From 6edea124fb65f00d58b3a0f1ec6cabe88236b882 Mon Sep 17 00:00:00 2001
From: notplants-bot <mfowler.email@protonmail.com>
Date: Sat, 1 Aug 2026 21:21:08 +0000
Subject: [PATCH] =?UTF-8?q?flake:=20update=20inputs=20=E2=80=94=20nixpkgs?=
 =?UTF-8?q?=2024.11=20->=2026.05,=20sops-nix=20follows=20(operator=202026-?=
 =?UTF-8?q?08-01)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

nixpkgs un-pinned from a frozen rev (50ab7937, 24.11, 2025-06-30) to the nixos-26.05
channel; sops-nix un-pinned to follow it. The old pins claimed to match the cc-ci
server "for ecosystem consistency", but this host runs agents/tmux/nginx/docker, not
recipe CI, so it need not track that server — and a frozen rev only accrues unpatched
CVEs. Built + activated: generation nixos-26.05.20260731.5b4f72e, kernel 6.6.94 ->
6.18.40 (reboot pending for the kernel). Pre-update files: /tmp/flake.{nix,lock}.pre-update.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 flake.lock | 15 +++++++--------
 flake.nix  | 11 +++++++----
 2 files changed, 14 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 143b18c..0d79ac4 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,17 +2,17 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1751274312,
-        "narHash": "sha256-/bVBlRpECLVzjV19t5KMdMFWSwKLtb5RyXdjz3LJT+g=",
+        "lastModified": 1785491804,
+        "narHash": "sha256-p00vplVOyfKGlhju0+eGGPAxyYYKaY0lpyuoHLFIx2Y=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "50ab793786d9de88ee30ec4e4c24fb4236fc2674",
+        "rev": "5b4f72e1705a63aace42900610c4db82cb4af0ec",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
+        "ref": "nixos-26.05",
         "repo": "nixpkgs",
-        "rev": "50ab793786d9de88ee30ec4e4c24fb4236fc2674",
         "type": "github"
       }
     },
@@ -29,17 +29,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1750119275,
-        "narHash": "sha256-Rr7Pooz9zQbhdVxux16h7URa6mA80Pb/G07T4lHvh0M=",
+        "lastModified": 1783174389,
+        "narHash": "sha256-aCWC8ngycU7OdJrU2+Je3qf+1a2ykuBvpPhZT/9tXMc=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "77c423a03b9b2b79709ea2cb63336312e78b72e2",
+        "rev": "f1406619a3884cd5c47992a70b8b35c9c0fcb4c9",
         "type": "github"
       },
       "original": {
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "77c423a03b9b2b79709ea2cb63336312e78b72e2",
         "type": "github"
       }
     }
diff --git a/flake.nix b/flake.nix
index ae4d17c..cb658f3 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,11 +2,14 @@
   description = "cc-ci-orchestrator — NixOS host for the cc-ci loops runtime (Builder/Adversary/Watchdog)";
 
   inputs = {
-    # Pinned to the same revision as the cc-ci server for ecosystem consistency.
-    nixpkgs.url = "github:NixOS/nixpkgs/50ab793786d9de88ee30ec4e4c24fb4236fc2674";
+    # Follow the current stable release channel (operator 2026-08-01), was a hard rev pin at
+    # nixpkgs 24.11 (50ab7937, 2025-06-30) kept "the same as the cc-ci server". This host runs
+    # agents/tmux/nginx/docker, not recipe CI, so it does not need to match that server — and a
+    # frozen rev only accrues unpatched CVEs. `nix flake update` now actually moves.
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
 
-    # Same pin as cc-ci server (buildGo125Module compatibility with nixpkgs 24.11).
-    sops-nix.url = "github:Mic92/sops-nix/77c423a03b9b2b79709ea2cb63336312e78b72e2";
+    # sops-nix follows nixpkgs below, so it no longer needs its own matching pin.
+    sops-nix.url = "github:Mic92/sops-nix";
     sops-nix.inputs.nixpkgs.follows = "nixpkgs";
   };