[codex] fix vulnerable dependencies

[GuangmingLuo]

Summary

• Upgrade github.com/ollama/ollama in the root module from v0.11.4 to v0.11.11.
• Upgrade google.golang.org/grpc to v1.72.3 in the affected flow/agent/deer-go, flow/agent/manus, and quickstart/eino_assistant modules.
• Upgrade the Deer Go Python MCP server from mcp==1.8.1 to mcp>=1.13.0 and refresh uv.lock, which resolves to mcp==1.27.2 and python-multipart==0.0.32.
• In flow/agent/manus, go mod tidy also aligns go.mod with the existing source import of github.com/cloudwego/eino-ext/components/tool/duckduckgo/v2 in manus.go; this is a manifest/lockfile consistency fix with no source changes, and it accounts for the new transitive goquery / cascadia entries.

Validation

• git diff --check
• env -u GOROOT go mod tidy in root, flow/agent/deer-go, flow/agent/manus, and quickstart/eino_assistant
• env -u GOROOT go test ./... in root: passed
• env -u GOROOT go test ./... in quickstart/eino_assistant: passed
• uvx --from uv uv lock --upgrade-package mcp --upgrade-package python-multipart: passed
• uv run python -m py_compile server.py: passed

Known existing module build issues observed during validation:

• env -u GOROOT go test ./... in flow/agent/deer-go fails in existing github.com/cloudwego/eino-ext/components/tool/mcp@v0.0.0-20250514085234-473e80da5261 API usage (schema.NewParamsOneOfByOpenAPIV3, mcp.CallToolParams).
• env -u GOROOT go test ./... in flow/agent/manus fails in existing github.com/cloudwego/eino-ext/components/tool/browseruse@v0.0.0-20250421090053-2091919102c7 / libs/acl/openai API usage (schema.NewParamsOneOfByOpenAPIV3, ParamsOneOf.ToOpenAPIV3).

[Copilot]

Pull request overview

This PR updates vulnerable dependencies across multiple Go modules and the Deer Go Python MCP server, aiming to remediate security findings by bumping key libraries to patched versions.

Changes:

• Bump root module indirect dependency github.com/ollama/ollama from v0.11.4 to v0.11.11.
• Bump google.golang.org/grpc to v1.72.3 (and related genproto entries where applicable) across affected Go submodules.
• Upgrade the Deer Go Python MCP server dependency from mcp==1.8.1 to mcp>=1.13.0 and refresh uv.lock (resolving to mcp==1.27.2, python-multipart==0.0.32, etc.).

Reviewed changes

Copilot reviewed 5 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
go.mod	Updates root module indirect dependency version for github.com/ollama/ollama.
go.sum	Updates root module checksums to match the upgraded ollama version.
quickstart/eino_assistant/go.mod	Bumps indirect google.golang.org/grpc to v1.72.3.
quickstart/eino_assistant/go.sum	Updates checksums for the upgraded grpc version.
flow/agent/deer-go/go.mod	Bumps indirect grpc to v1.72.3 and aligns related genproto versions.
flow/agent/deer-go/go.sum	Updates checksums for grpc and genproto changes.
flow/agent/manus/go.mod	Bumps indirect grpc to v1.72.3 and also updates duckduckgo dependency to /v2.
flow/agent/manus/go.sum	Updates checksums reflecting grpc and additional dependency graph changes.
flow/agent/deer-go/biz/mcps/python/pyproject.toml	Changes MCP dependency constraint to mcp>=1.13.0.
flow/agent/deer-go/biz/mcps/python/uv.lock	Refreshes Python lockfile to newer resolved versions (incl. mcp==1.27.2, python-multipart==0.0.32).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 10 changed files in this pull request and generated no new comments.