Most dependencies are vendored in the upstream source anyway, deps.nix just contains the few that are not. Dependencies were updated manually because go2nix doesn't work correctly for this package - it produces an empty deps.nix.