From 3b6d0321209858516c1de3eee23d6dbec75c53c2 Mon Sep 17 00:00:00 2001
From: Jeremy Daer <jeremy@37signals.com>
Date: Tue, 20 Oct 2026 20:47:52 -0700
Subject: [PATCH 1/4] Build with Go 1.26.10 for GO-2026-6809

The v0.15.0 release run failed its govulncheck step on GO-2026-6809,
crypto/x509 "Distrust compromised intermediate certificates", found in
the Go 1.26.9 standard library and fixed in 1.26.10. v0.15.0 never
published; this ships as v0.15.1.

As with the 1.26.9 bump, this is the toolchain line, not the go line.
setup-go reads the toolchain directive, so every CI and release job
builds and scans with 1.26.10, and a local go older than that switches
to it. The go line stays the minimum that builds the module, since the
flake builds with nixpkgs' Go under GOTOOLCHAIN=local.
---
 go.mod | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/go.mod b/go.mod
index c8a17713f..ac592f6f2 100644
--- a/go.mod
+++ b/go.mod
@@ -2,7 +2,7 @@ module github.com/basecamp/basecamp-cli
 
 go 1.26.7
 
-toolchain go1.26.9
+toolchain go1.26.10
 
 require (
 	charm.land/bubbles/v2 v2.2.1

From 04b6358eadd3cf4d2e8317bd3b922383dfba4999 Mon Sep 17 00:00:00 2001
From: Jeremy Daer <jeremy@37signals.com>
Date: Tue, 20 Oct 2026 20:49:48 -0700
Subject: [PATCH 2/4] Update nix flake and plugin version for v0.15.1

---
 .claude-plugin/plugin.json | 2 +-
 .codex-plugin/plugin.json  | 2 +-
 nix/package.nix            | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json
index 717c12c9b..d214555a8 100644
--- a/.claude-plugin/plugin.json
+++ b/.claude-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "basecamp-cli",
-  "version": "0.15.0",
+  "version": "0.15.1",
   "description": "Basecamp integration for Claude Code. Create todos, track work, link code to projects.",
   "author": {
     "name": "37signals",
diff --git a/.codex-plugin/plugin.json b/.codex-plugin/plugin.json
index 5cc8639ac..e58849292 100644
--- a/.codex-plugin/plugin.json
+++ b/.codex-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "basecamp-cli",
-  "version": "0.15.0",
+  "version": "0.15.1",
   "description": "Use Basecamp from Codex to find work, create todos, and keep projects up to date.",
   "author": {
     "name": "37signals",
diff --git a/nix/package.nix b/nix/package.nix
index 8f1f8277b..b47f10d95 100644
--- a/nix/package.nix
+++ b/nix/package.nix
@@ -3,7 +3,7 @@
 buildGoModule.override { go = go_1_26; } (finalAttrs: {
   pname = "basecamp";
   # Updated automatically by scripts/update-nix-flake.sh on each release.
-  version = "0.15.0";
+  version = "0.15.1";
 
   src = lib.cleanSource ./..;
 

From 3e34d5bad53c6ac6dbd330896535e60976e332b2 Mon Sep 17 00:00:00 2001
From: Jeremy Daer <jeremy@37signals.com>
Date: Tue, 20 Oct 2026 22:43:48 -0700
Subject: [PATCH 3/4] Advance flake.lock to nixpkgs-unstable for Go 1.26.9

The flake builds with nixpkgs go_1_26 under GOTOOLCHAIN=local, not the
go.mod toolchain line, and the pinned nixpkgs carried Go 1.26.7. A
Nix-built binary therefore missed the eleven standard-library advisories
fixed in 1.26.9 as well as GO-2026-6809.

nixpkgs-unstable has Go 1.26.9 but not yet 1.26.10, so this closes the
eleven and leaves GO-2026-6809 for the Nix build only. flake.lock moves
again in its own change once nixpkgs-unstable carries 1.26.10; Nix
installs build from main, so that needs no new tag. vendorHash is
unchanged, and the flake builds a 0.15.1 binary that reports go1.26.9.
---
 flake.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/flake.lock b/flake.lock
index a682097d9..fba2492bf 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1787814960,
-        "narHash": "sha256-PYZq1qzCJXC2zGI0mH07vrZBsw6DRBAOX0jN1pPtqOQ=",
+        "lastModified": 1792506237,
+        "narHash": "sha256-Q/8KLB6jNfpaUN1HAedE/u/Et9feE/zYSsutBLKrCFk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "c27cdad491a991b11ed731760aa2ef8db0cb0410",
+        "rev": "5adc50831c259f87faeb09ddf930d43597197473",
         "type": "github"
       },
       "original": {

From e24e17cdd0ca0da9ada7fe940b78279ef8d18bf3 Mon Sep 17 00:00:00 2001
From: Jeremy Daer <jeremy@37signals.com>
Date: Tue, 20 Oct 2026 23:15:27 -0700
Subject: [PATCH 4/4] Keep flake.lock where v0.14.0 had it for this release

Today's nixpkgs-unstable removed ruby_3_3, which the dev shell pins in step
with .mise.toml and CI's setup-ruby. Moving Ruby to 3.4 everywhere and the
flake to a Go 1.26.10 nixpkgs goes in its own PR after the release; Nix
installs build from main, so they pick it up without a tag.
---
 flake.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/flake.lock b/flake.lock
index fba2492bf..a682097d9 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1792506237,
-        "narHash": "sha256-Q/8KLB6jNfpaUN1HAedE/u/Et9feE/zYSsutBLKrCFk=",
+        "lastModified": 1787814960,
+        "narHash": "sha256-PYZq1qzCJXC2zGI0mH07vrZBsw6DRBAOX0jN1pPtqOQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5adc50831c259f87faeb09ddf930d43597197473",
+        "rev": "c27cdad491a991b11ed731760aa2ef8db0cb0410",
         "type": "github"
       },
       "original": {