What the developer wrote
Authored by M1nd3r
chore(build): update `shell.nix`
- update of tarballs for `nixpkgs` and `rustOverlay` for more recent ones
- inlcudes update of `uv` to version `0.10.10` (from `0.7.14`) which fixes an issue with alternating revision number when updating `uv.lock` file (PRs from dependabot have `revision = 3`, PRs made by other contributors using the older `uv` have `revision = 2`)
- note that `nixpkgs.llvmPackages_17` are no longer availble in the new `nixpkgs`
What changed, and why it matters
This is a routine build-environment maintenance update. It refreshes the versions of two Nix package collections used by Trezor's developer shell and updates the `uv` Python packaging tool from 0.7.14 to 0.10.10. The change does not touch the firmware code, wallet logic, cryptography, or any user-facing security feature. There is no indication of a security vulnerability being fixed.
No security action required. Treat as normal build hygiene.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit updates shell.nix only. It bumps rust-overlay and nixpkgs tarballs to newer snapshots, updates uv to 0.10.10 to resolve a lock-file revision inconsistency between Dependabot and other contributors, replaces the deprecated gitAndTools.git-subrepo attribute with git-subrepo, and removes the unused llvmPackages_17 reference. No firmware, bootloader, crypto, or application code is modified.
Changed components
shell.nix (developer build environment)Inspect captured patch +7 / −8
diff --git a/shell.nix b/shell.nix
index ae07db68..ab44155b 100644
--- a/shell.nix
+++ b/shell.nix
@@ -4,17 +4,17 @@
}:
let
- # the last commit from master as of 2025-05-19
+ # the last commit from master as of 2026-03-16
rustOverlay = import (builtins.fetchTarball {
- url = "https://github.com/oxalica/rust-overlay/archive/bd030fd9983f7fddf87be1c64aa3064c8afa24c4.tar.gz";
- sha256 = "1j3kjh0zlanj31c14hk18nzj9j9aw6ib8lg2pjmywlicd0hmhisv";
+ url = "https://github.com/oxalica/rust-overlay/archive/f600ea449c7b5bb596fa1cf21c871cc5b9e31316.tar.gz";
+ sha256 = "0x70l5b4v5zljnwkzbv7yi5ld04vb75zb6wk620sfm6vd406166c";
});
# define this variable and devTools if you want nrf{util,connect}
acceptJlink = builtins.getEnv "TREZOR_FIRMWARE_ACCEPT_JLINK_LICENSE" == "yes";
- # the last successful build of nixpkgs-unstable as of 2025-06-25
+ # the last successful build of nixpkgs-unstable as of 2026-03-16
nixpkgs = import (builtins.fetchTarball {
- url = "https://github.com/NixOS/nixpkgs/archive/992f916556fcfaa94451ebc7fc6e396134bbf5b1.tar.gz";
- sha256 = "0wbqb6sy58q3mnrmx67ffdx8rq10jg4cvh4jx3rrbr1pqzpzsgxc";
+ url = "https://github.com/NixOS/nixpkgs/archive/a07d4ce6bee67d7c838a8a5796e75dff9caa21ef.tar.gz";
+ sha256 = "0f6zni3jn6ji5icwbidbpmcgxdal2qnjszp7ragdcy0857hvq3c5";
}) {
config = {
allowUnfree = acceptJlink;
@@ -71,7 +71,6 @@ let
version = "stm-cubeide-v1.13.0";
nativeBuildInputs = oldAttrs.nativeBuildInputs ++ [ nixpkgs.autoreconfHook ];
}));
- llvmPackages = nixpkgs.llvmPackages_17;
# see pyright/README.md for update procedure
pyright = oldNixpkgs.callPackage ./ci/pyright {};
in
@@ -94,7 +93,7 @@ stdenvNoCC.mkDerivation ({
gcc-arm-embedded-13
gcc14
git
- gitAndTools.git-subrepo
+ git-subrepo
gnumake
graphviz
libffi
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.