Build with Go 1.26.10 and update nix flake and plugin version for v0.15.1

Merged
JE
2d ago
+4-4

Release metadata for v0.15.1. v0.15.0 never published: its release run failed "Test before release" when govulncheck found GO-2026-6809 (crypto/x509, "Distrust compromised intermediate certificates") in Go 1.26.9, fixed in 1.26.10, and its tag was deleted. v0.15.1 ships what v0.15.0 would have, plus the toolchain bump.

  • go.mod: toolchain go1.26.9 → go1.26.10. setup-go reads the toolchain line, so every CI and release job builds and scans with 1.26.10. The go line stays 1.26.7, and no other file pins 1.26.9.
  • nix/package.nix version 0.15.0 → 0.15.1, from scripts/update-nix-flake.sh 0.15.1. The toolchain line doesn't change the vendored modules, so vendorHash stays, and the script's Nix build succeeded with it.
  • .claude-plugin/plugin.json and .codex-plugin/plugin.json stamped 0.15.1 by scripts/stamp-plugin-version.sh and scripts/stamp-codex-plugin-version.sh.

govulncheck -tags dev ./... passes under 1.26.10, and still reports GO-2026-6809 when forced back to 1.26.9. As with #930, the v0.15.1 tag goes on this PR's merge commit: make release VERSION=0.15.1 from main then finds the metadata in place and only creates and pushes the tag.

Summary by cubic

Prepares the v0.15.1 release metadata; v0.15.0 never published because its release run failed govulncheck on GO-2026-6809, a crypto/x509 vulnerability in Go 1.26.9, fixed in 1.26.10.

  • Bumps the go.mod toolchain line to go1.26.10; the go line stays 1.26.7.
  • Updates nix/package.nix and stamps .claude-plugin/plugin.json and .codex-plugin/plugin.json to version 0.15.1.
  • Leaves flake.lock where v0.14.0 had it: today's nixpkgs-unstable dropped ruby_3_3, which the dev shell pins, so the flake moves to a Go 1.26.10 nixpkgs in a separate PR after the release; Nix installs build from main and pick it up without a tag.