chore(deps): bump napi-derive from 3.6.3 to 3.6.9 in /plugins/codex-security/native

[dependabot]

Summary

Upgrade the native bindings' napi-derive dependency from 3.6.3 to 3.6.9 while keeping the locked build and license packaging working.

Changes

• Upgrade napi-derive and its convert_case dependency.
• Lock napi-derive-backend to 6.1.4, which uses the same syn major version as napi-derive 3.6.9. Version 6.1.5 caused compiler type mismatches between syn 2 and 3.
• Refresh the version-specific license entries for napi-derive and napi-derive-backend after checking their upstream licenses.

Testing

• Ruff 0.16.9 check and format checks passed for plugins/codex-security.
• pnpm --dir sdk/typescript run build:ci passed.
• Plugin source compatibility check and all 9 compatibility tests passed.
• cargo fmt --check and cargo clippy --locked -- -D warnings passed.
• Native release build, license notice generation, and the Linux x64 Node-API 8 behavioral proof passed on Node 24.21.0, including with an empty PATH.
• Verified the upgraded crates' upstream license text matches the vendored license byte for byte.

Risk and rollout

No public CLI or runtime settings change. The lockfile preserves the compatible macro/backend pairing, and the license overrides remain restricted to the reviewed package versions. Merge after the cross-platform native and package CI checks pass.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-05T19:30:04.103236Z	2ef85a0	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

Reviewed the derive upgrade, compatible syn-2 backend lock, and version-specific license entries. Locked native compilation, linting, notices, behavioral proof, and portable source checks pass; two independent review passes and verification found no blockers. Approving the final head 2ef85a0 subject to required cross-platform CI.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.