[alangou]

Summary

Complete the published CA distrust update from #4794 across the Go SDK, uv/Node tooling, and container trust stores. Update the upstream packages and image pins so rebuilt applications and images reject the affected certificate chains.

Related Issue

Closes #4800.

Changes

• Require Go 1.26.10 for the SDK and align the development toolchain pins. Document Go 1.27.3 as the minimum on the Go 1.27 branch.
• Pin uv 0.13.4 and Node.js 24.22.1 and install the pinned uv in the affected CI jobs.
• Use the upstream uv 0.13.4 Nix package through a dedicated input, preserving the existing nixpkgs revision for compilers and cross toolchains.
• Refresh the gateway and supervisor Distroless digests and update the CI and Gator NVIDIA Ubuntu 24.04 base to noble-20260917.
• Update Gator's existing NodeSource package pin to Node.js 22.23.4 and pin the MCP client to the corresponding official Node image. The existing APT install steps fetch the corrected Debian/Ubuntu CA packages.
• Update Go prerequisites and the image trust-store verification guidance.

The rebuilt CI image still needs publishing and the workflow CI-image digests need refreshing during integration.

Release Notes

Rebuild existing Go SDK applications with Go 1.26.10 or newer; Go 1.27 users need at least 1.27.3. Rebuild and redeploy affected gateway, supervisor, and workload images to apply their trust-store updates.

Testing

• mise run --skip-tools go:ci: lint, build, race tests, formatting, proto, and docs checks.
• mise run --skip-tools sdk:ts:ci: 196 tests and the full TypeScript validation pipeline.
• Local amd64 builds of the CI, gateway, supervisor, sandbox, Gator, and MCP client images; Gator Node/npm/Codex checks in both Docker and an OpenShell sandbox.
• Docker sandbox tests: 6 TLS/uv tests and all 3 MCP conformance scenarios.
• Certificate checks reject all 12 published demonstration chains; Node HTTPS checks also pass a valid-certificate positive control.
• nix flake check --no-build --all-systems; uv 0.13.4 resolves for x86_64 Linux, ARM64 Linux, and ARM64 macOS.
• Native Linux Nix uv package build and uv --version: 0.13.4.
• Build and enter the full Linux Nix development shell: uv 0.13.4 and Cargo 1.95.0.
• Compare the Nix shells on all three supported platforms with the pre-PR baseline: every package except uv and all compiler environment settings remain unchanged.
• Local reproduction of the Trivy PR scan using the exact CI baseline and merge commits: report tests, ignore validation, and both configuration scans pass; no new HIGH or CRITICAL findings.
• Documentation validation, Markdown lint, and git diff --check.

No new unit tests: this change updates dependency versions and image packaging. Runtime checks were run on amd64; the selected images and Gator's NodeSource package are also available for arm64.

Checklist

• Follows Conventional Commits.
• Commits are signed off (DCO).
• Relevant SDK and operational documentation updated.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-4801.docs.buildwithfern.com/openshell

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[alangou]

/ok to test e226873

[github-actions]

Label test:e2e applied for e226873. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[alangou]

/ok to test 59c472f

[purp]

LGTM 🚢

[github-actions]

Compatibility review (advisory)

New or updated breaking changes; see the full report for all findings.

1. go-sdk — No explicit risk acceptance found

The Go SDK module and documented minimum changed from Go 1.25.13 to Go 1.26.10.

• Impact: Existing Go 1.25 consumers are no longer supported, and builds fail where automatic toolchain download is disabled or unavailable.
• Action: Restore Go 1.25.13 compatibility for v0.1.6, or defer the compiler-floor increase to a minor train with notice and migration guidance.
• PR: fix(deps): refresh toolchains and container trust stores #4801

Review details

• Execution: complete
• Candidate: PR #4801 (f45b3abe26983cb8bcc0d93f3e8d3aaf08079996)
• Baseline: 321b93a898b8859ea9c0643a26c2f4e3b362e503 (321b93a898b8859ea9c0643a26c2f4e3b362e503)
• Reviewed: rust-sdk, python-sdk, go-sdk, typescript-sdk, api-behavior, cli, configuration, policy, helm, state

Advisory review; publication gates are unchanged.

Branch check run

[alangou]

I accept that v0.1.6 drops support for Go 1.25 SDK consumers. Go 1.25 has no upstream fix. Users must upgrade to Go 1.26.10 or Go 1.27.3 and rebuild

[alangou]

/ok to test 91a4f07

[github-actions]

Compatibility review (advisory)

New or updated breaking changes; see the full report for all findings.

1. go-sdk — Risk explicitly accepted

The module's go directive and documented minimum rose from Go 1.25.13 to Go 1.26.10.

• Impact: Existing Go 1.25 consumers must upgrade or permit toolchain download; builds fail before compilation when automatic download is disabled or unavailable.

• Action: Restore Go 1.25.13 compatibility for v0.1.6, or defer the floor increase to a minor train while retaining the documented upgrade and rebuild guidance.

• PR: fix(deps): refresh toolchains and container trust stores #4801

• Acceptance: comment

Review details

• Execution: complete
• Candidate: PR #4801 (b307b1ecb2b4df24d75a954e83de04b3dffbeac5)
• Baseline: 321b93a898b8859ea9c0643a26c2f4e3b362e503 (321b93a898b8859ea9c0643a26c2f4e3b362e503)
• Reviewed: rust-sdk, python-sdk, go-sdk, typescript-sdk, api-behavior, cli, configuration, policy, helm, state

Advisory review; publication gates are unchanged.

Branch check run