From 89bf0202c492badf396a903e4685d227cec08b68 Mon Sep 17 00:00:00 2001
From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com>
Date: Tue, 21 Jul 2026 13:05:06 +0000
Subject: [PATCH 1/2] fix(raider): drop removed gst_all_1.gst-vaapi plugin

gst-vaapi was removed in GStreamer 1.28 (nixpkgs throws on the attribute),
which broke raider's toplevel eval. VA-API decoding is now provided by
gst-plugins-bad, which is already in the multimedia plugin list.
---
 modules/constellation/desktop.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/modules/constellation/desktop.nix b/modules/constellation/desktop.nix
index d62add2..011e853 100644
--- a/modules/constellation/desktop.nix
+++ b/modules/constellation/desktop.nix
@@ -165,7 +165,8 @@ in {
             gst_all_1.gst-plugins-bad
             gst_all_1.gst-plugins-ugly
             gst_all_1.gst-libav
-            gst_all_1.gst-vaapi
+            # gst-vaapi was removed in GStreamer 1.28; VA-API decoding is now
+            # provided by gst-plugins-bad (already included above).
           ]
           ++ lib.optionals cfg.virtualization [
             quickemu

From 3a3ea1c0269ea1ee4a9413c636aaf039992d059a Mon Sep 17 00:00:00 2001
From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com>
Date: Tue, 21 Jul 2026 13:05:06 +0000
Subject: [PATCH 2/2] fix(galactica): permit insecure pnpm-9.15.9 for opencloud

nixpkgs marked pnpm-9.15.9 insecure (multiple CVEs), and opencloud's web
frontend pulls it as a build-time dependency, so galactica's toplevel
failed to evaluate. Allow the package (build-time only, not runtime) via
permittedInsecurePackages so the config evaluates again.
---
 hosts/galactica/configuration.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hosts/galactica/configuration.nix b/hosts/galactica/configuration.nix
index 58ab0c3..0705265 100644
--- a/hosts/galactica/configuration.nix
+++ b/hosts/galactica/configuration.nix
@@ -185,6 +185,9 @@ in {
     "aspnetcore-runtime-wrapped-6.0.36"
     "dotnet-sdk-6.0.428"
     "dotnet-sdk-wrapped-6.0.428"
+    # Build-time dependency of opencloud's web frontend; only used during
+    # the pnpm fetch/build, not at runtime.
+    "pnpm-9.15.9"
   ];
 
   services.check-stock = {