Running nixpkgs-update (https://nix-community.org/update-bot/) with UPDATE_INFO: cacert 0 -> 1
attrpath: cacert
Checking auto update branch...
[version] 
[version] skipping because derivation has updateScript
[rustCrateVersion] 
[rustCrateVersion] No cargoHash found
[golangModuleVersion] 
[golangModuleVersion] Not a buildGoModule package with vendorHash
[npmDepsVersion] 
[npmDepsVersion] No npmDepsHash
[updateScript] 
[updateScript] Success
[updateScript] this derivation will be built:
  /nix/store/q1gpznl194ln2xshkgacczyrp91k3pfc-packages.json.drv
building '/nix/store/q1gpznl194ln2xshkgacczyrp91k3pfc-packages.json.drv'...
structuredAttrs is enabled

Going to be running update for following packages:
 - nss-cacert-3.131.1

Press Enter key to continue...
Running update for:
Enqueuing group of 1 packages
 - nss-cacert-3.131.1: UPDATING ...
 - nss-cacert-3.131.1: DONE.

Packages updated!

Diff after rewrites:
diff --git a/pkgs/by-name/ca/cacert/package.nix b/pkgs/by-name/ca/cacert/package.nix
index 0c5f16b2ab7a..713d40793a42 100644
--- a/pkgs/by-name/ca/cacert/package.nix
+++ b/pkgs/by-name/ca/cacert/package.nix
@@ -20,7 +20,7 @@ let
     lib.concatStringsSep "\n\n" extraCertificateStrings
   );
 
-  version = "3.131.1";
+  version = "3.131";
   meta = {
     homepage = "https://firefox-source-docs.mozilla.org/security/nss/runbooks/rootstore.html#root-store-consumers";
     description = "Bundle of X.509 certificates of public Certificate Authorities (CA)";
@@ -52,7 +52,7 @@ stdenv.mkDerivation {
         "https://hg-edge.mozilla.org/projects/nss/raw-file/${tag}/${file}"
         "https://raw.githubusercontent.com/nss-dev/nss/refs/tags/${tag}/${file}"
       ];
-    hash = "sha256-PsK00kDcEsdH6vRQBh24SvdXxIO72jAvninOtdcL5RA=";
+    hash = "sha256-vrfm3+ZJmSblLAdcJ7z75MlX+GCcV1s4YCc64oBvY+s=";
   };
 
   unpackPhase = ''

No auto update branch exists
Successfully finished processing
Automatic update generated by [nixpkgs-update](https://github.com/nix-community/nixpkgs-update) tools. This update was made based on information from passthru.updateScript.

meta.description for cacert is: Bundle of X.509 certificates of public Certificate Authorities (CA)

meta.homepage for cacert is: https://firefox-source-docs.mozilla.org/security/nss/runbooks/rootstore.html#root-store-consumers




###### Updates performed
- Ran passthru.UpdateScript

###### To inspect upstream changes





###### Impact

<b>Checks done</b>

---

- built on NixOS
- The tests defined in `passthru.tests`, if any, passed
- found 3.131 in filename of file in /nix/store/ig7m70y1mwxyw3ymbyq42a1vay40fqlv-nss-cacert-3.131

---

<details>
<summary>
<b>Rebuild report</b> (if merged into master) (click to expand)
</summary>

```
50621 total rebuild path(s)

50617 package rebuild(s)

First fifty rebuilds by attrpath

ArchiSteamFarm
CuboCore.coreaction
CuboCore.corearchiver
CuboCore.corefm
CuboCore.coregarage
CuboCore.corehunt
CuboCore.coreimage
CuboCore.coreinfo
CuboCore.corekeyboard
CuboCore.corepad
CuboCore.corepaint
CuboCore.corepdf
CuboCore.corepins
CuboCore.corerenamer
CuboCore.coreshot
CuboCore.corestats
CuboCore.corestuff
CuboCore.coreterminal
CuboCore.coretime
CuboCore.coretoppings
CuboCore.coreuniverse
CuboCore.libcprime
CuboCore.libcsys
DisnixWebService
Fabric
LycheeSlicer
MMA
OVMF
OVMF-amdsev
OVMF-cloud-hypervisor
OVMF-inteltdx
OVMF-xen
OVMFFull
R
SDL
SDL2
SDL2_Pango
SDL2_gfx
SDL2_image
SDL2_mixer
SDL2_net
SDL2_sound
SDL2_ttf
SDL_audiolib
SDL_compat
SDL_gfx
SDL_image
SDL_mixer
SDL_net
```

</details>

<details>
<summary>
<b>Instructions to test this update</b> (click to expand)
</summary>

---

Either **download from the cache**:
```
nix-store -r /nix/store/ig7m70y1mwxyw3ymbyq42a1vay40fqlv-nss-cacert-3.131 \
  --option binary-caches 'https://cache.nixos.org/ https://nixpkgs-update-cache.nix-community.org/' \
  --option trusted-public-keys '
  nixpkgs-update-cache.nix-community.org-1:U8d6wiQecHUPJFSqHN9GSSmNkmdiFW7GW7WNAnHW0SM=
  cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
  '
```
(The nixpkgs-update cache is only trusted for this store-path realization.)
For the cached download to work, your user must be in the `trusted-users` list or you can use `sudo` since root is effectively trusted.

Or, **build yourself**:
```
nix-build -A cacert https://github.com/r-ryantm/nixpkgs/archive/483c37a1f57a96165fbd64392e82b324eed30f3e.tar.gz
```
Or:
```
nix build github:r-ryantm/nixpkgs/483c37a1f57a96165fbd64392e82b324eed30f3e#cacert
```

After you've downloaded or built it, look at the files and if there are any, run the binaries:
```
ls -la /nix/store/ig7m70y1mwxyw3ymbyq42a1vay40fqlv-nss-cacert-3.131
ls -la /nix/store/ig7m70y1mwxyw3ymbyq42a1vay40fqlv-nss-cacert-3.131/bin
```

---

</details>
<br/>



### Pre-merge build results

Nixpkgs review skipped

---

###### Maintainer pings

cc @fpletz @lukegb @balsoft @andir @pyrox0 for [testing](https://github.com/nix-community/nixpkgs-update/blob/main/doc/nixpkgs-maintainer-faq.md#r-ryantm-opened-a-pr-for-my-package-what-do-i-do).

> [!TIP]
> As a maintainer, if your package is located under `pkgs/by-name/*`, you can comment **`@NixOS/nixpkgs-merge-bot merge`** to automatically merge this update using the [`nixpkgs-merge-bot`](https://github.com/NixOS/nixpkgs/blob/master/ci/README.md#nixpkgs-merge-bot).
https://api.github.com/repos/NixOS/nixpkgs/pulls/577423