[rahultee]

Working...
Why

Revert the NSS 3.131.1 CA update as a workaround for the full bundle build failure. Its changed CA dependency changes Git and the .NET bootstrap derivation. Rebuilding .NET exposes an IdentityModel assembly-version overflow: 8.0.0.71022 exceeds the allowed revision range.

What changed

• Remove only the CA-data override added by that PR; restore each package set's previous CA bundle.
• Keep the Node 22.23.4 and 24.22.1 security updates and their patched Brotli dependencies.
• Keep all lockfile pins and other later changes unchanged.

Test plan

• nix fmt -- --check . (84 files) and git diff --check passed.
• All 50 active and 50 deployment module definitions, all module aliases and the bundle derivation evaluated.
• Evaluation restores the previous .NET 10 module and bootstrap derivations.
• Node 22/24 evaluation confirms the same security versions and Brotli fix remain selected.
• Full .NET and bundle builds were not run. Restoring derivations does not prove that full CI will pass.

Rollout

This rolls back a CA-certificate security update and restores older trust data. It is a workaround, not a fix for the .NET version bug. Rebuild the module bundle after merge. Restore the CA update after fixing the .NET build.

• This is fully backward and forward compatible

~ written by ⠕ Replit