fix(nix): bump nixpkgs pin so nix-shell-test builds with go >= 1.25.9

[defangdevs]

Problem

nix-shell-test is failing on main and on every open PR (including #2225) with:

go: go.mod requires go >= 1.25.9 (running go 1.25.5; GOTOOLCHAIN=local)

Root cause

Dependabot's github.com/moby/buildkit bump in #2224 pulled in buildkit v0.31.1, whose own go.mod requires go 1.25.9 — this transitively raised our module's effective minimum toolchain requirement. That's unrelated to any single PR's diff; it landed on main itself.

flake.lock's nixpkgs input was pinned to a January 2026 revision that only ships go_1_25 1.25.5. The Nix sandbox has no network access to auto-fetch a newer toolchain (GOTOOLCHAIN=local), so the build fails outright before it even gets to vendor-hash verification — the CI job's existing "Update vendorHash if needed" auto-fix step never even triggers, since the failure isn't a hash mismatch.

Fix

• Bump the nixpkgs flake input to a current revision (go_1_25 = 1.25.13, satisfies >= 1.25.9).
• Update pkgs/defang/cli.nix's vendorHash for the go.sum changes from the buildkit bump (the old hash was already stale after chore(deps): bump github.com/moby/buildkit from 0.28.1 to 0.31.1 in /src #2224, just never surfaced because the build died on the Go version check first).

Verified locally:

nix build .#defang-cli   # succeeds
nix run .#defang-cli -- --version   # defang version development

Test plan

• nix build .#defang-cli succeeds locally with the updated pin
• nix-shell-test passes in CI on this PR

[coderabbitai]

Warning

Review limit reached

@defangdevs, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 25 minutes

Limit details: You’ve used all 2 included reviews currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: e6a4a318-c1f6-4a56-bf2d-dc7139eedba8

📥 Commits

Reviewing files that changed from the base of the PR and between 77957a2 and dcd65eb.

⛔ Files ignored due to path filters (1)

• flake.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• pkgs/defang/cli.nix

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}