stdenv-bootstrap-tools: Fix lib*_asneeded problem on gcc16 (#545658)

(texlive-bin-big is not a real attribute, but it does not appear to be
actually exposed as an attribute. we're building this as a dependency of
`texlivePackages.texlive-scripts`.)

autoconf 2.72 has a bug where AC_PROG_CXX would reject c++20 compilers,
and attempts to switch to c++98 or c++11 instead of using the compiler's
default. when using gcc 16, which defaults to c++20, this causes
texlive-bin-big to be built with c++20, causing issues with some of the
included icu4c headers. this bug was fixed in autoconf 2.73, so we
regenerate the autoconf declarations with the newest version of autconf
(currently 2.73). once the configure scripts distributed with the source
are regenerated with autoconf 2.73+, the `reautoconf` call should be
removed.

.editorconfig

@@ -23,15 +23,15 @@ insert_final_newline = false
 
 # see https://nixos.org/nixpkgs/manual/#chap-conventions
 
-[*.{bash,css,js,json,lock,md,nix,pl,pm,py,rb,sh,ts,xml}]
+[*.{bash,css,js,json,lock,md,nix,pl,pm,py,rb,sh,xml}]
 indent_style = space
 
 # Match docbook files, set indent width of one
 [*.xml]
 indent_size = 1
 
-# Match js/json/lockfiles/markdown/nix/ruby/ts files, set indent width of two
-[*.{js,json,lock,md,nix,rb,ts}]
+# Match json/lockfiles/markdown/nix/ruby files, set indent width of two
+[*.{js,json,lock,md,nix,rb}]
 indent_size = 2
 
 # Match all the Bash code in Nix files, set indent width of two
@@ -79,7 +79,7 @@ indent_size = unset
 trim_trailing_whitespace = true
 
 # binaries
-[*.{nib,torrent}]
+[*.nib]
 end_of_line = unset
 insert_final_newline = unset
 trim_trailing_whitespace = unset

.gitattributes

@@ -62,6 +62,3 @@ ci/OWNERS linguist-language=CODEOWNERS
 # patching CRLF line endings from an upstream source package.
 *.diff !text !eol
 *.patch !text !eol
-
-# Torrent files are binary files and should not be re-encoded.
-*.torrent !text !eol

.github/actions/checkout/action.yml

@@ -13,7 +13,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+    - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
       env:
         MERGED_SHA: ${{ inputs.merged-as-untrusted-at }}
         TARGET_SHA: ${{ inputs.target-as-trusted-at }}

.github/dependabot.yml

@@ -1,9 +1,7 @@
 version: 2
 updates:
   - package-ecosystem: "github-actions"
-    directories:
-      - "/"
-      - ".github/actions/*/*"
+    directory: "/"
     schedule:
       interval: "weekly"
     labels: []

.github/labeler.yml

@@ -43,6 +43,14 @@
               - .github/**/*
               - ci/**/*.*
 
+"6.topic: coq":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - pkgs/applications/science/logic/coq/**/*
+              - pkgs/development/coq-modules/**/*
+              - pkgs/top-level/coq-packages.nix
+
 "6.topic: COSMIC":
   - any:
       - changed-files:
@@ -458,18 +466,6 @@
           - any-glob-to-any-file:
               - pkgs/development/rocm-modules/**/*
 
-"6.topic: rocq":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/applications/science/logic/coq/**/*
-              - pkgs/applications/science/logic/rocq-core/**/*
-              - pkgs/build-support/coq/**/*
-              - pkgs/build-support/rocq/**/*
-              - pkgs/development/rocq-modules/**/*
-              - pkgs/top-level/coq-packages.nix
-              - pkgs/top-level/rocq-packages.nix
-
 "6.topic: ruby":
   - any:
       - changed-files:

.github/workflows/backport.yml

@@ -39,8 +39,6 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ github.event.pull_request.head.sha }}
-          # Avoid materializing full nixpkgs tree
-          sparse-checkout: .
           token: ${{ steps.app-token.outputs.token }}
           persist-credentials: true
 

.github/workflows/bot.yml

@@ -49,7 +49,7 @@ jobs:
             ci/github-script
 
       - name: Install dependencies
-        run: npm ci --package-lock-only=false --no-audit @actions/artifact bottleneck
+        run: npm ci --package-lock-only=false @actions/artifact bottleneck
         working-directory: ci/github-script
 
       # Use a GitHub App, because it has much higher rate limits: 12,500 instead of 5,000 req / hour.
@@ -76,8 +76,7 @@ jobs:
           github-token: ${{ steps.app-token.outputs.token || github.token }}
           retries: 3
           script: |
-            const { default: bot } = await import('${{ github.workspace }}/ci/github-script/bot.js')
-            await bot({
+            require('./ci/github-script/bot.js')({
               github,
               context,
               core,
@@ -89,7 +88,7 @@ jobs:
           GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
         run: gh api /rate_limit | jq
 
-      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
+      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
         name: Labels from touched files
         if: |
           github.event_name == 'pull_request_target' &&
@@ -99,7 +98,7 @@ jobs:
           configuration-path: .github/labeler.yml # default
           sync-labels: true
 
-      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
+      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
         name: Labels from touched files (no sync)
         if: |
           github.event_name == 'pull_request_target' &&
@@ -109,7 +108,7 @@ jobs:
           configuration-path: .github/labeler-no-sync.yml
           sync-labels: false
 
-      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
+      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
         name: Labels from touched files (development branches)
         # Development branches like staging-next, haskell-updates and python-updates get special labels.
         # This is to avoid the mass of labels there, which is mostly useless - and really annoying for

.github/workflows/build.yml

@@ -59,7 +59,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
         with:
           # Sandbox is disabled on MacOS by default.
           extra_nix_config: sandbox = true

.github/workflows/check.yml

@@ -51,7 +51,7 @@ jobs:
             ci/github-script
 
       - name: Install dependencies
-        run: npm ci --package-lock-only=false --no-audit bottleneck
+        run: npm ci --package-lock-only=false bottleneck
         working-directory: trusted/ci/github-script
 
       - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
@@ -76,8 +76,7 @@ jobs:
           github-token: ${{ steps.app-token.outputs.token || github.token }}
           script: |
             const targetsStable = JSON.parse(process.env.TARGETS_STABLE)
-            const { default: commits } = await import('${{ github.workspace }}/trusted/ci/github-script/commits.js')
-            await commits({
+            require('./trusted/ci/github-script/commits.js')({
               github,
               context,
               core,
@@ -122,8 +121,7 @@ jobs:
         with:
           github-token: ${{ steps.app-token.outputs.token || github.token }}
           script: |
-            const { default: checkManualFileEdits } = await import('${{ github.workspace }}/trusted/ci/github-script/manual-file-edits.js')
-            await checkManualFileEdits({
+            require('./trusted/ci/github-script/manual-file-edits.js')({
               github,
               context,
               core,
@@ -136,35 +134,6 @@ jobs:
           GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
         run: gh api /rate_limit | jq
 
-  github-script:
-    runs-on: ubuntu-24.04-arm
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-          sparse-checkout: .github/actions
-
-      - name: Checkout merge and target commits
-        uses: ./.github/actions/checkout
-        with:
-          merged-as-untrusted-at: ${{ inputs.mergedSha }}
-          target-as-trusted-at: ${{ inputs.targetSha }}
-
-      - name: Install dependencies to trusted/
-        run: |
-          npm ci --package-lock-only=false --no-audit
-          echo "$PWD/node_modules/.bin" >> "$GITHUB_PATH"
-        working-directory: nixpkgs/trusted/ci/github-script
-
-      - name: Link trusted/ dependencies to untrusted/
-        run: ln -s "$PWD/trusted/ci/github-script/node_modules" untrusted/ci/github-script/node_modules
-        working-directory: nixpkgs
-
-      - name: Check ci/github-script
-        run: npm test
-        working-directory: nixpkgs/untrusted/ci/github-script
-
   owners:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 5
@@ -173,14 +142,13 @@ jobs:
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
-
       - name: Checkout merge and target commits
         uses: ./.github/actions/checkout
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true

.github/workflows/comment.yml

@@ -43,7 +43,7 @@ jobs:
           github-token: ${{ steps.app-token.outputs.token || github.token }}
           retries: 3
           script: |
-            const { handleMergeComment } = await import('${{ github.workspace }}/ci/github-script/merge.js')
+            const { handleMergeComment } = require('./ci/github-script/merge.js')
             const { body, node_id } = context.payload.comment
 
             await handleMergeComment({

.github/workflows/eval.yml

@@ -139,7 +139,7 @@ jobs:
             core.info(`Found pinned.json commit: ${ciPinBumpCommit}`)
 
       - name: Install Nix
-        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - name: Load supported versions
         id: versions
@@ -187,7 +187,7 @@ jobs:
           target-as-trusted-at: ${{ inputs.targetSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true
@@ -277,7 +277,7 @@ jobs:
           merge-multiple: true
 
       - name: Install Nix
-        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - name: Combine all output paths and eval stats
         run: |
@@ -375,8 +375,7 @@ jobs:
         with:
           github-token: ${{ steps.app-token.outputs.token || github.token }}
           script: |
-            const { checkTargetBranch } = await import('${{ github.workspace }}/nixpkgs/trusted/ci/github-script/check-target-branch.ts')
-            await checkTargetBranch({
+            require('./nixpkgs/trusted/ci/github-script/check-target-branch.js')({
               github,
               context,
               core,
@@ -487,7 +486,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - name: Ensure flake outputs on all systems still evaluate
         run: nix flake check --all-systems --no-build './nixpkgs/untrusted?shallow=1'

.github/workflows/lint.yml

@@ -35,7 +35,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       # TODO: Figure out how to best enable caching for the treefmt job. Cachix won't work well,
       # because the cache would be invalidated on every commit - treefmt checks every file.
@@ -70,7 +70,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true
@@ -100,7 +100,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true
@@ -142,9 +142,9 @@ jobs:
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
-            const { default: checkCommitMessages } = await import('${{ github.workspace }}/trusted/ci/github-script/lint-commits.js')
+            const checkCommitMessages = require('./trusted/ci/github-script/lint-commits.js')
 
-            await checkCommitMessages({
+            checkCommitMessages({
               github,
               context,
               core,

.github/workflows/merge-group.yml

@@ -29,7 +29,7 @@ jobs:
         with:
           persist-credentials: false
           sparse-checkout: |
-            ci/github-script
+            ci/github-script/supportedSystems.js
 
       - id: prepare
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -38,8 +38,8 @@ jobs:
           TARGET_SHA: ${{ inputs.targetSha }}
         with:
           script: |
-            const { classify } = await import('${{ github.workspace }}/ci/github-script/supportedBranches.js')
-            const { default: supportedSystems } = await import('${{ github.workspace }}/ci/github-script/supportedSystems.js')
+            const { classify } = require('./ci/supportedBranches.js')
+            const supportedSystems = require('./ci/github-script/supportedSystems.js')
 
             const baseBranch = (
               context.payload.merge_group?.base_ref ??

.github/workflows/pull-request-target.yml

@@ -64,8 +64,7 @@ jobs:
           #   https://github.com/octokit/plugin-retry.js/blob/9a2443746c350b3beedec35cf26e197ea318a261/src/index.ts#L14
           retry-exempt-status-codes: 400,401,403,404
           script: |
-            const { default: prepare } = await import('${{ github.workspace }}/ci/github-script/prepare.js')
-            await prepare({
+            require('./ci/github-script/prepare.js')({
               github,
               context,
               core,

.github/workflows/review.yml

@@ -40,7 +40,7 @@ jobs:
           github-token: ${{ steps.app-token.outputs.token || github.token }}
           retries: 3
           script: |
-            const { handleMergeComment } = await import('${{ github.workspace }}/ci/github-script/merge.js')
+            const { handleMergeComment } = require('./ci/github-script/merge.js')
 
             // PRs from forks don't have any PRs associated by default.
             // Thus, we request the PR number with an API call *to* the fork's repo.

.github/workflows/teams.yml

@@ -38,7 +38,7 @@ jobs:
             maintainers/github-teams.json
 
       - name: Install dependencies
-        run: npm ci --package-lock-only=false --no-audit bottleneck
+        run: npm ci --package-lock-only=false bottleneck
         working-directory: ci/github-script
 
       - name: Synchronise teams
@@ -46,8 +46,7 @@ jobs:
         with:
           github-token: ${{ steps.app-token.outputs.token }}
           script: |
-            const { default: getTeams } = await import('${{ github.workspace }}/ci/github-script/get-teams.js')
-            await getTeams({
+            require('./ci/github-script/get-teams.js')({
               github,
               context,
               core,
@@ -79,3 +78,4 @@ jobs:
             This is an automated PR to sync the GitHub teams with access to this repository to the `lib.teams` list.
 
             This PR can be merged without taking any further action.
+

.github/workflows/test.yml

@@ -35,8 +35,7 @@ jobs:
           #   https://github.com/octokit/plugin-retry.js/blob/9a2443746c350b3beedec35cf26e197ea318a261/src/index.ts#L14
           retry-exempt-status-codes: 400,401,403,404
           script: |
-            const { default: prepare } = await import('${{ github.workspace }}/ci/github-script/prepare.js')
-            await prepare({
+            require('./ci/github-script/prepare.js')({
               github,
               context,
               core,
@@ -62,11 +61,9 @@ jobs:
               '.github/workflows/lint.yml',
               '.github/workflows/merge-group.yml',
               '.github/workflows/test.yml',
-              'ci/github-script/package.json',
-              'ci/github-script/package-lock.json',
-              'ci/github-script/supportedBranches.js',
               'ci/github-script/supportedSystems.js',
               'ci/pinned.json',
+              'ci/supportedBranches.js',
               'pkgs/top-level/release-supported-systems.json',
             ].includes(file))) core.setOutput('merge-group', true)
 
@@ -80,20 +77,18 @@ jobs:
               '.github/workflows/pull-request-target.yml',
               '.github/workflows/test.yml',
               'ci/github-script/bot.js',
-              'ci/github-script/check-target-branch.ts',
+              'ci/github-script/check-target-branch.js',
               'ci/github-script/commits.js',
               'ci/github-script/get-pr-commit-details.js',
               'ci/github-script/lint-commits.js',
               'ci/github-script/merge.js',
-              'ci/github-script/package.json',
-              'ci/github-script/package-lock.json',
               'ci/github-script/prepare.js',
               'ci/github-script/reviewers.js',
               'ci/github-script/reviews.js',
-              'ci/github-script/supportedBranches.js',
               'ci/github-script/supportedSystems.js',
               'ci/github-script/withRateLimit.js',
               'ci/pinned.json',
+              'ci/supportedBranches.js',
               'pkgs/top-level/release-supported-systems.json',
             ].includes(file))) core.setOutput('pr', true)
 

.mailmap

@@ -6,7 +6,6 @@ Christina Sørensen <christina@cafkafk.com> <christinaafk@gmail.com>
 Christina Sørensen <christina@cafkafk.com> <89321978+cafkafk@users.noreply.github.com>
 Daniel Løvbrøtte Olsen <me@dandellion.xyz> <daniel.olsen99@gmail.com>
 Ethan Carter Edwards <ethan@ethancedwards.com> Ethan Edwards <ethancarteredwards@gmail.com>
-Ethan Carter Edwards <ethan@ethancedwards.com> <ethancedwards8@users.noreply.github.com>
 Fabian Affolter <mail@fabian-affolter.ch> <fabian@affolter-engineering.ch>
 Fiona Behrens <me@kloenk.dev>
 Fiona Behrens <me@kloenk.dev> <me@kloenk.de>

CONTRIBUTING.md

@@ -571,10 +571,7 @@ If a contributor does not want committers to push to their branch, they must unc
 
 ### Release notes
 
-If you add or remove a NixOS module, or make other breaking or significant NixOS changes, write about it in the next NixOS release notes in [`nixos/doc/manual/release-notes`](./nixos/doc/manual/release-notes).
-
-If you make major or breaking changes to a package (other than removal), write about it in the next Nixpkgs release notes in [`doc/release-notes`](./doc/release-notes).
-Package removals should not get a Nixpkgs release note, [a throwing alias should be added instead](./pkgs/README.md#steps-to-remove-a-package-from-nixpkgs).
+If you removed packages or made some major NixOS changes, write about it in the next release notes in [`nixos/doc/manual/release-notes`](./nixos/doc/manual/release-notes).
 
 ### File naming and organisation
 
@@ -587,9 +584,9 @@ CI [enforces](./.github/workflows/lint.yml) all Nix files to be formatted using
 
 You can ensure this locally using either of these commands:
 ```
-nix fmt
-nix develop --command treefmt
 nix-shell --run treefmt
+nix develop --command treefmt
+nix fmt
 ```
 
 If you're starting your editor in `nix-shell` or `nix develop`, you can also set it up to automatically run `treefmt` on save.
@@ -957,6 +954,7 @@ The following situations are fully or partially exempt:
 
 If you believe that someone is using automation without appropriate disclosure and review, you can politely ask them if that’s the case and point them to this policy as appropriate.
 Please assume good faith and remain civil; it’s not always possible to determine, and it is more likely that someone overlooked this policy than deliberately violated it.
+If you think someone is continuing to break the policy after this, please escalate to the [Nixpkgs core team](https://nixos.org/community/teams/nixpkgs-core/) rather than fighting over it.
 
 If a contribution is clearly in violation of the policy (e.g. the contributor admits it was not followed, or there are AI tool attributions that do not meet our required format), it can be closed or hidden, preferably after informing the contributor of the policy and giving them a chance to address the violations.
 Deliberate violations of this policy are considered to break the [Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) clause against “Wasting other people’s time with low quality contributions, including but not limited to LLM and bot spam”.

ci/OWNERS

@@ -199,7 +199,7 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @Artturin @Ericson2314 @lo
 /doc/languages-frameworks/haskell.section.md  @sternenseemann @maralorn @wolfgangwalther
 /maintainers/scripts/haskell                  @sternenseemann @maralorn @wolfgangwalther
 /pkgs/development/compilers/ghc               @sternenseemann @maralorn @wolfgangwalther
-/pkgs/development/compilers/ghc/9.6.6-debian-binary.nix  @sternenseemann @maralorn @wolfgangwalther @OPNA2608 @liberodark @NixOS/loongarch64
+/pkgs/development/compilers/ghc/9.6.6-debian-binary.nix  @sternenseemann @maralorn @wolfgangwalther @OPNA2608
 /pkgs/development/haskell-modules             @sternenseemann @maralorn @wolfgangwalther
 /pkgs/test/haskell                            @sternenseemann @maralorn @wolfgangwalther
 /pkgs/top-level/release-haskell.nix           @sternenseemann @maralorn @wolfgangwalther
@@ -211,7 +211,7 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @Artturin @Ericson2314 @lo
 /pkgs/development/perl-modules      @stigtsp @marcusramberg
 
 # R
-/pkgs/by-name/r/R   @jbedo
+/pkgs/applications/science/math/R   @jbedo
 /pkgs/development/r-modules         @jbedo
 
 # Rust
@@ -263,15 +263,15 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /lib/licenses @alyssais @emilazy @jopejoe1
 
 # Qt
-/pkgs/development/libraries/qt-5 @NixOS/qt-kde
-/pkgs/development/libraries/qt-6 @NixOS/qt-kde
+/pkgs/development/libraries/qt-5 @K900 @NickCao @SuperSandro2000
+/pkgs/development/libraries/qt-6 @K900 @NickCao @SuperSandro2000
 
 # KDE Frameworks 5
-/pkgs/development/libraries/kde-frameworks @NixOS/qt-kde
+/pkgs/development/libraries/kde-frameworks @K900 @NickCao @SuperSandro2000
 
 # KDE / Plasma 6
-/pkgs/kde @NixOS/qt-kde
-/maintainers/scripts/kde @NixOS/qt-kde
+/pkgs/kde @K900 @NickCao @SuperSandro2000
+/maintainers/scripts/kde @K900 @NickCao @SuperSandro2000
 
 # PostgreSQL and related stuff
 /pkgs/by-name/po/postgresqlTestHook @NixOS/postgres
@@ -361,10 +361,7 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/applications/editors/kakoune     @philiptaron
 
 # LuaPackages
-/pkgs/development/interpreters/lua-5  @NixOS/lua
-/pkgs/development/interpreters/luajit @NixOS/lua
 /pkgs/development/lua-modules         @NixOS/lua
-/pkgs/top-level/lua-packages.nix      @NixOS/lua
 
 # Neovim
 /pkgs/applications/editors/neovim           @NixOS/neovim
@@ -393,9 +390,9 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /doc/build-helpers/images/dockertools.section.md @roberth @jhol
 
 # Go
-/doc/languages-frameworks/go.section.md @kalbasit @Mic92
-/pkgs/build-support/go @kalbasit @Mic92
-/pkgs/development/compilers/go @kalbasit @Mic92
+/doc/languages-frameworks/go.section.md @kalbasit @katexochen @Mic92
+/pkgs/build-support/go @kalbasit @katexochen @Mic92
+/pkgs/development/compilers/go @kalbasit @katexochen @Mic92
 
 # GNOME
 /pkgs/desktops/gnome                              @NixOS/gnome
@@ -469,8 +466,9 @@ nixos/tests/incus/                      @adamcstephens
 pkgs/by-name/in/incus/                  @adamcstephens
 pkgs/by-name/lx/lxc*                    @adamcstephens
 
-# Flutter
+# ExpidusOS, Flutter
 /pkgs/development/compilers/flutter @RossComputerGuy
+/pkgs/desktops/expidus              @RossComputerGuy
 
 # GNU Tar & Zip
 /pkgs/by-name/gn/gnutar        @RossComputerGuy
@@ -528,7 +526,3 @@ pkgs/by-name/wa/warp-terminal/  @emilytrau @imadnyc @4evy @johnrtitor
 /nixos/lib/testing                                          @NixOS/test-driver
 /nixos/tests/nixos-test-driver                              @NixOS/test-driver
 /nixos/modules/virtualisation/nspawn-container/run-nspawn   @NixOS/test-driver
-
-# Boot security
-/pkgs/by-name/au/autopen    @NixOS/boot-security
-/pkgs/misc/signed-packages  @NixOS/boot-security

ci/README.md

@@ -104,7 +104,7 @@ For the purposes of CI, branches in the NixOS/nixpkgs repository are classified
 
 Some branches also have a version component, which is either `unstable` or `YY.MM`.
 
-`ci/github-script/supportedBranches.js` is a script imported by CI to classify the base and head branches of a Pull Request.
+`ci/supportedBranches.js` is a script imported by CI to classify the base and head branches of a Pull Request.
 This classification will then be used to skip certain jobs.
 This script can also be run locally to print basic test cases.
 

ci/github-script/.gitignore

@@ -1,5 +1,2 @@
-comparison
-comparison.zip
 node_modules
 step-summary.md
-*.tsbuildinfo

ci/github-script/bot.js

@@ -1,13 +1,12 @@
-// @ts-nocheck
-import { readFile, writeFile } from 'node:fs/promises'
-import path from 'node:path'
-import { DefaultArtifactClient } from '@actions/artifact'
-import { handleMerge } from './merge.js'
-import { handleReviewers } from './reviewers.js'
-import { classify } from './supportedBranches.js'
-import withRateLimit from './withRateLimit.js'
+module.exports = async ({ github, context, core, dry }) => {
+  const path = require('node:path')
+  const { DefaultArtifactClient } = await import('@actions/artifact')
+  const { readFile, writeFile } = require('node:fs/promises')
+  const withRateLimit = require('./withRateLimit.js')
+  const { classify } = require('../supportedBranches.js')
+  const { handleMerge } = require('./merge.js')
+  const { handleReviewers } = require('./reviewers.js')
 
-export default async ({ github, context, core, dry }) => {
   const artifactClient = new DefaultArtifactClient()
 
   // Detect if running in a fork (not NixOS/nixpkgs)
@@ -397,11 +396,11 @@ export default async ({ github, context, core, dry }) => {
         per_page: 100,
       })
 
-      // label llm-assisted PRs accordingly, retaining it if manually set
+      // label llm-assisted PRs accordingly
       const assistedByPattern = /Assisted-by: (?!nix-init)/i
-      if (prCommits.some((c) => assistedByPattern.test(c.commit.message))) {
-        evalLabels['llm-assisted'] = true
-      }
+      evalLabels['llm-assisted'] = prCommits.some((c) =>
+        assistedByPattern.test(c.commit.message),
+      )
 
       const commitSubjects = prCommits.map(
         (c) => c.commit.message.split('\n')[0],
@@ -689,21 +688,16 @@ export default async ({ github, context, core, dry }) => {
     if (context.payload.pull_request) {
       await handle({ item: context.payload.pull_request, stats })
     } else {
-      // We don't use filters here because that causes GitHub to use an often-outdated index,
-      // resulting in the cursor not being updated, and therefore causing the same PRs
-      // to use up our rate limit over and over again.
       const lastRun = (
         await github.rest.actions.listWorkflowRuns({
           ...context.repo,
           workflow_id: 'bot.yml',
+          event: 'schedule',
+          status: 'success',
+          exclude_pull_requests: true,
+          per_page: 1,
         })
-      ).data.workflow_runs.find(
-        (run) => run.event === 'schedule' && run.conclusion === 'success',
-      )
-
-      core.info(
-        `Last successful run created at: ${lastRun?.created_at ?? '<n/a>'}`,
-      )
+      ).data.workflow_runs[0]
 
       const cutoff = new Date(
         Math.max(
@@ -799,7 +793,6 @@ export default async ({ github, context, core, dry }) => {
         } else {
           // No stats.artifacts++, because this does not allow passing a custom token.
           // Thus, the upload will not happen with the app token, but the default github.token.
-          core.info(`pagination-cursor: ${cursor}`)
           await artifactClient.uploadArtifact(
             'pagination-cursor',
             [uploadPath],
@@ -809,8 +802,6 @@ export default async ({ github, context, core, dry }) => {
             },
           )
         }
-      } else {
-        core.info('pagination-cursor: <n/a>')
       }
 
       // Some items might be in both search results, so filtering out duplicates as well.

ci/github-script/check-target-branch-policy.test.ts

@@ -1,242 +0,0 @@
-import assert from 'node:assert/strict'
-import test from 'node:test'
-import { evaluateTargetBranchPolicy } from './check-target-branch-policy.ts'
-
-type DecisionFacts = {
-  base: string
-  head: string
-  maxRebuildCount: number
-  rebuildsAllTests: boolean
-  onlyChangedFile: string | null
-}
-
-type Decision =
-  | 'mass-rebuild'
-  | 'nixos-rebuild'
-  | 'possible-mass-rebuild'
-  | 'skip-development-merge'
-  | 'dismiss'
-
-const defaults: DecisionFacts = {
-  base: 'master',
-  head: 'topic-branch',
-  maxRebuildCount: 0,
-  rebuildsAllTests: false,
-  onlyChangedFile: null,
-}
-
-const cases: Array<{
-  name: string
-  facts: Partial<DecisionFacts>
-  expected: Decision
-}> = [
-  {
-    name: 'allows fewer than 500 rebuilds on master',
-    facts: { maxRebuildCount: 499 },
-    expected: 'dismiss',
-  },
-  {
-    name: 'flags 500 rebuilds on master as a possible mass rebuild',
-    facts: { maxRebuildCount: 500 },
-    expected: 'possible-mass-rebuild',
-  },
-  {
-    name: 'flags 999 rebuilds on master as a possible mass rebuild',
-    facts: { maxRebuildCount: 999 },
-    expected: 'possible-mass-rebuild',
-  },
-  {
-    name: 'flags 1000 rebuilds on master as a mass rebuild',
-    facts: { maxRebuildCount: 1000 },
-    expected: 'mass-rebuild',
-  },
-  {
-    name: 'flags a mass rebuild on staging-nixos',
-    facts: { base: 'staging-nixos', maxRebuildCount: 24_000 },
-    expected: 'mass-rebuild',
-  },
-  {
-    name: 'flags a mass rebuild on a release staging-nixos branch',
-    facts: { base: 'staging-nixos-26.05', maxRebuildCount: 1000 },
-    expected: 'mass-rebuild',
-  },
-  {
-    name: 'allows mass rebuilds on staging',
-    facts: { base: 'staging', maxRebuildCount: 1000 },
-    expected: 'dismiss',
-  },
-  {
-    name: 'flags a mass rebuild on a release branch',
-    facts: { base: 'release-26.05', maxRebuildCount: 1000 },
-    expected: 'mass-rebuild',
-  },
-  {
-    name: 'flags NixOS test rebuilds on master',
-    facts: { rebuildsAllTests: true },
-    expected: 'nixos-rebuild',
-  },
-  {
-    name: 'flags NixOS test rebuilds on a release branch',
-    facts: { base: 'release-26.05', rebuildsAllTests: true },
-    expected: 'nixos-rebuild',
-  },
-  {
-    name: 'allows NixOS test rebuilds on staging-nixos',
-    facts: { base: 'staging-nixos', rebuildsAllTests: true },
-    expected: 'dismiss',
-  },
-  {
-    name: 'does not flag a possible mass rebuild when staging-nixos rebuilds all NixOS tests',
-    facts: {
-      base: 'staging-nixos',
-      maxRebuildCount: 500,
-      rebuildsAllTests: true,
-    },
-    expected: 'dismiss',
-  },
-  {
-    name: 'flags other possible mass rebuilds on staging-nixos',
-    facts: { base: 'staging-nixos', maxRebuildCount: 500 },
-    expected: 'possible-mass-rebuild',
-  },
-  {
-    name: 'skips staging into master',
-    facts: {
-      head: 'staging',
-      maxRebuildCount: 24_000,
-    },
-    expected: 'skip-development-merge',
-  },
-  {
-    name: 'skips staging-nixos into master',
-    facts: {
-      head: 'staging-nixos',
-      maxRebuildCount: 24_000,
-    },
-    expected: 'skip-development-merge',
-  },
-  {
-    name: 'skips master into staging-nixos',
-    facts: {
-      base: 'staging-nixos',
-      head: 'master',
-      maxRebuildCount: 24_000,
-    },
-    expected: 'skip-development-merge',
-  },
-  {
-    name: 'checks staging into staging-nixos',
-    facts: {
-      base: 'staging-nixos',
-      head: 'staging',
-      maxRebuildCount: 24_000,
-    },
-    expected: 'mass-rebuild',
-  },
-  {
-    name: 'skips release staging-nixos into its release branch',
-    facts: {
-      base: 'release-26.05',
-      head: 'staging-nixos-26.05',
-      maxRebuildCount: 24_000,
-    },
-    expected: 'skip-development-merge',
-  },
-  {
-    name: 'skips a release branch into its staging-nixos branch',
-    facts: {
-      base: 'staging-nixos-26.05',
-      head: 'release-26.05',
-      maxRebuildCount: 24_000,
-    },
-    expected: 'skip-development-merge',
-  },
-  {
-    name: 'checks release staging into its staging-nixos branch',
-    facts: {
-      base: 'staging-nixos-26.05',
-      head: 'staging-26.05',
-      maxRebuildCount: 24_000,
-    },
-    expected: 'mass-rebuild',
-  },
-  {
-    name: 'kernels-org exemption suppresses a possible mass rebuild',
-    facts: {
-      maxRebuildCount: 999,
-      onlyChangedFile: 'pkgs/os-specific/linux/kernel/kernels-org.json',
-    },
-    expected: 'dismiss',
-  },
-  {
-    name: 'kernels-org exemption suppresses a definite mass rebuild',
-    facts: {
-      maxRebuildCount: 1000,
-      onlyChangedFile: 'pkgs/os-specific/linux/kernel/kernels-org.json',
-    },
-    expected: 'dismiss',
-  },
-  {
-    name: 'kernels-org exemption suppresses a NixOS test rebuild',
-    facts: {
-      rebuildsAllTests: true,
-      onlyChangedFile: 'pkgs/os-specific/linux/kernel/kernels-org.json',
-    },
-    expected: 'dismiss',
-  },
-  {
-    name: 'xanmod kernel exemption suppresses a possible mass rebuild',
-    facts: {
-      maxRebuildCount: 999,
-      onlyChangedFile: 'pkgs/os-specific/linux/kernel/xanmod-kernels.nix',
-    },
-    expected: 'dismiss',
-  },
-  {
-    name: 'xanmod kernel exemption suppresses a definite mass rebuild',
-    facts: {
-      maxRebuildCount: 1000,
-      onlyChangedFile: 'pkgs/os-specific/linux/kernel/xanmod-kernels.nix',
-    },
-    expected: 'dismiss',
-  },
-  {
-    name: 'xanmod kernel exemption suppresses a NixOS test rebuild',
-    facts: {
-      rebuildsAllTests: true,
-      onlyChangedFile: 'pkgs/os-specific/linux/kernel/xanmod-kernels.nix',
-    },
-    expected: 'dismiss',
-  },
-  {
-    name: 'Home Assistant exemption suppresses a mass rebuild',
-    facts: {
-      head: 'wip-home-assistant',
-      maxRebuildCount: 1500,
-    },
-    expected: 'dismiss',
-  },
-  {
-    name: 'does not exempt a Home Assistant update above 1500 rebuilds',
-    facts: { head: 'wip-home-assistant', maxRebuildCount: 1501 },
-    expected: 'mass-rebuild',
-  },
-  {
-    name: 'Home Assistant exemption does not suppress a NixOS test rebuild',
-    facts: {
-      head: 'wip-home-assistant',
-      maxRebuildCount: 1500,
-      rebuildsAllTests: true,
-    },
-    expected: 'nixos-rebuild',
-  },
-]
-
-for (const { name, facts, expected } of cases) {
-  test(name, () => {
-    assert.equal(
-      evaluateTargetBranchPolicy({ ...defaults, ...facts }).decision,
-      expected,
-    )
-  })
-}

ci/github-script/check-target-branch-policy.ts

@@ -1,116 +0,0 @@
-import { classify, split } from './supportedBranches.js'
-
-type TargetBranchPolicyFacts = {
-  base: string
-  head: string
-  maxRebuildCount: number
-  rebuildsAllTests: boolean
-  onlyChangedFile: string | null
-}
-
-type TargetBranchReviewDecision =
-  | 'mass-rebuild'
-  | 'nixos-rebuild'
-  | 'possible-mass-rebuild'
-  | 'skip-development-merge'
-  | 'dismiss'
-
-type TargetBranchPolicyResult = {
-  decision: TargetBranchReviewDecision
-  details: {
-    isExemptKernelUpdate: boolean
-    isExemptHomeAssistantUpdate: boolean
-  }
-}
-
-export function getTargetBranchPolicy({
-  base,
-  head,
-}: {
-  base: string
-  head: string
-}) {
-  const baseClassification = classify(base)
-  const headClassification = classify(head)
-  const isPrimaryBase = baseClassification.type.includes('primary')
-  const isPrimaryHead = headClassification.type.includes('primary')
-  const isStagingNixosBase = split(base).prefix === 'staging-nixos'
-  const isDevelopmentHead = headClassification.type.includes('development')
-  const shouldSkipDevelopmentMerge =
-    isDevelopmentHead && (!isStagingNixosBase || isPrimaryHead)
-
-  return {
-    isStagingNixosBase,
-    shouldSkipDevelopmentMerge,
-    shouldCheckMassRebuild:
-      !shouldSkipDevelopmentMerge && (isPrimaryBase || isStagingNixosBase),
-    shouldCheckNixosRebuild: !shouldSkipDevelopmentMerge && isPrimaryBase,
-  }
-}
-
-export function evaluateTargetBranchPolicy({
-  base,
-  head,
-  maxRebuildCount,
-  rebuildsAllTests,
-  onlyChangedFile,
-}: TargetBranchPolicyFacts): TargetBranchPolicyResult {
-  const {
-    isStagingNixosBase,
-    shouldSkipDevelopmentMerge,
-    shouldCheckMassRebuild,
-    shouldCheckNixosRebuild,
-  } = getTargetBranchPolicy({ base, head })
-
-  // https://github.com/NixOS/nixpkgs/pull/553786#issuecomment-5510286851
-  // kernels-org should go to staging-nixos (or master) and staging-nixos-xx.xx (or release-xx.xx) when backported
-  // https://github.com/NixOS/nixpkgs/pull/521157
-  // xanmod should go to master and release-xx.xx when backported
-  const isExemptKernelUpdate =
-    onlyChangedFile === 'pkgs/os-specific/linux/kernel/kernels-org.json' ||
-    onlyChangedFile === 'pkgs/os-specific/linux/kernel/xanmod-kernels.nix'
-
-  // https://github.com/NixOS/nixpkgs/pull/483194#issuecomment-3793393218
-  const isExemptHomeAssistantUpdate =
-    maxRebuildCount <= 1500 && head === 'wip-home-assistant'
-
-  const details = {
-    isExemptKernelUpdate,
-    isExemptHomeAssistantUpdate,
-  }
-
-  const result = (decision: TargetBranchReviewDecision) => ({
-    decision,
-    details,
-  })
-
-  const isMassRebuild =
-    maxRebuildCount >= 1000 &&
-    !isExemptKernelUpdate &&
-    !isExemptHomeAssistantUpdate
-
-  if (shouldCheckMassRebuild && isMassRebuild) {
-    return result('mass-rebuild')
-  }
-
-  if (shouldCheckNixosRebuild && rebuildsAllTests && !isExemptKernelUpdate) {
-    return result('nixos-rebuild')
-  }
-
-  const isPossibleMassRebuild =
-    maxRebuildCount >= 500 &&
-    !isMassRebuild &&
-    !isExemptKernelUpdate &&
-    !isExemptHomeAssistantUpdate
-  if (
-    shouldCheckMassRebuild &&
-    isPossibleMassRebuild &&
-    !(rebuildsAllTests && isStagingNixosBase)
-  ) {
-    return result('possible-mass-rebuild')
-  }
-
-  return result(
-    shouldSkipDevelopmentMerge ? 'skip-development-merge' : 'dismiss',
-  )
-}

ci/github-script/check-target-branch.js

@@ -0,0 +1,221 @@
+/// @ts-check
+
+// TODO: should this be combined with the branch checks in prepare.js?
+// They do seem quite similar, but this needs to run after eval,
+// and prepare.js obviously doesn't.
+
+const { classify, split } = require('../supportedBranches.js')
+const { readFile } = require('node:fs/promises')
+const { postReview, dismissReviews } = require('./reviews.js')
+
+const reviewKey = 'check-target-branch'
+/**
+ * @param {{
+ *  github: InstanceType<import('@actions/github/lib/utils').GitHub>,
+ *  context: import('@actions/github/lib/context').Context
+ *  core: import('@actions/core')
+ *  dry: boolean
+ * }} CheckTargetBranchProps
+ */
+async function checkTargetBranch({ github, context, core, dry }) {
+  /**
+   * @type {{
+   *  attrdiff: {
+   *   added: string[],
+   *   changed: string[],
+   *   removed: string[],
+   *  },
+   *  attrdiffByKernel: Record<string, {
+   *   added: string[],
+   *   changed: string[],
+   *   removed: string[],
+   *  }>,
+   *  attrdiffByPlatform: Record<string, {
+   *   added: string[],
+   *   changed: string[],
+   *   removed: string[],
+   *  }>,
+   *  labels: Record<string, boolean>,
+   *  rebuildCountByKernel: Record<string, number>,
+   *  rebuildsByKernel: Record<string, string[]>,
+   *  rebuildsByPlatform: Record<string, string[]>,
+   * }}
+   */
+  const changed = JSON.parse(
+    await readFile('comparison/changed-paths.json', 'utf-8'),
+  )
+  const pull_number = context.payload.pull_request?.number
+  if (!pull_number) {
+    core.warning(
+      'Skipping checkTargetBranch: no pull_request number (is this being run as part of a merge group?)',
+    )
+    return
+  }
+  const prInfo = (
+    await github.rest.pulls.get({
+      ...context.repo,
+      pull_number,
+    })
+  ).data
+  const base = prInfo.base.ref
+  const head = prInfo.head.ref
+  const baseClassification = classify(base)
+  const headClassification = classify(head)
+
+  // Don't run on, e.g., staging-nixos to master merges.
+  if (headClassification.type.includes('development')) {
+    core.info(
+      `Skipping checkTargetBranch: PR is from a development branch (${head})`,
+    )
+
+    await dismissReviews({
+      github,
+      context,
+      core,
+      dry,
+      reviewKey,
+    })
+
+    return
+  }
+  // Don't run on PRs against staging branches, wip branches, haskell-updates, etc.
+  if (!baseClassification.type.includes('primary')) {
+    core.info(
+      `Skipping checkTargetBranch: PR is against a non-primary base branch (${base})`,
+    )
+
+    await dismissReviews({
+      github,
+      context,
+      core,
+      dry,
+      reviewKey,
+    })
+
+    return
+  }
+
+  const maxRebuildCount = Math.max(
+    ...Object.values(changed.rebuildCountByKernel),
+  )
+  const rebuildsAllTests =
+    changed.attrdiff.changed.includes('nixosTests.simple-container') ||
+    changed.attrdiff.changed.includes('nixosTests.simple-vm')
+
+  // https://github.com/NixOS/nixpkgs/pull/521157
+  // These should go to master and release-xx.xx when backported
+  let isExemptKernelUpdate = false
+  if (prInfo.changed_files === 1) {
+    const changedFiles = (
+      await github.rest.pulls.listFiles({
+        ...context.repo,
+        pull_number,
+      })
+    ).data
+    isExemptKernelUpdate =
+      changedFiles.length === 1 &&
+      changedFiles[0].filename ===
+        'pkgs/os-specific/linux/kernel/xanmod-kernels.nix'
+  }
+
+  // https://github.com/NixOS/nixpkgs/pull/483194#issuecomment-3793393218
+  const isExemptHomeAssistantUpdate =
+    maxRebuildCount <= 1500 && head === 'wip-home-assistant'
+
+  core.info(
+    [
+      `checkTargetBranch: this PR:`,
+      `  * causes ${maxRebuildCount} rebuilds`,
+      `  * ${rebuildsAllTests ? 'rebuilds' : 'does not rebuild'} all NixOS tests`,
+      `  * ${isExemptKernelUpdate ? 'is' : 'is not'} an exempt kernel update`,
+      `  * ${isExemptHomeAssistantUpdate ? 'is' : 'is not'} an exempt home-assistant update`,
+    ].join('\n'),
+  )
+
+  if (
+    maxRebuildCount >= 1000 &&
+    !isExemptHomeAssistantUpdate &&
+    !isExemptKernelUpdate
+  ) {
+    const desiredBranch =
+      base === 'master' ? 'staging' : `staging-${split(base).version}`
+    const body = [
+      `The PR's base branch is set to \`${base}\`, but this PR causes ${maxRebuildCount} rebuilds.`,
+      'It is therefore considered a mass rebuild.',
+      `Please [change the base branch](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-base-branch-of-a-pull-request) to [the right base branch for your changes](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#branch-conventions) (probably \`${desiredBranch}\`).`,
+    ].join('\n')
+
+    await postReview({
+      github,
+      context,
+      core,
+      dry,
+      body,
+      event: 'REQUEST_CHANGES',
+      reviewKey,
+    })
+  } else if (rebuildsAllTests && !isExemptKernelUpdate) {
+    let branchText
+    if (base === 'master' && maxRebuildCount >= 500) {
+      branchText = '(probably either `staging-nixos` or `staging`)'
+    } else if (base === 'master') {
+      branchText = '(probably `staging-nixos`)'
+    } else if (maxRebuildCount >= 500) {
+      branchText = `(probably either \`staging-nixos-${split(base).version}\` or \`staging-${split(base).version}\`)`
+    } else {
+      branchText = `(probably \`staging-nixos-${split(base).version}\`)`
+    }
+    const body = [
+      `The PR's base branch is set to \`${base}\`, but this PR rebuilds all NixOS tests.`,
+      base === 'master' && maxRebuildCount >= 500
+        ? `Since this PR also causes ${maxRebuildCount} rebuilds, it may also be considered a mass rebuild.`
+        : '',
+      `Please [change the base branch](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-base-branch-of-a-pull-request) to [the right base branch for your changes](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#branch-conventions) ${branchText}.`,
+    ].join('\n')
+
+    await postReview({
+      github,
+      context,
+      core,
+      dry,
+      body,
+      event: 'REQUEST_CHANGES',
+      reviewKey,
+    })
+  } else if (
+    maxRebuildCount >= 500 &&
+    !isExemptKernelUpdate &&
+    !isExemptHomeAssistantUpdate
+  ) {
+    const stagingBranch =
+      base === 'master' ? 'staging' : `staging-${split(base).version}`
+    const body = [
+      `The PR's base branch is set to \`${base}\`, and this PR causes ${maxRebuildCount} rebuilds.`,
+      `Please consider whether this PR causes a mass rebuild according to [our conventions](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#branch-conventions).`,
+      `If it does cause a mass rebuild, please [change the base branch](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-base-branch-of-a-pull-request) to [the right base branch for your changes](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#branch-conventions) (probably \`${stagingBranch}\`).`,
+      `If it does not cause a mass rebuild, this message can be ignored.`,
+    ].join('\n')
+
+    await postReview({
+      github,
+      context,
+      core,
+      dry,
+      body,
+      event: 'REQUEST_CHANGES',
+      reviewKey,
+    })
+  } else {
+    core.info('checkTargetBranch: this PR is against an appropriate branch.')
+
+    await dismissReviews({
+      github,
+      context,
+      core,
+      dry,
+      reviewKey,
+    })
+  }
+}
+
+module.exports = checkTargetBranch

ci/github-script/check-target-branch.ts

@@ -1,242 +0,0 @@
-import { readFile } from 'node:fs/promises'
-import type * as actionsCore from '@actions/core'
-import type { context as actionsContext } from '@actions/github'
-import type { GitHub } from '@actions/github/lib/utils'
-import {
-  evaluateTargetBranchPolicy,
-  getTargetBranchPolicy,
-} from './check-target-branch-policy.ts'
-import { dismissReviews, postReview } from './reviews.js'
-import { split } from './supportedBranches.js'
-
-// TODO: should this be combined with the branch checks in prepare.js?
-// They do seem quite similar, but this needs to run after eval,
-// and prepare.js obviously doesn't.
-
-const reviewKey = 'check-target-branch'
-
-type ChangedPaths = {
-  attrdiff: {
-    added: string[]
-    changed: string[]
-    removed: string[]
-  }
-  attrdiffByKernel: Record<
-    string,
-    {
-      added: string[]
-      changed: string[]
-      removed: string[]
-    }
-  >
-  attrdiffByPlatform: Record<
-    string,
-    {
-      added: string[]
-      changed: string[]
-      removed: string[]
-    }
-  >
-  labels: Record<string, boolean>
-  rebuildCountByKernel: Record<string, number>
-  rebuildsByKernel: Record<string, string[]>
-  rebuildsByPlatform: Record<string, string[]>
-}
-
-type TargetBranchReviewFacts = {
-  github: InstanceType<typeof GitHub>
-  context: typeof actionsContext
-  core: typeof actionsCore
-  dry: boolean
-  base: string
-  maxRebuildCount: number
-}
-
-function getStagingBranch(base: string) {
-  const version = split(base).version
-  return version ? `staging-${version}` : 'staging'
-}
-
-async function postMassRebuildReview(facts: TargetBranchReviewFacts) {
-  const { github, context, core, dry, base, maxRebuildCount } = facts
-  const desiredBranch = getStagingBranch(base)
-  const body = [
-    `The PR's base branch is set to \`${base}\`, but this PR causes ${maxRebuildCount} rebuilds.`,
-    'It is therefore considered a mass rebuild.',
-    `Please [change the base branch](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-base-branch-of-a-pull-request) to [the right base branch for your changes](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#branch-conventions) (probably \`${desiredBranch}\`).`,
-  ].join('\n')
-
-  await postReview({
-    github,
-    context,
-    core,
-    dry,
-    body,
-    event: 'REQUEST_CHANGES',
-    reviewKey,
-  })
-}
-
-async function postNixosRebuildReview(facts: TargetBranchReviewFacts) {
-  const { github, context, core, dry, base, maxRebuildCount } = facts
-  let branchText: string
-  if (base === 'master' && maxRebuildCount >= 500) {
-    branchText = '(probably either `staging-nixos` or `staging`)'
-  } else if (base === 'master') {
-    branchText = '(probably `staging-nixos`)'
-  } else if (maxRebuildCount >= 500) {
-    branchText = `(probably either \`staging-nixos-${split(base).version}\` or \`staging-${split(base).version}\`)`
-  } else {
-    branchText = `(probably \`staging-nixos-${split(base).version}\`)`
-  }
-  const body = [
-    `The PR's base branch is set to \`${base}\`, but this PR rebuilds all NixOS tests.`,
-    base === 'master' && maxRebuildCount >= 500
-      ? `Since this PR also causes ${maxRebuildCount} rebuilds, it may also be considered a mass rebuild.`
-      : '',
-    `Please [change the base branch](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-base-branch-of-a-pull-request) to [the right base branch for your changes](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#branch-conventions) ${branchText}.`,
-  ].join('\n')
-
-  await postReview({
-    github,
-    context,
-    core,
-    dry,
-    body,
-    event: 'REQUEST_CHANGES',
-    reviewKey,
-  })
-}
-
-async function postPossibleMassRebuildReview(facts: TargetBranchReviewFacts) {
-  const { github, context, core, dry, base, maxRebuildCount } = facts
-  const stagingBranch = getStagingBranch(base)
-  const body = [
-    `The PR's base branch is set to \`${base}\`, and this PR causes ${maxRebuildCount} rebuilds.`,
-    `Please consider whether this PR causes a mass rebuild according to [our conventions](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#branch-conventions).`,
-    `If it does cause a mass rebuild, please [change the base branch](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-base-branch-of-a-pull-request) to [the right base branch for your changes](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#branch-conventions) (probably \`${stagingBranch}\`).`,
-    `If it does not cause a mass rebuild, this message can be ignored.`,
-  ].join('\n')
-
-  await postReview({
-    github,
-    context,
-    core,
-    dry,
-    body,
-    event: 'REQUEST_CHANGES',
-    reviewKey,
-  })
-}
-
-export async function checkTargetBranch({
-  github,
-  context,
-  core,
-  dry,
-}: {
-  github: InstanceType<typeof GitHub>
-  context: typeof actionsContext
-  core: typeof actionsCore
-  dry: boolean
-}) {
-  const changed: ChangedPaths = JSON.parse(
-    await readFile('comparison/changed-paths.json', 'utf-8'),
-  )
-  const pull_number = context.payload.pull_request?.number
-  if (!pull_number) {
-    core.warning(
-      'Skipping checkTargetBranch: no pull_request number (is this being run as part of a merge group?)',
-    )
-    return
-  }
-  const prInfo = (
-    await github.rest.pulls.get({
-      ...context.repo,
-      pull_number,
-    })
-  ).data
-  const base = prInfo.base.ref
-  const head = prInfo.head.ref
-  const { shouldCheckMassRebuild } = getTargetBranchPolicy({ base, head })
-
-  const maxRebuildCount = Math.max(
-    ...Object.values(changed.rebuildCountByKernel),
-  )
-  const rebuildsAllTests =
-    changed.attrdiff.changed.includes('nixosTests.simple-container') ||
-    changed.attrdiff.changed.includes('nixosTests.simple-vm')
-
-  let onlyChangedFile: string | null = null
-  if (shouldCheckMassRebuild && prInfo.changed_files === 1) {
-    const changedFiles = (
-      await github.rest.pulls.listFiles({
-        ...context.repo,
-        pull_number,
-      })
-    ).data
-    onlyChangedFile =
-      changedFiles.length === 1 ? changedFiles[0].filename : null
-  }
-
-  const {
-    decision,
-    details: { isExemptKernelUpdate, isExemptHomeAssistantUpdate },
-  } = evaluateTargetBranchPolicy({
-    base,
-    head,
-    maxRebuildCount,
-    rebuildsAllTests,
-    onlyChangedFile,
-  })
-
-  core.info(
-    [
-      `checkTargetBranch: this PR:`,
-      `  * causes ${maxRebuildCount} rebuilds`,
-      `  * ${rebuildsAllTests ? 'rebuilds' : 'does not rebuild'} all NixOS tests`,
-      `  * ${isExemptKernelUpdate ? 'is' : 'is not'} an exempt kernel update`,
-      `  * ${isExemptHomeAssistantUpdate ? 'is' : 'is not'} an exempt home-assistant update`,
-    ].join('\n'),
-  )
-
-  const reviewFacts: TargetBranchReviewFacts = {
-    github,
-    context,
-    core,
-    dry,
-    base,
-    maxRebuildCount,
-  }
-
-  if (decision === 'mass-rebuild') {
-    await postMassRebuildReview(reviewFacts)
-    return
-  }
-
-  if (decision === 'nixos-rebuild') {
-    await postNixosRebuildReview(reviewFacts)
-    return
-  }
-
-  if (decision === 'possible-mass-rebuild') {
-    await postPossibleMassRebuildReview(reviewFacts)
-    return
-  }
-
-  if (decision === 'skip-development-merge') {
-    core.info(
-      `Skipping checkTargetBranch: PR merges the development branch ${head} into ${base}`,
-    )
-  } else {
-    core.info('checkTargetBranch: this PR is against an appropriate branch.')
-  }
-
-  await dismissReviews({
-    github,
-    context,
-    core,
-    dry,
-    reviewKey,
-  })
-}

ci/github-script/commits.js

@@ -1,12 +1,8 @@
-// @ts-nocheck
-import { execFileSync } from 'node:child_process'
-import { dismissReviews, postReview } from './reviews.js'
-import { classify } from './supportedBranches.js'
-import withRateLimit from './withRateLimit.js'
-
-const dirname = import.meta.dirname
-
-export default async ({ github, context, core, dry, cherryPicks }) => {
+module.exports = async ({ github, context, core, dry, cherryPicks }) => {
+  const { execFileSync } = require('node:child_process')
+  const { classify } = require('../supportedBranches.js')
+  const withRateLimit = require('./withRateLimit.js')
+  const { dismissReviews, postReview } = require('./reviews.js')
   const reviewKey = 'check-commits'
 
   await withRateLimit({ github, core }, async (stats) => {
@@ -96,7 +92,7 @@ export default async ({ github, context, core, dry, cherryPicks }) => {
     function diff({ sha, commit, original_sha }) {
       const diff = execFileSync('git', [
         '-C',
-        dirname,
+        __dirname,
         'range-diff',
         '--no-color',
         '--ignore-all-space',
@@ -123,7 +119,7 @@ export default async ({ github, context, core, dry, cherryPicks }) => {
 
       const colored_diff = execFileSync('git', [
         '-C',
-        dirname,
+        __dirname,
         'range-diff',
         '--color',
         '--no-notes',
@@ -162,7 +158,7 @@ export default async ({ github, context, core, dry, cherryPicks }) => {
       // Fetching all commits we need for diff at once is much faster than any other method.
       execFileSync('git', [
         '-C',
-        dirname,
+        __dirname,
         'fetch',
         '--depth=2',
         'origin',
@@ -290,7 +286,7 @@ export default async ({ github, context, core, dry, cherryPicks }) => {
         // that's too long. We think this is unlikely to happen, and so don't deal with it explicitly.
         const truncated = []
         let total_length = 0
-        for (const line of diff) {
+        for (line of diff) {
           total_length += line.length
           if (total_length > 10000) {
             truncated.push('', '[...truncated...]')

ci/github-script/get-pr-commit-details.js

@@ -1,7 +1,6 @@
-import { execFile as nodeExecFile } from 'node:child_process'
-import { promisify } from 'node:util'
-
-const execFile = promisify(nodeExecFile)
+// @ts-check
+const { promisify } = require('node:util')
+const execFile = promisify(require('node:child_process').execFile)
 
 /**
  * @typedef {{
@@ -17,7 +16,7 @@ const execFile = promisify(nodeExecFile)
 /**
  * @param {{
  *  args: string[]
- *  core: typeof import('@actions/core'),
+ *  core: import('@actions/core'),
  *  quiet?: boolean,
  *  repoPath?: string,
  * }} RunGitProps
@@ -41,14 +40,14 @@ async function runGit({ args, repoPath, core, quiet }) {
  * of 250 commits and doesn't return the changed files.
  *
  * @param {{
- *  core: typeof import('@actions/core'),
- *  pr: Awaited<ReturnType<InstanceType<typeof import('@actions/github/lib/utils').GitHub>["rest"]["pulls"]["get"]>>["data"]
+ *  core: import('@actions/core'),
+ *  pr: Awaited<ReturnType<InstanceType<import('@actions/github/lib/utils').GitHub>["rest"]["pulls"]["get"]>>["data"]
  *  repoPath?: string,
  * }} GetCommitMessagesForPRProps
  *
  * @returns {Promise<Commit[]>}
  */
-export async function getCommitDetailsForPR({ core, pr, repoPath }) {
+async function getCommitDetailsForPR({ core, pr, repoPath }) {
   await runGit({
     args: ['fetch', `--depth=1`, 'origin', pr.base.sha],
     repoPath,
@@ -77,7 +76,7 @@ export async function getCommitDetailsForPR({ core, pr, repoPath }) {
 
   return Promise.all(
     shas.map(async (sha) => {
-      // Subject, author name, author email, committer name, committer email (all tab-separated)
+      // Subject, author name, author email, committer name, committer email (all tab-seperated)
       // then a blank line, then filenames.
       const result = (
         await runGit({
@@ -114,3 +113,5 @@ export async function getCommitDetailsForPR({ core, pr, repoPath }) {
     }),
   )
 }
+
+module.exports = { getCommitDetailsForPR }

ci/github-script/get-teams.js

@@ -1,14 +1,13 @@
-// @ts-nocheck
-import { writeFileSync } from 'node:fs'
-import withRateLimit from './withRateLimit.js'
-
 const excludeTeams = [
   /^voters.*$/,
   /^nixpkgs-maintainers$/,
   /^nixpkgs-committers$/,
 ]
 
-export default async ({ github, context, core, outFile }) => {
+module.exports = async ({ github, context, core, outFile }) => {
+  const withRateLimit = require('./withRateLimit.js')
+  const { writeFileSync } = require('node:fs')
+
   const org = context.repo.owner
 
   const result = {}

ci/github-script/lint-commits.js

@@ -1,17 +1,18 @@
-import { getCommitDetailsForPR } from './get-pr-commit-details.js'
-import { classify } from './supportedBranches.js'
+// @ts-check
+const { classify } = require('../supportedBranches.js')
+const { getCommitDetailsForPR } = require('./get-pr-commit-details.js')
 
 /** @typedef {import('./get-pr-commit-details.js').Commit} Commit */
 
 /**
  * @param {{
- *  github: InstanceType<typeof import('@actions/github/lib/utils').GitHub>,
+ *  github: InstanceType<import('@actions/github/lib/utils').GitHub>,
  *  context: typeof import('@actions/github').context,
- *  core: typeof import('@actions/core'),
+ *  core: import('@actions/core'),
  *  repoPath?: string,
  * }} LintCommitsProps
  */
-export default async function lintCommits({ github, context, core, repoPath }) {
+async function lintCommits({ github, context, core, repoPath }) {
   // This check should only be run when we have the pull_request context.
   const pull_number = context.payload.pull_request?.number
   if (!pull_number) {
@@ -56,7 +57,7 @@ export default async function lintCommits({ github, context, core, repoPath }) {
 /**
  * @param {{
  *  commits: Commit[],
- *  core: typeof import('@actions/core'),
+ *  core: import('@actions/core'),
  * }} CheckCommitMessagesProps
  */
 async function checkCommitMessages({ commits, core }) {
@@ -169,7 +170,7 @@ async function checkCommitMessages({ commits, core }) {
 /**
  * @param {{
  *  commits: Commit[],
- *  core: typeof import('@actions/core'),
+ *  core: import('@actions/core'),
  * }} CheckGitFieldsProps
  */
 async function checkCommitMetadata({ commits, core }) {
@@ -220,3 +221,5 @@ async function checkCommitMetadata({ commits, core }) {
     core.setFailed('Committers: merging is discouraged.')
   }
 }
+
+module.exports = lintCommits

ci/github-script/manual-file-edits.js

@@ -1,23 +1,18 @@
-import { getCommitDetailsForPR } from './get-pr-commit-details.js'
-import { dismissReviews, postReview } from './reviews.js'
-import { classify } from './supportedBranches.js'
+// @ts-check
+const { classify } = require('../supportedBranches.js')
+const { getCommitDetailsForPR } = require('./get-pr-commit-details')
 
 /**
  * @param {{
- *  github: InstanceType<typeof import('@actions/github/lib/utils').GitHub>,
- *  context: typeof import('@actions/github').context,
- *  core: typeof import('@actions/core'),
+ *  github: InstanceType<import('@actions/github/lib/utils').GitHub>,
+ *  context: import('@actions/github/lib/context').Context,
+ *  core: import('@actions/core'),
  *  repoPath?: string,
  *  dry: boolean,
  * }} CheckManualFileEditsProps
  */
-export default async function checkManualFileEdits({
-  github,
-  context,
-  core,
-  repoPath,
-  dry,
-}) {
+async function checkManualFileEdits({ github, context, core, repoPath, dry }) {
+  const { dismissReviews, postReview } = require('./reviews.js')
   const reviewKey = 'manual-file-edits'
 
   const pull_number = context.payload.pull_request?.number
@@ -96,3 +91,5 @@ export default async function checkManualFileEdits({
     })
   }
 }
+
+module.exports = checkManualFileEdits

ci/github-script/merge.js

@@ -1,5 +1,4 @@
-// @ts-nocheck
-import { classify } from './supportedBranches.js'
+const { classify } = require('../supportedBranches.js')
 
 function runChecklist({
   committers,
@@ -123,7 +122,7 @@ function hasMergeCommand(body) {
     .match(/^@NixOS\/nixpkgs-merge-bot merge\s*$/im)
 }
 
-export async function handleMergeComment({ github, body, node_id, reaction }) {
+async function handleMergeComment({ github, body, node_id, reaction }) {
   if (!hasMergeCommand(body)) return
 
   await github.graphql(
@@ -138,7 +137,7 @@ export async function handleMergeComment({ github, body, node_id, reaction }) {
   )
 }
 
-export async function handleMerge({
+async function handleMerge({
   github,
   context,
   core,
@@ -409,3 +408,8 @@ export async function handleMerge({
   // This is used to set the respective label in bot.js.
   return result
 }
+
+module.exports = {
+  handleMerge,
+  handleMergeComment,
+}

ci/github-script/package-lock.json

@@ -10,10 +10,6 @@
         "@actions/github": "9.1.0",
         "bottleneck": "2.19.5",
         "commander": "14.0.3"
-      },
-      "devDependencies": {
-        "@types/node": "24.13.3",
-        "typescript": "7.0.2"
       }
     },
     "node_modules/@actions/artifact": {
@@ -592,19 +588,6 @@
         "protoc-gen-ts": "bin/protoc-gen-ts"
       }
     },
-    "node_modules/@protobuf-ts/plugin/node_modules/typescript": {
-      "version": "3.9.10",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-3.9.10.tgz",
-      "integrity": "sha512-w6fIxVE/H1PkLKcCPsFqKE7Kv7QUwhU8qQY2MueZXWx5cPZdwFupLgKK3vntcK98BtNHZtAF4LA/yl2a7k8R6Q==",
-      "license": "Apache-2.0",
-      "bin": {
-        "tsc": "bin/tsc",
-        "tsserver": "bin/tsserver"
-      },
-      "engines": {
-        "node": ">=4.2.0"
-      }
-    },
     "node_modules/@protobuf-ts/protoc": {
       "version": "2.11.1",
       "resolved": "https://registry.npmjs.org/@protobuf-ts/protoc/-/protoc-2.11.1.tgz",
@@ -629,336 +612,6 @@
         "@protobuf-ts/runtime": "^2.11.1"
       }
     },
-    "node_modules/@types/node": {
-      "version": "24.13.3",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.3.tgz",
-      "integrity": "sha512-Dh8vAsV36ig5wa9OX4pXvMc9D3Veibfw2wix0CUwYODLD8nkj9UsLjASr49nPg+2eKzxhBV+v7L8pXvT4e639Q==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "undici-types": "~7.18.0"
-      }
-    },
-    "node_modules/@typescript/typescript-aix-ppc64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-aix-ppc64/-/typescript-aix-ppc64-7.0.2.tgz",
-      "integrity": "sha512-MTKKkWB7p/0E9xi1d1tHtZ5PiLkGEMIq88pK2CubZjOsLtYTLqhgIgi6zepFa+9GHZ6h05NMCkQxGKiPXMxXtQ==",
-      "cpu": [
-        "ppc64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "aix"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-darwin-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-arm64/-/typescript-darwin-arm64-7.0.2.tgz",
-      "integrity": "sha512-gowzar9MwS/aRWp6f3a4KUqzRjAZjOsmGNCM6LcTgXum+dBfgsBVMN+AgvOCCbguXyick6LJhpBszxMebJ8syA==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-darwin-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-x64/-/typescript-darwin-x64-7.0.2.tgz",
-      "integrity": "sha512-SZ9xZInqApNlNGc9s0W1VSsktYSOe9cFqNOIqmN1Gs8SmkjKZYFt017G4VwPxASInODuAdbTW7sXiFUf893RgA==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-freebsd-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-arm64/-/typescript-freebsd-arm64-7.0.2.tgz",
-      "integrity": "sha512-W5NH4y/J0plIIS5b2xvTEkU7JFxyqdMAOgf+Ilhl0vHQXKO5dZoxd+C/jEtq56c4F3wk71RB4BMRQ2XdI+bwYQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-freebsd-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-x64/-/typescript-freebsd-x64-7.0.2.tgz",
-      "integrity": "sha512-UMGDx5sTpzNw3WiPebH7l90IWfJggEd+egHt/q6p7/Cm3zqoV7VxkGXt+3DxPIw8CcmvAB0j3sVVfbhX+M4Tpw==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-arm": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm/-/typescript-linux-arm-7.0.2.tgz",
-      "integrity": "sha512-gffT3xPz9sR7j/YJExkyPntrI0P2EP9XbOyWzth2/Gs0RstK+90RBcO0ncXoXy/beYll1SXw846Nf2zdnEz0QQ==",
-      "cpu": [
-        "arm"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm64/-/typescript-linux-arm64-7.0.2.tgz",
-      "integrity": "sha512-Qh4eU4/y3yDjnfjjyPYihMj5/ODIlmt+Bzu17OI+fiSRDW57QmU5SiN63exPRNJPKUzcc1INa1NXdrJ+MqHjUQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-loong64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-loong64/-/typescript-linux-loong64-7.0.2.tgz",
-      "integrity": "sha512-uEHck9i8hoAzXPiYRib1O7miOnz23SxIeVl6F4LXox+qov1K35jHcEW6VHKvZI+pyvl7fZEP4MCU5LYvIq1GuQ==",
-      "cpu": [
-        "loong64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-mips64el": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-mips64el/-/typescript-linux-mips64el-7.0.2.tgz",
-      "integrity": "sha512-R4KvAMnE43W5Qeqb0Ly56O3mWMWIAgsMyz36DCaycd5nbg/9kzm0liw3JocfRqyJY0KPmzFjbswozXyW0DnIYA==",
-      "cpu": [
-        "mips64el"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-ppc64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-ppc64/-/typescript-linux-ppc64-7.0.2.tgz",
-      "integrity": "sha512-DORx5b3sd/4S7eayxm4FQv+A7CrkUIGRaHiwI8oiHTAI1fAPWhF4J0vAlkC8biAlHSVVwxMQ3tjZ2/DVbnQiiA==",
-      "cpu": [
-        "ppc64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-riscv64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-riscv64/-/typescript-linux-riscv64-7.0.2.tgz",
-      "integrity": "sha512-wf0jqEDOjrPRnKwYRyyJDRo11KMbvMFrU+q4zqKyChODBzvlkbhNQfKvLxQCcwTpdDaXSHZTVuh0JoCrKCUMHQ==",
-      "cpu": [
-        "riscv64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-s390x": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-s390x/-/typescript-linux-s390x-7.0.2.tgz",
-      "integrity": "sha512-IkwJc3L7yhytWd/ewjyxNDfOmswCm9GWMJT/ue/dU4aZNbwZeYAetq42VyLmsmSjvoX7z74X6ZaYCtzAr0EuGw==",
-      "cpu": [
-        "s390x"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-x64/-/typescript-linux-x64-7.0.2.tgz",
-      "integrity": "sha512-EYdf2cNg7rgCWJnxCdJ+F3V39O8ihb37eHAu1LK8oAFizgTQbPOK7zHHXbPt8rX24COqODXeI3sIf0fCXG7H/A==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-netbsd-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-arm64/-/typescript-netbsd-arm64-7.0.2.tgz",
-      "integrity": "sha512-+polYF4MF04aPpO5FTkHran9yUQDSXqy5GiSDKpsll5jy3l3+g9QLhpf39T+ePtefhXLOGrLl0QIjkQP6VnelA==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-netbsd-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-x64/-/typescript-netbsd-x64-7.0.2.tgz",
-      "integrity": "sha512-8YIT0EHM/3dq10ZOVF/A7pc/YSMtbcecct4rWtexrnSCHOPcpC2KTLXfTCR6vDpnSiY12heNb1GiN/wu+T/FyA==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-openbsd-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-arm64/-/typescript-openbsd-arm64-7.0.2.tgz",
-      "integrity": "sha512-APT8+ClYnuYm1u9+kgGXoMj2VzWzcymwh2gNSQVySHfkRDGOTVkoWLjCmOQSaO+PoqQ57B0flRp9SA+7GnnkzQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-openbsd-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-x64/-/typescript-openbsd-x64-7.0.2.tgz",
-      "integrity": "sha512-yX7s+Q0Dln0Dt9tEzZsAjXXR/+ytBM7AlglaqyeMPxQszJ1JhlJdZ6jLA+IzldHtflX81em7lDao1xXu+aRRkg==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-sunos-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-sunos-x64/-/typescript-sunos-x64-7.0.2.tgz",
-      "integrity": "sha512-dLJDGaLZ1D4HPQn62u1n8mBDkJREwMsAkCdkwd4Ieqw+x3TUyTsqY0YiBCtE6H6OzzgGk3iuZ3vFWRS+E8/d1g==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "sunos"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-win32-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-arm64/-/typescript-win32-arm64-7.0.2.tgz",
-      "integrity": "sha512-Gyl1Vy6OsWesLzmq+EP0Fb7b4Nid5232AvcA2SFcdYreldpNtYFFofPjnt62y9hQy7VTaZp65ICJjuAQRaVcIQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-win32-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-x64/-/typescript-win32-x64-7.0.2.tgz",
-      "integrity": "sha512-0BQ3HkAHHlKLSp1qRvf3SUhGpGsDuhB/jgFw75guyqbxJqEaS0Cw/VFO8i2nHglJUzQCRtMMR/IBAKE3ETMC4g==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
     "node_modules/@typescript/vfs": {
       "version": "1.6.1",
       "resolved": "https://registry.npmjs.org/@typescript/vfs/-/vfs-1.6.1.tgz",
@@ -2004,37 +1657,16 @@
       }
     },
     "node_modules/typescript": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-7.0.2.tgz",
-      "integrity": "sha512-8FYau96o3NKOhbjKi/qNvG/W5jhzxkbdm5sj9AbZ/5T5sWqn3hJgLfGx27sRKZWTvyzCP8dLRBTf5tBTSRVUNA==",
+      "version": "3.9.10",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-3.9.10.tgz",
+      "integrity": "sha512-w6fIxVE/H1PkLKcCPsFqKE7Kv7QUwhU8qQY2MueZXWx5cPZdwFupLgKK3vntcK98BtNHZtAF4LA/yl2a7k8R6Q==",
       "license": "Apache-2.0",
       "bin": {
-        "tsc": "bin/tsc"
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
       },
       "engines": {
-        "node": ">=16.20.0"
-      },
-      "optionalDependencies": {
-        "@typescript/typescript-aix-ppc64": "7.0.2",
-        "@typescript/typescript-darwin-arm64": "7.0.2",
-        "@typescript/typescript-darwin-x64": "7.0.2",
-        "@typescript/typescript-freebsd-arm64": "7.0.2",
-        "@typescript/typescript-freebsd-x64": "7.0.2",
-        "@typescript/typescript-linux-arm": "7.0.2",
-        "@typescript/typescript-linux-arm64": "7.0.2",
-        "@typescript/typescript-linux-loong64": "7.0.2",
-        "@typescript/typescript-linux-mips64el": "7.0.2",
-        "@typescript/typescript-linux-ppc64": "7.0.2",
-        "@typescript/typescript-linux-riscv64": "7.0.2",
-        "@typescript/typescript-linux-s390x": "7.0.2",
-        "@typescript/typescript-linux-x64": "7.0.2",
-        "@typescript/typescript-netbsd-arm64": "7.0.2",
-        "@typescript/typescript-netbsd-x64": "7.0.2",
-        "@typescript/typescript-openbsd-arm64": "7.0.2",
-        "@typescript/typescript-openbsd-x64": "7.0.2",
-        "@typescript/typescript-sunos-x64": "7.0.2",
-        "@typescript/typescript-win32-arm64": "7.0.2",
-        "@typescript/typescript-win32-x64": "7.0.2"
+        "node": ">=4.2.0"
       }
     },
     "node_modules/undici": {
@@ -2049,13 +1681,6 @@
         "node": ">=14.0"
       }
     },
-    "node_modules/undici-types": {
-      "version": "7.18.2",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.18.2.tgz",
-      "integrity": "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/universal-user-agent": {
       "version": "7.0.3",
       "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.3.tgz",

ci/github-script/package.json

@@ -1,11 +1,5 @@
 {
   "private": true,
-  "scripts": {
-    "typecheck": "tsc --build",
-    "testsuite": "node --test",
-    "test": "npm run typecheck && npm run testsuite"
-  },
-  "type": "module",
   "//": [
     "Keep `@actions/core` and `@actions/github` in sync with",
     "https://github.com/actions/github-script/blob/main/package.json."
@@ -16,9 +10,5 @@
     "@actions/github": "9.1.0",
     "bottleneck": "2.19.5",
     "commander": "14.0.3"
-  },
-  "devDependencies": {
-    "@types/node": "24.13.3",
-    "typescript": "7.0.2"
   }
 }

ci/github-script/prepare.js

@@ -1,11 +1,9 @@
-// @ts-nocheck
-import { dismissReviews, postReview } from './reviews.js'
-import { classify } from './supportedBranches.js'
-import supportedSystems from './supportedSystems.js'
-
+const { classify } = require('../supportedBranches.js')
+const { postReview, dismissReviews } = require('./reviews.js')
 const reviewKey = 'prepare'
+const supportedSystems = require('./supportedSystems.js')
 
-export default async ({ github, context, core, dry }) => {
+module.exports = async ({ github, context, core, dry }) => {
   const pull_number = context.payload.pull_request.number
 
   for (const retryInterval of [5, 10, 20, 40, 80]) {
@@ -66,7 +64,7 @@ export default async ({ github, context, core, dry }) => {
       // commits between that base and head is the real base. We can query for this via GitHub's
       // REST API. There can be multiple candidates for the real base with the same number of
       // commits. In this case we pick the "best" candidate by a fixed ordering of branches,
-      // as defined in ci/github-script/supportedBranches.js.
+      // as defined in ci/supportedBranches.js.
       //
       // These requests take a while, when comparing against the wrong release - they need
       // to look at way more than 10k commits in that case. Thus, we try to minimize the

ci/github-script/reviewers.js

@@ -1,5 +1,4 @@
-// @ts-nocheck
-export async function handleReviewers({
+async function handleReviewers({
   github,
   context,
   core,
@@ -183,3 +182,7 @@ export async function handleReviewers({
     teams_reached.size === 0
   )
 }
+
+module.exports = {
+  handleReviewers,
+}

ci/github-script/reviews.js

@@ -1,3 +1,5 @@
+// @ts-check
+
 const eventToState = {
   COMMENT: 'COMMENTED',
   REQUEST_CHANGES: 'CHANGES_REQUESTED',
@@ -14,7 +16,7 @@ const reviewUsers = [
 ]
 
 /**
- * @typedef {InstanceType<typeof import('@actions/github/lib/utils').GitHub>} GitHub
+ * @typedef {InstanceType<import('@actions/github/lib/utils').GitHub>} GitHub
  * @typedef {typeof import('@actions/github').context} Context
  *
  * @typedef {Awaited<ReturnType<GitHub['rest']['pulls']['listReviews']>>['data'][number]} Review
@@ -25,18 +27,12 @@ const reviewUsers = [
  * @param {{
  *  github: GitHub,
  *  context: Context,
- *  core: typeof import('@actions/core'),
+ *  core: import('@actions/core'),
  *  dry: boolean,
  *  reviewKey?: string,
  * }} DismissReviewsProps
  */
-export async function dismissReviews({
-  github,
-  context,
-  core,
-  dry,
-  reviewKey,
-}) {
+async function dismissReviews({ github, context, core, dry, reviewKey }) {
   const pull_number = context.payload.pull_request?.number
   if (!pull_number) {
     core.warning('dismissReviews called outside of pull_request context')
@@ -169,14 +165,14 @@ export async function dismissReviews({
  * @param {{
  *  github: GitHub,
  *  context: Context,
- *  core: typeof import('@actions/core'),
+ *  core: import('@actions/core'),
  *  dry: boolean,
  *  body: string,
- *  event: keyof typeof eventToState,
+ *  event: keyof eventToState,
  *  reviewKey: string,
  * }} PostReviewProps
  */
-export async function postReview({
+async function postReview({
   github,
   context,
   core,
@@ -268,3 +264,8 @@ export async function postReview({
     }
   }
 }
+
+module.exports = {
+  dismissReviews,
+  postReview,
+}

ci/github-script/run

@@ -1,4 +1,4 @@
-#!/usr/bin/env node
+#!/usr/bin/env -S node --import ./run
 import { execSync } from 'node:child_process'
 import { closeSync, mkdtempSync, openSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
@@ -112,8 +112,8 @@ program
   .argument('<repo>', 'Name of the GitHub repository to run on (Example: nixpkgs)')
   .argument('<pr>', 'Number of the Pull Request to run on')
   .action(async (owner, repo, pr, options) => {
-    const checkTargetBranch = (await import('./check-target-branch.ts')).checkTargetBranch
-    await run(checkTargetBranch, owner, repo, pr, options)
+    const checkCommitMessages = (await import('./check-target-branch.js')).default
+    await run(checkCommitMessages, owner, repo, pr, options)
   })
 
 program

ci/github-script/supportedSystems.js

@@ -1,5 +1,4 @@
-// @ts-nocheck
-export default async ({ github, context, targetSha }) => {
+module.exports = async ({ github, context, targetSha }) => {
   const { content, encoding } = (
     await github.rest.repos.getContent({
       ...context.repo,

ci/github-script/tsconfig.json

@@ -1,26 +0,0 @@
-{
-  "compilerOptions": {
-    "lib": [
-      "es2024",
-      "ESNext.Array",
-      "ESNext.Collection",
-      "ESNext.Error",
-      "ESNext.Iterator",
-      "ESNext.Promise"
-    ],
-    "module": "nodenext",
-    "target": "es2024",
-
-    "strict": true,
-    "esModuleInterop": true,
-    "skipLibCheck": true,
-    "moduleResolution": "nodenext",
-
-    "allowImportingTsExtensions": true,
-    "allowJs": true,
-    "checkJs": true,
-    "erasableSyntaxOnly": true,
-    "verbatimModuleSyntax": true,
-    "noEmit": true,
-  }
-}

ci/github-script/withRateLimit.js

@@ -1,7 +1,6 @@
-// @ts-nocheck
-import Bottleneck from 'bottleneck'
+module.exports = async ({ github, core, maxConcurrent = 1 }, callback) => {
+  const Bottleneck = require('bottleneck')
 
-export default async ({ github, core, maxConcurrent = 1 }, callback) => {
   const stats = {
     issues: 0,
     prs: 0,

ci/nixpkgs-vet.nix

@@ -31,7 +31,6 @@ runCommand "nixpkgs-vet"
     env.NIXPKGS_VET_NIX_PACKAGE = nix;
   }
   ''
-    export NIX_STORE_DIR=$(mktemp -d)
     export NIX_STATE_DIR=$(mktemp -d)
     $NIXPKGS_VET_NIX_PACKAGE/bin/nix-store --init
 

ci/pinned.json

@@ -9,22 +9,9 @@
       },
       "branch": "nixpkgs-unstable",
       "submodules": false,
-      "revision": "7525d999cd850b9a488817abc89c75dc733acf17",
-      "url": "https://github.com/NixOS/nixpkgs/archive/7525d999cd850b9a488817abc89c75dc733acf17.tar.gz",
-      "hash": "sha256-4IHyyLgLBdKefkljdKod4IMn023pQiDXAWJA187cmdY="
-    },
-    "nixpkgs-26.05-darwin": {
-      "type": "Git",
-      "repository": {
-        "type": "GitHub",
-        "owner": "NixOS",
-        "repo": "nixpkgs"
-      },
-      "branch": "nixpkgs-26.05-darwin",
-      "submodules": false,
-      "revision": "51fe96f9107566e6b8eeb7fc4ba696c01e548b04",
-      "url": "https://github.com/NixOS/nixpkgs/archive/51fe96f9107566e6b8eeb7fc4ba696c01e548b04.tar.gz",
-      "hash": "sha256-yj0LPLnsmYoLmA3FGANjeTEwej0/DHjZBXWnDQDUuIs="
+      "revision": "421eebfd0ec7bccd4abe826ce62d7e6e83129493",
+      "url": "https://github.com/NixOS/nixpkgs/archive/421eebfd0ec7bccd4abe826ce62d7e6e83129493.tar.gz",
+      "hash": "sha256:1lxfhfgiv1sz2v7fg43gny57sa6wf59n98q7ldsyb2p06f4sal7w"
     }
   },
   "version": 8

ci/supportedBranches.js

@@ -2,9 +2,6 @@
 /*
 #!nix-shell -i node -p nodejs
 */
-// @ts-nocheck
-import { resolve } from 'node:path'
-import { fileURLToPath } from 'node:url'
 
 const typeConfig = {
   master: ['development', 'primary'],
@@ -47,13 +44,10 @@ function classify(branch) {
   }
 }
 
-export { classify, split }
+module.exports = { classify, split }
 
 // If called directly via CLI, runs the following tests:
-if (
-  process.argv[1] &&
-  fileURLToPath(import.meta.url) === resolve(process.argv[1])
-) {
+if (!module.parent) {
   console.log('split(branch)')
   function testSplit(branch) {
     console.log(branch, split(branch))

doc/README.md

@@ -14,12 +14,17 @@ Use **examples** first to show how to get something done. Keep **Explanation** l
 
 Use our [styleguide](./styleguide.md) for more in depth guidance on writing good documentation.
 
-Documentation about Nixpkgs belongs here, this includes 'getting-started'-guides and 'onboarding-guides' for *using* Nixpkgs and the language frameworks it ships.
+This directory contains **guides** and **reference** documentation for Nixpkgs.
 
-Write **guides** task-first: lead with a working example, then explain in prose.
-Write **reference** as the specification of functions and attributes.
+Borrowing from [Diátaxis framework](https://diataxis.fr/) what suits our needs:
 
-We are actively working to generate reference documentation from the [doc-comments](https://github.com/NixOS/rfcs/blob/master/rfcs/0145-doc-strings.md) present in code, which also lets you view it locally with `:doc` in `nix repl`.
+**Guides** are task-oriented. They can be tutorial-style walkthroughs or how-to sections.
+Explanations appear as prose after examples.
+
+**Reference** documentation is the specification of functions and attributes.
+
+We are actively working to generate **all** reference documentation from the [doc-comments](https://github.com/NixOS/rfcs/blob/master/rfcs/0145-doc-strings.md) present in code.
+This also provides the benefit of using `:doc` in the `nix repl` to view reference documentation locally on the fly.
 
 See [Document structure](#document-structure) for a structural template.
 
@@ -193,15 +198,15 @@ watermelon
 - If creating a commit purely for documentation changes, format the commit message in the following way:
 
   ```
-  doc/component: (documentation summary)
+  doc: (documentation summary)
 
   (Motivation for change, relevant links, additional information.)
   ```
 
   Examples:
 
-  * doc/stdenv: update the kernel config documentation to use `nix-shell`
-  * doc/getting-started: add information about `nix-update-script`
+  * doc: update the kernel config documentation to use `nix-shell`
+  * doc: add information about `nix-update-script`
 
     Closes #216321.
 

doc/build-helpers.md

@@ -15,3 +15,15 @@ In addition, it offers various options to customize parts of the builds.
 There is no uniform interface for build helpers.
 [Trivial build helpers](#chap-trivial-builders) and [fetchers](#chap-pkgs-fetchers) have various input types for convenience.
 [Language- or framework-specific build helpers](#chap-language-support) usually follow the style of `stdenv.mkDerivation`, which accepts an attribute set or a fixed-point function taking an attribute set.
+
+```{=include=} chapters
+build-helpers/fixed-point-arguments.chapter.md
+build-helpers/fetchers.chapter.md
+build-helpers/trivial-build-helpers.chapter.md
+build-helpers/testers.chapter.md
+build-helpers/dev-shell-tools.chapter.md
+build-helpers/special.md
+build-helpers/images.md
+hooks/index.md
+packages/index.md
+```

doc/build-helpers/fetchers.chapter.md

@@ -853,7 +853,7 @@ Used with CVS. Expects `cvsRoot`, `tag`, and `hash`.
 
 Used with Mercurial. Expects `url`, `rev`, `hash`, overridable with [`<pkg>.overrideAttrs`](#sec-pkg-overrideAttrs).
 
-A number of fetcher functions wrap lower-level fetchers such as `fetchurl`, `fetchzip`, and `fetchgit`. They are mainly convenience functions intended for commonly used destinations of source code in Nixpkgs. These wrapper fetchers are listed below.
+A number of fetcher functions wrap part of `fetchurl` and `fetchzip`. They are mainly convenience functions intended for commonly used destinations of source code in Nixpkgs. These wrapper fetchers are listed below.
 
 ## `fetchFromGitea`, `fetchFromForgejo` and `fetchFromCodeberg` {#fetchfromgitea}
 
@@ -876,45 +876,6 @@ However, `fetchFromGitHub` will automatically switch to using `fetchgit` in any
 
 When `fetchgit` is used, refer to the `fetchgit` section for documentation of its available options.
 
-## `fetchFromHuggingFace` {#fetchfromhuggingface}
-
-`fetchFromHuggingFace` fetches repositories from Hugging Face Hub. It expects
-`repoId`, exactly one of `rev` or `tag`, and `hash`.
-
-`repoId` must be in the form `repo` or `owner/repo`, so repositories such as
-`gpt2` work as well.
-
-::: {.example #ex-fetchfromhuggingface}
-
-# Fetching a model repository from Hugging Face
-
-```nix
-fetchFromHuggingFace {
-  repoId = "hf-internal-testing/tiny-random-gpt2";
-  rev = "71034c5d8bde858ff824298bdedc65515b97d2b9";
-  backend = "lfs";
-  hash = "sha256-8K9B/C62GW5lXC0c8QQpQ9QAE1UMoG+kYqvGhnWIp64=";
-}
-```
-
-:::
-
-The optional `repoType` argument selects which Hugging Face Hub repository type
-to use:
-
-- `"model"` (default) fetches from `https://huggingface.co/<repo-id>`
-- `"dataset"` fetches from `https://huggingface.co/datasets/<repo-id>`
-- `"space"` fetches from `https://huggingface.co/spaces/<repo-id>`
-
-To use a different Hugging Face Hub instance, use `domain`
-(defaults to `"huggingface.co"`).
-
-The optional `backend` argument defaults to `"xet"`. Because the Xet backend is
-not implemented yet, callers must currently set `backend = "lfs"`, which uses
-`fetchgit` with Git LFS enabled and defaults `fetchSubmodules` to `false`.
-`rootDir`, `sparseCheckout`, and low-level `fetchgit` options such as
-`deepClone`, `fetchTags`, `leaveDotGit`, and `branchName` are also supported.
-
 ## `fetchFromGitLab` {#fetchfromgitlab}
 
 This is used with GitLab repositories. It behaves similarly to `fetchFromGitHub`, and expects `owner`, `repo`, `rev`, and `hash`.
@@ -988,20 +949,6 @@ fetchRadiclePatch {
 }
 ```
 
-## `fetchFromTangled` {#fetchfromtangled}
-
-This is to be used with tangled repositories. `fetchFromTangled` works with
-very similar arguments to `fetchFromGithub`. However, instead of a `owner` and
-`repo`, a `did` argument is expected.
-
-```nix
-fetchFromTangled {
-  did = "did:plc:jj6ajj6duxnlthwtnob4qyuv"; # tranquil.farm/tranquil-pds
-  tag = "v6.6.0";
-  hash = "sha256-cfTsjmK/IMqT5kMKOGpwwWbBlvtrCDOerUJJ8AVI3kY=";
-}
-```
-
 ## `requireFile` {#requirefile}
 
 `requireFile` allows requesting files that cannot be fetched automatically, but whose content is known.

doc/build-helpers/images.md

@@ -1,3 +1,12 @@
 # Images {#chap-images}
 
 This chapter describes tools for creating various types of images.
+
+```{=include=} sections
+images/appimagetools.section.md
+images/dockertools.section.md
+images/ocitools.section.md
+images/portableservice.section.md
+images/makediskimage.section.md
+images/binarycache.section.md
+```

doc/build-helpers/images/appimagetools.section.md

@@ -28,7 +28,7 @@ However, [those were unified early 2020](https://github.com/NixOS/nixpkgs/pull/8
 
 ```nix
 { appimageTools, fetchurl }:
-appimageTools.wrapType2 {
+let
   pname = "nuclear";
   version = "0.6.30";
 
@@ -36,7 +36,8 @@ appimageTools.wrapType2 {
     url = "https://github.com/nukeop/nuclear/releases/download/v${version}/nuclear-v${version}.AppImage";
     hash = "sha256-he1uGC1M/nFcKpMM9JKY4oeexJcnzV0ZRxhTjtJz6xw=";
   };
-}
+in
+appimageTools.wrapType2 { inherit pname version src; }
 ```
 
 :::
@@ -55,7 +56,7 @@ There are a few ways to learn which dependencies an application needs:
 
 ```nix
 { appimageTools, fetchurl }:
-appimageTools.wrapType2 {
+let
   pname = "irccloud";
   version = "0.16.0";
 
@@ -63,7 +64,9 @@ appimageTools.wrapType2 {
     url = "https://github.com/irccloud/irccloud-desktop/releases/download/v${version}/IRCCloud-${version}-linux-x86_64.AppImage";
     hash = "sha256-/hMPvYdnVB1XjKgU2v47HnVvW4+uC3rhRjbucqin4iI=";
   };
-
+in
+appimageTools.wrapType2 {
+  inherit pname version src;
   extraPkgs = pkgs: [ pkgs.at-spi2-core ];
 }
 ```
@@ -85,12 +88,12 @@ However, [those were unified early 2020](https://github.com/NixOS/nixpkgs/pull/8
 
 # Extracting an AppImage to install extra files
 
-`wrapType2` automatically extracts the AppImage for you and makes it available via the `contents` attribute.
-Note how `finalAttrs.contents` is used in `extraInstallCommands` to install additional files that were extracted from the AppImage.
+This example was adapted from a real package in Nixpkgs to show how `extract` is usually used in combination with `wrapType2`.
+Note how `appimageContents` is used in `extraInstallCommands` to install additional files that were extracted from the AppImage.
 
 ```nix
 { appimageTools, fetchurl }:
-appimageTools.wrapType2 (finalAttrs: {
+let
   pname = "irccloud";
   version = "0.16.0";
 
@@ -99,24 +102,27 @@ appimageTools.wrapType2 (finalAttrs: {
     hash = "sha256-/hMPvYdnVB1XjKgU2v47HnVvW4+uC3rhRjbucqin4iI=";
   };
 
+  appimageContents = appimageTools.extract { inherit pname version src; };
+in
+appimageTools.wrapType2 {
+  inherit pname version src;
+
   extraPkgs = pkgs: [ pkgs.at-spi2-core ];
 
   extraInstallCommands = ''
     mv $out/bin/irccloud-${version} $out/bin/irccloud
-    install -m 444 -D ${finalAttrs.contents}/irccloud.desktop $out/share/applications/irccloud.desktop
-    install -m 444 -D ${finalAttrs.contents}/usr/share/icons/hicolor/512x512/apps/irccloud.png \
+    install -m 444 -D ${appimageContents}/irccloud.desktop $out/share/applications/irccloud.desktop
+    install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/512x512/apps/irccloud.png \
       $out/share/icons/hicolor/512x512/apps/irccloud.png
     substituteInPlace $out/share/applications/irccloud.desktop \
       --replace-fail 'Exec=AppRun' 'Exec=irccloud'
   '';
-})
+}
 ```
 
 :::
 
-`appimageTools` also exposes the `extract` function should you need to do it manually, requiring `pname`, `version`, and `src` arguments (`src` being the AppImage file to extract).
-
-The arguments passed to `extract` can also contain a `postExtract` attribute, which allows you to execute additional commands after the files are extracted from the AppImage.
+The argument passed to `extract` can also contain a `postExtract` attribute, which allows you to execute additional commands after the files are extracted from the AppImage.
 `postExtract` must be a string with commands to run.
 
 :::{.warning}
@@ -132,7 +138,7 @@ This is a rewrite of [](#ex-extracting-appimage) to use `postExtract` and `wrapA
 
 ```nix
 { appimageTools, fetchurl }:
-appimageTools.wrapAppImage (finalAttrs: {
+let
   pname = "irccloud";
   version = "0.16.0";
 
@@ -141,22 +147,30 @@ appimageTools.wrapAppImage (finalAttrs: {
     hash = "sha256-/hMPvYdnVB1XjKgU2v47HnVvW4+uC3rhRjbucqin4iI=";
   };
 
-  contents = appimageTools.extract {
-    inherit (finalAttrs) pname version src;
+  appimageContents = appimageTools.extract {
+    inherit pname version src;
     postExtract = ''
       substituteInPlace $out/irccloud.desktop --replace-fail 'Exec=AppRun' 'Exec=irccloud'
     '';
   };
+in
+appimageTools.wrapAppImage {
+  inherit pname version;
+
+  src = appimageContents;
 
   extraPkgs = pkgs: [ pkgs.at-spi2-core ];
 
   extraInstallCommands = ''
     mv $out/bin/irccloud-${version} $out/bin/irccloud
-    install -m 444 -D ${finalAttrs.contents}/irccloud.desktop $out/share/applications/irccloud.desktop
-    install -m 444 -D ${finalAttrs.contents}/usr/share/icons/hicolor/512x512/apps/irccloud.png \
+    install -m 444 -D ${appimageContents}/irccloud.desktop $out/share/applications/irccloud.desktop
+    install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/512x512/apps/irccloud.png \
       $out/share/icons/hicolor/512x512/apps/irccloud.png
   '';
-})
+
+  # specify src archive for nix-update
+  passthru.src = src;
+}
 ```
 
 :::

doc/build-helpers/images/portableservice.section.md

@@ -68,7 +68,7 @@ See [](#ex-portableService-hello) to understand how to use the output of `portab
 
 : Allows you to override the package that provides {manpage}`mksquashfs(1)`, which is used internally by `portableService`.
 
-  _Default value:_ `pkgs.squashfs-tools`.
+  _Default value:_ `pkgs.squashfsTools`.
 
 `squash-compression` (String; _optional_)
 

doc/build-helpers/special.md

@@ -1,3 +1,13 @@
 # Special build helpers {#chap-special}
 
 This chapter describes several special build helpers.
+
+```{=include=} sections
+special/buildenv.section.md
+special/fakenss.section.md
+special/fhs-environments.section.md
+special/makesetuphook.section.md
+special/mkshell.section.md
+special/vm-tools.section.md
+special/checkpoint-build.section.md
+```

doc/contributing.md

@@ -1 +1,10 @@
 # Contributing to Nixpkgs {#part-contributing}
+
+```{=include=} chapters
+contributing/quick-start.chapter.md
+contributing/coding-conventions.chapter.md
+contributing/submitting-changes.chapter.md
+contributing/vulnerability-roundup.chapter.md
+contributing/reviewing-contributions.chapter.md
+contributing/contributing-to-documentation.chapter.md
+```

doc/development.md

@@ -4,3 +4,7 @@ This section shows you how Nixpkgs is developed and how you can interact with th
 If you are interested in contributing yourself, see [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md).
 
 <!-- In the future this section should also include: How to test pull requests, how to know if pull requests are available in channels, etc. -->
+
+```{=include=} chapters
+development/opening-issues.chapter.md
+```

doc/doc-support/include-to-nav.py

@@ -1,204 +0,0 @@
-import json
-import re
-import sys
-from pathlib import Path
-from typing import TypedDict
-
-# Coupled to where this file lives!
-# Needed to resolve the relative includes file paths
-DOC_ROOT = Path(__file__).resolve().parent.parent
-
-ROOT_FILE = DOC_ROOT / "manual.md.in"
-
-INCLUDE_RE = re.compile(r"^```\{=include=\}(?P<rest>.*)$")
-FENCE_RE = re.compile(r"^(```|~~~)")
-HEADING_RE = re.compile(r"^(#{1,6})\s+(.*?)\s*(?:\{#([^}]+)\})?\s*$")
-
-
-class TokenIncludeBlock:
-    """Represents a complete include block like:
-
-    ```{=include=} sections
-    special/buildenv.section.md
-    ```
-
-    As
-
-    typ = "sections"
-    files = [ "special/buildenv.section.md" ]
-
-    """
-    kind = "include"
-
-    def __repr__(self):
-        # For debugging
-        return f"```{{=include=}} {self.typ}\n" "\n".join(self.files) + "\n```"
-
-    def __init__(self, typ, args, files, start, end):
-        self.typ: str = typ
-        self.args: list[str] = args
-        self.files: list[str] = files
-        self.start: int = start
-        self.end: int = end
-
-    def is_option_block(self) -> bool:
-        # option blocks have some special syntax which is part of another migration
-        # 8 coccurrences, seperate migration
-        return self.typ == "options"
-
-    def into_file(self) -> bool:
-        # into-file is trivial after the nav migration
-        # 2 coccurrences, can be migrated by hand
-        return any("html:into-file=" in arg for arg in self.args)
-
-    def keep(self) -> bool:
-        # Keep the include blocks that require seperate migration
-        return self.is_option_block() or self.into_file()
-
-class TokenHeading:
-    kind = "heading"
-
-    def __init__(self, level, title, anchor):
-        self.level: int = level
-        self.title: str = title
-        self.anchor: str = anchor
-
-
-def tokenize(src: str) -> list[TokenIncludeBlock|TokenHeading]:
-    """Finds all Includes and Headings"""
-    lines = src.splitlines()
-    items = []
-    fenced = False
-    i = 0
-    while i < len(lines):
-        line = lines[i]
-        m = INCLUDE_RE.match(line)
-        if m and not fenced:
-            typ, *args = m.group("rest").split()
-            end = i + 1
-            while end < len(lines) and not lines[end].startswith("```"):
-                end += 1
-            if end == len(lines):
-                sys.exit(f"unterminated include block at line {i + 1}")
-            files = [f.strip() for f in lines[i + 1 : end] if f.strip()]
-            items.append(TokenIncludeBlock(typ, args, files, i, end))
-            i = end + 1
-            continue
-        if FENCE_RE.match(line):
-            fenced = not fenced
-            i += 1
-            continue
-        if not fenced:
-            m = HEADING_RE.match(line)
-            if m:
-                items.append(TokenHeading(len(m.group(1)), m.group(2), m.group(3)))
-        i += 1
-    return items
-
-
-def read_source(source: Path) ->  None | tuple[str, Path]:
-    """Read a return [content,Path]
-
-    library.md is called .md.in; provided at build time via nixdoc
-
-    So the filename might differ
-    """
-    if source.exists():
-        return source.read_text(), source
-
-    in_file = Path(str(source) + ".in")
-    if in_file.exists():
-        return in_file.read_text(), in_file
-    return None
-
-# Make sure we process every file only once
-visited = set()
-
-# Map from filename -> line_nrs
-# These lines will be deleted from the file
-rewrites: dict[str, tuple[int,int]] = {}
-
-group_ids: set[str] = set()
-
-class Green(TypedDict):
-    label: str
-    id: str
-    children: list["Green"]
-    file: str | None
-
-def convert_md_in(md_in: Path) -> Green:
-    """Build up items for the nav.json as we recurse.
-    Collecting line-areas and group_ids
-    """
-    if md_in in visited:
-        sys.exit(f"{md_in}: reached twice")
-
-    visited.add(md_in)
-
-    res = read_source(md_in)
-
-    rel_file = md_in.relative_to(DOC_ROOT).as_posix()
-    if not res:
-        return {"file": rel_file}
-
-    text, actual = res
-    token: list[TokenHeading|TokenIncludeBlock] = tokenize(text)
-
-    # Collect a list of actual files to be processed
-    # Recurse for files
-    # Do not recurse for "options", "into-file"
-    all_file_includes: list[TokenIncludeBlock] = [it for it in token if it.kind == "include" and not (it.is_option_block() or it.into_file())]
-    children = [convert_md_in((md_in.parent / f).resolve()) for b in all_file_includes for f in b.files]
-
-    # Lines to rewrite
-    include_blocks_to_rewrite: list[TokenIncludeBlock] = [it for it in all_file_includes if not it.keep()]
-    rewrites[actual] = [(b.start, b.end) for b in include_blocks_to_rewrite]
-
-    if not children:
-        return {"file": rel_file}
-
-    title = next((it for it in token if it.kind == "heading" and it.level == 1), None)
-    if title is None:
-        sys.exit(f"{md_in}: no level-1 heading to label its group")
-    if not title.anchor:
-        sys.exit(f"{md_in}: level-1 heading has no id")
-    if title.anchor in group_ids:
-        sys.exit(f"{md_in}: duplicate group id {title.anchor}")
-    group_ids.add(title.anchor)
-
-    return Green({
-        "label": title.title.replace("`", ""),
-        "id": title.anchor,
-        "children": [{"file": rel_file}] + children,
-    })
-
-
-def remove_includes(path: Path, drop_lines: tuple[int,int]):
-    if not drop_lines:
-        return
-
-    lines = path.read_text().splitlines()
-    for start, end in sorted(drop_lines, reverse=True):
-        del lines[start : end + 1]
-        if 0 < start < len(lines) and not lines[start - 1].strip() and not lines[start].strip():
-            del lines[start]
-    while lines and not lines[-1].strip():
-        lines.pop()
-    path.write_text("\n".join(lines) + "\n")
-
-
-def main():
-    nav = DOC_ROOT / "nav.json"
-    if json.loads(nav.read_text())["items"]:
-        sys.exit("nav.json already has items; This tool can only run once")
-
-    root = convert_md_in(ROOT_FILE)
-    items = root["children"][1:]
-
-    nav.write_text(json.dumps({"open": [], "items": items}, indent=2) + "\n")
-    for path, lines in rewrites.items():
-        remove_includes(path, lines)
-
-
-if __name__ == "__main__":
-    main()

doc/doc-support/package.nix

@@ -118,7 +118,7 @@ stdenvNoCC.mkDerivation (
         --script ./anchor.min.js \
         --script ./anchor-use.js \
         --sidebar-depth 3 \
-        --experimental-config ./nav.json \
+        --nav ./nav.json \
         --header ${./header.html}\
         --no-navheader \
         manual.md \

doc/functions.md

@@ -1,3 +1,11 @@
 # Functions reference {#chap-functions}
 
 The Nixpkgs repository has several utility functions to manipulate Nix expressions.
+
+```{=include=} sections
+functions/library.md
+functions/generators.section.md
+functions/debug.section.md
+functions/prefer-remote-fetch.section.md
+functions/nix-gitignore.section.md
+```

doc/getting-started/dev-environments.md

@@ -1,49 +0,0 @@
-# Dev environments {#dev-environments}
-
-Create a `shell.nix` with the following:
-
-```nix
-# shell.nix
-let
-  nixpkgs = fetchTarball "https://github.com/NixOS/nixpkgs/archive/nixos-unstable.tar.gz";
-  pkgs = import nixpkgs { };
-in
-pkgs.mkShell {
-  packages = [ pkgs.python3 ];
-  shellHook = ''
-    echo "Welcome in my nix shell"
-  '';
-}
-```
-
-run
-
-```sh
-nix-shell
-```
-
-This activates your `shell.nix` and you should see:
-
-```sh
-unpacking 'https://github.com/NixOS/nixpkgs/archive/nixos-unstable.tar.gz' into the Git cache...
-Welcome in your nix shell
-```
-
-python3 is available
-
-```sh
-$ python3 --version
-```
-
-To leave the shell
-
-```bash
-ctrl+D
-```
-
-:::{.note}
-You should use [pinned nixpkgs](https://nix.dev/guides/recipes/dependency-management.html).
-The example used `unstable` here for demonstration purposes only
-:::
-
-For further information check out [nix-shell](https://nix.dev/manual/nix/stable/command-ref/nix-shell)

doc/getting-started/getting-started.part.md

@@ -1 +0,0 @@
-# Getting started {#getting-started}

doc/hooks/ghc.section.md

@@ -0,0 +1,3 @@
+# GHC {#ghc}
+
+Creates a temporary package database and registers every Haskell build input in it (TODO: how?).

doc/hooks/index.md

@@ -4,3 +4,54 @@ Nixpkgs has several hook packages that augment the stdenv phases.
 
 The stdenv built-in hooks are documented in [](#ssec-setup-hooks).
 
+```{=include=} sections
+autoconf.section.md
+automake.section.md
+autopatchcil.section.md
+autopatchelf.section.md
+aws-c-common.section.md
+bmake.section.md
+breakpoint.section.md
+cernlib.section.md
+check-phase-thread-limit-hook.section.md
+cmake.section.md
+desktop-file-utils.section.md
+gdk-pixbuf.section.md
+ghc.section.md
+gnome.section.md
+haredo.section.md
+installShellFiles.section.md
+installFonts.section.md
+julec.section.md
+just.section.md
+libglycin.section.md
+libiconv.section.md
+libxml2.section.md
+meson.section.md
+mpi-check-hook.section.md
+ninja.section.md
+nodejs-install-executables.section.md
+nodejs-install-manuals.section.md
+npm-build-hook.section.md
+npm-config-hook.section.md
+npm-install-hook.section.md
+patch-rc-path-hooks.section.md
+perl.section.md
+pkg-config.section.md
+pnpm.section.md
+postgresql-test-hook.section.md
+premake.section.md
+python.section.md
+scons.section.md
+tauri.section.md
+tetex-tex-live.section.md
+udevCheckHook.section.md
+unzip.section.md
+validatePkgConfig.section.md
+versionCheckHook.section.md
+waf.section.md
+writable-tmpdir-as-home-hook.section.md
+zig.section.md
+xcbuild.section.md
+xfce4-dev-tools.section.md
+```

doc/hooks/juce.section.md

@@ -24,10 +24,10 @@ stdenv.mkDerivation {
 
 ## Variables controlling `juce.projucerHook` {#juce-projucer-hook-variables}
 
-### `dontUseProjucerConfigure` {#juce-dontuseprojucerconfigure}
+### `dontUseProjucerConfigure`
 
 Disables `projucerConfigurePhase`
 
-### `dontUseProjucerInstall` {#juce-dontuseprojucerinstall}
+### `dontUseProjucerInstall`
 
 Disables `projucerInstallPhase`

doc/hooks/writable-tmpdir-as-home-hook.section.md

@@ -2,4 +2,4 @@
 
 This setup hook provides a writable home directory for packages that require it.
 
-To use, just add the hook to the `nativeBuildInputs` (or `nativeCheckInputs`, `nativeInstallCheckInputs`, etc.) of the package.
+To use, just add the hook to the `nativeBuildInputs` of the package.

doc/interoperability.md

@@ -1 +1,5 @@
 # Interoperability Standards {#part-interoperability}
+
+```{=include=} chapters
+interoperability/cyclonedx.md
+```

doc/languages-frameworks/android.section.md

@@ -116,7 +116,7 @@ options:
 For each requested system image we can specify the following options:
 
 * `systemImageTypes` specifies what kind of system images should be included.
-  Defaults to: `google_apis`, `google_apis_playstore`, `google_apis_ps16k` and `google_apis_playstore_ps16k`.
+  Defaults to: `default`.
 * `abiVersions` specifies what kind of ABI version of each system image should
   be included. Defaults to `armeabi-v7a` and `arm64-v8a`.
 

doc/languages-frameworks/beam.section.md

@@ -34,21 +34,17 @@ Inside each package set are:
 - builders: mixRelease, buildRebar3, etc
 - hooks: for composing builders and packages
 
-The package set is the only place Erlang and Elixir versions are chosen. Builders such as `mixRelease`, `fetchMixDeps` and `buildMix` take them from the set they are called from, and do not accept `erlang`, `elixir` or `hex` arguments.
-
-To use a non-default Elixir, derive a new set with `overrideScope`. This keeps the rest of the set consistent, so every builder picks up the overridden Elixir:
+To use a non-default Elixir it's important to keep the rest of the package set consistent, so it's recommended to use `.extend`. This ensures that builders like `mixRelease`, `fetchMixDeps`, and `buildMix` all pick up the overridden Elixir:
 
 ```nix
 let
-  beamPackages = beam27Packages.overrideScope (final: prev: { elixir = final.elixir_1_18; });
+  beamPackages = beam27Packages.extend (self: super: { elixir = self.elixir_1_18; });
 in
 beamPackages.mixRelease {
   # ...
 }
 ```
 
-`erlang` can be replaced the same way, which is useful for a patched OTP. Every member of the set is built from the set's own `erlang`, so overriding it rebuilds Elixir, Rebar3 and the rest against it.
-
 ## Build Tools {#beam-build-tools}
 
 ### Rebar3 {#beam-build-tools-rebar3}
@@ -210,7 +206,7 @@ Here is how your `default.nix` file would look for a Phoenix project.
   # beam27Packages or beam29Packages is available if you need a particular version
   beamPackages,
 }:
-beamPackages.mixRelease (finalAttrs: {
+let
   pname = "your_project";
   version = "0.0.1";
 
@@ -219,6 +215,24 @@ beamPackages.mixRelease (finalAttrs: {
     rev = "replace_with_your_commit";
   };
 
+  # if using mix2nix you can use the mixNixDeps attribute
+  mixFodDeps = beamPackages.fetchMixDeps {
+    pname = "mix-deps-${pname}";
+    inherit src version;
+    # nix will complain and tell you the right value to replace this with
+    hash = lib.fakeHash;
+    mixEnv = ""; # default is "prod", when empty includes all dependencies, such as "dev", "test".
+    # if you have build time environment variables add them here
+    MY_ENV_VAR = "my_value";
+  };
+in
+beamPackages.mixRelease {
+  inherit
+    src
+    pname
+    version
+    mixFodDeps
+    ;
   # if you have build time environment variables add them here
   MY_ENV_VAR = "my_value";
 
@@ -228,18 +242,7 @@ beamPackages.mixRelease (finalAttrs: {
     mix do deps.loadpaths --no-deps-check, phx.digest
     mix phx.digest --no-deps-check
   '';
-
-  # if using mix2nix you can use the mixNixDeps attribute
-  mixFodDeps = beamPackages.fetchMixDeps {
-    pname = "mix-deps-${finalAttrs.pname}";
-    inherit (finalAttrs) src version;
-    # nix will complain and tell you the right value to replace this with
-    hash = lib.fakeHash;
-    mixEnv = ""; # default is "prod", when empty includes all dependencies, such as "dev", "test".
-    # if you have build time environment variables add them here
-    MY_ENV_VAR = "my_value";
-  };
-})
+}
 ```
 
 Setup will require the following steps:
@@ -336,8 +339,8 @@ Usually, we need to create a `shell.nix` file and do our development inside the
 
 with pkgs;
 let
-  # pin OTP via beam27Packages/beam28Packages/... and Elixir via overrideScope
-  beamPackages = beam27Packages.overrideScope (final: prev: { elixir = final.elixir_1_18; });
+  # pin OTP via beam27Packages/beam28Packages/... and Elixir via .extend
+  beamPackages = beam27Packages.extend (self: super: { elixir = self.elixir_1_18; });
 in
 mkShell { buildInputs = [ beamPackages.elixir ]; }
 ```
@@ -372,8 +375,8 @@ Here is an example `shell.nix`.
 with import <nixpkgs> { };
 
 let
-  # pin OTP via beam27Packages/beam28Packages/... and Elixir via overrideScope
-  beamPackages = beam27Packages.overrideScope (final: prev: { elixir = final.elixir_1_18; });
+  # pin OTP via beam27Packages/beam28Packages/... and Elixir via .extend
+  beamPackages = beam27Packages.extend (self: super: { elixir = self.elixir_1_18; });
 
   # define packages to install
   basePackages = [

doc/languages-frameworks/index.md

@@ -53,3 +53,56 @@ Each supported language or software ecosystem has its own package set named `<la
   …
   ```
   :::
+
+```{=include=} sections
+agda.section.md
+android.section.md
+astal.section.md
+beam.section.md
+chicken.section.md
+cosmic.section.md
+crystal.section.md
+cuda.section.md
+cuelang.section.md
+dart.section.md
+dhall.section.md
+dlang.section.md
+dotnet.section.md
+emscripten.section.md
+factor.section.md
+gnome.section.md
+go.section.md
+gradle.section.md
+hare.section.md
+haskell.section.md
+hy.section.md
+idris.section.md
+idris2.section.md
+ios.section.md
+java.section.md
+javascript.section.md
+julia.section.md
+lean4.section.md
+lisp.section.md
+lua.section.md
+maven.section.md
+nim.section.md
+ocaml.section.md
+octave.section.md
+perl.section.md
+php.section.md
+pkg-config.section.md
+python.section.md
+qt.section.md
+r.section.md
+rocq.section.md
+ruby.section.md
+rust.section.md
+scheme.section.md
+swift.section.md
+tcl.section.md
+texlive.section.md
+typst.section.md
+vim.section.md
+neovim.section.md
+```

doc/languages-frameworks/javascript.section.md

@@ -1,30 +1,49 @@
-# JavaScript {#language-javascript}
+# Javascript {#language-javascript}
 
 ## Introduction {#javascript-introduction}
 
-Package JavaScript applications with the tools below.
+This contains instructions on how to package JavaScript applications.
+
+The various tools available will be listed in the [tools-overview](#javascript-tools-overview).
+Some general principles for packaging will follow.
+Finally, some tool-specific instructions will be given.
+
+## Getting unstuck / finding code examples {#javascript-finding-examples}
+
+If you find you are lacking inspiration for packaging JavaScript applications, the links below might prove useful.
+Searching online for prior art can be helpful if you are running into solved problems.
+
+### Github {#javascript-finding-examples-github}
+
+- Searching Nix files for `yarnConfigHook`: <https://github.com/search?q=yarnConfigHook+language%3ANix&type=code>
+- Searching just `flake.nix` files for `yarnConfigHook`: <https://github.com/search?q=yarnConfigHook+path%3A**%2Fflake.nix&type=code>
+
+### Gitlab {#javascript-finding-examples-gitlab}
+
+- Searching Nix files for `yarnConfigHook`: <https://gitlab.com/search?scope=blobs&search=yarnConfigHook+extension%3Anix>
+- Searching just `flake.nix` files for `yarnConfigHook`: <https://gitlab.com/search?scope=blobs&search=yarnConfigHook+filename%3Aflake.nix>
 
 ## Tools overview {#javascript-tools-overview}
 
 ## General principles {#javascript-general-principles}
 
-The principles below are ordered by importance.
+The following principles are given in order of importance with potential exceptions.
 
-### Use the project's Node.js version {#javascript-upstream-node-version}
+### Try to use the same node version used upstream {#javascript-upstream-node-version}
 
-It is often not documented which Node.js version the project uses, but if it is, use the same version when packaging.
+It is often not documented which node version is used upstream, but if it is, try to use the same version when packaging.
 
-This can be a problem if the project uses the latest and greatest and you are trying to use an earlier version of Node.js.
+This can be a problem if upstream is using the latest and greatest and you are trying to use an earlier version of node.
 Some cryptic errors regarding V8 may appear.
 
-### Use the project's package manager and lock file {#javascript-upstream-package-manager}
+### Try to respect the package manager originally used by upstream (and use the upstream lock file) {#javascript-upstream-package-manager}
 
 A lock file (package-lock.json, yarn.lock...) is supposed to make reproducible installations of `node_modules` for each tool.
 
-Package manager guidelines recommend committing those lock files to the repository.
-If a particular lock file is present, it is a strong indication of which package manager the project uses.
+Guidelines of package managers, recommend to commit those lock files to the repos.
+If a particular lock file is present, it is a strong indication of which package manager is used upstream.
 
-Use a Nix tool that understands the lock file.
+It's better to try to use a Nix tool that understands the lock file.
 Using a different tool might give you a hard-to-understand error because different packages have been installed.
 
 Using a different tool forces you to commit a lock file to the repository.
@@ -32,16 +51,16 @@ These files are fairly large, so when packaging for nixpkgs, this approach does
 
 Exceptions to this rule are:
 
-- When you encounter one of the bugs from a Nix tool. In each of the tool-specific instructions, known problems are detailed. If a tool has a problem, try another. You may have to re-create a lock file and commit it to Nixpkgs.
-- Some lock files contain a particular version of a package that has been pulled off npm for some reason. In that case, you can recreate the lock file (by removing the original and running `npm install`, `yarn`, etc.) and commit this to Nixpkgs.
+- When you encounter one of the bugs from a Nix tool. In each of the tool-specific instructions, known problems will be detailed. If you have a problem with a particular tool, then it's best to try another tool, even if this means you will have to re-create a lock file and commit it to Nixpkgs.
+- Some lock files contain particular version of a package that has been pulled off npm for some reason. In that case, you can recreate upstream lock (by removing the original and `npm install`, `yarn`, ...) and commit this to nixpkgs.
 
-### Use the project's `package.json` {#javascript-upstream-package-json}
+### Try to use upstream package.json {#javascript-upstream-package-json}
 
 Exceptions to this rule are:
 
-- Sometimes the project assumes some dependencies are installed globally. Add them to the `package.json` manually (`yarn add xxx` or `npm install xxx`). Run locally installed CLI tools with `npx`, for example `npx postcss`. That is how you call them in the phases.
+- Sometimes the upstream repo assumes some dependencies should be installed globally. In that case, you can add them manually to the upstream `package.json` (`yarn add xxx` or `npm install xxx`, ...). Dependencies that are installed locally can be executed with `npx` for CLI tools (e.g. `npx postcss ...`, this is how you can call those dependencies in the phases).
 - Sometimes there is a version conflict between some dependency requirements. In that case you can fix a version by removing the `^`.
-- Sometimes a script in `package.json` does not work as is. It might call a CLI tool that is not available, or `cd` into a directory with a different `package.json`, which is common with workspaces. Read what the script does. Reproduce it in the build phases. For example, a `build` script may call `build:ui` and `build:server` in turn. If one fails, split them into separate steps.
+- Sometimes the script defined in the package.json does not work as is. Some scripts for example use CLI tools that might not be available, or cd in directory with a different package.json (for workspaces notably). In that case, it's perfectly fine to look at what the particular script is doing and break this down in the phases. In the build script you can see `build:*` calling in turns several other build scripts like `build:ui` or `build:server`. If one of those fails, you can try to separate those into,
 
   ```sh
   yarn build:ui
@@ -51,7 +70,7 @@ Exceptions to this rule are:
   npm run build:server
   ```
 
-  When you need to override `package.json`, it is best to use the one from the project and make explicit overrides. Here is an example:
+  when you need to override a package.json. It's nice to use the one from the upstream source and do some explicit override. Here is an example:
 
   ```nix
   {
@@ -63,22 +82,22 @@ Exceptions to this rule are:
   }
   ```
 
-  You still need to commit the modified version of the lock files, but at least the overrides are explicit for everyone to see.
+  You will still need to commit the modified version of the lock files, but at least the overrides are explicit for everyone to see.
 
-### Use `node_modules` directly {#javascript-using-node_modules}
+### Using node_modules directly {#javascript-using-node_modules}
 
-Each tool has an abstraction to build the node_modules (dependencies) directory.
+Each tool has an abstraction to just build the node_modules (dependencies) directory.
 You can always use the `stdenv.mkDerivation` with the node_modules to build the package (symlink the node_modules directory and then use the package build command).
-The `node_modules` abstraction can also be used to build some web framework frontends.
-For an example of this, see how [plausible](https://github.com/NixOS/nixpkgs/blob/master/pkgs/by-name/pl/plausible/package.nix) is built.
-Then, when building the frontend, you can symlink the `node_modules` directory.
+The node_modules abstraction can be also used to build some web framework frontends.
+For an example of this see how [plausible](https://github.com/NixOS/nixpkgs/blob/master/pkgs/by-name/pl/plausible/package.nix) is built.
+Then when building the frontend you can just symlink the node_modules directory.
 
 ## Tool-specific instructions {#javascript-tool-specific}
 
 ### buildNpmPackage {#javascript-buildNpmPackage}
 
-`buildNpmPackage` packages npm-based projects in Nixpkgs without the use of an auto-generated dependencies file.
-It uses npm's cache. It builds a reproducible cache of the project's dependencies and points npm at it.
+`buildNpmPackage` allows you to package npm-based projects in Nixpkgs without the use of an auto-generated dependencies file.
+It works by utilizing npm's cache functionality -- creating a reproducible cache that contains the dependencies of a project, and pointing npm to it.
 
 Here's an example:
 
@@ -116,9 +135,9 @@ buildNpmPackage (finalAttrs: {
 })
 ```
 
-In the default `installPhase` set by `buildNpmPackage`, it uses `npm pack --json --dry-run` to decide what files to install. They go in `$out/lib/node_modules/$name/`, where `$name` is the `name` string in the package's `package.json`.
+In the default `installPhase` set by `buildNpmPackage`, it uses `npm pack --json --dry-run` to decide what files to install in `$out/lib/node_modules/$name/`, where `$name` is the `name` string defined in the package's `package.json`.
 Additionally, the `bin` and `man` keys in the source's `package.json` are used to decide what binaries and manpages are supposed to be installed.
-If these are not defined, `npm pack` may miss some files, and no binaries are produced.
+If these are not defined, `npm pack` may miss some files, and no binaries will be produced.
 
 #### Arguments {#javascript-buildNpmPackage-arguments}
 
@@ -153,8 +172,8 @@ sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
 
 `fetchNpmDeps` is a Nix function that requires the following mandatory arguments:
 
-- `src`: A directory or tarball with a `package-lock.json` file
-- `hash`: The output hash of the dependencies defined in `package-lock.json`.
+- `src`: A directory / tarball with `package-lock.json` file
+- `hash`: The output hash of the node dependencies defined in `package-lock.json`.
 
 It returns a derivation with all `package-lock.json` dependencies downloaded into `$out/`, usable as an npm cache.
 
@@ -168,7 +187,7 @@ There is no need to specify a `hash`, since it relies entirely on the integrity
 
 ##### Inputs {#javascript-buildNpmPackage-inputs}
 
-- `npmRoot`: Path to the package directory containing the source tree.
+- `npmRoot`: Path to package directory containing the source tree.
   If this is omitted, the `package` and `packageLock` arguments must be specified instead.
 - `package`: Parsed contents of `package.json`
 - `packageLock`: Parsed contents of `package-lock.json`
@@ -176,7 +195,7 @@ There is no need to specify a `hash`, since it relies entirely on the integrity
 - `version`: Package version
 - `fetcherOpts`: An attribute set of arguments forwarded to the underlying fetcher.
 
-It returns a derivation with a patched `package.json` and `package-lock.json` with all dependencies resolved to Nix store paths.
+It returns a derivation with a patched `package.json` & `package-lock.json` with all dependencies resolved to Nix store paths.
 
 :::{.note}
 `npmHooks.npmConfigHook` cannot be used with `importNpmLock`.
@@ -238,18 +257,18 @@ buildNpmPackage {
 
 `importNpmLock.buildNodeModules` returns a derivation with a pre-built `node_modules` directory, as imported by `importNpmLock`.
 
-This is to be used together with `importNpmLock.hooks.linkNodeModulesHook` to support `nix-shell`/`nix develop` development workflows.
+This is to be used together with `importNpmLock.hooks.linkNodeModulesHook` to facilitate `nix-shell`/`nix develop` based development workflows.
 
 It accepts an argument with the following attributes:
 
 `npmRoot` (Path; optional)
-: Path to the package directory containing the source tree. If not specified, the `package` and `packageLock` arguments must both be specified.
+: Path to package directory containing the source tree. If not specified, the `package` and `packageLock` arguments must both be specified.
 
 `package` (Attrset; optional)
 : Parsed contents of `package.json`, as returned by `lib.importJSON ./my-package.json`. If not specified, the `package.json` in `npmRoot` is used.
 
 `packageLock` (Attrset; optional)
-: Parsed contents of `package-lock.json`, as returned by `lib.importJSON ./my-package-lock.json`. If not specified, the `package-lock.json` in `npmRoot` is used.
+: Parsed contents of `package-lock.json`, as returned `lib.importJSON ./my-package-lock.json`. If not specified, the `package-lock.json` in `npmRoot` is used.
 
 `derivationArgs` (`mkDerivation` attrset; optional)
 : Arguments passed to `stdenv.mkDerivation`
@@ -269,26 +288,26 @@ pkgs.mkShell {
   };
 }
 ```
-creates a development shell where a `node_modules` directory is created and packages are symlinked to the Nix store when activated.
+will create a development shell where a `node_modules` directory is created & packages symlinked to the Nix store when activated.
 
 :::{.note}
-Commands like `npm install` and `npm add` that write packages and executables need to be used with `--package-lock-only`.
+Commands like `npm install` & `npm add` that write packages & executables need to be used with `--package-lock-only`.
 
-This means `npm` installs dependencies by writing into `package-lock.json` without modifying the `node_modules` folder. It installs by reloading the devShell.
-This gives the `nix shell` near-exclusive ownership over your `node_modules` folder.
+This means `npm` installs dependencies by writing into `package-lock.json` without modifying the `node_modules` folder. Installation happens through reloading the devShell.
+This might be best practice since it gives the `nix shell` virtually exclusive ownership over your `node_modules` folder.
 
-Set `package-lock-only = true` in your project-local [`.npmrc`](https://docs.npmjs.com/cli/v11/configuring-npm/npmrc).
+It's recommended to set `package-lock-only = true` in your project-local [`.npmrc`](https://docs.npmjs.com/cli/v11/configuring-npm/npmrc).
 :::
 
 ### corepack {#javascript-corepack}
 
-This package puts the corepack wrappers for pnpm and yarn in your PATH, and they honor the `packageManager` setting in the `package.json`.
+This package puts the corepack wrappers for pnpm and yarn in your PATH, and they will honor the `packageManager` setting in the `package.json`.
 
 ### pnpm {#javascript-pnpm}
 
 pnpm is available as the top-level package `pnpm`. Additionally, there are variants pinned to certain major versions, like `pnpm_9`, `pnpm_10`, `pnpm_10_29_2` and `pnpm_11`, which support different sets of lock file versions.
 
-When packaging an application that includes a `pnpm-lock.yaml`, you need to fetch the pnpm store for that project using a fixed-output-derivation. The function `fetchPnpmDeps` can create this pnpm store derivation. In conjunction, the setup hook `pnpmConfigHook` prepares the build environment to install the pre-fetched dependencies store. The example below uses the fetcher and setup hook for a package that has `package.json` and `pnpm-lock.yaml`:
+When packaging an application that includes a `pnpm-lock.yaml`, you need to fetch the pnpm store for that project using a fixed-output-derivation. The function `fetchPnpmDeps` can create this pnpm store derivation. In conjunction, the setup hook `pnpmConfigHook` will prepare the build environment to install the pre-fetched dependencies store. Here is an example for a package that contains `package.json` and a `pnpm-lock.yaml` files using the fetcher and setup hook above:
 
 There is also the [`pnpmBuildHook`](#pnpm-build-hook) for building packages with `pnpm`, as seen in [](#ex-pnpm-build-hook).
 
@@ -331,7 +350,7 @@ stdenv.mkDerivation (finalAttrs: {
 })
 ```
 
-Use a pinned version of pnpm (for example `pnpm_9` or `pnpm_10`) to increase reproducibility. An older version may be required if the package needs a certain lock file version. To do so, pass the `pnpm` argument to `fetchPnpmDeps`. Then override the `pnpm` arg in `pnpmConfigHook`. Here are the changes in the example above to use a pinned pnpm version:
+It is highly recommended to use a pinned version of pnpm (i.e., `pnpm_9` or `pnpm_10`), to increase future reproducibility. It might also be required to use an older version if the package needs support for a certain lock file version. To do so, you can pass the `pnpm` argument to `fetchPnpmDeps` and override the `pnpm` arg in `pnpmConfigHook`. Here are the changes in the example above to use a pinned pnpm version:
 
 <!-- TODO: Does splicing still work when overriding in nativeBuildInputs here? -->
 
@@ -373,7 +392,7 @@ Use a pinned version of pnpm (for example `pnpm_9` or `pnpm_10`) to increase rep
  })
 ```
 
-In case you are patching `package.json` or `pnpm-lock.yaml`, make sure to pass `finalAttrs.patches` to the function as well (i.e., `inherit (finalAttrs) patches`).
+In case you are patching `package.json` or `pnpm-lock.yaml`, make sure to pass `finalAttrs.patches` to the function as well (i.e., `inherit (finalAttrs) patches`.
 
 `pnpmConfigHook` supports adding additional `pnpm install` flags via `pnpmInstallFlags` which can be set to a Nix string array:
 
@@ -389,14 +408,14 @@ In case you are patching `package.json` or `pnpm-lock.yaml`, make sure to pass `
 }
 ```
 
-If needed, set `dontPnpmConfigure = true;` to fully disable `pnpmConfigHook` without removing it from inputs manually.
+If needed, `dontPnpmConfigure = true;` can be used to fully disable `pnpmConfigHook` without manually removing it from inputs.
 
 #### Dealing with `sourceRoot` {#javascript-pnpm-sourceRoot}
 
-If the pnpm project is in a subdirectory, you can define `sourceRoot` or `setSourceRoot` for `fetchPnpmDeps`.
-If `sourceRoot` is different between the parent derivation and `fetchPnpmDeps`, you have to set `pnpmRoot` to effectively be the same location as it is in `fetchPnpmDeps`.
+If the pnpm project is in a subdirectory, you can just define `sourceRoot` or `setSourceRoot` for `fetchPnpmDeps`.
+If `sourceRoot` is different between the parent derivation and `fetchPnpmDeps`, you will have to set `pnpmRoot` to effectively be the same location as it is in `fetchPnpmDeps`.
 
-Assuming the directory structure below, you can define `sourceRoot` and `pnpmRoot`:
+Assuming the following directory structure, we can define `sourceRoot` and `pnpmRoot` as follows:
 
 ```
 .
@@ -420,9 +439,10 @@ Assuming the directory structure below, you can define `sourceRoot` and `pnpmRoo
 }
 ```
 
-#### pnpm workspaces {#javascript-pnpm-workspaces}
+#### PNPM Workspaces {#javascript-pnpm-workspaces}
 
-For a pnpm workspace, set `pnpmWorkspaces = [ "<workspace project name 1>" "<workspace project name 2>" ]` in your `fetchPnpmDeps` call. pnpm then installs only the dependencies for those workspace packages.
+If you need to use a PNPM workspace for your project, then set `pnpmWorkspaces = [ "<workspace project name 1>" "<workspace project name 2>" ]`, etc, in your `fetchPnpmDeps` call,
+which will make PNPM only install dependencies for those workspace packages.
 
 For example:
 
@@ -438,9 +458,9 @@ For example:
 ```
 
 The above would make `fetchPnpmDeps` call only install dependencies for the `@astrojs/language-server` workspace package.
-You do not need to set `sourceRoot` to make this work.
+Note that you do not need to set `sourceRoot` to make this work.
 
-For these projects, build with `pnpm --filter=<pnpm workspace name> build`, because `npmHooks.npmBuildHook` may not work. The example below fits most workspace projects:
+Usually, in such cases, you'd want to use `pnpm --filter=<pnpm workspace name> build` to build your project, as `npmHooks.npmBuildHook` probably won't work. A `buildPhase` based on the following example will probably fit most workspace projects:
 
 ```nix
 {
@@ -454,9 +474,9 @@ For these projects, build with `pnpm --filter=<pnpm workspace name> build`, beca
 }
 ```
 
-#### Additional pnpm commands and settings {#javascript-pnpm-extraCommands}
+#### Additional PNPM Commands and settings {#javascript-pnpm-extraCommands}
 
-If you require setting an additional pnpm configuration setting (such as `dedupe-peer-dependents` or similar),
+If you require setting an additional PNPM configuration setting (such as `dedupe-peer-dependents` or similar),
 set `prePnpmInstall` to the right commands to run. For example:
 
 ```nix
@@ -471,11 +491,11 @@ set `prePnpmInstall` to the right commands to run. For example:
 }
 ```
 
-In this example, `prePnpmInstall` runs in both `pnpmConfigHook` and the `fetchPnpmDeps` builder.
+In this example, `prePnpmInstall` will be run by both `pnpmConfigHook` and by the `fetchPnpmDeps` builder.
 
 #### pnpm `fetcherVersion` {#javascript-pnpm-fetcherVersion}
 
-This is the version of the output of `fetchPnpmDeps`. Use `4` for new packages:
+This is the version of the output of `fetchPnpmDeps`. New packages should use `4`:
 
 ```nix
 {
@@ -491,7 +511,7 @@ This is the version of the output of `fetchPnpmDeps`. Use `4` for new packages:
 When upgrading to a newer `fetcherVersion`, you need to regenerate the hash.
 
 This variable ensures that we can make changes to the output of `fetchPnpmDeps` without breaking existing hashes.
-Changes can include workarounds or bug fixes to existing pnpm issues.
+Changes can include workarounds or bug fixes to existing PNPM issues.
 
 ##### Version history {#javascript-pnpm-fetcherVersion-versionHistory}
 
@@ -504,9 +524,9 @@ Version 3 is the minimum supported value. Versions 1 and 2 were removed in the 2
 
 ### Yarn {#javascript-yarn}
 
-Yarn-based projects use a `yarn.lock` file instead of a `package-lock.json` to pin dependencies.
+Yarn based projects use a `yarn.lock` file instead of a `package-lock.json` to pin dependencies.
 
-To package Yarn-based applications, you need to distinguish by the version pointers in the `yarn.lock` file. See the following sections.
+To package yarn-based applications, you need to distinguish by the version pointers in the `yarn.lock` file. See the following sections.
 
 #### Yarn v1 {#javascript-yarn-v1}
 
@@ -575,12 +595,12 @@ This script by default runs `yarn --offline build`, and it relies upon the proje
 
 ##### `yarnInstallHook` arguments {#javascript-yarninstallhook}
 
-To install the package, `yarnInstallHook` uses both `npm` and `yarn` to clean up project files and dependencies. To disable this phase, you can set `dontYarnInstall = true` or override the `installPhase`. Below is a list of additional `mkDerivation` arguments read by this hook:
+To install the package `yarnInstallHook` uses both `npm` and `yarn` to cleanup project files and dependencies. To disable this phase, you can set `dontYarnInstall = true` or override the `installPhase`. Below is a list of additional `mkDerivation` arguments read by this hook:
 
 - `yarnKeepDevDeps`: Disables the removal of devDependencies from `node_modules` before installation.
 
 #### Yarn Berry v3/v4 {#javascript-yarn-v3-v4}
-Yarn Berry (v3 / v4) versions have similar formats. They start with blocks like these:
+Yarn Berry (v3 / v4) have similar formats, they start with blocks like these:
 
 ```yaml
 __metadata:
@@ -600,7 +620,7 @@ For these packages, we have some helpers exposed under the respective `yarn-berr
 - `fetchYarnBerryDeps`
 - `yarnBerryConfigHook`
 
-Explicitly pin the major version. For example, capture the `yarn-berry_Xn` argument and re-define it as a `yarn-berry` `let` binding.
+It's recommended to ensure you're explicitly pinning the major version used, for example by capturing the `yarn-berry_Xn` argument and then re-defining it as a `yarn-berry` `let` binding.
 
 ```nix
 {
@@ -636,26 +656,26 @@ stdenv.mkDerivation (finalAttrs: {
 ##### `yarn-berry_X.fetchYarnBerryDeps` {#javascript-fetchYarnBerryDeps}
 `fetchYarnBerryDeps` runs `yarn-berry-fetcher fetch` in a fixed-output-derivation. It is a custom fetcher designed to reproducibly download all files in the `yarn.lock` file, validating their hashes in the process. For git dependencies, it creates a checkout at `${offlineCache}/checkouts/<40-character-commit-hash>` (relying on the git commit hash to describe the contents of the checkout).
 
-To produce the `hash` argument for the `fetchYarnBerryDeps` call, run `yarn-berry-fetcher prefetch`:
+To produce the `hash` argument for `fetchYarnBerryDeps` function call, the `yarn-berry-fetcher prefetch` command can be used:
 
 ```console
 $ yarn-berry-fetcher prefetch </path/to/yarn.lock> [/path/to/missing-hashes.json]
 ```
 
-This prints the hash to stdout. Use it in update scripts to recalculate the hash for a new `yarn.lock`.
+This prints the hash to stdout and can be used in update scripts to recalculate the hash for a new version of `yarn.lock`.
 
 ##### `yarn-berry_X.yarnBerryConfigHook` {#javascript-yarnBerryConfigHook}
 `yarnBerryConfigHook` uses the store path `offlineCache` points to, to run a `yarn install` during the build, producing a usable `node_modules` directory from the downloaded dependencies.
 
 Internally, this uses a patched version of Yarn to ensure git dependencies are re-packed and any attempted downloads fail immediately.
 
-##### Patching the project's `package.json` or `yarn.lock` files {#javascript-yarnBerry-patching}
-In case patching the project's `package.json` or `yarn.lock` is needed, it's important to pass `finalAttrs.patches` to `fetchYarnBerryDeps` as well, so the patched variants are picked up (i.e., `inherit (finalAttrs) patches`).
+##### Patching upstream `package.json` or `yarn.lock` files {#javascript-yarnBerry-patching}
+In case patching the upstream `package.json` or `yarn.lock` is needed, it's important to pass `finalAttrs.patches` to `fetchYarnBerryDeps` as well, so the patched variants are picked up (i.e., `inherit (finalAttrs) patches`.
 
 ##### Missing hashes in the `yarn.lock` file {#javascript-yarnBerry-missing-hashes}
 Unfortunately, `yarn.lock` files do not include hashes for optional/platform-specific dependencies. This is [by design](https://github.com/yarnpkg/berry/issues/6759).
 
-To compensate for this, run the `yarn-berry-fetcher missing-hashes` subcommand to produce all missing hashes. These are stored in a `missing-hashes.json` file, which needs to be passed to both the build itself, as well as the `fetchYarnBerryDeps` helper:
+To compensate for this, the `yarn-berry-fetcher missing-hashes` subcommand can be used to produce all missing hashes. These are usually stored in a `missing-hashes.json` file, which needs to be passed to both the build itself, as well as the `fetchYarnBerryDeps` helper:
 
 ```nix
 {
@@ -698,7 +718,7 @@ If you are packaging something outside Nixpkgs, consider the following:
 
 ### npmlock2nix {#javascript-npmlock2nix}
 
-[npmlock2nix](https://github.com/nix-community/npmlock2nix) aims at building `node_modules` without code generation. It hasn't reached v1 yet; the API may change.
+[npmlock2nix](https://github.com/nix-community/npmlock2nix) aims at building `node_modules` without code generation. It hasn't reached v1 yet, the API might be subject to change.
 
 #### Pitfalls {#javascript-npmlock2nix-pitfalls}
 
@@ -706,7 +726,7 @@ There are some [problems with npm v7](https://github.com/tweag/npmlock2nix/issue
 
 ### nix-npm-buildpackage {#javascript-nix-npm-buildpackage}
 
-[nix-npm-buildpackage](https://github.com/serokell/nix-npm-buildpackage) aims at building `node_modules` without code generation. It hasn't reached v1 yet; the API may change. It supports both `package-lock.json` and yarn.lock.
+[nix-npm-buildpackage](https://github.com/serokell/nix-npm-buildpackage) aims at building `node_modules` without code generation. It hasn't reached v1 yet, the API might change. It supports both `package-lock.json` and yarn.lock.
 
 #### Pitfalls {#javascript-nix-npm-buildpackage-pitfalls}
 

doc/languages-frameworks/neovim.section.md

@@ -267,13 +267,13 @@ You can install the standalone parsers and queries directly without installing `
 ### Treesitter setup using WASM parsers and queries {#neovim-plugin-treesitter-wasm}
 
 Neovim can load WASM parsers when it is built with Wasmtime support.
-In nixpkgs, WASM parser plugins are available from the `wasm32-wasip1` cross package set:
+In nixpkgs, WASM parser plugins are available from the `wasi32` cross package set:
 
 ```nix
 (pkgs.wrapNeovim (pkgs.neovim-unwrapped.override { wasmSupport = true; }) {
   configure = {
     packages.myPlugins =
-      with pkgs.pkgsCross.wasm32-wasip1.vimPlugins;
+      with pkgs.pkgsCross.wasi32.vimPlugins;
       let
         # Select the grammars you need
         treesitter-grammars = with nvim-treesitter-parsers; [
@@ -296,7 +296,7 @@ In nixpkgs, WASM parser plugins are available from the `wasm32-wasip1` cross pac
 
 Do not install both native and WASM parsers for the same language.
 For example, installing both `pkgs.vimPlugins.nvim-treesitter-parsers.nix` and
-`pkgs.pkgsCross.wasm32-wasip1.vimPlugins.nvim-treesitter-parsers.nix` is invalid because Neovim
+`pkgs.pkgsCross.wasi32.vimPlugins.nvim-treesitter-parsers.nix` is invalid because Neovim
 loads the first `parser/nix.*` found on `runtimepath`.
 
 Use `:checkhealth vim.treesitter` to verify Nix-managed WASM parsers.

doc/languages-frameworks/ocaml.section.md

@@ -59,9 +59,6 @@ Here is a simple package example.
 - The library will be installed using the `angstrom.install` file that dune
   generates.
 
-- It also accepts an optional `dunePackages` argument, if there is more than one
-  dune package that needs to be built (see `zipperposition`)
-
 ```nix
 {
   lib,

doc/languages-frameworks/rocq.section.md

@@ -3,12 +3,11 @@
 Note that "The Rocq Prover" (Rocq for short) is the new name of the
 proof assistant formerly known as Coq. The `coq` and `coqPackages`
 derivations currently remain for both older versions of Coq, but also
-as compatibility aliases for some versions of Rocq. In both cases, the
-`coq` and `rocq-core` attributes exist. In the case of Coq (< 9),
-`rocq-core` is just an alias for `coq`, while in the case of Rocq (>= 9),
-`rocq-core` is the main Rocq derivation, while `coq` provides
-compatibility binaries (`coqc`, `coqtop`, etc.) for packages that still
-depend on them.
+some versions of Rocq during the renaming transition. In the latter
+case, the `coq` derivation encompasses the compatibility binaries
+(`coqtop`, `coqc`, etc.) in addition to the `rocq` binary. The packages
+only in `coqPackages` are the ones which currently still depend on these
+compatibility binaries.
 
 ## Rocq derivation: `rocq-core` {#rocq-derivation-rocq}
 
@@ -18,18 +17,18 @@ The Rocq derivation is overridable through the `rocq-core.override overrides`, w
 * `customOCamlPackages` (optional, defaults to `null`, which lets Rocq choose a version automatically), which can be set to any of the ocaml packages attribute of `ocaml-ng` (such as `ocaml-ng.ocamlPackages_4_14` which is the default for Rocq 9.1 for example).
 * `rocq-version` (optional, defaults to the short version e.g. "9.1"), is a version number of the form "x.y" that indicates which Rocq's version build behavior to mimic when using a source which is not a release. E.g. `rocq-core.override { version = "40be8435e132aab2231a79091f011ebc3e64a753"; rocq-version = "9.1"; }`.
 
-## Creating custom Coq environments with `rocq-core.withPackages` {#coq-withPackages}
+## Creating custom Coq environments with `coq.withPackages` {#coq-withPackages}
 
-The `rocq-core.withPackages` function provides a convenient way to create a Rocq environment that includes additional Rocq packages. This is similar to how `python.withPackages` works for Python environments.
+The `coq.withPackages` function provides a convenient way to create a Coq environment that includes additional Coq packages. This is similar to how `python.withPackages` works for Python environments.
 
-The function takes a function that receives the Rocq package set and returns a list of packages. It returns a wrapped Rocq environment where the Rocq binaries (`rocq`, etc.) are configured with the appropriate environment variables to find the packages.
+The function takes a function that receives the Coq package set and returns a list of packages. It returns a wrapped Coq environment where all Coq binaries (`coqtop`, `coqc`, `coqdep`, `coqchk`, `coqide`, etc.) are configured with the appropriate environment variables to find the packages.
 
 ### Usage {#coq-withPackages-usage}
 
-Here is an example of creating a Rocq environment with specific packages.
+Here is an example of creating a Coq environment with specific packages.
 
 ```nix
-rocq-core.withPackages (
+coq.withPackages (
   ps: with ps; [
     mathcomp
     bignums
@@ -37,9 +36,7 @@ rocq-core.withPackages (
 )
 ```
 
-If you install the `vsrocq-language-server` or `rocq-lsp` server, make sure to list them as part of the above `rocq-core.withPackages` expression instead of installing them separately if you want them to find your Rocq packages.
-
-For versions prior to Rocq 9.0, a similar `coq.withPackages` function is available.
+If you install the `vsrocq-language-server` or `rocq-lsp` server, make sure to list them as part of the above `coq.withPackages` expression instead of installing them separately if you want them to find your Coq/Rocq packages.
 
 ## Rocq packages attribute sets: `rocqPackages` {#rocq-packages-attribute-sets-rocqpackages}
 
@@ -133,7 +130,7 @@ mkRocqDerivation {
     mathcomp.boot
     mathcomp.algebra
     mathcomp-finmap
-    mathcomp.finite-group
+    mathcomp.fingroup
     mathcomp-bigenough
   ];
 

doc/languages-frameworks/rust.section.md

@@ -739,7 +739,7 @@ stdenv.mkDerivation (finalAttrs: {
 ### Compiling `wasm32-wasip1` package {#compiling-wasm32-wasip1-package}
 
 ```nix
-pkgsCross.wasm32-wasip1.callPackage (
+pkgsCross.wasi32.callPackage (
   {
     fetchFromGitHub,
     rustPlatform,

doc/lib.md

@@ -1 +1,6 @@
 # Nixpkgs `lib` {#id-1.4}
+
+```{=include=} chapters
+functions.md
+module-system/module-system.chapter.md
+```

doc/manual.md.in

@@ -1,6 +1,27 @@
 # Nixpkgs Manual {#nixpkgs-manual}
 ## Version @MANUAL_VERSION@
 
+```{=include=} chapters
+preface.chapter.md
+first-package.chapter.md
+```
+
+```{=include=} parts
+using-nixpkgs.md
+lib.md
+stdenv.md
+toolchains.md
+build-helpers.md
+modules/index.md
+development.md
+contributing.md
+interoperability.md
+```
+
+```{=include=} chapters
+languages-frameworks/index.md
+```
+
 ```{=include=} appendix html:into-file=//release-notes.html
 release-notes/release-notes.md
 ```

doc/modules/index.md

@@ -4,5 +4,9 @@ The Nixpkgs repository provides [Module System] modules for various purposes.
 
 The following sections are organized by [module class].
 
+```{=include=} chapters
+generic.chapter.md
+```
+
 [Module System]: https://nixos.org/manual/nixpkgs/unstable/#module-system
 [module class]: https://nixos.org/manual/nixpkgs/unstable/#module-system-lib-evalModules-param-class

doc/nav.json

@@ -1,706 +1,3 @@
 {
-  "open": [],
-  "items": [
-    {
-      "file": "preface.chapter.md"
-    },
-    {
-      "label": "Getting started",
-      "id": "getting-started",
-      "children": [
-        {
-          "file": "getting-started/getting-started.part.md"
-        },
-        {
-          "file": "getting-started/first-package.chapter.md"
-        },
-        {
-          "file": "getting-started/dev-environments.md"
-        }
-      ]
-    },
-    {
-      "label": "Using Nixpkgs",
-      "id": "part-using",
-      "children": [
-        {
-          "file": "using-nixpkgs.md"
-        },
-        {
-          "file": "channels.chapter.md"
-        },
-        {
-          "file": "using/platform-support.chapter.md"
-        },
-        {
-          "file": "using/configuration.chapter.md"
-        },
-        {
-          "file": "using/overlays.chapter.md"
-        },
-        {
-          "file": "using/overrides.chapter.md"
-        }
-      ]
-    },
-    {
-      "label": "Nixpkgs lib",
-      "id": "id-1.4",
-      "children": [
-        {
-          "file": "lib.md"
-        },
-        {
-          "label": "Functions reference",
-          "id": "chap-functions",
-          "children": [
-            {
-              "file": "functions.md"
-            },
-            {
-              "id-prefix": "auto-generated",
-              "file": "functions/library.md"
-            },
-            {
-              "file": "functions/generators.section.md"
-            },
-            {
-              "file": "functions/debug.section.md"
-            },
-            {
-              "file": "functions/prefer-remote-fetch.section.md"
-            },
-            {
-              "file": "functions/nix-gitignore.section.md"
-            }
-          ]
-        },
-        {
-          "file": "module-system/module-system.chapter.md"
-        }
-      ]
-    },
-    {
-      "label": "Standard environment",
-      "id": "part-stdenv",
-      "children": [
-        {
-          "file": "stdenv.md"
-        },
-        {
-          "file": "stdenv/stdenv.chapter.md"
-        },
-        {
-          "file": "stdenv/meta.chapter.md"
-        },
-        {
-          "file": "stdenv/passthru.chapter.md"
-        },
-        {
-          "file": "stdenv/multiple-output.chapter.md"
-        },
-        {
-          "file": "stdenv/cross-compilation.chapter.md"
-        },
-        {
-          "file": "stdenv/platform-notes.chapter.md"
-        }
-      ]
-    },
-    {
-      "label": "Toolchains",
-      "id": "part-toolchains",
-      "children": [
-        {
-          "file": "toolchains.md"
-        },
-        {
-          "file": "toolchains/llvm.chapter.md"
-        }
-      ]
-    },
-    {
-      "label": "Build helpers",
-      "id": "part-builders",
-      "children": [
-        {
-          "file": "build-helpers.md"
-        },
-        {
-          "file": "build-helpers/fixed-point-arguments.chapter.md"
-        },
-        {
-          "file": "build-helpers/fetchers.chapter.md"
-        },
-        {
-          "file": "build-helpers/trivial-build-helpers.chapter.md"
-        },
-        {
-          "file": "build-helpers/testers.chapter.md"
-        },
-        {
-          "file": "build-helpers/dev-shell-tools.chapter.md"
-        },
-        {
-          "label": "Special build helpers",
-          "id": "chap-special",
-          "children": [
-            {
-              "file": "build-helpers/special.md"
-            },
-            {
-              "file": "build-helpers/special/buildenv.section.md"
-            },
-            {
-              "file": "build-helpers/special/fakenss.section.md"
-            },
-            {
-              "file": "build-helpers/special/fhs-environments.section.md"
-            },
-            {
-              "file": "build-helpers/special/makesetuphook.section.md"
-            },
-            {
-              "file": "build-helpers/special/mkshell.section.md"
-            },
-            {
-              "file": "build-helpers/special/vm-tools.section.md"
-            },
-            {
-              "file": "build-helpers/special/checkpoint-build.section.md"
-            }
-          ]
-        },
-        {
-          "label": "Images",
-          "id": "chap-images",
-          "children": [
-            {
-              "file": "build-helpers/images.md"
-            },
-            {
-              "file": "build-helpers/images/appimagetools.section.md"
-            },
-            {
-              "file": "build-helpers/images/dockertools.section.md"
-            },
-            {
-              "file": "build-helpers/images/ocitools.section.md"
-            },
-            {
-              "file": "build-helpers/images/portableservice.section.md"
-            },
-            {
-              "file": "build-helpers/images/makediskimage.section.md"
-            },
-            {
-              "file": "build-helpers/images/binarycache.section.md"
-            }
-          ]
-        },
-        {
-          "label": "Hooks reference",
-          "id": "chap-hooks",
-          "children": [
-            {
-              "file": "hooks/index.md"
-            },
-            {
-              "file": "hooks/autoconf.section.md"
-            },
-            {
-              "file": "hooks/automake.section.md"
-            },
-            {
-              "file": "hooks/autopatchcil.section.md"
-            },
-            {
-              "file": "hooks/autopatchelf.section.md"
-            },
-            {
-              "file": "hooks/aws-c-common.section.md"
-            },
-            {
-              "file": "hooks/bmake.section.md"
-            },
-            {
-              "file": "hooks/breakpoint.section.md"
-            },
-            {
-              "file": "hooks/cernlib.section.md"
-            },
-            {
-              "file": "hooks/check-phase-thread-limit-hook.section.md"
-            },
-            {
-              "file": "hooks/cmake.section.md"
-            },
-            {
-              "file": "hooks/desktop-file-utils.section.md"
-            },
-            {
-              "file": "hooks/gdk-pixbuf.section.md"
-            },
-            {
-              "file": "hooks/gnome.section.md"
-            },
-            {
-              "file": "hooks/haredo.section.md"
-            },
-            {
-              "file": "hooks/installShellFiles.section.md"
-            },
-            {
-              "file": "hooks/installFonts.section.md"
-            },
-            {
-              "file": "hooks/juce.section.md"
-            },
-            {
-              "file": "hooks/julec.section.md"
-            },
-            {
-              "file": "hooks/just.section.md"
-            },
-            {
-              "file": "hooks/libglycin.section.md"
-            },
-            {
-              "file": "hooks/libiconv.section.md"
-            },
-            {
-              "file": "hooks/libxml2.section.md"
-            },
-            {
-              "file": "hooks/memcached-test-hook.section.md"
-            },
-            {
-              "file": "hooks/meson.section.md"
-            },
-            {
-              "file": "hooks/mpi-check-hook.section.md"
-            },
-            {
-              "file": "hooks/ninja.section.md"
-            },
-            {
-              "file": "hooks/nodejs-install-executables.section.md"
-            },
-            {
-              "file": "hooks/nodejs-install-manuals.section.md"
-            },
-            {
-              "file": "hooks/npm-build-hook.section.md"
-            },
-            {
-              "file": "hooks/npm-config-hook.section.md"
-            },
-            {
-              "file": "hooks/npm-install-hook.section.md"
-            },
-            {
-              "file": "hooks/patch-rc-path-hooks.section.md"
-            },
-            {
-              "file": "hooks/perl.section.md"
-            },
-            {
-              "file": "hooks/pkg-config.section.md"
-            },
-            {
-              "file": "hooks/pnpm.section.md"
-            },
-            {
-              "file": "hooks/postgresql-test-hook.section.md"
-            },
-            {
-              "file": "hooks/premake.section.md"
-            },
-            {
-              "file": "hooks/python.section.md"
-            },
-            {
-              "file": "hooks/redis-test-hook.section.md"
-            },
-            {
-              "file": "hooks/scons.section.md"
-            },
-            {
-              "file": "hooks/tauri.section.md"
-            },
-            {
-              "file": "hooks/tetex-tex-live.section.md"
-            },
-            {
-              "file": "hooks/udevCheckHook.section.md"
-            },
-            {
-              "file": "hooks/unzip.section.md"
-            },
-            {
-              "file": "hooks/validatePkgConfig.section.md"
-            },
-            {
-              "file": "hooks/versionCheckHook.section.md"
-            },
-            {
-              "file": "hooks/waf.section.md"
-            },
-            {
-              "file": "hooks/writable-tmpdir-as-home-hook.section.md"
-            },
-            {
-              "file": "hooks/zig.section.md"
-            },
-            {
-              "file": "hooks/xcbuild.section.md"
-            },
-            {
-              "file": "hooks/xfce4-dev-tools.section.md"
-            }
-          ]
-        },
-        {
-          "label": "Packages",
-          "id": "chap-packages",
-          "children": [
-            {
-              "file": "packages/index.md"
-            },
-            {
-              "file": "packages/citrix.section.md"
-            },
-            {
-              "file": "packages/darwin-builder.section.md"
-            },
-            {
-              "file": "packages/dlib.section.md"
-            },
-            {
-              "file": "packages/eclipse.section.md"
-            },
-            {
-              "file": "packages/elm.section.md"
-            },
-            {
-              "file": "packages/emacs.section.md"
-            },
-            {
-              "file": "packages/firefox.section.md"
-            },
-            {
-              "file": "packages/friction-graphics.section.md"
-            },
-            {
-              "file": "packages/fish.section.md"
-            },
-            {
-              "file": "packages/fuse.section.md"
-            },
-            {
-              "file": "packages/geant4.section.md"
-            },
-            {
-              "file": "packages/ibus.section.md"
-            },
-            {
-              "file": "packages/inkscape.section.md"
-            },
-            {
-              "file": "packages/kakoune.section.md"
-            },
-            {
-              "file": "packages/krita.section.md"
-            },
-            {
-              "file": "packages/linux.section.md"
-            },
-            {
-              "file": "packages/lhapdf.section.md"
-            },
-            {
-              "file": "packages/locales.section.md"
-            },
-            {
-              "file": "packages/etc-files.section.md"
-            },
-            {
-              "file": "packages/nginx.section.md"
-            },
-            {
-              "file": "packages/nrfutil.section.md"
-            },
-            {
-              "file": "packages/opengl.section.md"
-            },
-            {
-              "file": "packages/packer.section.md"
-            },
-            {
-              "file": "packages/shell-helpers.section.md"
-            },
-            {
-              "file": "packages/python-tree-sitter.section.md"
-            },
-            {
-              "label": "treefmt",
-              "id": "treefmt",
-              "children": [
-                {
-                  "file": "packages/treefmt.section.md"
-                },
-                {
-                  "id-prefix": "auto-generated-treefmt-functions",
-                  "file": "packages/treefmt-functions.section.md"
-                }
-              ]
-            },
-            {
-              "file": "packages/steam.section.md"
-            },
-            {
-              "file": "packages/cataclysm-dda.section.md"
-            },
-            {
-              "file": "packages/urxvt.section.md"
-            },
-            {
-              "file": "packages/vcpkg.section.md"
-            },
-            {
-              "file": "packages/weechat.section.md"
-            },
-            {
-              "file": "packages/uv.section.md"
-            },
-            {
-              "file": "packages/build-support.md"
-            }
-          ]
-        }
-      ]
-    },
-    {
-      "label": "Modules",
-      "id": "modules",
-      "children": [
-        {
-          "file": "modules/index.md"
-        },
-        {
-          "file": "modules/generic.chapter.md"
-        }
-      ]
-    },
-    {
-      "label": "Development of Nixpkgs",
-      "id": "part-development",
-      "children": [
-        {
-          "file": "development.md"
-        },
-        {
-          "file": "development/opening-issues.chapter.md"
-        }
-      ]
-    },
-    {
-      "label": "Contributing to Nixpkgs",
-      "id": "part-contributing",
-      "children": [
-        {
-          "file": "contributing.md"
-        },
-        {
-          "file": "contributing/quick-start.chapter.md"
-        },
-        {
-          "file": "contributing/coding-conventions.chapter.md"
-        },
-        {
-          "file": "contributing/submitting-changes.chapter.md"
-        },
-        {
-          "file": "contributing/vulnerability-roundup.chapter.md"
-        },
-        {
-          "file": "contributing/reviewing-contributions.chapter.md"
-        },
-        {
-          "file": "contributing/contributing-to-documentation.chapter.md"
-        }
-      ]
-    },
-    {
-      "label": "Interoperability Standards",
-      "id": "part-interoperability",
-      "children": [
-        {
-          "file": "interoperability.md"
-        },
-        {
-          "file": "interoperability/cyclonedx.md"
-        }
-      ]
-    },
-    {
-      "label": "Languages and frameworks",
-      "id": "chap-language-support",
-      "children": [
-        {
-          "file": "languages-frameworks/index.md"
-        },
-        {
-          "file": "languages-frameworks/agda.section.md"
-        },
-        {
-          "file": "languages-frameworks/android.section.md"
-        },
-        {
-          "file": "languages-frameworks/astal.section.md"
-        },
-        {
-          "file": "languages-frameworks/beam.section.md"
-        },
-        {
-          "file": "languages-frameworks/chicken.section.md"
-        },
-        {
-          "file": "languages-frameworks/cosmic.section.md"
-        },
-        {
-          "file": "languages-frameworks/crystal.section.md"
-        },
-        {
-          "file": "languages-frameworks/cuda.section.md"
-        },
-        {
-          "file": "languages-frameworks/cuelang.section.md"
-        },
-        {
-          "file": "languages-frameworks/dart.section.md"
-        },
-        {
-          "file": "languages-frameworks/dhall.section.md"
-        },
-        {
-          "file": "languages-frameworks/dlang.section.md"
-        },
-        {
-          "file": "languages-frameworks/dotnet.section.md"
-        },
-        {
-          "file": "languages-frameworks/emscripten.section.md"
-        },
-        {
-          "file": "languages-frameworks/factor.section.md"
-        },
-        {
-          "file": "languages-frameworks/gnome.section.md"
-        },
-        {
-          "file": "languages-frameworks/go.section.md"
-        },
-        {
-          "file": "languages-frameworks/gradle.section.md"
-        },
-        {
-          "file": "languages-frameworks/hare.section.md"
-        },
-        {
-          "file": "languages-frameworks/haskell.section.md"
-        },
-        {
-          "file": "languages-frameworks/hy.section.md"
-        },
-        {
-          "file": "languages-frameworks/idris.section.md"
-        },
-        {
-          "file": "languages-frameworks/idris2.section.md"
-        },
-        {
-          "file": "languages-frameworks/ios.section.md"
-        },
-        {
-          "file": "languages-frameworks/java.section.md"
-        },
-        {
-          "file": "languages-frameworks/javascript.section.md"
-        },
-        {
-          "file": "languages-frameworks/julia.section.md"
-        },
-        {
-          "file": "languages-frameworks/lean4.section.md"
-        },
-        {
-          "file": "languages-frameworks/lisp.section.md"
-        },
-        {
-          "file": "languages-frameworks/lua.section.md"
-        },
-        {
-          "file": "languages-frameworks/maven.section.md"
-        },
-        {
-          "file": "languages-frameworks/nim.section.md"
-        },
-        {
-          "file": "languages-frameworks/ocaml.section.md"
-        },
-        {
-          "file": "languages-frameworks/octave.section.md"
-        },
-        {
-          "file": "languages-frameworks/perl.section.md"
-        },
-        {
-          "file": "languages-frameworks/php.section.md"
-        },
-        {
-          "file": "languages-frameworks/pkg-config.section.md"
-        },
-        {
-          "file": "languages-frameworks/python.section.md"
-        },
-        {
-          "file": "languages-frameworks/qt.section.md"
-        },
-        {
-          "file": "languages-frameworks/r.section.md"
-        },
-        {
-          "file": "languages-frameworks/rocq.section.md"
-        },
-        {
-          "file": "languages-frameworks/ruby.section.md"
-        },
-        {
-          "file": "languages-frameworks/rust.section.md"
-        },
-        {
-          "file": "languages-frameworks/scheme.section.md"
-        },
-        {
-          "file": "languages-frameworks/swift.section.md"
-        },
-        {
-          "file": "languages-frameworks/tcl.section.md"
-        },
-        {
-          "file": "languages-frameworks/texlive.section.md"
-        },
-        {
-          "file": "languages-frameworks/typst.section.md"
-        },
-        {
-          "file": "languages-frameworks/vim.section.md"
-        },
-        {
-          "file": "languages-frameworks/neovim.section.md"
-        }
-      ]
-    }
-  ]
+  "open": []
 }

doc/packages/darwin-builder.section.md

@@ -83,57 +83,6 @@ $ sudo launchctl kickstart -k system/org.nixos.nix-daemon
 
 Note that if the builder is running and you have created the above ssh conf file, you can ssh into the builder with `sudo ssh builder@linux-builder`.
 
-## Using the Virtualization.framework backend {#sec-darwin-builder-vz}
-
-`darwin.linux-builder-vz` is a variant of `darwin.linux-builder` that runs the same
-NixOS guest on Apple's Virtualization.framework (via `pkgs.vzvm`) instead of QEMU.
-Instead of emulating x86_64, it exposes Rosetta to the guest, so `x86_64-linux`
-builds are translated rather than emulated, which is substantially faster. It
-requires an Apple silicon host (`aarch64-darwin`) running macOS 13 or newer, with
-Rosetta installed:
-
-```ShellSession
-$ softwareupdate --install-rosetta --agree-to-license
-```
-
-The builder refuses to start when Rosetta is missing, rather than silently dropping
-`x86_64-linux` support; set `virtualisation.vz.rosetta.enable = false` to run
-without it.
-
-It is a drop-in replacement: it listens on the same host port (31022) and presents
-the same host key as the QEMU builder, so the `nix.conf` and SSH configuration
-described above apply unchanged; only the transport behind the port changes, from
-TCP forwarding to vsock. Since a single builder VM handles both architectures
-through Rosetta, list both systems in your `builders` entry
-(`aarch64-linux,x86_64-linux`), or with nix-darwin:
-
-```nix
-{
-  nix.linux-builder = {
-    enable = true;
-    package = pkgs.darwin.linux-builder-vz;
-    systems = [
-      "aarch64-linux"
-      "x86_64-linux"
-    ];
-  };
-}
-```
-
-When switching an existing QEMU builder over, delete its data disk first (e.g.
-`sudo rm /var/lib/linux-builder/nixos.qcow2`): the vz builder reuses the file name
-but writes a raw image, and refuses to misread a genuine qcow2 left behind.
-
-The guest console goes to the macOS unified log by default; read it with:
-
-```ShellSession
-$ /usr/bin/log show --last 5m --predicate 'subsystem == "systems.applicative.vzvm"'
-```
-
-The `virtualisation.vz.*` NixOS options configure the backend further, e.g.
-`virtualisation.vz.nestedVirtualization` gives the guest a working `/dev/kvm` for
-running NixOS integration tests on the builder (macOS 15+, M3 or newer).
-
 ## Example flake usage {#sec-darwin-builder-example-flake}
 
 ```nix

doc/packages/index.md

@@ -1,3 +1,39 @@
 # Packages {#chap-packages}
 
 This chapter contains information about how to use and maintain the Nix expressions for a number of specific packages, such as the Linux kernel or X.org.
+
+```{=include=} sections
+citrix.section.md
+darwin-builder.section.md
+dlib.section.md
+eclipse.section.md
+elm.section.md
+emacs.section.md
+firefox.section.md
+friction-graphics.section.md
+fish.section.md
+fuse.section.md
+geant4.section.md
+ibus.section.md
+inkscape.section.md
+kakoune.section.md
+krita.section.md
+linux.section.md
+lhapdf.section.md
+locales.section.md
+etc-files.section.md
+nginx.section.md
+nrfutil.section.md
+opengl.section.md
+packer.section.md
+shell-helpers.section.md
+python-tree-sitter.section.md
+treefmt.section.md
+steam.section.md
+cataclysm-dda.section.md
+urxvt.section.md
+vcpkg.section.md
+weechat.section.md
+uv.section.md
+build-support.md
+```

doc/packages/treefmt.section.md

@@ -7,6 +7,10 @@ provides functions for configuring treefmt using the module system, which are [d
 
 Alternatively, treefmt can be configured using [treefmt-nix](https://github.com/numtide/treefmt-nix).
 
+```{=include=} sections auto-id-prefix=auto-generated-treefmt-functions
+treefmt-functions.section.md
+```
+
 ## Options Reference {#sec-treefmt-options-reference}
 
 The following attributes can be passed to [`withConfig`](#pkgs.treefmt.withConfig) or [`evalConfig`](#pkgs.treefmt.evalConfig):
@@ -16,3 +20,4 @@ id-prefix: opt-treefmt-
 list-id: configuration-variable-list
 source: ../treefmt-options.json
 ```
+

doc/redirects.json

@@ -105,9 +105,6 @@
   "cuda-writing-tests": [
     "index.html#cuda-writing-tests"
   ],
-  "dev-environments": [
-    "index.html#dev-environments"
-  ],
   "ex-build-helpers-extendMkDerivation": [
     "index.html#ex-build-helpers-extendMkDerivation"
   ],
@@ -143,9 +140,6 @@
   "ex-writeShellApplication": [
     "index.html#ex-writeShellApplication"
   ],
-  "fetchfromtangled": [
-    "index.html#fetchfromtangled"
-  ],
   "first-package-go": [
     "index.html#first-package-go"
   ],
@@ -155,9 +149,6 @@
   "friction-graphics-wayland": [
     "index.html#friction-graphics-wayland"
   ],
-  "getting-started": [
-    "index.html#getting-started"
-  ],
   "ghc-deprecation-policy": [
     "index.html#ghc-deprecation-policy"
   ],
@@ -218,21 +209,6 @@
   "julec-hook-variables": [
     "index.html#julec-hook-variables"
   ],
-  "juce-projucer-hook": [
-    "index.html#juce-projucer-hook"
-  ],
-  "juce-projucer-hook-example": [
-    "index.html#juce-projucer-hook-example"
-  ],
-  "juce-projucer-hook-variables": [
-    "index.html#juce-projucer-hook-variables"
-  ],
-  "juce-dontuseprojucerconfigure": [
-    "index.html#juce-dontuseprojucerconfigure"
-  ],
-  "juce-dontuseprojucerinstall": [
-    "index.html#juce-dontuseprojucerinstall"
-  ],
   "libcxxhardeningextensive": [
     "index.html#libcxxhardeningextensive"
   ],
@@ -464,9 +440,6 @@
   "sec-darwin-availability-checks": [
     "index.html#sec-darwin-availability-checks"
   ],
-  "sec-darwin-builder-vz": [
-    "index.html#sec-darwin-builder-vz"
-  ],
   "sec-darwin-libcxx-deployment-targets": [
     "index.html#sec-darwin-libcxx-deployment-targets"
   ],
@@ -2089,12 +2062,6 @@
   "fetchfromgithub": [
     "index.html#fetchfromgithub"
   ],
-  "fetchfromhuggingface": [
-    "index.html#fetchfromhuggingface"
-  ],
-  "ex-fetchfromhuggingface": [
-    "index.html#ex-fetchfromhuggingface"
-  ],
   "fetchfromgitlab": [
     "index.html#fetchfromgitlab"
   ],
@@ -2465,18 +2432,6 @@
   "sec-checkpoint-build-example": [
     "index.html#sec-checkpoint-build-example"
   ],
-  "sec-redisTestHook": [
-    "index.html#sec-redisTestHook"
-  ],
-  "sec-redisTestHook-variables": [
-    "index.html#sec-redisTestHook-variables"
-  ],
-  "sec-memcachedTestHook": [
-    "index.html#sec-memcachedTestHook"
-  ],
-  "sec-memcachedTestHook-variables": [
-    "index.html#sec-memcachedTestHook-variables"
-  ],
   "chap-images": [
     "index.html#chap-images"
   ],
@@ -2828,6 +2783,9 @@
   "glycin-dont-wrap": [
     "index.html#glycin-dont-wrap"
   ],
+  "ghc": [
+    "index.html#ghc"
+  ],
   "gnome-platform": [
     "index.html#gnome-platform"
   ],
@@ -3675,8 +3633,7 @@
     "index.html#hareHook-cross-compilation"
   ],
   "haskell": [
-    "index.html#haskell",
-    "index.html#ghc"
+    "index.html#haskell"
   ],
   "haskell-available-packages": [
     "index.html#haskell-available-packages"
@@ -3805,9 +3762,15 @@
     "index.html#language-javascript"
   ],
   "javascript-introduction": [
-    "index.html#javascript-introduction",
-    "index.html#javascript-finding-examples",
-    "index.html#javascript-finding-examples-github",
+    "index.html#javascript-introduction"
+  ],
+  "javascript-finding-examples": [
+    "index.html#javascript-finding-examples"
+  ],
+  "javascript-finding-examples-github": [
+    "index.html#javascript-finding-examples-github"
+  ],
+  "javascript-finding-examples-gitlab": [
     "index.html#javascript-finding-examples-gitlab"
   ],
   "javascript-tools-overview": [

doc/release-notes/rl-2611.section.md

@@ -16,23 +16,12 @@
   +nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.zst";
   ```
 
-- Emacs has been updated to 31.
-  This introduces some backwards‐incompatible changes; see the NEWS for details.
-  NEWS can be viewed from Emacs by typing `C-h n`, or by clicking `Help->Emacs News` from the menu bar.
-  It can also be browsed [online](https://cgit.git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-31).
-
-- `sing-box` now supports NaïveProxy outbounds.
+- GCC has been updated from GCC 15 to GCC 16. This introduces some backwards-incompatible changes. Refer to the [upstream porting guide](https://gcc.gnu.org/gcc-16/porting_to.html) for details.
 
 ## Backward Incompatibilities {#sec-nixpkgs-release-26.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- `moon` has been updated to `2.x` and needs manual migration. See the [migration guide](https://moonrepo.dev/docs/migrate/2.0) for instructions.
-
-- `perlPackages.NetOAuth` has been updated from 0.28 to 0.33.
-  Callers that verify messages must now set `allowed_signature_methods` per message or configure `@Net::OAuth::ALLOWED_SIGNATURE_METHODS`; `verify` otherwise throws an exception.
-  See the [upstream changelog](https://metacpan.org/dist/Net-OAuth/changes) for details.
-
 - []{#x86_64-darwin-26.11}
 
   Support for `x86_64-darwin` has been dropped, due to Apple’s deprecation of the platform and limited build infrastructure and developer time.
@@ -49,14 +38,8 @@
 
 - `databricks-cli` has been updated from `0.290.2` to `1.x.x`, the first major release. OAuth tokens for interactive logins (`auth_type = databricks-cli`) are now stored in the OS-native secure store by default (Secret Service on Linux) instead of `~/.databricks/token-cache.json`; cached tokens from older versions are not migrated, so run `databricks auth login` once per profile after upgrading. To keep the previous file-backed storage, set `DATABRICKS_AUTH_STORAGE=plaintext` or add `auth_storage = plaintext` under `[__settings__]` in `~/.databrickscfg`. Additionally, the `vector_search_endpoints` DABs resource renamed `min_qps` to `target_qps` (and the `vector-search-endpoints` command renamed `--min-qps` to `--target-qps`). See the [upstream changelog](https://github.com/databricks/cli/blob/main/CHANGELOG.md) for details.
 
-- Gradle 7 has been removed because it is end-of-life. Please [upgrade to a newer version of Gradle](https://docs.gradle.org/current/userguide/upgrading_version_7.html).
-
 - `hurl` has been updated to `8.x.x` which has some breaking changes. See [upstream changelog](https://github.com/Orange-OpenSource/hurl/releases/tag/8.0.0) for details.
 
-- The existing `wasm32-wasi` target has become `wasm32-wasip1` and `pkgsCross.wasi32` has become `pkgsCross.wasm32-wasip1`, aligning with LLVM's nomenclature. Aliases are in place and old forms will continue to be parsed but there might be some breakage if you're relying on the exact form of these (e.g., in sysroot paths).
-
-- `sing-box` has been updated to 1.14.0, which has removed some deprecated options.  See [upstream documentation](https://sing-box.sagernet.org/migration/) for details and migration options.
-
 - `gotosocial` has been updated to 0.22.0. This release contains a very long database migration, which should not be cancelled or interrupted under any circumstances.
  -  Postgres users: Following the migration, if you encounter slowdown on Postgres specifically (ie., timing out while loading timelines) you may need to run some manual database maintenance steps. Please check https://docs.gotosocial.org/en/stable/admin/database_maintenance/#postgres.
 
@@ -72,31 +55,17 @@
 
 - `fflogs` has been removed because it was no longer functional. Users should switch to `archon-lite`.
 
-- `keycloak.plugins.scim-for-keycloak` has been removed. The upstream open-source project is [end-of-life](https://github.com/Captain-P-Goldfish/scim-for-keycloak) and its last release targets Keycloak 20, which is incompatible with the packaged Keycloak.
-
-- `keycloak.plugins.scim-keycloak-user-storage-spi` has been removed. Upstream has moved the plugin into Keycloak itself as the experimental `ipatuura` federation provider and no longer maintains the standalone repository.
-
 - `services.mysql` now sets `root@localhost` authentication to `auth_socket` when used with `mysql` or `percona-server`.
   Existing deployments will also be adjusted if possible. See the [security advisory GHSA-6qxx-6rg8-c4p8](https://github.com/NixOS/nixpkgs/security/advisories/GHSA-6qxx-6rg8-c4p8) for more information.
 
-- `sqlitestudio` has been renamed to `letos` to reflect upstream changes. See [Letos: Name rebranding](https://github.com/pawelsalawa/letos/issues/5441) for more information.
-
 - `zerofs` has been updated from `1.x` to `2.x` which is a breaking change. Volumes created by earlier releases are refused at open with a clear error. There is no migration tool; older volumes remain readable and writable by the release that created them.
 
 - `keycloak.plugins.keycloak-metrics-spi` has been removed. Keycloak exposes Prometheus metrics natively on its management interface; enable them with the `metrics-enabled` setting (and `event-metrics-user-enabled` for login and event counters). See [Gaining insights with metrics](https://www.keycloak.org/observability/configuration-metrics).
 
 - `alps` has been rewritten upstream, see [upstream repository](https://github.com/migadu/alps) for documentation.
 
-- `writers.makeDataWriter` has been removed. It has been deprecated since 2023. Use `pkgs.writeTextFile` instead.
-
-- `bosun` has been removed as it is no longer maintained upstream. the corresponding monitoring options has been removed.
-
 - `uhttpmock` providing 0.0 ABI was removed. `uhttpmock_1_0` providing 1.0 ABI was renamed to `uhttpmock` and `uhttpmock_1_0` was kept as an alias.
 
-- `himalaya` has been updated from `v1.2.0` to `v2.0.0`, which introduces breaking changes. See the [release notes](https://github.com/pimalaya/himalaya/releases/tag/v2.0.0) and the [migration guide](https://github.com/pimalaya/himalaya/blob/master/MIGRATION.md).
-
-- `tengine` has been removed as it has seen seriously delayed responses to security vulnerabilities.
-
 - `nix-serve-ng` (and `haskellPackages.nix-serve-ng`) is now built against Lix instead of CppNix, following upstream which has switched to Lix as its supported Nix implementation.
 
 - Linux kernel configuration has been moved out of the `linux-kernel` field of the platform structure into the kernel builders:
@@ -116,10 +85,6 @@
 
 - `pdns` has been updated from `5.0.x` to `5.1.x`. Please be sure to review the [Upgrade Notes](https://doc.powerdns.com/authoritative/upgrading.html#to-5-1-0) before upgrading. Namely LUA record updates are no longer allowed by default, and the embedded webserver no longer includes a `access-control-allow-origin: *` header by default.
 
-- LibreOffice upstream switched from Fresh/Still stable branches to a single Stable branch; `libreoffice` and `libreoffice-qt` work as before, but more specific aliases like `libreoffice-fresh` should be replaced.
-
-- `davmail` no longer supports building with GTK 2, and the `preferGtk3` override flag has been removed as GTK 3 is always used.
-
 - Support for the legacy U‐Boot image format has been removed from the Linux kernel builders, as it is deprecated upstream and no longer used by any platform in Nixpkgs.
 
 - `etcd_3_4` package was dropped, as it's gone EOL. Please upgrade to either 3.5 or 3.6. See [migration notes](https://etcd.io/docs/v3.6/upgrades/upgrade_3_6/) for incompatibilities and upgrade procedure.
@@ -132,38 +97,18 @@
 
 - `buildFHSEnvChroot` has been removed after deprecation in 23.05.
 
-- `leafnode` has been removed, as it was an unmaintained alpha-release of leafnode 2 and has a dependency on the EOL PRCE-library. Consider using `leafnode1` instead, which is still maintained.
-
 - `gh-actions-cache` has been removed since its functionality has been integrated directly into `gh` (`gh cache`). See [upstream readme](https://github.com/actions/gh-actions-cache).
 
-- The OCaml-based Xen Store Daemon has been split off the `xen` package, and is now present in the `ocamlPackages.oxenstored` package.
-
 - `requireFile` now sets `meta.license = lib.licenses.unfree` by default. Users of `requireFile`-based derivations that preserve this default will need to explicitly allow their evaluation as described in [](#sec-allow-unfree).
 
 - `texlive.combine` is deprecated and scheduled for removal in 27.05. Please migrate to `texliveSmall.withPackages` (see [](#sec-language-texlive-user-guide)).
 
-- `katex` has been updated from 0.16 to 0.18 and has introduced breaking changes.  See upstream changelog for details: [0.17.0](https://github.com/KaTeX/KaTeX/releases/tag/v0.17.0), [0.18.0](https://github.com/KaTeX/KaTeX/releases/tag/v0.18.0).
-
 - `keycloak` was updated to >= 26.7.0 and includes some breaking internal (API) changes. See the [upstream migration guide](https://www.keycloak.org/docs/latest/upgrading/#migrating-to-26-7-0) for more information.
 
-- `pdfium` is now built from source instead of packaging prebuilt binaries. `pdfium-binaries` has been renamed to `pdfium`, and `pdfium-binaries-v8` has been removed.
-
 - `librest` providing 0.7 ABI was removed. `librest_1_0` providing 1.0 ABI was renamed to `librest` and `librest_1_0` was kept as an alias.
 
-- `luaPackages.lrexlib-pcre` has been removed as part of the process to fully migrate from the end-of-life PRCE library to PCRE2. `luaPackages.lrexlib-pcre2` and multiple other versions of lrexlib can be used instead.
-
 - `pnpm_10` was upgraded to version 10.34.1+, which introduced stricter integrity checks. If you encounter `ERR_PNPM_MISSING_TARBALL_INTEGRITY`, you can fall back to the older `pnpm_10_34_0`.
 
-- `buildMozillaMach` is now using `enable<feature>` and `with<dependency>`
-  terminology from RFC 169 and the `wrapFirefox` and `wrapThunderbird` functions
-  check for these new attribute names on the passed package.
-  The `privacySupport` function argument has been replaced by multiple
-  granular options corresponding to individual features: `enableDataReporting`,
-  `enableLocation`, `enableWebRTC`.
-  The `requireSigning` and `allowAddonSideload` function arguments moved from
-  the outer to the inner function and were renamed to `enableAddonSigning` and
-  `enableAddonSideload`, respectively.
-
 - `fetchPnpmDeps`' `fetcherVersion = 1` and `fetcherVersion = 2` have been
   removed, as announced in the 26.05 release. Packages still using them now
   throw an evaluation error and must migrate to `fetcherVersion = 3` (or later)
@@ -171,8 +116,6 @@
   [pnpm `fetcherVersion` section](#javascript-pnpm-fetcherVersion) of the manual
   for details.
 
-- `makeSetupHook` now uses structured attributes and only makes substitutions based on the values of the `substitutions` argument - other derivation attributes are no longer considered.
-
 - `rebuilderd` has been updated to 0.27.0 introducing breaking changes. See upstream changelog for details: [0.26.0](https://github.com/kpcyrd/rebuilderd/releases/tag/v0.26.0), [0.27.0](https://github.com/kpcyrd/rebuilderd/releases/tag/v0.27.0)
 
 - Starting with v14, `flameshot` will primarily utilise xdg-desktop-portal calls for screenshotting. This will directly affect users on X11 window managers due to the lack of a compatible portal with Screenshot feature. See [upstream changelog](https://github.com/flameshot-org/flameshot/releases/tag/v14.0.0) or [NixOS Flameshot](https://wiki.nixos.org/wiki/Flameshot) wiki page for workarounds.
@@ -182,32 +125,18 @@
 
 - `vimacs` has been removed, as it has not been maintained in 10 years and was built for an old version of vim (6.0).
 
-- The deprecated `appimageTools.extractType1`, `appimageTools.extractType2`, and `appimageTools.wrapType1` aliases now emit warnings. Use `appimageTools.extract` and `appimageTools.wrapType2` instead.
-
-- netbox plugins have been moved from the python3Packages to the netboxPlugins package set.
-
 ## Other Notable Changes {#sec-nixpkgs-release-26.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
 - `super-productivity` has been updated. The binary has been renamed from `super-productivity` to `superproductivity`. A symlink from the old name is provided for backward compatibility.
 
-- `buildFHSEnv`, `appimageTools.wrapAppImage`, and `appimageTools.wrapType2` now support the `finalAttrs` pattern. When using `wrapAppImage`, it is now recommended to pass the extracted AppImage to the `contents` attribute (instead of `src`), to avoid shadowing `src`. Passing the extracted contents to `src` is now deprecated and will be removed in a future release.
-
-- All databases of the MySQL family – `mysql`, `mariadb` and `percona` – now provide a client-only package `client` sub-attribute. Use the `<dbname>.client` package if the server components are not needed. The main package continues to ship the client binaries as well.
-
 - Package-URL (PURL, https://github.com/package-url/purl-spec) metadata identifier has been added for `fetchgit`, `fetchpypi` and `fetchFromGithub` fetchers.
   `mkDerivation` has been adjusted to reuse this information.
   Package-URLs allow reliably identifying and locating software packages.
   Maintainers of derivations using the adapted fetchers should rely on the `drv.src.meta.identifiers.v1.purl` default identifier and can enhance their `drv.meta.identifiers.v1.purls` list once they would like to have additional identifiers.
   Maintainers using `fetchurl` for `drv.src` are urged to adapt their `drv.meta.identifiers.purlParts` for proper identification.
 
-- The fwts efi-runtime kernel module was removed.
-
-- `homebox` v0.26.0 introduced a new, required value to be set, `HBOX_AUTH_API_KEY_PEPPER`. If one is not provided the module will create one, it is recommended that you back this up as it is part of API Key generation and validation.
-
-- `nextpnr` introduced support for the nexus and gatemate architectures. Building support for each individual architecture can be configured using the package parameters.
-
 - Emacs loads the `early-default` library after `early-init.el`.
   Users can add `early-init.el` via `emacs.pkgs.withPackages`
   by packaging `early-init.el` into a library named `early-default`.
@@ -218,8 +147,6 @@
   They were missing before because Ceph omitted logs when this directory was missing.
   Ceph logs can grow large, so you may want to configure rotation of these logs.
 
-- Firefox wrapper now accepts an optional `appDataDir` argument, which sets `MOZ_APP_DATA` to relocate Firefox application data. This is especially useful on macOS 27 and later, where wrapped Firefox applications may be denied access to profiles in traditional application data directory.
-
 ## Nixpkgs Library {#sec-nixpkgs-release-26.11-lib}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -228,8 +155,6 @@
 
 - `fittrackee` 1.0.0 now requires postgres with postgis. The [upgrade guide](https://docs.fittrackee.org/en/upgrading-to-1.0.0.html) has steps to prepare for this upgrade.
 
-- `typescript` 7.0.2 now uses the Golang implementation. The [announcement document](https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/) has information on what was changed.
-
 ### Deprecations {#sec-nixpkgs-release-26.11-lib-deprecations}
 
 - Setting `config.allowBrokenPredicate` is deprecated in favor of

doc/stdenv.md

@@ -1 +1,10 @@
 # Standard environment {#part-stdenv}
+
+```{=include=} chapters
+stdenv/stdenv.chapter.md
+stdenv/meta.chapter.md
+stdenv/passthru.chapter.md
+stdenv/multiple-output.chapter.md
+stdenv/cross-compilation.chapter.md
+stdenv/platform-notes.chapter.md
+```

doc/stdenv/stdenv.chapter.md

@@ -508,7 +508,6 @@ A number between 0 and 7 indicating how much information to log. If set to 1 or
 #### `enableParallelBuilding` {#var-stdenv-enableParallelBuilding}
 
 If set to `true`, `stdenv` will pass specific flags to `make` and other build tools to enable parallel building with up to `build-cores` workers.
-Can be overridden for a specific phase using `enableParallelInstalling` or `enableParallelChecking`.
 
 Unless set to `false`, some build systems with good support for parallel building including `cmake`, `meson`, and `qmake` will set it to `true`.
 

doc/style.css

@@ -465,8 +465,7 @@ div.appendix .variablelist .term {
   font-display: swap;
 }
 
-div.chapter,
-div.page {
+.chapter {
   content-visibility: auto;
 }
 

doc/toolchains.md

@@ -1 +1,5 @@
 # Toolchains {#part-toolchains}
+
+```{=include=} chapters
+toolchains/llvm.chapter.md
+```

doc/using-nixpkgs.md

@@ -1 +1,9 @@
 # Using Nixpkgs {#part-using}
+
+```{=include=} chapters
+channels.chapter.md
+using/platform-support.chapter.md
+using/configuration.chapter.md
+using/overlays.chapter.md
+using/overrides.chapter.md
+```

flake.nix

@@ -199,8 +199,7 @@
         && system != "riscv64-linux"
         # Exclude x86_64-freebsd because "Package ‘go-1.22.12-freebsd-amd64-bootstrap’ in /nix/store/0yw40qnrar3lvc5hax5n49abl57apjbn-source/pkgs/development/compilers/go/binary.nix:50 is not available on the requested hostPlatform"
         && system != "x86_64-freebsd"
-        # TODO: revert to importing fmt.pkg directly from ./ci when support for 26.05 ends
-      ) (forAllSystems (system: (import ./shell.nix { inherit system; }).formatter));
+      ) (forAllSystems (system: (import ./ci { inherit system; }).fmt.pkg));
 
       /**
         A nested structure of [packages](https://nix.dev/manual/nix/latest/glossary#package-attribute-set) and other values.

lib/asserts.nix

@@ -7,9 +7,6 @@ let
   inherit (lib.lists)
     filter
     ;
-  inherit (lib.attrsets)
-    catAttrs
-    ;
   inherit (lib.trivial)
     showWarnings
     ;
@@ -195,7 +192,7 @@ rec {
   checkAssertWarn =
     assertions: warnings: val:
     let
-      failedAssertions = catAttrs "message" (filter (x: !x.assertion) assertions);
+      failedAssertions = map (x: x.message) (filter (x: !x.assertion) assertions);
     in
     if failedAssertions != [ ] then
       throw "\nFailed assertions:\n${concatStringsSep "\n" (map (x: "- ${x}") failedAssertions)}"

lib/attrsets.nix

@@ -333,8 +333,8 @@ rec {
     :::
   */
   getAttrFromPath =
-    attrPath:
-    attrByPath attrPath (abort ("cannot find attribute '" + concatStringsSep "." attrPath + "'"));
+    attrPath: set:
+    attrByPath attrPath (abort ("cannot find attribute '" + concatStringsSep "." attrPath + "'")) set;
 
   /**
     Map each attribute in the given set and merge them into a new attribute set.
@@ -832,7 +832,9 @@ rec {
   */
   foldAttrs =
     op: nul: list_of_attrs:
-    mapAttrs (name: foldr op nul) (zipAttrs list_of_attrs);
+    foldr (
+      n: a: foldr (name: o: o // { ${name} = op n.${name} (a.${name} or nul); }) a (attrNames n)
+    ) { } list_of_attrs;
 
   /**
     Recursively collect sets that verify a given predicate named `pred`
@@ -871,18 +873,13 @@ rec {
     :::
   */
   collect =
-    pred:
-    let
-      recurse =
-        attrs:
-        if pred attrs then
-          [ attrs ]
-        else if isAttrs attrs then
-          concatMap recurse (attrValues attrs)
-        else
-          [ ];
-    in
-    recurse;
+    pred: attrs:
+    if pred attrs then
+      [ attrs ]
+    else if isAttrs attrs then
+      concatMap (collect pred) (attrValues attrs)
+    else
+      [ ];
 
   /**
     Return the cartesian product of attribute set value combinations.
@@ -1161,7 +1158,7 @@ rec {
     mapAttrsRecursive :: ([String] -> a -> b) -> AttrSet -> AttrSet
     ```
   */
-  mapAttrsRecursive = mapAttrsRecursiveCond (as: true);
+  mapAttrsRecursive = f: set: mapAttrsRecursiveCond (as: true) f set;
 
   /**
     Like `mapAttrsRecursive`, but it takes an additional predicate that tells it whether to recurse into an attribute set.
@@ -1348,14 +1345,7 @@ rec {
 
     :::
   */
-  genAttrs =
-    names: f:
-    listToAttrs (
-      map (name: {
-        inherit name;
-        value = f name;
-      }) names
-    );
+  genAttrs = names: f: genAttrs' names (n: nameValuePair n (f n));
 
   /**
     Like `genAttrs`, but allows the name of each attribute to be specified in addition to the value.
@@ -1873,7 +1863,7 @@ rec {
 
     :::
   */
-  overrideExisting = old: new: old // intersectAttrs old new;
+  overrideExisting = old: new: mapAttrs (name: value: new.${name} or value) old;
 
   /**
     Turns a list of strings into a human-readable description of those
@@ -1981,9 +1971,10 @@ rec {
   getFirstOutput =
     candidates: pkg:
     let
-      outputs = filter (name: pkg ? ${name}) candidates;
+      outputs = builtins.filter (name: hasAttr name pkg) candidates;
+      output = builtins.head outputs;
     in
-    if pkg.outputSpecified or false || outputs == [ ] then pkg else pkg.${head outputs};
+    if pkg.outputSpecified or false || outputs == [ ] then pkg else pkg.${output};
 
   /**
     Get a package's `bin` output.
@@ -2218,13 +2209,7 @@ rec {
 
     :::
   */
-  recurseIntoAttrs =
-    let
-      doRecurse = {
-        recurseForDerivations = true;
-      };
-    in
-    attrs: attrs // doRecurse;
+  recurseIntoAttrs = attrs: attrs // { recurseForDerivations = true; };
 
   /**
     Undo the effect of `recurseIntoAttrs`.
@@ -2241,13 +2226,7 @@ rec {
     dontRecurseIntoAttrs :: AttrSet -> AttrSet
     ```
   */
-  dontRecurseIntoAttrs =
-    let
-      dontRecurse = {
-        recurseForDerivations = false;
-      };
-    in
-    attrs: attrs // dontRecurse;
+  dontRecurseIntoAttrs = attrs: attrs // { recurseForDerivations = false; };
 
   /**
     `unionOfDisjoint x y` is equal to `x // y`, but accessing attributes present

lib/customisation.nix

@@ -2,7 +2,6 @@
 
 let
   inherit (builtins)
-    catAttrs
     intersectAttrs
     unsafeGetAttrPos
     ;
@@ -407,7 +406,7 @@ rec {
           ++ [
             {
               name = "all";
-              value = catAttrs "value" outputsList;
+              value = map (x: x.value) outputsList;
             }
           ]
         )

lib/default.nix

@@ -89,14 +89,6 @@ let
 
       # domain-specific
       fetchers = callLibs ./fetchers.nix;
-      services = callLibs ./services/lib.nix;
-      importService = self.modules.importApply ./services/service.nix;
-
-      # Modules that are not specific to a module class
-      genericModules = {
-        meta-maintainers = ./modules/generic/meta-maintainers.nix;
-        assertions = ./modules/generic/assertions.nix;
-      };
 
       # Eval-time filesystem handling
       path = callLibs ./path;

lib/deprecated/misc.nix

@@ -241,7 +241,7 @@ let
   # See https://github.com/NixOS/nixpkgs/pull/194391 for details.
   closePropagationFast =
     list:
-    builtins.catAttrs "val" (
+    map (x: x.val) (
       builtins.genericClosure {
         startSet = map (x: {
           key = x.outPath;

lib/fileset/internal.nix

@@ -349,33 +349,24 @@ rec {
     ```
   */
   _normaliseTreeFilter =
-    let
-      # Recurses into a tree that's already known to be a directory (either a "directory" or an attrset).
-      #
-      # Only directories need to be recursed into:
-      # Files are either null (excluded) or a file type string (included), which are already normalised.
-      #
-      # Checking this in the caller instead of here also avoids the thunk allocation for the path concatenation below.
-      recurse =
-        path: tree:
-        let
-          normalisedSubtrees = mapAttrs (
-            name: subtree:
-            if subtree == "directory" || isAttrs subtree then recurse (path + "/${name}") subtree else subtree
-          ) (_directoryEntries path tree);
-          subtreeValues = attrValues normalisedSubtrees;
-        in
-        # This triggers either when all files in a directory are filtered out
-        # Or when the directory doesn't contain any files at all
-        if all isNull subtreeValues then
-          null
-        # Triggers when we have the same as a `readDir path`, so we can turn it back into an equivalent "directory".
-        else if all isString subtreeValues then
-          "directory"
-        else
-          normalisedSubtrees;
-    in
-    path: tree: if tree == "directory" || isAttrs tree then recurse path tree else tree;
+    path: tree:
+    if tree == "directory" || isAttrs tree then
+      let
+        entries = _directoryEntries path tree;
+        normalisedSubtrees = mapAttrs (name: _normaliseTreeFilter (path + "/${name}")) entries;
+        subtreeValues = attrValues normalisedSubtrees;
+      in
+      # This triggers either when all files in a directory are filtered out
+      # Or when the directory doesn't contain any files at all
+      if all isNull subtreeValues then
+        null
+      # Triggers when we have the same as a `readDir path`, so we can turn it back into an equivalent "directory".
+      else if all isString subtreeValues then
+        "directory"
+      else
+        normalisedSubtrees
+    else
+      tree;
 
   /**
     A minimal normalisation of a filesetTree, intended for pretty-printing:
@@ -535,9 +526,6 @@ rec {
         else
           "/" + concatStringsSep "/" fileset._internalBaseComponents + "/";
 
-      getBaseStringPrefix = substring 0 baseLength;
-      removeBaseStringPrefix = substring baseLength (-1);
-
       baseLength = stringLength baseString;
 
       # Check whether a list of path components under the base path exists in the tree.
@@ -563,12 +551,7 @@ rec {
               # or a string ("directory" or "regular", etc.) in which case it's included
               localTree != null;
         in
-        # Start by recursing into the first element. This is guaranteed to be
-        # safe. components will never be empty (builtins.split can't make an
-        # empty list). Tree can be something other than an attrset, but if so,
-        # the isAttrs check will fail when being passed `or tree`, and the index
-        # being ahead doesn't matter.
-        recurse 2 (tree.${head components} or tree);
+        recurse 0 tree;
 
       # Filter suited when there's no files
       empty = _: _: false;
@@ -586,34 +569,25 @@ rec {
           pathSlash = path + "/";
         in
         (
-          # Same as `hasPrefix baseString pathSlash`, but more efficient.
-          # The path is either the base itself or underneath it,
-          # but only on the few paths above it, so its checked first.
-          # With base /foo/bar this matches /foo/bar and /foo/bar/baz
-          # hasPrefix "/foo/bar/" "/foo/bar/baz/"
-          if getBaseStringPrefix pathSlash == baseString then
-            if pathSlash == baseString then
-              # The path is the base directory itself, which is always included
-              true
-            else
-              # Same as `removePrefix baseString path`, but more efficient.
-              # From the above code we know that hasPrefix baseString pathSlash holds, so this is safe.
-              # We don't use pathSlash here because we only needed the trailing slash for the prefix matching.
-              # With base /foo and path /foo/bar/baz this gives
-              # inTree (split "/" (removePrefix "/foo/" "/foo/bar/baz"))
-              # == inTree (split "/" "bar/baz")
-              # == inTree [ "bar" "baz" ]
-              inTree (split "/" (removeBaseStringPrefix path))
           # Same as `hasPrefix pathSlash baseString`, but more efficient.
-          # The path is a proper ancestor of the base, which needs to be included for the base to be reachable:
           # With base /foo/bar we need to include /foo:
           # hasPrefix "/foo/" "/foo/bar/"
-          else if substring 0 (stringLength pathSlash) baseString == pathSlash then
+          if substring 0 (stringLength pathSlash) baseString == pathSlash then
             true
-          else
-            # The path is unrelated to the base, so nothing from it is included
-            # With base /foo/bar this matches e.g. /baz
+          # Same as `! hasPrefix baseString pathSlash`, but more efficient.
+          # With base /foo/bar we need to exclude /baz
+          # ! hasPrefix "/baz/" "/foo/bar/"
+          else if substring 0 baseLength pathSlash != baseString then
             false
+          else
+            # Same as `removePrefix baseString path`, but more efficient.
+            # From the above code we know that hasPrefix baseString pathSlash holds, so this is safe.
+            # We don't use pathSlash here because we only needed the trailing slash for the prefix matching.
+            # With base /foo and path /foo/bar/baz this gives
+            # inTree (split "/" (removePrefix "/foo/" "/foo/bar/baz"))
+            # == inTree (split "/" "bar/baz")
+            # == inTree [ "bar" "baz" ]
+            inTree (split "/" (substring baseLength (-1) path))
         )
         # This is a way have an additional check in case the above is true without any significant performance cost
         && (
@@ -828,34 +802,21 @@ rec {
   */
   _unionTrees =
     trees:
-    if length trees == 1 then
-      # The union of a single tree simply returns the first element
-      head trees
-    else
-      let
-        # Like lib.findFirstIndex but without indexing.
-        # This is a hot path so the indexing arithmetic adds up.
-        firstStr = foldl' (
-          found: tree:
-          if found != null then
-            found
-          else if isString tree then
-            tree
-          else
-            found # null
-        ) null trees;
-        nonNulls = filter (tree: tree != null) trees;
-      in
+    let
+      stringIndex = findFirstIndex isString null trees;
+      withoutNull = filter (tree: tree != null) trees;
+    in
+    if stringIndex != null then
       # If there's a string, it's always a fully included tree (dir or file),
       # no need to look at other elements
-      if firstStr != null then
-        firstStr
-      else if nonNulls == [ ] then
-        null
-      else
-        # The non-null elements have to be attribute sets representing partial trees
-        # We need to recurse into those
-        zipAttrsWith (name: _unionTrees) nonNulls;
+      elemAt trees stringIndex
+    else if withoutNull == [ ] then
+      # If all trees are null, then the resulting tree is also null
+      null
+    else
+      # The non-null elements have to be attribute sets representing partial trees
+      # We need to recurse into those
+      zipAttrsWith (name: _unionTrees) withoutNull;
 
   /**
     Computes the intersection of two filesets.

lib/filesystem.nix

@@ -375,8 +375,6 @@ in
         recurseIntoAttrs
         removeSuffix
         ;
-      isNixFile = hasSuffix ".nix";
-      removeNixSuffix = removeSuffix ".nix";
 
       # Generate an attrset corresponding to a given directory.
       # This function is outside `packagesFromDirectoryRecursive`'s lambda expression,
@@ -399,10 +397,10 @@ in
                 }
               );
             }
-          else if type == "regular" && isNixFile name then
+          else if type == "regular" && hasSuffix ".nix" name then
             {
               # call .nix files
-              "${removeNixSuffix name}" = callPackage path { };
+              "${removeSuffix ".nix" name}" = callPackage path { };
             }
           else if type == "regular" then
             {

lib/gvariant.nix

@@ -14,7 +14,6 @@
 
 let
   inherit (lib)
-    catAttrs
     concatMapStringsSep
     concatStrings
     escape
@@ -410,7 +409,7 @@ rec {
     elems:
     let
       gvarElems = map mkValue elems;
-      tupleType = type.tupleOf (catAttrs "type" gvarElems);
+      tupleType = type.tupleOf (map (e: e.type) gvarElems);
     in
     mkPrimitive tupleType gvarElems
     // {

lib/licenses/licenses.nix

@@ -178,11 +178,6 @@ lib.mapAttrs mkLicense (
       fullName = "Baekmuk License";
     };
 
-    bisonException22 = {
-      spdxId = "Bison-exception-2.2";
-      fullName = "Bison exception 2.2";
-    };
-
     bitstreamCharter = {
       spdxId = "Bitstream-Charter";
       fullName = "Bitstream Charter Font License";
@@ -203,11 +198,6 @@ lib.mapAttrs mkLicense (
       fullName = " BitTorrent Open Source License v1.1";
     };
 
-    blessing = {
-      spdxId = "blessing";
-      fullName = "SQLite Blessing";
-    };
-
     boehmGC = {
       spdxId = "Boehm-GC";
       fullName = "Boehm-Demers-Weiser GC License";
@@ -283,12 +273,6 @@ lib.mapAttrs mkLicense (
       fullName = "BSD 3-Clause Tso variant";
     };
 
-    bsdAskToEndorse = {
-      #spdxId = "BSD-ask-to-endorse"; # Accepted to SPDX waiting on next SPDX release
-      fullName = "BSD - ask to endorse";
-      url = "https://github.com/sudo-project/sudo/blob/c1307ea9ff340ce0538779f8e456501461fc44b7/plugins/sudoers/redblack.c#L24-L43";
-    };
-
     bsdAxisNoDisclaimerUnmodified = {
       fullName = "BSD-Axis without Warranty Disclaimer with Unmodified requirement";
       url = "https://scancode-licensedb.aboutcode.org/bsd-no-disclaimer-unmodified.html";
@@ -331,11 +315,6 @@ lib.mapAttrs mkLicense (
       fullName = "Buddy License";
     };
 
-    bugroff = {
-      spdxId = "Bugroff";
-      fullName = "Bugroff License";
-    };
-
     bzip2 = {
       spdxId = "bzip2-1.0.6";
       fullName = "bzip2 and libbzip2 License v1.0.6";
@@ -715,16 +694,6 @@ lib.mapAttrs mkLicense (
       url = "https://geant4.web.cern.ch/geant4/license/LICENSE.html";
     };
 
-    gccException20 = {
-      spdxId = "GCC-exception-2.0";
-      fullName = "GCC Runtime Library exception 2.0";
-    };
-
-    gccException31 = {
-      spdxId = "GCC-exception-3.1";
-      fullName = "GCC Runtime Library exception 3.1";
-    };
-
     geogebra = {
       fullName = "GeoGebra Non-Commercial License Agreement";
       url = "https://www.geogebra.org/license";
@@ -956,16 +925,6 @@ lib.mapAttrs mkLicense (
       redistributable = true;
     };
 
-    fsfap = {
-      spdxId = "FSFAP";
-      fullName = "FSF All Permissive License";
-    };
-
-    fsfullr = {
-      spdxId = "FSFULLR";
-      fullName = "FSF Unlimited License (with License Retention)";
-    };
-
     hl3 = {
       fullName = "Hippocratic License v3.0";
       url = "https://firstdonoharm.dev/version/3/0/core.txt";
@@ -1060,9 +1019,9 @@ lib.mapAttrs mkLicense (
       fullName = "Licence Libre du Québec – Permissive version 1.1";
     };
 
-    llgplPreamble = {
-      spdxId = "LLGPL";
-      fullName = "LLGPL Preamble"; # Only used together with LGPL (clarifying C-centric terms of LGPL in context of Lisp), SPDX tracks it separately
+    llgpl21 = {
+      fullName = "Lisp LGPL; GNU Lesser General Public License version 2.1 with Franz Inc. preamble for clarification of LGPL terms in context of Lisp";
+      url = "https://opensource.franz.com/preamble.html";
     };
 
     llvm-exception = {
@@ -1295,21 +1254,11 @@ lib.mapAttrs mkLicense (
       fullName = "Open Data Commons Open Database License v1.0";
     };
 
-    ofl10 = {
-      spdxId = "OFL-1.0";
-      fullName = "SIL Open Font License 1.0";
-    };
-
     ofl = {
       spdxId = "OFL-1.1";
       fullName = "SIL Open Font License 1.1";
     };
 
-    ogluk30 = {
-      spdxId = "OGL-UK-3.0";
-      fullName = "Open Government Licence v3.0";
-    };
-
     oml = {
       spdxId = "OML";
       fullName = "Open Market License";
@@ -1396,16 +1345,6 @@ lib.mapAttrs mkLicense (
       fullName = "Q Public License 1.0";
     };
 
-    qtGplException10 = {
-      spdxId = "Qt-GPL-exception-1.0";
-      fullName = "Qt GPL exception 1.0";
-    };
-
-    qtLgplException11 = {
-      spdxId = "Qt-LGPL-exception-1.1";
-      fullName = "Qt LPL exception 1.1";
-    };
-
     qwtException = {
       spdxId = "Qwt-exception-1.0";
       fullName = "Qwt exception 1.0";
@@ -1482,8 +1421,15 @@ lib.mapAttrs mkLicense (
     };
 
     stk = {
-      spdxId = "MIT-STK";
-      fullName = "MIT-STK License";
+      shortName = "stk";
+      fullName = "Synthesis Tool Kit 4.3";
+      url = "https://github.com/thestk/stk/blob/master/LICENSE";
+    };
+
+    sudo = {
+      shortName = "sudo";
+      fullName = "Sudo License (ISC-style)";
+      url = "https://www.sudo.ws/about/license/";
     };
 
     sustainableUse = {
@@ -1632,13 +1578,6 @@ lib.mapAttrs mkLicense (
       fullName = "Universal Permissive License";
     };
 
-    valveSDK = {
-      fullName = "Valve Corporation Steamworks SDK Access Agreement";
-      url = "https://partner.steamgames.com/documentation/sdk_access_agreement";
-      free = false;
-      redistributable = true;
-    };
-
     vim = {
       spdxId = "Vim";
       fullName = "Vim License";
@@ -1653,8 +1592,6 @@ lib.mapAttrs mkLicense (
     vol-sl = {
       fullName = "Volatility Software License, Version 1.0";
       url = "https://www.volatilityfoundation.org/license/vsl-v1.0";
-      free = false;
-      redistributable = true;
     };
 
     vsl10 = {
@@ -1686,11 +1623,6 @@ lib.mapAttrs mkLicense (
       fullName = "W3C Software Notice and License (1998-07-20)";
     };
 
-    w3c-20150513 = {
-      spdxId = "W3C-20150513";
-      fullName = "W3C Software Notice and Document License (2015-05-13)";
-    };
-
     wadalab = {
       fullName = "Wadalab Font License";
       url = "https://fedoraproject.org/wiki/Licensing:Wadalab?rd=Licensing/Wadalab";

lib/lists.nix

@@ -646,28 +646,11 @@ rec {
     :::
   */
   findFirst =
-    let
-      init = {
-        found = false;
-      };
-    in
     pred: default: list:
     let
-      result = foldl' (
-        acc: el:
-        if !acc.found && pred el then
-          # We haven't found a match yet, and the current element passes the
-          # predicate!
-          {
-            found = true;
-            value = el;
-          }
-        else
-          # There's already a match, or the current element fails the predicate
-          acc
-      ) init list;
+      index = findFirstIndex pred null list;
     in
-    if result.found then result.value else default;
+    if index == null then default else elemAt list index;
 
   /**
     Returns true if function `pred` returns true for at least one

lib/meta-types.nix

@@ -16,7 +16,6 @@ let
     any
     attrNames
     attrValues
-    catAttrs
     concatMap
     isFunction
     isBool
@@ -142,10 +141,10 @@ lib.fix (self: {
     assert all isTypeDef types;
     let
       # Store a list of functions so we don't have to pay the cost of attrset lookups at runtime.
-      funcs = catAttrs "verify" types;
+      funcs = map (t: t.verify) types;
     in
     {
-      name = "union<${concatStringsSep "," (catAttrs "name" types)}>";
+      name = "union<${concatStringsSep "," (map (t: t.name) types)}>";
       verify = v: any (func: func v) funcs;
     };
 
@@ -154,10 +153,10 @@ lib.fix (self: {
     assert all isTypeDef types;
     let
       # Store a list of functions so we don't have to pay the cost of attrset lookups at runtime.
-      funcs = catAttrs "verify" types;
+      funcs = map (t: t.verify) types;
     in
     {
-      name = "intersection<${concatStringsSep "," (catAttrs "name" types)}>";
+      name = "intersection<${concatStringsSep "," (map (t: t.name) types)}>";
       verify = v: all (func: func v) funcs;
     };
 

lib/modules.nix

@@ -566,7 +566,7 @@ let
         let
           keyFilter = filter (attrs: !isDisabled modulesPath disabled attrs);
         in
-        catAttrs "module" (genericClosure {
+        map (attrs: attrs.module) (genericClosure {
           startSet = keyFilter modules;
           operator = attrs: keyFilter attrs.modules;
         });
@@ -722,9 +722,10 @@ let
       # a module will resolve strictly the attributes used as argument but
       # not their values.  The values are forwarding the result of the
       # evaluation of the option.
+      context = name: ''while evaluating the module argument `${name}' in "${key}":'';
       extraArgs = mapAttrs (
         name: _:
-        addErrorContext ''while evaluating the module argument `${name}' in "${key}":'' (
+        addErrorContext (context name) (
           args.${name} or (addErrorContext
             "noting that argument `${name}` is not externally provided, so querying `_module.args` instead, requiring `config`"
             config._module.args.${name}
@@ -1147,8 +1148,8 @@ let
     // {
       value = addErrorContext "while evaluating the option `${showOption loc}':" value;
       inherit (res.defsFinal') highestPrio;
-      definitions = catAttrs "value" res.defsFinal;
-      files = catAttrs "file" res.defsFinal;
+      definitions = map (def: def.value) res.defsFinal;
+      files = map (def: def.file) res.defsFinal;
       definitionsWithLocations = res.defsFinal;
       inherit (res) isDefined;
       inherit (res.checkedAndMerged) valueMeta;