chore(deps): bump the pkgs pin - #1064

One line, but worth reading the blast radius before approving.

What this picks up

The pin was 9 days and 62 commits stale (c854d6b1, 2026-07-20). The motivating change is gominimal/pkgs#534, which rebuilds microvm-rootfs from Alpine and drops the glibc closure. The pin is linear, so this necessarily carries everything before it too.

Materially in range:

The remaining ~57 are routine package version bumps.

Pinned at the branch tip rather than at #534's own commit: pinning mid-history buys nothing here, and the three commits after it are a bottom bump, a graphviz bump, and a license-metadata fix.

Verification

mip materialize --arch aarch64 minvmd-rootfs at the new pin resolves from cache and yields:

47,212,544 bytes — Linux rev 1.0 ext2 filesystem data
interpreter: /lib/ld-musl-aarch64.so.1   (no glibc present)

That is #534's image, not a rebuild of the old one.

The same image has already been booted and driven through the full session e2e — cold activate 4296 ms, warm ls 16 ms, sandbox proof 8030 ms — and A/B'd for cold-boot latency against the outgoing rootfs:

n=10 each, distributions non-overlapping. ~16% faster cold boot alongside the 4× size cut.

mip check passes.

Risk

This changes the guest for macOS too, which already ships the payload — the VM lanes are the real gate, not the local checks above. The other thing I cannot prove locally is the dogfood build smoke: if upstream's R2 mirror is not populated for the new pin, that build falls back to compiling from source. That surfaces in ci, by design.

Sequencing note: this is what makes the slimmed rootfs actually reach a release. .github/actions/materialize resolves guest artifacts through this pin, so until it moves, #534 is merged upstream but unreachable downstream.

🤖 Generated with Claude Code