Thank you for your work! :-)

It's a little bit unfortunate that the upstream repos don't work with tags for the releases. That way it's not only slightly more effort for us to keep nixpkgs up to date, but also from a security perspective it's less clear that these are the actual blessed releases (instead of someone's pull request or not even that -- as I understand it, anyone can add arbitrary commits to GitHub repos (but cannot change what the "master" or "main" tag refers to)).

If you have the resources, filing upstream issues for this lack of tags might be worthwhile.

it's a little bit unfortunate that the upstream repos don't work with tags for the releases.

most vim plugins are rolling releases

It's a little bit unfortunate that the upstream repos don't work with tags for the releases.

That is a generally problem in the vim ecosystem and nothing nixpkgs can solve alone.

If you have the resources, filing upstream issues for this lack of tags might be worthwhile.

That would be about 687 vim plugins to create for. Plug does not even have support for git tags.

That way it's not only slightly more effort for us to keep nixpkgs up to date, but also from a security perspective it's less clear that these are the actual blessed releases

That is a general problem with GitHub. It might be worth it to look into ways to prevent those fetches completely in nixpkgs.

This is a semi-automatic executed nixpkgs-review which is checked by a human on a best effort basis and does not build all packages (e.g. lumo, tensorflow or pytorch).
If you have any questions or problems please reach out to SuperSandro2000 on IRC.

Result of nixpkgs-review pr 110390 run on x86_64-linux 1