autopen: init at 0.2.0

.editorconfig

@@ -23,15 +23,15 @@ insert_final_newline = false
 
 # see https://nixos.org/nixpkgs/manual/#chap-conventions
 
-[*.{bash,css,js,json,lock,md,nix,pl,pm,py,rb,sh,ts,xml}]
+[*.{bash,css,js,json,lock,md,nix,pl,pm,py,rb,sh,xml}]
 indent_style = space
 
 # Match docbook files, set indent width of one
 [*.xml]
 indent_size = 1
 
-# Match js/json/lockfiles/markdown/nix/ruby/ts files, set indent width of two
-[*.{js,json,lock,md,nix,rb,ts}]
+# Match json/lockfiles/markdown/nix/ruby files, set indent width of two
+[*.{js,json,lock,md,nix,rb}]
 indent_size = 2
 
 # Match all the Bash code in Nix files, set indent width of two
@@ -79,7 +79,7 @@ indent_size = unset
 trim_trailing_whitespace = true
 
 # binaries
-[*.{nib,torrent}]
+[*.nib]
 end_of_line = unset
 insert_final_newline = unset
 trim_trailing_whitespace = unset

.gitattributes

@@ -62,6 +62,3 @@ ci/OWNERS linguist-language=CODEOWNERS
 # patching CRLF line endings from an upstream source package.
 *.diff !text !eol
 *.patch !text !eol
-
-# Torrent files are binary files and should not be re-encoded.
-*.torrent !text !eol

.github/actions/checkout/action.yml

@@ -13,7 +13,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+    - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
       env:
         MERGED_SHA: ${{ inputs.merged-as-untrusted-at }}
         TARGET_SHA: ${{ inputs.target-as-trusted-at }}

.github/dependabot.yml

@@ -1,9 +1,7 @@
 version: 2
 updates:
   - package-ecosystem: "github-actions"
-    directories:
-      - "/"
-      - ".github/actions/*/*"
+    directory: "/"
     schedule:
       interval: "weekly"
     labels: []

.github/labeler.yml

@@ -43,6 +43,14 @@
               - .github/**/*
               - ci/**/*.*
 
+"6.topic: coq":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - pkgs/applications/science/logic/coq/**/*
+              - pkgs/development/coq-modules/**/*
+              - pkgs/top-level/coq-packages.nix
+
 "6.topic: COSMIC":
   - any:
       - changed-files:
@@ -458,18 +466,6 @@
           - any-glob-to-any-file:
               - pkgs/development/rocm-modules/**/*
 
-"6.topic: rocq":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/applications/science/logic/coq/**/*
-              - pkgs/applications/science/logic/rocq-core/**/*
-              - pkgs/build-support/coq/**/*
-              - pkgs/build-support/rocq/**/*
-              - pkgs/development/rocq-modules/**/*
-              - pkgs/top-level/coq-packages.nix
-              - pkgs/top-level/rocq-packages.nix
-
 "6.topic: ruby":
   - any:
       - changed-files:

.github/workflows/build.yml

@@ -59,7 +59,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
         with:
           # Sandbox is disabled on MacOS by default.
           extra_nix_config: sandbox = true

.github/workflows/check.yml

@@ -134,35 +134,6 @@ jobs:
           GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
         run: gh api /rate_limit | jq
 
-  github-script:
-    runs-on: ubuntu-24.04-arm
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-          sparse-checkout: .github/actions
-
-      - name: Checkout merge and target commits
-        uses: ./.github/actions/checkout
-        with:
-          merged-as-untrusted-at: ${{ inputs.mergedSha }}
-          target-as-trusted-at: ${{ inputs.targetSha }}
-
-      - name: Install dependencies to trusted/
-        run: |
-          npm ci --package-lock-only=false
-          echo "$PWD/node_modules/.bin" >> "$GITHUB_PATH"
-        working-directory: nixpkgs/trusted/ci/github-script
-
-      - name: Link trusted/ dependencies to untrusted/
-        run: ln -s "$PWD/trusted/ci/github-script/node_modules" untrusted/ci/github-script/node_modules
-        working-directory: nixpkgs
-
-      - name: Type-check ci/github-script
-        run: tsc --build
-        working-directory: nixpkgs/untrusted/ci/github-script
-
   owners:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 5
@@ -171,14 +142,13 @@ jobs:
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
-
       - name: Checkout merge and target commits
         uses: ./.github/actions/checkout
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true

.github/workflows/eval.yml

@@ -139,7 +139,7 @@ jobs:
             core.info(`Found pinned.json commit: ${ciPinBumpCommit}`)
 
       - name: Install Nix
-        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - name: Load supported versions
         id: versions
@@ -187,7 +187,7 @@ jobs:
           target-as-trusted-at: ${{ inputs.targetSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true
@@ -277,7 +277,7 @@ jobs:
           merge-multiple: true
 
       - name: Install Nix
-        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - name: Combine all output paths and eval stats
         run: |
@@ -375,7 +375,7 @@ jobs:
         with:
           github-token: ${{ steps.app-token.outputs.token || github.token }}
           script: |
-            require('./nixpkgs/trusted/ci/github-script/check-target-branch.ts')({
+            require('./nixpkgs/trusted/ci/github-script/check-target-branch.js')({
               github,
               context,
               core,
@@ -486,7 +486,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - name: Ensure flake outputs on all systems still evaluate
         run: nix flake check --all-systems --no-build './nixpkgs/untrusted?shallow=1'

.github/workflows/lint.yml

@@ -35,7 +35,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       # TODO: Figure out how to best enable caching for the treefmt job. Cachix won't work well,
       # because the cache would be invalidated on every commit - treefmt checks every file.
@@ -70,7 +70,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true
@@ -100,7 +100,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true

.github/workflows/test.yml

@@ -77,7 +77,7 @@ jobs:
               '.github/workflows/pull-request-target.yml',
               '.github/workflows/test.yml',
               'ci/github-script/bot.js',
-              'ci/github-script/check-target-branch.ts',
+              'ci/github-script/check-target-branch.js',
               'ci/github-script/commits.js',
               'ci/github-script/get-pr-commit-details.js',
               'ci/github-script/lint-commits.js',

.mailmap

@@ -6,7 +6,6 @@ Christina Sørensen <christina@cafkafk.com> <christinaafk@gmail.com>
 Christina Sørensen <christina@cafkafk.com> <89321978+cafkafk@users.noreply.github.com>
 Daniel Løvbrøtte Olsen <me@dandellion.xyz> <daniel.olsen99@gmail.com>
 Ethan Carter Edwards <ethan@ethancedwards.com> Ethan Edwards <ethancarteredwards@gmail.com>
-Ethan Carter Edwards <ethan@ethancedwards.com> <ethancedwards8@users.noreply.github.com>
 Fabian Affolter <mail@fabian-affolter.ch> <fabian@affolter-engineering.ch>
 Fiona Behrens <me@kloenk.dev>
 Fiona Behrens <me@kloenk.dev> <me@kloenk.de>

CONTRIBUTING.md

@@ -957,6 +957,7 @@ The following situations are fully or partially exempt:
 
 If you believe that someone is using automation without appropriate disclosure and review, you can politely ask them if that’s the case and point them to this policy as appropriate.
 Please assume good faith and remain civil; it’s not always possible to determine, and it is more likely that someone overlooked this policy than deliberately violated it.
+If you think someone is continuing to break the policy after this, please escalate to the [Nixpkgs core team](https://nixos.org/community/teams/nixpkgs-core/) rather than fighting over it.
 
 If a contribution is clearly in violation of the policy (e.g. the contributor admits it was not followed, or there are AI tool attributions that do not meet our required format), it can be closed or hidden, preferably after informing the contributor of the policy and giving them a chance to address the violations.
 Deliberate violations of this policy are considered to break the [Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) clause against “Wasting other people’s time with low quality contributions, including but not limited to LLM and bot spam”.

ci/OWNERS

@@ -361,10 +361,7 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/applications/editors/kakoune     @philiptaron
 
 # LuaPackages
-/pkgs/development/interpreters/lua-5  @NixOS/lua
-/pkgs/development/interpreters/luajit @NixOS/lua
 /pkgs/development/lua-modules         @NixOS/lua
-/pkgs/top-level/lua-packages.nix      @NixOS/lua
 
 # Neovim
 /pkgs/applications/editors/neovim           @NixOS/neovim
@@ -469,8 +466,9 @@ nixos/tests/incus/                      @adamcstephens
 pkgs/by-name/in/incus/                  @adamcstephens
 pkgs/by-name/lx/lxc*                    @adamcstephens
 
-# Flutter
+# ExpidusOS, Flutter
 /pkgs/development/compilers/flutter @RossComputerGuy
+/pkgs/desktops/expidus              @RossComputerGuy
 
 # GNU Tar & Zip
 /pkgs/by-name/gn/gnutar        @RossComputerGuy
@@ -528,3 +526,6 @@ pkgs/by-name/wa/warp-terminal/  @emilytrau @imadnyc @4evy @johnrtitor
 /nixos/lib/testing                                          @NixOS/test-driver
 /nixos/tests/nixos-test-driver                              @NixOS/test-driver
 /nixos/modules/virtualisation/nspawn-container/run-nspawn   @NixOS/test-driver
+
+# Boot security
+/pkgs/by-name/au/autopen    @NixOS/boot-security

ci/github-script/.gitignore

@@ -1,5 +1,2 @@
-comparison
-comparison.zip
 node_modules
 step-summary.md
-*.tsbuildinfo

ci/github-script/bot.js

@@ -1,4 +1,3 @@
-// @ts-nocheck
 module.exports = async ({ github, context, core, dry }) => {
   const path = require('node:path')
   const { DefaultArtifactClient } = await import('@actions/artifact')

ci/github-script/check-target-branch.js

@@ -1,6 +1,4 @@
-import type * as actionsCore from '@actions/core'
-import type { context as actionsContext } from '@actions/github'
-import type { GitHub } from '@actions/github/lib/utils'
+/// @ts-check
 
 // TODO: should this be combined with the branch checks in prepare.js?
 // They do seem quite similar, but this needs to run after eval,
@@ -11,47 +9,39 @@ const { readFile } = require('node:fs/promises')
 const { postReview, dismissReviews } = require('./reviews.js')
 
 const reviewKey = 'check-target-branch'
-
-type ChangedPaths = {
-  attrdiff: {
-    added: string[]
-    changed: string[]
-    removed: string[]
-  }
-  attrdiffByKernel: Record<
-    string,
-    {
-      added: string[]
-      changed: string[]
-      removed: string[]
-    }
-  >
-  attrdiffByPlatform: Record<
-    string,
-    {
-      added: string[]
-      changed: string[]
-      removed: string[]
-    }
-  >
-  labels: Record<string, boolean>
-  rebuildCountByKernel: Record<string, number>
-  rebuildsByKernel: Record<string, string[]>
-  rebuildsByPlatform: Record<string, string[]>
-}
-
-async function checkTargetBranch({
-  github,
-  context,
-  core,
-  dry,
-}: {
-  github: InstanceType<typeof GitHub>
-  context: typeof actionsContext
-  core: typeof actionsCore
-  dry: boolean
-}) {
-  const changed: ChangedPaths = JSON.parse(
+/**
+ * @param {{
+ *  github: InstanceType<import('@actions/github/lib/utils').GitHub>,
+ *  context: typeof import('@actions/github').context
+ *  core: import('@actions/core')
+ *  dry: boolean
+ * }} CheckTargetBranchProps
+ */
+async function checkTargetBranch({ github, context, core, dry }) {
+  /**
+   * @type {{
+   *  attrdiff: {
+   *   added: string[],
+   *   changed: string[],
+   *   removed: string[],
+   *  },
+   *  attrdiffByKernel: Record<string, {
+   *   added: string[],
+   *   changed: string[],
+   *   removed: string[],
+   *  }>,
+   *  attrdiffByPlatform: Record<string, {
+   *   added: string[],
+   *   changed: string[],
+   *   removed: string[],
+   *  }>,
+   *  labels: Record<string, boolean>,
+   *  rebuildCountByKernel: Record<string, number>,
+   *  rebuildsByKernel: Record<string, string[]>,
+   *  rebuildsByPlatform: Record<string, string[]>,
+   * }}
+   */
+  const changed = JSON.parse(
     await readFile('comparison/changed-paths.json', 'utf-8'),
   )
   const pull_number = context.payload.pull_request?.number
@@ -165,7 +155,7 @@ async function checkTargetBranch({
       reviewKey,
     })
   } else if (rebuildsAllTests && !isExemptKernelUpdate) {
-    let branchText: string
+    let branchText
     if (base === 'master' && maxRebuildCount >= 500) {
       branchText = '(probably either `staging-nixos` or `staging`)'
     } else if (base === 'master') {

ci/github-script/commits.js

@@ -1,4 +1,3 @@
-// @ts-nocheck
 module.exports = async ({ github, context, core, dry, cherryPicks }) => {
   const { execFileSync } = require('node:child_process')
   const { classify } = require('../supportedBranches.js')

ci/github-script/get-pr-commit-details.js

@@ -1,4 +1,4 @@
-// @ts-nocheck
+// @ts-check
 const { promisify } = require('node:util')
 const execFile = promisify(require('node:child_process').execFile)
 
@@ -16,7 +16,7 @@ const execFile = promisify(require('node:child_process').execFile)
 /**
  * @param {{
  *  args: string[]
- *  core: typeof import('@actions/core'),
+ *  core: import('@actions/core'),
  *  quiet?: boolean,
  *  repoPath?: string,
  * }} RunGitProps
@@ -40,7 +40,7 @@ async function runGit({ args, repoPath, core, quiet }) {
  * of 250 commits and doesn't return the changed files.
  *
  * @param {{
- *  core: typeof import('@actions/core'),
+ *  core: import('@actions/core'),
  *  pr: Awaited<ReturnType<InstanceType<import('@actions/github/lib/utils').GitHub>["rest"]["pulls"]["get"]>>["data"]
  *  repoPath?: string,
  * }} GetCommitMessagesForPRProps

ci/github-script/get-teams.js

@@ -1,4 +1,3 @@
-// @ts-nocheck
 const excludeTeams = [
   /^voters.*$/,
   /^nixpkgs-maintainers$/,

ci/github-script/lint-commits.js

@@ -1,3 +1,4 @@
+// @ts-check
 const { classify } = require('../supportedBranches.js')
 const { getCommitDetailsForPR } = require('./get-pr-commit-details.js')
 
@@ -5,9 +6,9 @@ const { getCommitDetailsForPR } = require('./get-pr-commit-details.js')
 
 /**
  * @param {{
- *  github: InstanceType<typeof import('@actions/github/lib/utils').GitHub>,
+ *  github: InstanceType<import('@actions/github/lib/utils').GitHub>,
  *  context: typeof import('@actions/github').context,
- *  core: typeof import('@actions/core'),
+ *  core: import('@actions/core'),
  *  repoPath?: string,
  * }} LintCommitsProps
  */
@@ -56,7 +57,7 @@ async function lintCommits({ github, context, core, repoPath }) {
 /**
  * @param {{
  *  commits: Commit[],
- *  core: typeof import('@actions/core'),
+ *  core: import('@actions/core'),
  * }} CheckCommitMessagesProps
  */
 async function checkCommitMessages({ commits, core }) {
@@ -169,7 +170,7 @@ async function checkCommitMessages({ commits, core }) {
 /**
  * @param {{
  *  commits: Commit[],
- *  core: typeof import('@actions/core'),
+ *  core: import('@actions/core'),
  * }} CheckGitFieldsProps
  */
 async function checkCommitMetadata({ commits, core }) {

ci/github-script/manual-file-edits.js

@@ -1,11 +1,12 @@
+// @ts-check
 const { classify } = require('../supportedBranches.js')
 const { getCommitDetailsForPR } = require('./get-pr-commit-details')
 
 /**
  * @param {{
- *  github: InstanceType<typeof import('@actions/github/lib/utils').GitHub>,
+ *  github: InstanceType<import('@actions/github/lib/utils').GitHub>,
  *  context: typeof import('@actions/github').context,
- *  core: typeof import('@actions/core'),
+ *  core: import('@actions/core'),
  *  repoPath?: string,
  *  dry: boolean,
  * }} CheckManualFileEditsProps

ci/github-script/merge.js

@@ -1,4 +1,3 @@
-// @ts-nocheck
 const { classify } = require('../supportedBranches.js')
 
 function runChecklist({

ci/github-script/package-lock.json

@@ -10,11 +10,6 @@
         "@actions/github": "9.1.0",
         "bottleneck": "2.19.5",
         "commander": "14.0.3"
-      },
-      "devDependencies": {
-        "@tsconfig/node24": "24.0.4",
-        "@types/node": "24.13.3",
-        "typescript": "7.0.2"
       }
     },
     "node_modules/@actions/artifact": {
@@ -593,19 +588,6 @@
         "protoc-gen-ts": "bin/protoc-gen-ts"
       }
     },
-    "node_modules/@protobuf-ts/plugin/node_modules/typescript": {
-      "version": "3.9.10",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-3.9.10.tgz",
-      "integrity": "sha512-w6fIxVE/H1PkLKcCPsFqKE7Kv7QUwhU8qQY2MueZXWx5cPZdwFupLgKK3vntcK98BtNHZtAF4LA/yl2a7k8R6Q==",
-      "license": "Apache-2.0",
-      "bin": {
-        "tsc": "bin/tsc",
-        "tsserver": "bin/tsserver"
-      },
-      "engines": {
-        "node": ">=4.2.0"
-      }
-    },
     "node_modules/@protobuf-ts/protoc": {
       "version": "2.11.1",
       "resolved": "https://registry.npmjs.org/@protobuf-ts/protoc/-/protoc-2.11.1.tgz",
@@ -630,343 +612,6 @@
         "@protobuf-ts/runtime": "^2.11.1"
       }
     },
-    "node_modules/@tsconfig/node24": {
-      "version": "24.0.4",
-      "resolved": "https://registry.npmjs.org/@tsconfig/node24/-/node24-24.0.4.tgz",
-      "integrity": "sha512-2A933l5P5oCbv6qSxHs7ckKwobs8BDAe9SJ/Xr2Hy+nDlwmLE1GhFh/g/vXGRZWgxBg9nX/5piDtHR9Dkw/XuA==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@types/node": {
-      "version": "24.13.3",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.3.tgz",
-      "integrity": "sha512-Dh8vAsV36ig5wa9OX4pXvMc9D3Veibfw2wix0CUwYODLD8nkj9UsLjASr49nPg+2eKzxhBV+v7L8pXvT4e639Q==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "undici-types": "~7.18.0"
-      }
-    },
-    "node_modules/@typescript/typescript-aix-ppc64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-aix-ppc64/-/typescript-aix-ppc64-7.0.2.tgz",
-      "integrity": "sha512-MTKKkWB7p/0E9xi1d1tHtZ5PiLkGEMIq88pK2CubZjOsLtYTLqhgIgi6zepFa+9GHZ6h05NMCkQxGKiPXMxXtQ==",
-      "cpu": [
-        "ppc64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "aix"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-darwin-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-arm64/-/typescript-darwin-arm64-7.0.2.tgz",
-      "integrity": "sha512-gowzar9MwS/aRWp6f3a4KUqzRjAZjOsmGNCM6LcTgXum+dBfgsBVMN+AgvOCCbguXyick6LJhpBszxMebJ8syA==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-darwin-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-x64/-/typescript-darwin-x64-7.0.2.tgz",
-      "integrity": "sha512-SZ9xZInqApNlNGc9s0W1VSsktYSOe9cFqNOIqmN1Gs8SmkjKZYFt017G4VwPxASInODuAdbTW7sXiFUf893RgA==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-freebsd-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-arm64/-/typescript-freebsd-arm64-7.0.2.tgz",
-      "integrity": "sha512-W5NH4y/J0plIIS5b2xvTEkU7JFxyqdMAOgf+Ilhl0vHQXKO5dZoxd+C/jEtq56c4F3wk71RB4BMRQ2XdI+bwYQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-freebsd-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-x64/-/typescript-freebsd-x64-7.0.2.tgz",
-      "integrity": "sha512-UMGDx5sTpzNw3WiPebH7l90IWfJggEd+egHt/q6p7/Cm3zqoV7VxkGXt+3DxPIw8CcmvAB0j3sVVfbhX+M4Tpw==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-arm": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm/-/typescript-linux-arm-7.0.2.tgz",
-      "integrity": "sha512-gffT3xPz9sR7j/YJExkyPntrI0P2EP9XbOyWzth2/Gs0RstK+90RBcO0ncXoXy/beYll1SXw846Nf2zdnEz0QQ==",
-      "cpu": [
-        "arm"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm64/-/typescript-linux-arm64-7.0.2.tgz",
-      "integrity": "sha512-Qh4eU4/y3yDjnfjjyPYihMj5/ODIlmt+Bzu17OI+fiSRDW57QmU5SiN63exPRNJPKUzcc1INa1NXdrJ+MqHjUQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-loong64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-loong64/-/typescript-linux-loong64-7.0.2.tgz",
-      "integrity": "sha512-uEHck9i8hoAzXPiYRib1O7miOnz23SxIeVl6F4LXox+qov1K35jHcEW6VHKvZI+pyvl7fZEP4MCU5LYvIq1GuQ==",
-      "cpu": [
-        "loong64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-mips64el": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-mips64el/-/typescript-linux-mips64el-7.0.2.tgz",
-      "integrity": "sha512-R4KvAMnE43W5Qeqb0Ly56O3mWMWIAgsMyz36DCaycd5nbg/9kzm0liw3JocfRqyJY0KPmzFjbswozXyW0DnIYA==",
-      "cpu": [
-        "mips64el"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-ppc64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-ppc64/-/typescript-linux-ppc64-7.0.2.tgz",
-      "integrity": "sha512-DORx5b3sd/4S7eayxm4FQv+A7CrkUIGRaHiwI8oiHTAI1fAPWhF4J0vAlkC8biAlHSVVwxMQ3tjZ2/DVbnQiiA==",
-      "cpu": [
-        "ppc64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-riscv64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-riscv64/-/typescript-linux-riscv64-7.0.2.tgz",
-      "integrity": "sha512-wf0jqEDOjrPRnKwYRyyJDRo11KMbvMFrU+q4zqKyChODBzvlkbhNQfKvLxQCcwTpdDaXSHZTVuh0JoCrKCUMHQ==",
-      "cpu": [
-        "riscv64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-s390x": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-s390x/-/typescript-linux-s390x-7.0.2.tgz",
-      "integrity": "sha512-IkwJc3L7yhytWd/ewjyxNDfOmswCm9GWMJT/ue/dU4aZNbwZeYAetq42VyLmsmSjvoX7z74X6ZaYCtzAr0EuGw==",
-      "cpu": [
-        "s390x"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-x64/-/typescript-linux-x64-7.0.2.tgz",
-      "integrity": "sha512-EYdf2cNg7rgCWJnxCdJ+F3V39O8ihb37eHAu1LK8oAFizgTQbPOK7zHHXbPt8rX24COqODXeI3sIf0fCXG7H/A==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-netbsd-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-arm64/-/typescript-netbsd-arm64-7.0.2.tgz",
-      "integrity": "sha512-+polYF4MF04aPpO5FTkHran9yUQDSXqy5GiSDKpsll5jy3l3+g9QLhpf39T+ePtefhXLOGrLl0QIjkQP6VnelA==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-netbsd-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-x64/-/typescript-netbsd-x64-7.0.2.tgz",
-      "integrity": "sha512-8YIT0EHM/3dq10ZOVF/A7pc/YSMtbcecct4rWtexrnSCHOPcpC2KTLXfTCR6vDpnSiY12heNb1GiN/wu+T/FyA==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-openbsd-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-arm64/-/typescript-openbsd-arm64-7.0.2.tgz",
-      "integrity": "sha512-APT8+ClYnuYm1u9+kgGXoMj2VzWzcymwh2gNSQVySHfkRDGOTVkoWLjCmOQSaO+PoqQ57B0flRp9SA+7GnnkzQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-openbsd-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-x64/-/typescript-openbsd-x64-7.0.2.tgz",
-      "integrity": "sha512-yX7s+Q0Dln0Dt9tEzZsAjXXR/+ytBM7AlglaqyeMPxQszJ1JhlJdZ6jLA+IzldHtflX81em7lDao1xXu+aRRkg==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-sunos-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-sunos-x64/-/typescript-sunos-x64-7.0.2.tgz",
-      "integrity": "sha512-dLJDGaLZ1D4HPQn62u1n8mBDkJREwMsAkCdkwd4Ieqw+x3TUyTsqY0YiBCtE6H6OzzgGk3iuZ3vFWRS+E8/d1g==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "sunos"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-win32-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-arm64/-/typescript-win32-arm64-7.0.2.tgz",
-      "integrity": "sha512-Gyl1Vy6OsWesLzmq+EP0Fb7b4Nid5232AvcA2SFcdYreldpNtYFFofPjnt62y9hQy7VTaZp65ICJjuAQRaVcIQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-win32-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-x64/-/typescript-win32-x64-7.0.2.tgz",
-      "integrity": "sha512-0BQ3HkAHHlKLSp1qRvf3SUhGpGsDuhB/jgFw75guyqbxJqEaS0Cw/VFO8i2nHglJUzQCRtMMR/IBAKE3ETMC4g==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
     "node_modules/@typescript/vfs": {
       "version": "1.6.1",
       "resolved": "https://registry.npmjs.org/@typescript/vfs/-/vfs-1.6.1.tgz",
@@ -2012,37 +1657,16 @@
       }
     },
     "node_modules/typescript": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-7.0.2.tgz",
-      "integrity": "sha512-8FYau96o3NKOhbjKi/qNvG/W5jhzxkbdm5sj9AbZ/5T5sWqn3hJgLfGx27sRKZWTvyzCP8dLRBTf5tBTSRVUNA==",
+      "version": "3.9.10",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-3.9.10.tgz",
+      "integrity": "sha512-w6fIxVE/H1PkLKcCPsFqKE7Kv7QUwhU8qQY2MueZXWx5cPZdwFupLgKK3vntcK98BtNHZtAF4LA/yl2a7k8R6Q==",
       "license": "Apache-2.0",
       "bin": {
-        "tsc": "bin/tsc"
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
       },
       "engines": {
-        "node": ">=16.20.0"
-      },
-      "optionalDependencies": {
-        "@typescript/typescript-aix-ppc64": "7.0.2",
-        "@typescript/typescript-darwin-arm64": "7.0.2",
-        "@typescript/typescript-darwin-x64": "7.0.2",
-        "@typescript/typescript-freebsd-arm64": "7.0.2",
-        "@typescript/typescript-freebsd-x64": "7.0.2",
-        "@typescript/typescript-linux-arm": "7.0.2",
-        "@typescript/typescript-linux-arm64": "7.0.2",
-        "@typescript/typescript-linux-loong64": "7.0.2",
-        "@typescript/typescript-linux-mips64el": "7.0.2",
-        "@typescript/typescript-linux-ppc64": "7.0.2",
-        "@typescript/typescript-linux-riscv64": "7.0.2",
-        "@typescript/typescript-linux-s390x": "7.0.2",
-        "@typescript/typescript-linux-x64": "7.0.2",
-        "@typescript/typescript-netbsd-arm64": "7.0.2",
-        "@typescript/typescript-netbsd-x64": "7.0.2",
-        "@typescript/typescript-openbsd-arm64": "7.0.2",
-        "@typescript/typescript-openbsd-x64": "7.0.2",
-        "@typescript/typescript-sunos-x64": "7.0.2",
-        "@typescript/typescript-win32-arm64": "7.0.2",
-        "@typescript/typescript-win32-x64": "7.0.2"
+        "node": ">=4.2.0"
       }
     },
     "node_modules/undici": {
@@ -2057,13 +1681,6 @@
         "node": ">=14.0"
       }
     },
-    "node_modules/undici-types": {
-      "version": "7.18.2",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.18.2.tgz",
-      "integrity": "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/universal-user-agent": {
       "version": "7.0.3",
       "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.3.tgz",

ci/github-script/package.json

@@ -10,10 +10,5 @@
     "@actions/github": "9.1.0",
     "bottleneck": "2.19.5",
     "commander": "14.0.3"
-  },
-  "devDependencies": {
-    "@tsconfig/node24": "24.0.4",
-    "@types/node": "24.13.3",
-    "typescript": "7.0.2"
   }
 }

ci/github-script/prepare.js

@@ -1,4 +1,3 @@
-// @ts-nocheck
 const { classify } = require('../supportedBranches.js')
 const { postReview, dismissReviews } = require('./reviews.js')
 const reviewKey = 'prepare'

ci/github-script/reviewers.js

@@ -1,4 +1,3 @@
-// @ts-nocheck
 async function handleReviewers({
   github,
   context,

ci/github-script/reviews.js

@@ -1,3 +1,5 @@
+// @ts-check
+
 const eventToState = {
   COMMENT: 'COMMENTED',
   REQUEST_CHANGES: 'CHANGES_REQUESTED',
@@ -14,7 +16,7 @@ const reviewUsers = [
 ]
 
 /**
- * @typedef {InstanceType<typeof import('@actions/github/lib/utils').GitHub>} GitHub
+ * @typedef {InstanceType<import('@actions/github/lib/utils').GitHub>} GitHub
  * @typedef {typeof import('@actions/github').context} Context
  *
  * @typedef {Awaited<ReturnType<GitHub['rest']['pulls']['listReviews']>>['data'][number]} Review
@@ -25,7 +27,7 @@ const reviewUsers = [
  * @param {{
  *  github: GitHub,
  *  context: Context,
- *  core: typeof import('@actions/core'),
+ *  core: import('@actions/core'),
  *  dry: boolean,
  *  reviewKey?: string,
  * }} DismissReviewsProps
@@ -163,10 +165,10 @@ async function dismissReviews({ github, context, core, dry, reviewKey }) {
  * @param {{
  *  github: GitHub,
  *  context: Context,
- *  core: typeof import('@actions/core'),
+ *  core: import('@actions/core'),
  *  dry: boolean,
  *  body: string,
- *  event: keyof typeof eventToState,
+ *  event: keyof eventToState,
  *  reviewKey: string,
  * }} PostReviewProps
  */

ci/github-script/run

@@ -112,8 +112,8 @@ program
   .argument('<repo>', 'Name of the GitHub repository to run on (Example: nixpkgs)')
   .argument('<pr>', 'Number of the Pull Request to run on')
   .action(async (owner, repo, pr, options) => {
-    const checkTargetBranch = (await import('./check-target-branch.ts')).default
-    await run(checkTargetBranch, owner, repo, pr, options)
+    const checkCommitMessages = (await import('./check-target-branch.js')).default
+    await run(checkCommitMessages, owner, repo, pr, options)
   })
 
 program

ci/github-script/supportedSystems.js

@@ -1,4 +1,3 @@
-// @ts-nocheck
 module.exports = async ({ github, context, targetSha }) => {
   const { content, encoding } = (
     await github.rest.repos.getContent({

ci/github-script/tsconfig.json

@@ -1,26 +0,0 @@
-{
-  "compilerOptions": {
-    "lib": [
-      "es2024",
-      "ESNext.Array",
-      "ESNext.Collection",
-      "ESNext.Error",
-      "ESNext.Iterator",
-      "ESNext.Promise"
-    ],
-    "module": "nodenext",
-    "target": "es2024",
-
-    "strict": true,
-    "esModuleInterop": true,
-    "skipLibCheck": true,
-    "moduleResolution": "node16",
-
-    "allowImportingTsExtensions": true,
-    "allowJs": true,
-    "checkJs": true,
-    "erasableSyntaxOnly": true,
-    "verbatimModuleSyntax": true,
-    "noEmit": true,
-  }
-}

ci/github-script/withRateLimit.js

@@ -1,4 +1,3 @@
-// @ts-nocheck
 module.exports = async ({ github, core, maxConcurrent = 1 }, callback) => {
   const Bottleneck = require('bottleneck')
 

ci/supportedBranches.js

@@ -2,7 +2,6 @@
 /*
 #!nix-shell -i node -p nodejs
 */
-// @ts-nocheck
 
 const typeConfig = {
   master: ['development', 'primary'],

doc/README.md

@@ -14,12 +14,17 @@ Use **examples** first to show how to get something done. Keep **Explanation** l
 
 Use our [styleguide](./styleguide.md) for more in depth guidance on writing good documentation.
 
-Documentation about Nixpkgs belongs here, this includes 'getting-started'-guides and 'onboarding-guides' for *using* Nixpkgs and the language frameworks it ships.
+This directory contains **guides** and **reference** documentation for Nixpkgs.
 
-Write **guides** task-first: lead with a working example, then explain in prose.
-Write **reference** as the specification of functions and attributes.
+Borrowing from [Diátaxis framework](https://diataxis.fr/) what suits our needs:
 
-We are actively working to generate reference documentation from the [doc-comments](https://github.com/NixOS/rfcs/blob/master/rfcs/0145-doc-strings.md) present in code, which also lets you view it locally with `:doc` in `nix repl`.
+**Guides** are task-oriented. They can be tutorial-style walkthroughs or how-to sections.
+Explanations appear as prose after examples.
+
+**Reference** documentation is the specification of functions and attributes.
+
+We are actively working to generate **all** reference documentation from the [doc-comments](https://github.com/NixOS/rfcs/blob/master/rfcs/0145-doc-strings.md) present in code.
+This also provides the benefit of using `:doc` in the `nix repl` to view reference documentation locally on the fly.
 
 See [Document structure](#document-structure) for a structural template.
 

doc/build-helpers/fetchers.chapter.md

@@ -988,20 +988,6 @@ fetchRadiclePatch {
 }
 ```
 
-## `fetchFromTangled` {#fetchfromtangled}
-
-This is to be used with tangled repositories. `fetchFromTangled` works with
-very similar arguments to `fetchFromGithub`. However, instead of a `owner` and
-`repo`, a `did` argument is expected.
-
-```nix
-fetchFromTangled {
-  did = "did:plc:jj6ajj6duxnlthwtnob4qyuv"; # tranquil.farm/tranquil-pds
-  tag = "v6.6.0";
-  hash = "sha256-cfTsjmK/IMqT5kMKOGpwwWbBlvtrCDOerUJJ8AVI3kY=";
-}
-```
-
 ## `requireFile` {#requirefile}
 
 `requireFile` allows requesting files that cannot be fetched automatically, but whose content is known.

doc/build-helpers/images/portableservice.section.md

@@ -68,7 +68,7 @@ See [](#ex-portableService-hello) to understand how to use the output of `portab
 
 : Allows you to override the package that provides {manpage}`mksquashfs(1)`, which is used internally by `portableService`.
 
-  _Default value:_ `pkgs.squashfs-tools`.
+  _Default value:_ `pkgs.squashfsTools`.
 
 `squash-compression` (String; _optional_)
 

doc/getting-started/dev-environments.md

@@ -1,49 +0,0 @@
-# Dev environments {#dev-environments}
-
-Create a `shell.nix` with the following:
-
-```nix
-# shell.nix
-let
-  nixpkgs = fetchTarball "https://github.com/NixOS/nixpkgs/archive/nixos-unstable.tar.gz";
-  pkgs = import nixpkgs { };
-in
-pkgs.mkShell {
-  packages = [ pkgs.python3 ];
-  shellHook = ''
-    echo "Welcome in my nix shell"
-  '';
-}
-```
-
-run
-
-```sh
-nix-shell
-```
-
-This activates your `shell.nix` and you should see:
-
-```sh
-unpacking 'https://github.com/NixOS/nixpkgs/archive/nixos-unstable.tar.gz' into the Git cache...
-Welcome in your nix shell
-```
-
-python3 is available
-
-```sh
-$ python3 --version
-```
-
-To leave the shell
-
-```bash
-ctrl+D
-```
-
-:::{.note}
-You should use [pinned nixpkgs](https://nix.dev/guides/recipes/dependency-management.html).
-The example used `unstable` here for demonstration purposes only
-:::
-
-For further information check out [nix-shell](https://nix.dev/manual/nix/stable/command-ref/nix-shell)

doc/getting-started/getting-started.part.md

@@ -1,6 +0,0 @@
-# Getting started {#getting-started}
-
-```{=include=} chapters
-first-package.chapter.md
-dev-environments.md
-```

doc/hooks/ghc.section.md

@@ -0,0 +1,3 @@
+# GHC {#ghc}
+
+Creates a temporary package database and registers every Haskell build input in it (TODO: how?).

doc/hooks/index.md

@@ -17,6 +17,7 @@ check-phase-thread-limit-hook.section.md
 cmake.section.md
 desktop-file-utils.section.md
 gdk-pixbuf.section.md
+ghc.section.md
 gnome.section.md
 haredo.section.md
 installShellFiles.section.md

doc/languages-frameworks/android.section.md

@@ -116,7 +116,7 @@ options:
 For each requested system image we can specify the following options:
 
 * `systemImageTypes` specifies what kind of system images should be included.
-  Defaults to: `google_apis`, `google_apis_playstore`, `google_apis_ps16k` and `google_apis_playstore_ps16k`.
+  Defaults to: `default`.
 * `abiVersions` specifies what kind of ABI version of each system image should
   be included. Defaults to `armeabi-v7a` and `arm64-v8a`.
 

doc/languages-frameworks/beam.section.md

@@ -34,21 +34,17 @@ Inside each package set are:
 - builders: mixRelease, buildRebar3, etc
 - hooks: for composing builders and packages
 
-The package set is the only place Erlang and Elixir versions are chosen. Builders such as `mixRelease`, `fetchMixDeps` and `buildMix` take them from the set they are called from, and do not accept `erlang`, `elixir` or `hex` arguments.
-
-To use a non-default Elixir, derive a new set with `overrideScope`. This keeps the rest of the set consistent, so every builder picks up the overridden Elixir:
+To use a non-default Elixir it's important to keep the rest of the package set consistent, so it's recommended to use `.extend`. This ensures that builders like `mixRelease`, `fetchMixDeps`, and `buildMix` all pick up the overridden Elixir:
 
 ```nix
 let
-  beamPackages = beam27Packages.overrideScope (final: prev: { elixir = final.elixir_1_18; });
+  beamPackages = beam27Packages.extend (self: super: { elixir = self.elixir_1_18; });
 in
 beamPackages.mixRelease {
   # ...
 }
 ```
 
-`erlang` can be replaced the same way, which is useful for a patched OTP. Every member of the set is built from the set's own `erlang`, so overriding it rebuilds Elixir, Rebar3 and the rest against it.
-
 ## Build Tools {#beam-build-tools}
 
 ### Rebar3 {#beam-build-tools-rebar3}
@@ -210,7 +206,7 @@ Here is how your `default.nix` file would look for a Phoenix project.
   # beam27Packages or beam29Packages is available if you need a particular version
   beamPackages,
 }:
-beamPackages.mixRelease (finalAttrs: {
+let
   pname = "your_project";
   version = "0.0.1";
 
@@ -219,6 +215,24 @@ beamPackages.mixRelease (finalAttrs: {
     rev = "replace_with_your_commit";
   };
 
+  # if using mix2nix you can use the mixNixDeps attribute
+  mixFodDeps = beamPackages.fetchMixDeps {
+    pname = "mix-deps-${pname}";
+    inherit src version;
+    # nix will complain and tell you the right value to replace this with
+    hash = lib.fakeHash;
+    mixEnv = ""; # default is "prod", when empty includes all dependencies, such as "dev", "test".
+    # if you have build time environment variables add them here
+    MY_ENV_VAR = "my_value";
+  };
+in
+beamPackages.mixRelease {
+  inherit
+    src
+    pname
+    version
+    mixFodDeps
+    ;
   # if you have build time environment variables add them here
   MY_ENV_VAR = "my_value";
 
@@ -228,18 +242,7 @@ beamPackages.mixRelease (finalAttrs: {
     mix do deps.loadpaths --no-deps-check, phx.digest
     mix phx.digest --no-deps-check
   '';
-
-  # if using mix2nix you can use the mixNixDeps attribute
-  mixFodDeps = beamPackages.fetchMixDeps {
-    pname = "mix-deps-${finalAttrs.pname}";
-    inherit (finalAttrs) src version;
-    # nix will complain and tell you the right value to replace this with
-    hash = lib.fakeHash;
-    mixEnv = ""; # default is "prod", when empty includes all dependencies, such as "dev", "test".
-    # if you have build time environment variables add them here
-    MY_ENV_VAR = "my_value";
-  };
-})
+}
 ```
 
 Setup will require the following steps:
@@ -336,8 +339,8 @@ Usually, we need to create a `shell.nix` file and do our development inside the
 
 with pkgs;
 let
-  # pin OTP via beam27Packages/beam28Packages/... and Elixir via overrideScope
-  beamPackages = beam27Packages.overrideScope (final: prev: { elixir = final.elixir_1_18; });
+  # pin OTP via beam27Packages/beam28Packages/... and Elixir via .extend
+  beamPackages = beam27Packages.extend (self: super: { elixir = self.elixir_1_18; });
 in
 mkShell { buildInputs = [ beamPackages.elixir ]; }
 ```
@@ -372,8 +375,8 @@ Here is an example `shell.nix`.
 with import <nixpkgs> { };
 
 let
-  # pin OTP via beam27Packages/beam28Packages/... and Elixir via overrideScope
-  beamPackages = beam27Packages.overrideScope (final: prev: { elixir = final.elixir_1_18; });
+  # pin OTP via beam27Packages/beam28Packages/... and Elixir via .extend
+  beamPackages = beam27Packages.extend (self: super: { elixir = self.elixir_1_18; });
 
   # define packages to install
   basePackages = [

doc/languages-frameworks/javascript.section.md

@@ -1,30 +1,49 @@
-# JavaScript {#language-javascript}
+# Javascript {#language-javascript}
 
 ## Introduction {#javascript-introduction}
 
-Package JavaScript applications with the tools below.
+This contains instructions on how to package JavaScript applications.
+
+The various tools available will be listed in the [tools-overview](#javascript-tools-overview).
+Some general principles for packaging will follow.
+Finally, some tool-specific instructions will be given.
+
+## Getting unstuck / finding code examples {#javascript-finding-examples}
+
+If you find you are lacking inspiration for packaging JavaScript applications, the links below might prove useful.
+Searching online for prior art can be helpful if you are running into solved problems.
+
+### Github {#javascript-finding-examples-github}
+
+- Searching Nix files for `yarnConfigHook`: <https://github.com/search?q=yarnConfigHook+language%3ANix&type=code>
+- Searching just `flake.nix` files for `yarnConfigHook`: <https://github.com/search?q=yarnConfigHook+path%3A**%2Fflake.nix&type=code>
+
+### Gitlab {#javascript-finding-examples-gitlab}
+
+- Searching Nix files for `yarnConfigHook`: <https://gitlab.com/search?scope=blobs&search=yarnConfigHook+extension%3Anix>
+- Searching just `flake.nix` files for `yarnConfigHook`: <https://gitlab.com/search?scope=blobs&search=yarnConfigHook+filename%3Aflake.nix>
 
 ## Tools overview {#javascript-tools-overview}
 
 ## General principles {#javascript-general-principles}
 
-The principles below are ordered by importance.
+The following principles are given in order of importance with potential exceptions.
 
-### Use the project's Node.js version {#javascript-upstream-node-version}
+### Try to use the same node version used upstream {#javascript-upstream-node-version}
 
-It is often not documented which Node.js version the project uses, but if it is, use the same version when packaging.
+It is often not documented which node version is used upstream, but if it is, try to use the same version when packaging.
 
-This can be a problem if the project uses the latest and greatest and you are trying to use an earlier version of Node.js.
+This can be a problem if upstream is using the latest and greatest and you are trying to use an earlier version of node.
 Some cryptic errors regarding V8 may appear.
 
-### Use the project's package manager and lock file {#javascript-upstream-package-manager}
+### Try to respect the package manager originally used by upstream (and use the upstream lock file) {#javascript-upstream-package-manager}
 
 A lock file (package-lock.json, yarn.lock...) is supposed to make reproducible installations of `node_modules` for each tool.
 
-Package manager guidelines recommend committing those lock files to the repository.
-If a particular lock file is present, it is a strong indication of which package manager the project uses.
+Guidelines of package managers, recommend to commit those lock files to the repos.
+If a particular lock file is present, it is a strong indication of which package manager is used upstream.
 
-Use a Nix tool that understands the lock file.
+It's better to try to use a Nix tool that understands the lock file.
 Using a different tool might give you a hard-to-understand error because different packages have been installed.
 
 Using a different tool forces you to commit a lock file to the repository.
@@ -32,16 +51,16 @@ These files are fairly large, so when packaging for nixpkgs, this approach does
 
 Exceptions to this rule are:
 
-- When you encounter one of the bugs from a Nix tool. In each of the tool-specific instructions, known problems are detailed. If a tool has a problem, try another. You may have to re-create a lock file and commit it to Nixpkgs.
-- Some lock files contain a particular version of a package that has been pulled off npm for some reason. In that case, you can recreate the lock file (by removing the original and running `npm install`, `yarn`, etc.) and commit this to Nixpkgs.
+- When you encounter one of the bugs from a Nix tool. In each of the tool-specific instructions, known problems will be detailed. If you have a problem with a particular tool, then it's best to try another tool, even if this means you will have to re-create a lock file and commit it to Nixpkgs.
+- Some lock files contain particular version of a package that has been pulled off npm for some reason. In that case, you can recreate upstream lock (by removing the original and `npm install`, `yarn`, ...) and commit this to nixpkgs.
 
-### Use the project's `package.json` {#javascript-upstream-package-json}
+### Try to use upstream package.json {#javascript-upstream-package-json}
 
 Exceptions to this rule are:
 
-- Sometimes the project assumes some dependencies are installed globally. Add them to the `package.json` manually (`yarn add xxx` or `npm install xxx`). Run locally installed CLI tools with `npx`, for example `npx postcss`. That is how you call them in the phases.
+- Sometimes the upstream repo assumes some dependencies should be installed globally. In that case, you can add them manually to the upstream `package.json` (`yarn add xxx` or `npm install xxx`, ...). Dependencies that are installed locally can be executed with `npx` for CLI tools (e.g. `npx postcss ...`, this is how you can call those dependencies in the phases).
 - Sometimes there is a version conflict between some dependency requirements. In that case you can fix a version by removing the `^`.
-- Sometimes a script in `package.json` does not work as is. It might call a CLI tool that is not available, or `cd` into a directory with a different `package.json`, which is common with workspaces. Read what the script does. Reproduce it in the build phases. For example, a `build` script may call `build:ui` and `build:server` in turn. If one fails, split them into separate steps.
+- Sometimes the script defined in the package.json does not work as is. Some scripts for example use CLI tools that might not be available, or cd in directory with a different package.json (for workspaces notably). In that case, it's perfectly fine to look at what the particular script is doing and break this down in the phases. In the build script you can see `build:*` calling in turns several other build scripts like `build:ui` or `build:server`. If one of those fails, you can try to separate those into,
 
   ```sh
   yarn build:ui
@@ -51,7 +70,7 @@ Exceptions to this rule are:
   npm run build:server
   ```
 
-  When you need to override `package.json`, it is best to use the one from the project and make explicit overrides. Here is an example:
+  when you need to override a package.json. It's nice to use the one from the upstream source and do some explicit override. Here is an example:
 
   ```nix
   {
@@ -63,22 +82,22 @@ Exceptions to this rule are:
   }
   ```
 
-  You still need to commit the modified version of the lock files, but at least the overrides are explicit for everyone to see.
+  You will still need to commit the modified version of the lock files, but at least the overrides are explicit for everyone to see.
 
-### Use `node_modules` directly {#javascript-using-node_modules}
+### Using node_modules directly {#javascript-using-node_modules}
 
-Each tool has an abstraction to build the node_modules (dependencies) directory.
+Each tool has an abstraction to just build the node_modules (dependencies) directory.
 You can always use the `stdenv.mkDerivation` with the node_modules to build the package (symlink the node_modules directory and then use the package build command).
-The `node_modules` abstraction can also be used to build some web framework frontends.
-For an example of this, see how [plausible](https://github.com/NixOS/nixpkgs/blob/master/pkgs/by-name/pl/plausible/package.nix) is built.
-Then, when building the frontend, you can symlink the `node_modules` directory.
+The node_modules abstraction can be also used to build some web framework frontends.
+For an example of this see how [plausible](https://github.com/NixOS/nixpkgs/blob/master/pkgs/by-name/pl/plausible/package.nix) is built.
+Then when building the frontend you can just symlink the node_modules directory.
 
 ## Tool-specific instructions {#javascript-tool-specific}
 
 ### buildNpmPackage {#javascript-buildNpmPackage}
 
-`buildNpmPackage` packages npm-based projects in Nixpkgs without the use of an auto-generated dependencies file.
-It uses npm's cache. It builds a reproducible cache of the project's dependencies and points npm at it.
+`buildNpmPackage` allows you to package npm-based projects in Nixpkgs without the use of an auto-generated dependencies file.
+It works by utilizing npm's cache functionality -- creating a reproducible cache that contains the dependencies of a project, and pointing npm to it.
 
 Here's an example:
 
@@ -116,9 +135,9 @@ buildNpmPackage (finalAttrs: {
 })
 ```
 
-In the default `installPhase` set by `buildNpmPackage`, it uses `npm pack --json --dry-run` to decide what files to install. They go in `$out/lib/node_modules/$name/`, where `$name` is the `name` string in the package's `package.json`.
+In the default `installPhase` set by `buildNpmPackage`, it uses `npm pack --json --dry-run` to decide what files to install in `$out/lib/node_modules/$name/`, where `$name` is the `name` string defined in the package's `package.json`.
 Additionally, the `bin` and `man` keys in the source's `package.json` are used to decide what binaries and manpages are supposed to be installed.
-If these are not defined, `npm pack` may miss some files, and no binaries are produced.
+If these are not defined, `npm pack` may miss some files, and no binaries will be produced.
 
 #### Arguments {#javascript-buildNpmPackage-arguments}
 
@@ -153,8 +172,8 @@ sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
 
 `fetchNpmDeps` is a Nix function that requires the following mandatory arguments:
 
-- `src`: A directory or tarball with a `package-lock.json` file
-- `hash`: The output hash of the dependencies defined in `package-lock.json`.
+- `src`: A directory / tarball with `package-lock.json` file
+- `hash`: The output hash of the node dependencies defined in `package-lock.json`.
 
 It returns a derivation with all `package-lock.json` dependencies downloaded into `$out/`, usable as an npm cache.
 
@@ -168,7 +187,7 @@ There is no need to specify a `hash`, since it relies entirely on the integrity
 
 ##### Inputs {#javascript-buildNpmPackage-inputs}
 
-- `npmRoot`: Path to the package directory containing the source tree.
+- `npmRoot`: Path to package directory containing the source tree.
   If this is omitted, the `package` and `packageLock` arguments must be specified instead.
 - `package`: Parsed contents of `package.json`
 - `packageLock`: Parsed contents of `package-lock.json`
@@ -176,7 +195,7 @@ There is no need to specify a `hash`, since it relies entirely on the integrity
 - `version`: Package version
 - `fetcherOpts`: An attribute set of arguments forwarded to the underlying fetcher.
 
-It returns a derivation with a patched `package.json` and `package-lock.json` with all dependencies resolved to Nix store paths.
+It returns a derivation with a patched `package.json` & `package-lock.json` with all dependencies resolved to Nix store paths.
 
 :::{.note}
 `npmHooks.npmConfigHook` cannot be used with `importNpmLock`.
@@ -238,18 +257,18 @@ buildNpmPackage {
 
 `importNpmLock.buildNodeModules` returns a derivation with a pre-built `node_modules` directory, as imported by `importNpmLock`.
 
-This is to be used together with `importNpmLock.hooks.linkNodeModulesHook` to support `nix-shell`/`nix develop` development workflows.
+This is to be used together with `importNpmLock.hooks.linkNodeModulesHook` to facilitate `nix-shell`/`nix develop` based development workflows.
 
 It accepts an argument with the following attributes:
 
 `npmRoot` (Path; optional)
-: Path to the package directory containing the source tree. If not specified, the `package` and `packageLock` arguments must both be specified.
+: Path to package directory containing the source tree. If not specified, the `package` and `packageLock` arguments must both be specified.
 
 `package` (Attrset; optional)
 : Parsed contents of `package.json`, as returned by `lib.importJSON ./my-package.json`. If not specified, the `package.json` in `npmRoot` is used.
 
 `packageLock` (Attrset; optional)
-: Parsed contents of `package-lock.json`, as returned by `lib.importJSON ./my-package-lock.json`. If not specified, the `package-lock.json` in `npmRoot` is used.
+: Parsed contents of `package-lock.json`, as returned `lib.importJSON ./my-package-lock.json`. If not specified, the `package-lock.json` in `npmRoot` is used.
 
 `derivationArgs` (`mkDerivation` attrset; optional)
 : Arguments passed to `stdenv.mkDerivation`
@@ -269,26 +288,26 @@ pkgs.mkShell {
   };
 }
 ```
-creates a development shell where a `node_modules` directory is created and packages are symlinked to the Nix store when activated.
+will create a development shell where a `node_modules` directory is created & packages symlinked to the Nix store when activated.
 
 :::{.note}
-Commands like `npm install` and `npm add` that write packages and executables need to be used with `--package-lock-only`.
+Commands like `npm install` & `npm add` that write packages & executables need to be used with `--package-lock-only`.
 
-This means `npm` installs dependencies by writing into `package-lock.json` without modifying the `node_modules` folder. It installs by reloading the devShell.
-This gives the `nix shell` near-exclusive ownership over your `node_modules` folder.
+This means `npm` installs dependencies by writing into `package-lock.json` without modifying the `node_modules` folder. Installation happens through reloading the devShell.
+This might be best practice since it gives the `nix shell` virtually exclusive ownership over your `node_modules` folder.
 
-Set `package-lock-only = true` in your project-local [`.npmrc`](https://docs.npmjs.com/cli/v11/configuring-npm/npmrc).
+It's recommended to set `package-lock-only = true` in your project-local [`.npmrc`](https://docs.npmjs.com/cli/v11/configuring-npm/npmrc).
 :::
 
 ### corepack {#javascript-corepack}
 
-This package puts the corepack wrappers for pnpm and yarn in your PATH, and they honor the `packageManager` setting in the `package.json`.
+This package puts the corepack wrappers for pnpm and yarn in your PATH, and they will honor the `packageManager` setting in the `package.json`.
 
 ### pnpm {#javascript-pnpm}
 
 pnpm is available as the top-level package `pnpm`. Additionally, there are variants pinned to certain major versions, like `pnpm_9`, `pnpm_10`, `pnpm_10_29_2` and `pnpm_11`, which support different sets of lock file versions.
 
-When packaging an application that includes a `pnpm-lock.yaml`, you need to fetch the pnpm store for that project using a fixed-output-derivation. The function `fetchPnpmDeps` can create this pnpm store derivation. In conjunction, the setup hook `pnpmConfigHook` prepares the build environment to install the pre-fetched dependencies store. The example below uses the fetcher and setup hook for a package that has `package.json` and `pnpm-lock.yaml`:
+When packaging an application that includes a `pnpm-lock.yaml`, you need to fetch the pnpm store for that project using a fixed-output-derivation. The function `fetchPnpmDeps` can create this pnpm store derivation. In conjunction, the setup hook `pnpmConfigHook` will prepare the build environment to install the pre-fetched dependencies store. Here is an example for a package that contains `package.json` and a `pnpm-lock.yaml` files using the fetcher and setup hook above:
 
 There is also the [`pnpmBuildHook`](#pnpm-build-hook) for building packages with `pnpm`, as seen in [](#ex-pnpm-build-hook).
 
@@ -331,7 +350,7 @@ stdenv.mkDerivation (finalAttrs: {
 })
 ```
 
-Use a pinned version of pnpm (for example `pnpm_9` or `pnpm_10`) to increase reproducibility. An older version may be required if the package needs a certain lock file version. To do so, pass the `pnpm` argument to `fetchPnpmDeps`. Then override the `pnpm` arg in `pnpmConfigHook`. Here are the changes in the example above to use a pinned pnpm version:
+It is highly recommended to use a pinned version of pnpm (i.e., `pnpm_9` or `pnpm_10`), to increase future reproducibility. It might also be required to use an older version if the package needs support for a certain lock file version. To do so, you can pass the `pnpm` argument to `fetchPnpmDeps` and override the `pnpm` arg in `pnpmConfigHook`. Here are the changes in the example above to use a pinned pnpm version:
 
 <!-- TODO: Does splicing still work when overriding in nativeBuildInputs here? -->
 
@@ -373,7 +392,7 @@ Use a pinned version of pnpm (for example `pnpm_9` or `pnpm_10`) to increase rep
  })
 ```
 
-In case you are patching `package.json` or `pnpm-lock.yaml`, make sure to pass `finalAttrs.patches` to the function as well (i.e., `inherit (finalAttrs) patches`).
+In case you are patching `package.json` or `pnpm-lock.yaml`, make sure to pass `finalAttrs.patches` to the function as well (i.e., `inherit (finalAttrs) patches`.
 
 `pnpmConfigHook` supports adding additional `pnpm install` flags via `pnpmInstallFlags` which can be set to a Nix string array:
 
@@ -389,14 +408,14 @@ In case you are patching `package.json` or `pnpm-lock.yaml`, make sure to pass `
 }
 ```
 
-If needed, set `dontPnpmConfigure = true;` to fully disable `pnpmConfigHook` without removing it from inputs manually.
+If needed, `dontPnpmConfigure = true;` can be used to fully disable `pnpmConfigHook` without manually removing it from inputs.
 
 #### Dealing with `sourceRoot` {#javascript-pnpm-sourceRoot}
 
-If the pnpm project is in a subdirectory, you can define `sourceRoot` or `setSourceRoot` for `fetchPnpmDeps`.
-If `sourceRoot` is different between the parent derivation and `fetchPnpmDeps`, you have to set `pnpmRoot` to effectively be the same location as it is in `fetchPnpmDeps`.
+If the pnpm project is in a subdirectory, you can just define `sourceRoot` or `setSourceRoot` for `fetchPnpmDeps`.
+If `sourceRoot` is different between the parent derivation and `fetchPnpmDeps`, you will have to set `pnpmRoot` to effectively be the same location as it is in `fetchPnpmDeps`.
 
-Assuming the directory structure below, you can define `sourceRoot` and `pnpmRoot`:
+Assuming the following directory structure, we can define `sourceRoot` and `pnpmRoot` as follows:
 
 ```
 .
@@ -420,9 +439,10 @@ Assuming the directory structure below, you can define `sourceRoot` and `pnpmRoo
 }
 ```
 
-#### pnpm workspaces {#javascript-pnpm-workspaces}
+#### PNPM Workspaces {#javascript-pnpm-workspaces}
 
-For a pnpm workspace, set `pnpmWorkspaces = [ "<workspace project name 1>" "<workspace project name 2>" ]` in your `fetchPnpmDeps` call. pnpm then installs only the dependencies for those workspace packages.
+If you need to use a PNPM workspace for your project, then set `pnpmWorkspaces = [ "<workspace project name 1>" "<workspace project name 2>" ]`, etc, in your `fetchPnpmDeps` call,
+which will make PNPM only install dependencies for those workspace packages.
 
 For example:
 
@@ -438,9 +458,9 @@ For example:
 ```
 
 The above would make `fetchPnpmDeps` call only install dependencies for the `@astrojs/language-server` workspace package.
-You do not need to set `sourceRoot` to make this work.
+Note that you do not need to set `sourceRoot` to make this work.
 
-For these projects, build with `pnpm --filter=<pnpm workspace name> build`, because `npmHooks.npmBuildHook` may not work. The example below fits most workspace projects:
+Usually, in such cases, you'd want to use `pnpm --filter=<pnpm workspace name> build` to build your project, as `npmHooks.npmBuildHook` probably won't work. A `buildPhase` based on the following example will probably fit most workspace projects:
 
 ```nix
 {
@@ -454,9 +474,9 @@ For these projects, build with `pnpm --filter=<pnpm workspace name> build`, beca
 }
 ```
 
-#### Additional pnpm commands and settings {#javascript-pnpm-extraCommands}
+#### Additional PNPM Commands and settings {#javascript-pnpm-extraCommands}
 
-If you require setting an additional pnpm configuration setting (such as `dedupe-peer-dependents` or similar),
+If you require setting an additional PNPM configuration setting (such as `dedupe-peer-dependents` or similar),
 set `prePnpmInstall` to the right commands to run. For example:
 
 ```nix
@@ -471,11 +491,11 @@ set `prePnpmInstall` to the right commands to run. For example:
 }
 ```
 
-In this example, `prePnpmInstall` runs in both `pnpmConfigHook` and the `fetchPnpmDeps` builder.
+In this example, `prePnpmInstall` will be run by both `pnpmConfigHook` and by the `fetchPnpmDeps` builder.
 
 #### pnpm `fetcherVersion` {#javascript-pnpm-fetcherVersion}
 
-This is the version of the output of `fetchPnpmDeps`. Use `4` for new packages:
+This is the version of the output of `fetchPnpmDeps`. New packages should use `4`:
 
 ```nix
 {
@@ -491,7 +511,7 @@ This is the version of the output of `fetchPnpmDeps`. Use `4` for new packages:
 When upgrading to a newer `fetcherVersion`, you need to regenerate the hash.
 
 This variable ensures that we can make changes to the output of `fetchPnpmDeps` without breaking existing hashes.
-Changes can include workarounds or bug fixes to existing pnpm issues.
+Changes can include workarounds or bug fixes to existing PNPM issues.
 
 ##### Version history {#javascript-pnpm-fetcherVersion-versionHistory}
 
@@ -504,9 +524,9 @@ Version 3 is the minimum supported value. Versions 1 and 2 were removed in the 2
 
 ### Yarn {#javascript-yarn}
 
-Yarn-based projects use a `yarn.lock` file instead of a `package-lock.json` to pin dependencies.
+Yarn based projects use a `yarn.lock` file instead of a `package-lock.json` to pin dependencies.
 
-To package Yarn-based applications, you need to distinguish by the version pointers in the `yarn.lock` file. See the following sections.
+To package yarn-based applications, you need to distinguish by the version pointers in the `yarn.lock` file. See the following sections.
 
 #### Yarn v1 {#javascript-yarn-v1}
 
@@ -575,12 +595,12 @@ This script by default runs `yarn --offline build`, and it relies upon the proje
 
 ##### `yarnInstallHook` arguments {#javascript-yarninstallhook}
 
-To install the package, `yarnInstallHook` uses both `npm` and `yarn` to clean up project files and dependencies. To disable this phase, you can set `dontYarnInstall = true` or override the `installPhase`. Below is a list of additional `mkDerivation` arguments read by this hook:
+To install the package `yarnInstallHook` uses both `npm` and `yarn` to cleanup project files and dependencies. To disable this phase, you can set `dontYarnInstall = true` or override the `installPhase`. Below is a list of additional `mkDerivation` arguments read by this hook:
 
 - `yarnKeepDevDeps`: Disables the removal of devDependencies from `node_modules` before installation.
 
 #### Yarn Berry v3/v4 {#javascript-yarn-v3-v4}
-Yarn Berry (v3 / v4) versions have similar formats. They start with blocks like these:
+Yarn Berry (v3 / v4) have similar formats, they start with blocks like these:
 
 ```yaml
 __metadata:
@@ -600,7 +620,7 @@ For these packages, we have some helpers exposed under the respective `yarn-berr
 - `fetchYarnBerryDeps`
 - `yarnBerryConfigHook`
 
-Explicitly pin the major version. For example, capture the `yarn-berry_Xn` argument and re-define it as a `yarn-berry` `let` binding.
+It's recommended to ensure you're explicitly pinning the major version used, for example by capturing the `yarn-berry_Xn` argument and then re-defining it as a `yarn-berry` `let` binding.
 
 ```nix
 {
@@ -636,26 +656,26 @@ stdenv.mkDerivation (finalAttrs: {
 ##### `yarn-berry_X.fetchYarnBerryDeps` {#javascript-fetchYarnBerryDeps}
 `fetchYarnBerryDeps` runs `yarn-berry-fetcher fetch` in a fixed-output-derivation. It is a custom fetcher designed to reproducibly download all files in the `yarn.lock` file, validating their hashes in the process. For git dependencies, it creates a checkout at `${offlineCache}/checkouts/<40-character-commit-hash>` (relying on the git commit hash to describe the contents of the checkout).
 
-To produce the `hash` argument for the `fetchYarnBerryDeps` call, run `yarn-berry-fetcher prefetch`:
+To produce the `hash` argument for `fetchYarnBerryDeps` function call, the `yarn-berry-fetcher prefetch` command can be used:
 
 ```console
 $ yarn-berry-fetcher prefetch </path/to/yarn.lock> [/path/to/missing-hashes.json]
 ```
 
-This prints the hash to stdout. Use it in update scripts to recalculate the hash for a new `yarn.lock`.
+This prints the hash to stdout and can be used in update scripts to recalculate the hash for a new version of `yarn.lock`.
 
 ##### `yarn-berry_X.yarnBerryConfigHook` {#javascript-yarnBerryConfigHook}
 `yarnBerryConfigHook` uses the store path `offlineCache` points to, to run a `yarn install` during the build, producing a usable `node_modules` directory from the downloaded dependencies.
 
 Internally, this uses a patched version of Yarn to ensure git dependencies are re-packed and any attempted downloads fail immediately.
 
-##### Patching the project's `package.json` or `yarn.lock` files {#javascript-yarnBerry-patching}
-In case patching the project's `package.json` or `yarn.lock` is needed, it's important to pass `finalAttrs.patches` to `fetchYarnBerryDeps` as well, so the patched variants are picked up (i.e., `inherit (finalAttrs) patches`).
+##### Patching upstream `package.json` or `yarn.lock` files {#javascript-yarnBerry-patching}
+In case patching the upstream `package.json` or `yarn.lock` is needed, it's important to pass `finalAttrs.patches` to `fetchYarnBerryDeps` as well, so the patched variants are picked up (i.e., `inherit (finalAttrs) patches`.
 
 ##### Missing hashes in the `yarn.lock` file {#javascript-yarnBerry-missing-hashes}
 Unfortunately, `yarn.lock` files do not include hashes for optional/platform-specific dependencies. This is [by design](https://github.com/yarnpkg/berry/issues/6759).
 
-To compensate for this, run the `yarn-berry-fetcher missing-hashes` subcommand to produce all missing hashes. These are stored in a `missing-hashes.json` file, which needs to be passed to both the build itself, as well as the `fetchYarnBerryDeps` helper:
+To compensate for this, the `yarn-berry-fetcher missing-hashes` subcommand can be used to produce all missing hashes. These are usually stored in a `missing-hashes.json` file, which needs to be passed to both the build itself, as well as the `fetchYarnBerryDeps` helper:
 
 ```nix
 {
@@ -698,7 +718,7 @@ If you are packaging something outside Nixpkgs, consider the following:
 
 ### npmlock2nix {#javascript-npmlock2nix}
 
-[npmlock2nix](https://github.com/nix-community/npmlock2nix) aims at building `node_modules` without code generation. It hasn't reached v1 yet; the API may change.
+[npmlock2nix](https://github.com/nix-community/npmlock2nix) aims at building `node_modules` without code generation. It hasn't reached v1 yet, the API might be subject to change.
 
 #### Pitfalls {#javascript-npmlock2nix-pitfalls}
 
@@ -706,7 +726,7 @@ There are some [problems with npm v7](https://github.com/tweag/npmlock2nix/issue
 
 ### nix-npm-buildpackage {#javascript-nix-npm-buildpackage}
 
-[nix-npm-buildpackage](https://github.com/serokell/nix-npm-buildpackage) aims at building `node_modules` without code generation. It hasn't reached v1 yet; the API may change. It supports both `package-lock.json` and yarn.lock.
+[nix-npm-buildpackage](https://github.com/serokell/nix-npm-buildpackage) aims at building `node_modules` without code generation. It hasn't reached v1 yet, the API might change. It supports both `package-lock.json` and yarn.lock.
 
 #### Pitfalls {#javascript-nix-npm-buildpackage-pitfalls}
 

doc/languages-frameworks/ocaml.section.md

@@ -59,9 +59,6 @@ Here is a simple package example.
 - The library will be installed using the `angstrom.install` file that dune
   generates.
 
-- It also accepts an optional `dunePackages` argument, if there is more than one
-  dune package that needs to be built (see `zipperposition`)
-
 ```nix
 {
   lib,

doc/languages-frameworks/rocq.section.md

@@ -3,12 +3,11 @@
 Note that "The Rocq Prover" (Rocq for short) is the new name of the
 proof assistant formerly known as Coq. The `coq` and `coqPackages`
 derivations currently remain for both older versions of Coq, but also
-as compatibility aliases for some versions of Rocq. In both cases, the
-`coq` and `rocq-core` attributes exist. In the case of Coq (< 9),
-`rocq-core` is just an alias for `coq`, while in the case of Rocq (>= 9),
-`rocq-core` is the main Rocq derivation, while `coq` provides
-compatibility binaries (`coqc`, `coqtop`, etc.) for packages that still
-depend on them.
+some versions of Rocq during the renaming transition. In the latter
+case, the `coq` derivation encompasses the compatibility binaries
+(`coqtop`, `coqc`, etc.) in addition to the `rocq` binary. The packages
+only in `coqPackages` are the ones which currently still depend on these
+compatibility binaries.
 
 ## Rocq derivation: `rocq-core` {#rocq-derivation-rocq}
 
@@ -18,18 +17,18 @@ The Rocq derivation is overridable through the `rocq-core.override overrides`, w
 * `customOCamlPackages` (optional, defaults to `null`, which lets Rocq choose a version automatically), which can be set to any of the ocaml packages attribute of `ocaml-ng` (such as `ocaml-ng.ocamlPackages_4_14` which is the default for Rocq 9.1 for example).
 * `rocq-version` (optional, defaults to the short version e.g. "9.1"), is a version number of the form "x.y" that indicates which Rocq's version build behavior to mimic when using a source which is not a release. E.g. `rocq-core.override { version = "40be8435e132aab2231a79091f011ebc3e64a753"; rocq-version = "9.1"; }`.
 
-## Creating custom Coq environments with `rocq-core.withPackages` {#coq-withPackages}
+## Creating custom Coq environments with `coq.withPackages` {#coq-withPackages}
 
-The `rocq-core.withPackages` function provides a convenient way to create a Rocq environment that includes additional Rocq packages. This is similar to how `python.withPackages` works for Python environments.
+The `coq.withPackages` function provides a convenient way to create a Coq environment that includes additional Coq packages. This is similar to how `python.withPackages` works for Python environments.
 
-The function takes a function that receives the Rocq package set and returns a list of packages. It returns a wrapped Rocq environment where the Rocq binaries (`rocq`, etc.) are configured with the appropriate environment variables to find the packages.
+The function takes a function that receives the Coq package set and returns a list of packages. It returns a wrapped Coq environment where all Coq binaries (`coqtop`, `coqc`, `coqdep`, `coqchk`, `coqide`, etc.) are configured with the appropriate environment variables to find the packages.
 
 ### Usage {#coq-withPackages-usage}
 
-Here is an example of creating a Rocq environment with specific packages.
+Here is an example of creating a Coq environment with specific packages.
 
 ```nix
-rocq-core.withPackages (
+coq.withPackages (
   ps: with ps; [
     mathcomp
     bignums
@@ -37,9 +36,7 @@ rocq-core.withPackages (
 )
 ```
 
-If you install the `vsrocq-language-server` or `rocq-lsp` server, make sure to list them as part of the above `rocq-core.withPackages` expression instead of installing them separately if you want them to find your Rocq packages.
-
-For versions prior to Rocq 9.0, a similar `coq.withPackages` function is available.
+If you install the `vsrocq-language-server` or `rocq-lsp` server, make sure to list them as part of the above `coq.withPackages` expression instead of installing them separately if you want them to find your Coq/Rocq packages.
 
 ## Rocq packages attribute sets: `rocqPackages` {#rocq-packages-attribute-sets-rocqpackages}
 
@@ -133,7 +130,7 @@ mkRocqDerivation {
     mathcomp.boot
     mathcomp.algebra
     mathcomp-finmap
-    mathcomp.finite-group
+    mathcomp.fingroup
     mathcomp-bigenough
   ];
 

doc/manual.md.in

@@ -3,10 +3,10 @@
 
 ```{=include=} chapters
 preface.chapter.md
+first-package.chapter.md
 ```
 
 ```{=include=} parts
-getting-started/getting-started.part.md
 using-nixpkgs.md
 lib.md
 stdenv.md

doc/redirects.json

@@ -105,9 +105,6 @@
   "cuda-writing-tests": [
     "index.html#cuda-writing-tests"
   ],
-  "dev-environments": [
-    "index.html#dev-environments"
-  ],
   "ex-build-helpers-extendMkDerivation": [
     "index.html#ex-build-helpers-extendMkDerivation"
   ],
@@ -143,9 +140,6 @@
   "ex-writeShellApplication": [
     "index.html#ex-writeShellApplication"
   ],
-  "fetchfromtangled": [
-    "index.html#fetchfromtangled"
-  ],
   "first-package-go": [
     "index.html#first-package-go"
   ],
@@ -155,9 +149,6 @@
   "friction-graphics-wayland": [
     "index.html#friction-graphics-wayland"
   ],
-  "getting-started": [
-    "index.html#getting-started"
-  ],
   "ghc-deprecation-policy": [
     "index.html#ghc-deprecation-policy"
   ],
@@ -2801,6 +2792,9 @@
   "glycin-dont-wrap": [
     "index.html#glycin-dont-wrap"
   ],
+  "ghc": [
+    "index.html#ghc"
+  ],
   "gnome-platform": [
     "index.html#gnome-platform"
   ],
@@ -3648,8 +3642,7 @@
     "index.html#hareHook-cross-compilation"
   ],
   "haskell": [
-    "index.html#haskell",
-    "index.html#ghc"
+    "index.html#haskell"
   ],
   "haskell-available-packages": [
     "index.html#haskell-available-packages"
@@ -3778,9 +3771,15 @@
     "index.html#language-javascript"
   ],
   "javascript-introduction": [
-    "index.html#javascript-introduction",
-    "index.html#javascript-finding-examples",
-    "index.html#javascript-finding-examples-github",
+    "index.html#javascript-introduction"
+  ],
+  "javascript-finding-examples": [
+    "index.html#javascript-finding-examples"
+  ],
+  "javascript-finding-examples-github": [
+    "index.html#javascript-finding-examples-github"
+  ],
+  "javascript-finding-examples-gitlab": [
     "index.html#javascript-finding-examples-gitlab"
   ],
   "javascript-tools-overview": [

doc/release-notes/rl-2611.section.md

@@ -72,8 +72,6 @@
 
 - `alps` has been rewritten upstream, see [upstream repository](https://github.com/migadu/alps) for documentation.
 
-- `writers.makeDataWriter` has been removed. It has been deprecated since 2023. Use `pkgs.writeTextFile` instead.
-
 - `bosun` has been removed as it is no longer maintained upstream. the corresponding monitoring options has been removed.
 
 - `uhttpmock` providing 0.0 ABI was removed. `uhttpmock_1_0` providing 1.0 ABI was renamed to `uhttpmock` and `uhttpmock_1_0` was kept as an alias.
@@ -101,8 +99,6 @@
 
 - `pdns` has been updated from `5.0.x` to `5.1.x`. Please be sure to review the [Upgrade Notes](https://doc.powerdns.com/authoritative/upgrading.html#to-5-1-0) before upgrading. Namely LUA record updates are no longer allowed by default, and the embedded webserver no longer includes a `access-control-allow-origin: *` header by default.
 
-- LibreOffice upstream switched from Fresh/Still stable branches to a single Stable branch; `libreoffice` and `libreoffice-qt` work as before, but more specific aliases like `libreoffice-fresh` should be replaced.
-
 - `davmail` no longer supports building with GTK 2, and the `preferGtk3` override flag has been removed as GTK 3 is always used.
 
 - Support for the legacy U‐Boot image format has been removed from the Linux kernel builders, as it is deprecated upstream and no longer used by any platform in Nixpkgs.
@@ -121,8 +117,6 @@
 
 - `gh-actions-cache` has been removed since its functionality has been integrated directly into `gh` (`gh cache`). See [upstream readme](https://github.com/actions/gh-actions-cache).
 
-- The OCaml-based Xen Store Daemon has been split off the `xen` package, and is now present in the `ocamlPackages.oxenstored` package.
-
 - `requireFile` now sets `meta.license = lib.licenses.unfree` by default. Users of `requireFile`-based derivations that preserve this default will need to explicitly allow their evaluation as described in [](#sec-allow-unfree).
 
 - `texlive.combine` is deprecated and scheduled for removal in 27.05. Please migrate to `texliveSmall.withPackages` (see [](#sec-language-texlive-user-guide)).
@@ -142,8 +136,6 @@
   [pnpm `fetcherVersion` section](#javascript-pnpm-fetcherVersion) of the manual
   for details.
 
-- `makeSetupHook` now uses structured attributes and only makes substitutions based on the values of the `substitutions` argument - other derivation attributes are no longer considered.
-
 - `rebuilderd` has been updated to 0.27.0 introducing breaking changes. See upstream changelog for details: [0.26.0](https://github.com/kpcyrd/rebuilderd/releases/tag/v0.26.0), [0.27.0](https://github.com/kpcyrd/rebuilderd/releases/tag/v0.27.0)
 
 - Starting with v14, `flameshot` will primarily utilise xdg-desktop-portal calls for screenshotting. This will directly affect users on X11 window managers due to the lack of a compatible portal with Screenshot feature. See [upstream changelog](https://github.com/flameshot-org/flameshot/releases/tag/v14.0.0) or [NixOS Flameshot](https://wiki.nixos.org/wiki/Flameshot) wiki page for workarounds.
@@ -163,8 +155,6 @@
 
 - `buildFHSEnv`, `appimageTools.wrapAppImage`, and `appimageTools.wrapType2` now support the `finalAttrs` pattern. When using `wrapAppImage`, it is now recommended to pass the extracted AppImage to the `contents` attribute (instead of `src`), to avoid shadowing `src`. Passing the extracted contents to `src` is now deprecated and will be removed in a future release.
 
-- All databases of the MySQL family – `mysql`, `mariadb` and `percona` – now provide a client-only package `client` sub-attribute. Use the `<dbname>.client` package if the server components are not needed. The main package continues to ship the client binaries as well.
-
 - Package-URL (PURL, https://github.com/package-url/purl-spec) metadata identifier has been added for `fetchgit`, `fetchpypi` and `fetchFromGithub` fetchers.
   `mkDerivation` has been adjusted to reuse this information.
   Package-URLs allow reliably identifying and locating software packages.
@@ -173,8 +163,6 @@
 
 - The fwts efi-runtime kernel module was removed.
 
-- `homebox` v0.26.0 introduced a new, required value to be set, `HBOX_AUTH_API_KEY_PEPPER`. If one is not provided the module will create one, it is recommended that you back this up as it is part of API Key generation and validation.
-
 - Emacs loads the `early-default` library after `early-init.el`.
   Users can add `early-init.el` via `emacs.pkgs.withPackages`
   by packaging `early-init.el` into a library named `early-default`.

doc/stdenv/stdenv.chapter.md

@@ -508,7 +508,6 @@ A number between 0 and 7 indicating how much information to log. If set to 1 or
 #### `enableParallelBuilding` {#var-stdenv-enableParallelBuilding}
 
 If set to `true`, `stdenv` will pass specific flags to `make` and other build tools to enable parallel building with up to `build-cores` workers.
-Can be overridden for a specific phase using `enableParallelInstalling` or `enableParallelChecking`.
 
 Unless set to `false`, some build systems with good support for parallel building including `cmake`, `meson`, and `qmake` will set it to `true`.
 

doc/style.css

@@ -465,8 +465,7 @@ div.appendix .variablelist .term {
   font-display: swap;
 }
 
-div.chapter,
-div.page {
+.chapter {
   content-visibility: auto;
 }
 

lib/asserts.nix

@@ -7,9 +7,6 @@ let
   inherit (lib.lists)
     filter
     ;
-  inherit (lib.attrsets)
-    catAttrs
-    ;
   inherit (lib.trivial)
     showWarnings
     ;
@@ -195,7 +192,7 @@ rec {
   checkAssertWarn =
     assertions: warnings: val:
     let
-      failedAssertions = catAttrs "message" (filter (x: !x.assertion) assertions);
+      failedAssertions = map (x: x.message) (filter (x: !x.assertion) assertions);
     in
     if failedAssertions != [ ] then
       throw "\nFailed assertions:\n${concatStringsSep "\n" (map (x: "- ${x}") failedAssertions)}"

lib/customisation.nix

@@ -2,7 +2,6 @@
 
 let
   inherit (builtins)
-    catAttrs
     intersectAttrs
     unsafeGetAttrPos
     ;
@@ -407,7 +406,7 @@ rec {
           ++ [
             {
               name = "all";
-              value = catAttrs "value" outputsList;
+              value = map (x: x.value) outputsList;
             }
           ]
         )

lib/deprecated/misc.nix

@@ -241,7 +241,7 @@ let
   # See https://github.com/NixOS/nixpkgs/pull/194391 for details.
   closePropagationFast =
     list:
-    builtins.catAttrs "val" (
+    map (x: x.val) (
       builtins.genericClosure {
         startSet = map (x: {
           key = x.outPath;

lib/fileset/internal.nix

@@ -349,33 +349,24 @@ rec {
     ```
   */
   _normaliseTreeFilter =
-    let
-      # Recurses into a tree that's already known to be a directory (either a "directory" or an attrset).
-      #
-      # Only directories need to be recursed into:
-      # Files are either null (excluded) or a file type string (included), which are already normalised.
-      #
-      # Checking this in the caller instead of here also avoids the thunk allocation for the path concatenation below.
-      recurse =
-        path: tree:
-        let
-          normalisedSubtrees = mapAttrs (
-            name: subtree:
-            if subtree == "directory" || isAttrs subtree then recurse (path + "/${name}") subtree else subtree
-          ) (_directoryEntries path tree);
-          subtreeValues = attrValues normalisedSubtrees;
-        in
-        # This triggers either when all files in a directory are filtered out
-        # Or when the directory doesn't contain any files at all
-        if all isNull subtreeValues then
-          null
-        # Triggers when we have the same as a `readDir path`, so we can turn it back into an equivalent "directory".
-        else if all isString subtreeValues then
-          "directory"
-        else
-          normalisedSubtrees;
-    in
-    path: tree: if tree == "directory" || isAttrs tree then recurse path tree else tree;
+    path: tree:
+    if tree == "directory" || isAttrs tree then
+      let
+        entries = _directoryEntries path tree;
+        normalisedSubtrees = mapAttrs (name: _normaliseTreeFilter (path + "/${name}")) entries;
+        subtreeValues = attrValues normalisedSubtrees;
+      in
+      # This triggers either when all files in a directory are filtered out
+      # Or when the directory doesn't contain any files at all
+      if all isNull subtreeValues then
+        null
+      # Triggers when we have the same as a `readDir path`, so we can turn it back into an equivalent "directory".
+      else if all isString subtreeValues then
+        "directory"
+      else
+        normalisedSubtrees
+    else
+      tree;
 
   /**
     A minimal normalisation of a filesetTree, intended for pretty-printing:
@@ -535,9 +526,6 @@ rec {
         else
           "/" + concatStringsSep "/" fileset._internalBaseComponents + "/";
 
-      getBaseStringPrefix = substring 0 baseLength;
-      removeBaseStringPrefix = substring baseLength (-1);
-
       baseLength = stringLength baseString;
 
       # Check whether a list of path components under the base path exists in the tree.
@@ -563,12 +551,7 @@ rec {
               # or a string ("directory" or "regular", etc.) in which case it's included
               localTree != null;
         in
-        # Start by recursing into the first element. This is guaranteed to be
-        # safe. components will never be empty (builtins.split can't make an
-        # empty list). Tree can be something other than an attrset, but if so,
-        # the isAttrs check will fail when being passed `or tree`, and the index
-        # being ahead doesn't matter.
-        recurse 2 (tree.${head components} or tree);
+        recurse 0 tree;
 
       # Filter suited when there's no files
       empty = _: _: false;
@@ -586,34 +569,25 @@ rec {
           pathSlash = path + "/";
         in
         (
-          # Same as `hasPrefix baseString pathSlash`, but more efficient.
-          # The path is either the base itself or underneath it,
-          # but only on the few paths above it, so its checked first.
-          # With base /foo/bar this matches /foo/bar and /foo/bar/baz
-          # hasPrefix "/foo/bar/" "/foo/bar/baz/"
-          if getBaseStringPrefix pathSlash == baseString then
-            if pathSlash == baseString then
-              # The path is the base directory itself, which is always included
-              true
-            else
-              # Same as `removePrefix baseString path`, but more efficient.
-              # From the above code we know that hasPrefix baseString pathSlash holds, so this is safe.
-              # We don't use pathSlash here because we only needed the trailing slash for the prefix matching.
-              # With base /foo and path /foo/bar/baz this gives
-              # inTree (split "/" (removePrefix "/foo/" "/foo/bar/baz"))
-              # == inTree (split "/" "bar/baz")
-              # == inTree [ "bar" "baz" ]
-              inTree (split "/" (removeBaseStringPrefix path))
           # Same as `hasPrefix pathSlash baseString`, but more efficient.
-          # The path is a proper ancestor of the base, which needs to be included for the base to be reachable:
           # With base /foo/bar we need to include /foo:
           # hasPrefix "/foo/" "/foo/bar/"
-          else if substring 0 (stringLength pathSlash) baseString == pathSlash then
+          if substring 0 (stringLength pathSlash) baseString == pathSlash then
             true
-          else
-            # The path is unrelated to the base, so nothing from it is included
-            # With base /foo/bar this matches e.g. /baz
+          # Same as `! hasPrefix baseString pathSlash`, but more efficient.
+          # With base /foo/bar we need to exclude /baz
+          # ! hasPrefix "/baz/" "/foo/bar/"
+          else if substring 0 baseLength pathSlash != baseString then
             false
+          else
+            # Same as `removePrefix baseString path`, but more efficient.
+            # From the above code we know that hasPrefix baseString pathSlash holds, so this is safe.
+            # We don't use pathSlash here because we only needed the trailing slash for the prefix matching.
+            # With base /foo and path /foo/bar/baz this gives
+            # inTree (split "/" (removePrefix "/foo/" "/foo/bar/baz"))
+            # == inTree (split "/" "bar/baz")
+            # == inTree [ "bar" "baz" ]
+            inTree (split "/" (substring baseLength (-1) path))
         )
         # This is a way have an additional check in case the above is true without any significant performance cost
         && (
@@ -828,34 +802,21 @@ rec {
   */
   _unionTrees =
     trees:
-    if length trees == 1 then
-      # The union of a single tree simply returns the first element
-      head trees
-    else
-      let
-        # Like lib.findFirstIndex but without indexing.
-        # This is a hot path so the indexing arithmetic adds up.
-        firstStr = foldl' (
-          found: tree:
-          if found != null then
-            found
-          else if isString tree then
-            tree
-          else
-            found # null
-        ) null trees;
-        nonNulls = filter (tree: tree != null) trees;
-      in
+    let
+      stringIndex = findFirstIndex isString null trees;
+      withoutNull = filter (tree: tree != null) trees;
+    in
+    if stringIndex != null then
       # If there's a string, it's always a fully included tree (dir or file),
       # no need to look at other elements
-      if firstStr != null then
-        firstStr
-      else if nonNulls == [ ] then
-        null
-      else
-        # The non-null elements have to be attribute sets representing partial trees
-        # We need to recurse into those
-        zipAttrsWith (name: _unionTrees) nonNulls;
+      elemAt trees stringIndex
+    else if withoutNull == [ ] then
+      # If all trees are null, then the resulting tree is also null
+      null
+    else
+      # The non-null elements have to be attribute sets representing partial trees
+      # We need to recurse into those
+      zipAttrsWith (name: _unionTrees) withoutNull;
 
   /**
     Computes the intersection of two filesets.

lib/gvariant.nix

@@ -14,7 +14,6 @@
 
 let
   inherit (lib)
-    catAttrs
     concatMapStringsSep
     concatStrings
     escape
@@ -410,7 +409,7 @@ rec {
     elems:
     let
       gvarElems = map mkValue elems;
-      tupleType = type.tupleOf (catAttrs "type" gvarElems);
+      tupleType = type.tupleOf (map (e: e.type) gvarElems);
     in
     mkPrimitive tupleType gvarElems
     // {

lib/licenses/licenses.nix

@@ -203,11 +203,6 @@ lib.mapAttrs mkLicense (
       fullName = " BitTorrent Open Source License v1.1";
     };
 
-    blessing = {
-      spdxId = "blessing";
-      fullName = "SQLite Blessing";
-    };
-
     boehmGC = {
       spdxId = "Boehm-GC";
       fullName = "Boehm-Demers-Weiser GC License";
@@ -283,12 +278,6 @@ lib.mapAttrs mkLicense (
       fullName = "BSD 3-Clause Tso variant";
     };
 
-    bsdAskToEndorse = {
-      #spdxId = "BSD-ask-to-endorse"; # Accepted to SPDX waiting on next SPDX release
-      fullName = "BSD - ask to endorse";
-      url = "https://github.com/sudo-project/sudo/blob/c1307ea9ff340ce0538779f8e456501461fc44b7/plugins/sudoers/redblack.c#L24-L43";
-    };
-
     bsdAxisNoDisclaimerUnmodified = {
       fullName = "BSD-Axis without Warranty Disclaimer with Unmodified requirement";
       url = "https://scancode-licensedb.aboutcode.org/bsd-no-disclaimer-unmodified.html";
@@ -715,11 +704,6 @@ lib.mapAttrs mkLicense (
       url = "https://geant4.web.cern.ch/geant4/license/LICENSE.html";
     };
 
-    gccException20 = {
-      spdxId = "GCC-exception-2.0";
-      fullName = "GCC Runtime Library exception 2.0";
-    };
-
     gccException31 = {
       spdxId = "GCC-exception-3.1";
       fullName = "GCC Runtime Library exception 3.1";
@@ -1295,11 +1279,6 @@ lib.mapAttrs mkLicense (
       fullName = "Open Data Commons Open Database License v1.0";
     };
 
-    ofl10 = {
-      spdxId = "OFL-1.0";
-      fullName = "SIL Open Font License 1.0";
-    };
-
     ofl = {
       spdxId = "OFL-1.1";
       fullName = "SIL Open Font License 1.1";
@@ -1486,6 +1465,12 @@ lib.mapAttrs mkLicense (
       fullName = "MIT-STK License";
     };
 
+    sudo = {
+      shortName = "sudo";
+      fullName = "Sudo License (ISC-style)";
+      url = "https://www.sudo.ws/about/license/";
+    };
+
     sustainableUse = {
       spdxId = "SUL-1.0";
       fullName = "Sustainable Use License";
@@ -1632,13 +1617,6 @@ lib.mapAttrs mkLicense (
       fullName = "Universal Permissive License";
     };
 
-    valveSDK = {
-      fullName = "Valve Corporation Steamworks SDK Access Agreement";
-      url = "https://partner.steamgames.com/documentation/sdk_access_agreement";
-      free = false;
-      redistributable = true;
-    };
-
     vim = {
       spdxId = "Vim";
       fullName = "Vim License";
@@ -1653,8 +1631,6 @@ lib.mapAttrs mkLicense (
     vol-sl = {
       fullName = "Volatility Software License, Version 1.0";
       url = "https://www.volatilityfoundation.org/license/vsl-v1.0";
-      free = false;
-      redistributable = true;
     };
 
     vsl10 = {

lib/meta-types.nix

@@ -16,7 +16,6 @@ let
     any
     attrNames
     attrValues
-    catAttrs
     concatMap
     isFunction
     isBool
@@ -142,10 +141,10 @@ lib.fix (self: {
     assert all isTypeDef types;
     let
       # Store a list of functions so we don't have to pay the cost of attrset lookups at runtime.
-      funcs = catAttrs "verify" types;
+      funcs = map (t: t.verify) types;
     in
     {
-      name = "union<${concatStringsSep "," (catAttrs "name" types)}>";
+      name = "union<${concatStringsSep "," (map (t: t.name) types)}>";
       verify = v: any (func: func v) funcs;
     };
 
@@ -154,10 +153,10 @@ lib.fix (self: {
     assert all isTypeDef types;
     let
       # Store a list of functions so we don't have to pay the cost of attrset lookups at runtime.
-      funcs = catAttrs "verify" types;
+      funcs = map (t: t.verify) types;
     in
     {
-      name = "intersection<${concatStringsSep "," (catAttrs "name" types)}>";
+      name = "intersection<${concatStringsSep "," (map (t: t.name) types)}>";
       verify = v: all (func: func v) funcs;
     };
 

lib/modules.nix

@@ -566,7 +566,7 @@ let
         let
           keyFilter = filter (attrs: !isDisabled modulesPath disabled attrs);
         in
-        catAttrs "module" (genericClosure {
+        map (attrs: attrs.module) (genericClosure {
           startSet = keyFilter modules;
           operator = attrs: keyFilter attrs.modules;
         });
@@ -1148,8 +1148,8 @@ let
     // {
       value = addErrorContext "while evaluating the option `${showOption loc}':" value;
       inherit (res.defsFinal') highestPrio;
-      definitions = catAttrs "value" res.defsFinal;
-      files = catAttrs "file" res.defsFinal;
+      definitions = map (def: def.value) res.defsFinal;
+      files = map (def: def.file) res.defsFinal;
       definitionsWithLocations = res.defsFinal;
       inherit (res) isDefined;
       inherit (res.checkedAndMerged) valueMeta;

lib/options.nix

@@ -29,7 +29,6 @@ let
     ;
   inherit (lib.attrsets)
     attrByPath
-    catAttrs
     optionalAttrs
     showAttrPath
     ;
@@ -540,7 +539,7 @@ rec {
 
     :::
   */
-  getValues = catAttrs "value";
+  getValues = map (x: x.value);
 
   /**
     Extracts values of all `file` keys of the given list
@@ -562,7 +561,7 @@ rec {
 
     :::
   */
-  getFiles = catAttrs "file";
+  getFiles = map (x: x.file);
 
   # Generate documentation template from the list of option declaration like
   # the set generated with filterOptionSets.

lib/systems/default.nix

@@ -151,22 +151,7 @@ let
           );
 
         # Derived meta-data
-        useLLVM =
-          final.isFreeBSD
-          || final.isOpenBSD
-          || final.isUefi
-          || final.isMsvc
-          ||
-            # because GCC does not support this platform yet
-            (with final; isWindows && isAarch64);
-
-        # Use the split GCC package set (`gccNGPackages`) instead of the
-        # monolithic `gcc`.
-        #
-        # I (@Ericson2314) plan on making more obscure low-tier
-        # platforms (e.g. NetBSD) use it soon, so we can dogfood GCC NG
-        # and thereby iron out its bugs.
-        useGccNG = final.isCygwin;
+        useLLVM = final.isFreeBSD || final.isOpenBSD;
 
         libc =
           if final.isDarwin then
@@ -191,7 +176,9 @@ let
             "uclibc"
           else if final.isAndroid then
             "bionic"
-          else if final.isLinux then
+          else if
+            final.isLinux # default
+          then
             "glibc"
           else if final.isFreeBSD then
             "fblibc"
@@ -203,8 +190,6 @@ let
             "avrlibc"
           else if final.isGhcjs then
             null
-          else if final.isUefi then
-            null
           else if final.isNone then
             "newlib"
           # TODO(@Ericson2314) think more about other operating systems

lib/systems/examples.nix

@@ -93,6 +93,7 @@ rec {
     config = "aarch64-unknown-linux-android";
     androidSdkVersion = "35";
     androidNdkVersion = "27";
+    libc = "bionic";
     useAndroidPrebuilt = false;
     useLLVM = true;
   };
@@ -168,18 +169,22 @@ rec {
 
   riscv64-embedded = {
     config = "riscv64-none-elf";
+    libc = "newlib";
   };
 
   riscv32-embedded = {
     config = "riscv32-none-elf";
+    libc = "newlib";
   };
 
   mips64-embedded = {
     config = "mips64-none-elf";
+    libc = "newlib";
   };
 
   mips-embedded = {
     config = "mips-none-elf";
+    libc = "newlib";
   };
 
   # https://github.com/loongson/la-softdev-convention/blob/master/la-softdev-convention.adoc#10-operating-system-package-build-requirements
@@ -196,17 +201,17 @@ rec {
 
   mmix = {
     config = "mmix-unknown-mmixware";
-    # Not `isNone`: the OS here is `mmixware`, so the bare-metal default does
-    # not apply.
     libc = "newlib";
   };
 
   rx-embedded = {
     config = "rx-none-elf";
+    libc = "newlib";
   };
 
   msp430 = {
     config = "msp430-elf";
+    libc = "newlib";
   };
 
   avr = {
@@ -215,10 +220,12 @@ rec {
 
   vc4 = {
     config = "vc4-elf";
+    libc = "newlib";
   };
 
   or1k = {
     config = "or1k-elf";
+    libc = "newlib";
   };
 
   m68k = {
@@ -243,6 +250,7 @@ rec {
 
   arm-embedded = {
     config = "arm-none-eabi";
+    libc = "newlib";
   };
   arm-embedded-nano = {
     config = "arm-none-eabi";
@@ -250,6 +258,7 @@ rec {
   };
   armhf-embedded = {
     config = "arm-none-eabihf";
+    libc = "newlib";
     # GCC8+ does not build without this
     # (https://www.mail-archive.com/gcc-bugs@gcc.gnu.org/msg552339.html):
     gcc = {
@@ -260,31 +269,38 @@ rec {
 
   aarch64-embedded = {
     config = "aarch64-none-elf";
+    libc = "newlib";
     rust.rustcTarget = "aarch64-unknown-none";
   };
 
   aarch64be-embedded = {
     config = "aarch64_be-none-elf";
+    libc = "newlib";
   };
 
   ppc-embedded = {
     config = "powerpc-none-eabi";
+    libc = "newlib";
   };
 
   ppcle-embedded = {
     config = "powerpcle-none-eabi";
+    libc = "newlib";
   };
 
   i686-embedded = {
     config = "i686-elf";
+    libc = "newlib";
   };
 
   x86_64-embedded = {
     config = "x86_64-elf";
+    libc = "newlib";
   };
 
   microblaze-embedded = {
     config = "microblazeel-none-elf";
+    libc = "newlib";
   };
 
   #
@@ -322,10 +338,16 @@ rec {
 
   x86_64-unknown-uefi = {
     config = "x86_64-unknown-uefi";
+    libc = null;
+    useLLVM = true;
+    linker = "lld";
   };
 
   aarch64-unknown-uefi = {
     config = "aarch64-unknown-uefi";
+    libc = null;
+    useLLVM = true;
+    linker = "lld";
   };
 
   #
@@ -360,11 +382,12 @@ rec {
   };
 
   # mingw-w64 with ucrt for Aarch64, default compiler (which is LLVM
-  # see ./default.nix).
+  # because GCC does not support this platform yet).
   mingw-ucrt-aarch64 = {
     config = "aarch64-w64-mingw32";
     libc = "ucrt";
     rust.rustcTarget = "aarch64-pc-windows-gnullvm";
+    useLLVM = true;
   };
 
   # mingw-64 back compat
@@ -377,10 +400,12 @@ rec {
   # Target the MSVC ABI
   x86_64-windows = {
     config = "x86_64-pc-windows-msvc";
+    useLLVM = true;
   };
 
   aarch64-windows = {
     config = "aarch64-pc-windows-msvc";
+    useLLVM = true;
   };
 
   x86_64-cygwin = {
@@ -391,10 +416,12 @@ rec {
 
   aarch64-freebsd = {
     config = "aarch64-unknown-freebsd";
+    useLLVM = true;
   };
 
   x86_64-freebsd = {
     config = "x86_64-unknown-freebsd";
+    useLLVM = true;
   };
 
   x86_64-netbsd = {

lib/types.nix

@@ -608,7 +608,7 @@ rec {
     description = "fileset";
     descriptionClass = "noun";
     check = isFileset;
-    merge = loc: defs: unions (getValues defs);
+    merge = loc: defs: unions (map (x: x.value) defs);
     emptyValue.value = empty;
   };
 

maintainers/github-teams.json

@@ -2,10 +2,11 @@
   "acme": {
     "description": "Maintain ACME-related packages and modules.",
     "id": 3806126,
-    "maintainers": {},
+    "maintainers": {
+      "emilazy": 18535642
+    },
     "members": {
       "arianvp": 628387,
-      "emilazy": 18535642,
       "m1cr0man": 3044438
     },
     "name": "ACME"
@@ -59,6 +60,7 @@
       "adamcstephens": 2071575,
       "ankhers": 750786,
       "gleber": 33185,
+      "minijackson": 1200507,
       "yurrriq": 1866448
     },
     "name": "Beam"
@@ -66,11 +68,12 @@
   "boot-security": {
     "description": "Maintain support for boot security technologies like Secure Boot",
     "id": 18686947,
-    "maintainers": {},
-    "members": {
-      "ElvishJerricco": 1365692,
+    "maintainers": {
       "emilazy": 18535642
     },
+    "members": {
+      "ElvishJerricco": 1365692
+    },
     "name": "Boot security"
   },
   "bootstrapping": {
@@ -95,8 +98,8 @@
       "fgaz": 8182846,
       "natsukium": 25083790,
       "philiptaron": 43863,
-      "tomodachi94": 68489118,
-      "tr3foil": 29682759
+      "pyrotelekinetic": 29682759,
+      "tomodachi94": 68489118
     },
     "members": {},
     "name": "Categorization"
@@ -181,6 +184,7 @@
     "description": "Improve Darwin-support across Nixpkgs and help maintainers without access to Darwin hardware. Apply to join through https://github.com/NixOS/nixpkgs/issues/323144 to keep the process transparent.",
     "id": 2385202,
     "maintainers": {
+      "emilazy": 18535642,
       "toonn": 1486805
     },
     "members": {
@@ -207,12 +211,10 @@
       "cideM": 4246921,
       "cidkidnix": 67574902,
       "copumpkin": 2623,
-      "delafthi": 50531499,
       "devusb": 4951663,
       "domenkozar": 126339,
       "dwt": 57199,
       "eclairevoyant": 848000,
-      "emilazy": 18535642,
       "ethancedwards8": 60861925,
       "fiddlerwoaroof": 808745,
       "fulsomenko": 14945057,
@@ -262,7 +264,6 @@
       "stephenstubbs": 18033664,
       "t-monaghan": 62273348,
       "thefloweringash": 42933,
-      "thtrf": 82712122,
       "tricktron": 16036882,
       "uncenter": 47499684,
       "usertam": 22500027,
@@ -579,11 +580,11 @@
     "id": 9955829,
     "maintainers": {
       "RossComputerGuy": 19699320,
-      "alyssais": 2768870
+      "alyssais": 2768870,
+      "emilazy": 18535642
     },
     "members": {
       "Ericson2314": 1055245,
-      "emilazy": 18535642,
       "peterwaller-arm": 52030119,
       "rrbutani": 7833358
     },
@@ -658,6 +659,7 @@
       "djacu": 7043297
     },
     "members": {
+      "Sigmanificient": 53050011,
       "flyfloh": 74379,
       "thilobillerbeck": 7442383
     },
@@ -694,8 +696,8 @@
       "eclairevoyant": 848000
     },
     "members": {
-      "daylinmorgan": 47667941,
-      "eveeifyeve": 88671402
+      "Eveeifyeve": 88671402,
+      "daylinmorgan": 47667941
     },
     "name": "nim"
   },
@@ -754,6 +756,16 @@
     },
     "name": "Nixpkgs CI"
   },
+  "nixpkgs-core": {
+    "description": "Provides leadership for and has authority over Nixpkgs.",
+    "id": 14317027,
+    "maintainers": {
+      "alyssais": 2768870,
+      "emilazy": 18535642
+    },
+    "members": {},
+    "name": "Nixpkgs core"
+  },
   "nixpkgs-merge-bot": {
     "description": "This team exists as a target for triggering the nixpkgs merge bot.",
     "id": 13926892,
@@ -788,11 +800,10 @@
     "description": "Maintain Pantheon desktop environment and platform",
     "id": 4786995,
     "maintainers": {
-      "bobby285271": 20080233,
       "davidak": 91113
     },
     "members": {
-      "amz-x": 18249234
+      "bobby285271": 20080233
     },
     "name": "Pantheon"
   },
@@ -856,7 +867,6 @@
       "lorenzleutgeb": 542154
     },
     "members": {
-      "Mic92": 96200,
       "ju1m": 21160136,
       "matthiasbeyer": 427866
     },
@@ -897,6 +907,7 @@
       "0x4A6F": 9675338
     },
     "members": {
+      "DarkKirb": 23011243,
       "dramforever": 2818072,
       "fgaz": 8182846,
       "jonhermansen": 660911
@@ -990,11 +1001,11 @@
     "id": 11265412,
     "maintainers": {
       "RossComputerGuy": 19699320,
+      "emilazy": 18535642,
       "philiptaron": 43863
     },
     "members": {
       "Ericson2314": 1055245,
-      "emilazy": 18535642,
       "reckenrode": 7413633
     },
     "name": "stdenv"

maintainers/maintainer-list.nix

@@ -63,12 +63,6 @@
 {
   # keep-sorted start case=no numeric=no block=yes
 
-  "3mp3ri0r" = {
-    email = "christoforus@xendit.co";
-    github = "3mp3ri0r";
-    githubId = 3140815;
-    name = "Christoforus Surjoputro";
-  };
   _0b11stan = {
     name = "Tristan Auvinet Pinaudeau";
     email = "tristan@tic.sh";
@@ -295,11 +289,6 @@
     name = "6543";
     keys = [ { fingerprint = "8722 B61D 7234 1082 553B  201C B8BE 6D61 0E61 C862"; } ];
   };
-  _66HEX = {
-    name = "Marek Jóźwiak";
-    github = "66HEX";
-    githubId = 168720167;
-  };
   _6AA4FD = {
     email = "f6442954@gmail.com";
     github = "6AA4FD";
@@ -627,11 +616,6 @@
       { fingerprint = "CE85 54F7 B9BC AC0D D648  5661 AB5F C04C 3C94 443F"; }
     ];
   };
-  ad-si = {
-    name = "Adrian Sieber";
-    github = "ad-si";
-    githubId = 36796532;
-  };
   ad030 = {
     name = "Alex Dam";
     github = "ad030";
@@ -891,12 +875,6 @@
     githubId = 6055037;
     name = "Alexander Hirner";
   };
-  AhmedAmr = {
-    email = "ahmedamr24680@gmail.com";
-    github = "AhmedAmrNabil";
-    githubId = 43810060;
-    name = "Ahmed Amr";
-  };
   ahoneybun = {
     email = "aaronhoneycutt@proton.me";
     github = "ahoneybun";
@@ -1450,11 +1428,6 @@
     githubId = 30437811;
     name = "Alex Andrews";
   };
-  alikaansun = {
-    github = "alikaansun";
-    githubId = 77810345;
-    name = "Ali Kaan Sunnetcioglu";
-  };
   alikindsys = {
     email = "alice@blocovermelho.org";
     github = "alikindsys";
@@ -1993,13 +1966,6 @@
     githubId = 143312793;
     name = "Annin";
   };
-  annoyingrains = {
-    email = "avali@avali.zone";
-    matrix = "@avali:avali.zone";
-    github = "AnnoyingRain5";
-    githubId = 35289650;
-    name = "AnnoyingRains";
-  };
   anntnzrb = {
     github = "anntnzrb";
     githubId = 51257127;
@@ -2220,12 +2186,6 @@
     githubId = 8436007;
     name = "Aria Edmonds";
   };
-  ar4m1s = {
-    name = "Aramis";
-    github = "Ar4m1s";
-    githubId = 59250656;
-    matrix = "@vegardbm:matrix.org";
-  };
   arbel-arad = {
     email = "arbel@spacetime.technology";
     github = "arbel-arad";
@@ -2352,12 +2312,6 @@
     githubId = 8049011;
     name = "Arik Grahl";
   };
-  arison = {
-    email = "arison@duck.com";
-    github = "ArisoN-ext";
-    githubId = 181835726;
-    name = "ArisoN";
-  };
   ariutta = {
     email = "anders.riutta@gmail.com";
     github = "ariutta";
@@ -3694,6 +3648,13 @@
     githubId = 185443;
     name = "Alexey Lebedeff";
   };
+  binary-eater = {
+    email = "sergeantsagara@protonmail.com";
+    github = "Binary-Eater";
+    githubId = 10691440;
+    name = "Rahul Rameshbabu";
+    keys = [ { fingerprint = "678A 8DF1 D9F2 B51B 7110  BE53 FF24 7B3E 5411 387B"; } ];
+  };
   binarycat = {
     email = "binarycat@envs.net";
     github = "lolbinarycat";
@@ -4878,12 +4839,6 @@
     githubId = 543423;
     name = "Alex Wied";
   };
-  ceridwen15 = {
-    email = "me@cdwn.gay";
-    github = "NonsensicalNickname";
-    githubId = 118519066;
-    name = "Ceridwen Weaving";
-  };
   cfouche = {
     email = "chaddai.fouche@gmail.com";
     github = "Chaddai";
@@ -5187,11 +5142,6 @@
     githubId = 1103294;
     name = "Christopher Rosset";
   };
-  christo-auer = {
-    name = "Christopher Auer";
-    github = "christo-auer";
-    githubId = 15138131;
-  };
   christoph-heiss = {
     email = "christoph@c8h4.io";
     github = "christoph-heiss";
@@ -5424,12 +5374,6 @@
     githubId = 69784758;
     matrix = "@clot27:matrix.org";
   };
-  cloudglides = {
-    name = "Cloud";
-    email = "cloudglides@proton.me";
-    github = "cloudglides";
-    githubId = 111557161;
-  };
   cloudripper = {
     email = "dev+nixpkgs@cldrpr.com";
     github = "cloudripper";
@@ -5622,12 +5566,6 @@
     githubId = 327028;
     name = "Cole Mickens";
   };
-  colepearson27 = {
-    name = "Cole Pearson";
-    email = "colepearson27@gmail.com";
-    github = "colepearson27";
-    githubId = 113060096;
-  };
   colescott = {
     email = "colescottsf@gmail.com";
     github = "colescott";
@@ -6914,12 +6852,6 @@
     githubId = 27348469;
     name = "Cat";
   };
-  denzonl = {
-    email = "dennis@bogers.xyz";
-    github = "DenzoNL";
-    githubId = 7504556;
-    name = "Dennis Bogers";
-  };
   derchris = {
     email = "derchris@me.com";
     github = "derchrisuk";
@@ -7172,12 +7104,6 @@
     githubId = 15774340;
     name = "Thomas Depierre";
   };
-  dibenzepin = {
-    name = "Fumnanya";
-    email = "fmowete@outlook.com";
-    github = "dibenzepin";
-    githubId = 87488715;
-  };
   DictXiong = {
     email = "me@beardic.cn";
     github = "DictXiong";
@@ -7619,6 +7545,12 @@
     githubId = 81854406;
     name = "Chew Cheng Hong";
   };
+  drew-dirac = {
+    email = "drew@diracinc.com";
+    github = "drew-dirac";
+    githubId = 187309685;
+    name = "Drew Council";
+  };
   drperceptron = {
     github = "drperceptron";
     githubId = 92106371;
@@ -7798,8 +7730,7 @@
     matrix = "@dvdznf:gitter.im";
   };
   dvn0 = {
-    email = "devan@informatics.coop";
-    keys = [ { fingerprint = "E0F4 87C6 6298 7353 A7D0 E997 8203 BD5C 41D8 29DF"; } ];
+    email = "git@dvn.me";
     github = "dvn0";
     githubId = 10859387;
     name = "Devan Carpenter";
@@ -8028,24 +7959,12 @@
     githubId = 63352906;
     keys = [ { fingerprint = "922F CA48 5FDB 20B1 ED1B  A61F 284D 11D3 33C4 D21B"; } ];
   };
-  edgarpost = {
-    name = "Edgar Post-Buijs";
-    email = "github@edgarpost.com";
-    github = "EdgarPost";
-    githubId = 488221;
-  };
   edlimerkaj = {
     name = "Edli Merkaj";
     email = "edli.merkaj@identinet.io";
     github = "edlimerkaj";
     githubId = 71988351;
   };
-  edoars = {
-    name = "Edoardo Signorini";
-    email = "mail@edoars.me";
-    github = "edoars";
-    githubId = 44139791;
-  };
   edrex = {
     email = "ericdrex@gmail.com";
     github = "edrex";
@@ -8168,13 +8087,6 @@
     githubId = 7494394;
     name = "Karim Elatov";
   };
-  eldios = {
-    email = "emanuele.lele.calo@gmail.com";
-    github = "eldios";
-    githubId = 483767;
-    name = "Emanuele 'Lele' Calo";
-    keys = [ { fingerprint = "AA6B C774 3F8F 9AD8 4BBA  15C7 2CCB F4B7 1EFF DD46"; } ];
-  };
   eleanor = {
     email = "dejan@proteansec.com";
     github = "proteansec";
@@ -8333,12 +8245,6 @@
     githubId = 1365692;
     name = "Will Fancher";
   };
-  elzorrorebelde = {
-    name = "Jorge Javier Araya Navarro";
-    email = "jorge@esavara.cr";
-    github = "elzorrorebelde";
-    githubId = 1055216;
-  };
   emaiax = {
     email = "github@emaiax.dev";
     github = "emaiax";
@@ -8725,11 +8631,6 @@
       { fingerprint = "2E51 F618 39D1 FA94 7A73  00C2 34C0 4305 D581 DBFE"; }
     ];
   };
-  ethanthoma = {
-    name = "Ethan Thoma";
-    github = "ethanthoma";
-    githubId = 4424467;
-  };
   ethindp = {
     name = "Ethin Probst";
     email = "harlydavidsen@gmail.com";
@@ -8826,12 +8727,6 @@
     githubId = 330292;
     name = "Evan Richter";
   };
-  evanwporter = {
-    email = "evanwporter@gmail.com";
-    github = "evanwporter";
-    githubId = 115374841;
-    name = "Evan Porter";
-  };
   evax = {
     email = "nixos@evax.fr";
     github = "evax";
@@ -10154,11 +10049,6 @@
     name = "Kirill Samoylenkov";
     keys = [ { fingerprint = "955B 97C5 78A3 DF03 D818  25EB 8E40 5DD2 CF84 CCE0"; } ];
   };
-  gefla = {
-    name = "Gerd Flaig";
-    github = "gefla";
-    githubId = 56790;
-  };
   genga898 = {
     email = "genga898@gmail.com";
     github = "genga898";
@@ -10205,12 +10095,7 @@
     github = "gepbird";
     githubId = 29818440;
     name = "Gutyina Gergő";
-    matrix = "@gepbird:matrix.org";
     keys = [
-      { fingerprint = "hEzYpII9pUMfbhhr1LbUaLoGKGKX7UJQ1i9QU5SIssQ"; }
-      { fingerprint = "MnieeyZ1Y02OB4PMrkM5xrk3ZXq3XTahcSocDyqzmFg"; }
-      { fingerprint = "YfsHXlTvwc3HmLzQPi4g9nn4bKCj/mV/xgg9dxxxdnU"; }
-      { fingerprint = "2NGbD6uF4OYtqjaYvN4foZFooT7XTAHODUaNxGVuJdk"; }
       { fingerprint = "RoAfvqa6w1l8Vdm3W60TDXurYwJ6h03VEGD+wDNGEwc"; }
       { fingerprint = "MP2UpIRtJpbFFqyucP431H/FPCfn58UhEUTro4lXtRs"; }
     ];
@@ -10435,12 +10320,6 @@
     github = "gkleen";
     githubId = 20089782;
   };
-  gl1tchxd = {
-    name = "Felix Buchsteiner";
-    github = "gl1tchxd-git";
-    githubId = 92686452;
-    email = "contact@gl1tchxd.at";
-  };
   gleber = {
     email = "gleber.p@gmail.com";
     github = "gleber";
@@ -11083,12 +10962,6 @@
     githubId = 79340822;
     keys = [ { fingerprint = "3582 5B85 66C8 4F36 45C7  EC42 809F 7938 9CB1 8650"; } ];
   };
-  havunen = {
-    name = "Sampo Kivistö";
-    email = "sampo.kivisto@live.fi";
-    github = "havunen";
-    githubId = 2021355;
-  };
   hawkw = {
     email = "eliza@elizas.website";
     github = "hawkw";
@@ -11369,6 +11242,11 @@
     githubId = 58676303;
     name = "hhydraa";
   };
+  hibiday = {
+    name = "Katsumi Takeuchi";
+    github = "hibiday";
+    githubId = 137286929;
+  };
   higebu = {
     name = "Yuya Kusakabe";
     email = "yuya.kusakabe@gmail.com";
@@ -11380,11 +11258,6 @@
     github = "HigherOrderLogic";
     githubId = 73709188;
   };
-  highghlow = {
-    name = "Alex Kravchenko";
-    github = "unhighghlow";
-    githubId = 132668972;
-  };
   hirenashah = {
     email = "hiren@hiren.io";
     github = "hirenashah";
@@ -11713,12 +11586,6 @@
     github = "I-Al-Istannen";
     githubId = 20284688;
   };
-  i-love-lean = {
-    name = "i-love-lean";
-    github = "i-love-lean";
-    githubId = 170473930;
-    email = "nixpkgs@unnamed.website";
-  };
   i01011001 = {
     email = "yugen.m7@gmail.com";
     github = "i01011001";
@@ -12560,13 +12427,6 @@
     githubId = 7558482;
     name = "Jack Gerrits";
   };
-  jackoe = {
-    name = "Jack Wines";
-    email = "nixos@winesj.com";
-    github = "jackoe";
-    githubId = 3060163;
-    matrix = "@noiobeforebedtime:winesj.com";
-  };
   jackr = {
     name = "Jack Rosenberg";
     email = "nixos@jackr.eu";
@@ -13686,12 +13546,6 @@
     githubId = 32305209;
     name = "John Children";
   };
-  johnhamelink = {
-    email = "me@johnhame.link";
-    github = "johnhamelink";
-    githubId = 101739;
-    name = "John Hamelink";
-  };
   johnjohnstone = {
     email = "jjohnstone@riseup.net";
     github = "johnjohnstone";
@@ -14133,12 +13987,6 @@
     name = "John Soo";
     githubId = 10039785;
   };
-  jsqu4re = {
-    email = "johannes.jeising@gmail.com";
-    github = "jsqu4re";
-    githubId = 35706792;
-    name = "Johannes Jeising";
-  };
   jsusk = {
     email = "joshua@suskalo.org";
     github = "IGJoshua";
@@ -16232,11 +16080,7 @@
   };
   liamthexpl0rer = {
     name = "Liam";
-    matrix = "@liamthexpl0rer:l14mx.de";
-    keys = [
-      { fingerprint = "3C0A 0FC8 E406 E602 50F3  FCFD 7633 7F2C A1CB 537D"; }
-      { fingerprint = "CC53 895B 3CC7 7B29 AA46  55EF 6DF0 2F41 092A 9B30"; }
-    ];
+    matrix = "@liamthexpl0rer:matrix.org";
     github = "liamthexpl0rer";
     githubId = 119797945;
   };
@@ -17040,19 +16884,6 @@
       }
     ];
   };
-  lunitur = {
-    email = "karlo.puselj@gmail.com";
-    github = "Lunitur";
-    githubId = 8092435;
-    name = "Karlo Pušelj";
-  };
-  lunkentuss = {
-    email = "peter.hansson17@gmail.com";
-    matrix = "@lunkentuss:matrix.org";
-    github = "lunkentuss";
-    githubId = 9850798;
-    name = "Peter Hansson";
-  };
   LunNova = {
     email = "nixpkgs-maintainer@lunnova.dev";
     github = "LunNova";
@@ -17090,17 +16921,6 @@
     matrix = "@lux:ontheblueplanet.com";
     name = "Lux";
   };
-  luytan = {
-    email = "luytan@khora.me";
-    github = "luytan";
-    githubId = 221864923;
-    name = "Luytan";
-    keys = [
-      {
-        fingerprint = "E7B7 215C 0DFB 3D8C 17EE  95E0 E0AD 187A 4F2B 41EF";
-      }
-    ];
-  };
   luz = {
     email = "luz666@daum.net";
     github = "Luz";
@@ -17799,11 +17619,6 @@
     githubId = 29855073;
     name = "Michael Colicchia";
   };
-  Masrepus = {
-    github = "Masrepus";
-    githubId = 6538121;
-    name = "Samuel Hopstock";
-  };
   masrlinu = {
     github = "masrlinu";
     githubId = 5259918;
@@ -18823,12 +18638,6 @@
     githubId = 1387206;
     name = "Mike Sperber";
   };
-  mikilio = {
-    email = "kilian.mio@mikilio.com";
-    github = "Mikilio";
-    githubId = 86004375;
-    name = "Kilian Mio";
-  };
   mikoim = {
     email = "ek@esh.ink";
     github = "mikoim";
@@ -19006,12 +18815,6 @@
     githubId = 54669781;
     keys = [ { fingerprint = "293B 93D8 A471 059F 85D7  16A6 5BA9 2099 D9BE 2DAA"; } ];
   };
-  mishushakov = {
-    email = "mish@e2b.dev";
-    github = "mishushakov";
-    githubId = 10400064;
-    name = "Mish Ushakov";
-  };
   misilelab = {
     name = "misilelab";
     email = "misileminecord@gmail.com";
@@ -19173,12 +18976,6 @@
     githubId = 104795;
     name = "Marek Mahut";
   };
-  mmclinton = {
-    email = "nixpkg.concur071@simplelogin.com";
-    github = "mmclinton";
-    githubId = 96266047;
-    name = "Miller Clinton";
-  };
   mmesch = {
     github = "MMesch";
     githubId = 2597803;
@@ -19384,13 +19181,6 @@
     matrix = "@motiejus:jakstys.lt";
     name = "Motiejus Jakštys";
   };
-  Mowerick = {
-    email = "oliverhagenauer@gmail.com";
-    github = "Mowerick";
-    githubId = 102822250;
-    keys = [ { fingerprint = "6472 901A F0E7 F983 4893  042F 5F76 361C 2EF9 C95F"; } ];
-    name = "Oliver Hagenauer";
-  };
   mpcsh = {
     email = "m@mpc.sh";
     github = "mpcsh";
@@ -19501,12 +19291,6 @@
     githubId = 15896005;
     name = "Vladyslav Burzakovskyy";
   };
-  mroboff = {
-    email = "mark.roboff@bluecircuit.ai";
-    github = "mroboff";
-    githubId = 81203001;
-    name = "Mark Roboff";
-  };
   mrsmoer = {
     email = "mrsmoer@protonmail.com";
     github = "MrSmoer";
@@ -20684,12 +20468,6 @@
     githubId = 70602908;
     github = "nikolaizombie1";
   };
-  nikp123 = {
-    name = "nikp123";
-    email = "nikp123@e.email";
-    github = "nikp123";
-    githubId = 4696350;
-  };
   nikstur = {
     email = "nikstur@outlook.com";
     name = "nikstur";
@@ -20941,12 +20719,6 @@
     githubId = 41154684;
     name = "nokazn";
   };
-  nolight132 = {
-    email = "contact@nolight.dev";
-    github = "nolight132";
-    githubId = 71591964;
-    name = "Pavel Olizko";
-  };
   nolith = {
     github = "nolith";
     githubId = 78752;
@@ -21173,12 +20945,6 @@
     githubId = 1839979;
     name = "Niklas Thörne";
   };
-  ntsk = {
-    email = "ntsk@ntsk.jp";
-    github = "ntsk";
-    githubId = 5681281;
-    name = "ntsk";
-  };
   nudelsalat = {
     email = "nudelsalat@clouz.de";
     name = "Fabian Dreßler";
@@ -21964,12 +21730,6 @@
     githubId = 4908217;
     name = "Paho Lurie-Gregg";
   };
-  paige = {
-    email = "paigely@tuta.io";
-    github = "ssalggnikool";
-    githubId = 235818692;
-    name = "paige";
-  };
   pakhfn = {
     email = "pakhfn@gmail.com";
     github = "pakhfn";
@@ -22999,6 +22759,12 @@
     githubId = 4201956;
     name = "pongo1231";
   };
+  poopsicles = {
+    name = "Fumnanya";
+    email = "fmowete@outlook.com";
+    github = "dibenzepin";
+    githubId = 87488715;
+  };
   PopeRigby = {
     name = "PopeRigby";
     github = "poperigby";
@@ -23727,13 +23493,6 @@
     github = "rachalaraj";
     githubId = 124191100;
   };
-  rachitvrma = {
-    name = "Rachit Kumar Verma";
-    email = "rachitverma1122+nixpkgs@gmail.com";
-    matrix = "@rachitvrma:matrix.org";
-    github = "rachitvrma";
-    githubId = 155641117;
-  };
   RadxaYuntian = {
     # This is the work account for @MakiseKurisu
     name = "ZHANG Yuntian";
@@ -24042,12 +23801,6 @@
     name = "Roland Conybeare";
     keys = [ { fingerprint = "bw5Cr/4ul1C2UvxopphbZbFI1i5PCSnOmPID7mJ/Ogo"; } ];
   };
-  rdk31 = {
-    email = "nixpkgs@rdk31.com";
-    github = "rdk31";
-    githubId = 16737959;
-    name = "rdk31";
-  };
   rdnetto = {
     email = "rdnetto@gmail.com";
     github = "rdnetto";
@@ -24071,12 +23824,6 @@
       { fingerprint = "01D7 5486 3A6D 64EA AC77 0D26 FBF1 9A98 2CCE 0048"; }
     ];
   };
-  recutita = {
-    name = "Katsumi Takeuchi";
-    email = "contact@recutita.com";
-    github = "recutita";
-    githubId = 137286929;
-  };
   redfish64 = {
     email = "engler@gmail.com";
     github = "redfish64";
@@ -24374,12 +24121,6 @@
     githubId = 6047658;
     name = "Ryan Horiguchi";
   };
-  rhousand = {
-    email = "rhousand@gmail.com";
-    github = "rhousand";
-    githubId = 6124540;
-    name = "Ryan Housand";
-  };
   rhydianjenkins = {
     name = "Rhydian Jenkins";
     github = "RhydianJenkins";
@@ -26191,6 +25932,12 @@
     githubId = 5512096;
     name = "Sébastien Guimmara";
   };
+  shackra = {
+    name = "Jorge Javier Araya Navarro";
+    email = "jorge@esavara.cr";
+    github = "shackra";
+    githubId = 1055216;
+  };
   shadaj = {
     github = "shadaj";
     githubId = 543055;
@@ -26743,12 +26490,6 @@
     githubId = 848812;
     name = "Stephan Jau";
   };
-  sjcobb = {
-    email = "sjcobb2003@gmail.com";
-    github = "sjcobb2022";
-    githubId = 68509699;
-    name = "sjcobb";
-  };
   sjfloat = {
     email = "steve+nixpkgs@jonescape.com";
     github = "sjfloat";
@@ -26768,12 +26509,6 @@
     githubId = 617130;
     keys = [ { fingerprint = "C4F7 46C7 B560 38D8 210F  0288 5877 DEE9 7428 557F"; } ];
   };
-  skirlez = {
-    name = "skirlez";
-    email = "skirlez3@gmail.com";
-    github = "skirlez";
-    githubId = 17904548;
-  };
   skohtv = {
     name = "Skoh";
     email = "contact@skoh.dev";
@@ -27446,18 +27181,18 @@
     name = "Steven Allen";
     keys = [ { fingerprint = "327B 20CE 21EA 68CF A774  8675 7C92 3221 5899 410C"; } ];
   };
+  steeleduncan = {
+    email = "steeleduncan@hotmail.com";
+    github = "steeleduncan";
+    githubId = 866573;
+    name = "Duncan Steele";
+  };
   steell = {
     email = "steve@steellworks.com";
     github = "Steell";
     githubId = 1699155;
     name = "Steve Elliott";
   };
-  stefanboca = {
-    email = "stefan.r.boca@gmail.com";
-    github = "stefanboca";
-    githubId = 45266795;
-    name = "Stefan Boca";
-  };
   stefanfehrenbach = {
     email = "stefan.fehrenbach@gmail.com";
     github = "fehrenbach";
@@ -27576,12 +27311,6 @@
     githubId = 4340859;
     name = "Stian Lågstad";
   };
-  stig = {
-    email = "stig@circleci.com";
-    github = "stig";
-    githubId = 45407;
-    name = "Stig Brautaset";
-  };
   StijnDW = {
     email = "nixdev@rinsa.eu";
     github = "Stekke";
@@ -29369,11 +29098,6 @@
     githubId = 47905926;
     name = "toyboot4e";
   };
-  tpansino = {
-    name = "Tom Pansino";
-    github = "tpansino";
-    githubId = 2768420;
-  };
   tphanir = {
     github = "tphanir";
     name = "phani";
@@ -29785,11 +29509,6 @@
     githubId = 12422133;
     name = "Chromo-residuum-opec";
   };
-  ui-1 = {
-    name = "ui-1";
-    github = "ui-1";
-    githubId = 134524800;
-  };
   uku3lig = {
     name = "uku";
     email = "hi@uku.moe";
@@ -31161,13 +30880,6 @@
     githubId = 1595132;
     name = "Kranium Gikos Mendoza";
   };
-  WOnder93 = {
-    email = "omosnacek@gmail.com";
-    github = "WOnder93";
-    githubId = 3041388;
-    matrix = "@omos:fedora.im";
-    name = "Ondrej Mosnáček";
-  };
   workflow = {
     email = "4farlion@gmail.com";
     github = "workflow";
@@ -31479,12 +31191,6 @@
     githubId = 3028542;
     name = "Guillermo NWDD";
   };
-  xoconoch = {
-    email = "github@cordovault.com";
-    github = "xoconoch";
-    githubId = 93692082;
-    name = "Xoconoch";
-  };
   xokdvium = {
     email = "sergei@zimmerman.foo";
     github = "xokdvium";
@@ -32103,12 +31809,6 @@
     githubId = 3449926;
     name = "David Costa";
   };
-  ZariTen = {
-    email = "ZaritenProt@proton.me";
-    github = "ZariTen";
-    githubId = 48529745;
-    name = "ZariTen";
-  };
   zatm8 = {
     email = "maxis1191@gmail.com";
     github = "mourogurt";
@@ -32207,11 +31907,6 @@
     githubId = 39456023;
     name = "Mike Yim";
   };
-  zeusec = {
-    name = "Cole";
-    github = "zeusec";
-    githubId = 65095161;
-  };
   zevisert = {
     email = "dev@zevisert.ca";
     github = "zevisert";

maintainers/scripts/kde/collect-licenses.sh

@@ -25,11 +25,6 @@ for k in "${!sources[@]}"; do
     mkdir "$TMPDIR/$k"
     tar -C "$TMPDIR/$k" -xf "${sources[$k]}"
 
-    if [ "$k" == "kdenlive" ]; then
-        echo "[kdenlive] Applying horrible hack"
-        rm -rf "$TMPDIR/$k/"*"/data/lumas"
-    fi
-
     (cd "$TMPDIR/$k"; reuse lint --json) | jq --arg name "$k" '{$name: .summary.used_licenses | sort}' -c > "$TMPDIR/$k.json"
 done
 

maintainers/scripts/kde/utils.py

@@ -91,13 +91,13 @@ class KDERepoMetadata:
         return {p.name: p for p in self.projects}
 
     @functools.cached_property
-    def projects_by_repo(self):
-        return {p.repo_path: p for p in self.projects}
+    def projects_by_path(self):
+        return {p.project_path: p for p in self.projects}
 
     def try_lookup_package(self, path):
         if path in IGNORE:
             return None
-        project = self.projects_by_repo.get(path)
+        project = self.projects_by_path.get(path)
         if project is None and path not in WARNED:
             WARNED.add(path)
             print(f"Warning: unknown project {path}")
@@ -109,7 +109,7 @@ class KDERepoMetadata:
             Project.from_yaml(metadata_file)
             for metadata_file in repo_metadata.glob("projects-invent/**/metadata.yaml")
         ] + [
-            Project(id, None, project_path, project_path)
+            Project(id, None, project_path, None)
             for project_path, id in THIRD_PARTY.items()
         ]
 
@@ -125,11 +125,11 @@ class KDERepoMetadata:
         dep_graph = collections.defaultdict(set)
 
         if unstable:
-            spec_name = "kde-dependencies-latest-kf6"
+            spec_name = "dependency-data-kf6-qt6"
         else:
-            spec_name = "kde-dependencies-stable-kf6"
+            spec_name = "dependency-data-stable-kf6-qt6"
 
-        spec_path = repo_metadata / "kde-dependencies" / spec_name
+        spec_path = repo_metadata / "dependencies" / spec_name
         for line in spec_path.open():
             line = line.strip()
             if line.startswith("#"):

maintainers/scripts/luarocks-packages.csv

@@ -23,7 +23,6 @@ digestif,,,,,5.3,
 dkjson,,,,,,
 enet,,,,,,ulysseszhan
 etlua,,,,,,ulysseszhan
-fallo,,,,,,mrcjkb
 fennel,,,,,,misterio77
 fidget.nvim,,,,,5.1,mrcjkb
 fifo,,,,,,

maintainers/scripts/nixpkgs-lint.nix

@@ -10,9 +10,6 @@ stdenv.mkDerivation {
   pname = "nixpkgs-lint";
   version = "1";
 
-  __structuredAttrs = true;
-  strictDeps = true;
-
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [
     perl
@@ -23,20 +20,16 @@ stdenv.mkDerivation {
   dontBuild = true;
 
   installPhase = ''
-    runHook preInstall
-
     mkdir -p $out/bin
     cp ${./nixpkgs-lint.pl} $out/bin/nixpkgs-lint
     # make the built version hermetic
     substituteInPlace  $out/bin/nixpkgs-lint \
       --replace-fail "#! /usr/bin/env nix-shell" "#! ${lib.getExe perl}"
     wrapProgram $out/bin/nixpkgs-lint --set PERL5LIB $PERL5LIB
-
-    runHook postInstall
   '';
 
   meta = {
-    description = "Utility for Nixpkgs contributors to check Nixpkgs for common errors";
+    description = "A utility for Nixpkgs contributors to check Nixpkgs for common errors";
     mainProgram = "nixpkgs-lint";
     platforms = lib.platforms.unix;
   };

maintainers/team-list.nix

@@ -91,6 +91,10 @@ with lib.maintainers;
     shortName = "Blockchains";
   };
 
+  boot-security = {
+    github = "boot-security";
+  };
+
   budgie = {
     members = [
       bobby285271
@@ -402,7 +406,6 @@ with lib.maintainers;
       GaetanLepage
       natsukium
       thomasjm
-      haansn08
     ];
     scope = "Maintain Jupyter and related packages.";
     shortName = "Jupyter";
@@ -711,6 +714,7 @@ with lib.maintainers;
 
   sage = {
     members = [
+      timokau
       raskin
       collares
     ];

nixos/doc/manual/development/running-nixos-tests.section.md

@@ -59,6 +59,6 @@ To make this path available, set the following option:
 
 ```nix
 {
-  nix.settings.extra-sandbox-paths = [ "/dev/net" ];
+  nix.settings.sandbox-paths = [ "/dev/net" ];
 }
 ```

nixos/doc/manual/development/settings-options.section.md

@@ -291,17 +291,10 @@ have a predefined type and string generator already declared under
     and returning a set with JSON-specific attributes `type` and
     `generate` as specified [below](#pkgs-formats-result).
 
-`pkgs.formats.yaml` { *`tags`* ? false }
+`pkgs.formats.yaml` { }
 
-:   A function taking an attribute set with values
-
-    `tags`
-
-    :   A boolean for controlling whether YAML tags can be generated.
-        If set, attribute sets with a single key that starts with a "!"
-        will be interpreted as a YAML tag.
-
-    It returns a set with YAML-specific attributes `type` and
+:   A function taking an empty attribute set (for future extensibility)
+    and returning a set with YAML-specific attributes `type` and
     `generate` as specified [below](#pkgs-formats-result).
 
 `pkgs.formats.ini` { *`listsAsDuplicateKeys`* ? false, *`listToValue`* ? null, \.\.\. }
@@ -402,7 +395,7 @@ have a predefined type and string generator already declared under
 
     `mkRaw pythonCode`
 
-    :   Outputs the given string as raw Python code. Note that the final result will be stripped of any comments.
+    :   Outputs the given string as raw Python code
 
     `_imports`
 

nixos/doc/manual/development/state-revision.section.md

@@ -1,57 +0,0 @@
-# State revision {#sec-state-revision}
-
-NixOS includes a {option}`system.stateVersion` option, used by some modules for a
-variety of reasons related to non-backward-compatible changes to software or
-the module itself.
-Module authors are discouraged from adding new uses of
-{option}`system.stateVersion` to their module.
-
-However, when the alternatives are impractical, modules that wish to consume
-{option}`system.stateVersion` should instead define their own `stateRevision`
-option using `utils.mkStateRevisionOption`.
-There should be no uses of `config.system.stateVersion` directly in the module.
-
-(Note the name difference: the {option}`system.stateVersion` option, with a V,
-takes a value that looks like "YY.MM".
-A `stateRevision` option, with an R, takes a non-negative integer value.)
-
-Modules should also add the value of their `stateRevision` option to
-`system.moduleStateRevisions."your.module.stateRevision"`, when the module is
-enabled.
-This is a purely informative option that exists to help describe the effects of
-changing {option}`system.stateVersion`.
-
-Example:
-
-```nix
-{
-  lib,
-  config,
-  utils,
-  ...
-}:
-let
-  cfg = config.services.whatever;
-in
-{
-  options.services.whatever = {
-    enable = lib.mkEnableOption "whatever, a service that does whatever";
-    stateRevision = utils.mkStateRevisionOption {
-      descriptionName = "the whatever service";
-      migrations = {
-        "26.05" = "Rename `/var/lib/old_name` to `/var/lib/new_name`.";
-      };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    systemd.services.whatever = {
-      # ...
-      serviceConfig.StateDirectory = if cfg.stateRevision < 1 then "old_name" else "new_name";
-    };
-
-    # Important: this is inside the `lib.mkIf cfg.enable`
-    system.moduleStateRevisions."services.whatever.stateRevision" = cfg.stateRevision;
-  };
-}
-```

nixos/doc/manual/development/writing-modules.chapter.md

@@ -220,5 +220,4 @@ importing-modules.section.md
 replace-modules.section.md
 freeform-modules.section.md
 settings-options.section.md
-state-revision.section.md
 ```

nixos/doc/manual/installation/upgrading.chapter.md

@@ -41,22 +41,8 @@ supported stable release.
 When you first install NixOS, you're automatically subscribed to the
 NixOS channel that corresponds to your installation source. For
 instance, if you installed from a 26.05 ISO, you will be subscribed to
-the `nixos-26.05` channel.
-
-Commands below are prefixed with `#` and have to be run as root in a
-login shell:
-
-```ShellSession
-$ sudo -i
-```
-
-Without `sudo`:
-
-```ShellSession
-$ su -
-```
-
-To see which NixOS channel you're subscribed to, run:
+the `nixos-26.05` channel. To see which NixOS channel you're subscribed
+to, run the following as root:
 
 ```ShellSession
 # nix-channel --list | grep nixos
@@ -98,15 +84,9 @@ by running
 which is equivalent to the more verbose `nix-channel --update nixos; nixos-rebuild switch`.
 
 ::: {.note}
-Channels are set per user. `nix-channel` reads and writes
-`$HOME/.nix-channels`, so it acts on the channels of whoever owns the
-current `$HOME`. A login shell sets `$HOME` to `/root`, which is why the
-commands above act on root's channels — the ones
-`/etc/nixos/configuration.nix` uses.
-
-Plain `sudo` and `su` keep your own `$HOME`. `nix-channel --list` then
-lists your own channels, and prints nothing when you have none.
-`nix-channel --add` adds the channel for your user alone.
+Channels are set per user. This means that running `nix-channel --add`
+as a non root user (or without sudo) will not affect
+configuration in `/etc/nixos/configuration.nix`
 :::
 
 ::: {.warning}

nixos/doc/manual/preface.md

@@ -7,5 +7,5 @@ Additional information regarding the Nix package manager and the Nixpkgs project
 If you encounter problems, please report them on the [`Discourse`](https://discourse.nixos.org), the [Matrix room](https://matrix.to/#/%23nix:nixos.org), or on the [`#nixos` channel on Libera.Chat](irc://irc.libera.chat/#nixos). Alternatively, consider [contributing to this manual](#chap-contributing). Bugs should be reported in [NixOS’ GitHub issue tracker](https://github.com/NixOS/nixpkgs/issues).
 
 ::: {.note}
-Commands prefixed with `#` have to be run as root.
+Commands prefixed with `#` have to be run as root, either requiring to login as root user or temporarily switching to it using `sudo` for example.
 :::

nixos/doc/manual/redirects.json

@@ -253,9 +253,6 @@
   "sec-override-nixos-test": [
     "index.html#sec-override-nixos-test"
   ],
-  "sec-state-revision": [
-    "index.html#sec-state-revision"
-  ],
   "sec-wireless-declarative": [
     "index.html#sec-wireless-declarative"
   ],

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -464,7 +464,7 @@
 
 - `services.pds` has been renamed to `services.bluesky-pds`.
 
-- `services.pfix-srsd` now automatically integrates with the local Postfix instance, when enabled. This behavior can disabled using the `services.pfix-srsd.configurePostfix` option.
+- `services.pfix-srsd` now automatically integrates with the local Postfix instance, when enabled. This behavior can disabled using the [services.pfix-srsd.configurePostfix](#opt-services.pfix-srsd.configurePostfix) option.
 
 - `services.postsrsd` now automatically integrates with the local Postfix instance, when enabled. This behavior can disabled using the [services.postsrsd.configurePostfix](#opt-services.postsrsd.configurePostfix) option.
 

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -28,20 +28,10 @@
   firewall, is available through
   [services.portmaster](#opt-services.portmaster.enable).
 
-- [btrfs-heatmap](https://github.com/knorrie/btrfs-heatmap), setcap wrapper for `btrfs-heatmap` package, a visualizer of how a btrfs filesystem is using the underlying disk space of the block devices. Available as [programs.btrfs-heatmap](#opt-programs.btrfs-heatmap.enable)
-
-- [compsize](https://github.com/kilobyte/compsize), setcap wrapper for `compsize` package, a cli utility to to inspect compression type/ratio on BTRFS filesystems. Available as [programs.compsize](#opt-programs.compsize.enable)
-
 - [tranquil](https://tangled.org/tranquil.farm/tranquil-pds) is an ATProto PDS (personal data server) implementation in Rust. A featureful, spec conscious and community driven alternative to the Bluesky reference implementation PDS. Available as [services.tranquil-pds](#opt-services.tranquil-pds.enable).
 
-- [Cardwire](https://github.com/OpenGamingCollective/cardwire), a GPU manager for Linux that uses eBPF+LSM hooks to control GPUs. Available as [services.cardwired](#opt-services.cardwired.enable).
-
 - [Moonlight Qt](https://moonlight-stream.org/), a client for playing your PC games on almost any device. Available as [programs.moonlight-qt](#opt-programs.moonlight-qt.enable).
 
-- [udp514-journal](https://github.com/eworm-de/udp514-journal), a service to forward remote syslog messages to systemd-journal. Available as [services.udp514-journal](#opt-services.udp514-journal.enable).
-
-- [RomM](https://romm.app/), a self-hosted ROM manager and player. Available as [services.romm](#opt-services.romm.enable).
-
 - [scx_loader](https://github.com/sched-ext/scx-loader), a system daemon and DBus-based loader for sched_ext schedulers. `scxctl` is the command-line client for interacting with the loader, allowing users to switch schedulers, modes, and arguments dynamically. Available as [services.scx-loader](#opt-services.scx-loader.enable)
 
 - [tap](https://github.com/bluesky-social/indigo/tree/main/cmd/tap), an ATProtocol firehose synchronisation utility. Available as [services.tap](#opt-services.tap.enable).
@@ -60,20 +50,14 @@
 
 - [Stump](https://www.stumpapp.dev/), a free and open source comics, manga and digital book server with OPDS support. Available as [services.stump](#opt-services.stump.enable).
 
-- [P2Pool](https://github.com/SChernykh/p2pool), a decentralized mining pool for Monero. Available as [services.p2pool](#opt-services.p2pool.enable).
-
 - [Freescout](https://freescout.net/), a free, open source Helpdesk and shared mailbox. Available as [services.freescout](#opt-services.freescout.enable).
 
 - [Lix TOML remote builders](https://docs.lix.systems/manual/lix/stable/advanced-topics/distributed-builds.html#using-a-toml-configuration), remote builder configuration using lix's TOML format. Available as [lix.buildMachines](#opt-lix.buildMachines). Note: incompatible with `nix.buildMachines`.
 
-- [Forgejo Runner](https://forgejo.org/docs/latest/admin/actions/), a daemon for Forgejo Actions. Available as [services.forgejo-runner](#opt-services.forgejo-runner.instances).
-
 - [Koito](https://koito.io/), a modern, themeable scrobbler that you can use with any program that scrobbles to a custom ListenBrainz URL. Available as [services.koito](#opt-services.koito.enable).
 
 - [Zapret2](https://github.com/bol-van/zapret2), an extensible DPI bypass program. Available as [services.zapret2](#opt-services.zapret2.enable).
 
-- [Solaar](https://github.com/pwr-Solaar/Solaar), a program to control logitech devices.
-
 - [FlapAlerted](https://github.com/Kioubit/FlapAlerted), detects BGP flapping events and provides statistics based on BGP update messages. Available as [services.flap-alerted](#opt-services.flap-alerted.enable).
 
 - [gocron](https://github.com/flohoss/gocron), a task scheduler with web interface. Available as [services.gocron](#opt-services.gocron.enable).
@@ -84,16 +68,10 @@
 
 - [Matrix Authentication Service](https://github.com/element-hq/matrix-authentication-service) is an OAuth2.0 and OpenID Connect provider for Matrix homeservers (such as Synapse). It replaces standard password authentication with modern OpenID Connect flows, and can delegate authentication to upstream OIDC providers. Available as [services.matrix-authentication-service](#opt-services.matrix-authentication-service.enable).
 
-- [Krill](https://nlnetlabs.nl/projects/krill/about), RPKI CA and Publication Server written in Rust. Available as [services.krill](#opt-services.krill.enable).
-
-- [vellum](https://github.com/greyxp1/vellum) is a live screen annotation overlay for Wayland. Available as [programs.vellum](#opt-programs.vellum.enable).
-
 - [stash-clipboard](https://github.com/NotAShelf/stash), a Wayland clipboard "manager" with fast persistent history and multi-media support. Available as [services.stash-clipboard](#opt-services.stash-clipboard.enable).
 
 - [OO7](https://github.com/linux-credentials/oo7) is a desktop-agnostic Secret Service provider. Available as [services.oo7](#opt-services.oo7.enable)
 
-- [rosec](https://github.com/jmylchreest/rosec), a secrets daemon implementing the freedesktop.org Secret Service API with modular backend providers. It can automatically unlock the user's vault on login via PAM. Available as [services.rosec](#opt-services.rosec.enable).
-
 - [NordVPN](https://github.com/NordSecurity/nordvpn-linux), a NordVPN client for linux. Available as [services.nordvpn](options.html#opt-services.nordvpn.enable).
 
 - [RNSD](https://reticulum.network/), the Reticulum Network Stack Daemon. It provides a secure and efficient way to communicate over the Reticulum Network. Available as [services.rnsd](#opt-services.rnsd.enable).
@@ -102,14 +80,6 @@
 
 - [Entropy](https://github.com/ergohaven/entropy), a configurator for programmable keyboards and input devices running Vial-QMK/RMK firmware. Available as [programs.entropy](#opt-programs.entropy.enable).
 
-- [Kvrocks](https://kvrocks.apache.org/), a distributed key value NoSQL database compatible with the Redis protocol. Available as [services.kvrocks](#opt-services.kvrocks.enable).
-
-- [kvrocks_exporter](https://github.com/RocksLabs/kvrocks_exporter), a Prometheus exporter for Kvrocks metrics. Available as [services.prometheus.exporters.kvrocks](#opt-services.prometheus.exporters.kvrocks.enable).
-
-- [Umbriel](https://docs.noctalia.dev/umbriel/), a Wayland compositor built on wlroots and SceneFX. Available as [programs.umbriel](#opt-programs.umbriel.enable).
-
-- [Rundeck](https://www.rundeck.com), Self-Service Operations [services.rundeck](#opt-services.rundeck.enable).
-
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -144,8 +114,6 @@
 
 - Rustical migrates from `settings.http.host` and `settings.http.port` to `settings.http.bind` to support UNIX domain sockets as well as TCP sockets in one setting.
 
-- The `jetty_11` package has been removed as it reached end of life. Use `jetty_12` instead.
-
 - The Mullvad VPN service now has a separate toggle to enable the Mullvad VPN graphical user interface. If you have previously used Mullvad on a desktop by setting `services.mullvad-vpn.package` to `pkgs.mullvad-vpn`, you should now **unset that option**, and enable `services.mullvad-vpn.gui.enable`. The VPN will not work if `services.mullvad-vpn.package` is set to `pkgs.mullvad-vpn`, as `pkgs.mullvad-vpn` no longer contains the Mullvad Daemon; please ensure that `services.mullvad-vpn.package` is set to `pkgs.mullvad`, regardless if you plan to enable the graphical user interface or not.
 
 - A number of options for `services.llama-cpp` have been removed in favor of the structured [](#opt-services.llama-cpp.settings) option, attributes from which are used as arguments to `llama-server` executable, you can see all available options by running `llama-server --help`. Configuring model presets using Nix attribute set via `services.llama-cpp.modelsPreset` is no longer supported, please use `services.llama-cpp.settings.models-preset` with a path to an INI file containing desired options.
@@ -172,12 +140,8 @@
 
 - String values passed to `services.phpfpm.settings`, `services.phpfpm.pools.<name>.phpEnv`, and `services.phpfpm.pools.<name>.settings` are now properly quoted and escaped, except for the `${}` syntax that is left as-is. If you are manually escaping these values, please adjust accordingly.
 
-- GitLab has been updated from 18.x to 19.x and requires PostgreSQL >= 17, as stated in the [documentation](https://docs.gitlab.com/19.1/install/requirements/#postgresql). Check the [upgrade guide](#module-services-postgres-upgrading) in the NixOS manual on how to upgrade your PostgreSQL installation.
-
 - `services.gitlab.registry` has been modified so that the GitLab container registry runs in the `gitlab-container-registry` system user. This behavior can be modified with the `services.gitlab.registry.user` option.
 
-- `fail2ban` has been updated to 1.1.1, which has a few breaking changes compared to 1.1.0 ([changelog](https://github.com/fail2ban/fail2ban/blob/1.1.1/ChangeLog))
-
 - `systemd.user.extraConfig` has been removed in favor of the structured [](#opt-systemd.user.settings.Manager) option. Use `systemd.user.settings.Manager` to set any `systemd-user.conf(5)` option directly. For example, replace `systemd.user.extraConfig = "DefaultTimeoutStartSec=60";` with `systemd.user.settings.Manager.DefaultTimeoutStartSec = 60;`.
 
 - `matrix-appservice-discord` was removed from nixpkgs along with its NixOS module (`services.matrix-appservice-discord`) as it is no longer actively maintained upstream. Use the actively-maintained puppeting bridge [`mautrix-discord`](#opt-services.mautrix-discord.enable) instead.
@@ -188,33 +152,18 @@
 
 - `services.firezone.server.provision` has been removed due to it being unmaintanable. Remove all uses of provisioning and use the WebUI to configure firezone.
 
-- `security.unprivilegedUsernsClone` has been removed. The option controls a sysctl only provided by the removed -hardened kernels. The removal should only affect users running custom hardened kernels.
-  Disabling user-namespace is possible by setting `boot.kernel.sysctl."user.max_user_namespaces"` to zero, but not generally advised, as browsers, like firefox and chrome, and many other user tools use namespaces for sandboxing.
-
 - The `services.syncthing` module now updates the Syncthing REST API using partial updates (`PATCH`) instead of full replacements (`PUT`) for general settings. Updating these settings was broken and prone to errors after updates, see [#428808](https://github.com/NixOS/nixpkgs/issues/428808) and [#528889](https://github.com/NixOS/nixpkgs/issues/528889). As a result, settings modified manually through the Syncthing Web UI that are not explicitly defined in your Nix configuration will now persist across rebuilds.
 
 - `services.plantuml-server.packages.jetty` now supports `jetty_12`, it no longer supports `jetty_11`.
 
 - `services.komodo-periphery` has been updated to support version 2.0.0. Some options have been renamed to match the new configuration structure; compatibility aliases are provided for the renamed options. The `passkeys` and `outbound.onboardingKey` options have been removed; use `passkeyFiles`, `auth.privateKey`/`auth.corePublicKeys`, or `outbound.onboardingKeyFile` instead. New outbound mode configuration is available under `outbound.*`.
 
-- `services.pfix-srsd` and the supporting `pfixtools` package have been removed, as the project is dormant and does not support pcre2.  `services.postsrsd` is the recommended replacement for Sender Rewriting Scheme support with Postfix.
-
-- `services.quake3-server.port` has been removed in favor of the structured [](#opt-services.quake3-server.settings.net_port) option. Use `services.quake3-server.settings.net_port` to set any custom UDP port directly.
-
 - Package `overseerr` has been removed as the `overseerr` and `jellyseerr` projects were merged under `seerr`.
 
-- The papra NixOS module is now hardening the systemd unit by default. If this breaks any of the configured directories, please reconfigure them through `services.papra.environment` to enable sandbox passthrough.
-
 - `slskd` has been updated to v0.25.0, which renames the `global` option to `transfers`. Please review the [changelog](https://github.com/slskd/slskd/releases#release-0.25.0).
 
 - [firefox-syncserver.database.type](#opt-services.firefox-syncserver.database.type) no longer defaults to `"mysql"`. You must now explicitly choose between `"mysql"` and `"postgresql"`. New deployments should prefer PostgreSQL.
 
-- `chatgpt` has been retargeted to OpenAI's new ChatGPT desktop app, while the previous app has been renamed to `chatgpt-classic`.
-
-- NetBox was updated to `>= 4.6.8`. Have a look at the breaking changes
-  of the [4.6 release](https://github.com/netbox-community/netbox/releases/tag/v4.6.0),
-  make the required changes to your database, if needed, then upgrade by setting `services.netbox.package = pkgs.netbox_4_6;` in your configuration.
-
 ## Other Notable Changes {#sec-release-26.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -226,8 +175,6 @@
 - `temporal` has been updated to the 1.31 release line. Always consult the [upstream upgrade
   notes](https://docs.temporal.io/self-hosted-guide/upgrade-server) before upgrading between versions.
 
-- The Xen Project Hypervisor has been [updated to version 4.22](https://wiki.xenproject.org/wiki/Xen_Project_4.22_Release_Notes), after [version 4.21](https://wiki.xenproject.org/wiki/Xen_Project_4.21_Release_Notes) was skipped in 26.05. The module now has a separate option to customise the OCaml-based Xen Store Daemon package, `virtualisation.xen.store.package`.
-
 - The `shell_interact()` function on interactive runs of NixOS VM tests has been deprecated. Use the SSH backdoor instead.
 
 - NixOS VM tests now prefer to express durations and timeouts as `datetime.timedelta` values instead of bare numbers. Methods such as `machine.wait_until_succeeds`, `machine.sleep`, `retry`, and `polling_condition` now accept a `timedelta` (e.g., `machine.wait_for_unit("sshd.service", timeout=datetime.timedelta(minutes=1))`). Passing an `int`/`float` as seconds still works but now emits a deprecation warning. Argument names that explicitly defined units were preserved but have had `timedelta` equivalents introduced (`timeout_seconds` → `timeout`, `secs` → `duration`, `seconds_interval` → `interval`).
@@ -258,14 +205,10 @@
 
 - `services.nginx` gained a [`lua`](#opt-services.nginx.lua.enable) option to enable Lua scripting via OpenResty's lua-nginx-module on a stock nginx, configuring `lua_package_path`/`lua_package_cpath` from the packages listed in [`services.nginx.lua.extraPackages`](#opt-services.nginx.lua.extraPackages). Use this to add Lua to a regular nginx; for the full OpenResty platform (libraries that rely on its bundled lualib, such as `lua-resty-openidc`), set `services.nginx.package` to `pkgs.openresty` instead — the option configures the Lua search path for it too.
 
-- `services.nginx.virtualHosts.<name>.locations.<name>` gained a new `useGrpcErrorPages` option. If enabled, it sets up error pages that are valid gRPC messages. This is useful if you proxy gRPC and want to emit errors from nginx, for example when adding authentication on top.
-
 - `security.polkit.settings` added for RFC42 style configuration of the polkitd daemon.
 
 - `boot.supportedFilesystems.ntfs` installs `ntfsprogs-plus` instead of `ntfs3g` on kernel version 7.1 and later, unless `boot.supportedFilesystems.ntfs-3g` is explicitly enabled.
 
-- `services.i2pd` has been refactored to take [RFC42](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md)-compliant `settings`. In order to migrate, you will need to move existing config under `settings` and rename them in accordance with the [upstream config format](https://docs.i2pd.website/en/latest/user-guide/configuration/#available-options). In addition, `inTunnels` and `outTunnels` needs to be renamed to `serverTunnels` and `clientTunnels` respectively.
-
 - The `programs.fuse` module, which provides the `fusermount3` executable and the `/etc/fuse.conf` config file, is now opt-in. The obligation to enable it has been shifted to its various consumers (e.g. gvfs, flatpak, appimage, sshfs). This can break fuse consumers at runtime, that don't explicitly declare that dependency with a module, e.g the mounting functionality in various backup tools (borg, restic, rclone, ...).
 
 - `services.plausible` can now again seed an initial admin user declaratively via [`services.plausible.adminUser.email`](#opt-services.plausible.adminUser.email).
@@ -274,10 +217,6 @@
 
 - `services.gitlab.registry` now uses PostgreSQL as database storage for new installations and supports old installations that use the filesystem as metadata storage. It creates the required PostgreSQL database and user. Users can manually migrate their filesystem based metadata storage. See [GitLab Container Registry Migration to database metadata store](#module-services-gitlab-registry-database-migration).
 
-- `services.fail2ban` now supports systemd socket activation via `fail2ban.socket`
-
-- Enabling [`services.userborn`](#opt-services.userborn.enable) on a system that was previously managed by the default `update-users-groups.pl` script now imports the legacy state from `/var/lib/nixos/` on the first switch. Locked stub entries are added to `/etc/passwd` and `/etc/group` for every name recorded in `uid-map`/`gid-map` that no longer has a live entry, so a previously-used UID/GID cannot be reassigned to a different user. Subordinate id ranges recorded in `auto-subuid-map` are seeded into the subid files as well. If the import fails, userborn does not start and the user database is left untouched. Inspect `journalctl -u userborn-import-legacy.service`, fix or remove the legacy state, and switch again. The import can be skipped entirely with [`services.userborn.importLegacyState`](#opt-services.userborn.importLegacyState)` = false`.
-
 - The `newuidmap` and `newgidmap` security wrappers are now installed with `cap_setuid`/`cap_setgid` file capabilities instead of the setuid-root bit, matching shadow's `--with-fcaps` install mode and other major distributions. Rootless containers (podman, docker-rootless, unprivileged user namespaces) are unaffected. The only behavioural change is that mapping host uid 0 via `/etc/subuid` (which NixOS never configures by default) additionally requires `cap_setfcap`; users who explicitly grant uid 0 in a subuid range can restore the previous behaviour with `security.wrappers.newuidmap.capabilities = lib.mkForce "cap_setuid,cap_setfcap+ep";`.
 
 - The `authelia` module now uses systemd's `LoadCredential` to load all files defined in `secrets`. As such, these files no longer need to be readable by the authelia user and group: they can for example be set to be only readable by the root user.
@@ -294,5 +233,3 @@
 - `trilium-desktop` and `trilium-server` have been updated to 0.104.0. This release includes security hardening fixes that may break functionality. [See upstream release note for details](https://github.com/TriliumNext/Trilium/releases/tag/v0.104.0).
 
 - `nix` now supports running in "daemonless" mode by setting `nix.daemon.enable = false`. Under this mode all store operations must go through the [local store type](https://nix.dev/manual/nix/latest/store/types/local-store), which typically requires root permissions.
-
-- [Hister](https://github.com/asciimoo/hister), a web history service offering blazing fast, content-based search across visited websites. Available as [services.hister](#opt-services.hister.enable).

nixos/lib/make-iso9660-image.nix

@@ -6,7 +6,7 @@
   xorriso,
   syslinux,
   libossp_uuid,
-  squashfs-tools,
+  squashfsTools,
 
   # The file name of the resulting ISO image.
   isoName ? "cd.iso",

nixos/lib/make-squashfs.nix

@@ -1,7 +1,7 @@
 {
   lib,
   stdenv,
-  squashfs-tools,
+  squashfsTools,
   closureInfo,
 
   fileName ? "squashfs",
@@ -31,7 +31,7 @@ stdenv.mkDerivation {
   # to the closure that was used to build it
   unsafeDiscardReferences.out = true;
 
-  nativeBuildInputs = [ squashfs-tools ];
+  nativeBuildInputs = [ squashfsTools ];
 
   buildCommand = ''
     closureInfo=${closureInfo { rootPaths = storeContents; }}

nixos/lib/test-driver/default.nix

@@ -60,7 +60,7 @@ buildPythonApplication {
     util-linux
     vde2
   ]
-  ++ lib.optionals stdenv.hostPlatform.isLinux [
+  ++ lib.optionals stdenv.isLinux [
     vhost-device-vsock
   ]
   ++ lib.optionals enableNspawn [

nixos/lib/test-driver/src/test_driver/machine/__init__.py

@@ -1809,16 +1809,15 @@ class NspawnMachine(BaseMachine):
 
         # 1. Wait for the directory to actually be created by the container
         self.log(f"Waiting for journal at {journal_path}...")
-        warn_after = 10
+        max_attempts = 10
         attempts = 0
-        while not journal_path.exists():
-            if proc.poll() is not None:
-                self.log(f"Error: Journal directory {journal_path} never appeared.")
-                return
+        while not journal_path.exists() and attempts < max_attempts:
             time.sleep(1)
             attempts += 1
-            if attempts == warn_after:
-                self.log(f"Still waiting for journal at {journal_path}...")
+
+        if not journal_path.exists():
+            self.log(f"Error: Journal directory {journal_path} never appeared.")
+            return
 
         # 2. Start the journalctl process
         # Using a loop here handles cases where journalctl might exit unexpectedly

nixos/lib/testing/meta.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  lib,
-  options,
-  ...
-}:
+{ lib, options, ... }:
 let
   inherit (lib) types mkOption literalMD;
 
@@ -31,7 +26,7 @@ in
       '';
       apply = lib.filterAttrs (k: v: v != null);
       type = types.submodule (
-        { options, ... }:
+        { options, config, ... }:
         {
           options = {
             maintainers = mkOption {
@@ -76,10 +71,7 @@ in
             };
             platforms = mkOption {
               type = types.listOf types.raw;
-              default = lib.platforms.linux ++ lib.optionals (config.containers == { }) lib.platforms.darwin;
-              defaultText = literalMD ''
-                `lib.platforms.linux ++ lib.platforms.darwin` when no containers are configured; otherwise `lib.platforms.linux`.
-              '';
+              default = lib.platforms.linux ++ lib.platforms.darwin;
               description = ''
                 Sets the [`meta.platforms`](https://nixos.org/manual/nixpkgs/stable/#var-meta-platforms) attribute on the [{option}`test`](#test-opt-test) derivation.
               '';

nixos/lib/testing/run.nix

@@ -35,7 +35,8 @@ let
     options = {
       devnet = mkOption {
         type = types.bool;
-        default = containers != { } && nodes != { };
+        default =
+          builtins.length (lib.attrNames containers) > 0 && builtins.length (lib.attrNames nodes) > 0;
         defaultText = lib.literalMD "`true` if both VMs and containers are present.";
         description = ''
           This heuristic setting that assumes that the majority of tests requires VMs and containers
@@ -51,14 +52,14 @@ let
       };
       uid-range = mkOption {
         type = types.bool;
-        default = containers != { };
+        default = builtins.length (lib.attrNames containers) > 0;
         defaultText = lib.literalMD "`true` if containers are present.";
         description = "Containers use systemd-nspawn, which requires pid 0 inside of the sandbox. `uid-range` enables that.";
       };
       kvm = mkOption {
         type = types.bool;
-        default = isLinux && nodes != { };
-        defaultText = lib.literalMD "`true` if built to run on Linux and any virtual machines are specified.";
+        default = isLinux;
+        defaultText = lib.literalMD "`true` if built to run on Linux.";
         description = "Whether Linux KVM virtualization is required when running this test. Can be disabled to allow emulated execution.";
       };
       apple-virt = mkOption {

nixos/lib/testing/testScript.nix

@@ -7,22 +7,27 @@ testModuleArgs@{
   ...
 }:
 let
-  inherit (lib) mkOption types const;
-  inherit (types) coercedTo lines functionTo;
+  inherit (lib) mkOption types;
+  inherit (types) either str functionTo;
 in
 {
   options = {
     testScript = mkOption {
-      type = coercedTo lines const (functionTo lines);
-      # Only pass args the testScript function expects.
-      apply = v: args: v (builtins.intersectAttrs (lib.functionArgs v) args);
+      type = either str (functionTo str);
+      apply =
+        v:
+        if lib.isFunction v then
+          # Only pass args the testScript function expects.
+          args: v (builtins.intersectAttrs (lib.functionArgs v) args)
+        else
+          v;
       description = ''
         A series of python declarations and statements that you write to perform
         the test.
       '';
     };
     testScriptString = mkOption {
-      type = lines;
+      type = str;
       readOnly = true;
       internal = true;
     };
@@ -45,19 +50,23 @@ in
     withoutTestScriptReferences.includeTestScriptReferences = false;
     withoutTestScriptReferences.testScript = lib.mkForce "testscript omitted";
 
-    testScriptString = config.testScript {
-      nodes = lib.mapAttrs (
-        k: v:
-        if v.virtualisation.useNixStoreImage then
-          # prevent infinite recursion when testScript would
-          # reference v's toplevel
-          config.withoutTestScriptReferences.nodesCompat.${k}
-        else
-          # reuse memoized config
-          v
-      ) config.nodesCompat;
-      containers = config.containers;
-    };
+    testScriptString =
+      if lib.isFunction config.testScript then
+        config.testScript {
+          nodes = lib.mapAttrs (
+            k: v:
+            if v.virtualisation.useNixStoreImage then
+              # prevent infinite recursion when testScript would
+              # reference v's toplevel
+              config.withoutTestScriptReferences.nodesCompat.${k}
+            else
+              # reuse memoized config
+              v
+          ) config.nodesCompat;
+          containers = config.containers;
+        }
+      else
+        config.testScript;
 
     nodeDefaults =
       { config, name, ... }:

nixos/lib/utils.nix

@@ -6,10 +6,8 @@
 
 let
   inherit (lib)
-    all
     any
     attrNames
-    concatImapStringsSep
     concatMapStringsSep
     concatStringsSep
     elem
@@ -29,11 +27,8 @@ let
     isList
     isPath
     isString
-    length
     listToAttrs
-    literalMD
     mapAttrs
-    mkOption
     nameValuePair
     optionalString
     removePrefix
@@ -41,10 +36,8 @@ let
     splitString
     stringToCharacters
     types
-    versionOlder
     ;
 
-  inherit (lib.lists) findFirstIndex;
   inherit (lib.strings) toJSON escapeC;
 in
 
@@ -611,122 +604,6 @@ let
         lib.listToAttrs
       ];
     };
-
-    /**
-      Creates a per-module `stateRevision` option that takes an int value, with a
-      default that is derived from `system.stateVersion`.
-
-      # Inputs
-
-      `descriptionName`
-      : A human-friendly name for your module, used for the description of the
-        created option.
-
-      `migrations`
-      : Attribute set that maps from values of `system.stateVersion`
-        (representing the breakpoints at which the default value of this option
-        will change) to Markdown instructions to users for manually migrating
-        their data to this breakpoint. The migration instructions will be
-        included in the NixOS documentation for this option. (These instructions
-        must only contain Markdown inlines, because they will be rendered as
-        items in an ordered list. In particular, nested lists will not render
-        correctly.)
-
-        `migrations` will also be exposed as an attribute on the result.
-
-      # Examples
-      :::{.example}
-      ## `lib.options.mkStateRevisionOption` usage example
-
-      ```nix
-      exampleModule =
-        { lib, config, utils, ... }:
-        {
-          options.services.whatever = {
-            stateRevision = utils.mkStateRevisionOption {
-              descriptionName = "the whatever service";
-              migrations = {
-                "26.05" = "Rename `/var/lib/old_name` to `/var/lib/new_name`.";
-                "26.11" = "Run the `upgrade_whatever` utility.";
-                };
-              };
-            };
-          };
-        }
-
-      (pkgs.nixos [
-        exampleModule
-        { system.stateVersion = "25.11"; }
-      ]).config.services.whatever.stateRevision # => 0
-      (pkgs.nixos [
-        exampleModule
-        { system.stateVersion = "26.05"; }
-      ]).config.services.whatever.stateRevision # => 1
-      (pkgs.nixos [
-        exampleModule
-        { system.stateVersion = "27.05"; }
-      ]).config.services.whatever.stateRevision # => 2
-      ```
-
-      :::
-
-      Modules should use this function when they change how data managed by the
-      module is persisted on the system between NixOS releases.
-
-      The default value of the option will be the number of attributes in the
-      `migrations` parameter with name less than or equal to the value of
-      `system.stateVersion`.
-
-      When using this function, don't forget to add the option's value to
-      `system.moduleStateRevisions."your.module.stateRevision"` when your module is
-      enabled.
-    */
-    mkStateRevisionOption =
-      {
-        descriptionName,
-        migrations,
-      }:
-      let
-        versions = attrNames migrations;
-        maxVal = length versions;
-      in
-      assert all (v: builtins.match "[0-9]{2}\\.[0-9]{2}" v != null) versions;
-      mkOption {
-        type = types.ints.between 0 maxVal;
-        description = ''
-          This option versions the format of state persisted by
-          ${descriptionName}. Its default value depends on the value of
-          {option}`system.stateVersion`.
-
-          Users who wish to increment this option will need to take manual
-          migration steps to preserve their data. **If you perform these
-          migrations, rolling back to an older generation will require also
-          reversing the migrations to the state expected by that generation.**
-          The migrations needed to advance to each value of this option are as
-          follows (perform all instructions after the row for the current
-          `stateRevision`, up to and including the row for the new
-          `stateRevision`):
-
-          0. (none)
-          ${concatImapStringsSep "\n" (
-            v: sv: "${toString v}. ${replaceStrings [ "\n" ] [ " " ] migrations.${sv}}"
-          ) versions}
-
-          Note that you do **not** need to change {option}`system.stateVersion`
-          in order to update this option. {option}`system.stateVersion` only
-          determines the default value of this option. Most users should not
-          change {option}`system.stateVersion` at all.
-        '';
-        default = findFirstIndex (versionOlder config.system.stateVersion) maxVal versions;
-        defaultText = literalMD ''
-          If {option}`system.stateVersion` is:
-          ${concatImapStringsSep "\n" (v: sv: "* <${sv}: ${toString (v - 1)}") versions}
-          * otherwise: ${toString maxVal}
-        '';
-      }
-      // {
-        inherit migrations;
-      };
   };
 in
 utils

nixos/modules/config/users-groups.nix

@@ -842,7 +842,7 @@ in
       users.users = {
         root = {
           uid = ids.uids.root;
-          description = mkDefault "System administrator";
+          description = "System administrator";
           home = "/root";
           shell = mkDefault cfg.defaultUserShell;
           group = "root";
@@ -850,7 +850,7 @@ in
         nobody = {
           uid = ids.uids.nobody;
           isSystemUser = true;
-          description = mkDefault "Unprivileged account (don't use!)";
+          description = "Unprivileged account (don't use!)";
           group = "nogroup";
         };
       };

nixos/modules/hardware/all-hardware.nix

@@ -109,10 +109,6 @@ in
       "pata_qdi"
       "pata_winbond"
     ]
-    ++ lib.optionals (lib.versionAtLeast config.boot.kernelPackages.kernel.version "7.2") [
-      # xhci-pci defers AMD 800-series chipset controllers to this driver.
-      "xhci_pci_prom21"
-    ]
     ++ lib.optionals platform.isx86 [ "vmw_balloon" ]
     ++ lib.optionals (pkgs.stdenv.hostPlatform.isi686 || pkgs.stdenv.hostPlatform.isx86_64) [
       "vmw_vmci"

nixos/modules/hardware/logitech.nix

@@ -19,8 +19,8 @@ in
       [ "hardware" "logitech" "wireless" "enable" ]
     )
     (lib.mkRenamedOptionModule
+      [ "hardware" "logitech" "enableGraphical" ]
       [ "hardware" "logitech" "wireless" "enableGraphical" ]
-      [ "programs" "solaar" "enable" ]
     )
   ];
 
@@ -56,11 +56,20 @@ in
 
     wireless = {
       enable = lib.mkEnableOption "support for Logitech Wireless Devices";
+
+      enableGraphical = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Enable graphical support applications.";
+      };
     };
   };
 
   config = lib.mkIf (cfg.wireless.enable || cfg.lcd.enable) {
-    environment.systemPackages = lib.optional cfg.wireless.enable pkgs.ltunify;
+    environment.systemPackages =
+      [ ]
+      ++ lib.optional cfg.wireless.enable pkgs.ltunify
+      ++ lib.optional cfg.wireless.enableGraphical pkgs.solaar;
 
     services.udev = {
       # ltunifi and solaar both provide udev rules but the most up-to-date have been split

nixos/modules/hardware/video/nvidia.nix

@@ -482,7 +482,7 @@ in
               combineIcdPkgs =
                 icd: pkgs:
                 pkgs.symlinkJoin {
-                  name = "nvidia-egl-external-platforms${lib.optionalString pkgs.stdenv.hostPlatform.is32bit "-x32"}";
+                  name = "nvidia-egl-external-platforms${lib.optionalString pkgs.stdenv.is32bit "-x32"}";
                   paths = lib.attrVals icd pkgs;
                   # Remediate reversed priorities in pre-595 drivers,
                   # https://github.com/NixOS/nixpkgs/pull/497342#issuecomment-4034876793

nixos/modules/i18n/input-method/fcitx5.nix

@@ -9,16 +9,6 @@ let
   cfg = imcfg.fcitx5;
   fcitx5Package = pkgs.qt6Packages.fcitx5-with-addons.override { inherit (cfg) addons; };
   settingsFormat = pkgs.formats.ini { };
-  mkKeyValue = lib.generators.mkKeyValueDefault {
-    mkValueString =
-      v:
-      if true == v then
-        "True"
-      else if false == v then
-        "False"
-      else
-        lib.generators.mkValueStringDefault { } v;
-  } "=";
 in
 {
   options = {
@@ -141,13 +131,10 @@ in
           };
       in
       lib.attrsets.mergeAttrsList [
-        (optionalFile "config" (lib.generators.toINI { inherit mkKeyValue; }) cfg.settings.globalOptions)
-        (optionalFile "profile" (lib.generators.toINI { inherit mkKeyValue; }) cfg.settings.inputMethod)
+        (optionalFile "config" (lib.generators.toINI { }) cfg.settings.globalOptions)
+        (optionalFile "profile" (lib.generators.toINI { }) cfg.settings.inputMethod)
         (lib.concatMapAttrs (
-          name: value:
-          optionalFile "conf/${name}.conf" (lib.generators.toINIWithGlobalSection {
-            inherit mkKeyValue;
-          }) value
+          name: value: optionalFile "conf/${name}.conf" (lib.generators.toINIWithGlobalSection { }) value
         ) cfg.settings.addons)
       ];
 

nixos/modules/image/repart-image.nix

@@ -17,7 +17,7 @@
   dosfstools,
   mtools,
   e2fsprogs,
-  squashfs-tools,
+  squashfsTools,
   erofs-utils,
   btrfs-progs,
   xfsprogs,
@@ -104,7 +104,7 @@ let
       mtools
     ];
     "ext4" = [ e2fsprogs.bin ];
-    "squashfs" = [ squashfs-tools ];
+    "squashfs" = [ squashfsTools ];
     "erofs" = [ erofs-utils ];
     "btrfs" = [ btrfs-progs ];
     "xfs" = [ xfsprogs ];

nixos/modules/installer/sd-card/sd-image.nix

@@ -400,7 +400,7 @@ in
         # Figure out device names for the boot device and root filesystem.
         rootPart=$(${lib.getExe' pkgs.util-linux "findmnt"} -n -o SOURCE /)
         bootDevice=$(${lib.getExe' pkgs.util-linux "lsblk"} -npo PKNAME $rootPart)
-        partNum=$(${lib.getExe' pkgs.util-linux "lsblk"} -npo PARTN $rootPart)
+        partNum=$(${lib.getExe' pkgs.util-linux "lsblk"} -npo MAJ:MIN $rootPart | ${lib.getExe pkgs.gawk} -F: '{print $2}')
 
         # Resize the root partition and the filesystem to fit the disk
         echo ",+," | ${lib.getExe' pkgs.util-linux "sfdisk"} -N$partNum --no-reread $bootDevice

nixos/modules/installer/tools/nixos-generate-config.pl

@@ -206,10 +206,10 @@ sub pciCheck {
          $device eq "0x4222" || $device eq "0x4227");
 
     # Intel NPU driver
-    # list taken from linux(v7.1): drivers/accel/ivpu/ivpu_drv.h
+    # list taken from linux(v6.18): drivers/accel/ivpu/ivpu_drv.h
     if ($vendor eq "0x8086" &&
-        ($device eq "0x7d1d" || $device eq "0xad1d" || $device eq "0x643e" ||
-         $device eq "0xb03e" || $device eq "0xfd3e" || $device eq "0xd71d"))
+        ($device eq "0xfd3e" || $device eq "0x7d1d" || $device eq "0xad1d" ||
+         $device eq "0x643e" || $device eq "0xb03e"))
     {
         push @attrs, "hardware.cpu.intel.npu.enable = true;";
     }

nixos/modules/misc/ids.nix

@@ -194,7 +194,7 @@ in
       redmine = 147;
       #seeks = 148; # removed 2020-06-21
       prosody = 149;
-      # i2pd = 150; # dynamically allocated as of 2026-08-07
+      i2pd = 150;
       systemd-coredump = 151;
       systemd-network = 152;
       systemd-resolve = 153;
@@ -534,7 +534,7 @@ in
       redmine = 147;
       #seeks = 148; # removed 2020-06-21
       prosody = 149;
-      # i2pd = 150; # dynamically allocated as of 2026-08-07
+      i2pd = 150;
       systemd-network = 152;
       systemd-resolve = 153;
       systemd-timesync = 154;

nixos/modules/misc/nixpkgs.nix

@@ -2,51 +2,12 @@
   config,
   options,
   lib,
-  pkgs,
   ...
 }:
 let
   cfg = config.nixpkgs;
   opt = options.nixpkgs;
 
-  isConfig = x: builtins.isAttrs x || lib.isFunction x;
-
-  optCall = f: x: if lib.isFunction f then f x else f;
-
-  mergeConfig =
-    lhs_: rhs_:
-    let
-      lhs = optCall lhs_ { inherit lib pkgs; };
-      rhs = optCall rhs_ { inherit lib pkgs; };
-    in
-    lib.recursiveUpdate lhs rhs
-    // lib.optionalAttrs (lhs ? allowUnfreePackages) {
-      allowUnfreePackages = lhs.allowUnfreePackages ++ (lib.attrByPath [ "allowUnfreePackages" ] [ ] rhs);
-    }
-    // lib.optionalAttrs (lhs ? packageOverrides) {
-      packageOverrides =
-        pkgs:
-        optCall lhs.packageOverrides pkgs // optCall (lib.attrByPath [ "packageOverrides" ] { } rhs) pkgs;
-    }
-    // lib.optionalAttrs (lhs ? perlPackageOverrides) {
-      perlPackageOverrides =
-        pkgs:
-        optCall lhs.perlPackageOverrides pkgs
-        // optCall (lib.attrByPath [ "perlPackageOverrides" ] { } rhs) pkgs;
-    };
-
-  configType = lib.mkOptionType {
-    name = "nixpkgs-config";
-    description = "nixpkgs config";
-    check =
-      x:
-      let
-        traceXIfNot = c: if c x then true else lib.traceSeqN 1 x false;
-      in
-      traceXIfNot isConfig;
-    merge = args: lib.foldr (def: mergeConfig def.value) { };
-  };
-
   overlayType = lib.mkOptionType {
     name = "nixpkgs-overlay";
     description = "nixpkgs overlay";
@@ -73,6 +34,8 @@ let
     ++ lib.optional (opt.localSystem.highestPrio < (lib.mkOptionDefault { }).priority) opt.localSystem
     ++ lib.optional (opt.crossSystem.highestPrio < (lib.mkOptionDefault { }).priority) opt.crossSystem;
 
+  _configDefinitions = opt.config.definitionsWithLocations;
+
   defaultPkgs =
     if opt.hostPlatform.isDefined then
       let
@@ -90,14 +53,21 @@ let
       in
       import ../../.. (
         {
-          inherit (cfg) config overlays;
+          inherit _configDefinitions;
+          inherit (cfg) overlays;
+          # Explicitly set config to prevent impure.nix from filling it
+          # from the NIXPKGS_CONFIG environment variable.
+          config = { };
         }
         // systemArgs
       )
     else
       import ../../.. {
+        inherit _configDefinitions;
+        # Explicitly set config to prevent impure.nix from filling it
+        # from the NIXPKGS_CONFIG environment variable.
+        config = { };
         inherit (cfg)
-          config
           overlays
           localSystem
           crossSystem
@@ -165,7 +135,15 @@ in
       example = lib.literalExpression ''
         { allowBroken = true; allowUnfree = true; }
       '';
-      type = configType;
+      type = lib.types.deferredModuleWith {
+        staticModules = [
+          { _module.args.docPrefix = "https://nixos.org/manual/nixpkgs/unstable/"; }
+          ../../../pkgs/top-level/config.nix
+        ];
+      };
+      # Returns pkgs.config instead of nixpkgs.config
+      # This shadows the deferredModule to make it look like a submodule
+      apply = _: finalPkgs.config;
       description = ''
         Global configuration for Nixpkgs.
         The complete list of [Nixpkgs configuration options](https://nixos.org/manual/nixpkgs/unstable/#sec-config-options-reference) is in the [Nixpkgs manual section on global configuration](https://nixos.org/manual/nixpkgs/unstable/#chap-packageconfig).
@@ -406,7 +384,7 @@ in
           '';
         }
         {
-          assertion = opt.pkgs.isDefined -> cfg.config == { };
+          assertion = opt.pkgs.isDefined -> opt.config.highestPrio == (lib.mkOptionDefault null).priority;
           message = ''
             Your system configures nixpkgs with an externally created instance.
             `nixpkgs.config` options should be passed when creating the instance instead.

nixos/modules/misc/version.nix

@@ -254,30 +254,6 @@ in
       '';
     };
 
-    moduleStateRevisions = mkOption {
-      type =
-        let
-          baseType = types.attrsOf types.ints.unsigned;
-          isStateRevisionOption = x: lib.isOption x && x ? migrations;
-        in
-        types.addCheck baseType (
-          attrs:
-          builtins.all (
-            attrPath: isStateRevisionOption (lib.attrByPath (lib.splitString "." attrPath) null options)
-          ) (builtins.attrNames attrs)
-        )
-        // {
-          description = "${baseType.description}, in which every attribute name is the path to an option created with mkStateRevisionOption";
-        };
-      default = { };
-      internal = true;
-      description = ''
-        NixOS modules should set attributes on this option. Users should leave
-        it alone. Future tooling may use it to determine the consequences of
-        updating {option}`system.stateVersion`.
-      '';
-    };
-
     configurationRevision = mkOption {
       type = types.nullOr types.str;
       default = null;

nixos/modules/module-list.nix

@@ -185,7 +185,6 @@
   ./programs/bcc.nix
   ./programs/benchexec.nix
   ./programs/browserpass.nix
-  ./programs/btrfs-heatmap.nix
   ./programs/calls.nix
   ./programs/captive-browser.nix
   ./programs/ccache.nix
@@ -197,7 +196,6 @@
   ./programs/cnping.nix
   ./programs/comma.nix
   ./programs/command-not-found/command-not-found.nix
-  ./programs/compsize.nix
   ./programs/coolercontrol.nix
   ./programs/corefreq.nix
   ./programs/cpu-energy-meter.nix
@@ -295,7 +293,6 @@
   ./programs/npm.nix
   ./programs/ns-usbloader.nix
   ./programs/nushell.nix
-  ./programs/nvrs.nix
   ./programs/nxdumpclient.nix
   ./programs/oblogout.nix
   ./programs/obs-studio.nix
@@ -328,7 +325,6 @@
   ./programs/skim.nix
   ./programs/slock.nix
   ./programs/sniffnet.nix
-  ./programs/solaar.nix
   ./programs/soundmodem.nix
   ./programs/ssh.nix
   ./programs/starship.nix
@@ -350,9 +346,7 @@
   ./programs/tsm-client.nix
   ./programs/turbovnc.nix
   ./programs/udevil.nix
-  ./programs/upki.nix
   ./programs/usbtop.nix
-  ./programs/vellum.nix
   ./programs/vim.nix
   ./programs/virt-manager.nix
   ./programs/vivid.nix
@@ -372,7 +366,6 @@
   ./programs/wayland/pinnacle.nix
   ./programs/wayland/river.nix
   ./programs/wayland/sway.nix
-  ./programs/wayland/umbriel.nix
   ./programs/wayland/uwsm.nix
   ./programs/wayland/waybar.nix
   ./programs/wayland/wayfire.nix
@@ -525,7 +518,6 @@
   ./services/continuous-integration/buildbot/master.nix
   ./services/continuous-integration/buildbot/worker.nix
   ./services/continuous-integration/buildkite-agents.nix
-  ./services/continuous-integration/forgejo-runner.nix
   ./services/continuous-integration/gitea-actions-runner.nix
   ./services/continuous-integration/github-runners.nix
   ./services/continuous-integration/gitlab-runner/runner.nix
@@ -555,7 +547,6 @@
   ./services/databases/hbase-standalone.nix
   ./services/databases/influxdb2.nix
   ./services/databases/influxdb.nix
-  ./services/databases/kvrocks.nix
   ./services/databases/lldap.nix
   ./services/databases/memcached.nix
   ./services/databases/monetdb.nix
@@ -647,7 +638,6 @@
   ./services/display-managers/greetd.nix
   ./services/display-managers/lemurs.nix
   ./services/display-managers/ly.nix
-  ./services/display-managers/noctalia-greeter.nix
   ./services/display-managers/plasma-login-manager.nix
   ./services/display-managers/regreet.nix
   ./services/display-managers/sddm.nix
@@ -687,7 +677,6 @@
   ./services/hardware/bolt.nix
   ./services/hardware/brltty.nix
   ./services/hardware/buffyboard.nix
-  ./services/hardware/cardwired.nix
   ./services/hardware/ddccontrol.nix
   ./services/hardware/deepcool-digital-linux.nix
   ./services/hardware/dell-bios-fan-control.nix
@@ -784,7 +773,6 @@
   ./services/logging/syslog-ng.nix
   ./services/logging/syslogd.nix
   ./services/logging/SystemdJournal2Gelf.nix
-  ./services/logging/udp514-journal.nix
   ./services/logging/ulogd.nix
   ./services/logging/vector.nix
   ./services/mail/automx2.nix
@@ -807,6 +795,7 @@
   ./services/mail/offlineimap.nix
   ./services/mail/opendkim.nix
   ./services/mail/opensmtpd.nix
+  ./services/mail/pfix-srsd.nix
   ./services/mail/postfix-tlspol.nix
   ./services/mail/postfix.nix
   ./services/mail/postgrey.nix
@@ -1297,7 +1286,6 @@
   ./services/networking/knot-resolver.nix
   ./services/networking/knot.nix
   ./services/networking/kresd.nix
-  ./services/networking/krill.nix
   ./services/networking/lambdabot.nix
   ./services/networking/legit.nix
   ./services/networking/libreswan.nix
@@ -1321,7 +1309,6 @@
   ./services/networking/mmsd.nix
   ./services/networking/modemmanager.nix
   ./services/networking/monero.nix
-  ./services/networking/moonshine.nix
   ./services/networking/mosquitto.nix
   ./services/networking/mozillavpn.nix
   ./services/networking/mptcpd.nix
@@ -1384,7 +1371,6 @@
   ./services/networking/opkssh/opkssh.nix
   ./services/networking/ostinato.nix
   ./services/networking/owamp.nix
-  ./services/networking/p2pool.nix
   ./services/networking/pangolin.nix
   ./services/networking/pdns-recursor.nix
   ./services/networking/pdnsd.nix
@@ -1577,7 +1563,6 @@
   ./services/security/physlock.nix
   ./services/security/pocket-id.nix
   ./services/security/reaction.nix
-  ./services/security/rosec.nix
   ./services/security/shibboleth-sp.nix
   ./services/security/sks.nix
   ./services/security/spire/agent.nix
@@ -1723,7 +1708,6 @@
   ./services/web-apps/haven.nix
   ./services/web-apps/healthchecks.nix
   ./services/web-apps/hedgedoc.nix
-  ./services/web-apps/hister.nix
   ./services/web-apps/hledger-web.nix
   ./services/web-apps/homebox.nix
   ./services/web-apps/homer.nix
@@ -1821,10 +1805,8 @@
   ./services/web-apps/remark42.nix
   ./services/web-apps/reposilite.nix
   ./services/web-apps/rimgo.nix
-  ./services/web-apps/romm.nix
   ./services/web-apps/rss-bridge.nix
   ./services/web-apps/rsshub.nix
-  ./services/web-apps/rundeck.nix
   ./services/web-apps/rustical.nix
   ./services/web-apps/rutorrent.nix
   ./services/web-apps/screego.nix

nixos/modules/programs/atuin.nix

@@ -60,7 +60,7 @@ in
       description = ''
         Configuration written to {file}`/etc/atuin/config.toml`.
 
-        See <https://docs.atuin.sh/latest/configuration/config/> for the full list
+        See <https://docs.atuin.sh/configuration/config/> for the full list
         of options.
       '';
     };
@@ -99,7 +99,7 @@ in
         {file}`/etc/atuin/themes/theme-name.toml`
         where the name of each attribute is the theme-name
 
-        See <https://docs.atuin.sh/latest/guide/theming/> for the full list
+        See <https://docs.atuin.sh/guide/theming/> for the full list
         of options.
       '';
       default = { };

nixos/modules/programs/benchexec.nix

@@ -86,6 +86,9 @@ in
     programs = {
       cpu-energy-meter.enable = lib.mkDefault true;
     };
+
+    # See <https://github.com/sosy-lab/benchexec/blob/3.18/doc/INSTALL.md#kernel-requirements>.
+    security.unprivilegedUsernsClone = true;
   };
 
   meta.maintainers = with lib.maintainers; [ lorenzleutgeb ];