chore(deps): docker: bump the all-docker group across 1 directory with 2 updates

[dependabot]

Bumps the all-docker group with 2 updates in the /agent directory: golang and python.

Updates golang from 1.26.4-bookworm to 1.26.5-bookworm

Updates python from 3.13-slim to 3.14-slim

[scottschreckengaust]

@dependabot rebase

[scottschreckengaust]

Verdict: Request changes — split the safe golang patch from the untested Python 3.14 minor bump

The golang 1.26.4-bookworm → 1.26.5-bookworm patch bump (gh builder stage) is fine — patch-level, digest-covered by the module install, no behavior risk. Ship it.

The python:3.13-slim → 3.14-slim change is a minor interpreter upgrade riding a "docker" dependabot group, and it front-runs the already-tracked coordinated upgrade in #105 (chore(agent): upgrade Python 3.13 → 3.14) — which is still open, unassigned, and carries no approved label. Per ADR-003, the runtime upgrade should land through that issue, not as a side effect of a grouped digest bump.

The bump is probably runtime-safe — but nothing in this PR's green checks proves it, and merging as-is leaves the toolchain in a drifted state.

Blocking

1. No CI gate actually exercises Python 3.14. The green build (agentcore) check runs mise run build on the runner's Python (pinned 3.13 in agent/mise.toml) and only synths CDK — it never builds agent/Dockerfile. The image is built solely via DockerImageAsset / AgentRuntimeArtifact.fromAsset (cdk/src/stacks/agent.ts:85,616) at deploy time. The integ-smoke gate deliberately omits the AgentCore runtime (cdk/test/integ/integ.task-api-smoke.ts:27 — "no agent ever runs"), and the trivy/grype image scan runs weekly in security.yml, not on this PR. So a 3.14 interpreter first executes in a real deploy. The green checkmarks here are not evidence of safety.

2. Toolchain pin drift — the change is incomplete. #105 requires four coordinated edits; this PR makes only the first. Left unchanged:

   • agent/mise.toml:4 → python = "3.13" (local dev + CI still build/test on 3.13, so no gate ever type-checks or lints against the deployed interpreter)
   • agent/pyproject.toml:97 → target-version = "py313" (ruff)
   • agent/pyproject.toml:163 → python-version = "3.13" (ty)
   • uv.lock re-lock

   Result: the container runs 3.14 while every quality gate reasons about 3.13. That is exactly the blind spot that hides 3.14 regressions.

Non-blocking (confirms the bump is likely safe once tested)

• Native-extension wheels all resolve on 3.14: uv.lock carries cp314-cp314 wheels for cedarpy 4.8.4, pydantic-core, rpds-py, charset-normalizer, websockets, and cryptography (abi3), plus 3.14 resolution markers — uv sync --frozen should succeed.
• Deprecated asyncio.get_event_loop_policy() (agent/src/server.py:233, agent/src/pipeline.py:969) is diagnostic-only (a boot log line + a uvloop warning), deprecated-not-removed in 3.14, functional through ~3.16. [tool.ty.rules] deprecated = "ignore" already accounts for it.
• No exposure to the usual 3.14 breakers: no multiprocessing/start-method reliance, no removed child watchers, no removed stdlib modules, no warnings-as-errors that would promote a DeprecationWarning to a hard failure. uvicorn is launched with --loop asyncio (no uvloop).

Recommended path

Either (a) close this in favor of doing #105 as one coordinated PR (Dockerfile + mise + ruff + ty + uv lock) with its testing checklist run — docker build, uv sync --frozen, agent unit tests on 3.14, trivy, and a full agent smoke run; or (b) split this: merge the golang patch now, and expand the Python change to include the three pin edits + re-lock, then trigger a manual deploy/integ run against the shared account before merge. Do not merge the interpreter bump on the strength of these checks alone.

---

Review agents run

• Manual principal-architect review + deep supply-chain analysis (wheel/ABI availability, removed-module scan, asyncio-deprecation trace, CI-coverage trace). ✅
• security-review / /review pr-review-toolkit agents (code-reviewer, silent-failure-hunter, type-design-analyzer, comment-analyzer, pr-test-analyzer): omitted — not installed in this environment, and the diff is a 2-line base-image tag change touching no application code, error handling, types, tests, IAM, Cedar, secrets, or network. Supply-chain/base-image risk (their nearest in-scope concern) was covered by the manual analysis above.

[scottschreckengaust]

Pin drift: this moves the container to 3.14 but the quality gates stay on 3.13 — agent/mise.toml:4 (python = "3.13"), pyproject.toml:97 (target-version = "py313"), and pyproject.toml:163 (ty python-version = "3.13") are unchanged, and uv.lock is not re-locked. Per issue #105 this interpreter upgrade needs all four edits in one coordinated PR (then re-lock), not a lone base-image tag bump. The golang line above is a safe patch bump and can proceed independently.