From ed36775cf0ed9c3aa81a8b35541f51db9b0fcb13 Mon Sep 17 00:00:00 2001
From: emmatherock <emanuelxoda@gmail.com>
Date: Fri, 10 Jul 2026 23:29:34 -0300
Subject: [PATCH] fix: pin Flatpak to 1.16.6 to work around sandbox env leak
 bug

Flatpak >=1.18.0 leaks the NixOS host environment into the sandbox,
breaking glycin-svg icon loading (e.g. OpenDeck). Pin services.flatpak.package
to a nixpkgs-flatpak input locked to a revision with Flatpak 1.16.6, scoped
to the Flatpak service only, until flatpak/flatpak#6721 lands in nixpkgs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 flake.lock                   | 17 +++++++++++++++++
 flake.nix                    |  8 ++++++++
 modules/services/flatpak.nix |  8 ++++++++
 3 files changed, 33 insertions(+)

diff --git a/flake.lock b/flake.lock
index 0c5ddd4..234da5e 100644
--- a/flake.lock
+++ b/flake.lock
@@ -265,6 +265,22 @@
         "type": "github"
       }
     },
+    "nixpkgs-flatpak": {
+      "locked": {
+        "lastModified": 1781332575,
+        "narHash": "sha256-tyh5yzbIN2ftH+uilyTWR6WCMZQeh3m5iOowTLNodyk=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "51effaf9783e0226281ad10e95a4af6c8a145316",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "51effaf9783e0226281ad10e95a4af6c8a145316",
+        "type": "github"
+      }
+    },
     "nixpkgs_2": {
       "locked": {
         "lastModified": 1783475452,
@@ -347,6 +363,7 @@
         "nix-flatpak": "nix-flatpak",
         "nix-vscode-extensions": "nix-vscode-extensions",
         "nixpkgs": "nixpkgs_4",
+        "nixpkgs-flatpak": "nixpkgs-flatpak",
         "sidra": "sidra",
         "vscode-server": "vscode-server"
       }
diff --git a/flake.nix b/flake.nix
index db260c8..584be05 100644
--- a/flake.nix
+++ b/flake.nix
@@ -18,6 +18,14 @@
     vscode-server.url = "github:nix-community/nixos-vscode-server";
     llm-agents.url = "github:numtide/llm-agents.nix";
     nix-vscode-extensions.url = "github:nix-community/nix-vscode-extensions";
+
+    # TEMPORARY: pinned to the last nixpkgs revision known to ship Flatpak 1.16.6.
+    # Flatpak >=1.18.0 leaks the NixOS host environment into the sandbox and breaks
+    # glycin-svg icon loading (e.g. OpenDeck). Remove this input, the overlay-less
+    # services.flatpak.package override below, and this comment once
+    # https://github.com/flatpak/flatpak/issues/6721 is fixed upstream and merged
+    # into nixpkgs (see also flatpak/flatpak#6717, NixOS/nixpkgs#534376).
+    nixpkgs-flatpak.url = "github:NixOS/nixpkgs/51effaf9783e0226281ad10e95a4af6c8a145316";
   };
 
   outputs = { self, nixpkgs, apple-fonts, home-manager, sidra, vscode-server, nix-vscode-extensions, ... }@inputs: {
diff --git a/modules/services/flatpak.nix b/modules/services/flatpak.nix
index ebfc654..f72533a 100644
--- a/modules/services/flatpak.nix
+++ b/modules/services/flatpak.nix
@@ -1,7 +1,15 @@
+{ inputs, pkgs, ... }:
+
 {
   services.flatpak = {
     enable = true;
 
+    # TEMPORARY: pin Flatpak itself to 1.16.6 via nixpkgs-flatpak (see flake.nix).
+    # Flatpak >=1.18.0 leaks the NixOS host environment into the sandbox and breaks
+    # glycin-svg icon loading (e.g. OpenDeck). Remove once
+    # https://github.com/flatpak/flatpak/issues/6721 lands in nixpkgs.
+    package = inputs.nixpkgs-flatpak.legacyPackages.${pkgs.system}.flatpak;
+
     remotes = [
       {
         name = "flathub";