From 8f58bae5ed7e5515b99f4728bcbafed5c082ca32 Mon Sep 17 00:00:00 2001 From: Martin Fischer Date: Wed, 21 Oct 2026 18:04:16 +0200 Subject: deps: update nixos, nixos-small and nixos-unstable Security update due to CA compromise. For all: nss: 3.112.5, 3.128 -> 3.112.5, 3.131 nix: 2.34.8 -> 2.34.9 For hamac: chromium: 153.0.8010.52 -> 155.0.8059.84 firefox: 156.0 -> 158.0 jujutsu: 0.45.1 -> 0.46.0 pi-coding-agent: 0.87.1 -> 1.3.0 thunderbird: 156.0 -> 157.0.1 wireshark-qt: 4.6.8 -> 4.6.9 zed-editor: 1.20.2 -> 1.24.2 For ev: grafana-loki: 3.7.7 -> 3.7.8 zigbee2mqtt: 2.14.0 -> 2.14.2 For tente: grafana: 13.0.9 -> 13.0.11 grafana-loki: 3.7.7 -> 3.7.8 headscale: 0.28.0 -> 0.29.3 nginx: 1.30.5 -> 1.30.6 --- nixos/npins/sources.json | 16 ++++++++-------- nixos/profiles/workstation/firefox.nix | 1 + nixos/profiles/workstation/pkgs/pi.nix | 23 ++++++++++++++++++++++- 3 files changed, 31 insertions(+), 9 deletions(-) (limited to 'nixos') diff --git a/nixos/npins/sources.json b/nixos/npins/sources.json index 070f08f..8fc6e74 100644 --- a/nixos/npins/sources.json +++ b/nixos/npins/sources.json @@ -80,9 +80,9 @@ }, "branch": "master", "submodules": false, - "revision": "bac7da2cfa0cd67a764a4f1199119eaa3164add2", + "revision": "0d373b36fed5c24e34ebd9747390a4347bcb1ab2", "url": null, - "hash": "sha256-PCc3AuDWSViyfA4cHXF2m6dYAw6pkm+mtJ0mUWZBjcs=" + "hash": "sha256-MngbFxDoY5BxF04MaABuKMkMErWsf+rpNvpmD6n73Sw=" }, "my-rust-features": { "type": "Git", @@ -135,20 +135,20 @@ "nixos": { "type": "Channel", "name": "nixos-26.05", - "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.10478.1bc55b9def81/nixexprs.tar.xz", - "hash": "sha256-DfkF+sEdKXCrvkg7olt82Q9cfP3p7Ro2R851fcTcSxI=" + "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.12297.cd4ea8d57de1/nixexprs.tar.xz", + "hash": "sha256-OtQ9jaQ9aXZDm61TqykPLZdXJa2NMykYG3d0tbT683U=" }, "nixos-small": { "type": "Channel", "name": "nixos-26.05-small", - "url": "https://releases.nixos.org/nixos/26.05-small/nixos-26.05.10525.ccec4b6c6bf3/nixexprs.tar.xz", - "hash": "sha256-fiFr3bohK9pcxHhhyxGuPK0U/W1/0VQl/lUXP9Spcsg=" + "url": "https://releases.nixos.org/nixos/26.05-small/nixos-26.05.12338.2544984418e6/nixexprs.tar.xz", + "hash": "sha256-+83IgDzywfGz36Lha94c6VioF93u5+FUSsIpuSLGaeM=" }, "nixos-unstable": { "type": "Channel", "name": "nixos-unstable", - "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1078696.4975466d3247/nixexprs.tar.xz", - "hash": "sha256-EZwz6sR6RLzbKiJJ9QQgXPZ/zA6P8ecfFr/6fwBRfes=" + "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1097682.02c087f3fe67/nixexprs.tar.xz", + "hash": "sha256-ij8QUxzTOHovLrNOxVRx+RAhGQFOMsJbji0veiatH5k=" }, "prometheus-sql-exporter": { "type": "GitRelease", diff --git a/nixos/profiles/workstation/firefox.nix b/nixos/profiles/workstation/firefox.nix index ead7b45..7e4e39b 100644 --- a/nixos/profiles/workstation/firefox.nix +++ b/nixos/profiles/workstation/firefox.nix @@ -17,6 +17,7 @@ "browser.aboutConfig.showWarning" = false; "browser.ml.chat.menu" = false; + "browser.nova.enabled" = false; "browser.tabs.insertAfterCurrent" = true; "browser.tabs.groups.enabled" = false; "browser.tabs.splitView.enabled" = false; diff --git a/nixos/profiles/workstation/pkgs/pi.nix b/nixos/profiles/workstation/pkgs/pi.nix index e5d1da6..d617089 100644 --- a/nixos/profiles/workstation/pkgs/pi.nix +++ b/nixos/profiles/workstation/pkgs/pi.nix @@ -4,11 +4,32 @@ lib, pi-coding-agent, python3, + runCommand, symlinkJoin, writeShellScriptBin, }: let + # Patch away the new distracting block-art logo. We're patching dist/ + # rather than src to avoid downloading >600MB of npm-deps. + pi-coding-agent-patched = runCommand "${pi-coding-agent.name}-no-logo" { } '' + cp -a ${pi-coding-agent} "$out" + chmod -R u+w "$out" + + substituteInPlace "$out/lib/node_modules/pi-monorepo/dist/modes/interactive/components/pi-logo.js" \ + --replace-fail 'return !isAppleTerminalSession();' 'return false;' \ + --replace-fail 'return `''${foregroundAnsi(CORAL, mode)}P''${RESET}''${foregroundAnsi(YELLOW, mode)}i''${RESET}`;' \ + 'return theme.bold(theme.fg("accent", "pi"));' + substituteInPlace "$out/lib/node_modules/pi-monorepo/dist/bundle/chunks/chunk-66G7ITPS.js" \ + --replace-fail 'function supportsPiLogo(){return!isAppleTerminalSession()}' \ + 'function supportsPiLogo(){return false}' \ + --replace-fail 'function piWordmark(){let mode=theme.getColorMode();return`''${foregroundAnsi(CORAL,mode)}P''${RESET}''${foregroundAnsi(YELLOW,mode)}i''${RESET}`}' \ + 'function piWordmark(){return theme.bold(theme.fg("accent","pi"))}' + + substituteInPlace "$out/bin/pi" "$out/bin/.pi-wrapped" \ + --replace-fail '${pi-coding-agent}' "$out" + ''; + sbox = writeShellScriptBin "sbox" '' set -euo pipefail @@ -54,7 +75,7 @@ let --bind "$HOME/.config/pi" "$HOME/.config/pi" \ --bind "$physical_pwd" "$physical_pwd" \ --chdir "$physical_pwd" \ - ${pi-coding-agent}/bin/pi \ + ${pi-coding-agent-patched}/bin/pi \ --append-system-prompt "You're running in a sandbox with an ephemeral root filesystem and a separate PID namespace. The current working directory and a few configuration and cache paths are mounted from the host." \ --append-system-prompt "$HOME/.config/pi/APPEND_SYSTEM.md" \ "$@" -- cgit v1.3.1