Release NixOS 26.05

(cherry picked from commit d9affaa686)

.github/ISSUE_TEMPLATE.md

@@ -0,0 +1,6 @@
+<!--
+    Please note: This blank issue template is meant for extraordinary issues
+    that do not fit the templates. Unless you know your issue is relevant to
+    Nixpkgs and requires the free-form blank issue, please use the issue
+    templates instead.
+-->

.github/ISSUE_TEMPLATE/01_bug_report.yml

@@ -35,8 +35,8 @@ body:
         If you are using an older version, please update to the latest stable version and check if the issue persists before continuing this bug report.
       options:
         - "Please select a version."
-        - "- Unstable (26.11)"
-        - "- Stable (26.05)"
+        - "- Unstable (26.05)"
+        - "- Stable (25.11)"
       default: 0
     validations:
       required: true

.github/ISSUE_TEMPLATE/02_bug_report_darwin.yml

@@ -35,8 +35,8 @@ body:
         If you are using an older version, please update to the latest stable version and check if the issue persists before continuing this bug report.
       options:
         - "Please select a version."
-        - "- Unstable (26.11)"
-        - "- Stable (26.05)"
+        - "- Unstable (26.05)"
+        - "- Stable (25.11)"
       default: 0
     validations:
       required: true
@@ -99,7 +99,7 @@ body:
     attributes:
       label: "Are you using nix-darwin?"
       description: |
-        [`nix-darwin`](https://github.com/nix-darwin/nix-darwin) is a set of NixOS-like modules for macOS systems. Depending on your issue, this information may be relevant.
+        [`nix-darwin`](https://github.com/LnL7/nix-darwin) is a set of NixOS-like modules for macOS systems. Depending on your issue, this information may be relevant.
       options:
         - "Yes, I am using nix-darwin."
         - "No, I am not using nix-darwin."

.github/ISSUE_TEMPLATE/03_bug_report_nixos.yml

@@ -35,8 +35,8 @@ body:
         If you are using an older version, please update to the latest stable version and check if the issue persists before continuing this bug report.
       options:
         - "Please select a version."
-        - "- Unstable (26.11)"
-        - "- Stable (26.05)"
+        - "- Unstable (26.05)"
+        - "- Stable (25.11)"
       default: 0
     validations:
       required: true

.github/ISSUE_TEMPLATE/04_build_failure.yml

@@ -37,8 +37,8 @@ body:
         If you are purposefully trying to build an ancient version of a package in an older Nixpkgs, please coordinate with the [NixOS Archivists](https://matrix.to/#/#archivists:nixos.org).
       options:
         - "Please select a version."
-        - "- Unstable (26.11)"
-        - "- Stable (26.05)"
+        - "- Unstable (26.05)"
+        - "- Stable (25.11)"
       default: 0
     validations:
       required: true
@@ -56,12 +56,12 @@ body:
       description: |
         Can [Hydra](https://hydra.nixos.org), Nixpkgs' Continuous Integration system, reproduce this build failure?
         Please use the search function in the header bar to locate the last build job for the package in question.
-        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/subprojects/hydra/root/static/images/emojione-red-x-274c.svg" width="20px" align="top" alt="Red X"> icon near the package entry, say '**Yes, Hydra can reproduce this build failure.**'
-        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/subprojects/hydra/root/static/images/emojione-gray-x-2716.svg" width="20px" align="top" alt="Dark Gray X"> icon near the package entry, then the build failure occurs with another package, and you need to track the original failing package by going down the chain of 'Cached failures' until you reach the final package in the failing dependency chain. Once you locate the failing package, re-write this report against that package and say '**Yes, Hydra can reproduce this build failure.**'
-        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/subprojects/hydra/root/static/images/emojione-check-2714.svg" width="20px" align="top" alt="Green Check Mark"> icon near the package entry, then it most likely means it's a local issue with your system. (Maybe you ran out of space?)
+        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/src/root/static/images/emojione-red-x-274c.svg" width="20px" align="top" alt="Red X"> icon near the package entry, say '**Yes, Hydra can reproduce this build failure.**'
+        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/src/root/static/images/emojione-gray-x-2716.svg" width="20px" align="top" alt="Dark Gray X"> icon near the package entry, then the build failure occurs with another package, and you need to track the original failing package by going down the chain of 'Cached failures' until you reach the final package in the failing dependency chain. Once you locate the failing package, re-write this report against that package and say '**Yes, Hydra can reproduce this build failure.**'
+        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/src/root/static/images/emojione-check-2714.svg" width="20px" align="top" alt="Green Check Mark"> icon near the package entry, then it most likely means it's a local issue with your system. (Maybe you ran out of space?)
           You can still open a build failure report, but please say '**No, Hydra cannot reproduce this build failure.**' below.
-        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/subprojects/hydra/root/static/images/emojione-question-2754.svg" width="20px" align="top" alt="Gray Question Mark"> icon near the package entry, say '**Hydra is currently rebuilding this package.**'
-        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/subprojects/hydra/root/static/images/emojione-stopsign-1f6d1.svg" width="20px" align="top" alt="Red Stop Sign"> icon near the package entry, then the build job was stopped manually. If this occurs, please coordinate with the [Infrastructure Team](https://matrix.to/#/#infra:nixos.org), and say '**The last build job was manually cancelled.**'
+        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/src/root/static/images/emojione-question-2754.svg" width="20px" align="top" alt="Gray Question Mark"> icon near the package entry, say '**Hydra is currently rebuilding this package.**'
+        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/src/root/static/images/emojione-stopsign-1f6d1.svg" width="20px" align="top" alt="Red Stop Sign"> icon near the package entry, then the build job was stopped manually. If this occurs, please coordinate with the [Infrastructure Team](https://matrix.to/#/#infra:nixos.org), and say '**The last build job was manually cancelled.**'
         - If Hydra isn't supposed to build the package at all, say '**Hydra doesn’t try to build the package.**'
       options:
         - "Please select the Hydra Status."

.github/ISSUE_TEMPLATE/05_update_request.yml

@@ -37,8 +37,8 @@ body:
         If the package has been updated in unstable, but you believe the update should be backported to the stable release of Nixpkgs, please file the '**Request: backport to stable**' form instead.
       options:
         - "Please select a version."
-        - "- Unstable (26.11)"
-        - "- Stable (26.05)"
+        - "- Unstable (26.05)"
+        - "- Stable (25.11)"
       default: 0
     validations:
       required: true

.github/ISSUE_TEMPLATE/06_module_request.yml

@@ -35,8 +35,8 @@ body:
         If you are using an older or stable version, please update to the latest **unstable** version and check if the module still does not exist before continuing this request.
       options:
         - "Please select a version."
-        - "- Unstable (26.11)"
-        - "- Stable (26.05)"
+        - "- Unstable (26.05)"
+        - "- Stable (25.11)"
       default: 0
     validations:
       required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -13,6 +13,7 @@ For new packages please briefly describe the package or provide a link to its ho
 - Built on platform:
   - [ ] x86_64-linux
   - [ ] aarch64-linux
+  - [ ] x86_64-darwin
   - [ ] aarch64-darwin
 - Tested, as applicable:
   - [ ] [NixOS tests] in [nixos/tests].

.github/actions/checkout/action.yml

@@ -19,7 +19,6 @@ runs:
         TARGET_SHA: ${{ inputs.target-as-trusted-at }}
         PIN_BUMP_SHA: ${{ inputs.untrusted-pin-bump }}
       with:
-        retries: 3
         script: |
           const { rm, writeFile } = require('node:fs/promises')
           const { spawn } = require('node:child_process')

.github/labeler-no-sync.yml

@@ -22,6 +22,17 @@
               - doc/**/*
               - nixos/doc/**/*
 
+"backport release-25.11":
+  - all:
+      - changed-files:
+          - any-glob-to-any-file:
+              - .github/actions/**/*
+              - .github/workflows/*
+              - .github/labeler*.yml
+              - ci/**/*.*
+              - maintainers/github-teams.json
+      - base-branch: ['master']
+
 "backport release-26.05":
   - all:
       - changed-files:

.github/workflows/backport.yml

@@ -36,7 +36,7 @@ jobs:
           permission-pull-requests: write
           permission-workflows: write
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           token: ${{ steps.app-token.outputs.token }}
@@ -49,7 +49,7 @@ jobs:
 
       - name: Create backport PRs
         id: backport
-        uses: korthout/backport-action@2e830a1d0b8269505846ddd407a70876913ad1f8 # v4.6.0
+        uses: korthout/backport-action@66065406958f46e82238fd59546f5a99e69e22aa # v4.5.2
         with:
           # Config README: https://github.com/korthout/backport-action#backport-action
           add_author_as_reviewer: true

.github/workflows/bot.yml

@@ -41,16 +41,19 @@ jobs:
   run:
     runs-on: ubuntu-slim
     if: github.event_name != 'schedule' || github.repository_owner == 'NixOS'
+    env:
+      # TODO: Remove after 2026-03-04, when Node 24 becomes the default.
+      # https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           sparse-checkout: |
             ci/github-script
 
       - name: Install dependencies
-        run: npm ci --package-lock-only=false @actions/artifact bottleneck
-        working-directory: ci/github-script
+        run: npm install @actions/artifact@6.2.1 bottleneck@2.19.5
 
       # Use a GitHub App, because it has much higher rate limits: 12,500 instead of 5,000 req / hour.
       - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
@@ -88,7 +91,7 @@ jobs:
           GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
         run: gh api /rate_limit | jq
 
-      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
+      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
         name: Labels from touched files
         if: |
           github.event_name == 'pull_request_target' &&
@@ -98,7 +101,7 @@ jobs:
           configuration-path: .github/labeler.yml # default
           sync-labels: true
 
-      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
+      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
         name: Labels from touched files (no sync)
         if: |
           github.event_name == 'pull_request_target' &&
@@ -108,7 +111,7 @@ jobs:
           configuration-path: .github/labeler-no-sync.yml
           sync-labels: false
 
-      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
+      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
         name: Labels from touched files (development branches)
         # Development branches like staging-next, haskell-updates and python-updates get special labels.
         # This is to avoid the mass of labels there, which is mostly useless - and really annoying for

.github/workflows/build.yml

@@ -34,22 +34,25 @@ jobs:
       matrix:
         include:
           - runner: ubuntu-24.04
-            system: x86_64-linux
+            name: x86_64-linux
+            systems: x86_64-linux
             builds: [shell, manual-nixos, lib-tests, tarball]
             desc: shell, docs, lib, tarball
           - runner: ubuntu-24.04-arm
-            system: aarch64-linux
+            name: aarch64-linux
+            systems: aarch64-linux
             builds: [shell, manual-nixos, manual-nixpkgs]
             desc: shell, docs
           - runner: macos-14
-            system: aarch64-darwin
+            name: darwin
+            systems: aarch64-darwin x86_64-darwin
             builds: [shell]
             desc: shell
-    name: '${{ matrix.system }}: ${{ matrix.desc }}'
+    name: '${{ matrix.name }}: ${{ matrix.desc }}'
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -59,7 +62,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+      - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
         with:
           # Sandbox is disabled on MacOS by default.
           extra_nix_config: sandbox = true
@@ -77,9 +80,7 @@ jobs:
 
       - name: Build shell
         if: contains(matrix.builds, 'shell')
-        env:
-          system: ${{ matrix.system }}
-        run: nix-build-uncached nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A shell --argstr system "$system"
+        run: echo "${{ matrix.systems }}" | xargs -n1 nix-build-uncached nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A shell --argstr system
 
       - name: Build NixOS manual
         if: |
@@ -107,5 +108,5 @@ jobs:
           contains(fromJSON(inputs.baseBranch).type, 'primary')
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: ${{ inputs.artifact-prefix }}nixos-manual-${{ matrix.system }}
+          name: ${{ inputs.artifact-prefix }}nixos-manual-${{ matrix.name }}
           path: nixos-manual

.github/workflows/check.yml

@@ -43,7 +43,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 3
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           path: trusted
@@ -51,8 +51,7 @@ jobs:
             ci/github-script
 
       - name: Install dependencies
-        run: npm ci --package-lock-only=false bottleneck
-        working-directory: trusted/ci/github-script
+        run: npm install bottleneck@2.19.5
 
       - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         if: github.event_name != 'pull_request' && vars.NIXPKGS_COMMIT_CHECK_CLIENT_ID
@@ -93,10 +92,10 @@ jobs:
     if: inputs.baseBranch && inputs.headBranch
     permissions:
       pull-requests: write
-    runs-on: ubuntu-24.04-arm
-    timeout-minutes: 8
+    runs-on: ubuntu-slim
+    timeout-minutes: 3
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           path: trusted
@@ -138,7 +137,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -148,7 +147,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+      - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true

.github/workflows/comment.yml

@@ -23,7 +23,7 @@ jobs:
     timeout-minutes: 2
     if: contains(github.event.comment.body, '@NixOS/nixpkgs-merge-bot merge')
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/eval.yml

@@ -15,9 +15,6 @@ on:
       targetSha:
         required: true
         type: string
-      baseBranch:
-        required: true
-        type: string
       systems:
         required: true
         type: string
@@ -50,7 +47,7 @@ jobs:
       ciPinBumpCommit: ${{ steps.find-pinned-commit.outputs.ciPinBumpCommit }}
       ciPinBumpCommitShort: ${{ steps.find-pinned-commit.outputs.ciPinBumpCommitShort }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           path: trusted
@@ -58,7 +55,7 @@ jobs:
             ci/supportedVersions.nix
 
       - name: Check out the PR at the test merge commit
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           ref: ${{ inputs.mergedSha }}
@@ -139,7 +136,7 @@ jobs:
             core.info(`Found pinned.json commit: ${ciPinBumpCommit}`)
 
       - name: Install Nix
-        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+        uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
 
       - name: Load supported versions
         id: versions
@@ -174,7 +171,7 @@ jobs:
           sudo mkswap /swap
           sudo swapon /swap
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -187,7 +184,7 @@ jobs:
           target-as-trusted-at: ${{ inputs.targetSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+        uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true
@@ -259,7 +256,7 @@ jobs:
       statuses: write # creating 'Eval Summary' commit statuses
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -277,7 +274,7 @@ jobs:
           merge-multiple: true
 
       - name: Install Nix
-        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+        uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
 
       - name: Combine all output paths and eval stats
         run: |
@@ -294,7 +291,6 @@ jobs:
       - name: Compare against the target branch
         env:
           TARGET_SHA: ${{ inputs.mergedSha }}
-          BASE_BRANCH: ${{ fromJSON(inputs.baseBranch).branch }}
         run: |
           git -C nixpkgs/trusted diff --name-only "$TARGET_SHA" \
             | jq --raw-input --slurp 'split("\n")[:-1]' > touched-files.json
@@ -303,7 +299,6 @@ jobs:
           nix-build nixpkgs/trusted/ci --arg nixpkgs ./nixpkgs/trusted-pinned -A eval.compare \
             --arg combinedDir ./combined \
             --arg touchedFilesJson ./touched-files.json \
-            --argstr baseBranch "$BASE_BRANCH" \
             --out-link comparison
 
           cat comparison/step-summary.md >> "$GITHUB_STEP_SUMMARY"
@@ -476,7 +471,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -486,7 +481,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+        uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
 
       - name: Ensure flake outputs on all systems still evaluate
         run: nix flake check --all-systems --no-build './nixpkgs/untrusted?shallow=1'

.github/workflows/lint.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -35,7 +35,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+      - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
 
       # TODO: Figure out how to best enable caching for the treefmt job. Cachix won't work well,
       # because the cache would be invalidated on every commit - treefmt checks every file.
@@ -61,7 +61,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -70,7 +70,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+      - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true
@@ -90,7 +90,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -100,7 +100,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+      - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true
@@ -131,10 +131,10 @@ jobs:
     # Luckily there's no need to lint commit messages in the Merge Queue, because
     # changes to the target branch can't change commit messages on the base branch.
     if: ${{ github.event.pull_request.number }}
-    runs-on: ubuntu-24.04-arm
-    timeout-minutes: 8
+    runs-on: ubuntu-slim
+    timeout-minutes: 5
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: true # Needed to run git fetch for large PRs.
           path: trusted

.github/workflows/merge-group.yml

@@ -25,7 +25,7 @@ jobs:
       targetSha: ${{ steps.prepare.outputs.targetSha }}
       systems: ${{ steps.prepare.outputs.systems }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           sparse-checkout: |
@@ -97,7 +97,6 @@ jobs:
       artifact-prefix: ${{ inputs.artifact-prefix }}
       mergedSha: ${{ needs.prepare.outputs.mergedSha }}
       targetSha: ${{ needs.prepare.outputs.targetSha }}
-      baseBranch: ${{ needs.prepare.outputs.baseBranch }}
       systems: ${{ needs.prepare.outputs.systems }}
 
   build:

.github/workflows/periodic-merge-24h.yml

@@ -31,6 +31,12 @@ jobs:
       max-parallel: 1
       matrix:
         pairs:
+          - from: release-25.11
+            into: staging-next-25.11
+          - from: staging-next-25.11
+            into: staging-25.11
+          - from: release-25.11
+            into: staging-nixos-25.11
           - from: release-26.05
             into: staging-next-26.05
           - from: staging-next-26.05

.github/workflows/periodic-merge.yml

@@ -34,7 +34,7 @@ jobs:
           permission-contents: write
           permission-pull-requests: write
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 

.github/workflows/pull-request-target.yml

@@ -36,7 +36,7 @@ jobs:
       systems: ${{ steps.prepare.outputs.systems }}
       touched: ${{ steps.prepare.outputs.touched }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           sparse-checkout-cone-mode: true # default, for clarity
@@ -110,7 +110,6 @@ jobs:
       mergedSha: ${{ needs.prepare.outputs.mergedSha }}
       headSha: ${{ github.event.pull_request.head.sha }}
       targetSha: ${{ needs.prepare.outputs.targetSha }}
-      baseBranch: ${{ needs.prepare.outputs.baseBranch }}
       systems: ${{ needs.prepare.outputs.systems }}
       testVersions: ${{ contains(fromJSON(needs.prepare.outputs.touched), 'pinned') && !contains(fromJSON(needs.prepare.outputs.headBranch).type, 'development') }}
 

.github/workflows/review.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 2
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/teams.yml

@@ -2,7 +2,7 @@ name: Teams
 
 on:
   schedule:
-    # Every Monday at 19:42 (randomly chosen)
+    # Every Tuesday at 19:42 (randomly chosen)
     - cron: '42 19 * * 1'
   workflow_dispatch:
 
@@ -30,7 +30,7 @@ jobs:
           permission-pull-requests: write
 
       - name: Fetch source
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           sparse-checkout: |
@@ -38,8 +38,7 @@ jobs:
             maintainers/github-teams.json
 
       - name: Install dependencies
-        run: npm ci --package-lock-only=false bottleneck
-        working-directory: ci/github-script
+        run: npm install bottleneck@2.19.5
 
       - name: Synchronise teams
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

.github/workflows/test.yml

@@ -19,7 +19,7 @@ jobs:
       push: ${{ steps.files.outputs.push }}
       targetSha: ${{ steps.prepare.outputs.targetSha }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           sparse-checkout-cone-mode: true # default, for clarity
@@ -64,7 +64,6 @@ jobs:
               'ci/github-script/supportedSystems.js',
               'ci/pinned.json',
               'ci/supportedBranches.js',
-              'pkgs/top-level/release-supported-systems.json',
             ].includes(file))) core.setOutput('merge-group', true)
 
             if (files.some(file => [
@@ -89,7 +88,6 @@ jobs:
               'ci/github-script/withRateLimit.js',
               'ci/pinned.json',
               'ci/supportedBranches.js',
-              'pkgs/top-level/release-supported-systems.json',
             ].includes(file))) core.setOutput('pr', true)
 
   merge-group:

.gitignore

@@ -27,9 +27,6 @@ tags
 .mypy_cache
 __pycache__
 
-/AGENTS.md
-/CLAUDE.md
-
 /pkgs/development/libraries/qt-5/*/tmp/
 /pkgs/desktops/kde-5/*/tmp/
 /pkgs/development/mobile/androidenv/xml/*

.mailmap

@@ -17,7 +17,6 @@ jopejoe1 <nixpkgs@missing.ninja> <34899572+jopejoe1@users.noreply.github.com>
 jopejoe1 <nixpkgs@missing.ninja> <jopejoe1@missing.ninja>
 jopejoe1 <nixpkgs@missing.ninja> <jopejoe1>
 Jörg Thalheim <joerg@thalheim.io> <Mic92@users.noreply.github.com>
-Katalin Rebhan <me@dblsaiko.net>
 Lin Jian <me@linj.tech> <linj.dev@outlook.com>
 Lin Jian <me@linj.tech> <75130626+jian-lin@users.noreply.github.com>
 Martin Weinelt <hexa@darmstadt.ccc.de> <mweinelt@users.noreply.github.com>

README.md

@@ -1,9 +1,9 @@
 <p align="center">
   <a href="https://nixos.org">
     <picture>
-      <source media="(prefers-color-scheme: light)" srcset="https://brand.nixos.org/logos/nixos-logo-rainbow-gradient-black-regular-horizontal-minimal.svg">
-      <source media="(prefers-color-scheme: dark)" srcset="https://brand.nixos.org/logos/nixos-logo-rainbow-gradient-white-regular-horizontal-minimal.svg">
-      <img src="https://brand.nixos.org/logos/nixos-logo-rainbow-gradient-black-regular-horizontal-minimal.svg" width="500px" alt="NixOS logo">
+      <source media="(prefers-color-scheme: light)" srcset="https://brand.nixos.org/logos/nixos-logo-default-gradient-black-regular-horizontal-minimal.svg">
+      <source media="(prefers-color-scheme: dark)" srcset="https://brand.nixos.org/logos/nixos-logo-default-gradient-white-regular-horizontal-minimal.svg">
+      <img src="https://brand.nixos.org/logos/nixos-logo-default-gradient-black-regular-horizontal-minimal.svg" width="500px" alt="NixOS logo">
     </picture>
   </a>
 </p>
@@ -13,7 +13,7 @@
   <a href="https://opencollective.com/nixos"><img src="https://opencollective.com/nixos/tiers/supporter/badge.svg?label=supporters&color=brightgreen" alt="Open Collective supporters" /></a>
 </p>
 
-[Nixpkgs](https://github.com/nixos/nixpkgs) is a collection of over 140,000 software packages that can be installed with the [Nix](https://nixos.org/nix/) package manager.
+[Nixpkgs](https://github.com/nixos/nixpkgs) is a collection of over 120,000 software packages that can be installed with the [Nix](https://nixos.org/nix/) package manager.
 It also implements [NixOS](https://nixos.org/nixos/), a purely-functional Linux distribution.
 
 # Manuals
@@ -47,9 +47,9 @@ Here are some of the main ones:
 Nixpkgs and NixOS are built and tested by our continuous integration system, [Hydra](https://hydra.nixos.org/).
 
 * [Continuous package builds for unstable/master](https://hydra.nixos.org/jobset/nixos/trunk-combined)
-* [Continuous package builds for the NixOS 26.05 release](https://hydra.nixos.org/jobset/nixos/release-26.05)
+* [Continuous package builds for the NixOS 25.11 release](https://hydra.nixos.org/jobset/nixos/release-25.11)
 * [Tests for unstable/master](https://hydra.nixos.org/job/nixos/trunk-combined/tested#tabs-constituents)
-* [Tests for the NixOS 26.05 release](https://hydra.nixos.org/job/nixos/release-26.05/tested#tabs-constituents)
+* [Tests for the NixOS 25.11 release](https://hydra.nixos.org/job/nixos/release-25.11/tested#tabs-constituents)
 
 Artifacts successfully built with Hydra are published to cache at https://cache.nixos.org/.
 When successful build and test criteria are met, the Nixpkgs expressions are distributed via [Nix channels](https://nix.dev/manual/nix/stable/command-ref/nix-channel.html).

ci/OWNERS

@@ -25,27 +25,26 @@
 /shell.nix @infinisil @NixOS/Security
 
 # Libraries
-/lib                        @infinisil @hsjobeki @llakala
-/lib/generators.nix         @infinisil @hsjobeki @llakala
-/lib/cli.nix                @infinisil @hsjobeki @llakala
-/lib/debug.nix              @infinisil @hsjobeki @llakala
-/lib/asserts.nix            @infinisil @hsjobeki @llakala
-/lib/path/*                 @infinisil @hsjobeki @llakala
-/lib/fileset                @infinisil @hsjobeki @llakala
-/maintainers/github-teams.json @infinisil @llakala
-/maintainers/computed-team-list.nix @infinisil @llakala
+/lib                        @infinisil @hsjobeki
+/lib/generators.nix         @infinisil @hsjobeki
+/lib/cli.nix                @infinisil @hsjobeki
+/lib/debug.nix              @infinisil @hsjobeki
+/lib/asserts.nix            @infinisil @hsjobeki
+/lib/path/*                 @infinisil @hsjobeki
+/lib/fileset                @infinisil @hsjobeki
+/maintainers/github-teams.json @infinisil
+/maintainers/computed-team-list.nix @infinisil
 ## Standard environment–related libraries
-/lib/customisation.nix      @alyssais @NixOS/stdenv @llakala
-/lib/derivations.nix        @NixOS/stdenv @llakala
-/lib/fetchers.nix           @alyssais @NixOS/stdenv @llakala
-/lib/meta.nix               @alyssais @NixOS/stdenv @llakala
-/lib/meta-types.nix         @infinisil @adisbladis @NixOS/stdenv @llakala
-/lib/source-types.nix       @alyssais @NixOS/stdenv @llakala
+/lib/customisation.nix      @alyssais @NixOS/stdenv
+/lib/derivations.nix        @NixOS/stdenv
+/lib/fetchers.nix           @alyssais @NixOS/stdenv
+/lib/meta.nix               @alyssais @NixOS/stdenv
+/lib/source-types.nix       @alyssais @NixOS/stdenv
 /lib/systems                @alyssais @NixOS/stdenv
 ## Libraries / Module system
-/lib/modules.nix            @infinisil @roberth @hsjobeki @llakala
-/lib/types.nix              @infinisil @roberth @hsjobeki @llakala
-/lib/options.nix            @infinisil @roberth @hsjobeki @llakala
+/lib/modules.nix            @infinisil @roberth @hsjobeki
+/lib/types.nix              @infinisil @roberth @hsjobeki
+/lib/options.nix            @infinisil @roberth @hsjobeki
 /lib/tests/modules.sh       @infinisil @roberth @hsjobeki
 /lib/tests/modules          @infinisil @roberth @hsjobeki
 
@@ -57,31 +56,31 @@
 /pkgs/top-level/splice.nix                       @Ericson2314
 /pkgs/top-level/release-cross.nix                @Ericson2314
 /pkgs/top-level/by-name-overlay.nix              @infinisil @philiptaron
-/pkgs/top-level/config.nix                       @jopejoe1
-/pkgs/top-level/make-tarball.nix                 @jopejoe1
-/pkgs/top-level/packages-config.nix              @jopejoe1
-/pkgs/top-level/packages-info.nix                @jopejoe1
-/pkgs/top-level/release-lib.nix                  @jopejoe1
-/pkgs/top-level/release.nix                      @jopejoe1
-/pkgs/stdenv                                     @philiptaron @NixOS/stdenv @llakala
-/pkgs/stdenv/generic                             @Ericson2314 @NixOS/stdenv @llakala
-/pkgs/stdenv/generic/problems.nix                @infinisil @llakala
+/pkgs/stdenv                                     @philiptaron @NixOS/stdenv
+/pkgs/stdenv/generic                             @Ericson2314 @NixOS/stdenv
+/pkgs/stdenv/generic/problems.nix                @infinisil
 /pkgs/test/problems                              @infinisil
-/pkgs/stdenv/generic/check-meta.nix              @infinisil @Ericson2314 @adisbladis @NixOS/stdenv @llakala
+/pkgs/stdenv/generic/check-meta.nix              @infinisil @Ericson2314 @adisbladis @NixOS/stdenv
+/pkgs/stdenv/generic/meta-types.nix              @infinisil @adisbladis @NixOS/stdenv
 /pkgs/stdenv/cross                               @Ericson2314 @NixOS/stdenv
 /pkgs/build-support                              @philiptaron
 /pkgs/build-support/cc-wrapper                   @Ericson2314
 /pkgs/build-support/bintools-wrapper             @Ericson2314
 /pkgs/build-support/setup-hooks                  @Ericson2314
 /pkgs/build-support/setup-hooks/arrayUtilities   @ConnorBaker
+/pkgs/build-support/setup-hooks/auto-patchelf.sh @layus
+/pkgs/by-name/au/auto-patchelf                   @layus
 
 ## Format generators/serializers
 /pkgs/pkgs-lib                                   @Stunkymonkey @h7x4
-/pkgs/pkgs-lib/formats/json2x                    @Stunkymonkey @h7x4 @figsoda
 
 # Nixpkgs build-support
 /pkgs/build-support/writers @lassulus
 
+# Nixpkgs make-disk-image
+/doc/build-helpers/images/makediskimage.section.md  @raitobezarius
+/nixos/lib/make-disk-image.nix                 @raitobezarius
+
 # Nix, the package manager
 # @raitobezarius is not "code owner", but is listed here to be notified of changes
 # pertaining to the Nix package manager.
@@ -95,16 +94,16 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @Artturin @Ericson2314 @lo
 /maintainers/scripts/doc @jtojnar @ryantm
 
 # Contributor documentation
-/CONTRIBUTING.md
-/.github/PULL_REQUEST_TEMPLATE.md
-/doc/contributing/
-/doc/contributing/contributing-to-documentation.chapter.md @jtojnar
-/lib/README.md
-/doc/README.md
-/nixos/README.md
-/pkgs/README.md
-/pkgs/by-name/README.md
-/maintainers/README.md
+/CONTRIBUTING.md @infinisil
+/.github/PULL_REQUEST_TEMPLATE.md @infinisil
+/doc/contributing/ @infinisil
+/doc/contributing/contributing-to-documentation.chapter.md @jtojnar @infinisil
+/lib/README.md @infinisil
+/doc/README.md @infinisil
+/nixos/README.md @infinisil
+/pkgs/README.md @infinisil
+/pkgs/by-name/README.md @infinisil
+/maintainers/README.md @infinisil
 
 # User-facing development documentation
 /doc/development.md @infinisil
@@ -123,6 +122,9 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @Artturin @Ericson2314 @lo
 /doc/redirects.json                @GetPsyched
 /nixos/doc/manual/redirects.json   @GetPsyched
 
+# NixOS integration test driver
+/nixos/lib/test-driver  @tfc
+
 # NixOS QEMU virtualisation
 /nixos/modules/virtualisation/qemu-vm.nix                 @raitobezarius
 /nixos/modules/services/backup/libvirtd-autosnapshot.nix  @6543
@@ -182,10 +184,10 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @Artturin @Ericson2314 @lo
 /pkgs/by-name/an/android*                     @NixOS/android
 
 # Python-related code and docs
-/doc/languages-frameworks/python.section.md   @mweinelt
-/maintainers/scripts/update-python-libraries  @mweinelt
-/pkgs/by-name/up/update-python-libraries      @mweinelt
-/pkgs/development/interpreters/python         @mweinelt
+/doc/languages-frameworks/python.section.md   @mweinelt @natsukium
+/maintainers/scripts/update-python-libraries  @mweinelt @natsukium
+/pkgs/by-name/up/update-python-libraries      @mweinelt @natsukium
+/pkgs/development/interpreters/python         @mweinelt @natsukium
 
 # CUDA
 /pkgs/top-level/cuda-packages.nix             @NixOS/cuda-maintainers
@@ -215,10 +217,10 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @Artturin @Ericson2314 @lo
 /pkgs/development/r-modules         @jbedo
 
 # Rust
-/pkgs/development/compilers/rust @NixOS/rust @alyssais
-/pkgs/build-support/rust @NixOS/rust
+/pkgs/development/compilers/rust @alyssais @Mic92 @winterqt
+/pkgs/build-support/rust @winterqt
 /pkgs/build-support/rust/fetch-cargo-vendor* @TomaSajt
-/doc/languages-frameworks/rust.section.md @NixOS/rust
+/doc/languages-frameworks/rust.section.md @winterqt
 
 # Tcl
 /pkgs/development/interpreters/tcl  @fgaz
@@ -230,10 +232,14 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @Artturin @Ericson2314 @lo
 # C compilers
 /pkgs/development/compilers/gcc
 /pkgs/development/compilers/llvm @NixOS/llvm
+/pkgs/development/compilers/emscripten @raitobezarius
 /doc/toolchains/llvm.chapter.md @NixOS/llvm
+/doc/languages-frameworks/emscripten.section.md @raitobezarius
 
 # Audio
+/nixos/modules/services/audio/botamusique.nix @mweinelt
 /nixos/modules/services/audio/snapserver.nix @mweinelt
+/nixos/tests/botamusique.nix @mweinelt
 /nixos/tests/snapcast.nix @mweinelt
 
 # Browsers
@@ -263,15 +269,15 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /lib/licenses @alyssais @emilazy @jopejoe1
 
 # Qt
-/pkgs/development/libraries/qt-5 @K900 @NickCao @SuperSandro2000
-/pkgs/development/libraries/qt-6 @K900 @NickCao @SuperSandro2000
+/pkgs/development/libraries/qt-5 @K900 @NickCao @SuperSandro2000 @ttuegel
+/pkgs/development/libraries/qt-6 @K900 @NickCao @SuperSandro2000 @ttuegel
 
 # KDE Frameworks 5
-/pkgs/development/libraries/kde-frameworks @K900 @NickCao @SuperSandro2000
+/pkgs/development/libraries/kde-frameworks @K900 @NickCao @SuperSandro2000 @ttuegel
 
 # KDE / Plasma 6
-/pkgs/kde @K900 @NickCao @SuperSandro2000
-/maintainers/scripts/kde @K900 @NickCao @SuperSandro2000
+/pkgs/kde @K900 @NickCao @SuperSandro2000 @ttuegel
+/maintainers/scripts/kde @K900 @NickCao @SuperSandro2000 @ttuegel
 
 # PostgreSQL and related stuff
 /pkgs/by-name/po/postgresqlTestHook @NixOS/postgres
@@ -322,9 +328,9 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /nixos/tests/knot.nix @mweinelt
 
 # Web servers
-/doc/packages/nginx.section.md @leona-ya @Ma27
-/pkgs/servers/http/nginx/ @helsinki-Jo @leona-ya @Ma27
-/nixos/modules/services/web-servers/nginx/ @leona-ya @Ma27
+/doc/packages/nginx.section.md @raitobezarius
+/pkgs/servers/http/nginx/ @raitobezarius
+/nixos/modules/services/web-servers/nginx/ @raitobezarius
 
 # D
 /pkgs/build-support/dlang @jtbx @TomaSajt
@@ -364,8 +370,7 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/development/lua-modules         @NixOS/lua
 
 # Neovim
-/pkgs/applications/editors/neovim           @NixOS/neovim
-/doc/languages-frameworks/neovim.section.md @NixOS/neovim
+/pkgs/applications/editors/neovim      @NixOS/neovim
 
 # VimPlugins
 /pkgs/applications/editors/vim/plugins         @NixOS/neovim
@@ -389,15 +394,18 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /nixos/tests/docker-tools*                       @roberth @jhol
 /doc/build-helpers/images/dockertools.section.md @roberth @jhol
 
+# Blockchains
+/pkgs/applications/blockchains  @mmahut @RaghavSood
+
 # Go
 /doc/languages-frameworks/go.section.md @kalbasit @katexochen @Mic92
 /pkgs/build-support/go @kalbasit @katexochen @Mic92
 /pkgs/development/compilers/go @kalbasit @katexochen @Mic92
 
 # GNOME
-/pkgs/desktops/gnome                              @NixOS/gnome
-/pkgs/desktops/gnome/extensions                   @NixOS/gnome
-/pkgs/build-support/make-hardcode-gsettings-patch @NixOS/gnome
+/pkgs/desktops/gnome                              @jtojnar
+/pkgs/desktops/gnome/extensions                   @jtojnar
+/pkgs/build-support/make-hardcode-gsettings-patch @jtojnar
 
 # Cinnamon
 /pkgs/by-name/ci/cinnamon-*    @mkg20001
@@ -429,7 +437,6 @@ nixos/tests/forgejo.nix               @adamcstephens @bendlas @christoph-heiss @
 /doc/languages-frameworks/javascript.section.md @winterqt
 /pkgs/development/tools/pnpm                    @Scrumplex @gepbird
 /pkgs/build-support/node/fetch-pnpm-deps        @Scrumplex @gepbird
-/pkgs/test/pnpm                                 @Scrumplex @gepbird
 
 # OCaml
 /pkgs/build-support/ocaml           @ulrikstrid
@@ -506,7 +513,7 @@ pkgs/by-name/oc/octodns/ @anthonyroussel
 pkgs/by-name/te/teleport*     @arianvp @justinas @sigma @tomberek @techknowlogick @JuliusFreudenberger
 
 # Warp-terminal
-pkgs/by-name/wa/warp-terminal/  @emilytrau @imadnyc @4evy @johnrtitor
+pkgs/by-name/wa/warp-terminal/  @emilytrau @imadnyc @FlameFlag @johnrtitor
 
 # Nim
 /doc/languages-frameworks/nim.section.md  @NixOS/nim
@@ -517,12 +524,3 @@ pkgs/by-name/wa/warp-terminal/  @emilytrau @imadnyc @4evy @johnrtitor
 # Radicle
 /pkgs/build-support/fetchradicle/      @NixOS/radicle
 /pkgs/build-support/fetchradiclepatch/ @NixOS/radicle
-
-# Zellij plugins
-/pkgs/by-name/ze/zellij/plugins/   @PerchunPak
-
-# Test-driver
-/nixos/lib/test-driver                                      @NixOS/test-driver
-/nixos/lib/testing                                          @NixOS/test-driver
-/nixos/tests/nixos-test-driver                              @NixOS/test-driver
-/nixos/modules/virtualisation/nspawn-container/run-nspawn   @NixOS/test-driver

ci/README.md

@@ -51,16 +51,6 @@ To ensure security and a focused utility, the bot adheres to specific limitation
   - opened by [@r-ryantm](https://nix-community.github.io/nixpkgs-update/r-ryantm/).
 - The user attempting to merge is a member of [@NixOS/nixpkgs-maintainers].
 - The user attempting to merge is a maintainer of all packages touched by the PR.
-- No [committer][@NixOS/nixpkgs-committers] has an outstanding "changes requested" review.
-  These block both the merge queue and auto-merge, so the bot refuses to merge until the review is addressed or dismissed.
-
-Once these constraints are met, the bot picks a merge strategy based on the `no PR failures` commit status:
-
-- CI passing: the PR is added to the merge queue.
-- CI unfinished (pending or missing status): the bot enables [Auto Merge], which queues the PR once required checks succeed.
-  Note that if CI later fails, nothing happens until it is fixed and passes.
-- CI already failing (`error`/`failure` status): the bot does not enable Auto Merge, because it would never trigger, and fixing CI requires a new push that invalidates the merge command.
-  A fresh `@NixOS/nixpkgs-merge-bot merge` comment is needed once CI is green again.
 
 ### Approving merge bot changes
 
@@ -114,4 +104,3 @@ This script can also be run locally to print basic test cases.
 [@NixOS/nixpkgs-ci]: https://github.com/orgs/NixOS/teams/nixpkgs-ci
 [@NixOS/nixpkgs-core]: https://github.com/orgs/NixOS/teams/nixpkgs-core
 [RFC 172]: https://github.com/NixOS/rfcs/pull/172
-[Auto Merge]: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/automatically-merging-a-pull-request

ci/default.nix

@@ -26,7 +26,132 @@ let
 
   fmt =
     let
-      treefmt = pkgs.treefmt.withConfig ./treefmt.nix;
+      treefmtNixSrc = fetchTarball {
+        inherit (pinned.treefmt-nix) url;
+        sha256 = pinned.treefmt-nix.hash;
+      };
+      treefmtEval = (import treefmtNixSrc).evalModule pkgs {
+        # Important: The auto-rebase script uses `git filter-branch --tree-filter`,
+        # which creates trees within the Git repository under `.git-rewrite/t`,
+        # notably without having a `.git` themselves.
+        # So if this projectRootFile were the default `.git/config`,
+        # having the auto-rebase script use treefmt on such a tree would make it
+        # format all files in the _parent_ Git tree as well.
+        projectRootFile = ".git-blame-ignore-revs";
+
+        # Be a bit more verbose by default, so we can see progress happening
+        settings.verbose = 1;
+
+        # By default it's info, which is too noisy since we have many unmatched files
+        settings.on-unmatched = "debug";
+
+        programs.actionlint.enable = true;
+
+        programs.biome = {
+          enable = true;
+          # Disable settings validation because its inputs are liable to hash mismatch
+          validate.enable = false;
+          settings.formatter = {
+            useEditorconfig = true;
+          };
+          settings.javascript.formatter = {
+            quoteStyle = "single";
+            semicolons = "asNeeded";
+          };
+          settings.json.formatter.enabled = false;
+        };
+        settings.formatter.biome.excludes = [
+          "*.min.js"
+          "pkgs/*"
+        ];
+
+        programs.keep-sorted.enable = true;
+
+        # This uses nixfmt underneath, the default formatter for Nix code.
+        # See https://github.com/NixOS/nixfmt
+        programs.nixfmt = {
+          enable = true;
+          package = pkgs.nixfmt;
+        };
+
+        programs.yamlfmt = {
+          enable = true;
+          settings.formatter = {
+            retain_line_breaks = true;
+          };
+        };
+        settings.formatter.yamlfmt.excludes = [
+          # Aligns comments with whitespace
+          "pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml"
+          # TODO: Fix formatting for auto-generated file
+          "pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml"
+        ];
+
+        programs.nixf-diagnose = {
+          enable = true;
+          ignore = [
+            # Rule names can currently be looked up here:
+            # https://github.com/nix-community/nixd/blob/main/libnixf/src/Basic/diagnostic.py
+            # TODO: Remove the following and fix things.
+            "sema-unused-def-lambda-noarg-formal"
+            "sema-unused-def-lambda-witharg-arg"
+            "sema-unused-def-lambda-witharg-formal"
+            "sema-unused-def-let"
+            # Keep this rule, because we have `lib.or`.
+            "or-identifier"
+            # TODO: remove after outstanding prelude diagnostics issues are fixed:
+            # https://github.com/nix-community/nixd/issues/761
+            # https://github.com/nix-community/nixd/issues/762
+            "sema-primop-removed-prefix"
+            "sema-primop-overridden"
+            "sema-constant-overridden"
+            "sema-primop-unknown"
+          ];
+        };
+        settings.formatter.nixf-diagnose = {
+          # Ensure nixfmt cleans up after nixf-diagnose.
+          priority = -1;
+          excludes = [
+            # Auto-generated; violates sema-extra-with
+            # Can only sensibly be removed when --auto-fix supports multiple fixes at once:
+            # https://github.com/inclyc/nixf-diagnose/issues/13
+            "pkgs/servers/home-assistant/component-packages.nix"
+            # https://github.com/nix-community/nixd/issues/708
+            "nixos/maintainers/scripts/azure-new/examples/basic/system.nix"
+          ];
+        };
+
+        settings.formatter.editorconfig-checker = {
+          command = "${pkgs.lib.getExe pkgs.editorconfig-checker}";
+          options = [
+            "-disable-indent-size"
+            # TODO: Remove this once this upstream issue is fixed:
+            #   https://github.com/editorconfig-checker/editorconfig-checker/issues/505
+            "-disable-charset"
+          ];
+          includes = [ "*" ];
+          priority = 1;
+        };
+
+        # TODO: Upstream this into treefmt-nix eventually:
+        #   https://github.com/numtide/treefmt-nix/issues/387
+        settings.formatter.markdown-code-runner = {
+          command = pkgs.lib.getExe pkgs.markdown-code-runner;
+          options =
+            let
+              config = pkgs.writers.writeTOML "markdown-code-runner-config" {
+                presets.nixfmt = {
+                  language = "nix";
+                  command = [ (pkgs.lib.getExe pkgs.nixfmt) ];
+                };
+              };
+            in
+            [ "--config=${config}" ];
+          includes = [ "*.md" ];
+        };
+
+        programs.zizmor.enable = true;
+      };
       fs = pkgs.lib.fileset;
       nixFilesSrc = fs.toSource {
         root = ../.;
@@ -34,24 +159,14 @@ let
       };
     in
     {
-      pkg = treefmt;
-      check = treefmt.check nixFilesSrc;
+      shell = treefmtEval.config.build.devShell;
+      pkg = treefmtEval.config.build.wrapper;
+      check = treefmtEval.config.build.check nixFilesSrc;
     };
 
-  # nixos-render-docs and nixos-render-docs-redirects
-  # Should be used from tree to build the matching in-tree documentation
-  docPkgs = pkgs.extend (
-    final: prev: {
-      nixos-render-docs = final.callPackage ../pkgs/by-name/ni/nixos-render-docs/package.nix { };
-      nixos-render-docs-redirects =
-        final.callPackage ../pkgs/by-name/ni/nixos-render-docs-redirects/package.nix
-          { };
-    }
-  );
-
 in
 rec {
-  inherit pkgs docPkgs fmt;
+  inherit pkgs fmt;
   codeownersValidator = pkgs.callPackage ./codeowners-validator { };
 
   # FIXME(lf-): it might be useful to test other Nix implementations
@@ -64,13 +179,13 @@ rec {
   # CI jobs
   lib-tests = import ../lib/tests/release.nix { inherit pkgs; };
   manual-nixos = (import ../nixos/release.nix { }).manual.${system} or null;
-  manual-nixpkgs = (import ../doc { pkgs = docPkgs; });
+  manual-nixpkgs = (import ../doc { inherit pkgs; });
   nixpkgs-vet = pkgs.callPackage ./nixpkgs-vet.nix {
     nix = pkgs.nixVersions.latest;
   };
   parse = pkgs.lib.recurseIntoAttrs {
     nix_latest = pkgs.callPackage ./parse.nix { nix = pkgs.nixVersions.latest; };
-    stable = pkgs.callPackage ./parse.nix { nix = pkgs.nixVersions.stable; };
+    nix_2_28 = pkgs.callPackage ./parse.nix { nix = pkgs.nixVersions.nix_2_28; };
     lix = pkgs.callPackage ./parse.nix { nix = pkgs.lix; };
     lix_latest = pkgs.callPackage ./parse.nix { nix = pkgs.lixPackageSets.latest.lix; };
   };

ci/eval/attrpaths.nix

@@ -0,0 +1,85 @@
+# This expression will, as efficiently as possible, dump a
+# *superset* of all attrpaths of derivations which might be
+# part of a release on *any* platform.
+#
+# This expression runs single-threaded under all current Nix
+# implementations, but much faster and with much less memory
+# used than ./outpaths.nix itself.
+#
+# Once you have the list of attrnames you can split it up into
+# $NUM_CORES batches and evaluate the outpaths separately for each
+# batch, in parallel.
+#
+# To dump the attrnames:
+#
+#   nix-instantiate --eval --strict --json ci/eval/attrpaths.nix -A names
+#
+{
+  lib ? import (path + "/lib"),
+  trace ? false,
+  path ? ./../..,
+  extraNixpkgsConfigJson ? "{}",
+}:
+let
+
+  # TODO: Use mapAttrsToListRecursiveCond when this PR lands:
+  # https://github.com/NixOS/nixpkgs/pull/395160
+  justAttrNames =
+    path: value:
+    let
+      result =
+        if path == [ "AAAAAASomeThingsFailToEvaluate" ] || !(lib.isAttrs value) then
+          [ ]
+        else if lib.isDerivation value then
+          [ path ]
+        else
+          lib.pipe value [
+            (lib.mapAttrsToList (
+              name: value:
+              lib.addErrorContext "while evaluating package set attribute path '${
+                lib.showAttrPath (path ++ [ name ])
+              }'" (justAttrNames (path ++ [ name ]) value)
+            ))
+            lib.concatLists
+          ];
+    in
+    lib.traceIf trace "** ${lib.showAttrPath path}" result;
+
+  outpaths = import ./outpaths.nix {
+    inherit path;
+    extraNixpkgsConfig = builtins.fromJSON extraNixpkgsConfigJson;
+    attrNamesOnly = true;
+  };
+
+  paths = [
+    # Some of the following are based on variants, which are disabled with `attrNamesOnly = true`.
+    # Until these have been removed from release.nix / hydra, we manually add them to the list.
+    [
+      "pkgsLLVM"
+      "stdenv"
+    ]
+    [
+      "pkgsArocc"
+      "stdenv"
+    ]
+    [
+      "pkgsZig"
+      "stdenv"
+    ]
+    [
+      "pkgsStatic"
+      "stdenv"
+    ]
+    [
+      "pkgsMusl"
+      "stdenv"
+    ]
+  ]
+  ++ justAttrNames [ ] outpaths;
+
+  names = map lib.showAttrPath paths;
+
+in
+{
+  inherit paths names;
+}

ci/eval/chunk.nix

@@ -2,8 +2,8 @@
 {
   lib ? import ../../lib,
   path ? ../..,
-  # The file containing the preEval result
-  preEvalFile,
+  # The file containing all available attribute paths, which are split into chunks here
+  attrpathFile,
   chunkSize,
   myChunk,
   includeBroken,
@@ -12,13 +12,12 @@
 }:
 
 let
-  preEvalResult = lib.importJSON preEvalFile;
-  myAttrpaths = lib.sublist (chunkSize * myChunk) chunkSize preEvalResult.paths;
+  attrpaths = lib.importJSON attrpathFile;
+  myAttrpaths = lib.sublist (chunkSize * myChunk) chunkSize attrpaths;
 
   unfiltered = import ./outpaths.nix {
     inherit path;
     inherit includeBroken systems;
-    inherit (preEvalResult) attrPathsDisallowedForInternalUse;
     extraNixpkgsConfig = builtins.fromJSON extraNixpkgsConfigJson;
   };
 

ci/eval/compare/default.nix

@@ -49,7 +49,6 @@ in
 {
   combinedDir,
   touchedFilesJson,
-  baseBranch,
   ownersFile ? ../../OWNERS,
 }:
 let
@@ -239,33 +238,34 @@ runCommand "compare"
       jq -r -f ${./generate-step-summary.jq} < ${changed-paths}
     } >> $out/step-summary.md
 
-    {
-      echo
-      echo "# Performance comparison"
-      echo
-      echo "This compares the performance of this branch against the \`${baseBranch}\` branch."
-      echo
-    } >> $out/step-summary.md
-
-    # cmp-stats only compares the stats chunks present in both revisions, so the
-    # comparison is still produced when packages were added/removed. The paired
-    # chunks may cover different attrs in that case, so caveat the figures.
-    if ! jq -e '(.attrdiff.added | length == 0) and (.attrdiff.removed | length == 0)' "${changed-paths}" > /dev/null; then
+    if jq -e '(.attrdiff.added | length == 0) and (.attrdiff.removed | length == 0)' "${changed-paths}" > /dev/null; then
+      # Chunks have changed between revisions
+      # We cannot generate a performance comparison
       {
-        echo "> [!NOTE]"
-        echo "> The package sets differ between the two revisions. This comparison only"
-        echo "> covers packages evaluated in both, so treat the figures as approximate."
+        echo
+        echo "# Performance comparison"
+        echo
+        echo "This compares the performance of this branch against its pull request base branch (e.g., 'master')"
+        echo
+        echo "For further help please refer to: [ci/README.md](https://github.com/NixOS/nixpkgs/blob/master/ci/README.md)"
         echo
       } >> $out/step-summary.md
+
+      cmp-stats --explain ${combined}/before/stats ${combined}/after/stats >> $out/step-summary.md
+
+    else
+      # Package chunks are the same in both revisions
+      # We can use the to generate a performance comparison
+      {
+        echo
+        echo "# Performance Comparison"
+        echo
+        echo "Performance stats were skipped because the package sets differ between the two revisions."
+        echo
+        echo "For further help please refer to: [ci/README.md](https://github.com/NixOS/nixpkgs/blob/master/ci/README.md)"
+      } >> $out/step-summary.md
     fi
 
-    {
-      echo "For further help please refer to: [ci/README.md](https://github.com/NixOS/nixpkgs/blob/master/ci/README.md)"
-      echo
-    } >> $out/step-summary.md
-
-    cmp-stats --explain ${combined}/before/stats ${combined}/after/stats >> $out/step-summary.md
-
     jq -r '.[]' "${touchedFilesJson}" > ./touched-files
     readarray -t touchedFiles < ./touched-files
     echo "This PR touches ''${#touchedFiles[@]} files"

ci/eval/default.nix

@@ -17,7 +17,6 @@
   busybox,
   jq,
   nix,
-  perf,
 }:
 
 {
@@ -39,7 +38,7 @@ let
       fileset = unions (
         map (lib.path.append ../..) [
           ".version"
-          "ci/eval/pre-eval.nix"
+          "ci/eval/attrpaths.nix"
           "ci/eval/chunk.nix"
           "ci/eval/outpaths.nix"
           "default.nix"
@@ -57,11 +56,11 @@ let
     builtins.readFile ../../pkgs/top-level/release-supported-systems.json
   );
 
-  preEval =
+  attrpathsSuperset =
     {
       evalSystem,
     }:
-    runCommand "pre-eval"
+    runCommand "attrpaths-superset.json"
       {
         src = nixpkgs;
         # Don't depend on -dev outputs to reduce closure size for CI.
@@ -74,15 +73,15 @@ let
         export NIX_STATE_DIR=$(mktemp -d)
         mkdir $out
         export GC_INITIAL_HEAP_SIZE=4g
-        command time -f "Pre-eval done [%MKB max resident, %Es elapsed] %C" \
+        command time -f "Attribute eval done [%MKB max resident, %Es elapsed] %C" \
           nix-instantiate --eval --strict --json --show-trace \
-            "$src/ci/eval/pre-eval.nix" \
-            -A result \
+            "$src/ci/eval/attrpaths.nix" \
+            -A paths \
             -I "$src" \
             --argstr extraNixpkgsConfigJson ${lib.escapeShellArg (builtins.toJSON extraNixpkgsConfig)} \
             --option restrict-eval true \
             --option allow-import-from-derivation false \
-            --option eval-system "${evalSystem}" > $out/result.json
+            --option eval-system "${evalSystem}" > $out/paths.json
       '';
 
   singleSystem =
@@ -91,10 +90,8 @@ let
       # Note that this is intentionally not called `system`,
       # because `--argstr system` would only be passed to the ci/default.nix file!
       evalSystem ? builtins.currentSystem,
-      # The path to the `result.json` file from `preEval`
-      preEvalFile ? "${preEval { inherit evalSystem; }}/result.json",
-      # Output the number of assembly instructions executed during evaluation
-      countInstructions ? false,
+      # The path to the `paths.json` file from `attrpathsSuperset`
+      attrpathFile ? "${attrpathsSuperset { inherit evalSystem; }}/paths.json",
     }:
     let
       singleChunk = writeShellScript "single-chunk" ''
@@ -103,7 +100,6 @@ let
         myChunk=$2
         system=$3
         outputDir=$4
-        preEvalFile=$5
 
         # Default is 5, higher values effectively disable the warning.
         # This randomly breaks Eval.
@@ -125,12 +121,12 @@ let
           --show-trace \
           --arg chunkSize "$chunkSize" \
           --arg myChunk "$myChunk" \
-          --arg preEvalFile "$preEvalFile" \
+          --arg attrpathFile "${attrpathFile}" \
           --arg systems "[ \"$system\" ]" \
           --arg includeBroken ${lib.boolToString includeBroken} \
           --argstr extraNixpkgsConfigJson ${lib.escapeShellArg (builtins.toJSON extraNixpkgsConfig)} \
           -I ${nixpkgs} \
-          -I "$preEvalFile" \
+          -I ${attrpathFile} \
           > "$outputDir/result/$myChunk" \
           2> "$outputDir/stderr/$myChunk"
         exitCode=$?
@@ -150,16 +146,13 @@ let
     runCommand "nixpkgs-eval-${evalSystem}"
       {
         # Don't depend on -dev outputs to reduce closure size for CI.
-        nativeBuildInputs = map lib.getBin (
-          [
-            busybox
-            jq
-            nix
-          ]
-          ++ lib.optionals countInstructions [ perf ]
-        );
+        nativeBuildInputs = map lib.getBin [
+          busybox
+          jq
+          nix
+        ];
         env = {
-          inherit evalSystem chunkSize countInstructions;
+          inherit evalSystem chunkSize;
         };
         __structuredAttrs = true;
         unsafeDiscardReferences.out = true;
@@ -171,6 +164,12 @@ let
         echo "System: $evalSystem"
         cores=$NIX_BUILD_CORES
         echo "Cores: $cores"
+        attrCount=$(jq length "${attrpathFile}")
+        echo "Attribute count: $attrCount"
+        echo "Chunk size: $chunkSize"
+        # Same as `attrCount / chunkSize` but rounded up
+        chunkCount=$(( (attrCount - 1) / chunkSize + 1 ))
+        echo "Chunk count: $chunkCount"
 
         mkdir -p $out/${evalSystem}
 
@@ -191,78 +190,29 @@ let
           done
         ) &
 
-        chunkedEval() {
-          local chunkOutputDir=$1
-          local preEvalFile=$2
+        seq_end=$(( chunkCount - 1 ))
 
-          local attrCount=$(jq '.paths | length' "$preEvalFile")
-          echo "Attribute count: $attrCount"
-          echo "Chunk size: $chunkSize"
-          # Same as `attrCount / chunkSize` but rounded up
-          local chunkCount=$(( (attrCount - 1) / chunkSize + 1 ))
-          echo "Chunk count: $chunkCount"
+        ${lib.optionalString quickTest ''
+          seq_end=0
+        ''}
 
-          local seq_end=$(( chunkCount - 1 ))
-          ${lib.optionalString quickTest ''
-            seq_end=0
-          ''}
+        chunkOutputDir=$(mktemp -d)
+        mkdir "$chunkOutputDir"/{result,stats,timestats,stderr}
 
-          mkdir -p "$chunkOutputDir"/{result,stats,timestats,stderr}
+        seq -w 0 "$seq_end" |
+          command time -f "%e" -o "$out/${evalSystem}/total-time" \
+          xargs -I{} -P"$cores" \
+          ${singleChunk} "$chunkSize" {} "$evalSystem" "$chunkOutputDir"
 
-          runAllChunks() {
-            seq -w 0 "$seq_end" |
-              xargs -I{} -P"$cores" \
-              ${singleChunk} "$chunkSize" {} "$evalSystem" "$chunkOutputDir" "$preEvalFile"
-          }
+        cp -r "$chunkOutputDir"/stats $out/${evalSystem}/stats-by-chunk
 
-          if [[ -n "$countInstructions" ]]; then
-            export seq_end cores chunkSize evalSystem chunkOutputDir preEvalFile
-            export -f runAllChunks
-            perf stat \
-              --event instructions:u --field-separator , --output "$chunkOutputDir"/perf-output-file \
-              bash -c runAllChunks
-            cat "$chunkOutputDir"/perf-output-file | tail -n 1 | cut -d, -f1 > "$chunkOutputDir"/instructions
-            rm "$chunkOutputDir"/perf-output-file
-          else
-            runAllChunks
-          fi
-
-          if (( chunkSize * chunkCount != attrCount )); then
-            # A final incomplete chunk would mess up the stats, don't include it
-            rm "$chunkOutputDir"/stats/"$seq_end"
-          fi
-        }
-
-        chunkOutputDirs=$(mktemp -d)
-
-        # Preparation for the second eval
-        disallowedAttributesPreEvalFile=$(mktemp)
-        jq '{
-          paths: (.attrPathsDisallowedForInternalUse | map(.attrPath)),
-          attrPathsDisallowedForInternalUse: []
-        }' ${preEvalFile} > "$disallowedAttributesPreEvalFile"
-
-        startEpoch=$(date +%s)
-
-        # The first eval evaluates only attributes that are not disallowed for internal Nixpkgs use, ensuring that they don't depend on disallowed attributes
-        # Because the first eval doesn't evaluate the disallowed attributes themselves, but we still want to check that they don't fail evaluation, we evaluate them separately in a second eval
-        # The reason we need two evals is because we want disallowed attributes to be able to depend on other disallowed attributes, which inherently needs a separate Nixpkgs instantiation
-        # And while we could interleave that instantiation into a single eval, that would ~double memory usage for all chunks, while doing it separately doesn't
-        echo "Evaluating the internally allowed attributes"
-        chunkedEval "$chunkOutputDirs"/allowed ${preEvalFile}
-        echo "Evaluating the internally disallowed attributes"
-        chunkedEval "$chunkOutputDirs"/disallowed "$disallowedAttributesPreEvalFile"
-
-        echo $(( $(date +%s) - startEpoch )) > "$out/${evalSystem}/total-time"
-
-        # We only use the stats from the allowed attrs eval, because the disallowed attrs are generally not even a full chunk
-        cp -r "$chunkOutputDirs"/allowed/stats $out/${evalSystem}/stats-by-chunk
-        if [[ -f "$chunkOutputDirs"/allowed/instructions ]]; then
-          cp "$chunkOutputDirs"/allowed/instructions $out/${evalSystem}/instructions
+        if (( chunkSize * chunkCount != attrCount )); then
+          # A final incomplete chunk would mess up the stats, don't include it
+          rm "$chunkOutputDir"/stats/"$seq_end"
         fi
 
-        cat "$chunkOutputDirs"/*/result/* | jq -s 'add | map_values(.outputs)' > $out/${evalSystem}/paths.json
-        cat "$chunkOutputDirs"/*/result/* | jq -s 'add | map_values(.meta)' > $out/${evalSystem}/meta.json
+        cat "$chunkOutputDir"/result/* | jq -s 'add | map_values(.outputs)' > $out/${evalSystem}/paths.json
+        cat "$chunkOutputDir"/result/* | jq -s 'add | map_values(.meta)' > $out/${evalSystem}/meta.json
       '';
 
   diff = callPackage ./diff.nix { };
@@ -299,20 +249,14 @@ let
           }) | from_entries
         ' > $out/maintainers.json
 
-        mkdir -p $out/before/stats $out/before/instructions
+        mkdir -p $out/before/stats
         for d in ${diffDir}/before/*; do
           cp -r "$d"/stats-by-chunk $out/before/stats/$(basename "$d")
-          if [[ -f "$d"/instructions ]]; then
-            cp "$d"/instructions $out/before/instructions/$(basename "$d")
-          fi
         done
 
-        mkdir -p $out/after/stats $out/after/instructions
+        mkdir -p $out/after/stats
         for d in ${diffDir}/after/*; do
           cp -r "$d"/stats-by-chunk $out/after/stats/$(basename "$d")
-          if [[ -f "$d"/instructions ]]; then
-            cp "$d"/instructions $out/after/instructions/$(basename "$d")
-          fi
         done
       '';
 
@@ -322,16 +266,13 @@ let
     {
       # Whether to evaluate on a specific set of systems, by default all are evaluated
       evalSystems ? if quickTest then [ "x86_64-linux" ] else supportedSystems,
-      # Output the number of assembly instructions executed during evaluation on
-      # each system
-      countInstructions ? false,
     }:
     symlinkJoin {
       name = "nixpkgs-eval-baseline";
       paths = map (
         evalSystem:
         singleSystem {
-          inherit evalSystem countInstructions;
+          inherit evalSystem;
         }
       ) evalSystems;
     };
@@ -347,12 +288,6 @@ let
       #   | jq --raw-input --slurp 'split("\n")[:-1]' > touched-files.json
       # ```
       touchedFilesJson ? builtins.toFile "touched-files.json" "[ ]",
-      # The branch the local comparison is made against; matches the `master`
-      # used in the touched-files expression above.
-      baseBranch ? "master",
-      # Output the number of assembly instructions executed during evaluation on
-      # each system
-      countInstructions ? false,
     }:
     let
       diffs = symlinkJoin {
@@ -363,14 +298,14 @@ let
             inherit evalSystem;
             beforeDir = baseline;
             afterDir = singleSystem {
-              inherit evalSystem countInstructions;
+              inherit evalSystem;
             };
           }
         ) evalSystems;
       };
       comparisonReport = compare {
         combinedDir = combine { diffDir = diffs; };
-        inherit touchedFilesJson baseBranch;
+        inherit touchedFilesJson;
       };
     in
     comparisonReport;
@@ -378,7 +313,7 @@ let
 in
 {
   inherit
-    preEval
+    attrpathsSuperset
     singleSystem
     diff
     combine

ci/eval/outpaths.nix

@@ -6,7 +6,7 @@
   includeBroken ? true, # set this to false to exclude meta.broken packages from the output
   path ? ./../..,
 
-  # used by ./pre-eval.nix
+  # used by ./attrpaths.nix
   attrNamesOnly ? false,
 
   # Set this to `null` to build for builtins.currentSystem only
@@ -14,8 +14,6 @@
     builtins.readFile (path + "/pkgs/top-level/release-supported-systems.json")
   ),
 
-  attrPathsDisallowedForInternalUse ? [ ],
-
   # Customize the config used to evaluate nixpkgs
   extraNixpkgsConfig ? { },
 }:
@@ -37,22 +35,6 @@ let
             allowVariants = !attrNamesOnly;
             checkMeta = true;
 
-            # We don't need to care about problems being caught using the
-            # standard mechanism, because any problems whose kind is not
-            # nixpkgsInternalUseAllowed cause the corresponding attributes to
-            # be disallowed entirely for internal use with
-            # attrPathsDisallowedForInternalUse, see also ./pre-eval.nix
-            problems.matchers = lib.mkForce [
-              # We only need to set the broken handler to error, so that CI
-              # doesn't evaluate those. No reason it couldn't evaluate them
-              # afaik, but this is how it's been before.
-              {
-                kind = "broken";
-                handler = "error";
-              }
-            ];
-            inherit attrPathsDisallowedForInternalUse;
-
             # Silence the `x86_64-darwin` deprecation warning.
             allowDeprecatedx86_64Darwin = true;
 

ci/eval/pre-eval.nix

@@ -1,128 +0,0 @@
-# This file does a fast pre-evaluation of Nixpkgs to determine:
-# - paths: A *superset* of all attrpaths of derivations which might be part of a release on *any* platform.
-# - attrPathsDisallowedForInternalUse: Attribute paths whose meta.problems has problems whose kinds should not be used internally in Nixpkgs
-#
-# This expression runs single-threaded under all current Nix
-# implementations, but much faster and with much less memory
-# used than ./outpaths.nix itself.
-#
-# Once you have the list of attrnames you can split it up into
-# $NUM_CORES batches and evaluate the outpaths separately for each
-# batch, in parallel.
-#
-# To dump the result:
-#
-#   nix-instantiate --eval --strict --json ci/eval/pre-eval.nix -A result
-#
-{
-  lib ? import (path + "/lib"),
-  trace ? false,
-  path ? ./../..,
-  extraNixpkgsConfigJson ? "{}",
-}:
-let
-
-  # TODO: Use mapAttrsToListRecursiveCond when this PR lands:
-  # https://github.com/NixOS/nixpkgs/pull/395160
-  listAttrs =
-    path: value:
-    let
-      result =
-        if path == [ "AAAAAASomeThingsFailToEvaluate" ] || !(lib.isAttrs value) then
-          [ ]
-        else if lib.isDerivation value then
-          [
-            {
-              inherit path value;
-            }
-          ]
-        else
-          lib.pipe value [
-            (lib.mapAttrsToList (
-              name: value:
-              lib.addErrorContext "while evaluating package set attribute path '${
-                lib.showAttrPath (path ++ [ name ])
-              }'" (listAttrs (path ++ [ name ]) value)
-            ))
-            lib.concatLists
-          ];
-    in
-    lib.traceIf trace "** ${lib.showAttrPath path}" result;
-
-  outpaths = import ./outpaths.nix {
-    inherit path;
-    extraNixpkgsConfig = builtins.fromJSON extraNixpkgsConfigJson;
-    attrNamesOnly = true;
-  };
-
-  list =
-    map
-      (path: {
-        inherit path;
-        # This looks a bit weird, but the only reason we care about this value
-        # is for the meta.problems check below, and stdenv's certainly don't
-        # have any problems, so this is fine :)
-        value = { };
-      })
-      [
-        # Some of the following are based on variants, which are disabled with `attrNamesOnly = true`.
-        # Until these have been removed from release.nix / hydra, we manually add them to the list.
-        [
-          "pkgsLLVM"
-          "stdenv"
-        ]
-        [
-          "pkgsArocc"
-          "stdenv"
-        ]
-        [
-          "pkgsZig"
-          "stdenv"
-        ]
-        [
-          "pkgsStatic"
-          "stdenv"
-        ]
-        [
-          "pkgsMusl"
-          "stdenv"
-        ]
-      ]
-    ++ listAttrs [ ] outpaths;
-  paths = map (attrs: attrs.path) list;
-  names = map lib.showAttrPath paths;
-
-  inherit (import ../../pkgs/stdenv/generic/problems.nix { inherit lib; })
-    disallowNixpkgsInternalUseKinds
-    ;
-
-  # Determine the list of attributes whose packages have any meta.problems
-  # with a kind that's disallowed from internal Nixpkgs use
-  attrPathsDisallowedForInternalUse = lib.pipe list [
-    (lib.map (
-      attrs:
-      attrs
-      // {
-        problematicProblems = builtins.tryEval (
-          lib.filterAttrs (name: problem: disallowNixpkgsInternalUseKinds ? ${problem.kind}) (
-            attrs.value.meta.problems or { }
-          )
-        );
-      }
-    ))
-    (lib.filter (attrs: attrs.problematicProblems.success && attrs.problematicProblems.value != { }))
-    (lib.map (attrs: {
-      attrPath = attrs.path;
-      reason = "it has certain meta.problems whose kinds are disallowed: ${
-        lib.generators.toPretty { } attrs.problematicProblems.value
-      }";
-    }))
-  ];
-in
-{
-  # TODO: Do we still need these? Probably not
-  inherit paths names;
-  result = {
-    inherit paths attrPathsDisallowedForInternalUse;
-  };
-}

ci/github-script/bot.js

@@ -206,8 +206,20 @@ module.exports = async ({ github, context, core, dry }) => {
 
     const maintainers = await getMaintainerMap(pull_request.base.ref)
 
+    const merge_bot_eligible = await handleMerge({
+      github,
+      context,
+      core,
+      log,
+      dry,
+      pull_request,
+      events,
+      maintainers,
+      getTeamMembers,
+      getUser,
+    })
+
     // Check for any human reviews other than the PR author, GitHub actions and other GitHub apps.
-    // `commit { oid }` is needed by handleMerge to verify approvals are against the current head.
     const reviews = (
       await github.graphql(
         `query($owner: String!, $repo: String!, $pr: Int!) {
@@ -219,7 +231,6 @@ module.exports = async ({ github, context, core, dry }) => {
             reviews(first: 100) {
               nodes {
                 state
-                commit { oid }
                 user: author {
                   # Only get users, no bots
                   ... on User {
@@ -255,20 +266,6 @@ module.exports = async ({ github, context, core, dry }) => {
         r.user.id !== pull_request.user?.id,
     )
 
-    const merge_bot_eligible = await handleMerge({
-      github,
-      context,
-      core,
-      log,
-      dry,
-      pull_request,
-      events,
-      reviews,
-      maintainers,
-      getTeamMembers,
-      getUser,
-    })
-
     const approvals = new Set(
       reviews
         .filter((review) => review.state === 'APPROVED')
@@ -395,13 +392,6 @@ module.exports = async ({ github, context, core, dry }) => {
         pull_number,
         per_page: 100,
       })
-
-      // label llm-assisted PRs accordingly
-      const assistedByPattern = /Assisted-by: (?!nix-init)/i
-      evalLabels['llm-assisted'] = prCommits.some((c) =>
-        assistedByPattern.test(c.commit.message),
-      )
-
       const commitSubjects = prCommits.map(
         (c) => c.commit.message.split('\n')[0],
       )

ci/github-script/lint-commits.js

@@ -74,10 +74,8 @@ async function checkCommitMessages({ commits, core }) {
     'fix',
     'perf',
     'refactor',
-    'services',
     'style',
     'test',
-    'update',
   ]
 
   /**

ci/github-script/merge.js

@@ -2,11 +2,11 @@ const { classify } = require('../supportedBranches.js')
 
 function runChecklist({
   committers,
+  events,
   files,
   pull_request,
   log,
   maintainers,
-  reviews,
   user,
   userIsMaintainer,
 }) {
@@ -27,35 +27,18 @@ function runChecklist({
         .reduce((acc, cur) => acc?.intersection(cur) ?? cur)
 
   const approvals = new Set(
-    reviews
+    events
       .filter(
-        ({ state, commit }) =>
-          state === 'APPROVED' &&
+        ({ event, state, commit_id }) =>
+          event === 'reviewed' &&
+          state === 'approved' &&
           // Only approvals for the current head SHA count, otherwise authors could push
           // bad code between the approval and the merge.
-          commit?.oid === pull_request.head.sha,
+          commit_id === pull_request.head.sha,
       )
-      .map(({ user }) => user.id),
-  )
-
-  // A "changes requested" review from a committer blocks both the merge queue and
-  // auto-merge, even if it was made on an older commit (unlike approvals, GitHub does
-  // not auto-dismiss changes-requested reviews on push). For each committer, take their
-  // latest actionable review; if it's CHANGES_REQUESTED, they're blocking the PR.
-  // Dismissed reviews surface as DISMISSED and comment-only follow-ups as COMMENTED, so
-  // both are skipped naturally — the prior actionable review still stands until the
-  // committer explicitly approves or requests changes again.
-  const committerReviewState = new Map()
-  for (const { user, state } of reviews) {
-    if (
-      committers.has(user.id) &&
-      ['APPROVED', 'CHANGES_REQUESTED'].includes(state)
-    ) {
-      committerReviewState.set(user.id, state)
-    }
-  }
-  const noBlockingReviews = !Array.from(committerReviewState.values()).includes(
-    'CHANGES_REQUESTED',
+      .map(({ user }) => user?.id)
+      // Some users have been deleted, so filter these out.
+      .filter(Boolean),
   )
 
   const checklist = {
@@ -74,11 +57,6 @@ function runChecklist({
         pull_request.user.login === 'r-ryantm',
     },
     'PR is not a draft': !pull_request.draft,
-    // CI state is intentionally *not* a checklist item: auto-merge exists precisely to
-    // cover unfinished CI, and an already-failed CI is reported via the merge message
-    // (see merge() below) rather than a blanket refusal.
-    'PR is not blocked by a "changes requested" review from a [committer](https://github.com/orgs/NixOS/teams/nixpkgs-committers).':
-      noBlockingReviews,
   }
 
   if (user) {
@@ -119,7 +97,7 @@ function hasMergeCommand(body) {
   return (body ?? '')
     .replace(/<!--.*?-->/gms, '')
     .replace(/(^`{3,})[^`].*?\1/gms, '')
-    .match(/^@NixOS\/nixpkgs-merge-bot merge\s*$/im)
+    .match(/^@NixOS\/nixpkgs-merge-bot merge\s*$/m)
 }
 
 async function handleMergeComment({ github, body, node_id, reaction }) {
@@ -145,7 +123,6 @@ async function handleMerge({
   dry,
   pull_request,
   events,
-  reviews,
   maintainers,
   getTeamMembers,
   getUser,
@@ -171,14 +148,6 @@ async function handleMerge({
   // including an early exit when the first non-by-name file is found.
   if (files.length >= 100) return false
 
-  const noPrFailuresState = (
-    await github.rest.repos.listCommitStatusesForRef({
-      ...context.repo,
-      ref: pull_request.head.sha,
-      per_page: 100,
-    })
-  ).data.find(({ context }) => context === 'no PR failures')?.state
-
   // Only look through comments *after* the latest (force) push.
   const lastPush = events.findLastIndex(
     ({ event, sha, commit_id }) =>
@@ -204,12 +173,10 @@ async function handleMerge({
         )),
   )
 
-  // Returns `{ reaction, messages }`: the reaction to leave on the merge comment and the
-  // lines to append to the bot's reply. Throws only on an unexpected API error.
   async function merge() {
     if (dry) {
       core.info(`Merging #${pull_number}... (dry)`)
-      return { reaction: 'ROCKET', messages: ['Merge completed (dry)'] }
+      return ['Merge completed (dry)']
     }
 
     // Using GraphQL mutations instead of the REST /merge endpoint, because the latter
@@ -230,37 +197,16 @@ async function handleMerge({
         { node_id: pull_request.node_id, sha: pull_request.head.sha },
       )
       log('merge', 'Queued for merge')
-      return {
-        reaction: 'ROCKET',
-        messages: [
-          `:heavy_check_mark: [Queued](${resp.enqueuePullRequest.mergeQueueEntry.mergeQueue.url}) for merge (#306934)`,
-        ],
-      }
+      return [
+        `:heavy_check_mark: [Queued](${resp.enqueuePullRequest.mergeQueueEntry.mergeQueue.url}) for merge (#306934)`,
+      ]
     } catch (e) {
       log('Enqueuing failed', e.response.errors[0].message)
     }
 
-    // Enqueuing fails when the required status checks are not satisfied, yet. If CI has
-    // already failed, enabling auto-merge would be pointless: it would never fire, and
-    // fixing CI requires a new push, which invalidates this merge command anyway (we only
-    // act on comments after the latest push). So we don't enable auto-merge and instead
-    // ask for a fresh command once CI is green again.
-    if (['error', 'failure'].includes(noPrFailuresState)) {
-      log('merge', 'CI has failed, not enabling auto-merge')
-      return {
-        reaction: 'THUMBS_DOWN',
-        messages: [
-          ':x: Pull Request could not be merged: CI has failed (#305350).',
-          '',
-          '> [!TIP]',
-          '> PRs cannot be merged while CI is failing.',
-          '> Once CI is passing, comment `@NixOS/nixpkgs-merge-bot merge` again.',
-        ],
-      }
-    }
-
-    // CI has not finished yet, so we enable auto-merge. We could also only use auto-merge,
-    // but this often gets stuck for no apparent reason.
+    // If required status checks are not satisfied, yet, the above will fail. In this case
+    // we can enable auto-merge. We could also only use auto-merge, but this often gets
+    // stuck for no apparent reason.
     try {
       await github.graphql(
         `mutation($node_id: ID!, $sha: GitObjectID) {
@@ -273,17 +219,12 @@ async function handleMerge({
         { node_id: pull_request.node_id, sha: pull_request.head.sha },
       )
       log('merge', 'Auto-merge enabled')
-      return {
-        reaction: 'ROCKET',
-        messages: [
-          `:heavy_check_mark: Enabled Auto Merge (#306934)`,
-          '',
-          '> [!TIP]',
-          '> [Auto Merge](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/automatically-merging-a-pull-request) will queue this PR once required CI checks succeed.',
-          '> If CI fails instead, fixing it needs a new push, which disables Auto Merge and invalidates this command — comment `@NixOS/nixpkgs-merge-bot merge` again once CI is green.',
-          '> If GitHub gets stuck even though CI passed (it sometimes does), leaving another approval should kick off the merge.',
-        ],
-      }
+      return [
+        `:heavy_check_mark: Enabled Auto Merge (#306934)`,
+        '',
+        '> [!TIP]',
+        '> Sometimes GitHub gets stuck after enabling Auto Merge. In this case, leaving another approval should trigger the merge.',
+      ]
     } catch (e) {
       log('Auto Merge failed', e.response.errors[0].message)
       throw new Error(e.response.errors[0].message)
@@ -326,11 +267,11 @@ async function handleMerge({
 
     const { result, eligible, checklist } = runChecklist({
       committers,
+      events,
       files,
       pull_request,
       log,
       maintainers,
-      reviews,
       user: comment.user,
       userIsMaintainer: await isMaintainer(comment.user.login),
     })
@@ -367,12 +308,10 @@ async function handleMerge({
     }
 
     if (result) {
+      await react('ROCKET')
       try {
-        const { reaction, messages } = await merge()
-        await react(reaction)
-        body.push(...messages)
+        body.push(...(await merge()))
       } catch (e) {
-        await react('THUMBS_DOWN')
         // Remove the HTML comment with node_id reference to allow retrying this merge on the next run.
         body.shift()
         body.push(`:x: Merge failed with: ${e} (#371492)`)
@@ -397,11 +336,11 @@ async function handleMerge({
 
   const { result } = runChecklist({
     committers,
+    events,
     files,
     pull_request,
     log,
     maintainers,
-    reviews,
   })
 
   // Returns a boolean, which indicates whether the PR is merge-bot eligible in principle.

ci/github-script/package-lock.json

@@ -4,6 +4,7 @@
   "requires": true,
   "packages": {
     "": {
+      "name": "github-script",
       "dependencies": {
         "@actions/artifact": "6.2.1",
         "@actions/core": "1.10.1",

ci/github-script/package.json

@@ -2,7 +2,9 @@
   "private": true,
   "//": [
     "Keep `@actions/core` and `@actions/github` in sync with",
-    "https://github.com/actions/github-script/blob/main/package.json."
+    "https://github.com/actions/github-script/blob/main/package.json.",
+    "Keep `@actions/artifact` and `bottleneck` in sync with",
+    "`.github/workflows/bot.yml`."
   ],
   "dependencies": {
     "@actions/artifact": "6.2.1",

ci/pinned.json

@@ -9,10 +9,23 @@
       },
       "branch": "nixpkgs-unstable",
       "submodules": false,
-      "revision": "421eebfd0ec7bccd4abe826ce62d7e6e83129493",
-      "url": "https://github.com/NixOS/nixpkgs/archive/421eebfd0ec7bccd4abe826ce62d7e6e83129493.tar.gz",
-      "hash": "sha256:1lxfhfgiv1sz2v7fg43gny57sa6wf59n98q7ldsyb2p06f4sal7w"
+      "revision": "02f3fa0374fa13707d42d55d58ecc76b091f223c",
+      "url": "https://github.com/NixOS/nixpkgs/archive/02f3fa0374fa13707d42d55d58ecc76b091f223c.tar.gz",
+      "hash": "0z8d33c5g0gk9a74ppqq77npisf9xx9c8ai9isxa2hyjx4lv1pki"
+    },
+    "treefmt-nix": {
+      "type": "Git",
+      "repository": {
+        "type": "GitHub",
+        "owner": "numtide",
+        "repo": "treefmt-nix"
+      },
+      "branch": "main",
+      "submodules": false,
+      "revision": "790751ff7fd3801feeaf96d7dc416a8d581265ba",
+      "url": "https://github.com/numtide/treefmt-nix/archive/790751ff7fd3801feeaf96d7dc416a8d581265ba.tar.gz",
+      "hash": "1zah3dmbpn3ap5acg22kq1j19dg32gj73l43yamjcxhc38sv9kd5"
     }
   },
-  "version": 8
+  "version": 5
 }

ci/treefmt.nix

@@ -1,175 +0,0 @@
-{
-  lib,
-  pkgs,
-  ...
-}:
-{
-  runtimeInputs = [
-    # tree-root uses `git rev-parse --show-toplevel`
-    pkgs.gitMinimal
-  ];
-
-  settings = {
-    # numtide/treefmt-nix defaults
-    excludes = [
-      "*.lock"
-      "*.patch"
-      "*.diff"
-      "package-lock.json"
-      "go.mod"
-      "go.sum"
-      ".gitattributes"
-      ".gitignore"
-      ".gitmodules"
-      "COPYING"
-      "LICENSE"
-    ];
-
-    # Be a bit more verbose by default, so we can see progress happening
-    verbose = 1;
-
-    # By default it's info, which is too noisy since we have many unmatched files
-    on-unmatched = "debug";
-
-    formatter = {
-      # keep-sorted start block=yes newline_separated=yes
-      actionlint = {
-        command = lib.getExe pkgs.actionlint;
-        includes = [
-          ".github/workflows/*.yml"
-          ".github/workflows/*.yaml"
-        ];
-      };
-
-      biome = {
-        command = lib.getExe pkgs.biome;
-        excludes = [
-          "*.min.js"
-          "pkgs/*"
-        ];
-        includes = [
-          "*.js"
-          "*.ts"
-          "*.mjs"
-          "*.mts"
-          "*.cjs"
-          "*.cts"
-          "*.jsx"
-          "*.tsx"
-          "*.d.ts"
-          "*.d.cts"
-          "*.d.mts"
-          "*.css"
-        ];
-        options = [
-          "check"
-          "--write"
-          "--no-errors-on-unmatched"
-          "--use-editorconfig=true"
-          "--javascript-formatter-quote-style=single"
-          "--semicolons=as-needed"
-        ];
-      };
-
-      editorconfig-checker = {
-        command = lib.getExe pkgs.editorconfig-checker;
-        options = [
-          "-disable-indent-size"
-          # TODO: Remove this once this upstream issue is fixed:
-          #   https://github.com/editorconfig-checker/editorconfig-checker/issues/505
-          "-disable-charset"
-        ];
-        includes = [ "*" ];
-        priority = 1;
-      };
-
-      keep-sorted = {
-        command = lib.getExe pkgs.keep-sorted;
-        includes = [ "*" ];
-      };
-
-      markdown-code-runner = {
-        command = lib.getExe pkgs.markdown-code-runner;
-        options =
-          let
-            config = pkgs.writers.writeTOML "markdown-code-runner-config" {
-              presets.nixfmt = {
-                language = "nix";
-                command = [ (lib.getExe pkgs.nixfmt) ];
-              };
-            };
-          in
-          [ "--config=${config}" ];
-        includes = [ "*.md" ];
-      };
-
-      nixf-diagnose = {
-        command = lib.getExe pkgs.nixf-diagnose;
-        excludes = [
-          # Auto-generated; violates sema-extra-with
-          # Can only sensibly be removed when --auto-fix supports multiple fixes at once:
-          # https://github.com/inclyc/nixf-diagnose/issues/13
-          "pkgs/servers/home-assistant/component-packages.nix"
-          # https://github.com/nix-community/nixd/issues/708
-          "nixos/maintainers/scripts/azure-new/examples/basic/system.nix"
-        ];
-        includes = [ "*.nix" ];
-        options = [
-          "--auto-fix"
-          # Rule names can currently be looked up here:
-          # https://github.com/nix-community/nixd/blob/main/libnixf/src/Basic/diagnostic.py
-          # TODO: Remove the following and fix things.
-          "--ignore=sema-unused-def-lambda-noarg-formal"
-          "--ignore=sema-unused-def-lambda-witharg-arg"
-          "--ignore=sema-unused-def-lambda-witharg-formal"
-          "--ignore=sema-unused-def-let"
-          # TODO: remove after outstanding prelude diagnostics issues are fixed:
-          # https://github.com/nix-community/nixd/issues/761
-          # https://github.com/nix-community/nixd/issues/762
-          "--ignore=sema-primop-removed-prefix"
-          "--ignore=sema-primop-overridden"
-          "--ignore=sema-constant-overridden"
-          "--ignore=sema-primop-unknown"
-        ];
-        # Ensure nixfmt cleans up after nixf-diagnose.
-        priority = -1;
-      };
-
-      # This uses nixfmt underneath, the default formatter for Nix code.
-      # See https://github.com/NixOS/nixfmt
-      nixfmt = {
-        command = lib.getExe pkgs.nixfmt;
-        includes = [ "*.nix" ];
-      };
-
-      yamlfmt = {
-        command = lib.getExe pkgs.yamlfmt;
-        excludes = [
-          # Aligns comments with whitespace
-          "pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml"
-          # TODO: Fix formatting for auto-generated file
-          "pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml"
-        ];
-        includes = [
-          "*.yaml"
-          "*.yml"
-        ];
-        options = [
-          "-formatter"
-          "retain_line_breaks=true"
-        ];
-      };
-
-      zizmor = {
-        command = lib.getExe pkgs.zizmor;
-        includes = [
-          ".github/workflows/*.yml"
-          ".github/workflows/*.yaml"
-          ".github/actions/**/*.yml"
-          ".github/actions/**/*.yaml"
-        ];
-      };
-      # keep-sorted end
-    };
-  };
-}

ci/update-pinned.sh

@@ -1,9 +1,8 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -E 'with import ../. {}; mkShell { packages = [ npins ]; }'
+#!nix-shell -i bash -p npins
 
 set -euo pipefail
 
 cd "$(dirname "${BASH_SOURCE[0]}")"
 
-npins --lock-file pinned.json upgrade
 npins --lock-file pinned.json update

doc/README.md

@@ -1,32 +1,21 @@
-# Contributing to the Nixpkgs manual
+# Contributing to the Nixpkgs reference manual
 
-This directory houses the source files for the Nixpkgs manual.
+This directory houses the source files for the Nixpkgs reference manual.
 
-> [!NOTE]
+> [!IMPORTANT]
+> We are actively restructuring our documentation to follow the [Diátaxis framework](https://diataxis.fr/)
 >
-> We are actively restructuring our documentation to be more beginner friendly.
+> Going forward, this directory should **only** contain [reference documentation](https://nix.dev/contributing/documentation/diataxis#reference).
+> For tutorials, guides and explanations, contribute to <https://nix.dev/> instead.
 >
+> We are actively working to generate **all** reference documentation from the [doc-comments](https://github.com/NixOS/rfcs/blob/master/rfcs/0145-doc-strings.md) present in code.
+> This also provides the benefit of using `:doc` in the `nix repl` to view reference documentation locally on the fly.
 
-When writing new docs use **Progressive Disclosure**
+For documentation only relevant for contributors, use Markdown files next to the source and regular code comments.
 
-Start simple, pick up beginners.
-Use **examples** first to show how to get something done. Keep **Explanation** lean.
-
-Use our [styleguide](./styleguide.md) for more in depth guidance on writing good documentation.
-
-This directory contains **guides** and **reference** documentation for Nixpkgs.
-
-Borrowing from [Diátaxis framework](https://diataxis.fr/) what suits our needs:
-
-**Guides** are task-oriented. They can be tutorial-style walkthroughs or how-to sections.
-Explanations appear as prose after examples.
-
-**Reference** documentation is the specification of functions and attributes.
-
-We are actively working to generate **all** reference documentation from the [doc-comments](https://github.com/NixOS/rfcs/blob/master/rfcs/0145-doc-strings.md) present in code.
-This also provides the benefit of using `:doc` in the `nix repl` to view reference documentation locally on the fly.
-
-See [Document structure](#document-structure) for a structural template.
+> [!TIP]
+> Feedback for improving support for parsing and rendering doc-comments is highly appreciated.
+> [Open an issue](https://github.com/NixOS/nixpkgs/issues/new?labels=6.topic%3A+documentation&title=Doc%3A+) to request bugfixes or new features.
 
 Rendered documentation:
 - [Unstable (from master)](https://nixos.org/manual/nixpkgs/unstable/)
@@ -47,7 +36,7 @@ If the build succeeds, the manual will be in `./result/share/doc/nixpkgs/manual.
 
 ### Development environment
 
-To reduce repetition, consider using tools from the provided development environment:
+In order to reduce repetition, consider using tools from the provided development environment:
 
 Load it from the Nixpkgs documentation directory with
 
@@ -65,11 +54,9 @@ Make sure that your local files aren't added to Git history by adding the follow
 /**/.direnv
 ```
 
-#### Live preview
+#### `devmode`
 
-Run [`devmode`](../pkgs/by-name/de/devmode/README.md) for a live preview while editing the manual: it rebuilds on every change and reloads the page in your browser automatically.
-
-Changes to the renderer 'pkgs/by-name/ni/nixos-render-docs' need a manual restart. Run: `devmode` again.
+Use [`devmode`](../pkgs/by-name/de/devmode/README.md) for a live preview when editing the manual.
 
 ### Testing redirects
 
@@ -220,64 +207,6 @@ When needed, each convention explains why it exists, so you can make a decision
 Note that these conventions are about the **structure** of the manual (and its source files), not about the content that goes in it.
 You, as the writer of documentation, are still in charge of its content.
 
-**For prose style, see the [documentation styleguide](./styleguide.md).**
-
-### Document structure
-
-Organize each chapter as guide sections first, then a single `## Reference` section.
-
-A well-structured chapter looks like this:
-
-````markdown
-# Foo {#foo}
-
-`foo` builds Foo projects from a `foo.toml`.
-
-## Package a Foo application {#foo-packaging}
-
-:::{.example #ex-foo-packaging}
-
-# Package the hello app
-
-```nix
-{ foo }:
-buildFooPackage {
-  pname = "hello";
-  version = "1.0";
-}
-```
-
-:::
-
-`buildFooPackage` needs `pname` and `version`.
-Keep explanation short, and place it after the example.
-
-## Reference {#foo-reference}
-
-### `buildFooPackage` {#foo-buildFooPackage}
-
-Builds a Foo application from source.
-
-#### Inputs {#foo-buildFooPackage-inputs}
-
-`pname` (String)
-: The program name.
-
-#### Examples {#foo-buildFooPackage-examples}
-
-See [](#ex-foo-packaging).
-````
-
-Examples live in one place: the guide owns them and the reference links to them.
-
-Guides introduce minimal working examples that are goal-oriented (typical usage).
-
-Reference may introduce additional examples that are unit-oriented. (minimal usage, edge-cases).
-If the guide example is already sufficient, just link to it from the reference.
-
-Follow this structure strictly; to deviate, ping @NixOS/documentation-team.
-
-
 ### One sentence per line
 
 Put each sentence in its own line.
@@ -290,16 +219,17 @@ When changing existing content, update formatting if possible, but avoid excessi
 
 ### Examples first
 
-Put examples before detailed explanations (see the [styleguide](./styleguide.md) for the rationale).
+Readers look at examples first: an example communicates what something does faster than a description.
+Put examples before detailed explanations.
 
-Use this structure for each documented item:
+Prefer this structure for each documented item:
 
 1. Title
-2. Abstract (optional, one sentence max)
+2. Abstract (optional, one sentence max, the example often speaks for itself)
 3. Example
 4. Explanation (details, edge cases, types, defaults)
 
-Rendered example:
+For instance:
 
 ````markdown
 ## `lib.toUpper`
@@ -351,17 +281,11 @@ Returns the difference as a number.
 
 Use the [admonition syntax](#admonitions) for callouts and examples.
 
-### `callPackage`-compatible examples
+### Provide self-contained examples
 
-Provide at least one example per function, in its doc-comment.
-
-Keep each example at the level it documents:
-
-- A **reference example** might sometimes live in a doc-comment and show function call shape.
-- A **guide example** lives in a guide section and shows a complete task that may compose several functions.
-
-When the task is nothing more than the call itself, the guide example is enough.
-The reference example links to the guide example.
+Provide at least one example per function, and make examples self-contained.
+This is easier to understand for beginners.
+It also helps with testing that it actually works – especially once we introduce automation.
 
 Example code should be such that it can be passed to `pkgs.callPackage`.
 Instead of something like:

doc/build-helpers.md

@@ -25,5 +25,6 @@ build-helpers/dev-shell-tools.chapter.md
 build-helpers/special.md
 build-helpers/images.md
 hooks/index.md
+languages-frameworks/index.md
 packages/index.md
 ```

doc/build-helpers/dev-shell-tools.chapter.md

@@ -2,7 +2,7 @@
 
 The `nix-shell` command has popularized the concept of transient shell environments for development or testing purposes.
 <!--
-  We should try to document the product, not its development process in the Nixpkgs manual,
+  We should try to document the product, not its development process in the Nixpkgs reference manual,
   but *something* needs to be said to provide context for this library.
   This is the most future proof sentence I could come up with while Nix itself does not yet make use of this.
   Relevant is the current status of the devShell attribute "project": https://github.com/NixOS/nix/issues/7501

doc/build-helpers/fixed-point-arguments.chapter.md

@@ -1,50 +1,48 @@
 # Fixed-point arguments of build helpers {#chap-build-helpers-finalAttrs}
 
-`stdenv.mkDerivation` also accepts a [fixed-point function](#function-library-lib.fixedPoints.fix) instead of a plain attribute set:
+As mentioned in the beginning of this part, `stdenv.mkDerivation` could alternatively accept a fixed-point function. The input of this function, typically named `finalAttrs`, is expected to be the final state of the attribute set.  A build helper like this is said to accept **fixed-point arguments**.
 
-```nix
-{
-  stdenv,
-  fetchurl,
-}:
-stdenv.mkDerivation (finalAttrs: {
-  pname = "hello";
-  version = "2.12";
+Build helpers don't always support fixed-point arguments yet, as support in [`stdenv.mkDerivation`](#mkderivation-recursive-attributes) was first included in Nixpkgs 22.05.
 
-  src = fetchurl {
-    url = "mirror://gnu/hello/hello-${finalAttrs.version}.tar.gz";
-    hash = "sha256-...";
-  };
-})
-```
+## Defining a build helper with `lib.extendMkDerivation` {#sec-build-helper-extendMkDerivation}
 
-The function's input, conventionally named `finalAttrs`, is the final state of the attribute set. Here `src` reads `finalAttrs.version` instead of repeating the version string. A build helper like this is said to accept **fixed-point arguments**.
-
-Attributes that reference each other through `finalAttrs` stay correct when changing any of them with [`overrideAttrs`](#sec-pkg-overrideAttrs), because they all access the final values of the fixed-point computation.
-
-`rec` cannot do this: its self-references are fixed when the set is defined and ignore later overrides.
-See [recursive-sets](https://nix.dev/manual/nix/stable/language/syntax#recursive-sets) for the underlying mechanism.
-
-## Define a build helper with `lib.extendMkDerivation` {#sec-build-helper-extendMkDerivation}
-
-Use [`lib.customisation.extendMkDerivation`](#function-library-lib.customisation.extendMkDerivation) to define a build helper with fixed-point support from an existing one.
-Its argument `extendDrvArgs` takes an attribute overlay similar to [`<pkg>.overrideAttrs`](#sec-pkg-overrideAttrs).
+Developers can use the Nixpkgs library function [`lib.customisation.extendMkDerivation`](#function-library-lib.customisation.extendMkDerivation) to define a build helper supporting fixed-point arguments from an existing one with such support, with an attribute overlay similar to the one taken by [`<pkg>.overrideAttrs`](#sec-pkg-overrideAttrs).
 
 Besides overriding, `lib.extendMkDerivation` also supports `excludeDrvArgNames` to optionally exclude some arguments in the input fixed-point arguments from passing down to the base build helper (specified as `constructDrv`).
 
 :::{.example #ex-build-helpers-extendMkDerivation}
 
-# Example `mkLocalDerivation` - a build helper over `mkDerivation`
+# Example definition of `mkLocalDerivation` extended from `stdenv.mkDerivation` with `lib.extendMkDerivation`
 
-Define a build helper named `mkLocalDerivation` that builds locally without using substitutes by default.
+We want to define a build helper named `mkLocalDerivation` that builds locally without using substitutes by default.
 
-Use `lib.extendMkDerivation`:
+Instead of taking a plain attribute set,
 
 ```nix
 {
-  lib,
-  stdenv,
-}:
+  preferLocalBuild ? true,
+  allowSubstitute ? false,
+  specialArg ? (_: false),
+  ...
+}@args:
+
+stdenv.mkDerivation (
+  removeAttrs [
+    # Don't pass specialArg into mkDerivation.
+    "specialArg"
+  ] args
+  // {
+    # Arguments to pass
+    inherit preferLocalBuild allowSubstitute;
+    # Some expressions involving specialArg
+    greeting = if specialArg "hi" then "hi" else "hello";
+  }
+)
+```
+
+we could define with `lib.extendMkDerivation` an attribute overlay to make the result build helper also accept the attribute set's fixed point passing to the underlying `stdenv.mkDerivation`, named `finalAttrs` here:
+
+```nix
 lib.extendMkDerivation {
   constructDrv = stdenv.mkDerivation;
   excludeDrvArgNames = [
@@ -69,78 +67,4 @@ lib.extendMkDerivation {
 ```
 :::
 
-To apply extra changes to the result derivation, pass `transformDrv` to `lib.extendMkDerivation`:
-
-```nix
-lib.customisation.extendMkDerivation { transformDrv = drv: /...; }
-```
-
-Construct a wrapper derivation around another derivation using `transformDrv`
-
-The wrapper has access to the original arguments
-
-:::{.example #ex-build-helpers-extendMkDerivation-transformDrv-wrapper}
-
-# Define a custom build helper that downloads and builds
-
-```nix
-{
-  lib,
-  stdenvNoCC,
-  cacert,
-  configure-example,
-  download-example,
-}:
-
-lib.extendMkDerivation {
-  constructDrv = stdenvNoCC.mkDerivation;
-
-  excludeDrvArgNames = [
-    "bar"
-  ];
-
-  extendDrvArgs =
-    finalAttrs:
-    {
-      bar,
-      foo,
-      hash ? "",
-      ...
-    }@args:
-    {
-      inherit hash;
-      nativeBuildInputs = args.nativeBuildInputs or [ ] ++ [
-        cacert
-        download-example
-      ];
-      buildPhase = ''
-        runHook preBuild
-        download-example --foo="$foo" --out="$out"
-        runHook postBuild
-      '';
-      impureEnvVars = lib.fetchers.proxyImpureEnvVars;
-      outputHash = if finalAttrs.hash != "" then finalAttrs.hash else lib.fakeHash;
-      outputHashFormat = "recursive";
-      passthru = args.passthru or { } // {
-        inherit bar;
-      };
-    };
-
-  transformDrv =
-    unwrapped:
-    stdenvNoCC.mkDerivation (finalAttrs: {
-      name = finalAttrs.src.name + "-wrapped";
-      src = unwrapped;
-      nativeBuildInputs = [
-        configure-example
-      ];
-      inherit (unwrapped) bar;
-      buildPhase = ''
-        runHook preBuild
-        configure-example --bar="$bar"
-        runHook postBuild
-      '';
-    });
-}
-```
-:::
+If one needs to apply extra changes to the result derivation, pass the derivation transformation function to `lib.extendMkDerivation` as `lib.customisation.extendMkDerivation { transformDrv = drv: ...; }`.

doc/build-helpers/testers.chapter.md

@@ -98,14 +98,6 @@ It has two modes:
 
 : The path to the files to check.
 
-`relocatable` (boolean, optional) {#tester-lycheeLinkCheck-param-relocatable}
-
-: Whether the site is expected to be relocatable, i.e. servable from any URL path prefix.
-
-  When `true` (the default), root-relative links (starting with `/`) are treated as errors, because they break when the site is served from a subpath or opened via `file://` URLs.
-
-  When `false`, root-relative links are resolved against the `site` directory.
-
 `remap` (attribute set, optional) {#tester-lycheeLinkCheck-param-remap}
 
 : An attribute set where the attribute names are regular expressions.
@@ -737,112 +729,4 @@ Notable attributes:
 
  * `driverInteractive`: a script that launches an interactive Python session in the context of the `testScript`.
 
-## `modularServiceCompliance` {#tester-modularServiceCompliance}
-
-Compliance suite for [modular service](https://nixos.org/manual/nixos/unstable/#modular-services) integrations.
-
-Tests that a service manager integration correctly handles the portable modular services contract: `process.argv`, sub-services, assertions, and warnings.
-
-### Return value {#tester-modularServiceCompliance-return}
-
-An attribute set of derivations which perform the tests during their build.
-
-### Inputs {#tester-modularServiceCompliance-inputs}
-
-`evalConfig` (function)
-
-: `{ services } -> { config; checkDrv; }`.
-  Function to evaluate the given services in the integration's full context.
-  This function is called for evaluation checks on configurations that will not be run.
-  - Input `services` is an attrset of modular service configurations. These should be used verbatim.
-  - Output attribute `config` is the resulting evaluated services attrset (e.g., the value of the `system.services` option in NixOS).
-    This attribute must be available even if `checkDrv` would fail.
-  - Output attribute `checkDrv` is a representative derivation whose existence and buildability prove the eval is sound (e.g., `system.build.toplevel` in NixOS, but could perhaps be more specific in the case of another process manager integration).
-  - The generic tester only reads `config` and `checkDrv`. An integration may return additional attributes for its own integration-specific eval checks. Such extra attributes are optional.
-
-`mkTest` (function)
-
-: `{ name, services, testExe } -> derivation`.
-  - Input `name` is a test name, suitable for use as a derivation name.
-  - Input `services` is an attrset of modular service configurations, matching the structure of the integration's services option.
-  - Input `testExe` is a store path to an executable that verifies the services.
-  - Output: a derivation that runs the service manager with the provided configuration inputs and then calls `testExe` after starting the services. That executable must have access to `sharedDir`.
-
-`sharedDir` (string)
-
-: Path to a directory writable by service processes and readable by `testExe`.
-  The integration must ensure this directory is available when the services and `testExe` run.
-
-`callReload` (function)
-
-: `path -> string`.
-  Given a service's name `path` (the list of service names from the top-level service down to the target sub-service, e.g. `[ "reload" "inner" ]`), returns a shell command that reloads that service.
-  The command is embedded in `testExe` and executed with sufficient privilege to reload the service (e.g. as root in the test VM).
-  There is no manager-agnostic reload command, so every integration must provide this; the integration joins the `path` per its own unit-naming convention (the suite does not assume one).
-  On NixOS the `path` dash-joins into the systemd unit name with a `.service` suffix, so the command is `systemctl reload ${lib.concatStringsSep "-" path}.service` (a top-level service is a single-element path `[ "svc" ]` -> `svc.service`; a nested sub-service `[ "parent" "child" ]` -> `parent-child.service`).
-
-:::{.example #ex-modularServiceCompliance-nixos}
-
-# NixOS invocation of the compliance suite
-
-```nix
-# In nixos/tests/all-tests.nix:
-# modularServiceCompliance =
-recurseIntoAttrs (
-  pkgs.testers.modularServiceCompliance {
-    sharedDir = "/tmp/modular-service-compliance";
-    evalConfig =
-      { services }:
-      let
-        machine = evalSystem (
-          { ... }:
-          {
-            system.services = services;
-            system.stateVersion = "25.05";
-            fileSystems."/" = {
-              device = "/test/dummy";
-              fsType = "auto";
-            };
-            boot.loader.grub.enable = false;
-          }
-        );
-      in
-      {
-        config = machine.config.system.services;
-        checkDrv = machine.config.system.build.toplevel;
-      };
-    callReload = path: "systemctl reload ${lib.concatStringsSep "-" path}.service";
-    mkTest =
-      {
-        name,
-        services,
-        testExe,
-      }:
-      runTest {
-        _class = "nixosTest";
-        inherit name;
-        nodes.machine.system.services = services;
-        testScript = ''
-          machine.wait_for_unit("multi-user.target")
-          machine.succeed("${testExe}")
-        '';
-      };
-  }
-)
-```
-
-:::
-
-### Manual compliance items {#tester-modularServiceCompliance-manual}
-
-The following compliance items are not yet automated and must be verified manually when implementing a new modular service integration.
-
-- **Failing assertions prevent deployment.**
-  A service with `assertions = [{ assertion = false; message = "..."; }]` must cause the deployment to fail.
-  The mechanism is integration-specific (e.g., NixOS checks assertions during `system.build.toplevel` evaluation).
-
-- **Warnings are visible to the user.**
-  A service with `warnings = [ "..." ]` must surface the warning to the user.
-  On NixOS these are `builtins.warn` messages emitted during evaluation.
-
 [file system object]: https://nix.dev/manual/nix/latest/store/file-system-object

doc/build-helpers/trivial-build-helpers.chapter.md

@@ -165,7 +165,7 @@ They are useful for creating files from Nix expressions, and are all implemented
 Each of these functions will cause a derivation to be produced.
 When you coerce the result of each of these functions to a string with [string interpolation](https://nixos.org/manual/nix/stable/language/string-interpolation) or [`toString`](https://nixos.org/manual/nix/stable/language/builtins#builtins-toString), it will evaluate to the [store path](https://nixos.org/manual/nix/stable/store/store-path) of this derivation.
 
-::: {.note}
+:::: {.note}
 Some of these functions will put the resulting files within a directory inside the [derivation output](https://nixos.org/manual/nix/stable/language/derivations#attr-outputs).
 If you need to refer to the resulting files somewhere else in a Nix expression, append their path to the derivation's store path.
 
@@ -190,7 +190,7 @@ writeShellScript "evaluate-my-file.sh" ''
   cat ${my-file}/share/my-file
 ''
 ```
-:::
+::::
 
 ### `makeDesktopItem` {#trivial-builder-makeDesktopItem}
 

doc/channels.chapter.md

@@ -1,26 +0,0 @@
-# How channels work {#how-channels-work}
-
-nixpkgs uses the [channels feature](https://nixos.org/nix/manual/#sec-channels) of nix.
-
-nixpkgs is distributed for users of Nix on non-NixOS distributions through the channel
-`nixpkgs-unstable`. Users of NixOS generally use one of the `nixos-*` channels,
-e.g. `nixos-22.11`, which includes all packages and modules for the stable NixOS
-22.11. Stable NixOS releases are generally only given
-security updates. More up to date packages and modules are available via the
-`nixos-unstable` channel.
-
-Both `nixos-unstable` and `nixpkgs-unstable` follow the `master` branch of the
-nixpkgs repository, although both do lag the `master` branch by generally
-[a couple of days](https://status.nixos.org/). Updates to a channel are
-distributed as soon as all tests for that channel pass, e.g.
-[this table](https://hydra.nixos.org/job/nixpkgs/trunk/unstable#tabs-constituents)
-shows the status of tests for the `nixpkgs-unstable` channel.
-
-The tests are conducted by a cluster called [Hydra](https://nixos.org/hydra/),
-which also builds binary packages from the Nix expressions in Nixpkgs for
-`x86_64-linux`, `aarch64-linux`, `x86_64-darwin` and `aarch64-darwin`.
-The binaries are made available via a [binary cache](https://cache.nixos.org).
-
-The current Nix expressions of the channels are available in the
-[nixpkgs repository](https://github.com/NixOS/nixpkgs) in branches
-that correspond to the channel names (e.g. `nixos-22.11-small`).

doc/default.nix

@@ -1,5 +1,5 @@
 {
-  pkgs ? (import ../ci { }).docPkgs,
+  pkgs ? (import ../ci { }).pkgs,
   nixpkgs ? { },
 }:
 

doc/doc-support/header.html

@@ -1,7 +0,0 @@
-<div class="manual-header">
-    <nav class="manual-header--tabs">
-        <a class="manual-header--tab manual-header--tab-active" href="#">Nixpkgs</a>
-        <a class="manual-header--tab" href="https://nixos.org/manual/nixos/stable/">NixOS</a>
-    </nav>
-    <span class="manual-header--title">Nixpkgs Manual</span>
-</div>

doc/doc-support/package.nix

@@ -73,7 +73,6 @@ stdenvNoCC.mkDerivation (
             ../anchor.min.js
             ../manpage-urls.json
             ../redirects.json
-            ../nav.json
           ]
         );
     };
@@ -117,10 +116,8 @@ stdenvNoCC.mkDerivation (
         --script ./highlightjs/loader.js \
         --script ./anchor.min.js \
         --script ./anchor-use.js \
-        --sidebar-depth 3 \
-        --nav ./nav.json \
-        --header ${./header.html}\
-        --no-navheader \
+        --toc-depth 1 \
+        --section-toc-depth 1 \
         manual.md \
         out/index.html
 

doc/first-package.chapter.md

@@ -1,84 +0,0 @@
-# Package your first application {#chap-first-package}
-
-Package an application with Nixpkgs by picking the build helper for its language and setting a few attributes.
-
-Each language ecosystem has its own build helper.
-See [](#chap-language-support) for the full set.
-
-## Package a Go application {#first-package-go}
-
-`buildGoModule` builds Go programs that use Go modules.
-
-Write the package to `package.nix`:
-
-:::{.example #ex-first-package-go}
-
-# Package `pet` with `buildGoModule`
-
-```nix
-# package.nix
-{
-  buildGoModule,
-  fetchFromGitHub,
-  lib,
-}:
-buildGoModule (finalAttrs: {
-  pname = "pet";
-  version = "0.3.4";
-
-  src = fetchFromGitHub {
-    owner = "knqyf263";
-    repo = "pet";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-Gjw1dRrgM8D3G7v6WIM2+50r4HmTXvx0Xxme2fH9TlQ=";
-  };
-
-  vendorHash = "sha256-6hCgv2/8UIRHw1kCe3nLkxF23zE/7t5RDwEjSzX3pBQ=";
-
-  meta = {
-    description = "Simple command-line snippet manager, written in Go";
-    homepage = "https://github.com/knqyf263/pet";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ kalbasit ];
-  };
-})
-```
-
-:::
-
-`buildGoModule` needs `pname`, `version`, `src`, and `vendorHash`.
-
-Pin Nixpkgs and call the package from `default.nix`:
-
-```nix
-# default.nix
-let
-  nixpkgs = fetchTarball "https://github.com/NixOS/nixpkgs/archive/nixos-unstable.tar.gz";
-  pkgs = import nixpkgs { };
-in
-pkgs.callPackage ./package.nix { }
-```
-
-Build it:
-
-```shell
-$ nix-build ./default.nix
-# or equivalent
-$ nix-build
-```
-
-Run it:
-
-```shell
-$ ./result/bin/pet --help
-pet - Simple command-line snippet manager.
-```
-
-`vendorHash` pins the fetched dependencies.
-To find its value:
-
-1. Set `vendorHash` to an empty string `""`.
-2. Run `nix-build`.
-3. Copy the correct value from the error into `vendorHash`.
-
-See the [Go reference](#sec-language-go) for every attribute and advanced usage.

doc/hooks/check-phase-thread-limit-hook.section.md

@@ -1,24 +0,0 @@
-# checkPhaseThreadLimitHook {#setup-hook-check-phase-thread-limit}
-
-This hook defaults a variety of environment variables known
-to control thread counts to 1. Many of these otherwise default
-to `$(nproc)`, which causes massive overloads on build machines
-if nix build jobs and build cores are already tuned to fully utilize
-compute capacity of a builder without additional parallelism.
-
-Currently sets the following environment variables:
-- [`OMP_NUM_THREADS`](https://www.openmp.org/spec-html/5.0/openmpse50.html)
-- [`OPENBLAS_NUM_THREADS`](https://github.com/OpenMathLib/OpenBLAS/blob/e7b45174355edec1f04de1cabcf5ca6a98ea7fbc/USAGE.md#how-can-i-use-openblas-in-multi-threaded-applications)
-- [`MKL_NUM_THREADS`](https://www.intel.com/content/www/us/en/docs/onemkl/developer-guide-linux/2023-0/mkl-domain-num-threads.html)
-- [`BLIS_NUM_THREADS`](https://github.com/flame/blis/blob/b8b75b4e19459f5d618b57aa814ca38b1d82eb82/docs/Multithreading.md#specifying-multithreading)
-- `VECLIB_MAXIMUM_THREADS`: Only affects darwin, see [`man 7 Accelerate`](https://manp.gs/mac/7/Accelerate)
-- [`NUMBA_NUM_THREADS`](https://numba.readthedocs.io/en/stable/reference/envvars.html#threading-control)
-- [`NUMEXPR_NUM_THREADS`](https://numexpr.readthedocs.io/en/latest/user_guide.html#threadpool-configuration)
-
-The `NIX_CHECK_PHASE_DEFAULT_NUM_THREADS` environment variable
-can be used to override the default thread count limit.
-`dontLimitCheckPhaseThreads = true;` can be used to disable
-thread limiting on an individual package.
-
-This hook will not attempt to override already existing
-definitions for thread count environment variables.

doc/hooks/index.md

@@ -13,7 +13,6 @@ aws-c-common.section.md
 bmake.section.md
 breakpoint.section.md
 cernlib.section.md
-check-phase-thread-limit-hook.section.md
 cmake.section.md
 desktop-file-utils.section.md
 gdk-pixbuf.section.md
@@ -38,7 +37,6 @@ npm-install-hook.section.md
 patch-rc-path-hooks.section.md
 perl.section.md
 pkg-config.section.md
-pnpm.section.md
 postgresql-test-hook.section.md
 premake.section.md
 python.section.md
@@ -50,7 +48,6 @@ unzip.section.md
 validatePkgConfig.section.md
 versionCheckHook.section.md
 waf.section.md
-writable-tmpdir-as-home-hook.section.md
 zig.section.md
 xcbuild.section.md
 xfce4-dev-tools.section.md

doc/hooks/pnpm.section.md

@@ -1,142 +0,0 @@
-# pnpmBuildHook {#pnpm-build-hook}
-
-[pnpm](https://pnpm.io/) is a an NPM-compatible package manager focused on increasing managment speeds, and reducing disk space.
-
-The `pnpmBuildHook` in Nixpkgs overrides the default build phase for building packages that use pnpm.
-
-:::{.example #ex-pnpm-build-hook}
-## pnpmBuildHook example code snippet {#pnpm-build-hook-code-snippet}
-
-```nix
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchPnpmDeps,
-  pnpmConfigHook,
-  pnpmBuildHook,
-  makeBinaryWrapper,
-  pnpm_10,
-}:
-let
-  pnpm = pnpm_10;
-in
-stdenv.mkDerivation (finalAttrs: {
-  pname = "coolPackages";
-  version = "1.0";
-
-  src = fetchFromGitHub {
-    owner = "JaneCool";
-    repo = "coolpackage";
-    tag = finalAttrs.version;
-    hash = lib.fakeHash;
-  };
-
-  __structuredAttrs = true;
-  strictDeps = true;
-
-  pnpmDeps = fetchPnpmDeps {
-    inherit (finalAttrs) pname version src;
-    inherit pnpm;
-    fetcherVersion = 4;
-    hash = lib.fakeHash;
-  };
-
-  nativeBuildInputs = [
-    pnpmConfigHook
-    pnpmBuildHook
-    makeBinaryWrapper
-  ];
-
-  pnpmBuildScript = "build";
-  pnpmBuildFlags = [
-    "--mode"
-    "production"
-  ];
-  pnpmWorkspaces = [
-    "test"
-  ];
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir "$out"
-    cp -r dist/. "$out"
-
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "very cool package that does cool things";
-    mainProgram = "cool";
-  };
-})
-```
-:::
-
-## Variables controlling pnpmBuildHook {#pnpm-build-hook-variables}
-
-### pnpm Exclusive Variables {#pnpm-build-hook-exclusive-variables}
-
-#### `pnpmBuildScript` {#pnpm-build-hook-script}
-
-Controls the script ran to build the package, by default the script is `build`.
-
-#### `pnpmFlags` {#pnpm-build-hook-flags}
-
-Controls flags used for all invocations of pnpm across all hooks local to this derivation.
-
-#### `pnpmBuildFlags` {#pnpm-build-hook-build-flags}
-
-Controls the flags pass only to the pnpm build script invocation.
-
-#### `dontPnpmBuild` {#pnpm-build-hook-dont}
-
-Disables automatically running `pnpmBuildHook`. The build can still be run manually if needed, for example:
-
-```nix
-{
-  lib,
-  rustPlatform,
-  pnpmBuildHook,
-  pnpmConfigHook,
-  fetchPnpmDeps,
-  emptyDirectory,
-  pnpm_10,
-}:
-let
-  pnpm = pnpm_10;
-in
-rustPlatform.buildRustPackage (finalAttrs: {
-  pname = "super-fast-application";
-  version = "1.0";
-
-  src = emptyDirectory;
-
-  cargoHash = lib.fakeHash;
-
-  nativeBuildInputs = [
-    pnpmBuildHook
-    pnpmConfigHook
-  ];
-
-  pnpmDeps = fetchPnpmDeps {
-    inherit (finalAttrs) pname version src;
-    inherit pnpm;
-    fetcherVersion = 4;
-    hash = lib.fakeHash;
-  };
-
-  dontPnpmBuild = true;
-  postBuild = ''
-    pnpmBuildHook
-  '';
-})
-```
-
-### Honored Variables {#pnpm-build-hook-honored-variables}
-
-The following variables are honored by `pnpmBuildHook`.
-
-* [`pnpmRoot`](#javascript-pnpm-sourceRoot)
-* [`pnpmWorkspaces`](#javascript-pnpm-workspaces)

doc/hooks/writable-tmpdir-as-home-hook.section.md

@@ -1,5 +0,0 @@
-# writableTmpDirAsHomeHook {#writableTmpDirAsHomeHook}
-
-This setup hook provides a writable home directory for packages that require it.
-
-To use, just add the hook to the `nativeBuildInputs` of the package.

doc/languages-frameworks/beam.section.md

@@ -125,7 +125,7 @@ There are 2 ways to package backend dependencies: either per-dependency mix2nix
 
 When writing an elixir project targeting `mixRelease`, you can also consider using [deps_nix](https://github.com/code-supply/deps_nix) with `mixNixDeps`. `deps_nix` supports git dependencies, but is intended to be added to the project's `mix.exs` directly.
 
-##### mix2nix {#mix2nix}
+###### mix2nix {#mix2nix}
 
 `mix2nix` is a cli tool available in Nixpkgs. It will generate a Nix expression from a `mix.lock` file. It is quite standard in the 2nix tool series.
 
@@ -175,7 +175,7 @@ If there are git dependencies.
 
 You will need to run the build process once to fix the hash to correspond to your new git src.
 
-##### FOD {#fixed-output-derivation}
+###### FOD {#fixed-output-derivation}
 
 A fixed output derivation will download mix dependencies from the internet. To ensure reproducibility, a hash will be supplied. Note that mix is relatively reproducible. An FOD generating a different hash on each run hasn't been observed (as opposed to npm where the chances are relatively high). See [akkoma](https://github.com/NixOS/nixpkgs/blob/master/pkgs/by-name/ak/akkoma/package.nix) for a usage example of FOD.
 
@@ -255,7 +255,7 @@ Setup will require the following steps:
 
 #### Example of creating a service for an Elixir - Phoenix project {#example-of-creating-a-service-for-an-elixir---phoenix-project}
 
-To create a service with your release, you could add a `service.nix`
+In order to create a service with your release, you could add a `service.nix`
 in your project with the following
 
 ```nix

doc/languages-frameworks/gnome.section.md

@@ -105,7 +105,7 @@ Given the requirements above, the package expression would become messy quickly:
 }
 ```
 
-Fortunately, we have a [family of hooks]{#ssec-gnome-hooks-wrapgappshook} that automate this. They work in conjunction with other setup hooks that populate environment variables, and will then wrap all executables in `bin` and `libexec` directories using said variables. If a package has multiple outputs, these hooks will work on `outputBin` by default, or on the outputs listed in `wrapGAppsInOutputs` if set.
+Fortunately, we have a [family of hooks]{#ssec-gnome-hooks-wrapgappshook} that automate this. They work in conjunction with other setup hooks that populate environment variables, and will then wrap all executables in `bin` and `libexec` directories using said variables.
 
 - [`wrapGAppsHook3`]{#ssec-gnome-hooks-wrapgappshook3} for GTK 3 apps. For convenience, it also adds `dconf.lib` for a GIO module implementing a GSettings backend using `dconf`, `gtk3` for GSettings schemas, and `librsvg` for GdkPixbuf loader to the closure.
 - [`wrapGAppsHook4`]{#ssec-gnome-hooks-wrapgappshook4} for GTK 4 apps. Same as `wrapGAppsHook3` but replaces `gtk3` with `gtk4`.

doc/languages-frameworks/haskell.section.md

@@ -679,7 +679,7 @@ Defaults to `false`.
 
 `genericBuilderArgsModifier`
 : This argument accepts a function allowing you to modify the arguments passed
-to `mkDerivation` to create the development environment. For example,
+to `mkDerivation` in order to create the development environment. For example,
 `args: { doCheck = false; }` would cause the environment to not include any test
 dependencies. Defaults to `lib.id`.
 

doc/languages-frameworks/index.md

@@ -2,10 +2,6 @@
 
 The [standard build environment](#chap-stdenv) makes it easy to build typical Autotools-based packages with very little code. Any other kind of package can be accommodated by overriding the appropriate phases of `stdenv`. However, there are specialised functions in Nixpkgs to easily build packages for other programming languages, such as Perl or Haskell. These are described in this chapter.
 
-::: {.tip}
-New to packaging? Start with [](#chap-first-package), then return here for the ecosystem you need.
-:::
-
 Each supported language or software ecosystem has its own package set named `<language or ecosystem>Packages`, which can be explored in various ways:
 
 - Search on [search.nixos.org](https://search.nixos.org/packages)
@@ -60,6 +56,7 @@ android.section.md
 astal.section.md
 beam.section.md
 chicken.section.md
+rocq.section.md
 cosmic.section.md
 crystal.section.md
 cuda.section.md
@@ -95,7 +92,6 @@ pkg-config.section.md
 python.section.md
 qt.section.md
 r.section.md
-rocq.section.md
 ruby.section.md
 rust.section.md
 scheme.section.md

doc/languages-frameworks/javascript.section.md

@@ -305,12 +305,10 @@ This package puts the corepack wrappers for pnpm and yarn in your PATH, and they
 
 ### pnpm {#javascript-pnpm}
 
-pnpm is available as the top-level package `pnpm`. Additionally, there are variants pinned to certain major versions, like `pnpm_9`, `pnpm_10`, `pnpm_10_29_2` and `pnpm_11`, which support different sets of lock file versions.
+pnpm is available as the top-level package `pnpm`. Additionally, there are variants pinned to certain major versions, like `pnpm_8`, `pnpm_9`, `pnpm_10`, `pnpm_10_29_2` and `pnpm_11`, which support different sets of lock file versions.
 
 When packaging an application that includes a `pnpm-lock.yaml`, you need to fetch the pnpm store for that project using a fixed-output-derivation. The function `fetchPnpmDeps` can create this pnpm store derivation. In conjunction, the setup hook `pnpmConfigHook` will prepare the build environment to install the pre-fetched dependencies store. Here is an example for a package that contains `package.json` and a `pnpm-lock.yaml` files using the fetcher and setup hook above:
 
-There is also the [`pnpmBuildHook`](#pnpm-build-hook) for building packages with `pnpm`, as seen in [](#ex-pnpm-build-hook).
-
 ```nix
 {
   fetchPnpmDeps,
@@ -366,7 +364,7 @@ It is highly recommended to use a pinned version of pnpm (i.e., `pnpm_9` or `pnp
 +let
 +  # Optionally override pnpm to use a custom nodejs version
 +  # Make sure that the same nodejs version is referenced in nativeBuildInputs
-+  # pnpm = pnpm_10.override { nodejs-slim = nodejs-slim_22; };
++  # pnpm = pnpm_10.override { nodejs = nodejs-slim_22; };
 +in
  stdenv.mkDerivation (finalAttrs: {
    pname = "foo";
@@ -408,8 +406,6 @@ In case you are patching `package.json` or `pnpm-lock.yaml`, make sure to pass `
 }
 ```
 
-If needed, `dontPnpmConfigure = true;` can be used to fully disable `pnpmConfigHook` without manually removing it from inputs.
-
 #### Dealing with `sourceRoot` {#javascript-pnpm-sourceRoot}
 
 If the pnpm project is in a subdirectory, you can just define `sourceRoot` or `setSourceRoot` for `fetchPnpmDeps`.
@@ -495,7 +491,7 @@ In this example, `prePnpmInstall` will be run by both `pnpmConfigHook` and by th
 
 #### pnpm `fetcherVersion` {#javascript-pnpm-fetcherVersion}
 
-This is the version of the output of `fetchPnpmDeps`. New packages should use `4`:
+This is the version of the output of `fetchPnpmDeps`. New packages should use `3`:
 
 ```nix
 {
@@ -515,10 +511,10 @@ Changes can include workarounds or bug fixes to existing PNPM issues.
 
 ##### Version history {#javascript-pnpm-fetcherVersion-versionHistory}
 
-Version 3 is the minimum supported value. Versions 1 and 2 were removed in the 26.11 release; packages that still use them fail to evaluate and must migrate to `fetcherVersion = 3` (or later) and regenerate their hashes.
+Version 3 is the recommended value for new packages. Versions 1 and 2 are deprecated and scheduled for removal in the 26.11 release; existing packages must migrate.
 
-- 1: Initial version, nothing special. (removed in 26.11)
-- 2: [Ensure consistent permissions](https://github.com/NixOS/nixpkgs/pull/422975) (removed in 26.11)
+- 1: Initial version, nothing special.
+- 2: [Ensure consistent permissions](https://github.com/NixOS/nixpkgs/pull/422975)
 - 3: [Build a reproducible tarball](https://github.com/NixOS/nixpkgs/pull/469950)
 - 4: [Dump SQLite database to an SQL file](https://github.com/NixOS/nixpkgs/pull/522703)
 

doc/languages-frameworks/lua.section.md

@@ -162,17 +162,6 @@ the package `luarocks-packages-updater`:
 nix-shell -p luarocks-packages-updater --run luarocks-packages-updater
 ```
 
-To add a new package without updating all packages, run
-
-```sh
-
-nix-shell -p luarocks-packages-updater
-luarocks-packages-updater add [--maintainers "<maintainer>"] <package-name>
-```
-
-The optional `--maintainers` argument accepts a space-separated list of nixpkgs maintainer names.
-When omitted, the package is added without maintainers.
-
 [luarocks2nix](https://github.com/nix-community/luarocks) is a tool capable of generating nix derivations from both rockspec and src.rock (and favors the src.rock).
 The automation only goes so far though and some packages need to be customized.
 These customizations go in [pkgs/development/lua-modules/overrides.nix](https://github.com/NixOS/nixpkgs/tree/master/pkgs/development/lua-modules/overrides.nix).
@@ -243,7 +232,7 @@ The following is an example:
         vyp
         lblasc
       ];
-      license = lib.licenses.mit;
+      license.fullName = "MIT/X11";
     };
   };
 }

doc/languages-frameworks/maven.section.md

@@ -174,59 +174,6 @@ To make sure that your package does not add extra manual effort when upgrading M
 </plugin>
 ```
 
-## Maven 4 {#maven-4}
-
-Alongside the default `maven` package (the latest Maven 3 release), nixpkgs ships `maven_4`, which packages the [Maven 4](https://maven.apache.org/whatsnewinmaven4.html) release line.
-
-`maven_4` is a standalone derivation and can be used as a drop-in replacement wherever `maven` is used, for example to build a project with the latest Maven 4:
-
-```nix
-{
-  lib,
-  fetchFromGitHub,
-  jre,
-  makeWrapper,
-  maven_4,
-}:
-
-maven_4.buildMavenPackage (finalAttrs: {
-  pname = "jd-cli";
-  version = "1.2.1";
-
-  src = fetchFromGitHub {
-    owner = "intoolswetrust";
-    repo = "jd-cli";
-    tag = "jd-cli-${finalAttrs.version}";
-    hash = "sha256-rRttA5H0A0c44loBzbKH7Waoted3IsOgxGCD2VM0U/Q=";
-  };
-
-  mvnHash = "";
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/bin $out/share/jd-cli
-    install -Dm644 jd-cli/target/jd-cli.jar $out/share/jd-cli
-
-    makeWrapper ${jre}/bin/java $out/bin/jd-cli \
-      --add-flags "-jar $out/share/jd-cli/jd-cli.jar"
-
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "Simple command line wrapper around JD Core Java Decompiler project";
-    homepage = "https://github.com/intoolswetrust/jd-cli";
-    license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ majiir ];
-  };
-})
-```
-
-`maven_4` exposes the same `buildMavenPackage` helper as `maven` (see [](#maven-buildmavenpackage)), so all of the patterns documented above apply equally. Note that the Maven dependencies resolved by Maven 4 differ from those resolved by Maven 3, so `mvnHash` must be recomputed when switching between the two.
-
 ## Manually using `mvn2nix` {#maven-mvn2nix}
 ::: {.warning}
 This way is no longer recommended; see [](#maven-buildmavenpackage) for the simpler and preferred way.
@@ -341,7 +288,7 @@ The double invocation is a _simple_ way to get around the problem that `nix-buil
 
 It treats the entire Maven repository as a single source to be downloaded, relying on Maven's dependency resolution to satisfy the output hash. This is similar to fetchers like `fetchgit`, except it has to run a Maven build to determine what to download.
 
-The first step will be to build the Maven project as a fixed-output derivation to collect the Maven repository -- below is an [example](https://github.com/fzakaria/nixos-maven-example/blob/main/double-invocation-repository.nix).
+The first step will be to build the Maven project as a fixed-output derivation in order to collect the Maven repository -- below is an [example](https://github.com/fzakaria/nixos-maven-example/blob/main/double-invocation-repository.nix).
 
 ::: {.note}
 Traditionally the Maven repository is at `~/.m2/repository`. We will override this to be the `$out` directory.
@@ -469,7 +416,7 @@ The previous example builds a `jar` file but that's not a file one can run.
 
 You need to use it with `java -jar $out/share/java/output.jar` and make sure to provide the required dependencies on the classpath.
 
-The following explains how to use `makeWrapper` to make the derivation produce an executable that will run the JAR file you created.
+The following explains how to use `makeWrapper` in order to make the derivation produce an executable that will run the JAR file you created.
 
 We will use the same repository we built above (either _double invocation_ or _buildMaven_) to setup a CLASSPATH for our JAR.
 

doc/languages-frameworks/neovim.section.md

@@ -25,7 +25,7 @@ neovim.override {
   withRuby = false;
   configure = {
     customRC = ''
-      " here your custom viml configuration goes!
+      # here your custom viml configuration goes!
     '';
     packages.myVimPackage = with pkgs.vimPlugins; {
       # See examples below on how to use custom packages.
@@ -47,7 +47,7 @@ neovim-qt.override {
   neovim = neovim.override {
     configure = {
       customRC = ''
-        " your custom viml configuration
+        # your custom viml configuration
       '';
     };
   };
@@ -64,14 +64,11 @@ For instance, `sqlite-lua` needs `g:sqlite_clib_path` to be set to work. Nixpkgs
 - `wrapRc`: Nix, not being able to write in your `$HOME`, loads the
   generated Neovim configuration via the `$VIMINIT` environment variable, i.e. : `export VIMINIT='lua dofile("/nix/store/…-init.lua")'`. This has side effects like preventing Neovim from sourcing your `init.lua` in `$XDG_CONFIG_HOME/nvim` (see bullet 7 of [`:help startup`](https://neovim.io/doc/user/starting.html#startup) in Neovim). Disable it if you want to generate your own wrapper. You can still reuse the generated vimscript init code via `neovim.passthru.initRc`.
 - `plugins`: A list of plugins to add to the wrapper.
-- `extraLuaPackages`: A function passed on to `lua.withPackages`.
-- `extraPython3Packages`: A function passed on to `python3.withPackages`.
-- `withPython3`, `withNodeJs`, `withRuby`, `withPerl` control when to enable neovim
+- `extraLuaPackages`: A function passed on to `lua.withPackages`
+- `withPython3`, `withNodeJs`, `withRuby` control when to enable neovim
   providers (see `:h provider`).
-- `vimAlias` and `viAlias` control whether to symlink the `vim` and `vi` binaries to `nvim` respectively.
-- `extraName` is a string appended to the package name and derivation name.
 
-```nix
+```
 wrapNeovimUnstable neovim-unwrapped {
   autoconfigure = true;
   autowrapRuntimeDeps = true;
@@ -83,8 +80,7 @@ wrapNeovimUnstable neovim-unwrapped {
     vim.opt.colorcolumn = { 100 }
     vim.opt.termguicolors = true
   '';
-  # plugins accepts a list of either plugins or attribute sets containing:
-  # { plugin = ...; config = ...; type = "viml"|"lua"; } (type defaults to "viml")
+  # plugins accepts a list of either plugins or { plugin = ...; config = ..vimscript.. };
   plugins = with vimPlugins; [
     {
       plugin = vim-obsession;
@@ -92,19 +88,7 @@ wrapNeovimUnstable neovim-unwrapped {
         map <Leader>$ <Cmd>Obsession<CR>
       '';
     }
-    {
-      plugin = grug-far-nvim;
-      type = "lua";
-      config = ''
-        require('grug-far').setup({
-          startInInsertMode = false,
-        })
-      '';
-    }
-    (nvim-treesitter.withPlugins (p: [
-      p.nix
-      p.python
-    ]))
+    (nvim-treesitter.withPlugins (p: [ p.nix p.python ]))
     hex-nvim
   ];
   extraLuaPackages = lp: [ lp.mpack ];
@@ -114,12 +98,12 @@ wrapNeovimUnstable neovim-unwrapped {
 }
 ```
 
-You can explore the configuration with `nix repl` to discover these options and
+You can explore the configuration with`nix repl` to discover these options and
 override them. For instance:
 ```nix
-neovim.override {
+neovim.overrideAttrs (oldAttrs: {
   autowrapRuntimeDeps = false;
-}
+})
 ```
 
 ## Specificities for some plugins {#neovim-plugin-specificities}
@@ -152,7 +136,7 @@ For example, if upstream documents that a plugin uses the Vim license but GitHub
 
 ## LuaRocks based plugins {#neovim-luarocks-based-plugins}
 
-To automatically handle plugin dependencies, several Neovim plugins
+In order to automatically handle plugin dependencies, several Neovim plugins
 upload their package to [LuaRocks](https://www.luarocks.org). This means less work for nixpkgs maintainers in the long term as dependencies get updated automatically.
 This means several Neovim plugins are first packaged as nixpkgs [lua
 packages](#packaging-a-library-on-luarocks), and converted via `buildNeovimPlugin` in
@@ -167,8 +151,6 @@ For instance:
 ```
 To update these packages, you should use the lua updater rather than vim's.
 
-To add a lua package to the `vimPlugins` set, add it to the `luarocksPackageNames` list in [luaPackagePlugins.nix](https://github.com/nixos/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/luaPackagePlugins.nix).
-
 ## Treesitter {#neovim-plugin-treesitter}
 
 [Treesitter](https://tree-sitter.github.io/) provides syntax parsing for Neovim, enabling features like:
@@ -264,43 +246,6 @@ You can install the standalone parsers and queries directly without installing `
 })
 ```
 
-### Treesitter setup using WASM parsers and queries {#neovim-plugin-treesitter-wasm}
-
-Neovim can load WASM parsers when it is built with Wasmtime support.
-In nixpkgs, WASM parser plugins are available from the `wasi32` cross package set:
-
-```nix
-(pkgs.wrapNeovim (pkgs.neovim-unwrapped.override { wasmSupport = true; }) {
-  configure = {
-    packages.myPlugins =
-      with pkgs.pkgsCross.wasi32.vimPlugins;
-      let
-        # Select the grammars you need
-        treesitter-grammars = with nvim-treesitter-parsers; [
-          nix
-          python
-        ];
-        # Queries are needed for treesitter based syntax highlighting and folds.
-        treesitter-queries = map (p: p.associatedQuery) treesitter-grammars;
-      in
-      {
-        start = [
-          # regular plugins
-        ]
-        ++ treesitter-grammars
-        ++ treesitter-queries;
-      };
-  };
-})
-```
-
-Do not install both native and WASM parsers for the same language.
-For example, installing both `pkgs.vimPlugins.nvim-treesitter-parsers.nix` and
-`pkgs.pkgsCross.wasi32.vimPlugins.nvim-treesitter-parsers.nix` is invalid because Neovim
-loads the first `parser/nix.*` found on `runtimepath`.
-
-Use `:checkhealth vim.treesitter` to verify Nix-managed WASM parsers.
-
 You can enable treesitter features for installed grammars in a `FileType` autocommand
 or in an `ftplugin/<language>.lua` script, e.g.
 

doc/languages-frameworks/python.section.md

@@ -48,6 +48,7 @@ Based on the packages defined in `pkgs/top-level/python-packages.nix` an
 attribute set is created for each available Python interpreter. The available
 sets are
 
+* `pkgs.python27Packages`
 * `pkgs.python3Packages`
 * `pkgs.python311Packages`
 * `pkgs.python312Packages`
@@ -59,7 +60,9 @@ sets are
 
 and the aliases
 
+* `pkgs.python2Packages` pointing to `pkgs.python27Packages`
 * `pkgs.python3Packages` pointing to `pkgs.python313Packages`
+* `pkgs.pythonPackages` pointing to `pkgs.python2Packages`
 * `pkgs.pypy2Packages` pointing to `pkgs.pypy27Packages`
 * `pkgs.pypy3Packages` pointing to `pkgs.pypy310Packages`
 * `pkgs.pypyPackages` pointing to `pkgs.pypy2Packages`
@@ -204,9 +207,25 @@ following are specific to `buildPythonPackage`:
 * `setupPyGlobalFlags ? []`: List of flags passed to `setup.py` command.
 * `setupPyBuildFlags ? []`: List of flags passed to `setup.py build_ext` command.
 
-##### Writing override-compatible packages {#buildpythonpackage-fixed-point-arguments}
+##### Using fixed-point arguments {#buildpythonpackage-fixed-point-arguments}
 
-Use `finalAttrs` to make a package easy to update and override:
+Both `buildPythonPackage` and `buildPythonApplication` support [fixed-point arguments](#chap-build-helpers-finalAttrs), similar to `stdenv.mkDerivation`.
+This allows you to reference the final attributes of the derivation.
+
+Instead of using `rec`:
+
+```nix
+buildPythonPackage rec {
+  pname = "pyspread";
+  version = "2.4";
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-...";
+  };
+}
+```
+
+You can use the `finalAttrs` pattern:
 
 ```nix
 buildPythonPackage (finalAttrs: {
@@ -220,9 +239,7 @@ buildPythonPackage (finalAttrs: {
 })
 ```
 
-When a downstream callsite *overrides* `version` the override becomes visible as `finalAttrs.version`.
-
-Both `buildPythonPackage` and `buildPythonApplication` support [fixed-point arguments](#chap-build-helpers-finalAttrs), similar to `stdenv.mkDerivation`.
+See the [general documentation on fixed-point arguments](#chap-build-helpers-finalAttrs) for more details on the benefits of this pattern.
 
 ::: {.note}
 
@@ -270,27 +287,29 @@ because their behaviour is different:
 The `buildPythonPackage` function has a `overridePythonAttrs` method that can be
 used to override the package. In the following example we create an environment
 where we have the `blaze` package using an older version of `pandas`. We
-first override the Python package set, then instantiate an interpreter with
-that package set.
+override first the Python interpreter and pass `packageOverrides` which contains
+the overrides for packages in the package set.
 
 ```nix
 with import <nixpkgs> { };
 
 let
-  pythonPackages = python3Packages.overrideScope (
-    final: prev: {
-      pandas = prev.pandas.overridePythonAttrs (old: rec {
-        version = "0.19.1";
-        src = fetchPypi {
-          pname = "pandas";
-          inherit version;
-          hash = "sha256-JQn+rtpy/OA2deLszSKEuxyttqBzcAil50H+JDHUdCE=";
-        };
-      });
-    }
-  );
+  python = pkgs.python3.override {
+    packageOverrides = self: super: {
+      pandas = super.pandas.overridePythonAttrs (
+        finalAttrs: prevAttrs: {
+          version = "0.19.1";
+          src = fetchPypi {
+            pname = "pandas";
+            inherit (finalAttrs) version;
+            hash = "sha256-JQn+rtpy/OA2deLszSKEuxyttqBzcAil50H+JDHUdCE=";
+          };
+        }
+      );
+    };
+  };
 in
-(pythonPackages.python.withPackages (ps: [ ps.blaze ])).env
+(python.withPackages (ps: [ ps.blaze ])).env
 ```
 
 The next example shows a non trivial overriding of the `blas` implementation to
@@ -298,16 +317,15 @@ be used through out all of the Python package set:
 
 ```nix
 {
-  python3PackagesWithBlas = python3Packages.overrideScope (
-    final: prev: {
+  python3MyBlas = pkgs.python3.override {
+    packageOverrides = self: super: {
       # We need toPythonModule for the package set to evaluate this
-      blas = final.toPythonModule (prev.blas.override { blasProvider = final.mkl; });
-      lapack = final.toPythonModule (prev.lapack.override { lapackProvider = final.mkl; });
-    }
-  );
+      blas = super.toPythonModule (super.pkgs.blas.override { blasProvider = super.pkgs.mkl; });
+      lapack = super.toPythonModule (super.pkgs.lapack.override { lapackProvider = super.pkgs.mkl; });
+    };
+  };
 }
 ```
-This will create a new Python package set with the blas and lapack implementation set to Intel MKL.
 
 This is particularly useful for numpy and scipy users who want to gain speed with other blas implementations.
 Note that using `scipy = super.scipy.override { blas = super.pkgs.mkl; };` will likely result in
@@ -439,10 +457,11 @@ Note that overriding packages deeper in the dependency graph _can_ work, but it'
 let
   pyproject = pkgs.lib.importTOML ./pyproject.toml;
 
-  myPython3Packages = pkgs.python3Packages.overrideScope (
-    final: _: {
+  myPython = pkgs.python.override {
+    self = myPython;
+    packageOverrides = pyfinal: pyprev: {
       # An editable package with a script that loads our mutable location
-      my-editable = final.mkPythonEditablePackage {
+      my-editable = pyfinal.mkPythonEditablePackage {
         # Inherit project metadata from pyproject.toml
         pname = pyproject.project.name;
         inherit (pyproject.project) version;
@@ -453,10 +472,10 @@ let
         # Inject a script (other PEP-621 entrypoints are also accepted)
         inherit (pyproject.project) scripts;
       };
-    }
-  );
+    };
+  };
 
-  pythonEnv = myPython3Packages.python.withPackages (ps: [ ps.my-editable ]);
+  pythonEnv = myPython.withPackages (ps: [ ps.my-editable ]);
 
 in
 pkgs.mkShell { packages = [ pythonEnv ]; }
@@ -556,6 +575,9 @@ In contrast to [`python.buildEnv`](#python.buildenv-function), [`python.withPack
 more advanced options such as `ignoreCollisions = true` or `postBuild`. If you
 need them, you have to use [`python.buildEnv`](#python.buildenv-function).
 
+Python 2 namespace packages may provide `__init__.py` that collide. In that case
+[`python.buildEnv`](#python.buildenv-function) should be used with `ignoreCollisions = true`.
+
 #### Setup hooks {#setup-hooks}
 
 The following are setup hooks specifically for Python packages. Most of these
@@ -607,9 +629,10 @@ buildPythonPackage.override { stdenv = customStdenv; } {
 
 Several versions of the Python interpreter are available on Nix, as well as a
 high amount of packages. The attribute `python3` refers to the default
-interpreter, which is currently CPython 3.13. It is also possible to refer to
-specific versions, e.g., `python313` refers to CPython 3.13, and `pypy` refers
-to the default PyPy interpreter.
+interpreter, which is currently CPython 3.13. The attribute `python` refers to
+CPython 2.7 for backwards compatibility. It is also possible to refer to
+specific versions, e.g., `python313` refers to CPython 3.13, and `pypy` refers to
+the default PyPy interpreter.
 
 Python is used a lot, and in different ways. This affects also how it is
 packaged. In the case of Python on Nix, an important distinction is made between
@@ -621,6 +644,14 @@ In the Nixpkgs tree Python applications can be found throughout, depending on
 what they do, and are called from the main package set. Python libraries,
 however, are in separate sets, with one set per interpreter version.
 
+The interpreters have several common attributes. One of these attributes is
+`pkgs`, which is a package set of Python libraries for this specific
+interpreter. E.g., the `toolz` package corresponding to the default interpreter
+is `python3.pkgs.toolz`, and the CPython 3.13 version is `python313.pkgs.toolz`.
+The main package set contains aliases to these package sets, e.g.
+`pythonPackages` refers to `python.pkgs` and `python313Packages` to
+`python313.pkgs`.
+
 #### Installing Python and packages {#installing-python-and-packages}
 
 The Nix and NixOS manuals explain how packages are generally installed. In the
@@ -990,7 +1021,7 @@ information. The output of the function is a derivation.
 
 An expression for `toolz` can be found in the Nixpkgs repository. As explained
 in the introduction of this Python section, a derivation of `toolz` is available
-for each interpreter version, e.g. `python313Packages.toolz` refers to the `toolz`
+for each interpreter version, e.g. `python313.pkgs.toolz` refers to the `toolz`
 derivation corresponding to the CPython 3.13 interpreter.
 
 The above example works when you're directly working on
@@ -1005,7 +1036,7 @@ with import <nixpkgs> { };
 
 (
   let
-    my_toolz = python313Packages.buildPythonPackage (finalAttrs: {
+    my_toolz = python313.pkgs.buildPythonPackage (finalAttrs: {
       pname = "toolz";
       version = "0.10.0";
       pyproject = true;
@@ -1015,7 +1046,7 @@ with import <nixpkgs> { };
         hash = "sha256-CP3V73yWSArRHBLUct4hrNMjWZlvaaUlkpm1QP66RWA=";
       };
 
-      build-system = [ python313Packages.setuptools ];
+      build-system = [ python313.pkgs.setuptools ];
 
       # has no tests
       doCheck = false;
@@ -1028,7 +1059,7 @@ with import <nixpkgs> { };
     });
 
   in
-  python313Packages.python.withPackages (
+  python313.withPackages (
     ps: with ps; [
       numpy
       my_toolz
@@ -1049,11 +1080,6 @@ of [`withPackages`](#python.withpackages-function) we used a `let` expression. Y
 `toolz` from the Nixpkgs package set this time, but instead took our own version
 that we introduced with the `let` expression.
 
-There is also a legacy API that can be accessed via `python3.pkgs`, which will also give access to
-the Python package set for a given interpreter. This API is not recommended to be used anymore
-because the package set at `python3.pkgs` is not spliced, while the package set at `python3Packages`
-is. This can lead to strange errors during cross-compilation, or if Python is used at build time.
-
 #### Handling dependencies {#handling-dependencies}
 
 Our example, `toolz`, does not have any dependencies on other Python packages or system libraries.
@@ -1614,7 +1640,7 @@ looked at how you can create environments in which specified packages are
 available.
 
 At some point you'll likely have multiple packages which you would
-like to be able to use in different projects. To minimise unnecessary
+like to be able to use in different projects. In order to minimise unnecessary
 duplication we now look at how you can maintain a repository with your
 own packages. The important functions here are `import` and `callPackage`.
 
@@ -1691,22 +1717,27 @@ should also be done when packaging `A`.
 
 ### How to override a Python package? {#how-to-override-a-python-package}
 
-We can override the Python package set, then instantiate an interpreter with it.
-In the following example we rename the `pandas` package and build it.
+We can override the interpreter and pass `packageOverrides`. In the following
+example we rename the `pandas` package and build it.
 
 ```nix
 with import <nixpkgs> { };
 
-let
-  pythonPackages = python3Packages.overrideScope (
-    final: prev: {
-      pandas = prev.pandas.overridePythonAttrs {
-        name = "foo";
-      };
-    }
-  );
-in
-(pythonPackages.python.withPackages (ps: [ ps.pandas ])).env
+(
+  let
+    python =
+      let
+        packageOverrides = self: super: {
+          pandas = super.pandas.overridePythonAttrs (old: {
+            name = "foo";
+          });
+        };
+      in
+      pkgs.python313.override { inherit packageOverrides; };
+
+  in
+  python.withPackages (ps: [ ps.pandas ])
+).env
 ```
 
 Using `nix-build` on this expression will build an environment that contains the
@@ -1722,10 +1753,12 @@ the updated `scipy` version.
 ```nix
 with import <nixpkgs> { };
 
-let
-  pythonPackages = python313Packages.overrideScope (_: prev: { scipy = prev.scipy_0_17; });
-in
-(pythonPackages.python.withPackages (ps: [ ps.blaze ])).env
+(
+  let
+    packageOverrides = self: super: { scipy = super.scipy_0_17; };
+  in
+  (pkgs.python313.override { inherit packageOverrides; }).withPackages (ps: [ ps.blaze ])
+).env
 ```
 
 The requested package `blaze` depends on `pandas` which itself depends on `scipy`.
@@ -1739,16 +1772,14 @@ let
   pkgs = import <nixpkgs> { };
   newpkgs = import pkgs.path {
     overlays = [
-      (_: prev: {
+      (self: super: {
         python313 =
           let
-            pythonPackages = prev.python313Packages.overrideScope (
-              _: prev: {
-                numpy = prev.numpy_1_18;
-              }
-            );
+            packageOverrides = python-self: python-super: {
+              numpy = python-super.numpy_1_18;
+            };
           in
-          pythonPackages.python3;
+          super.python313.override { inherit packageOverrides; };
       })
     ];
   };
@@ -1861,7 +1892,7 @@ pkgs.mkShell rec {
     pythonPackages.numpy
     pythonPackages.requests
 
-    # In this particular example, to compile any binary extensions they may
+    # In this particular example, in order to compile any binary extensions they may
     # require, the Python modules listed in the hypothetical requirements.txt need
     # the following packages to be installed locally:
     taglib
@@ -1889,8 +1920,9 @@ pkgs.mkShell rec {
 }
 ```
 
-In case the supplied venvShellHook is insufficient, you can define your own
-shell hook and adapt to your needs like in the following example:
+In case the supplied venvShellHook is insufficient, or when Python 2 support is
+needed, you can define your own shell hook and adapt to your needs like in the
+following example:
 
 ```nix
 with import <nixpkgs> { };
@@ -1903,6 +1935,8 @@ pkgs.mkShell rec {
   name = "impurePythonEnv";
   buildInputs = [
     pythonPackages.python
+    # Needed when using python 2.7
+    # pythonPackages.virtualenv
     # ...
   ];
 
@@ -1915,6 +1949,8 @@ pkgs.mkShell rec {
       echo "Skipping venv creation, '${venvDir}' already exists"
     else
       echo "Creating new venv environment in path: '${venvDir}'"
+      # Note that the module venv was only introduced in python 3, so for 2.7
+      # this needs to be replaced with a call to virtualenv
       ${pythonPackages.python.interpreter} -m venv "${venvDir}"
     fi
 
@@ -1941,17 +1977,19 @@ If you need to change a package's attribute(s) from `configuration.nix` you coul
 
 ```nix
 {
-  nixpkgs.config.packageOverrides = final: _: {
-    python3Packages = super.python3Packages.overrideScope (pySuper: {
-      twisted = pySuper.twisted.overridePythonAttrs {
-        src = final.fetchPypi {
-          pname = "Twisted";
-          version = "19.10.0";
-          hash = "sha256-c5S6fycq5yKnTz2Wnc9Zm8TvCTvDkgOHSKSQ8XJKUV0=";
-          extension = "tar.bz2";
-        };
+  nixpkgs.config.packageOverrides = super: {
+    python3 = super.python3.override {
+      packageOverrides = python-self: python-super: {
+        twisted = python-super.twisted.overridePythonAttrs (oldAttrs: {
+          src = super.fetchPypi {
+            pname = "Twisted";
+            version = "19.10.0";
+            hash = "sha256-c5S6fycq5yKnTz2Wnc9Zm8TvCTvDkgOHSKSQ8XJKUV0=";
+            extension = "tar.bz2";
+          };
+        });
       };
-    });
+    };
   };
 }
 ```
@@ -1967,7 +2005,7 @@ this snippet:
 
 ```nix
 {
-  myPythonPackages = python3Packages.overrideScope (final: super: { twisted = <...>; });
+  myPythonPackages = python3Packages.override { overrides = self: super: { twisted = <...>; }; };
 }
 ```
 
@@ -1976,17 +2014,19 @@ this snippet:
 Use the following overlay template:
 
 ```nix
-self: _: {
-  python3Packages = super.python3Packages.overrideScope (pySuper: {
-    twisted = pySuper.twisted.overrideAttrs {
-      src = final.fetchPypi {
-        pname = "Twisted";
-        version = "19.10.0";
-        hash = "sha256-c5S6fycq5yKnTz2Wnc9Zm8TvCTvDkgOHSKSQ8XJKUV0=";
-        extension = "tar.bz2";
-      };
+self: super: {
+  python = super.python.override {
+    packageOverrides = python-self: python-super: {
+      twisted = python-super.twisted.overrideAttrs (oldAttrs: {
+        src = super.fetchPypi {
+          pname = "Twisted";
+          version = "19.10.0";
+          hash = "sha256-c5S6fycq5yKnTz2Wnc9Zm8TvCTvDkgOHSKSQ8XJKUV0=";
+          extension = "tar.bz2";
+        };
+      });
     };
-  });
+  };
 }
 ```
 
@@ -2092,7 +2132,7 @@ See also [contributing section](#contributing).
 ### Are Python interpreters built deterministically? {#deterministic-builds}
 
 The Python interpreters are now built deterministically. Minor modifications had
-to be made to the interpreters to generate deterministic bytecode. This
+to be made to the interpreters in order to generate deterministic bytecode. This
 has security implications and is relevant for those using Python in a
 `nix-shell`.
 

doc/languages-frameworks/rocq.section.md

@@ -51,7 +51,7 @@ The recommended way of defining a derivation for a Rocq library, is to use the `
   * if it is a string of the form `owner:branch` then it tries to download the `branch` of owner `owner` for a project of the same name using the same vcs, and the `version` attribute of the resulting derivation is set to `"dev"`, additionally if the owner is not provided (i.e. if the `owner:` prefix is missing), it defaults to the original owner of the package (see below),
   * if it is a string of the form `"#N"`, and the domain is github, then it tries to download the current head of the pull request `#N` from github,
 * `defaultVersion` (optional). Rocq libraries may be compatible with some specific versions of Rocq only. The `defaultVersion` attribute is used when no `version` is provided (or if `version = null`) to select the version of the library to use by default, depending on the context. This selection will mainly depend on a `rocq-core` version number but also possibly on other packages versions (e.g. `mathcomp`). If its value ends up to be `null`, the package is marked for removal in end-user `rocqPackages` attribute set.
-* `release` (optional, defaults to `{}`), lists all the known releases of the library and for each of them provides an attribute set with at least a `hash` attribute (you may put the empty string `""` to automatically insert a fake hash, this will trigger an error which will allow you to find the correct hash), each attribute set of the list of releases also takes optional overloading arguments for the fetcher as below (i.e.`domain`, `owner`, `repo`, `rev`, `artifact` assuming the default fetcher is used) and optional overrides for the result of the fetcher (i.e. `version` and `src`).
+* `release` (optional, defaults to `{}`), lists all the known releases of the library and for each of them provides an attribute set with at least a `hash` attribute (you may put the empty string `""` in order to automatically insert a fake hash, this will trigger an error which will allow you to find the correct hash), each attribute set of the list of releases also takes optional overloading arguments for the fetcher as below (i.e.`domain`, `owner`, `repo`, `rev`, `artifact` assuming the default fetcher is used) and optional overrides for the result of the fetcher (i.e. `version` and `src`).
 * `fetcher` (optional, defaults to a generic fetching mechanism supporting github or gitlab based infrastructures), is a function that takes at least an `owner`, a `repo`, a `rev`, and a `hash` and returns an attribute set with a `version` and `src`.
 * `repo` (optional, defaults to the value of `pname`),
 * `owner` (optional, defaults to `"rocq-community"`).
@@ -59,7 +59,7 @@ The recommended way of defining a derivation for a Rocq library, is to use the `
 * `releaseRev` (optional, defaults to `(v: v)`), provides a default mapping from release names to revision hashes/branch names/tags,
 * `releaseArtifact` (optional, defaults to `(v: null)`), provides a default mapping from release names to artifact names (only works for github artifact for now),
 * `displayVersion` (optional), provides a way to alter the computation of `name` from `pname`, by explaining how to display version numbers,
-* `namePrefix` (optional, defaults to `[ "rocq" ]`), provides a way to alter the computation of `name` from `pname`, by explaining which dependencies must occur in `name`,
+* `namePrefix` (optional, defaults to `[ "rocq-core" ]`), provides a way to alter the computation of `name` from `pname`, by explaining which dependencies must occur in `name`,
 * `nativeBuildInputs` (optional), is a list of executables that are required to build the current derivation, in addition to the default ones (namely `which`, `dune` and `ocaml` depending on whether `useDune`, `useDuneifVersion` and `mlPlugin` are set).
 * `extraNativeBuildInputs` (optional, deprecated), an additional list of derivation to add to `nativeBuildInputs`,
 * `overrideNativeBuildInputs` (optional) replaces the default list of derivation to which `nativeBuildInputs` and `extraNativeBuildInputs` adds extra elements,
@@ -68,14 +68,12 @@ The recommended way of defining a derivation for a Rocq library, is to use the `
 * `overrideBuildInputs` (optional) replaces the default list of derivation to which `buildInputs` and `extraBuildInputs` adds extras elements,
 * `propagatedBuildInputs` (optional) is passed as is to `mkDerivation`, we recommend to use this for Rocq libraries and Rocq plugin dependencies, as this makes sure the paths of the compiled libraries and plugins will always be added to the build environments of subsequent derivation, which is necessary for Rocq packages to work correctly,
 * `mlPlugin` (optional, defaults to `false`). Some extensions (plugins) might require OCaml and sometimes other OCaml packages. Standard dependencies can be added by setting the current option to `true`. For a finer grain control, the `rocq-core.ocamlPackages` attribute can be used in `nativeBuildInputs`, `buildInputs`, and `propagatedBuildInputs` to depend on the same package set Rocq was built against.
-* `useDuneifVersion` (optional, default to `(x: false)`) uses Dune to build the package if the provided predicate evaluates to true on the version, e.g. `useDuneifVersion = versions.isGe "1.1"`  will use dune if the version of the package is greater or equal to `"1.1"`,
+* `useDuneifVersion` (optional, default to `(x: false)` uses Dune to build the package if the provided predicate evaluates to true on the version, e.g. `useDuneifVersion = versions.isGe "1.1"`  will use dune if the version of the package is greater or equal to `"1.1"`,
 * `useDune` (optional, defaults to `false`) uses Dune to build the package if set to true, the presence of this attribute overrides the behavior of the previous one.
 * `opam-name` (optional, defaults to concatenating with a dash separator the components of `namePrefix` and `pname`), name of the Dune package to build.
 * `enableParallelBuilding` (optional, defaults to `true`), since it is activated by default, we provide a way to disable it.
 * `extraInstallFlags` (optional), allows to extend `installFlags` which initializes the variables `COQLIBINSTALL` and `COQPLUGININSTALL` so as to install in the proper subdirectory. Indeed Rocq libraries should be installed in `$(out)/lib/coq/${rocq-core.rocq-version}/user-contrib/`. Such directories are automatically added to the `$ROCQPATH` environment variable by the hook defined in the Rocq derivation.
 * `setROCQBIN` (optional, defaults to `true`), by default, the environment variable `$ROCQBIN` is set to the current Rocq's binary, but one can disable this behavior by setting it to `false`,
-* `useCoq` (optional, defaults to `false`), adds the Coq compatibility binaries to the build environment, which is necessary for some packages that still depend on them and sets `COQBIN` to the path of the `coqc` binary (if `setROCQBIN` is also set to `true`). A wrapper `mkCoqDerivation` is provided that sets this option to `true`.
-* `useCoqifVersion` (optional, defaults to `(x: false)`), adds the Coq compatibility binaries to the build environment if the provided predicate evaluates to true on the version. This can be useful for supporting old package versions that need the Coq compatibility binaries, while newer versions do not.
 * `useMelquiondRemake` (optional, default to `null`) is an attribute set, which, if given, overloads the `preConfigurePhases`, `configureFlags`, `buildPhase`, and `installPhase` attributes of the derivation for a specific use in libraries using `remake` as set up by Guillaume Melquiond for `flocq`, `gappalib`, `interval`, and `coquelicot` (see the corresponding derivation for concrete examples of use of this option). For backward compatibility, the attribute `useMelquiondRemake.logpath` must be set to the logical root of the library (otherwise, one can pass `useMelquiondRemake = {}` to activate this without backward compatibility).
 * `dropAttrs`, `keepAttrs`, `dropDerivationAttrs` are all optional and allow to tune which attribute is added or removed from the final call to `mkDerivation`.
 
@@ -155,7 +153,7 @@ For example, assuming you have a special `mathcomp` dependency you want to use,
 multinomials.override { mathcomp = my-special-mathcomp; }
 ```
 
-In Nixpkgs, all Rocq derivations take a `version` argument.  This can be overridden to easily use a different version:
+In Nixpkgs, all Rocq derivations take a `version` argument.  This can be overridden in order to easily use a different version:
 
 ```nix
 rocqPackages.multinomials.override { version = "1.5.1"; }

doc/languages-frameworks/ruby.section.md

@@ -125,7 +125,7 @@ With this file in your directory, you can run `nix-shell` to build and use the g
 
 The `bundlerEnv` is a wrapper over all the gems in your gemset. This means that all the `/lib` and `/bin` directories will be available, and the executables of all gems (even of indirect dependencies) will end up in your `$PATH`. The `wrappedRuby` provides you with all executables that come with Ruby itself, but wrapped so they can easily find the gems in your gemset.
 
-One common issue that you might have is that you have Ruby, but also `bundler` in your gemset. That leads to a conflict for `/bin/bundle` and `/bin/bundler`. You can resolve this by wrapping either your Ruby or your gems in a `lowPrio` call. So to give the `bundler` from your gemset priority, it would be used like this:
+One common issue that you might have is that you have Ruby, but also `bundler` in your gemset. That leads to a conflict for `/bin/bundle` and `/bin/bundler`. You can resolve this by wrapping either your Ruby or your gems in a `lowPrio` call. So in order to give the `bundler` from your gemset priority, it would be used like this:
 
 ```nix
 # ...
@@ -265,7 +265,7 @@ Now that you know how to get a working Ruby environment with Nix, it's time to g
 
 All gems in the standard set are automatically generated from a single `Gemfile`. The dependency resolution is done with `bundler` and makes it more likely that all gems are compatible with each other.
 
-To add a new gem to nixpkgs, you can put it into the `/pkgs/development/ruby-modules/with-packages/Gemfile` and run `./maintainers/scripts/update-ruby-packages`.
+In order to add a new gem to nixpkgs, you can put it into the `/pkgs/development/ruby-modules/with-packages/Gemfile` and run `./maintainers/scripts/update-ruby-packages`.
 
 To test that it works, you can then try using the gem with:
 

doc/languages-frameworks/rust.section.md

@@ -885,7 +885,8 @@ general. A number of other parameters can be overridden:
   empty, or `"forbid"` (no cap) when `lints` is set. Because `rustc`
   only honours the first `--cap-lints` it receives, this cannot be
   changed via `extraRustcOpts`; use this attribute instead. Useful
-  with `useClippy`, since clippy lints are also capped by this flag:
+  when overriding the `rust` attribute to point at `clippy-driver`,
+  since clippy lints are also capped by this flag:
 
   ```nix
   (hello { }).override { capLints = "warn"; }
@@ -911,34 +912,6 @@ general. A number of other parameters can be overridden:
   }
   ```
 
-- Whether to compile the crate with `clippy-driver` instead of `rustc`.
-  Build scripts (`build.rs`) keep plain `rustc`. The default `capLints`
-  of `"allow"` suppresses all lints including clippy's, so this is
-  usually paired with `capLints` and lint flags via `extraRustcOpts`:
-
-  ```nix
-  (hello { }).override {
-    useClippy = true;
-    capLints = "warn";
-    extraRustcOpts = [
-      "-Dwarnings"
-      "-Wclippy::all"
-    ];
-  }
-  ```
-
-  When using a Rust toolchain that bundles its own `clippy-driver`
-  (rust-overlay, Fenix), pass it via `clippy` so the sysroot matches:
-
-  ```nix
-  (hello { }).override {
-    rust = myToolchain;
-    clippy = myToolchain;
-    useClippy = true;
-    capLints = "warn";
-  }
-  ```
-
 - Phases, just like in any other derivation, can be specified using
   the following attributes: `preUnpack`, `postUnpack`, `prePatch`,
   `patches`, `postPatch`, `preConfigure` (in the case of a Rust crate,

doc/languages-frameworks/swift.section.md

@@ -160,7 +160,7 @@ This essentially runs: `swift test -c release`
 
 In some cases, it may be necessary to patch a SwiftPM dependency. SwiftPM
 dependencies are located in `.build/checkouts`, but the `swiftpm2nix` helper
-provides these as symlinks to read-only `/nix/store` paths. To patch
+provides these as symlinks to read-only `/nix/store` paths. In order to patch
 them, we need to make them writable.
 
 A special function `swiftpmMakeMutable` is available to replace the symlink

doc/languages-frameworks/texlive.section.md

@@ -32,21 +32,6 @@ There is a TeX Live packaging that lives entirely under attribute `texlive`.
   )
   ```
 
-- Packages can be overriden by passing a new package with the same `pname` to `.withPackages`. For instance, the following replaces Asymptote with the version from Nixpkgs, which is usually more up to date:
-  ```nix
-  texliveMedium.withPackages (ps: [ asymptote ])
-  ```
-
-- To exclude a package from a collection, use an empty override as below:
-  ```nix
-  texliveBasic.withPackages (
-    ps: with ps; [
-      collection-bibtexextra
-      { pname = "bib2gls"; }
-    ]
-  )
-  ```
-
 - To add the documentation for all packages in the environment, use
   ```nix
   texliveSmall.overrideAttrs { withDocs = true; }

doc/languages-frameworks/vim.section.md

@@ -149,16 +149,11 @@ Note: this is not possible anymore for Neovim.
 
 ## Adding new plugins to nixpkgs {#adding-new-plugins-to-nixpkgs}
 
-:::{.note}
-Before adding a Neovim Lua plugin, check if a release is available on [luarocks](https://luarocks.org/).
-If it is, add it as a [LuaRocks based plugin](#neovim-luarocks-based-plugins).
-:::
-
 Nix expressions for Vim plugins are stored in [pkgs/applications/editors/vim/plugins](https://github.com/NixOS/nixpkgs/tree/master/pkgs/applications/editors/vim/plugins). For the vast majority of plugins, Nix expressions are automatically generated by running [`nix-shell -p vimPluginsUpdater --run vim-plugins-updater`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/utils/updater.nix). This creates a [generated.nix](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/generated.nix) file based on the plugins listed in [vim-plugin-names](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/vim-plugin-names).
 
 When the vim updater detects an nvim-treesitter update, it also runs [`nvim-treesitter/update.py $(nix-build -A vimPlugins.nvim-treesitter)`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/utils/update.py) to update the tree sitter grammars for `nvim-treesitter`.
 
-Some plugins require overrides to function properly. Overrides are placed in [overrides.nix](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/overrides.nix). Overrides are most often required when a plugin requires some dependencies, or extra steps are required during the build process. For example `deoplete-fish` requires both `deoplete-nvim` and `vim-fish`, and so the following override was added:
+Some plugins require overrides in order to function properly. Overrides are placed in [overrides.nix](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/overrides.nix). Overrides are most often required when a plugin requires some dependencies, or extra steps are required during the build process. For example `deoplete-fish` requires both `deoplete-nvim` and `vim-fish`, and so the following override was added:
 
 ```nix
 {

doc/manual.md.in

@@ -1,9 +1,8 @@
-# Nixpkgs Manual {#nixpkgs-manual}
+# Nixpkgs Reference Manual {#nixpkgs-manual}
 ## Version @MANUAL_VERSION@
 
 ```{=include=} chapters
 preface.chapter.md
-first-package.chapter.md
 ```
 
 ```{=include=} parts
@@ -18,10 +17,6 @@ contributing.md
 interoperability.md
 ```
 
-```{=include=} chapters
-languages-frameworks/index.md
-```
-
 ```{=include=} appendix html:into-file=//release-notes.html
 release-notes/release-notes.md
 ```

doc/nav.json

@@ -1,3 +0,0 @@
-{
-  "open": []
-}

doc/packages/citrix.section.md

@@ -10,7 +10,7 @@ The tarball archive needs to be downloaded manually, as the license agreements o
 
 The [self-service](https://support.citrix.com/article/CTX200337) is an application for managing Citrix desktops and applications. Please note that this feature only works with at least `citrix_workspace_20_06_0` and later versions.
 
-To set this up, you first have to [download the `.cr` file from the Netscaler Gateway](https://its.uiowa.edu/support/article/102186). After that, you can configure the `selfservice` like this:
+In order to set this up, you first have to [download the `.cr` file from the Netscaler Gateway](https://its.uiowa.edu/support/article/102186). After that, you can configure the `selfservice` like this:
 
 ```ShellSession
 $ storebrowse -C ~/Downloads/receiverconfig.cr
@@ -19,7 +19,7 @@ $ selfservice
 
 ## Custom certificates {#sec-citrix-custom-certs}
 
-The `Citrix Workspace App` in `nixpkgs` trusts several certificates [from the Mozilla database](https://curl.haxx.se/docs/caextract.html) by default. However, several companies using Citrix might require their own corporate certificate. On distros with imperative packaging, these certs can be stored easily in [`$ICAROOT`](https://citrix.github.io/receiver-for-linux-command-reference/), however, this directory is a store path in `nixpkgs`. To work around this issue, the package provides a simple mechanism to add custom certificates without rebuilding the entire package using `symlinkJoin`:
+The `Citrix Workspace App` in `nixpkgs` trusts several certificates [from the Mozilla database](https://curl.haxx.se/docs/caextract.html) by default. However, several companies using Citrix might require their own corporate certificate. On distros with imperative packaging, these certs can be stored easily in [`$ICAROOT`](https://citrix.github.io/receiver-for-linux-command-reference/), however, this directory is a store path in `nixpkgs`. In order to work around this issue, the package provides a simple mechanism to add custom certificates without rebuilding the entire package using `symlinkJoin`:
 
 ```nix
 with import <nixpkgs> { config.allowUnfree = true; };

doc/packages/darwin-builder.section.md

@@ -89,7 +89,7 @@ Note that if the builder is running and you have created the above ssh conf file
 {
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-22.11-darwin";
-    darwin.url = "github:nix-darwin/nix-darwin/master";
+    darwin.url = "github:lnl7/nix-darwin/master";
     darwin.inputs.nixpkgs.follows = "nixpkgs";
   };
 

doc/packages/emacs.section.md

@@ -24,7 +24,7 @@ The Emacs package comes with some extra helpers to make it easier to configure.
 }
 ```
 
-You can install it like any other package via `nix-env -iA myEmacs`. However, this will only install those packages. It will not `configure` them for us. To do this, we need to provide a configuration file. Luckily, it is possible to do this from within Nix! By modifying the above example, we can make Emacs load a custom config file. The key is to create a package that provides a `default.el` file in `/share/emacs/site-start/`. Emacs knows to load this file automatically when it starts.  Similarly, for `early-init.el`, you can create a package that provides an `early-default.el` file in `/share/emacs/site-start/`.
+You can install it like any other package via `nix-env -iA myEmacs`. However, this will only install those packages. It will not `configure` them for us. To do this, we need to provide a configuration file. Luckily, it is possible to do this from within Nix! By modifying the above example, we can make Emacs load a custom config file. The key is to create a package that provides a `default.el` file in `/share/emacs/site-start/`. Emacs knows to load this file automatically when it starts.
 
 ```nix
 {

doc/packages/index.md

@@ -25,7 +25,6 @@ etc-files.section.md
 nginx.section.md
 nrfutil.section.md
 opengl.section.md
-packer.section.md
 shell-helpers.section.md
 python-tree-sitter.section.md
 treefmt.section.md

doc/packages/packer.section.md

@@ -1,70 +0,0 @@
-# Packer {#sec-packer}
-
-[Packer](https://www.packer.io) is a tool for creating identical machine images
-for multiple platforms from a single source configuration.
-
-## Using Packer with plugins {#sec-packer-with-plugins}
-
-Packer's functionality is extended through
-[plugins](https://developer.hashicorp.com/packer/docs/plugins). Rather than
-letting Packer download plugins at runtime, you can build a Packer wrapper that
-bundles the plugins you need with `packer.withPlugins`.
-
-`packer.withPlugins` takes a function that receives the set of available plugins
-and returns the list of plugins to include:
-
-```nix
-packer.withPlugins (ps: [ ps.docker ])
-```
-
-This produces a `packer` executable wrapped with the `PACKER_PLUGIN_PATH`
-environment variable set, so the selected plugins are available without a
-separate `packer plugins install` step.
-
-For example, to get a development shell with Packer and the Docker plugin:
-
-```nix
-{
-  pkgs ? import <nixpkgs> { },
-}:
-
-pkgs.mkShell {
-  packages = [
-    (pkgs.packer.withPlugins (ps: [ ps.docker ]))
-  ];
-}
-```
-
-Multiple plugins can be selected at once:
-
-```nix
-packer.withPlugins (ps: [
-  ps.docker
-  ps.qemu
-])
-```
-
-## Listing available plugins {#sec-packer-list-plugins}
-
-The packaged plugins are exposed as the `packer.plugins` attribute set. To list
-every plugin available in your version of Nixpkgs, query its attribute names:
-
-```ShellSession
-$ nix eval nixpkgs#packer.plugins --apply builtins.attrNames
-[ "docker" "qemu" ]
-```
-
-Without flakes:
-
-```ShellSession
-$ nix-env -f '<nixpkgs>' -qaP -A packer.plugins
-packer.plugins.docker  packer-plugin-docker-1.1.2
-packer.plugins.qemu    packer-plugin-qemu-1.1.4
-```
-
-The attribute name (for example `docker` or `qemu`) is what you pass to
-`packer.withPlugins`.
-
-Notes:
-
-- `mkPackerPlugin` currently only supports `fetchFromGitHub` as the fetcher.

doc/packages/urxvt.section.md

@@ -22,7 +22,7 @@ rxvt-unicode.override {
 
 If the `configure` function returns an attrset without the `plugins` attribute, `availablePlugins` will be used automatically.
 
-To add plugins but also keep all default plugins installed, it is possible to use the following method:
+In order to add plugins but also keep all default plugins installed, it is possible to use the following method:
 
 ```nix
 rxvt-unicode.override {

doc/packages/weechat.section.md

@@ -39,7 +39,7 @@ weechat.override {
 }
 ```
 
-To also keep all default plugins installed, it is possible to use the following method:
+In order to also keep all default plugins installed, it is possible to use the following method:
 
 ```nix
 weechat.override {

doc/preface.chapter.md

@@ -1,14 +1,50 @@
-# Overview {#preface}
+# Preface {#preface}
 
-Nixpkgs is a set of packages for the [Nix package manager](https://nixos.org/nix/), released under the [MIT license](https://github.com/NixOS/nixpkgs/blob/master/COPYING).
+The Nix Packages collection (Nixpkgs) is a set of thousands of packages for the
+[Nix package manager](https://nixos.org/nix/), released under a
+[permissive MIT license](https://github.com/NixOS/nixpkgs/blob/master/COPYING).
+Packages are available for several platforms, and can be used with the Nix
+package manager on most GNU/Linux distributions as well as [NixOS](https://nixos.org/nixos).
 
-Further documentation:
+This document is the user [_reference_](https://nix.dev/contributing/documentation/diataxis#reference) manual for Nixpkgs.
+It describes the entire public interface of Nixpkgs in a concise and orderly manner, and all relevant behaviors, with examples and cross-references.
 
+To discover other kinds of documentation:
 - [nix.dev](https://nix.dev/): Tutorials and guides for getting things done with Nix
-- [NixOS Search](https://search.nixos.org)
-- [Contributing](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md): to Nixpkgs
+- [NixOS **Option Search**](https://search.nixos.org/options) and reference documentation
+- [Nixpkgs **Package Search**](https://search.nixos.org/packages)
+- [**NixOS** manual](https://nixos.org/manual/nixos/stable/): Reference documentation for the NixOS Linux distribution
+- [`CONTRIBUTING.md`](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md): Contributing to Nixpkgs, including this manual
+
+## Overview of Nixpkgs {#overview-of-nixpkgs}
 
 Nix expressions describe how to build packages from source and are collected in
-the [nixpkgs repository](https://github.com/NixOS/nixpkgs).
+the [Nixpkgs repository](https://github.com/NixOS/nixpkgs). Also included in the
+collection are Nix expressions for
+[NixOS modules](https://nixos.org/nixos/manual/index.html#sec-writing-modules).
+With these expressions the Nix package manager can build binary packages.
 
-Packages are distributed through [channels](#how-channels-work).
+Packages, including the Nix packages collection, are distributed through
+[channels](https://nixos.org/nix/manual/#sec-channels). The collection is
+distributed for users of Nix on non-NixOS distributions through the channel
+`nixpkgs-unstable`. Users of NixOS generally use one of the `nixos-*` channels,
+e.g., `nixos-22.11`, which includes all packages and modules for the stable NixOS
+22.11. Stable NixOS releases are generally only given
+security updates. More up-to-date packages and modules are available via the
+`nixos-unstable` channel.
+
+Both `nixos-unstable` and `nixpkgs-unstable` follow the `master` branch of the
+Nixpkgs repository, although both do lag the `master` branch by generally
+[a couple of days](https://status.nixos.org/). Updates to a channel are
+distributed as soon as all tests for that channel pass, e.g.,
+[this table](https://hydra.nixos.org/job/nixpkgs/trunk/unstable#tabs-constituents)
+shows the status of tests for the `nixpkgs-unstable` channel.
+
+The tests are conducted by a cluster called [Hydra](https://nixos.org/hydra/),
+which also builds binary packages from the Nix expressions in Nixpkgs for
+`x86_64-linux`, `aarch64-linux`, `x86_64-darwin` and `aarch64-darwin`.
+The binaries are made available via a [binary cache](https://cache.nixos.org).
+
+The current Nix expressions of the channels are available in the
+[Nixpkgs repository](https://github.com/NixOS/nixpkgs) in branches
+that correspond to the channel names (e.g., `nixos-22.11-small`).

doc/redirects.json

@@ -2,9 +2,6 @@
   "chap-build-helpers-finalAttrs": [
     "index.html#chap-build-helpers-finalAttrs"
   ],
-  "chap-first-package": [
-    "index.html#chap-first-package"
-  ],
   "chap-release-notes": [
     "release-notes.html#chap-release-notes"
   ],
@@ -108,15 +105,6 @@
   "ex-build-helpers-extendMkDerivation": [
     "index.html#ex-build-helpers-extendMkDerivation"
   ],
-  "ex-build-helpers-extendMkDerivation-transformDrv-wrapper": [
-    "index.html#ex-build-helpers-extendMkDerivation-transformDrv-wrapper"
-  ],
-  "ex-first-package-go": [
-    "index.html#ex-first-package-go"
-  ],
-  "ex-modularServiceCompliance-nixos": [
-    "index.html#ex-modularServiceCompliance-nixos"
-  ],
   "ex-pkgs-replace-vars": [
     "index.html#ex-pkgs-replace-vars",
     "index.html#ex-pkgs-substituteAll",
@@ -125,9 +113,6 @@
   "ex-pkgs-replace-vars-with": [
     "index.html#ex-pkgs-replace-vars-with"
   ],
-  "ex-pnpm-build-hook": [
-    "index.html#ex-pnpm-build-hook"
-  ],
   "ex-shfmt": [
     "index.html#ex-shfmt"
   ],
@@ -140,9 +125,6 @@
   "ex-writeShellApplication": [
     "index.html#ex-writeShellApplication"
   ],
-  "first-package-go": [
-    "index.html#first-package-go"
-  ],
   "friction-graphics": [
     "index.html#friction-graphics"
   ],
@@ -152,9 +134,6 @@
   "ghc-deprecation-policy": [
     "index.html#ghc-deprecation-policy"
   ],
-  "how-channels-work": [
-    "index.html#how-channels-work"
-  ],
   "inkscape-plugins": [
     "index.html#inkscape-plugins"
   ],
@@ -239,9 +218,6 @@
   "neovim-luarocks-based-plugins": [
     "index.html#neovim-luarocks-based-plugins"
   ],
-  "neovim-plugin-treesitter-wasm": [
-    "index.html#neovim-plugin-treesitter-wasm"
-  ],
   "nixpkgs-manual": [
     "index.html#nixpkgs-manual"
   ],
@@ -370,35 +346,10 @@
   "pkgs.treefmt.withConfig": [
     "index.html#pkgs.treefmt.withConfig"
   ],
-  "pnpm-build-hook": [
-    "index.html#pnpm-build-hook"
-  ],
-  "pnpm-build-hook-build-flags": [
-    "index.html#pnpm-build-hook-build-flags"
-  ],
-  "pnpm-build-hook-code-snippet": [
-    "index.html#pnpm-build-hook-code-snippet"
-  ],
-  "pnpm-build-hook-dont": [
-    "index.html#pnpm-build-hook-dont"
-  ],
-  "pnpm-build-hook-exclusive-variables": [
-    "index.html#pnpm-build-hook-exclusive-variables"
-  ],
-  "pnpm-build-hook-flags": [
-    "index.html#pnpm-build-hook-flags"
-  ],
-  "pnpm-build-hook-script": [
-    "index.html#pnpm-build-hook-script"
-  ],
-  "pnpm-build-hook-variables": [
-    "index.html#pnpm-build-hook-variables"
-  ],
-  "pnpm-build-hook-honored-variables": [
-    "index.html#pnpm-build-hook-honored-variables"
-  ],
   "preface": [
-    "index.html#preface",
+    "index.html#preface"
+  ],
+  "overview-of-nixpkgs": [
     "index.html#overview-of-nixpkgs"
   ],
   "part-using": [
@@ -461,9 +412,6 @@
   "sec-meta-identifiers-cpe": [
     "index.html#sec-meta-identifiers-cpe"
   ],
-  "sec-meta-identifiers-purl": [
-    "index.html#sec-meta-identifiers-purl"
-  ],
   "sec-modify-via-packageOverrides": [
     "index.html#sec-modify-via-packageOverrides"
   ],
@@ -485,30 +433,6 @@
   "chap-overlays": [
     "index.html#chap-overlays"
   ],
-  "sec-nixpkgs-release-26.11": [
-    "release-notes.html#sec-nixpkgs-release-26.11"
-  ],
-  "sec-nixpkgs-release-26.11-highlights": [
-    "release-notes.html#sec-nixpkgs-release-26.11-highlights"
-  ],
-  "sec-nixpkgs-release-26.11-incompatibilities": [
-    "release-notes.html#sec-nixpkgs-release-26.11-incompatibilities"
-  ],
-  "sec-nixpkgs-release-26.11-lib": [
-    "release-notes.html#sec-nixpkgs-release-26.11-lib"
-  ],
-  "sec-nixpkgs-release-26.11-lib-breaking": [
-    "release-notes.html#sec-nixpkgs-release-26.11-lib-breaking"
-  ],
-  "sec-nixpkgs-release-26.11-lib-deprecations": [
-    "release-notes.html#sec-nixpkgs-release-26.11-lib-deprecations"
-  ],
-  "sec-nixpkgs-release-26.11-lib-additions-improvements": [
-    "release-notes.html#sec-nixpkgs-release-26.11-lib-additions-improvements"
-  ],
-  "sec-nixpkgs-release-26.11-notable-changes": [
-    "release-notes.html#sec-nixpkgs-release-26.11-notable-changes"
-  ],
   "sec-nixpkgs-release-26.05": [
     "release-notes.html#sec-nixpkgs-release-26.05"
   ],
@@ -639,15 +563,6 @@
   "chap-overrides": [
     "index.html#chap-overrides"
   ],
-  "sec-packer": [
-    "index.html#sec-packer"
-  ],
-  "sec-packer-list-plugins": [
-    "index.html#sec-packer-list-plugins"
-  ],
-  "sec-packer-with-plugins": [
-    "index.html#sec-packer-with-plugins"
-  ],
   "sec-pkg-override": [
     "index.html#sec-pkg-override"
   ],
@@ -930,18 +845,6 @@
   "glibcxxassertions": [
     "index.html#glibcxxassertions"
   ],
-  "tester-modularServiceCompliance": [
-    "index.html#tester-modularServiceCompliance"
-  ],
-  "tester-modularServiceCompliance-inputs": [
-    "index.html#tester-modularServiceCompliance-inputs"
-  ],
-  "tester-modularServiceCompliance-manual": [
-    "index.html#tester-modularServiceCompliance-manual"
-  ],
-  "tester-modularServiceCompliance-return": [
-    "index.html#tester-modularServiceCompliance-return"
-  ],
   "tester-shfmt": [
     "index.html#tester-shfmt"
   ],
@@ -1008,15 +911,6 @@
   "var-meta-identifiers-possibleCPEs": [
     "index.html#var-meta-identifiers-possibleCPEs"
   ],
-  "var-meta-identifiers-purl": [
-    "index.html#var-meta-identifiers-purl"
-  ],
-  "var-meta-identifiers-purlParts": [
-    "index.html#var-meta-identifiers-purlParts"
-  ],
-  "var-meta-identifiers-purls": [
-    "index.html#var-meta-identifiers-purls"
-  ],
   "var-meta-teams": [
     "index.html#var-meta-teams"
   ],
@@ -1125,15 +1019,9 @@
   "tar-files": [
     "index.html#tar-files"
   ],
-  "writableTmpDirAsHomeHook": [
-    "index.html#writableTmpDirAsHomeHook"
-  ],
   "x86_64-darwin-26.05": [
     "release-notes.html#x86_64-darwin-26.05"
   ],
-  "x86_64-darwin-26.11": [
-    "release-notes.html#x86_64-darwin-26.11"
-  ],
   "zip-files": [
     "index.html#zip-files"
   ],
@@ -2921,10 +2809,6 @@
   "setup-hook-mpi-check": [
     "index.html#setup-hook-mpi-check"
   ],
-  "setup-hook-check-phase-thread-limit": [
-    "index.html#setup-hook-check-phase-thread-limit",
-    "index.html#setup-hook-omp-check"
-  ],
   "ninja": [
     "index.html#ninja"
   ],
@@ -4019,9 +3903,6 @@
   "maven": [
     "index.html#maven"
   ],
-  "maven-4": [
-    "index.html#maven-4"
-  ],
   "maven-buildmavenpackage": [
     "index.html#maven-buildmavenpackage"
   ],

doc/release-notes/release-notes.md

@@ -3,7 +3,6 @@
 This section lists the release notes for each stable version of Nixpkgs and the current unstable revision.
 
 ```{=include=} sections
-rl-2611.section.md
 rl-2605.section.md
 rl-2511.section.md
 rl-2505.section.md

doc/release-notes/rl-2605.section.md

@@ -380,8 +380,6 @@
 
 - `collabora-desktop` The desktop version of Collabora Office is now available, package version `25.05.9.2-2`.
 
-- The `services.geoserver` NixOS module has been added to allow running [Geoserver](https://geoserver.org/) as a service.
-
 - `fetchPnpmDeps` and `pnpmConfigHook` were added as top-level attributes, replacing the now deprecated `pnpm.fetchDeps` and `pnpm.configHook` attributes.
 
 - `fetchPnpmDeps`' `fetcherVersion = 1` and `fetcherVersion = 2` are deprecated

doc/release-notes/rl-2611.section.md

@@ -1,149 +1,22 @@
-# Nixpkgs 26.11 ("Zokor", 2026.11/??) {#sec-nixpkgs-release-26.11}
+# Nixpkgs 26.11 (2026.11/??) {#sec-nixpkgs-release-26.11}
 
 ## Highlights {#sec-nixpkgs-release-26.11-highlights}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- The {file}`nixexprs.tar.xz` tarball will be discontinued together with Nixpkgs
-  27.05 after 2027-12-31. Migrate to the {file}`nixexprs.tar.zst` tarball
-  instead.
-
-  This affects for example users who pull Nixpkgs as a flake input from
-  https://channels.nixos.org:
-
-  ```diff
-  -nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.xz";
-  +nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.zst";
-  ```
+- Create the first release note entry in this section!
 
 ## Backward Incompatibilities {#sec-nixpkgs-release-26.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- []{#x86_64-darwin-26.11}
-
-  Support for `x86_64-darwin` has been dropped, due to Apple’s deprecation of the platform and limited build infrastructure and developer time.
-  We will no longer build packages for the platform or support building them from source.
-
-  The Nixpkgs 26.05 stable branch will still maintain platform support and binaries will be built until it goes out of support at the end of 2026.
-  Users of `x86_64-darwin` will receive an error message explaining how to switch to 26.05.
-
-  By the time of this release, Homebrew will offer only limited [Tier 3](https://docs.brew.sh/Support-Tiers#tier-3) support for the platform, but MacPorts will likely continue to support it for a long time.
-  We also recommend users consider installing NixOS, which should continue to run on essentially all Intel Macs, especially after Apple stops security support for macOS 26 in 2028.
-
-- `bundlerApp` now sets `__structuredAttrs = true` for its result package.
-  Out-of-tree packages passing `postBuild` to `bundlerApp` should examine if their `postBuild` commands are compatible with structured attributes.
-
-- `databricks-cli` has been updated from `0.290.2` to `1.x.x`, the first major release. OAuth tokens for interactive logins (`auth_type = databricks-cli`) are now stored in the OS-native secure store by default (Secret Service on Linux) instead of `~/.databricks/token-cache.json`; cached tokens from older versions are not migrated, so run `databricks auth login` once per profile after upgrading. To keep the previous file-backed storage, set `DATABRICKS_AUTH_STORAGE=plaintext` or add `auth_storage = plaintext` under `[__settings__]` in `~/.databrickscfg`. Additionally, the `vector_search_endpoints` DABs resource renamed `min_qps` to `target_qps` (and the `vector-search-endpoints` command renamed `--min-qps` to `--target-qps`). See the [upstream changelog](https://github.com/databricks/cli/blob/main/CHANGELOG.md) for details.
-
-- `hurl` has been updated to `8.x.x` which has some breaking changes. See [upstream changelog](https://github.com/Orange-OpenSource/hurl/releases/tag/8.0.0) for details.
-
-- `gotosocial` has been updated to 0.22.0. This release contains a very long database migration, which should not be cancelled or interrupted under any circumstances.
- -  Postgres users: Following the migration, if you encounter slowdown on Postgres specifically (ie., timing out while loading timelines) you may need to run some manual database maintenance steps. Please check https://docs.gotosocial.org/en/stable/admin/database_maintenance/#postgres.
-
-- `xsecurelock` no longer supports authentication via htaccess files (`~/.xsecurelock.pw`) or via the `pamtester` program by default. Only the recommended PAM module is supported unless rebuilt with `withHtaccess` or `withPamtester`.
-
-- `python3Packages.django-health-check` has been updated to major version 4. See its [migration guide](https://codingjoe.dev/django-health-check/migrate-to-v4/) and [changelog](https://github.com/codingjoe/django-health-check/releases/tag/4.0.0) for breaking changes.
-
-- `jmtpfs` has been removed due to lack of maintenance and fuse3 support.
-
-- `libgdata` has been removed, as it was archived upstream and relied on the insecure libsoup 2.4.
-
-- `mcphost` has been removed, as it was archived upstream and declared unmaintained.
-
-- `fflogs` has been removed because it was no longer functional. Users should switch to `archon-lite`.
-
-- `services.mysql` now sets `root@localhost` authentication to `auth_socket` when used with `mysql` or `percona-server`.
-  Existing deployments will also be adjusted if possible. See the [security advisory GHSA-6qxx-6rg8-c4p8](https://github.com/NixOS/nixpkgs/security/advisories/GHSA-6qxx-6rg8-c4p8) for more information.
-
-- `zerofs` has been updated from `1.x` to `2.x` which is a breaking change. Volumes created by earlier releases are refused at open with a clear error. There is no migration tool; older volumes remain readable and writable by the release that created them.
-
-- `keycloak.plugins.keycloak-metrics-spi` has been removed. Keycloak exposes Prometheus metrics natively on its management interface; enable them with the `metrics-enabled` setting (and `event-metrics-user-enabled` for login and event counters). See [Gaining insights with metrics](https://www.keycloak.org/observability/configuration-metrics).
-
-- `alps` has been rewritten upstream, see [upstream repository](https://github.com/migadu/alps) for documentation.
-
-- `uhttpmock` providing 0.0 ABI was removed. `uhttpmock_1_0` providing 1.0 ABI was renamed to `uhttpmock` and `uhttpmock_1_0` was kept as an alias.
-
-- `nix-serve-ng` (and `haskellPackages.nix-serve-ng`) is now built against Lix instead of CppNix, following upstream which has switched to Lix as its supported Nix implementation.
-
-- Linux kernel configuration has been moved out of the `linux-kernel` field of the platform structure into the kernel builders:
-  - `linux-kernel.name` has been removed.
-  - `linux-kernel.target` is available as the `target` parameter and passthru attribute on the kernel builders.
-  - `linux-kernel.installTarget` has been removed, as it should not be necessary to customize.
-  - `linux-kernel.DTB` is available as the `buildDTBs` parameter and passthru attribute on the kernel builders.
-  - `linux-kernel.{autoModules,preferBuiltin,extraConfig}` were already available as kernel builder parameters.
-
-- The `img` argument of `vmTools` has been renamed to `kernelImage`, as it collided with the top-level `img` package.
-  Additionally, the kernel module tree used inside the VM has been split out of the `kernel` argument into a new `kernelModules` argument (defaulting to `kernel`).
-  Callers that overrode `kernel` with a module tree (e.g. from `pkgs.aggregateModules`) to make extra modules available must now pass it via `kernelModules` instead, keeping `kernel` pointing at a bootable kernel derivation.
-
-- The ARMv5 Linux kernel build now uses a standard configuration and generates a standard compressed image instead of the deprecated legacy U‐Boot image format.
-  `lib.systems.{examples,platforms}.{sheevaplug,pogoplug4}` have been unified into `lib.systems.examples.armv5tel-multiplatform`.
-  Note that there is no official support for ARMv5 and it is not possible to build even a simple NixOS configuration out of the box.
-
-- `pdns` has been updated from `5.0.x` to `5.1.x`. Please be sure to review the [Upgrade Notes](https://doc.powerdns.com/authoritative/upgrading.html#to-5-1-0) before upgrading. Namely LUA record updates are no longer allowed by default, and the embedded webserver no longer includes a `access-control-allow-origin: *` header by default.
-
-- Support for the legacy U‐Boot image format has been removed from the Linux kernel builders, as it is deprecated upstream and no longer used by any platform in Nixpkgs.
-
-- `etcd_3_4` package was dropped, as it's gone EOL. Please upgrade to either 3.5 or 3.6. See [migration notes](https://etcd.io/docs/v3.6/upgrades/upgrade_3_6/) for incompatibilities and upgrade procedure.
-
-- `rke2` retires ingress-nginx and transitions to Traefik starting in `rke2_1_36`. Because ingress-nginx was retired upstream as of March 2026, Traefik is now the default
-  for new clusters starting in v1.36 (existing clusters will keep their current ingress upon upgrade to avoid breakage). This transition brings the following structural changes:
-  - Airgapped Environments: The rke2-images-core tarball now contains Traefik images instead of ingress-nginx. The standalone rke2-images-traefik tarball has been removed.
-    Users who must continue using ingress-nginx will now need to manually provide the rke2-images-ingress-nginx tarball.
-  - Future Removal: The ingress-nginx chart will not receive any additional updates and will be completely removed in v1.37 for community users.
-
-- `buildFHSEnvChroot` has been removed after deprecation in 23.05.
-
-- `gh-actions-cache` has been removed since its functionality has been integrated directly into `gh` (`gh cache`). See [upstream readme](https://github.com/actions/gh-actions-cache).
-
-- `requireFile` now sets `meta.license = lib.licenses.unfree` by default. Users of `requireFile`-based derivations that preserve this default will need to explicitly allow their evaluation as described in [](#sec-allow-unfree).
-
-- `texlive.combine` is deprecated and scheduled for removal in 27.05. Please migrate to `texliveSmall.withPackages` (see [](#sec-language-texlive-user-guide)).
-
-- `keycloak` was updated to >= 26.7.0 and includes some breaking internal (API) changes. See the [upstream migration guide](https://www.keycloak.org/docs/latest/upgrading/#migrating-to-26-7-0) for more information.
-
-- `librest` providing 0.7 ABI was removed. `librest_1_0` providing 1.0 ABI was renamed to `librest` and `librest_1_0` was kept as an alias.
-
-- `pnpm_10` was upgraded to version 10.34.1+, which introduced stricter integrity checks. If you encounter `ERR_PNPM_MISSING_TARBALL_INTEGRITY`, you can fall back to the older `pnpm_10_34_0`.
-
-- `fetchPnpmDeps`' `fetcherVersion = 1` and `fetcherVersion = 2` have been
-  removed, as announced in the 26.05 release. Packages still using them now
-  throw an evaluation error and must migrate to `fetcherVersion = 3` (or later)
-  and regenerate their hashes. See the
-  [pnpm `fetcherVersion` section](#javascript-pnpm-fetcherVersion) of the manual
-  for details.
-
-- `rebuilderd` has been updated to 0.27.0 introducing breaking changes. See upstream changelog for details: [0.26.0](https://github.com/kpcyrd/rebuilderd/releases/tag/v0.26.0), [0.27.0](https://github.com/kpcyrd/rebuilderd/releases/tag/v0.27.0)
-
-- Starting with v14, `flameshot` will primarily utilise xdg-desktop-portal calls for screenshotting. This will directly affect users on X11 window managers due to the lack of a compatible portal with Screenshot feature. See [upstream changelog](https://github.com/flameshot-org/flameshot/releases/tag/v14.0.0) or [NixOS Flameshot](https://wiki.nixos.org/wiki/Flameshot) wiki page for workarounds.
-- `nim1` and respective aliases have been removed due to entering EOL; please migrate to `nim` or `nim-unwrapped` (nim 2).
-- `nim-2_0` & `nim-2_2` and respective aliases have been removed; please migrate to `nim` or `nim-unwrapped` (nim 2.2.10).
-- `domoticz` has been updated from `2024.7` to `2026.x`, breaking third party applications and scripts using the old RType calls. Review the [release notes](https://github.com/domoticz/domoticz/blob/2026.2/History.txt#L398) for more information.
-
-- `vimacs` has been removed, as it has not been maintained in 10 years and was built for an old version of vim (6.0).
+- Create the first release note entry in this section!
 
 ## Other Notable Changes {#sec-nixpkgs-release-26.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- `super-productivity` has been updated. The binary has been renamed from `super-productivity` to `superproductivity`. A symlink from the old name is provided for backward compatibility.
-
-- Package-URL (PURL, https://github.com/package-url/purl-spec) metadata identifier has been added for `fetchgit`, `fetchpypi` and `fetchFromGithub` fetchers.
-  `mkDerivation` has been adjusted to reuse this information.
-  Package-URLs allow reliably identifying and locating software packages.
-  Maintainers of derivations using the adapted fetchers should rely on the `drv.src.meta.identifiers.v1.purl` default identifier and can enhance their `drv.meta.identifiers.v1.purls` list once they would like to have additional identifiers.
-  Maintainers using `fetchurl` for `drv.src` are urged to adapt their `drv.meta.identifiers.purlParts` for proper identification.
-
-- Emacs loads the `early-default` library after `early-init.el`.
-  Users can add `early-init.el` via `emacs.pkgs.withPackages`
-  by packaging `early-init.el` into a library named `early-default`.
-  To prevent loading the `early-default` library,
-  set `inhibit-early-default-init` in `early-init.el`.
-
-- `services.ceph` enabled the generation of Ceph log files at `/var/log/ceph/`.
-  They were missing before because Ceph omitted logs when this directory was missing.
-  Ceph logs can grow large, so you may want to configure rotation of these logs.
+- Create the first release note entry in this section!
 
 ## Nixpkgs Library {#sec-nixpkgs-release-26.11-lib}
 
@@ -151,15 +24,15 @@
 
 ### Breaking changes {#sec-nixpkgs-release-26.11-lib-breaking}
 
-- `fittrackee` 1.0.0 now requires postgres with postgis. The [upgrade guide](https://docs.fittrackee.org/en/upgrading-to-1.0.0.html) has steps to prepare for this upgrade.
+- Create the first release note entry in this section!
+
 
 ### Deprecations {#sec-nixpkgs-release-26.11-lib-deprecations}
 
-- Setting `config.allowBrokenPredicate` is deprecated in favor of
-  using `config.problems.handlers.PackageName.broken = "warn"` (or `=
-  "ignore"`). For more information see [](#sec-allow-broken).
+- Create the first release note entry in this section!
 
 
 ### Additions and Improvements {#sec-nixpkgs-release-26.11-lib-additions-improvements}
 
 - Create the first release note entry in this section!
+

doc/stdenv/cross-compilation.chapter.md

@@ -50,7 +50,7 @@ The exact schema these fields follow is a bit ill-defined due to a long and conv
 
 `system`
 
-: This is a two-component shorthand for the platform. Examples of this would be "aarch64-darwin" and "i686-linux"; see `lib.systems.doubles` for more. The first component corresponds to the CPU architecture of the platform and the second to the operating system of the platform (`[cpu]-[os]`). This format has built-in support in Nix, such as the `builtins.currentSystem` impure string.
+: This is a two-component shorthand for the platform. Examples of this would be "x86_64-darwin" and "i686-linux"; see `lib.systems.doubles` for more. The first component corresponds to the CPU architecture of the platform and the second to the operating system of the platform (`[cpu]-[os]`). This format has built-in support in Nix, such as the `builtins.currentSystem` impure string.
 
 `config`
 

doc/stdenv/meta.chapter.md

@@ -77,7 +77,7 @@ A link or a list of links to the location of Changelog for a package. A link may
 
 ### `license` {#var-meta-license}
 
-The license, or licenses, for the package. One from the attribute set defined in [`nixpkgs/lib/licenses/licenses.nix`](https://github.com/NixOS/nixpkgs/blob/master/lib/licenses/licenses.nix). At this moment using both a list of licenses and a single license is valid. If the license field is in the form of a list representation, then it means that parts of the package are licensed differently. Each license should preferably be referenced by their attribute. The non-list attribute value can also be a space delimited string representation of the contained attribute `shortNames` or `spdxIds`. The following are all valid examples:
+The license, or licenses, for the package. One from the attribute set defined in [`nixpkgs/lib/licenses.nix`](https://github.com/NixOS/nixpkgs/blob/master/lib/licenses.nix). At this moment using both a list of licenses and a single license is valid. If the license field is in the form of a list representation, then it means that parts of the package are licensed differently. Each license should preferably be referenced by their attribute. The non-list attribute value can also be a space delimited string representation of the contained attribute `shortNames` or `spdxIds`. The following are all valid examples:
 
 - Single license referenced by attribute (preferred) `lib.licenses.gpl3Only`.
 - Single license referenced by its attribute shortName (frowned upon) `"gpl3Only"`.
@@ -157,8 +157,6 @@ The list of Nix platform types for which the [Hydra](https://github.com/nixos/hy
 }
 ```
 
-Note that this does not affect whether reverse dependencies of the package are built on Hydra.
-
 ### `broken` {#var-meta-broken}
 
 If set to `true`, the package is marked as "broken", meaning that it won’t show up in [search.nixos.org](https://search.nixos.org/packages), and cannot be built or installed unless [explicitly allowed](#sec-allow-broken).
@@ -216,7 +214,7 @@ If this list is not empty, the package is marked as "insecure", meaning that it
 
 ## Licenses {#sec-meta-license}
 
-The `meta.license` attribute should preferably contain a value from `lib.licenses` defined in [`nixpkgs/lib/licenses/licenses.nix`](https://github.com/NixOS/nixpkgs/blob/master/lib/licenses/licenses.nix), or in-place license description of the same format if the license is unlikely to be useful in another expression.
+The `meta.license` attribute should preferably contain a value from `lib.licenses` defined in [`nixpkgs/lib/licenses.nix`](https://github.com/NixOS/nixpkgs/blob/master/lib/licenses.nix), or in-place license description of the same format if the license is unlikely to be useful in another expression.
 
 Although it’s typically better to indicate the specific license, a few generic options are available:
 
@@ -342,30 +340,3 @@ A readonly attribute that concatenates all CPE parts in one string.
 #### `meta.identifiers.possibleCPEs` {#var-meta-identifiers-possibleCPEs}
 
 A readonly attribute containing the list of guesses for what CPE for this package can look like. It includes all variants of version handling mentioned above. Each item is an attrset with attributes `cpeParts` and `cpe` for each guess.
-
-### Package URL {#sec-meta-identifiers-purl}
-
-[Package-URL](https://github.com/package-url/purl-spec) (PURL) is a specification to reliably identify and locate software packages.
-Through identification of software packages, additional (non-major) use cases are e.g. software license cross-verification via third party databases or initial vulnerability response management.
-Package-URLs shall default to the `mkDerivation.src`, as the original consumed software package is the single source of truth.
-
-#### `meta.identifiers.purlParts` {#var-meta-identifiers-purlParts}
-
-This attribute contains an attribute set of all parts of the PURL for this package.
-
-* `type` mandatory [type](https://github.com/package-url/purl-spec/blob/18fd3e395dda53c00bc8b11fe481666dc7b3807a/docs/standard/summary.md) which needs to be provided
-* `spec` specify the PURL in accordance with the [purl-spec](https://github.com/package-url/purl-spec/blob/18fd3e395dda53c00bc8b11fe481666dc7b3807a/purl-specification.md)
-
-#### `meta.identifiers.purl` {#var-meta-identifiers-purl}
-
-An extendable attribute which is built based on `purlParts`.
-This is the main identifier of the software package.
-For handling edge cases, consider using the list interface [`meta.identifiers.purls`](#var-meta-identifiers-purls).
-
-#### `meta.identifiers.purls` {#var-meta-identifiers-purls}
-
-An extendable list attribute which defaults to a single element equal to [`meta.identifiers.purl`](#var-meta-identifiers-purl).
-It provides an interface for additional identifiers of `mkDerivation.src` or for identifiers of vendored dependencies inside `mkDerivation.src`, which maintainers may carefully consider to specify as well.
-
-Additional identifiers are generally not recommended, as they might cause maintenance overhead or diverge.
-For example, a source distribution `pkg:github` may be hard to keep correctly aligned with the corresponding binary distribution `pkg:pypi`.

doc/stdenv/stdenv.chapter.md

@@ -776,7 +776,7 @@ By default, the flag `--disable-dependency-tracking` is added to the configure f
 
 ##### `dontFixLibtool` {#var-stdenv-dontFixLibtool}
 
-By default, the configure phase applies some special hackery to all files called `ltmain.sh` before running the configure script to improve the purity of Libtool-based packages [^footnote-stdenv-sys-lib-search-path] . If this is undesirable, set this variable to true.
+By default, the configure phase applies some special hackery to all files called `ltmain.sh` before running the configure script in order to improve the purity of Libtool-based packages [^footnote-stdenv-sys-lib-search-path] . If this is undesirable, set this variable to true.
 
 ##### `dontDisableStatic` {#var-stdenv-dontDisableStatic}
 
@@ -939,7 +939,7 @@ The fixup phase performs (Nix-specific) post-processing actions on the files ins
 
 - It moves the `man/`, `doc/` and `info/` subdirectories of `$out` to `share/`.
 - It strips libraries and executables of debug information.
-- On Linux, it applies the `patchelf` command to ELF executables and libraries to remove unused directories from the `RPATH` to prevent unnecessary runtime dependencies.
+- On Linux, it applies the `patchelf` command to ELF executables and libraries to remove unused directories from the `RPATH` in order to prevent unnecessary runtime dependencies.
 - It rewrites the interpreter paths of shell scripts to paths found in `PATH`. E.g., `/usr/bin/perl` will be rewritten to `/nix/store/some-perl/bin/perl` found in `PATH`. See [](#patch-shebangs.sh) for details.
 
 #### Variables controlling the fixup phase {#variables-controlling-the-fixup-phase}
@@ -1345,7 +1345,7 @@ $ echo $configureFlags
 
 Nix itself considers a build-time dependency as merely something that should previously be built and accessible at build time—packages themselves are on their own to perform any additional setup. In most cases, that is fine, and the downstream derivation can deal with its own dependencies. But for a few common tasks, that would result in almost every package doing the same sort of setup work—depending not on the package itself, but entirely on which dependencies were used.
 
-To alleviate this burden, the setup hook mechanism was written, where any package can include a shell script that \[by convention rather than enforcement by Nix\], any downstream reverse-dependency will source as part of its build process. That allows the downstream dependency to merely specify its dependencies, and lets those dependencies effectively initialize themselves. No boilerplate mirroring the list of dependencies is needed.
+In order to alleviate this burden, the setup hook mechanism was written, where any package can include a shell script that \[by convention rather than enforcement by Nix\], any downstream reverse-dependency will source as part of its build process. That allows the downstream dependency to merely specify its dependencies, and lets those dependencies effectively initialize themselves. No boilerplate mirroring the list of dependencies is needed.
 
 The setup hook mechanism is a bit of a sledgehammer though: a powerful feature with a broad and indiscriminate area of effect. The combination of its power and implicit use may be expedient, but isn’t without costs. Nix itself is unchanged, but the spirit of added dependencies being effect-free is violated even if the latter isn’t. For example, if a derivation path is mentioned more than once, Nix itself doesn’t care and makes sure the dependency derivation is already built just the same—depending is just needing something to exist, and needing is idempotent. However, a dependency specified twice will have its setup hook run twice, and that could easily change the build environment (though a well-written setup hook will therefore strive to be idempotent so this is in fact not observable). More broadly, setup hooks are anti-modular in that multiple dependencies, whether the same or different, should not interfere and yet their setup hooks may well do so.
 

doc/style.css

@@ -23,17 +23,21 @@ body {
 @media screen and (min-width: 992px) {
   .book,
   .appendix {
-    max-width: 55rem;
+    max-width: 60rem;
   }
 }
 
 @media screen and (min-width: 1200px) {
   .book,
   .appendix {
-    max-width: 55rem;
+    max-width: 73rem;
   }
 }
 
+.book .list-of-examples {
+  display: none;
+}
+
 h1 {
   font-size: 2em;
   margin: 0.67em 0;
@@ -114,7 +118,7 @@ html {
 body {
   font-size: 1rem;
   font-family: "Roboto", sans-serif;
-  font-weight: 400;
+  font-weight: 300;
   color: var(--main-text-color);
   background-color: var(--background);
   min-height: 100vh;
@@ -127,36 +131,11 @@ body {
     padding-left: 1rem;
     padding-right: 1rem;
   }
-
-  /*
-  See: https://developer.mozilla.org/en-US/docs/Web/API/Popover_API
-
-  - :popover-open pseudo-class matches a popover element when it is in the showing state
-  - ::backdrop full-screen element placed directly behind popover
-  */
-  nav.toc-sidebar:popover-open {
-    position: fixed;
-    inset: 0 auto 0 0;
-    width: min(20rem, 85vw);
-    height: 100dvh;
-    max-height: none;
-    margin: 0;
-    padding: 1rem;
-    overflow-y: auto;
-    overscroll-behavior: contain;
-    background: var(--background);
-    border: 0;
-    border-right: 0.0625rem solid #d8d8d8;
-    box-shadow: 0 0 1.5rem rgb(0 0 0 / 0.35);
-  }
-
-  nav.toc-sidebar::backdrop {
-    background: rgb(0 0 0 / 0.5);
-  }
 }
 
 a {
-  text-decoration: underline;
+  text-decoration: none;
+  border-bottom: 1px solid;
   color: var(--link-color);
 }
 
@@ -183,52 +162,63 @@ hr {
   margin-bottom: 1rem;
 }
 
-h1,
-h2,
-h3,
-h4,
-h5,
-h6 {
-  font-weight: 800;
-  line-height: 1.1;
-  margin: 1.5rem 0 0.5rem;
-}
-
-/*
-  Major-second scale see: https://typescale.com/
-  rounded to .025rem (0.4px)
-*/
 h1 {
-  font-size: 2rem;
+  font-weight: 800;
+  line-height: 110%;
+  font-size: 200%;
+  margin-bottom: 1rem;
   color: var(--heading-color);
 }
 
 h2 {
-  font-size: 1.8rem;
+  font-weight: 800;
+  line-height: 110%;
+  font-size: 170%;
+  margin-bottom: 0.625rem;
   color: var(--heading-color);
 }
 
+h2:not(:first-child) {
+  margin-top: 1rem;
+}
+
 h3 {
-  font-size: 1.6rem;
+  font-weight: 800;
+  line-height: 110%;
+  margin-bottom: 1rem;
+  font-size: 150%;
   color: var(--heading-color);
 }
 
+.note h3,
+.tip h3,
+.warning h3,
+.caution h3,
+.important h3 {
+  font-size: 120%;
+}
+
 h4 {
-  font-size: 1.425rem;
+  font-weight: 800;
+  line-height: 110%;
+  margin-bottom: 1rem;
+  font-size: 140%;
   color: var(--heading-color);
 }
 
 h5 {
-  font-size: 1.275rem;
+  font-weight: 800;
+  line-height: 110%;
+  margin-bottom: 1rem;
+  font-size: 130%;
   color: var(--small-heading-color);
 }
 
 h6 {
-  font-size: 1.125rem;
-}
-
-:is(.note, .tip, .warning, .caution, .important) h3 {
-  font-size: 1.425rem;
+  font-weight: 800;
+  line-height: 110%;
+  margin-bottom: 1rem;
+  font-size: 120%;
 }
 
 strong {
@@ -256,9 +246,13 @@ code {
 }
 
 code {
-  padding: 0.2em 0.4em;
-  background: var(--inline-code-background);
-  border-radius: 0.375rem;
+  color: #ff8657;
+  background: #f4f4f4;
+  display: inline-block;
+  padding: 0 0.5rem;
+  border: 1px solid #d8d8d8;
+  border-radius: 0.5rem;
+  line-height: 1.57777778;
 }
 
 div.book .programlisting,
@@ -270,7 +264,16 @@ div.appendix .programlisting {
   color: var(--codeblock-text-color);
 }
 
-:is(.note, .tip, .warning, .caution, .important) {
+div.book .note,
+div.book .tip,
+div.book .warning,
+div.book .caution,
+div.book .important,
+div.appendix .note,
+div.appendix .tip,
+div.appendix .warning,
+div.appendix .caution,
+div.appendix .important {
   margin-bottom: 1rem;
   border-radius: 0.5rem;
   padding: 1.5rem;
@@ -278,44 +281,69 @@ div.appendix .programlisting {
   background: #f4f4f4;
 }
 
-:is(.note, .tip, .warning, .caution, .important) > .title {
+div.book .note > .title,
+div.book .tip > .title,
+div.book .warning > .title,
+div.book .caution > .title,
+div.book .important > .title,
+div.appendix .note > .title,
+div.appendix .tip > .title,
+div.appendix .warning > .title,
+div.appendix .caution > .title,
+div.appendix .important > .title {
   font-weight: 800;
   line-height: 110%;
   color: inherit;
   margin-bottom: 0;
 }
 
-:is(.note, .tip, .warning, .caution, .important) > :first-child {
+div.book .note > :first-child,
+div.book .tip > :first-child,
+div.book .warning > :first-child,
+div.book .caution > :first-child,
+div.book .important > :first-child,
+div.appendix .note > :first-child,
+div.appendix .tip > :first-child,
+div.appendix .warning > :first-child,
+div.appendix .caution > :first-child,
+div.appendix .important > :first-child {
   margin-top: 0;
 }
 
-:is(.note, .tip, .warning, .caution, .important) > :last-child {
+div.book .note > :last-child,
+div.book .tip > :last-child,
+div.book .warning > :last-child,
+div.book .caution > :last-child,
+div.book .important > :last-child,
+div.appendix .note > :last-child,
+div.appendix .tip > :last-child,
+div.appendix .warning > :last-child,
+div.appendix .caution > :last-child,
+div.appendix .important > :last-child {
   margin-bottom: 0;
 }
 
-.note {
+div.book .note,
+div.book .tip,
+div.book .important,
+div.appendix .note,
+div.appendix .tip,
+div.appendix .important {
   color: var(--note-text-color);
   background: var(--note-background);
 }
 
-.tip {
-  color: var(--tip-text-color);
-  background: var(--tip-background);
-}
-
-.important {
-  color: var(--important-text-color);
-  background: var(--important-background);
-}
-
-.warning {
+div.book .warning,
+div.book .caution,
+div.appendix .warning,
+div.appendix .caution {
   color: var(--warning-text-color);
-  background: var(--warning-background);
+  background-color: var(--warning-background);
 }
 
-.caution {
-  color: var(--caution-text-color);
-  background: var(--caution-background);
+div.book .section,
+div.appendix .section {
+  margin-top: 2em;
 }
 
 div.book div.example,
@@ -359,13 +387,39 @@ div.appendix dt {
   margin-top: 1em;
 }
 
+div.book .toc dt,
+div.appendix .toc dt {
+  margin-top: 0;
+}
+
+div.book .list-of-examples dt,
+div.appendix .list-of-examples dt {
+  margin-top: 0;
+}
+
 div.book code,
 div.appendix code {
+  padding: 0;
+  border: 0;
+  background-color: inherit;
+  color: inherit;
+  font-size: 100%;
   -webkit-hyphens: none;
   -moz-hyphens: none;
   hyphens: none;
 }
 
+div.book div.toc,
+div.appendix div.toc {
+  margin-bottom: 3em;
+  border-bottom: 0.0625rem solid #d8d8d8;
+}
+
+div.book div.toc dd,
+div.appendix div.toc dd {
+  margin-left: 2em;
+}
+
 div.book span.command,
 div.appendix span.command {
   font-family: monospace;
@@ -396,31 +450,17 @@ div.appendix .variablelist .term {
 }
 
 :root {
-  --sidebar-width: 20rem;
-  --header-height: 3rem;
   --background: #fff;
   --main-text-color: #000;
   --link-color: #405d99;
   --heading-color: #6586c8;
   --small-heading-color: #6a6a6a;
-  /* NOTE */
-  --note-text-color: #0065d2;
-  --note-background: #e4f5ff;
-  /* TIP */
-  --tip-text-color: #188000;
-  --tip-background: #e8fae3;
-  /* IMPORTANT */
-  --important-text-color: #8a3db8;
-  --important-background: #fbedff;
-  /* WARNING */
-  --warning-text-color: #aa4a00;
-  --warning-background: #fff0db;
-  /* CAUTION */
-  --caution-text-color: #be222a;
-  --caution-background: #ffebe8;
+  --note-text-color: #5277c3;
+  --note-background: #f2f8fd;
+  --warning-text-color: #cc3900;
+  --warning-background: #fff5e1;
   --codeblock-background: #f2f8fd;
   --codeblock-text-color: #000;
-  --inline-code-background: #818b981f;
 }
 
 @media (prefers-color-scheme: dark) {
@@ -429,27 +469,20 @@ div.appendix .variablelist .term {
     --main-text-color: #fff;
     --link-color: #6586c8;
     --small-heading-color: #fff;
-    /* NOTE */
-    --note-text-color: #66c6ff;
-    --note-background: #1e2f44;
-    /* TIP */
-    --tip-text-color: #80e05f;
-    --tip-background: #22331d;
-    /* IMPORTANT */
-    --important-text-color: #ea9dff;
-    --important-background: #35273f;
-    /* WARNING */
-    --warning-text-color: #ffaa00;
-    --warning-background: #3c2a13;
-    /* CAUTION */
-    --caution-text-color: #ff8c84;
-    --caution-background: #422522;
+    --note-background: none;
+    --warning-background: none;
     --codeblock-background: #393939;
     --codeblock-text-color: #fff;
-    --inline-code-background: #656c7633;
   }
 
-  :is(.note, .tip, .warning, .caution, .important) {
+  div.book .note,
+  div.book .tip,
+  div.appendix .note,
+  div.appendix .tip,
+  div.book .warning,
+  div.book .caution,
+  div.appendix .warning,
+  div.appendix .caution {
     border: 2px solid;
     font-weight: 400;
   }
@@ -457,241 +490,9 @@ div.appendix .variablelist .term {
 
 @font-face {
   font-family: Roboto;
-  src:
-    url(Roboto.ttf) format("truetype") tech(variations),
-    url(Roboto.ttf) format("truetype-variations");
-  font-weight: 100 900;
-  font-style: normal;
-  font-display: swap;
+  src: url(Roboto.ttf);
 }
 
 .chapter {
   content-visibility: auto;
 }
-
-.navheader {
-  position: sticky;
-  top: 0;
-  z-index: 1;
-  background-color: var(--background);
-}
-
-nav.toc-sidebar {
-  height: 100%;
-  padding: 0 1rem 2rem;
-  background-color: var(--background);
-  color: var(--main-text-color);
-}
-
-/* menu button, shown on mobile, hidden on desktop */
-.toc-toggle {
-  display: inline-flex;
-  align-items: center;
-  margin: 0.75rem 0 0;
-  padding: 0.4rem 0.8rem;
-  border: 0.0625rem solid #d8d8d8;
-  border-radius: 0.25rem;
-  background: var(--background);
-  color: var(--main-text-color);
-  font: inherit;
-  cursor: pointer;
-  position: fixed;
-  top: 0.5rem;
-  left: 0.8rem;
-  z-index: 2;
-}
-
-nav.toc-sidebar .toc {
-  margin-bottom: 0;
-}
-
-nav.toc-sidebar ol.toc,
-nav.toc-sidebar ol.toc ol {
-  list-style: none;
-  margin: 0;
-  padding-left: 0;
-}
-
-nav.toc-sidebar ol.toc ol {
-  padding-left: 1em;
-}
-
-nav.toc-sidebar li {
-  margin: 0;
-}
-
-nav.toc-sidebar summary {
-  cursor: pointer;
-  display: flex;
-  align-items: center;
-  list-style: none;
-}
-
-nav.toc-sidebar summary::before {
-  content: "▸";
-  flex: none;
-  font-size: 0.75em;
-}
-nav.toc-sidebar details[open] > summary::before {
-  content: "▾";
-}
-
-nav.toc-sidebar a {
-  display: block;
-  width: 100%;
-  padding: 3px 8px;
-  border-left: 3px solid transparent;
-  border-radius: 3px;
-  color: inherit;
-  transition:
-    background-color 120ms ease,
-    border-color 120ms ease;
-}
-nav.toc-sidebar a:hover {
-  background-color: #f2f2f2 !important;
-}
-
-nav.toc-sidebar a.active {
-  background-color: #d8d8d8;
-  border-left-color: #444;
-  font-weight: 600;
-}
-nav.toc-sidebar a.active-trail {
-  border-left-color: #bbb;
-  background-color: #e8e8e8;
-}
-
-@media (prefers-color-scheme: dark) {
-  nav.toc-sidebar a:hover {
-    /* hover should win over scroll selectors despite beeing less specific */
-    background-color: #606060 !important;
-  }
-  nav.toc-sidebar a.active {
-    background-color: #373737;
-    border-left-color: #eee;
-    font-weight: 600;
-  }
-  nav.toc-sidebar a.active-trail {
-    border-left-color: #eee;
-    background-color: #323232;
-  }
-}
-
-@media screen and (min-width: 768px) {
-  body {
-    height: 100vh;
-    min-height: 0;
-    display: grid;
-    grid-template-columns: minmax(0, 1fr);
-    grid-template-rows: var(--header-height) auto minmax(0, 1fr);
-  }
-
-  body:has(> nav.toc-sidebar) {
-    grid-template-columns: var(--sidebar-width) minmax(0, 1fr);
-  }
-
-  .navheader {
-    grid-column: 1 / -1;
-    grid-row: 2;
-  }
-
-  nav.toc-sidebar {
-    /* un-pop the drawer */
-    display: block;
-    position: static;
-    inset: auto;
-    /*  */
-    margin: 0;
-    grid-column: 1;
-    grid-row: 3;
-    max-height: none;
-    overflow-y: auto;
-    border: none;
-  }
-
-  /* Hide the toggle button on desktop */
-  .toc-toggle {
-    display: none;
-  }
-
-  main.content {
-    grid-column: 1 / -1;
-    grid-row: 3;
-    overflow-y: auto;
-    padding: 0 1rem;
-  }
-
-  body:has(> nav.toc-sidebar) main.content {
-    grid-column: 2;
-  }
-}
-
-.manual-header {
-  background-color: var(--background);
-  border-bottom: 0.0625rem solid #d8d8d8;
-  display: flex;
-  flex-direction: column;
-}
-
-.manual-header--title {
-  order: -1;
-  padding: 0.5rem 1rem 0;
-  font-size: 0.875rem;
-  font-weight: 500;
-  color: var(--small-heading-color);
-  text-align: center;
-}
-
-.manual-header--tabs {
-  display: flex;
-  align-items: stretch;
-  justify-content: space-around;
-  margin: 0;
-  padding: 0;
-}
-
-.manual-header--tab {
-  display: flex;
-  align-items: center;
-  padding: 0 1rem;
-  font-size: 0.875rem;
-  font-weight: 500;
-  color: var(--main-text-color);
-  text-decoration: none;
-  border-bottom: 0.1875rem solid transparent;
-  border-top: 0.1875rem solid transparent;
-  transition: border-bottom-color 0.15s ease;
-}
-
-.manual-header--tab:hover {
-  border-bottom-color: var(--heading-color);
-  color: var(--main-text-color);
-}
-
-.manual-header--tab-active {
-  border-bottom-color: var(--heading-color);
-  color: var(--heading-color);
-  font-weight: 700;
-}
-
-@media screen and (min-width: 768px) {
-  .manual-header {
-    height: var(--header-height);
-    flex-direction: row;
-    align-items: stretch;
-    grid-column: 1 / -1;
-    grid-row: 1;
-  }
-
-  .manual-header--title {
-    order: 0;
-    margin-left: auto;
-    padding: 0 1rem;
-    align-self: center;
-  }
-
-  .manual-header--tabs {
-    justify-content: flex-start;
-    padding: 0 1rem;
-  }
-}

doc/styleguide.md

@@ -1,420 +0,0 @@
-# Styleguide
-
-## Writing Principles
-
-A consistent style greatly increases the usability of all documentation and communication.
-
-Use this page as a reference and style guide for our internal and external documentation.
-
-### Knowledge Expectations
-
-**Assume competence, not familiarity.**
-
-Write for someone who knows a great deal — up to but not including this project.
-
-**What readers know:**
-
-- Basic computer operation
-- Command line familiarity
-- General interest in systems configuration
-
-**What readers don't know:**
-
-- NixOS-specific concepts
-- NixOS ecosystem details or grammar
-- NixOS workflows
-
-If specific knowledge is required, mention it at the start of the page.
-
-#### Show, Don't Tell
-
-The fastest path to understanding is a working example.
-People learn by doing, not by reading about doing.
-
-**Recommended structure:**
-
-- Start with the minimal working code or command
-- Briefly explain what it does
-- Cover edge cases or variations
-- Link to further information instead of including it
-
-#### Grammar and Style
-
-**Sentence structure:**
-
-- Use simple, direct sentences
-- Break complex ideas into multiple short sentences
-- Avoid nested clauses
-
-**Bad:**
-
-> The following command, which utilizes nixos-generate-config to produce a comprehensive hardware configuration, will write the results back into the respective configuration directory located on your local machine.
-
-What the user does is hidden in the middle.
-`nixos-generate-config` is a leaked implementation detail.
-Users care about *detecting hardware*, not *the tool that does it*.
-
-**Good:**
-
-> This command detects your hardware and saves the configuration.
-
-#### Content Organization
-
-Lead with value. State what the reader will accomplish before explaining how.
-
-**Bad:**
-
-> To create a new NixOS configuration that you can later use as a webserver, first navigate to your project directory, then add a new host configuration file with the desired machine name.
-
-**Good:**
-
-Add a webserver configuration to your NixOS setup:
-
-```nix
-# hosts/webserver/configuration.nix
-{ ... }:
-{
-  services.nginx.enable = true;
-}
-```
-
-Use **progressive disclosure**. Introduce concepts only when needed.
-
-**Recommended structure:**
-
-1. State the goal (one sentence)
-2. Show the simplest working example
-3. Explain concepts if needed
-4. Provide advanced options separately or link to the reference
-
-#### No Meta-commentary
-
-Don't describe what the documentation does. Just do it.
-
-**Don't:**
-
-> This section explains how to configure networking.
-> The following guide walks you through setting up a web server.
-
-**Do:**
-
-> Configure networking by setting:
-> Set up a web server:
-
-#### Code Examples
-
-**Keep examples focused:**
-
-- Show one concept at a time
-- Use realistic but simple scenarios
-- Avoid dependencies on other examples
-
-**Minimal comments**
-
-Let the code speak for itself.
-Paste code examples directly and without further alteration.
-
-**Bad:**
-
-```nix
-# This sets the hostname for the machine
-{
-  networking.hostName = "webserver"; # Change this to your machine's hostname
-  # This enables SSH access
-  services.openssh.enable = true; # Required for remote deployment
-}
-```
-
-**Good:**
-
-```nix
-{
-  networking.hostName = "webserver";
-  services.openssh.enable = true;
-}
-```
-
-#### Lead with Practical Examples
-
-Don't front-load theory. Readers want to accomplish something first, then understand why it works.
-
-- Show configuration as *what you want*, not *how the module system works*
-- Introduce Nix-specific concepts only when they are needed to complete the task
-- Defer language mechanics to reference pages or `nix.dev`
-
-**Bad:**
-
-> Before adding a service, you need to understand the NixOS module system and attribute set merging.
-
-**Good:**
-
-Enable nginx:
-
-```nix
-{ services.nginx.enable = true; }
-```
-
-This adds nginx to your system configuration. Rebuild to apply:
-
-```bash
-sudo nixos-rebuild switch
-```
-
-#### Teach Nix through examples, not theory
-
-
-Users learn the NixOS module system by seeing patterns first.
-
-- Start with a working example
-- Explanation follows the code
-- Link deeper concepts instead of inlining them
-- Link to `nix.dev` for optional learning
-
-#### General Rules
-
-- Abbreviate keys like `ssh-ed25519 AAAAC3NzaC…`
-- Abbreviate IP addresses like `192.168.XXX.XXX`
-- Variables are capitalized and start with `$`, e.g. `$YOUR_HOSTNAME`
-- Variables should be directly usable during copy-paste
-- Do **not** describe missing code parts (`#elided`, `#omitted`)
-- **Machine vs Host**: use "machine" for the NixOS system identity, "host" for the physical or virtual hardware
-
-#### Capitalization
-
-- GB / RAM / HDD
-- bootable USB drive
-- Wi-Fi / DHCP / DNS
-- macOS / NixOS / Nix / Linux
-- Flakes
-- git
-
-#### Headings
-
-Use sentence case. A reader scanning only headings should understand the page.
-
-**Don't:**
-
-> Getting Started
-> Overview
-> Configure The Database
-
-**Do:**
-
-> Set up a PostgreSQL database
-> Configure networking
-> Add a user to the system
-
-#### Imperative Mood, Voice, and Person
-
-Use imperative mood for instructions. Address the reader as "you", not "the user". Use active voice; in other words, make the subject do the action.
-
-**Don't:**
-
-> The user should run the following command.
-> The configuration will need to be updated.
-> The key is generated by the system.
-
-**Do:**
-
-> Run the command.
-> Update the configuration.
-> The system generates the key.
-
-#### Tense
-
-Use present tense for descriptions. Future tense makes documentation feel tentative.
-
-**Don't:**
-
-> This will create a new folder.
-> Running this command will install the package.
-
-**Do:**
-
-> This creates a new folder.
-> Running this command installs the package.
-
-#### Be Confident
-
-State facts. Don't hedge with "should," "might," "typically," or "usually" unless the behavior genuinely varies.
-
-**Don't:**
-
-> This should create the configuration file.
-> The service will usually start automatically.
-
-**Do:**
-
-> This creates the configuration file.
-> The service starts automatically.
-
-#### Avoid Nominalizations
-
-A nominalization is a verb turned into a noun, often by adding *-tion*, *-meant*, or *-ance* (e.g. "explanation", "selection"). The fix: find the hidden verb and use it directly.
-
-**Don't:**
-
-> Make a selection from the list.
-> Provide an explanation of the error.
-
-**Do:**
-
-> Select from the list.
-> Explain the error.
-
-#### Plain Words
-
-Technical precision for technical terms; plain language for everything else.
-
-- "use" not "utilize"
-- "start" not "initiate"
-- "end" not "terminate"
-- "help" not "facilitate"
-- "send" not "transmit"
-- "set up" not "establish"
-- "find out" not "ascertain"
-
-#### Filler Words and Weak Phrases
-
-Cut words and phrases that add length without meaning.
-
-Delete on sight:
-
-- "simply", "just", "easily", "basically", "obviously"
-- "in order to" → use "to"
-- "allows you to" → use the verb directly
-- "it's worth noting that" → just say the thing
-- no exclamation marks in technical prose
-
-**Don't:**
-
-> Simply run `nixos-rebuild switch`.
-> In order to deploy, you first need to run the command, which allows you to push the config.
-> It's worth noting that this requires root access.
-
-**Do:**
-
-> Run `nixos-rebuild switch`.
-> To deploy, run:
-> This requires root access.
-
-Every word must earn its place.
-
-#### Writing Procedures
-
-One instruction per sentence. Don't pack multiple actions into one sentence.
-
-**Don't:**
-
-> Navigate to your project directory and run the command, then check the output.
-
-**Do:**
-
-1. Navigate to your project directory.
-2. Run the command.
-3. Check the output.
-
-Don't bury the negative. Key limitations should be prominent, not a footnote after a positive description.
-
-**Don't:**
-
-> This service supports multiple roles, integrates with existing modules, and works great for most setups (note that multiple instances are not supported).
-
-**Do:**
-
-> This service does not support multiple instances.
-
-#### Consistent Terminology
-
-Pick a term and stick to it. Don't swap synonyms to avoid repetition. In technical documentation, repetition is clarity.
-
-**Don't:**
-
-> Create a machine... configure the host... deploy the node.
-
-**Do:**
-
-> Create a machine... configure the machine... deploy the machine.
-
-#### Links
-
-Use descriptive link text. Never use "click here" or "this link."
-
-**Don't:**
-
-> For more information, see `[this page](url)`.
-> Click `[here](url)` to read the reference.
-
-**Do:**
-
-> See the `[NixOS options reference](url)` for details.
-> Read the `[NixOS module system guide](url)`.
-
-Only link when the destination is directly relevant, not for generic background context (sometimes known as "Wikipedia-style links"). Readers feel obligated to click links, fearing they'll miss something important. Don't send them to a generic article about a technology when they're looking for how *your* system uses it.
-
-**Don't:**
-
-> Our software uses [SQLite](https://sqlite.org/) for storage.
-> *(Reader clicks expecting schema details — finds a generic product page instead.)*
-
-(Note that in the above example, the SQLite link is the SQLite home page, which is likely not pertinent.)
-
-**Do:**
-
-> See `[database schema](url)` for the full table structure.
-
-#### UI Language
-
-Match UI element names exactly: wording, casing, and spacing (even if a label seems oddly worded).
-
-**Don't:**
-
-> Click the generator button.
-> Select the save option.
-
-**Do:**
-
-> Click **Generate a Key**.
-> Click **Save Changes**.
-
-Someone will go looking for a button labeled "generator." They will not find it. They will be frustrated.
-
-Consistency between documentation and interface builds confidence. Words are part of the interface.
-
-:::{.tip}
-This can be tricky as UI changes; we don't yet have a policy in place for how to handle this. We welcome comments and suggestions.
-:::
-
-#### Clean system discipline
-
-Your machine has things new users don't: cached credentials, installed tools, environment variables, existing configuration. When writing or updating documentation:
-
-**Don't:**
-
-> Write steps from memory on your development machine, assuming what works there will work everywhere.
-
-**Do:**
-
-> - Start on a clean system — a fresh VM or new user account
-> - Take notes in real time as you work through the steps
-> - Document every warning, prompt, or unexpected output the system shows
-
-Also think in combinations: WSL vs native Linux, with and without existing keys. You don't need to test every matrix square — but you need to know which ones diverge.
-
-#### Never type code — always copy-paste
-
-Always copy commands and code from a terminal where you just ran them successfully. Never retype from memory.
-
-**Don't:**
-
-> Retype a command from memory into the documentation.
-> Retype code into a code-block from memory
-
-**Do:**
-
-> Paste commands directly from the shell or IDE.
-> Paste code that has been successfully validated with nix-instantiate or nix-build
-
-Replace sensitive values with placeholders: `<YOUR-KEY>`, `<YOUR-HOST>`, `<YOUR-TOKEN>`.
-
-Typed-from-memory commands introduce subtle errors. Even the most experienced software developers have occasional typos.

doc/using-nixpkgs.md

@@ -1,7 +1,6 @@
 # Using Nixpkgs {#part-using}
 
 ```{=include=} chapters
-channels.chapter.md
 using/platform-support.chapter.md
 using/configuration.chapter.md
 using/overlays.chapter.md

doc/using/configuration.chapter.md

@@ -152,7 +152,7 @@ There are several ways to tweak how Nix handles a package which has been marked
 
     Note that `allowlistedLicenses` only applies to unfree licenses unless `allowUnfree` is enabled. It is not a generic allowlist for all types of licenses. `blocklistedLicenses` applies to all licenses.
 
-A complete list of licenses can be found in the file [`nixpkgs/lib/licenses/licenses.nix`](https://github.com/NixOS/nixpkgs/blob/master/lib/licenses/licenses.nix) of the nixpkgs tree.
+A complete list of licenses can be found in the file `lib/licenses.nix` of the nixpkgs tree.
 
 ## Installing insecure packages {#sec-allow-insecure}
 

doc/using/platform-support.chapter.md

@@ -1,16 +1,16 @@
 # Platform Support {#chap-platform-support}
 
-Packages receive varying degrees of support, both in terms of maintainer and security team attention and available computation resources for continuous integration (CI). We have 7 defined tiers denoting how well supported each platform is.
+Packages receive varying degrees of support, both in terms of maintainer attention and available computation resources for continuous integration (CI). We have 7 defined tiers denoting how well supported each platform is.
 
 ## Tiers {#sec-platform-tiers}
 
 ### Tier 1 {#sec-platform-tier1}
 
-[Tier 1](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-1) platforms receive the highest level of support where problems can block updates, security fixes are treated with urgency, platform-specific patches are freely applied, and most packages are expected to work.
+[Tier 1](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-1) platforms receive the highest level of support where problems can block updates, platform-specific patches are freely applied, and most packages are expected to work.
 
 ### Tier 2 {#sec-platform-tier2}
 
-[Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) platforms are expected to remain functional and secure with updates, receive platform-specific patches as needed, and have many packages built by Hydra with full ofBorg support.
+[Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) platforms are expected to remain functional with updates, receive platform-specific patches as needed, and have many packages built by Hydra with full ofBorg support.
 
 ### Tier 3 {#sec-platform-tier3}
 
@@ -22,25 +22,28 @@ Platform Tiers [4 through 7](https://github.com/NixOS/rfcs/blob/master/rfcs/0046
 
 ## Breakdown {#sec-platform-breakdown}
 
-| Triple                                | Support Tier                                                                                   | Channel Blockers | Hydra Support | Security Support | Ofborg Support | Bootstrap Tarballs | Cross Compiling Support |
-|---------------------------------------|------------------------------------------------------------------------------------------------|------------------|---------------|------------------|----------------|--------------------|-------------------------|
-| `x86_64-unknown-linux-gnu`            | [Tier 1](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-1) | Many             | ✔️             | ✔️                | ✔️              | ✔️                  | ✔️                       |
-| `aarch64-unknown-linux-gnu`           | [Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) | Some             | ✔️             | ✔️                | ✔️              | ✔️                  | ✔️                       |
-| `x86_64-unknown-linux-musl`           | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | Limited       | ❌               | ❌             | ✔️                  | ✔️                       |
-| `aarch64-unknown-linux-musl`          | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | Limited       | ❌               | ❌             | ✔️                  | ✔️                       |
-| `x86_64-unknown-unknown-freebsd`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
-| `arm64-apple-darwin`                  | [Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) | Some             | ✔️             | ✔️                | ✔️              | ✔️                  | ❌                      |
-| `i686-unknown-linux-gnu`              | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | Limited       | ❌               | ❌             | ✔️                  | ✔️                       |
-| `riscv32-unknown-linux-gnu`           | [Tier 4](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-4) | None             | ❌            | ❌               | ❌             | ❌                 | ✔️                       |
-| `riscv64-unknown-linux-gnu`           | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
-| `loongarch64-unknown-linux-gnu`       | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
-| `armv6l-unknown-linux-gnueabihf`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
-| `armv6l-unknown-linux-musleabihf`     | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
-| `armv7l-unknown-linux-gnueabihf`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
-| `armv5tel-unknown-linux-gnueabi`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
-| `mips64el-unknown-linux-gnuabi64`     | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
-| `mips64el-unknown-linux-gnuabin32`    | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
-| `mipsel-unknown-linux-gnu`            | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
-| `powerpc64-unknown-linux-gnuabielfv2` | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
-| `powerpc64le-unknown-linux-gnu`       | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
-| `s390x-unknown-linux-gnu`             | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None             | ❌            | ❌               | ❌             | ✔️                  | ✔️                       |
+| Triple                                | Support Tier | Channel Blockers | Hydra Support | Ofborg Support | Bootstrap Tarballs | Cross Compiling Support |
+| ------------------------------------- | ------------ | ---------------- | ------------- | -------------- | ------------------ | ----------------------- |
+| `x86_64-unknown-linux-gnu`            | [Tier 1](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-1) | Many | ✔️            | ✔️            | ✔️                 | ✔️                      |
+| `aarch64-unknown-linux-gnu`           | [Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) | Some | ✔️            | ✔️            | ✔️                 | ✔️                      |
+| `x86_64-unknown-linux-musl`           | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | Limited        | ❌             | ✔️                 | ✔️                      |
+| `aarch64-unknown-linux-musl`          | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | Limited        | ❌             | ✔️                 | ✔️                      |
+| `x86_64-unknown-unknown-freebsd`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
+| `arm64-apple-darwin`                  | [Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) | Some | ✔️            | ✔️            | ✔️                 | ❌\*                     |
+| `x86_64-apple-darwin`                 | [Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) | Some | ✔️            | ✔️            | ✔️                 | ❌\*                     |
+| `i686-unknown-linux-gnu`              | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | Limited        | ❌             | ✔️                 | ✔️                      |
+| `riscv32-unknown-linux-gnu`           | [Tier 4](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-4) | None | ❌             | ❌             | ❌                  | ✔️                      |
+| `riscv64-unknown-linux-gnu`           | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
+| `loongarch64-unknown-linux-gnu`       | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
+| `armv6l-unknown-linux-gnueabihf`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
+| `armv6l-unknown-linux-musleabihf`     | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
+| `armv7l-unknown-linux-gnueabihf`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
+| `armv5tel-unknown-linux-gnueabi`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
+| `mips64el-unknown-linux-gnuabi64`     | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
+| `mips64el-unknown-linux-gnuabin32`    | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
+| `mipsel-unknown-linux-gnu`            | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
+| `powerpc64-unknown-linux-gnuabielfv2` | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
+| `powerpc64le-unknown-linux-gnu`       | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
+| `s390x-unknown-linux-gnu`             | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
+
+\* - Cross compiling is only supported on Darwin hosts.

flake.nix

@@ -220,25 +220,17 @@
         evaluation. Evaluating the attribute value tends to require a significant
         amount of computation, even considering lazy evaluation.
       */
-      legacyPackages =
-        let
-          # We include `x86_64-darwin` here to ensure that users get a
-          # good error message for the 26.11 deprecation of the platform,
-          # while excluding it from `lib.systems.flakeExposed` so that we
-          # don’t break `nix flake check` for downstream users.
-          forAllSystems' = lib.genAttrs (lib.systems.flakeExposed ++ [ "x86_64-darwin" ]);
-        in
-        forAllSystems' (
-          system:
-          (import ./. {
-            inherit system;
-            overlays = import ./pkgs/top-level/impure-overlays.nix ++ [
-              (final: prev: {
-                lib = prev.lib.extend libVersionInfoOverlay;
-              })
-            ];
-          })
-        );
+      legacyPackages = forAllSystems (
+        system:
+        (import ./. {
+          inherit system;
+          overlays = import ./pkgs/top-level/impure-overlays.nix ++ [
+            (final: prev: {
+              lib = prev.lib.extend libVersionInfoOverlay;
+            })
+          ];
+        })
+      );
 
       /**
         Optional modules that can be imported into a NixOS configuration.

lib/.version

@@ -1 +1 @@
-26.11
+26.05

lib/attrsets.nix

@@ -5,6 +5,7 @@
 
 let
   inherit (builtins) head length;
+  inherit (lib.trivial) mergeAttrs;
   inherit (lib.strings)
     concatStringsSep
     concatMapStringsSep
@@ -12,18 +13,16 @@ let
     sanitizeDerivationName
     ;
   inherit (lib.lists)
-    all
-    concatLists
+    filter
+    foldr
+    foldl'
     concatMap
     elemAt
-    filter
-    foldl
-    foldl'
-    foldr
-    groupBy
+    all
     partition
-    reverseList
+    groupBy
     take
+    foldl
     ;
 in
 
@@ -371,11 +370,7 @@ rec {
 
     :::
   */
-  concatMapAttrs =
-    f: v:
-    listToAttrs (
-      concatLists (reverseList (mapAttrsToList (name: value: attrsToList (f name value)) v))
-    );
+  concatMapAttrs = f: v: foldl' mergeAttrs { } (attrValues (mapAttrs f v));
 
   /**
     Update or set specific paths of an attribute set.
@@ -1140,7 +1135,7 @@ rec {
 
     For a function that gives you control over what counts as a leaf, see `mapAttrsRecursiveCond`.
 
-    ::: {.example #map-attrs-recursive-example}
+    :::{#map-attrs-recursive-example .example}
     # Map over leaf attributes
 
     ```nix
@@ -1165,7 +1160,7 @@ rec {
     If the predicate returns false, `mapAttrsRecursiveCond` does not recurse, but instead applies the mapping function.
     If the predicate returns true, it does recurse, and does not apply the mapping function.
 
-    ::: {.example #map-attrs-recursive-cond-example}
+    :::{#map-attrs-recursive-cond-example .example}
     # Map over an leaf attributes defined by a condition
 
     Map derivations to their `name` attribute.
@@ -1617,15 +1612,13 @@ rec {
       binaryMerge =
         start: end:
         # assert start < end; # Invariant
-        if end - start == 1 then
-          # Base case - there will be exactly 1 element due to the invariant, in
-          # which case we just return it directly
-          elemAt list start
-        else
+        if end - start >= 2 then
           # If there's at least 2 elements, split the range in two, recurse on each part and merge the result
-          # Relies on floor for odd results
           # The invariant is satisfied because each half will have at least 1 element
-          binaryMerge start ((start + end) / 2) // binaryMerge ((start + end) / 2) end;
+          binaryMerge start (start + (end - start) / 2) // binaryMerge (start + (end - start) / 2) end
+        else
+          # Otherwise there will be exactly 1 element due to the invariant, in which case we just return it directly
+          elemAt list start;
     in
     if list == [ ] then
       # Calling binaryMerge as below would not satisfy its invariant
@@ -1805,28 +1798,22 @@ rec {
     :::
   */
   matchAttrs =
-    let
-      recurse =
-        pattern: attrs:
-        all (
-          # Compare equality between `pattern` & `attrs`.
-          attr:
-          # Missing attr, not equal.
-          attrs ? ${attr}
-          && (
-            let
-              lhs = pattern.${attr};
-              rhs = attrs.${attr};
-            in
-            # Simple equality check is primarily for non-attrsets, but we run it
-            # on attrsets too, since it may let us avoid recursing
-            lhs == rhs || isAttrs lhs && isAttrs rhs && recurse lhs rhs
-          )
-        ) (attrNames pattern);
-    in
-    pattern:
+    pattern: attrs:
     assert isAttrs pattern;
-    recurse pattern;
+    all (
+      # Compare equality between `pattern` & `attrs`.
+      attr:
+      # Missing attr, not equal.
+      attrs ? ${attr}
+      && (
+        let
+          lhs = pattern.${attr};
+          rhs = attrs.${attr};
+        in
+        # If attrset check recursively
+        if isAttrs lhs then isAttrs rhs && matchAttrs lhs rhs else lhs == rhs
+      )
+    ) (attrNames pattern);
 
   /**
     Override only the attributes that are already present in the old set

lib/cli.nix

@@ -1,22 +1,6 @@
 { lib }:
 
-let
-  inherit (lib)
-    concatLists
-    concatMap
-    escapeShellArgs
-    isBool
-    isList
-    mapAttrsToList
-    oldestSupportedReleaseIsAtLeast
-    optional
-    stringLength
-    warnIf
-    ;
-  inherit (lib.generators) mkValueStringDefault;
-  mkValueString = mkValueStringDefault { };
-in
-rec {
+{
   /**
     Automatically convert an attribute set to command-line options.
 
@@ -56,9 +40,9 @@ rec {
     :::
   */
   toGNUCommandLineShell =
-    warnIf (oldestSupportedReleaseIsAtLeast 2511)
+    lib.warnIf (lib.oldestSupportedReleaseIsAtLeast 2511)
       "lib.cli.toGNUCommandLineShell is deprecated, please use lib.cli.toCommandLineShell or lib.cli.toCommandLineShellGNU instead."
-      (options: attrs: escapeShellArgs (toGNUCommandLine options attrs));
+      (options: attrs: lib.escapeShellArgs (lib.cli.toGNUCommandLine options attrs));
 
   /**
     Automatically convert an attribute set to a list of command-line options.
@@ -132,15 +116,15 @@ rec {
     :::
   */
   toGNUCommandLine =
-    warnIf (oldestSupportedReleaseIsAtLeast 2511)
+    lib.warnIf (lib.oldestSupportedReleaseIsAtLeast 2511)
       "lib.cli.toGNUCommandLine is deprecated, please use lib.cli.toCommandLine or lib.cli.toCommandLineShellGNU instead."
       (
         {
-          mkOptionName ? k: if stringLength k == 1 then "-${k}" else "--${k}",
+          mkOptionName ? k: if builtins.stringLength k == 1 then "-${k}" else "--${k}",
 
-          mkBool ? k: v: optional v (mkOptionName k),
+          mkBool ? k: v: lib.optional v (mkOptionName k),
 
-          mkList ? k: concatMap (mkOption k),
+          mkList ? k: v: lib.concatMap (mkOption k) v,
 
           mkOption ?
             k: v:
@@ -149,24 +133,26 @@ rec {
             else if optionValueSeparator == null then
               [
                 (mkOptionName k)
-                (mkValueString v)
+                (lib.generators.mkValueStringDefault { } v)
               ]
             else
-              [ "${mkOptionName k}${optionValueSeparator}${mkValueString v}" ],
+              [ "${mkOptionName k}${optionValueSeparator}${lib.generators.mkValueStringDefault { } v}" ],
 
           optionValueSeparator ? null,
         }:
+        options:
         let
           render =
             k: v:
-            if isBool v then
+            if builtins.isBool v then
               mkBool k v
-            else if isList v then
+            else if builtins.isList v then
               mkList k v
             else
               mkOption k v;
+
         in
-        options: concatLists (mapAttrsToList render options)
+        builtins.concatLists (lib.mapAttrsToList render options)
       );
 
   /**
@@ -177,7 +163,8 @@ rec {
     For further reference see:
     [`lib.cli.toCommandLineGNU`](#function-library-lib.cli.toCommandLineGNU)
   */
-  toCommandLineShellGNU = options: attrs: escapeShellArgs (toCommandLineGNU options attrs);
+  toCommandLineShellGNU =
+    options: attrs: lib.escapeShellArgs (lib.cli.toCommandLineGNU options attrs);
 
   /**
     Converts an attribute set into a list of GNU-style command-line arguments.
@@ -240,9 +227,9 @@ rec {
   */
   toCommandLineGNU =
     {
-      isLong ? optionName: stringLength optionName > 1,
+      isLong ? optionName: builtins.stringLength optionName > 1,
       explicitBool ? false,
-      formatArg ? mkValueString,
+      formatArg ? lib.generators.mkValueStringDefault { },
     }:
     let
       optionFormat = optionName: {
@@ -251,7 +238,7 @@ rec {
         inherit explicitBool formatArg;
       };
     in
-    toCommandLine optionFormat;
+    lib.cli.toCommandLine optionFormat;
 
   /**
     Converts the given attributes into a single shell-escaped command-line
@@ -261,7 +248,8 @@ rec {
     For further reference see:
     [`lib.cli.toCommandLine`](#function-library-lib.cli.toCommandLine)
   */
-  toCommandLineShell = optionFormat: attrs: escapeShellArgs (toCommandLine optionFormat attrs);
+  toCommandLineShell =
+    optionFormat: attrs: lib.escapeShellArgs (lib.cli.toCommandLine optionFormat attrs);
 
   /**
     Converts an attribute set into a list of command-line arguments.
@@ -433,14 +421,14 @@ rec {
     - `lib.cli.toCommandLineShellGNU`
   */
   toCommandLine =
-    optionFormat:
+    optionFormat: attrs:
     let
       handlePair =
         k: v:
         if k == "" then
-          throw "lib.cli.toCommandLine only accepts non-empty option names."
-        else if isList v then
-          concatMap (handleOption k) v
+          lib.throw "lib.cli.toCommandLine only accepts non-empty option names."
+        else if builtins.isList v then
+          builtins.concatMap (handleOption k) v
         else
           handleOption k v;
 
@@ -451,7 +439,7 @@ rec {
           option,
           sep,
           explicitBool,
-          formatArg ? mkValueString,
+          formatArg ? lib.generators.mkValueStringDefault { },
         }:
         k: v:
         if v == null || (!explicitBool && v == false) then
@@ -470,5 +458,5 @@ rec {
               arg
             ];
     in
-    attrs: concatLists (mapAttrsToList handlePair attrs);
+    builtins.concatLists (lib.mapAttrsToList handlePair attrs);
 }