audit: update 5 high-impact package dependencies

[timothytlewis]

Summary

Version audit of ~40 high-impact infrastructure packages as of 2026-03-06. Identified version blocks, stale dependency pins, and systemic issues. This PR updates the top 5 most actionable packages.

Changes

• jq: Migrate upstream from archived stedolan/jq to active jqlang/jq (version source + distributable URL)
• terraform: Update Go build dependency pin from ~1.24.1 to ~1.25.7 (matches go.mod)
• kubectl: Update Go build dependency pin from ~1.24.4 to ~1.25.0 (matches go.mod)
• python: Update zlib dependency pin from =1.3.1 to =1.3.2 (tcl uses ^1.3, compatible)
• rust: Relax Python build dependency from <3.12 to <3.15 (allows building with current Python)

Audit Report

Full audit report included at docs/audit/2026-03-06-version-audit-report.md covering:

• 40 packages across 7 categories (runtimes, build tools, libraries, CLI tools, databases, devops)
• 3 packages with explicit version blocks
• 5 packages with stale dependency pins
• 1 systemic issue (OpenSSL 1.1 → 3 migration)

Notable Findings (not addressed in this PR)

• curl: Blocked at ≤8.17.x — openssl.org: ^1.1 dependency prevents curl 8.18+ (which requires OpenSSL 3)
• Node.js: Hard-pinned to openssl.org: 1.1 — Node 22+ LTS needs OpenSSL 3
• OpenSSL 1→3 migration: curl, Node.js, Python, Ruby all depend on OpenSSL 1.1. A coordinated migration is the highest-priority systemic improvement for the pantry.

Test plan

• Verify jq version discovery works with jqlang/jq releases
• Verify Terraform builds with Go 1.25.7
• Verify kubectl builds with Go 1.25.0
• Verify Python builds with zlib 1.3.2
• Verify Rust builds with Python 3.12+

🤖 Generated with Claude Code

[jhheider]

this won't work, unless we rebuild tcl. it has to match the version built against. if we want to rebuild tcl8.6 against zlib 1.3.2, then this could work (if not other cascade fails).

[jhheider]

this is a massive problem with linked programs. to solve it, we'd need to modify pkgx to allow multiple versions of openssl in a project, as we do with unicode. or make openssl3 its own package so they don't conflict.

[jhheider]

this is because of ssl version issues. the package was forked, and curl.se/ssl3 provides versions later than 8.18, which require openssl3, so they don't contaminate everything else.

[jhheider]

i extracted the four quick ones to #12190; once those are in, it'll only be the python bit that needs attention.