chore: update flake.lock (monthly)

[sb-postgres-bot]

Automated changes by the update-flake-lock GitHub Action.

Flake lock file updates:

• Updated input 'multigres':
    'github:multigres/multigres/b713432298450dd0095498193e86d9f9a9f2c348?narHash=sha256-rHIfalPF5%2BP7innXfoP4cIH4EqzIMVP5qepGYb/iJpA%3D' (2026-07-29)
  → 'github:multigres/multigres/ebfc0deee3e60d7f4e3406fd36599fcf94aa156f?narHash=sha256-AbJVPFXxkilbqZ7fJS4xthEDgOxXjKHSpH20kDZZtDY%3D' (2026-07-30)
• Updated input 'nix-eval-jobs':
    'github:nix-community/nix-eval-jobs/daa42f9e9c84aeff1e325dd50fda321f53dfd02c?narHash=sha256-hA%2BNOH8KDcsuvH7vJqSwk74PyZP3MtvI/l%2BCggZcnTc%3D' (2025-10-14)
  → 'github:nix-community/nix-eval-jobs/a0cd02231c58974a6b5aaa3712069b071047162e?narHash=sha256-/C5wyGYe4uMKKH26vy3knpwP/hvjOHO/58cySL8ADC4%3D' (2026-07-16)
• Updated input 'nix-eval-jobs/nix':
    'github:NixOS/nix/4041bfdb401ad6d1c31a292fab90392254be506a?narHash=sha256-BuKtM7Vr5EcxBXxUENBQPlOBwmNd5mkTRkSmlJi/iQ4%3D' (2025-10-14)
  → 'github:NixOS/nix/aa2613fa02ca6199fe0ebf61a0f7f6d781d32a47?narHash=sha256-UkRzz0meYeuSQt5rQodwfiSe1If%2B5JojDP7Kxk0beXM%3D' (2026-07-14)
• Updated input 'nix-eval-jobs/nixpkgs':
    'https://releases.nixos.org/nixpkgs/nixpkgs-25.11pre877036.c12c63cd6c5e/nixexprs.tar.xz?narHash=sha256-vhAtaRMIQiEghARviANBmSnhGz9Qf2IQJ%2BnQgsDXnVs%3D' (1980-01-01)
  → 'https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre918255.346dd96ad74d/nixexprs.tar.xz?narHash=sha256-OuZZ71OA/6fZePPqgVinI4QVu9j1QCt%2BQ9i5ZgmSGqI%3D' (2025-12-29)
• Updated input 'nixpkgs':
    'https://releases.nixos.org/nixos/unstable/nixos-26.05pre921484.fb7944c166a3/nixexprs.tar.xz?narHash=sha256-3xDI4xtzovwqE/eAxCwmXxUqBg6Yoam2L1u0IwRNhW4%3D' (2026-01-02)
  → 'https://releases.nixos.org/nixos/unstable/nixos-26.11pre1043649.0954f7ee2f6b/nixexprs.tar.xz?narHash=sha256-JfsUqyQ4MGL0SvJNPFikXYlUdXg0xMzBdjwTPawZSl4%3D' (2026-07-29)
• Updated input 'rust-overlay':
    'github:oxalica/rust-overlay/7b50ad68415ae5be7ee4cc68fa570c420741b644?narHash=sha256-ngar%2ByP06x3%2B2k2Iey29uU0DWx5ur06h3iPBQXlU%2ByI%3D' (2025-12-09)
  → 'github:oxalica/rust-overlay/c5b112f74bdbf91c5afd2d3779d12989818c9e8c?narHash=sha256-6gtZiMMyfgr1CHA5g6fXoIYkTngQWMm1wtp3gNtuqJU%3D' (2026-07-30)

Running GitHub Actions on this PR

GitHub Actions will not run workflows on pull requests which are opened by a GitHub Action.

To run GitHub Actions workflows on this PR, close and re-open this pull request.

[brainrake]

Why this PR is failing

It's the automated flake.lock update, and it bumped nixpkgs from 25.11pre → 26.05pre (c12c63c → 346dd96), which broke three independent things downstream:

1. nix-eval / eval fails — nix/packages/supascan.nix:4 does go124 = pkgs.go_1_24;, but go_1_24 no longer exists in the new nixpkgs (attribute 'go_1_24' missing). Affects checks.*.supascan on all 3 platforms.

2. linux-arm64/x64 without Nix fail — binaries built against the newer nixpkgs now link against glibc 2.42, but the "without Nix" test runners have an older glibc: psql-wrapped: /lib/aarch64-linux-gnu/libc.so.6: version 'GLIBC_2.42' not found.

3. Check Docker Image Changes fails — sfcgal-2.2.0 fails to build under the newer CGAL pulled in by the nixpkgs bump: 'surface_intersection' is not a member of 'CGAL::Polygon_mesh_processing'. This cascades to break the postgis derivations that depend on sfcgal.

Extension Dependency Analysis was still running at last check but is almost certainly hitting the same postgis/sfcgal build failure (#3).

Likely fixes needed (not applied — just diagnosis):

• Repin go_1_24 → whatever Go attr exists in the new nixpkgs (e.g. go_1_25), in nix/packages/supascan.nix.
• Either pin an older/patched sfcgal, or patch its CGAL call site (surface_intersection → self_intersections or equivalent per new CGAL API).
• The glibc mismatch is likely inherent to the nixpkgs bump being ahead of the "without Nix" CI runner image — may need to update that runner image, or hold nixpkgs back until compatible.

[brainrake]

Opened a fix for the go_1_24 nix-eval failure (root cause #1 above) in #2329 — repins supascan/gatekeeper to go_1_25, the newest Go version present in both the current and bumped nixpkgs.

[brainrake]

Follow-up on the glibc issue (root cause #2 in the earlier comment): checked every shared library in the portable CLI bundle (~150 .so files) for their GLIBC symbol requirements. Only one is not backwards compatible with the glibc this bundle previously required: `libncursesw.so.6`, which needs `GLIBC_2.42` for a single symbol, `cfgetospeed`. Everything else — postgres itself, libpq, openssl, curl, ICU, every extension — tops out at `GLIBC_2.38`.

Confirmed it's not an ncurses version issue: the exact same ncurses source, built against the old nixpkgs glibc (2.40), only requires up to `GLIBC_2.38`; built against the bumped glibc (2.42), it requires `GLIBC_2.42` for that one symbol. glibc re-versioned `cfgetospeed` (an obscure serial-baud-rate termios function that's basically only called by curses libraries) in 2.42, and the linker binds fresh compiles to the newest version by default. The old, functionally identical `GLIBC_2.17`-versioned symbol is still exported by the new glibc, so this is fixable with a targeted `.symver` directive rather than needing a newer host OS or a global glibc pin.

Fix in progress: #2336 (validation PR against this branch, will land as a develop-based PR once confirmed green).

[samrose]

@brainrake this needs a serious testing plan documented somewhere, to assure that breaking changes are not introduced. I did not see it here in the PR.