-2026-16118, CVE-2026-54371, CVE-2026-11979, and CVE-2026-6653.

Bumps package version to 3.0.3 so merging triggers a release.

[Copilot]

🟡 Changes recommended

Workflow annotations still need to be synchronized with the updated action versions.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Updates the base image and dependencies to remediate vulnerabilities, and bumps the package to version 3.0.3.

Changes:

• Refreshes amd64/aarch64 base image digests and Nix inputs.
• Updates Go dependencies, checksums, vendor hash, and generated mocks.
• Updates CI and publishing action pins.
• Bumps the package version to 3.0.3.

File summaries

File	Description
package.nix	Updates package version and vendor hash.
internal/infra/sysdig/mocks/client_extension.go	Regenerates client mocks.
go.sum	Updates Go dependency checksums.
go.mod	Updates Go dependencies.
flake.lock	Refreshes Nix dependency pins.
docker-base-amd64.nix	Updates the amd64 base image.
docker-base-aarch64.nix	Updates the aarch64 base image.
.github/workflows/pull-request-ci.yaml	Updates CI action pins.
.github/workflows/publish.yaml	Updates publishing action pins.

Review details

Files not reviewed (1)

• internal/infra/sysdig/mocks/client_extension.go: Generated file

Suppressed comments (6)

.github/workflows/publish.yaml:205

• The adjacent annotation still says this action is pinned to v21, but this changed reference is v23. Please update the annotation so the documented supply-chain pin matches the action (and keep the repeated installer blocks consistent).

        uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa # v23

.github/workflows/publish.yaml:210

• The adjacent annotation still says this action is pinned to v13, but this changed reference is v15. Please update the annotation so the documented supply-chain pin matches the action (and keep the repeated cache blocks consistent).

        uses: DeterminateSystems/magic-nix-cache-action@84c0677f58dcedf3b91f8223ce36a9ea5b3c84b7 # v15

.github/workflows/publish.yaml:252

• The adjacent annotation still says this action is pinned to v21, but this changed reference is v23. Please update the annotation so the documented supply-chain pin matches the action (and keep the repeated installer blocks consistent).

        uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa # v23

.github/workflows/publish.yaml:257

• The adjacent annotation still says this action is pinned to v13, but this changed reference is v15. Please update the annotation so the documented supply-chain pin matches the action (and keep the repeated cache blocks consistent).

        uses: DeterminateSystems/magic-nix-cache-action@84c0677f58dcedf3b91f8223ce36a9ea5b3c84b7 # v15

.github/workflows/pull-request-ci.yaml:78

• The adjacent annotation still says this action is pinned to v21, but this changed reference is v23. Please update the annotation so the documented supply-chain pin matches the action (and keep the repeated installer blocks consistent).

        uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa # v23

.github/workflows/pull-request-ci.yaml:83

• The adjacent annotation still says this action is pinned to v13, but this changed reference is v15. Please update the annotation so the documented supply-chain pin matches the action (and keep the repeated cache blocks consistent).

        uses: DeterminateSystems/magic-nix-cache-action@84c0677f58dcedf3b91f8223ce36a9ea5b3c84b7 # v15

• Files reviewed: 6/10 changed files
• Comments generated: 4
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.