Improve schema, only update direct inputs

lib/modules/manager/nix/extract.ts

@@ -24,11 +24,6 @@ export function extractPackageFile(
 
   const flakeLock = flakeLockParsed.data;
 
-  if (flakeLock.version !== 7) {
-    logger.debug({ packageFile }, 'Unsupported flake lock version');
-    return null;
-  }
-
   for (const depName of Object.keys(flakeLock.nodes ?? {})) {
     // the root input is a magic string for the entrypoint and only references other flake inputs
     if (depName === 'root') {
@@ -40,6 +35,11 @@ export function extractPackageFile(
       continue;
     }
 
+    // skip all locked nodes which are not in the flake.nix and cannot be updated
+    if (!(depName in (flakeLock.nodes['root'].inputs ?? []))) {
+      continue;
+    }
+
     const flakeInput = flakeLock.nodes[depName];
     const flakeLocked = flakeInput.locked;
     const flakeOriginal = flakeInput.original;
@@ -52,7 +52,7 @@ export function extractPackageFile(
       continue;
     }
 
-    // indirect inputs cannot be updated via normal means
+    // indirect inputs cannot be reliable updated because they depend on the flake registry
     if (flakeOriginal.type === 'indirect') {
       continue;
     }

lib/modules/manager/nix/schema.ts

@@ -32,16 +32,16 @@ export const OriginalInput = z.object({
 });
 
 export const NixInput = z.object({
-  inputs: z.record(z.string(), z.string()).optional(),
+  inputs: z.record(z.string(), z.string().or(z.array(z.string()))).optional(),
   locked: LockedInput.optional(),
   original: OriginalInput.optional(),
 });
 
 export const NixFlakeLock = Json.pipe(
   z.object({
     nodes: z.record(z.string(), NixInput).optional(),
-    root: z.string(),
-    version: z.number(),
+    root: z.literal('root').optional(),
+    version: z.literal(7),
   }),
 );