Merge branch 'master' into age-plugin

Author: NovaViper

.github/workflows/test.yml

@@ -10,7 +10,7 @@ jobs:
   tests:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
     - uses: cachix/install-nix-action@v31
     - name: Add keys group (needed for go tests)
       run: sudo groupadd keys

.github/workflows/update-vendor-hash.yml

@@ -10,7 +10,7 @@ jobs:
         with:
           app-id: ${{ vars.CI_APP_ID }}
           private-key: ${{ secrets.CI_APP_PRIVATE_KEY }}
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0

.github/workflows/upgrade-flakes.yml

@@ -9,7 +9,7 @@ jobs:
   createPullRequest:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - name: Install Nix
         uses: cachix/install-nix-action@v31
         with:

README.md

@@ -851,7 +851,7 @@ The actual sops configuration is in the `sops` namespace in your home.nix (or in
 The secrets are decrypted in a systemd user service called `sops-nix`, so other services needing secrets must order after it:
 ```nix
 {
-  systemd.user.services.mbsync.unitConfig.After = [ "sops-nix.service" ];
+  systemd.user.services.mbsync.Unit.After = [ "sops-nix.service" ];
 }
 ```
 

default.nix

@@ -1,6 +1,6 @@
 {
   pkgs ? import <nixpkgs> { },
-  vendorHash ? "sha256-b+yUkMeIKiozlrANOwaMY2QDWo0cZYpD9SXZuSgYUQs=",
+  vendorHash ? "sha256-diS0zLssN1jaPRDleaIsUe6oGJE0KgvF1Jl81pnzhhU=",
 }:
 let
   sops-install-secrets = pkgs.callPackage ./pkgs/sops-install-secrets {

dev/private.narHash

@@ -1 +1 @@
-sha256-LWGPhPU6l7VM8rvPbl0g8h+jPO90rkiqYL1bFLUuro8=
+sha256-wyQ2oeHNYAjJm329fi01r7XBoHxs7V4MYhCuzNqvFsY=

dev/private/flake.lock

@@ -57,7 +57,6 @@
             sops-init-gpg-key
             sops-pgp-hook
             sops-import-keys-hook
-            sops-ssh-to-age
             ;
           # backward compatibility
           inherit (prev) ssh-to-pgp;

flake.lock

@@ -11,8 +11,8 @@ require (
 	github.com/joho/godotenv v1.5.1
 	github.com/moby/sys/mountinfo v0.7.2
 	github.com/mozilla-services/yaml v0.0.0-20201007153854-c369669a6625
-	golang.org/x/crypto v0.42.0
-	golang.org/x/sys v0.36.0
+	golang.org/x/crypto v0.46.0
+	golang.org/x/sys v0.39.0
 	gopkg.in/ini.v1 v1.67.0
 )
 
@@ -116,11 +116,11 @@ require (
 	go.opentelemetry.io/otel/sdk/metric v1.37.0 // indirect
 	go.opentelemetry.io/otel/trace v1.37.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/net v0.44.0 // indirect
+	golang.org/x/net v0.47.0 // indirect
 	golang.org/x/oauth2 v0.31.0 // indirect
-	golang.org/x/sync v0.17.0 // indirect
-	golang.org/x/term v0.35.0 // indirect
-	golang.org/x/text v0.29.0 // indirect
+	golang.org/x/sync v0.19.0 // indirect
+	golang.org/x/term v0.38.0 // indirect
+	golang.org/x/text v0.32.0 // indirect
 	golang.org/x/time v0.13.0 // indirect
 	google.golang.org/api v0.250.0 // indirect
 	google.golang.org/genproto v0.0.0-20250603155806-513f23925822 // indirect