Nix

nixpkgs stays on fa137313 (nixos-26.05), so Go 1.27.3 and golangci-lint 2.15.0 are the same builds as before. In the shell, devenv-tasks moves from 2.4.0 to 2.4.1 and brings GCC 16.2's runtime library with it, and glibc 2.42-67 leaves the closure because devenv-tasks no longer links against it.

devenv b904dcb5 → 0d6c556e — direct

Changelog:

• 91 commits on main since v2.4.0, versioned 2.4.1 in development with no tagged release yet.
• [Fix] Rejects task names containing :: (fix(tasks): reject task names containing "::" cachix/devenv#3228).
• [Fix] Starts process dependencies that never started, waits for cancellation cleanup before the scheduler exits, and skips prerequisites of disabled processes on startup (fix(tasks): start never-started process dependencies cachix/devenv#3238, fix(tasks): wait for cancellation cleanup before scheduler exit cachix/devenv#3256, fix(tasks): don't run prerequisites of disabled processes on startup cachix/devenv#3288).
• [Fix] Restores the original terminal settings after a task runs (fix(terminal): restore original settings after task execution cachix/devenv#3300).
• [Fix] Keeps task PATH exports on their own line in shell-env.sh (fix: keep PATH exports on their own line when assembling shell-env.sh cachix/devenv#3166).
• [Fix] Orders treefmt after devenv:files and copies managed files atomically (fix(files): order treefmt after devenv:files, copy atomically cachix/devenv#3173).
• [Fix] Updates the bundled Nix to 2.35.3 (fix(nix): update bundled Nix to 2.35.3 cachix/devenv#3290) and substitutes locked inputs through Nix's native fetcher during bootstrap (fix(bootstrap): substitute locked inputs through native Nix fetcher cachix/devenv#3312).
• [Fix] languages.go only rebuilds its dev dependencies when the chosen Go package is newer.
• [Feature] Adds git environment configuration and attributes (feat(git): add environment configuration and attributes cachix/devenv#3301), a Mergiraf merge driver (feat: add Mergiraf merge driver integration cachix/devenv#2284), a changelog-merge integration (feat(integrations): add changelog-merge cachix/devenv#3307) and an ollama service (Add ollama service cachix/devenv#3306).
• [Fix] Drops its cachix flake input.

Codebase impact:

• No impact detected.

rust_devenv-tasks 2.4.0 → 2.4.1 — transitive

Changelog:

• [Fix] The task runner built from the devenv revision above, carrying its task fixes (fix(tasks): reject task names containing "::" cachix/devenv#3228, fix(tasks): start never-started process dependencies cachix/devenv#3238, fix(tasks): wait for cancellation cleanup before scheduler exit cachix/devenv#3256, fix(tasks): don't run prerequisites of disabled processes on startup cachix/devenv#3288, fix(terminal): restore original settings after task execution cachix/devenv#3300).

Codebase impact:

• No impact detected.

gcc 16.2.0 — new, transitive

Changelog:

• [Feature] GCC 16.2's runtime libraries (libstdc++, libgcc_s), which devenv-tasks now links against since it is built from devenv's newer nixpkgs.

Codebase impact:

• No impact detected.

devenv/nixpkgs (cachix/devenv-nixpkgs) 256551e4 → d97234e5 — indirect

Changelog:

• [Feature] Rolls devenv's nixpkgs forward through seven upstream revisions between 2026-08-26 and 2026-10-26, recording test results for each, and tracks nixpkgs master for certificate fixes.
• [Fix] Vendors upstream patches for lean4's CMake 4.4 install prefix and LLVM's Darwin codesign test, and drops obsolete patches.

Codebase impact:

• No impact detected.

devenv/nixpkgs/nixpkgs-src c8f90650 → 674a2028 — indirect

Changelog:

• [Feature] The nixpkgs-unstable revision underneath devenv-nixpkgs, moving from 2026-08-22 to 2026-10-24. It builds devenv's own tooling, including devenv-tasks above.

Codebase impact:

• No impact detected.

devenv/nix (cachix/nix) bd10d7f5 → 082f1410 — indirect

Changelog:

• [Security] Disallows unprivileged repair in the daemon's AddMultipleToStore, AddToStoreNar and AddToStore, and unpacks to a temporary location in LocalStore::addToStore.
• [Security] Validates padding after skipped NAR contents.
• [Fix] Merges rather than clobbers colliding inputDrvs hashes, and fixes nix flake prefetch-inputs randomly skipping inputs.
• [Fix] Improves sandbox-fallback diagnostics and disallows fallback with a relocated store.
• [Feature] Bumps the bundled Nix to 2.35.3.

Codebase impact:

• No impact detected.

devenv/git-hooks (cachix/git-hooks.nix) 27555e26 → 1ba1dbfe — indirect

Changelog:

• [Feature] Adds gitleaks, ty, nu-check and nu-lint hooks.
• [Breaking] Deprecates the nixfmt-classic and nixfmt-rfc-style hooks and removes x86_64-darwin.
• [Fix] Shares package evaluation and the overlaid nixpkgs across flake outputs, and makes nufmt match .nu files.

Codebase impact:

• No impact detected.

devenv/flake-parts f16b25b8 → 024633cd — indirect

Changelog:

• [Fix] The default moduleLocation no longer copies the flake to the store.

Codebase impact:

• No impact detected.

devenv/nixd e2ca72c3 → 87012f56 — indirect

Changelog:

• [Fix] Completion propagates incomplete provider results and retriggers on empty selector results (fix(completion): propagate incomplete provider results nix-community/nixd#887, fix(completion): retrigger empty selector results nix-community/nixd#888).
• [Fix] Code actions keep comments when flattening attribute sets and avoid a double comma in formals (fix(code-action): preserve comments when flattening attribute sets nix-community/nixd#897, fix(code-action): avoid a double comma when adding to formals with a trailing comma nix-community/nixd#901).
• [Fix] Attribute sets merge recursively in semantic analysis (libnixf/Sema: recursively merge attrsets nix-community/nixd#910).
• [Feature] Adds CLI option tests and an LLVM static build (add CLI options test, LLVM static build support, and improve library linkage nix-community/nixd#885).

Codebase impact:

• No impact detected.

devenv/nixd/treefmt-nix 27b3b12a → 0d6d739a — indirect

Changelog:

• [Feature] Adds the jq, air, mandoc and json-sort formatters, a typos autoFix option, ruff-check extendIgnore and extendExclude, and stdin-options support.
• [Fix] Runs prettier in stdin mode and adds *.heex to mix-format.

Codebase impact:

• No impact detected.

devenv/rust-overlay 860d7c83 → c7e9d512 — indirect

Changelog:

• [Feature] 58 daily manifest updates adding the Rust nightly, beta and stable toolchains published between 2026-09-02 and 2026-10-27.

Codebase impact:

• No impact detected.

niteo-agents f1d400ef → 75a132dd — direct

Changelog:

• [Feature] Adds a skill per path-scoped rule (alembic, backend, frontend, nix) so Codex can read them, and drops the plugins section from the tooling rule (feat: Let Codex follow our rules and use our MCPs teamniteo/agents#52).
• [Feature] Adds an eighth key principle on keeping diffs short (More aggressive minimalism teamniteo/agents#50).
• [Feature] Limits feat: and fix: to user-facing changes (Be more specific that feat: is only for user-facing stuff teamniteo/agents#56).
• [Feature] Never renames a pushed branch, because that closes its open PR (chore: Never rename a pushed branch teamniteo/agents#51).
• [Fix] Allows team MCP tools under home-manager's names (fix: Allow team MCP tools under home-manager's names teamniteo/agents#54), then drops the shared permission allow-list (chore: Drop the shared permission allow-list teamniteo/agents#55).
• [Fix] Points the rules' headers at the renamed teamniteo/agents repo (chore: Point at teamniteo/agents teamniteo/agents#49), and notes that Codex needs each checkout trusted (chore: Note that Codex needs each checkout trusted teamniteo/agents#53).

Codebase impact:

• scripts/sync-agent-conventions.py links the four new skills (alembic-rules, backend-rules, frontend-rules, nix-rules) into .agents/skills/ on shell entry.
• .agents/rules/conventions.md now reserves feat: and fix: for user-facing changes, which changes how commits in this repo are prefixed.

nixpkgs-unstable d357a2b5 → a0788123 — direct

Changelog:

• [Fix] Moves to the newest revision before the cutoff, 2026-10-31, one day older than the 2026-11-01 revision it replaces. golangci-lint, the one package taken from it, is the same 2.15.0 build.

Codebase impact:

• No impact detected.

GitHub Actions

teamniteo/gha-actions v42 → v44 — direct

Changelog:

• The Claude review action runs anthropics/claude-code-action v1.0.266, which bundles Claude Code 2.1.316 (chore: Update dependencies to 2026-11-01 teamniteo/gha-actions#62).
• gha-actions' own test workflow moves dawidd6/action-download-artifact to v28. Consumers do not run it.
• The Claude review's reply tool runs github/github-mcp-server v2.0.3, built with Go 1.27.3 to drop the compromised CA roots (chore: Update dependencies to 2026-10-25 teamniteo/gha-actions#61).

Codebase impact:

• No impact detected.

actions/setup-go v6.5.0 → v7.0.0 — major

Changelog:

• [Breaking] Migrates the action to ESM and upgrades its dependencies (Migrate to ESM and upgrade dependencies actions/setup-go#763); its inputs, outputs and Node 24 runtime are unchanged.
• [Feature] Bumps @actions/cache to 6.2.0 (chore(deps): bump @actions/cache to 6.2.0 actions/setup-go#771).

Codebase impact:

• Runs in the macOS leg of Test and in Test macOS Nix package in ci.yml, both with go-version: '1.27.3', so neither step needs a change.

actions/cache v4.3.0 → v5.1.0 — major

Changelog:

• [Breaking] Runs on Node 24 and requires Actions Runner 2.327.1 or later (Upgrade to use node24 actions/cache#1630).
• [Fix] Handles read-only cache access by logging a denied write instead of failing (Bump @actions/cache to v5.1.0 - handle read-only cache access actions/cache#1775).
• [Fix] No longer retries a 429 from the cache service when creating an entry.
• [Security] Updates @actions/cache to 5.0.5, @actions/core to 2.0.3 and ts-http-runtime, patching dependency advisories (Update dependencies & patch security vulnerabilities actions/cache#1738, Update ts-http-runtime dependency actions/cache#1747).
• [Fix] Updates @actions/cache for the Node 24 punycode deprecation (fix: update @actions/cache for Node.js 24 punycode deprecation actions/cache#1685).

Codebase impact:

• Runs as "Restore Go modules and build cache" in both legs of Test in ci.yml. Both legs run on GitHub-hosted runners, which already meet the 2.327.1 floor.

nix-community/cache-nix-action v7 → v7.0.2 — direct

Changelog:

• No updates.

Codebase impact:

• No impact detected.

Go

No module moves this week. modernc.org/sqlite 1.62.0 (2026-11-07) and the modernc.org/libc 1.80.1 (2026-11-03) it needs were published after the cutoff, so both stay on 1.61.0 and 1.79.1.

Summary

devenv and niteo-agents move after sitting out the last cycle, and nixpkgs-unstable steps back one day to the shared pin. The shell changes only in devenv's own task runner, and the two major action bumps change no inputs this repo sets. The one change that reaches day-to-day work is the agents rules' narrower meaning of feat: and fix:. Safe to merge.

Refs teamniteo/ops#2869