The previous commit moved the CVE-2026-109618/109619 floor into a bare
`assert ... ; { ... }` above the module body. That breaks evaluation:
error: infinite recursion encountered
... while evaluating the module argument `pkgs` in
/nix/store/...-source/modules/php.nix
... noting that argument `pkgs` is not externally provided, so querying
`_module.args` instead, requiring `config`
A module-level assert is checked as soon as the module's attrset is forced
to WHNF, which the module system does while merging definitions (it is the
`checkUnmatched` branch in lib/modules.nix that was on the stack). At that
point `pkgs` is not an externally supplied argument — there are no
specialArgs here — so it resolves through `config._module.args.pkgs`
(lib/modules.nix:745), and that option lives in the same fixpoint that is
still being computed. Hence the loop. The old code never hit this because
`phpBase` was only forced from inside `options`/`config`, i.e. after the
fixpoint existed.
Move the check to `config.assertions`, which is evaluated inside the
fixpoint once `pkgs` is available. Behaviour is unchanged: a rolled-back
nixpkgs pin still fails the build with the floor message instead of
silently building a vulnerable PHP.
naturallaw777
9a4a4ee51a