Use Go 1.27.3 for Nix package and development shell

Merged
RO
6d ago
+3-3

Summary

Refresh flake.lock so the shared nix/go.nix toolchain resolves Go 1.27.3 instead of 1.27.0. Both the packaged CLI and development shell use that derivation.

This completes the certificate-trust fix for Nix installs before the next CLI release: #593 updated the Go/mise pins, but Nix selects its compiler independently. Fixes GO-2026-6809 for this install path.

No feature PRs, CLI commands, SDK versions or package versions are changed here.

Verification

  • Generated with nix flake update nixpkgs.
  • Evaluated the shared derivation from the exact new lock: version 1.27.3.
  • Reviewed the diff: only nixpkgs revision, timestamp and content hash change.
  • git diff --check passes.
  • Full Nix flake build must pass CI before merge.

This is prerequisite security release preparation under the operator’s instruction to release the CLI, not a request to include any of the outstanding feature PRs.

Summary by cubic

Updates the Nix flake lock so the Go toolchain resolves 1.27.3 instead of 1.27.0 for both the packaged CLI and the development shell.

This completes the certificate-trust fix for Nix installs: PR #593 updated the Go/mise pins, but Nix selects its compiler independently. Fixes GO-2026-6809 for this install path. No CLI commands, SDK versions, or package versions change.