python3Packages.dramatiq: 2.0.1 -> 2.1.0

https://github.com/Bogdanp/dramatiq/compare/v2.0.1...v2.1.0

.github/ISSUE_TEMPLATE/01_bug_report.yml

@@ -36,7 +36,8 @@ body:
       options:
         - "Please select a version."
         - "- Unstable (26.11)"
-        - "- Stable (26.05)"
+        - "- Beta (26.05)"
+        - "- Stable (25.11)"
       default: 0
     validations:
       required: true

.github/ISSUE_TEMPLATE/02_bug_report_darwin.yml

@@ -36,7 +36,8 @@ body:
       options:
         - "Please select a version."
         - "- Unstable (26.11)"
-        - "- Stable (26.05)"
+        - "- Beta (26.05)"
+        - "- Stable (25.11)"
       default: 0
     validations:
       required: true

.github/ISSUE_TEMPLATE/03_bug_report_nixos.yml

@@ -36,7 +36,8 @@ body:
       options:
         - "Please select a version."
         - "- Unstable (26.11)"
-        - "- Stable (26.05)"
+        - "- Beta (26.05)"
+        - "- Stable (25.11)"
       default: 0
     validations:
       required: true

.github/ISSUE_TEMPLATE/04_build_failure.yml

@@ -38,7 +38,8 @@ body:
       options:
         - "Please select a version."
         - "- Unstable (26.11)"
-        - "- Stable (26.05)"
+        - "- Beta (26.05)"
+        - "- Stable (25.11)"
       default: 0
     validations:
       required: true
@@ -56,12 +57,12 @@ body:
       description: |
         Can [Hydra](https://hydra.nixos.org), Nixpkgs' Continuous Integration system, reproduce this build failure?
         Please use the search function in the header bar to locate the last build job for the package in question.
-        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/subprojects/hydra/root/static/images/emojione-red-x-274c.svg" width="20px" align="top" alt="Red X"> icon near the package entry, say '**Yes, Hydra can reproduce this build failure.**'
-        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/subprojects/hydra/root/static/images/emojione-gray-x-2716.svg" width="20px" align="top" alt="Dark Gray X"> icon near the package entry, then the build failure occurs with another package, and you need to track the original failing package by going down the chain of 'Cached failures' until you reach the final package in the failing dependency chain. Once you locate the failing package, re-write this report against that package and say '**Yes, Hydra can reproduce this build failure.**'
-        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/subprojects/hydra/root/static/images/emojione-check-2714.svg" width="20px" align="top" alt="Green Check Mark"> icon near the package entry, then it most likely means it's a local issue with your system. (Maybe you ran out of space?)
+        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/src/root/static/images/emojione-red-x-274c.svg" width="20px" align="top" alt="Red X"> icon near the package entry, say '**Yes, Hydra can reproduce this build failure.**'
+        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/src/root/static/images/emojione-gray-x-2716.svg" width="20px" align="top" alt="Dark Gray X"> icon near the package entry, then the build failure occurs with another package, and you need to track the original failing package by going down the chain of 'Cached failures' until you reach the final package in the failing dependency chain. Once you locate the failing package, re-write this report against that package and say '**Yes, Hydra can reproduce this build failure.**'
+        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/src/root/static/images/emojione-check-2714.svg" width="20px" align="top" alt="Green Check Mark"> icon near the package entry, then it most likely means it's a local issue with your system. (Maybe you ran out of space?)
           You can still open a build failure report, but please say '**No, Hydra cannot reproduce this build failure.**' below.
-        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/subprojects/hydra/root/static/images/emojione-question-2754.svg" width="20px" align="top" alt="Gray Question Mark"> icon near the package entry, say '**Hydra is currently rebuilding this package.**'
-        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/subprojects/hydra/root/static/images/emojione-stopsign-1f6d1.svg" width="20px" align="top" alt="Red Stop Sign"> icon near the package entry, then the build job was stopped manually. If this occurs, please coordinate with the [Infrastructure Team](https://matrix.to/#/#infra:nixos.org), and say '**The last build job was manually cancelled.**'
+        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/src/root/static/images/emojione-question-2754.svg" width="20px" align="top" alt="Gray Question Mark"> icon near the package entry, say '**Hydra is currently rebuilding this package.**'
+        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/src/root/static/images/emojione-stopsign-1f6d1.svg" width="20px" align="top" alt="Red Stop Sign"> icon near the package entry, then the build job was stopped manually. If this occurs, please coordinate with the [Infrastructure Team](https://matrix.to/#/#infra:nixos.org), and say '**The last build job was manually cancelled.**'
         - If Hydra isn't supposed to build the package at all, say '**Hydra doesn’t try to build the package.**'
       options:
         - "Please select the Hydra Status."

.github/ISSUE_TEMPLATE/05_update_request.yml

@@ -38,7 +38,8 @@ body:
       options:
         - "Please select a version."
         - "- Unstable (26.11)"
-        - "- Stable (26.05)"
+        - "- Beta (26.05)"
+        - "- Stable (25.11)"
       default: 0
     validations:
       required: true

.github/ISSUE_TEMPLATE/06_module_request.yml

@@ -36,7 +36,8 @@ body:
       options:
         - "Please select a version."
         - "- Unstable (26.11)"
-        - "- Stable (26.05)"
+        - "- Beta (26.05)"
+        - "- Stable (25.11)"
       default: 0
     validations:
       required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -13,6 +13,7 @@ For new packages please briefly describe the package or provide a link to its ho
 - Built on platform:
   - [ ] x86_64-linux
   - [ ] aarch64-linux
+  - [ ] x86_64-darwin
   - [ ] aarch64-darwin
 - Tested, as applicable:
   - [ ] [NixOS tests] in [nixos/tests].

.github/labeler-no-sync.yml

@@ -22,6 +22,17 @@
               - doc/**/*
               - nixos/doc/**/*
 
+"backport release-25.11":
+  - all:
+      - changed-files:
+          - any-glob-to-any-file:
+              - .github/actions/**/*
+              - .github/workflows/*
+              - .github/labeler*.yml
+              - ci/**/*.*
+              - maintainers/github-teams.json
+      - base-branch: ['master']
+
 "backport release-26.05":
   - all:
       - changed-files:

.github/labeler.yml

@@ -9,7 +9,6 @@
           - '^release-'
           - '^staging-\d'
           - '^staging-next-\d'
-          - '^staging-nixos-\d'
 
 # NOTE: bsd, darwin and cross-compilation labels are handled by ofborg
 "6.topic: agda":

.github/workflows/backport.yml

@@ -36,7 +36,7 @@ jobs:
           permission-pull-requests: write
           permission-workflows: write
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           token: ${{ steps.app-token.outputs.token }}
@@ -49,7 +49,7 @@ jobs:
 
       - name: Create backport PRs
         id: backport
-        uses: korthout/backport-action@2e830a1d0b8269505846ddd407a70876913ad1f8 # v4.6.0
+        uses: korthout/backport-action@66065406958f46e82238fd59546f5a99e69e22aa # v4.5.2
         with:
           # Config README: https://github.com/korthout/backport-action#backport-action
           add_author_as_reviewer: true

.github/workflows/bot.yml

@@ -46,7 +46,7 @@ jobs:
       # https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/build.yml

@@ -34,22 +34,25 @@ jobs:
       matrix:
         include:
           - runner: ubuntu-24.04
-            system: x86_64-linux
+            name: x86_64-linux
+            systems: x86_64-linux
             builds: [shell, manual-nixos, lib-tests, tarball]
             desc: shell, docs, lib, tarball
           - runner: ubuntu-24.04-arm
-            system: aarch64-linux
+            name: aarch64-linux
+            systems: aarch64-linux
             builds: [shell, manual-nixos, manual-nixpkgs]
             desc: shell, docs
           - runner: macos-14
-            system: aarch64-darwin
+            name: darwin
+            systems: aarch64-darwin x86_64-darwin
             builds: [shell]
             desc: shell
-    name: '${{ matrix.system }}: ${{ matrix.desc }}'
+    name: '${{ matrix.name }}: ${{ matrix.desc }}'
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -77,9 +80,7 @@ jobs:
 
       - name: Build shell
         if: contains(matrix.builds, 'shell')
-        env:
-          system: ${{ matrix.system }}
-        run: nix-build-uncached nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A shell --argstr system "$system"
+        run: echo "${{ matrix.systems }}" | xargs -n1 nix-build-uncached nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A shell --argstr system
 
       - name: Build NixOS manual
         if: |
@@ -107,5 +108,5 @@ jobs:
           contains(fromJSON(inputs.baseBranch).type, 'primary')
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: ${{ inputs.artifact-prefix }}nixos-manual-${{ matrix.system }}
+          name: ${{ inputs.artifact-prefix }}nixos-manual-${{ matrix.name }}
           path: nixos-manual

.github/workflows/check.yml

@@ -43,7 +43,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 3
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           path: trusted
@@ -95,7 +95,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 3
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           path: trusted
@@ -137,7 +137,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           sparse-checkout: .github/actions

.github/workflows/comment.yml

@@ -23,7 +23,7 @@ jobs:
     timeout-minutes: 2
     if: contains(github.event.comment.body, '@NixOS/nixpkgs-merge-bot merge')
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/eval.yml

@@ -15,9 +15,6 @@ on:
       targetSha:
         required: true
         type: string
-      baseBranch:
-        required: true
-        type: string
       systems:
         required: true
         type: string
@@ -50,7 +47,7 @@ jobs:
       ciPinBumpCommit: ${{ steps.find-pinned-commit.outputs.ciPinBumpCommit }}
       ciPinBumpCommitShort: ${{ steps.find-pinned-commit.outputs.ciPinBumpCommitShort }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           path: trusted
@@ -58,7 +55,7 @@ jobs:
             ci/supportedVersions.nix
 
       - name: Check out the PR at the test merge commit
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           ref: ${{ inputs.mergedSha }}
@@ -174,7 +171,7 @@ jobs:
           sudo mkswap /swap
           sudo swapon /swap
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -259,7 +256,7 @@ jobs:
       statuses: write # creating 'Eval Summary' commit statuses
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -294,7 +291,6 @@ jobs:
       - name: Compare against the target branch
         env:
           TARGET_SHA: ${{ inputs.mergedSha }}
-          BASE_BRANCH: ${{ fromJSON(inputs.baseBranch).branch }}
         run: |
           git -C nixpkgs/trusted diff --name-only "$TARGET_SHA" \
             | jq --raw-input --slurp 'split("\n")[:-1]' > touched-files.json
@@ -303,7 +299,6 @@ jobs:
           nix-build nixpkgs/trusted/ci --arg nixpkgs ./nixpkgs/trusted-pinned -A eval.compare \
             --arg combinedDir ./combined \
             --arg touchedFilesJson ./touched-files.json \
-            --argstr baseBranch "$BASE_BRANCH" \
             --out-link comparison
 
           cat comparison/step-summary.md >> "$GITHUB_STEP_SUMMARY"
@@ -476,7 +471,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           sparse-checkout: .github/actions

.github/workflows/lint.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -61,7 +61,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -90,7 +90,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -134,7 +134,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: true # Needed to run git fetch for large PRs.
           path: trusted

.github/workflows/merge-group.yml

@@ -25,7 +25,7 @@ jobs:
       targetSha: ${{ steps.prepare.outputs.targetSha }}
       systems: ${{ steps.prepare.outputs.systems }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           sparse-checkout: |
@@ -97,7 +97,6 @@ jobs:
       artifact-prefix: ${{ inputs.artifact-prefix }}
       mergedSha: ${{ needs.prepare.outputs.mergedSha }}
       targetSha: ${{ needs.prepare.outputs.targetSha }}
-      baseBranch: ${{ needs.prepare.outputs.baseBranch }}
       systems: ${{ needs.prepare.outputs.systems }}
 
   build:

.github/workflows/periodic-merge-24h.yml

@@ -31,6 +31,12 @@ jobs:
       max-parallel: 1
       matrix:
         pairs:
+          - from: release-25.11
+            into: staging-next-25.11
+          - from: staging-next-25.11
+            into: staging-25.11
+          - from: release-25.11
+            into: staging-nixos-25.11
           - from: release-26.05
             into: staging-next-26.05
           - from: staging-next-26.05

.github/workflows/periodic-merge.yml

@@ -34,7 +34,7 @@ jobs:
           permission-contents: write
           permission-pull-requests: write
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 

.github/workflows/pull-request-target.yml

@@ -36,7 +36,7 @@ jobs:
       systems: ${{ steps.prepare.outputs.systems }}
       touched: ${{ steps.prepare.outputs.touched }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           sparse-checkout-cone-mode: true # default, for clarity
@@ -110,7 +110,6 @@ jobs:
       mergedSha: ${{ needs.prepare.outputs.mergedSha }}
       headSha: ${{ github.event.pull_request.head.sha }}
       targetSha: ${{ needs.prepare.outputs.targetSha }}
-      baseBranch: ${{ needs.prepare.outputs.baseBranch }}
       systems: ${{ needs.prepare.outputs.systems }}
       testVersions: ${{ contains(fromJSON(needs.prepare.outputs.touched), 'pinned') && !contains(fromJSON(needs.prepare.outputs.headBranch).type, 'development') }}
 

.github/workflows/review.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 2
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/teams.yml

@@ -2,7 +2,7 @@ name: Teams
 
 on:
   schedule:
-    # Every Monday at 19:42 (randomly chosen)
+    # Every Tuesday at 19:42 (randomly chosen)
     - cron: '42 19 * * 1'
   workflow_dispatch:
 
@@ -30,7 +30,7 @@ jobs:
           permission-pull-requests: write
 
       - name: Fetch source
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/test.yml

@@ -19,7 +19,7 @@ jobs:
       push: ${{ steps.files.outputs.push }}
       targetSha: ${{ steps.prepare.outputs.targetSha }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           sparse-checkout-cone-mode: true # default, for clarity
@@ -64,7 +64,6 @@ jobs:
               'ci/github-script/supportedSystems.js',
               'ci/pinned.json',
               'ci/supportedBranches.js',
-              'pkgs/top-level/release-supported-systems.json',
             ].includes(file))) core.setOutput('merge-group', true)
 
             if (files.some(file => [
@@ -89,7 +88,6 @@ jobs:
               'ci/github-script/withRateLimit.js',
               'ci/pinned.json',
               'ci/supportedBranches.js',
-              'pkgs/top-level/release-supported-systems.json',
             ].includes(file))) core.setOutput('pr', true)
 
   merge-group:

.mailmap

@@ -17,7 +17,6 @@ jopejoe1 <nixpkgs@missing.ninja> <34899572+jopejoe1@users.noreply.github.com>
 jopejoe1 <nixpkgs@missing.ninja> <jopejoe1@missing.ninja>
 jopejoe1 <nixpkgs@missing.ninja> <jopejoe1>
 Jörg Thalheim <joerg@thalheim.io> <Mic92@users.noreply.github.com>
-Katalin Rebhan <me@dblsaiko.net>
 Lin Jian <me@linj.tech> <linj.dev@outlook.com>
 Lin Jian <me@linj.tech> <75130626+jian-lin@users.noreply.github.com>
 Martin Weinelt <hexa@darmstadt.ccc.de> <mweinelt@users.noreply.github.com>

README.md

@@ -1,9 +1,9 @@
 <p align="center">
   <a href="https://nixos.org">
     <picture>
-      <source media="(prefers-color-scheme: light)" srcset="https://brand.nixos.org/logos/nixos-logo-rainbow-gradient-black-regular-horizontal-minimal.svg">
-      <source media="(prefers-color-scheme: dark)" srcset="https://brand.nixos.org/logos/nixos-logo-rainbow-gradient-white-regular-horizontal-minimal.svg">
-      <img src="https://brand.nixos.org/logos/nixos-logo-rainbow-gradient-black-regular-horizontal-minimal.svg" width="500px" alt="NixOS logo">
+      <source media="(prefers-color-scheme: light)" srcset="https://brand.nixos.org/logos/nixos-logo-default-gradient-black-regular-horizontal-minimal.svg">
+      <source media="(prefers-color-scheme: dark)" srcset="https://brand.nixos.org/logos/nixos-logo-default-gradient-white-regular-horizontal-minimal.svg">
+      <img src="https://brand.nixos.org/logos/nixos-logo-default-gradient-black-regular-horizontal-minimal.svg" width="500px" alt="NixOS logo">
     </picture>
   </a>
 </p>
@@ -13,7 +13,7 @@
   <a href="https://opencollective.com/nixos"><img src="https://opencollective.com/nixos/tiers/supporter/badge.svg?label=supporters&color=brightgreen" alt="Open Collective supporters" /></a>
 </p>
 
-[Nixpkgs](https://github.com/nixos/nixpkgs) is a collection of over 140,000 software packages that can be installed with the [Nix](https://nixos.org/nix/) package manager.
+[Nixpkgs](https://github.com/nixos/nixpkgs) is a collection of over 120,000 software packages that can be installed with the [Nix](https://nixos.org/nix/) package manager.
 It also implements [NixOS](https://nixos.org/nixos/), a purely-functional Linux distribution.
 
 # Manuals
@@ -47,9 +47,9 @@ Here are some of the main ones:
 Nixpkgs and NixOS are built and tested by our continuous integration system, [Hydra](https://hydra.nixos.org/).
 
 * [Continuous package builds for unstable/master](https://hydra.nixos.org/jobset/nixos/trunk-combined)
-* [Continuous package builds for the NixOS 26.05 release](https://hydra.nixos.org/jobset/nixos/release-26.05)
+* [Continuous package builds for the NixOS 25.11 release](https://hydra.nixos.org/jobset/nixos/release-25.11)
 * [Tests for unstable/master](https://hydra.nixos.org/job/nixos/trunk-combined/tested#tabs-constituents)
-* [Tests for the NixOS 26.05 release](https://hydra.nixos.org/job/nixos/release-26.05/tested#tabs-constituents)
+* [Tests for the NixOS 25.11 release](https://hydra.nixos.org/job/nixos/release-25.11/tested#tabs-constituents)
 
 Artifacts successfully built with Hydra are published to cache at https://cache.nixos.org/.
 When successful build and test criteria are met, the Nixpkgs expressions are distributed via [Nix channels](https://nix.dev/manual/nix/stable/command-ref/nix-channel.html).

ci/OWNERS

@@ -25,27 +25,26 @@
 /shell.nix @infinisil @NixOS/Security
 
 # Libraries
-/lib                        @infinisil @hsjobeki @llakala
-/lib/generators.nix         @infinisil @hsjobeki @llakala
-/lib/cli.nix                @infinisil @hsjobeki @llakala
-/lib/debug.nix              @infinisil @hsjobeki @llakala
-/lib/asserts.nix            @infinisil @hsjobeki @llakala
-/lib/path/*                 @infinisil @hsjobeki @llakala
-/lib/fileset                @infinisil @hsjobeki @llakala
-/maintainers/github-teams.json @infinisil @llakala
-/maintainers/computed-team-list.nix @infinisil @llakala
+/lib                        @infinisil @hsjobeki
+/lib/generators.nix         @infinisil @hsjobeki
+/lib/cli.nix                @infinisil @hsjobeki
+/lib/debug.nix              @infinisil @hsjobeki
+/lib/asserts.nix            @infinisil @hsjobeki
+/lib/path/*                 @infinisil @hsjobeki
+/lib/fileset                @infinisil @hsjobeki
+/maintainers/github-teams.json @infinisil
+/maintainers/computed-team-list.nix @infinisil
 ## Standard environment–related libraries
-/lib/customisation.nix      @alyssais @NixOS/stdenv @llakala
-/lib/derivations.nix        @NixOS/stdenv @llakala
-/lib/fetchers.nix           @alyssais @NixOS/stdenv @llakala
-/lib/meta.nix               @alyssais @NixOS/stdenv @llakala
-/lib/meta-types.nix         @infinisil @adisbladis @NixOS/stdenv @llakala
-/lib/source-types.nix       @alyssais @NixOS/stdenv @llakala
-/lib/systems                @alyssais @NixOS/stdenv @llakala
+/lib/customisation.nix      @alyssais @NixOS/stdenv
+/lib/derivations.nix        @NixOS/stdenv
+/lib/fetchers.nix           @alyssais @NixOS/stdenv
+/lib/meta.nix               @alyssais @NixOS/stdenv
+/lib/source-types.nix       @alyssais @NixOS/stdenv
+/lib/systems                @alyssais @NixOS/stdenv
 ## Libraries / Module system
-/lib/modules.nix            @infinisil @roberth @hsjobeki @llakala
-/lib/types.nix              @infinisil @roberth @hsjobeki @llakala
-/lib/options.nix            @infinisil @roberth @hsjobeki @llakala
+/lib/modules.nix            @infinisil @roberth @hsjobeki
+/lib/types.nix              @infinisil @roberth @hsjobeki
+/lib/options.nix            @infinisil @roberth @hsjobeki
 /lib/tests/modules.sh       @infinisil @roberth @hsjobeki
 /lib/tests/modules          @infinisil @roberth @hsjobeki
 
@@ -57,31 +56,31 @@
 /pkgs/top-level/splice.nix                       @Ericson2314
 /pkgs/top-level/release-cross.nix                @Ericson2314
 /pkgs/top-level/by-name-overlay.nix              @infinisil @philiptaron
-/pkgs/top-level/config.nix                       @jopejoe1
-/pkgs/top-level/make-tarball.nix                 @jopejoe1
-/pkgs/top-level/packages-config.nix              @jopejoe1
-/pkgs/top-level/packages-info.nix                @jopejoe1
-/pkgs/top-level/release-lib.nix                  @jopejoe1
-/pkgs/top-level/release.nix                      @jopejoe1
-/pkgs/stdenv                                     @philiptaron @NixOS/stdenv @llakala
-/pkgs/stdenv/generic                             @Ericson2314 @NixOS/stdenv @llakala
-/pkgs/stdenv/generic/problems.nix                @infinisil @llakala
+/pkgs/stdenv                                     @philiptaron @NixOS/stdenv
+/pkgs/stdenv/generic                             @Ericson2314 @NixOS/stdenv
+/pkgs/stdenv/generic/problems.nix                @infinisil
 /pkgs/test/problems                              @infinisil
-/pkgs/stdenv/generic/check-meta.nix              @infinisil @Ericson2314 @adisbladis @NixOS/stdenv @llakala
+/pkgs/stdenv/generic/check-meta.nix              @infinisil @Ericson2314 @adisbladis @NixOS/stdenv
+/pkgs/stdenv/generic/meta-types.nix              @infinisil @adisbladis @NixOS/stdenv
 /pkgs/stdenv/cross                               @Ericson2314 @NixOS/stdenv
 /pkgs/build-support                              @philiptaron
 /pkgs/build-support/cc-wrapper                   @Ericson2314
 /pkgs/build-support/bintools-wrapper             @Ericson2314
 /pkgs/build-support/setup-hooks                  @Ericson2314
 /pkgs/build-support/setup-hooks/arrayUtilities   @ConnorBaker
+/pkgs/build-support/setup-hooks/auto-patchelf.sh @layus
+/pkgs/by-name/au/auto-patchelf                   @layus
 
 ## Format generators/serializers
 /pkgs/pkgs-lib                                   @Stunkymonkey @h7x4
-/pkgs/pkgs-lib/formats/json2x                    @Stunkymonkey @h7x4 @figsoda
 
 # Nixpkgs build-support
 /pkgs/build-support/writers @lassulus
 
+# Nixpkgs make-disk-image
+/doc/build-helpers/images/makediskimage.section.md  @raitobezarius
+/nixos/lib/make-disk-image.nix                 @raitobezarius
+
 # Nix, the package manager
 # @raitobezarius is not "code owner", but is listed here to be notified of changes
 # pertaining to the Nix package manager.
@@ -95,16 +94,16 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @Artturin @Ericson2314 @lo
 /maintainers/scripts/doc @jtojnar @ryantm
 
 # Contributor documentation
-/CONTRIBUTING.md
-/.github/PULL_REQUEST_TEMPLATE.md
-/doc/contributing/
-/doc/contributing/contributing-to-documentation.chapter.md @jtojnar
-/lib/README.md
-/doc/README.md
-/nixos/README.md
-/pkgs/README.md
-/pkgs/by-name/README.md
-/maintainers/README.md
+/CONTRIBUTING.md @infinisil
+/.github/PULL_REQUEST_TEMPLATE.md @infinisil
+/doc/contributing/ @infinisil
+/doc/contributing/contributing-to-documentation.chapter.md @jtojnar @infinisil
+/lib/README.md @infinisil
+/doc/README.md @infinisil
+/nixos/README.md @infinisil
+/pkgs/README.md @infinisil
+/pkgs/by-name/README.md @infinisil
+/maintainers/README.md @infinisil
 
 # User-facing development documentation
 /doc/development.md @infinisil
@@ -123,6 +122,10 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @Artturin @Ericson2314 @lo
 /doc/redirects.json                @GetPsyched
 /nixos/doc/manual/redirects.json   @GetPsyched
 
+# NixOS integration test driver
+/nixos/lib/test-driver  @tfc
+/nixos/lib/testing      @tfc
+
 # NixOS QEMU virtualisation
 /nixos/modules/virtualisation/qemu-vm.nix                 @raitobezarius
 /nixos/modules/services/backup/libvirtd-autosnapshot.nix  @6543
@@ -186,6 +189,8 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @Artturin @Ericson2314 @lo
 /maintainers/scripts/update-python-libraries  @mweinelt @natsukium
 /pkgs/by-name/up/update-python-libraries      @mweinelt @natsukium
 /pkgs/development/interpreters/python         @mweinelt @natsukium
+/pkgs/top-level/python-packages.nix                     @natsukium
+/pkgs/top-level/release-python.nix                      @natsukium
 
 # CUDA
 /pkgs/top-level/cuda-packages.nix             @NixOS/cuda-maintainers
@@ -215,10 +220,10 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @Artturin @Ericson2314 @lo
 /pkgs/development/r-modules         @jbedo
 
 # Rust
-/pkgs/development/compilers/rust @NixOS/rust @alyssais
-/pkgs/build-support/rust @NixOS/rust
+/pkgs/development/compilers/rust @alyssais @Mic92 @winterqt
+/pkgs/build-support/rust @winterqt
 /pkgs/build-support/rust/fetch-cargo-vendor* @TomaSajt
-/doc/languages-frameworks/rust.section.md @NixOS/rust
+/doc/languages-frameworks/rust.section.md @winterqt
 
 # Tcl
 /pkgs/development/interpreters/tcl  @fgaz
@@ -230,10 +235,14 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @Artturin @Ericson2314 @lo
 # C compilers
 /pkgs/development/compilers/gcc
 /pkgs/development/compilers/llvm @NixOS/llvm
+/pkgs/development/compilers/emscripten @raitobezarius
 /doc/toolchains/llvm.chapter.md @NixOS/llvm
+/doc/languages-frameworks/emscripten.section.md @raitobezarius
 
 # Audio
+/nixos/modules/services/audio/botamusique.nix @mweinelt
 /nixos/modules/services/audio/snapserver.nix @mweinelt
+/nixos/tests/botamusique.nix @mweinelt
 /nixos/tests/snapcast.nix @mweinelt
 
 # Browsers
@@ -260,18 +269,18 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/applications/editors/jetbrains @leona-ya @theCapypara
 
 # Licenses
-/lib/licenses @alyssais @emilazy @jopejoe1 @llakala
+/lib/licenses @alyssais @emilazy @jopejoe1
 
 # Qt
-/pkgs/development/libraries/qt-5 @K900 @NickCao @SuperSandro2000
-/pkgs/development/libraries/qt-6 @K900 @NickCao @SuperSandro2000
+/pkgs/development/libraries/qt-5 @K900 @NickCao @SuperSandro2000 @ttuegel
+/pkgs/development/libraries/qt-6 @K900 @NickCao @SuperSandro2000 @ttuegel
 
 # KDE Frameworks 5
-/pkgs/development/libraries/kde-frameworks @K900 @NickCao @SuperSandro2000
+/pkgs/development/libraries/kde-frameworks @K900 @NickCao @SuperSandro2000 @ttuegel
 
 # KDE / Plasma 6
-/pkgs/kde @K900 @NickCao @SuperSandro2000
-/maintainers/scripts/kde @K900 @NickCao @SuperSandro2000
+/pkgs/kde @K900 @NickCao @SuperSandro2000 @ttuegel
+/maintainers/scripts/kde @K900 @NickCao @SuperSandro2000 @ttuegel
 
 # PostgreSQL and related stuff
 /pkgs/by-name/po/postgresqlTestHook @NixOS/postgres
@@ -322,9 +331,9 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /nixos/tests/knot.nix @mweinelt
 
 # Web servers
-/doc/packages/nginx.section.md @leona-ya @Ma27
-/pkgs/servers/http/nginx/ @helsinki-Jo @leona-ya @Ma27
-/nixos/modules/services/web-servers/nginx/ @leona-ya @Ma27
+/doc/packages/nginx.section.md @raitobezarius
+/pkgs/servers/http/nginx/ @raitobezarius
+/nixos/modules/services/web-servers/nginx/ @raitobezarius
 
 # D
 /pkgs/build-support/dlang @jtbx @TomaSajt
@@ -364,8 +373,7 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/development/lua-modules         @NixOS/lua
 
 # Neovim
-/pkgs/applications/editors/neovim           @NixOS/neovim
-/doc/languages-frameworks/neovim.section.md @NixOS/neovim
+/pkgs/applications/editors/neovim      @NixOS/neovim
 
 # VimPlugins
 /pkgs/applications/editors/vim/plugins         @NixOS/neovim
@@ -389,15 +397,18 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /nixos/tests/docker-tools*                       @roberth @jhol
 /doc/build-helpers/images/dockertools.section.md @roberth @jhol
 
+# Blockchains
+/pkgs/applications/blockchains  @mmahut @RaghavSood
+
 # Go
 /doc/languages-frameworks/go.section.md @kalbasit @katexochen @Mic92
 /pkgs/build-support/go @kalbasit @katexochen @Mic92
 /pkgs/development/compilers/go @kalbasit @katexochen @Mic92
 
 # GNOME
-/pkgs/desktops/gnome                              @NixOS/gnome
-/pkgs/desktops/gnome/extensions                   @NixOS/gnome
-/pkgs/build-support/make-hardcode-gsettings-patch @NixOS/gnome
+/pkgs/desktops/gnome                              @jtojnar
+/pkgs/desktops/gnome/extensions                   @jtojnar
+/pkgs/build-support/make-hardcode-gsettings-patch @jtojnar
 
 # Cinnamon
 /pkgs/by-name/ci/cinnamon-*    @mkg20001
@@ -429,7 +440,6 @@ nixos/tests/forgejo.nix               @adamcstephens @bendlas @christoph-heiss @
 /doc/languages-frameworks/javascript.section.md @winterqt
 /pkgs/development/tools/pnpm                    @Scrumplex @gepbird
 /pkgs/build-support/node/fetch-pnpm-deps        @Scrumplex @gepbird
-/pkgs/test/pnpm                                 @Scrumplex @gepbird
 
 # OCaml
 /pkgs/build-support/ocaml           @ulrikstrid
@@ -520,9 +530,3 @@ pkgs/by-name/wa/warp-terminal/  @emilytrau @imadnyc @FlameFlag @johnrtitor
 
 # Zellij plugins
 /pkgs/by-name/ze/zellij/plugins/   @PerchunPak
-
-# Test-driver
-/nixos/lib/test-driver                                      @NixOS/test-driver
-/nixos/lib/testing                                          @NixOS/test-driver
-/nixos/tests/nixos-test-driver                              @NixOS/test-driver
-/nixos/modules/virtualisation/nspawn-container/run-nspawn   @NixOS/test-driver

ci/README.md

@@ -51,16 +51,6 @@ To ensure security and a focused utility, the bot adheres to specific limitation
   - opened by [@r-ryantm](https://nix-community.github.io/nixpkgs-update/r-ryantm/).
 - The user attempting to merge is a member of [@NixOS/nixpkgs-maintainers].
 - The user attempting to merge is a maintainer of all packages touched by the PR.
-- No [committer][@NixOS/nixpkgs-committers] has an outstanding "changes requested" review.
-  These block both the merge queue and auto-merge, so the bot refuses to merge until the review is addressed or dismissed.
-
-Once these constraints are met, the bot picks a merge strategy based on the `no PR failures` commit status:
-
-- CI passing: the PR is added to the merge queue.
-- CI unfinished (pending or missing status): the bot enables [Auto Merge], which queues the PR once required checks succeed.
-  Note that if CI later fails, nothing happens until it is fixed and passes.
-- CI already failing (`error`/`failure` status): the bot does not enable Auto Merge, because it would never trigger, and fixing CI requires a new push that invalidates the merge command.
-  A fresh `@NixOS/nixpkgs-merge-bot merge` comment is needed once CI is green again.
 
 ### Approving merge bot changes
 
@@ -114,4 +104,3 @@ This script can also be run locally to print basic test cases.
 [@NixOS/nixpkgs-ci]: https://github.com/orgs/NixOS/teams/nixpkgs-ci
 [@NixOS/nixpkgs-core]: https://github.com/orgs/NixOS/teams/nixpkgs-core
 [RFC 172]: https://github.com/NixOS/rfcs/pull/172
-[Auto Merge]: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/automatically-merging-a-pull-request

ci/default.nix

@@ -26,7 +26,132 @@ let
 
   fmt =
     let
-      treefmt = pkgs.treefmt.withConfig ./treefmt.nix;
+      treefmtNixSrc = fetchTarball {
+        inherit (pinned.treefmt-nix) url;
+        sha256 = pinned.treefmt-nix.hash;
+      };
+      treefmtEval = (import treefmtNixSrc).evalModule pkgs {
+        # Important: The auto-rebase script uses `git filter-branch --tree-filter`,
+        # which creates trees within the Git repository under `.git-rewrite/t`,
+        # notably without having a `.git` themselves.
+        # So if this projectRootFile were the default `.git/config`,
+        # having the auto-rebase script use treefmt on such a tree would make it
+        # format all files in the _parent_ Git tree as well.
+        projectRootFile = ".git-blame-ignore-revs";
+
+        # Be a bit more verbose by default, so we can see progress happening
+        settings.verbose = 1;
+
+        # By default it's info, which is too noisy since we have many unmatched files
+        settings.on-unmatched = "debug";
+
+        programs.actionlint.enable = true;
+
+        programs.biome = {
+          enable = true;
+          # Disable settings validation because its inputs are liable to hash mismatch
+          validate.enable = false;
+          settings.formatter = {
+            useEditorconfig = true;
+          };
+          settings.javascript.formatter = {
+            quoteStyle = "single";
+            semicolons = "asNeeded";
+          };
+          settings.json.formatter.enabled = false;
+        };
+        settings.formatter.biome.excludes = [
+          "*.min.js"
+          "pkgs/*"
+        ];
+
+        programs.keep-sorted.enable = true;
+
+        # This uses nixfmt underneath, the default formatter for Nix code.
+        # See https://github.com/NixOS/nixfmt
+        programs.nixfmt = {
+          enable = true;
+          package = pkgs.nixfmt;
+        };
+
+        programs.yamlfmt = {
+          enable = true;
+          settings.formatter = {
+            retain_line_breaks = true;
+          };
+        };
+        settings.formatter.yamlfmt.excludes = [
+          # Aligns comments with whitespace
+          "pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml"
+          # TODO: Fix formatting for auto-generated file
+          "pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml"
+        ];
+
+        programs.nixf-diagnose = {
+          enable = true;
+          ignore = [
+            # Rule names can currently be looked up here:
+            # https://github.com/nix-community/nixd/blob/main/libnixf/src/Basic/diagnostic.py
+            # TODO: Remove the following and fix things.
+            "sema-unused-def-lambda-noarg-formal"
+            "sema-unused-def-lambda-witharg-arg"
+            "sema-unused-def-lambda-witharg-formal"
+            "sema-unused-def-let"
+            # Keep this rule, because we have `lib.or`.
+            "or-identifier"
+            # TODO: remove after outstanding prelude diagnostics issues are fixed:
+            # https://github.com/nix-community/nixd/issues/761
+            # https://github.com/nix-community/nixd/issues/762
+            "sema-primop-removed-prefix"
+            "sema-primop-overridden"
+            "sema-constant-overridden"
+            "sema-primop-unknown"
+          ];
+        };
+        settings.formatter.nixf-diagnose = {
+          # Ensure nixfmt cleans up after nixf-diagnose.
+          priority = -1;
+          excludes = [
+            # Auto-generated; violates sema-extra-with
+            # Can only sensibly be removed when --auto-fix supports multiple fixes at once:
+            # https://github.com/inclyc/nixf-diagnose/issues/13
+            "pkgs/servers/home-assistant/component-packages.nix"
+            # https://github.com/nix-community/nixd/issues/708
+            "nixos/maintainers/scripts/azure-new/examples/basic/system.nix"
+          ];
+        };
+
+        settings.formatter.editorconfig-checker = {
+          command = "${pkgs.lib.getExe pkgs.editorconfig-checker}";
+          options = [
+            "-disable-indent-size"
+            # TODO: Remove this once this upstream issue is fixed:
+            #   https://github.com/editorconfig-checker/editorconfig-checker/issues/505
+            "-disable-charset"
+          ];
+          includes = [ "*" ];
+          priority = 1;
+        };
+
+        # TODO: Upstream this into treefmt-nix eventually:
+        #   https://github.com/numtide/treefmt-nix/issues/387
+        settings.formatter.markdown-code-runner = {
+          command = pkgs.lib.getExe pkgs.markdown-code-runner;
+          options =
+            let
+              config = pkgs.writers.writeTOML "markdown-code-runner-config" {
+                presets.nixfmt = {
+                  language = "nix";
+                  command = [ (pkgs.lib.getExe pkgs.nixfmt) ];
+                };
+              };
+            in
+            [ "--config=${config}" ];
+          includes = [ "*.md" ];
+        };
+
+        programs.zizmor.enable = true;
+      };
       fs = pkgs.lib.fileset;
       nixFilesSrc = fs.toSource {
         root = ../.;
@@ -34,24 +159,14 @@ let
       };
     in
     {
-      pkg = treefmt;
-      check = treefmt.check nixFilesSrc;
+      shell = treefmtEval.config.build.devShell;
+      pkg = treefmtEval.config.build.wrapper;
+      check = treefmtEval.config.build.check nixFilesSrc;
     };
 
-  # nixos-render-docs and nixos-render-docs-redirects
-  # Should be used from tree to build the matching in-tree documentation
-  docPkgs = pkgs.extend (
-    final: prev: {
-      nixos-render-docs = final.callPackage ../pkgs/by-name/ni/nixos-render-docs/package.nix { };
-      nixos-render-docs-redirects =
-        final.callPackage ../pkgs/by-name/ni/nixos-render-docs-redirects/package.nix
-          { };
-    }
-  );
-
 in
 rec {
-  inherit pkgs docPkgs fmt;
+  inherit pkgs fmt;
   codeownersValidator = pkgs.callPackage ./codeowners-validator { };
 
   # FIXME(lf-): it might be useful to test other Nix implementations
@@ -64,7 +179,7 @@ rec {
   # CI jobs
   lib-tests = import ../lib/tests/release.nix { inherit pkgs; };
   manual-nixos = (import ../nixos/release.nix { }).manual.${system} or null;
-  manual-nixpkgs = (import ../doc { pkgs = docPkgs; });
+  manual-nixpkgs = (import ../doc { inherit pkgs; });
   nixpkgs-vet = pkgs.callPackage ./nixpkgs-vet.nix {
     nix = pkgs.nixVersions.latest;
   };

ci/eval/attrpaths.nix

@@ -0,0 +1,85 @@
+# This expression will, as efficiently as possible, dump a
+# *superset* of all attrpaths of derivations which might be
+# part of a release on *any* platform.
+#
+# This expression runs single-threaded under all current Nix
+# implementations, but much faster and with much less memory
+# used than ./outpaths.nix itself.
+#
+# Once you have the list of attrnames you can split it up into
+# $NUM_CORES batches and evaluate the outpaths separately for each
+# batch, in parallel.
+#
+# To dump the attrnames:
+#
+#   nix-instantiate --eval --strict --json ci/eval/attrpaths.nix -A names
+#
+{
+  lib ? import (path + "/lib"),
+  trace ? false,
+  path ? ./../..,
+  extraNixpkgsConfigJson ? "{}",
+}:
+let
+
+  # TODO: Use mapAttrsToListRecursiveCond when this PR lands:
+  # https://github.com/NixOS/nixpkgs/pull/395160
+  justAttrNames =
+    path: value:
+    let
+      result =
+        if path == [ "AAAAAASomeThingsFailToEvaluate" ] || !(lib.isAttrs value) then
+          [ ]
+        else if lib.isDerivation value then
+          [ path ]
+        else
+          lib.pipe value [
+            (lib.mapAttrsToList (
+              name: value:
+              lib.addErrorContext "while evaluating package set attribute path '${
+                lib.showAttrPath (path ++ [ name ])
+              }'" (justAttrNames (path ++ [ name ]) value)
+            ))
+            lib.concatLists
+          ];
+    in
+    lib.traceIf trace "** ${lib.showAttrPath path}" result;
+
+  outpaths = import ./outpaths.nix {
+    inherit path;
+    extraNixpkgsConfig = builtins.fromJSON extraNixpkgsConfigJson;
+    attrNamesOnly = true;
+  };
+
+  paths = [
+    # Some of the following are based on variants, which are disabled with `attrNamesOnly = true`.
+    # Until these have been removed from release.nix / hydra, we manually add them to the list.
+    [
+      "pkgsLLVM"
+      "stdenv"
+    ]
+    [
+      "pkgsArocc"
+      "stdenv"
+    ]
+    [
+      "pkgsZig"
+      "stdenv"
+    ]
+    [
+      "pkgsStatic"
+      "stdenv"
+    ]
+    [
+      "pkgsMusl"
+      "stdenv"
+    ]
+  ]
+  ++ justAttrNames [ ] outpaths;
+
+  names = map lib.showAttrPath paths;
+
+in
+{
+  inherit paths names;
+}

ci/eval/chunk.nix

@@ -2,8 +2,8 @@
 {
   lib ? import ../../lib,
   path ? ../..,
-  # The file containing the preEval result
-  preEvalFile,
+  # The file containing all available attribute paths, which are split into chunks here
+  attrpathFile,
   chunkSize,
   myChunk,
   includeBroken,
@@ -12,13 +12,12 @@
 }:
 
 let
-  preEvalResult = lib.importJSON preEvalFile;
-  myAttrpaths = lib.sublist (chunkSize * myChunk) chunkSize preEvalResult.paths;
+  attrpaths = lib.importJSON attrpathFile;
+  myAttrpaths = lib.sublist (chunkSize * myChunk) chunkSize attrpaths;
 
   unfiltered = import ./outpaths.nix {
     inherit path;
     inherit includeBroken systems;
-    inherit (preEvalResult) attrPathsDisallowedForInternalUse;
     extraNixpkgsConfig = builtins.fromJSON extraNixpkgsConfigJson;
   };
 

ci/eval/compare/default.nix

@@ -49,7 +49,6 @@ in
 {
   combinedDir,
   touchedFilesJson,
-  baseBranch,
   ownersFile ? ../../OWNERS,
 }:
 let
@@ -239,33 +238,34 @@ runCommand "compare"
       jq -r -f ${./generate-step-summary.jq} < ${changed-paths}
     } >> $out/step-summary.md
 
-    {
-      echo
-      echo "# Performance comparison"
-      echo
-      echo "This compares the performance of this branch against the \`${baseBranch}\` branch."
-      echo
-    } >> $out/step-summary.md
-
-    # cmp-stats only compares the stats chunks present in both revisions, so the
-    # comparison is still produced when packages were added/removed. The paired
-    # chunks may cover different attrs in that case, so caveat the figures.
-    if ! jq -e '(.attrdiff.added | length == 0) and (.attrdiff.removed | length == 0)' "${changed-paths}" > /dev/null; then
+    if jq -e '(.attrdiff.added | length == 0) and (.attrdiff.removed | length == 0)' "${changed-paths}" > /dev/null; then
+      # Chunks have changed between revisions
+      # We cannot generate a performance comparison
       {
-        echo "> [!NOTE]"
-        echo "> The package sets differ between the two revisions. This comparison only"
-        echo "> covers packages evaluated in both, so treat the figures as approximate."
+        echo
+        echo "# Performance comparison"
+        echo
+        echo "This compares the performance of this branch against its pull request base branch (e.g., 'master')"
+        echo
+        echo "For further help please refer to: [ci/README.md](https://github.com/NixOS/nixpkgs/blob/master/ci/README.md)"
         echo
       } >> $out/step-summary.md
+
+      cmp-stats --explain ${combined}/before/stats ${combined}/after/stats >> $out/step-summary.md
+
+    else
+      # Package chunks are the same in both revisions
+      # We can use the to generate a performance comparison
+      {
+        echo
+        echo "# Performance Comparison"
+        echo
+        echo "Performance stats were skipped because the package sets differ between the two revisions."
+        echo
+        echo "For further help please refer to: [ci/README.md](https://github.com/NixOS/nixpkgs/blob/master/ci/README.md)"
+      } >> $out/step-summary.md
     fi
 
-    {
-      echo "For further help please refer to: [ci/README.md](https://github.com/NixOS/nixpkgs/blob/master/ci/README.md)"
-      echo
-    } >> $out/step-summary.md
-
-    cmp-stats --explain ${combined}/before/stats ${combined}/after/stats >> $out/step-summary.md
-
     jq -r '.[]' "${touchedFilesJson}" > ./touched-files
     readarray -t touchedFiles < ./touched-files
     echo "This PR touches ''${#touchedFiles[@]} files"

ci/eval/default.nix

@@ -38,7 +38,7 @@ let
       fileset = unions (
         map (lib.path.append ../..) [
           ".version"
-          "ci/eval/pre-eval.nix"
+          "ci/eval/attrpaths.nix"
           "ci/eval/chunk.nix"
           "ci/eval/outpaths.nix"
           "default.nix"
@@ -56,11 +56,11 @@ let
     builtins.readFile ../../pkgs/top-level/release-supported-systems.json
   );
 
-  preEval =
+  attrpathsSuperset =
     {
       evalSystem,
     }:
-    runCommand "pre-eval"
+    runCommand "attrpaths-superset.json"
       {
         src = nixpkgs;
         # Don't depend on -dev outputs to reduce closure size for CI.
@@ -73,15 +73,15 @@ let
         export NIX_STATE_DIR=$(mktemp -d)
         mkdir $out
         export GC_INITIAL_HEAP_SIZE=4g
-        command time -f "Pre-eval done [%MKB max resident, %Es elapsed] %C" \
+        command time -f "Attribute eval done [%MKB max resident, %Es elapsed] %C" \
           nix-instantiate --eval --strict --json --show-trace \
-            "$src/ci/eval/pre-eval.nix" \
-            -A result \
+            "$src/ci/eval/attrpaths.nix" \
+            -A paths \
             -I "$src" \
             --argstr extraNixpkgsConfigJson ${lib.escapeShellArg (builtins.toJSON extraNixpkgsConfig)} \
             --option restrict-eval true \
             --option allow-import-from-derivation false \
-            --option eval-system "${evalSystem}" > $out/result.json
+            --option eval-system "${evalSystem}" > $out/paths.json
       '';
 
   singleSystem =
@@ -90,8 +90,8 @@ let
       # Note that this is intentionally not called `system`,
       # because `--argstr system` would only be passed to the ci/default.nix file!
       evalSystem ? builtins.currentSystem,
-      # The path to the `result.json` file from `preEval`
-      preEvalFile ? "${preEval { inherit evalSystem; }}/result.json",
+      # The path to the `paths.json` file from `attrpathsSuperset`
+      attrpathFile ? "${attrpathsSuperset { inherit evalSystem; }}/paths.json",
     }:
     let
       singleChunk = writeShellScript "single-chunk" ''
@@ -100,7 +100,6 @@ let
         myChunk=$2
         system=$3
         outputDir=$4
-        preEvalFile=$5
 
         # Default is 5, higher values effectively disable the warning.
         # This randomly breaks Eval.
@@ -122,12 +121,12 @@ let
           --show-trace \
           --arg chunkSize "$chunkSize" \
           --arg myChunk "$myChunk" \
-          --arg preEvalFile "$preEvalFile" \
+          --arg attrpathFile "${attrpathFile}" \
           --arg systems "[ \"$system\" ]" \
           --arg includeBroken ${lib.boolToString includeBroken} \
           --argstr extraNixpkgsConfigJson ${lib.escapeShellArg (builtins.toJSON extraNixpkgsConfig)} \
           -I ${nixpkgs} \
-          -I "$preEvalFile" \
+          -I ${attrpathFile} \
           > "$outputDir/result/$myChunk" \
           2> "$outputDir/stderr/$myChunk"
         exitCode=$?
@@ -165,6 +164,12 @@ let
         echo "System: $evalSystem"
         cores=$NIX_BUILD_CORES
         echo "Cores: $cores"
+        attrCount=$(jq length "${attrpathFile}")
+        echo "Attribute count: $attrCount"
+        echo "Chunk size: $chunkSize"
+        # Same as `attrCount / chunkSize` but rounded up
+        chunkCount=$(( (attrCount - 1) / chunkSize + 1 ))
+        echo "Chunk count: $chunkCount"
 
         mkdir -p $out/${evalSystem}
 
@@ -185,61 +190,29 @@ let
           done
         ) &
 
-        chunkedEval() {
-          local chunkOutputDir=$1
-          local preEvalFile=$2
+        seq_end=$(( chunkCount - 1 ))
 
-          local attrCount=$(jq '.paths | length' "$preEvalFile")
-          echo "Attribute count: $attrCount"
-          echo "Chunk size: $chunkSize"
-          # Same as `attrCount / chunkSize` but rounded up
-          local chunkCount=$(( (attrCount - 1) / chunkSize + 1 ))
-          echo "Chunk count: $chunkCount"
+        ${lib.optionalString quickTest ''
+          seq_end=0
+        ''}
 
-          local seq_end=$(( chunkCount - 1 ))
-          ${lib.optionalString quickTest ''
-            seq_end=0
-          ''}
+        chunkOutputDir=$(mktemp -d)
+        mkdir "$chunkOutputDir"/{result,stats,timestats,stderr}
 
-          mkdir -p "$chunkOutputDir"/{result,stats,timestats,stderr}
+        seq -w 0 "$seq_end" |
+          command time -f "%e" -o "$out/${evalSystem}/total-time" \
+          xargs -I{} -P"$cores" \
+          ${singleChunk} "$chunkSize" {} "$evalSystem" "$chunkOutputDir"
 
-          seq -w 0 "$seq_end" |
-            xargs -I{} -P"$cores" \
-            ${singleChunk} "$chunkSize" {} "$evalSystem" "$chunkOutputDir" "$preEvalFile"
+        cp -r "$chunkOutputDir"/stats $out/${evalSystem}/stats-by-chunk
 
-          if (( chunkSize * chunkCount != attrCount )); then
-            # A final incomplete chunk would mess up the stats, don't include it
-            rm "$chunkOutputDir"/stats/"$seq_end"
-          fi
-        }
+        if (( chunkSize * chunkCount != attrCount )); then
+          # A final incomplete chunk would mess up the stats, don't include it
+          rm "$chunkOutputDir"/stats/"$seq_end"
+        fi
 
-        chunkOutputDirs=$(mktemp -d)
-
-        # Preparation for the second eval
-        disallowedAttributesPreEvalFile=$(mktemp)
-        jq '{
-          paths: (.attrPathsDisallowedForInternalUse | map(.attrPath)),
-          attrPathsDisallowedForInternalUse: []
-        }' ${preEvalFile} > "$disallowedAttributesPreEvalFile"
-
-        startEpoch=$(date +%s)
-
-        # The first eval evaluates only attributes that are not disallowed for internal Nixpkgs use, ensuring that they don't depend on disallowed attributes
-        # Because the first eval doesn't evaluate the disallowed attributes themselves, but we still want to check that they don't fail evaluation, we evaluate them separately in a second eval
-        # The reason we need two evals is because we want disallowed attributes to be able to depend on other disallowed attributes, which inherently needs a separate Nixpkgs instantiation
-        # And while we could interleave that instantiation into a single eval, that would ~double memory usage for all chunks, while doing it separately doesn't
-        echo "Evaluating the internally allowed attributes"
-        chunkedEval "$chunkOutputDirs"/allowed ${preEvalFile}
-        echo "Evaluating the internally disallowed attributes"
-        chunkedEval "$chunkOutputDirs"/disallowed "$disallowedAttributesPreEvalFile"
-
-        echo $(( $(date +%s) - startEpoch )) > "$out/${evalSystem}/total-time"
-
-        # We only use the stats from the allowed attrs eval, because the disallowed attrs are generally not even a full chunk
-        cp -r "$chunkOutputDirs"/allowed/stats $out/${evalSystem}/stats-by-chunk
-
-        cat "$chunkOutputDirs"/*/result/* | jq -s 'add | map_values(.outputs)' > $out/${evalSystem}/paths.json
-        cat "$chunkOutputDirs"/*/result/* | jq -s 'add | map_values(.meta)' > $out/${evalSystem}/meta.json
+        cat "$chunkOutputDir"/result/* | jq -s 'add | map_values(.outputs)' > $out/${evalSystem}/paths.json
+        cat "$chunkOutputDir"/result/* | jq -s 'add | map_values(.meta)' > $out/${evalSystem}/meta.json
       '';
 
   diff = callPackage ./diff.nix { };
@@ -315,9 +288,6 @@ let
       #   | jq --raw-input --slurp 'split("\n")[:-1]' > touched-files.json
       # ```
       touchedFilesJson ? builtins.toFile "touched-files.json" "[ ]",
-      # The branch the local comparison is made against; matches the `master`
-      # used in the touched-files expression above.
-      baseBranch ? "master",
     }:
     let
       diffs = symlinkJoin {
@@ -335,7 +305,7 @@ let
       };
       comparisonReport = compare {
         combinedDir = combine { diffDir = diffs; };
-        inherit touchedFilesJson baseBranch;
+        inherit touchedFilesJson;
       };
     in
     comparisonReport;
@@ -343,7 +313,7 @@ let
 in
 {
   inherit
-    preEval
+    attrpathsSuperset
     singleSystem
     diff
     combine

ci/eval/outpaths.nix

@@ -6,7 +6,7 @@
   includeBroken ? true, # set this to false to exclude meta.broken packages from the output
   path ? ./../..,
 
-  # used by ./pre-eval.nix
+  # used by ./attrpaths.nix
   attrNamesOnly ? false,
 
   # Set this to `null` to build for builtins.currentSystem only
@@ -14,8 +14,6 @@
     builtins.readFile (path + "/pkgs/top-level/release-supported-systems.json")
   ),
 
-  attrPathsDisallowedForInternalUse ? [ ],
-
   # Customize the config used to evaluate nixpkgs
   extraNixpkgsConfig ? { },
 }:
@@ -37,22 +35,6 @@ let
             allowVariants = !attrNamesOnly;
             checkMeta = true;
 
-            # We don't need to care about problems being caught using the
-            # standard mechanism, because any problems whose kind is not
-            # nixpkgsInternalUseAllowed cause the corresponding attributes to
-            # be disallowed entirely for internal use with
-            # attrPathsDisallowedForInternalUse, see also ./pre-eval.nix
-            problems.matchers = lib.mkForce [
-              # We only need to set the broken handler to error, so that CI
-              # doesn't evaluate those. No reason it couldn't evaluate them
-              # afaik, but this is how it's been before.
-              {
-                kind = "broken";
-                handler = "error";
-              }
-            ];
-            inherit attrPathsDisallowedForInternalUse;
-
             # Silence the `x86_64-darwin` deprecation warning.
             allowDeprecatedx86_64Darwin = true;
 

ci/eval/pre-eval.nix

@@ -1,128 +0,0 @@
-# This file does a fast pre-evaluation of Nixpkgs to determine:
-# - paths: A *superset* of all attrpaths of derivations which might be part of a release on *any* platform.
-# - attrPathsDisallowedForInternalUse: Attribute paths whose meta.problems has problems whose kinds should not be used internally in Nixpkgs
-#
-# This expression runs single-threaded under all current Nix
-# implementations, but much faster and with much less memory
-# used than ./outpaths.nix itself.
-#
-# Once you have the list of attrnames you can split it up into
-# $NUM_CORES batches and evaluate the outpaths separately for each
-# batch, in parallel.
-#
-# To dump the result:
-#
-#   nix-instantiate --eval --strict --json ci/eval/pre-eval.nix -A result
-#
-{
-  lib ? import (path + "/lib"),
-  trace ? false,
-  path ? ./../..,
-  extraNixpkgsConfigJson ? "{}",
-}:
-let
-
-  # TODO: Use mapAttrsToListRecursiveCond when this PR lands:
-  # https://github.com/NixOS/nixpkgs/pull/395160
-  listAttrs =
-    path: value:
-    let
-      result =
-        if path == [ "AAAAAASomeThingsFailToEvaluate" ] || !(lib.isAttrs value) then
-          [ ]
-        else if lib.isDerivation value then
-          [
-            {
-              inherit path value;
-            }
-          ]
-        else
-          lib.pipe value [
-            (lib.mapAttrsToList (
-              name: value:
-              lib.addErrorContext "while evaluating package set attribute path '${
-                lib.showAttrPath (path ++ [ name ])
-              }'" (listAttrs (path ++ [ name ]) value)
-            ))
-            lib.concatLists
-          ];
-    in
-    lib.traceIf trace "** ${lib.showAttrPath path}" result;
-
-  outpaths = import ./outpaths.nix {
-    inherit path;
-    extraNixpkgsConfig = builtins.fromJSON extraNixpkgsConfigJson;
-    attrNamesOnly = true;
-  };
-
-  list =
-    map
-      (path: {
-        inherit path;
-        # This looks a bit weird, but the only reason we care about this value
-        # is for the meta.problems check below, and stdenv's certainly don't
-        # have any problems, so this is fine :)
-        value = { };
-      })
-      [
-        # Some of the following are based on variants, which are disabled with `attrNamesOnly = true`.
-        # Until these have been removed from release.nix / hydra, we manually add them to the list.
-        [
-          "pkgsLLVM"
-          "stdenv"
-        ]
-        [
-          "pkgsArocc"
-          "stdenv"
-        ]
-        [
-          "pkgsZig"
-          "stdenv"
-        ]
-        [
-          "pkgsStatic"
-          "stdenv"
-        ]
-        [
-          "pkgsMusl"
-          "stdenv"
-        ]
-      ]
-    ++ listAttrs [ ] outpaths;
-  paths = map (attrs: attrs.path) list;
-  names = map lib.showAttrPath paths;
-
-  inherit (import ../../pkgs/stdenv/generic/problems.nix { inherit lib; })
-    disallowNixpkgsInternalUseKinds
-    ;
-
-  # Determine the list of attributes whose packages have any meta.problems
-  # with a kind that's disallowed from internal Nixpkgs use
-  attrPathsDisallowedForInternalUse = lib.pipe list [
-    (lib.map (
-      attrs:
-      attrs
-      // {
-        problematicProblems = builtins.tryEval (
-          lib.filterAttrs (name: problem: disallowNixpkgsInternalUseKinds ? ${problem.kind}) (
-            attrs.value.meta.problems or { }
-          )
-        );
-      }
-    ))
-    (lib.filter (attrs: attrs.problematicProblems.success && attrs.problematicProblems.value != { }))
-    (lib.map (attrs: {
-      attrPath = attrs.path;
-      reason = "it has certain meta.problems whose kinds are disallowed: ${
-        lib.generators.toPretty { } attrs.problematicProblems.value
-      }";
-    }))
-  ];
-in
-{
-  # TODO: Do we still need these? Probably not
-  inherit paths names;
-  result = {
-    inherit paths attrPathsDisallowedForInternalUse;
-  };
-}

ci/github-script/bot.js

@@ -206,8 +206,20 @@ module.exports = async ({ github, context, core, dry }) => {
 
     const maintainers = await getMaintainerMap(pull_request.base.ref)
 
+    const merge_bot_eligible = await handleMerge({
+      github,
+      context,
+      core,
+      log,
+      dry,
+      pull_request,
+      events,
+      maintainers,
+      getTeamMembers,
+      getUser,
+    })
+
     // Check for any human reviews other than the PR author, GitHub actions and other GitHub apps.
-    // `commit { oid }` is needed by handleMerge to verify approvals are against the current head.
     const reviews = (
       await github.graphql(
         `query($owner: String!, $repo: String!, $pr: Int!) {
@@ -219,7 +231,6 @@ module.exports = async ({ github, context, core, dry }) => {
             reviews(first: 100) {
               nodes {
                 state
-                commit { oid }
                 user: author {
                   # Only get users, no bots
                   ... on User {
@@ -255,20 +266,6 @@ module.exports = async ({ github, context, core, dry }) => {
         r.user.id !== pull_request.user?.id,
     )
 
-    const merge_bot_eligible = await handleMerge({
-      github,
-      context,
-      core,
-      log,
-      dry,
-      pull_request,
-      events,
-      reviews,
-      maintainers,
-      getTeamMembers,
-      getUser,
-    })
-
     const approvals = new Set(
       reviews
         .filter((review) => review.state === 'APPROVED')

ci/github-script/merge.js

@@ -2,11 +2,11 @@ const { classify } = require('../supportedBranches.js')
 
 function runChecklist({
   committers,
+  events,
   files,
   pull_request,
   log,
   maintainers,
-  reviews,
   user,
   userIsMaintainer,
 }) {
@@ -27,35 +27,18 @@ function runChecklist({
         .reduce((acc, cur) => acc?.intersection(cur) ?? cur)
 
   const approvals = new Set(
-    reviews
+    events
       .filter(
-        ({ state, commit }) =>
-          state === 'APPROVED' &&
+        ({ event, state, commit_id }) =>
+          event === 'reviewed' &&
+          state === 'approved' &&
           // Only approvals for the current head SHA count, otherwise authors could push
           // bad code between the approval and the merge.
-          commit?.oid === pull_request.head.sha,
+          commit_id === pull_request.head.sha,
       )
-      .map(({ user }) => user.id),
-  )
-
-  // A "changes requested" review from a committer blocks both the merge queue and
-  // auto-merge, even if it was made on an older commit (unlike approvals, GitHub does
-  // not auto-dismiss changes-requested reviews on push). For each committer, take their
-  // latest actionable review; if it's CHANGES_REQUESTED, they're blocking the PR.
-  // Dismissed reviews surface as DISMISSED and comment-only follow-ups as COMMENTED, so
-  // both are skipped naturally — the prior actionable review still stands until the
-  // committer explicitly approves or requests changes again.
-  const committerReviewState = new Map()
-  for (const { user, state } of reviews) {
-    if (
-      committers.has(user.id) &&
-      ['APPROVED', 'CHANGES_REQUESTED'].includes(state)
-    ) {
-      committerReviewState.set(user.id, state)
-    }
-  }
-  const noBlockingReviews = !Array.from(committerReviewState.values()).includes(
-    'CHANGES_REQUESTED',
+      .map(({ user }) => user?.id)
+      // Some users have been deleted, so filter these out.
+      .filter(Boolean),
   )
 
   const checklist = {
@@ -74,11 +57,6 @@ function runChecklist({
         pull_request.user.login === 'r-ryantm',
     },
     'PR is not a draft': !pull_request.draft,
-    // CI state is intentionally *not* a checklist item: auto-merge exists precisely to
-    // cover unfinished CI, and an already-failed CI is reported via the merge message
-    // (see merge() below) rather than a blanket refusal.
-    'PR is not blocked by a "changes requested" review from a [committer](https://github.com/orgs/NixOS/teams/nixpkgs-committers).':
-      noBlockingReviews,
   }
 
   if (user) {
@@ -119,7 +97,7 @@ function hasMergeCommand(body) {
   return (body ?? '')
     .replace(/<!--.*?-->/gms, '')
     .replace(/(^`{3,})[^`].*?\1/gms, '')
-    .match(/^@NixOS\/nixpkgs-merge-bot merge\s*$/im)
+    .match(/^@NixOS\/nixpkgs-merge-bot merge\s*$/m)
 }
 
 async function handleMergeComment({ github, body, node_id, reaction }) {
@@ -145,7 +123,6 @@ async function handleMerge({
   dry,
   pull_request,
   events,
-  reviews,
   maintainers,
   getTeamMembers,
   getUser,
@@ -171,14 +148,6 @@ async function handleMerge({
   // including an early exit when the first non-by-name file is found.
   if (files.length >= 100) return false
 
-  const noPrFailuresState = (
-    await github.rest.repos.listCommitStatusesForRef({
-      ...context.repo,
-      ref: pull_request.head.sha,
-      per_page: 100,
-    })
-  ).data.find(({ context }) => context === 'no PR failures')?.state
-
   // Only look through comments *after* the latest (force) push.
   const lastPush = events.findLastIndex(
     ({ event, sha, commit_id }) =>
@@ -204,12 +173,10 @@ async function handleMerge({
         )),
   )
 
-  // Returns `{ reaction, messages }`: the reaction to leave on the merge comment and the
-  // lines to append to the bot's reply. Throws only on an unexpected API error.
   async function merge() {
     if (dry) {
       core.info(`Merging #${pull_number}... (dry)`)
-      return { reaction: 'ROCKET', messages: ['Merge completed (dry)'] }
+      return ['Merge completed (dry)']
     }
 
     // Using GraphQL mutations instead of the REST /merge endpoint, because the latter
@@ -230,37 +197,16 @@ async function handleMerge({
         { node_id: pull_request.node_id, sha: pull_request.head.sha },
       )
       log('merge', 'Queued for merge')
-      return {
-        reaction: 'ROCKET',
-        messages: [
-          `:heavy_check_mark: [Queued](${resp.enqueuePullRequest.mergeQueueEntry.mergeQueue.url}) for merge (#306934)`,
-        ],
-      }
+      return [
+        `:heavy_check_mark: [Queued](${resp.enqueuePullRequest.mergeQueueEntry.mergeQueue.url}) for merge (#306934)`,
+      ]
     } catch (e) {
       log('Enqueuing failed', e.response.errors[0].message)
     }
 
-    // Enqueuing fails when the required status checks are not satisfied, yet. If CI has
-    // already failed, enabling auto-merge would be pointless: it would never fire, and
-    // fixing CI requires a new push, which invalidates this merge command anyway (we only
-    // act on comments after the latest push). So we don't enable auto-merge and instead
-    // ask for a fresh command once CI is green again.
-    if (['error', 'failure'].includes(noPrFailuresState)) {
-      log('merge', 'CI has failed, not enabling auto-merge')
-      return {
-        reaction: 'THUMBS_DOWN',
-        messages: [
-          ':x: Pull Request could not be merged: CI has failed (#305350).',
-          '',
-          '> [!TIP]',
-          '> PRs cannot be merged while CI is failing.',
-          '> Once CI is passing, comment `@NixOS/nixpkgs-merge-bot merge` again.',
-        ],
-      }
-    }
-
-    // CI has not finished yet, so we enable auto-merge. We could also only use auto-merge,
-    // but this often gets stuck for no apparent reason.
+    // If required status checks are not satisfied, yet, the above will fail. In this case
+    // we can enable auto-merge. We could also only use auto-merge, but this often gets
+    // stuck for no apparent reason.
     try {
       await github.graphql(
         `mutation($node_id: ID!, $sha: GitObjectID) {
@@ -273,17 +219,12 @@ async function handleMerge({
         { node_id: pull_request.node_id, sha: pull_request.head.sha },
       )
       log('merge', 'Auto-merge enabled')
-      return {
-        reaction: 'ROCKET',
-        messages: [
-          `:heavy_check_mark: Enabled Auto Merge (#306934)`,
-          '',
-          '> [!TIP]',
-          '> [Auto Merge](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/automatically-merging-a-pull-request) will queue this PR once required CI checks succeed.',
-          '> If CI fails instead, fixing it needs a new push, which disables Auto Merge and invalidates this command — comment `@NixOS/nixpkgs-merge-bot merge` again once CI is green.',
-          '> If GitHub gets stuck even though CI passed (it sometimes does), leaving another approval should kick off the merge.',
-        ],
-      }
+      return [
+        `:heavy_check_mark: Enabled Auto Merge (#306934)`,
+        '',
+        '> [!TIP]',
+        '> Sometimes GitHub gets stuck after enabling Auto Merge. In this case, leaving another approval should trigger the merge.',
+      ]
     } catch (e) {
       log('Auto Merge failed', e.response.errors[0].message)
       throw new Error(e.response.errors[0].message)
@@ -326,11 +267,11 @@ async function handleMerge({
 
     const { result, eligible, checklist } = runChecklist({
       committers,
+      events,
       files,
       pull_request,
       log,
       maintainers,
-      reviews,
       user: comment.user,
       userIsMaintainer: await isMaintainer(comment.user.login),
     })
@@ -367,12 +308,10 @@ async function handleMerge({
     }
 
     if (result) {
+      await react('ROCKET')
       try {
-        const { reaction, messages } = await merge()
-        await react(reaction)
-        body.push(...messages)
+        body.push(...(await merge()))
       } catch (e) {
-        await react('THUMBS_DOWN')
         // Remove the HTML comment with node_id reference to allow retrying this merge on the next run.
         body.shift()
         body.push(`:x: Merge failed with: ${e} (#371492)`)
@@ -397,11 +336,11 @@ async function handleMerge({
 
   const { result } = runChecklist({
     committers,
+    events,
     files,
     pull_request,
     log,
     maintainers,
-    reviews,
   })
 
   // Returns a boolean, which indicates whether the PR is merge-bot eligible in principle.

ci/pinned.json

@@ -9,10 +9,23 @@
       },
       "branch": "nixpkgs-unstable",
       "submodules": false,
-      "revision": "8c91a71d13451abc40eb9dae8910f972f979852f",
-      "url": "https://github.com/NixOS/nixpkgs/archive/8c91a71d13451abc40eb9dae8910f972f979852f.tar.gz",
-      "hash": "sha256-fnzKKPvS+oieI/pTzotA5tkoM47EB1NpaBcgk4R97hE="
+      "revision": "02f3fa0374fa13707d42d55d58ecc76b091f223c",
+      "url": "https://github.com/NixOS/nixpkgs/archive/02f3fa0374fa13707d42d55d58ecc76b091f223c.tar.gz",
+      "hash": "0z8d33c5g0gk9a74ppqq77npisf9xx9c8ai9isxa2hyjx4lv1pki"
+    },
+    "treefmt-nix": {
+      "type": "Git",
+      "repository": {
+        "type": "GitHub",
+        "owner": "numtide",
+        "repo": "treefmt-nix"
+      },
+      "branch": "main",
+      "submodules": false,
+      "revision": "790751ff7fd3801feeaf96d7dc416a8d581265ba",
+      "url": "https://github.com/numtide/treefmt-nix/archive/790751ff7fd3801feeaf96d7dc416a8d581265ba.tar.gz",
+      "hash": "1zah3dmbpn3ap5acg22kq1j19dg32gj73l43yamjcxhc38sv9kd5"
     }
   },
-  "version": 8
+  "version": 5
 }

ci/treefmt.nix

@@ -1,170 +0,0 @@
-{
-  lib,
-  pkgs,
-  ...
-}:
-{
-  settings = {
-    # numtide/treefmt-nix defaults
-    excludes = [
-      "*.lock"
-      "*.patch"
-      "*.diff"
-      "package-lock.json"
-      "go.mod"
-      "go.sum"
-      ".gitattributes"
-      ".gitignore"
-      ".gitmodules"
-      "COPYING"
-      "LICENSE"
-    ];
-
-    # Be a bit more verbose by default, so we can see progress happening
-    verbose = 1;
-
-    # By default it's info, which is too noisy since we have many unmatched files
-    on-unmatched = "debug";
-
-    formatter = {
-      # keep-sorted start block=yes newline_separated=yes
-      actionlint = {
-        command = lib.getExe pkgs.actionlint;
-        includes = [
-          ".github/workflows/*.yml"
-          ".github/workflows/*.yaml"
-        ];
-      };
-
-      biome = {
-        command = lib.getExe pkgs.biome;
-        excludes = [
-          "*.min.js"
-          "pkgs/*"
-        ];
-        includes = [
-          "*.js"
-          "*.ts"
-          "*.mjs"
-          "*.mts"
-          "*.cjs"
-          "*.cts"
-          "*.jsx"
-          "*.tsx"
-          "*.d.ts"
-          "*.d.cts"
-          "*.d.mts"
-          "*.css"
-        ];
-        options = [
-          "check"
-          "--write"
-          "--no-errors-on-unmatched"
-          "--use-editorconfig=true"
-          "--javascript-formatter-quote-style=single"
-          "--semicolons=as-needed"
-        ];
-      };
-
-      editorconfig-checker = {
-        command = lib.getExe pkgs.editorconfig-checker;
-        options = [
-          "-disable-indent-size"
-          # TODO: Remove this once this upstream issue is fixed:
-          #   https://github.com/editorconfig-checker/editorconfig-checker/issues/505
-          "-disable-charset"
-        ];
-        includes = [ "*" ];
-        priority = 1;
-      };
-
-      keep-sorted = {
-        command = lib.getExe pkgs.keep-sorted;
-        includes = [ "*" ];
-      };
-
-      markdown-code-runner = {
-        command = lib.getExe pkgs.markdown-code-runner;
-        options =
-          let
-            config = pkgs.writers.writeTOML "markdown-code-runner-config" {
-              presets.nixfmt = {
-                language = "nix";
-                command = [ (lib.getExe pkgs.nixfmt) ];
-              };
-            };
-          in
-          [ "--config=${config}" ];
-        includes = [ "*.md" ];
-      };
-
-      nixf-diagnose = {
-        command = lib.getExe pkgs.nixf-diagnose;
-        excludes = [
-          # Auto-generated; violates sema-extra-with
-          # Can only sensibly be removed when --auto-fix supports multiple fixes at once:
-          # https://github.com/inclyc/nixf-diagnose/issues/13
-          "pkgs/servers/home-assistant/component-packages.nix"
-          # https://github.com/nix-community/nixd/issues/708
-          "nixos/maintainers/scripts/azure-new/examples/basic/system.nix"
-        ];
-        includes = [ "*.nix" ];
-        options = [
-          "--auto-fix"
-          # Rule names can currently be looked up here:
-          # https://github.com/nix-community/nixd/blob/main/libnixf/src/Basic/diagnostic.py
-          # TODO: Remove the following and fix things.
-          "--ignore=sema-unused-def-lambda-noarg-formal"
-          "--ignore=sema-unused-def-lambda-witharg-arg"
-          "--ignore=sema-unused-def-lambda-witharg-formal"
-          "--ignore=sema-unused-def-let"
-          # TODO: remove after outstanding prelude diagnostics issues are fixed:
-          # https://github.com/nix-community/nixd/issues/761
-          # https://github.com/nix-community/nixd/issues/762
-          "--ignore=sema-primop-removed-prefix"
-          "--ignore=sema-primop-overridden"
-          "--ignore=sema-constant-overridden"
-          "--ignore=sema-primop-unknown"
-        ];
-        # Ensure nixfmt cleans up after nixf-diagnose.
-        priority = -1;
-      };
-
-      # This uses nixfmt underneath, the default formatter for Nix code.
-      # See https://github.com/NixOS/nixfmt
-      nixfmt = {
-        command = lib.getExe pkgs.nixfmt;
-        includes = [ "*.nix" ];
-      };
-
-      yamlfmt = {
-        command = lib.getExe pkgs.yamlfmt;
-        excludes = [
-          # Aligns comments with whitespace
-          "pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml"
-          # TODO: Fix formatting for auto-generated file
-          "pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml"
-        ];
-        includes = [
-          "*.yaml"
-          "*.yml"
-        ];
-        options = [
-          "-formatter"
-          "retain_line_breaks=true"
-        ];
-      };
-
-      zizmor = {
-        command = lib.getExe pkgs.zizmor;
-        includes = [
-          ".github/workflows/*.yml"
-          ".github/workflows/*.yaml"
-          ".github/actions/**/*.yml"
-          ".github/actions/**/*.yaml"
-        ];
-      };
-      # keep-sorted end
-    };
-  };
-}

ci/update-pinned.sh

@@ -1,9 +1,8 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p npins -I nixpkgs=../
+#!nix-shell -i bash -p npins
 
 set -euo pipefail
 
 cd "$(dirname "${BASH_SOURCE[0]}")"
 
-npins --lock-file pinned.json upgrade
 npins --lock-file pinned.json update

doc/README.md

@@ -36,7 +36,7 @@ If the build succeeds, the manual will be in `./result/share/doc/nixpkgs/manual.
 
 ### Development environment
 
-To reduce repetition, consider using tools from the provided development environment:
+In order to reduce repetition, consider using tools from the provided development environment:
 
 Load it from the Nixpkgs documentation directory with
 
@@ -207,8 +207,6 @@ When needed, each convention explains why it exists, so you can make a decision
 Note that these conventions are about the **structure** of the manual (and its source files), not about the content that goes in it.
 You, as the writer of documentation, are still in charge of its content.
 
-**For prose style, see the [documentation styleguide](./styleguide.md).**
-
 ### One sentence per line
 
 Put each sentence in its own line.
@@ -221,16 +219,17 @@ When changing existing content, update formatting if possible, but avoid excessi
 
 ### Examples first
 
-Put examples before detailed explanations (see the [styleguide](./styleguide.md) for the rationale).
+Readers look at examples first: an example communicates what something does faster than a description.
+Put examples before detailed explanations.
 
-Use this structure for each documented item:
+Prefer this structure for each documented item:
 
 1. Title
-2. Abstract (optional, one sentence max)
+2. Abstract (optional, one sentence max, the example often speaks for itself)
 3. Example
 4. Explanation (details, edge cases, types, defaults)
 
-Rendered example:
+For instance:
 
 ````markdown
 ## `lib.toUpper`
@@ -282,9 +281,11 @@ Returns the difference as a number.
 
 Use the [admonition syntax](#admonitions) for callouts and examples.
 
-### `callPackage`-compatible examples
+### Provide self-contained examples
 
-Provide at least one example per function.
+Provide at least one example per function, and make examples self-contained.
+This is easier to understand for beginners.
+It also helps with testing that it actually works – especially once we introduce automation.
 
 Example code should be such that it can be passed to `pkgs.callPackage`.
 Instead of something like:

doc/build-helpers/fixed-point-arguments.chapter.md

@@ -1,39 +1,46 @@
 # Fixed-point arguments of build helpers {#chap-build-helpers-finalAttrs}
 
-`stdenv.mkDerivation` also accepts a [fixed-point function](#function-library-lib.fixedPoints.fix) instead of a plain attribute set:
+As mentioned in the beginning of this part, `stdenv.mkDerivation` could alternatively accept a fixed-point function. The input of this function, typically named `finalAttrs`, is expected to be the final state of the attribute set.  A build helper like this is said to accept **fixed-point arguments**.
 
-```nix
-stdenv.mkDerivation (finalAttrs: {
-  pname = "hello";
-  version = "2.12";
+Build helpers don't always support fixed-point arguments yet, as support in [`stdenv.mkDerivation`](#mkderivation-recursive-attributes) was first included in Nixpkgs 22.05.
 
-  src = fetchurl {
-    url = "mirror://gnu/hello/hello-${finalAttrs.version}.tar.gz";
-    hash = "sha256-...";
-  };
-})
-```
+## Defining a build helper with `lib.extendMkDerivation` {#sec-build-helper-extendMkDerivation}
 
-The function's input, conventionally named `finalAttrs`, is the final state of the attribute set. Here `src` reads `finalAttrs.version` instead of repeating the version string. A build helper like this is said to accept **fixed-point arguments**.
-
-Attributes that reference each other through `finalAttrs` stay correct when changing any of them with [`overrideAttrs`](#sec-pkg-overrideAttrs), because they all access the final values of the fixed-point computation.
-
-`rec` cannot do this: its self-references are fixed when the set is defined and ignore later overrides.
-See [recursive-sets](https://nix.dev/manual/nix/stable/language/syntax#recursive-sets) for the underlying mechanism.
-
-## Define a build helper with `lib.extendMkDerivation` {#sec-build-helper-extendMkDerivation}
-
-Use [`lib.customisation.extendMkDerivation`](#function-library-lib.customisation.extendMkDerivation) to define a build helper with fixed-point support from an existing one. It takes an attribute overlay similar to [`<pkg>.overrideAttrs`](#sec-pkg-overrideAttrs).
+Developers can use the Nixpkgs library function [`lib.customisation.extendMkDerivation`](#function-library-lib.customisation.extendMkDerivation) to define a build helper supporting fixed-point arguments from an existing one with such support, with an attribute overlay similar to the one taken by [`<pkg>.overrideAttrs`](#sec-pkg-overrideAttrs).
 
 Besides overriding, `lib.extendMkDerivation` also supports `excludeDrvArgNames` to optionally exclude some arguments in the input fixed-point arguments from passing down to the base build helper (specified as `constructDrv`).
 
 :::{.example #ex-build-helpers-extendMkDerivation}
 
-# Example `mkLocalDerivation` - a build helper over `mkDerivation`
+# Example definition of `mkLocalDerivation` extended from `stdenv.mkDerivation` with `lib.extendMkDerivation`
 
-Define a build helper named `mkLocalDerivation` that builds locally without using substitutes by default.
+We want to define a build helper named `mkLocalDerivation` that builds locally without using substitutes by default.
 
-Use `lib.extendMkDerivation`:
+Instead of taking a plain attribute set,
+
+```nix
+{
+  preferLocalBuild ? true,
+  allowSubstitute ? false,
+  specialArg ? (_: false),
+  ...
+}@args:
+
+stdenv.mkDerivation (
+  removeAttrs [
+    # Don't pass specialArg into mkDerivation.
+    "specialArg"
+  ] args
+  // {
+    # Arguments to pass
+    inherit preferLocalBuild allowSubstitute;
+    # Some expressions involving specialArg
+    greeting = if specialArg "hi" then "hi" else "hello";
+  }
+)
+```
+
+we could define with `lib.extendMkDerivation` an attribute overlay to make the result build helper also accept the attribute set's fixed point passing to the underlying `stdenv.mkDerivation`, named `finalAttrs` here:
 
 ```nix
 lib.extendMkDerivation {
@@ -60,8 +67,4 @@ lib.extendMkDerivation {
 ```
 :::
 
-To apply extra changes to the result derivation, pass `transformDrv` to `lib.extendMkDerivation`:
-
-```nix
-lib.customisation.extendMkDerivation { transformDrv = drv: /...; }
-```
+If one needs to apply extra changes to the result derivation, pass the derivation transformation function to `lib.extendMkDerivation` as `lib.customisation.extendMkDerivation { transformDrv = drv: ...; }`.

doc/build-helpers/testers.chapter.md

@@ -98,14 +98,6 @@ It has two modes:
 
 : The path to the files to check.
 
-`relocatable` (boolean, optional) {#tester-lycheeLinkCheck-param-relocatable}
-
-: Whether the site is expected to be relocatable, i.e. servable from any URL path prefix.
-
-  When `true` (the default), root-relative links (starting with `/`) are treated as errors, because they break when the site is served from a subpath or opened via `file://` URLs.
-
-  When `false`, root-relative links are resolved against the `site` directory.
-
 `remap` (attribute set, optional) {#tester-lycheeLinkCheck-param-remap}
 
 : An attribute set where the attribute names are regular expressions.
@@ -737,102 +729,4 @@ Notable attributes:
 
  * `driverInteractive`: a script that launches an interactive Python session in the context of the `testScript`.
 
-## `modularServiceCompliance` {#tester-modularServiceCompliance}
-
-Compliance suite for [modular service](https://nixos.org/manual/nixos/unstable/#modular-services) integrations.
-
-Tests that a service manager integration correctly handles the portable modular services contract: `process.argv`, sub-services, assertions, and warnings.
-
-### Return value {#tester-modularServiceCompliance-return}
-
-An attribute set of derivations which perform the tests during their build.
-
-### Inputs {#tester-modularServiceCompliance-inputs}
-
-`evalConfig` (function)
-
-: `{ services } -> { config; checkDrv; }`.
-  Function to evaluate the given services in the integration's full context.
-  This function is called for evaluation checks on configurations that will not be run.
-  - Input `services` is an attrset of modular service configurations. These should be used verbatim.
-  - Output attribute `config` is the resulting evaluated services attrset (e.g., the value of the `system.services` option in NixOS).
-    This attribute must be available even if `checkDrv` would fail.
-  - Output attribute `checkDrv` is a representative derivation whose existence and buildability prove the eval is sound (e.g., `system.build.toplevel` in NixOS, but could perhaps be more specific in the case of another process manager integration).
-
-`mkTest` (function)
-
-: `{ name, services, testExe } -> derivation`.
-  - Input `name` is a test name, suitable for use as a derivation name.
-  - Input `services` is an attrset of modular service configurations, matching the structure of the integration's services option.
-  - Input `testExe` is a store path to an executable that verifies the services.
-  - Output: a derivation that runs the service manager with the provided configuration inputs and then calls `testExe` after starting the services. That executable must have access to `sharedDir`.
-
-`sharedDir` (string)
-
-: Path to a directory writable by service processes and readable by `testExe`.
-  The integration must ensure this directory is available when the services and `testExe` run.
-
-:::{.example #ex-modularServiceCompliance-nixos}
-
-# NixOS invocation of the compliance suite
-
-```nix
-# In nixos/tests/all-tests.nix:
-# modularServiceCompliance =
-recurseIntoAttrs (
-  pkgs.testers.modularServiceCompliance {
-    sharedDir = "/tmp/modular-service-compliance";
-    evalConfig =
-      { services }:
-      let
-        machine = evalSystem (
-          { ... }:
-          {
-            system.services = services;
-            system.stateVersion = "25.05";
-            fileSystems."/" = {
-              device = "/test/dummy";
-              fsType = "auto";
-            };
-            boot.loader.grub.enable = false;
-          }
-        );
-      in
-      {
-        config = machine.config.system.services;
-        checkDrv = machine.config.system.build.toplevel;
-      };
-    mkTest =
-      {
-        name,
-        services,
-        testExe,
-      }:
-      runTest {
-        _class = "nixosTest";
-        inherit name;
-        nodes.machine.system.services = services;
-        testScript = ''
-          machine.wait_for_unit("multi-user.target")
-          machine.succeed("${testExe}")
-        '';
-      };
-  }
-)
-```
-
-:::
-
-### Manual compliance items {#tester-modularServiceCompliance-manual}
-
-The following compliance items are not yet automated and must be verified manually when implementing a new modular service integration.
-
-- **Failing assertions prevent deployment.**
-  A service with `assertions = [{ assertion = false; message = "..."; }]` must cause the deployment to fail.
-  The mechanism is integration-specific (e.g., NixOS checks assertions during `system.build.toplevel` evaluation).
-
-- **Warnings are visible to the user.**
-  A service with `warnings = [ "..." ]` must surface the warning to the user.
-  On NixOS these are `builtins.warn` messages emitted during evaluation.
-
 [file system object]: https://nix.dev/manual/nix/latest/store/file-system-object

doc/default.nix

@@ -1,5 +1,5 @@
 {
-  pkgs ? (import ../ci { }).docPkgs,
+  pkgs ? (import ../ci { }).pkgs,
   nixpkgs ? { },
 }:
 

doc/doc-support/package.nix

@@ -73,7 +73,6 @@ stdenvNoCC.mkDerivation (
             ../anchor.min.js
             ../manpage-urls.json
             ../redirects.json
-            ../nav.json
           ]
         );
     };
@@ -117,8 +116,8 @@ stdenvNoCC.mkDerivation (
         --script ./highlightjs/loader.js \
         --script ./anchor.min.js \
         --script ./anchor-use.js \
-        --sidebar-depth 3 \
-        --nav ./nav.json \
+        --toc-depth 1 \
+        --section-toc-depth 1 \
         manual.md \
         out/index.html
 

doc/hooks/index.md

@@ -37,7 +37,6 @@ npm-install-hook.section.md
 patch-rc-path-hooks.section.md
 perl.section.md
 pkg-config.section.md
-pnpm.section.md
 postgresql-test-hook.section.md
 premake.section.md
 python.section.md

doc/hooks/pnpm.section.md

@@ -1,142 +0,0 @@
-# pnpmBuildHook {#pnpm-build-hook}
-
-[pnpm](https://pnpm.io/) is a an NPM-compatible package manager focused on increasing managment speeds, and reducing disk space.
-
-The `pnpmBuildHook` in Nixpkgs overrides the default build phase for building packages that use pnpm.
-
-:::{.example #ex-pnpm-build-hook}
-## pnpmBuildHook example code snippet {#pnpm-build-hook-code-snippet}
-
-```nix
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchPnpmDeps,
-  pnpmConfigHook,
-  pnpmBuildHook,
-  makeBinaryWrapper,
-  pnpm_10,
-}:
-let
-  pnpm = pnpm_10;
-in
-stdenv.mkDerivation (finalAttrs: {
-  pname = "coolPackages";
-  version = "1.0";
-
-  src = fetchFromGitHub {
-    owner = "JaneCool";
-    repo = "coolpackage";
-    tag = finalAttrs.version;
-    hash = lib.fakeHash;
-  };
-
-  __structuredAttrs = true;
-  strictDeps = true;
-
-  pnpmDeps = fetchPnpmDeps {
-    inherit (finalAttrs) pname version src;
-    inherit pnpm;
-    fetcherversion = 4;
-    hash = lib.fakeHash;
-  };
-
-  nativeBuildInputs = [
-    pnpmConfigHook
-    pnpmBuildHook
-    makeBinaryWrapper
-  ];
-
-  pnpmBuildScript = "build";
-  pnpmBuildFlags = [
-    "--mode"
-    "production"
-  ];
-  pnpmWorkspaces = [
-    "test"
-  ];
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir "$out"
-    cp -r dist/. "$out"
-
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "very cool package that does cool things";
-    mainProgram = "cool";
-  };
-})
-```
-:::
-
-## Variables controlling pnpmBuildHook {#pnpm-build-hook-variables}
-
-### pnpm Exclusive Variables {#pnpm-build-hook-exclusive-variables}
-
-#### `pnpmBuildScript` {#pnpm-build-hook-script}
-
-Controls the script ran to build the package, by default the script is `build`.
-
-#### `pnpmFlags` {#pnpm-build-hook-flags}
-
-Controls flags used for all invocations of pnpm across all hooks local to this derivation.
-
-#### `pnpmBuildFlags` {#pnpm-build-hook-build-flags}
-
-Controls the flags pass only to the pnpm build script invocation.
-
-#### `dontPnpmBuild` {#pnpm-build-hook-dont}
-
-Disables automatically running `pnpmBuildHook`. The build can still be run manually if needed, for example:
-
-```nix
-{
-  lib,
-  rustPlatform,
-  pnpmBuildHook,
-  pnpmConfigHook,
-  fetchPnpmDeps,
-  emptyDirectory,
-  pnpm_10,
-}:
-let
-  pnpm = pnpm_10;
-in
-rustPlatform.buildRustPackage (finalAttrs: {
-  pname = "super-fast-application";
-  version = "1.0";
-
-  src = emptyDirectory;
-
-  cargoHash = lib.fakeHash;
-
-  nativeBuildInputs = [
-    pnpmBuildHook
-    pnpmConfigHook
-  ];
-
-  pnpmDeps = fetchPnpmDeps {
-    inherit (finalAttrs) pname version src;
-    inherit pnpm;
-    fetcherversion = 4;
-    hash = lib.fakeHash;
-  };
-
-  dontPnpmBuild = true;
-  postBuild = ''
-    pnpmBuildHook
-  '';
-})
-```
-
-### Honored Variables {#pnpm-build-hook-honored-variables}
-
-The following variables are honored by `pnpmBuildHook`.
-
-* [`pnpmRoot`](#javascript-pnpm-sourceRoot)
-* [`pnpmWorkspaces`](#javascript-pnpm-workspaces)

doc/languages-frameworks/beam.section.md

@@ -125,7 +125,7 @@ There are 2 ways to package backend dependencies: either per-dependency mix2nix
 
 When writing an elixir project targeting `mixRelease`, you can also consider using [deps_nix](https://github.com/code-supply/deps_nix) with `mixNixDeps`. `deps_nix` supports git dependencies, but is intended to be added to the project's `mix.exs` directly.
 
-##### mix2nix {#mix2nix}
+###### mix2nix {#mix2nix}
 
 `mix2nix` is a cli tool available in Nixpkgs. It will generate a Nix expression from a `mix.lock` file. It is quite standard in the 2nix tool series.
 
@@ -175,7 +175,7 @@ If there are git dependencies.
 
 You will need to run the build process once to fix the hash to correspond to your new git src.
 
-##### FOD {#fixed-output-derivation}
+###### FOD {#fixed-output-derivation}
 
 A fixed output derivation will download mix dependencies from the internet. To ensure reproducibility, a hash will be supplied. Note that mix is relatively reproducible. An FOD generating a different hash on each run hasn't been observed (as opposed to npm where the chances are relatively high). See [akkoma](https://github.com/NixOS/nixpkgs/blob/master/pkgs/by-name/ak/akkoma/package.nix) for a usage example of FOD.
 
@@ -255,7 +255,7 @@ Setup will require the following steps:
 
 #### Example of creating a service for an Elixir - Phoenix project {#example-of-creating-a-service-for-an-elixir---phoenix-project}
 
-To create a service with your release, you could add a `service.nix`
+In order to create a service with your release, you could add a `service.nix`
 in your project with the following
 
 ```nix

doc/languages-frameworks/haskell.section.md

@@ -679,7 +679,7 @@ Defaults to `false`.
 
 `genericBuilderArgsModifier`
 : This argument accepts a function allowing you to modify the arguments passed
-to `mkDerivation` to create the development environment. For example,
+to `mkDerivation` in order to create the development environment. For example,
 `args: { doCheck = false; }` would cause the environment to not include any test
 dependencies. Defaults to `lib.id`.
 

doc/languages-frameworks/javascript.section.md

@@ -309,8 +309,6 @@ pnpm is available as the top-level package `pnpm`. Additionally, there are varia
 
 When packaging an application that includes a `pnpm-lock.yaml`, you need to fetch the pnpm store for that project using a fixed-output-derivation. The function `fetchPnpmDeps` can create this pnpm store derivation. In conjunction, the setup hook `pnpmConfigHook` will prepare the build environment to install the pre-fetched dependencies store. Here is an example for a package that contains `package.json` and a `pnpm-lock.yaml` files using the fetcher and setup hook above:
 
-There is also the [`pnpmBuildHook`](#pnpm-build-hook) for building packages with `pnpm`, as seen in [](#ex-pnpm-build-hook).
-
 ```nix
 {
   fetchPnpmDeps,
@@ -366,7 +364,7 @@ It is highly recommended to use a pinned version of pnpm (i.e., `pnpm_9` or `pnp
 +let
 +  # Optionally override pnpm to use a custom nodejs version
 +  # Make sure that the same nodejs version is referenced in nativeBuildInputs
-+  # pnpm = pnpm_10.override { nodejs-slim = nodejs-slim_22; };
++  # pnpm = pnpm_10.override { nodejs = nodejs-slim_22; };
 +in
  stdenv.mkDerivation (finalAttrs: {
    pname = "foo";
@@ -408,8 +406,6 @@ In case you are patching `package.json` or `pnpm-lock.yaml`, make sure to pass `
 }
 ```
 
-If needed, `dontPnpmConfigure = true;` can be used to fully disable `pnpmConfigHook` without manually removing it from inputs.
-
 #### Dealing with `sourceRoot` {#javascript-pnpm-sourceRoot}
 
 If the pnpm project is in a subdirectory, you can just define `sourceRoot` or `setSourceRoot` for `fetchPnpmDeps`.
@@ -515,10 +511,10 @@ Changes can include workarounds or bug fixes to existing PNPM issues.
 
 ##### Version history {#javascript-pnpm-fetcherVersion-versionHistory}
 
-Version 3 is the minimum supported value. Versions 1 and 2 were removed in the 26.11 release; packages that still use them fail to evaluate and must migrate to `fetcherVersion = 3` (or later) and regenerate their hashes.
+Version 3 is the recommended value for new packages. Versions 1 and 2 are deprecated and scheduled for removal in the 26.11 release; existing packages must migrate.
 
-- 1: Initial version, nothing special. (removed in 26.11)
-- 2: [Ensure consistent permissions](https://github.com/NixOS/nixpkgs/pull/422975) (removed in 26.11)
+- 1: Initial version, nothing special.
+- 2: [Ensure consistent permissions](https://github.com/NixOS/nixpkgs/pull/422975)
 - 3: [Build a reproducible tarball](https://github.com/NixOS/nixpkgs/pull/469950)
 - 4: [Dump SQLite database to an SQL file](https://github.com/NixOS/nixpkgs/pull/522703)
 

doc/languages-frameworks/lua.section.md

@@ -162,14 +162,6 @@ the package `luarocks-packages-updater`:
 nix-shell -p luarocks-packages-updater --run luarocks-packages-updater
 ```
 
-To add a new package without updating all packages, run
-
-```sh
-
-nix-shell -p luarocks-packages-updater
-luarocks-packages-updater add <package-name>
-```
-
 [luarocks2nix](https://github.com/nix-community/luarocks) is a tool capable of generating nix derivations from both rockspec and src.rock (and favors the src.rock).
 The automation only goes so far though and some packages need to be customized.
 These customizations go in [pkgs/development/lua-modules/overrides.nix](https://github.com/NixOS/nixpkgs/tree/master/pkgs/development/lua-modules/overrides.nix).

doc/languages-frameworks/maven.section.md

@@ -174,59 +174,6 @@ To make sure that your package does not add extra manual effort when upgrading M
 </plugin>
 ```
 
-## Maven 4 {#maven-4}
-
-Alongside the default `maven` package (the latest Maven 3 release), nixpkgs ships `maven_4`, which packages the [Maven 4](https://maven.apache.org/whatsnewinmaven4.html) release line.
-
-`maven_4` is a standalone derivation and can be used as a drop-in replacement wherever `maven` is used, for example to build a project with the latest Maven 4:
-
-```nix
-{
-  lib,
-  fetchFromGitHub,
-  jre,
-  makeWrapper,
-  maven_4,
-}:
-
-maven_4.buildMavenPackage (finalAttrs: {
-  pname = "jd-cli";
-  version = "1.2.1";
-
-  src = fetchFromGitHub {
-    owner = "intoolswetrust";
-    repo = "jd-cli";
-    tag = "jd-cli-${finalAttrs.version}";
-    hash = "sha256-rRttA5H0A0c44loBzbKH7Waoted3IsOgxGCD2VM0U/Q=";
-  };
-
-  mvnHash = "";
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/bin $out/share/jd-cli
-    install -Dm644 jd-cli/target/jd-cli.jar $out/share/jd-cli
-
-    makeWrapper ${jre}/bin/java $out/bin/jd-cli \
-      --add-flags "-jar $out/share/jd-cli/jd-cli.jar"
-
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "Simple command line wrapper around JD Core Java Decompiler project";
-    homepage = "https://github.com/intoolswetrust/jd-cli";
-    license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ majiir ];
-  };
-})
-```
-
-`maven_4` exposes the same `buildMavenPackage` helper as `maven` (see [](#maven-buildmavenpackage)), so all of the patterns documented above apply equally. Note that the Maven dependencies resolved by Maven 4 differ from those resolved by Maven 3, so `mvnHash` must be recomputed when switching between the two.
-
 ## Manually using `mvn2nix` {#maven-mvn2nix}
 ::: {.warning}
 This way is no longer recommended; see [](#maven-buildmavenpackage) for the simpler and preferred way.
@@ -341,7 +288,7 @@ The double invocation is a _simple_ way to get around the problem that `nix-buil
 
 It treats the entire Maven repository as a single source to be downloaded, relying on Maven's dependency resolution to satisfy the output hash. This is similar to fetchers like `fetchgit`, except it has to run a Maven build to determine what to download.
 
-The first step will be to build the Maven project as a fixed-output derivation to collect the Maven repository -- below is an [example](https://github.com/fzakaria/nixos-maven-example/blob/main/double-invocation-repository.nix).
+The first step will be to build the Maven project as a fixed-output derivation in order to collect the Maven repository -- below is an [example](https://github.com/fzakaria/nixos-maven-example/blob/main/double-invocation-repository.nix).
 
 ::: {.note}
 Traditionally the Maven repository is at `~/.m2/repository`. We will override this to be the `$out` directory.
@@ -469,7 +416,7 @@ The previous example builds a `jar` file but that's not a file one can run.
 
 You need to use it with `java -jar $out/share/java/output.jar` and make sure to provide the required dependencies on the classpath.
 
-The following explains how to use `makeWrapper` to make the derivation produce an executable that will run the JAR file you created.
+The following explains how to use `makeWrapper` in order to make the derivation produce an executable that will run the JAR file you created.
 
 We will use the same repository we built above (either _double invocation_ or _buildMaven_) to setup a CLASSPATH for our JAR.
 

doc/languages-frameworks/neovim.section.md

@@ -25,7 +25,7 @@ neovim.override {
   withRuby = false;
   configure = {
     customRC = ''
-      " here your custom viml configuration goes!
+      # here your custom viml configuration goes!
     '';
     packages.myVimPackage = with pkgs.vimPlugins; {
       # See examples below on how to use custom packages.
@@ -47,7 +47,7 @@ neovim-qt.override {
   neovim = neovim.override {
     configure = {
       customRC = ''
-        " your custom viml configuration
+        # your custom viml configuration
       '';
     };
   };
@@ -64,14 +64,11 @@ For instance, `sqlite-lua` needs `g:sqlite_clib_path` to be set to work. Nixpkgs
 - `wrapRc`: Nix, not being able to write in your `$HOME`, loads the
   generated Neovim configuration via the `$VIMINIT` environment variable, i.e. : `export VIMINIT='lua dofile("/nix/store/…-init.lua")'`. This has side effects like preventing Neovim from sourcing your `init.lua` in `$XDG_CONFIG_HOME/nvim` (see bullet 7 of [`:help startup`](https://neovim.io/doc/user/starting.html#startup) in Neovim). Disable it if you want to generate your own wrapper. You can still reuse the generated vimscript init code via `neovim.passthru.initRc`.
 - `plugins`: A list of plugins to add to the wrapper.
-- `extraLuaPackages`: A function passed on to `lua.withPackages`.
-- `extraPython3Packages`: A function passed on to `python3.withPackages`.
-- `withPython3`, `withNodeJs`, `withRuby`, `withPerl` control when to enable neovim
+- `extraLuaPackages`: A function passed on to `lua.withPackages`
+- `withPython3`, `withNodeJs`, `withRuby` control when to enable neovim
   providers (see `:h provider`).
-- `vimAlias` and `viAlias` control whether to symlink the `vim` and `vi` binaries to `nvim` respectively.
-- `extraName` is a string appended to the package name and derivation name.
 
-```nix
+```
 wrapNeovimUnstable neovim-unwrapped {
   autoconfigure = true;
   autowrapRuntimeDeps = true;
@@ -83,8 +80,7 @@ wrapNeovimUnstable neovim-unwrapped {
     vim.opt.colorcolumn = { 100 }
     vim.opt.termguicolors = true
   '';
-  # plugins accepts a list of either plugins or attribute sets containing:
-  # { plugin = ...; config = ...; type = "viml"|"lua"; } (type defaults to "viml")
+  # plugins accepts a list of either plugins or { plugin = ...; config = ..vimscript.. };
   plugins = with vimPlugins; [
     {
       plugin = vim-obsession;
@@ -92,19 +88,7 @@ wrapNeovimUnstable neovim-unwrapped {
         map <Leader>$ <Cmd>Obsession<CR>
       '';
     }
-    {
-      plugin = grug-far-nvim;
-      type = "lua";
-      config = ''
-        require('grug-far').setup({
-          startInInsertMode = false,
-        })
-      '';
-    }
-    (nvim-treesitter.withPlugins (p: [
-      p.nix
-      p.python
-    ]))
+    (nvim-treesitter.withPlugins (p: [ p.nix p.python ]))
     hex-nvim
   ];
   extraLuaPackages = lp: [ lp.mpack ];
@@ -114,12 +98,12 @@ wrapNeovimUnstable neovim-unwrapped {
 }
 ```
 
-You can explore the configuration with `nix repl` to discover these options and
+You can explore the configuration with`nix repl` to discover these options and
 override them. For instance:
 ```nix
-neovim.override {
+neovim.overrideAttrs (oldAttrs: {
   autowrapRuntimeDeps = false;
-}
+})
 ```
 
 ## Specificities for some plugins {#neovim-plugin-specificities}
@@ -152,7 +136,7 @@ For example, if upstream documents that a plugin uses the Vim license but GitHub
 
 ## LuaRocks based plugins {#neovim-luarocks-based-plugins}
 
-To automatically handle plugin dependencies, several Neovim plugins
+In order to automatically handle plugin dependencies, several Neovim plugins
 upload their package to [LuaRocks](https://www.luarocks.org). This means less work for nixpkgs maintainers in the long term as dependencies get updated automatically.
 This means several Neovim plugins are first packaged as nixpkgs [lua
 packages](#packaging-a-library-on-luarocks), and converted via `buildNeovimPlugin` in
@@ -167,8 +151,6 @@ For instance:
 ```
 To update these packages, you should use the lua updater rather than vim's.
 
-To add a lua package to the `vimPlugins` set, add it to the `luarocksPackageNames` list in [luaPackagePlugins.nix](https://github.com/nixos/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/luaPackagePlugins.nix).
-
 ## Treesitter {#neovim-plugin-treesitter}
 
 [Treesitter](https://tree-sitter.github.io/) provides syntax parsing for Neovim, enabling features like:
@@ -264,43 +246,6 @@ You can install the standalone parsers and queries directly without installing `
 })
 ```
 
-### Treesitter setup using WASM parsers and queries {#neovim-plugin-treesitter-wasm}
-
-Neovim can load WASM parsers when it is built with Wasmtime support.
-In nixpkgs, WASM parser plugins are available from the `wasi32` cross package set:
-
-```nix
-(pkgs.wrapNeovim (pkgs.neovim-unwrapped.override { wasmSupport = true; }) {
-  configure = {
-    packages.myPlugins =
-      with pkgs.pkgsCross.wasi32.vimPlugins;
-      let
-        # Select the grammars you need
-        treesitter-grammars = with nvim-treesitter-parsers; [
-          nix
-          python
-        ];
-        # Queries are needed for treesitter based syntax highlighting and folds.
-        treesitter-queries = map (p: p.associatedQuery) treesitter-grammars;
-      in
-      {
-        start = [
-          # regular plugins
-        ]
-        ++ treesitter-grammars
-        ++ treesitter-queries;
-      };
-  };
-})
-```
-
-Do not install both native and WASM parsers for the same language.
-For example, installing both `pkgs.vimPlugins.nvim-treesitter-parsers.nix` and
-`pkgs.pkgsCross.wasi32.vimPlugins.nvim-treesitter-parsers.nix` is invalid because Neovim
-loads the first `parser/nix.*` found on `runtimepath`.
-
-Use `:checkhealth vim.treesitter` to verify Nix-managed WASM parsers.
-
 You can enable treesitter features for installed grammars in a `FileType` autocommand
 or in an `ftplugin/<language>.lua` script, e.g.
 

doc/languages-frameworks/python.section.md

@@ -48,6 +48,7 @@ Based on the packages defined in `pkgs/top-level/python-packages.nix` an
 attribute set is created for each available Python interpreter. The available
 sets are
 
+* `pkgs.python27Packages`
 * `pkgs.python3Packages`
 * `pkgs.python311Packages`
 * `pkgs.python312Packages`
@@ -59,7 +60,9 @@ sets are
 
 and the aliases
 
+* `pkgs.python2Packages` pointing to `pkgs.python27Packages`
 * `pkgs.python3Packages` pointing to `pkgs.python313Packages`
+* `pkgs.pythonPackages` pointing to `pkgs.python2Packages`
 * `pkgs.pypy2Packages` pointing to `pkgs.pypy27Packages`
 * `pkgs.pypy3Packages` pointing to `pkgs.pypy310Packages`
 * `pkgs.pypyPackages` pointing to `pkgs.pypy2Packages`
@@ -204,9 +207,25 @@ following are specific to `buildPythonPackage`:
 * `setupPyGlobalFlags ? []`: List of flags passed to `setup.py` command.
 * `setupPyBuildFlags ? []`: List of flags passed to `setup.py build_ext` command.
 
-##### Writing override-compatible packages {#buildpythonpackage-fixed-point-arguments}
+##### Using fixed-point arguments {#buildpythonpackage-fixed-point-arguments}
 
-Use `finalAttrs` to make a package easy to update and override:
+Both `buildPythonPackage` and `buildPythonApplication` support [fixed-point arguments](#chap-build-helpers-finalAttrs), similar to `stdenv.mkDerivation`.
+This allows you to reference the final attributes of the derivation.
+
+Instead of using `rec`:
+
+```nix
+buildPythonPackage rec {
+  pname = "pyspread";
+  version = "2.4";
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-...";
+  };
+}
+```
+
+You can use the `finalAttrs` pattern:
 
 ```nix
 buildPythonPackage (finalAttrs: {
@@ -220,9 +239,7 @@ buildPythonPackage (finalAttrs: {
 })
 ```
 
-When a downstream callsite *overrides* `version` the override becomes visible as `finalAttrs.version`.
-
-Both `buildPythonPackage` and `buildPythonApplication` support [fixed-point arguments](#chap-build-helpers-finalAttrs), similar to `stdenv.mkDerivation`.
+See the [general documentation on fixed-point arguments](#chap-build-helpers-finalAttrs) for more details on the benefits of this pattern.
 
 ::: {.note}
 
@@ -270,27 +287,29 @@ because their behaviour is different:
 The `buildPythonPackage` function has a `overridePythonAttrs` method that can be
 used to override the package. In the following example we create an environment
 where we have the `blaze` package using an older version of `pandas`. We
-first override the Python package set, then instantiate an interpreter with
-that package set.
+override first the Python interpreter and pass `packageOverrides` which contains
+the overrides for packages in the package set.
 
 ```nix
 with import <nixpkgs> { };
 
 let
-  pythonPackages = python3Packages.overrideScope (
-    final: prev: {
-      pandas = prev.pandas.overridePythonAttrs (old: rec {
-        version = "0.19.1";
-        src = fetchPypi {
-          pname = "pandas";
-          inherit version;
-          hash = "sha256-JQn+rtpy/OA2deLszSKEuxyttqBzcAil50H+JDHUdCE=";
-        };
-      });
-    }
-  );
+  python = pkgs.python3.override {
+    packageOverrides = self: super: {
+      pandas = super.pandas.overridePythonAttrs (
+        finalAttrs: prevAttrs: {
+          version = "0.19.1";
+          src = fetchPypi {
+            pname = "pandas";
+            inherit (finalAttrs) version;
+            hash = "sha256-JQn+rtpy/OA2deLszSKEuxyttqBzcAil50H+JDHUdCE=";
+          };
+        }
+      );
+    };
+  };
 in
-(pythonPackages.python.withPackages (ps: [ ps.blaze ])).env
+(python.withPackages (ps: [ ps.blaze ])).env
 ```
 
 The next example shows a non trivial overriding of the `blas` implementation to
@@ -298,16 +317,15 @@ be used through out all of the Python package set:
 
 ```nix
 {
-  python3PackagesWithBlas = python3Packages.overrideScope (
-    final: prev: {
+  python3MyBlas = pkgs.python3.override {
+    packageOverrides = self: super: {
       # We need toPythonModule for the package set to evaluate this
-      blas = final.toPythonModule (prev.blas.override { blasProvider = final.mkl; });
-      lapack = final.toPythonModule (prev.lapack.override { lapackProvider = final.mkl; });
-    }
-  );
+      blas = super.toPythonModule (super.pkgs.blas.override { blasProvider = super.pkgs.mkl; });
+      lapack = super.toPythonModule (super.pkgs.lapack.override { lapackProvider = super.pkgs.mkl; });
+    };
+  };
 }
 ```
-This will create a new Python package set with the blas and lapack implementation set to Intel MKL.
 
 This is particularly useful for numpy and scipy users who want to gain speed with other blas implementations.
 Note that using `scipy = super.scipy.override { blas = super.pkgs.mkl; };` will likely result in
@@ -439,10 +457,11 @@ Note that overriding packages deeper in the dependency graph _can_ work, but it'
 let
   pyproject = pkgs.lib.importTOML ./pyproject.toml;
 
-  myPython3Packages = pkgs.python3Packages.overrideScope (
-    final: _: {
+  myPython = pkgs.python.override {
+    self = myPython;
+    packageOverrides = pyfinal: pyprev: {
       # An editable package with a script that loads our mutable location
-      my-editable = final.mkPythonEditablePackage {
+      my-editable = pyfinal.mkPythonEditablePackage {
         # Inherit project metadata from pyproject.toml
         pname = pyproject.project.name;
         inherit (pyproject.project) version;
@@ -453,10 +472,10 @@ let
         # Inject a script (other PEP-621 entrypoints are also accepted)
         inherit (pyproject.project) scripts;
       };
-    }
-  );
+    };
+  };
 
-  pythonEnv = myPython3Packages.python.withPackages (ps: [ ps.my-editable ]);
+  pythonEnv = myPython.withPackages (ps: [ ps.my-editable ]);
 
 in
 pkgs.mkShell { packages = [ pythonEnv ]; }
@@ -556,6 +575,9 @@ In contrast to [`python.buildEnv`](#python.buildenv-function), [`python.withPack
 more advanced options such as `ignoreCollisions = true` or `postBuild`. If you
 need them, you have to use [`python.buildEnv`](#python.buildenv-function).
 
+Python 2 namespace packages may provide `__init__.py` that collide. In that case
+[`python.buildEnv`](#python.buildenv-function) should be used with `ignoreCollisions = true`.
+
 #### Setup hooks {#setup-hooks}
 
 The following are setup hooks specifically for Python packages. Most of these
@@ -607,9 +629,10 @@ buildPythonPackage.override { stdenv = customStdenv; } {
 
 Several versions of the Python interpreter are available on Nix, as well as a
 high amount of packages. The attribute `python3` refers to the default
-interpreter, which is currently CPython 3.13. It is also possible to refer to
-specific versions, e.g., `python313` refers to CPython 3.13, and `pypy` refers
-to the default PyPy interpreter.
+interpreter, which is currently CPython 3.13. The attribute `python` refers to
+CPython 2.7 for backwards compatibility. It is also possible to refer to
+specific versions, e.g., `python313` refers to CPython 3.13, and `pypy` refers to
+the default PyPy interpreter.
 
 Python is used a lot, and in different ways. This affects also how it is
 packaged. In the case of Python on Nix, an important distinction is made between
@@ -621,6 +644,14 @@ In the Nixpkgs tree Python applications can be found throughout, depending on
 what they do, and are called from the main package set. Python libraries,
 however, are in separate sets, with one set per interpreter version.
 
+The interpreters have several common attributes. One of these attributes is
+`pkgs`, which is a package set of Python libraries for this specific
+interpreter. E.g., the `toolz` package corresponding to the default interpreter
+is `python3.pkgs.toolz`, and the CPython 3.13 version is `python313.pkgs.toolz`.
+The main package set contains aliases to these package sets, e.g.
+`pythonPackages` refers to `python.pkgs` and `python313Packages` to
+`python313.pkgs`.
+
 #### Installing Python and packages {#installing-python-and-packages}
 
 The Nix and NixOS manuals explain how packages are generally installed. In the
@@ -990,7 +1021,7 @@ information. The output of the function is a derivation.
 
 An expression for `toolz` can be found in the Nixpkgs repository. As explained
 in the introduction of this Python section, a derivation of `toolz` is available
-for each interpreter version, e.g. `python313Packages.toolz` refers to the `toolz`
+for each interpreter version, e.g. `python313.pkgs.toolz` refers to the `toolz`
 derivation corresponding to the CPython 3.13 interpreter.
 
 The above example works when you're directly working on
@@ -1005,7 +1036,7 @@ with import <nixpkgs> { };
 
 (
   let
-    my_toolz = python313Packages.buildPythonPackage (finalAttrs: {
+    my_toolz = python313.pkgs.buildPythonPackage (finalAttrs: {
       pname = "toolz";
       version = "0.10.0";
       pyproject = true;
@@ -1015,7 +1046,7 @@ with import <nixpkgs> { };
         hash = "sha256-CP3V73yWSArRHBLUct4hrNMjWZlvaaUlkpm1QP66RWA=";
       };
 
-      build-system = [ python313Packages.setuptools ];
+      build-system = [ python313.pkgs.setuptools ];
 
       # has no tests
       doCheck = false;
@@ -1028,7 +1059,7 @@ with import <nixpkgs> { };
     });
 
   in
-  python313Packages.python.withPackages (
+  python313.withPackages (
     ps: with ps; [
       numpy
       my_toolz
@@ -1049,11 +1080,6 @@ of [`withPackages`](#python.withpackages-function) we used a `let` expression. Y
 `toolz` from the Nixpkgs package set this time, but instead took our own version
 that we introduced with the `let` expression.
 
-There is also a legacy API that can be accessed via `python3.pkgs`, which will also give access to
-the Python package set for a given interpreter. This API is not recommended to be used anymore
-because the package set at `python3.pkgs` is not spliced, while the package set at `python3Packages`
-is. This can lead to strange errors during cross-compilation, or if Python is used at build time.
-
 #### Handling dependencies {#handling-dependencies}
 
 Our example, `toolz`, does not have any dependencies on other Python packages or system libraries.
@@ -1614,7 +1640,7 @@ looked at how you can create environments in which specified packages are
 available.
 
 At some point you'll likely have multiple packages which you would
-like to be able to use in different projects. To minimise unnecessary
+like to be able to use in different projects. In order to minimise unnecessary
 duplication we now look at how you can maintain a repository with your
 own packages. The important functions here are `import` and `callPackage`.
 
@@ -1691,22 +1717,27 @@ should also be done when packaging `A`.
 
 ### How to override a Python package? {#how-to-override-a-python-package}
 
-We can override the Python package set, then instantiate an interpreter with it.
-In the following example we rename the `pandas` package and build it.
+We can override the interpreter and pass `packageOverrides`. In the following
+example we rename the `pandas` package and build it.
 
 ```nix
 with import <nixpkgs> { };
 
-let
-  pythonPackages = python3Packages.overrideScope (
-    final: prev: {
-      pandas = prev.pandas.overridePythonAttrs {
-        name = "foo";
-      };
-    }
-  );
-in
-(pythonPackages.python.withPackages (ps: [ ps.pandas ])).env
+(
+  let
+    python =
+      let
+        packageOverrides = self: super: {
+          pandas = super.pandas.overridePythonAttrs (old: {
+            name = "foo";
+          });
+        };
+      in
+      pkgs.python313.override { inherit packageOverrides; };
+
+  in
+  python.withPackages (ps: [ ps.pandas ])
+).env
 ```
 
 Using `nix-build` on this expression will build an environment that contains the
@@ -1722,10 +1753,12 @@ the updated `scipy` version.
 ```nix
 with import <nixpkgs> { };
 
-let
-  pythonPackages = python313Packages.overrideScope (_: prev: { scipy = prev.scipy_0_17; });
-in
-(pythonPackages.python.withPackages (ps: [ ps.blaze ])).env
+(
+  let
+    packageOverrides = self: super: { scipy = super.scipy_0_17; };
+  in
+  (pkgs.python313.override { inherit packageOverrides; }).withPackages (ps: [ ps.blaze ])
+).env
 ```
 
 The requested package `blaze` depends on `pandas` which itself depends on `scipy`.
@@ -1739,16 +1772,14 @@ let
   pkgs = import <nixpkgs> { };
   newpkgs = import pkgs.path {
     overlays = [
-      (_: prev: {
+      (self: super: {
         python313 =
           let
-            pythonPackages = prev.python313Packages.overrideScope (
-              _: prev: {
-                numpy = prev.numpy_1_18;
-              }
-            );
+            packageOverrides = python-self: python-super: {
+              numpy = python-super.numpy_1_18;
+            };
           in
-          pythonPackages.python3;
+          super.python313.override { inherit packageOverrides; };
       })
     ];
   };
@@ -1861,7 +1892,7 @@ pkgs.mkShell rec {
     pythonPackages.numpy
     pythonPackages.requests
 
-    # In this particular example, to compile any binary extensions they may
+    # In this particular example, in order to compile any binary extensions they may
     # require, the Python modules listed in the hypothetical requirements.txt need
     # the following packages to be installed locally:
     taglib
@@ -1889,8 +1920,9 @@ pkgs.mkShell rec {
 }
 ```
 
-In case the supplied venvShellHook is insufficient, you can define your own
-shell hook and adapt to your needs like in the following example:
+In case the supplied venvShellHook is insufficient, or when Python 2 support is
+needed, you can define your own shell hook and adapt to your needs like in the
+following example:
 
 ```nix
 with import <nixpkgs> { };
@@ -1903,6 +1935,8 @@ pkgs.mkShell rec {
   name = "impurePythonEnv";
   buildInputs = [
     pythonPackages.python
+    # Needed when using python 2.7
+    # pythonPackages.virtualenv
     # ...
   ];
 
@@ -1915,6 +1949,8 @@ pkgs.mkShell rec {
       echo "Skipping venv creation, '${venvDir}' already exists"
     else
       echo "Creating new venv environment in path: '${venvDir}'"
+      # Note that the module venv was only introduced in python 3, so for 2.7
+      # this needs to be replaced with a call to virtualenv
       ${pythonPackages.python.interpreter} -m venv "${venvDir}"
     fi
 
@@ -1941,17 +1977,19 @@ If you need to change a package's attribute(s) from `configuration.nix` you coul
 
 ```nix
 {
-  nixpkgs.config.packageOverrides = final: _: {
-    python3Packages = super.python3Packages.overrideScope (pySuper: {
-      twisted = pySuper.twisted.overridePythonAttrs {
-        src = final.fetchPypi {
-          pname = "Twisted";
-          version = "19.10.0";
-          hash = "sha256-c5S6fycq5yKnTz2Wnc9Zm8TvCTvDkgOHSKSQ8XJKUV0=";
-          extension = "tar.bz2";
-        };
+  nixpkgs.config.packageOverrides = super: {
+    python3 = super.python3.override {
+      packageOverrides = python-self: python-super: {
+        twisted = python-super.twisted.overridePythonAttrs (oldAttrs: {
+          src = super.fetchPypi {
+            pname = "Twisted";
+            version = "19.10.0";
+            hash = "sha256-c5S6fycq5yKnTz2Wnc9Zm8TvCTvDkgOHSKSQ8XJKUV0=";
+            extension = "tar.bz2";
+          };
+        });
       };
-    });
+    };
   };
 }
 ```
@@ -1967,7 +2005,7 @@ this snippet:
 
 ```nix
 {
-  myPythonPackages = python3Packages.overrideScope (final: super: { twisted = <...>; });
+  myPythonPackages = python3Packages.override { overrides = self: super: { twisted = <...>; }; };
 }
 ```
 
@@ -1976,17 +2014,19 @@ this snippet:
 Use the following overlay template:
 
 ```nix
-self: _: {
-  python3Packages = super.python3Packages.overrideScope (pySuper: {
-    twisted = pySuper.twisted.overrideAttrs {
-      src = final.fetchPypi {
-        pname = "Twisted";
-        version = "19.10.0";
-        hash = "sha256-c5S6fycq5yKnTz2Wnc9Zm8TvCTvDkgOHSKSQ8XJKUV0=";
-        extension = "tar.bz2";
-      };
+self: super: {
+  python = super.python.override {
+    packageOverrides = python-self: python-super: {
+      twisted = python-super.twisted.overrideAttrs (oldAttrs: {
+        src = super.fetchPypi {
+          pname = "Twisted";
+          version = "19.10.0";
+          hash = "sha256-c5S6fycq5yKnTz2Wnc9Zm8TvCTvDkgOHSKSQ8XJKUV0=";
+          extension = "tar.bz2";
+        };
+      });
     };
-  });
+  };
 }
 ```
 
@@ -2092,7 +2132,7 @@ See also [contributing section](#contributing).
 ### Are Python interpreters built deterministically? {#deterministic-builds}
 
 The Python interpreters are now built deterministically. Minor modifications had
-to be made to the interpreters to generate deterministic bytecode. This
+to be made to the interpreters in order to generate deterministic bytecode. This
 has security implications and is relevant for those using Python in a
 `nix-shell`.
 

doc/languages-frameworks/rocq.section.md

@@ -51,7 +51,7 @@ The recommended way of defining a derivation for a Rocq library, is to use the `
   * if it is a string of the form `owner:branch` then it tries to download the `branch` of owner `owner` for a project of the same name using the same vcs, and the `version` attribute of the resulting derivation is set to `"dev"`, additionally if the owner is not provided (i.e. if the `owner:` prefix is missing), it defaults to the original owner of the package (see below),
   * if it is a string of the form `"#N"`, and the domain is github, then it tries to download the current head of the pull request `#N` from github,
 * `defaultVersion` (optional). Rocq libraries may be compatible with some specific versions of Rocq only. The `defaultVersion` attribute is used when no `version` is provided (or if `version = null`) to select the version of the library to use by default, depending on the context. This selection will mainly depend on a `rocq-core` version number but also possibly on other packages versions (e.g. `mathcomp`). If its value ends up to be `null`, the package is marked for removal in end-user `rocqPackages` attribute set.
-* `release` (optional, defaults to `{}`), lists all the known releases of the library and for each of them provides an attribute set with at least a `hash` attribute (you may put the empty string `""` to automatically insert a fake hash, this will trigger an error which will allow you to find the correct hash), each attribute set of the list of releases also takes optional overloading arguments for the fetcher as below (i.e.`domain`, `owner`, `repo`, `rev`, `artifact` assuming the default fetcher is used) and optional overrides for the result of the fetcher (i.e. `version` and `src`).
+* `release` (optional, defaults to `{}`), lists all the known releases of the library and for each of them provides an attribute set with at least a `hash` attribute (you may put the empty string `""` in order to automatically insert a fake hash, this will trigger an error which will allow you to find the correct hash), each attribute set of the list of releases also takes optional overloading arguments for the fetcher as below (i.e.`domain`, `owner`, `repo`, `rev`, `artifact` assuming the default fetcher is used) and optional overrides for the result of the fetcher (i.e. `version` and `src`).
 * `fetcher` (optional, defaults to a generic fetching mechanism supporting github or gitlab based infrastructures), is a function that takes at least an `owner`, a `repo`, a `rev`, and a `hash` and returns an attribute set with a `version` and `src`.
 * `repo` (optional, defaults to the value of `pname`),
 * `owner` (optional, defaults to `"rocq-community"`).
@@ -153,7 +153,7 @@ For example, assuming you have a special `mathcomp` dependency you want to use,
 multinomials.override { mathcomp = my-special-mathcomp; }
 ```
 
-In Nixpkgs, all Rocq derivations take a `version` argument.  This can be overridden to easily use a different version:
+In Nixpkgs, all Rocq derivations take a `version` argument.  This can be overridden in order to easily use a different version:
 
 ```nix
 rocqPackages.multinomials.override { version = "1.5.1"; }

doc/languages-frameworks/ruby.section.md

@@ -125,7 +125,7 @@ With this file in your directory, you can run `nix-shell` to build and use the g
 
 The `bundlerEnv` is a wrapper over all the gems in your gemset. This means that all the `/lib` and `/bin` directories will be available, and the executables of all gems (even of indirect dependencies) will end up in your `$PATH`. The `wrappedRuby` provides you with all executables that come with Ruby itself, but wrapped so they can easily find the gems in your gemset.
 
-One common issue that you might have is that you have Ruby, but also `bundler` in your gemset. That leads to a conflict for `/bin/bundle` and `/bin/bundler`. You can resolve this by wrapping either your Ruby or your gems in a `lowPrio` call. So to give the `bundler` from your gemset priority, it would be used like this:
+One common issue that you might have is that you have Ruby, but also `bundler` in your gemset. That leads to a conflict for `/bin/bundle` and `/bin/bundler`. You can resolve this by wrapping either your Ruby or your gems in a `lowPrio` call. So in order to give the `bundler` from your gemset priority, it would be used like this:
 
 ```nix
 # ...
@@ -265,7 +265,7 @@ Now that you know how to get a working Ruby environment with Nix, it's time to g
 
 All gems in the standard set are automatically generated from a single `Gemfile`. The dependency resolution is done with `bundler` and makes it more likely that all gems are compatible with each other.
 
-To add a new gem to nixpkgs, you can put it into the `/pkgs/development/ruby-modules/with-packages/Gemfile` and run `./maintainers/scripts/update-ruby-packages`.
+In order to add a new gem to nixpkgs, you can put it into the `/pkgs/development/ruby-modules/with-packages/Gemfile` and run `./maintainers/scripts/update-ruby-packages`.
 
 To test that it works, you can then try using the gem with:
 

doc/languages-frameworks/rust.section.md

@@ -885,7 +885,8 @@ general. A number of other parameters can be overridden:
   empty, or `"forbid"` (no cap) when `lints` is set. Because `rustc`
   only honours the first `--cap-lints` it receives, this cannot be
   changed via `extraRustcOpts`; use this attribute instead. Useful
-  with `useClippy`, since clippy lints are also capped by this flag:
+  when overriding the `rust` attribute to point at `clippy-driver`,
+  since clippy lints are also capped by this flag:
 
   ```nix
   (hello { }).override { capLints = "warn"; }
@@ -911,34 +912,6 @@ general. A number of other parameters can be overridden:
   }
   ```
 
-- Whether to compile the crate with `clippy-driver` instead of `rustc`.
-  Build scripts (`build.rs`) keep plain `rustc`. The default `capLints`
-  of `"allow"` suppresses all lints including clippy's, so this is
-  usually paired with `capLints` and lint flags via `extraRustcOpts`:
-
-  ```nix
-  (hello { }).override {
-    useClippy = true;
-    capLints = "warn";
-    extraRustcOpts = [
-      "-Dwarnings"
-      "-Wclippy::all"
-    ];
-  }
-  ```
-
-  When using a Rust toolchain that bundles its own `clippy-driver`
-  (rust-overlay, Fenix), pass it via `clippy` so the sysroot matches:
-
-  ```nix
-  (hello { }).override {
-    rust = myToolchain;
-    clippy = myToolchain;
-    useClippy = true;
-    capLints = "warn";
-  }
-  ```
-
 - Phases, just like in any other derivation, can be specified using
   the following attributes: `preUnpack`, `postUnpack`, `prePatch`,
   `patches`, `postPatch`, `preConfigure` (in the case of a Rust crate,

doc/languages-frameworks/swift.section.md

@@ -160,7 +160,7 @@ This essentially runs: `swift test -c release`
 
 In some cases, it may be necessary to patch a SwiftPM dependency. SwiftPM
 dependencies are located in `.build/checkouts`, but the `swiftpm2nix` helper
-provides these as symlinks to read-only `/nix/store` paths. To patch
+provides these as symlinks to read-only `/nix/store` paths. In order to patch
 them, we need to make them writable.
 
 A special function `swiftpmMakeMutable` is available to replace the symlink

doc/languages-frameworks/vim.section.md

@@ -153,7 +153,7 @@ Nix expressions for Vim plugins are stored in [pkgs/applications/editors/vim/plu
 
 When the vim updater detects an nvim-treesitter update, it also runs [`nvim-treesitter/update.py $(nix-build -A vimPlugins.nvim-treesitter)`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/utils/update.py) to update the tree sitter grammars for `nvim-treesitter`.
 
-Some plugins require overrides to function properly. Overrides are placed in [overrides.nix](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/overrides.nix). Overrides are most often required when a plugin requires some dependencies, or extra steps are required during the build process. For example `deoplete-fish` requires both `deoplete-nvim` and `vim-fish`, and so the following override was added:
+Some plugins require overrides in order to function properly. Overrides are placed in [overrides.nix](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/overrides.nix). Overrides are most often required when a plugin requires some dependencies, or extra steps are required during the build process. For example `deoplete-fish` requires both `deoplete-nvim` and `vim-fish`, and so the following override was added:
 
 ```nix
 {

doc/nav.json

@@ -1,3 +0,0 @@
-{
-  "open": []
-}

doc/packages/citrix.section.md

@@ -10,7 +10,7 @@ The tarball archive needs to be downloaded manually, as the license agreements o
 
 The [self-service](https://support.citrix.com/article/CTX200337) is an application for managing Citrix desktops and applications. Please note that this feature only works with at least `citrix_workspace_20_06_0` and later versions.
 
-To set this up, you first have to [download the `.cr` file from the Netscaler Gateway](https://its.uiowa.edu/support/article/102186). After that, you can configure the `selfservice` like this:
+In order to set this up, you first have to [download the `.cr` file from the Netscaler Gateway](https://its.uiowa.edu/support/article/102186). After that, you can configure the `selfservice` like this:
 
 ```ShellSession
 $ storebrowse -C ~/Downloads/receiverconfig.cr
@@ -19,7 +19,7 @@ $ selfservice
 
 ## Custom certificates {#sec-citrix-custom-certs}
 
-The `Citrix Workspace App` in `nixpkgs` trusts several certificates [from the Mozilla database](https://curl.haxx.se/docs/caextract.html) by default. However, several companies using Citrix might require their own corporate certificate. On distros with imperative packaging, these certs can be stored easily in [`$ICAROOT`](https://citrix.github.io/receiver-for-linux-command-reference/), however, this directory is a store path in `nixpkgs`. To work around this issue, the package provides a simple mechanism to add custom certificates without rebuilding the entire package using `symlinkJoin`:
+The `Citrix Workspace App` in `nixpkgs` trusts several certificates [from the Mozilla database](https://curl.haxx.se/docs/caextract.html) by default. However, several companies using Citrix might require their own corporate certificate. On distros with imperative packaging, these certs can be stored easily in [`$ICAROOT`](https://citrix.github.io/receiver-for-linux-command-reference/), however, this directory is a store path in `nixpkgs`. In order to work around this issue, the package provides a simple mechanism to add custom certificates without rebuilding the entire package using `symlinkJoin`:
 
 ```nix
 with import <nixpkgs> { config.allowUnfree = true; };

doc/packages/emacs.section.md

@@ -24,7 +24,7 @@ The Emacs package comes with some extra helpers to make it easier to configure.
 }
 ```
 
-You can install it like any other package via `nix-env -iA myEmacs`. However, this will only install those packages. It will not `configure` them for us. To do this, we need to provide a configuration file. Luckily, it is possible to do this from within Nix! By modifying the above example, we can make Emacs load a custom config file. The key is to create a package that provides a `default.el` file in `/share/emacs/site-start/`. Emacs knows to load this file automatically when it starts.  Similarly, for `early-init.el`, you can create a package that provides an `early-default.el` file in `/share/emacs/site-start/`.
+You can install it like any other package via `nix-env -iA myEmacs`. However, this will only install those packages. It will not `configure` them for us. To do this, we need to provide a configuration file. Luckily, it is possible to do this from within Nix! By modifying the above example, we can make Emacs load a custom config file. The key is to create a package that provides a `default.el` file in `/share/emacs/site-start/`. Emacs knows to load this file automatically when it starts.
 
 ```nix
 {

doc/packages/index.md

@@ -25,7 +25,6 @@ etc-files.section.md
 nginx.section.md
 nrfutil.section.md
 opengl.section.md
-packer.section.md
 shell-helpers.section.md
 python-tree-sitter.section.md
 treefmt.section.md

doc/packages/packer.section.md

@@ -1,70 +0,0 @@
-# Packer {#sec-packer}
-
-[Packer](https://www.packer.io) is a tool for creating identical machine images
-for multiple platforms from a single source configuration.
-
-## Using Packer with plugins {#sec-packer-with-plugins}
-
-Packer's functionality is extended through
-[plugins](https://developer.hashicorp.com/packer/docs/plugins). Rather than
-letting Packer download plugins at runtime, you can build a Packer wrapper that
-bundles the plugins you need with `packer.withPlugins`.
-
-`packer.withPlugins` takes a function that receives the set of available plugins
-and returns the list of plugins to include:
-
-```nix
-packer.withPlugins (ps: [ ps.docker ])
-```
-
-This produces a `packer` executable wrapped with the `PACKER_PLUGIN_PATH`
-environment variable set, so the selected plugins are available without a
-separate `packer plugins install` step.
-
-For example, to get a development shell with Packer and the Docker plugin:
-
-```nix
-{
-  pkgs ? import <nixpkgs> { },
-}:
-
-pkgs.mkShell {
-  packages = [
-    (pkgs.packer.withPlugins (ps: [ ps.docker ]))
-  ];
-}
-```
-
-Multiple plugins can be selected at once:
-
-```nix
-packer.withPlugins (ps: [
-  ps.docker
-  ps.qemu
-])
-```
-
-## Listing available plugins {#sec-packer-list-plugins}
-
-The packaged plugins are exposed as the `packer.plugins` attribute set. To list
-every plugin available in your version of Nixpkgs, query its attribute names:
-
-```ShellSession
-$ nix eval nixpkgs#packer.plugins --apply builtins.attrNames
-[ "docker" "qemu" ]
-```
-
-Without flakes:
-
-```ShellSession
-$ nix-env -f '<nixpkgs>' -qaP -A packer.plugins
-packer.plugins.docker  packer-plugin-docker-1.1.2
-packer.plugins.qemu    packer-plugin-qemu-1.1.4
-```
-
-The attribute name (for example `docker` or `qemu`) is what you pass to
-`packer.withPlugins`.
-
-Notes:
-
-- `mkPackerPlugin` currently only supports `fetchFromGitHub` as the fetcher.

doc/packages/urxvt.section.md

@@ -22,7 +22,7 @@ rxvt-unicode.override {
 
 If the `configure` function returns an attrset without the `plugins` attribute, `availablePlugins` will be used automatically.
 
-To add plugins but also keep all default plugins installed, it is possible to use the following method:
+In order to add plugins but also keep all default plugins installed, it is possible to use the following method:
 
 ```nix
 rxvt-unicode.override {

doc/packages/weechat.section.md

@@ -39,7 +39,7 @@ weechat.override {
 }
 ```
 
-To also keep all default plugins installed, it is possible to use the following method:
+In order to also keep all default plugins installed, it is possible to use the following method:
 
 ```nix
 weechat.override {

doc/redirects.json

@@ -105,9 +105,6 @@
   "ex-build-helpers-extendMkDerivation": [
     "index.html#ex-build-helpers-extendMkDerivation"
   ],
-  "ex-modularServiceCompliance-nixos": [
-    "index.html#ex-modularServiceCompliance-nixos"
-  ],
   "ex-pkgs-replace-vars": [
     "index.html#ex-pkgs-replace-vars",
     "index.html#ex-pkgs-substituteAll",
@@ -116,9 +113,6 @@
   "ex-pkgs-replace-vars-with": [
     "index.html#ex-pkgs-replace-vars-with"
   ],
-  "ex-pnpm-build-hook": [
-    "index.html#ex-pnpm-build-hook"
-  ],
   "ex-shfmt": [
     "index.html#ex-shfmt"
   ],
@@ -224,9 +218,6 @@
   "neovim-luarocks-based-plugins": [
     "index.html#neovim-luarocks-based-plugins"
   ],
-  "neovim-plugin-treesitter-wasm": [
-    "index.html#neovim-plugin-treesitter-wasm"
-  ],
   "nixpkgs-manual": [
     "index.html#nixpkgs-manual"
   ],
@@ -355,33 +346,6 @@
   "pkgs.treefmt.withConfig": [
     "index.html#pkgs.treefmt.withConfig"
   ],
-  "pnpm-build-hook": [
-    "index.html#pnpm-build-hook"
-  ],
-  "pnpm-build-hook-build-flags": [
-    "index.html#pnpm-build-hook-build-flags"
-  ],
-  "pnpm-build-hook-code-snippet": [
-    "index.html#pnpm-build-hook-code-snippet"
-  ],
-  "pnpm-build-hook-dont": [
-    "index.html#pnpm-build-hook-dont"
-  ],
-  "pnpm-build-hook-exclusive-variables": [
-    "index.html#pnpm-build-hook-exclusive-variables"
-  ],
-  "pnpm-build-hook-flags": [
-    "index.html#pnpm-build-hook-flags"
-  ],
-  "pnpm-build-hook-script": [
-    "index.html#pnpm-build-hook-script"
-  ],
-  "pnpm-build-hook-variables": [
-    "index.html#pnpm-build-hook-variables"
-  ],
-  "pnpm-build-hook-honored-variables": [
-    "index.html#pnpm-build-hook-honored-variables"
-  ],
   "preface": [
     "index.html#preface"
   ],
@@ -626,15 +590,6 @@
   "chap-overrides": [
     "index.html#chap-overrides"
   ],
-  "sec-packer": [
-    "index.html#sec-packer"
-  ],
-  "sec-packer-list-plugins": [
-    "index.html#sec-packer-list-plugins"
-  ],
-  "sec-packer-with-plugins": [
-    "index.html#sec-packer-with-plugins"
-  ],
   "sec-pkg-override": [
     "index.html#sec-pkg-override"
   ],
@@ -917,18 +872,6 @@
   "glibcxxassertions": [
     "index.html#glibcxxassertions"
   ],
-  "tester-modularServiceCompliance": [
-    "index.html#tester-modularServiceCompliance"
-  ],
-  "tester-modularServiceCompliance-inputs": [
-    "index.html#tester-modularServiceCompliance-inputs"
-  ],
-  "tester-modularServiceCompliance-manual": [
-    "index.html#tester-modularServiceCompliance-manual"
-  ],
-  "tester-modularServiceCompliance-return": [
-    "index.html#tester-modularServiceCompliance-return"
-  ],
   "tester-shfmt": [
     "index.html#tester-shfmt"
   ],
@@ -3999,9 +3942,6 @@
   "maven": [
     "index.html#maven"
   ],
-  "maven-4": [
-    "index.html#maven-4"
-  ],
   "maven-buildmavenpackage": [
     "index.html#maven-buildmavenpackage"
   ],

doc/release-notes/rl-2605.section.md

@@ -1,4 +1,4 @@
-# Nixpkgs 26.05 ("Yarara", 2026.05/30) {#sec-nixpkgs-release-26.05}
+# Nixpkgs 26.05 ("Yarara", 2026.05/??) {#sec-nixpkgs-release-26.05}
 
 ## Highlights {#sec-nixpkgs-release-26.05-highlights}
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -6,44 +6,6 @@
 - GCC has been updated from GCC 14 to GCC 15.
   This introduces some backwards incompatible changes; Refer to the [upstream porting guide](https://gcc.gnu.org/gcc-15/porting_to.html) for details.
 
-- `glibc` has been updated to version 2.42.
-
-  This version no longer makes the stack executable when a shared library requires this. A symptom
-  is an error like
-
-  > cannot enable executable stack as shared object requires: Invalid argument
-
-  This is usually a bug. Please consider reporting it to the software maintainers.
-
-  In a lot of cases, the library requires the execstack by mistake only. The following workarounds exist:
-
-  * When building the shared library in question from source, use the following linker flags to force turning off the
-    executable flag:
-
-    ```nix
-    mkDerivation {
-      # …
-
-      env.NIX_LDFLAGS = "-z,noexecstack";
-    }
-    ```
-
-  * If the sources are not available, the execstack-flag can be cleared with `patchelf`:
-
-    ```
-    patchelf --clear-execstack binary-only.so
-    ```
-
-  * If the shared library to be loaded actually requires an executable stack and it isn't turned
-    on by the application loading it, you may force allowing that behavior by setting the
-    following environment variable:
-
-    ```
-    GLIBC_TUNABLES=glibc.rtld.execstack=2
-    ```
-
-    **Do not set this globally!** This makes your setup inherently less secure.
-
 - Node.js default version has been updated from 22 LTS to 24 LTS.
   This introduces some breaking changes; Refer to the [upstream migration article](https://nodejs.org/en/blog/migrations/v22-to-v24) for details.
 
@@ -112,8 +74,6 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- `mdbook-linkcheck` has been removed as it is unmaintained and incompatible with the latest version of `mdbook`. Users can instead migrate to `mdbook-linkcheck2`.
-
 - The `nodePackages` package set has been removed entirely from nixpkgs. This package set was created to ease the maintenance burden of maintaining lots of
   NodeJS-based packages within nixpkgs, but became a burden itself. Over the past several releases, there has been a focus on removing it in favor of the more modern nixpkgs packaging strategies.
   After a long time, this package set has been deprecated and removed. If you are using its package set in your own config, please use the top-level packages instead.(i.e `pkgs.package-name` instead of `pkgs.nodePackages.package-name`).
@@ -151,23 +111,6 @@
 
 - `nodePackages.wavedrom-cli` has been removed, as it was unmaintained within nixpkgs.
 
-- MATE packages have been moved to top level (e.g. if you previously added `pkgs.mate.caja` to `environment.systemPackages`, you will need to change it to `pkgs.caja`).
-
-- `kratos` has been updated from 1.3.1 to [25.4.0](https://github.com/ory/kratos/releases/tag/v25.4.0). Upstream switched to a new versioning scheme (year.major.minor). Notable breaking changes:
-
-  - The `migrate sql` CLI command is now `migrate sql up`
-  - OIDC registration validation errors are now placed in the `default` node group instead of `oidc`
-  - Failed OIDC account linking returns HTTP 400 instead of 200
-
-- `pdns` has been updated to version [v5.0.x](https://doc.powerdns.com/authoritative/changelog/5.0.html), which introduces breaking changes. Check out the [Upgrade Notes](https://doc.powerdns.com/authoritative/upgrading.html#to-5-0-0) for details.
-
-- `geph` package's built-in GUI `geph5-client-gui` has been [removed](https://github.com/geph-official/geph5/commit/f2221fb8386312daf2cef05483ebb353ff48bdb4) by the upstream. All users who wish to continue using the GUI should install the `gephgui-wry`, which is consistent with the official release version.
-
-- `xfsprogs` was updated to version 6.18.0, which enables parent pointers and exchange-range by default. Upstream recommends not to use these features with kernels older than 6.18.
-   GRUB2 is likely unable to boot from filesystems with these features enabled.
-
-- `lunarvim` package has been removed, as it was abandoned upstream and relied on an old version of `neovim` to work properly.
-
 - `requireFile` now treats any `message` or `url` argument as a literal string, rather than subjecting it to Bash here-doc expansion.  This allows including strings like `$PWD` in the message without needing to know about and handle the undocumented Bash expansion.
 
 - `nodePackages.browserify` has been removed, as it was unmaintained within nixpkgs.
@@ -183,6 +126,8 @@
 - `kanata` now requires `karabiner-dk` version 6.0+ or later.
   The package has been updated to use the new `karabiner-dk` package and the `darwinDriver` output stays at the version defined in the package.
 
+- Reloading or restarting systemd units from the NixOS activation script is deprecated, and will be removed in NixOS 26.11. This deprecation is part of a bigger effort to deprecate activation scripts altogether, which will take place over several releases. There are no in-tree usages of the now-deprecated reload/restart functionality.
+
 - Keycloak has been updated to 26.6.X, bringing a lot of new features like federated client authentication, JWT authorization grants, workflows and the ability to do
   zero-downtime patch releases. Read more about [all the exciting new capabilities in keycloak 26.6 here](https://github.com/keycloak/keycloak/releases/tag/26.6.0)
   and [consult the migration guide to 26.6](https://www.keycloak.org/docs/latest/upgrading/index.html#migrating-to-26-6-0) to find out whether this is a breaking
@@ -232,7 +177,7 @@
 
 - `iroh` has been removed and split up into `iroh-dns-server` and `iroh-relay`.
 
-- The `xorg` package set has been deprecated, packages have moved to the top level.
+- the `xorg` package set has been deprecated, packages have moved to the top level.
 
 - `python3Packages.buildPythonPackage` and `python3Packages.buildPythonApplication` now throw errors in the presence of `pytestFlagsArray`.
   Please use [`pytestFlags` and `(enabled|disabled)(TestPaths|Tests|TestMarks)`](#using-pytestcheckhook) instead.
@@ -269,12 +214,23 @@
 - `jetbrains.plugins.addPlugins` no longer supports plugin names or ID strings.
   You can still use `addPlugins` with plugin derivations, such as plugins packaged outside of Nixpkgs.
 
+- The `programs.captive-browser` module no longer falls back on a setcap wrapper around udhcpc to discover your network's DNS server due to [GHSA-wc3r-c66x-8xmc](https://github.com/NixOS/nixpkgs/security/advisories/GHSA-wc3r-c66x-8xmc) (CVE-2026-25740). If you're using this module, you must either configure `programs.captive-browser.dhcp-dns` manually or enable one of NetworkManager, dhcpcd, or systemd-networkd.
+
 - NetBox was updated to `>= 4.5.5`. Have a look at the breaking changes
   of the [4.5 release](https://github.com/netbox-community/netbox/releases/tag/v4.5.0),
   make the required changes to your database, if needed, then upgrade by setting `services.netbox.package = pkgs.netbox_4_5;` in your configuration.
 
+- The `services.yggdrasil` module has been refactored with the following breaking changes:
+  - The `services.yggdrasil.configFile` option has been removed. Configuration should now be specified directly via `services.yggdrasil.settings`.
+  - The `services.yggdrasil.persistentKeys` option has been removed. To maintain persistent keys and IPv6 addresses across reboots, use `services.yggdrasil.settings.PrivateKeyPath` to securely load your private key from a file via systemd credentials. The private key must be in PEM format (PKCS #8).
+  - Storing `PrivateKey` directly in `settings` is now explicitly forbidden to prevent keys from being stored world-readable in the Nix store.
+  - If you previously used `configFile`, migrate your configuration to the `settings` option and extract the private key to a separate file referenced by `PrivateKeyPath`.
+  - If you previously used `persistentKeys`, convert your keys to PEM format and store them in a secure location accessible only to root, then reference them via `PrivateKeyPath`.
+
 - `pocket-id` has been updated to version 2 that contains [breaking changes](https://pocket-id.org/docs/setup/major-releases/migrate-v2).
 
+- `services.xserver` will now throw an error if an X11 driver specified in  `videoDriver(s)` cannot be found. Previously, unknown drivers would be silently ignored.
+
 - `asio` (standalone version of `boost::asio`) has been updated from 1.24.0 to 1.36.0. Some breaking changes were introduced between these
   two versions, and the one affected most was the removal of `asio::io_service` in favor of `asio::io_context` in 1.33.0. `asio_1_32_0` is
   retained for packages that have not completed migration. `asio_1_10` has been removed as no packages depend on it anymore.
@@ -297,6 +253,8 @@
 
 - Ethercalc and its associated module have been removed, as the package is unmaintained and cannot be installed from source with npm now.
 
+- The `services.avahi.wideArea` option now defaults to `false` as a mitigation against [`CVE-2024-52615`/`GHSA-x6vp-f33h-h32g`](https://github.com/avahi/avahi/security/advisories/GHSA-x6vp-f33h-h32g).
+
 - `coreth` has been removed, as upstream has moved it into `avalanchego`.
 
 - `nodePackages.prebuild-install` was removed because it appeared to be unmaintained upstream.
@@ -326,6 +284,8 @@
 
 - `shisho` has been removed because it's archived. `semgrep`, `opengrep`, and `ast-grep` provide similar functionality.
 
+- `services.openssh.settings.AcceptEnv` is now explicitly defined as an option that takes a list of strings, to facilitate option merging. Setting it to a string value is no longer supported.
+
 - All Xfce packages have been moved to top level (e.g. if you previously added `pkgs.xfce.xfce4-whiskermenu-plugin` to `environment.systemPackages`, you will need to change it to `pkgs.xfce4-whiskermenu-plugin`). The `xfce` scope will be removed in NixOS 26.11.
 
 - The Dovecot IMAP server has been updated to version 2.4, with the `dovecot` attribute now referring to this backwards-incompatible version. The attribute `dovecot_2_3` refers to the previous version. The Pigeonhole plugin has been similarly updated to 2.4, with the version compatible with Dovecot 2.3 being at `dovecot_pigeonhole_0_5`. See <https://doc.dovecot.org/latest/installation/upgrade/2.3-to-2.4.html> for more information on how to upgrade.
@@ -336,8 +296,12 @@
 
 - `vimPlugins.nvim-treesitter` has been updated to `main` branch, which is a full and incompatible rewrite. If you can't or don't want to update, you should use `vimPlugins.nvim-treesitter-legacy`.
 
+- `services.taskchampion-sync-server` module has had an option `services.taskchampion-sync-server.dynamicUser` added to use systemd's DynamicUser feature. This is enabled by default when stateVersion is at least 26.05, and disabled otherwise. If you need this feature, you need to set `services.taskchampion-sync-server.dynamicUser` to `true` and migrate `/var/lib/taskchampion-sync-server` to `/var/lib/private/taskchampion-sync-server`.
+
 - Package `jellyseerr` has been renamed to `seerr` following the upstream rename.
 
+- The default packages in `services.jenkins.packages` have been dropped, since not every Jenkins installation needs any package at all. It's more reasonable to leave it empty and let users configure what they need.
+
 - The `pie` hardening flag has been removed and will now error, after being deprecated in 25.11. Compilers are expected to enable PIE by default, as has been common practice since 2016 outside of Nixpkgs. If a package needs `pie` disabled pass `-no-pie` in `CFLAGS`. It is unlikely this will be necessary in many cases; due to the prevalence of default PIE toolchains, most packages incompatible with PIE already pass `-no-pie`.
 
 - `pqos-wrapper` was removed as it has been unmaintained since 2022 and not widely used.
@@ -350,8 +314,6 @@
 
 - `linuxPackages.nvidiaPackages` now follows NVIDIA's official release branches by exposing `production`, `new_feature`, and `beta`. The convenience aliases `latest` (newer of `production` and `new_feature`) and `bleeding_edge` (newer of `latest` and `beta`) are provided; note that `beta` now refers strictly to the beta branch.
 
-- `stestrCheckHook` was added: This test hook runs `stestr run`. You can disable tests with `disabledTests` and `disabledTestsRegex`.
-
 - `balatro` now supports the Google Play and Xbox PC versions of the game.  Pass the `apk` or `Assets.zip` as `balatro.override { src = "…" }`.
 
 - `uptime-kuma` has been updated to v2, which requires an automated migration that can take a few hours. **A backup is highly recommended.**
@@ -362,25 +324,17 @@
 
 - The `libcxxhardeningextensive` hardening flag has been **disabled** by default. Enabling it by default in 25.11 was unintentional and may have had a negative effect on performance in some cases. `libcxxhardeningfast` remains enabled by default.
 
-- Wine has been updated to the 11.0 branch. Please check the [upstream announcement](https://gitlab.winehq.org/wine/wine/-/releases/wine-11.0) for more details.
-
-- Cinnamon has been updated to 6.6, please check the [upstream announcement](https://www.linuxmint.com/rel_zena_whatsnew.php) for more details.
-
-- `rspamd` has been updated to 4.0. Please check the upstream [migration](https://docs.rspamd.com/tutorials/migration/#migration-to-rspamd-400) documentation, especially if you run a sharded Redis deployment.
-
-- `hyphen` now supports over 40 language variants through `hyphenDicts` and now allows to enable all supported languages through `hyphenDicts.all`.
-
-- `budgie` has been updated to 10.10, please check the [upstream announcement](https://buddiesofbudgie.org/blog/budgie-10-10-released) for more details.
-
 - The packages `ibtool`, `actool` and `re-plistbuddy` have been added, providing reimplementations of the corresponding proprietary Apple tools. They are more compatible with the originals than the previously existing `xcbuild` package, and should enable more darwin software to be built from source.
 
+- Switch inhibitors were introduced, which add a pre-switch check that compares a list of strings between the previous and the new generation, and refuses to switch into the new generation when there is a difference between the two lists. This allows avoiding switching into a system when for instance the systemd version changed by adding `config.systemd.package.version` to the switch inhibitors for your system. You can still forcefully switch into any generation by setting `NIXOS_NO_CHECK=1`.
+
 - GNU Taler has been updated to version 1.3.
   This release focuses on getting everything ready for a deployment of GNU Taler by Magnet bank.
   For more details, see the [upstream release notes](https://www.taler.net/en/news/2025-13.html).
 
-- `collabora-desktop` The desktop version of Collabora Office is now available, package version `25.05.9.2-2`.
+- The `services.nextcloud-spreed-signaling` NixOS module has been added to facilitate declarative management of a standalone Spreed signaling server ("High Performance Backend" for Nextcloud Talk).
 
-- The `services.geoserver` NixOS module has been added to allow running [Geoserver](https://geoserver.org/) as a service.
+- `collabora-desktop` The desktop version of Collabora Office is now available, package version `25.05.9.2-2`.
 
 - `fetchPnpmDeps` and `pnpmConfigHook` were added as top-level attributes, replacing the now deprecated `pnpm.fetchDeps` and `pnpm.configHook` attributes.
 
@@ -414,6 +368,8 @@
 
 - Updated `gonic` to 0.21.0. A full ("slow") scan is recommended after upgrading to v0.21.0 to pick up the newly scanned fields (contributors, ISRCs, record labels, per-track years, ARTIST_CREDIT).
 
+- the `autossh-ng` NixOS module was introduced as a simpler alternative to the existing `autossh` module.
+
 - Added `haskell.packages.microhs`, a set of Haskell packages built with MicroHs.
 
 - `gnuradio`: Overriding the `.pkgs` package set is now possible with a `packageOverrides` function, like with `python.pkgs` and other language-specific package sets.
@@ -432,6 +388,8 @@ gnuradioMinimal.override {
 }
 ```
 
+- Added `headplane` and `headplane-agent` packages, and `services.headplane` service.
+
 ## Nixpkgs Library {#sec-nixpkgs-release-26.05-lib}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -464,3 +422,4 @@ gnuradioMinimal.override {
 
 - The builder `php.buildComposerProject2` for PHP applications has been improved for better reliability and stability.
 
+- The `services.drupal` module has a few improvements aimed at making it better for installing custom Drupal instances, namely a new `webRoot` option for identifying custom webroots in source code, a new `configRoot` option for identifying and synchronizing config yamls onto NixOS, and some new settings for managing variable content and filepaths.

doc/release-notes/rl-2611.section.md

@@ -10,89 +10,21 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- `databricks-cli` has been updated from `0.290.2` to `1.x.x`, the first major release. OAuth tokens for interactive logins (`auth_type = databricks-cli`) are now stored in the OS-native secure store by default (Secret Service on Linux) instead of `~/.databricks/token-cache.json`; cached tokens from older versions are not migrated, so run `databricks auth login` once per profile after upgrading. To keep the previous file-backed storage, set `DATABRICKS_AUTH_STORAGE=plaintext` or add `auth_storage = plaintext` under `[__settings__]` in `~/.databrickscfg`. Additionally, the `vector_search_endpoints` DABs resource renamed `min_qps` to `target_qps` (and the `vector-search-endpoints` command renamed `--min-qps` to `--target-qps`). See the [upstream changelog](https://github.com/databricks/cli/blob/main/CHANGELOG.md) for details.
-
 - `hurl` has been updated to `8.x.x` which has some breaking changes. See [upstream changelog](https://github.com/Orange-OpenSource/hurl/releases/tag/8.0.0) for details.
-
-- `xsecurelock` no longer supports authentication via htaccess files (`~/.xsecurelock.pw`) or via the `pamtester` program by default. Only the recommended PAM module is supported unless rebuilt with `withHtaccess` or `withPamtester`.
-
 - `python3Packages.django-health-check` has been updated to major version 4. See its [migration guide](https://codingjoe.dev/django-health-check/migrate-to-v4/) and [changelog](https://github.com/codingjoe/django-health-check/releases/tag/4.0.0) for breaking changes.
 
-- `libgdata` has been removed, as it was archived upstream and relied on the insecure libsoup 2.4.
-
-- `services.mysql` now sets `root@localhost` authentication to `auth_socket` when used with `mysql` or `percona-server`.
-  Existing deployments will also be adjusted if possible. See the [security advisory GHSA-6qxx-6rg8-c4p8](https://github.com/NixOS/nixpkgs/security/advisories/GHSA-6qxx-6rg8-c4p8) for more information.
-
-- `uhttpmock` providing 0.0 ABI was removed. `uhttpmock_1_0` providing 1.0 ABI was renamed to `uhttpmock` and `uhttpmock_1_0` was kept as an alias.
-
-- `nix-serve-ng` (and `haskellPackages.nix-serve-ng`) is now built against Lix instead of CppNix, following upstream which has switched to Lix as its supported Nix implementation.
-
-- Linux kernel configuration has been moved out of the `linux-kernel` field of the platform structure into the kernel builders:
-  - `linux-kernel.name` has been removed.
-  - `linux-kernel.target` is available as the `target` parameter and passthru attribute on the kernel builders.
-  - `linux-kernel.installTarget` has been removed, as it should not be necessary to customize.
-  - `linux-kernel.DTB` is available as the `buildDTBs` parameter and passthru attribute on the kernel builders.
-  - `linux-kernel.{autoModules,preferBuiltin,extraConfig}` were already available as kernel builder parameters.
-
-- The `img` argument of `vmTools` has been renamed to `kernelImage`, as it collided with the top-level `img` package.
-  Additionally, the kernel module tree used inside the VM has been split out of the `kernel` argument into a new `kernelModules` argument (defaulting to `kernel`).
-  Callers that overrode `kernel` with a module tree (e.g. from `pkgs.aggregateModules`) to make extra modules available must now pass it via `kernelModules` instead, keeping `kernel` pointing at a bootable kernel derivation.
-
-- The ARMv5 Linux kernel build now uses a standard configuration and generates a standard compressed image instead of the deprecated legacy U‐Boot image format.
-  `lib.systems.{examples,platforms}.{sheevaplug,pogoplug4}` have been unified into `lib.systems.examples.armv5tel-multiplatform`.
-  Note that there is no official support for ARMv5 and it is not possible to build even a simple NixOS configuration out of the box.
-
-- `pdns` has been updated from `5.0.x` to `5.1.x`. Please be sure to review the [Upgrade Notes](https://doc.powerdns.com/authoritative/upgrading.html#to-5-1-0) before upgrading. Namely LUA record updates are no longer allowed by default, and the embedded webserver no longer includes a `access-control-allow-origin: *` header by default.
-
-- Support for the legacy U‐Boot image format has been removed from the Linux kernel builders, as it is deprecated upstream and no longer used by any platform in Nixpkgs.
-
-- `rke2` retires ingress-nginx and transitions to Traefik starting in `rke2_1_36`. Because ingress-nginx was retired upstream as of March 2026, Traefik is now the default
-  for new clusters starting in v1.36 (existing clusters will keep their current ingress upon upgrade to avoid breakage). This transition brings the following structural changes:
-  - Airgapped Environments: The rke2-images-core tarball now contains Traefik images instead of ingress-nginx. The standalone rke2-images-traefik tarball has been removed.
-    Users who must continue using ingress-nginx will now need to manually provide the rke2-images-ingress-nginx tarball.
-  - Future Removal: The ingress-nginx chart will not receive any additional updates and will be completely removed in v1.37 for community users.
-
-- `buildFHSEnvChroot` has been removed after deprecation in 23.05.
-
 - `requireFile` now sets `meta.license = lib.licenses.unfree` by default. Users of `requireFile`-based derivations that preserve this default will need to explicitly allow their evaluation as described in [](#sec-allow-unfree).
 
-- `librest` providing 0.7 ABI was removed. `librest_1_0` providing 1.0 ABI was renamed to `librest` and `librest_1_0` was kept as an alias.
-
-- `pnpm_10` was upgraded to version 10.34.1+, which introduced stricter integrity checks. If you encounter `ERR_PNPM_MISSING_TARBALL_INTEGRITY`, you can fall back to the older `pnpm_10_34_0`.
-
-- `fetchPnpmDeps`' `fetcherVersion = 1` and `fetcherVersion = 2` have been
-  removed, as announced in the 26.05 release. Packages still using them now
-  throw an evaluation error and must migrate to `fetcherVersion = 3` (or later)
-  and regenerate their hashes. See the
-  [pnpm `fetcherVersion` section](#javascript-pnpm-fetcherVersion) of the manual
-  for details.
-
-- `rebuilderd` has been updated to 0.27.0 introducing breaking changes. See upstream changelog for details: [0.26.0](https://github.com/kpcyrd/rebuilderd/releases/tag/v0.26.0), [0.27.0](https://github.com/kpcyrd/rebuilderd/releases/tag/v0.27.0)
-
-- Starting with v14, `flameshot` will primarily utilise xdg-desktop-portal calls for screenshotting. This will directly affect users on X11 window managers due to the lack of a compatible portal with Screenshot feature. See [upstream changelog](https://github.com/flameshot-org/flameshot/releases/tag/v14.0.0) or [NixOS Flameshot](https://wiki.nixos.org/wiki/Flameshot) wiki page for workarounds.
-
 ## Other Notable Changes {#sec-nixpkgs-release-26.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- `super-productivity` has been updated. The binary has been renamed from `super-productivity` to `superproductivity`. A symlink from the old name is provided for backward compatibility.
-
 - Package-URL (PURL, https://github.com/package-url/purl-spec) metadata identifier has been added for `fetchgit`, `fetchpypi` and `fetchFromGithub` fetchers.
   `mkDerivation` has been adjusted to reuse this information.
   Package-URLs allow reliably identifying and locating software packages.
   Maintainers of derivations using the adapted fetchers should rely on the `drv.src.meta.identifiers.v1.purl` default identifier and can enhance their `drv.meta.identifiers.v1.purls` list once they would like to have additional identifiers.
   Maintainers using `fetchurl` for `drv.src` are urged to adapt their `drv.meta.identifiers.purlParts` for proper identification.
 
-- Emacs loads the `early-default` library after `early-init.el`.
-  Users can add `early-init.el` via `emacs.pkgs.withPackages`
-  by packaging `early-init.el` into a library named `early-default`.
-  To prevent loading the `early-default` library,
-  set `inhibit-early-default-init` in `early-init.el`.
-
-- `services.ceph` enabled the generation of Ceph log files at `/var/log/ceph/`.
-  They were missing before because Ceph omitted logs when this directory was missing.
-  Ceph logs can grow large, so you may want to configure rotation of these logs.
-
 ## Nixpkgs Library {#sec-nixpkgs-release-26.11-lib}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

doc/stdenv/meta.chapter.md

@@ -77,7 +77,7 @@ A link or a list of links to the location of Changelog for a package. A link may
 
 ### `license` {#var-meta-license}
 
-The license, or licenses, for the package. One from the attribute set defined in [`nixpkgs/lib/licenses/licenses.nix`](https://github.com/NixOS/nixpkgs/blob/master/lib/licenses/licenses.nix). At this moment using both a list of licenses and a single license is valid. If the license field is in the form of a list representation, then it means that parts of the package are licensed differently. Each license should preferably be referenced by their attribute. The non-list attribute value can also be a space delimited string representation of the contained attribute `shortNames` or `spdxIds`. The following are all valid examples:
+The license, or licenses, for the package. One from the attribute set defined in [`nixpkgs/lib/licenses.nix`](https://github.com/NixOS/nixpkgs/blob/master/lib/licenses.nix). At this moment using both a list of licenses and a single license is valid. If the license field is in the form of a list representation, then it means that parts of the package are licensed differently. Each license should preferably be referenced by their attribute. The non-list attribute value can also be a space delimited string representation of the contained attribute `shortNames` or `spdxIds`. The following are all valid examples:
 
 - Single license referenced by attribute (preferred) `lib.licenses.gpl3Only`.
 - Single license referenced by its attribute shortName (frowned upon) `"gpl3Only"`.
@@ -216,7 +216,7 @@ If this list is not empty, the package is marked as "insecure", meaning that it
 
 ## Licenses {#sec-meta-license}
 
-The `meta.license` attribute should preferably contain a value from `lib.licenses` defined in [`nixpkgs/lib/licenses/licenses.nix`](https://github.com/NixOS/nixpkgs/blob/master/lib/licenses/licenses.nix), or in-place license description of the same format if the license is unlikely to be useful in another expression.
+The `meta.license` attribute should preferably contain a value from `lib.licenses` defined in [`nixpkgs/lib/licenses.nix`](https://github.com/NixOS/nixpkgs/blob/master/lib/licenses.nix), or in-place license description of the same format if the license is unlikely to be useful in another expression.
 
 Although it’s typically better to indicate the specific license, a few generic options are available:
 

doc/stdenv/stdenv.chapter.md

@@ -776,7 +776,7 @@ By default, the flag `--disable-dependency-tracking` is added to the configure f
 
 ##### `dontFixLibtool` {#var-stdenv-dontFixLibtool}
 
-By default, the configure phase applies some special hackery to all files called `ltmain.sh` before running the configure script to improve the purity of Libtool-based packages [^footnote-stdenv-sys-lib-search-path] . If this is undesirable, set this variable to true.
+By default, the configure phase applies some special hackery to all files called `ltmain.sh` before running the configure script in order to improve the purity of Libtool-based packages [^footnote-stdenv-sys-lib-search-path] . If this is undesirable, set this variable to true.
 
 ##### `dontDisableStatic` {#var-stdenv-dontDisableStatic}
 
@@ -939,7 +939,7 @@ The fixup phase performs (Nix-specific) post-processing actions on the files ins
 
 - It moves the `man/`, `doc/` and `info/` subdirectories of `$out` to `share/`.
 - It strips libraries and executables of debug information.
-- On Linux, it applies the `patchelf` command to ELF executables and libraries to remove unused directories from the `RPATH` to prevent unnecessary runtime dependencies.
+- On Linux, it applies the `patchelf` command to ELF executables and libraries to remove unused directories from the `RPATH` in order to prevent unnecessary runtime dependencies.
 - It rewrites the interpreter paths of shell scripts to paths found in `PATH`. E.g., `/usr/bin/perl` will be rewritten to `/nix/store/some-perl/bin/perl` found in `PATH`. See [](#patch-shebangs.sh) for details.
 
 #### Variables controlling the fixup phase {#variables-controlling-the-fixup-phase}
@@ -1345,7 +1345,7 @@ $ echo $configureFlags
 
 Nix itself considers a build-time dependency as merely something that should previously be built and accessible at build time—packages themselves are on their own to perform any additional setup. In most cases, that is fine, and the downstream derivation can deal with its own dependencies. But for a few common tasks, that would result in almost every package doing the same sort of setup work—depending not on the package itself, but entirely on which dependencies were used.
 
-To alleviate this burden, the setup hook mechanism was written, where any package can include a shell script that \[by convention rather than enforcement by Nix\], any downstream reverse-dependency will source as part of its build process. That allows the downstream dependency to merely specify its dependencies, and lets those dependencies effectively initialize themselves. No boilerplate mirroring the list of dependencies is needed.
+In order to alleviate this burden, the setup hook mechanism was written, where any package can include a shell script that \[by convention rather than enforcement by Nix\], any downstream reverse-dependency will source as part of its build process. That allows the downstream dependency to merely specify its dependencies, and lets those dependencies effectively initialize themselves. No boilerplate mirroring the list of dependencies is needed.
 
 The setup hook mechanism is a bit of a sledgehammer though: a powerful feature with a broad and indiscriminate area of effect. The combination of its power and implicit use may be expedient, but isn’t without costs. Nix itself is unchanged, but the spirit of added dependencies being effect-free is violated even if the latter isn’t. For example, if a derivation path is mentioned more than once, Nix itself doesn’t care and makes sure the dependency derivation is already built just the same—depending is just needing something to exist, and needing is idempotent. However, a dependency specified twice will have its setup hook run twice, and that could easily change the build environment (though a well-written setup hook will therefore strive to be idempotent so this is in fact not observable). More broadly, setup hooks are anti-modular in that multiple dependencies, whether the same or different, should not interfere and yet their setup hooks may well do so.
 

doc/style.css

@@ -34,7 +34,7 @@ body {
   }
 }
 
-.list-of-examples {
+.book .list-of-examples {
   display: none;
 }
 
@@ -131,32 +131,6 @@ body {
     padding-left: 1rem;
     padding-right: 1rem;
   }
-
-  /*
-  See: https://developer.mozilla.org/en-US/docs/Web/API/Popover_API
-
-  - :popover-open pseudo-class matches a popover element when it is in the showing state
-  - ::backdrop full-screen element placed directly behind popover
-  */
-  nav.toc-sidebar:popover-open {
-    position: fixed;
-    inset: 0 auto 0 0;
-    width: min(20rem, 85vw);
-    height: 100dvh;
-    max-height: none;
-    margin: 0;
-    padding: 1rem;
-    overflow-y: auto;
-    overscroll-behavior: contain;
-    background: var(--background);
-    border: 0;
-    border-right: 0.0625rem solid #d8d8d8;
-    box-shadow: 0 0 1.5rem rgb(0 0 0 / 0.35);
-  }
-
-  nav.toc-sidebar::backdrop {
-    background: rgb(0 0 0 / 0.5);
-  }
 }
 
 a {
@@ -413,6 +387,16 @@ div.appendix dt {
   margin-top: 1em;
 }
 
+div.book .toc dt,
+div.appendix .toc dt {
+  margin-top: 0;
+}
+
+div.book .list-of-examples dt,
+div.appendix .list-of-examples dt {
+  margin-top: 0;
+}
+
 div.book code,
 div.appendix code {
   padding: 0;
@@ -425,6 +409,17 @@ div.appendix code {
   hyphens: none;
 }
 
+div.book div.toc,
+div.appendix div.toc {
+  margin-bottom: 3em;
+  border-bottom: 0.0625rem solid #d8d8d8;
+}
+
+div.book div.toc dd,
+div.appendix div.toc dd {
+  margin-left: 2em;
+}
+
 div.book span.command,
 div.appendix span.command {
   font-family: monospace;
@@ -455,7 +450,6 @@ div.appendix .variablelist .term {
 }
 
 :root {
-  --sidebar-width: 20rem;
   --background: #fff;
   --main-text-color: #000;
   --link-color: #405d99;
@@ -502,106 +496,3 @@ div.appendix .variablelist .term {
 .chapter {
   content-visibility: auto;
 }
-
-.navheader {
-  position: sticky;
-  top: 0;
-  z-index: 1;
-  background-color: var(--background);
-}
-
-nav.toc-sidebar {
-  height: 100%;
-  padding: 0 1rem 2rem;
-}
-
-/* menu button, shown on mobile, hidden on desktop */
-.toc-toggle {
-  display: inline-flex;
-  align-items: center;
-  margin: 0.75rem 0 0;
-  padding: 0.4rem 0.8rem;
-  border: 0.0625rem solid #d8d8d8;
-  border-radius: 0.25rem;
-  background: var(--background);
-  color: var(--main-text-color);
-  font: inherit;
-  cursor: pointer;
-  position: fixed;
-  top: 0.5rem;
-  left: 0.8rem;
-  z-index: 2;
-}
-
-nav.toc-sidebar .toc {
-  margin-bottom: 0;
-}
-
-nav.toc-sidebar ol.toc,
-nav.toc-sidebar ol.toc ol {
-  list-style: none;
-  margin: 0;
-  padding-left: 0;
-}
-
-nav.toc-sidebar ol.toc ol {
-  padding-left: 1em;
-}
-
-nav.toc-sidebar li {
-  margin: 0;
-}
-
-nav.toc-sidebar summary {
-  cursor: pointer;
-}
-
-@media screen and (min-width: 768px) {
-  body {
-    height: 100vh;
-    min-height: 0;
-    display: grid;
-    grid-template-columns: minmax(0, 1fr);
-    grid-template-rows: auto minmax(0, 1fr);
-  }
-
-  body:has(> nav.toc-sidebar) {
-    grid-template-columns: var(--sidebar-width) minmax(0, 1fr);
-  }
-
-  .navheader {
-    grid-column: 1 / -1;
-    grid-row: 1;
-  }
-
-  nav.toc-sidebar {
-    /* un-pop the drawer */
-    display: block;
-    position: static;
-    inset: auto;
-    /*  */
-    margin: 0;
-    grid-column: 1;
-    grid-row: 2;
-    max-height: none;
-    overflow-y: auto;
-    border: none;
-    border-right: 0.0625rem solid #d8d8d8;
-  }
-
-  /* Hide the toggle button on desktop */
-  .toc-toggle {
-    display: none;
-  }
-
-  main.content {
-    grid-column: 1 / -1;
-    grid-row: 2;
-    overflow-y: auto;
-    padding: 0 1rem;
-  }
-
-  body:has(> nav.toc-sidebar) main.content {
-    grid-column: 2;
-  }
-}

doc/styleguide.md

@@ -1,420 +0,0 @@
-# Styleguide
-
-## Writing Principles
-
-A consistent style greatly increases the usability of all documentation and communication.
-
-Use this page as a reference and style guide for our internal and external documentation.
-
-### Knowledge Expectations
-
-**Assume competence, not familiarity.**
-
-Write for someone who knows a great deal — up to but not including this project.
-
-**What readers know:**
-
-- Basic computer operation
-- Command line familiarity
-- General interest in systems configuration
-
-**What readers don't know:**
-
-- NixOS-specific concepts
-- NixOS ecosystem details or grammar
-- NixOS workflows
-
-If specific knowledge is required, mention it at the start of the page.
-
-#### Show, Don't Tell
-
-The fastest path to understanding is a working example.
-People learn by doing, not by reading about doing.
-
-**Recommended structure:**
-
-- Start with the minimal working code or command
-- Briefly explain what it does
-- Cover edge cases or variations
-- Link to further information instead of including it
-
-#### Grammar and Style
-
-**Sentence structure:**
-
-- Use simple, direct sentences
-- Break complex ideas into multiple short sentences
-- Avoid nested clauses
-
-**Bad:**
-
-> The following command, which utilizes nixos-generate-config to produce a comprehensive hardware configuration, will write the results back into the respective configuration directory located on your local machine.
-
-What the user does is hidden in the middle.
-`nixos-generate-config` is a leaked implementation detail.
-Users care about *detecting hardware*, not *the tool that does it*.
-
-**Good:**
-
-> This command detects your hardware and saves the configuration.
-
-#### Content Organization
-
-Lead with value. State what the reader will accomplish before explaining how.
-
-**Bad:**
-
-> To create a new NixOS configuration that you can later use as a webserver, first navigate to your project directory, then add a new host configuration file with the desired machine name.
-
-**Good:**
-
-Add a webserver configuration to your NixOS setup:
-
-```nix
-# hosts/webserver/configuration.nix
-{ ... }:
-{
-  services.nginx.enable = true;
-}
-```
-
-Use **progressive disclosure**. Introduce concepts only when needed.
-
-**Recommended structure:**
-
-1. State the goal (one sentence)
-2. Show the simplest working example
-3. Explain concepts if needed
-4. Provide advanced options separately or link to the reference
-
-#### No Meta-commentary
-
-Don't describe what the documentation does. Just do it.
-
-**Don't:**
-
-> This section explains how to configure networking.
-> The following guide walks you through setting up a web server.
-
-**Do:**
-
-> Configure networking by setting:
-> Set up a web server:
-
-#### Code Examples
-
-**Keep examples focused:**
-
-- Show one concept at a time
-- Use realistic but simple scenarios
-- Avoid dependencies on other examples
-
-**Minimal comments**
-
-Let the code speak for itself.
-Paste code examples directly and without further alteration.
-
-**Bad:**
-
-```nix
-# This sets the hostname for the machine
-{
-  networking.hostName = "webserver"; # Change this to your machine's hostname
-  # This enables SSH access
-  services.openssh.enable = true; # Required for remote deployment
-}
-```
-
-**Good:**
-
-```nix
-{
-  networking.hostName = "webserver";
-  services.openssh.enable = true;
-}
-```
-
-#### Lead with Practical Examples
-
-Don't front-load theory. Readers want to accomplish something first, then understand why it works.
-
-- Show configuration as *what you want*, not *how the module system works*
-- Introduce Nix-specific concepts only when they are needed to complete the task
-- Defer language mechanics to reference pages or `nix.dev`
-
-**Bad:**
-
-> Before adding a service, you need to understand the NixOS module system and attribute set merging.
-
-**Good:**
-
-Enable nginx:
-
-```nix
-{ services.nginx.enable = true; }
-```
-
-This adds nginx to your system configuration. Rebuild to apply:
-
-```bash
-sudo nixos-rebuild switch
-```
-
-#### Teach Nix through examples, not theory
-
-
-Users learn the NixOS module system by seeing patterns first.
-
-- Start with a working example
-- Explanation follows the code
-- Link deeper concepts instead of inlining them
-- Link to `nix.dev` for optional learning
-
-#### General Rules
-
-- Abbreviate keys like `ssh-ed25519 AAAAC3NzaC…`
-- Abbreviate IP addresses like `192.168.XXX.XXX`
-- Variables are capitalized and start with `$`, e.g. `$YOUR_HOSTNAME`
-- Variables should be directly usable during copy-paste
-- Do **not** describe missing code parts (`#elided`, `#omitted`)
-- **Machine vs Host**: use "machine" for the NixOS system identity, "host" for the physical or virtual hardware
-
-#### Capitalization
-
-- GB / RAM / HDD
-- bootable USB drive
-- Wi-Fi / DHCP / DNS
-- macOS / NixOS / Nix / Linux
-- Flakes
-- git
-
-#### Headings
-
-Use sentence case. A reader scanning only headings should understand the page.
-
-**Don't:**
-
-> Getting Started
-> Overview
-> Configure The Database
-
-**Do:**
-
-> Set up a PostgreSQL database
-> Configure networking
-> Add a user to the system
-
-#### Imperative Mood, Voice, and Person
-
-Use imperative mood for instructions. Address the reader as "you", not "the user". Use active voice; in other words, make the subject do the action.
-
-**Don't:**
-
-> The user should run the following command.
-> The configuration will need to be updated.
-> The key is generated by the system.
-
-**Do:**
-
-> Run the command.
-> Update the configuration.
-> The system generates the key.
-
-#### Tense
-
-Use present tense for descriptions. Future tense makes documentation feel tentative.
-
-**Don't:**
-
-> This will create a new folder.
-> Running this command will install the package.
-
-**Do:**
-
-> This creates a new folder.
-> Running this command installs the package.
-
-#### Be Confident
-
-State facts. Don't hedge with "should," "might," "typically," or "usually" unless the behavior genuinely varies.
-
-**Don't:**
-
-> This should create the configuration file.
-> The service will usually start automatically.
-
-**Do:**
-
-> This creates the configuration file.
-> The service starts automatically.
-
-#### Avoid Nominalizations
-
-A nominalization is a verb turned into a noun, often by adding *-tion*, *-meant*, or *-ance* (e.g. "explanation", "selection"). The fix: find the hidden verb and use it directly.
-
-**Don't:**
-
-> Make a selection from the list.
-> Provide an explanation of the error.
-
-**Do:**
-
-> Select from the list.
-> Explain the error.
-
-#### Plain Words
-
-Technical precision for technical terms; plain language for everything else.
-
-- "use" not "utilize"
-- "start" not "initiate"
-- "end" not "terminate"
-- "help" not "facilitate"
-- "send" not "transmit"
-- "set up" not "establish"
-- "find out" not "ascertain"
-
-#### Filler Words and Weak Phrases
-
-Cut words and phrases that add length without meaning.
-
-Delete on sight:
-
-- "simply", "just", "easily", "basically", "obviously"
-- "in order to" → use "to"
-- "allows you to" → use the verb directly
-- "it's worth noting that" → just say the thing
-- no exclamation marks in technical prose
-
-**Don't:**
-
-> Simply run `nixos-rebuild switch`.
-> In order to deploy, you first need to run the command, which allows you to push the config.
-> It's worth noting that this requires root access.
-
-**Do:**
-
-> Run `nixos-rebuild switch`.
-> To deploy, run:
-> This requires root access.
-
-Every word must earn its place.
-
-#### Writing Procedures
-
-One instruction per sentence. Don't pack multiple actions into one sentence.
-
-**Don't:**
-
-> Navigate to your project directory and run the command, then check the output.
-
-**Do:**
-
-1. Navigate to your project directory.
-2. Run the command.
-3. Check the output.
-
-Don't bury the negative. Key limitations should be prominent, not a footnote after a positive description.
-
-**Don't:**
-
-> This service supports multiple roles, integrates with existing modules, and works great for most setups (note that multiple instances are not supported).
-
-**Do:**
-
-> This service does not support multiple instances.
-
-#### Consistent Terminology
-
-Pick a term and stick to it. Don't swap synonyms to avoid repetition. In technical documentation, repetition is clarity.
-
-**Don't:**
-
-> Create a machine... configure the host... deploy the node.
-
-**Do:**
-
-> Create a machine... configure the machine... deploy the machine.
-
-#### Links
-
-Use descriptive link text. Never use "click here" or "this link."
-
-**Don't:**
-
-> For more information, see `[this page](url)`.
-> Click `[here](url)` to read the reference.
-
-**Do:**
-
-> See the `[NixOS options reference](url)` for details.
-> Read the `[NixOS module system guide](url)`.
-
-Only link when the destination is directly relevant, not for generic background context (sometimes known as "Wikipedia-style links"). Readers feel obligated to click links, fearing they'll miss something important. Don't send them to a generic article about a technology when they're looking for how *your* system uses it.
-
-**Don't:**
-
-> Our software uses [SQLite](https://sqlite.org/) for storage.
-> *(Reader clicks expecting schema details — finds a generic product page instead.)*
-
-(Note that in the above example, the SQLite link is the SQLite home page, which is likely not pertinent.)
-
-**Do:**
-
-> See `[database schema](url)` for the full table structure.
-
-#### UI Language
-
-Match UI element names exactly: wording, casing, and spacing (even if a label seems oddly worded).
-
-**Don't:**
-
-> Click the generator button.
-> Select the save option.
-
-**Do:**
-
-> Click **Generate a Key**.
-> Click **Save Changes**.
-
-Someone will go looking for a button labeled "generator." They will not find it. They will be frustrated.
-
-Consistency between documentation and interface builds confidence. Words are part of the interface.
-
-:::{.tip}
-This can be tricky as UI changes; we don't yet have a policy in place for how to handle this. We welcome comments and suggestions.
-:::
-
-#### Clean system discipline
-
-Your machine has things new users don't: cached credentials, installed tools, environment variables, existing configuration. When writing or updating documentation:
-
-**Don't:**
-
-> Write steps from memory on your development machine, assuming what works there will work everywhere.
-
-**Do:**
-
-> - Start on a clean system — a fresh VM or new user account
-> - Take notes in real time as you work through the steps
-> - Document every warning, prompt, or unexpected output the system shows
-
-Also think in combinations: WSL vs native Linux, with and without existing keys. You don't need to test every matrix square — but you need to know which ones diverge.
-
-#### Never type code — always copy-paste
-
-Always copy commands and code from a terminal where you just ran them successfully. Never retype from memory.
-
-**Don't:**
-
-> Retype a command from memory into the documentation.
-> Retype code into a code-block from memory
-
-**Do:**
-
-> Paste commands directly from the shell or IDE.
-> Paste code that has been successfully validated with nix-instantiate or nix-build
-
-Replace sensitive values with placeholders: `<YOUR-KEY>`, `<YOUR-HOST>`, `<YOUR-TOKEN>`.
-
-Typed-from-memory commands introduce subtle errors. Even the most experienced software developers have occasional typos.

doc/using/configuration.chapter.md

@@ -152,7 +152,7 @@ There are several ways to tweak how Nix handles a package which has been marked
 
     Note that `allowlistedLicenses` only applies to unfree licenses unless `allowUnfree` is enabled. It is not a generic allowlist for all types of licenses. `blocklistedLicenses` applies to all licenses.
 
-A complete list of licenses can be found in the file [`nixpkgs/lib/licenses/licenses.nix`](https://github.com/NixOS/nixpkgs/blob/master/lib/licenses/licenses.nix) of the nixpkgs tree.
+A complete list of licenses can be found in the file `lib/licenses.nix` of the nixpkgs tree.
 
 ## Installing insecure packages {#sec-allow-insecure}
 

lib/attrsets.nix

@@ -5,6 +5,7 @@
 
 let
   inherit (builtins) head length;
+  inherit (lib.trivial) mergeAttrs;
   inherit (lib.strings)
     concatStringsSep
     concatMapStringsSep
@@ -12,18 +13,16 @@ let
     sanitizeDerivationName
     ;
   inherit (lib.lists)
-    all
-    concatLists
+    filter
+    foldr
+    foldl'
     concatMap
     elemAt
-    filter
-    foldl
-    foldl'
-    foldr
-    groupBy
+    all
     partition
-    reverseList
+    groupBy
     take
+    foldl
     ;
 in
 
@@ -371,11 +370,7 @@ rec {
 
     :::
   */
-  concatMapAttrs =
-    f: v:
-    listToAttrs (
-      concatLists (reverseList (mapAttrsToList (name: value: attrsToList (f name value)) v))
-    );
+  concatMapAttrs = f: v: foldl' mergeAttrs { } (attrValues (mapAttrs f v));
 
   /**
     Update or set specific paths of an attribute set.
@@ -1617,15 +1612,13 @@ rec {
       binaryMerge =
         start: end:
         # assert start < end; # Invariant
-        if end - start == 1 then
-          # Base case - there will be exactly 1 element due to the invariant, in
-          # which case we just return it directly
-          elemAt list start
-        else
+        if end - start >= 2 then
           # If there's at least 2 elements, split the range in two, recurse on each part and merge the result
-          # Relies on floor for odd results
           # The invariant is satisfied because each half will have at least 1 element
-          binaryMerge start ((start + end) / 2) // binaryMerge ((start + end) / 2) end;
+          binaryMerge start (start + (end - start) / 2) // binaryMerge (start + (end - start) / 2) end
+        else
+          # Otherwise there will be exactly 1 element due to the invariant, in which case we just return it directly
+          elemAt list start;
     in
     if list == [ ] then
       # Calling binaryMerge as below would not satisfy its invariant
@@ -1805,28 +1798,22 @@ rec {
     :::
   */
   matchAttrs =
-    let
-      recurse =
-        pattern: attrs:
-        all (
-          # Compare equality between `pattern` & `attrs`.
-          attr:
-          # Missing attr, not equal.
-          attrs ? ${attr}
-          && (
-            let
-              lhs = pattern.${attr};
-              rhs = attrs.${attr};
-            in
-            # Simple equality check is primarily for non-attrsets, but we run it
-            # on attrsets too, since it may let us avoid recursing
-            lhs == rhs || isAttrs lhs && isAttrs rhs && recurse lhs rhs
-          )
-        ) (attrNames pattern);
-    in
-    pattern:
+    pattern: attrs:
     assert isAttrs pattern;
-    recurse pattern;
+    all (
+      # Compare equality between `pattern` & `attrs`.
+      attr:
+      # Missing attr, not equal.
+      attrs ? ${attr}
+      && (
+        let
+          lhs = pattern.${attr};
+          rhs = attrs.${attr};
+        in
+        # If attrset check recursively
+        if isAttrs lhs then isAttrs rhs && matchAttrs lhs rhs else lhs == rhs
+      )
+    ) (attrNames pattern);
 
   /**
     Override only the attributes that are already present in the old set

lib/cli.nix

@@ -1,22 +1,6 @@
 { lib }:
 
-let
-  inherit (lib)
-    concatLists
-    concatMap
-    escapeShellArgs
-    isBool
-    isList
-    mapAttrsToList
-    oldestSupportedReleaseIsAtLeast
-    optional
-    stringLength
-    warnIf
-    ;
-  inherit (lib.generators) mkValueStringDefault;
-  mkValueString = mkValueStringDefault { };
-in
-rec {
+{
   /**
     Automatically convert an attribute set to command-line options.
 
@@ -56,9 +40,9 @@ rec {
     :::
   */
   toGNUCommandLineShell =
-    warnIf (oldestSupportedReleaseIsAtLeast 2511)
+    lib.warnIf (lib.oldestSupportedReleaseIsAtLeast 2511)
       "lib.cli.toGNUCommandLineShell is deprecated, please use lib.cli.toCommandLineShell or lib.cli.toCommandLineShellGNU instead."
-      (options: attrs: escapeShellArgs (toGNUCommandLine options attrs));
+      (options: attrs: lib.escapeShellArgs (lib.cli.toGNUCommandLine options attrs));
 
   /**
     Automatically convert an attribute set to a list of command-line options.
@@ -132,15 +116,15 @@ rec {
     :::
   */
   toGNUCommandLine =
-    warnIf (oldestSupportedReleaseIsAtLeast 2511)
+    lib.warnIf (lib.oldestSupportedReleaseIsAtLeast 2511)
       "lib.cli.toGNUCommandLine is deprecated, please use lib.cli.toCommandLine or lib.cli.toCommandLineShellGNU instead."
       (
         {
-          mkOptionName ? k: if stringLength k == 1 then "-${k}" else "--${k}",
+          mkOptionName ? k: if builtins.stringLength k == 1 then "-${k}" else "--${k}",
 
-          mkBool ? k: v: optional v (mkOptionName k),
+          mkBool ? k: v: lib.optional v (mkOptionName k),
 
-          mkList ? k: concatMap (mkOption k),
+          mkList ? k: v: lib.concatMap (mkOption k) v,
 
           mkOption ?
             k: v:
@@ -149,24 +133,26 @@ rec {
             else if optionValueSeparator == null then
               [
                 (mkOptionName k)
-                (mkValueString v)
+                (lib.generators.mkValueStringDefault { } v)
               ]
             else
-              [ "${mkOptionName k}${optionValueSeparator}${mkValueString v}" ],
+              [ "${mkOptionName k}${optionValueSeparator}${lib.generators.mkValueStringDefault { } v}" ],
 
           optionValueSeparator ? null,
         }:
+        options:
         let
           render =
             k: v:
-            if isBool v then
+            if builtins.isBool v then
               mkBool k v
-            else if isList v then
+            else if builtins.isList v then
               mkList k v
             else
               mkOption k v;
+
         in
-        options: concatLists (mapAttrsToList render options)
+        builtins.concatLists (lib.mapAttrsToList render options)
       );
 
   /**
@@ -177,7 +163,8 @@ rec {
     For further reference see:
     [`lib.cli.toCommandLineGNU`](#function-library-lib.cli.toCommandLineGNU)
   */
-  toCommandLineShellGNU = options: attrs: escapeShellArgs (toCommandLineGNU options attrs);
+  toCommandLineShellGNU =
+    options: attrs: lib.escapeShellArgs (lib.cli.toCommandLineGNU options attrs);
 
   /**
     Converts an attribute set into a list of GNU-style command-line arguments.
@@ -240,9 +227,9 @@ rec {
   */
   toCommandLineGNU =
     {
-      isLong ? optionName: stringLength optionName > 1,
+      isLong ? optionName: builtins.stringLength optionName > 1,
       explicitBool ? false,
-      formatArg ? mkValueString,
+      formatArg ? lib.generators.mkValueStringDefault { },
     }:
     let
       optionFormat = optionName: {
@@ -251,7 +238,7 @@ rec {
         inherit explicitBool formatArg;
       };
     in
-    toCommandLine optionFormat;
+    lib.cli.toCommandLine optionFormat;
 
   /**
     Converts the given attributes into a single shell-escaped command-line
@@ -261,7 +248,8 @@ rec {
     For further reference see:
     [`lib.cli.toCommandLine`](#function-library-lib.cli.toCommandLine)
   */
-  toCommandLineShell = optionFormat: attrs: escapeShellArgs (toCommandLine optionFormat attrs);
+  toCommandLineShell =
+    optionFormat: attrs: lib.escapeShellArgs (lib.cli.toCommandLine optionFormat attrs);
 
   /**
     Converts an attribute set into a list of command-line arguments.
@@ -433,14 +421,14 @@ rec {
     - `lib.cli.toCommandLineShellGNU`
   */
   toCommandLine =
-    optionFormat:
+    optionFormat: attrs:
     let
       handlePair =
         k: v:
         if k == "" then
-          throw "lib.cli.toCommandLine only accepts non-empty option names."
-        else if isList v then
-          concatMap (handleOption k) v
+          lib.throw "lib.cli.toCommandLine only accepts non-empty option names."
+        else if builtins.isList v then
+          builtins.concatMap (handleOption k) v
         else
           handleOption k v;
 
@@ -451,7 +439,7 @@ rec {
           option,
           sep,
           explicitBool,
-          formatArg ? mkValueString,
+          formatArg ? lib.generators.mkValueStringDefault { },
         }:
         k: v:
         if v == null || (!explicitBool && v == false) then
@@ -470,5 +458,5 @@ rec {
               arg
             ];
     in
-    attrs: concatLists (mapAttrsToList handlePair attrs);
+    builtins.concatLists (lib.mapAttrsToList handlePair attrs);
 }

lib/derivations.nix

@@ -6,6 +6,7 @@ let
     isString
     mapAttrs
     removeAttrs
+    throwIfNot
     ;
 
   showMaybeAttrPosPre =
@@ -107,18 +108,18 @@ in
       # attrset spine returned by lazyDerivation does not depend on it.
       # Instead, the individual derivation attributes do depend on it.
       checked =
-        if derivation.type or null != "derivation" then
-          throw "lazyDerivation: input must be a derivation."
-        # NOTE: Technically we could require our outputs to be a subset of the
-        # actual ones, or even leave them unchecked and fail on a lazy basis.
-        # However, consider the case where an output is added in the underlying
-        # derivation, such as dev. lazyDerivation would remove it and cause it
-        # to fail as a buildInputs item, without any indication as to what
-        # happened. Hence the more stringent condition. We could consider
-        # adding a flag to control this behavior if there's a valid case for it,
-        # but the documentation must have a note like this.
-        else if derivation.outputs != outputs then
-          throw ''
+        throwIfNot (derivation.type or null == "derivation") "lazyDerivation: input must be a derivation."
+          throwIfNot
+          # NOTE: Technically we could require our outputs to be a subset of the
+          # actual ones, or even leave them unchecked and fail on a lazy basis.
+          # However, consider the case where an output is added in the underlying
+          # derivation, such as dev. lazyDerivation would remove it and cause it
+          # to fail as a buildInputs item, without any indication as to what
+          # happened. Hence the more stringent condition. We could consider
+          # adding a flag to control this behavior if there's a valid case for it,
+          # but the documentation must have a note like this.
+          (derivation.outputs == outputs)
+          ''
             lib.lazyDerivation: The derivation ${derivation.name or "<unknown>"} has outputs that don't match the assumed outputs.
 
             Assumed outputs passed to lazyDerivation${showMaybeAttrPosPre ",\n    at " "outputs" args}:
@@ -141,7 +142,6 @@ in
             If none of the above works for you, replace the lib.lazyDerivation call by the
             expression in the derivation argument.
           ''
-        else
           derivation;
     in
     {

lib/fetchers.nix

@@ -22,6 +22,7 @@ let
     concatMapStringsSep
     head
     length
+    throwIf
     ;
   inherit (lib.attrsets)
     attrsToList
@@ -129,7 +130,7 @@ rec {
             hashesAsNVPairs = attrsToList (intersectAttrs hashSet args);
           in
           if hashesAsNVPairs == [ ] then
-            if required then throw "fetcher called without `hash`" else null
+            throwIf required "fetcher called without `hash`" null
           else if length hashesAsNVPairs != 1 then
             throw "fetcher called with mutually-incompatible arguments: ${
               concatMapStringsSep ", " (a: a.name) hashesAsNVPairs

lib/generators.nix

@@ -24,6 +24,7 @@ let
   inherit (lib)
     addErrorContext
     any
+    assertMsg
     attrNames
     attrValues
     concatLists
@@ -63,6 +64,7 @@ let
     reverseList
     splitString
     tail
+    toList
     ;
 
   inherit (lib.strings)
@@ -847,7 +849,7 @@ rec {
         _type == "lua-inline";
 
       generatedBindings =
-        assert badVarNames == [ ] || throw "Bad Lua var names: ${toPretty { } badVarNames}";
+        assert assertMsg (badVarNames == [ ]) "Bad Lua var names: ${toPretty { } badVarNames}";
         concatStrings (mapAttrsToList (key: value: "${indent}${key} = ${toLua innerArgs value}\n") v);
 
       # https://en.wikibooks.org/wiki/Lua_Programming/variable#Variable_names

lib/gvariant.nix

@@ -191,15 +191,10 @@ rec {
   mkArray =
     elems:
     let
-      vs = map mkValue (
-        if elems == [ ] then throw "Please create empty array with mkEmptyArray." else elems
-      );
-      firstType = (head vs).type;
-      elemType =
-        if lib.any (v: v.type != firstType) vs then
-          throw "Elements in a list should have same type."
-        else
-          firstType;
+      vs = map mkValue (lib.throwIf (elems == [ ]) "Please create empty array with mkEmptyArray." elems);
+      elemType = lib.throwIfNot (lib.all (t: (head vs).type == t) (
+        map (v: v.type) vs
+      )) "Elements in a list should have same type." (head vs).type;
     in
     mkPrimitive (type.arrayOf elemType) vs
     // {

lib/licenses/licenses.nix

@@ -1323,17 +1323,6 @@ lib.mapAttrs mkLicense (
       fullName = "Qwt exception 1.0";
     };
 
-    reticulum = {
-      # The Reticulum License restricts certain fields of use, notably systems
-      # intended to harm human beings and AI/ML training datasets. Such usage
-      # restrictions are incompatible with the Open Source Definition
-      # (https://opensource.org/osd), in particular "No Discrimination Against
-      # Fields of Endeavor".
-      free = false;
-      fullName = "Reticulum License";
-      url = "https://reticulum.network/license";
-    };
-
     ruby = {
       spdxId = "Ruby";
       fullName = "Ruby License";

lib/lists.nix

@@ -6,12 +6,12 @@ let
   inherit (lib.strings) toInt;
   inherit (lib.trivial)
     compare
-    id
     min
-    seq
+    id
     warn
     ;
   inherit (lib.attrsets) mapAttrs attrNames attrValues;
+  inherit (lib) max;
 in
 rec {
 
@@ -276,14 +276,11 @@ rec {
     :::
   */
   foldl' =
-    let
-      inherit (builtins) foldl';
-    in
     op: acc:
     # The builtin `foldl'` is a bit lazier than one might expect.
     # See https://github.com/NixOS/nix/pull/7158.
     # In particular, the initial accumulator value is not forced before the first iteration starts.
-    seq acc (foldl' op acc);
+    builtins.seq acc (builtins.foldl' op acc);
 
   /**
     Map with index starting from 0
@@ -445,7 +442,7 @@ rec {
 
     :::
   */
-  flatten = x: if isList x then concatMap flatten x else [ x ];
+  flatten = x: if isList x then concatMap (y: flatten y) x else [ x ];
 
   /**
     Remove elements equal to `e` from a list.  Useful for `buildInputs`.
@@ -1125,10 +1122,9 @@ rec {
   reverseList =
     xs:
     let
-      # subtract one to save an __sub call on every element
-      lastIndex = length xs - 1;
+      l = length xs;
     in
-    genList (n: elemAt xs (lastIndex - n)) (lastIndex + 1);
+    genList (n: elemAt xs (l - n - 1)) l;
 
   /**
     Depth-First Search (DFS) for lists `list != []`.
@@ -1185,13 +1181,13 @@ rec {
           c = filter (x: before x us) visited;
           b = partition (x: before x us) rest;
         in
-        if stopOnCycles && c != [ ] then
+        if stopOnCycles && (length c > 0) then
           {
             cycle = us;
             loops = c;
             inherit visited rest;
           }
-        else if b.right == [ ] then
+        else if length b.right == 0 then
           # nothing is before us
           {
             minimal = us;
@@ -1248,33 +1244,27 @@ rec {
     :::
   */
   toposort =
-    before:
+    before: list:
     let
-      dfs = listDfs true before;
-      recurse =
-        list:
-        let
-          dfsthis = dfs list;
-          toporest = recurse (dfsthis.visited ++ dfsthis.rest);
-        in
-        if length list < 2 then
-          # finish
-          { result = list; }
-        else if dfsthis ? cycle then
-          # there's a cycle, starting from the current vertex, return it
-          {
-            cycle = reverseList dfsthis.visited ++ [ dfsthis.cycle ];
-            inherit (dfsthis) loops;
-          }
-        else if toporest ? cycle then
-          # there's a cycle somewhere else in the graph, return it
-          toporest
-        # Slow, but short. Can be made a bit faster with an explicit stack.
-        else
-          # there are no cycles
-          { result = [ dfsthis.minimal ] ++ toporest.result; };
+      dfsthis = listDfs true before list;
+      toporest = toposort before (dfsthis.visited ++ dfsthis.rest);
     in
-    recurse;
+    if length list < 2 then
+      # finish
+      { result = list; }
+    else if dfsthis ? cycle then
+      # there's a cycle, starting from the current vertex, return it
+      {
+        cycle = reverseList ([ dfsthis.cycle ] ++ dfsthis.visited);
+        inherit (dfsthis) loops;
+      }
+    else if toporest ? cycle then
+      # there's a cycle somewhere else in the graph, return it
+      toporest
+    # Slow, but short. Can be made a bit faster with an explicit stack.
+    else
+      # there are no cycles
+      { result = [ dfsthis.minimal ] ++ toporest.result; };
 
   /**
     Sort a list based on a comparator function which compares two
@@ -1514,12 +1504,7 @@ rec {
 
     :::
   */
-  take =
-    count: list:
-    let
-      len = length list;
-    in
-    genList (elemAt list) (if count > len then len else count);
+  take = count: sublist 0 count;
 
   /**
     Returns the last (at most) N elements of a list.
@@ -1553,13 +1538,7 @@ rec {
 
     :::
   */
-  takeEnd =
-    count: list:
-    let
-      len = length list;
-      start = if count > len then 0 else len - count;
-    in
-    genList (i: elemAt list (start + i)) (if start > len then 0 else len - start);
+  takeEnd = n: xs: drop (max 0 (length xs - n)) xs;
 
   /**
     Remove the first (at most) N elements of a list.
@@ -1593,12 +1572,7 @@ rec {
 
     :::
   */
-  drop =
-    count: list:
-    let
-      len = length list;
-    in
-    genList (n: elemAt list (n + count)) (if count > len then 0 else len - count);
+  drop = count: list: sublist count (length list) list;
 
   /**
     Remove the last (at most) N elements of a list.
@@ -1632,19 +1606,7 @@ rec {
     ```
     :::
   */
-  dropEnd =
-    n: list:
-    let
-      len = length list;
-    in
-    genList (elemAt list) (
-      if n > len then
-        0
-      else if n < 0 then
-        len
-      else
-        len - n
-    );
+  dropEnd = n: xs: take (max 0 (length xs - n)) xs;
 
   /**
     Whether the first list is a prefix of the second list.
@@ -1848,7 +1810,7 @@ rec {
   */
   last =
     list:
-    assert list != [ ] || throw "lists.last: list must not be empty!";
+    assert lib.assertMsg (list != [ ]) "lists.last: list must not be empty!";
     elemAt list (length list - 1);
 
   /**
@@ -1881,8 +1843,8 @@ rec {
   */
   init =
     list:
-    assert list != [ ] || throw "lists.init: list must not be empty!";
-    genList (elemAt list) (length list - 1);
+    assert lib.assertMsg (list != [ ]) "lists.init: list must not be empty!";
+    take (length list - 1) list;
 
   /**
     Returns the image of the cross product of some lists by a function.
@@ -2157,8 +2119,7 @@ rec {
   */
   replaceElemAt =
     list: idx: newElem:
-    assert
-      idx >= 0 && idx < length list
-      || throw "'lists.replaceElemAt' called with index ${toString idx} on a list of size ${toString (length list)}";
+    assert lib.assertMsg (idx >= 0 && idx < length list)
+      "'lists.replaceElemAt' called with index ${toString idx} on a list of size ${toString (length list)}";
     genList (i: if i == idx then newElem else elemAt list i) (length list);
 }

lib/meta.nix

@@ -12,6 +12,7 @@ let
     all
     isDerivation
     getBin
+    assertMsg
     ;
   inherit (lib.attrsets) mapAttrs' filterAttrs;
   inherit (builtins)
@@ -570,15 +571,12 @@ rec {
   */
   getExe' =
     x: y:
-    assert
-      isDerivation x
-      || throw "lib.meta.getExe': The first argument is of type ${typeOf x}, but it should be a derivation instead.";
-    assert
-      isString y
-      || throw "lib.meta.getExe': The second argument is of type ${typeOf y}, but it should be a string instead.";
-    assert
-      match ".*/.*" y == null
-      || throw "lib.meta.getExe': The second argument \"${y}\" is a nested path with a \"/\" character, but it should just be the name of the executable instead.";
+    assert assertMsg (isDerivation x)
+      "lib.meta.getExe': The first argument is of type ${typeOf x}, but it should be a derivation instead.";
+    assert assertMsg (isString y)
+      "lib.meta.getExe': The second argument is of type ${typeOf y}, but it should be a string instead.";
+    assert assertMsg (match ".*/.*" y == null)
+      "lib.meta.getExe': The second argument \"${y}\" is a nested path with a \"/\" character, but it should just be the name of the executable instead.";
     "${getBin x}/bin/${y}";
 
   /**

lib/modules.nix

@@ -46,6 +46,7 @@ let
     setAttrByPath
     substring
     take
+    throwIfNot
     trace
     typeOf
     types
@@ -679,11 +680,8 @@ let
           config = addFreeformType (addMeta (m.config or { }));
         }
     else
-    # shorthand syntax
-    if !isAttrs m then
-      throw "module ${file} (${key}) does not look like a module."
-    else
-      {
+      # shorthand syntax
+      throwIfNot (isAttrs m) "module ${file} (${key}) does not look like a module." {
         _file = toString m._file or file;
         _class = m._class or null;
         key = toString m.key or key;
@@ -1020,16 +1018,38 @@ let
           mergedType = t.typeMerge t'.functor;
           typesMergeable = mergedType != null;
 
+          # TODO: Remove this when all downstream reliances of internals: 'functor.wrapped' are sufficiently migrated.
+          # A function that adds the deprecated wrapped message to a type.
+          addDeprecatedWrapped =
+            t:
+            t
+            // {
+              functor = t.functor // {
+                wrapped = t.functor.wrappedDeprecationMessage {
+                  inherit loc;
+                };
+              };
+            };
+
           typeSet =
-            if opt.options ? type && res ? type then
-              if typesMergeable then
-                {
-                  type = mergedType;
-                }
+            if opt.options ? type then
+              if res ? type then
+                if typesMergeable then
+                  {
+                    type =
+                      if mergedType ? functor.wrappedDeprecationMessage then
+                        addDeprecatedWrapped mergedType
+                      else
+                        mergedType;
+                  }
+                else
+                  # Keep in sync with the same error below!
+                  throw
+                    "The option `${showOption loc}' in `${opt._file}' is already declared in ${showFiles res.declarations}."
+              else if opt.options.type ? functor.wrappedDeprecationMessage then
+                { type = addDeprecatedWrapped opt.options.type; }
               else
-                # Keep in sync with the same error below!
-                throw
-                  "The option `${showOption loc}' in `${opt._file}' is already declared in ${showFiles res.declarations}."
+                { }
             else
               { };
 

lib/network/internal.nix

@@ -104,9 +104,9 @@ let
   */
   parseExpandedIpv6 =
     addr:
-    assert
+    assert lib.assertMsg (
       length addr == ipv6Pieces
-      || throw "parseExpandedIpv6: expected list of integers with ${ipv6Pieces} elements";
+    ) "parseExpandedIpv6: expected list of integers with ${ipv6Pieces} elements";
     let
       u16FromHexStr =
         hex:

lib/path/default.nix

@@ -32,6 +32,10 @@ let
     substring
     ;
 
+  inherit (lib.asserts)
+    assertMsg
+    ;
+
   inherit (lib.path.subpath)
     isValid
     ;
@@ -234,14 +238,11 @@ in
     path:
     # The subpath string to append
     subpath:
-    assert
-      isPath path
-      || throw "lib.path.append: The first argument is of type ${builtins.typeOf path}, but a path was expected";
-    assert
-      isValid subpath
-      || throw ''
-        lib.path.append: Second argument is not a valid subpath string:
-            ${subpathInvalidReason subpath}'';
+    assert assertMsg (isPath path)
+      "lib.path.append: The first argument is of type ${builtins.typeOf path}, but a path was expected";
+    assert assertMsg (isValid subpath) ''
+      lib.path.append: Second argument is not a valid subpath string:
+          ${subpathInvalidReason subpath}'';
     path + ("/" + subpath);
 
   /**
@@ -284,25 +285,21 @@ in
   */
   hasPrefix =
     path1:
-    assert
-      isPath path1
-      || throw "lib.path.hasPrefix: First argument is of type ${typeOf path1}, but a path was expected";
+    assert assertMsg (isPath path1)
+      "lib.path.hasPrefix: First argument is of type ${typeOf path1}, but a path was expected";
     let
       path1Deconstructed = deconstructPath path1;
     in
     path2:
-    assert
-      isPath path2
-      || throw "lib.path.hasPrefix: Second argument is of type ${typeOf path2}, but a path was expected";
+    assert assertMsg (isPath path2)
+      "lib.path.hasPrefix: Second argument is of type ${typeOf path2}, but a path was expected";
     let
       path2Deconstructed = deconstructPath path2;
     in
-    assert
-      path1Deconstructed.root == path2Deconstructed.root
-      || throw ''
-        lib.path.hasPrefix: Filesystem roots must be the same for both paths, but paths with different roots were given:
-            first argument: "${toString path1}" with root "${toString path1Deconstructed.root}"
-            second argument: "${toString path2}" with root "${toString path2Deconstructed.root}"'';
+    assert assertMsg (path1Deconstructed.root == path2Deconstructed.root) ''
+      lib.path.hasPrefix: Filesystem roots must be the same for both paths, but paths with different roots were given:
+          first argument: "${toString path1}" with root "${toString path1Deconstructed.root}"
+          second argument: "${toString path2}" with root "${toString path2Deconstructed.root}"'';
     take (length path1Deconstructed.components) path2Deconstructed.components
     == path1Deconstructed.components;
 
@@ -347,17 +344,15 @@ in
   */
   removePrefix =
     path1:
-    assert
-      isPath path1
-      || throw "lib.path.removePrefix: First argument is of type ${typeOf path1}, but a path was expected.";
+    assert assertMsg (isPath path1)
+      "lib.path.removePrefix: First argument is of type ${typeOf path1}, but a path was expected.";
     let
       path1Deconstructed = deconstructPath path1;
       path1Length = length path1Deconstructed.components;
     in
     path2:
-    assert
-      isPath path2
-      || throw "lib.path.removePrefix: Second argument is of type ${typeOf path2}, but a path was expected.";
+    assert assertMsg (isPath path2)
+      "lib.path.removePrefix: Second argument is of type ${typeOf path2}, but a path was expected.";
     let
       path2Deconstructed = deconstructPath path2;
       success = take path1Length path2Deconstructed.components == path1Deconstructed.components;
@@ -367,12 +362,10 @@ in
         else
           throw ''lib.path.removePrefix: The first path argument "${toString path1}" is not a component-wise prefix of the second path argument "${toString path2}".'';
     in
-    assert
-      path1Deconstructed.root == path2Deconstructed.root
-      || throw ''
-        lib.path.removePrefix: Filesystem roots must be the same for both paths, but paths with different roots were given:
-            first argument: "${toString path1}" with root "${toString path1Deconstructed.root}"
-            second argument: "${toString path2}" with root "${toString path2Deconstructed.root}"'';
+    assert assertMsg (path1Deconstructed.root == path2Deconstructed.root) ''
+      lib.path.removePrefix: Filesystem roots must be the same for both paths, but paths with different roots were given:
+          first argument: "${toString path1}" with root "${toString path1Deconstructed.root}"
+          second argument: "${toString path2}" with root "${toString path2Deconstructed.root}"'';
     joinRelPath components;
 
   /**
@@ -429,9 +422,8 @@ in
   splitRoot =
     # The path to split the root off of
     path:
-    assert
-      isPath path
-      || throw "lib.path.splitRoot: Argument is of type ${typeOf path}, but a path was expected";
+    assert assertMsg (isPath path)
+      "lib.path.splitRoot: Argument is of type ${typeOf path}, but a path was expected";
     let
       deconstructed = deconstructPath path;
     in
@@ -502,15 +494,14 @@ in
     let
       deconstructed = deconstructPath path;
     in
-    assert
-      isPath path
-      || throw "lib.path.hasStorePathPrefix: Argument is of type ${typeOf path}, but a path was expected";
-    assert
+    assert assertMsg (isPath path)
+      "lib.path.hasStorePathPrefix: Argument is of type ${typeOf path}, but a path was expected";
+    assert assertMsg
       # This function likely breaks or needs adjustment if used with other filesystem roots, if they ever get implemented.
       # Let's try to error nicely in such a case, though it's unclear how an implementation would work even and whether this could be detected.
       # See also https://github.com/NixOS/nix/pull/6530#discussion_r1422843117
-      deconstructed.root == /. && toString deconstructed.root == "/"
-      || throw "lib.path.hasStorePathPrefix: Argument has a filesystem root (${toString deconstructed.root}) that's not /, which is currently not supported.";
+      (deconstructed.root == /. && toString deconstructed.root == "/")
+      "lib.path.hasStorePathPrefix: Argument has a filesystem root (${toString deconstructed.root}) that's not /, which is currently not supported.";
     componentsHaveStorePathPrefix deconstructed.components;
 
   /**
@@ -711,11 +702,9 @@ in
   subpath.components =
     # The subpath string to split into components
     subpath:
-    assert
-      isValid subpath
-      || throw ''
-        lib.path.subpath.components: Argument is not a valid subpath string:
-            ${subpathInvalidReason subpath}'';
+    assert assertMsg (isValid subpath) ''
+      lib.path.subpath.components: Argument is not a valid subpath string:
+          ${subpathInvalidReason subpath}'';
     splitRelPath subpath;
 
   /**
@@ -810,11 +799,9 @@ in
   subpath.normalise =
     # The subpath string to normalise
     subpath:
-    assert
-      isValid subpath
-      || throw ''
-        lib.path.subpath.normalise: Argument is not a valid subpath string:
-            ${subpathInvalidReason subpath}'';
+    assert assertMsg (isValid subpath) ''
+      lib.path.subpath.normalise: Argument is not a valid subpath string:
+          ${subpathInvalidReason subpath}'';
     joinRelPath (splitRelPath subpath);
 
 }

lib/sources.nix

@@ -4,31 +4,22 @@
 # Tested in lib/tests/sources.sh
 let
   inherit (lib.strings)
-    escapeRegex
-    hasPrefix
-    hasSuffix
     match
-    removePrefix
-    removeSuffix
     split
-    splitString
     storeDir
-    stringLength
-    substring
+    escapeRegex
+    removePrefix
     ;
   inherit (lib)
-    any
     boolToString
-    concatStrings
-    elemAt
-    fileContents
     filter
-    head
-    isList
     isString
-    last
-    length
     readFile
+    concatStrings
+    length
+    elemAt
+    isList
+    any
     ;
   inherit (lib.filesystem)
     pathIsRegularFile
@@ -50,15 +41,9 @@ let
     : 2\. Function argument
   */
   cleanSourceFilter =
-    let
-      hasEmacsBackupFileSuffix = hasSuffix "~";
-      hasObjectSuffix = hasSuffix ".o";
-      hasSharedObjectSuffix = hasSuffix ".so";
-      hasResultPrefix = hasPrefix "result";
-    in
     name: type:
     let
-      baseName = baseNameOf name;
+      baseName = baseNameOf (toString name);
     in
     !(
       # Filter out version control software files/directories
@@ -77,15 +62,17 @@ let
       )
       ||
         # Filter out editor backup / swap files.
-        hasEmacsBackupFileSuffix baseName
+        lib.hasSuffix "~" baseName
       || match "^\\.sw[a-z]$" baseName != null
       || match "^\\..*\\.sw[a-z]$" baseName != null
-      # Filter out generated files.
-      || hasObjectSuffix baseName
-      || hasSharedObjectSuffix baseName
+      ||
+
+        # Filter out generates files.
+        lib.hasSuffix ".o" baseName
+      || lib.hasSuffix ".so" baseName
       ||
         # Filter out nix-build result symlinks
-        (type == "symlink" && hasResultPrefix baseName)
+        (type == "symlink" && lib.hasPrefix "result" baseName)
       ||
         # Filter out sockets and other types of files we can't have in the store.
         (type == "unknown")
@@ -146,13 +133,13 @@ let
     {
       # A path or cleanSourceWith result to filter and/or rename.
       src,
-      # Optional with default value of null (include everything)
+      # Optional with default value: constant true (include everything)
       # The function will be combined with the && operator such
       # that src.filter is called lazily.
       # For implementing a filter, see
       # https://nixos.org/nix/manual/#builtin-filterSource
       # Type: A function (Path -> Type -> Bool)
-      filter ? null,
+      filter ? _path: _type: true,
       # Optional name to use as part of the store path.
       # This defaults to `src.name` or otherwise `"source"`.
       name ? null,
@@ -162,13 +149,7 @@ let
     in
     fromSourceAttributes {
       inherit (orig) origSrc;
-      filter =
-        if orig.filter == null then
-          filter
-        else if filter == null then
-          orig.filter
-        else
-          path: type: filter path type && orig.filter path type;
+      filter = path: type: filter path type && orig.filter path type;
       name = if name != null then name else orig.name;
     };
 
@@ -197,14 +178,11 @@ let
       attrs
       // {
         filter =
-          if attrs.filter == null then
-            path: type: builtins.trace "${attrs.name}.filter ${path} = true" true
-          else
-            path: type:
-            let
-              r = attrs.filter path type;
-            in
-            builtins.trace "${attrs.name}.filter ${path} = ${boolToString r}" r;
+          path: type:
+          let
+            r = attrs.filter path type;
+          in
+          builtins.trace "${attrs.name}.filter ${path} = ${boolToString r}" r;
       }
     )
     // {
@@ -240,13 +218,13 @@ let
       isFiltered = src ? _isLibCleanSourceWith;
       origSrc = if isFiltered then src.origSrc else src;
     in
-    cleanSourceWith {
+    lib.cleanSourceWith {
       filter = (
         path: type:
         let
-          relPath = removePrefix (toString origSrc + "/") (toString path);
+          relPath = lib.removePrefix (toString origSrc + "/") (toString path);
         in
-        any (re: match re relPath != null) regexes
+        lib.any (re: match re relPath != null) regexes
       );
       inherit src;
     };
@@ -292,9 +270,9 @@ let
       filter =
         name: type:
         let
-          base = baseNameOf name;
+          base = baseNameOf (toString name);
         in
-        type == "directory" || any (ext: hasSuffix ext base) exts;
+        type == "directory" || lib.any (ext: lib.hasSuffix ext base) exts;
     in
     cleanSourceWith { inherit filter src; };
 
@@ -341,9 +319,9 @@ let
           packedRefsName = path + "/packed-refs";
           absolutePath =
             base: path:
-            if hasPrefix "/" path then
+            if lib.hasPrefix "/" path then
               path
-            else if hasPrefix "/" base then
+            else if lib.hasPrefix "/" base then
               "${base}/${path}"
             else
               "/${base}/${path}";
@@ -359,12 +337,12 @@ let
             { error = "File contains no gitdir reference: " + path; }
           else
             let
-              gitDir = absolutePath (dirOf path) (head m);
+              gitDir = absolutePath (dirOf path) (lib.head m);
               commonDir'' =
-                if pathIsRegularFile "${gitDir}/commondir" then fileContents "${gitDir}/commondir" else gitDir;
-              commonDir' = removeSuffix "/" commonDir'';
+                if pathIsRegularFile "${gitDir}/commondir" then lib.fileContents "${gitDir}/commondir" else gitDir;
+              commonDir' = lib.removeSuffix "/" commonDir'';
               commonDir = absolutePath gitDir commonDir';
-              refFile = removePrefix "${commonDir}/" "${gitDir}/${file}";
+              refFile = lib.removePrefix "${commonDir}/" "${gitDir}/${file}";
             in
             readCommitFromFile refFile commonDir
 
@@ -374,10 +352,10 @@ let
         # sometimes it stores something like: «ref: refs/heads/branch-name»
         then
           let
-            fileContent = fileContents fileName;
+            fileContent = lib.fileContents fileName;
             matchRef = match "^ref: (.*)$" fileContent;
           in
-          if matchRef == null then { value = fileContent; } else readCommitFromFile (head matchRef) path
+          if matchRef == null then { value = fileContent; } else readCommitFromFile (lib.head matchRef) path
 
         else if
           pathIsRegularFile packedRefsName
@@ -395,14 +373,14 @@ let
           if refs == [ ] then
             { error = "Could not find " + file + " in " + packedRefsName; }
           else
-            { value = head (matchRef (head refs)); }
+            { value = lib.head (matchRef (lib.head refs)); }
 
         else
           { error = "Not a .git directory: " + toString path; };
     in
     readCommitFromFile "HEAD";
 
-  pathHasContext = builtins.hasContext or (hasPrefix storeDir);
+  pathHasContext = builtins.hasContext or (lib.hasPrefix storeDir);
 
   canCleanSource = src: src ? _isLibCleanSourceWith || !(pathHasContext (toString src));
 
@@ -425,7 +403,7 @@ let
     {
       # The original path
       origSrc = if isFiltered then src.origSrc else src;
-      filter = if isFiltered then src.filter else null; # make sure to handle this!
+      filter = if isFiltered then src.filter else _: _: true;
       name = if isFiltered then src.name else "source";
     };
 
@@ -433,9 +411,6 @@ let
   #
   # Inverse of toSourceAttributes for Source objects.
   fromSourceAttributes =
-    let
-      inherit (builtins) path;
-    in
     {
       origSrc,
       filter,
@@ -443,13 +418,9 @@ let
     }:
     {
       _isLibCleanSourceWith = true;
-      inherit origSrc name;
-      # preserve outside checks, since a filter of null looks odd for
-      # comparisons
-      filter = if filter == null then _: _: true else filter;
-      outPath = path {
-        inherit name;
-        ${if filter != null then "filter" else null} = filter;
+      inherit origSrc filter name;
+      outPath = builtins.path {
+        inherit filter name;
         path = origSrc;
       };
     };
@@ -460,14 +431,15 @@ let
   urlToName =
     url:
     let
-      base = baseNameOf (removeSuffix "/" (last (splitString ":" (toString url))));
+      inherit (lib.strings) stringLength;
+      base = baseNameOf (lib.removeSuffix "/" (lib.last (lib.splitString ":" (toString url))));
       # chop away one git or archive-related extension
       removeExt =
         name:
         let
           matchExt = match "(.*)\\.(git|tar|zip|gz|tgz|bz|tbz|bz2|tbz2|lzma|txz|xz|zstd)$" name;
         in
-        if matchExt != null then head matchExt else name;
+        if matchExt != null then lib.head matchExt else name;
       # apply function f to string x while the result shrinks
       shrink =
         f: x:
@@ -489,9 +461,9 @@ let
       matchVer = match "([A-Za-z]+[-_. ]?)*(v)?([0-9.]+.*)" baseRev;
     in
     if matchHash != null then
-      substring 0 7 baseRev
+      builtins.substring 0 7 baseRev
     else if matchVer != null then
-      last matchVer
+      lib.last matchVer
     else
       baseRev;
 
@@ -651,7 +623,7 @@ let
 
     in
     src: patterns:
-    cleanSourceWith {
+    lib.cleanSourceWith {
       filter = mkSourceFilter src patterns;
       inherit src;
     };

lib/strings.nix

@@ -6,6 +6,8 @@ let
 
   inherit (builtins) length;
 
+  inherit (lib.trivial) warnIf;
+
   asciiTable = import ./ascii-table.nix;
 
 in
@@ -14,7 +16,6 @@ rec {
 
   inherit (builtins)
     compareVersions
-    concatMap
     elem
     elemAt
     filter
@@ -563,10 +564,7 @@ rec {
     :::
   */
   makeSearchPath =
-    subDir: paths:
-    concatStringsSep ":" (
-      concatMap (path: if path != null then [ (path + "/" + subDir) ] else [ ]) paths
-    );
+    subDir: paths: concatStringsSep ":" (map (path: path + "/" + subDir) (filter (x: x != null) paths));
 
   /**
     Construct a Unix-style search path by appending the given
@@ -604,14 +602,8 @@ rec {
     :::
   */
   makeSearchPathOutput =
-    output:
-    let
-      getOutput' = lib.getOutput output;
-    in
-    subDir: pkgs:
-    concatStringsSep ":" (
-      concatMap (path: if path != null then [ (getOutput' path + "/" + subDir) ] else [ ]) pkgs
-    );
+    output: subDir: pkgs:
+    makeSearchPath subDir (map (lib.getOutput output) pkgs);
 
   /**
     Construct a library search path (such as RPATH) containing the
@@ -729,17 +721,15 @@ rec {
     :::
   */
   normalizePath =
-    let
-      startsWithSlash = hasSuffix "/";
-    in
     s:
-    if isPath s then
-      throw ''
+    warnIf (isPath s)
+      ''
         lib.strings.normalizePath: The argument (${toString s}) is a path value, but only strings are supported.
-            Path values are always normalised in Nix, so there's no need to call this function on them.''
-    else
-      builtins.foldl' (x: y: if y == "/" && startsWithSlash x then x else x + y) "" (
-        stringToCharacters s
+            Path values are always normalised in Nix, so there's no need to call this function on them.
+            This function also copies the path to the Nix store and returns the store path, the same as "''${path}" will, which may not be what you want.
+            This behavior is deprecated and will throw an error in the future.''
+      (
+        builtins.foldl' (x: y: if y == "/" && hasSuffix "/" x then x else x + y) "" (stringToCharacters s)
       );
 
   /**
@@ -806,18 +796,17 @@ rec {
     :::
   */
   hasPrefix =
-    pref:
-    let
-      lenPrefix = stringLength pref;
-    in
-    if isPath pref then
-      # Before 23.05, paths would be copied to the store before converting them
-      # to strings and comparing. This was surprising and confusing.
-      throw ''
+    pref: str:
+    # Before 23.05, paths would be copied to the store before converting them
+    # to strings and comparing. This was surprising and confusing.
+    warnIf (isPath pref)
+      ''
         lib.strings.hasPrefix: The first argument (${toString pref}) is a path value, but only strings are supported.
+            There is almost certainly a bug in the calling code, since this function always returns `false` in such a case.
+            This function also copies the path to the Nix store, which may not be what you want.
+            This behavior is deprecated and will throw an error in the future.
             You might want to use `lib.path.hasPrefix` instead, which correctly supports paths.''
-    else
-      str: substring 0 lenPrefix str == pref;
+      (substring 0 (stringLength pref) str == pref);
 
   /**
     Determine whether a string has given suffix.
@@ -850,23 +839,20 @@ rec {
     :::
   */
   hasSuffix =
-    suffix:
+    suffix: content:
     let
+      lenContent = stringLength content;
       lenSuffix = stringLength suffix;
     in
-    if isPath suffix then
-      # Before 23.05, paths would be copied to the store before converting them
-      # to strings and comparing. This was surprising and confusing.
-      throw ''
+    # Before 23.05, paths would be copied to the store before converting them
+    # to strings and comparing. This was surprising and confusing.
+    warnIf (isPath suffix)
+      ''
         lib.strings.hasSuffix: The first argument (${toString suffix}) is a path value, but only strings are supported.
-        There is almost certainly a bug in the calling code, since this function always returns `false` in such a case.
-        This function also copies the path to the Nix store, which may not be what you want.''
-    else
-      content:
-      let
-        lenContent = stringLength content;
-      in
-      lenContent >= lenSuffix && substring (lenContent - lenSuffix) lenContent content == suffix;
+            There is almost certainly a bug in the calling code, since this function always returns `false` in such a case.
+            This function also copies the path to the Nix store, which may not be what you want.
+            This behavior is deprecated and will throw an error in the future.''
+      (lenContent >= lenSuffix && substring (lenContent - lenSuffix) lenContent content == suffix);
 
   /**
     Determine whether a string contains the given infix
@@ -903,19 +889,16 @@ rec {
     :::
   */
   hasInfix =
-    infix:
-    let
-      escapedInfix = escapeRegex infix;
-    in
-    if isPath infix then
-      # Before 23.05, paths would be copied to the store before converting them
-      # to strings and comparing. This was surprising and confusing.
-      throw ''
+    infix: content:
+    # Before 23.05, paths would be copied to the store before converting them
+    # to strings and comparing. This was surprising and confusing.
+    warnIf (isPath infix)
+      ''
         lib.strings.hasInfix: The first argument (${toString infix}) is a path value, but only strings are supported.
             There is almost certainly a bug in the calling code, since this function always returns `false` in such a case.
-            This function also copies the path to the Nix store, which may not be what you want.''
-    else
-      content: builtins.match ".*${escapedInfix}.*" "${content}" != null;
+            This function also copies the path to the Nix store, which may not be what you want.
+            This behavior is deprecated and will throw an error in the future.''
+      (builtins.match ".*${escapeRegex infix}.*" "${content}" != null);
 
   /**
     Convert a string `s` to a list of characters (i.e. singleton strings).
@@ -1320,11 +1303,8 @@ rec {
     :::
   */
   toShellVar =
-    name:
-    if (!isValidPosixName name) then
-      throw "toShellVar: ${name} is not a valid shell variable name"
-    else
-      value:
+    name: value:
+    lib.throwIfNot (isValidPosixName name) "toShellVar: ${name} is not a valid shell variable name" (
       if isAttrs value && !isStringLike value then
         "declare -A ${name}=(${
           concatStringsSep " " (lib.mapAttrsToList (n: v: "[${escapeShellArg n}]=${escapeShellArg v}") value)
@@ -1332,7 +1312,8 @@ rec {
       else if isList value then
         "declare -a ${name}=(${escapeShellArgs value})"
       else
-        "${name}=${escapeShellArg value}";
+        "${name}=${escapeShellArg value}"
+    );
 
   /**
     Translate an attribute set `vars` into corresponding shell variable declarations
@@ -1589,14 +1570,15 @@ rec {
   */
   toSentenceCase =
     str:
-    if !isString str then
-      throw "toSentenceCase does only accepts string values, but got ${typeOf str}"
-    else
-      let
-        firstChar = substring 0 1 str;
-        rest = substring 1 (-1) str; # -1 takes till the end of the string
-      in
-      toUpper firstChar + toLower rest;
+    lib.throwIfNot (isString str)
+      "toSentenceCase does only accepts string values, but got ${typeOf str}"
+      (
+        let
+          firstChar = substring 0 1 str;
+          rest = substring 1 (stringLength str) str;
+        in
+        addContextFrom str (toUpper firstChar + toLower rest)
+      );
 
   /**
     Converts a string to camelCase. Handles snake_case, PascalCase,
@@ -1632,9 +1614,7 @@ rec {
   */
   toCamelCase =
     str:
-    if !isString str then
-      throw "toCamelCase does only accepts string values, but got ${typeOf str}"
-    else
+    lib.throwIfNot (isString str) "toCamelCase does only accepts string values, but got ${typeOf str}" (
       let
         separators = splitStringBy (
           prev: curr:
@@ -1654,7 +1634,8 @@ rec {
         first = if length parts > 0 then toLower (head parts) else "";
         rest = if length parts > 1 then map toSentenceCase (tail parts) else [ ];
       in
-      concatStrings ([ first ] ++ rest);
+      concatStrings (map (addContextFrom str) ([ first ] ++ rest))
+    );
 
   /**
     Appends string context from string like object `src` to `target`.
@@ -1740,11 +1721,13 @@ rec {
     :::
   */
   splitString =
-    sep:
+    sep: s:
     let
-      escapedSep = escapeRegex (toString sep);
+      splits = builtins.filter builtins.isString (
+        builtins.split (escapeRegex (toString sep)) (toString s)
+      );
     in
-    s: map (addContextFrom s) (filter isString (split escapedSep (toString s)));
+    map (addContextFrom s) splits;
 
   /**
     Splits a string into substrings based on a predicate that examines adjacent characters.
@@ -1811,27 +1794,31 @@ rec {
     predicate: keepSplit: str:
     let
       len = stringLength str;
-      withContext = addContextFrom str;
 
       # Helper function that processes the string character by character
       go =
         pos: currentPart: result:
         # Base case: reached end of string
         if pos == len then
-          result ++ [ (withContext currentPart) ]
+          result ++ [ currentPart ]
         else
           let
             currChar = substring pos 1 str;
             prevChar = if pos > 0 then substring (pos - 1) 1 str else "";
+            isSplit = predicate prevChar currChar;
           in
-          if predicate prevChar currChar then
+          if isSplit then
             # Split here - add current part to results and start a new one
-            go (pos + 1) (if keepSplit then currChar else "") (result ++ [ (withContext currentPart) ])
+            let
+              newResult = result ++ [ currentPart ];
+              newCurrentPart = if keepSplit then currChar else "";
+            in
+            go (pos + 1) newCurrentPart newResult
           else
             # Keep building current part
             go (pos + 1) (currentPart + currChar) result;
     in
-    if len == 0 then [ (withContext "") ] else go 0 "" [ ];
+    if len == 0 then [ (addContextFrom str "") ] else map (addContextFrom str) (go 0 "" [ ]);
 
   /**
     Returns a string without the specified prefix, if the prefix matches.
@@ -1864,24 +1851,25 @@ rec {
     :::
   */
   removePrefix =
-    prefix:
-    let
-      preLen = stringLength prefix;
-    in
-    if isPath prefix then
-      # Before 23.05, paths would be copied to the store before converting them
-      # to strings and comparing. This was surprising and confusing.
-      throw ''
+    prefix: str:
+    # Before 23.05, paths would be copied to the store before converting them
+    # to strings and comparing. This was surprising and confusing.
+    warnIf (isPath prefix)
+      ''
         lib.strings.removePrefix: The first argument (${toString prefix}) is a path value, but only strings are supported.
             There is almost certainly a bug in the calling code, since this function never removes any prefix in such a case.
-            This function also copies the path to the Nix store, which may not be what you want.''
-    else
-      str:
-      if substring 0 preLen str == prefix then
-        # -1 will take the string until the end
-        substring preLen (-1) str
-      else
-        str;
+            This function also copies the path to the Nix store, which may not be what you want.
+            This behavior is deprecated and will throw an error in the future.''
+      (
+        let
+          preLen = stringLength prefix;
+        in
+        if substring 0 preLen str == prefix then
+          # -1 will take the string until the end
+          substring preLen (-1) str
+        else
+          str
+      );
 
   /**
     Returns a string without the specified suffix, if the suffix matches.
@@ -1914,26 +1902,25 @@ rec {
     :::
   */
   removeSuffix =
-    suffix:
-    let
-      sufLen = stringLength suffix;
-    in
-    if isPath suffix then
-      # Before 23.05, paths would be copied to the store before converting them
-      # to strings and comparing. This was surprising and confusing.
-      throw ''
+    suffix: str:
+    # Before 23.05, paths would be copied to the store before converting them
+    # to strings and comparing. This was surprising and confusing.
+    warnIf (isPath suffix)
+      ''
         lib.strings.removeSuffix: The first argument (${toString suffix}) is a path value, but only strings are supported.
             There is almost certainly a bug in the calling code, since this function never removes any suffix in such a case.
-            This function also copies the path to the Nix store, which may not be what you want.''
-    else
-      str:
-      let
-        sLen = stringLength str;
-      in
-      if sufLen <= sLen && suffix == substring (sLen - sufLen) sufLen str then
-        substring 0 (sLen - sufLen) str
-      else
-        str;
+            This function also copies the path to the Nix store, which may not be what you want.
+            This behavior is deprecated and will throw an error in the future.''
+      (
+        let
+          sufLen = stringLength suffix;
+          sLen = stringLength str;
+        in
+        if sufLen <= sLen && suffix == substring (sLen - sufLen) sufLen str then
+          substring 0 (sLen - sufLen) str
+        else
+          str
+      );
 
   /**
     Returns true if string `v1` denotes a version older than `v2`.
@@ -1999,7 +1986,7 @@ rec {
 
     :::
   */
-  versionAtLeast = v1: v2: compareVersions v2 v1 != 1;
+  versionAtLeast = v1: v2: !versionOlder v1 v2;
 
   /**
     This function takes an argument `x` that's either a derivation or a
@@ -2162,9 +2149,8 @@ rec {
         "LIST"
       ];
     in
-    type:
+    type: feature: value:
     assert (elem (toUpper type) types);
-    feature: value:
     assert (isString feature);
     assert (isString value);
     "-D${feature}:${toUpper type}=${value}";
@@ -2200,8 +2186,9 @@ rec {
   */
   cmakeBool =
     condition: flag:
+    assert (lib.isString condition);
     assert (lib.isBool flag);
-    cmakeOptionType "bool" condition (if flag then "TRUE" else "FALSE");
+    cmakeOptionType "bool" condition (lib.toUpper (lib.boolToString flag));
 
   /**
     Create a `"-D<feature>:STRING=<value>"` string that can be passed to typical
@@ -2233,7 +2220,11 @@ rec {
 
     :::
   */
-  cmakeFeature = cmakeOptionType "string";
+  cmakeFeature =
+    feature: value:
+    assert (lib.isString feature);
+    assert (lib.isString value);
+    cmakeOptionType "string" feature value;
 
   /**
     Create a `"-D<feature>=<value>"` string that can be passed to typical Meson
@@ -2303,6 +2294,7 @@ rec {
   */
   mesonBool =
     condition: flag:
+    assert (lib.isString condition);
     assert (lib.isBool flag);
     mesonOption condition (lib.boolToString flag);
 
@@ -2339,6 +2331,7 @@ rec {
   */
   mesonEnable =
     feature: flag:
+    assert (lib.isString feature);
     assert (lib.isBool flag);
     mesonOption feature (if flag then "enabled" else "disabled");
 
@@ -2532,9 +2525,8 @@ rec {
       strw = lib.stringLength str;
       reqWidth = width - (lib.stringLength filler);
     in
-    assert
-      strw <= width
-      || throw "fixedWidthString: requested string length (${toString width}) must not be shorter than actual length (${toString strw})";
+    assert lib.assertMsg (strw <= width)
+      "fixedWidthString: requested string length (${toString width}) must not be shorter than actual length (${toString strw})";
     if strw == width then str else filler + fixedWidthString reqWidth filler str;
 
   /**

lib/systems/default.nix

@@ -17,17 +17,12 @@ let
 
   inherit (lib.strings) toJSON;
 
-  inherit (lib.trivial)
-    oldestSupportedReleaseIsAtLeast
-    ;
-
   doubles = import ./doubles.nix { inherit lib; };
   parse = import ./parse.nix { inherit lib; };
   inspect = import ./inspect.nix { inherit lib; };
   platforms = import ./platforms.nix { inherit lib; };
   examples = import ./examples.nix { inherit lib; };
   architectures = import ./architectures.nix { inherit lib; };
-  rustc-target-env = import ./rustc-target-env.nix;
 
   /**
     Elaborated systems contain functions, which means that they don't satisfy
@@ -304,10 +299,12 @@ let
         inherit
           (
             {
+              linux-kernel = args.linux-kernel or { };
               gcc = args.gcc or { };
             }
             // platforms.select final
           )
+          linux-kernel
           gcc
           ;
 
@@ -454,16 +451,6 @@ let
                 else
                   final.parsed.cpu.name;
 
-              # https://doc.rust-lang.org/reference/conditional-compilation.html#target_env
-              # Accomodate system definitions written before Nixpkgs learned about target_env.
-              env =
-                if rust ? platform.env then
-                  rust.platform.env
-                else if rustc-target-env ? ${final.rust.rustcTargetSpec} then
-                  rustc-target-env.${final.rust.rustcTargetSpec}
-                else
-                  "";
-
               # https://doc.rust-lang.org/reference/conditional-compilation.html#target_os
               os =
                 if rust ? platform then
@@ -705,14 +692,6 @@ let
         };
       };
     in
-    # Platforms elaborated by pre-26.11 Nixpkgs will include the `linux-kernel` attr,
-    # so we can't assert its absence until 26.11 is the oldest supported release.
-    # Assertion will activate during the 27.05 cycle, when 26.05 support ends.
-    # TODO: Remove assertion in the 27.11 cycle.
-    assert
-      oldestSupportedReleaseIsAtLeast 2611 && args ? linux-kernel
-      -> throw "lib.systems.elaborate: linux-kernel has been removed; see the 26.11 release notes";
-
     assert final.useAndroidPrebuilt -> final.isAndroid;
     assert foldl' (pass: { assertion, message }: if assertion final then pass else throw message) true (
       final.parsed.abi.assertions or [ ]

lib/systems/doubles.nix

@@ -1,15 +1,7 @@
 { lib }:
 let
-  inherit (lib)
-    lists
-    splitString
-    ;
+  inherit (lib) lists;
   inherit (lib.systems) parse;
-  inherit (parse)
-    mkSystemFromSkeleton
-    mkSkeletonFromList
-    doubleFromSystem
-    ;
   inherit (lib.systems.inspect) predicates;
   inherit (lib.attrsets) matchAttrs;
 
@@ -125,17 +117,9 @@ let
     "x86_64-uefi"
   ];
 
-  uncheckedSystemFromString =
-    let
-      systemType = {
-        _type = "system";
-      };
-    in
-    s: mkSystemFromSkeleton (mkSkeletonFromList (splitString "-" s)) // systemType;
+  allParsed = map parse.mkSystemFromString all;
 
-  allParsed = map uncheckedSystemFromString all;
-
-  filterDoubles = f: map doubleFromSystem (lists.filter f allParsed);
+  filterDoubles = f: map parse.doubleFromSystem (lists.filter f allParsed);
 
 in
 {

lib/systems/examples.nix

@@ -40,9 +40,10 @@ rec {
     rust.rustcTarget = "powerpc-unknown-linux-gnu";
   };
 
-  armv5tel-multiplatform = {
+  sheevaplug = {
     config = "armv5tel-unknown-linux-gnueabi";
-  };
+  }
+  // platforms.sheevaplug;
 
   raspberryPi = {
     config = "armv6l-unknown-linux-gnueabihf";
@@ -98,6 +99,11 @@ rec {
     useLLVM = true;
   };
 
+  pogoplug4 = {
+    config = "armv5tel-unknown-linux-gnueabi";
+  }
+  // platforms.pogoplug4;
+
   ben-nanonote = {
     config = "mipsel-unknown-linux-uclibc";
   }
@@ -149,6 +155,7 @@ rec {
   gnu64 = {
     config = "x86_64-unknown-linux-gnu";
   };
+  gnu64_simplekernel = gnu64 // platforms.pc_simplekernel; # see test/cross/default.nix
   gnu32 = {
     config = "i686-unknown-linux-gnu";
   };

lib/systems/inspect.nix

@@ -2,17 +2,14 @@
 
 let
   inherit (lib)
-    all
     any
-    attrNames
     attrValues
     concatMap
     filter
-    flip
     hasPrefix
-    isAttrs
     isList
     mapAttrs
+    matchAttrs
     recursiveUpdateUntil
     toList
     ;
@@ -27,49 +24,19 @@ let
     execFormats
     ;
 
-  # Based on lib.attrsets.matchAttrs, but with:
-  # - the initial isAttrs assertion removed, since this function is only ever
-  # called with attrsets
-  # - isAttrs only performed on one side when recursing, since our input data
-  # will always share a structure
-  matchAttrsUnchecked =
-    pattern: attrs:
-    all (
-      # Compare equality between `pattern` & `attrs`.
-      attr:
-      # Missing attr, not equal.
-      attrs ? ${attr}
-      && (
-        let
-          lhs = pattern.${attr};
-          rhs = attrs.${attr};
-        in
-        # Simple equality check is primarily for non-attrsets, but we run it
-        # on attrsets too, since it may let us avoid recursing
-        lhs == rhs || isAttrs lhs && matchAttrsUnchecked lhs rhs
-      )
-    ) (attrNames pattern);
-
-  removeAssertions = flip removeAttrs [ "assertions" ];
-  abis = mapAttrs (
-    _: abi: if abi ? assertions then removeAssertions abi else abi
-  ) lib.systems.parse.abis;
+  abis = mapAttrs (_: abi: removeAttrs abi [ "assertions" ]) lib.systems.parse.abis;
 in
 
 rec {
   # these patterns are to be matched against {host,build,target}Platform.parsed
-  #
-  # Note: All toplevel attributes within a pattern are expected to be attrsets.
-  # matchAttrsUnchecked should be changed if a pattern is ever added that
-  # doesn't follow this axiom
   patterns = rec {
     # The patterns below are lists in sum-of-products form.
     #
     # Each attribute is list of product conditions; non-list values are treated
     # as a singleton list.  If *any* product condition in the list matches then
     # the predicate matches.  Each product condition is tested by
-    # `matchAttrsUnchecked`, which requires a match on *all* attributes of the
-    # product.
+    # `lib.attrsets.matchAttrs`, which requires a match on *all* attributes of
+    # the product.
 
     isi686 = {
       cpu = cpuTypes.i686;
@@ -522,40 +489,14 @@ rec {
       ) pat2
     ) pat1;
 
-  matchAnyPattern =
-    let
-      # same as matchAttrsUnchecked definition at the top of the file, but:
-      # - pattern names are cached and reused for multiple attrset calls
-      # - avoid running isAttrs since all patterns are nested attrsets
-      matchPattern =
-        pattern:
-        let
-          names = attrNames pattern;
-        in
-        attrs:
-        all (
-          attr:
-          attrs ? ${attr}
-          && (
-            let
-              lhs = pattern.${attr};
-              rhs = attrs.${attr};
-            in
-            lhs == rhs || matchAttrsUnchecked lhs rhs
-          )
-        ) names;
-
-    in
-    pattern:
-    if isList pattern then
-      let
-        cachedPatterns = map matchPattern pattern;
-      in
-      attrs: any (pattern: pattern attrs) cachedPatterns
+  matchAnyAttrs =
+    patterns:
+    if isList patterns then
+      attrs: any (pattern: matchAttrs pattern attrs) patterns
     else
-      matchPattern pattern;
+      matchAttrs patterns;
 
-  predicates = mapAttrs (_: matchAnyPattern) patterns;
+  predicates = mapAttrs (_: matchAnyAttrs) patterns;
 
   # these patterns are to be matched against the entire
   # {host,build,target}Platform structure; they include a `parsed={}` marker so

lib/systems/parse.nix

@@ -17,9 +17,6 @@
 { lib }:
 
 let
-  inherit (import ../meta-types.nix { inherit lib; })
-    enum
-    ;
   inherit (lib)
     all
     any
@@ -31,6 +28,7 @@ let
     id
     length
     mapAttrs
+    mergeOneOption
     optionalString
     splitString
     versionAtLeast
@@ -48,19 +46,20 @@ let
     isCygwin
     ;
 
+  inherit (lib.types)
+    enum
+    isType
+    mkOptionType
+    setType
+    ;
+
   setTypes =
     type:
-    if type ? verify then
-      let
-        inherit (type) verify;
-      in
-      mapAttrs (
-        name: value:
-        assert verify value;
-        { inherit name; } // value
-      )
-    else
-      mapAttrs (name: value: { inherit name; } // value);
+    mapAttrs (
+      name: value:
+      assert type.check value;
+      setType type.name ({ inherit name; } // value)
+    );
 
   # gnu-config will ignore the portion of a triple matching the
   # regex `e?abi.*$` when determining the validity of a triple.  In
@@ -77,9 +76,11 @@ in
 rec {
 
   ################################################################################
-  types.openSignificantByte = {
+
+  types.openSignificantByte = mkOptionType {
     name = "significant-byte";
     description = "Endianness";
+    merge = mergeOneOption;
   };
 
   types.significantByte = enum (attrValues significantBytes);
@@ -102,24 +103,21 @@ rec {
 
   ################################################################################
 
-  types.openCpuType = {
+  types.openCpuType = mkOptionType {
     name = "cpu-type";
     description = "instruction set architecture name and information";
-    verify =
-      let
-        verifyBitWidth = types.bitWidth.verify;
-        verifySignificantByte = types.significantByte.verify;
-      in
-      v:
-      verifyBitWidth v.bits
-      && (if 8 < v.bits then verifySignificantByte v.significantByte else !(v ? significantByte));
+    merge = mergeOneOption;
+    check =
+      x:
+      types.bitWidth.check x.bits
+      && (if 8 < x.bits then types.significantByte.check x.significantByte else !(x ? significantByte));
   };
 
   types.cpuType = enum (attrValues cpuTypes);
 
   cpuTypes =
     let
-      inherit (significantBytes) littleEndian bigEndian;
+      inherit (significantBytes) bigEndian littleEndian;
     in
     setTypes types.openCpuType {
       arm = {
@@ -489,9 +487,10 @@ rec {
 
   ################################################################################
 
-  types.openVendor = {
+  types.openVendor = mkOptionType {
     name = "vendor";
     description = "vendor for the platform";
+    merge = mergeOneOption;
   };
 
   types.vendor = enum (attrValues vendors);
@@ -500,19 +499,23 @@ rec {
     apple = { };
     pc = { };
     knuth = { };
+
     # Actually matters, unlocking some MinGW-w64-specific options in GCC. See
     # bottom of https://sourceforge.net/p/mingw-w64/wiki2/Unicode%20apps/
     w64 = { };
+
     none = { };
     unknown = { };
   };
 
   ################################################################################
 
-  types.openExecFormat = {
+  types.openExecFormat = mkOptionType {
     name = "exec-format";
     description = "executable container used by the kernel";
+    merge = mergeOneOption;
   };
+
   types.execFormat = enum (attrValues execFormats);
 
   execFormats = setTypes types.openExecFormat {
@@ -521,14 +524,16 @@ rec {
     macho = { };
     pe = { };
     wasm = { };
+
     unknown = { };
   };
 
   ################################################################################
 
-  types.openKernelFamily = {
+  types.openKernelFamily = mkOptionType {
     name = "exec-format";
     description = "executable container used by the kernel";
+    merge = mergeOneOption;
   };
 
   types.kernelFamily = enum (attrValues kernelFamilies);
@@ -540,15 +545,12 @@ rec {
 
   ################################################################################
 
-  types.openKernel = {
-    name = "open-kernel";
+  types.openKernel = mkOptionType {
+    name = "kernel";
     description = "kernel name and information";
-    verify =
-      let
-        verifyExecFormat = types.execFormat.verify;
-        verifyKernelFamily = types.kernelFamily.verify;
-      in
-      v: verifyExecFormat v.execFormat && all verifyKernelFamily (attrValues v.families);
+    merge = mergeOneOption;
+    check =
+      x: types.execFormat.check x.execFormat && all types.kernelFamily.check (attrValues x.families);
   };
 
   types.kernel = enum (attrValues kernels);
@@ -645,9 +647,10 @@ rec {
 
   ################################################################################
 
-  types.openAbi = {
+  types.openAbi = mkOptionType {
     name = "abi";
     description = "binary interface for compiled code and syscalls";
+    merge = mergeOneOption;
   };
 
   types.abi = enum (attrValues abis);
@@ -757,138 +760,119 @@ rec {
 
   ################################################################################
 
-  types.parsedPlatform = {
+  types.parsedPlatform = mkOptionType {
     name = "system";
     description = "fully parsed representation of llvm- or nix-style platform tuple";
-    verify =
-      let
-        verifyCpu = types.cpuType.verify;
-        verifyVendor = types.vendor.verify;
-        verifyKernel = types.kernel.verify;
-        verifyAbi = types.abi.verify;
-      in
+    merge = mergeOneOption;
+    check =
       {
         cpu,
         vendor,
         kernel,
         abi,
       }:
-      verifyCpu cpu && verifyVendor vendor && verifyKernel kernel && verifyAbi abi;
+      types.cpuType.check cpu
+      && types.vendor.check vendor
+      && types.kernel.check kernel
+      && types.abi.check abi;
   };
 
-  isSystem = v: v._type or null == "system";
+  isSystem = isType "system";
 
   mkSystem =
-    let
-      inherit (types.parsedPlatform) verify;
-    in
     components:
-    assert verify components;
-    components
-    // {
-      _type = "system";
-    };
+    assert types.parsedPlatform.check components;
+    setType "system" components;
 
   mkSkeletonFromList =
-    let
-      linuxComponents = [
-        "eabi"
-        "eabihf"
-        "elf"
-        "gnu"
-      ];
-      appleComponents = [
-        "redox"
-        "mmixware"
-        "ghcjs"
-        "mingw32"
-        "uefi"
-      ];
-    in
     l:
     {
       "1" =
-        let
-          firstComponent = head l;
-        in
-        if firstComponent == "avr" then
+        if head l == "avr" then
           {
-            cpu = firstComponent;
+            cpu = head l;
             kernel = "none";
             abi = "unknown";
           }
         else
           throw "system string '${lib.concatStringsSep "-" l}' with 1 component is ambiguous";
       "2" = # We only do 2-part hacks for things Nix already supports
-        let
-          secondComponent = elemAt l 1;
-        in
-        if secondComponent == "cygwin" then
+        if elemAt l 1 == "cygwin" then
           mkSkeletonFromList [
             (head l)
             "pc"
-            secondComponent
+            "cygwin"
           ]
         # MSVC ought to be the default ABI so this case isn't needed. But then it
         # becomes difficult to handle the gnu* variants for Aarch32 correctly for
         # minGW. So it's easier to make gnu* the default for the MinGW, but
         # hack-in MSVC for the non-MinGW case right here.
-        else if secondComponent == "windows" then
+        else if elemAt l 1 == "windows" then
           {
             cpu = head l;
-            kernel = secondComponent;
+            kernel = "windows";
             abi = "msvc";
           }
-        else if secondComponent == "elf" then
+        else if (elemAt l 1) == "elf" then
           {
             cpu = head l;
             vendor = "unknown";
             kernel = "none";
-            abi = secondComponent;
+            abi = elemAt l 1;
           }
         else
           {
             cpu = head l;
-            kernel = secondComponent;
+            kernel = elemAt l 1;
           };
       "3" =
-        let
-          secondComponent = elemAt l 1;
-          thirdComponent = elemAt l 2;
-        in
         # cpu-kernel-environment
-        if secondComponent == "linux" || elem thirdComponent linuxComponents then
+        if
+          elemAt l 1 == "linux"
+          || elem (elemAt l 2) [
+            "eabi"
+            "eabihf"
+            "elf"
+            "gnu"
+          ]
+        then
           {
             cpu = head l;
-            kernel = secondComponent;
-            abi = thirdComponent;
+            kernel = elemAt l 1;
+            abi = elemAt l 2;
             vendor = "unknown";
           }
         # cpu-vendor-os
         else if
-          secondComponent == "apple"
-          || elem thirdComponent appleComponents
-          || hasPrefix "freebsd" thirdComponent
-          || hasPrefix "netbsd" thirdComponent
-          || hasPrefix "openbsd" thirdComponent
-          || hasPrefix "genode" thirdComponent
-          || hasPrefix "wasm32" (head l)
+          elemAt l 1 == "apple"
+          || elem (elemAt l 2) [
+            "redox"
+            "mmixware"
+            "ghcjs"
+            "mingw32"
+            "uefi"
+          ]
+          || hasPrefix "freebsd" (elemAt l 2)
+          || hasPrefix "netbsd" (elemAt l 2)
+          || hasPrefix "openbsd" (elemAt l 2)
+          || hasPrefix "genode" (elemAt l 2)
+          || hasPrefix "wasm32" (elemAt l 0)
         then
           {
             cpu = head l;
-            vendor = secondComponent;
+            vendor = elemAt l 1;
             kernel =
-              if thirdComponent == "mingw32" then
+              if elemAt l 2 == "mingw32" then
                 "windows" # autotools breaks on -gnu for window
               else
-                thirdComponent;
+                elemAt l 2;
           }
         # lots of tools expect a triplet for Cygwin, even though the vendor is just "pc"
-        else if thirdComponent == "cygwin" then
+        else if elemAt l 2 == "cygwin" then
           {
             cpu = head l;
-            vendor = secondComponent;
-            kernel = thirdComponent;
+            vendor = elemAt l 1;
+            kernel = "cygwin";
           }
         else
           throw "system string '${lib.concatStringsSep "-" l}' with 3 components is ambiguous";
@@ -903,17 +887,7 @@ rec {
     or (throw "system string '${lib.concatStringsSep "-" l}' has invalid number of hyphen-separated components");
 
   # This should revert the job done by config.guess from the gcc compiler.
-  # Note: this does _not_ verify that the system is valid
-  # `mkSystemFromString` is recommended for external use
   mkSystemFromSkeleton =
-    let
-      getCpu = name: cpuTypes.${name} or (throw "Unknown CPU type: ${name}");
-      getVendor = name: vendors.${name} or (throw "Unknown vendor: ${name}");
-      getKernel = name: kernels.${name} or (throw "Unknown kernel: ${name}");
-      getAbi = name: abis.${name} or (throw "Unknown ABI: ${name}");
-      hasDarwinPrefix = hasPrefix "darwin";
-      hasBsdPrefix = hasPrefix "netbsd";
-    in
     {
       cpu,
       # Optional, but fallback too complex for here.
@@ -928,6 +902,11 @@ rec {
         null,
     }@args:
     let
+      getCpu = name: cpuTypes.${name} or (throw "Unknown CPU type: ${name}");
+      getVendor = name: vendors.${name} or (throw "Unknown vendor: ${name}");
+      getKernel = name: kernels.${name} or (throw "Unknown kernel: ${name}");
+      getAbi = name: abis.${name} or (throw "Unknown ABI: ${name}");
+
       parsed = {
         cpu = getCpu args.cpu;
         vendor =
@@ -940,10 +919,10 @@ rec {
           else
             vendors.unknown;
         kernel =
-          if hasDarwinPrefix args.kernel then
-            kernels.darwin
-          else if hasBsdPrefix args.kernel then
-            kernels.netbsd
+          if hasPrefix "darwin" args.kernel then
+            getKernel "darwin"
+          else if hasPrefix "netbsd" args.kernel then
+            getKernel "netbsd"
           else
             getKernel (removeAbiSuffix args.kernel);
         abi =
@@ -962,12 +941,11 @@ rec {
       };
 
     in
-    parsed;
+    mkSystem parsed;
 
-  mkSystemFromString = s: mkSystem (mkSystemFromSkeleton (mkSkeletonFromList (splitString "-" s)));
+  mkSystemFromString = s: mkSystemFromSkeleton (mkSkeletonFromList (splitString "-" s));
 
-  kernelName =
-    kernel: if kernel ? version then kernel.name + toString kernel.version else kernel.name;
+  kernelName = kernel: kernel.name + toString (kernel.version or "");
 
   darwinArch = cpu: if cpu.name == "aarch64" then "arm64" else cpu.name;
 

lib/systems/platforms.nix

@@ -3,21 +3,206 @@
 # targetPlatform, etc) containing at least the minimal set of attrs
 # required (see types.parsedPlatform in lib/systems/parse.nix).  This
 # file takes an already-valid platform and further elaborates it with
-# optional fields; currently these are: gcc, and rustc.
+# optional fields; currently these are: linux-kernel, gcc, and rustc.
 
 { lib }:
 rec {
+  pc = {
+    linux-kernel = {
+      name = "pc";
+
+      baseConfig = "defconfig";
+      # Build whatever possible as a module, if not stated in the extra config.
+      autoModules = true;
+      target = "bzImage";
+    };
+  };
+
+  pc_simplekernel = lib.recursiveUpdate pc {
+    linux-kernel.autoModules = false;
+  };
+
+  ##
+  ## POWER
+  ##
+
+  powernv = {
+    linux-kernel = {
+      name = "PowerNV";
+
+      baseConfig = "powernv_defconfig";
+      target = "vmlinux";
+      autoModules = true;
+    };
+  };
+
+  ppc64 = {
+    linux-kernel = {
+      name = "powerpc64";
+
+      baseConfig = "ppc64_defconfig";
+      target = "vmlinux";
+      autoModules = true;
+    };
+  };
+
   ##
   ## ARM
   ##
 
-  armv5tel-multiplatform = {
+  pogoplug4 = {
+    linux-kernel = {
+      name = "pogoplug4";
+
+      baseConfig = "multi_v5_defconfig";
+      autoModules = false;
+      extraConfig = ''
+        # Ubi for the mtd
+        MTD_UBI y
+        UBIFS_FS y
+        UBIFS_FS_XATTR y
+        UBIFS_FS_ADVANCED_COMPR y
+        UBIFS_FS_LZO y
+        UBIFS_FS_ZLIB y
+        UBIFS_FS_DEBUG n
+      '';
+      makeFlags = [ "LOADADDR=0x8000" ];
+      target = "uImage";
+      # TODO reenable once manual-config's config actually builds a .dtb and this is checked to be working
+      #DTB = true;
+    };
+    gcc = {
+      arch = "armv5te";
+    };
+  };
+
+  sheevaplug = {
+    linux-kernel = {
+      name = "sheevaplug";
+
+      baseConfig = "multi_v5_defconfig";
+      autoModules = false;
+      extraConfig = ''
+        BLK_DEV_RAM y
+        BLK_DEV_INITRD y
+        BLK_DEV_CRYPTOLOOP m
+        BLK_DEV_DM m
+        DM_CRYPT m
+        MD y
+        BTRFS_FS m
+        XFS_FS m
+        JFS_FS m
+        EXT4_FS m
+        USB_STORAGE_CYPRESS_ATACB m
+
+        # mv cesa requires this sw fallback, for mv-sha1
+        CRYPTO_SHA1 y
+        # Fast crypto
+        CRYPTO_TWOFISH y
+        CRYPTO_TWOFISH_COMMON y
+        CRYPTO_BLOWFISH y
+        CRYPTO_BLOWFISH_COMMON y
+
+        IP_PNP y
+        IP_PNP_DHCP y
+        NFS_FS y
+        ROOT_NFS y
+        TUN m
+        NFS_V4 y
+        NFS_V4_1 y
+        NFS_FSCACHE y
+        NFSD m
+        NFSD_V2_ACL y
+        NFSD_V3 y
+        NFSD_V3_ACL y
+        NFSD_V4 y
+        NETFILTER y
+        IP_NF_IPTABLES y
+        IP_NF_FILTER y
+        IP_NF_MATCH_ADDRTYPE y
+        IP_NF_TARGET_LOG y
+        IP_NF_MANGLE y
+        IPV6 m
+        VLAN_8021Q m
+
+        CIFS y
+        CIFS_XATTR y
+        CIFS_POSIX y
+        CIFS_FSCACHE y
+        CIFS_ACL y
+
+        WATCHDOG y
+        WATCHDOG_CORE y
+        ORION_WATCHDOG m
+
+        ZRAM m
+        NETCONSOLE m
+
+        # Disable OABI to have seccomp_filter (required for systemd)
+        # https://github.com/raspberrypi/firmware/issues/651
+        OABI_COMPAT n
+
+        # Fail to build
+        DRM n
+        SCSI_ADVANSYS n
+        USB_ISP1362_HCD n
+        SND_SOC n
+        SND_ALI5451 n
+        FB_SAVAGE n
+        SCSI_NSP32 n
+        ATA_SFF n
+        SUNGEM n
+        IRDA n
+        ATM_HE n
+        SCSI_ACARD n
+        BLK_DEV_CMD640_ENHANCED n
+
+        FUSE_FS m
+
+        # systemd uses cgroups
+        CGROUPS y
+
+        # Latencytop
+        LATENCYTOP y
+
+        # Ubi for the mtd
+        MTD_UBI y
+        UBIFS_FS y
+        UBIFS_FS_XATTR y
+        UBIFS_FS_ADVANCED_COMPR y
+        UBIFS_FS_LZO y
+        UBIFS_FS_ZLIB y
+        UBIFS_FS_DEBUG n
+
+        # Kdb, for kernel troubles
+        KGDB y
+        KGDB_SERIAL_CONSOLE y
+        KGDB_KDB y
+      '';
+      makeFlags = [ "LOADADDR=0x0200000" ];
+      target = "uImage";
+      DTB = true; # Beyond 3.10
+    };
     gcc = {
       arch = "armv5te";
     };
   };
 
   raspberrypi = {
+    linux-kernel = {
+      name = "raspberrypi";
+
+      baseConfig = "bcm2835_defconfig";
+      DTB = true;
+      autoModules = true;
+      preferBuiltin = true;
+      extraConfig = ''
+        # Disable OABI to have seccomp_filter (required for systemd)
+        # https://github.com/raspberrypi/firmware/issues/651
+        OABI_COMPAT n
+      '';
+      target = "zImage";
+    };
     gcc = {
       # https://en.wikipedia.org/wiki/Raspberry_Pi#Specifications
       arch = "armv6kz";
@@ -36,6 +221,15 @@ rec {
   };
 
   zero-gravitas = {
+    linux-kernel = {
+      name = "zero-gravitas";
+
+      baseConfig = "zero-gravitas_defconfig";
+      # Target verified by checking /boot on reMarkable 1 device
+      target = "zImage";
+      autoModules = false;
+      DTB = true;
+    };
     gcc = {
       fpu = "neon";
       cpu = "cortex-a9";
@@ -43,6 +237,15 @@ rec {
   };
 
   zero-sugar = {
+    linux-kernel = {
+      name = "zero-sugar";
+
+      baseConfig = "zero-sugar_defconfig";
+      DTB = true;
+      autoModules = false;
+      preferBuiltin = true;
+      target = "zImage";
+    };
     gcc = {
       cpu = "cortex-a7";
       fpu = "neon-vfpv4";
@@ -50,8 +253,52 @@ rec {
     };
   };
 
+  utilite = {
+    linux-kernel = {
+      name = "utilite";
+      maseConfig = "multi_v7_defconfig";
+      autoModules = false;
+      extraConfig = ''
+        # Ubi for the mtd
+        MTD_UBI y
+        UBIFS_FS y
+        UBIFS_FS_XATTR y
+        UBIFS_FS_ADVANCED_COMPR y
+        UBIFS_FS_LZO y
+        UBIFS_FS_ZLIB y
+        UBIFS_FS_DEBUG n
+      '';
+      makeFlags = [ "LOADADDR=0x10800000" ];
+      target = "uImage";
+      DTB = true;
+    };
+    gcc = {
+      cpu = "cortex-a9";
+      fpu = "neon";
+    };
+  };
+
+  guruplug = lib.recursiveUpdate sheevaplug {
+    # Define `CONFIG_MACH_GURUPLUG' (see
+    # <http://kerneltrap.org/mailarchive/git-commits-head/2010/5/19/33618>)
+    # and other GuruPlug-specific things.  Requires the `guruplug-defconfig'
+    # patch.
+    linux-kernel.baseConfig = "guruplug_defconfig";
+  };
+
+  beaglebone = lib.recursiveUpdate armv7l-hf-multiplatform {
+    linux-kernel = {
+      name = "beaglebone";
+      baseConfig = "bb.org_defconfig";
+      autoModules = false;
+      extraConfig = ""; # TBD kernel config
+      target = "zImage";
+    };
+  };
+
   # https://developer.android.com/ndk/guides/abis#v7a
   armv7a-android = {
+    linux-kernel.name = "armeabi-v7a";
     gcc = {
       arch = "armv7-a";
       float-abi = "softfp";
@@ -60,6 +307,35 @@ rec {
   };
 
   armv7l-hf-multiplatform = {
+    linux-kernel = {
+      name = "armv7l-hf-multiplatform";
+      Major = "2.6"; # Using "2.6" enables 2.6 kernel syscalls in glibc.
+      baseConfig = "multi_v7_defconfig";
+      DTB = true;
+      autoModules = true;
+      preferBuiltin = true;
+      target = "zImage";
+      extraConfig = ''
+        # Serial port for Raspberry Pi 3. Wasn't included in ARMv7 defconfig
+        # until 4.17.
+        SERIAL_8250_BCM2835AUX y
+        SERIAL_8250_EXTENDED y
+        SERIAL_8250_SHARE_IRQ y
+
+        # Hangs ODROID-XU4
+        ARM_BIG_LITTLE_CPUIDLE n
+
+        # Disable OABI to have seccomp_filter (required for systemd)
+        # https://github.com/raspberrypi/firmware/issues/651
+        OABI_COMPAT n
+
+        # >=5.12 fails with:
+        # drivers/net/ethernet/micrel/ks8851_common.o: in function `ks8851_probe_common':
+        # ks8851_common.c:(.text+0x179c): undefined reference to `__this_module'
+        # See: https://lore.kernel.org/netdev/20210116164828.40545-1-marex@denx.de/T/
+        KS8851_MLL y
+      '';
+    };
     gcc = {
       # Some table about fpu flags:
       # http://community.arm.com/servlet/JiveServlet/showImage/38-1981-3827/blogentry-103749-004812900+1365712953_thumb.png
@@ -84,6 +360,35 @@ rec {
   };
 
   aarch64-multiplatform = {
+    linux-kernel = {
+      name = "aarch64-multiplatform";
+      baseConfig = "defconfig";
+      DTB = true;
+      autoModules = true;
+      preferBuiltin = true;
+      extraConfig = ''
+        # Raspberry Pi 3 stuff. Not needed for   s >= 4.10.
+        ARCH_BCM2835 y
+        BCM2835_MBOX y
+        BCM2835_WDT y
+        RASPBERRYPI_FIRMWARE y
+        RASPBERRYPI_POWER y
+        SERIAL_8250_BCM2835AUX y
+        SERIAL_8250_EXTENDED y
+        SERIAL_8250_SHARE_IRQ y
+
+        # Cavium ThunderX stuff.
+        PCI_HOST_THUNDER_ECAM y
+
+        # Nvidia Tegra stuff.
+        PCI_TEGRA y
+
+        # The default (=y) forces us to have the XHCI firmware available in initrd,
+        # which our initrd builder can't currently do easily.
+        USB_XHCI_TEGRA m
+      '';
+      target = "Image";
+    };
     gcc = {
       arch = "armv8-a";
     };
@@ -101,6 +406,9 @@ rec {
   ##
 
   ben_nanonote = {
+    linux-kernel = {
+      name = "ben_nanonote";
+    };
     gcc = {
       arch = "mips32";
       float = "soft";
@@ -108,6 +416,74 @@ rec {
   };
 
   fuloong2f_n32 = {
+    linux-kernel = {
+      name = "fuloong2f_n32";
+      baseConfig = "lemote2f_defconfig";
+      autoModules = false;
+      extraConfig = ''
+        MIGRATION n
+        COMPACTION n
+
+        # nixos mounts some cgroup
+        CGROUPS y
+
+        BLK_DEV_RAM y
+        BLK_DEV_INITRD y
+        BLK_DEV_CRYPTOLOOP m
+        BLK_DEV_DM m
+        DM_CRYPT m
+        MD y
+        EXT4_FS m
+        USB_STORAGE_CYPRESS_ATACB m
+
+        IP_PNP y
+        IP_PNP_DHCP y
+        IP_PNP_BOOTP y
+        NFS_FS y
+        ROOT_NFS y
+        TUN m
+        NFS_V4 y
+        NFS_V4_1 y
+        NFS_FSCACHE y
+        NFSD m
+        NFSD_V2_ACL y
+        NFSD_V3 y
+        NFSD_V3_ACL y
+        NFSD_V4 y
+
+        # Fail to build
+        DRM n
+        SCSI_ADVANSYS n
+        USB_ISP1362_HCD n
+        SND_SOC n
+        SND_ALI5451 n
+        FB_SAVAGE n
+        SCSI_NSP32 n
+        ATA_SFF n
+        SUNGEM n
+        IRDA n
+        ATM_HE n
+        SCSI_ACARD n
+        BLK_DEV_CMD640_ENHANCED n
+
+        FUSE_FS m
+
+        # Needed for udev >= 150
+        SYSFS_DEPRECATED_V2 n
+
+        VGA_CONSOLE n
+        VT_HW_CONSOLE_BINDING y
+        SERIAL_8250_CONSOLE y
+        FRAMEBUFFER_CONSOLE y
+        EXT2_FS y
+        EXT3_FS y
+        MAGIC_SYSRQ y
+
+        # The kernel doesn't boot at all, with FTRACE
+        FTRACE n
+      '';
+      target = "vmlinux";
+    };
     gcc = {
       arch = "loongson2f";
       float = "hard";
@@ -153,10 +529,50 @@ rec {
     };
   };
 
+  # based on:
+  #   https://www.mail-archive.com/qemu-discuss@nongnu.org/msg05179.html
+  #   https://gmplib.org/~tege/qemu.html#mips64-debian
+  mips64el-qemu-linux-gnuabi64 = {
+    linux-kernel = {
+      name = "mips64el";
+      baseConfig = "64r2el_defconfig";
+      target = "vmlinuz";
+      autoModules = false;
+      DTB = true;
+      # for qemu 9p passthrough filesystem
+      extraConfig = ''
+        MIPS_MALTA y
+        PAGE_SIZE_4KB y
+        CPU_LITTLE_ENDIAN y
+        CPU_MIPS64_R2 y
+        64BIT y
+        CPU_MIPS64_R2 y
+
+        NET_9P y
+        NET_9P_VIRTIO y
+        9P_FS y
+        9P_FS_POSIX_ACL y
+        PCI y
+        VIRTIO_PCI y
+      '';
+    };
+  };
+
   ##
   ## Other
   ##
 
+  riscv-multiplatform = {
+    linux-kernel = {
+      name = "riscv-multiplatform";
+      target = "Image";
+      autoModules = true;
+      preferBuiltin = true;
+      baseConfig = "defconfig";
+      DTB = true;
+    };
+  };
+
   loongarch64-multiplatform = {
     gcc = {
       # https://github.com/loongson/la-softdev-convention/blob/master/la-softdev-convention.adoc#10-operating-system-package-build-requirements
@@ -168,6 +584,14 @@ rec {
       # https://github.com/llvm/llvm-project/pull/132173
       cmodel = "medium";
     };
+    linux-kernel = {
+      name = "loongarch-multiplatform";
+      target = "vmlinuz.efi";
+      autoModules = true;
+      preferBuiltin = true;
+      baseConfig = "defconfig";
+      DTB = true;
+    };
   };
 
   # This function takes a minimally-valid "platform" and returns an
@@ -175,15 +599,19 @@ rec {
   # included in the platform in order to further elaborate it.
   select =
     platform:
+    # x86
+    if platform.isx86 then
+      pc
+
     # ARM
-    if platform.isAarch32 then
+    else if platform.isAarch32 then
       let
         version = platform.parsed.cpu.version or null;
       in
       if version == null then
-        { }
+        pc
       else if lib.versionOlder version "6" then
-        armv5tel-multiplatform
+        sheevaplug
       else if lib.versionOlder version "7" then
         raspberrypi
       else
@@ -195,9 +623,24 @@ rec {
     else if platform.isLoongArch64 then
       loongarch64-multiplatform
 
+    else if platform.isRiscV then
+      riscv-multiplatform
+
     else if platform.parsed.cpu == lib.systems.parse.cpuTypes.mipsel then
       (import ./examples.nix { inherit lib; }).mipsel-linux-gnu
 
+    else if platform.isPower64 then
+      if platform.isLittleEndian then powernv else ppc64
+
+    else if platform.isSh4 then
+      {
+        linux-kernel = {
+          target = "vmlinux";
+          # SH arch doesn't have a 'make install' target.
+          installTarget = "vmlinux";
+        };
+      }
+
     else
       { };
 }

lib/systems/rustc-target-env.nix

@@ -1,160 +0,0 @@
-# As of rustc 1.96.0. Empty `target_env` values are omitted.
-#
-# Generation script:
-# #!/bin/bash
-# rustc --print target-list | while read -r target ; do
-#     env=$(rustc --print cfg --target "$target" | grep '^target_env=' | sed 's/# ^target_env="//;s/"$//')
-#     [[ -z "$env" ]] && continue
-#     printf '  %s = "%s";\n' "$target" "$env"
-# done
-{
-  aarch64-apple-ios-macabi = "macabi";
-  aarch64-apple-ios-sim = "sim";
-  aarch64-apple-tvos-sim = "sim";
-  aarch64-apple-visionos-sim = "sim";
-  aarch64-apple-watchos-sim = "sim";
-  aarch64-pc-windows-gnullvm = "gnu";
-  aarch64-pc-windows-msvc = "msvc";
-  aarch64-unknown-linux-gnu = "gnu";
-  aarch64-unknown-linux-gnu_ilp32 = "gnu";
-  aarch64-unknown-linux-musl = "musl";
-  aarch64-unknown-linux-ohos = "ohos";
-  aarch64-unknown-managarm-mlibc = "mlibc";
-  aarch64-unknown-nto-qnx700 = "nto70";
-  aarch64-unknown-nto-qnx710 = "nto71";
-  aarch64-unknown-nto-qnx710_iosock = "nto71_iosock";
-  aarch64-unknown-nto-qnx800 = "nto80";
-  aarch64-unknown-redox = "relibc";
-  aarch64-uwp-windows-msvc = "msvc";
-  aarch64-wrs-vxworks = "gnu";
-  aarch64_be-unknown-linux-gnu = "gnu";
-  aarch64_be-unknown-linux-gnu_ilp32 = "gnu";
-  aarch64_be-unknown-linux-musl = "musl";
-  arm-unknown-linux-gnueabi = "gnu";
-  arm-unknown-linux-gnueabihf = "gnu";
-  arm-unknown-linux-musleabi = "musl";
-  arm-unknown-linux-musleabihf = "musl";
-  arm64ec-pc-windows-msvc = "msvc";
-  armeb-unknown-linux-gnueabi = "gnu";
-  armv4t-unknown-linux-gnueabi = "gnu";
-  armv5te-unknown-linux-gnueabi = "gnu";
-  armv5te-unknown-linux-musleabi = "musl";
-  armv5te-unknown-linux-uclibceabi = "uclibc";
-  armv6k-nintendo-3ds = "newlib";
-  armv7-rtems-eabihf = "newlib";
-  armv7-sony-vita-newlibeabihf = "newlib";
-  armv7-unknown-linux-gnueabi = "gnu";
-  armv7-unknown-linux-gnueabihf = "gnu";
-  armv7-unknown-linux-musleabi = "musl";
-  armv7-unknown-linux-musleabihf = "musl";
-  armv7-unknown-linux-ohos = "ohos";
-  armv7-unknown-linux-uclibceabi = "uclibc";
-  armv7-unknown-linux-uclibceabihf = "uclibc";
-  armv7-wrs-vxworks-eabihf = "gnu";
-  armv7a-vex-v5 = "v5";
-  csky-unknown-linux-gnuabiv2 = "gnu";
-  csky-unknown-linux-gnuabiv2hf = "gnu";
-  hexagon-unknown-linux-musl = "musl";
-  i386-apple-ios = "sim";
-  i586-unknown-linux-gnu = "gnu";
-  i586-unknown-linux-musl = "musl";
-  i586-unknown-redox = "relibc";
-  i686-pc-nto-qnx700 = "nto70";
-  i686-pc-windows-gnu = "gnu";
-  i686-pc-windows-gnullvm = "gnu";
-  i686-pc-windows-msvc = "msvc";
-  i686-unknown-hurd-gnu = "gnu";
-  i686-unknown-linux-gnu = "gnu";
-  i686-unknown-linux-musl = "musl";
-  i686-uwp-windows-gnu = "gnu";
-  i686-uwp-windows-msvc = "msvc";
-  i686-win7-windows-gnu = "gnu";
-  i686-win7-windows-msvc = "msvc";
-  i686-wrs-vxworks = "gnu";
-  loongarch64-unknown-linux-gnu = "gnu";
-  loongarch64-unknown-linux-musl = "musl";
-  loongarch64-unknown-linux-ohos = "ohos";
-  m68k-unknown-linux-gnu = "gnu";
-  mips-unknown-linux-gnu = "gnu";
-  mips-unknown-linux-musl = "musl";
-  mips-unknown-linux-uclibc = "uclibc";
-  mips64-openwrt-linux-musl = "musl";
-  mips64-unknown-linux-gnuabi64 = "gnu";
-  mips64-unknown-linux-muslabi64 = "musl";
-  mips64el-unknown-linux-gnuabi64 = "gnu";
-  mips64el-unknown-linux-muslabi64 = "musl";
-  mipsel-unknown-linux-gnu = "gnu";
-  mipsel-unknown-linux-musl = "musl";
-  mipsel-unknown-linux-uclibc = "uclibc";
-  mipsisa32r6-unknown-linux-gnu = "gnu";
-  mipsisa32r6el-unknown-linux-gnu = "gnu";
-  mipsisa64r6-unknown-linux-gnuabi64 = "gnu";
-  mipsisa64r6el-unknown-linux-gnuabi64 = "gnu";
-  powerpc-unknown-linux-gnu = "gnu";
-  powerpc-unknown-linux-gnuspe = "gnu";
-  powerpc-unknown-linux-musl = "musl";
-  powerpc-unknown-linux-muslspe = "musl";
-  powerpc-wrs-vxworks = "gnu";
-  powerpc-wrs-vxworks-spe = "gnu";
-  powerpc64-unknown-linux-gnu = "gnu";
-  powerpc64-unknown-linux-musl = "musl";
-  powerpc64-wrs-vxworks = "gnu";
-  powerpc64le-unknown-linux-gnu = "gnu";
-  powerpc64le-unknown-linux-musl = "musl";
-  riscv32-wrs-vxworks = "gnu";
-  riscv32gc-unknown-linux-gnu = "gnu";
-  riscv32gc-unknown-linux-musl = "musl";
-  riscv32imac-esp-espidf = "newlib";
-  riscv32imafc-esp-espidf = "newlib";
-  riscv32imc-esp-espidf = "newlib";
-  riscv64-wrs-vxworks = "gnu";
-  riscv64a23-unknown-linux-gnu = "gnu";
-  riscv64gc-unknown-linux-gnu = "gnu";
-  riscv64gc-unknown-linux-musl = "musl";
-  riscv64gc-unknown-managarm-mlibc = "mlibc";
-  riscv64gc-unknown-redox = "relibc";
-  s390x-unknown-linux-gnu = "gnu";
-  s390x-unknown-linux-musl = "musl";
-  sparc-unknown-linux-gnu = "gnu";
-  sparc64-unknown-linux-gnu = "gnu";
-  thumbv7a-pc-windows-msvc = "msvc";
-  thumbv7a-uwp-windows-msvc = "msvc";
-  thumbv7neon-unknown-linux-gnueabihf = "gnu";
-  thumbv7neon-unknown-linux-musleabihf = "musl";
-  wasm32-wali-linux-musl = "musl";
-  wasm32-wasip1 = "p1";
-  wasm32-wasip1-threads = "p1";
-  wasm32-wasip2 = "p2";
-  wasm32-wasip3 = "p3";
-  x86_64-apple-ios = "sim";
-  x86_64-apple-ios-macabi = "macabi";
-  x86_64-apple-tvos = "sim";
-  x86_64-apple-watchos-sim = "sim";
-  x86_64-fortanix-unknown-sgx = "sgx";
-  x86_64-pc-nto-qnx710 = "nto71";
-  x86_64-pc-nto-qnx710_iosock = "nto71_iosock";
-  x86_64-pc-nto-qnx800 = "nto80";
-  x86_64-pc-windows-gnu = "gnu";
-  x86_64-pc-windows-gnullvm = "gnu";
-  x86_64-pc-windows-msvc = "msvc";
-  x86_64-unikraft-linux-musl = "musl";
-  x86_64-unknown-hurd-gnu = "gnu";
-  x86_64-unknown-l4re-uclibc = "uclibc";
-  x86_64-unknown-linux-gnu = "gnu";
-  x86_64-unknown-linux-gnuasan = "gnu";
-  x86_64-unknown-linux-gnumsan = "gnu";
-  x86_64-unknown-linux-gnutsan = "gnu";
-  x86_64-unknown-linux-gnux32 = "gnu";
-  x86_64-unknown-linux-musl = "musl";
-  x86_64-unknown-linux-ohos = "ohos";
-  x86_64-unknown-managarm-mlibc = "mlibc";
-  x86_64-unknown-redox = "relibc";
-  x86_64-uwp-windows-gnu = "gnu";
-  x86_64-uwp-windows-msvc = "msvc";
-  x86_64-win7-windows-gnu = "gnu";
-  x86_64-win7-windows-msvc = "msvc";
-  x86_64-wrs-vxworks = "gnu";
-  xtensa-esp32-espidf = "newlib";
-  xtensa-esp32s2-espidf = "newlib";
-  xtensa-esp32s3-espidf = "newlib";
-}

lib/tests/misc.nix

@@ -2164,21 +2164,6 @@ runTests {
     };
   };
 
-  testConcatMapAttrsDuplicates = {
-    expr =
-      concatMapAttrs
-        (name: value: {
-          final = value;
-        })
-        {
-          a = 1;
-          b = 2;
-        };
-    expected = {
-      final = 2;
-    };
-  };
-
   testFilterAttrs = {
     expr = filterAttrs (n: v: n != "a" && (v.hello or false) == true) {
       a.hello = true;

lib/tests/modules.sh

@@ -515,6 +515,56 @@ checkConfigError 'infinite recursion encountered' config.nonLazyResult ./lazy-at
 checkConfigOutput '^"mergedName.<id>.nested"$' config.result ./name-merge-attrsWith-1.nix
 checkConfigError 'The option .mergedName. in .*\.nix. is already declared in .*\.nix' config.mergedName ./name-merge-attrsWith-2.nix
 
+# Test type.functor.wrapped deprecation warning
+# should emit the warning on:
+# - merged types
+# - non-merged types
+# - nestedTypes elemType
+# attrsWith
+ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.attrsWith.type.functor.wrapped ./deprecated-wrapped.nix
+ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedAttrsWith.type.functor.wrapped ./deprecated-wrapped.nix
+
+ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.attrsWith.type.nestedTypes.elemType.functor.wrapped ./deprecated-wrapped.nix
+ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedAttrsWith.type.nestedTypes.elemType.functor.wrapped ./deprecated-wrapped.nix
+# listOf
+ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.listOf.type.functor.wrapped ./deprecated-wrapped.nix
+ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedListOf.type.functor.wrapped ./deprecated-wrapped.nix
+
+ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.listOf.type.nestedTypes.elemType.functor.wrapped ./deprecated-wrapped.nix
+ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedListOf.type.nestedTypes.elemType.functor.wrapped ./deprecated-wrapped.nix
+# unique / uniq
+ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.unique.type.functor.wrapped ./deprecated-wrapped.nix
+ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedUnique.type.functor.wrapped ./deprecated-wrapped.nix
+
+ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.unique.type.nestedTypes.elemType.functor.wrapped ./deprecated-wrapped.nix
+ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedUnique.type.nestedTypes.elemType.functor.wrapped ./deprecated-wrapped.nix
+# nullOr
+ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.nullOr.type.functor.wrapped ./deprecated-wrapped.nix
+ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedNullOr.type.functor.wrapped ./deprecated-wrapped.nix
+
+ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.nullOr.type.nestedTypes.elemType.functor.wrapped ./deprecated-wrapped.nix
+ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedNullOr.type.nestedTypes.elemType.functor.wrapped ./deprecated-wrapped.nix
+# functionTo
+ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.functionTo.type.functor.wrapped ./deprecated-wrapped.nix
+ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedFunctionTo.type.functor.wrapped ./deprecated-wrapped.nix
+
+ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.functionTo.type.nestedTypes.elemType.functor.wrapped ./deprecated-wrapped.nix
+ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedFunctionTo.type.nestedTypes.elemType.functor.wrapped ./deprecated-wrapped.nix
+
+# coercedTo
+# Note: test 'nestedTypes.finalType' and 'nestedTypes.coercedType'
+ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.coercedTo.type.functor.wrapped ./deprecated-wrapped.nix
+ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.coercedTo.type.nestedTypes.finalType.functor.wrapped ./deprecated-wrapped.nix
+ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.coercedTo.type.nestedTypes.coercedType.functor.wrapped ./deprecated-wrapped.nix
+# either
+ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.either.type.functor.wrapped ./deprecated-wrapped.nix
+ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedEither.type.functor.wrapped ./deprecated-wrapped.nix
+
+ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.either.type.nestedTypes.left.functor.wrapped ./deprecated-wrapped.nix
+ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.either.type.nestedTypes.right.functor.wrapped ./deprecated-wrapped.nix
+ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedEither.type.nestedTypes.left.functor.wrapped ./deprecated-wrapped.nix
+ABORT_ON_WARN=1 checkConfigError 'The deprecated `.*functor.wrapped` attribute .*is accessed, use `.*nestedTypes.elemType` instead.' options.mergedEither.type.nestedTypes.right.functor.wrapped ./deprecated-wrapped.nix
+
 # Even with multiple assignments, a type error should be thrown if any of them aren't valid
 checkConfigError 'A definition for option .* is not of type .*' \
   config.value ./declare-int-unsigned-value.nix ./define-value-list.nix ./define-value-int-positive.nix
@@ -683,6 +733,9 @@ checkConfigError 'The option .theOption.nested. in .other.nix. is already declar
 # Test that types.optionType leaves types untouched as long as they don't need to be merged
 checkConfigOutput 'ok' config.freeformItems.foo.bar ./adhoc-freeformType-survives-type-merge.nix
 
+# Test that specifying both functor.wrapped and functor.payload isn't allowed
+checkConfigError 'Type foo defines both `functor.payload` and `functor.wrapped` at the same time, which is not supported.' config.result ./default-type-merge-both.nix
+
 # Test that not including functor.wrapped is allowed
 checkConfigOutput 'ok' config.result ./default-type-merge-payload.nix
 

lib/tests/modules/default-type-merge-both.nix

@@ -0,0 +1,28 @@
+{ lib, options, ... }:
+let
+  foo = lib.mkOptionType {
+    name = "foo";
+    functor = lib.types.defaultFunctor "foo" // {
+      wrapped = lib.types.int;
+      payload = 10;
+    };
+  };
+in
+{
+  imports = [
+    {
+      options.foo = lib.mkOption {
+        type = foo;
+      };
+    }
+    {
+      options.foo = lib.mkOption {
+        type = foo;
+      };
+    }
+  ];
+
+  options.result = lib.mkOption {
+    default = builtins.seq options.foo null;
+  };
+}

lib/tests/modules/types-attrTag.nix

@@ -120,17 +120,7 @@ in
       assert config.merged.positive == { yay = 100; };
       assert config.merged.extensi-foo == { extensible = "foo"; };
       assert config.merged.extensi-bar == { extensible = "bar"; };
-      assert config.docs."submodules.<name>.foo.bar".declarations == [ __curPos.file ];
       assert config.docs."submodules.<name>.foo.bar".type == "signed integer";
-      assert
-        lib.length
-          (options.submodules.type.nestedTypes.elemType.nestedTypes.foo.type.getSubOptions [ ])
-          .bar.declarationPositions == 1;
-      assert
-        (lib.head
-          (options.submodules.type.nestedTypes.elemType.nestedTypes.foo.type.getSubOptions [ ])
-          .bar.declarationPositions
-        ).file == __curPos.file;
       assert config.docs."submodules.<name>.qux".type == "string";
       assert config.docs."submodules.<name>.qux".declarations == [ __curPos.file ];
       assert
@@ -143,11 +133,8 @@ in
       assert config.docs."submodules.<name>.qux".description == "A qux for when you don't want a foo";
       assert config.docs."submodules.<name>.qux".readOnly == false;
       assert config.docs."submodules.<name>.qux".visible == true;
-      assert
-        lib.length options.submodules.type.nestedTypes.elemType.nestedTypes.qux.declarationPositions == 1;
-      assert
-        (lib.head options.submodules.type.nestedTypes.elemType.nestedTypes.qux.declarationPositions).file
-        == __curPos.file;
+      # Not available (yet?)
+      # assert config.docs."submodules.<name>.qux".declarationsWithPositions == [ ... ];
       assert options.submodules.declarations == [ __curPos.file ];
       assert lib.length options.submodules.declarationPositions == 1;
       assert (lib.head options.submodules.declarationPositions).file == __curPos.file;

lib/tests/release.nix

@@ -9,6 +9,7 @@
   pkgsBB ? pkgs.pkgsBuildBuild,
   nix ? pkgs-nixVersions.stable,
   nixVersions ? [
+    pkgs-nixVersions.nix_2_28
     nix
     pkgs-nixVersions.latest
   ],

lib/tests/systems.nix

@@ -215,22 +215,6 @@ lib.runTests (
   })
 
   // {
-    test_platforms_pass_typecheck = {
-      # To improve performance, the result of parsing all 70+ systems in
-      # `lib.platforms` into their attrset representations aren't typechecked.
-      # The results are expected to be constant, and avoiding the slow
-      # validation gives a meaningful improvement to evaluation speed. We ensure
-      # that all systems pass validation here
-      expr = builtins.filter (
-        system:
-        let
-          evalResult = builtins.tryEval (lib.systems.parse.mkSystemFromString system);
-        in
-        evalResult.success == false
-      ) lib.platforms.all;
-
-      expected = [ ];
-    };
     test_equals_example_x86_64-linux = {
       expr = lib.systems.equals (lib.systems.elaborate "x86_64-linux") (
         lib.systems.elaborate "x86_64-linux"