Hm, we have a problem on this pin, because nix 2.3 has been marked insecure in #420974. This means it's not cached anymore. I guess we'll have to drop it from the parse check.

@sternenseemann @tazjin could you chime in on what the plans / progress are for backporting the recent CVE patches to Nix 2.3?

We have multiple options here:

• Drop Nix 2.3 from nixpkgs, raise nixVersions.minimum to the next available version and run the parse check with that at the lower end.
• Temporarily remove the parse check for nix 2.3 in the expectation that all knownVulnerabilities will be fixed: Only then will we get a cached nix 2.3 again.
• Immediately fix 2.3 and wait for that before the bump here.

In case we drop Nix 2.3, we can't prevent nix 2.3-incompatible syntax from sneaking in anymore and should raise the minimum required nix version to evaluate nixpkgs. IIRC, this will also allow us to remove some cruft around structuredAttrs, because we'll be able to drop support for many intermediate versions, where fixes for that were not backported.

I guess the reformat should also be added to .git-blame-ignore-revs?

I guess the reformat should also be added to .git-blame-ignore-revs?

Yes, but I'd like to do this in a follow up. I'm sure I'll need to rebase a bit more, and don't want to have a wrong hash in there. Been there before elsewhere.

what the plans / progress are for backporting the recent CVE patches to Nix 2.3?

I looked into this a bit more.

• nixVersions.nix_2_3: add knownVulnerabilities #420974 (comment) mentions the intent to backport "the most critical patches".
• The work is going on in Backport Lix CVE fixes to Nix 2.3 tvlfyi/nix#5, but doesn't look like it's finished already. Especially considering that some of these CVE have not been worked on at all, yet. (and it's unclear if they ever will be)
• It doesn't look like we will get a cached version of nix 2.3 any time soon, again.

Since we surely don't want to block this PR / updates to CI indefinitely, I will do the following:

• Remove Nix 2.3 from the CI parse check to unblock this PR.
• Open a new PR to drop Nix 2.3 entirely, since we can't test for it. Ofc, this will be subject to discussion and it ultimately doesn't need to be done at all, if the patches can be backported - but the discussion about it will be decoupled from advancing the CI pin (and nixfmt'ing the tree etc.).

Rebased and resolved merge conflicts. Not keen on more of them, so let's get this done.

I will now do all the periodic merges to resolve the arising conflicts.

Edit: For the curious, I am using the approach outlined in #395864, aka the custom git merge driver.

Backport in #428039.

I did the following:

• merged this PR
• merged master into staging-next
• merged staging-next into staging
• merged (master/staging) into haskell-updates
• merged the backport
• merged release-25.05 into staging-next-25.05
• merged staging-next-25.05 into staging-25.05

Each merge was done with the custom merge driver and then amended with another run of treefmt for incoming changes from the other branch.

All development branches are now formatted with nixfmt 1.0.0!

Thanks for handling this! Really happy to see the concatenation change land. Are you going to handle adding all of those to .git-blame-ignore-revs?

Yes, on my list.