An interesting article about a vulnerability that was discovered in Nixpkgs (Github): https://ptrpa.ws/nixpkgs-actions-abuse

OK, it's time for me to do what I dislike doing the most: to beg. Uhg, I feel gross just thinking about it but...

I want to get the Sparrow Nix package updated in Nixpkgs ASAP because if it doesn't get updated before the Java SDKs 22-24 get dropped (which will happen sometime between now and the release of NixOS 25.11) the Sparrow package will be in a broken state; Hydra won't build it, and end-users won't be able to install it. Which means I'd have to do a NixOS 25.11 backport of the Sparrow package, and I hate backporting.

I'm doing this disgusting begging dance in hopes that some plebs will test the Nix package and make some noise on the PR: https://github.com/NixOS/nixpkgs/pull/449169

Luckly PRs have been getting merged much quicker than they used to, so there's still a good chance. So,

1. Test the package.
2. Post stickers, comments, whatever, on the PR.

Also notice that the PR number ends in 69, which is the number of... uh... creation ;)

sparrow 2.3 is coming to a Nixpkgs near you.

1. To test, execute: nix run github:emmanuelrosa/nixpkgs/sparrow-2.3.0#sparrow
2. Report your findings, or more generally signal your interest at https://github.com/NixOS/nixpkgs/pull/449169

#nix #nixos

OK, sparrow 2.3.0 is out! And you can get the Nix package from my Nix flake https://github.com/emmanuelrosa/btc-clients-nix

Did I beat all of the other third-party packages?

The update will make it to Nixpkgs at some point, but it's worth noting that this Sparrow update did not work with the recent Nix package update to Zulu 24. So, I removed the Nixpkgs JDK and went with the bundled JDK, which is something I recently mentioned I may have to do, which is Temurin 22.

One nice benefit of this change is that the package is simpler; Less Nix code.

Nix package updates:

- The bisq2 JDK was updated from 23 to 25, and from openjdk to Zulu JDK; Because there seems to be an issue with openjdk 25 and JFX 25.
- The sparrow JDK was updated from 23 to 24. sparrow is currently not compatible with JDK 25.

The problem here is that within a couple of months JDK 22-24 will be dropped from Nixpkgs, which leaves sparrow without a compatible JDK. Yeah, this is all happening again.

I already tested sparrow with the bundled JDK (created with jpackage), which is Temurin JDK 22, and it works. So there's that option.

There's nothing quite like a good game of whack-a-mole.

Can you imagine Apple, Dell, Lenovo, or HP taking about their defered or rejected products? Yeah, that's not going to happen.

Well, Framework did just that: https://www.youtube.com/watch?v=0RzUBqtgODM

What I find interesting about this is that instead of the usual, constipated "business talk" that's used by BigTech, the CEO of Framework talks like a normal person to consumers.

It's refreshing. And smart.

OK, we are doing some package updates because Nixpkgs will be dropping JDK 23 since it's now EOL.

So, if you use the sparrow and/or bisq2 Nix packages, I'd like for you to test the Nix package updates:

- sparrow: https://github.com/NixOS/nixpkgs/pull/445018
- bisq2: https://github.com/NixOS/nixpkgs/pull/445024

Note: The apps haven't been updated. Only the JDK has.

You can test them with the following commands:

- nix run github:msgilligan/nixpkgs/msgilligan/bisq2-zulu-25#sparrow
- nix run github:emmanuelrosa/nixpkgs/bisq2-zulu-25#bisq2

After trying them out, report your findings in the PR.

Thank you!

#nix #nixos #sparrow #bisq2

CUPS needs to be updated to fix two CVEs:

- (high severity) https://www.cve.org/CVERecord?id=CVE-2025-58060
- https://www.cve.org/CVERecord?id=CVE-2025-58364

The NixOS PR to watch is https://github.com/NixOS/nixpkgs/pull/442076

#nixos

Nix package updates:

- aarch64 support for the Bisq 2 Nix package was merged into Nixpkgs.
- The bitcoin core and bitcoin knots Nix packages now have automatic build-time GPG verification.
- Webcam QR code scanning support for Bisq 2 has been merged into Nixpkgs.

Coming up is upgrading the sparrow and bisq 2 packages to JDK 24. And thank goodness there's now a second maintainer helping out with the sparrow package :)

#nix #nixos