flake: update nixpkgs input

Without https://github.com/NixOS/nixpkgs/pull/434761 evaluation of the
`nixpkgsLibTests` will fail in CI with recent enough Lix, due to reliance on
the TOML integer saturation bug.

Reported-by: Sergei Zimmerman <sergei@zimmerman.foo>

Change-Id: I6a6a6964838009d2c525f67035f84072fdfad988

docker.nix

@@ -62,8 +62,7 @@ let
     ++ autoLayered
     ++ extraPkgs;
 
-  users =
-    {
+  users = {
 
     root = {
       uid = 0;
@@ -361,7 +360,8 @@ let
         "org.opencontainers.image.version" = pkgs.nix.version;
         "org.opencontainers.image.description" =
           "Minimal Lix container image, with some batteries included.";
-      } // lib.optionalAttrs (lixRevision != null) { "org.opencontainers.image.revision" = lixRevision; };
+      }
+      // lib.optionalAttrs (lixRevision != null) { "org.opencontainers.image.revision" = lixRevision; };
     };
 
     meta = {

flake.lock

@@ -108,11 +108,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1749522908,
-        "narHash": "sha256-eWANkhWXFL1MmaxzsZ9bhLCNT8OVs7CC+OXaSDGlA8A=",
+        "lastModified": 1757198069,
+        "narHash": "sha256-m3VUcOD4rTs8J7S+3dOjWMrAjw6RcITC3XYQ98zhEFs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e5cb99555c45a13dcc5f1317462238530b0066b7",
+        "rev": "0747026fc57ecb9c28901c7f7a2b5dc40e8af43c",
         "type": "github"
       },
       "original": {

flake.nix

@@ -175,8 +175,13 @@
         {
           nixStable = prev.nix;
 
-          # Nix 2.18 has been removed from Nixpkgs ≥ 25.05, so we need to reintroduce it ourselves for our tests.
           nixVersions = prev.nixVersions // {
+            nix_2_3 = prev.nixVersions.nix_2_3.overrideAttrs (old: {
+              meta = old.meta // {
+                knownVulnerabilities = [ ];
+              };
+            });
+            # Nix 2.18 has been removed from Nixpkgs ≥ 25.05, so we need to reintroduce it ourselves for our tests.
             nix_2_18 = nix_2_18.outputs.packages.${currentStdenv.hostPlatform.system}.default;
           };
 
@@ -440,12 +445,13 @@
               in
               pkgs.symlinkJoin {
                 name = "nixpkgs-lib-tests";
-                paths =
-                  [ testWithNix ]
+                paths = [
+                  testWithNix
+                ]
                 # NOTE: nixpkgs 25.05 is being ... *creative*, and requires this dance to override
                 # the evaluator used for the test. it will break again in the future, don't worry.
                 ++ lib.optionals pkgs.stdenv.isLinux [
-                    ((pkgs.callPackage "${nixpkgs}/ci/eval" { nixVersions.latest = nix; }).attrpathsSuperset {
+                  ((pkgs.callPackage "${nixpkgs}/ci/eval" { inherit nix; }).attrpathsSuperset {
                     evalSystem = system;
                   })
                 ];

misc/capnproto.nix

@@ -46,7 +46,8 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = [
     openssl
     zlib
-  ] ++ lib.optional (stdenv.cc.isClang && stdenv.hostPlatform.isStatic) empty-libgcc_eh;
+  ]
+  ++ lib.optional (stdenv.cc.isClang && stdenv.hostPlatform.isStatic) empty-libgcc_eh;
 
   # FIXME: separate the binaries from the stuff that user systems actually use
   # This runs into a terrible UX issue in Lix and I just don't want to debug it

package.nix

@@ -238,8 +238,9 @@ stdenv.mkDerivation (finalAttrs: {
     );
   };
 
-  outputs =
-    [ "out" ]
+  outputs = [
+    "out"
+  ]
   ++ lib.optionals (!finalAttrs.dontBuild) [
     "dev"
     "doc"
@@ -285,8 +286,7 @@ stdenv.mkDerivation (finalAttrs: {
   # We only include CMake so that Meson can locate toml11, which only ships CMake dependency metadata.
   dontUseCmakeConfigure = true;
 
-  nativeBuildInputs =
-    [
+  nativeBuildInputs = [
     finalAttrs.lixPythonForBuild
     meson
     ninja
@@ -326,8 +326,7 @@ stdenv.mkDerivation (finalAttrs: {
     llvmPackages.clang-unwrapped
   ];
 
-  buildInputs =
-    [
+  buildInputs = [
     curl
     bzip2
     xz
@@ -373,8 +372,7 @@ stdenv.mkDerivation (finalAttrs: {
     finalAttrs.lixPythonForBuild
   ];
 
-  env =
-    {
+  env = {
     # Meson allows referencing a /usr/share/cargo/registry shaped thing for subproject sources.
     # Turns out the Nix-generated Cargo dependencies are named the same as they
     # would be in a Cargo registry cache.

perl/default.nix

@@ -46,7 +46,8 @@ perl.pkgs.toPerlModule (
       perlPackages.DBDSQLite
       # for kj-async
       capnproto
-    ] ++ lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Security;
+    ]
+    ++ lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Security;
 
     # Nixpkgs' Meson hook likes to set this to "plain".
     mesonBuildType = "debugoptimized";

subprojects/nix-eval-jobs/default.nix

@@ -39,7 +39,8 @@ let
       # nlohmann_json can be only discovered via cmake files
       cmake
       capnproto
-    ] ++ (lib.optional stdenv.cc.isClang [ clang-tools ]);
+    ]
+    ++ (lib.optional stdenv.cc.isClang [ clang-tools ]);
 
     passthru = {
       inherit nix;

tests/nixos/chown-to-user.nix

@@ -26,8 +26,9 @@ in
   name = "chown-to-user";
 
   nodes = {
-    machine = { lib, pkgs, ... }: {
+    machine = { config, lib, pkgs, ... }: {
       virtualisation.writableStore = true;
+      virtualisation.additionalPaths = [ config.system.build.extraUtils ];
 
       users.users.test = {
         isNormalUser = true;

tests/nixos/remote-builds-ssh-ng.nix

@@ -56,6 +56,7 @@ in
           imports = [ test.config.builders.config ];
           services.openssh.enable = true;
           virtualisation.writableStore = true;
+          virtualisation.additionalPaths = [ config.system.build.extraUtils ];
           nix.settings.sandbox = true;
           nix.settings.substituters = lib.mkForce [ ];
         };