openclaw: fix update script for insecure package (#500841)

pkgs/by-name/op/openclaw/package.nix

@@ -9,7 +9,6 @@
   nodejs_22,
   makeWrapper,
   versionCheckHook,
-  nix-update-script,
   rolldown,
   installShellFiles,
   version ? "2026.3.12",
@@ -100,7 +99,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
 
-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = ./update.sh;
 
   meta = {
     description = "Self-hosted, open-source AI assistant/agent";

pkgs/by-name/op/openclaw/update.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -I nixpkgs=./. -i bash -p nix-update
+#shellcheck shell=bash
+
+set -euo pipefail
+
+export NIXPKGS_ALLOW_INSECURE=1 # package has knownVulnerabilities
+nix-update "$UPDATE_NIX_ATTR_PATH"