How can I find all parents of a certain package?

Help
1

In the last few days I’ve been unable to rebuild due to an error that pnpm is insecure.

 sudo nixos-rebuild switch
building the system configuration...
error:
       … while calling the 'derivationStrict' builtin
         at «nix-internal»/derivation-internal.nix:37:12:
           36|
           37|   strict = derivationStrict drvAttrs;
             |            ^
           38|

       … while evaluating derivation 'nixos-system-nixos-26.05.20260629.1f01958'
         whose name attribute is located at «github:NixOS/nixpkgs/1f01958ffb5b3545c96d9ef2f4e24c5e5e1eb846?narHash=sha256-i5nw9BYYsMDAaOC4J%2BJmTof6b2GhlyH076awYRNrTV8%3D»/pkgs/stdenv/generic/make-derivation.nix:647:11

       … while evaluating attribute 'buildCommand' of derivation 'nixos-system-nixos-26.05.20260629.1f01958'
         at «github:NixOS/nixpkgs/1f01958ffb5b3545c96d9ef2f4e24c5e5e1eb846?narHash=sha256-i5nw9BYYsMDAaOC4J%2BJmTof6b2GhlyH076awYRNrTV8%3D»/nixos/modules/system/activation/top-level.nix:63:7:
           62|       allowSubstitutes = false;
           63|       buildCommand = systemBuilder;
             |       ^
           64|

       … while evaluating the option `environment.etc.dbus-1.source':

       (stack trace truncated; use '--show-trace' to show the full, detailed trace)

       error: Refusing to evaluate package 'pnpm-10.29.2' in /nix/store/yzpbrhbmaxbrpvn1wfx06zbm1chykk8b-source/pkgs/development/tools/pnpm/generic.nix:164 because it is marked as insecure

       Known issues:
        - CVE-2026-48995
        - CVE-2026-50014
        - CVE-2026-50015
        - CVE-2026-50016
        - CVE-2026-50017
        - CVE-2026-50573
        - CVE-2026-55699

I’ve tried following other threads using nix-store –query –referrers /nix/store/yzpbrhbmaxbrpvn1wfx06zbm1chykk8b-source and nix-tree but can’t find pnpm. It isn’t being pulled in by a new package that I’ve added to configuration.nix as I was able to build just fine a few days ago and haven’t made any modifications since. Also, it seems that the pnpm package is a part of the package Source, unless I’m reading this wrong.

I want to view all packages that use pnpm so I can remove them. Is there a way to do this?

2

Try this:

nix why-depends --all --impure --expr 'import <nixpkgs/nixos> { }' \
  config.system.build.toplevel pkgs.pnpm
3

I get the following error:

error:
       … while evaluating the attribute 'config'
         at /nix/store/px5hriq26pdgx0khrk7h9bc1gdijgjjf-source/lib/modules.nix:402:9:
          401|         options = checked options;
          402|         config = checked (removeAttrs config [ "_module" ]);
             |         ^
          403|         _module = checked (config._module);

       … while calling the 'seq' builtin
         at /nix/store/px5hriq26pdgx0khrk7h9bc1gdijgjjf-source/lib/modules.nix:402:18:
          401|         options = checked options;
          402|         config = checked (removeAttrs config [ "_module" ]);
             |                  ^
          403|         _module = checked (config._module);

       (stack trace truncated; use '--show-trace' to show the full, detailed trace)

       error: file 'nixos-config' was not found in the Nix search path (add it using $NIX_PATH or -I)

Should $NIX_PATH be the path to my configuration.nix?

4

I tried setting it to my configuration.nix and got the following:

❯ sudo nix why-depends --all --impure --expr 'import <nixpkgs/nixos> { }' config.system.build.toplevel pkgs.pnpm -I nixos-config=/etc/nixos/configuration.nix
error:
       … while evaluating the attribute 'config'
         at /nix/store/px5hriq26pdgx0khrk7h9bc1gdijgjjf-source/lib/modules.nix:402:9:
          401|         options = checked options;
          402|         config = checked (removeAttrs config [ "_module" ]);
             |         ^
          403|         _module = checked (config._module);

       … while calling the 'seq' builtin
         at /nix/store/px5hriq26pdgx0khrk7h9bc1gdijgjjf-source/lib/modules.nix:402:18:
          401|         options = checked options;
          402|         config = checked (removeAttrs config [ "_module" ]);
             |                  ^
          403|         _module = checked (config._module);

       (stack trace truncated; use '--show-trace' to show the full, detailed trace)

       error: The option `home-manager' does not exist. Definition values:
       - In `/etc/nixos/configuration.nix':
           {
             backupFileExtension = ".bak";
             useGlobalPkgs = true;
             users = {
               professor = {
           ...

       Did you mean `image', `powerManagement' or `containers'?

Home manager was working fine before the last few days as far as I can tell.

5

nixos-rebuild switch --show-trace |& grep 'while evaluating derivation'

1 Like
6

Thanks, that gave me this.

 nixos-rebuild switch --show-trace |& grep 'while evaluating derivation'
       … while evaluating derivation 'nixos-system-nixos-26.05.20260629.1f01958'
       … while evaluating derivation 'etc'
       … while evaluating derivation 'dbus-1'
       … while evaluating derivation 'system-path'
       … while evaluating derivation 'heroic-2.22.0'
       … while evaluating derivation 'heroic-2.22.0-bwrap'
       … while evaluating derivation 'heroic-2.22.0-fhsenv-rootfs'
       … while evaluating derivation 'heroic-unwrapped-2.22.0'

So the issue is with Heroic’s use of pnpm then. Looks like the maintainers have already changed versions and it’s pending. Thanks for the help.