Fix NixOS build failure by allowing insecure libsoup-2.74.3 package

[Copilot]

Resolves the nixos-rebuild switch build failure caused by libsoup-2.74.3 being marked as insecure due to multiple CVEs.

Problem

The system build was failing with the following error:

error: Package 'libsoup-2.74.3' in /nix/store/...default.nix:134 is marked as insecure, refusing to evaluate.

Known issues:
 - libsoup 2 is EOL, with many known unfixed CVEs.
 - CVE-2025-4948, CVE-2025-46421, CVE-2025-32914, etc.

The error occurred during fontconfig evaluation in the home-manager configuration chain, preventing the entire system from building.

Root Cause

libsoup 2.x has reached end-of-life with numerous unfixed security vulnerabilities. NixOS now marks this package as insecure by default and refuses to evaluate configurations that depend on it. However, some packages in the current configuration still transitively depend on libsoup 2.x rather than the newer libsoup 3.x.

Solution

Added libsoup-2.74.3 to the permittedInsecurePackages list in the nixpkgs configuration:

nixpkgs = {
  overlays = builtins.attrValues outputs.overlays;
  config = {
    allowUnfree = true;
    permittedInsecurePackages = [
      "libsoup-2.74.3"
    ];
  };
};

This change:

• ✅ Allows the system to build successfully while acknowledging the security risk
• ✅ Follows the recommended approach from the NixOS error message
• ✅ Provides a temporary workaround until dependencies migrate to libsoup 3
• ✅ Applied system-wide in hosts/common.nix to handle all configurations

Security Note

This is a temporary measure to unblock system builds. The CVEs listed in the error message are known issues that have been addressed in libsoup 3.x. Users should plan to update or replace packages that depend on libsoup 2.x when libsoup 3.x compatible versions become available in nixpkgs.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.