[alangou]

Summary

Complete the published CA distrust update from #4794 across the Go SDK, uv/Node tooling, and container trust stores. Update the upstream packages and image pins so rebuilt applications and images reject the affected certificate chains.

Related Issue

Closes #4800.

Changes

• Require Go 1.26.10 for the SDK and align the development toolchain pins. Document Go 1.27.3 as the minimum on the Go 1.27 branch.
• Pin uv 0.13.4 and Node.js 24.22.1, install the pinned uv in the affected CI jobs, and update flake.lock to the upstream nixpkgs revision providing uv 0.13.4.
• Refresh the gateway and supervisor Distroless digests and require the corrected Debian/Ubuntu CA packages in image builds.
• Use official Ubuntu 24.04 for Gator and copy Node.js 22.23.4 from its pinned official image, preserving the existing npm/Codex paths. Use the same Node image directly for the MCP client.
• Update Go prerequisites and the image trust-store verification guidance.

The rebuilt CI image still needs publishing and the workflow CI-image digests need refreshing during integration.

Release Notes

Rebuild existing Go SDK applications with Go 1.26.10 or newer; Go 1.27 users need at least 1.27.3. Rebuild and redeploy affected gateway, supervisor, and workload images to apply their trust-store updates.

Testing

• mise run --skip-tools go:ci: lint, build, race tests, formatting, proto, and docs checks.
• mise run --skip-tools sdk:ts:ci: 196 tests and the full TypeScript validation pipeline.
• Local amd64 builds of the CI, gateway, supervisor, sandbox, Gator, and MCP client images; Gator Node/npm/Codex checks in both Docker and an OpenShell sandbox.
• Docker sandbox tests: 6 TLS/uv tests and all 3 MCP conformance scenarios.
• Certificate checks reject all 12 published demonstration chains; Node HTTPS checks also pass a valid-certificate positive control.
• nix flake check --no-build --all-systems; uv 0.13.4 resolves for x86_64 Linux, ARM64 Linux, and ARM64 macOS.
• Native Linux Nix uv package build and uv --version: 0.13.4.
• Documentation validation, Markdown lint, and git diff --check.

No new unit tests: this change updates dependency versions and image packaging. Image runtime checks were run on amd64; the pinned image manifests include arm64.

Checklist

• Follows Conventional Commits.
• Commits are signed off (DCO).
• Relevant SDK and operational documentation updated.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-4801.docs.buildwithfern.com/openshell

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.