chore: update flake.lock (monthly)

[sb-postgres-bot]

Automated changes by the update-flake-lock GitHub Action.

Flake lock file updates:

• Updated input 'devshell':
    'github:numtide/devshell/17ed8d9744ebe70424659b0ef74ad6d41fc87071?narHash=sha256-M7SZyPZiqZUR/EiiBJnmyUbOi5oE/03tCeFrTiUZchI%3D' (2025-11-24)
  → 'github:numtide/devshell/255a2b1725a20d060f566e4755dbf571bbbb5f76?narHash=sha256-460jc0%2BCZfyaO8%2Bw8JNtlClB2n4ui1RbHfPTLkpwhU8%3D' (2026-01-19)
• Updated input 'flake-parts':
    'github:hercules-ci/flake-parts/2cccadc7357c0ba201788ae99c4dfa90728ef5e0?narHash=sha256-LlLt2Jo/gMNYAwOgdRQBrsRoOz7BPRkzvNaI/fzXi2Q%3D' (2025-11-21)
  → 'github:hercules-ci/flake-parts/9d0d87172c374f89da73c1cfe6d81ae62feac1f1?narHash=sha256-onL0VLf9vPllmT0H/OlURIU5r5t5WIEl7t4tVNKT0Nw%3D' (2026-08-24)
• Updated input 'flake-parts/nixpkgs-lib':
    'github:nix-community/nixpkgs.lib/719359f4562934ae99f5443f20aa06c2ffff91fc?narHash=sha256-b0yj6kfvO8ApcSE%2BQmA6mUfu8IYG6/uU28OFn4PaC8M%3D' (2025-10-29)
  → 'github:nix-community/nixpkgs.lib/0e79af5e3d4dcfcd676ab5ba3f95d2e3352e078c?narHash=sha256-OmshNvn2vupOFpYinLUu%2B1Dnpu4n7Q5N3ggGVNHpkUI%3D' (2026-07-26)
• Updated input 'git-hooks':
    'github:cachix/git-hooks.nix/548fc44fca28a5e81c5d6b846e555e6b9c2a5a3c?narHash=sha256-rhSqPNxDVow7OQKi4qS5H8Au0P4S3AYbawBSmJNUtBQ%3D' (2025-12-06)
  → 'github:cachix/git-hooks.nix/27555e2624241fb116b49095df4caaee85a25691?narHash=sha256-nt%2BlUqYVpc9Y6JeMd2WmXzCDojasdadKo0mWcluvY2Y%3D' (2026-09-01)
• Updated input 'git-hooks/flake-compat':
    'github:edolstra/flake-compat/f387cd2afec9419c8ee37694406ca490c3f34ee5?narHash=sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4%3D' (2025-10-27)
  → 'github:NixOS/flake-compat/5edf11c44bc78a0d334f6334cdaf7d60d732daab?narHash=sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns%3D' (2025-12-29)
• Removed input 'git-hooks/gitignore'
• Removed input 'git-hooks/gitignore/nixpkgs'
• Updated input 'multigres':
    'github:multigres/multigres/b713432298450dd0095498193e86d9f9a9f2c348?narHash=sha256-rHIfalPF5%2BP7innXfoP4cIH4EqzIMVP5qepGYb/iJpA%3D' (2026-07-29)
  → 'github:multigres/multigres/b0d11a0125275333187a1502e952c2655c594b0f?narHash=sha256-7%2BMt4T55oxmSd9UoSvir4Z2JzLm6ggVvzH9sgZWGx7E%3D' (2026-09-01)
• Updated input 'nix-darwin':
    'github:nix-darwin/nix-darwin/9f48ffaca1f44b3e590976b4da8666a9e86e6eb1?narHash=sha256-V%2BVkFs0aSG0ca8p/N3gib7FAf4cq9jyr5Gm%2BZBrHQpo%3D' (2026-01-06)
  → 'github:nix-darwin/nix-darwin/4cff07de74b50e64bdd68cd4e722ab5b6b35ee48?narHash=sha256-oQFip%2Bv0luP8NIxJzmiW4Wu8bILsbFWom5l0zonl8hQ%3D' (2026-08-16)
• Updated input 'nix-editor':
    'github:snowfallorg/nix-editor/b5017f8d61753ce6a3a1a2aa7e474d59146a8ae3?narHash=sha256-Ne9NG7x45a8aJyAN%2ByYWbr/6mQHBVVkwZZ72EZHHRqw%3D' (2023-12-20)
  → 'github:snowfallorg/nix-editor/a72c7d695d5568fe19ff34d161a22c716ffbdc07?narHash=sha256-9CP5NPGPNEJZCAIUytdXrvDXUBaOKaw6uAKJwvonJBI%3D' (2026-02-26)
• Removed input 'nix-editor/utils'
• Updated input 'nix-eval-jobs':
    'github:nix-community/nix-eval-jobs/daa42f9e9c84aeff1e325dd50fda321f53dfd02c?narHash=sha256-hA%2BNOH8KDcsuvH7vJqSwk74PyZP3MtvI/l%2BCggZcnTc%3D' (2025-10-14)
  → 'github:nix-community/nix-eval-jobs/55e658518ae417cf26f36643fcfdebe5c5db17aa?narHash=sha256-4z5GnNd9cbkKChaovYghlxuh1k5rYlxNT7wpZeR1oU0%3D' (2026-09-01)
• Removed input 'nix-eval-jobs/flake-parts'
• Updated input 'nix-eval-jobs/nix':
    'github:NixOS/nix/4041bfdb401ad6d1c31a292fab90392254be506a?narHash=sha256-BuKtM7Vr5EcxBXxUENBQPlOBwmNd5mkTRkSmlJi/iQ4%3D' (2025-10-14)
  → 'github:NixOS/nix/8eb4cf95c7a0541f6b360db49b528e6d7e71e403?narHash=sha256-wmE9BA1E5C1HDlK5iuYkY%2BXFEby5N1GHMx0yxE0el9E%3D' (2026-08-23)
• Updated input 'nix-eval-jobs/nixpkgs':
    'https://releases.nixos.org/nixpkgs/nixpkgs-25.11pre877036.c12c63cd6c5e/nixexprs.tar.xz?narHash=sha256-vhAtaRMIQiEghARviANBmSnhGz9Qf2IQJ%2BnQgsDXnVs%3D' (1980-01-01)
  → 'https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1061294.ac6b2166e7a9/nixexprs.tar.xz?narHash=sha256-ZEByVBPrWjUOLKInvr2aOGcy13/ObSLNEt/1o5ThyzA%3D' (2026-08-25)
• Updated input 'nix2container':
    'github:nlewo/nix2container/e5496ab66e9de9e3f67dc06f692dfbc471b6316e?narHash=sha256-vdOuy2pid2/DasUgb08lDOswdPJkN5qjXfBYItVy/R4%3D' (2025-10-29)
  → 'github:nlewo/nix2container/76be9608a7f4d6c985d28b0e7be903ae2547df3e?narHash=sha256-2lguQpLPQaxpQCJjXhmEEAfabwsAhkP29Z7fgLzHARA%3D' (2026-04-06)
• Updated input 'nixpkgs':
    'https://releases.nixos.org/nixos/unstable/nixos-26.05pre921484.fb7944c166a3/nixexprs.tar.xz?narHash=sha256-3xDI4xtzovwqE/eAxCwmXxUqBg6Yoam2L1u0IwRNhW4%3D' (2026-01-02)
  → 'https://releases.nixos.org/nixos/unstable/nixos-26.11pre1064949.34ab99075ac4/nixexprs.tar.xz?narHash=sha256-maQBa7XmWJ%2Ba6te4QwF%2B%2BR1FIXUrjvki0AtGOOhyZn0%3D' (2026-08-31)
• Updated input 'rust-overlay':
    'github:oxalica/rust-overlay/7b50ad68415ae5be7ee4cc68fa570c420741b644?narHash=sha256-ngar%2ByP06x3%2B2k2Iey29uU0DWx5ur06h3iPBQXlU%2ByI%3D' (2025-12-09)
  → 'github:oxalica/rust-overlay/6a84c41e705533dcc5569ac0731f18406b4cdf86?narHash=sha256-siCQqLbY7AbZ9V3oyc65K8bhNr7QgZTXoqLTws3pv0s%3D' (2026-09-01)
• Updated input 'treefmt-nix':
    'github:numtide/treefmt-nix/5b4ee75aeefd1e2d5a1cc43cf6ba65eba75e83e4?narHash=sha256-AlEObg0syDl%2BSpi4LsZIBrjw%2BsnSVU4T8MOeuZJUJjM%3D' (2025-11-12)
  → 'github:numtide/treefmt-nix/27b3b12a8e6375f28ebe122f07d230ca5459bbfa?narHash=sha256-WSFCsDSE5ffgD2MqzkM2CYjeFiKhRF/dJUN8uedb6YE%3D' (2026-08-16)

Running GitHub Actions on this PR

GitHub Actions will not run workflows on pull requests which are opened by a GitHub Action.

To run GitHub Actions workflows on this PR, close and re-open this pull request.

[brainrake]

Why this PR is failing

It's the automated flake.lock update, and it bumped nixpkgs from 25.11pre → 26.05pre (c12c63c → 346dd96), which broke three independent things downstream:

1. nix-eval / eval fails — nix/packages/supascan.nix:4 does go124 = pkgs.go_1_24;, but go_1_24 no longer exists in the new nixpkgs (attribute 'go_1_24' missing). Affects checks.*.supascan on all 3 platforms.

2. linux-arm64/x64 without Nix fail — binaries built against the newer nixpkgs now link against glibc 2.42, but the "without Nix" test runners have an older glibc: psql-wrapped: /lib/aarch64-linux-gnu/libc.so.6: version 'GLIBC_2.42' not found.

3. Check Docker Image Changes fails — sfcgal-2.2.0 fails to build under the newer CGAL pulled in by the nixpkgs bump: 'surface_intersection' is not a member of 'CGAL::Polygon_mesh_processing'. This cascades to break the postgis derivations that depend on sfcgal.

Extension Dependency Analysis was still running at last check but is almost certainly hitting the same postgis/sfcgal build failure (#3).

Likely fixes needed (not applied — just diagnosis):

• Repin go_1_24 → whatever Go attr exists in the new nixpkgs (e.g. go_1_25), in nix/packages/supascan.nix.
• Either pin an older/patched sfcgal, or patch its CGAL call site (surface_intersection → self_intersections or equivalent per new CGAL API).
• The glibc mismatch is likely inherent to the nixpkgs bump being ahead of the "without Nix" CI runner image — may need to update that runner image, or hold nixpkgs back until compatible.

[brainrake]

Opened a fix for the go_1_24 nix-eval failure (root cause #1 above) in #2329 — repins supascan/gatekeeper to go_1_25, the newest Go version present in both the current and bumped nixpkgs.

[brainrake]

Follow-up on the glibc issue (root cause #2 in the earlier comment): checked every shared library in the portable CLI bundle (~150 .so files) for their GLIBC symbol requirements. Only one is not backwards compatible with the glibc this bundle previously required: `libncursesw.so.6`, which needs `GLIBC_2.42` for a single symbol, `cfgetospeed`. Everything else — postgres itself, libpq, openssl, curl, ICU, every extension — tops out at `GLIBC_2.38`.

Confirmed it's not an ncurses version issue: the exact same ncurses source, built against the old nixpkgs glibc (2.40), only requires up to `GLIBC_2.38`; built against the bumped glibc (2.42), it requires `GLIBC_2.42` for that one symbol. glibc re-versioned `cfgetospeed` (an obscure serial-baud-rate termios function that's basically only called by curses libraries) in 2.42, and the linker binds fresh compiles to the newest version by default. The old, functionally identical `GLIBC_2.17`-versioned symbol is still exported by the new glibc, so this is fixable with a targeted `.symver` directive rather than needing a newer host OS or a global glibc pin.

Fix in progress: #2336 (validation PR against this branch, will land as a develop-based PR once confirmed green).

[samrose]

@brainrake this needs a serious testing plan documented somewhere, to assure that breaking changes are not introduced. I did not see it here in the PR.