[robzolkos]

Summary

Refresh flake.lock so the shared nix/go.nix toolchain resolves Go 1.27.3 instead of 1.27.0. Both the packaged CLI and development shell use that derivation.

This completes the certificate-trust fix for Nix installs before the next CLI release: #593 updated the Go/mise pins, but Nix selects its compiler independently. Fixes GO-2026-6809 for this install path.

No feature PRs, CLI commands, SDK versions or package versions are changed here.

Verification

• Generated with nix flake update nixpkgs.
• Evaluated the shared derivation from the exact new lock: version 1.27.3.
• Reviewed the diff: only nixpkgs revision, timestamp and content hash change.
• git diff --check passes.
• Full Nix flake build must pass CI before merge.

This is prerequisite security release preparation under the operator’s instruction to release the CLI, not a request to include any of the outstanding feature PRs.

---

Summary by cubic

Updates the Nix flake lock so the Go toolchain resolves 1.27.3 instead of 1.27.0 for both the packaged CLI and the development shell.

This completes the certificate-trust fix for Nix installs: PR #593 updated the Go/mise pins, but Nix selects its compiler independently. Fixes GO-2026-6809 for this install path. No CLI commands, SDK versions, or package versions change.

^{Written for commit 70b4e17. Summary will update on new commits.}

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

[robzolkos]

Pre-release convergence at 70b4e17: all 24 checks settled (20 success, 3 skipped, 1 neutral), including Nix flake builds; no failures or pending jobs, cleanly mergeable, 0 total / 0 unresolved review threads and no review-body findings. Copilot reported on this exact head but excludes lockfiles and reviewed no files; Cubic is unavailable due to the monthly quota. Neither is represented as an approval. Manual review confirms the only change is the nixpkgs lock revision/hash/timestamp, and evaluating the actual shared derivation under this lock returns Go 1.27.3 for the package and development shell. Merging this security prerequisite under the operator’s authorization to release the CLI; outstanding feature PRs remain untouched.