From 2ca29e9d42430a738dfcf5945d2b944d2577f97c Mon Sep 17 00:00:00 2001 From: "Node.js GitHub Bot" Date: Sun, 8 Nov 2026 00:36:57 +0000 Subject: [PATCH 1/5] tools: update nixpkgs pins - unstable to 085af13c1607f4f73ab1e7a51071faf6577a7e87 - 26.05 to 57f1c8965649ce5bcac5118a0d2e41f1fbdc56e5 --- tools/nix/pkgs-26.05.nix | 4 ++-- tools/nix/pkgs.nix | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/tools/nix/pkgs-26.05.nix b/tools/nix/pkgs-26.05.nix index d90a1d8ba931..9a410b7fce91 100644 --- a/tools/nix/pkgs-26.05.nix +++ b/tools/nix/pkgs-26.05.nix @@ -1,10 +1,10 @@ arg: let repo = "https://github.com/NixOS/nixpkgs"; - rev = "c0ae35c6460f00dcac6a59063e080f826e620b28"; + rev = "57f1c8965649ce5bcac5118a0d2e41f1fbdc56e5"; nixpkgs = import (builtins.fetchTarball { url = "${repo}/archive/${rev}.tar.gz"; - sha256 = "0hbdqzpiv8p44li7jng01mlg2zbb1ff18z3r250f4rjbqflbiwxs"; + sha256 = "08gxbi52psc9wvflpfsli9fjvcv1jvzd70w6c8pxl4swjvfcsq3d"; }) arg; in # Unstable channel no longer supports Intel architecture for macOS. We can use the 26.05 channel diff --git a/tools/nix/pkgs.nix b/tools/nix/pkgs.nix index 43cbb29ddd39..309c35241c17 100644 --- a/tools/nix/pkgs.nix +++ b/tools/nix/pkgs.nix @@ -1,10 +1,10 @@ arg: let repo = "https://github.com/NixOS/nixpkgs"; - rev = "0bb2eedc20e4739f29e8045034f2828ad7054f8f"; + rev = "085af13c1607f4f73ab1e7a51071faf6577a7e87"; nixpkgs = import (builtins.fetchTarball { url = "${repo}/archive/${rev}.tar.gz"; - sha256 = "008j4dj5yrzww91qvp1lp2c9d1lkwc6i2dpainf5nkdkr3rwj8vy"; + sha256 = "0wwdfxvwc19qymmjshf8qzw39dqyav1kgxna2ady9l7akqzanm1i"; }) arg; in # Unstable channel no longer supports Intel architecture for macOS. We can use the 26.05 channel From d92903f3c8a50dbadbdc97a296340f7213caa8d3 Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Sun, 8 Nov 2026 10:02:03 +0100 Subject: [PATCH 2/5] fixup! tools: update nixpkgs pins --- tools/nix/pkgs.nix | 19 ------------------- 1 file changed, 19 deletions(-) diff --git a/tools/nix/pkgs.nix b/tools/nix/pkgs.nix index 309c35241c17..6ed279484a52 100644 --- a/tools/nix/pkgs.nix +++ b/tools/nix/pkgs.nix @@ -38,23 +38,4 @@ else Cflags: -I${lib.getInclude boringssl}/include ''; }; - - # TODO: remove pin once https://github.com/mozilla/sccache/issues/2869 is resolved - sccache = nixpkgs.callPackage (builtins.fetchurl { - url = "${repo}/raw/aff8a0b28396750446e5537a96461bc4facdb287/pkgs/by-name/sc/sccache/package.nix"; - sha256 = "09dlc99sam9ld9jvzgcc00r4v4ls1cmbb0yim3mr895fpbs8b3qa"; - }) { }; - - # TODO: remove this override once the pin we use has picked up https://github.com/NixOS/nixpkgs/pull/575002 - uvwasi = nixpkgs.uvwasi.overrideAttrs (old: { - patches = old.patches ++ [ - (nixpkgs.fetchpatch2 { - url = "https://github.com/nodejs/uvwasi/commit/fe602a6911207efd8dcfc070a752bcf76813c978.patch?full_index=1"; - hash = "sha256-MyFvRuEhcqZR+Bz2pY9vani8U1iyQrDeni2kKKnJGEI="; - }) - ]; - - buildInputs = [ ]; - propagatedBuildInputs = old.buildInputs; - }); } From 0740983edff105fdb440c98af95a73a457ea7350 Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Sun, 8 Nov 2026 10:31:15 +0100 Subject: [PATCH 3/5] fixup! tools: update nixpkgs pins --- tools/nix/ci-shell.nix | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/tools/nix/ci-shell.nix b/tools/nix/ci-shell.nix index 65efc595a15e..344cbaa80b20 100644 --- a/tools/nix/ci-shell.nix +++ b/tools/nix/ci-shell.nix @@ -46,13 +46,17 @@ args@{ ) }-pkg-config-only" { + __structuredAttrs = true; + strictDeps = true; nativeBuildInputs = [ pkgs.pkgconf ]; buildInputs = [ dep ]; + outputChecks.out.disallowedRequisites = [ pkgs.pkgconf ]; } '' mkdir -p "$out/lib/pkgconfig" - for pc in $(pkgconf --list-package-names); do - ln -s "$(pkgconf --path "$pc")" "$out/lib/pkgconfig/" + for pc in $(pkgconf --env-only --list-package-names); do + PC_PATH="$(pkgconf --path "$pc")" + [ -z "$PC_PATH" ] || ln -s "$PC_PATH" "$out/lib/pkgconfig/" done '' ) old.buildInputs; From fdb69b1f77a28c875466edf072093d22832d482e Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Sun, 8 Nov 2026 11:22:57 +0100 Subject: [PATCH 4/5] fixup! tools: update nixpkgs pins --- .github/workflows/nix-changes.yml | 6 +++++- tools/nix/list-requisites.sh | 4 ++-- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/workflows/nix-changes.yml b/.github/workflows/nix-changes.yml index 85fba6798bcf..64d5c6e23593 100644 --- a/.github/workflows/nix-changes.yml +++ b/.github/workflows/nix-changes.yml @@ -56,7 +56,10 @@ jobs: - uses: cachix/install-nix-action@75c75c31ebece974e48ebc36b4ad125bd97bd97b # v31.11.3 with: - extra_nix_config: sandbox = true + extra_nix_config: | + sandbox = true + restrict-eval = true + allowed-uris = https://github.com/NixOS/nixpkgs/archive/ - uses: cachix/cachix-action@38b082610b782e7e93e209c35fd730d399dee866 # v17 with: @@ -78,6 +81,7 @@ jobs: ./tools/nix/list-requisites.sh > requisites-${{ matrix.system }}-before.list env: PUSH_BEFORE_SHA: ${{ github.event_name == 'push' && github.event.before || '' }} + NIX_CONFIG: restrict-eval = false - name: Output diff run: | diff --git a/tools/nix/list-requisites.sh b/tools/nix/list-requisites.sh index a66a89eb7def..ee6b8da6f025 100755 --- a/tools/nix/list-requisites.sh +++ b/tools/nix/list-requisites.sh @@ -4,7 +4,7 @@ set -ex BASE_DIR=$(cd "$(dirname "$0")/../.." && pwd) -OPTIONAL_FLAGS=$(nix-instantiate -I "nixpkgs=$BASE_DIR/tools/nix/pkgs.nix" --eval --strict --raw -E " +OPTIONAL_FLAGS=$(nix-instantiate -I "$BASE_DIR" -I "nixpkgs=$BASE_DIR/tools/nix/pkgs.nix" --eval --strict --raw -E " (import {}).lib.concatMapStrings (n: ''--arg \${n} true '') (builtins.filter @@ -16,7 +16,7 @@ OPTIONAL_FLAGS=$(nix-instantiate -I "nixpkgs=$BASE_DIR/tools/nix/pkgs.nix" --eva DRV=$( cd "$BASE_DIR" # shellcheck disable=SC2086 - nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \ + nix-instantiate -I. -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \ $OPTIONAL_FLAGS \ --arg sharedLibDeps '{ # Using an empty set as some build dependencies are required only in the absence of shared deps (e.g. Cargo). From 8e1e9e7589f7315620aab2a9ba5cff9ae34ce799 Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Sun, 8 Nov 2026 11:26:19 +0100 Subject: [PATCH 5/5] fixup! tools: update nixpkgs pins --- .github/workflows/nix-changes.yml | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/.github/workflows/nix-changes.yml b/.github/workflows/nix-changes.yml index 64d5c6e23593..e3e1f8653960 100644 --- a/.github/workflows/nix-changes.yml +++ b/.github/workflows/nix-changes.yml @@ -56,10 +56,7 @@ jobs: - uses: cachix/install-nix-action@75c75c31ebece974e48ebc36b4ad125bd97bd97b # v31.11.3 with: - extra_nix_config: | - sandbox = true - restrict-eval = true - allowed-uris = https://github.com/NixOS/nixpkgs/archive/ + extra_nix_config: sandbox = true - uses: cachix/cachix-action@38b082610b782e7e93e209c35fd730d399dee866 # v17 with: @@ -68,6 +65,12 @@ jobs: - name: Compute requisites after change run: ./tools/nix/list-requisites.sh > requisites-${{ matrix.system }}-after.list + env: + # Making sure we do not depend on eval-time fetches, which are not cached. + # The only exception is nixpkgs source tarballs. + NIX_CONFIG: | + restrict-eval = true + allowed-uris = https://github.com/NixOS/nixpkgs/archive/ - name: Compute requisites before change run: | @@ -81,7 +84,6 @@ jobs: ./tools/nix/list-requisites.sh > requisites-${{ matrix.system }}-before.list env: PUSH_BEFORE_SHA: ${{ github.event_name == 'push' && github.event.before || '' }} - NIX_CONFIG: restrict-eval = false - name: Output diff run: |