I believe this change is wrong both theoretically and practically.
Theoretically, `null` is available on every platform, because
`buildInputs = [ null ];` always succeeds and never throws a platform
availability error. `null` should be handled consistently with packages
that have no explicit list of supported platforms, as it of course
has no such list itself.
Practically, we use `null` to represent libraries that are always
present on a platform and do not require a library (for instance,
because they are part of `libc` or the macOS SDK). This has been
used for a long time by `libintl` (on all non‐glibc platforms),
and is also now used by `libGL` and friends on Darwin. This change
broke the check SDL3 does for OpenGL availability on Darwin, causing
<https://github.com/NixOS/nixpkgs/issues/407056>, which had to be
worked around by <https://github.com/NixOS/nixpkgs/pull/409525>.
Both `libintl` and `libGL` should count as available on platforms
where their functionality is part of the standard build environment,
and a package that is completely unavailable and whose functionality
cannot be expected should not use `null`, as it should result in
errors if used in a dependency list on an unsupported platform.
I accept that overriding with `null` is often a useful way to disable
dependencies that don’t have explicit feature flags, but I do not
think that making it work better with feature flags conditioned on
availability is worth the inconsistency and problems caused by this
change. Packages can instead expose the relevant feature flags as
arguments that default to the `lib.meta.availableOn` check or, if they
want to keep an “override the dependency to `null`” interface,
insert an explicit `pkg != null && …` check.
Additionally, the pull request was merged over a week after all
breaking changes were restricted for the 25.05 release. I believe that
the potential problems of dealing with the effects of this change for
an entire release cycle – the first release cycle where `libGL` is
`null` on Darwin, a change I made before the deadline and before this
change to `lib.meta.availableOn` – offset the risks of backporting
this revert at such a late stage.
It will cause overrides to backwards‐incompatibly revert to the
behaviour they had before the change, but since such overrides were
not possible until a few weeks ago, I hope that is an acceptable risk
compared to the potential issues leaving this in the release can
cause, given that it was merged after the deadline and has already
broken an existing construction in Nixpkgs.
This reverts commit 9338d924db.
(cherry picked from commit 98dbc7cc58)
This reverts commit 263297b4e5 while also
explaining in the docs where exactly LANGUAGE is ignored, and why.
Fixes#409306.
(cherry picked from commit 82dfbe95f5)
WINDOW struct was turned opaque in recent versions, meaning that direct access to struct members is no longer supported.
Add patch to replace direct access with calls to getter functions.
(cherry picked from commit fe359e9681)
The package previously had an issue where it defined valid variants but did
not properly connect the validation to the derivation. This resulted in only
the default "macchiato" variant being accessible.
Fixed by replacing `lib.checkListOfEnum` with `assert lib.assertOneOf`
to properly validate and allow selection of all defined variants:
"latte", "frappe", "macchiato" and "mocha".
Tested by successfully building the package with each variant.
(cherry picked from commit d71402645d)
This ensures the NixOS notes only refer to things like modules and
NixOS-specific improvements, while the Nixpkgs notes refer to all
package changes
(cherry picked from commit 39a20c95fe)
This keeps us in-line with all previous releases. Users should be able
to still differentiate the NixOS and Nixpkgs release notes based on the
header of Nixpkgs' notes
(cherry picked from commit 7edb76465e)
We intend to use the edited event to react to base branch changes - but
before this change, we also ran those jobs on simple edits like title or
description.
While this works for some of the quicker jobs, it will not be
sustainable for all evaluation-related jobs. But evaluation needs to be
re-triggered on a base branch change as well, thus this change.
(cherry picked from commit 9b01e09a35)
This seems to be a left-over from before the performance comparison was
changed to a difference-per-chunk analysis.
(cherry picked from commit edaf51cb83)
`OF_OVERLAY` breaks kernel compilation for version 5.10
(beginning with 5.10.236), but only on x86_64.
Luckily, `OF_OVERLAY` is of not real interest on x86_64,
so this commit unbreaks the build by just disabling that option
if the target is x86_64 *and* the kernel version is below 5.15.
v5.15 contains a patch that turns the compilation error into a
warning, so this measure is not needed from that version on:
https://git.kernel.org/linus/5aad03685185b5133a28e1ee1d4e98d3fd3642a3
The reasons for the build failure are not
fully clear at the time of this writing;
apparently, a change in `pahole` is the core cause.
For details see the issue and in particular this comment:
https://github.com/NixOS/nixpkgs/issues/403985#issuecomment-2863338895
If that is correct and `pahole` gets fixed,
we can probably revert the commit at hand.
(cherry picked from commit 1e6c445767)
Currently, is it possible for stdenv.hostPlatform.isEfi to be true but
the kernel to have no EFI support. This mainly occurs on armv6l and
causes systemd in initrd to fail to build because it attempts to include
the non-existent efivarfs module in the initrd.
To fix this, automatically enable CONFIG_EFI on platforms where isEfi is
true. An alternative would be to make isEfi false on armv6l, but EFI is
in fact usable on that platform.
To prove this, I successfully booted NixOS on a Raspberry Pi Zero using
systemd-boot and U-Boot's EFI support. I confirmed that efivarfs works
as well.
(cherry picked from commit 3aff7b471c)
During the Apple SDK revamp of #346043, cc-wrapper and bintools-wrapper
were modified to automatically add a fallback SDK if $DEVELOPER_DIR is
not set [^1]. However, because of the order of the && operands,
apple-sdk is always evaluated even when it's not needed.
Flip the && operands so we only trigger the evaluation when targeting
Darwin.
[^1]: 51755b0c00
(cherry picked from commit 5953ae56d8)
Since there are now variants of tpm2-pkcs11 with and without ABRMD
support (for the kernel resource manager), ensure we pick the correct
default.
Fixes an accidental backwards incompatibility with the module.
(cherry picked from commit 9c1564e395)
The default libraries use SDL2 compat after migration, switched to use
the specifically created classic variants. Only pygame and pygame-ce
use SDL2 classic, other listed packages use SDL2 compat so they were
removed.
Signed-off-by: Marcin Serwin <marcin@serwin.dev>
It is technically possible to guard all udevCheckHook usages behind
`lib.optionals (lib.meta.availableOn stdenv.buildPlatform systemdMinimal)`.
However, doing this is hard to read, clunky, and hard to discover.
*Not* doing such a guard would mean cross-compilation darwin -> linux breaks.
The workaround here is to just accept any udev rules if they can't be properly checked.
(cherry picked from commit 1461a8401c)
To avoid breakage in future this avoid using `get_qualified_name()` for
any non-internal mock. This is fine because the idea to
`get_qualified_name()` is to make it easier to refactor since you can
rename the method name and this is also automatically rename the mocks,
but non-internal mocks are unlikely to change names anyway.
(cherry picked from commit 90f7121314)
`gitlab` >= 18.0 requires at least `postgresql` >= 16. GitLab users
are advised to follow the mentioned steps in the manual to upgrade their
PostgreSQL installation.
(cherry picked from commit c46cc8a67a)
Usage:
```nix
nativeBuildInputs = [
udevCheckHook
];
doInstallCheck = true;
```
This hook executes `udevadm verify --resolve-names=never --no-style`
on all outputs that have `/etc/udev/rules.d`.
This us a logical part of #404323 to check packages that supply udev rules.
Note this hook introduces a dependency on `systemdMinimal`,
meaning this can't check systemdMinimal or its dependencies.
(cherry picked from commit b3bdbf4806)
This patch resolves an issue where systemd-udevd outputs events like:
/nix/store/jm9paymkapbi6pzwbjgmi634vaf2y5va-udev-rules/49-brother-mfp-brscan5-1.0.2-2.rules:17 Invalid key 'SYSFS'.
(cherry picked from commit ff62fe4136)
Renamed to `anytype.desktop` to stay consistent with the Wayland
application ID and added support for the custom URL scheme handler.
(cherry picked from commit d02c917a25)
Without applying the build option BUILD_NUMBER, Mumble only knows about
the major and minor version. So, if the actual version string is
1.5.735, then the Mumble application only displays 1.5.0. Fix that.
Reported-by: Hartmnt
Signed-off-by: Felix Singer <felixsinger@posteo.net>
(cherry picked from commit ccf1614060)
This was preliminarily pinned to SDL2_classic in 2532c66211 (#393386).
The reason for that was DRM support and an incompatible override interface.
sdl3 is build with drm enabled by default, which means building things
that depend on drm through sdl2-compat should just work, no override needed.
(cherry picked from commit 8f2001fb55)
`nixos-rebuild-ng` explicitly don't allocate a pseudo-TTY for SSH
because this causes lots of issues depending on the use case (for
example, multiplexing multiple SSH sessions).
Sadly not using a pseudo-TTY also cause other issues, like the fact that
using Ctrl+C (SIGINT) doesn't kill the underlying process because SSH
doesn't support it.
We can't really start using pseudo-TTY unless we want to overcomplicate
the code for parsing results (pseudo-TTY mangles the stdout/stderr
together), so we need to handle killing the underlying remote process
manually.
This is what this commit does, when we receive a `KeyboardInterrupt`
exception while calling `run_wrapper`, we will check if it is a remote
process and send a `pkill --full` with the arguments (this should ensure
that we don't kill other process, but we can't guarantee it). This
assumes the user has `procps` installed, but I think it is a safe
assumption since this seems to be a core package.
Sadly nothing we can do if the user doesn't have `procps` installed, the
good thing is that the worst that can happen is that we will silent
fail and the process will stay in background until it finishes.
Fix#403269.
(cherry picked from commit 61e61a59eb)
Without this, the greeter is unable to see `orca` program on `PATH`
and so `${gdm}/share/gdm/greeter/autostart/orca-autostart.desktop`
will fail to start it. As a result, screen reader would not work
on the login screen.
(cherry picked from commit 9af27f1cb5)
Containers did not have *systemd-journald-audit.socket* in *additionalUpstreamSystemUnits*, which meant that the unit was not provided.
However the *wantedBy* was added without any additional check, therefore creating an empty unit with just the *WantedBy* on *boot.isContainer* machines.
This caused `systemd-analyze verify` to fail:
```text
systemd-journald-audit.socket: Unit has no Listen setting (ListenStream=, ListenDatagram=, ListenFIFO=, ...). Refusing.
systemd-journald-audit.socket: Cannot add dependency job, ignoring: Unit systemd-journald-audit.socket has a bad unit file setting.
systemd-journald-audit.socket: Cannot add dependency job, ignoring: Unit systemd-journald-audit.socket has a bad unit file setting.
```
The upstream unit already contains the following, which should make it safe to include regardless:
```ini
[Unit]
ConditionSecurity=audit
ConditionCapability=CAP_AUDIT_READ
```
For reference, this popped up in the context of #[360426](https://redirect.github.com/NixOS/nixpkgs/issues/360426) as well as #[407696](https://redirect.github.com/NixOS/nixpkgs/pull/407696).
Co-authored-by: Bruce Toll <4109762+tollb@users.noreply.github.com>
Signed-off-by: benaryorg <binary@benary.org>
(cherry picked from commit e434130d0b)
Fix regression from https://github.com/NixOS/nixpkgs/pull/379629.
The systemd-journal test has been failing on hydra since 2025-02-10.
See, for instance: https://hydra.nixos.org/build/290855155.
This commit enables auditing, as expected by the tests. It also
addresses an issue where audit messages were getting dropped due to
rate limits.
(cherry picked from commit 22d51e08cf)
Partially revert #179194 which first filtered
`extraLocaleSettings.LANGUAGE`. Indeed this environment variable is
given precedence according to:
https://www.gnu.org/software/gettext/manual/html_node/Locale-Environment-Variables.html
So using it will simply make all other `extraLocaleSettings` be ignored
in practice, but the OS shouldn't ignore it when aggregating the locales
required in general, as this setup should still be legitimate, and it
may even be useful if you wish to set it by default and use `env -u
LANGUAGE` for some programs.
(cherry picked from commit 263297b4e5)
`onnxruntime` fails to find the logger in sandboxed `aarch64-linux` builds,
and promptly segfaults. As all other builds will check this import, I
doubt this has an effect on package health.
(cherry picked from commit 3de9866a86)
Until #405952 is fixed, we can use our own util-linux to avoid breaking
k3s in the release. Revert this commit when that happens.
(cherry picked from commit 4cf4acae57)
The full version of util-linux has systemd, NLS, and ncurses support.
k3s only uses a couple utilities from it at runtime, so use the minimal
version.
(cherry picked from commit 44d7b6dd7b)
fixes: clang: error: no such file or directory: '/usr/local/lib/libpng16.a'
on sandboxed darwin boxes
1. mozjpeg hasn't been updated since 2021. The newest commit from 2023
fixes the build on darwin but no new release was put forward
(see imagemin/mozjpeg-bin#64 and imagemin/mozjpeg-bin#81)
2. This prompts to manually patching the yarn.lock file
3. Which also needs to split the yarnConfigHook logic and
duplicate it in parts in the derivation
The benefit is to be able to build pgadmin on aarch64-darwin
without network.
Signed-off-by: Florian Brandes <florian.brandes@posteo.de>
(cherry picked from commit 10ff832c4f)
Due to lack of active maintenance, removing from tree to avoid
unnecessarily exposing users to active security vulnerabilities
(cherry picked from commit 13dce3b2e0)
Disk usage of the image has risen considerably since last release. We
still need to investigate the cause in detail. Increasing it for now
prevents build failures at least.
(cherry picked from commit 813d0ba1fb)
By default, `system.nixos.label` includes `system.nixos.tags` which
historically was not set for the amazon image.
Keeping the tag in the label of the generated disk image inside the
derivation (i.e. `image.filePath`) makes it easier to tell that the
file is for amazon (i.e.
`nixos-image-amazon-25.11pre-git-x86_64-linux.vpc`) while the "label"
in `image-info.json` for users of the AWS api stays stable (i.e.
`/25.05pre-git-x86_64-linux`).
`
(cherry picked from commit 8ccd7e5d9a)
All the tests except `context-filter` are broken:
ERROR:../tests/test-context.c:265:test_gupnp_context_error_when_bound: assertion failed (error == NULL): Error binding to address 127.0.0.1:0: Operation not permitted (g-io-error-quark, 14)
ERROR:../tests/test-context-manager.c:42:test_context_manager_manage: assertion failed (error == NULL): Failed to find IP of interface lo (gssdp-error, 0)
But we already disable them on the old `gupnp`.
(cherry picked from commit 0443142472)
Only all the tests are broken:
ERROR:../tests/test-functional.c:491:test_client_creation: assertion failed (error == NULL): Failed to bind socketError binding to address 169.254.192.89:1900: Operation not permitted (g-io-error-quark, 14)
But we already disable them on the old `gssdp`.
(cherry picked from commit 0ee528d2cc)
- use `finalAttrs`
- use `tag` and `hash` in `src`
- add {pre,post} hooks to the `installPhase`
- remove `with lib;` from `meta`
(cherry picked from commit 4adde8f35b)
Also makes it so that we only set `meta.platforms` in cases where we need
to restrict it; otherwise, we go with the default.
(cherry picked from commit f3db57edfa)
Make teleport built by the by-name structure in package.nix.
The versioned attributes are defined in their own package.nix
in by-name using overrides.
Also change reference in ci/OWNERS
(cherry picked from commit a01b51d00b)
While upstream has added release notes in their repo [1], no `2.0.11.1` version has been tagged.
According to the repology guidelines [2] that we mostly follow,
versioning of snapshots should be relative to the last tagged upstream release, which would be `2.0.11`.
The `2.0.11.1-unstable...` version string currently crashes the update script,
which is irritating when checking for all updates as a maintainer.
By the off-chance upstream does end up tagging a `2.0.11.1` later,
our version string would also incorrectly represent what we actually have.
Changelogs in git without a tag are still subject to change,
though unlikely in the case of SDL_ttf.
Whether we do or do not have the `.1` probably does not matter too much.
[1] e31d11a692
[2] https://repology.org/docs/requirements
(cherry picked from commit 1d5023fc3e)
The original Mono project [1] was archived.
It is now maintained by WineHQ on their gitlab [2].
This changes the homepage for the new mono package,
and moves the source fetchers to the version profiles.
[1] https://www.mono-project.com/
[2] https://gitlab.winehq.org/mono/mono
(cherry picked from commit 85e1bcb3a6)
This will allocate more resources to the build making sure it completes
in a more reasonable time and not block a build slot for over 3 hours.
(cherry picked from commit 8ef6064848)
The package in nixpkgs was basically unmaintained since 2018.
It's maintainer in nixpkgs is inactive since 2022.
It dependended on the already dropped SDL_gpu package, which it pinned internally.
This now also started failing to build.
While upstream has a newer version of `riko4` available,
it does not remove the SDL_gpu dependency or fix its issues.
(cherry picked from commit 3035235407)
The version in nixpkgs was outdated since Nov 2024, with countless releases since [1].
This is unacceptable for what is intended to be a network-facing service.
It also started failing to build.
[1] https://github.com/supabase/edge-runtime/releases
(cherry picked from commit 4e5251e1ef)
This commit makes the Lutris package use the meson build system, which is more appropriate to build the desktop app.
Indeed, the meson build of Lutris is the only one supporting translations for the desktop app.
However, the presence of the Makefile at the source root is preventing the Nix build system from building the package with meson without overriding the different build phases.
(cherry picked from commit 44cdbd3481)
* gdk_display_manager_get() was called before gtk_init()
* gtk_menu_button_set_icon_name: assertion 'GTK_IS_MENU_BUTTON (menu_button)' failed
(cherry picked from commit 353c718f02)
In certain situations moderngl will also try to directly load
`libGL.so`/`libEGL.so`, and fail to do so. Substitute a direct path like
in glcontext.
(cherry picked from commit f96b36ba52)
While OfBorg is still adding these, it takes a much longer time to do so
compared to the eval action. Since we're adding rebuild labels, I think
it'd be nice to just do it within the eval action.
(cherry picked from commit d52066e2b1)
This patch fixes a failure in the Selenium UI testing
script by waiting for an element to be clickable.
This allows the Angular to render properly.
(cherry picked from commit 94e7e3f350)
Consider a user wanting to set up the Linux builder for the first time,
but with a slightly more generous allocation of resources compared to
the default. They'll do something like this:
```
{
virtualisation.cores = 3;
virtualisation.darwin-builder = {
diskSize = 40 * 1024;
memorySize = 4 * 1024;
};
}
```
This will fail with an error like this:
```
error: a 'aarch64-linux' with features {} is required to build '/nix/store/3acpgmwqwnk8g2gc5r05ar2lvmn01b8a-builder.pl.drv', but I am a 'aarch64-darwin' with features {apple-virt, benchmark, big-parallel, nixos-test}
```
But why would they have to rebuild the NixOS system?! All they did was
change the arguments passed to QEMU, and nothing those options control
would affect the NixOS configuration itself... right?
`config.system.build.toplevel` is defined with `allowSubstitutes` set to
`false` by default, which makes it so that the toplevel can't be
substituted if Nix is trying to use it "directly." So because the above
example would have to rebuild the VM runner, which references toplevel
directly, Nix refuses to substitute it, unless `always-allow-substitutes
= true` is set as a Nix option. (In the case where the QEMU options
aren't changed at all, Nix just substitutes the runner, which sidesteps
this issue as the runner itself doesn't use toplevel as an input.)
(cherry picked from commit 747c55e702)
We use a NixOS VM test to execute the upstream tests of curl-impersonate
because they require networking which cannot be mocked easily in the
sandbox.
Of those upstream tests, test_http2_headers spawns nghttpd2, makes
request against it and then tries to parse the logs it emits.
The last step, the parsing of the logs, it extremely fragile and version
dependent. The version of nghttp2 that we carry in nixpkgs is newer than
the one curl-impersonate expects and happens to emit a different log
format.
So to fix the remaining test suite of curl-impersonate, we simply skip
test_http2_headers.
(cherry picked from commit 9266b72424)
Upstream manually sets the standard to c99 in configure.ac, which makes
the popen and pclose invocations in src/tilda-lock-files.c produce
implicit function declaration errors.
(cherry picked from commit c97f91a5a2)
Right now, there are some paths that don't even get exposed to certain
systems (notably Darwin, but some outliers exist for Linux such as the
Darwin-specific Hackage overlay) for one reason or another, usually
because of assertions like `stdenv.isLinux`. To catch these scenarios,
this change implements a way to specify the system to evaluate attrpaths
on, and makes it default to the system that we're evaluating outpaths
for.
(cherry picked from commit 6b18b3d67b)
Prevent the specialisation names from containing a forward slash.
Also escape them to allow for spaces in specialisation names.
(cherry picked from commit 2b9fc0ccc5)
Various includes are missing.
The zlib include was being patched in before.
The string include is now needed with gcc 14.
(cherry picked from commit f433407a68)
/build/evolution-ews-3.56.1/src/common/e-ews-common-utils.c:211:13: error: 'true' undeclared (first use in this function)
211 | if (true) {
| ^~~~
/build/evolution-ews-3.56.1/src/common/e-ews-common-utils.c:15:1: note: 'true' is defined in header '<stdbool.h>'; this is probably fixable by adding '#include <stdbool.h>'
14 | #include "e-ews-common-utils.h"
+++ |+#include <stdbool.h>
15 |
/build/evolution-ews-3.56.1/src/common/e-ews-common-utils.c:211:13: note: each undeclared identifier is reported only once for each function it appears in
211 | if (true) {
| ^~~~
(cherry picked from commit 7128c9546c)
The package fails to build with gcc 14.
It has neither maintainer nor homepage link in nixpkgs.
The last commit specifically interacting with `suidChroot` was in 2017,
the last update was in 2015. With no linked repository and no maintenance,
the security of something claiming to be a "Setuid-safe wrapper for chroot" is questionable at best.
(cherry picked from commit 2e6bfdc649)
```
Check whether the following modules can be imported: asyncinotify
Traceback (most recent call last):
File "<string>", line 1, in <module>
File "<string>", line 1, in <lambda>
File "/nix/store/vfdk6q81hdjqjfiqz8f92hibdck3kmn6-python3-3.12.10/lib/python3.12/importlib/__init__.py", line 90, in import_module
return _bootstrap._gcd_import(name[level:], package, level)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "<frozen importlib._bootstrap>", line 1387, in _gcd_import
File "<frozen importlib._bootstrap>", line 1360, in _find_and_load
File "<frozen importlib._bootstrap>", line 1331, in _find_and_load_unlocked
File "<frozen importlib._bootstrap>", line 935, in _load_unlocked
File "<frozen importlib._bootstrap_external>", line 999, in exec_module
File "<frozen importlib._bootstrap>", line 488, in _call_with_frames_removed
File "/nix/store/bk44appr4dabadspjahk3l0ad29vhq8s-python3.12-asyncinotify-4.2.0/lib/python3.12/site-packages/asyncinotify/__init__.py", line 23, in <module>
from . import _ffi
File "/nix/store/bk44appr4dabadspjahk3l0ad29vhq8s-python3.12-asyncinotify-4.2.0/lib/python3.12/site-packages/asyncinotify/_ffi.py", line 36, in <module>
libc.inotify_init.restype = check_return
^^^^^^^^^^^^^^^^^
File "/nix/store/vfdk6q81hdjqjfiqz8f92hibdck3kmn6-python3-3.12.10/lib/python3.12/ctypes/__init__.py", line 392, in __getattr__
func = self.__getitem__(name)
^^^^^^^^^^^^^^^^^^^^^^
File "/nix/store/vfdk6q81hdjqjfiqz8f92hibdck3kmn6-python3-3.12.10/lib/python3.12/ctypes/__init__.py", line 397, in __getitem__
func = self._FuncPtr((name_or_ordinal, self))
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: dlsym(0x3312f2768, inotify_init): symbol not found
```
(cherry picked from commit 4ca073a957)
The package uses `mkDerivation`+`toPythonModule` in python packages.
This means `disabled` is not an option.
The package already shouldn't work on py 3.12 as per compatibility matrix [1].
While it might be possible to patch this *again*, this poackage is currently a complete mess.
[1] https://wiki.qt.io/Qt_for_Python#Python_compatibility_matrix
(cherry picked from commit 76627c2d55)
The package was unmaintained upstream since 2015.
Apart from questionable security (it does not support VNC passwords and is dead upstream),
the build also started to fail since gcc 14.
(cherry picked from commit 529f5be0f6)
This has been missed in 921bd99f8d,
when that binary has been split out into an eponymous package.
The package does not contain any executable programs any more.
(cherry picked from commit ba6e8ff3d8)
> If you are using an older version, please [update to the latest stable version](https://nixos.org/download) and check if the issue persists before continuing this bug report.
> If you are purposefully trying to build an ancient version of a package in an older Nixpkgs, please coordinate with the [NixOS Archivists](https://matrix.to/#/#archivists:nixos.org).
> If the package has been updated in unstable, but you believe the update should be backported to the stable release of Nixpkgs, please file the '**Request: backport to stable**' form instead.
> If you are using an older or stable version, please update to the latest **unstable** version and check if the module still does not exist before continuing this request.
@@ -25,9 +25,8 @@ For new packages please briefly describe the package or provide a link to its ho
- made sure NixOS tests are [linked](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#linking-nixos-module-tests-to-a-package) to the relevant packages
- [ ] Tested compilation of all packages that depend on this change using `nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD"`. Note: all changes have to be committed, also see [nixpkgs-review usage](https://github.com/Mic92/nixpkgs-review#usage)
- [ ] Tested basic functionality of all binary files (usually in `./result/bin/`)
description: 'Checks whether the Pull Request is mergeable and checks out the repo at up to two commits:The result of a temporary merge of the head branch into the target branch ("merged"), and the parent of that commit on the target branch ("target"). Handles push events and merge conflicts gracefully.'
inputs:
merged-as-untrusted:
description:"Whether to checkout the merge commit in the ./untrusted folder."
type:boolean
target-as-trusted:
description:"Whether to checkout the target commit in the ./trusted folder."
@@ -345,7 +345,7 @@ See [Nix Channel Status](https://status.nixos.org/) for the current channels and
Here's a brief overview of the main Git branches and what channels they're used for:
- `master`: The main branch, used for the unstable channels such as `nixpkgs-unstable`, `nixos-unstable` and `nixos-unstable-small`.
- `release-YY.MM` (e.g. `release-25.11`): The NixOS release branches, used for the stable channels such as `nixos-25.11`, `nixos-25.11-small` and `nixpkgs-25.11-darwin`.
- `release-YY.MM` (e.g. `release-25.05`): The NixOS release branches, used for the stable channels such as `nixos-25.05`, `nixos-25.05-small` and `nixpkgs-25.05-darwin`.
When a channel is updated, a corresponding Git branch is also updated to point to the corresponding commit.
So e.g. the [`nixpkgs-unstable` branch](https://github.com/nixos/nixpkgs/tree/nixpkgs-unstable) corresponds to the Git commit from the [`nixpkgs-unstable` channel](https://channels.nixos.org/nixpkgs-unstable).
@@ -533,7 +533,7 @@ Names of files and directories should be in lowercase, with dashes between words
### Formatting
CI [enforces](./.github/workflows/check-format.yml) all Nix files to be
CI [enforces](./.github/workflows/check-nix-format.yml) all Nix files to be
formatted using the [official Nix formatter](https://github.com/NixOS/nixfmt).
You can ensure this locally using either of these commands:
@@ -40,3 +40,46 @@ Why not just build the tooling right from the PRs Nixpkgs version?
- Because it makes the CI check very fast, since no Nix builds need to be done, even for mass rebuilds.
- Because it improves security, since we don't have to build potentially untrusted code from PRs.
The tool only needs a very minimal Nix evaluation at runtime, which can work with [readonly-mode](https://nixos.org/manual/nix/stable/command-ref/opt-common.html#opt-readonly-mode) and [restrict-eval](https://nixos.org/manual/nix/stable/command-ref/conf-file.html#conf-restrict-eval).
## `get-merge-commit.sh GITHUB_REPO PR_NUMBER`
Check whether a PR is mergeable and return the test merge commit as
[computed by GitHub](https://docs.github.com/en/rest/guides/using-the-rest-api-to-interact-with-your-git-database?apiVersion=2022-11-28#checking-mergeability-of-pull-requests) and its parent.
Arguments:
-`GITHUB_REPO`: The repository of the PR, e.g. `NixOS/nixpkgs`
-`PR_NUMBER`: The PR number, e.g. `1234`
Exit codes:
- 0: The PR can be merged, the hashes of the test merge commit and the target commit are returned on stdout
- 1: The PR cannot be merged because it's not open anymore
- 2: The PR cannot be merged because it has a merge conflict
- 3: The merge commit isn't being computed, GitHub is likely having internal issues, unknown if the PR is mergeable
### Usage
This script is implemented as a reusable GitHub Actions workflow, and can be used as follows:
```yaml
on:pull_request_target
# We need a token to query the API, but it doesn't need any special permissions
permissions:{}
jobs:
get-merge-commit:
# use the relative path of the get-merge-commit workflow yaml here
If the build succeeds, the manual will be in `./result/share/doc/nixpkgs/manual.html`.
### Development environment
In order to reduce repetition, consider using tools from the provided development environment:
Load it from the Nixpkgs documentation directory with
```ShellSession
$ cd /path/to/nixpkgs/doc
$ nix-shell
```
To load the development utilities automatically when entering that directory, [set up `nix-direnv`](https://nix.dev/guides/recipes/direnv).
Make sure that your local files aren't added to Git history by adding the following lines to `.git/info/exclude` at the root of the Nixpkgs repository:
```
/**/.envrc
/**/.direnv
```
#### `devmode`
### devmode
The shell in the manual source directory makes available a command, `devmode`.
@@ -795,10 +795,6 @@ Additionally, the following optional arguments can be given:
: Clone the entire repository as opposing to just creating a shallow clone.
This implies `leaveDotGit`.
*`fetchTags`* (Boolean)
: Whether to fetch all tags from the remote repository. This is useful when the build process needs to run `git describe` or other commands that require tag information to be available. This parameter implies `leaveDotGit`, as tags are stored in the `.git` directory.
*`sparseCheckout`* (List of String)
: Prevent git from fetching unnecessary blobs from server.
@@ -115,8 +115,8 @@ All new projects should use the CUDA redistributables available in [`cudaPackage
### Updating supported compilers and GPUs {#updating-supported-compilers-and-gpus}
1. Update `nvccCompatibilities` in `pkgs/development/cuda-modules/_cuda/data/nvcc.nix` to include the newest release of NVCC, as well as any newly supported host compilers.
2. Update `cudaCapabilityToInfo` in `pkgs/development/cuda-modules/_cuda/data/cuda.nix` to include any new GPUs supported by the new release of CUDA.
1. Update `nvcc-compatibilities.nix` in `pkgs/development/cuda-modules/` to include the newest release of NVCC, as well as any newly supported host compilers.
2. Update `gpus.nix` in `pkgs/development/cuda-modules/` to include any new GPUs supported by the new release of CUDA.
### Updating the CUDA Toolkit runfile installer {#updating-the-cuda-toolkit}
@@ -59,7 +59,7 @@ For instance, `sqlite-lua` needs `g:sqlite_clib_path` to be set to work. Nixpkgs
-`neovimRcContent`: Extra vimL code sourced by the generated `init.lua`.
-`wrapperArgs`: Extra arguments forwarded to the `makeWrapper` call.
-`wrapRc`: Nix, not being able to write in your `$HOME`, loads the
generated Neovim configuration via the `$VIMINIT` environment variable, i.e. : `export VIMINIT='lua dofile("/nix/store/…-init.lua")'`. This has side effects like preventing Neovim from sourcing your `init.lua` in `$XDG_CONFIG_HOME/nvim` (see bullet 7 of [`:help startup`](https://neovim.io/doc/user/starting.html#startup) in Neovim). Disable it if you want to generate your own wrapper. You can still reuse the generated vimscript init code via `neovim.passthru.initRc`.
generated Neovim configuration via its `-u` argument, i.e. : `-u /nix/store/...generatedInit.lua`. This has side effects like preventing Neovim from reading your config in `$XDG_CONFIG_HOME` (see bullet 7 of [`:help startup`](https://neovim.io/doc/user/starting.html#_initialization) in Neovim). Disable it if you want to generate your own wrapper. You can still reuse while reusing the logic of the nixpkgs wrapper and access the generated config via `neovim.passthru.initRc`.
-`plugins`: A list of plugins to add to the wrapper.
@@ -177,7 +177,7 @@ Finally, there are some plugins that are also packaged in nodePackages because t
Run the update script with a GitHub API token that has at least `public_repo` access. Running the script without the token is likely to result in rate-limiting (429 errors). For steps on creating an API token, please refer to [GitHub's token documentation](https://docs.github.com/en/free-pro-team@latest/github/authenticating-to-github/creating-a-personal-access-token).
```sh
nix-shell -p vimPluginsUpdater --run 'vim-plugins-updater --github-token=mytoken'# or set GITHUB_TOKEN environment variable
nix-shell -p vimPluginsUpdater --run 'vim-plugins-updater --github-token=mytoken'# or set GITHUB_API_TOKEN environment variable
```
Alternatively, set the number of processes to a lower count to avoid rate-limiting.
[treefmt](https://github.com/numtide/treefmt) streamlines the process of applying formatters to your project, making it a breeze with just one command line.
The [`treefmt` package](https://search.nixos.org/packages?channel=unstable&show=treefmt)
provides functions for configuring treefmt using the module system, which are [documented below](#sec-functions-library-treefmt), along with [their options](#sec-treefmt-options-reference).
Alternatively, treefmt can be configured using [treefmt-nix](https://github.com/numtide/treefmt-nix).
- Applications linked against different Mesa versions than installed on the system should now work correctly going forward (however, applications against older Mesa, e.g. from Nixpkgs releases before 25.05, remain broken)
- Packages that used to depend on Mesa for libgbm or libdri should use `libgbm` or `dri-pkgconfig-stub` as inputs, respectively
- OpenSSH has been updated from 9.9p2 to 10.0p2, dropping support for DSA keys and adding a new `ssh-auth` binary to handle user authentication in a different address space from unauthenticated sessions. See the [full changelog](https://www.openwall.com/lists/oss-security/2025/04/09/1) for more details.
- OpenSSH has been updated from 9.9p2 to 10.0p2, dropping support for DSA keys and adding a new `ssh-auth` binary to handle user authentication in a different address space from unauthenticated sessions. Additionally, we now enable a configure option by default that attempts to lock sshd into RAM to prevent it from being swapped out, which may improve performance if the system is under memory pressure. See the [full changelog](https://www.openwall.com/lists/oss-security/2025/04/09/1) for more details.
- Emacs has been updated to 30.1.
This introduces some backwards‐incompatible changes; see the NEWS for details.
@@ -74,7 +74,7 @@
configuration settings. Notably, it now defaults to listening on a socket
rather than a port. See [Migrating from version 1.x](https://github.com/roehling/postsrsd/blob/2.0.10/README.rst#migrating-from-version-1x) and [Postfix Setup](https://github.com/roehling/postsrsd?tab=readme-ov-file#postfix-setup) for details.
-`renovate` was updated to v39. See the [upstream release notes](https://github.com/renovatebot/renovate/releases/tag/39.0.0) for breaking changes.
-`renovate` was updated to v39. See the [upstream release notes](https://docs.renovatebot.com/release-notes-for-major-versions/#version-39) for breaking changes.
Like upstream's docker images, renovate now runs on NodeJS 22.
- The hand written `perlPackages.SearchXapian` bindings have been dropped in favor of the (mostly compatible)
@@ -247,10 +247,6 @@
-`strawberry` has been updated to 1.2, which drops support for the VLC backend and Qt 5. The `strawberry-qt5` package
and `withGstreamer`/`withVlc` override options have been removed due to this.
-`nexusmods-app` has been upgraded from version 0.6.3. If you were running a version older than 0.7.0, then before upgrading, you **must reset all app state** (mods, games, settings, etc). Otherwise, NexusMods.App will crash due to app state files incompatibility.
- Typically, you can can reset to a clean state by running `NexusMods.App uninstall-app`. See Nexus Mod's [how to uninstall the app](https://nexus-mods.github.io/NexusMods.App/users/Uninstall) documentation for more detail and alternative methods.
- This should not be necessary going forward, because loading app state from 0.7.0 or newer is now supported. This is documented in the [0.7.1 changelog](https://github.com/Nexus-Mods/NexusMods.App/releases/tag/v0.7.1).
-`nezha` and its agent `nezha-agent` have been updated to v1, which contains breaking changes. See the [official wiki](https://nezha.wiki/en_US/) for more details.
-`ps3-disc-dumper` was updated to 4.2.5, which removed the CLI project and now exclusively offers the GUI
@@ -327,6 +323,9 @@
-`tldr` now uses [`tldr-python-client`](https://github.com/tldr-pages/tldr-python-client) instead of [`tldr-c-client`](https://github.com/tldr-pages/tldr-c-client) which is unmaintained.
-`renovate` was updated to v39. See the [upstream release notes](https://docs.renovatebot.com/release-notes-for-major-versions/#version-39) for breaking changes.
Like upstream's docker images, renovate now runs on NodeJS 22.
- The behavior of the `networking.nat.externalIP` and `networking.nat.externalIPv6` options has been changed. `networking.nat.forwardPorts` now only forwards packets destined for the specified IP addresses.
-`python3Packages.bpycv` has been removed due to being incompatible with Blender 4 and unmaintained.
@@ -441,10 +440,6 @@
There is also a breaking change in the handling of CUDA. Instead of using a CUDA compatible jaxlib
as before, you can use plugins like `python3Packages.jax-cuda12-plugin`.
- Added `allowVariants` to gate availability of package sets like `pkgsLLVM`, `pkgsMusl`, `pkgsZig`, etc. This was done in an effort to
decrease evaluation times by limiting the number of instances of nixpkgs to evaluate. The option will be removed in the future as a
new mechanism is in the works for handling cross compilation.
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
## Other Notable Changes {#sec-nixpkgs-release-25.05-notable-changes}
@@ -542,6 +537,11 @@
- `ddclient` was updated from 3.11.2 to 4.0.0 [Release notes](https://github.com/ddclient/ddclient/releases/tag/v4.0.0)
- `nexusmods-app` has been upgraded from version 0.6.3 to 0.10.2.
- Before upgrading, you **must reset all app state** (mods, games, settings, etc). NexusMods.App will crash if any state from a version older than 0.7.0 is still present.
- Typically, you can can reset to a clean state by running `NexusMods.App uninstall-app`. See Nexus Mod's [how to uninstall the app](https://nexus-mods.github.io/NexusMods.App/users/Uninstall) documentation for more detail and alternative methods.
- This should not be necessary going forward, because loading app state from 0.7.0 or newer is now supported. This is documented in the [0.7.1 changelog](https://github.com/Nexus-Mods/NexusMods.App/releases/tag/v0.7.1).
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
-The initial work to support native compilation on LoongArch64 has completed, with further changes currently
in preparation. In accordance with the [Software Development and Build Convention for LoongArch Architectures](https://github.com/loongson/la-softdev-convention),
this release sets the default march level to `la64v1.0`, covering the desktop and server processors of 3X5000
and newer series. However, embedded chips without LSX (Loongson SIMD eXtension), such as 2K0300 SoC, are not
supported. `pkgsCross.loongarch64-linux-embedded` can be used to build software and systems for these platforms.
-Create the first release note entry in this section!
### Additions and Improvements {#sec-nixpkgs-release-25.11-lib-additions-improvements}
-`neovim`: Added support for the `vim.o.exrc` option, the `VIMINIT` environment variable, and sourcing of `sysinit.vim`.
-Create the first release note entry in this section!
See the neovim help page [`:help startup`](https://neovim.io/doc/user/starting.html#startup) for more information, as well as [the nixpkgs neovim wrapper documentation](#neovim-custom-configuration).
LLVM is a target-independent optimizer and code generator and serves as the basis for many compilers such as Haskell's GHC, rustc, Zig, and many others. It forms the base tools for Apple's Darwin platform.
## Using LLVM {#sec-using-llvm}
LLVM has two ways of being used. One is by using it across all of Nixpkgs and the other is to compile and build individual packages.
### Building packages with LLVM {#sec-building-packages-with-llvm}
Nixpkgs supports two methods of compiling the world with LLVM. One is via setting `useLLVM` in `crossSystem` while importing. This is the recommended way when cross compiling as it is more expressive. An example of doing `aarch64-linux` cross compilation from `x86_64-linux` with LLVM on the target is the following:
```nix
import<nixpkgs>{
localSystem={
system="x86_64-linux";
};
crossSystem={
useLLVM=true;
linker="lld";
};
}
```
Note that we set `linker` to `lld`. This is because LLVM has its own linker called "lld". By setting it, we utilize Clang and lld within this new instance of Nixpkgs. There is a shorthand method for building everything with LLVM: `pkgsLLVM`. This is easier to use with `nix-build` (or `nix build`):
```bash
nix-build -A pkgsLLVM.hello
```
This will compile the GNU hello package with LLVM and the lld linker like previously mentioned.
#### Using `clangStdenv` {#sec-building-packages-with-llvm-using-clang-stdenv}
Another simple way is to override the stdenv with `clangStdenv`. This causes a single package to be built with Clang. However, this `stdenv` does not override platform defaults to use compiler-rt, libc++, and libunwind. This is the preferred way to make a single package in Nixpkgs build with Clang. There are cases where just Clang isn't enough. For these situations, there is `libcxxStdenv`, which uses Clang with libc++ and compiler-rt.
@@ -17,28 +17,6 @@ There's also [a convenient development daemon](https://nixos.org/manual/nixpkgs/
The above instructions don't deal with the appendix of available `configuration.nix` options, and the manual pages related to NixOS. These are built, and written in a different location and in a different format, as explained in the next sections.
## Development environment {#sec-contributing-development-env}
In order to reduce repetition, consider using tools from the provided development environment:
Load it from the NixOS documentation directory with
```ShellSession
$ cd /path/to/nixpkgs/nixos/doc/manual
$ nix-shell
```
To load the development utilities automatically when entering that directory, [set up `nix-direnv`](https://nix.dev/guides/recipes/direnv).
Make sure that your local files aren't added to Git history by adding the following lines to `.git/info/exclude` at the root of the Nixpkgs repository:
```
/**/.envrc
/**/.direnv
```
You might want to also use [`devmode`](https://github.com/NixOS/nixpkgs/blob/master/doc/README.md#devmode) while editing the manual.
Once you have a successful build, you can open the relevant HTML (path mentioned above) in a browser along with the anchor, and observe the redirection.
@@ -20,7 +20,7 @@ Alongside many enhancements to NixOS modules and general system improvements, th
- GNOME has been updated to version 48.
-`decibels` music player is now installed by default. You can disable it using [](#opt-environment.gnome.excludePackages).
-`gnome-shell-extensions` extension collection (which included GNOME Classic extensions, Apps Menu, and User Themes, among others) are no longer installed by default. You can install them again with {option}`services.xserver.desktopManager.gnome.sessionPath`.
-`gnome-shell-extensions` extension collection (which included GNOME Classic extensions, Apps Menu, and User Themes, among others) are no longer installed by default. You can install them again with [](#opt-services.xserver.desktopManager.gnome.sessionPath).
- Option [](#opt-services.gnome.core-developer-tools.enable) now also installs `sysprof` and `d-spy`.
- Option `services.gnome.core-utilities.enable` has been renamed to [](#opt-services.gnome.core-apps.enable).
-`cantarell-fonts`, `source-code-pro` and `source-sans` fonts are no longer installed by default. They have been replaced by `adwaita-fonts`.
@@ -48,43 +48,43 @@ Alongside many enhancements to NixOS modules and general system improvements, th
- [scanservjs](https://github.com/sbs20/scanservjs/), a web UI for SANE scanners. Available at [services.scanservjs](#opt-services.scanservjs.enable).
- [Kimai](https://www.kimai.org/), a web-based multi-user time-tracking application. Available as [services.kimai](#opt-services.kimai.sites).
- [Kimai](https://www.kimai.org/), a web-based multi-user time-tracking application. Available as [services.kimai](options.html#opt-services.kimai).
- [Kismet](https://www.kismetwireless.net/), a Wi-Fi, Bluetooth, and RF monitoring application supporting a wide range of hardware. Available as [services.kismet](#opt-services.kismet.enable).
- [vwifi](https://github.com/Raizo62/vwifi), a Wi-Fi simulator daemon leveraging the `mac80211_hwsim` and `vhost_vsock` kernel modules for efficient simulation of multi-node Wi-Fi networks. Available as [services.vwifi](#opt-services.vwifi.client.enable).
- [Oncall](https://oncall.tools), a web-based calendar tool designed for scheduling and managing on-call shifts. Available as [services.oncall](#opt-services.oncall.enable).
- [Oncall](https://oncall.tools), a web-based calendar tool designed for scheduling and managing on-call shifts. Available as [services.oncall](options.html#opt-services.oncall).
- [Homer](https://homer-demo.netlify.app/), a very simple static homepage for your server. Available as [services.homer](#opt-services.homer.enable).
- [Homer](https://homer-demo.netlify.app/), a very simple static homepage for your server. Available as [services.homer](options.html#opt-services.homer).
- [Ghidra](https://ghidra-sre.org/), a software reverse engineering (SRE) suite of tools. Available as [programs.ghidra](#opt-programs.ghidra.enable).
- [Ghidra](https://ghidra-sre.org/), a software reverse engineering (SRE) suite of tools. Available as [programs.ghidra](options.html#opt-programs.ghidra).
- [Omnom](https://github.com/asciimoo/omnom), a webpage bookmarking and snapshotting service. Available as [services.omnom](#opt-services.omnom.enable).
- [Omnom](https://github.com/asciimoo/omnom), a webpage bookmarking and snapshotting service. Available as [services.omnom](options.html#opt-services.omnom.enable).
- [Yggdrasil-Jumper](https://github.com/one-d-wide/yggdrasil-jumper), an independent project that aims to transparently reduce latency of a connection over Yggdrasil network, utilizing NAT traversal to automatically bypass intermediary nodes. Available as [services.yggdrasil-jumper](#opt-services.yggdrasil-jumper.enable).
- [xpad-noone](https://github.com/medusalix/xpad-noone) is the original upstream xpad driver from the Linux kernel with support for Xbox One controllers removed — especially useful for people who want to use an XBox One controller under the `xone` driver and an Xbox 360 controller under the `xpad` driver at the same time. Available as [hardware.xpad-noone](#opt-hardware.xpad-noone.enable).
- [xpad-noone](https://github.com/medusalix/xpad-noone) is the original upstream xpad driver from the Linux kernel with support for Xbox One controllers removed — especially useful for people who want to use an XBox One controller under the `xone` driver and an Xbox 360 controller under the `xpad` driver at the same time. Available as [hardware.xpad-noone](options.html#hardware.xpad-noone).
- [uMurmur](https://umurmur.net), minimalistic Mumble server primarily targeted to run on embedded computers. Available as [services.umurmur](#opt-services.umurmur.enable).
- [uMurmur](https://umurmur.net), minimalistic Mumble server primarily targeted to run on embedded computers. Available as [services.umurmur](options.html#opt-services.umurmur).
- [Zenoh](https://zenoh.io/), a pub/sub/query protocol with low overhead. The Zenoh router daemon is available as [services.zenohd](#opt-services.zenohd.enable).
- [Zenoh](https://zenoh.io/), a pub/sub/query protocol with low overhead. The Zenoh router daemon is available as [services.zenohd](options.html#opt-services.zenohd.enable).
- [ytdl-sub](https://github.com/jmbannon/ytdl-sub), a tool that downloads media via yt-dlp and prepares it for your favorite media player, including Kodi, Jellyfin, Plex, Emby, and modern music players. Available as [services.ytdl-sub](#opt-services.ytdl-sub.instances).
- [ytdl-sub](https://github.com/jmbannon/ytdl-sub), a tool that downloads media via yt-dlp and prepares it for your favorite media player, including Kodi, Jellyfin, Plex, Emby, and modern music players. Available as [services.ytdl-sub](options.html#opt-services.ytdl-sub.instances).
- [MaryTTS](https://github.com/marytts/marytts), an open-source, multilingual text-to-speech synthesis system written in pure Java. Available as [services.marytts](#opt-services.marytts.enable).
- [MaryTTS](https://github.com/marytts/marytts), an open-source, multilingual text-to-speech synthesis system written in pure Java. Available as [services.marytts](options.html#opt-services.marytts).
- [Continuwuity](https://continuwuity.org/), a federated chat server implementing the Matrix protocol, forked from Conduwuit. Available as [services.matrix-continuwuity](#opt-services.matrix-continuwuity.enable).
- [Reposilite](https://reposilite.com), a lightweight and easy-to-use repository manager for Maven-based artifacts in the JVM ecosystem. Available as [services.reposilite](#opt-services.reposilite.enable).
- [Reposilite](https://reposilite.com), a lightweight and easy-to-use repository manager for Maven-based artifacts in the JVM ecosystem. Available as [services.reposilite](options.html#opt-services.reposilite).
- [networking.modemmanager](#opt-networking.modemmanager.enable) has been split out of [networking.networkmanager](#opt-networking.networkmanager.enable). NetworkManager still enables ModemManager by default, but options exist now to run NetworkManager without ModemManager.
- [networking.modemmanager](options.html#opt-networking.modemmanager) has been split out of [networking.networkmanager](options.html#opt-networking.networkmanager). NetworkManager still enables ModemManager by default, but options exist now to run NetworkManager without ModemManager.
- [Routinator 3000](https://nlnetlabs.nl/projects/routing/routinator/), a full-featured RPKI Relying Party software package that runs as a service which periodically downloads and verifies RPKI data. Available as [services.routinator](#opt-services.routinator.enable).
- [Routinator 3000](https://nlnetlabs.nl/projects/routing/routinator/), a full-featured RPKI Relying Party software package that runs as a service which periodically downloads and verifies RPKI data.
- [doh-server](https://github.com/m13253/dns-over-https), a high performance DNS over HTTPS server. Available as [services.doh-server](#opt-services.doh-server.enable).
- [doh-server](https://github.com/m13253/dns-over-https), a high performance DNS over HTTPS server. Available as [services.doh-server](options.html#opt-services.doh-server.enable).
- [ncps](https://github.com/kalbasit/ncps), a Nix binary cache proxy service implemented in Go using [go-nix](https://github.com/nix-community/go-nix). Available as [services.ncps](#opt-services.ncps.enable).
- [ncps](https://github.com/kalbasit/ncps), a Nix binary cache proxy service implemented in Go using [go-nix](https://github.com/nix-community/go-nix). Available as [services.ncps](options.html#opt-services.ncps.enable).
- [Readeck](https://readeck.org/), a read-it later web-application. Available as [services.readeck](#opt-services.readeck.enable).
@@ -102,21 +102,21 @@ Alongside many enhancements to NixOS modules and general system improvements, th
- [Pinchflat](https://github.com/kieraneglin/pinchflat), a selfhosted YouTube media manager used to track channels and download videos on release. Available as [services.pinchflat](#opt-services.pinchflat.enable).
- [Amazon CloudWatch Agent](https://github.com/aws/amazon-cloudwatch-agent), the official telemetry collector for AWS CloudWatch and AWS X-Ray. Available as [services.amazon-cloudwatch-agent](#opt-services.amazon-cloudwatch-agent.enable).
- [Amazon CloudWatch Agent](https://github.com/aws/amazon-cloudwatch-agent), the official telemetry collector for AWS CloudWatch and AWS X-Ray. Available as [services.amazon-cloudwatch-agent](options.html#opt-services.amazon-cloudwatch-agent.enable).
- [Fluent Bit](https://github.com/fluent/fluent-bit), a fast Log, Metrics and Traces Processor and Forwarder. Available as [services.fluent-bit](#opt-services.fluent-bit.enable).
- [Bat](https://github.com/sharkdp/bat), a {manpage}`cat(1)` clone with wings. Available as [programs.bat](#opt-programs.bat.enable).
- [Bat](https://github.com/sharkdp/bat), a {manpage}`cat(1)` clone with wings. Available as [programs.bat](options.html#opt-programs.bat).
- [Autotier](https://github.com/45Drives/autotier), a passthrough FUSE filesystem. Available as [services.autotierfs](#opt-services.autotierfs.enable).
- [Autotier](https://github.com/45Drives/autotier), a passthrough FUSE filesystem. Available as [services.autotierfs](options.html#opt-services.autotierfs.enable).
- [PostgREST](https://postgrest.org), a standalone web server that turns your PostgreSQL database directly into a RESTful API. Available as [services.postgrest](#opt-services.postgrest.enable).
- [PostgREST](https://postgrest.org), a standalone web server that turns your PostgreSQL database directly into a RESTful API. Available as [services.postgrest](options.html#opt-services.postgrest.enable).
- [postgres-websockets](https://github.com/diogob/postgres-websockets), a middleware that adds websockets capabilities on top of PostgreSQL's asynchronous notifications using LISTEN and NOTIFY commands. Available as [services.postgres-websockets](#opt-services.postgres-websockets.enable).
- [postgres-websockets](https://github.com/diogob/postgres-websockets), a middleware that adds websockets capabilities on top of PostgreSQL's asynchronous notifications using LISTEN and NOTIFY commands. Available as [services.postgres-websockets](options.html#opt-services.postgres-websockets.enable).
- [µStreamer](https://github.com/pikvm/ustreamer), a lightweight MJPEG-HTTP streamer. Available as [services.ustreamer](#opt-services.ustreamer.enable).
- [µStreamer](https://github.com/pikvm/ustreamer), a lightweight MJPEG-HTTP streamer. Available as [services.ustreamer](options.html#opt-services.ustreamer).
- [Whoogle Search](https://github.com/benbusby/whoogle-search), a self-hosted, ad-free, privacy-respecting metasearch engine. Available as [services.whoogle-search](#opt-services.whoogle-search.enable).
- [Whoogle Search](https://github.com/benbusby/whoogle-search), a self-hosted, ad-free, privacy-respecting metasearch engine. Available as [services.whoogle-search](options.html#opt-services.whoogle-search.enable).
- [autobrr](https://autobrr.com), a modern download automation tool for torrents and usenets. Available as [services.autobrr](#opt-services.autobrr.enable).
@@ -124,31 +124,31 @@ Alongside many enhancements to NixOS modules and general system improvements, th
- [Froide-Govplan](https://github.com/okfde/froide-govplan), a web application government planer. Available as [services.froide-govplan](#opt-services.froide-govplan.enable).
- [agorakit](https://github.com/agorakit/agorakit), an organization tool for citizens' collectives. Available with [services.agorakit](#opt-services.agorakit.enable).
- [agorakit](https://github.com/agorakit/agorakit), an organization tool for citizens' collectives. Available with [services.agorakit](options.html#opt-services.agorakit.enable).
- [vivid](https://github.com/sharkdp/vivid), a generator for `LS_COLOR`. Available as [programs.vivid](#opt-programs.vivid.enable).
- [matrix-alertmanager](https://github.com/jaywink/matrix-alertmanager), a bot to receive Alertmanager webhook events and forward them to chosen Matrix rooms. Available as [services.matrix-alertmanager](#opt-services.matrix-alertmanager.enable).
- [matrix-alertmanager](https://github.com/jaywink/matrix-alertmanager), a bot to receive Alertmanager webhook events and forward them to chosen Matrix rooms. Available as [services.matrix-alertmanager](options.html#opt-services.matrix-alertmanager.enable).
- [waagent](https://github.com/Azure/WALinuxAgent), the Microsoft Azure Linux Agent (waagent) manages Linux provisioning and VM interaction with the Azure Fabric Controller. Available with [services.waagent](#opt-services.waagent.enable).
- [waagent](https://github.com/Azure/WALinuxAgent), the Microsoft Azure Linux Agent (waagent) manages Linux provisioning and VM interaction with the Azure Fabric Controller. Available with [services.waagent](options.html#opt-services.waagent.enable).
- [nfc-nci](https://github.com/StarGate01/ifdnfc-nci), an alternative NFC stack and PC/SC driver for the NXP PN54x chipset, commonly found in Lenovo systems as NXP1001 (NPC300). Available as [hardware.nfc-nci](#opt-hardware.nfc-nci.enable).
- [grav](https://getgrav.org/), a modern flat-file CMS. Available with [services.grav](#opt-services.grav.enable).
- [grav](https://getgrav.org/), a modern flat-file CMS. Available with [services.grav](options.html#opt-services.grav.enable).
- [duckdns](https://www.duckdns.org), free dynamic DNS. Available with [services.duckdns](#opt-services.duckdns.enable).
- [duckdns](https://www.duckdns.org), free dynamic DNS. Available with [services.duckdns](options.html#opt-services.duckdns.enable).
- [Zoxide](https://github.com/ajeetdsouza/zoxide), a smarter cd command, inspired by z and autojump. Available as [programs.zoxide](#opt-programs.zoxide.enable).
- [Zoxide](https://github.com/ajeetdsouza/zoxide), a smarter cd command, inspired by z and autojump. Available as [programs.zoxide](options.html#opt-programs.zoxide.enable).
- [victorialogs](https://docs.victoriametrics.com/victorialogs/), log database from VictoriaMetrics. Available as [services.victorialogs](#opt-services.victorialogs.enable).
- [gokapi](https://github.com/Forceu/Gokapi), Lightweight selfhosted Firefox Send alternative without public upload. AWS S3 supported. Available with [services.gokapi](#opt-services.gokapi.enable).
- [gokapi](https://github.com/Forceu/Gokapi), Lightweight selfhosted Firefox Send alternative without public upload. AWS S3 supported. Available with [services.gokapi](options.html#opt-services.gokapi.enable).
- [nostr-rs-relay](https://git.sr.ht/~gheartsfield/nostr-rs-relay/), This is a nostr relay, written in Rust. Available as [services.nostr-rs-relay](#opt-services.nostr-rs-relay.enable).
- [nostr-rs-relay](https://git.sr.ht/~gheartsfield/nostr-rs-relay/), This is a nostr relay, written in Rust. Available as [services.nostr-rs-relay](options.html#opt-services.nostr-rs-relay.enable).
- [haven](https://github.com/bitvora/haven), is a high availability vault for events on nostr. Available as [services.haven](#opt-services.haven.enable).
- [haven](https://github.com/bitvora/haven), is a high availability vault for events on nostr. Available as [services.haven](options.html#opt-services.haven.enable).
- [strfry](https://github.com/hoytech/strfry), a relay for the nostr protocol. Available as [services.strfry](#opt-services.strfry.enable).
- [strfry](https://github.com/hoytech/strfry), a relay for the nostr protocol. Available as [services.strfry](options.html#opt-services.strfry.enable).
- [Prometheus Node Cert Exporter](https://github.com/amimof/node-cert-exporter), a prometheus exporter to check for SSL cert expiry. Available as [services.prometheus.exporters.node-cert](#opt-services.prometheus.exporters.node-cert.enable).
@@ -172,9 +172,9 @@ Alongside many enhancements to NixOS modules and general system improvements, th
- [Fider](https://fider.io/), an open platform to collect and prioritize feedback. Available as [services.fider](#opt-services.fider.enable).
- [PDS](https://github.com/bluesky-social/pds), Personal Data Server for [bsky](https://bsky.social/). Available as [services.pds](#opt-services.pds.enable).
- [PDS](https://github.com/bluesky-social/pds), Personal Data Server for [bsky](https://bsky.social/). Available as [services.pds](option.html#opt-services.pds).
- [Anubis](https://github.com/TecharoHQ/anubis), a scraper defense software. Available as [services.anubis](#opt-services.anubis.defaultOptions).
- [Anubis](https://github.com/TecharoHQ/anubis), a scraper defense software. Available as [services.anubis](options.html#opt-services.anubis).
- [synapse-auto-compressor](https://github.com/matrix-org/rust-synapse-compress-state?tab=readme-ov-file#automated-tool-synapse_auto_compressor), a rust-based matrix-synapse state compressor for postgresql. Available as [services.synapse-auto-compressor](#opt-services.synapse-auto-compressor.enable).
@@ -196,23 +196,21 @@ Alongside many enhancements to NixOS modules and general system improvements, th
- [`g3proxy`](https://github.com/bytedance/g3), an open source enterprise forward proxy from ByteDance, similar to Squid or tinyproxy. Available as [services.g3proxy](#opt-services.g3proxy.enable).
- [OpenCloud](https://opencloud.eu/), an open-source, modern file-sync and sharing platform. It is a fork of oCIS, a ground-up rewrite of the well-known PHP-based NextCloud server. Available as [services.opencloud](#opt-services.opencloud.enable).
- [echoip](https://github.com/mpolden/echoip), a simple service for looking up your IP address. Available as [services.echoip](#opt-services.echoip.enable).
- [whoami](https://github.com/traefik/whoami), a tiny Go server that prints OS information and HTTP request to output. Available as [services.whoami](#opt-services.whoami.enable).
- [LiteLLM](https://github.com/BerriAI/litellm), a LLM Gateway to provide model access, fallbacks and spend tracking across 100+ LLMs. All in the OpenAI format. Available as [services.litellm](#opt-services.litellm.enable).
- [Buffyboard](https://gitlab.postmarketos.org/postmarketOS/buffybox/-/tree/master/buffyboard), a framebuffer on-screen keyboard. Available as [services.buffyboard](#opt-services.buffyboard.enable).
- [Buffyboard](https://gitlab.postmarketos.org/postmarketOS/buffybox/-/tree/master/buffyboard), a framebuffer on-screen keyboard. Available as [services.buffyboard](option.html#opt-services.buffyboard).
- [KanBoard](https://github.com/kanboard/kanboard), a project management tool that focuses on the Kanban methodology. Available as [services.kanboard](#opt-services.kanboard.enable).
- [git-worktree-switcher](https://github.com/mateusauler/git-worktree-switcher), switch between git worktrees with speed. Available as [programs.git-worktree-switcher](#opt-programs.git-worktree-switcher.enable).
- [GLPI-Agent](https://github.com/glpi-project/glpi-agent), GLPI Agent. Available as [services.glpiAgent](#opt-services.glpiAgent.enable).
- [GLPI-Agent](https://github.com/glpi-project/glpi-agent), GLPI Agent. Available as [services.glpiAgent](options.html#opt-services.glpiAgent.enable).
- [pgBackRest](https://pgbackrest.org), a reliable backup and restore solution for PostgreSQL. Available as [services.pgbackrest](#opt-services.pgbackrest.enable).
- [pgBackRest](https://pgbackrest.org), a reliable backup and restore solution for PostgreSQL. Available as [services.pgbackrest](options.html#opt-services.pgbackrest.enable).
- [Recyclarr](https://github.com/recyclarr/recyclarr) a TRaSH Guides synchronizer for Sonarr and Radarr. Available as [services.recyclarr](#opt-services.recyclarr.enable).
@@ -232,7 +230,7 @@ Alongside many enhancements to NixOS modules and general system improvements, th
- [bitbox-bridge](https://github.com/BitBoxSwiss/bitbox-bridge), a bridge software that connects BitBox hardware wallets to computers & web wallets like [Rabby](https://rabby.io/). Allows one to interact & transact with smart contracts, Web3 websites & financial services without storing private keys anywhere other than the hardware wallet. Available as [services.bitbox-bridge](#opt-services.bitbox-bridge.enable).
- [GoDNS](https://github.com/TimothyYe/godns), a dynamic DNS client written in Go, which supports multiple DNS providers. Available as [services.godns](#opt-services.godns.enable).
- [GoDNS](https://github.com/TimothyYe/godns), a dynamic DNS client written in Go, which supports multiple DNS providers. Available as [services.godns](option.html#opt-services.godns.enable).
- [CookCLI](https://cooklang.org/cli/) Server, a web UI for cooklang recipes. Available as [services.cook-cli](#opt-services.cook-cli.enable).
@@ -258,7 +256,7 @@ Alongside many enhancements to NixOS modules and general system improvements, th
- If [`services.nextcloud.package`](#opt-services.nextcloud.package) is specified explicitly, this package will be installed (**recommended**)
- If [`system.stateVersion`](#opt-system.stateVersion) is >=24.11, `pkgs.nextcloud30` will be installed by default.
- If [`system.stateVersion`](#opt-system.stateVersion) is >=24.05, `pkgs.nextcloud31` will be installed by default.
- Please note that an upgrade from v29 (or older) to v31 directly is not possible. Please upgrade to `nextcloud30` (or earlier) first. Nextcloud prohibits skipping major versions while upgrading. You can upgrade by declaring [`services.nextcloud.package = pkgs.nextcloud30;`](#opt-services.nextcloud.package).
- Please note that an upgrade from v29 (or older) to v31 directly is not possible. Please upgrade to `nextcloud30` (or earlier) first. Nextcloud prohibits skipping major versions while upgrading. You can upgrade by declaring [`services.nextcloud.package = pkgs.nextcloud30;`](options.html#opt-services.nextcloud.package).
- `services.cloudflare-dyndns.apiTokenFile` now must be just your Cloudflare api token. Previously it was supposed to be a file of the form `CLOUDFLARE_API_TOKEN=...`.
@@ -446,7 +444,7 @@ Alongside many enhancements to NixOS modules and general system improvements, th
- [`system.stateVersion`](#opt-system.stateVersion) is now validated and must be in the `"YY.MM"` format, ideally corresponding to a prior NixOS release.
- [`hardware.xone`](#opt-hardware.xone.enable) will also enable [`hardware.xpad-noone`](#opt-hardware.xpad-noone.enable) to provide Xbox 360 driver by default.
- [`hardware.xone`](options.html#opt-hardware.xone.enable) will also enable [`hardware.xpad-noone`](options.html#opt-hardware.xpad-noone.enable) to provide Xbox 360 driver by default.
- `services.mysql` now supports easy cluster setup via [`services.mysql.galeraCluster`](#opt-services.mysql.galeraCluster.enable) option.
@@ -515,8 +513,6 @@ Alongside many enhancements to NixOS modules and general system improvements, th
- `bind.cacheNetworks` now only controls access for recursive queries, where it previously controlled access for all queries.
- The [Starship](https://starship.rs) module now automatically loads the starship prompt when using [`xonsh`](https://xon.sh).
- [`services.mongodb.enableAuth`](#opt-services.mongodb.enableAuth) now uses the newer [mongosh](https://github.com/mongodb-js/mongosh) shell instead of the legacy shell to configure the initial superuser. You can configure the mongosh package to use through the [`services.mongodb.mongoshPackage`](#opt-services.mongodb.mongoshPackage) option.
- There is a new set of NixOS test tools for testing virtual Wi-Fi networks in many different topologies. See the {option}`services.vwifi` module, {option}`services.kismet` NixOS test, and [manual](https://nixos.org/manual/nixpkgs/unstable/#sec-nixos-test-wifi) for documentation and examples.
@@ -525,7 +521,7 @@ Alongside many enhancements to NixOS modules and general system improvements, th
- Exposed the `paperless-manage` script package via the `services.paperless.manage` read-only option.
- New options for the declarative configuration of the user space part of ALSA have been introduced under [hardware.alsa](#opt-hardware.alsa.enable), including setting the default capture and playback device, defining sound card aliases and volume controls.
- New options for the declarative configuration of the user space part of ALSA have been introduced under [hardware.alsa](options.html#opt-hardware.alsa.enable), including setting the default capture and playback device, defining sound card aliases and volume controls.
Note: these are intended for users not running a sound server like PulseAudio or PipeWire, but having ALSA as their only sound system.
- `services.k3s` now provides the `autoDeployCharts` option that allows to automatically deploy Helm charts via the k3s Helm controller.
@@ -543,11 +539,6 @@ Alongside many enhancements to NixOS modules and general system improvements, th
- A toggle has been added under `users.users.<name>.enable` to allow toggling individual users conditionally. If set to false, the user account will not be created.
- New hooks were added:
- `writableTmpDirAsHomeHook`: This setup hook ensures that the directory specified by the `HOME` environment variable is writable.
- `addBinToPathHook`: This setup hook checks if the `bin/` directory exists in the `$out` output path and, if so, adds it to the `PATH` environment variable.
- `gitSetupHook`: This setup hook sets up a valid Git configuration, including the `user.name` and `user.email` fields.
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
-Secure boot support can now be enabled for the Limine bootloader through {option}`boot.loader.limine.secureBoot.enable`. Bootloader install script signs the bootloader, then kernels are hashed during system rebuild and written to a config. This allows Limine to boot only the kernels installed through NixOS system.
-Create the first release note entry in this section!
## New Modules {#sec-release-25.11-new-modules}
@@ -12,28 +12,14 @@
- [gtklock](https://github.com/jovanlanik/gtklock), a GTK-based lockscreen for Wayland. Available as [programs.gtklock](#opt-programs.gtklock.enable).
- [FileBrowser](https://filebrowser.org/), a web application for managing and sharing files. Available as [services.filebrowser](#opt-services.filebrowser.enable).
- [LACT](https://github.com/ilya-zlobintsev/LACT), a GPU monitoring and configuration tool, can now be enabled through [services.lact.enable](#opt-services.lact.enable).
Note that for LACT to work properly on AMD GPU systems, you need to enable [hardware.amdgpu.overdrive.enable](#opt-hardware.amdgpu.overdrive.enable).
- [SuiteNumérique Docs](https://github.com/suitenumerique/docs), a collaborative note taking, wiki and documentation web platform and alternative to Notion or Outline. Available as [services.lasuite-docs](#opt-services.lasuite-docs.enable).
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
-The `services.polipo` module has been removed as `polipo` is unmaintained and archived upstream.
- The Pocket ID module ([`services.pocket-id`][#opt-services.pocket-id.enable]) and package (`pocket-id`) has been updated to 1.0.0. Some environment variables have been changed or removed, see the [migration guide](https://pocket-id.org/docs/setup/migrate-to-v1/).
-`renovate` was updated to v40. See the [upstream release notes](https://github.com/renovatebot/renovate/releases/tag/40.0.0) for breaking changes.
-Create the first release note entry in this section!
## Other Notable Changes {#sec-release-25.11-notable-changes}
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
-`services.clamsmtp` is unmaintained and was removed from Nixpkgs.
-`amdgpu` kernel driver overdrive mode can now be enabled by setting [hardware.amdgpu.overdrive.enable](#opt-hardware.amdgpu.overdrive.enable) and customized through [hardware.amdgpu.overdrive.ppfeaturemask](#opt-hardware.amdgpu.overdrive.ppfeaturemask).
This allows for fine-grained control over the GPU's performance and maybe required by overclocking softwares like Corectrl and Lact. These new options replace old options such as {option}`programs.corectrl.gpuOverclock.enable` and {option}`programs.tuxclocker.enableAMD`.
-Create the first release note entry in this section!
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
