[dependabot]

Bumps the nix group with 3 updates in the / directory: mbx, nixpkgs and rust-overlay.

Updates mbx from v1.27.0 to v1.29.0

Release notes

Sourced from mbx's releases.

v1.29.0: Remove a named compiler version's cache entries, and fixes for worktrees, wrappers and ZFS

mbx gc --rustc-version removes every cached Rust result for a compiler version you name, and mbx gc now cleans up task manifests that used to grow without limit. This release also fixes git-commit build scripts sharing results between worktrees, compiler wrappers set in Cargo config being dropped, broken rlibs from incremental reuse in optimized profiles, and several ZFS timestamp problems. After upgrading, some build scripts rerun once and optimized profiles stop getting incremental state from mbx; see Upgrade notes.

Added

• Remove cached results for a named Rust version (#845, @​jdx). gc.rustc_max_age only removes a version after it has gone unused for the whole window. Now you can reclaim an old toolchain's space right after an upgrade:

  mbx gc --rustc-version 1.97.1 --dry-run   # preview
  mbx gc --rustc-version 1.97.1

  The value is the release that rustc --version prints (1.99.0-nightly), or the full first line of rustc -vV without the leading rustc (1.99.0-nightly (abc123def 2026-09-01)) to target one nightly. The named version is removed even if it is the newest or was used recently. Objects that another version also uses are kept, and so are results that are not rustc compilations and results that a pending grouped CI export needs. The option applies only to that run, and --automatic rejects it.
• mbx doctor warns when filesystems don't record access times (#855, @​jbellis). A new atime check probes the action store (<cache_dir>/actions) and managed targets (<target.root>/v1). On noatime mounts, eviction loses its recent-use ordering, unused-unit collection is turned off, and seeding can't filter by recent use. The check passes under relatime and strictatime. On Linux the warning says how to turn access times back on, including the ZFS atime=on and relatime=on properties. The check also appears in --json output.
• mbx explain --last points to the cause of C compile bypasses (#857, @​jdx). When a recorded build has unexpected bypasses, the output tells you to rerun the recorded command under mbx explain, which names the option, flag or variable behind each one. For cc-unsupported-environment, it also lists which of the variables that bypass C compiles are set in your current shell: CPATH, COMPILER_PATH, C_INCLUDE_PATH, CPLUS_INCLUDE_PATH, OBJC_INCLUDE_PATH, GCC_EXEC_PREFIX, DEPENDENCIES_OUTPUT, SUNPRO_DEPENDENCIES, plus CL/_CL_ on Windows. LIBRARY_PATH does not cause a bypass. The recorded command is now shown with each argument quoted.

Fixed

• Build scripts that embed the git commit keep each worktree's commit (#865, @​ViRb3). If a build script ran git rev-parse HEAD and watched files under .git, a linked worktree could restore another worktree's result and build a binary that reported the wrong commit. In other cases every build printed build-script cache bypassed: Not a directory (os error 20) and ran uncached. Now mbx caches the result of any build script that watches git metadata separately for each checkout. It recognizes .git paths, bare repositories, separate git directories and nested repositories. If a script declares .git/HEAD from inside a linked worktree, its result is not stored, and the package's compilations report build-script input runs through a file: .git/HEAD. They no longer print a warning on every build.
• Compiler wrappers set in Cargo config work again under mbx (#846, @​lhzapata). mbx used to drop build.rustc-wrapper and build.rustc-workspace-wrapper set in .cargo/config.toml, CARGO_HOME, --config or an alias, so projects built without their wrapper and no error was shown. These wrappers now run in mbx's wrapper chain, including those set in included files. A wrapper set in config is now treated like the same wrapper in RUSTC_WRAPPER: a configured sccache, for example, makes mbx defer to it and leave the build uncached. If mbx can't model the configuration safely, it runs Cargo uncached and logs why at MBX_LOG=debug. This happens when a command-line --config changes a wrapper, a config file can't be read or parsed, an included file sets a wrapper, or a wrapper value isn't UTF-8. The alias forms cargo x --config alias.x='build' and cargo x --config term.quiet=true no longer exit 1.
• Optimized incremental builds no longer produce broken rlibs (#867, @​jbellis). When learned or eager incremental reuse added incremental state to a release-derived profile, local ThinLTO could leave rlibs with undefined anon.*.llvm.* symbols, and later links failed. See Upgrade notes for which profiles still get incremental state from mbx.
• Flags after an external Cargo subcommand reach the plugin (#868, @​jdx). Through the shim, commands such as cargo foo -Z x, cargo foo -C dir and cargo kani autoharness -Z autoharness failed with could not verify Cargo build storage: metadata probing failed. They now run the way they do with plain Cargo. Built-in commands such as cargo build -Z bad still show Cargo's own error.
• Metadata probe failures now say why (#862, @​jbellis). The "metadata probing failed" error now includes the cause: Cargo's exit status and the last few lines of its stderr, an I/O error, or a JSON problem. The full stderr is logged at debug level. For library users, mbx-cache-cargo adds try_resolve_reported, which returns a ProbeFailure.
• Builds no longer queue behind a compile they can't reuse (#859, @​jbellis). When checkouts with different inputs compiled the same crate, each waiting build compiled while still holding the in-flight lock, so builds queued one behind another for 5 to 40 minutes and printed nothing. A waiting build whose inputs don't match now releases the lock before compiling. mbx warns after 60 seconds of waiting and stops waiting after 10 minutes, or after four times the last recorded compile time if that is longer. This applies to both Rust and C/C++ compiles.
• mbx run stays cached when cargo on PATH is an mbx shim (#863, @​jbellis). In that setup, which some containers use, mbx run built outside the cache session and build scripts saw no MBX_SOCKET. The build now stays in the session, and the launched application still starts with a clean environment.
• mbx gc now removes old task manifests (#852, @​jdx). task-manifests/v1 was never collected and could reach tens of GiB. gc now removes a manifest and its lock file once no live checkout claims it and it has been untouched for a day. Output includes dropped N unclaimed task manifests, and --json reports action_store.removed_task_manifests.
• ZFS restores no longer cause needless Cargo rebuilds (#861, @​jbellis). On Linux, a restored output on ZFS could get a modification time slightly newer than files written after it. Cargo then rebuilt dependents and reran build scripts for no reason. Restored outputs on ZFS now get timestamps from the filesystem's own clock. Other filesystems and platforms are unchanged.
• Same-length edits within one timestamp tick are detected (#860, @​jbellis). On coarse-timestamp filesystems such as ZFS, a source file rewritten with the same length within one tick of mbx's pre-compile snapshot looked unchanged, even though the compiler might have read the old bytes. mbx now also hashes the content of files modified very recently, for both Rust and C/C++ compiles.
• Deleting or renaming a source file keeps the crate's incremental state (#847, @​ViRb3). This includes a git checkout that drops files. Before, the next build printed incremental state was not reused: failed to read compiler input ... and compiled the crate from scratch. A missing file now counts as an ordinary edit.
• Windows shows build errors instead of raw JSON (#844, @​jdx). ConPTY wrapped Cargo's long JSON diagnostic lines, so compile errors were printed as {"reason":"compiler-message",...}.
• An empty or non-Unicode MBX_CACHE_DIR resolves consistently (#837, @​lhzapata). With MBX_CACHE_DIR= (common when CI templates expand an unset variable) or a non-Unicode value, one invocation could read two different cache roots. An empty value now resolves no cache root everywhere, and a non-Unicode value is ignored everywhere.

Changed

• The pretty build summary no longer ends with the line "Savings estimate sums compiler work, not wall-clock time." (#849, @​jdx).

Upgrade notes

• Build scripts that watch git metadata rerun once per checkout. Their earlier results were stored without the checkout in the key (#865). Other build scripts are not affected.
• Some optimized profiles no longer get incremental state from mbx (#867). This applies to learned reuse, eager reuse and the fallback for uncached workspace libraries:
  • Explicit LTO turns it off at every opt-level.
  • Opt-levels 2, 3, s and z turn it off when local ThinLTO is possible. Note that Cargo's lto = false still allows local ThinLTO. To keep these profiles eligible, use lto = "off" or codegen-units = 1.
  • Opt-levels 0 and 1 are unaffected, and so are incremental flags that Cargo sets itself.
• A sccache (or other wrapper) set in Cargo config now leaves builds uncached (#846), the same as setting it in RUSTC_WRAPPER. Remove the wrapper from the config if you want mbx to cache those builds.

New Contributors

• @​lhzapata made their first contribution in #837

Full Changelog: jdx/mr-boxington@v1.28.0...v1.29.0

v1.28.0: Opt-in gc for unused compiler versions, experimental blaze routing, and cached cargo install

... (truncated)

Changelog

Sourced from mbx's changelog.

[workspace]

Label the release PR so it is easy to find and filter.

pr_labels = ["release"]

Releases happen by merging a release PR, not by any push that happens to

carry a version bump. Same choice as jdx/mbx-cache.

release_always = false git_release_enable = true

Drafted so release.yml can attach binaries before anyone sees it — a release

that appears without its assets is worse than one that appears a minute

later. release-plz.yml undrafts it once the upload succeeds.

git_release_draft = true

Three version tiers, because the crates promise different things.

mbx and mbx-cache-protocol each carry a stability promise, so each gets an

independent version: the CLI's surface is its commands and its JSON output,

the protocol crate's is a wire contract with an external consumer (the

jdx/mbx-cache server depends on it and nothing else). Neither should be

forced to a major bump by the other, which is what sharing a number would do.

mbx-cache-core, mbx-cache-rustc, and mbx-cache-cc are internals with no

promise to keep. They share a group so a release moves them together, and they

stay on 0.x so semver itself says a minor bump may break them. They cannot

hold the CLI's number without making every refactor inside them a major mbx

release.

[[package]] name = "mbx" publish = true

The CLI's commands and JSON output are the promise; the library target inside

mbx is not (see RELEASING.md). cargo-semver-checks reads that library, so a

change to an internal type it exposes, such as a field added to a public

struct, would otherwise turn into a major CLI release. The version follows

the commits instead, and a real CLI break is declared with ! and a

BREAKING CHANGE: footer.

semver_check = false

release-plz would otherwise tag the binary crate mbx-vX.Y.Z. The README's

install URLs are written against v{version}, and this is the tag people

reference, so it takes the bare name. Same workaround as jdx/tak.

git_tag_name = "v{{ version }}" git_release_enable = true

[[package]] name = "mbx-cache-protocol" publish = true

A library: crates.io is its distribution. A GitHub release for it would carry

no assets and would sit drafted forever, since only the mbx tag is undrafted.

git_release_enable = false

[[package]] name = "mbx-cache-core"

... (truncated)

Commits

• ce14529 chore: release (#839)
• 14ce94d fix(cargo): pass flags after an external subcommand through untouched (#868)
• 4b9e9e2 fix(rustc): prevent broken rlibs from optimized incremental reuse (#867)
• ff6a874 fix(build-script): keep each worktree's commit when a build script watches gi...
• 24abd68 fix(session): keep mbx run builds cached when cargo is an mbx shim (#863)
• 8b9bf4b test: isolate tests from MBX_LINKER, RUSTC and the host mbx config (#864)
• bc938ef fix(cargo): say why the cargo metadata probe failed (#862)
• 512b8bc fix(scheduler): stop builds queueing behind an in-flight compile they cannot ...
• 923ae49 fix(cache): catch same-length edits made within one timestamp tick (#860)
• 4000e1f fix(cache): stop restored outputs on ZFS from triggering needless Cargo rebui...
• Additional commits viewable in compare view

Updates nixpkgs from 5adc508 to 885ba4d

Commits

• 885ba4d postgresqlPackages.anonymizer: 3.2.3 -> 3.3.2 (#580282)
• 964de16 chatgpt: 26.1023.50603 -> 26.1027.30824 (#580702)
• 1c89083 kdePackages.kirigami-addons: 1.15.0 -> 1.16.0 (#580790)
• 6b1684a artalk: fix generation of shell completion, enable structuredAttrs (#580732)
• 4db90f6 nixos/hydra: Fix invocations of runuser in hydra-init (#578316)
• 15baaf0 fyne: 1.7.3 -> 1.7.4 (#580718)
• fbab1a9 thunderbird: 158.0 -> 159.0 (#580578)
• ff316b9 sonarqube-cli: 1.10.0.16040 -> 1.11.0.16877 (#580683)
• f188e1d incus: 7.5.1 -> 7.6.0 (#580773)
• 0d72aae libetebase: use libsodium over vendored version (#571118)
• Additional commits viewable in compare view

Updates rust-overlay from b0829a2 to 96a0986

Commits

• 96a0986 manifest: update
• afcefd0 manifest: update
• 19ecdd0 manifest: update
• c7e9d51 manifest: update
• 0d05759 manifest: update
• fad80eb manifest: update
• 5b9f119 manifest: update
• See full diff in compare view

Review

Rewritten by quest review after each round.

• Reviewer: Codex, gpt-6.1-sol, low effort
• Session: 01a1b374-5b2f-71d1-845c-04cb7464fbea, round 1
• Head: a6328d3
• Base: origin/main at 777c50c
• Score: 10/10, The specified diff consistently updates dependency pins and mr-boxington to v1.29.0 with no actionable defects found; lockfile JSON was validated, but builds and tests were not run.
• Findings: none

[pullfrog]

  ^{｜ Review this ➔}

[kixelated]

Automated review by review (OpenAI)

Reviewed head: 46d1e3152b2d7d709bf83bc70363b4930bcb50b0.

No actionable defects found in the input/lock updates. The mbx v1.29.0 reference and locked revision agree, its upstream flake keeps the same package outputs, and the benchmark records the actual mbx version. No changes requested from this static review.

Verification limits: inspected the changed Nix files, mbx's old/new flake, and benchmark integration through GitHub only. I did not evaluate or build Nix outputs, validate the NAR hashes, run tests, or audit every transitive nixpkgs change. Bench is still running and Queue was skipped. The mbx-consuming Bench (moq nix) job is also skipped on PRs by design, so the running benchmarks do not validate that integration.