flake.lock: Update

Flake lock file updates: • Updated input 'mmdoc': 'github:ryantm/mmdoc/cec02bafac9456bd1ed9b261b8d163a893885e5b' (2022-11-21) → 'github:ryantm/mmdoc/b6ddf748b1d1c01ca582bb1b3dafd6bc3a4c83a6' (2024-03-17) • Removed input 'mmdoc/nixpkgs-for-manual' • Added input 'mmdoc/systems': 'github:nix-systems/default/da67096a3b9bf56a91d16901293e51ba5b49a27e' (2023-04-09) • Updated input 'nixpkgs': 'github:NixOS/nixpkgs/293a28df6d7ff3dec1e61e37cc4ee6e6c0fb0847' (2022-12-30) → 'github:NixOS/nixpkgs/cf8cc1201be8bc71b7cbbbdaf349b22f4f99c7ae' (2024-04-28) • Updated input 'runtimeDeps': 'github:NixOS/nixpkgs/c8d7c8a78fb516c0842cc65346506a565c88014d' (2024-04-27) → 'github:NixOS/nixpkgs/9b03589f4d174bfd6ea9a9de6fb85333fd190f8b' (2024-04-30) • Updated input 'treefmt-nix': 'github:numtide/treefmt-nix/49dc4a92b02b8e68798abd99184f228243b6e3ac' (2024-04-01) → 'github:numtide/treefmt-nix/c6aaf729f34a36c445618580a9f95a48f5e4e03f' (2024-04-25)
Merge pull request #391 from qowoz/insecure
2024-09-11 13:57:20 +03:00 · 2024-05-01 01:01:41 +00:00 · 2024-04-28 12:15:47 +10:00 · 2024-04-28 12:15:13 +10:00 · 2024-04-28 12:11:52 +10:00 · 2024-04-28 12:11:52 +10:00
33 changed files with 519 additions and 379 deletions
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@ -1,17 +0,0 @@
-name: "CI"
-on:
-  pull_request:
-  push:
-jobs:
-  tests:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v4
-    - uses: cachix/install-nix-action@v20
-    - uses: cachix/cachix-action@v12
-      with:
-        name: nixpkgs-update
-        signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
-        authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-    - run: nix build --accept-flake-config
-    - run: nix flake check
--- a/.github/workflows/doc.yaml
+++ b/.github/workflows/doc.yaml
@ -6,23 +6,44 @@ on:
      - main
  workflow_dispatch:

+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: "doc"
+  cancel-in-progress: false
+
 jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
-        with:
-          # Nix Flakes doesn't work on shallow clones
-          fetch-depth: 0
-      - uses: cachix/install-nix-action@v15
+      - uses: cachix/install-nix-action@v26
        with:
          extra_nix_config: |
-            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
-      - run: nix build .#nixpkgs-update-doc
-      - if: success()
-        uses: crazy-max/ghaction-github-pages@v4
+            accept-flake-config = true
+            experimental-features = nix-command flakes
+            max-jobs = 0
+      - name: Setup Pages
+        id: pages
+        uses: actions/configure-pages@v5
+      - name: Build Pages
+        run: |
+          nix build .#nixpkgs-update-doc
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@v3
        with:
-          target_branch: gh-pages
-          build_dir: result/multi
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          path: ./result/multi
+
+  deploy:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    needs: publish
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4
--- a/.github/workflows/flake-updates.yml
+++ b/.github/workflows/flake-updates.yml
@ -9,9 +9,9 @@ jobs:
    steps:
      - uses: actions/checkout@v4
      - name: Install Nix
-        uses: cachix/install-nix-action@v25
+        uses: cachix/install-nix-action@v26
        with:
          extra_nix_config: |
            experimental-features = nix-command flakes
      - name: Update flake.lock
-        uses: DeterminateSystems/update-flake-lock@v20
+        uses: DeterminateSystems/update-flake-lock@v21
--- a/README.md
+++ b/README.md
@ -3,4 +3,4 @@
 [![Build Status](https://github.com/ryantm/nixpkgs-update/workflows/CI/badge.svg)](https://github.com/ryantm/nixpkgs-update/actions)
 [![Patreon](https://img.shields.io/badge/patreon-donate-blue.svg)](https://www.patreon.com/nixpkgsupdate)

-Please read the [documentation](https://ryantm.github.io/nixpkgs-update/).
+Please read the [documentation](https://nix-community.github.io/nixpkgs-update/).
--- a/app/Main.hs
+++ b/app/Main.hs
@ -116,7 +116,8 @@ commandParser =

 checkVulnerable :: O.Parser Command
 checkVulnerable =
-  CheckVulnerable <$> O.strArgument (O.metavar "PRODUCT_ID")
+  CheckVulnerable
+    <$> O.strArgument (O.metavar "PRODUCT_ID")
    <*> O.strArgument (O.metavar "OLD_VERSION")
    <*> O.strArgument (O.metavar "NEW_VERSION")

--- a/doc/batch-updates.md
+++ b/doc/batch-updates.md
@ -46,8 +46,8 @@ subcommand.

  There also exist alternative sources of updates, these include:

-   - PyPI, the Python Package Index:
-     [nixpkgs-update-pypi-releases](https://github.com/jonringer/nixpkgs-update-pypi-releases)
+   - package updateScript:
+      [passthru.updateScript](https://nixos.org/manual/nixpkgs/unstable/#var-passthru-updateScript)
   - GitHub releases:
     [nixpkgs-update-github-releases](https://github.com/synthetica9/nixpkgs-update-github-releases)

--- a/doc/contact.md
+++ b/doc/contact.md
@ -0,0 +1,5 @@
+# Contact {#contact}
+
+Github: [https://github.com/ryantm/nixpkgs-update](https://github.com/ryantm/nixpkgs-update)
+
+Matrix: [https://matrix.to/#/#nixpkgs-update:nixos.org](https://matrix.to/#/#nixpkgs-update:nixos.org)
--- a/doc/contributing.md
+++ b/doc/contributing.md
@ -38,4 +38,4 @@ nix run nixpkgs#haskellPackages.hpack

 Source files are formatted with [Ormolu](https://github.com/tweag/ormolu).

-There is also a [Cachix cache](https://nixpkgs-update.cachix.org/) available for the dependencies of this program.
+There is also a [Cachix cache](https://nix-community.cachix.org/) available for the dependencies of this program.
--- a/doc/installation.md
+++ b/doc/installation.md
@ -9,8 +9,8 @@ Run without installing on stable Nix:

 ```ShellSession
 $ nix run \
-  --option extra-substituters 'https://nixpkgs-update.cachix.org/' \
-  --option extra-trusted-public-keys 'nixpkgs-update.cachix.org-1:6y6Z2JdoL3APdu6/+Iy8eZX2ajf09e4EE9SnxSML1W8=' \
+  --option extra-substituters 'https://nix-community.cachix.org/' \
+  --option extra-trusted-public-keys 'nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=' \
  -f https://github.com/ryantm/nixpkgs-update/archive/main.tar.gz \
  -c nixpkgs-update --help
 ```
@ -19,8 +19,8 @@ Run without installing on unstable Nix with nix command enabled:

 ```ShellSession
 $ nix shell \
-  --option extra-substituters 'https://nixpkgs-update.cachix.org/' \
-  --option extra-trusted-public-keys 'nixpkgs-update.cachix.org-1:6y6Z2JdoL3APdu6/+Iy8eZX2ajf09e4EE9SnxSML1W8=' \
+  --option extra-substituters 'https://nix-community.cachix.org/' \
+  --option extra-trusted-public-keys 'nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=' \
  -f https://github.com/ryantm/nixpkgs-update/archive/main.tar.gz \
  -c nixpkgs-update --help
 ```
@ -29,8 +29,8 @@ Run without installing on unstable Nix with nix flakes enabled:

 ```ShellSession
 $ nix run \
-  --option extra-substituters 'https://nixpkgs-update.cachix.org/' \
-  --option extra-trusted-public-keys 'nixpkgs-update.cachix.org-1:6y6Z2JdoL3APdu6/+Iy8eZX2ajf09e4EE9SnxSML1W8=' \
+  --option extra-substituters 'https://nix-community.cachix.org/' \
+  --option extra-trusted-public-keys 'nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=' \
  github:ryantm/nixpkgs-update -- --help
 ```

@ -38,8 +38,8 @@ Install into your Nix profile:

 ```ShellSession
 $ nix-env \
-  --option extra-substituters 'https://nixpkgs-update.cachix.org/' \
-  --option extra-trusted-public-keys 'nixpkgs-update.cachix.org-1:6y6Z2JdoL3APdu6/+Iy8eZX2ajf09e4EE9SnxSML1W8=' \
+  --option extra-substituters 'https://nix-community.cachix.org/' \
+  --option extra-trusted-public-keys 'nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=' \
  -if https://github.com/ryantm/nixpkgs-update/archive/main.tar.gz
 ```

--- a/doc/introduction.md
+++ b/doc/introduction.md
@ -17,5 +17,5 @@ It is the code used by the GitHub bot
 [@r-ryantm](https://github.com/r-ryantm) to automatically update
 nixpkgs. It uses package repository information from
 [Repology.org](https://repology.org/repository/nix_unstable), the
-GitHub releases API, and PyPI to generate a lists of outdated
+GitHub releases API, and the package passthru.updateScript to generate a lists of outdated
 packages.
--- a/doc/nixpkgs-maintainer-faq.md
+++ b/doc/nixpkgs-maintainer-faq.md
@ -12,7 +12,7 @@ Thanks for being a maintainer. Hopefully, @r-ryantm will be able to save you som

 ## Why is @r-ryantm not updating my package? {#no-update}

-There are lots of reasons a package might not be updated. You can usually figure out which one is the issue by looking at the [logs](https://r.ryantm.com/log/) or by asking @ryantm on Matrix or GitHub.
+There are lots of reasons a package might not be updated. You can usually figure out which one is the issue by looking at the [logs](https://r.ryantm.com/log/) or by asking the [maintainers](#contact).

 ### No new version information

@ -20,15 +20,23 @@ r-ryantm gets its new version information from three sources:

 * Repology - information from Repology is delayed because it only updates when there is an unstable channel release
 * GitHub releases
-* PyPi releases
+* package passthru.updateScript

 If none of these sources says the package is out of date, it will not attempt to update it.

+### Disabling package updates
+
+Updates can be disabled by adding a comment to the package:
+```
+# nixpkgs-update: no auto update
+```
+[Example in nixpkgs](https://github.com/NixOS/nixpkgs/blob/f2294037ad2b1345c5d9c2df0e81bdb00eab21f3/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix#L7)
+
 ### Skiplist

 We maintain a [Skiplist](https://github.com/ryantm/nixpkgs-update/blob/main/src/Skiplist.hs) of different things not to update. It is possible your package is triggering one of the skip criteria.

-Python updates are skipped if they cause more than 25 rebuilds.
+Python updates are skipped if they cause more than 100 rebuilds.

 ### Existing Open or Draft PR

--- a/doc/toc.md
+++ b/doc/toc.md
@ -9,3 +9,4 @@
 * [Contributing](#contributing)
 * [Donate](#donate)
 * [Nixpkgs Maintainer FAQ](#nixpkgs-maintainer-faq)
+* [Contact](#contact)
--- a/flake.lock
+++ b/flake.lock
@ -5,14 +5,14 @@
        "nixpkgs": [
          "nixpkgs"
        ],
-        "nixpkgs-for-manual": "nixpkgs-for-manual"
+        "systems": "systems"
      },
      "locked": {
-        "lastModified": 1669050835,
-        "narHash": "sha256-4ppYRBBY6lIqwMNYp0XA2mku1lSPyX4JaoTf+gt5NDg=",
+        "lastModified": 1710694589,
+        "narHash": "sha256-5wa+Jzxr+LygoxSZuZg0YU81jgdnx2IY/CqDIJMOgec=",
        "owner": "ryantm",
        "repo": "mmdoc",
-        "rev": "cec02bafac9456bd1ed9b261b8d163a893885e5b",
+        "rev": "b6ddf748b1d1c01ca582bb1b3dafd6bc3a4c83a6",
        "type": "github"
      },
      "original": {
@ -23,11 +23,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1672428209,
-        "narHash": "sha256-eejhqkDz2cb2vc5VeaWphJz8UXNuoNoM8/Op8eWv2tQ=",
+        "lastModified": 1714314149,
+        "narHash": "sha256-yNAevSKF4krRWacmLUsLK7D7PlfuY3zF0lYnGYNi9vQ=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "293a28df6d7ff3dec1e61e37cc4ee6e6c0fb0847",
+        "rev": "cf8cc1201be8bc71b7cbbbdaf349b22f4f99c7ae",
        "type": "github"
      },
      "original": {
@ -35,26 +35,63 @@
        "type": "indirect"
      }
    },
-    "nixpkgs-for-manual": {
+    "root": {
+      "inputs": {
+        "mmdoc": "mmdoc",
+        "nixpkgs": "nixpkgs",
+        "runtimeDeps": "runtimeDeps",
+        "treefmt-nix": "treefmt-nix"
+      }
+    },
+    "runtimeDeps": {
      "locked": {
-        "lastModified": 1663819393,
-        "narHash": "sha256-SMWfyAOKRPBC95M8dhZJTlb0kHyilr2lKEAfQSHlM7I=",
-        "owner": "ryantm",
+        "lastModified": 1714463564,
+        "narHash": "sha256-8+w/34w9azAHZA9TwvzdT2z7VFFEey7tXsan5q5bR1M=",
+        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "6a6caacfdd079a0fa249046514480a1c4597d861",
+        "rev": "9b03589f4d174bfd6ea9a9de6fb85333fd190f8b",
        "type": "github"
      },
      "original": {
-        "owner": "ryantm",
-        "ref": "minman",
+        "owner": "NixOS",
+        "ref": "nixos-unstable-small",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
-    "root": {
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "treefmt-nix": {
      "inputs": {
-        "mmdoc": "mmdoc",
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1714058656,
+        "narHash": "sha256-Qv4RBm4LKuO4fNOfx9wl40W2rBbv5u5m+whxRYUMiaA=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "c6aaf729f34a36c445618580a9f95a48f5e4e03f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
      }
    }
  },
--- a/flake.nix
+++ b/flake.nix
@ -4,11 +4,35 @@
  inputs.mmdoc.url = "github:ryantm/mmdoc";
  inputs.mmdoc.inputs.nixpkgs.follows = "nixpkgs";

-  nixConfig.extra-substituters = "https://nixpkgs-update.cachix.org";
-  nixConfig.extra-trusted-public-keys = "nixpkgs-update.cachix.org-1:6y6Z2JdoL3APdu6/+Iy8eZX2ajf09e4EE9SnxSML1W8=";
+  inputs.treefmt-nix.url = "github:numtide/treefmt-nix";
+  inputs.treefmt-nix.inputs.nixpkgs.follows = "nixpkgs";

-  outputs = { self, nixpkgs, mmdoc } @ args:
+  inputs.runtimeDeps.url = "github:NixOS/nixpkgs/nixos-unstable-small";
+
+  nixConfig.extra-substituters = "https://nix-community.cachix.org";
+  nixConfig.extra-trusted-public-keys = "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=";
+
+  outputs = { self, nixpkgs, mmdoc, treefmt-nix, runtimeDeps } @ args:
+    let
+      systems = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
+      eachSystem = f: nixpkgs.lib.genAttrs systems (system: f nixpkgs.legacyPackages.${system});
+      treefmtEval = eachSystem (pkgs: treefmt-nix.lib.evalModule pkgs {
+        projectRootFile = ".git/config";
+        programs.ormolu.enable = true;
+      });
+    in
    {
+      checks.x86_64-linux =
+        let
+          packages = nixpkgs.lib.mapAttrs' (n: nixpkgs.lib.nameValuePair "package-${n}") self.packages.x86_64-linux;
+          devShells = nixpkgs.lib.mapAttrs' (n: nixpkgs.lib.nameValuePair "devShell-${n}") self.devShells.x86_64-linux;
+        in
+        packages // devShells // {
+          treefmt = treefmtEval.x86_64-linux.config.build.check self;
+        };
+
+      formatter = eachSystem (pkgs: treefmtEval.${pkgs.system}.config.build.wrapper);
+
      packages.x86_64-linux = import ./pkgs/default.nix (args // { system = "x86_64-linux"; });
      devShells.x86_64-linux.default = self.packages."x86_64-linux".devShell;

--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@ -1,5 +1,6 @@
 { nixpkgs
 , mmdoc
+, runtimeDeps
 , system
 , self
 , ...
@ -7,9 +8,11 @@

 let

+  runtimePkgs = import runtimeDeps { inherit system; };
+
  pkgs = import nixpkgs { inherit system; config = { allowBroken = true; }; };

-  drvAttrs = attrs: with pkgs; {
+  drvAttrs = attrs: with runtimePkgs; {
    NIX = nix;
    GIT = git;
    JQ = jq;
--- a/src/CVE.hs
+++ b/src/CVE.hs
@ -16,6 +16,7 @@ where

 import Data.Aeson
  ( FromJSON,
+    Key,
    Object,
    eitherDecode,
    parseJSON,
@ -23,7 +24,6 @@ import Data.Aeson
    (.!=),
    (.:),
    (.:!),
-    Key,
  )
 import Data.Aeson.Types (Parser, prependFailure)
 import qualified Data.ByteString.Lazy.Char8 as BSL
--- a/src/Check.hs
+++ b/src/Check.hs
@ -8,7 +8,7 @@ module Check
  ( result,
    -- exposed for testing:
    hasVersion,
-    versionWithoutPath
+    versionWithoutPath,
  )
 where

@ -50,10 +50,10 @@ isNonWordCharacter c = not (isWordCharacter c)
 -- | Construct regex: /.*\b${version}\b.*/s
 versionRegex :: Text -> RE' ()
 versionRegex version =
-  (\_ -> ()) <$> (
-    (((many RE.anySym) <* (RE.psym isNonWordCharacter)) <|> (RE.pure ""))
-    *> (RE.string version) <*
-    ((RE.pure "") <|> ((RE.psym isNonWordCharacter) *> (many RE.anySym)))
+  (\_ -> ())
+    <$> ( (((many RE.anySym) <* (RE.psym isNonWordCharacter)) <|> (RE.pure ""))
+            *> (RE.string version)
+            <* ((RE.pure "") <|> ((RE.psym isNonWordCharacter) *> (many RE.anySym)))
        )

 hasVersion :: Text -> Text -> Bool
@ -63,10 +63,9 @@ hasVersion contents expectedVersion =
 checkTestsBuild :: Text -> IO Bool
 checkTestsBuild attrPath = do
  let timeout = "10m"
-  let
-    args =
-        [ T.unpack timeout, "nix-build" ] ++
-        nixBuildOptions
+  let args =
+        [T.unpack timeout, "nix-build"]
+          ++ nixBuildOptions
          ++ [ "-E",
               "{ config }: (import ./. { inherit config; })."
                 ++ (T.unpack attrPath)
@ -99,8 +98,8 @@ versionWithoutPath resultPath expectedVersion =
  -- This can be done with negative lookbehind e.g
  -- /^(?<!${storePathWithoutVersion})${version}/
  -- Note we also escape the version with \Q/\E for grep -P
-  let storePath = fromMaybe (T.pack resultPath) $ T.stripPrefix "/nix/store/" (T.pack resultPath) in
-  case T.breakOn expectedVersion storePath of
+  let storePath = fromMaybe (T.pack resultPath) $ T.stripPrefix "/nix/store/" (T.pack resultPath)
+   in case T.breakOn expectedVersion storePath of
        (_, "") ->
          -- no version in prefix, just match version
          "\\Q"
@ -140,7 +139,8 @@ foundVersionInFileNames expectedVersion resultPath =
      ( do
          (_, contents) <-
            shell ("find " <> resultPath) & ourReadProcessInterleaved
-          (contents =~ versionRegex expectedVersion) & hoistMaybe
+          (contents =~ versionRegex expectedVersion)
+            & hoistMaybe
            & noteT (T.pack "Expected version not found")
          return $
            "- found "
@ -157,7 +157,8 @@ treeGist resultPath =
      ( do
          contents <- procTree [resultPath] & ourReadProcessInterleavedBS_
          g <-
-            shell gistBin & setStdin (byteStringInput contents)
+            shell gistBin
+              & setStdin (byteStringInput contents)
              & ourReadProcessInterleaved_
          return $ "- directory tree listing: " <> g <> "\n"
      )
@ -169,7 +170,8 @@ duGist resultPath =
      ( do
          contents <- proc "du" [resultPath] & ourReadProcessInterleavedBS_
          g <-
-            shell gistBin & setStdin (byteStringInput contents)
+            shell gistBin
+              & setStdin (byteStringInput contents)
              & ourReadProcessInterleaved_
          return $ "- du listing: " <> g <> "\n"
      )
--- a/src/GH.hs
+++ b/src/GH.hs
@ -23,7 +23,7 @@ import Data.Aeson (FromJSON)
 import Data.Bitraversable (bitraverse)
 import qualified Data.Text as T
 import qualified Data.Text.Encoding as T
-import Data.Time.Clock (getCurrentTime, addUTCTime)
+import Data.Time.Clock (addUTCTime, getCurrentTime)
 import qualified Data.Vector as V
 import qualified Git
 import qualified GitHub as GH
@ -54,12 +54,14 @@ pr env title body prHead base = do
  tryPR `catchE` \case
    -- If creating the PR returns a 422, most likely cause is that the
    -- branch was deleted, so push it again and retry once.
-    GH.HTTPError (HttpExceptionRequest _ (StatusCodeException r _)) | statusCode (responseStatus r) == 422 ->
+    GH.HTTPError (HttpExceptionRequest _ (StatusCodeException r _))
+      | statusCode (responseStatus r) == 422 ->
          Git.push env >> withExceptT (T.pack . show) tryPR
    e ->
      throwE . T.pack . show $ e
  where
-  tryPR = ExceptT $
+    tryPR =
+      ExceptT $
        fmap ((False,) . GH.getUrl . GH.pullRequestUrl)
          <$> ( liftIO $
                  ( GH.github
@ -78,23 +80,24 @@ prUpdate env title body prHead base = do
      runRequest = ExceptT . fmap (first (T.pack . show)) . liftIO . GH.github (authFrom env)
  let inNixpkgs f = f (N "nixos") (N "nixpkgs")

-  prs <- runRequest $
+  prs <-
+    runRequest $
      inNixpkgs GH.pullRequestsForR (GH.optionsHead prHead) GH.FetchAll

  case V.toList prs of
    [] -> pr env title body prHead base
-
    (_ : _ : _) -> throwE $ "Too many open PRs from " <> prHead
-
    [thePR] -> do
      let withExistingPR :: (GH.Name GH.Owner -> GH.Name GH.Repo -> GH.IssueNumber -> a) -> a
          withExistingPR f = inNixpkgs f (GH.simplePullRequestNumber thePR)

-      _ <- runRequest $
+      _ <-
+        runRequest $
          withExistingPR GH.updatePullRequestR $
            GH.EditPullRequest (Just title) Nothing Nothing Nothing Nothing

-      _ <- runRequest $
+      _ <-
+        runRequest $
          withExistingPR GH.createCommentR body

      return (True, GH.getUrl $ GH.simplePullRequestUrl thePR)
@ -129,12 +132,18 @@ parseURLMaybe url =
      extension = RE.string ".zip" <|> RE.string ".tar.gz"
      toParts n o = URLParts (N n) (N o)
      regex =
-        ( toParts <$> (domain *> pathSegment) <* slash <*> pathSegment
+        ( toParts
+            <$> (domain *> pathSegment)
+            <* slash
+            <*> pathSegment
            <*> (RE.string "/releases/download/" *> pathSegment)
            <* slash
            <* pathSegment
        )
-          <|> ( toParts <$> (domain *> pathSegment) <* slash <*> pathSegment
+          <|> ( toParts
+                  <$> (domain *> pathSegment)
+                  <* slash
+                  <*> pathSegment
                  <*> (RE.string "/archive/" *> pathSegment)
                  <* extension
              )
@ -187,7 +196,8 @@ commitIsOldEnoughToDelete auth ghUser sha = do

 refShouldBeDeleted :: GH.Auth -> GH.Name GH.Owner -> (Text, GH.Name GH.GitCommit) -> IO Bool
 refShouldBeDeleted auth ghUser (ref, sha) =
-  liftA2 (&&)
+  liftA2
+    (&&)
    (either (const False) not <$> openPRWithAutoUpdateRefFrom auth ghUser ref)
    (commitIsOldEnoughToDelete auth ghUser sha)

--- a/src/Git.hs
+++ b/src/Git.hs
@ -18,7 +18,7 @@ module Git
    setupNixpkgs,
    Git.show,
    worktreeAdd,
-    worktreeRemove
+    worktreeRemove,
  )
 where

@ -33,7 +33,7 @@ import Data.Time.Clock (addUTCTime, getCurrentTime)
 import qualified Data.Vector as V
 import Language.Haskell.TH.Env (envQ)
 import OurPrelude hiding (throw)
-import System.Directory (doesDirectoryExist, doesFileExist, getModificationTime, getCurrentDirectory, setCurrentDirectory)
+import System.Directory (doesDirectoryExist, doesFileExist, getCurrentDirectory, getModificationTime, setCurrentDirectory)
 import System.Environment.XDG.BaseDir (getUserCacheDir)
 import System.Exit ()
 import System.IO.Error (tryIOError)
@ -98,7 +98,8 @@ diff :: MonadIO m => Text -> ExceptT Text m Text
 diff branch = readProcessInterleavedNoIndexIssue_ $ procGit ["diff", T.unpack branch]

 diffFileNames :: MonadIO m => Text -> ExceptT Text m [Text]
-diffFileNames branch = readProcessInterleavedNoIndexIssue_ (procGit ["diff", T.unpack branch, "--name-only"])
+diffFileNames branch =
+  readProcessInterleavedNoIndexIssue_ (procGit ["diff", T.unpack branch, "--name-only"])
    & fmapRT T.lines

 staleFetchHead :: MonadIO m => m Bool
@ -121,7 +122,8 @@ fetchIfStale = whenM staleFetchHead fetch
 fetch :: MonadIO m => ExceptT Text m ()
 fetch =
  runProcessNoIndexIssue_ $
-    silently $ procGit ["fetch", "-q", "--prune", "--multiple", "upstream", "origin"]
+    silently $
+      procGit ["fetch", "-q", "--prune", "--multiple", "upstream", "origin"]

 push :: MonadIO m => UpdateEnv -> ExceptT Text m ()
 push updateEnv =
@ -210,7 +212,6 @@ deleteBranchesEverywhere branches = do
        Left error2 -> T.putStrLn $ tshow error2
        Right success2 -> T.putStrLn $ tshow success2

-
 runProcessNoIndexIssue_IO ::
  ProcessConfig () () () -> IO ()
 runProcessNoIndexIssue_IO config = go
@ -253,7 +254,6 @@ readProcessInterleavedNoIndexIssue_ config = tryIOTextET go
        ExitSuccess -> return $ bytestringToText out
        ExitFailure _ -> throw $ ExitCodeException code config out out

-
 readProcessInterleavedNoIndexIssue_IO ::
  ProcessConfig () () () -> IO Text
 readProcessInterleavedNoIndexIssue_IO config = go
--- a/src/NVDRules.hs
+++ b/src/NVDRules.hs
@ -15,14 +15,18 @@ filter _ cpeMatch "socat" v
  | cpeUpdatePresentAndNotPartOfVersion cpeMatch v = False -- TODO consider if this rule should be applied to all packages
 filter _ cpeMatch "uzbl" v
  | isNothing (v =~ yearRegex)
-      && "2009.12.22" `anyVersionInfixOf` cpeMatchVersionMatcher cpeMatch =
+      && "2009.12.22"
+      `anyVersionInfixOf` cpeMatchVersionMatcher cpeMatch =
      False
  | isNothing (v =~ yearRegex)
-      && "2010.04.03" `anyVersionInfixOf` cpeMatchVersionMatcher cpeMatch =
+      && "2010.04.03"
+      `anyVersionInfixOf` cpeMatchVersionMatcher cpeMatch =
      False
 filter _ cpeMatch "go" v
-  | "." `T.isInfixOf` v
-      && "-" `anyVersionInfixOf` cpeMatchVersionMatcher cpeMatch =
+  | "."
+      `T.isInfixOf` v
+      && "-"
+      `anyVersionInfixOf` cpeMatchVersionMatcher cpeMatch =
      False
 filter _ cpeMatch "terraform" _
  | cpeTargetSoftware (cpeMatchCPE cpeMatch) == Just "aws" = False
--- a/src/Nix.hs
+++ b/src/Nix.hs
@ -40,8 +40,8 @@ import qualified Data.Text.Lazy.Encoding as TL
 import qualified Git
 import Language.Haskell.TH.Env (envQ)
 import OurPrelude
-import qualified System.Process.Typed as TP
 import System.Exit ()
+import qualified System.Process.Typed as TP
 import Utils (UpdateEnv (..), nixBuildOptions, nixCommonOptions, srcOrMain)
 import Prelude hiding (log)

@ -127,7 +127,8 @@ lookupAttrPath updateEnv =
          <> nixCommonOptions
      )
      & ourReadProcess_
-    & fmapRT (fst >>> T.lines >>> head >>> T.words >>> head))
+      & fmapRT (fst >>> T.lines >>> head >>> T.words >>> head)
+  )
    <|>
    -- if that fails, check by attrpath
    (getAttrString "name" (packageName updateEnv))
@ -178,7 +179,8 @@ getHomepage :: MonadIO m => Text -> ExceptT Text m Text
 getHomepage = nixEvalApplyRaw "p: p.meta.homepage or \"\""

 getSrcUrl :: MonadIO m => Text -> ExceptT Text m Text
-getSrcUrl = srcOrMain
+getSrcUrl =
+  srcOrMain
    (nixEvalApplyRaw "p: builtins.elemAt p.drvAttrs.urls 0")

 buildCmd :: Text -> ProcessConfig () () ()
@ -245,10 +247,9 @@ resultLink =

 fakeHashMatching :: Text -> Text
 fakeHashMatching oldHash =
-  if "sha512-" `T.isPrefixOf` oldHash then
-    "sha512-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
-  else
-    "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
+  if "sha512-" `T.isPrefixOf` oldHash
+    then "sha512-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
+    else "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="

 -- fixed-output derivation produced path '/nix/store/fg2hz90z5bc773gpsx4gfxn3l6fl66nw-source' with sha256 hash '0q1lsgc1621czrg49nmabq6am9sgxa9syxrwzlksqqr4dyzw4nmf' instead of the expected hash '0bp22mzkjy48gncj5vm9b7whzrggcbs5pd4cnb6k8jpl9j02dhdv'
 getHashFromBuild :: MonadIO m => Text -> ExceptT Text m Text
@ -289,13 +290,15 @@ hasPatchNamed attrPath name = do
 hasUpdateScript :: MonadIO m => Text -> ExceptT Text m Bool
 hasUpdateScript attrPath = do
  nixEvalApply
-    "p: builtins.hasAttr \"updateScript\" p" attrPath
+    "p: builtins.hasAttr \"updateScript\" p"
+    attrPath
    & readNixBool

 runUpdateScript :: MonadIO m => Text -> ExceptT Text m (ExitCode, Text)
 runUpdateScript attrPath = do
  let timeout = "10m" :: Text
-  (exitCode, output) <- ourReadProcessInterleaved $
+  (exitCode, output) <-
+    ourReadProcessInterleaved $
      TP.setStdin (TP.byteStringInput "\n") $
        proc "timeout" [T.unpack timeout, "nix-shell", "maintainers/scripts/update.nix", "--argstr", "package", T.unpack attrPath]
  case exitCode of
--- a/src/NixpkgsReview.hs
+++ b/src/NixpkgsReview.hs
@ -33,7 +33,9 @@ run ::
  FilePath ->
  Text ->
  Sem r Text
-run cache commit = let timeout = "45m" :: Text in do
+run cache commit =
+  let timeout = "120m" :: Text
+   in do
        -- TODO: probably just skip running nixpkgs-review if the directory
        -- already exists
        void $
@ -41,7 +43,7 @@ run cache commit = let timeout = "45m" :: Text in do
            proc "rm" ["-rf", revDir cache commit]
        (exitCode, _nixpkgsReviewOutput) <-
          ourReadProcessInterleavedSem $
-      proc "timeout" [T.unpack timeout, (binPath <> "/nixpkgs-review"), "rev", T.unpack commit, "--no-shell"]
+            proc "timeout" [T.unpack timeout, (binPath <> "/nixpkgs-review"), "rev", T.unpack commit, "--no-shell", "--extra-nixpkgs-config", "{ allowInsecurePredicate = x: true; }"]
        case exitCode of
          ExitFailure 124 -> do
            output $ "[check][nixpkgs-review] took longer than " <> timeout <> " and timed out"
--- a/src/OurPrelude.hs
+++ b/src/OurPrelude.hs
@ -34,7 +34,6 @@ module OurPrelude
  )
 where

-import System.FilePath ((</>))
 import Control.Applicative ((<|>))
 import Control.Category ((>>>))
 import Control.Error
@ -57,6 +56,7 @@ import Polysemy
 import Polysemy.Error hiding (note, try, tryJust)
 import qualified Process as P
 import System.Exit
+import System.FilePath ((</>))
 import System.Process.Typed

 interpolate :: QuasiQuoter
--- a/src/Outpaths.hs
+++ b/src/Outpaths.hs
@ -17,14 +17,14 @@ import qualified Data.Set as S
 import qualified Data.Text as T
 import qualified Data.Text.IO as T
 import qualified Data.Vector as V
-import qualified System.Posix.Files as F
 import qualified Git
-import qualified Utils
-import qualified System.Directory
 import OurPrelude
+import qualified System.Directory
+import qualified System.Posix.Files as F
 import Text.Parsec (parse)
 import Text.Parser.Char
 import Text.Parser.Combinators
+import qualified Utils

 outPathsExpr :: Text
 outPathsExpr =
@ -94,14 +94,23 @@ outPath = do
  liftIO $ T.writeFile outpathFile outPathsExpr
  liftIO $ putStrLn "[outpaths] eval start"
  currentDir <- liftIO $ System.Directory.getCurrentDirectory
-  result <- ourReadProcessInterleaved_ $ proc "nix-env" [
-    "-f", outpathFile,
+  result <-
+    ourReadProcessInterleaved_ $
+      proc
+        "nix-env"
+        [ "-f",
+          outpathFile,
          "-qaP",
          "--no-name",
          "--out-path",
-    "--arg", "path", currentDir,
-    "--arg", "checkMeta", "true",
-    "--show-trace"]
+          "--arg",
+          "path",
+          currentDir,
+          "--arg",
+          "checkMeta",
+          "true",
+          "--show-trace"
+        ]
  liftIO $ putStrLn "[outpaths] eval end"
  pure result

@ -163,7 +172,8 @@ parseResults = S.fromList <$> parseResultLine `sepEndBy` newline

 parseResultLine :: CharParsing m => m ResultLine
 parseResultLine =
-  ResultLine <$> (T.dropWhileEnd (== '.') <$> parseAttrpath)
+  ResultLine
+    <$> (T.dropWhileEnd (== '.') <$> parseAttrpath)
    <*> parseArchitecture
    <* spaces
    <*> parseOutpaths
@ -182,7 +192,8 @@ parseOutpaths = V.fromList <$> (parseOutpath `sepBy1` char ';')

 parseOutpath :: CharParsing m => m Outpath
 parseOutpath =
-  Outpath <$> optional (try (T.pack <$> (many (noneOf "=\n") <* char '=')))
+  Outpath
+    <$> optional (try (T.pack <$> (many (noneOf "=\n") <* char '=')))
    <*> (T.pack <$> many (noneOf ";\n"))

 packageRebuilds :: Set ResultLine -> Vector Text
--- a/src/Repology.hs
+++ b/src/Repology.hs
@ -16,7 +16,7 @@ import GHC.Generics
 import Network.HTTP.Client.TLS (newTlsManager)
 import OurPrelude
 import Servant.API
-import Servant.Client (BaseUrl (..), mkClientEnv, ClientM, Scheme (..), client, runClientM)
+import Servant.Client (BaseUrl (..), ClientM, Scheme (..), client, mkClientEnv, runClientM)
 import System.IO

 baseUrl :: BaseUrl
@ -35,9 +35,9 @@ type Project = Vector Package
 type Projects = HashMap Text Project

 type API =
-  "project" :> Capture "project_name" Text :> Get '[JSON] Project :<|>
-  "projects" :> QueryParam "inrepo" Text :> QueryParam "outdated" Bool :> Get '[JSON] Projects :<|>
-  "projects" :> Capture "name" Text :> QueryParam "inrepo" Text :> QueryParam "outdated" Bool :> Get '[JSON] Projects
+  "project" :> Capture "project_name" Text :> Get '[JSON] Project
+    :<|> "projects" :> QueryParam "inrepo" Text :> QueryParam "outdated" Bool :> Get '[JSON] Projects
+    :<|> "projects" :> Capture "name" Text :> QueryParam "inrepo" Text :> QueryParam "outdated" Bool :> Get '[JSON] Projects

 data Package = Package
  { repo :: Text,
@ -56,12 +56,10 @@ api :: Proxy API
 api = Proxy

 project :: Text -> ClientM (Vector Package)
-
 projects ::
  Maybe Text ->
  Maybe Bool ->
  ClientM Projects
-
 projects' ::
  Text ->
  Maybe Text ->
--- a/src/Rewrite.hs
+++ b/src/Rewrite.hs
@ -241,6 +241,7 @@ updateScript log Args {..} = do
    else do
      lift $ log "skipping because derivation has no updateScript"
      return Nothing
+
 --------------------------------------------------------------------------------
 -- Common helper functions and utilities
 -- Helper to update version and src attributes, re-computing the sha256.
--- a/src/Skiplist.hs
+++ b/src/Skiplist.hs
@ -60,6 +60,9 @@ attrPathList =
    prefix
      "deepin"
      "deepin packages are upgraded in lockstep https://github.com/NixOS/nixpkgs/pull/52327#issuecomment-447684194",
+    prefix
+      "monero-"
+      "monero-cli and monero-gui packages are upgraded in lockstep",
    prefix
      "element-desktop"
      "@Ma27 asked to skip",
@ -87,7 +90,17 @@ attrPathList =
    eq "klee" "update repeatedly exceeded the 6h timeout",
    regex
      (string "python" *> few (psym isDigit) *> string "Packages.mmengine")
-      "takes way too long to build"
+      "takes way too long to build",
+    prefix
+      "linuxKernel"
+      "creates too many duplicate PRs",
+    prefix
+      "postgresql"
+      "creates too many duplicate PRs",
+    prefix
+      -- bump this when the default version is changed
+      "python312Packages"
+      "isn't the default python version"
  ]

 nameList :: Skiplist
@ -184,8 +197,8 @@ checkResultList =

 skipOutpathCalcList :: Skiplist
 skipOutpathCalcList =
-  [ eq "firefox-beta-bin-unwrapped" "master"
-  , eq "firefox-devedition-bin-unwrapped" "master"
+  [ eq "firefox-beta-bin-unwrapped" "master",
+    eq "firefox-devedition-bin-unwrapped" "master"
    -- "firefox-release-bin-unwrapped" is unneeded here because firefox-bin is a dependency of other packages that Hydra doesn't ignore.
  ]

@ -221,4 +234,4 @@ python numPackageRebuilds derivationContents =
    (not isPython || numPackageRebuilds <= maxPackageRebuild)
  where
    isPython = "buildPythonPackage" `T.isInfixOf` derivationContents
-    maxPackageRebuild = 25
+    maxPackageRebuild = 100
--- a/src/Update.hs
+++ b/src/Update.hs
@ -30,7 +30,7 @@ import qualified Data.Set as S
 import qualified Data.Text as T
 import qualified Data.Text.IO as T
 import Data.Time.Calendar (showGregorian)
-import Data.Time.Clock (getCurrentTime, utctDay, addUTCTime, UTCTime)
+import Data.Time.Clock (UTCTime, addUTCTime, getCurrentTime, utctDay)
 import qualified GH
 import qualified Git
 import Language.Haskell.TH.Env (envQ)
@ -41,6 +41,8 @@ import OurPrelude
 import qualified Outpaths
 import qualified Rewrite
 import qualified Skiplist
+import System.Directory (doesDirectoryExist, withCurrentDirectory)
+import System.Posix.Directory (createDirectory)
 import Utils
  ( Boundary (..),
    Options (..),
@ -55,8 +57,6 @@ import Utils
 import qualified Utils as U
 import qualified Version
 import Prelude hiding (log)
-import System.Directory (doesDirectoryExist, withCurrentDirectory)
-import System.Posix.Directory (createDirectory)

 default (T.Text)

@ -181,7 +181,8 @@ updatePackageBatch simpleLog updateInfoLine updateEnv@UpdateEnv {..} = do
    Right foundAttrPath -> do
      log <- alsoLogToAttrPath foundAttrPath simpleLog
      log updateInfoLine
-      mergeBase <- if batchUpdate options
+      mergeBase <-
+        if batchUpdate options
          then Git.mergeBase
          else pure "HEAD"
      withWorktree mergeBase foundAttrPath updateEnv $
@ -198,11 +199,13 @@ checkExistingUpdate log updateEnv existingCommitMsg attrPath = do
    Nothing -> lift $ log "No auto update branch exists"
    Just msg -> do
      let nV = newVersion updateEnv
-      lift $ log
+      lift $
+        log
          [interpolate|An auto update branch exists with message `$msg`. New version is $nV.|]

      case U.titleVersion msg of
-        Just branchV | Version.matchVersion (RangeMatcher (Including nV) Unbounded) branchV ->
+        Just branchV
+          | Version.matchVersion (RangeMatcher (Including nV) Unbounded) branchV ->
              throwError "An auto update branch exists with an equal or greater version"
        _ ->
          lift $ log "The auto update branch does not match or exceed the new version."
@ -329,7 +332,7 @@ updateAttrPath log mergeBase updateEnv@UpdateEnv {..} attrPath = do

    when hasUpdateScript do
      changedFiles <- Git.diffFileNames mergeBase
-      let rewrittenFile = case changedFiles of { [f] -> f; _ -> derivationFile }
+      let rewrittenFile = case changedFiles of [f] -> f; _ -> derivationFile
      assertNotUpdatedOn updateEnv' rewrittenFile "master"
      assertNotUpdatedOn updateEnv' rewrittenFile "staging"
      assertNotUpdatedOn updateEnv' rewrittenFile "staging-next"
@ -356,7 +359,9 @@ updateAttrPath log mergeBase updateEnv@UpdateEnv {..} attrPath = do
            then "Outpath calculations were skipped for this package; total number of rebuilds unknown."
            else Outpaths.outpathReport opDiff
    let prBase =
-          flip fromMaybe skipOutpathBase
+          flip
+            fromMaybe
+            skipOutpathBase
            if Outpaths.numPackageRebuilds opDiff <= 500
              then "master"
              else "staging"
@ -437,7 +442,9 @@ publishPackage log updateEnv oldSrcUrl newSrcUrl attrPath result opReport prBase
      let ghUser = GH.untagName . githubUser . options $ updateEnv
      let mkPR = if branchExists then GH.prUpdate else GH.pr
      (reusedPR, pullRequestUrl) <- mkPR updateEnv (prTitle updateEnv attrPath) prMsg (ghUser <> ":" <> (branchName updateEnv)) prBase
-      when branchExists $ liftIO $ log
+      when branchExists $
+        liftIO $
+          log
            if reusedPR
              then "Updated existing PR"
              else "Reused existing auto update branch, but no corresponding open PR was found, so created a new PR"
@ -492,7 +499,7 @@ prMessage updateEnv isBroken metaDescription metaHomepage metaChangelog rewriteM
      rewriteMsgsLine = foldl (\ms m -> ms <> T.pack "\n- " <> m) "\n###### Updates performed" rewriteMsgs
      maintainersCc =
        if not (T.null maintainers)
-          then "cc " <> maintainers <> " for [testing](https://github.com/ryantm/nixpkgs-update/blob/master/doc/nixpkgs-maintainer-faq.md#r-ryantm-opened-a-pr-for-my-package-what-do-i-do)."
+          then "cc " <> maintainers <> " for [testing](https://github.com/ryantm/nixpkgs-update/blob/main/doc/nixpkgs-maintainer-faq.md#r-ryantm-opened-a-pr-for-my-package-what-do-i-do)."
          else ""
      releaseUrlMessage =
        if releaseUrl == T.empty
@ -611,7 +618,8 @@ untilOfBorgFree log waitUntil = do
    stats <-
      shell "curl -s https://events.ofborg.org/stats.php" & readProcessInterleaved_
    waiting <-
-      shell (jqBin <> " .evaluator.messages.waiting") & setStdin (byteStringInput stats)
+      shell (jqBin <> " .evaluator.messages.waiting")
+        & setStdin (byteStringInput stats)
        & readProcessInterleaved_
        & fmap (BSL.readInt >>> fmap fst >>> fromMaybe 0)
    when (waiting > 2) $ do
@ -695,8 +703,7 @@ cveReport updateEnv =
 doCachix :: MonadIO m => (Text -> m ()) -> UpdateEnv -> Text -> ExceptT Text m Text
 doCachix log updateEnv resultPath =
  let o = options updateEnv
-  in
-    if batchUpdate o && "r-ryantm" == (GH.untagName $ githubUser o)
+   in if batchUpdate o && "r-ryantm" == (GH.untagName $ githubUser o)
        then do
          lift $ log ("cachix " <> (T.pack . show) resultPath)
          Nix.cachix resultPath
@ -737,7 +744,6 @@ updatePackage o updateInfo = do
    UpdatePackageSuccess -> do
      log $ "[result] Success updating " <> updateInfoLine

-
 withWorktree :: Text -> Text -> UpdateEnv -> IO a -> IO a
 withWorktree branch attrpath updateEnv action = do
  bracket
@ -747,8 +753,10 @@ withWorktree branch attrpath updateEnv action = do
        Git.worktreeRemove path
        Git.delete1 (branchName updateEnv)
        Git.worktreeAdd path branch updateEnv
-        pure path)
+        pure path
+    )
    ( \path -> do
        Git.worktreeRemove path
-        Git.delete1 (branchName updateEnv))
+        Git.delete1 (branchName updateEnv)
+    )
    (\path -> withCurrentDirectory path action)
--- a/src/Utils.hs
+++ b/src/Utils.hs
@ -27,7 +27,7 @@ module Utils
    regDirMode,
    outpathCacheDir,
    cacheDir,
-    worktreeDir
+    worktreeDir,
  )
 where

@ -48,10 +48,10 @@ import Database.SQLite.Simple.ToField (ToField, toField)
 import qualified GitHub as GH
 import OurPrelude
 import Polysemy.Output
-import System.Directory (doesDirectoryExist, createDirectoryIfMissing)
+import System.Directory (createDirectoryIfMissing, doesDirectoryExist)
+import System.Environment (lookupEnv)
 import System.Posix.Directory (createDirectory)
 import System.Posix.Env (getEnv)
-import System.Environment (lookupEnv)
 import System.Posix.Files
  ( directoryMode,
    fileExist,
@ -141,7 +141,10 @@ titleVersion title = if T.null prefix then Nothing else Just suffix

 regDirMode :: FileMode
 regDirMode =
-  directoryMode .|. ownerModes .|. groupModes .|. otherReadMode
+  directoryMode
+    .|. ownerModes
+    .|. groupModes
+    .|. otherReadMode
    .|. otherExecuteMode

 logsDirectory :: MonadIO m => ExceptT Text m FilePath
@ -214,7 +217,9 @@ logDir :: IO FilePath
 logDir = do
  r <-
    runExceptT
-      ( logsDirectory <|> xdgRuntimeDir <|> tmpRuntimeDir
+      ( logsDirectory
+          <|> xdgRuntimeDir
+          <|> tmpRuntimeDir
          <|> throwE
            "Failed to create log directory."
      )
--- a/src/Version.hs
+++ b/src/Version.hs
@ -8,8 +8,8 @@ module Version
  )
 where

-import Data.Foldable (toList)
 import Data.Char (isAlpha, isDigit)
+import Data.Foldable (toList)
 import Data.Function (on)
 import qualified Data.PartialOrd as PO
 import qualified Data.Text as T
--- a/test/CheckSpec.hs
+++ b/test/CheckSpec.hs
@ -1,8 +1,8 @@
 module CheckSpec where

+import qualified Check
 import qualified Data.Text as T
 import Test.Hspec
-import qualified Check

 main :: IO ()
 main = hspec spec
--- a/test_data/expected_pr_description_1.md
+++ b/test_data/expected_pr_description_1.md
@ -84,4 +84,4 @@ nixpkgs-review comment body

 ###### Maintainer pings

-cc @maintainer1 for [testing](https://github.com/ryantm/nixpkgs-update/blob/master/doc/nixpkgs-maintainer-faq.md#r-ryantm-opened-a-pr-for-my-package-what-do-i-do).
+cc @maintainer1 for [testing](https://github.com/ryantm/nixpkgs-update/blob/main/doc/nixpkgs-maintainer-faq.md#r-ryantm-opened-a-pr-for-my-package-what-do-i-do).
--- a/test_data/expected_pr_description_2.md
+++ b/test_data/expected_pr_description_2.md
@ -77,4 +77,4 @@ NixPkgs review skipped

 ###### Maintainer pings

-cc @maintainer1 for [testing](https://github.com/ryantm/nixpkgs-update/blob/master/doc/nixpkgs-maintainer-faq.md#r-ryantm-opened-a-pr-for-my-package-what-do-i-do).
+cc @maintainer1 for [testing](https://github.com/ryantm/nixpkgs-update/blob/main/doc/nixpkgs-maintainer-faq.md#r-ryantm-opened-a-pr-for-my-package-what-do-i-do).
Author	SHA1	Message	Date
github-actions[bot]	5d53ea9409	flake.lock: Update Flake lock file updates: • Updated input 'mmdoc': 'github:ryantm/mmdoc/cec02bafac9456bd1ed9b261b8d163a893885e5b' (2022-11-21) → 'github:ryantm/mmdoc/b6ddf748b1d1c01ca582bb1b3dafd6bc3a4c83a6' (2024-03-17) • Removed input 'mmdoc/nixpkgs-for-manual' • Added input 'mmdoc/systems': 'github:nix-systems/default/da67096a3b9bf56a91d16901293e51ba5b49a27e' (2023-04-09) • Updated input 'nixpkgs': 'github:NixOS/nixpkgs/293a28df6d7ff3dec1e61e37cc4ee6e6c0fb0847' (2022-12-30) → 'github:NixOS/nixpkgs/cf8cc1201be8bc71b7cbbbdaf349b22f4f99c7ae' (2024-04-28) • Updated input 'runtimeDeps': 'github:NixOS/nixpkgs/c8d7c8a78fb516c0842cc65346506a565c88014d' (2024-04-27) → 'github:NixOS/nixpkgs/9b03589f4d174bfd6ea9a9de6fb85333fd190f8b' (2024-04-30) • Updated input 'treefmt-nix': 'github:numtide/treefmt-nix/49dc4a92b02b8e68798abd99184f228243b6e3ac' (2024-04-01) → 'github:numtide/treefmt-nix/c6aaf729f34a36c445618580a9f95a48f5e4e03f' (2024-04-25)	2024-05-01 01:01:41 +00:00
zowoq	df23e62c33	Merge pull request #391 from qowoz/insecure allow nixpkgs-review to build insecure packages	2024-04-28 12:15:47 +10:00
zowoq	fc6a441992	Merge pull request #399 from qowoz/review-timeout increase nixpkgs-review timeout to 120 minutes, increase python max package rebuilds from 25 to 100	2024-04-28 12:15:13 +10:00
zowoq	5b65371222	increase python max package rebuilds from 25 to 100	2024-04-28 12:11:52 +10:00
zowoq	256708538c	increase nixpkgs-review timeout to 120 minutes	2024-04-28 12:11:52 +10:00
zowoq	6e45a0911d	allow nixpkgs-review to build insecure packages	2024-04-28 12:08:31 +10:00
zowoq	71ab24a2eb	separate runtime dependencies this is only intended to be temporary until the flake is updated	2024-04-28 12:07:16 +10:00
zowoq	0572aa48da	Merge pull request #406 from qowoz/treefmt add treefmt	2024-04-28 12:01:12 +10:00
zowoq	936918ca61	Merge pull request #417 from nix-community/disable-package doc: add section about disabling package updates	2024-04-28 10:39:34 +10:00
zowoq	170e20a236	Merge pull request #412 from qowoz/docs docs: add contact page with github and matrix links	2024-04-28 10:39:29 +10:00
zowoq	08fc765cd5	Merge pull request #405 from qowoz/python-updatescript doc: remove pypi, add updateScript	2024-04-28 10:39:14 +10:00
zowoq	9fca69f919	Merge pull request #418 from nix-community/readme README: fix link to docs	2024-04-28 10:31:33 +10:00
zowoq	86bf57dce5	Merge pull request #394 from nix-community/dependabot/github_actions/cachix/install-nix-action-26 build(deps): bump cachix/install-nix-action from 15 to 26	2024-04-28 10:30:59 +10:00
dependabot[bot]	cea9d014b8	build(deps): bump cachix/install-nix-action from 15 to 26 Bumps [cachix/install-nix-action](https://github.com/cachix/install-nix-action) from 15 to 26. - [Release notes](https://github.com/cachix/install-nix-action/releases) - [Commits](https://github.com/cachix/install-nix-action/compare/v15...v26) --- updated-dependencies: - dependency-name: cachix/install-nix-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2024-04-28 00:29:43 +00:00
zowoq	9c6d0ff795	format	2024-04-28 10:25:40 +10:00
zowoq	a57bd0d25e	add treefmt	2024-04-28 10:24:49 +10:00
zowoq	10b64aaaf0	Merge pull request #407 from qowoz/buildbot switch to buildbot	2024-04-28 10:22:12 +10:00
zowoq	cfc9fd5cf5	switch to buildbot - drop CI workflow, add attributes to checks - change cachix to nix-community - change doc workflow to deploy cached artifact also switch to using actions deployment that doesn't use repo branch	2024-04-28 10:20:24 +10:00
zowoq	8a113424ca	Merge pull request #401 from nix-community/dependabot/github_actions/DeterminateSystems/update-flake-lock-21 build(deps): bump DeterminateSystems/update-flake-lock from 20 to 21	2024-04-28 10:20:09 +10:00
zowoq	2a56175dd3	README: fix link to docs	2024-04-27 18:42:46 +10:00
zowoq	289072083f	doc: add section about disabling package updates	2024-04-27 15:44:10 +10:00
Ryan Mulligan	1d6efcd1ed	Merge pull request #414 from qowoz/skiplist skiplist: add package sets that cause duplicate PRs	2024-04-26 22:32:20 -07:00
zowoq	e879b3666b	skiplist: add package sets that cause duplicate PRs	2024-04-21 09:57:48 +10:00
Ryan Hendrickson	fbd0e11cae	Merge pull request #411 from qowoz/repo-branch update repo default branch	2024-04-10 23:18:13 -04:00
Ryan Hendrickson	9c581302b0	Merge pull request #410 from rnhmjoj/main skiplist: add monero packages	2024-04-10 23:16:50 -04:00
zowoq	6bcc854083	docs: add contact page with github and matrix links	2024-04-07 11:15:46 +10:00
zowoq	b528afd663	update repo default branch	2024-04-07 11:02:58 +10:00
rnhmjoj	992d8bc9be	skiplist: add monero packages	2024-04-06 21:31:11 +02:00
zowoq	fee7238d72	doc: remove pypi, add updateScript	2024-04-02 15:47:56 +10:00
dependabot[bot]	c10ce7e506	build(deps): bump DeterminateSystems/update-flake-lock from 20 to 21 Bumps [DeterminateSystems/update-flake-lock](https://github.com/determinatesystems/update-flake-lock) from 20 to 21. - [Release notes](https://github.com/determinatesystems/update-flake-lock/releases) - [Commits](https://github.com/determinatesystems/update-flake-lock/compare/v20...v21) --- updated-dependencies: - dependency-name: DeterminateSystems/update-flake-lock dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2024-03-18 04:07:19 +00:00