From fccb238ec7112136d673d0985b7a8f16bac45e43 Mon Sep 17 00:00:00 2001
From: George K <george@coder.com>
Date: Tue, 23 Jun 2026 09:08:35 -0700
Subject: [PATCH] fix: upgrade nixpkgs to 25.05 and pin protoc 23.4 (#26584)

`nix develop` and `nix-shell` were broken because the `nixos-24.11`
`google-chrome` derivation still pointed at Chrome 138, and Google no
longer serves that versioned `.deb`.

Update the flake's main `nixpkgs` input to `nixos-25.05` so the
shell resolves a current Chrome package again. Pin `protoc
23.4` explicitly from the upstream protobuf release archives. This keeps
the local Nix shell aligned with `mise.toml` and the CI/release codegen
toolchain.
---
 flake.lock |  8 ++++----
 flake.nix  | 45 +++++++++++++++++++++++++++++++++++++++++++--
 2 files changed, 47 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index dea5417e7e..2da9acc52c 100644
--- a/flake.lock
+++ b/flake.lock
@@ -44,16 +44,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1751274312,
-        "narHash": "sha256-/bVBlRpECLVzjV19t5KMdMFWSwKLtb5RyXdjz3LJT+g=",
+        "lastModified": 1767313136,
+        "narHash": "sha256-16KkgfdYqjaeRGBaYsNrhPRRENs0qzkQVUooNHtoy2w=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "50ab793786d9de88ee30ec4e4c24fb4236fc2674",
+        "rev": "ac62194c3917d5f474c1a844b6fd6da2db95077d",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-24.11",
+        "ref": "nixos-25.05",
         "repo": "nixpkgs",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index 3d07a257fa..0dd9dd214e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,7 +2,7 @@
   description = "Development environments on your infrastructure";
 
   inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.11";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-25.05";
     nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";
     nixpkgs-pinned.url = "github:nixos/nixpkgs/5deee6281831847857720668867729617629ef1f";
     flake-utils.url = "github:numtide/flake-utils";
@@ -108,6 +108,47 @@
           vendorHash = null;
         };
 
+        # Keep protoc aligned with mise.toml so local Nix shells use
+        # the same codegen tool version as CI and release workflows,
+        # regardless of nixpkgs channel defaults.
+        protobuf_23_4 =
+          let
+            releases = {
+              x86_64-linux = {
+                platform = "linux-x86_64";
+                hash = "sha256-BQLyhqye2GC2KaeWWhRSex8t0THkKD+iPC1/GEZyqpo=";
+              };
+              aarch64-linux = {
+                platform = "linux-aarch_64";
+                hash = "sha256-HHdQtuA4MFtaf8PQzaHr798Qak8wp4e/gm7S/EfDln0=";
+              };
+              aarch64-darwin = {
+                platform = "osx-aarch_64";
+                hash = "sha256-jHr66GJraBHntYl9FtlAwtv1Cx4TXtlYoB22VmvdpyY=";
+              };
+              x86_64-darwin = {
+                platform = "osx-x86_64";
+                hash = "sha256-B+X9zxsHCNM2fcXm640TXefkB9dTFskxVc/YqzYu7IA=";
+              };
+            };
+            target = releases.${system} or null;
+          in
+          if target != null then
+            pkgs.runCommand "protobuf-23.4" {
+              nativeBuildInputs = [ pkgs.unzip ];
+              src = pkgs.fetchurl {
+                url = "https://github.com/protocolbuffers/protobuf/releases/download/v23.4/protoc-23.4-${target.platform}.zip";
+                hash = target.hash;
+              };
+            } ''
+              mkdir -p "$out"
+              cd "$out"
+              unzip "$src"
+              chmod +x "$out/bin/protoc"
+            ''
+          else
+            throw "protobuf 23.4 is not defined for ${system}";
+
         # Custom sqlc build from coder/sqlc fork to fix ambiguous column bug, see:
         # - https://github.com/coder/sqlc/pull/1
         # - https://github.com/sqlc-dev/sqlc/pull/4159
@@ -263,7 +304,7 @@
             pnpm
             postgresql_16
             proto_gen_go_1_30
-            protobuf_23
+            protobuf_23_4
             ripgrep
             shellcheck
             (pinnedPkgs.shfmt)