nezha-theme-nazhua: 0.8.0 -> 1.2.0

(cherry picked from commit a32b83d1cf)

.github/ISSUE_TEMPLATE.md

@@ -0,0 +1,6 @@
+<!--
+    Please note: This blank issue template is meant for extraordinary issues
+    that do not fit the templates. Unless you know your issue is relevant to
+    Nixpkgs and requires the free-form blank issue, please use the issue
+    templates instead.
+-->

.github/ISSUE_TEMPLATE/01_bug_report.yml

@@ -35,8 +35,7 @@ body:
         If you are using an older version, please update to the latest stable version and check if the issue persists before continuing this bug report.
       options:
         - "Please select a version."
-        - "- Unstable (26.11)"
-        - "- Beta (26.05)"
+        - "- Unstable (26.05)"
         - "- Stable (25.11)"
       default: 0
     validations:

.github/ISSUE_TEMPLATE/02_bug_report_darwin.yml

@@ -35,8 +35,7 @@ body:
         If you are using an older version, please update to the latest stable version and check if the issue persists before continuing this bug report.
       options:
         - "Please select a version."
-        - "- Unstable (26.11)"
-        - "- Beta (26.05)"
+        - "- Unstable (26.05)"
         - "- Stable (25.11)"
       default: 0
     validations:
@@ -100,7 +99,7 @@ body:
     attributes:
       label: "Are you using nix-darwin?"
       description: |
-        [`nix-darwin`](https://github.com/nix-darwin/nix-darwin) is a set of NixOS-like modules for macOS systems. Depending on your issue, this information may be relevant.
+        [`nix-darwin`](https://github.com/LnL7/nix-darwin) is a set of NixOS-like modules for macOS systems. Depending on your issue, this information may be relevant.
       options:
         - "Yes, I am using nix-darwin."
         - "No, I am not using nix-darwin."

.github/ISSUE_TEMPLATE/03_bug_report_nixos.yml

@@ -35,8 +35,7 @@ body:
         If you are using an older version, please update to the latest stable version and check if the issue persists before continuing this bug report.
       options:
         - "Please select a version."
-        - "- Unstable (26.11)"
-        - "- Beta (26.05)"
+        - "- Unstable (26.05)"
         - "- Stable (25.11)"
       default: 0
     validations:

.github/ISSUE_TEMPLATE/04_build_failure.yml

@@ -37,8 +37,7 @@ body:
         If you are purposefully trying to build an ancient version of a package in an older Nixpkgs, please coordinate with the [NixOS Archivists](https://matrix.to/#/#archivists:nixos.org).
       options:
         - "Please select a version."
-        - "- Unstable (26.11)"
-        - "- Beta (26.05)"
+        - "- Unstable (26.05)"
         - "- Stable (25.11)"
       default: 0
     validations:

.github/ISSUE_TEMPLATE/05_update_request.yml

@@ -37,8 +37,7 @@ body:
         If the package has been updated in unstable, but you believe the update should be backported to the stable release of Nixpkgs, please file the '**Request: backport to stable**' form instead.
       options:
         - "Please select a version."
-        - "- Unstable (26.11)"
-        - "- Beta (26.05)"
+        - "- Unstable (26.05)"
         - "- Stable (25.11)"
       default: 0
     validations:

.github/ISSUE_TEMPLATE/06_module_request.yml

@@ -35,8 +35,7 @@ body:
         If you are using an older or stable version, please update to the latest **unstable** version and check if the module still does not exist before continuing this request.
       options:
         - "Please select a version."
-        - "- Unstable (26.11)"
-        - "- Beta (26.05)"
+        - "- Unstable (26.05)"
         - "- Stable (25.11)"
       default: 0
     validations:

.github/PULL_REQUEST_TEMPLATE.md

@@ -13,7 +13,6 @@ For new packages please briefly describe the package or provide a link to its ho
 - Built on platform:
   - [ ] x86_64-linux
   - [ ] aarch64-linux
-  - [ ] x86_64-darwin
   - [ ] aarch64-darwin
 - Tested, as applicable:
   - [ ] [NixOS tests] in [nixos/tests].

.github/labeler.yml

@@ -9,6 +9,7 @@
           - '^release-'
           - '^staging-\d'
           - '^staging-next-\d'
+          - '^staging-nixos-\d'
 
 # NOTE: bsd, darwin and cross-compilation labels are handled by ofborg
 "6.topic: agda":

.github/workflows/backport.yml

@@ -36,7 +36,7 @@ jobs:
           permission-pull-requests: write
           permission-workflows: write
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           token: ${{ steps.app-token.outputs.token }}

.github/workflows/bot.yml

@@ -46,7 +46,7 @@ jobs:
       # https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/build.yml

@@ -34,25 +34,22 @@ jobs:
       matrix:
         include:
           - runner: ubuntu-24.04
-            name: x86_64-linux
-            systems: x86_64-linux
+            system: x86_64-linux
             builds: [shell, manual-nixos, lib-tests, tarball]
             desc: shell, docs, lib, tarball
           - runner: ubuntu-24.04-arm
-            name: aarch64-linux
-            systems: aarch64-linux
+            system: aarch64-linux
             builds: [shell, manual-nixos, manual-nixpkgs]
             desc: shell, docs
           - runner: macos-14
-            name: darwin
-            systems: aarch64-darwin x86_64-darwin
+            system: aarch64-darwin
             builds: [shell]
             desc: shell
-    name: '${{ matrix.name }}: ${{ matrix.desc }}'
+    name: '${{ matrix.system }}: ${{ matrix.desc }}'
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -80,7 +77,9 @@ jobs:
 
       - name: Build shell
         if: contains(matrix.builds, 'shell')
-        run: echo "${{ matrix.systems }}" | xargs -n1 nix-build-uncached nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A shell --argstr system
+        env:
+          system: ${{ matrix.system }}
+        run: nix-build-uncached nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A shell --argstr system "$system"
 
       - name: Build NixOS manual
         if: |
@@ -108,5 +107,5 @@ jobs:
           contains(fromJSON(inputs.baseBranch).type, 'primary')
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: ${{ inputs.artifact-prefix }}nixos-manual-${{ matrix.name }}
+          name: ${{ inputs.artifact-prefix }}nixos-manual-${{ matrix.system }}
           path: nixos-manual

.github/workflows/check.yml

@@ -43,7 +43,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 3
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           path: trusted
@@ -95,7 +95,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 3
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           path: trusted
@@ -137,7 +137,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions

.github/workflows/comment.yml

@@ -23,7 +23,7 @@ jobs:
     timeout-minutes: 2
     if: contains(github.event.comment.body, '@NixOS/nixpkgs-merge-bot merge')
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/eval.yml

@@ -15,6 +15,9 @@ on:
       targetSha:
         required: true
         type: string
+      baseBranch:
+        required: true
+        type: string
       systems:
         required: true
         type: string
@@ -47,7 +50,7 @@ jobs:
       ciPinBumpCommit: ${{ steps.find-pinned-commit.outputs.ciPinBumpCommit }}
       ciPinBumpCommitShort: ${{ steps.find-pinned-commit.outputs.ciPinBumpCommitShort }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           path: trusted
@@ -55,7 +58,7 @@ jobs:
             ci/supportedVersions.nix
 
       - name: Check out the PR at the test merge commit
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           ref: ${{ inputs.mergedSha }}
@@ -171,7 +174,7 @@ jobs:
           sudo mkswap /swap
           sudo swapon /swap
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -256,7 +259,7 @@ jobs:
       statuses: write # creating 'Eval Summary' commit statuses
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -291,6 +294,7 @@ jobs:
       - name: Compare against the target branch
         env:
           TARGET_SHA: ${{ inputs.mergedSha }}
+          BASE_BRANCH: ${{ fromJSON(inputs.baseBranch).branch }}
         run: |
           git -C nixpkgs/trusted diff --name-only "$TARGET_SHA" \
             | jq --raw-input --slurp 'split("\n")[:-1]' > touched-files.json
@@ -299,6 +303,7 @@ jobs:
           nix-build nixpkgs/trusted/ci --arg nixpkgs ./nixpkgs/trusted-pinned -A eval.compare \
             --arg combinedDir ./combined \
             --arg touchedFilesJson ./touched-files.json \
+            --argstr baseBranch "$BASE_BRANCH" \
             --out-link comparison
 
           cat comparison/step-summary.md >> "$GITHUB_STEP_SUMMARY"
@@ -471,7 +476,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions

.github/workflows/lint.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -61,7 +61,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -90,7 +90,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -134,7 +134,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: true # Needed to run git fetch for large PRs.
           path: trusted

.github/workflows/merge-group.yml

@@ -25,7 +25,7 @@ jobs:
       targetSha: ${{ steps.prepare.outputs.targetSha }}
       systems: ${{ steps.prepare.outputs.systems }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: |
@@ -97,6 +97,7 @@ jobs:
       artifact-prefix: ${{ inputs.artifact-prefix }}
       mergedSha: ${{ needs.prepare.outputs.mergedSha }}
       targetSha: ${{ needs.prepare.outputs.targetSha }}
+      baseBranch: ${{ needs.prepare.outputs.baseBranch }}
       systems: ${{ needs.prepare.outputs.systems }}
 
   build:

.github/workflows/periodic-merge.yml

@@ -34,7 +34,7 @@ jobs:
           permission-contents: write
           permission-pull-requests: write
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 

.github/workflows/pull-request-target.yml

@@ -36,7 +36,7 @@ jobs:
       systems: ${{ steps.prepare.outputs.systems }}
       touched: ${{ steps.prepare.outputs.touched }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout-cone-mode: true # default, for clarity
@@ -110,6 +110,7 @@ jobs:
       mergedSha: ${{ needs.prepare.outputs.mergedSha }}
       headSha: ${{ github.event.pull_request.head.sha }}
       targetSha: ${{ needs.prepare.outputs.targetSha }}
+      baseBranch: ${{ needs.prepare.outputs.baseBranch }}
       systems: ${{ needs.prepare.outputs.systems }}
       testVersions: ${{ contains(fromJSON(needs.prepare.outputs.touched), 'pinned') && !contains(fromJSON(needs.prepare.outputs.headBranch).type, 'development') }}
 

.github/workflows/review.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 2
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/teams.yml

@@ -2,7 +2,7 @@ name: Teams
 
 on:
   schedule:
-    # Every Tuesday at 19:42 (randomly chosen)
+    # Every Monday at 19:42 (randomly chosen)
     - cron: '42 19 * * 1'
   workflow_dispatch:
 
@@ -30,7 +30,7 @@ jobs:
           permission-pull-requests: write
 
       - name: Fetch source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/test.yml

@@ -19,7 +19,7 @@ jobs:
       push: ${{ steps.files.outputs.push }}
       targetSha: ${{ steps.prepare.outputs.targetSha }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout-cone-mode: true # default, for clarity

README.md

@@ -47,9 +47,9 @@ Here are some of the main ones:
 Nixpkgs and NixOS are built and tested by our continuous integration system, [Hydra](https://hydra.nixos.org/).
 
 * [Continuous package builds for unstable/master](https://hydra.nixos.org/jobset/nixos/trunk-combined)
-* [Continuous package builds for the NixOS 25.11 release](https://hydra.nixos.org/jobset/nixos/release-25.11)
+* [Continuous package builds for the NixOS 26.05 release](https://hydra.nixos.org/jobset/nixos/release-26.05)
 * [Tests for unstable/master](https://hydra.nixos.org/job/nixos/trunk-combined/tested#tabs-constituents)
-* [Tests for the NixOS 25.11 release](https://hydra.nixos.org/job/nixos/release-25.11/tested#tabs-constituents)
+* [Tests for the NixOS 26.05 release](https://hydra.nixos.org/job/nixos/release-26.05/tested#tabs-constituents)
 
 Artifacts successfully built with Hydra are published to cache at https://cache.nixos.org/.
 When successful build and test criteria are met, the Nixpkgs expressions are distributed via [Nix channels](https://nix.dev/manual/nix/stable/command-ref/nix-channel.html).

ci/OWNERS

@@ -124,7 +124,6 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @Artturin @Ericson2314 @lo
 
 # NixOS integration test driver
 /nixos/lib/test-driver  @tfc
-/nixos/lib/testing      @tfc
 
 # NixOS QEMU virtualisation
 /nixos/modules/virtualisation/qemu-vm.nix                 @raitobezarius
@@ -189,8 +188,6 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @Artturin @Ericson2314 @lo
 /maintainers/scripts/update-python-libraries  @mweinelt @natsukium
 /pkgs/by-name/up/update-python-libraries      @mweinelt @natsukium
 /pkgs/development/interpreters/python         @mweinelt @natsukium
-/pkgs/top-level/python-packages.nix                     @natsukium
-/pkgs/top-level/release-python.nix                      @natsukium
 
 # CUDA
 /pkgs/top-level/cuda-packages.nix             @NixOS/cuda-maintainers

ci/README.md

@@ -51,6 +51,16 @@ To ensure security and a focused utility, the bot adheres to specific limitation
   - opened by [@r-ryantm](https://nix-community.github.io/nixpkgs-update/r-ryantm/).
 - The user attempting to merge is a member of [@NixOS/nixpkgs-maintainers].
 - The user attempting to merge is a maintainer of all packages touched by the PR.
+- No [committer][@NixOS/nixpkgs-committers] has an outstanding "changes requested" review.
+  These block both the merge queue and auto-merge, so the bot refuses to merge until the review is addressed or dismissed.
+
+Once these constraints are met, the bot picks a merge strategy based on the `no PR failures` commit status:
+
+- CI passing: the PR is added to the merge queue.
+- CI unfinished (pending or missing status): the bot enables [Auto Merge], which queues the PR once required checks succeed.
+  Note that if CI later fails, nothing happens until it is fixed and passes.
+- CI already failing (`error`/`failure` status): the bot does not enable Auto Merge, because it would never trigger, and fixing CI requires a new push that invalidates the merge command.
+  A fresh `@NixOS/nixpkgs-merge-bot merge` comment is needed once CI is green again.
 
 ### Approving merge bot changes
 
@@ -104,3 +114,4 @@ This script can also be run locally to print basic test cases.
 [@NixOS/nixpkgs-ci]: https://github.com/orgs/NixOS/teams/nixpkgs-ci
 [@NixOS/nixpkgs-core]: https://github.com/orgs/NixOS/teams/nixpkgs-core
 [RFC 172]: https://github.com/NixOS/rfcs/pull/172
+[Auto Merge]: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/automatically-merging-a-pull-request

ci/default.nix

@@ -26,132 +26,7 @@ let
 
   fmt =
     let
-      treefmtNixSrc = fetchTarball {
-        inherit (pinned.treefmt-nix) url;
-        sha256 = pinned.treefmt-nix.hash;
-      };
-      treefmtEval = (import treefmtNixSrc).evalModule pkgs {
-        # Important: The auto-rebase script uses `git filter-branch --tree-filter`,
-        # which creates trees within the Git repository under `.git-rewrite/t`,
-        # notably without having a `.git` themselves.
-        # So if this projectRootFile were the default `.git/config`,
-        # having the auto-rebase script use treefmt on such a tree would make it
-        # format all files in the _parent_ Git tree as well.
-        projectRootFile = ".git-blame-ignore-revs";
-
-        # Be a bit more verbose by default, so we can see progress happening
-        settings.verbose = 1;
-
-        # By default it's info, which is too noisy since we have many unmatched files
-        settings.on-unmatched = "debug";
-
-        programs.actionlint.enable = true;
-
-        programs.biome = {
-          enable = true;
-          # Disable settings validation because its inputs are liable to hash mismatch
-          validate.enable = false;
-          settings.formatter = {
-            useEditorconfig = true;
-          };
-          settings.javascript.formatter = {
-            quoteStyle = "single";
-            semicolons = "asNeeded";
-          };
-          settings.json.formatter.enabled = false;
-        };
-        settings.formatter.biome.excludes = [
-          "*.min.js"
-          "pkgs/*"
-        ];
-
-        programs.keep-sorted.enable = true;
-
-        # This uses nixfmt underneath, the default formatter for Nix code.
-        # See https://github.com/NixOS/nixfmt
-        programs.nixfmt = {
-          enable = true;
-          package = pkgs.nixfmt;
-        };
-
-        programs.yamlfmt = {
-          enable = true;
-          settings.formatter = {
-            retain_line_breaks = true;
-          };
-        };
-        settings.formatter.yamlfmt.excludes = [
-          # Aligns comments with whitespace
-          "pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml"
-          # TODO: Fix formatting for auto-generated file
-          "pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml"
-        ];
-
-        programs.nixf-diagnose = {
-          enable = true;
-          ignore = [
-            # Rule names can currently be looked up here:
-            # https://github.com/nix-community/nixd/blob/main/libnixf/src/Basic/diagnostic.py
-            # TODO: Remove the following and fix things.
-            "sema-unused-def-lambda-noarg-formal"
-            "sema-unused-def-lambda-witharg-arg"
-            "sema-unused-def-lambda-witharg-formal"
-            "sema-unused-def-let"
-            # Keep this rule, because we have `lib.or`.
-            "or-identifier"
-            # TODO: remove after outstanding prelude diagnostics issues are fixed:
-            # https://github.com/nix-community/nixd/issues/761
-            # https://github.com/nix-community/nixd/issues/762
-            "sema-primop-removed-prefix"
-            "sema-primop-overridden"
-            "sema-constant-overridden"
-            "sema-primop-unknown"
-          ];
-        };
-        settings.formatter.nixf-diagnose = {
-          # Ensure nixfmt cleans up after nixf-diagnose.
-          priority = -1;
-          excludes = [
-            # Auto-generated; violates sema-extra-with
-            # Can only sensibly be removed when --auto-fix supports multiple fixes at once:
-            # https://github.com/inclyc/nixf-diagnose/issues/13
-            "pkgs/servers/home-assistant/component-packages.nix"
-            # https://github.com/nix-community/nixd/issues/708
-            "nixos/maintainers/scripts/azure-new/examples/basic/system.nix"
-          ];
-        };
-
-        settings.formatter.editorconfig-checker = {
-          command = "${pkgs.lib.getExe pkgs.editorconfig-checker}";
-          options = [
-            "-disable-indent-size"
-            # TODO: Remove this once this upstream issue is fixed:
-            #   https://github.com/editorconfig-checker/editorconfig-checker/issues/505
-            "-disable-charset"
-          ];
-          includes = [ "*" ];
-          priority = 1;
-        };
-
-        # TODO: Upstream this into treefmt-nix eventually:
-        #   https://github.com/numtide/treefmt-nix/issues/387
-        settings.formatter.markdown-code-runner = {
-          command = pkgs.lib.getExe pkgs.markdown-code-runner;
-          options =
-            let
-              config = pkgs.writers.writeTOML "markdown-code-runner-config" {
-                presets.nixfmt = {
-                  language = "nix";
-                  command = [ (pkgs.lib.getExe pkgs.nixfmt) ];
-                };
-              };
-            in
-            [ "--config=${config}" ];
-          includes = [ "*.md" ];
-        };
-
-        programs.zizmor.enable = true;
-      };
+      treefmt = pkgs.treefmt.withConfig ./treefmt.nix;
       fs = pkgs.lib.fileset;
       nixFilesSrc = fs.toSource {
         root = ../.;
@@ -159,9 +34,8 @@ let
       };
     in
     {
-      shell = treefmtEval.config.build.devShell;
-      pkg = treefmtEval.config.build.wrapper;
-      check = treefmtEval.config.build.check nixFilesSrc;
+      pkg = treefmt;
+      check = treefmt.check nixFilesSrc;
     };
 
 in

ci/eval/attrpaths.nix

@@ -1,85 +0,0 @@
-# This expression will, as efficiently as possible, dump a
-# *superset* of all attrpaths of derivations which might be
-# part of a release on *any* platform.
-#
-# This expression runs single-threaded under all current Nix
-# implementations, but much faster and with much less memory
-# used than ./outpaths.nix itself.
-#
-# Once you have the list of attrnames you can split it up into
-# $NUM_CORES batches and evaluate the outpaths separately for each
-# batch, in parallel.
-#
-# To dump the attrnames:
-#
-#   nix-instantiate --eval --strict --json ci/eval/attrpaths.nix -A names
-#
-{
-  lib ? import (path + "/lib"),
-  trace ? false,
-  path ? ./../..,
-  extraNixpkgsConfigJson ? "{}",
-}:
-let
-
-  # TODO: Use mapAttrsToListRecursiveCond when this PR lands:
-  # https://github.com/NixOS/nixpkgs/pull/395160
-  justAttrNames =
-    path: value:
-    let
-      result =
-        if path == [ "AAAAAASomeThingsFailToEvaluate" ] || !(lib.isAttrs value) then
-          [ ]
-        else if lib.isDerivation value then
-          [ path ]
-        else
-          lib.pipe value [
-            (lib.mapAttrsToList (
-              name: value:
-              lib.addErrorContext "while evaluating package set attribute path '${
-                lib.showAttrPath (path ++ [ name ])
-              }'" (justAttrNames (path ++ [ name ]) value)
-            ))
-            lib.concatLists
-          ];
-    in
-    lib.traceIf trace "** ${lib.showAttrPath path}" result;
-
-  outpaths = import ./outpaths.nix {
-    inherit path;
-    extraNixpkgsConfig = builtins.fromJSON extraNixpkgsConfigJson;
-    attrNamesOnly = true;
-  };
-
-  paths = [
-    # Some of the following are based on variants, which are disabled with `attrNamesOnly = true`.
-    # Until these have been removed from release.nix / hydra, we manually add them to the list.
-    [
-      "pkgsLLVM"
-      "stdenv"
-    ]
-    [
-      "pkgsArocc"
-      "stdenv"
-    ]
-    [
-      "pkgsZig"
-      "stdenv"
-    ]
-    [
-      "pkgsStatic"
-      "stdenv"
-    ]
-    [
-      "pkgsMusl"
-      "stdenv"
-    ]
-  ]
-  ++ justAttrNames [ ] outpaths;
-
-  names = map lib.showAttrPath paths;
-
-in
-{
-  inherit paths names;
-}

ci/eval/chunk.nix

@@ -2,8 +2,8 @@
 {
   lib ? import ../../lib,
   path ? ../..,
-  # The file containing all available attribute paths, which are split into chunks here
-  attrpathFile,
+  # The file containing the preEval result
+  preEvalFile,
   chunkSize,
   myChunk,
   includeBroken,
@@ -12,12 +12,13 @@
 }:
 
 let
-  attrpaths = lib.importJSON attrpathFile;
-  myAttrpaths = lib.sublist (chunkSize * myChunk) chunkSize attrpaths;
+  preEvalResult = lib.importJSON preEvalFile;
+  myAttrpaths = lib.sublist (chunkSize * myChunk) chunkSize preEvalResult.paths;
 
   unfiltered = import ./outpaths.nix {
     inherit path;
     inherit includeBroken systems;
+    inherit (preEvalResult) attrPathsDisallowedForInternalUse;
     extraNixpkgsConfig = builtins.fromJSON extraNixpkgsConfigJson;
   };
 

ci/eval/compare/default.nix

@@ -49,6 +49,7 @@ in
 {
   combinedDir,
   touchedFilesJson,
+  baseBranch,
   ownersFile ? ../../OWNERS,
 }:
 let
@@ -238,34 +239,33 @@ runCommand "compare"
       jq -r -f ${./generate-step-summary.jq} < ${changed-paths}
     } >> $out/step-summary.md
 
-    if jq -e '(.attrdiff.added | length == 0) and (.attrdiff.removed | length == 0)' "${changed-paths}" > /dev/null; then
-      # Chunks have changed between revisions
-      # We cannot generate a performance comparison
-      {
-        echo
-        echo "# Performance comparison"
-        echo
-        echo "This compares the performance of this branch against its pull request base branch (e.g., 'master')"
-        echo
-        echo "For further help please refer to: [ci/README.md](https://github.com/NixOS/nixpkgs/blob/master/ci/README.md)"
-        echo
-      } >> $out/step-summary.md
+    {
+      echo
+      echo "# Performance comparison"
+      echo
+      echo "This compares the performance of this branch against the \`${baseBranch}\` branch."
+      echo
+    } >> $out/step-summary.md
 
-      cmp-stats --explain ${combined}/before/stats ${combined}/after/stats >> $out/step-summary.md
-
-    else
-      # Package chunks are the same in both revisions
-      # We can use the to generate a performance comparison
+    # cmp-stats only compares the stats chunks present in both revisions, so the
+    # comparison is still produced when packages were added/removed. The paired
+    # chunks may cover different attrs in that case, so caveat the figures.
+    if ! jq -e '(.attrdiff.added | length == 0) and (.attrdiff.removed | length == 0)' "${changed-paths}" > /dev/null; then
       {
+        echo "> [!NOTE]"
+        echo "> The package sets differ between the two revisions. This comparison only"
+        echo "> covers packages evaluated in both, so treat the figures as approximate."
         echo
-        echo "# Performance Comparison"
-        echo
-        echo "Performance stats were skipped because the package sets differ between the two revisions."
-        echo
-        echo "For further help please refer to: [ci/README.md](https://github.com/NixOS/nixpkgs/blob/master/ci/README.md)"
       } >> $out/step-summary.md
     fi
 
+    {
+      echo "For further help please refer to: [ci/README.md](https://github.com/NixOS/nixpkgs/blob/master/ci/README.md)"
+      echo
+    } >> $out/step-summary.md
+
+    cmp-stats --explain ${combined}/before/stats ${combined}/after/stats >> $out/step-summary.md
+
     jq -r '.[]' "${touchedFilesJson}" > ./touched-files
     readarray -t touchedFiles < ./touched-files
     echo "This PR touches ''${#touchedFiles[@]} files"

ci/eval/default.nix

@@ -38,7 +38,7 @@ let
       fileset = unions (
         map (lib.path.append ../..) [
           ".version"
-          "ci/eval/attrpaths.nix"
+          "ci/eval/pre-eval.nix"
           "ci/eval/chunk.nix"
           "ci/eval/outpaths.nix"
           "default.nix"
@@ -56,11 +56,11 @@ let
     builtins.readFile ../../pkgs/top-level/release-supported-systems.json
   );
 
-  attrpathsSuperset =
+  preEval =
     {
       evalSystem,
     }:
-    runCommand "attrpaths-superset.json"
+    runCommand "pre-eval"
       {
         src = nixpkgs;
         # Don't depend on -dev outputs to reduce closure size for CI.
@@ -73,15 +73,15 @@ let
         export NIX_STATE_DIR=$(mktemp -d)
         mkdir $out
         export GC_INITIAL_HEAP_SIZE=4g
-        command time -f "Attribute eval done [%MKB max resident, %Es elapsed] %C" \
+        command time -f "Pre-eval done [%MKB max resident, %Es elapsed] %C" \
           nix-instantiate --eval --strict --json --show-trace \
-            "$src/ci/eval/attrpaths.nix" \
-            -A paths \
+            "$src/ci/eval/pre-eval.nix" \
+            -A result \
             -I "$src" \
             --argstr extraNixpkgsConfigJson ${lib.escapeShellArg (builtins.toJSON extraNixpkgsConfig)} \
             --option restrict-eval true \
             --option allow-import-from-derivation false \
-            --option eval-system "${evalSystem}" > $out/paths.json
+            --option eval-system "${evalSystem}" > $out/result.json
       '';
 
   singleSystem =
@@ -90,8 +90,8 @@ let
       # Note that this is intentionally not called `system`,
       # because `--argstr system` would only be passed to the ci/default.nix file!
       evalSystem ? builtins.currentSystem,
-      # The path to the `paths.json` file from `attrpathsSuperset`
-      attrpathFile ? "${attrpathsSuperset { inherit evalSystem; }}/paths.json",
+      # The path to the `result.json` file from `preEval`
+      preEvalFile ? "${preEval { inherit evalSystem; }}/result.json",
     }:
     let
       singleChunk = writeShellScript "single-chunk" ''
@@ -121,12 +121,12 @@ let
           --show-trace \
           --arg chunkSize "$chunkSize" \
           --arg myChunk "$myChunk" \
-          --arg attrpathFile "${attrpathFile}" \
+          --arg preEvalFile "${preEvalFile}" \
           --arg systems "[ \"$system\" ]" \
           --arg includeBroken ${lib.boolToString includeBroken} \
           --argstr extraNixpkgsConfigJson ${lib.escapeShellArg (builtins.toJSON extraNixpkgsConfig)} \
           -I ${nixpkgs} \
-          -I ${attrpathFile} \
+          -I ${preEvalFile} \
           > "$outputDir/result/$myChunk" \
           2> "$outputDir/stderr/$myChunk"
         exitCode=$?
@@ -164,7 +164,7 @@ let
         echo "System: $evalSystem"
         cores=$NIX_BUILD_CORES
         echo "Cores: $cores"
-        attrCount=$(jq length "${attrpathFile}")
+        attrCount=$(jq '.paths | length' "${preEvalFile}")
         echo "Attribute count: $attrCount"
         echo "Chunk size: $chunkSize"
         # Same as `attrCount / chunkSize` but rounded up
@@ -288,6 +288,9 @@ let
       #   | jq --raw-input --slurp 'split("\n")[:-1]' > touched-files.json
       # ```
       touchedFilesJson ? builtins.toFile "touched-files.json" "[ ]",
+      # The branch the local comparison is made against; matches the `master`
+      # used in the touched-files expression above.
+      baseBranch ? "master",
     }:
     let
       diffs = symlinkJoin {
@@ -305,7 +308,7 @@ let
       };
       comparisonReport = compare {
         combinedDir = combine { diffDir = diffs; };
-        inherit touchedFilesJson;
+        inherit touchedFilesJson baseBranch;
       };
     in
     comparisonReport;
@@ -313,7 +316,7 @@ let
 in
 {
   inherit
-    attrpathsSuperset
+    preEval
     singleSystem
     diff
     combine

ci/eval/outpaths.nix

@@ -6,7 +6,7 @@
   includeBroken ? true, # set this to false to exclude meta.broken packages from the output
   path ? ./../..,
 
-  # used by ./attrpaths.nix
+  # used by ./pre-eval.nix
   attrNamesOnly ? false,
 
   # Set this to `null` to build for builtins.currentSystem only
@@ -14,6 +14,8 @@
     builtins.readFile (path + "/pkgs/top-level/release-supported-systems.json")
   ),
 
+  attrPathsDisallowedForInternalUse ? [ ],
+
   # Customize the config used to evaluate nixpkgs
   extraNixpkgsConfig ? { },
 }:
@@ -35,6 +37,22 @@ let
             allowVariants = !attrNamesOnly;
             checkMeta = true;
 
+            # We don't need to care about problems being caught using the
+            # standard mechanism, because any problems whose kind is not
+            # nixpkgsInternalUseAllowed cause the corresponding attributes to
+            # be disallowed entirely for internal use with
+            # attrPathsDisallowedForInternalUse, see also ./pre-eval.nix
+            problems.matchers = lib.mkForce [
+              # We only need to set the broken handler to error, so that CI
+              # doesn't evaluate those. No reason it couldn't evaluate them
+              # afaik, but this is how it's been before.
+              {
+                kind = "broken";
+                handler = "error";
+              }
+            ];
+            inherit attrPathsDisallowedForInternalUse;
+
             # Silence the `x86_64-darwin` deprecation warning.
             allowDeprecatedx86_64Darwin = true;
 

ci/eval/pre-eval.nix

@@ -0,0 +1,128 @@
+# This file does a fast pre-evaluation of Nixpkgs to determine:
+# - paths: A *superset* of all attrpaths of derivations which might be part of a release on *any* platform.
+# - attrPathsDisallowedForInternalUse: Attribute paths whose meta.problems has problems whose kinds should not be used internally in Nixpkgs
+#
+# This expression runs single-threaded under all current Nix
+# implementations, but much faster and with much less memory
+# used than ./outpaths.nix itself.
+#
+# Once you have the list of attrnames you can split it up into
+# $NUM_CORES batches and evaluate the outpaths separately for each
+# batch, in parallel.
+#
+# To dump the result:
+#
+#   nix-instantiate --eval --strict --json ci/eval/pre-eval.nix -A result
+#
+{
+  lib ? import (path + "/lib"),
+  trace ? false,
+  path ? ./../..,
+  extraNixpkgsConfigJson ? "{}",
+}:
+let
+
+  # TODO: Use mapAttrsToListRecursiveCond when this PR lands:
+  # https://github.com/NixOS/nixpkgs/pull/395160
+  listAttrs =
+    path: value:
+    let
+      result =
+        if path == [ "AAAAAASomeThingsFailToEvaluate" ] || !(lib.isAttrs value) then
+          [ ]
+        else if lib.isDerivation value then
+          [
+            {
+              inherit path value;
+            }
+          ]
+        else
+          lib.pipe value [
+            (lib.mapAttrsToList (
+              name: value:
+              lib.addErrorContext "while evaluating package set attribute path '${
+                lib.showAttrPath (path ++ [ name ])
+              }'" (listAttrs (path ++ [ name ]) value)
+            ))
+            lib.concatLists
+          ];
+    in
+    lib.traceIf trace "** ${lib.showAttrPath path}" result;
+
+  outpaths = import ./outpaths.nix {
+    inherit path;
+    extraNixpkgsConfig = builtins.fromJSON extraNixpkgsConfigJson;
+    attrNamesOnly = true;
+  };
+
+  list =
+    map
+      (path: {
+        inherit path;
+        # This looks a bit weird, but the only reason we care about this value
+        # is for the meta.problems check below, and stdenv's certainly don't
+        # have any problems, so this is fine :)
+        value = { };
+      })
+      [
+        # Some of the following are based on variants, which are disabled with `attrNamesOnly = true`.
+        # Until these have been removed from release.nix / hydra, we manually add them to the list.
+        [
+          "pkgsLLVM"
+          "stdenv"
+        ]
+        [
+          "pkgsArocc"
+          "stdenv"
+        ]
+        [
+          "pkgsZig"
+          "stdenv"
+        ]
+        [
+          "pkgsStatic"
+          "stdenv"
+        ]
+        [
+          "pkgsMusl"
+          "stdenv"
+        ]
+      ]
+    ++ listAttrs [ ] outpaths;
+  paths = map (attrs: attrs.path) list;
+  names = map lib.showAttrPath paths;
+
+  inherit (import ../../pkgs/stdenv/generic/problems.nix { inherit lib; })
+    disallowNixpkgsInternalUseKinds
+    ;
+
+  # Determine the list of attributes whose packages have any meta.problems
+  # with a kind that's disallowed from internal Nixpkgs use
+  attrPathsDisallowedForInternalUse = lib.pipe list [
+    (lib.map (
+      attrs:
+      attrs
+      // {
+        problematicProblems = builtins.tryEval (
+          lib.filterAttrs (name: problem: disallowNixpkgsInternalUseKinds ? ${problem.kind}) (
+            attrs.value.meta.problems or { }
+          )
+        );
+      }
+    ))
+    (lib.filter (attrs: attrs.problematicProblems.success && attrs.problematicProblems.value != { }))
+    (lib.map (attrs: {
+      attrPath = attrs.path;
+      reason = "it has certain meta.problems whose kinds are disallowed: ${
+        lib.generators.toPretty { } attrs.problematicProblems.value
+      }";
+    }))
+  ];
+in
+{
+  # TODO: Do we still need these? Probably not
+  inherit paths names;
+  result = {
+    inherit paths attrPathsDisallowedForInternalUse;
+  };
+}

ci/github-script/bot.js

@@ -206,20 +206,8 @@ module.exports = async ({ github, context, core, dry }) => {
 
     const maintainers = await getMaintainerMap(pull_request.base.ref)
 
-    const merge_bot_eligible = await handleMerge({
-      github,
-      context,
-      core,
-      log,
-      dry,
-      pull_request,
-      events,
-      maintainers,
-      getTeamMembers,
-      getUser,
-    })
-
     // Check for any human reviews other than the PR author, GitHub actions and other GitHub apps.
+    // `commit { oid }` is needed by handleMerge to verify approvals are against the current head.
     const reviews = (
       await github.graphql(
         `query($owner: String!, $repo: String!, $pr: Int!) {
@@ -231,6 +219,7 @@ module.exports = async ({ github, context, core, dry }) => {
             reviews(first: 100) {
               nodes {
                 state
+                commit { oid }
                 user: author {
                   # Only get users, no bots
                   ... on User {
@@ -266,6 +255,20 @@ module.exports = async ({ github, context, core, dry }) => {
         r.user.id !== pull_request.user?.id,
     )
 
+    const merge_bot_eligible = await handleMerge({
+      github,
+      context,
+      core,
+      log,
+      dry,
+      pull_request,
+      events,
+      reviews,
+      maintainers,
+      getTeamMembers,
+      getUser,
+    })
+
     const approvals = new Set(
       reviews
         .filter((review) => review.state === 'APPROVED')

ci/github-script/merge.js

@@ -2,11 +2,11 @@ const { classify } = require('../supportedBranches.js')
 
 function runChecklist({
   committers,
-  events,
   files,
   pull_request,
   log,
   maintainers,
+  reviews,
   user,
   userIsMaintainer,
 }) {
@@ -27,18 +27,35 @@ function runChecklist({
         .reduce((acc, cur) => acc?.intersection(cur) ?? cur)
 
   const approvals = new Set(
-    events
+    reviews
       .filter(
-        ({ event, state, commit_id }) =>
-          event === 'reviewed' &&
-          state === 'approved' &&
+        ({ state, commit }) =>
+          state === 'APPROVED' &&
           // Only approvals for the current head SHA count, otherwise authors could push
           // bad code between the approval and the merge.
-          commit_id === pull_request.head.sha,
+          commit?.oid === pull_request.head.sha,
       )
-      .map(({ user }) => user?.id)
-      // Some users have been deleted, so filter these out.
-      .filter(Boolean),
+      .map(({ user }) => user.id),
+  )
+
+  // A "changes requested" review from a committer blocks both the merge queue and
+  // auto-merge, even if it was made on an older commit (unlike approvals, GitHub does
+  // not auto-dismiss changes-requested reviews on push). For each committer, take their
+  // latest actionable review; if it's CHANGES_REQUESTED, they're blocking the PR.
+  // Dismissed reviews surface as DISMISSED and comment-only follow-ups as COMMENTED, so
+  // both are skipped naturally — the prior actionable review still stands until the
+  // committer explicitly approves or requests changes again.
+  const committerReviewState = new Map()
+  for (const { user, state } of reviews) {
+    if (
+      committers.has(user.id) &&
+      ['APPROVED', 'CHANGES_REQUESTED'].includes(state)
+    ) {
+      committerReviewState.set(user.id, state)
+    }
+  }
+  const noBlockingReviews = !Array.from(committerReviewState.values()).includes(
+    'CHANGES_REQUESTED',
   )
 
   const checklist = {
@@ -57,6 +74,11 @@ function runChecklist({
         pull_request.user.login === 'r-ryantm',
     },
     'PR is not a draft': !pull_request.draft,
+    // CI state is intentionally *not* a checklist item: auto-merge exists precisely to
+    // cover unfinished CI, and an already-failed CI is reported via the merge message
+    // (see merge() below) rather than a blanket refusal.
+    'PR is not blocked by a "changes requested" review from a [committer](https://github.com/orgs/NixOS/teams/nixpkgs-committers).':
+      noBlockingReviews,
   }
 
   if (user) {
@@ -97,7 +119,7 @@ function hasMergeCommand(body) {
   return (body ?? '')
     .replace(/<!--.*?-->/gms, '')
     .replace(/(^`{3,})[^`].*?\1/gms, '')
-    .match(/^@NixOS\/nixpkgs-merge-bot merge\s*$/m)
+    .match(/^@NixOS\/nixpkgs-merge-bot merge\s*$/im)
 }
 
 async function handleMergeComment({ github, body, node_id, reaction }) {
@@ -123,6 +145,7 @@ async function handleMerge({
   dry,
   pull_request,
   events,
+  reviews,
   maintainers,
   getTeamMembers,
   getUser,
@@ -148,6 +171,14 @@ async function handleMerge({
   // including an early exit when the first non-by-name file is found.
   if (files.length >= 100) return false
 
+  const noPrFailuresState = (
+    await github.rest.repos.listCommitStatusesForRef({
+      ...context.repo,
+      ref: pull_request.head.sha,
+      per_page: 100,
+    })
+  ).data.find(({ context }) => context === 'no PR failures')?.state
+
   // Only look through comments *after* the latest (force) push.
   const lastPush = events.findLastIndex(
     ({ event, sha, commit_id }) =>
@@ -173,10 +204,12 @@ async function handleMerge({
         )),
   )
 
+  // Returns `{ reaction, messages }`: the reaction to leave on the merge comment and the
+  // lines to append to the bot's reply. Throws only on an unexpected API error.
   async function merge() {
     if (dry) {
       core.info(`Merging #${pull_number}... (dry)`)
-      return ['Merge completed (dry)']
+      return { reaction: 'ROCKET', messages: ['Merge completed (dry)'] }
     }
 
     // Using GraphQL mutations instead of the REST /merge endpoint, because the latter
@@ -197,16 +230,37 @@ async function handleMerge({
         { node_id: pull_request.node_id, sha: pull_request.head.sha },
       )
       log('merge', 'Queued for merge')
-      return [
-        `:heavy_check_mark: [Queued](${resp.enqueuePullRequest.mergeQueueEntry.mergeQueue.url}) for merge (#306934)`,
-      ]
+      return {
+        reaction: 'ROCKET',
+        messages: [
+          `:heavy_check_mark: [Queued](${resp.enqueuePullRequest.mergeQueueEntry.mergeQueue.url}) for merge (#306934)`,
+        ],
+      }
     } catch (e) {
       log('Enqueuing failed', e.response.errors[0].message)
     }
 
-    // If required status checks are not satisfied, yet, the above will fail. In this case
-    // we can enable auto-merge. We could also only use auto-merge, but this often gets
-    // stuck for no apparent reason.
+    // Enqueuing fails when the required status checks are not satisfied, yet. If CI has
+    // already failed, enabling auto-merge would be pointless: it would never fire, and
+    // fixing CI requires a new push, which invalidates this merge command anyway (we only
+    // act on comments after the latest push). So we don't enable auto-merge and instead
+    // ask for a fresh command once CI is green again.
+    if (['error', 'failure'].includes(noPrFailuresState)) {
+      log('merge', 'CI has failed, not enabling auto-merge')
+      return {
+        reaction: 'THUMBS_DOWN',
+        messages: [
+          ':x: Pull Request could not be merged: CI has failed (#305350).',
+          '',
+          '> [!TIP]',
+          '> PRs cannot be merged while CI is failing.',
+          '> Once CI is passing, comment `@NixOS/nixpkgs-merge-bot merge` again.',
+        ],
+      }
+    }
+
+    // CI has not finished yet, so we enable auto-merge. We could also only use auto-merge,
+    // but this often gets stuck for no apparent reason.
     try {
       await github.graphql(
         `mutation($node_id: ID!, $sha: GitObjectID) {
@@ -219,12 +273,17 @@ async function handleMerge({
         { node_id: pull_request.node_id, sha: pull_request.head.sha },
       )
       log('merge', 'Auto-merge enabled')
-      return [
-        `:heavy_check_mark: Enabled Auto Merge (#306934)`,
-        '',
-        '> [!TIP]',
-        '> Sometimes GitHub gets stuck after enabling Auto Merge. In this case, leaving another approval should trigger the merge.',
-      ]
+      return {
+        reaction: 'ROCKET',
+        messages: [
+          `:heavy_check_mark: Enabled Auto Merge (#306934)`,
+          '',
+          '> [!TIP]',
+          '> [Auto Merge](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/automatically-merging-a-pull-request) will queue this PR once required CI checks succeed.',
+          '> If CI fails instead, fixing it needs a new push, which disables Auto Merge and invalidates this command — comment `@NixOS/nixpkgs-merge-bot merge` again once CI is green.',
+          '> If GitHub gets stuck even though CI passed (it sometimes does), leaving another approval should kick off the merge.',
+        ],
+      }
     } catch (e) {
       log('Auto Merge failed', e.response.errors[0].message)
       throw new Error(e.response.errors[0].message)
@@ -267,11 +326,11 @@ async function handleMerge({
 
     const { result, eligible, checklist } = runChecklist({
       committers,
-      events,
       files,
       pull_request,
       log,
       maintainers,
+      reviews,
       user: comment.user,
       userIsMaintainer: await isMaintainer(comment.user.login),
     })
@@ -308,10 +367,12 @@ async function handleMerge({
     }
 
     if (result) {
-      await react('ROCKET')
       try {
-        body.push(...(await merge()))
+        const { reaction, messages } = await merge()
+        await react(reaction)
+        body.push(...messages)
       } catch (e) {
+        await react('THUMBS_DOWN')
         // Remove the HTML comment with node_id reference to allow retrying this merge on the next run.
         body.shift()
         body.push(`:x: Merge failed with: ${e} (#371492)`)
@@ -336,11 +397,11 @@ async function handleMerge({
 
   const { result } = runChecklist({
     committers,
-    events,
     files,
     pull_request,
     log,
     maintainers,
+    reviews,
   })
 
   // Returns a boolean, which indicates whether the PR is merge-bot eligible in principle.

ci/pinned.json

@@ -9,23 +9,10 @@
       },
       "branch": "nixpkgs-unstable",
       "submodules": false,
-      "revision": "02f3fa0374fa13707d42d55d58ecc76b091f223c",
-      "url": "https://github.com/NixOS/nixpkgs/archive/02f3fa0374fa13707d42d55d58ecc76b091f223c.tar.gz",
-      "hash": "0z8d33c5g0gk9a74ppqq77npisf9xx9c8ai9isxa2hyjx4lv1pki"
-    },
-    "treefmt-nix": {
-      "type": "Git",
-      "repository": {
-        "type": "GitHub",
-        "owner": "numtide",
-        "repo": "treefmt-nix"
-      },
-      "branch": "main",
-      "submodules": false,
-      "revision": "790751ff7fd3801feeaf96d7dc416a8d581265ba",
-      "url": "https://github.com/numtide/treefmt-nix/archive/790751ff7fd3801feeaf96d7dc416a8d581265ba.tar.gz",
-      "hash": "1zah3dmbpn3ap5acg22kq1j19dg32gj73l43yamjcxhc38sv9kd5"
+      "revision": "8c91a71d13451abc40eb9dae8910f972f979852f",
+      "url": "https://github.com/NixOS/nixpkgs/archive/8c91a71d13451abc40eb9dae8910f972f979852f.tar.gz",
+      "hash": "sha256-fnzKKPvS+oieI/pTzotA5tkoM47EB1NpaBcgk4R97hE="
     }
   },
-  "version": 5
+  "version": 8
 }

ci/treefmt.nix

@@ -0,0 +1,170 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+{
+  settings = {
+    # numtide/treefmt-nix defaults
+    excludes = [
+      "*.lock"
+      "*.patch"
+      "*.diff"
+      "package-lock.json"
+      "go.mod"
+      "go.sum"
+      ".gitattributes"
+      ".gitignore"
+      ".gitmodules"
+      "COPYING"
+      "LICENSE"
+    ];
+
+    # Be a bit more verbose by default, so we can see progress happening
+    verbose = 1;
+
+    # By default it's info, which is too noisy since we have many unmatched files
+    on-unmatched = "debug";
+
+    formatter = {
+      # keep-sorted start block=yes newline_separated=yes
+      actionlint = {
+        command = lib.getExe pkgs.actionlint;
+        includes = [
+          ".github/workflows/*.yml"
+          ".github/workflows/*.yaml"
+        ];
+      };
+
+      biome = {
+        command = lib.getExe pkgs.biome;
+        excludes = [
+          "*.min.js"
+          "pkgs/*"
+        ];
+        includes = [
+          "*.js"
+          "*.ts"
+          "*.mjs"
+          "*.mts"
+          "*.cjs"
+          "*.cts"
+          "*.jsx"
+          "*.tsx"
+          "*.d.ts"
+          "*.d.cts"
+          "*.d.mts"
+          "*.css"
+        ];
+        options = [
+          "check"
+          "--write"
+          "--no-errors-on-unmatched"
+          "--use-editorconfig=true"
+          "--javascript-formatter-quote-style=single"
+          "--semicolons=as-needed"
+        ];
+      };
+
+      editorconfig-checker = {
+        command = lib.getExe pkgs.editorconfig-checker;
+        options = [
+          "-disable-indent-size"
+          # TODO: Remove this once this upstream issue is fixed:
+          #   https://github.com/editorconfig-checker/editorconfig-checker/issues/505
+          "-disable-charset"
+        ];
+        includes = [ "*" ];
+        priority = 1;
+      };
+
+      keep-sorted = {
+        command = lib.getExe pkgs.keep-sorted;
+        includes = [ "*" ];
+      };
+
+      markdown-code-runner = {
+        command = lib.getExe pkgs.markdown-code-runner;
+        options =
+          let
+            config = pkgs.writers.writeTOML "markdown-code-runner-config" {
+              presets.nixfmt = {
+                language = "nix";
+                command = [ (lib.getExe pkgs.nixfmt) ];
+              };
+            };
+          in
+          [ "--config=${config}" ];
+        includes = [ "*.md" ];
+      };
+
+      nixf-diagnose = {
+        command = lib.getExe pkgs.nixf-diagnose;
+        excludes = [
+          # Auto-generated; violates sema-extra-with
+          # Can only sensibly be removed when --auto-fix supports multiple fixes at once:
+          # https://github.com/inclyc/nixf-diagnose/issues/13
+          "pkgs/servers/home-assistant/component-packages.nix"
+          # https://github.com/nix-community/nixd/issues/708
+          "nixos/maintainers/scripts/azure-new/examples/basic/system.nix"
+        ];
+        includes = [ "*.nix" ];
+        options = [
+          "--auto-fix"
+          # Rule names can currently be looked up here:
+          # https://github.com/nix-community/nixd/blob/main/libnixf/src/Basic/diagnostic.py
+          # TODO: Remove the following and fix things.
+          "--ignore=sema-unused-def-lambda-noarg-formal"
+          "--ignore=sema-unused-def-lambda-witharg-arg"
+          "--ignore=sema-unused-def-lambda-witharg-formal"
+          "--ignore=sema-unused-def-let"
+          # TODO: remove after outstanding prelude diagnostics issues are fixed:
+          # https://github.com/nix-community/nixd/issues/761
+          # https://github.com/nix-community/nixd/issues/762
+          "--ignore=sema-primop-removed-prefix"
+          "--ignore=sema-primop-overridden"
+          "--ignore=sema-constant-overridden"
+          "--ignore=sema-primop-unknown"
+        ];
+        # Ensure nixfmt cleans up after nixf-diagnose.
+        priority = -1;
+      };
+
+      # This uses nixfmt underneath, the default formatter for Nix code.
+      # See https://github.com/NixOS/nixfmt
+      nixfmt = {
+        command = lib.getExe pkgs.nixfmt;
+        includes = [ "*.nix" ];
+      };
+
+      yamlfmt = {
+        command = lib.getExe pkgs.yamlfmt;
+        excludes = [
+          # Aligns comments with whitespace
+          "pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml"
+          # TODO: Fix formatting for auto-generated file
+          "pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml"
+        ];
+        includes = [
+          "*.yaml"
+          "*.yml"
+        ];
+        options = [
+          "-formatter"
+          "retain_line_breaks=true"
+        ];
+      };
+
+      zizmor = {
+        command = lib.getExe pkgs.zizmor;
+        includes = [
+          ".github/workflows/*.yml"
+          ".github/workflows/*.yaml"
+          ".github/actions/**/*.yml"
+          ".github/actions/**/*.yaml"
+        ];
+      };
+      # keep-sorted end
+    };
+  };
+}

ci/update-pinned.sh

@@ -1,8 +1,9 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p npins
+#!nix-shell -i bash -p npins -I nixpkgs=../
 
 set -euo pipefail
 
 cd "$(dirname "${BASH_SOURCE[0]}")"
 
+npins --lock-file pinned.json upgrade
 npins --lock-file pinned.json update

doc/hooks/index.md

@@ -48,7 +48,6 @@ unzip.section.md
 validatePkgConfig.section.md
 versionCheckHook.section.md
 waf.section.md
-writable-tmpdir-as-home-hook.section.md
 zig.section.md
 xcbuild.section.md
 xfce4-dev-tools.section.md

doc/hooks/writable-tmpdir-as-home-hook.section.md

@@ -1,5 +0,0 @@
-# writableTmpDirAsHomeHook {#writableTmpDirAsHomeHook}
-
-This setup hook provides a writable home directory for packages that require it.
-
-To use, just add the hook to the `nativeBuildInputs` of the package.

doc/languages-frameworks/javascript.section.md

@@ -364,7 +364,7 @@ It is highly recommended to use a pinned version of pnpm (i.e., `pnpm_9` or `pnp
 +let
 +  # Optionally override pnpm to use a custom nodejs version
 +  # Make sure that the same nodejs version is referenced in nativeBuildInputs
-+  # pnpm = pnpm_10.override { nodejs = nodejs-slim_22; };
++  # pnpm = pnpm_10.override { nodejs-slim = nodejs-slim_22; };
 +in
  stdenv.mkDerivation (finalAttrs: {
    pname = "foo";
@@ -406,6 +406,8 @@ In case you are patching `package.json` or `pnpm-lock.yaml`, make sure to pass `
 }
 ```
 
+If needed, `dontPnpmConfigure = true;` can be used to fully disable `pnpmConfigHook` without manually removing it from inputs.
+
 #### Dealing with `sourceRoot` {#javascript-pnpm-sourceRoot}
 
 If the pnpm project is in a subdirectory, you can just define `sourceRoot` or `setSourceRoot` for `fetchPnpmDeps`.

doc/languages-frameworks/lua.section.md

@@ -232,7 +232,7 @@ The following is an example:
         vyp
         lblasc
       ];
-      license = lib.licenses.mit;
+      license.fullName = "MIT/X11";
     };
   };
 }

doc/packages/darwin-builder.section.md

@@ -89,7 +89,7 @@ Note that if the builder is running and you have created the above ssh conf file
 {
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-22.11-darwin";
-    darwin.url = "github:nix-darwin/nix-darwin/master";
+    darwin.url = "github:lnl7/nix-darwin/master";
     darwin.inputs.nixpkgs.follows = "nixpkgs";
   };
 

doc/redirects.json

@@ -412,9 +412,6 @@
   "sec-meta-identifiers-cpe": [
     "index.html#sec-meta-identifiers-cpe"
   ],
-  "sec-meta-identifiers-purl": [
-    "index.html#sec-meta-identifiers-purl"
-  ],
   "sec-modify-via-packageOverrides": [
     "index.html#sec-modify-via-packageOverrides"
   ],
@@ -436,30 +433,6 @@
   "chap-overlays": [
     "index.html#chap-overlays"
   ],
-  "sec-nixpkgs-release-26.11": [
-    "release-notes.html#sec-nixpkgs-release-26.11"
-  ],
-  "sec-nixpkgs-release-26.11-highlights": [
-    "release-notes.html#sec-nixpkgs-release-26.11-highlights"
-  ],
-  "sec-nixpkgs-release-26.11-incompatibilities": [
-    "release-notes.html#sec-nixpkgs-release-26.11-incompatibilities"
-  ],
-  "sec-nixpkgs-release-26.11-lib": [
-    "release-notes.html#sec-nixpkgs-release-26.11-lib"
-  ],
-  "sec-nixpkgs-release-26.11-lib-breaking": [
-    "release-notes.html#sec-nixpkgs-release-26.11-lib-breaking"
-  ],
-  "sec-nixpkgs-release-26.11-lib-deprecations": [
-    "release-notes.html#sec-nixpkgs-release-26.11-lib-deprecations"
-  ],
-  "sec-nixpkgs-release-26.11-lib-additions-improvements": [
-    "release-notes.html#sec-nixpkgs-release-26.11-lib-additions-improvements"
-  ],
-  "sec-nixpkgs-release-26.11-notable-changes": [
-    "release-notes.html#sec-nixpkgs-release-26.11-notable-changes"
-  ],
   "sec-nixpkgs-release-26.05": [
     "release-notes.html#sec-nixpkgs-release-26.05"
   ],
@@ -938,15 +911,6 @@
   "var-meta-identifiers-possibleCPEs": [
     "index.html#var-meta-identifiers-possibleCPEs"
   ],
-  "var-meta-identifiers-purl": [
-    "index.html#var-meta-identifiers-purl"
-  ],
-  "var-meta-identifiers-purlParts": [
-    "index.html#var-meta-identifiers-purlParts"
-  ],
-  "var-meta-identifiers-purls": [
-    "index.html#var-meta-identifiers-purls"
-  ],
   "var-meta-teams": [
     "index.html#var-meta-teams"
   ],
@@ -1055,9 +1019,6 @@
   "tar-files": [
     "index.html#tar-files"
   ],
-  "writableTmpDirAsHomeHook": [
-    "index.html#writableTmpDirAsHomeHook"
-  ],
   "x86_64-darwin-26.05": [
     "release-notes.html#x86_64-darwin-26.05"
   ],

doc/release-notes/release-notes.md

@@ -3,7 +3,6 @@
 This section lists the release notes for each stable version of Nixpkgs and the current unstable revision.
 
 ```{=include=} sections
-rl-2611.section.md
 rl-2605.section.md
 rl-2511.section.md
 rl-2505.section.md

doc/release-notes/rl-2605.section.md

@@ -1,4 +1,4 @@
-# Nixpkgs 26.05 ("Yarara", 2026.05/??) {#sec-nixpkgs-release-26.05}
+# Nixpkgs 26.05 ("Yarara", 2026.05/30) {#sec-nixpkgs-release-26.05}
 
 ## Highlights {#sec-nixpkgs-release-26.05-highlights}
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -6,6 +6,44 @@
 - GCC has been updated from GCC 14 to GCC 15.
   This introduces some backwards incompatible changes; Refer to the [upstream porting guide](https://gcc.gnu.org/gcc-15/porting_to.html) for details.
 
+- `glibc` has been updated to version 2.42.
+
+  This version no longer makes the stack executable when a shared library requires this. A symptom
+  is an error like
+
+  > cannot enable executable stack as shared object requires: Invalid argument
+
+  This is usually a bug. Please consider reporting it to the software maintainers.
+
+  In a lot of cases, the library requires the execstack by mistake only. The following workarounds exist:
+
+  * When building the shared library in question from source, use the following linker flags to force turning off the
+    executable flag:
+
+    ```nix
+    mkDerivation {
+      # …
+
+      env.NIX_LDFLAGS = "-z,noexecstack";
+    }
+    ```
+
+  * If the sources are not available, the execstack-flag can be cleared with `patchelf`:
+
+    ```
+    patchelf --clear-execstack binary-only.so
+    ```
+
+  * If the shared library to be loaded actually requires an executable stack and it isn't turned
+    on by the application loading it, you may force allowing that behavior by setting the
+    following environment variable:
+
+    ```
+    GLIBC_TUNABLES=glibc.rtld.execstack=2
+    ```
+
+    **Do not set this globally!** This makes your setup inherently less secure.
+
 - Node.js default version has been updated from 22 LTS to 24 LTS.
   This introduces some breaking changes; Refer to the [upstream migration article](https://nodejs.org/en/blog/migrations/v22-to-v24) for details.
 
@@ -74,6 +112,8 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- `mdbook-linkcheck` has been removed as it is unmaintained and incompatible with the latest version of `mdbook`. Users can instead migrate to `mdbook-linkcheck2`.
+
 - The `nodePackages` package set has been removed entirely from nixpkgs. This package set was created to ease the maintenance burden of maintaining lots of
   NodeJS-based packages within nixpkgs, but became a burden itself. Over the past several releases, there has been a focus on removing it in favor of the more modern nixpkgs packaging strategies.
   After a long time, this package set has been deprecated and removed. If you are using its package set in your own config, please use the top-level packages instead.(i.e `pkgs.package-name` instead of `pkgs.nodePackages.package-name`).
@@ -111,6 +151,23 @@
 
 - `nodePackages.wavedrom-cli` has been removed, as it was unmaintained within nixpkgs.
 
+- MATE packages have been moved to top level (e.g. if you previously added `pkgs.mate.caja` to `environment.systemPackages`, you will need to change it to `pkgs.caja`).
+
+- `kratos` has been updated from 1.3.1 to [25.4.0](https://github.com/ory/kratos/releases/tag/v25.4.0). Upstream switched to a new versioning scheme (year.major.minor). Notable breaking changes:
+
+  - The `migrate sql` CLI command is now `migrate sql up`
+  - OIDC registration validation errors are now placed in the `default` node group instead of `oidc`
+  - Failed OIDC account linking returns HTTP 400 instead of 200
+
+- `pdns` has been updated to version [v5.0.x](https://doc.powerdns.com/authoritative/changelog/5.0.html), which introduces breaking changes. Check out the [Upgrade Notes](https://doc.powerdns.com/authoritative/upgrading.html#to-5-0-0) for details.
+
+- `geph` package's built-in GUI `geph5-client-gui` has been [removed](https://github.com/geph-official/geph5/commit/f2221fb8386312daf2cef05483ebb353ff48bdb4) by the upstream. All users who wish to continue using the GUI should install the `gephgui-wry`, which is consistent with the official release version.
+
+- `xfsprogs` was updated to version 6.18.0, which enables parent pointers and exchange-range by default. Upstream recommends not to use these features with kernels older than 6.18.
+   GRUB2 is likely unable to boot from filesystems with these features enabled.
+
+- `lunarvim` package has been removed, as it was abandoned upstream and relied on an old version of `neovim` to work properly.
+
 - `requireFile` now treats any `message` or `url` argument as a literal string, rather than subjecting it to Bash here-doc expansion.  This allows including strings like `$PWD` in the message without needing to know about and handle the undocumented Bash expansion.
 
 - `nodePackages.browserify` has been removed, as it was unmaintained within nixpkgs.
@@ -126,8 +183,6 @@
 - `kanata` now requires `karabiner-dk` version 6.0+ or later.
   The package has been updated to use the new `karabiner-dk` package and the `darwinDriver` output stays at the version defined in the package.
 
-- Reloading or restarting systemd units from the NixOS activation script is deprecated, and will be removed in NixOS 26.11. This deprecation is part of a bigger effort to deprecate activation scripts altogether, which will take place over several releases. There are no in-tree usages of the now-deprecated reload/restart functionality.
-
 - Keycloak has been updated to 26.6.X, bringing a lot of new features like federated client authentication, JWT authorization grants, workflows and the ability to do
   zero-downtime patch releases. Read more about [all the exciting new capabilities in keycloak 26.6 here](https://github.com/keycloak/keycloak/releases/tag/26.6.0)
   and [consult the migration guide to 26.6](https://www.keycloak.org/docs/latest/upgrading/index.html#migrating-to-26-6-0) to find out whether this is a breaking
@@ -177,7 +232,7 @@
 
 - `iroh` has been removed and split up into `iroh-dns-server` and `iroh-relay`.
 
-- the `xorg` package set has been deprecated, packages have moved to the top level.
+- The `xorg` package set has been deprecated, packages have moved to the top level.
 
 - `python3Packages.buildPythonPackage` and `python3Packages.buildPythonApplication` now throw errors in the presence of `pytestFlagsArray`.
   Please use [`pytestFlags` and `(enabled|disabled)(TestPaths|Tests|TestMarks)`](#using-pytestcheckhook) instead.
@@ -214,23 +269,12 @@
 - `jetbrains.plugins.addPlugins` no longer supports plugin names or ID strings.
   You can still use `addPlugins` with plugin derivations, such as plugins packaged outside of Nixpkgs.
 
-- The `programs.captive-browser` module no longer falls back on a setcap wrapper around udhcpc to discover your network's DNS server due to [GHSA-wc3r-c66x-8xmc](https://github.com/NixOS/nixpkgs/security/advisories/GHSA-wc3r-c66x-8xmc) (CVE-2026-25740). If you're using this module, you must either configure `programs.captive-browser.dhcp-dns` manually or enable one of NetworkManager, dhcpcd, or systemd-networkd.
-
 - NetBox was updated to `>= 4.5.5`. Have a look at the breaking changes
   of the [4.5 release](https://github.com/netbox-community/netbox/releases/tag/v4.5.0),
   make the required changes to your database, if needed, then upgrade by setting `services.netbox.package = pkgs.netbox_4_5;` in your configuration.
 
-- The `services.yggdrasil` module has been refactored with the following breaking changes:
-  - The `services.yggdrasil.configFile` option has been removed. Configuration should now be specified directly via `services.yggdrasil.settings`.
-  - The `services.yggdrasil.persistentKeys` option has been removed. To maintain persistent keys and IPv6 addresses across reboots, use `services.yggdrasil.settings.PrivateKeyPath` to securely load your private key from a file via systemd credentials. The private key must be in PEM format (PKCS #8).
-  - Storing `PrivateKey` directly in `settings` is now explicitly forbidden to prevent keys from being stored world-readable in the Nix store.
-  - If you previously used `configFile`, migrate your configuration to the `settings` option and extract the private key to a separate file referenced by `PrivateKeyPath`.
-  - If you previously used `persistentKeys`, convert your keys to PEM format and store them in a secure location accessible only to root, then reference them via `PrivateKeyPath`.
-
 - `pocket-id` has been updated to version 2 that contains [breaking changes](https://pocket-id.org/docs/setup/major-releases/migrate-v2).
 
-- `services.xserver` will now throw an error if an X11 driver specified in  `videoDriver(s)` cannot be found. Previously, unknown drivers would be silently ignored.
-
 - `asio` (standalone version of `boost::asio`) has been updated from 1.24.0 to 1.36.0. Some breaking changes were introduced between these
   two versions, and the one affected most was the removal of `asio::io_service` in favor of `asio::io_context` in 1.33.0. `asio_1_32_0` is
   retained for packages that have not completed migration. `asio_1_10` has been removed as no packages depend on it anymore.
@@ -253,8 +297,6 @@
 
 - Ethercalc and its associated module have been removed, as the package is unmaintained and cannot be installed from source with npm now.
 
-- The `services.avahi.wideArea` option now defaults to `false` as a mitigation against [`CVE-2024-52615`/`GHSA-x6vp-f33h-h32g`](https://github.com/avahi/avahi/security/advisories/GHSA-x6vp-f33h-h32g).
-
 - `coreth` has been removed, as upstream has moved it into `avalanchego`.
 
 - `nodePackages.prebuild-install` was removed because it appeared to be unmaintained upstream.
@@ -284,8 +326,6 @@
 
 - `shisho` has been removed because it's archived. `semgrep`, `opengrep`, and `ast-grep` provide similar functionality.
 
-- `services.openssh.settings.AcceptEnv` is now explicitly defined as an option that takes a list of strings, to facilitate option merging. Setting it to a string value is no longer supported.
-
 - All Xfce packages have been moved to top level (e.g. if you previously added `pkgs.xfce.xfce4-whiskermenu-plugin` to `environment.systemPackages`, you will need to change it to `pkgs.xfce4-whiskermenu-plugin`). The `xfce` scope will be removed in NixOS 26.11.
 
 - The Dovecot IMAP server has been updated to version 2.4, with the `dovecot` attribute now referring to this backwards-incompatible version. The attribute `dovecot_2_3` refers to the previous version. The Pigeonhole plugin has been similarly updated to 2.4, with the version compatible with Dovecot 2.3 being at `dovecot_pigeonhole_0_5`. See <https://doc.dovecot.org/latest/installation/upgrade/2.3-to-2.4.html> for more information on how to upgrade.
@@ -296,12 +336,8 @@
 
 - `vimPlugins.nvim-treesitter` has been updated to `main` branch, which is a full and incompatible rewrite. If you can't or don't want to update, you should use `vimPlugins.nvim-treesitter-legacy`.
 
-- `services.taskchampion-sync-server` module has had an option `services.taskchampion-sync-server.dynamicUser` added to use systemd's DynamicUser feature. This is enabled by default when stateVersion is at least 26.05, and disabled otherwise. If you need this feature, you need to set `services.taskchampion-sync-server.dynamicUser` to `true` and migrate `/var/lib/taskchampion-sync-server` to `/var/lib/private/taskchampion-sync-server`.
-
 - Package `jellyseerr` has been renamed to `seerr` following the upstream rename.
 
-- The default packages in `services.jenkins.packages` have been dropped, since not every Jenkins installation needs any package at all. It's more reasonable to leave it empty and let users configure what they need.
-
 - The `pie` hardening flag has been removed and will now error, after being deprecated in 25.11. Compilers are expected to enable PIE by default, as has been common practice since 2016 outside of Nixpkgs. If a package needs `pie` disabled pass `-no-pie` in `CFLAGS`. It is unlikely this will be necessary in many cases; due to the prevalence of default PIE toolchains, most packages incompatible with PIE already pass `-no-pie`.
 
 - `pqos-wrapper` was removed as it has been unmaintained since 2022 and not widely used.
@@ -314,6 +350,8 @@
 
 - `linuxPackages.nvidiaPackages` now follows NVIDIA's official release branches by exposing `production`, `new_feature`, and `beta`. The convenience aliases `latest` (newer of `production` and `new_feature`) and `bleeding_edge` (newer of `latest` and `beta`) are provided; note that `beta` now refers strictly to the beta branch.
 
+- `stestrCheckHook` was added: This test hook runs `stestr run`. You can disable tests with `disabledTests` and `disabledTestsRegex`.
+
 - `balatro` now supports the Google Play and Xbox PC versions of the game.  Pass the `apk` or `Assets.zip` as `balatro.override { src = "…" }`.
 
 - `uptime-kuma` has been updated to v2, which requires an automated migration that can take a few hours. **A backup is highly recommended.**
@@ -324,16 +362,22 @@
 
 - The `libcxxhardeningextensive` hardening flag has been **disabled** by default. Enabling it by default in 25.11 was unintentional and may have had a negative effect on performance in some cases. `libcxxhardeningfast` remains enabled by default.
 
-- The packages `ibtool`, `actool` and `re-plistbuddy` have been added, providing reimplementations of the corresponding proprietary Apple tools. They are more compatible with the originals than the previously existing `xcbuild` package, and should enable more darwin software to be built from source.
+- Wine has been updated to the 11.0 branch. Please check the [upstream announcement](https://gitlab.winehq.org/wine/wine/-/releases/wine-11.0) for more details.
 
-- Switch inhibitors were introduced, which add a pre-switch check that compares a list of strings between the previous and the new generation, and refuses to switch into the new generation when there is a difference between the two lists. This allows avoiding switching into a system when for instance the systemd version changed by adding `config.systemd.package.version` to the switch inhibitors for your system. You can still forcefully switch into any generation by setting `NIXOS_NO_CHECK=1`.
+- Cinnamon has been updated to 6.6, please check the [upstream announcement](https://www.linuxmint.com/rel_zena_whatsnew.php) for more details.
+
+- `rspamd` has been updated to 4.0. Please check the upstream [migration](https://docs.rspamd.com/tutorials/migration/#migration-to-rspamd-400) documentation, especially if you run a sharded Redis deployment.
+
+- `hyphen` now supports over 40 language variants through `hyphenDicts` and now allows to enable all supported languages through `hyphenDicts.all`.
+
+- `budgie` has been updated to 10.10, please check the [upstream announcement](https://buddiesofbudgie.org/blog/budgie-10-10-released) for more details.
+
+- The packages `ibtool`, `actool` and `re-plistbuddy` have been added, providing reimplementations of the corresponding proprietary Apple tools. They are more compatible with the originals than the previously existing `xcbuild` package, and should enable more darwin software to be built from source.
 
 - GNU Taler has been updated to version 1.3.
   This release focuses on getting everything ready for a deployment of GNU Taler by Magnet bank.
   For more details, see the [upstream release notes](https://www.taler.net/en/news/2025-13.html).
 
-- The `services.nextcloud-spreed-signaling` NixOS module has been added to facilitate declarative management of a standalone Spreed signaling server ("High Performance Backend" for Nextcloud Talk).
-
 - `collabora-desktop` The desktop version of Collabora Office is now available, package version `25.05.9.2-2`.
 
 - `fetchPnpmDeps` and `pnpmConfigHook` were added as top-level attributes, replacing the now deprecated `pnpm.fetchDeps` and `pnpm.configHook` attributes.
@@ -368,8 +412,6 @@
 
 - Updated `gonic` to 0.21.0. A full ("slow") scan is recommended after upgrading to v0.21.0 to pick up the newly scanned fields (contributors, ISRCs, record labels, per-track years, ARTIST_CREDIT).
 
-- the `autossh-ng` NixOS module was introduced as a simpler alternative to the existing `autossh` module.
-
 - Added `haskell.packages.microhs`, a set of Haskell packages built with MicroHs.
 
 - `gnuradio`: Overriding the `.pkgs` package set is now possible with a `packageOverrides` function, like with `python.pkgs` and other language-specific package sets.
@@ -388,8 +430,6 @@ gnuradioMinimal.override {
 }
 ```
 
-- Added `headplane` and `headplane-agent` packages, and `services.headplane` service.
-
 ## Nixpkgs Library {#sec-nixpkgs-release-26.05-lib}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -422,4 +462,3 @@ gnuradioMinimal.override {
 
 - The builder `php.buildComposerProject2` for PHP applications has been improved for better reliability and stability.
 
-- The `services.drupal` module has a few improvements aimed at making it better for installing custom Drupal instances, namely a new `webRoot` option for identifying custom webroots in source code, a new `configRoot` option for identifying and synchronizing config yamls onto NixOS, and some new settings for managing variable content and filepaths.

doc/release-notes/rl-2611.section.md

@@ -1,4 +1,4 @@
-# Nixpkgs 26.11 ("Zokor", 2026.11/??) {#sec-nixpkgs-release-26.11}
+# Nixpkgs 26.11 (2026.11/??) {#sec-nixpkgs-release-26.11}
 
 ## Highlights {#sec-nixpkgs-release-26.11-highlights}
 
@@ -10,20 +10,13 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- `hurl` has been updated to `8.x.x` which has some breaking changes. See [upstream changelog](https://github.com/Orange-OpenSource/hurl/releases/tag/8.0.0) for details.
-- `python3Packages.django-health-check` has been updated to major version 4. See its [migration guide](https://codingjoe.dev/django-health-check/migrate-to-v4/) and [changelog](https://github.com/codingjoe/django-health-check/releases/tag/4.0.0) for breaking changes.
-
-- `requireFile` now sets `meta.license = lib.licenses.unfree` by default. Users of `requireFile`-based derivations that preserve this default will need to explicitly allow their evaluation as described in [](#sec-allow-unfree).
+- Create the first release note entry in this section!
 
 ## Other Notable Changes {#sec-nixpkgs-release-26.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- Package-URL (PURL, https://github.com/package-url/purl-spec) metadata identifier has been added for `fetchgit`, `fetchpypi` and `fetchFromGithub` fetchers.
-  `mkDerivation` has been adjusted to reuse this information.
-  Package-URLs allow reliably identifying and locating software packages.
-  Maintainers of derivations using the adapted fetchers should rely on the `drv.src.meta.identifiers.v1.purl` default identifier and can enhance their `drv.meta.identifiers.v1.purls` list once they would like to have additional identifiers.
-  Maintainers using `fetchurl` for `drv.src` are urged to adapt their `drv.meta.identifiers.purlParts` for proper identification.
+- Create the first release note entry in this section!
 
 ## Nixpkgs Library {#sec-nixpkgs-release-26.11-lib}
 

doc/stdenv/meta.chapter.md

@@ -157,8 +157,6 @@ The list of Nix platform types for which the [Hydra](https://github.com/nixos/hy
 }
 ```
 
-Note that this does not affect whether reverse dependencies of the package are built on Hydra.
-
 ### `broken` {#var-meta-broken}
 
 If set to `true`, the package is marked as "broken", meaning that it won’t show up in [search.nixos.org](https://search.nixos.org/packages), and cannot be built or installed unless [explicitly allowed](#sec-allow-broken).
@@ -342,30 +340,3 @@ A readonly attribute that concatenates all CPE parts in one string.
 #### `meta.identifiers.possibleCPEs` {#var-meta-identifiers-possibleCPEs}
 
 A readonly attribute containing the list of guesses for what CPE for this package can look like. It includes all variants of version handling mentioned above. Each item is an attrset with attributes `cpeParts` and `cpe` for each guess.
-
-### Package URL {#sec-meta-identifiers-purl}
-
-[Package-URL](https://github.com/package-url/purl-spec) (PURL) is a specification to reliably identify and locate software packages.
-Through identification of software packages, additional (non-major) use cases are e.g. software license cross-verification via third party databases or initial vulnerability response management.
-Package-URLs shall default to the `mkDerivation.src`, as the original consumed software package is the single source of truth.
-
-#### `meta.identifiers.purlParts` {#var-meta-identifiers-purlParts}
-
-This attribute contains an attribute set of all parts of the PURL for this package.
-
-* `type` mandatory [type](https://github.com/package-url/purl-spec/blob/18fd3e395dda53c00bc8b11fe481666dc7b3807a/docs/standard/summary.md) which needs to be provided
-* `spec` specify the PURL in accordance with the [purl-spec](https://github.com/package-url/purl-spec/blob/18fd3e395dda53c00bc8b11fe481666dc7b3807a/purl-specification.md)
-
-#### `meta.identifiers.purl` {#var-meta-identifiers-purl}
-
-An extendable attribute which is built based on `purlParts`.
-This is the main identifier of the software package.
-For handling edge cases, consider using the list interface [`meta.identifiers.purls`](#var-meta-identifiers-purls).
-
-#### `meta.identifiers.purls` {#var-meta-identifiers-purls}
-
-An extendable list attribute which defaults to a single element equal to [`meta.identifiers.purl`](#var-meta-identifiers-purl).
-It provides an interface for additional identifiers of `mkDerivation.src` or for identifiers of vendored dependencies inside `mkDerivation.src`, which maintainers may carefully consider to specify as well.
-
-Additional identifiers are generally not recommended, as they might cause maintenance overhead or diverge.
-For example, a source distribution `pkg:github` may be hard to keep correctly aligned with the corresponding binary distribution `pkg:pypi`.

lib/.version

@@ -1 +1 @@
-26.11
+26.05

lib/attrsets.nix

@@ -5,7 +5,6 @@
 
 let
   inherit (builtins) head length;
-  inherit (lib.trivial) mergeAttrs;
   inherit (lib.strings)
     concatStringsSep
     concatMapStringsSep
@@ -13,16 +12,18 @@ let
     sanitizeDerivationName
     ;
   inherit (lib.lists)
-    filter
-    foldr
-    foldl'
+    all
+    concatLists
     concatMap
     elemAt
-    all
-    partition
-    groupBy
-    take
+    filter
     foldl
+    foldl'
+    foldr
+    groupBy
+    partition
+    reverseList
+    take
     ;
 in
 
@@ -370,7 +371,11 @@ rec {
 
     :::
   */
-  concatMapAttrs = f: v: foldl' mergeAttrs { } (attrValues (mapAttrs f v));
+  concatMapAttrs =
+    f: v:
+    listToAttrs (
+      concatLists (reverseList (mapAttrsToList (name: value: attrsToList (f name value)) v))
+    );
 
   /**
     Update or set specific paths of an attribute set.

lib/customisation.nix

@@ -400,25 +400,7 @@ rec {
     condition: passthru: drv:
     let
       commonAttrs =
-        drv
-        // listToAttrs (
-          outputsList
-          ++ [
-            {
-              name = "all";
-              value = map (x: x.value) outputsList;
-            }
-          ]
-        )
-        // passthru
-        // {
-          drvPath =
-            assert condition;
-            drv.drvPath;
-          outPath =
-            assert condition;
-            drv.outPath;
-        };
+        drv // (listToAttrs outputsList) // { all = map (x: x.value) outputsList; } // passthru;
 
       outputsList = map (outputName: {
         name = outputName;
@@ -440,7 +422,15 @@ rec {
         };
       }) (drv.outputs or [ "out" ]);
     in
-    commonAttrs;
+    commonAttrs
+    // {
+      drvPath =
+        assert condition;
+        drv.drvPath;
+      outPath =
+        assert condition;
+        drv.outPath;
+    };
 
   /**
     Strip a derivation of all non-essential attributes, returning

lib/generators.nix

@@ -23,12 +23,9 @@
 let
   inherit (lib)
     addErrorContext
-    any
     assertMsg
     attrNames
-    attrValues
     concatLists
-    concatMap
     concatMapStringsSep
     concatStrings
     concatStringsSep
@@ -55,7 +52,6 @@ let
     isString
     last
     length
-    genAttrs
     mapAttrs
     mapAttrsToList
     optionals
@@ -383,69 +379,55 @@ rec {
       See the [git-config documentation](https://git-scm.com/docs/git-config#_variables) for possible values.
   */
   toGitINI =
+    attrs:
     let
       mkSectionName =
-        let
-          containsQuote = hasInfix ''"'';
-        in
         name:
         let
+          containsQuote = hasInfix ''"'' name;
           sections = splitString "." name;
+          section = head sections;
+          subsections = tail sections;
+          subsection = concatStringsSep "." subsections;
         in
-        if containsQuote name || length sections == 1 then
-          name
-        else
-          ''${head sections} "${concatStringsSep "." (tail sections)}"'';
+        if containsQuote || subsections == [ ] then name else ''${section} "${subsection}"'';
 
       mkValueString =
+        v:
         let
-          escape = replaceStrings [ "\n" "	" ''"'' "\\" ] [ "\\n" "\\t" ''\"'' "\\\\" ];
+          escapedV = ''"${replaceStrings [ "\n" "	" ''"'' "\\" ] [ "\\n" "\\t" ''\"'' "\\\\" ] v}"'';
         in
-        v: mkValueStringDefault { } (if isString v then ''"${escape v}"'' else v);
+        mkValueStringDefault { } (if isString v then escapedV else v);
 
       # generation for multiple ini values
       mkKeyValue =
+        k: v:
         let
-          mkKeyValue = mkKeyValueDefault { inherit mkValueString; } " = ";
-          attrToString = k: v: "\t" + mkKeyValue k v;
+          mkKeyValue = mkKeyValueDefault { inherit mkValueString; } " = " k;
         in
-        k: v: if isList v then concatStringsSep "\n" (map (attrToString k) v) else attrToString k v;
+        concatStringsSep "\n" (map (kv: "\t" + mkKeyValue kv) (toList v));
 
       # converts { a.b.c = 5; } to { "a.b".c = 5; } for toINI
       gitFlattenAttrs =
         let
-          isNonDrvAttrs = value: isAttrs value && !isDerivation value;
           recurse =
             path: value:
-            if isNonDrvAttrs value then
-              concatMap (name: recurse ([ name ] ++ path) value.${name}) (attrNames value)
+            if isAttrs value && !isDerivation value then
+              mapAttrsToList (name: value: recurse ([ name ] ++ path) value) value
             else if length path > 1 then
-              [
-                {
-                  ${concatStringsSep "." (reverseList (tail path))}.${head path} = value;
-                }
-              ]
+              {
+                ${concatStringsSep "." (reverseList (tail path))}.${head path} = value;
+              }
             else
-              [
-                {
-                  ${head path} = value;
-                }
-              ];
+              {
+                ${head path} = value;
+              };
         in
-        attrs:
-        let
-          # Filter the names for any that contain nested attrsets. attrs that
-          # don't contain nested attrsets can stay the same =
-          namesToRewrite = filter (
-            name: isAttrs attrs.${name} && any isNonDrvAttrs (attrValues attrs.${name})
-          ) (attrNames attrs);
-          attrsToRewrite = genAttrs namesToRewrite (name: attrs.${name});
-        in
-        removeAttrs attrs namesToRewrite // foldl recursiveUpdate { } (recurse [ ] attrsToRewrite);
+        attrs: foldl recursiveUpdate { } (flatten (recurse [ ] attrs));
 
       toINI_ = toINI { inherit mkKeyValue mkSectionName; };
     in
-    attrs: toINI_ (gitFlattenAttrs attrs);
+    toINI_ (gitFlattenAttrs attrs);
 
   /**
     `mkKeyValueDefault` wrapper that handles dconf INI quirks.

lib/licenses/licenses.nix

@@ -575,13 +575,6 @@ lib.mapAttrs mkLicense (
       free = false;
     };
 
-    enpl = {
-      fullName = "Emmi AI Non-Production License";
-      url = "https://github.com/Emmi-AI/noether/blob/main/LICENSE.txt";
-      free = false;
-      redistributable = true;
-    };
-
     epl10 = {
       spdxId = "EPL-1.0";
       fullName = "Eclipse Public License 1.0";
@@ -1157,12 +1150,6 @@ lib.mapAttrs mkLicense (
       redistributable = true; # Only if used in Netdata products.
     };
 
-    netboxLimitedUse = {
-      fullName = "NetBox Limited Use License 1.0";
-      free = false;
-      url = "https://github.com/netboxlabs/netbox-branching/blob/8465b9aee69ded23930cfe1a522695bfb8955a5a/LICENSE.md";
-    };
-
     ngpl = {
       spdxId = "NGPL";
       fullName = "Nethack General Public License";

lib/modules.nix

@@ -1158,10 +1158,8 @@ let
       value = if opt ? apply then opt.apply res.mergedValue else res.mergedValue;
 
       warnDeprecation =
-        if (opt.type.deprecationMessage != null) then
-          warn "The type `types.${opt.type.name}' of option `${showOption loc}' defined in ${showFiles opt.declarations} is deprecated. ${opt.type.deprecationMessage}"
-        else
-          x: x;
+        warnIf (opt.type.deprecationMessage != null)
+          "The type `types.${opt.type.name}' of option `${showOption loc}' defined in ${showFiles opt.declarations} is deprecated. ${opt.type.deprecationMessage}";
 
     in
     warnDeprecation opt
@@ -1600,28 +1598,6 @@ let
     inherit priority content;
   };
 
-  /**
-    Applies a function to the value inside a definition,
-    preserving all surrounding properties (`mkForce`, `mkOrder`, `mkIf`, etc.).
-  */
-  mapDefinitionValue =
-    f: def:
-    if def ? _type then
-      if def._type == "merge" then
-        def // { contents = map (mapDefinitionValue f) def.contents; }
-      else if def._type == "if" then
-        def // { content = mapDefinitionValue f def.content; }
-      else if def._type == "override" then
-        def // { content = mapDefinitionValue f def.content; }
-      else if def._type == "order" then
-        def // { content = mapDefinitionValue f def.content; }
-      else if def._type == "definition" then
-        def // { value = mapDefinitionValue f def.value; }
-      else
-        f def
-    else
-      f def;
-
   mkBefore = mkOrder 500;
   defaultOrderPriority = 1000;
   mkAfter = mkOrder 1500;
@@ -2326,7 +2302,6 @@ private
     importApply
     importJSON
     importTOML
-    mapDefinitionValue
     mergeDefinitions
     mergeAttrDefinitionsWithPrio
     mergeOptionDecls # should be private?

lib/sources.nix

@@ -7,19 +7,12 @@ let
     match
     split
     storeDir
-    escapeRegex
-    removePrefix
     ;
   inherit (lib)
     boolToString
     filter
     isString
     readFile
-    concatStrings
-    length
-    elemAt
-    isList
-    any
     ;
   inherit (lib.filesystem)
     pathIsRegularFile
@@ -520,113 +513,6 @@ let
     else
       throw "repoRevToName: invalid kind";
 
-  /**
-    Filter a source tree by a list of doublestar-style glob patterns,
-    returning a source that only contains paths matching at least one
-    pattern. `*` matches a single path component, and `**` matches any
-    number of components.
-
-    # Inputs
-
-    `src`
-
-    : The source tree to filter.
-
-    `patterns`
-
-    : List of glob patterns to include, e.g. `[ "*.py" "src/**" ]`.
-      A leading `**` (e.g. `**\/*.py` for all `.py` files at any depth)
-      is also supported; the `\` here is just a Nix string escape used
-      to avoid closing this comment.
-
-    # Examples
-    :::{.example}
-    ## `sourceByGlobs` usage example
-
-    - Include everything under a subdirectory
-    ```nix
-    src = sourceByGlobs ./. [ "src/**" "tests/**" ]
-    ```
-
-    - Include all .py files in root directory only
-    ```nix
-    src = sourceByGlobs ./. [ "*.py" ]
-    ```
-
-    :::
-  */
-  sourceByGlobs =
-    let
-      splitPath = path: filter isString (split "/" path);
-      # Make component regex
-      mkRe =
-        s:
-        if s == "**" then
-          ".*" # Has special handling below
-        else
-          concatStrings (map (tok: if isList tok then "[^/]*" else escapeRegex tok) (split "\\*+" s));
-
-      # Make a source filter function from pattern
-      mkMatcher =
-        pat:
-        let
-          globs = map mkRe (splitPath pat);
-          glen = length globs;
-        in
-        path: type:
-        let
-          path' = splitPath path;
-          plen = length path';
-
-          recurse =
-            gi: pi:
-            let
-              g = elemAt globs gi;
-              p = elemAt path' pi;
-              m = match g p != null;
-            in
-            if pi >= plen then # Reached end of path
-              gi >= glen || (type == "directory" || type == "symlink") # Only allow partial matches for directories
-            else if gi >= glen then # Reached end of globs
-              false
-            else if g == ".*" then # Special handling for **
-              (
-                # Lookahead for next glob match
-                if (gi + 1) == glen then
-                  true
-                else if (match (elemAt globs (gi + 1)) p != null) then
-                  recurse (gi + 1) pi
-                else if m then
-                  recurse gi (pi + 1)
-                else
-                  false
-              )
-            else if m then
-              recurse (gi + 1) (pi + 1)
-            else
-              false;
-
-        in
-        recurse 0 0;
-
-      mkSourceFilter =
-        root: patterns:
-        let
-          root' = "${toString root}/";
-          matchers = map mkMatcher patterns;
-        in
-        name: type:
-        let
-          name' = removePrefix root' name;
-        in
-        any (m: m name' type) matchers;
-
-    in
-    src: patterns:
-    lib.cleanSourceWith {
-      filter = mkSourceFilter src patterns;
-      inherit src;
-    };
 in
 {
   inherit
@@ -646,7 +532,6 @@ in
 
     sourceByRegex
     sourceFilesBySuffices
-    sourceByGlobs
 
     trace
     ;

lib/tests/misc.nix

@@ -2164,6 +2164,21 @@ runTests {
     };
   };
 
+  testConcatMapAttrsDuplicates = {
+    expr =
+      concatMapAttrs
+        (name: value: {
+          final = value;
+        })
+        {
+          a = 1;
+          b = 2;
+        };
+    expected = {
+      final = 2;
+    };
+  };
+
   testFilterAttrs = {
     expr = filterAttrs (n: v: n != "a" && (v.hello or false) == true) {
       a.hello = true;
@@ -5114,96 +5129,4 @@ runTests {
     );
     expected = false;
   };
-
-  # mapDefinitionValue
-
-  testMapDefinitionValuePlain = {
-    expr = lib.modules.mapDefinitionValue (x: x + 1) 5;
-    expected = 6;
-  };
-
-  testMapDefinitionValueMkForce = {
-    expr = lib.modules.mapDefinitionValue (x: x + 1) (lib.mkForce 5);
-    expected = lib.mkForce 6;
-  };
-
-  testMapDefinitionValueMkDefault = {
-    expr = lib.modules.mapDefinitionValue (x: x + 1) (lib.mkDefault 5);
-    expected = lib.mkDefault 6;
-  };
-
-  testMapDefinitionValueMkOrder = {
-    expr = lib.modules.mapDefinitionValue (x: x + 1) (lib.mkOrder 500 5);
-    expected = lib.mkOrder 500 6;
-  };
-
-  testMapDefinitionValueMkOverrideNested = {
-    expr = lib.modules.mapDefinitionValue (x: x + 1) (lib.mkForce (lib.mkOrder 500 5));
-    expected = lib.mkForce (lib.mkOrder 500 6);
-  };
-
-  testMapDefinitionValueMkIf = {
-    expr = lib.modules.mapDefinitionValue (x: x + 1) (lib.mkIf true 5);
-    expected = lib.mkIf true 6;
-  };
-
-  testMapDefinitionValueMkMerge = {
-    expr = lib.modules.mapDefinitionValue (x: x + 1) (
-      lib.mkMerge [
-        5
-        10
-      ]
-    );
-    expected = lib.mkMerge [
-      6
-      11
-    ];
-  };
-
-  testMapDefinitionValueMkDefinition = {
-    expr = lib.modules.mapDefinitionValue (x: x + 1) (
-      lib.mkDefinition {
-        file = "test";
-        value = 5;
-      }
-    );
-    expected = lib.mkDefinition {
-      file = "test";
-      value = 6;
-    };
-  };
-
-  testMapDefinitionValueDeep = {
-    expr = lib.modules.mapDefinitionValue (x: x + 1) (lib.mkIf true (lib.mkForce (lib.mkOrder 500 5)));
-    expected = lib.mkIf true (lib.mkForce (lib.mkOrder 500 6));
-  };
-
-  testMapDefinitionValueAllNested = {
-    expr = lib.modules.mapDefinitionValue (x: x + 1) (
-      lib.mkMerge [
-        (lib.mkIf true (
-          lib.mkForce (
-            lib.mkOrder 500 (
-              lib.mkDefinition {
-                file = "test";
-                value = lib.mkBefore 5;
-              }
-            )
-          )
-        ))
-      ]
-    );
-    expected = lib.mkMerge [
-      (lib.mkIf true (
-        lib.mkForce (
-          lib.mkOrder 500 (
-            lib.mkDefinition {
-              file = "test";
-              value = lib.mkBefore 6;
-            }
-          )
-        )
-      ))
-    ];
-  };
 }

lib/tests/modules.sh

@@ -899,19 +899,6 @@ checkConfigError 'Did you mean .enable., .ebe. or .enabled.\?' config ./error-ty
 checkConfigError 'Did you mean .services\.myservice\.port. or .services\.myservice\.enable.\?' config.services.myservice ./error-typo-submodule.nix
 checkConfigError 'Did you mean .services\.nginx\.virtualHosts\."example\.com"\.ssl\.certificate. or .services\.nginx\.virtualHosts\."example\.com"\.ssl\.certificateKey.\?' config.services.nginx.virtualHosts.\"example.com\" ./error-typo-deeply-nested.nix
 
-# types.attrListOf
-checkConfigOutput '"ok"' config.assertions ./declare-attrList.nix
-checkConfigError 'A definition for option .attrListInt.badValue.a. is not of type .signed integer.. Definition values:' config.attrListIntStrict.badValue ./declare-attrList.nix
-checkConfigError 'A definition for option .attrList.badListElem. is not of type .attribute list of string.. Each list element must be a single-key attribute set, but got 2 keys' config.attrListStrict.badListElem ./declare-attrList.nix
-checkConfigError 'A definition for option .attrList.badString. is not of type .attribute list of string.. TypeError: Definition values:' config.attrListStrict.badString ./declare-attrList.nix
-checkConfigError 'A definition for option .attrList.badListString. is not of type .attribute list of string.. Each list element must be an attribute set, but got string' config.attrListStrict.badListString ./declare-attrList.nix
-
-# attrListWith valueMeta.definitions: file propagation
-checkConfigError 'the-defs-file\.nix' config.argv ./attrList-valueMeta-definitions-file-diagnostic-forwarding.nix
-
-# attrListOf does not support type merging
-checkConfigError 'The option .merged. in .*/declare-attrList-type-merge.nix. is already declared in .*/declare-attrList-type-merge.nix' config.merged ./declare-attrList-type-merge.nix
-
 cat <<EOF
 ====== module tests ======
 $pass Pass

lib/tests/modules/attrList-valueMeta-definitions-file-diagnostic-forwarding.nix

@@ -1,25 +0,0 @@
-{ lib, options, ... }:
-let
-  inherit (lib) mkOption mkMerge types;
-in
-{
-  imports = [
-    {
-      _file = "the-defs-file.nix";
-      config.flags.my-flag = 3.14;
-    }
-  ];
-
-  options.flags = mkOption {
-    type = types.attrListWith {
-      elemType = types.anything;
-      asAttrs = true;
-      mergeAttrValues = _name: vs: lib.head vs;
-    };
-  };
-  options.argv = mkOption { type = types.listOf types.str; };
-
-  # Feed definitions into argv; the float from the-defs-file.nix should cause
-  # a type error mentioning that file
-  config.argv = mkMerge options.flags.valueMeta.definitions;
-}

lib/tests/modules/declare-attrList-type-merge.nix

@@ -1,12 +0,0 @@
-# Test that attrListOf does not support type merging:
-# two declarations of the same option should fail.
-{ lib, ... }:
-let
-  inherit (lib) mkOption types;
-in
-{
-  imports = [
-    { options.merged = mkOption { type = types.attrListOf types.str; }; }
-    { options.merged = mkOption { type = types.attrListOf types.str; }; }
-  ];
-}

lib/tests/modules/declare-attrList.nix

@@ -1,925 +0,0 @@
-# Run with:
-#   cd nixpkgs
-#   ./lib/tests/modules.sh
-{ lib, config, ... }:
-let
-  inherit (lib)
-    mkOption
-    mkOrder
-    mkMerge
-    mkBefore
-    mkAfter
-    mkIf
-    mkOverride
-    mkDefault
-    mkForce
-    types
-    ;
-in
-{
-  options = {
-    attrList = mkOption {
-      type = types.lazyAttrsOf (types.attrListOf types.str);
-    };
-
-    attrListInt = mkOption {
-      type = types.lazyAttrsOf (types.attrListOf types.int);
-    };
-
-    attrListSubmodule = mkOption {
-      type = types.attrListOf (
-        types.submodule {
-          options.port = mkOption {
-            type = types.int;
-            description = "Port number";
-          };
-          options.host = mkOption {
-            type = types.str;
-            default = "localhost";
-            description = "Hostname";
-          };
-        }
-      );
-    };
-
-    # asAttrs: value is a merged attrset, ordered list in valueMeta
-    asAttrs = mkOption {
-      type = types.lazyAttrsOf (
-        types.attrListWith {
-          elemType = types.str;
-          asAttrs = true;
-          mergeAttrValues = _name: values: lib.last values;
-        }
-      );
-    };
-
-    # asAttrs with default mergeAttrValues: duplicates collected into lists
-    asAttrsDefault = mkOption {
-      type = types.lazyAttrsOf (
-        types.attrListWith {
-          elemType = types.int;
-          asAttrs = true;
-        }
-      );
-    };
-
-    # Strict wrappers that force deep evaluation, for testing error cases
-    attrListStrict = mkOption {
-      type = types.lazyAttrsOf types.raw;
-    };
-
-    attrListIntStrict = mkOption {
-      type = types.lazyAttrsOf types.raw;
-    };
-
-    # either picks attrList when input is list/attrset, int when input is int
-    eitherAttrListOrInt = mkOption {
-      type = types.either (types.attrListOf types.str) types.int;
-    };
-
-    eitherAttrListOrIntFallback = mkOption {
-      type = types.either (types.attrListOf types.str) types.int;
-    };
-
-    eitherIntOrAttrList = mkOption {
-      type = types.either types.int (types.attrListOf types.str);
-    };
-
-    eitherIntOrAttrListFallback = mkOption {
-      type = types.either types.int (types.attrListOf types.str);
-    };
-
-    assertions = mkOption { };
-  };
-
-  imports = [
-    # Second module contributing to multiModule
-    {
-      attrListInt.multiModule = [
-        { b = 2; }
-      ];
-    }
-  ];
-
-  config = {
-
-    # List input: pass-through
-    attrList.listInput = [
-      { a = "alpha"; }
-      { b = "beta"; }
-    ];
-
-    # Attrset input with explicit ordering
-    attrList.attrsetOrdered = {
-      x = mkOrder 200 "x-val";
-      y = mkOrder 100 "y-val";
-    };
-
-    # Mixed: list elements at default priority, attrset with mkOrder
-    attrList.mixed = mkMerge [
-      [
-        { m = "from-list"; }
-      ]
-      {
-        n = mkOrder 50 "from-attrset";
-      }
-    ];
-
-    # Multiple list definitions from separate modules
-    attrListInt.multiModule = [
-      { a = 1; }
-    ];
-
-    # Attrset without mkOrder uses default priority
-    attrList.attrsetNoOrder = {
-      foo = "bar";
-      baz = "qux";
-    };
-
-    # Empty list
-    attrList.empty = [ ];
-
-    # Ordering test: lower priority first
-    attrList.ordering = mkMerge [
-      {
-        last = mkOrder 1500 "last";
-      }
-      {
-        first = mkOrder 500 "first";
-      }
-      [
-        { middle = "middle"; }
-      ]
-    ];
-
-    # List elements support mkOrder/mkBefore/mkAfter
-    attrList.listOrdering = [
-      (mkAfter { z = "after"; })
-      { m = "default"; }
-      (mkBefore { a = "before"; })
-    ];
-
-    # Plain list entries land at default priority (1000):
-    # they appear after mkOrder 999 and before mkOrder 1001.
-    attrList.listDefaultPrio = mkMerge [
-      { after = mkOrder 1001 "after"; }
-      [
-        { mid = "list-entry"; }
-      ]
-      { before = mkOrder 999 "before"; }
-    ];
-
-    # mkBefore and mkAfter
-    attrList.beforeAfter = mkMerge [
-      {
-        z = mkAfter "after";
-      }
-      {
-        a = mkBefore "before";
-      }
-      [
-        { m = "default"; }
-      ]
-    ];
-
-    # mkIf: conditional definition
-    attrList.withMkIf = mkMerge [
-      (mkIf true [
-        { yes = "included"; }
-      ])
-      (mkIf false [
-        { no = "excluded"; }
-      ])
-    ];
-
-    # mkOverride: higher priority override wins
-    attrList.withOverride = mkMerge [
-      (mkOverride 100 [
-        { replaced = "gone"; }
-      ])
-      (mkOverride 50 [
-        { winner = "wins"; }
-      ])
-    ];
-
-    # mkDefault: lower priority than normal
-    attrList.withDefault = mkMerge [
-      (mkDefault [
-        { default = "overridden"; }
-      ])
-      [
-        { normal = "wins"; }
-      ]
-    ];
-
-    # mkForce on the whole option (should discard other defs)
-    attrList.withForce = mkMerge [
-      [
-        { discarded = "gone"; }
-      ]
-      (mkForce [
-        { forced = "wins"; }
-      ])
-    ];
-
-    # mkForce with mkOrder inside
-    attrList.forceWithOrder = mkForce [
-      (mkAfter { second = "after"; })
-      (mkBefore { first = "before"; })
-    ];
-
-    # mkForce on individual element values; non-forced entries are discarded.
-    # Discarded values use a mix of: plain value, mkDefault(abort ...), mkOverride 100 (abort ...).
-    # The abort variants verify laziness: peelProperties sees the wrapper without forcing the content.
-    attrListInt.forceElementValue = [
-      { a = mkDefault (abort "overridden by mkForce; laziness guarantee: MUST NOT be evaluated"); }
-      { a = mkForce 42; }
-      { a = mkOverride 100 (abort "overridden by mkForce; laziness guarantee: MUST NOT be evaluated"); }
-      { b = 2; }
-    ];
-
-    # mkForce on attrset format
-    attrList.forceAttrset = mkMerge [
-      [
-        { discarded = "gone"; }
-      ]
-      (mkForce {
-        x = mkOrder 200 "x-val";
-        y = mkOrder 100 "y-val";
-      })
-    ];
-
-    # mkForce on repeated key: forced entries override non-forced
-    attrList.forceRepeatedKey = [
-      { x = mkOverride 100 (abort "overridden by mkForce; laziness guarantee: MUST NOT be evaluated"); }
-      { x = mkForce "wins"; }
-      { x = mkForce "wins 2"; }
-    ];
-
-    # mkForce on repeated key across mkMerge
-    attrList.forceRepeatedKeyMerge = mkMerge [
-      [
-        { x = "unused: overridden by mkForce"; }
-        { x = mkDefault (abort "overridden by mkForce; laziness guarantee: MUST NOT be evaluated"); }
-      ]
-      [
-        { x = mkOverride 100 (abort "overridden by mkForce; laziness guarantee: MUST NOT be evaluated"); }
-      ]
-      [
-        { x = mkForce "forced"; }
-      ]
-    ];
-
-    # mkForce on repeated key in attrset format across mkMerge
-    attrList.forceRepeatedKeyAttrs = mkMerge [
-      {
-        x = mkDefault (abort "overridden by mkForce; laziness guarantee: MUST NOT be evaluated");
-        y = "kept";
-      }
-      { x = mkForce "forced"; }
-    ];
-
-    # mkForce only affects the key it's on, other keys survive
-    attrList.forcePartialAttrs = mkMerge [
-      {
-        x = "unused: overridden by mkForce";
-        y = "normal y";
-      }
-      { x = mkForce "forced x"; }
-    ];
-
-    # mkForce in attrset format overrides same key from list format
-    attrList.forceMixedFormats = mkMerge [
-      [
-        { x = mkOverride 100 (abort "overridden by mkForce; laziness guarantee: MUST NOT be evaluated"); }
-        { y = "list y"; }
-      ]
-      { x = mkForce "attrset forced x"; }
-    ];
-
-    # Nesting: list format, mkOrder on element + mkForce on value
-    attrList.nestListOrderForce = mkMerge [
-      [
-        { x = mkDefault (abort "overridden by mkForce; laziness guarantee: MUST NOT be evaluated"); }
-        (mkOrder 500 { x = mkForce "forced-early"; })
-        (mkOrder 1500 { y = "late"; })
-      ]
-      [
-        (mkOrder 100 { z = "earliest"; })
-      ]
-    ];
-
-    # Nesting: list format, mkOrder(mkForce(val)) on value
-    attrList.nestListOrderOfForce = mkMerge [
-      [
-        { x = mkOverride 100 (abort "overridden by mkForce; laziness guarantee: MUST NOT be evaluated"); }
-        { y = "plain-early"; }
-      ]
-      [
-        { x = mkOrder 1500 (mkForce "forced-late"); }
-        { z = mkOrder 500 "earliest"; }
-      ]
-      [
-        { x = "unused: overridden by mkForce"; }
-        { w = mkOrder 1200 "mid"; }
-      ]
-    ];
-
-    # Nesting: list format, mkForce(mkOrder(val)) on value
-    attrList.nestListForceOfOrder = mkMerge [
-      [
-        { x = "unused: overridden by mkForce"; }
-        { y = "plain-early"; }
-      ]
-      [
-        { x = mkForce (mkOrder 1500 "forced-late"); }
-        { z = mkOrder 500 "earliest"; }
-      ]
-      [
-        { x = mkDefault (abort "overridden by mkForce; laziness guarantee: MUST NOT be evaluated"); }
-        { w = mkOrder 1200 "mid"; }
-      ]
-    ];
-
-    # Nesting: attrset format, mkOrder wrapping mkForce
-    attrList.nestAttrsOrderOfForce = mkMerge [
-      {
-        x = mkOverride 100 (abort "overridden by mkForce; laziness guarantee: MUST NOT be evaluated");
-        y = "plain-early";
-      }
-      {
-        x = mkOrder 1500 (mkForce "forced-late");
-        z = mkOrder 500 "earliest";
-      }
-      {
-        x = "unused: overridden by mkForce";
-        w = mkOrder 1200 "mid";
-      }
-    ];
-
-    # Nesting: attrset format, mkForce wrapping mkOrder
-    attrList.nestAttrsForceOfOrder = mkMerge [
-      {
-        x = "unused: overridden by mkForce";
-        y = "plain-early";
-      }
-      {
-        x = mkForce (mkOrder 1500 "forced-late");
-        z = mkOrder 500 "earliest";
-      }
-      {
-        x = mkDefault (abort "overridden by mkForce; laziness guarantee: MUST NOT be evaluated");
-        w = mkOrder 1200 "mid";
-      }
-    ];
-
-    # mkIf false on individual element value filters it out (list format)
-    attrListInt.optionalValueList = [
-      { a = mkIf true 1; }
-      { b = mkIf false 2; }
-      { c = 3; }
-    ];
-
-    # mkIf false on individual element value filters it out (attrset format)
-    attrListInt.optionalValueAttrs = {
-      a = mkIf true 1;
-      b = mkIf false 2;
-      c = 3;
-    };
-
-    # submodule elemType: produces real valueMeta
-    attrListSubmodule = [
-      {
-        web = {
-          port = 80;
-        };
-      }
-      {
-        db = {
-          port = 5432;
-          host = "dbhost";
-        };
-      }
-    ];
-
-    # asAttrs: unique keys — value is a plain attrset
-    asAttrs.unique = [
-      { a = "alpha"; }
-      { b = "beta"; }
-    ];
-
-    # asAttrs: duplicate keys — last in order wins
-    asAttrs.duplicateKeys = mkMerge [
-      { x = mkOrder 500 "first"; }
-      { x = mkOrder 1500 "last"; }
-      { y = "only"; }
-    ];
-
-    # asAttrs: with ordering — value is attrset, ordered list in valueMeta
-    asAttrs.ordered = {
-      z = mkOrder 200 "z-val";
-      a = mkOrder 100 "a-val";
-    };
-
-    # asAttrs: with mkForce — forced key overrides
-    asAttrs.withForce = mkMerge [
-      { x = "unused: overridden by mkForce"; }
-      {
-        x = mkForce "forced";
-        y = "kept";
-      }
-    ];
-
-    # asAttrs: empty
-    asAttrs.empty = [ ];
-
-    # asAttrsDefault: unique keys
-    asAttrsDefault.unique = [
-      { a = 1; }
-      { b = 2; }
-    ];
-
-    # asAttrsDefault: duplicate keys — default collects into lists
-    asAttrsDefault.duplicates = mkMerge [
-      { x = mkOrder 500 10; }
-      { x = mkOrder 1500 30; }
-      { y = 99; }
-      [
-        { x = 20; }
-      ]
-    ];
-
-    # either: attrList branch matches for list input
-    eitherAttrListOrInt = [
-      { a = "hello"; }
-      { b = "world"; }
-    ];
-
-    # either: int input falls through to int branch
-    eitherAttrListOrIntFallback = 42;
-
-    # either (swapped): int first, attrList second — int input matches int
-    eitherIntOrAttrList = 42;
-
-    # either (swapped): list input falls through to attrList branch
-    eitherIntOrAttrListFallback = [
-      { a = "hello"; }
-    ];
-
-    # Bad: string where int expected
-    attrListInt.badValue = [
-      { a = "not-an-int"; }
-    ];
-
-    # Bad: list element with multiple keys
-    attrList.badListElem = [
-      {
-        a = "ok";
-        b = "extra";
-      }
-    ];
-
-    # Bad: plain string instead of list or attrset
-    attrList.badString = "not-a-container";
-
-    # Bad: list element is a bare string, not a singleton attrset
-    attrList.badListString = [
-      "not a singleton attribute"
-    ];
-
-    attrListStrict = builtins.mapAttrs (k: v: builtins.deepSeq v v) config.attrList;
-    attrListIntStrict = builtins.mapAttrs (k: v: builtins.deepSeq v v) config.attrListInt;
-
-    assertions =
-      let
-        c = lib.evalModules {
-          modules = [ ./declare-attrList.nix ];
-        };
-        cfg = c.config;
-      in
-
-      # List input preserves elements
-      assert
-        cfg.attrList.listInput == [
-          { a = "alpha"; }
-          { b = "beta"; }
-        ];
-
-      # Attrset input with mkOrder: lower priority comes first
-      assert
-        cfg.attrList.attrsetOrdered == [
-          { y = "y-val"; }
-          { x = "x-val"; }
-        ];
-
-      # Mixed input: mkOrder 50 < default 1000
-      assert
-        cfg.attrList.mixed == [
-          { n = "from-attrset"; }
-          { m = "from-list"; }
-        ];
-
-      # Multiple definitions from separate modules concatenate
-      # (import module's definition comes before this module's)
-      assert
-        cfg.attrListInt.multiModule == [
-          { b = 2; }
-          { a = 1; }
-        ];
-
-      # Attrset without mkOrder: all at default priority
-      assert builtins.length cfg.attrList.attrsetNoOrder == 2;
-
-      # Empty list stays empty
-      assert cfg.attrList.empty == [ ];
-
-      # List elements support mkOrder/mkBefore/mkAfter
-      assert
-        cfg.attrList.listOrdering == [
-          { a = "before"; }
-          { m = "default"; }
-          { z = "after"; }
-        ];
-
-      # Plain list entries are at default priority (1000)
-      assert
-        cfg.attrList.listDefaultPrio == [
-          { before = "before"; }
-          { mid = "list-entry"; }
-          { after = "after"; }
-        ];
-
-      # Ordering: 500 < 1000 (default) < 1500
-      assert
-        cfg.attrList.ordering == [
-          { first = "first"; }
-          { middle = "middle"; }
-          { last = "last"; }
-        ];
-
-      # mkBefore (500) < default (1000) < mkAfter (1500)
-      assert
-        cfg.attrList.beforeAfter == [
-          { a = "before"; }
-          { m = "default"; }
-          { z = "after"; }
-        ];
-
-      # mkIf true includes, mkIf false excludes
-      assert
-        cfg.attrList.withMkIf == [
-          { yes = "included"; }
-        ];
-
-      # mkOverride: only lowest priority override survives
-      assert
-        cfg.attrList.withOverride == [
-          { winner = "wins"; }
-        ];
-
-      # mkDefault is overridden by normal definitions
-      assert
-        cfg.attrList.withDefault == [
-          { normal = "wins"; }
-        ];
-
-      # mkForce discards other definitions
-      assert
-        cfg.attrList.withForce == [
-          { forced = "wins"; }
-        ];
-
-      # mkForce with mkOrder inside: ordering still works
-      assert
-        cfg.attrList.forceWithOrder == [
-          { first = "before"; }
-          { second = "after"; }
-        ];
-
-      # mkForce on individual element values passes through
-      assert
-        cfg.attrListInt.forceElementValue == [
-          { a = 42; }
-          { b = 2; }
-        ];
-
-      # mkForce on attrset format: discards other defs, ordering preserved
-      assert
-        cfg.attrList.forceAttrset == [
-          { y = "y-val"; }
-          { x = "x-val"; }
-        ];
-
-      # mkForce on repeated key: forced entries override non-forced
-      assert
-        cfg.attrList.forceRepeatedKey == [
-          { x = "wins"; }
-          { x = "wins 2"; }
-        ];
-
-      # mkForce on repeated key across mkMerge: forced wins
-      assert
-        cfg.attrList.forceRepeatedKeyMerge == [
-          { x = "forced"; }
-        ];
-
-      # mkForce on repeated key in attrset format: discards other x, keeps y
-      assert
-        cfg.attrList.forceRepeatedKeyAttrs == [
-          { y = "kept"; }
-          { x = "forced"; }
-        ];
-
-      # mkForce only affects its own key
-      assert
-        cfg.attrList.forcePartialAttrs == [
-          { y = "normal y"; }
-          { x = "forced x"; }
-        ];
-
-      # mkForce in attrset format overrides same key from list format
-      assert
-        cfg.attrList.forceMixedFormats == [
-          { y = "list y"; }
-          { x = "attrset forced x"; }
-        ];
-
-      # Nesting: list format, mkOrder on element + mkForce on value
-      # z(100) < x-forced(500) < y(1500); x-discarded filtered by mkForce
-      assert
-        cfg.attrList.nestListOrderForce == [
-          { z = "earliest"; }
-          { x = "forced-early"; }
-          { y = "late"; }
-        ];
-
-      # Nesting: list format, mkOrder(mkForce(val)) on value
-      # z(500) < y(1000) < w(1200) < x-forced(1500); x-discarded entries filtered
-      assert
-        cfg.attrList.nestListOrderOfForce == [
-          { z = "earliest"; }
-          { y = "plain-early"; }
-          { w = "mid"; }
-          { x = "forced-late"; }
-        ];
-
-      # Nesting: list format, mkForce(mkOrder(val)) on value
-      # z(500) < y(1000) < w(1200) < x-forced(1500); x-discarded entries filtered
-      assert
-        cfg.attrList.nestListForceOfOrder == [
-          { z = "earliest"; }
-          { y = "plain-early"; }
-          { w = "mid"; }
-          { x = "forced-late"; }
-        ];
-
-      # Nesting: attrset format, mkOrder(mkForce(val))
-      # z(500) < y(1000) < w(1200) < x-forced(1500); x-discarded entries filtered
-      assert
-        cfg.attrList.nestAttrsOrderOfForce == [
-          { z = "earliest"; }
-          { y = "plain-early"; }
-          { w = "mid"; }
-          { x = "forced-late"; }
-        ];
-
-      # Nesting: attrset format, mkForce(mkOrder(val))
-      # z(500) < y(1000) < w(1200) < x-forced(1500); x-discarded entries filtered
-      assert
-        cfg.attrList.nestAttrsForceOfOrder == [
-          { z = "earliest"; }
-          { y = "plain-early"; }
-          { w = "mid"; }
-          { x = "forced-late"; }
-        ];
-
-      # mkIf false on individual element value filters it out (list format)
-      assert
-        cfg.attrListInt.optionalValueList == [
-          { a = 1; }
-          { c = 3; }
-        ];
-
-      # mkIf false on individual element value filters it out (attrset format)
-      assert
-        cfg.attrListInt.optionalValueAttrs == [
-          { a = 1; }
-          { c = 3; }
-        ];
-
-      # submodule: value, option descriptions, and valueMeta with real configuration metadata
-      assert
-        cfg.attrListSubmodule == [
-          {
-            web = {
-              host = "localhost";
-              port = 80;
-            };
-          }
-          {
-            db = {
-              host = "dbhost";
-              port = 5432;
-            };
-          }
-        ];
-      assert
-        builtins.map (m: m.configuration.config) c.options.attrListSubmodule.valueMeta.attrList == [
-          {
-            host = "localhost";
-            port = 80;
-          }
-          {
-            host = "dbhost";
-            port = 5432;
-          }
-        ];
-      assert
-        builtins.map (
-          m:
-          builtins.mapAttrs (n: o: o.description) (builtins.removeAttrs m.configuration.options [ "_module" ])
-        ) c.options.attrListSubmodule.valueMeta.attrList == [
-          {
-            host = "Hostname";
-            port = "Port number";
-          }
-          {
-            host = "Hostname";
-            port = "Port number";
-          }
-        ];
-
-      # valueMeta.attrList has one entry per (non-filtered) element
-      assert
-        c.options.attrList.valueMeta.attrs.listInput.attrList == [
-          { }
-          { }
-        ];
-      assert
-        c.options.attrList.valueMeta.attrs.attrsetOrdered.attrList == [
-          { }
-          { }
-        ];
-      assert
-        c.options.attrList.valueMeta.attrs.mixed.attrList == [
-          { }
-          { }
-        ];
-      assert c.options.attrList.valueMeta.attrs.empty.attrList == [ ];
-      assert
-        c.options.attrListInt.valueMeta.attrs.optionalValueList.attrList == [
-          { }
-          { }
-        ];
-
-      # either: headError is null for valid attrList input, so attrList branch is picked
-      assert
-        cfg.eitherAttrListOrInt == [
-          { a = "hello"; }
-          { b = "world"; }
-        ];
-
-      # either: headError is non-null for int input, so int branch is picked
-      assert cfg.eitherAttrListOrIntFallback == 42;
-
-      # either (swapped): int first — int input matches
-      assert cfg.eitherIntOrAttrList == 42;
-
-      # either (swapped): list input falls through to attrList branch
-      assert
-        cfg.eitherIntOrAttrListFallback == [
-          { a = "hello"; }
-        ];
-
-      # asAttrs: unique keys — value is a plain attrset
-      assert
-        cfg.asAttrs.unique == {
-          a = "alpha";
-          b = "beta";
-        };
-      # ordered list preserved in valueMeta
-      assert
-        c.options.asAttrs.valueMeta.attrs.unique.attrListValue == [
-          { a = "alpha"; }
-          { b = "beta"; }
-        ];
-
-      # asAttrs: duplicate keys — last in order wins
-      assert
-        cfg.asAttrs.duplicateKeys == {
-          x = "last";
-          y = "only";
-        };
-      assert
-        c.options.asAttrs.valueMeta.attrs.duplicateKeys.attrListValue == [
-          { x = "first"; }
-          { y = "only"; }
-          { x = "last"; }
-        ];
-
-      # asAttrs: ordered — value is attrset (unordered), list in valueMeta preserves order
-      assert
-        cfg.asAttrs.ordered == {
-          a = "a-val";
-          z = "z-val";
-        };
-      assert
-        c.options.asAttrs.valueMeta.attrs.ordered.attrListValue == [
-          { a = "a-val"; }
-          { z = "z-val"; }
-        ];
-
-      # asAttrs: mkForce — forced key overrides, value is attrset
-      assert
-        cfg.asAttrs.withForce == {
-          x = "forced";
-          y = "kept";
-        };
-
-      # asAttrs: empty — value is empty attrset
-      assert cfg.asAttrs.empty == { };
-
-      # asAttrsDefault: unique keys — each value wrapped in singleton list
-      assert
-        cfg.asAttrsDefault.unique == {
-          a = [ 1 ];
-          b = [ 2 ];
-        };
-
-      # asAttrsDefault: duplicate keys — values collected into list in order
-      assert
-        cfg.asAttrsDefault.duplicates == {
-          x = [
-            10
-            20
-            30
-          ];
-          y = [ 99 ];
-        };
-      assert
-        c.options.asAttrsDefault.valueMeta.attrs.duplicates.attrListValue == [
-          { x = 10; }
-          { y = 99; }
-          { x = 20; }
-          { x = 30; }
-        ];
-
-      # valueMeta.definitions: mkDefinition records with mkOrder-wrapped single-key attrsets
-      # Use duplicateKeys which has mixed priorities and repeated keys
-      assert
-        let
-          defs = c.options.asAttrs.valueMeta.attrs.duplicateKeys.definitions;
-          extract = d: {
-            prio = d.value.priority;
-            value = d.value.content;
-          };
-        in
-        map extract defs == [
-          {
-            prio = 500;
-            value = {
-              x = "first";
-            };
-          }
-          {
-            prio = 1000;
-            value = {
-              y = "only";
-            };
-          }
-          {
-            prio = 1500;
-            value = {
-              x = "last";
-            };
-          }
-        ];
-
-      # Round-trip: feed definitions through mapDefinitionValue + mkMerge into a listOf option
-      assert
-        let
-          rendered = lib.modules.mapDefinitionValue (attr: lib.cli.toCommandLineGNU { } attr) (
-            mkMerge c.options.asAttrs.valueMeta.attrs.duplicateKeys.definitions
-          );
-          result =
-            (lib.evalModules {
-              modules = [
-                { options.out = mkOption { type = types.listOf types.str; }; }
-                { config.out = rendered; }
-                # Interleave: mkOrder 800 lands between x(500) and y(1000)
-                { config.out = mkOrder 800 [ "--interleaved" ]; }
-              ];
-            }).config.out;
-        in
-        result == [
-          "-xfirst"
-          "--interleaved"
-          "-yonly"
-          "-xlast"
-        ];
-
-      # Error cases are tested via checkConfigError in modules.sh
-
-      "ok";
-  };
-}

lib/tests/modules/types.nix

@@ -167,28 +167,6 @@ in
           elemType = str;
           lazy = false;
         }).description == "attribute set of string";
-      assert (attrListOf str).description == "attribute list of string";
-      assert (attrListOf int).description == "attribute list of signed integer";
-      assert (attrListOf bool).description == "attribute list of boolean";
-      assert (attrListOf (either int str)).description == "attribute list of (signed integer or string)";
-      assert (attrListOf (nullOr str)).description == "attribute list of (null or string)";
-      assert (attrListOf (listOf str)).description == "attribute list of list of string";
-      assert
-        (attrListOf (attrsOf int)).description == "attribute list of attribute set of signed integer";
-      assert (attrListOf (attrListOf str)).description == "attribute list of attribute list of string";
-      assert (attrListOf ints.positive).description == "attribute list of (positive integer, meaning >0)";
-      assert
-        (attrListOf (enum [
-          "a"
-          "b"
-        ])).description == "attribute list of (one of \"a\", \"b\")";
-      assert
-        (attrListOf (strMatching "[0-9]+")).description
-        == "attribute list of string matching the pattern [0-9]+";
-      assert
-        (attrListOf (nonEmptyListOf str)).description == "attribute list of non-empty (list of string)";
-      assert (attrListOf (submodule { })).description == "attribute list of (submodule)";
-
       assert (coercedTo str abort int).description == "signed integer or string convertible to it";
       assert (coercedTo int abort str).description == "string or signed integer convertible to it";
       assert (coercedTo bool abort str).description == "string or boolean convertible to it";

lib/tests/sources.sh

@@ -70,16 +70,4 @@ dir="$(nix-instantiate --eval --strict --read-write-mode --json --expr '(with im
 EOF
 ) || die "cleanSourceWith + cleanSource"
 
-
-dir="$(nix-instantiate --eval --strict --read-write-mode --json --expr '(with import <nixpkgs/lib>; "${
-  sources.sourceByGlobs '"$work"' [ "*.md" "**/*.o" ]
-}")' | crudeUnquoteJSON)"
-(cd "$dir"; find) | sort -f | diff -U10 - <(cat <<EOF
-.
-./module.o
-./README.md
-EOF
-) || die "sourceByGlobs 1"
-
-
 echo >&2 tests ok

lib/trivial.nix

@@ -504,7 +504,7 @@ in
     On each release the first letter is bumped and a new animal is chosen
     starting with that new letter.
   */
-  codeName = "Zokor";
+  codeName = "Yarara";
 
   /**
     Returns the current nixpkgs version suffix as string.

lib/types.nix

@@ -20,7 +20,6 @@ let
     isStorePath
     isString
     substring
-    sort
     throwIf
     toDerivation
     toList
@@ -28,7 +27,6 @@ let
     ;
   inherit (lib.lists)
     concatLists
-    concatMap
     elemAt
     filter
     foldl'
@@ -72,11 +70,6 @@ let
     mergeDefinitions
     fixupOptionType
     mergeOptionDecls
-    defaultOrderPriority
-    defaultOverridePriority
-    mkDefinition
-    mkOrder
-    mkOverride
     ;
   inherit (lib.fileset)
     isFileset
@@ -812,179 +805,6 @@ rec {
       substSubModules = m: nonEmptyListOf (elemType.substSubModules m);
     };
 
-  attrListOf = elemType: attrListWith { inherit elemType; };
-
-  attrListWith =
-    {
-      elemType,
-      asAttrs ? false,
-      mergeAttrValues ? _name: values: values,
-    }:
-    mkOptionType rec {
-      name = "attrListOf";
-      description = "attribute list of ${
-        optionDescriptionPhrase (class: class == "noun" || class == "composite") elemType
-      }";
-      descriptionClass = "composite";
-      check = {
-        __functor = _self: x: isList x || isAttrs x;
-        isV2MergeCoherent = true;
-      };
-      merge = {
-        __functor =
-          self: loc: defs:
-          (self.v2 { inherit loc defs; }).value;
-        v2 =
-          { loc, defs }:
-          let
-            # Peel order and override properties from a value in any nesting order.
-            # Returns { value, prio, overridePrio }.
-            # mkOrder is stripped (we consume it for sorting).
-            # mkOverride is preserved in value (mergeDefinitions strips it).
-            peelProperties =
-              value:
-              let
-                type = value._type or null;
-              in
-              if type == "order" then
-                let
-                  inner = peelProperties value.content;
-                in
-                {
-                  inherit (inner) value overridePrio;
-                  prio = value.priority;
-                }
-              else if type == "override" then
-                let
-                  inner = peelProperties value.content;
-                in
-                {
-                  inherit (inner) prio;
-                  overridePrio = value.priority;
-                  # Re-wrap mkOverride around the inner value (with mkOrder stripped)
-                  value = mkOverride value.priority inner.value;
-                }
-              else
-                {
-                  inherit value;
-                  prio = defaultOrderPriority;
-                  overridePrio = defaultOverridePriority;
-                };
-
-            # Extract { file, key, value, prio, overridePrio } from a single-key attrset,
-            # optionally wrapped in mkOrder at the element level (list format).
-            extractItem =
-              file: raw:
-              let
-                hasOrder = isType "order" raw;
-                item = if hasOrder then raw.content else raw;
-                key = head (attrNames item);
-                peeled = peelProperties item.${key};
-              in
-              if isAttrs item && length (attrNames item) == 1 then
-                peeled
-                // {
-                  inherit file key;
-                  prio = if hasOrder then raw.priority else peeled.prio;
-                }
-              else
-                throw "A definition for option `${showOption loc}' is not of type `${description}'. ${
-                  if !isAttrs item then
-                    "Each list element must be an attribute set, but got ${builtins.typeOf item}"
-                  else
-                    "Each list element must be a single-key attribute set, but got ${toString (length (attrNames item))} keys"
-                }.${
-                  showDefs [
-                    {
-                      inherit file;
-                      value = raw;
-                    }
-                  ]
-                }";
-
-            # Convert a definition to a flat list of { file, key, value, prio, overridePrio }
-            defToItems =
-              def:
-              if isList def.value then
-                map (extractItem def.file) def.value
-              else
-                # isAttrs: properties are on the values directly
-                map (
-                  key:
-                  peelProperties def.value.${key}
-                  // {
-                    inherit (def) file;
-                    inherit key;
-                  }
-                ) (attrNames def.value);
-
-            allItems = concatMap defToItems defs;
-
-            # Per key, find the highest override priority (lowest number)
-            winningOverridePrio = foldl' (
-              acc: item:
-              let
-                prev = acc.${item.key} or defaultOverridePriority;
-              in
-              if item.overridePrio < prev then
-                acc // { ${item.key} = item.overridePrio; }
-              else
-                # minimize `//` operations
-                acc
-            ) { } allItems;
-
-            # Keep only items at the winning override priority for their key
-            items = sort (a: b: a.prio < b.prio) (
-              filter (
-                item: item.overridePrio == winningOverridePrio.${item.key} or defaultOverridePriority
-              ) allItems
-            );
-
-            evals = filter (e: e.eval.optionalValue ? value) (
-              map (item: {
-                inherit (item) key file prio;
-                eval = mergeDefinitions (loc ++ [ item.key ]) elemType [
-                  {
-                    inherit (item) file value;
-                  }
-                ];
-              }) items
-            );
-
-            attrListValue = map (e: { ${e.key} = e.eval.optionalValue.value or e.eval.mergedValue; }) evals;
-          in
-          {
-            headError = checkDefsForError check loc defs;
-            value = if asAttrs then zipAttrsWith mergeAttrValues attrListValue else attrListValue;
-            valueMeta.attrList = map (e: e.eval.checkedAndMerged.valueMeta) evals;
-            /**
-              The ordered list representation, especially useful when asAttrs is set.
-            */
-            valueMeta.attrListValue = attrListValue;
-            valueMeta.definitions = map (
-              e:
-              mkDefinition {
-                inherit (e) file;
-                value = mkOrder e.prio { ${e.key} = e.eval.optionalValue.value or e.eval.mergedValue; };
-              }
-            ) evals;
-          };
-      };
-      emptyValue = {
-        value = if asAttrs then { } else [ ];
-      };
-      getSubOptions = prefix: elemType.getSubOptions (prefix ++ [ "*" ]);
-      getSubModules = elemType.getSubModules;
-      substSubModules =
-        m:
-        attrListWith {
-          inherit asAttrs mergeAttrValues;
-          elemType = elemType.substSubModules m;
-        };
-      typeMerge = t: null; # Disable type merging
-      nestedTypes.elemType = elemType;
-    };
-
   attrsOf = elemType: attrsWith { inherit elemType; };
 
   # A version of attrsOf that's lazy in its values at the expense of

maintainers/github-teams.json

@@ -2,10 +2,11 @@
   "acme": {
     "description": "Maintain ACME-related packages and modules.",
     "id": 3806126,
-    "maintainers": {},
+    "maintainers": {
+      "emilazy": 18535642
+    },
     "members": {
       "arianvp": 628387,
-      "emilazy": 18535642,
       "m1cr0man": 3044438
     },
     "name": "ACME"
@@ -42,12 +43,9 @@
     "id": 5468470,
     "maintainers": {},
     "members": {
-      "aherrmann": 732652,
       "avdv": 3471749,
-      "ethercrow": 222467,
       "groodt": 343415,
-      "kalbasit": 87115,
-      "mboes": 51356
+      "kalbasit": 87115
     },
     "name": "Bazel"
   },
@@ -71,11 +69,10 @@
     "description": "coordinates efforts towards bootstrappable builds (see https://bootstrappable.org/)",
     "id": 9141350,
     "maintainers": {
+      "philiptaron": 43863,
       "zeuner": 2545850
     },
-    "members": {
-      "philiptaron": 43863
-    },
+    "members": {},
     "name": "bootstrapping"
   },
   "categorization": {
@@ -128,7 +125,6 @@
       "Pandapip1": 45835846,
       "a-kenji": 65275785,
       "drakon64": 6444703,
-      "michaelBelsanti": 62124625,
       "thefossguy": 44400303
     },
     "name": "COSMIC"
@@ -176,6 +172,7 @@
     "description": "Improve Darwin-support across Nixpkgs and help maintainers without access to Darwin hardware. Apply to join through https://github.com/NixOS/nixpkgs/issues/323144 to keep the process transparent.",
     "id": 2385202,
     "maintainers": {
+      "emilazy": 18535642,
       "toonn": 1486805
     },
     "members": {
@@ -205,7 +202,6 @@
       "donn": 12652988,
       "dwt": 57199,
       "eclairevoyant": 848000,
-      "emilazy": 18535642,
       "ethancedwards8": 60861925,
       "fiddlerwoaroof": 808745,
       "fulsomenko": 14945057,
@@ -309,8 +305,7 @@
     "members": {
       "AndersonTorres": 5954806,
       "adisbladis": 63286,
-      "panchoh": 471059,
-      "ttuegel": 563054
+      "panchoh": 471059
     },
     "name": "emacs"
   },
@@ -407,13 +402,12 @@
   "gnome": {
     "description": "Maintain GNOME desktop environment and platform.",
     "id": 3806133,
-    "maintainers": {},
-    "members": {
-      "bobby285271": 20080233,
-      "dasj19": 7589338,
-      "hedning": 71978,
+    "maintainers": {
       "jtojnar": 705123
     },
+    "members": {
+      "bobby285271": 20080233
+    },
     "name": "GNOME"
   },
   "golang": {
@@ -556,13 +550,13 @@
     "id": 9955829,
     "maintainers": {
       "RossComputerGuy": 19699320,
-      "alyssais": 2768870
+      "alyssais": 2768870,
+      "emilazy": 18535642
     },
     "members": {
       "Ericson2314": 1055245,
-      "emilazy": 18535642,
-      "rrbutani": 7833358,
-      "sternenseemann": 3154475
+      "peterwaller-arm": 52030119,
+      "rrbutani": 7833358
     },
     "name": "LLVM"
   },
@@ -695,14 +689,15 @@
     "description": "",
     "id": 174820,
     "maintainers": {
-      "Ericson2314": 1055245,
-      "tomberek": 178444
+      "Ericson2314": 1055245
     },
     "members": {
       "Mic92": 96200,
       "Radvendii": 1239929,
       "edolstra": 1148549,
+      "lisanna-dettwyler": 72424138,
       "lovesegfault": 7243783,
+      "tomberek": 178444,
       "xokdvium": 145775305
     },
     "name": "Nix team"
@@ -819,14 +814,13 @@
     "description": "Maintain the Qt framework, KDE application suite, Plasma desktop environment and related projects",
     "id": 4341481,
     "maintainers": {
-      "ttuegel": 563054
+      "K900": 386765,
+      "NickCao": 15247171,
+      "SuperSandro2000": 7258858
     },
     "members": {
       "FRidh": 2129135,
-      "K900": 386765,
       "LunNova": 782440,
-      "NickCao": 15247171,
-      "SuperSandro2000": 7258858,
       "bkchr": 5718007,
       "ilya-fedin": 17829319,
       "mjm": 1181,
@@ -848,19 +842,31 @@
     },
     "name": "Radicle"
   },
+  "redis": {
+    "description": "Maintain Redis, related packages, module, and tests.",
+    "id": 17932473,
+    "maintainers": {
+      "Hythera": 87016780,
+      "MiniHarinn": 52773156,
+      "debtquity": 225436867,
+      "kybe236": 118068228
+    },
+    "members": {},
+    "name": "Redis"
+  },
   "reproducible": {
     "description": "Team that is interested in reproducible builds",
     "id": 7625643,
     "maintainers": {
-      "raboof": 131856,
-      "zimbatm": 3248
+      "raboof": 131856
     },
     "members": {
       "Artturin": 56650223,
       "Atemu": 18599032,
       "RaitoBezarius": 314564,
       "davidak": 91113,
-      "mschwaig": 3856390
+      "mschwaig": 3856390,
+      "zimbatm": 3248
     },
     "name": "reproducible"
   },
@@ -896,8 +902,7 @@
     "id": 7304571,
     "maintainers": {
       "Mic92": 96200,
-      "winterqt": 78392041,
-      "zowoq": 59103226
+      "winterqt": 78392041
     },
     "members": {},
     "name": "rust"
@@ -936,6 +941,8 @@
       "infinisil": 20525370
     },
     "members": {
+      "andir": 638836,
+      "leona-ya": 11006031,
       "pyrox0": 35778371
     },
     "name": "Security review"
@@ -964,13 +971,13 @@
     "description": "Maintain the standard environment and its surrounding logic.",
     "id": 11265412,
     "maintainers": {
-      "RossComputerGuy": 19699320
+      "RossComputerGuy": 19699320,
+      "emilazy": 18535642,
+      "philiptaron": 43863
     },
     "members": {
       "Artturin": 56650223,
       "Ericson2314": 1055245,
-      "emilazy": 18535642,
-      "philiptaron": 43863,
       "reckenrode": 7413633
     },
     "name": "stdenv"
@@ -990,6 +997,17 @@
     },
     "name": "systemd"
   },
+  "test-driver": {
+    "description": "Maintain the NixOS integration test driver.",
+    "id": 18201265,
+    "maintainers": {
+      "Ma27": 6025220,
+      "kmein": 10352507,
+      "tfc": 29044
+    },
+    "members": {},
+    "name": "test-driver"
+  },
   "xen-project": {
     "description": "Maintain the Xen Project Hypervisor and the related tooling ecosystem. Members listed as \"Maintainers\" are recipients of Xen Security Advisories sent to xsa@nixos.org.",
     "id": 11127725,

maintainers/maintainer-list.nix

@@ -710,12 +710,6 @@
     githubId = 25004152;
     name = "Adrian Gunnar Lauterer";
   };
-  adrielvelazquez = {
-    email = "AdrielVelazquez@gmail.com";
-    github = "AdrielVelazquez";
-    githubId = 3443378;
-    name = "Adriel Velazquez";
-  };
   AdrienLemaire = {
     email = "lemaire.adrien@gmail.com";
     github = "AdrienLemaire";
@@ -771,12 +765,6 @@
     githubId = 168;
     name = "Alexander Flatter";
   };
-  afldcr = {
-    email = "alex@fldcr.com";
-    github = "afldcr";
-    githubId = 335271;
-    name = "James Alexander Feldman-Crough";
-  };
   afontain = {
     email = "afontain@posteo.net";
     github = "necessarily-equal";
@@ -838,12 +826,6 @@
     githubId = 207841739;
     name = "Savchenko Dmitriy";
   };
-  aherrmann = {
-    email = "andreash87@gmx.ch";
-    github = "aherrmann";
-    githubId = 732652;
-    name = "Andreas Herrmann";
-  };
   ahirner = {
     email = "a.hirner+nixpkgs@gmail.com";
     github = "ahirner";
@@ -2130,6 +2112,12 @@
     githubId = 56009;
     name = "Arcadio Rubio García";
   };
+  arcayr = {
+    email = "nixpkgs@arcayr.online";
+    github = "arcayr";
+    githubId = 11192354;
+    name = "Elliot Speck";
+  };
   archer-65 = {
     email = "mario.liguori.056@gmail.com";
     github = "archer-65";
@@ -4162,6 +4150,13 @@
     githubId = 30717258;
     name = "bubblepipe";
   };
+  bubylou = {
+    email = "bubylou@pm.me";
+    matrix = "@bubylou:matrix.org";
+    github = "bubylou";
+    githubId = 3878640;
+    name = "Nicholas Malcolm";
+  };
   buckley310 = {
     email = "sean.bck@gmail.com";
     matrix = "@buckley310:matrix.org";
@@ -6194,7 +6189,7 @@
     name = "Daniel Șerbănescu";
   };
   daskladas = {
-    email = "xvzrsm@tutanota.de";
+    email = "mail@daskladas.de";
     github = "daskladas";
     githubId = 155686186;
     name = "Eric Heinemann";
@@ -6526,12 +6521,6 @@
     githubId = 48378098;
     name = "Danila Danko";
   };
-  deepfire = {
-    email = "_deepfire@feelingofgreen.ru";
-    github = "deepfire";
-    githubId = 452652;
-    name = "Kosyrev Serge";
-  };
   DeeUnderscore = {
     email = "d.anzorge@gmail.com";
     github = "DeeUnderscore";
@@ -7616,11 +7605,6 @@
     githubId = 54573;
     name = "Edward Amsden";
   };
-  eana = {
-    github = "eana";
-    githubId = 18534280;
-    name = "Jonas Eana";
-  };
   earldouglas = {
     email = "james@earldouglas.com";
     github = "earldouglas";
@@ -7657,12 +7641,6 @@
     github = "eclairevoyant";
     name = "éclairevoyant";
   };
-  eConnah = {
-    email = "git@econnah.uk";
-    github = "eConnah";
-    githubId = 63052937;
-    name = "Connor Alecks";
-  };
   edanaher = {
     email = "nixos@edanaher.net";
     github = "edanaher";
@@ -7935,6 +7913,11 @@
     githubId = 18375468;
     name = "Elliot Xu";
   };
+  elliotberman = {
+    name = "Elliot Berman";
+    github = "elliotberman";
+    githubId = 210410075;
+  };
   elliottslaughter = {
     name = "Elliott Slaughter";
     email = "elliottslaughter@gmail.com";
@@ -8319,11 +8302,6 @@
     githubId = 5427394;
     name = "Ersin Akinci";
   };
-  es-sai-fi = {
-    name = "es-sai-fi";
-    github = "es-sai-fi";
-    githubId = 96452903;
-  };
   esau79p = {
     github = "EsAu79p";
     githubId = 21313906;
@@ -8375,12 +8353,6 @@
       { fingerprint = "2E51 F618 39D1 FA94 7A73  00C2 34C0 4305 D581 DBFE"; }
     ];
   };
-  ethercrow = {
-    email = "ethercrow@gmail.com";
-    github = "ethercrow";
-    githubId = 222467;
-    name = "Dmitry Ivanov";
-  };
   ethindp = {
     name = "Ethin Probst";
     email = "harlydavidsen@gmail.com";
@@ -8630,12 +8602,6 @@
     github = "f2k1de";
     githubId = 11199213;
   };
-  f4814n = {
-    email = "me@f4814n.de";
-    github = "f4814";
-    githubId = 11909469;
-    name = "Fabian Geiselhart";
-  };
   f4z3r = {
     email = "f4z3r-github@pm.me";
     name = "Jakob Beckmann";
@@ -10159,12 +10125,6 @@
     githubId = 6893840;
     name = "Yacine Hmito";
   };
-  gquetel = {
-    email = "gregor.quetel@telecom-paris.fr";
-    github = "gquetel";
-    githubId = 48437427;
-    name = "Grégor Quetel";
-  };
   gracicot = {
     email = "dev@gracicot.com";
     matrix = "@gracicot-59e8f173d73408ce4f7ac803:gitter.im";
@@ -15624,6 +15584,12 @@
     githubId = 4312404;
     name = "Chris Rendle-Short";
   };
+  lightdiscord = {
+    email = "root@arnaud.sh";
+    github = "lightdiscord";
+    githubId = 24509182;
+    name = "Arnaud Pascal";
+  };
   lightquantum = {
     email = "self@lightquantum.me";
     github = "PhotonQuantum";
@@ -15830,6 +15796,12 @@
     githubId = 23727619;
     name = "Luca Ruperto";
   };
+  lnl7 = {
+    email = "daiderd@gmail.com";
+    github = "LnL7";
+    githubId = 689294;
+    name = "Daiderd Jordan";
+  };
   lo1tuma = {
     email = "schreck.mathias@gmail.com";
     github = "lo1tuma";
@@ -16294,11 +16266,6 @@
     githubId = 26020062;
     name = "lumi";
   };
-  luminarleaf = {
-    github = "LuminarLeaf";
-    githubId = 80571430;
-    name = "Luminar Leaf";
-  };
   luna_1024 = {
     email = "contact@luna.computer";
     github = "luna-1024";
@@ -17127,6 +17094,12 @@
     github = "matrss";
     githubId = 9308656;
   };
+  matshch = {
+    name = "Artem Leshchev";
+    github = "matshch";
+    githubId = 2412121;
+    email = "matshch@gmail.com";
+  };
   matt-snider = {
     email = "matt.snider@protonmail.com";
     github = "matt-snider";
@@ -17415,6 +17388,12 @@
     githubId = 613740;
     name = "Martin Baillie";
   };
+  mbbx6spp = {
+    email = "me@susanpotter.net";
+    github = "mbbx6spp";
+    githubId = 564;
+    name = "Susan Potter";
+  };
   mbe = {
     email = "brandonedens@gmail.com";
     github = "brandonedens";
@@ -17433,12 +17412,6 @@
     githubId = 9051309;
     name = "Maximilian Bode";
   };
-  mboes = {
-    email = "mboes@tweag.net";
-    github = "mboes";
-    githubId = 51356;
-    name = "Mathieu Boespflug";
-  };
   mBornand = {
     email = "dev.mbornand@systemb.ch";
     github = "mBornand";
@@ -19427,12 +19400,6 @@
     name = "neo";
     email = "chojs990222@gmail.com";
   };
-  neonvoid = {
-    email = "me@neonvoid.dev";
-    github = "neonvoidx";
-    githubId = 25580051;
-    name = "neonvoid";
-  };
   neosimsim = {
     email = "me@abn.sh";
     github = "neosimsim";
@@ -21421,6 +21388,12 @@
     githubId = 7420227;
     name = "Peter Tri Ho";
   };
+  peterwaller-arm = {
+    email = "peter.waller@arm.com";
+    github = "peterwaller-arm";
+    githubId = 52030119;
+    name = "Peter Waller";
+  };
   peterwilli = {
     email = "peter@codebuffet.co";
     github = "peterwilli";
@@ -24195,6 +24168,7 @@
   };
   ryand56 = {
     email = "git@ryand.ca";
+    matrix = "@ryan:ryand.ca";
     github = "ryand56";
     githubId = 22267679;
     name = "Ryan Omasta";
@@ -25680,6 +25654,12 @@
     githubId = 216167;
     name = "Steve Jones";
   };
+  sjmackenzie = {
+    email = "setori88@gmail.com";
+    github = "sjmackenzie";
+    githubId = 158321;
+    name = "Stewart Mackenzie";
+  };
   skaphi = {
     name = "Oskar Philipsson";
     email = "oskar.philipsson@gmail.com";
@@ -25984,6 +25964,12 @@
     githubId = 13762043;
     matrix = "@sophie:nue.soopy.moe";
   };
+  sophiebsw = {
+    name = "Sophia";
+    email = "nixpkgs@drifter.dev";
+    github = "sophiebsw";
+    githubId = 4594464;
+  };
   sophronesis = {
     email = "oleksandr.buzynnyi@gmail.com";
     github = "sophronesis";
@@ -26971,6 +26957,12 @@
     githubId = 6064962;
     name = "TakWolf";
   };
+  talal = {
+    email = "noreply@talal.ch";
+    github = "talal";
+    githubId = 3526562;
+    name = "Muhammad Talal Anwar";
+  };
   talhaHavadar = {
     email = "havadartalha@gmail.com";
     github = "talhaHavadar";
@@ -27364,6 +27356,13 @@
     github = "thattemperature";
     githubId = 125476238;
   };
+  thbemme = {
+    name = "Thomas Bemme";
+    email = "thomas.bemme@gmail.com";
+    matrix = "@riza:chaos.jetzt";
+    github = "thbemme";
+    githubId = 14074615;
+  };
   thblt = {
     name = "Thibault Polge";
     email = "thibault@thb.lt";
@@ -28233,12 +28232,6 @@
     githubId = 207457;
     name = "Matthieu Chevrier";
   };
-  trepetti = {
-    email = "trepetti@cs.columbia.edu";
-    github = "trepetti";
-    githubId = 25440339;
-    name = "Tom Repetti";
-  };
   trespaul = {
     email = "paul@trespaul.com";
     github = "trespaul";
@@ -28556,12 +28549,6 @@
     githubId = 30677291;
     name = "u2x1";
   };
-  u3kkasha = {
-    email = "fida.waseque@gmail.com";
-    github = "u3kkasha";
-    githubId = 146055002;
-    name = "Fida Waseque Choudhury";
-  };
   uakci = {
     name = "uakci";
     email = "git@uakci.space";
@@ -28895,12 +28882,6 @@
     githubId = 2612464;
     name = "Vincent Laporte";
   };
-  vbmithr = {
-    email = "vb@luminar.eu.org";
-    github = "vbmithr";
-    githubId = 797581;
-    name = "Vincent Bernardoff";
-  };
   vbrandl = {
     name = "Valentin Brandl";
     email = "mail+nixpkgs@vbrandl.net";
@@ -29461,12 +29442,6 @@
     github = "wdavidw";
     githubId = 46896;
   };
-  wduo87391 = {
-    name = "wduo87391";
-    email = "wduo87391@gmail.com";
-    github = "wduo87391";
-    githubId = 197874825;
-  };
   weathercold = {
     name = "Weathercold";
     email = "weathercold.scr@proton.me";
@@ -30401,12 +30376,6 @@
     githubId = 1742643;
     name = "Ravi Peters";
   };
-  ylecornec = {
-    email = "yves.stan.lecornec@tweag.io";
-    github = "ylecornec";
-    githubId = 5978566;
-    name = "Yves-Stan Le Cornec";
-  };
   ylh = {
     email = "nixpkgs@ylh.io";
     github = "ylh";

maintainers/scripts/luarocks-packages.csv

@@ -168,7 +168,6 @@ telescope.nvim,,,,,5.1,
 tiktoken_core,,,,,,natsukium
 tl,,,,,,mephistophiles
 toml-edit,,,,,5.1,mrcjkb
-tomlua,,,,,,birdee
 tree-sitter-cli,,,,,,
 tree-sitter-http,,,,0.0.33-1,,
 tree-sitter-norg,,,,,5.1,mrcjkb

maintainers/scripts/update.nix

@@ -13,9 +13,9 @@
   path ? null,
   max-workers ? null,
   include-overlays ? false,
-  keep-going ? null,
-  commit ? null,
-  skip-prompt ? null,
+  keep-going ? false,
+  commit ? false,
+  skip-prompt ? false,
   order ? null,
 }:
 
@@ -206,18 +206,18 @@ let
 
     to increase the number of jobs in parallel, or
 
-        --argstr keep-going true
+        --arg keep-going true
 
     to continue running when a single update fails.
 
     You can also make the updater automatically commit on your behalf from updateScripts
     that support it by adding
 
-        --argstr commit true
+        --arg commit true
 
-    to skip prompt:
+    To skip the prompt, you can add
 
-        --argstr skip-prompt true
+        --arg skip-prompt true
 
     By default, the updater will update the packages in arbitrary order. Alternately, you can force a specific order based on the packages’ dependency relations:
 
@@ -250,11 +250,15 @@ let
   # JSON file with data for update.py.
   packagesJson = pkgs.writeText "packages.json" (builtins.toJSON (map packageData packages));
 
+  # Allow boolean arguments to be provided with either --arg or --argstr.
+  # The ability to use the string "true" will be deprecated.
+  isTrue = arg: arg == true || arg == "true";
+
   optionalArgs =
     lib.optional (max-workers != null) "--max-workers=${max-workers}"
-    ++ lib.optional (keep-going == "true") "--keep-going"
-    ++ lib.optional (commit == "true") "--commit"
-    ++ lib.optional (skip-prompt == "true") "--skip-prompt"
+    ++ lib.optional (isTrue keep-going) "--keep-going"
+    ++ lib.optional (isTrue commit) "--commit"
+    ++ lib.optional (isTrue skip-prompt) "--skip-prompt"
     ++ lib.optional (order != null) "--order=${order}";
 
   args = [ packagesJson ] ++ optionalArgs;

maintainers/team-list.nix

@@ -68,12 +68,9 @@ with lib.maintainers;
 
   bazel = {
     members = [
-      mboes
       cbley
       olebedev
       groodt
-      aherrmann
-      ylecornec
       boltzmannrain
     ];
     scope = "Bazel build tool & related tools https://bazel.build/";
@@ -510,12 +507,11 @@ with lib.maintainers;
   matrix = {
     members = [
       ma27
-      mguentner
-      dandellion
       nickcao
       teutat3s
+      transcaffeine
     ];
-    scope = "Maintain the ecosystem around Matrix, a decentralized messenger.";
+    scope = "Maintain the foundational packages of the Matrix ecosystem.";
     shortName = "Matrix";
   };
 
@@ -567,7 +563,6 @@ with lib.maintainers;
       ethancedwards8
       phanirithvij
       prince213
-      wegank
     ];
     scope = "Maintain NGI-supported software.";
     shortName = "NGI";
@@ -662,7 +657,6 @@ with lib.maintainers;
   python = {
     members = [
       hexa
-      natsukium
     ];
     scope = "Maintain the Python interpreter and related packages.";
     shortName = "Python";
@@ -739,7 +733,6 @@ with lib.maintainers;
       dduan
       samasaur
       stephank
-      trepetti
     ];
     scope = "Maintain Swift compiler suite for NixOS.";
     shortName = "Swift";

nixos/doc/manual/configuration/profiles/headless.section.md

@@ -2,7 +2,7 @@
 
 Common configuration for headless machines (e.g., Amazon EC2 instances).
 
-Disables serial consoles,
+Disables [vesa](#opt-boot.vesa), serial consoles,
 [emergency mode](#opt-systemd.enableEmergencyMode),
 [grub splash images](#opt-boot.loader.grub.splashImage)
 and configures the kernel to reboot automatically on panic.

nixos/doc/manual/development/modular-services.md

@@ -6,7 +6,7 @@ Status: in development. This functionality is new in NixOS 25.11, and significan
 Traditionally, NixOS services were defined using sets of options *in* modules, not *as* modules. This made them non-modular, resulting in problems with composability, reuse, and portability.
 
 A configuration management framework is an application of `evalModules` with the `class` and `specialArgs` input attribute set to particular values.
-NixOS is such a configuration management framework, and so are [Home Manager](https://github.com/nix-community/home-manager) and [`nix-darwin`](https://github.com/nix-darwin/nix-darwin).
+NixOS is such a configuration management framework, and so are [Home Manager](https://github.com/nix-community/home-manager) and [`nix-darwin`](https://github.com/lnl7/nix-darwin).
 
 The service management component of a configuration management framework is the set of module options that connects Nix expressions with the underlying service (or process) manager.
 For NixOS this is the module wrapping [`systemd`](https://systemd.io/), on `nix-darwin` this is the module wrapping [`launchd`](https://en.wikipedia.org/wiki/Launchd).

nixos/doc/manual/development/option-types.section.md

@@ -494,47 +494,6 @@ Composed types are types that take a type as parameter. `listOf
 
       Displays the option as `foo.<id>` in the manual.
 
-`types.attrListOf` *`t`*
-
-:   An ordered list of single-attribute attribute sets, where each value is of *`t`* type.
-    The output is always `[ { name1 = value1; } { name2 = value2; } ... ]`.
-
-    Definitions can be provided in two formats, which may be mixed via `lib.mkMerge`, `imports`, etc:
-
-    - **List format**: `[ { a = 1; } { b = 2; } ]` — each element must be a single-attribute attribute set.
-      Elements may be wrapped in `lib.mkOrder` (or `lib.mkBefore`/`lib.mkAfter`) to control ordering;
-      unwrapped elements use the default order priority.
-
-    - **Attribute set format**: `{ a = lib.mkOrder 100 1; b = 2; }` — each name-value pair becomes a single-attribute attribute set in the output.
-      Values may be wrapped in `lib.mkOrder` (or `lib.mkBefore`/`lib.mkAfter`) to control ordering.
-      Values without `lib.mkOrder` use the default priority.
-
-    Multiple definitions of the same option are concatenated and then sorted by priority.
-    Entries at the same priority level preserve their definition order.
-
-`types.attrListWith` { *`elemType`*, *`asAttrs`* ? false, *`mergeAttrValues`* ? _name: values: values }
-
-:   An ordered list of single-attribute attribute sets, where each value is of *`elemType`* type.
-
-    **Parameters**
-
-    `elemType` (Required)
-    : Specifies the type of each value in the attribute list.
-
-    `asAttrs`
-    : When `true`, the option value is an attribute set instead of a list.
-      Duplicate keys are merged using `mergeAttrValues`.
-      The ordered list is always available via `valueMeta.attrListValue`.
-
-    `mergeAttrValues`
-    : A function `name: values: mergedValue` that controls how duplicate keys
-      are combined when `asAttrs = true`. This is passed as the callback to
-      `lib.zipAttrsWith`. The `values` list is in order of priority.
-      By default, all values are collected into a list.
-
-    **Behavior**
-
-    - `attrListWith { elemType = t; }` is equivalent to `attrListOf t`
 
 `types.uniq` *`t`*
 

nixos/doc/manual/redirects.json

@@ -2363,21 +2363,6 @@
   "ch-release-notes": [
     "release-notes.html#ch-release-notes"
   ],
-  "sec-release-26.11": [
-    "release-notes.html#sec-release-26.11"
-  ],
-  "sec-release-26.11-highlights": [
-    "release-notes.html#sec-release-26.11-highlights"
-  ],
-  "sec-release-26.11-new-modules": [
-    "release-notes.html#sec-release-26.11-new-modules"
-  ],
-  "sec-release-26.11-incompatibilities": [
-    "release-notes.html#sec-release-26.11-incompatibilities"
-  ],
-  "sec-release-26.11-notable-changes": [
-    "release-notes.html#sec-release-26.11-notable-changes"
-  ],
   "sec-release-26.05": [
     "release-notes.html#sec-release-26.05"
   ],

nixos/doc/manual/release-notes/release-notes.md

@@ -3,7 +3,6 @@
 This section lists the release notes for each stable version of NixOS and current unstable revision.
 
 ```{=include=} sections
-rl-2611.section.md
 rl-2605.section.md
 rl-2511.section.md
 rl-2505.section.md

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -1,4 +1,4 @@
-# Release 26.05 ("Yarara", 2026.05/??) {#sec-release-26.05}
+# Release 26.05 ("Yarara", 2026.05/30) {#sec-release-26.05}
 
 ## Highlights {#sec-release-26.05-highlights}
 
@@ -13,6 +13,7 @@
   - If you use LUKS disk encryption, ensure that `fileSystems."/".device` is set to `"/dev/mapper/<name>"`, where `<name>` matches the name in your `boot.initrd.luks.devices.<name>` definition, to avoid systemd timing out while prompting for a passphrase. If you have a more complex setup, e.g. with LVM on top of LUKS, you may need to add `"x-systemd.device-timeout=infinity"` to `fileSystems."/".options` instead. If you need to disable the timeout before you can boot into the system, pass `systemd.default_device_timeout_sec=infinity` on the kernel command line.
   - The `cryptsetup-askpass` program is not available; use `systemctl default` instead, which will prompt for passphrases as necessary. If you pipe password responses into SSH over stdin, use `ssh -o RequestTTY=force` to ensure `systemctl default` gets a TTY to prompt on.
   - Many kernel parameters have been replaced with native systemd versions; see [](#sec-boot-problems).
+  - `/dev/root` is not available with the systemd stage 1. In the old scripted stage 1, `/dev/root` was a symlink created by the init script from the `root=` kernel command line. With systemd stage 1, this symlink is not provided. If your configuration uses `/dev/root` in `fileSystems`, replace it with a stable device path such as `/dev/disk/by-label/...`, `/dev/disk/by-uuid/...`, or the appropriate `/dev/mapper/...` path.
 
 - The system.nix file has been added as an alternative entry point to configuration.nix (and flake.nix) that allows configuring NixOS without using `nix-channel`.
   This file must evaluate to a NixOS system derivation or an attribute set of such derivations, in which case the attribute to build has to be selected with the `--attr` option of `nixos-rebuild` or `nixos-install`.
@@ -23,11 +24,11 @@
     # Pinned Nixpkgs archive
     #
     # Use `curl -I https://channels.nixos.org/nixos-26.05` to get the
-    # latest commit of the stable channel and `nix --extra-experimental-features nix-command store prefetch-file --unpack`
-    # to compute its hash.
+    # latest commit of the stable channel and `nix-prefetch-url --unpack`
+    # to compute its sha256 hash.
     nixpkgs = builtins.fetchTarball {
       url = "https://github.com/NixOS/nixpkgs/archive/c217913993d6.tar.gz";
-      hash = "sha256-D1PA3xQv/s4W3lnR9yJFSld8UOLr0a/cBWMQMXS+1Qg=";
+      sha256 = "026mprs324330pfazlgbw987qmsa8ligglarvqbcxzig2kgw0lqg";
     };
   in
   import "${nixpkgs}/nixos" {
@@ -60,6 +61,10 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- [](#opt-services.autossh-ng.sessions) NixOS module was introduced as a simpler alternative to the existing [](#opt-services.autossh.sessions) module.
+
+- [services.nextcloud-spreed-signaling](#opt-services.nextcloud-spreed-signaling.enable) NixOS module has been added to facilitate declarative management of a standalone Spreed signaling server ("High Performance Backend" for Nextcloud Talk).
+
 - [OpenThread Border Router](https://openthread.io/), a Thread border router for POSIX-based platforms that bridges Thread mesh networks to IP networks. Available as [services.openthread-border-router](#opt-services.openthread-border-router.enable).
 
 - [Atuin](https://atuin.sh), magical shell history — sync, search and backup your terminal history. Available as [programs.atuin](#opt-programs.atuin.enable).
@@ -69,9 +74,9 @@
 
 - [Goupile](https://goupile.org/en), an open-source design tool for secure forms including Clinical Report Forms (eCRF). Available as [services.goupile](#opt-services.goupile.enable).
 
-- [knot-resolver](https://www.knot-resolver.cz/), in version 6. Available as `services.knot-resolver`. A module for knot-resolver 5 was already available as `services.kresd`.
+- [knot-resolver](https://www.knot-resolver.cz/), in version 6. Available as [services.knot-resolver](#opt-services.knot-resolver.enable). A module for knot-resolver 5 was already available as [services.kresd](#opt-services.kresd.enable).
 
-- [ImmichFrame](https://immichframe.dev/), display your photos from Immich as a digital photo frame. Available as `services.immichframe`.
+- [ImmichFrame](https://immichframe.dev/), display your photos from Immich as a digital photo frame. Available as [services.immichframe](#opt-services.immichframe.enable).
 
 - [PdfDing](https://www.pdfding.com/), manage, view and edit your PDFs seamlessly on all your devices wherever you are. Available as [services.pdfding](#opt-services.pdfding.enable).
 
@@ -79,7 +84,7 @@
 
 - [reaction](https://reaction.ppom.me/), a daemon that scans program outputs for repeated patterns, and takes action. A common usage is to scan ssh and webserver logs, and to ban hosts that cause multiple authentication errors. A modern alternative to fail2ban. Available as [services.reaction](#opt-services.reaction.enable).
 
-- [vinyl-cache](https://vinyl-cache.org) as the Varnish Cache project renamed itself. Available as [services.vinyl-cache](#opt-services.vinyl-cache.enable). To aid the migration, the old `services.varnish` module is still available.
+- [vinyl-cache](https://vinyl-cache.org) as the Varnish Cache project renamed itself. Available as [services.vinyl-cache](#opt-services.vinyl-cache.enable). To aid the migration, the old [services.varnish](#opt-services.varnish.enable) module is still available.
 
 - [papra](https://papra.app/), an open-source document management platform designed to help you organize, secure, and archive your files effortlessly. Available as [services.papra](#opt-services.papra.enable).
 
@@ -91,8 +96,6 @@
 
 - [kiwix-serve](https://wiki.kiwix.org/wiki/Kiwix-serve), a service that serves ZIM files (such as Wikipedia archives) over HTTP. Available as [services.kiwix-serve](#opt-services.kiwix-serve.enable).
 
-- [matterjs-server](https://github.com/matter-js/matterjs-server), a Matter controller with a Home Assistant compatible WebSocket API. Available as [services.matterjs-server](#opt-services.matterjs-server.enable).
-
 - [Remark42](https://remark42.com/), a self-hosted comment engine. Available as [services.remark42](#opt-services.remark42.enable).
 
 - [LibreChat](https://www.librechat.ai/), open-source self-hostable ChatGPT clone with Agents and RAG APIs. Available as [services.librechat](#opt-services.librechat.enable).
@@ -103,7 +106,7 @@
 
 - [bentopdf](https://github.com/alam00000/bentopdf), a privacy-first PDF toolkit running completely in-browser. Available as [services.bentopdf](#opt-services.bentopdf.enable).
 
-- [hyprwhspr-rs](https://github.com/better-slop/hyprwhspr-rs), a keybind activated speech-to-text voice dictation utility built for use with Hyprland. Available as `services.hyprwhspr-rs`.
+- [hyprwhspr-rs](https://github.com/better-slop/hyprwhspr-rs), a keybind activated speech-to-text voice dictation utility built for use with Hyprland. Available as [services.hyprwhspr-rs](#opt-services.hyprwhspr-rs.enable).
 
 - [DankMaterialShell](https://danklinux.com), a complete desktop shell for Wayland compositors built with Quickshell. Available as [programs.dms-shell](#opt-programs.dms-shell.enable).
 
@@ -131,19 +134,19 @@
 
 - [Dawarich](https://dawarich.app/), a self-hostable location history tracker. Available as [services.dawarich](#opt-services.dawarich.enable).
 
-- [Howdy](https://github.com/boltgolt/howdy), a Windows Hello™ style facial authentication program for Linux.
+- [Howdy](https://github.com/boltgolt/howdy), a Windows Hello™ style facial authentication program for Linux. Available as [services.howdy](#opt-services.howdy.enable)
 
-- [SuiteNumérique Drive](https://github.com/suitenumerique/drive), a collaborative file sharing and document management platform that scales. Built with Django and React. Open source alternative to Sharepoint or Google Drive.
+- [SuiteNumérique Drive](https://github.com/suitenumerique/drive), a collaborative file sharing and document management platform that scales. Built with Django and React. Open source alternative to Sharepoint or Google Drive. Available as [services.lasuite-drive](#opt-services.lasuite-drive.enable).
 
-- [linux-enable-ir-emitter](https://github.com/EmixamPP/linux-enable-ir-emitter), a tool used to set up IR cameras, used with Howdy.
+- [linux-enable-ir-emitter](https://github.com/EmixamPP/linux-enable-ir-emitter), a tool used to set up IR cameras, used with Howdy. Available as [services.linux-enable-ir-emitter](#opt-services.linux-enable-ir-emitter.enable).
 
-- [udp-over-tcp](https://github.com/mullvad/udp-over-tcp), a tunnel for proxying UDP traffic over a TCP stream. Available as `services.udp-over-tcp`.
+- [udp-over-tcp](https://github.com/mullvad/udp-over-tcp), a tunnel for proxying UDP traffic over a TCP stream. Available as [](#opt-services.udp-over-tcp.udp2tcp) and [](#opt-services.udp-over-tcp.tcp2udp).
 
 - [turborepo-remote-cache](https://ducktors.github.io/turborepo-remote-cache/), an open-source implementation of the [Turborepo custom remote cache server](https://turbo.build/repo/docs/core-concepts/remote-caching#self-hosting). Available as [services.turborepo-remote-cache](#opt-services.turborepo-remote-cache.enable).
 
-- [RSSHub](https://github.com/DIYgod/RSSHub), a service to convert many sources into rss. Available as `services.rsshub`.
+- [RSSHub](https://github.com/DIYgod/RSSHub), a service to convert many sources into rss. Available as [services.rsshub](#opt-services.rsshub.enable).
 
-- [ReFrame](https://github.com/AlynxZhou/reframe), a DRM/KMS based remote desktop for Linux that supports Wayland/NVIDIA/headless/login.
+- [ReFrame](https://github.com/AlynxZhou/reframe), a DRM/KMS based remote desktop for Linux that supports Wayland/NVIDIA/headless/login. Available as [services.reframe](#opt-services.reframe.enable)
 
 - [Komodo Periphery](https://github.com/moghtech/komodo), a multi-server Docker and Git deployment agent by Komodo. Available as [services.komodo-periphery](#opt-services.komodo-periphery.enable).
 
@@ -159,7 +162,7 @@
 
 - [Headplane](https://headplane.net), a feature-complete Web UI for Headscale. Available as [services.headplane](#opt-services.headplane.enable).
 
-- [whois](https://packages.qa.debian.org/w/whois.html), an intelligent WHOIS client. Available as `programs.whois`.
+- [whois](https://packages.qa.debian.org/w/whois.html), an intelligent WHOIS client. Available as [programs.whois](#opt-programs.whois.enable).
 
 - [porxie](https://codeberg.org/Blooym/porxie), a correct and efficient ATProto blob proxy for secure content delivery. Available as [services.porxie](#opt-services.porxie.enable).
 
@@ -169,12 +172,29 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- [](#opt-services.openssh.settings.AcceptEnv) is now explicitly defined as an option that takes a list of strings, to facilitate option merging. Setting it to a string value is no longer supported.
+
+- The default packages in [](#opt-services.jenkins.packages) have been dropped, since not every Jenkins installation needs any package at all. It's more reasonable to leave it empty and let users configure what they need.
+
+- [services.taskchampion-sync-server](#opt-services.taskchampion-sync-server.enable) module has had an option [](#opt-services.taskchampion-sync-server.dynamicUser) added to use systemd's DynamicUser feature. This is enabled by default when stateVersion is at least 26.05, and disabled otherwise. If you need this feature, you need to set `services.taskchampion-sync-server.dynamicUser` to `true` and migrate `/var/lib/taskchampion-sync-server` to `/var/lib/private/taskchampion-sync-server`.
+
+- The [programs.captive-browser](#opt-programs.captive-browser.enable) module no longer falls back on a setcap wrapper around udhcpc to discover your network's DNS server due to [GHSA-wc3r-c66x-8xmc](https://github.com/NixOS/nixpkgs/security/advisories/GHSA-wc3r-c66x-8xmc) (CVE-2026-25740). If you're using this module, you must either configure [](#opt-programs.captive-browser.dhcp-dns) manually or enable one of NetworkManager, dhcpcd, or systemd-networkd.
+
+- The [services.yggdrasil](#opt-services.yggdrasil.enable) module has been refactored with the following breaking changes:
+  - The `services.yggdrasil.configFile` option has been removed. Configuration should now be specified directly via [](#opt-services.yggdrasil.settings).
+  - The `services.yggdrasil.persistentKeys` option has been removed. To maintain persistent keys and IPv6 addresses across reboots, use [](#opt-services.yggdrasil.settings.PrivateKeyPath) to securely load your private key from a file via systemd credentials. The private key must be in PEM format (PKCS #8).
+  - Storing `PrivateKey` directly in `settings` is now explicitly forbidden to prevent keys from being stored world-readable in the Nix store.
+  - If you previously used `configFile`, migrate your configuration to the `settings` option and extract the private key to a separate file referenced by `PrivateKeyPath`.
+  - If you previously used `persistentKeys`, convert your keys to PEM format and store them in a secure location accessible only to root, then reference them via `PrivateKeyPath`.
+
+- [services.xserver](#opt-services.xserver.enable) will now throw an error if an X11 driver specified in  `videoDriver(s)` cannot be found. Previously, unknown drivers would be silently ignored.
+
+- The [](#opt-services.avahi.wideArea) option now defaults to `false` as a mitigation against [`CVE-2024-52615`/`GHSA-x6vp-f33h-h32g`](https://github.com/avahi/avahi/security/advisories/GHSA-x6vp-f33h-h32g).
+
 - `systemd.coredump.extraConfig` has been removed in favor of the structured [](#opt-systemd.coredump.settings.Coredump) option. Use `systemd.coredump.settings.Coredump` to set any `coredump.conf(5)` option directly. For example, replace `systemd.coredump.extraConfig = "Storage=journal";` with `systemd.coredump.settings.Coredump.Storage = "journal";`.
 
 - `services.home-assistant.config.lovelace.mode` has been renamed to `lovelace.dashboards` and `lovelace.resource_mode` to match the [configuration format](https://www.home-assistant.io/dashboards/dashboards/) required by Home Assistant 2026.8. Users who explicitly set `lovelace.mode` should remove it; the module generates the correct entries automatically.
 
-- `fulcrum` has been updated to 2.x. If run against an existing v1.x database without the `--db-upgrade` flag it refuses to start; the upgrade takes around an hour on Bitcoin mainnet.
-
 - `opentrack`, `slushload`, `synthesia`, `vtfedit`, `winbox`, `wineasio`, and `yabridge` use wineWow64Packages instead of wineWowPackages as wine versions >= 11.0 have deprecated wineWowPackages. As such, the prefixes for these packages are NOT backwards compatible and need to be regenerated with potential for data loss.
 
 - []{#sec-release-26.05-incompatibilities-profiles-hardened-removed} `profiles/hardened` has been removed, because:
@@ -186,9 +206,9 @@
 
 - `services.crabfit` was removed because its upstream packages are unmaintained and insecure.
 
-- `services.opensnitch.settings.Rules.Path` now defaults to `/var/lib/opensnitch/rules` instead of the previous `/etc/opensnitchd/rules` because it contains mutable data.
+- [services.opensnitch.settings.Rules.Path](#opt-services.opensnitch.settings.Rules.Path) now defaults to `/var/lib/opensnitch/rules` instead of the previous `/etc/opensnitchd/rules` because it contains mutable data.
 
-- `services.mosquitto` now generates per-listener authentication and access control via the upstream `password-file` and `acl-file` plugins instead of the deprecated `password_file` and `acl_file` options. The plugins contain the same code, so behaviour is unchanged, but [](#opt-services.mosquitto.package) must now be at least version 2.1.
+- [services.mosquitto](#opt-services.mosquitto.enable) now generates per-listener authentication and access control via the upstream `password-file` and `acl-file` plugins instead of the deprecated `password_file` and `acl_file` options. The plugins contain the same code, so behaviour is unchanged, but [](#opt-services.mosquitto.package) must now be at least version 2.1.
 
 - `sing-box` has been updated to 1.13.0, which has removed some deprecated options.  See [upstream documentation](https://sing-box.sagernet.org/configuration/) for details and migration options.
 
@@ -209,7 +229,7 @@
 
 - `linux_hardened` kernel has been removed due to a lack of maintenance.
 
-- `services.tandoor-recipes` now uses a sub-directory for media files by default starting with `26.05`. Existing setups should move media files out of the data directory and adjust `services.tandoor-recipes.extraConfig.MEDIA_ROOT` accordingly. See [Migrating media files for pre 26.05 installations](#module-services-tandoor-recipes-migrating-media).
+- [services.tandoor-recipes](#opt-services.tandoor-recipes.enable) now uses a sub-directory for media files by default starting with `26.05`. Existing setups should move media files out of the data directory and adjust `services.tandoor-recipes.extraConfig.MEDIA_ROOT` accordingly. See [Migrating media files for pre 26.05 installations](#module-services-tandoor-recipes-migrating-media).
 
 - `linux-rt` kernel has been removed due to a lack of maintenance.
 
@@ -221,10 +241,10 @@
 
 - `services.uptime` has been removed because the package it relies on does not exist anymore in nixpkgs.
 
-- `services.mattermost` now defaults to version 11, which has dropped support for MySQL in favor of Postgres. As a result, all support for MySQL has been removed from the module.
+- [services.mattermost](#opt-services.mattermost.enable) now defaults to version 11, which has dropped support for MySQL in favor of Postgres. As a result, all support for MySQL has been removed from the module.
   See the [migration steps](https://docs.mattermost.com/deployment-guide/manual-postgres-migration.html) if you were not running Postgres.
   Note that version 11 also restricts the user limit to 250 [by default](https://forum.mattermost.com/t/clarification-request-on-user-limits-max-250-user-server-v-11/25309);
-  see the `pkgs.mattermost` removeUserLimit and removeFreeBadge options combined with `services.mattermost.package` to change this behavior. For example:
+  see the `pkgs.mattermost` removeUserLimit and removeFreeBadge options combined with [](#opt-services.mattermost.package) to change this behavior. For example:
 
 ```nix
 {
@@ -237,10 +257,10 @@
 
 - `post-resume.target` has been removed. See {manpage}`systemd.special(7)` about `sleep.target` for instructions on ordering a process after resume with `ExecStop=`.
 
-- `services.vsftpd` no longer automatically configures a PAM module.  This means configurations using `services.vsftpd.localUsers` will no longer work unless `services.vsftpd.enableVirtualUsers` and `services.vsftpd.userDbPath` are also configured.  The old behaviour can be restored by setting `security.pam.services.vsftpd.enable = true`, although this only ever worked by accident and may not be secure.
+- [services.vsftpd](#opt-services.vsftpd.enable) no longer automatically configures a PAM module.  This means configurations using [](#opt-services.vsftpd.localUsers) will no longer work unless [](#opt-services.vsftpd.enableVirtualUsers) and [](#opt-services.vsftpd.userDbPath) are also configured.  The old behaviour can be restored by setting `security.pam.services.vsftpd.enable = true`, although this only ever worked by accident and may not be secure.
 
-- `services.kubernetes.addons.dns.coredns` has been renamed to `services.kubernetes.addons.dns.corednsImage` and now expects a
-package instead of attrs. Now, by default, nixpkgs.coredns in conjunction with dockerTools.buildImage is used, instead
+- `services.kubernetes.addons.dns.coredns` has been renamed to [](#opt-services.kubernetes.addons.dns.corednsImage) and now expects a
+package instead of attrs. Now, by default, nixpkgs.coredns in conjunction with `dockerTools.buildImage` is used, instead
 of pulling the upstream container image from Docker Hub. If you want the old behavior, you can set:
 
 ```nix
@@ -254,7 +274,7 @@ of pulling the upstream container image from Docker Hub. If you want the old beh
 }
 ```
 
-- `services.stalwart-mail` has been renamed to `services.stalwart` to align with upstream re-brand as an e-mail and collaboration server. Other notable breaking changes to module:
+- `services.stalwart-mail` has been renamed to [`services.stalwart`](#opt-services.stalwart.enable) to align with upstream re-brand as an e-mail and collaboration server. Other notable breaking changes to module:
 
   - Addition of module-specific `stateVersion` option, which on existing installations of Stalwart must be set to the same as `system.stateVersion`.
 
@@ -264,9 +284,9 @@ of pulling the upstream container image from Docker Hub. If you want the old beh
   - Default value for `services.stalwart.dataDir` has changed to `/var/lib/stalwart`. If `stateVersion` is older than `26.05`, will fallback to legacy value of `/var/lib/stalwart-mail`.
   - Default tracer name and type have changed to `journal`. If `stateVersion` is older than `26.05`, will fallback to legacy value of `stdout`.
 
-- `services.eintopf` has been renamed to `services.lauti` to align with upstream re-brand as a community online calendar.
+- `services.eintopf` has been renamed to [services.lauti](#opt-services.lauti.enable) to align with upstream re-brand as a community online calendar.
 
-- `services.oauth2-proxy.clientSecret` and `services.oauth2-proxy.cookie.secret` have been replaced with `services.oauth2-proxy.clientSecretFile` and `services.oauth2-proxy.cookie.secretFile` respectively. This was done to ensure secrets don't get made world-readable.
+- `services.oauth2-proxy.clientSecret` and `services.oauth2-proxy.cookie.secret` have been replaced with [](#opt-services.oauth2-proxy.clientSecretFile) and [](#opt-services.oauth2-proxy.cookie.secretFile) respectively. This was done to ensure secrets don't get made world-readable.
 
 - [`services.grafana.settings.security.secret_key`](#opt-services.grafana.settings.security.secret_key) doesn't have a
   default value anymore. Please generate your own key or hard-code the old one ("SW2YcwTIb9zpOOhoPsMm") explicitly.
@@ -286,18 +306,11 @@ of pulling the upstream container image from Docker Hub. If you want the old beh
 
 - Ethercalc and its associated module have been removed, as the package is unmaintained and cannot be installed from source with npm now.
 
-- `services.headplane` has been updated to 0.6.2, which introduces several changes to the configuration schema:
-  - `services.headplane.settings.oidc.redirect_uri` is deprecated. Use `services.headplane.settings.server.base_url` instead; the OIDC redirect URI is now automatically derived from it. Ensure `base_url` is the bare host URL without the `/admin` suffix.
-  - `services.headplane.settings.oidc.user_storage_file` is deprecated. Headplane 0.6.2 still accepts it to migrate the old JSON user database into the new internal SQL database.
-  - `services.headplane.settings.oidc.strict_validation` is deprecated and has no effect.
-  - `services.headplane.settings.oidc.token_endpoint_auth_method` now defaults to `null` (auto-detection), which typically falls back to `client_secret_basic`. Previous versions defaulted to `client_secret_post`.
-  - `services.headplane.settings.integration.agent.cache_ttl` is deprecated and has no effect in 0.6.2.
-
-- `services.immich` no longer supports pgvecto.rs since the package has been removed from nixpkgs.
+- [services.immich](#opt-services.immich.enable) no longer supports pgvecto.rs since the package has been removed from nixpkgs.
   As a result, options `services.immich.database.enableVectors` and `services.immich.database.enableVectorchord` have been removed, and VectorChord is now always used.
   If you have not completed the migration yet, ensure you completely remove the extension from your database before upgrading by following the [migration guide](https://github.com/NixOS/nixpkgs/blob/nixos-25.11/nixos/modules/services/web-apps/immich.md#migrating-from-pgvecto-rs-to-vectorchord-pre-2511-installations-module-services-immich-vectorchord-migration).
 
-- `services.cgit` before always had the git-http-backend and its "export all" setting enabled, which sidestepped any access control configured in cgit's settings. Now you have to make a decision and either enable or disable `services.cgit.gitHttpBackend.checkExportOkFiles` (or disable the git-http-backend).
+- [](#opt-services.cgit) before always had the git-http-backend and its "export all" setting enabled, which sidestepped any access control configured in cgit's settings. Now you have to make a decision and either enable or disable `opt-services.cgit.<name>.gitHttpBackend.checkExportOkFiles` (or disable the git-http-backend).
 
 - `rocmPackages_6` has been removed. `rocmPackages` has been updated to ROCm 7.x. Out of tree packages may rely on obsolete hipblas APIs or compile time constant warp size and need to be updated.
 
@@ -307,9 +320,7 @@ of pulling the upstream container image from Docker Hub. If you want the old beh
 
 - The Bash implementation of the `nixos-rebuild` program is removed. All switchable systems now use the Python rewrite. Any prior usage of `system.rebuild.enableNg` must now be removed. If you have any outstanding issues with the new implementation, please open an issue on GitHub.
 
-- `services.desktopManager.gnome` no longer installs the Geary e-mail client since it is not part of the GNOME [core applications](https://apps.gnome.org/) list. Geary's position in the default favorite apps section has been replaced by GNOME Text Editor. To keep it installed, add `programs.geary.enable = true;` to your configuration.
-
-- MATE packages have been moved to top level (e.g. if you previously added `pkgs.mate.caja` to `environment.systemPackages`, you will need to change it to `pkgs.caja`).
+- [services.desktopManager.gnome](#opt-services.desktopManager.gnome.enable) no longer installs the Geary e-mail client since it is not part of the GNOME [core applications](https://apps.gnome.org/) list. Geary's position in the default favorite apps section has been replaced by GNOME Text Editor. To keep it installed, add `programs.geary.enable = true;` to your configuration.
 
 - `walker` has been updated to 2.0.0+, which is a complete rewrite in rust.
 
@@ -321,7 +332,7 @@ of pulling the upstream container image from Docker Hub. If you want the old beh
 
 - Support for `reiserfs` in nixpkgs has been removed, following the removal in Linux 6.13.
 
-- `services.tor` no longer bind mounts Unix sockets of onion services into its chroot
+- [services.tor](#opt-services.tor.enable) no longer bind mounts Unix sockets of onion services into its chroot
 because it was not reliable. Users should do it themselves using either `JoinsNamespaceOf=` and Unix sockets in `/tmp`
 or `BindPaths=` from a persistent parent directory of each Unix socket.
 See <https://github.com/NixOS/nixpkgs/issues/481673>.
@@ -330,19 +341,21 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
 
 - `services.xserver.cmt` has been removed as the `xf86-input-cmt` package was broken and unmaintained upstream.
 
-- `programs.light` was removed from nixpkgs due to the corresponding package being unmaintained upstream. `brightnessctl` and `programs.acpilight` offer replacements.
+- `programs.light` was removed from nixpkgs due to the corresponding package being unmaintained upstream. `brightnessctl` and [hardware.acpilight](#opt-hardware.acpilight.enable) offer replacements.
 
 - `ceph` has been upgraded to v20. See the [Ceph "tentacle" release notes](https://docs.ceph.com/en/latest/releases/tentacle/#v20-2-0-tentacle) for details and recommended upgrade procedure.
   Note that **upgrades of server-side components are one-way**, and downgrading e.g. an OSD from *Tentacle* to *Squid* is not just not supported but is known to break.
 
-- `services.unifi`'s `jrePackage` option now defaults to `jdk25_headless` instead of `jdk17_headless`, in order to be compatible with new versions of `unifi`.
+- [](#opt-services.unifi.jrePackage) now defaults to `jdk25_headless` instead of `jdk17_headless`, in order to be compatible with new versions of `unifi`.
 
-- The `networking.wireless` module has been security hardened by default: the `wpa_supplicant` daemon now runs under an unprivileged user with restricted access to the system.
+- The [networking.wireless](#opt-networking.wireless.enable) module has been security hardened by default: the `wpa_supplicant` daemon now runs under an unprivileged user with restricted access to the system.
 
   As part of these changes, `/etc/wpa_supplicant.conf` has been deprecated: the NixOS-generated configuration file is now linked to `/etc/wpa_supplicant/nixos.conf` and `/etc/wpa_supplicant/imperative.conf` has been added for imperatively configuring `wpa_supplicant` or when using [allowAuxiliaryImperativeNetworks](#opt-networking.wireless.allowAuxiliaryImperativeNetworks).
 
   If client certificates, keys or other files are needed, these should be stored under `/etc/wpa_supplicant` and owned by `wpa_supplicant` to ensure the daemon can read them.
 
+  Similarly, the `ctrl_interface` directory set in `wpa_supplicant`'s conf must be writeable by the `wpa_supplicant` user so that the `wpa_supplicant` daemon can start successfully. If you were changing `ctrl_interface` in [extraConfig](#opt-networking.wireless.extraConfig) or in `/etc/wpa_supplicant/imperative.conf`, please remove that line.
+
   Also, the {option}`networking.wireless.userControlled.group` option has been removed since there is now a dedicated `wpa_supplicant` group to control the daemon, and {option}`networking.wireless.userControlled.enable` has been renamed to [](#opt-networking.wireless.userControlled).
 
   No functionality should have been impacted by these changes (including controlling via `wpa_cli`, integration with NetworkManager or connman), but if you find any problems, please open an issue on GitHub.
@@ -357,30 +370,20 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
   - In both "networkd" and "scripted" backends, the configuration of name servers is now part of `network-local-commands.service` (fixes issue [#445496](https://github.com/NixOS/nixpkgs/issues/445496)).
   - The issue that resulted in a completely unconfigured network if both `resolvconf` was disabled and no default gateway configured, has also been fixed.
 
-- `kratos` has been updated from 1.3.1 to [25.4.0](https://github.com/ory/kratos/releases/tag/v25.4.0). Upstream switched to a new versioning scheme (year.major.minor). Notable breaking changes:
-
-  - The `migrate sql` CLI command is now `migrate sql up`
-  - OIDC registration validation errors are now placed in the `default` node group instead of `oidc`
-  - Failed OIDC account linking returns HTTP 400 instead of 200
-
-- `pdns` has been updated to version [v5.0.x](https://doc.powerdns.com/authoritative/changelog/5.0.html), which introduces breaking changes. Check out the [Upgrade Notes](https://doc.powerdns.com/authoritative/upgrading.html#to-5-0-0) for details.
-
 - In the PowerDNS Recursor module, following the deprecation period started with NixOS 25.05, the option {option}`services.pdns-recursor.old-settings` has been removed and {option}`services.pdns-recursor.yaml-settings` consequently renamed to [](#opt-services.pdns-recursor.settings).
 
-- `services.angrr` now uses TOML for configuration. Define policies with `services.angrr.settings` (generate TOML file) or point to a file using `services.angrr.configFile`. The legacy options `services.angrr.period`, `services.angrr.ownedOnly`, and `services.angrr.removeRoot` have been removed. See `man 5 angrr` and the description of `services.angrr.settings` options for examples and details.
+- [services.angrr](#opt-services.angrr.enable) now uses TOML for configuration. Define policies with [](#opt-services.angrr.settings) (generate TOML file) or point to a file using [](#opt-services.angrr.configFile). The legacy options `services.angrr.period`, `services.angrr.ownedOnly`, and `services.angrr.removeRoot` have been removed. See `man 5 angrr` and the description of [](#opt-services.angrr.settings) options for examples and details.
 
-- `services.homepage-dashboard.environmentFile` has been renamed to `services.homepage-dashboard.environmentFiles`, and now expects a list of strings.
+- `services.homepage-dashboard.environmentFile` has been renamed to [](#opt-services.homepage-dashboard.environmentFiles), and now expects a list of strings.
 
 - `services.pingvin-share` has been removed as the `pingvin-share.backend` package was broken and the project was archived upstream.
 
-- `geph` package's built-in GUI `geph5-client-gui` has been [removed](https://github.com/geph-official/geph5/commit/f2221fb8386312daf2cef05483ebb353ff48bdb4) by the upstream. All users who wish to continue using the GUI should install the `gephgui-wry`, which is consistent with the official release version.
-
-- `services.jellyseerr` has been renamed to `services.seerr` following the upstream changes. Notable breaking changes:
+- `services.jellyseerr` has been renamed to [services.seerr](#opt-services.seerr.enable) following the upstream changes. Notable breaking changes:
   - systemd service name changed accordingly.
   - Default config directory moved from `/var/lib/jellyseerr/config` to `/var/lib/seerr/`.
     - If `stateVersion` is older than `26.05`, the module fall backs to the legacy path value.
 
-- `services.vikunja` has been updated to Vikunja [v1.0.0](https://vikunja.io/changelog/whats-new-in-vikunja-1.0.0/), which introduces multiple breaking changes.
+- [services.vikunja](#opt-services.vikunja.enable) has been updated to Vikunja [v1.0.0](https://vikunja.io/changelog/whats-new-in-vikunja-1.0.0/), which introduces multiple breaking changes.
   Notable breaking changes:
   - CORS is enabled by default. The module now sets
     `services.vikunja.settings.service.publicurl` by default. Custom overrides must ensure it is
@@ -391,16 +394,11 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
   - SQLite paths are now relative to `service.rootpath` unless absolute. Startup now validates file
     storage and OAuth providers.
 
-- `xfsprogs` was updated to version 6.18.0, which enables parent pointers and exchange-range by default. Upstream recommends not to use these features with kernels older than 6.18.
-   GRUB2 is likely unable to boot from filesystems with these features enabled.
-
 - `services.xtreemfs` has been removed as the `xtreemfs` package was broken and unmaintained upstream.
 
-- `lunarvim` package has been removed, as it was abandoned upstream and relied on an old version of `neovim` to work properly.
-
 - `opengfw` package and `services.opengfw` module have been removed as the upstream GitHub repository and website have been shut down.
 
-- `services.esphome` no longer uses `DynamicUser`. The service now runs as a static `esphome` system user. systemd handles the migration from `/var/lib/private/esphome` automatically, but users with [impermanence](https://github.com/nix-community/impermanence) setups should ensure `/var/lib/esphome` is persisted.
+- [services.esphome](#opt-services.esphome.enable) no longer uses `DynamicUser`. The service now runs as a static `esphome` system user. systemd handles the migration from `/var/lib/private/esphome` automatically, but users with [impermanence](https://github.com/nix-community/impermanence) setups should ensure `/var/lib/esphome` is persisted.
 
 - `programs.pqos-wrapper` module has been deleted as the corresponding package has been dropped from nixpkgs.
 
@@ -410,6 +408,10 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- Reloading or restarting systemd units from the NixOS activation script is deprecated, and will be removed in NixOS 26.11. This deprecation is part of a bigger effort to deprecate activation scripts altogether, which will take place over several releases. There are no in-tree usages of the now-deprecated reload/restart functionality.
+
+- Switch inhibitors were introduced, which add a pre-switch check that compares a list of strings between the previous and the new generation, and refuses to switch into the new generation when there is a difference between the two lists. This allows avoiding switching into a system when for instance the systemd version changed by adding `config.systemd.package.version` to the switch inhibitors for your system. You can still forcefully switch into any generation by setting `NIXOS_NO_CHECK=1`.
+
 - `switch-to-configuration` now reloads a service instead of restarting it when the only change to its unit is `ExecReload=`, and takes no action when `ExecReload=` is removed. Previously both cases triggered a restart.
 
 - [`hardware.nvidia.branch`](#opt-hardware.nvidia.branch) was added to select the NVIDIA driver branch; setting [`hardware.nvidia.package`](#opt-hardware.nvidia.package) overrides this.
@@ -418,12 +420,10 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
 
 - `nixos/nvidia` now uses EGL external platform ICD libraries built from source (`egl-gbm`, `egl-wayland`, `egl-wayland2`, `egl-x11`) instead of relying on vendor-provided binaries for these components.
 
-- `hardware.nvidia.moduleParams` was added to configure NVIDIA kernel module parameters declaratively. These parameters are now written to `modprobe` configuration instead of being passed through global kernel command-line parameters.
+- [](#opt-hardware.nvidia.moduleParams) was added to configure NVIDIA kernel module parameters declaratively. These parameters are now written to `modprobe` configuration instead of being passed through global kernel command-line parameters.
 
 - [hardware.xpadneo](#opt-hardware.xpadneo.enable) now supports configuring kernel module parameters via a freeform [settings](#opt-hardware.xpadneo.settings) option, with convenience options for [rumble attenuation](#opt-hardware.xpadneo.rumbleAttenuation) and [controller quirks](#opt-hardware.xpadneo.quirks).
 
-- Wine has been updated to the 11.0 branch. Please check the [upstream announcement](https://gitlab.winehq.org/wine/wine/-/releases/wine-11.0) for more details.
-
 - `security.acme` now defaults to a dynamic renewal duration, if
   [security.acme.defaults.validMinDays](#opt-security.acme.defaults.validMinDays)
   remains unset. This accommodates certificates with different ACME profile:
@@ -433,44 +433,37 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
     - For shortlived certificates with a total validity below 10 days renewal
       will happen after half of the total lifetime has passed
 
-- The module for the Dovecot IMAP server, *services.dovecot*, now uses RFC-42-style settings, exposing a structured interface to write the configuration file.
+- The module for the Dovecot IMAP server, [services.dovecot2](#opt-services.dovecot2.enable), now uses RFC-42-style settings, exposing a structured interface to write the configuration file.
 
   Also see the list of available settings for [Dovecot 2.3](https://doc.dovecot.org/2.3/settings/core/) or [2.4](https://doc.dovecot.org/2.4.2/core/summaries/settings.html).
 
-- Cinnamon has been updated to 6.6, please check the [upstream announcement](https://www.linuxmint.com/rel_zena_whatsnew.php) for more details.
+- [](#opt-fonts.fontconfig.useEmbeddedBitmaps) is now set to `true` by default.
 
-- Rspamd has been updated to 4.0. Please check the upstream [migration](https://docs.rspamd.com/tutorials/migration/#migration-to-rspamd-400) documentation, especially if you run a sharded Redis deployment.
-
-- Budgie has been updated to 10.10, please check the [upstream announcement](https://buddiesofbudgie.org/blog/budgie-10-10-released) for more details.
-
-- `fonts.fontconfig.useEmbeddedBitmaps` is now set to `true` by default.
-
-- `stestrCheckHook` was added: This test hook runs `stestr run`. You can disable tests with `disabledTests` and `disabledTestsRegex`.
-
-- `services.frp` now supports multiple instances through `services.frp.instances` to make it possible to run multiple frp clients or servers at the same time.
-
-- `hyphen` now supports over 40 language variants through `hyphenDicts` and now allows to enable all supported languages through `hyphenDicts.all`.
+- [services.frp](#opt-services.frp.instances) now supports multiple instances through [](#opt-services.frp.instances) to make it possible to run multiple frp clients or servers at the same time.
 
 - [services.resolved](#opt-services.resolved.enable) module was converted to RFC42-style settings. The moved options have also been renamed to match the upstream names. Aliases mean current configs will continue to function, but users should move to the new options as convenient.
 
-- `systemd.sleep.extraConfig` was replaced by [RFC 0042](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md)-compliant `systemd.sleep.settings.Sleep`, which is used to generate the `sleep.conf` configuration file. See {manpage}`sleep.conf.d(5)` for available options.
+- `systemd.sleep.extraConfig` was replaced by [RFC 0042](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md)-compliant [](#opt-systemd.sleep.settings.Sleep), which is used to generate the `sleep.conf` configuration file. See {manpage}`sleep.conf.d(5)` for available options.
 
-- Support for Bluetooth audio based on `bluez-alsa` has been added to the `hardware.alsa` module. It can be enabled with the new [enableBluetooth](#opt-hardware.alsa.enableBluetooth) option.
-- `services.atuin` now has an `environmentFile` option to safely allow configuring secrets, such as an `ATUIN_DB_URI` containing a Postgres password.
+- Support for Bluetooth audio based on `bluez-alsa` has been added to the [hardware.alsa](#opt-hardware.alsa.enable) module. It can be enabled with the new [enableBluetooth](#opt-hardware.alsa.enableBluetooth) option.
+
+- [services.atuin](#opt-services.atuin.enable) now has an `environmentFile` option to safely allow configuring secrets, such as an `ATUIN_DB_URI` containing a Postgres password.
 
 - `systemd.network.*` has been updated to support all configuration options from upstream `networkd` version 259.
 
-- `networking.resolvconf.enable` now defaults to `true` unconditionally instead of `!(config.environment.etc ? "resolv.conf")`. If you set `environment.etc."resolv.conf"` yourself, then you should also set `networking.resolvconf.enable = false`.
+- [](#opt-networking.resolvconf.enable) now defaults to `true` unconditionally instead of `!(config.environment.etc ? "resolv.conf")`. If you set `environment.etc."resolv.conf"` yourself, then you should also set `networking.resolvconf.enable = false`.
 
-- `services.openssh` now supports generating host SSH keys by setting `services.openssh.generateHostKeys = true` while leaving `services.openssh.enable` disabled.  This is particularly useful for systems that have no need of an SSH daemon but want SSH host keys for other purposes such as using agenix or sops-nix.
+- The [services.drupal](#opt-services.drupal.enable) module has a few improvements aimed at making it better for installing custom Drupal instances, namely a new `webRoot` option for identifying custom webroots in source code, a new `configRoot` option for identifying and synchronizing config yamls onto NixOS, and some new settings for managing variable content and filepaths.
 
-- `services.openssh.enableRecommendedAlgorithms` has been added to allow users to opt out of NixOS's curated set of recommended algorithms. This set to true by default, and thus is not a breaking change. Users may want to set this to false if they prefer upstream's default algorithms. See <https://github.com/NixOS/nixpkgs/pull/471330>.
+- [services.openssh](#opt-services.openssh.enable) now supports generating host SSH keys by setting `services.openssh.generateHostKeys = true` while leaving [](#opt-services.openssh.enable) disabled.  This is particularly useful for systems that have no need of an SSH daemon but want SSH host keys for other purposes such as using agenix or sops-nix.
 
-- `services.openssh.banner` has been removed. Use `services.openssh.settings.Banner` instead.
+- [](#opt-services.openssh.enableRecommendedAlgorithms) has been added to allow users to opt out of NixOS's curated set of recommended algorithms. This set to true by default, and thus is not a breaking change. Users may want to set this to false if they prefer upstream's default algorithms. See <https://github.com/NixOS/nixpkgs/pull/471330>.
 
-- IPVLAN interfaces can now be configured through the `networking.ipvlans` option in the networking module.
+- `services.openssh.banner` has been removed. Use [](#opt-services.openssh.settings.Banner) instead.
 
-- `services.caddy` now supports setting `httpPort` and `httpsPort` and opening them in the firewall via `openFirewall`.
+- IPVLAN interfaces can now be configured through the [](#opt-networking.ipvlans) option in the networking module.
+
+- [services.caddy](#opt-services.caddy.enable) now supports setting [](#opt-services.caddy.httpPort) and [](#opt-services.caddy.httpsPort) and opening them in the firewall via [](#opt-services.caddy.openFirewall).
 
 - The latest available version of Nextcloud is v33 (available as `pkgs.nextcloud33`). The installation logic is as follows:
   - If [`services.nextcloud.package`](#opt-services.nextcloud.package) is specified explicitly, this package will be installed (**recommended**)
@@ -483,59 +476,19 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
   To keep the old behavior for a site `example.com`, set `services.caddy.virtualHosts."example.com".hostName = "http://example.com"`.
   If you set custom Caddy options for a InvoicePlane site, migrate these options by removing `http://` from `services.caddy.virtualHosts."http://example.com"`.
 
-- `services.slurm` now supports slurmrestd usage through the `services.slurm.rest` NixOS options.
+- `services.slurm` now supports slurmrestd usage through the [](#opt-services.slurm.rest.enable) NixOS options.
 
-- The `networking.firewall.logRefusedConnections` option now defaults to
+- The [](#opt-networking.firewall.logRefusedConnections) option now defaults to
   `false`.  Logging of refused or dropped incoming connections can generate a
   very high volume of kernel log messages on internet-facing systems, causing
   the kernel ring buffer (dmesg) to rotate quickly and potentially discard more
   relevant diagnostic information.
 
-- The `services.calibre-web` systemd service has been hardened with additional sandboxing restrictions.
+- The [services.calibre-web](#opt-services.calibre-web.enable) systemd service has been hardened with additional sandboxing restrictions.
 
 - `services.kanidm` options for server, client and unix were moved under dedicated namespaces.
   For each component `enableComponent` and `componentSettings` are now `component.enable` and
   `component.settings`. The unix module now supports using SSH keys from Kanidm via
   `services.kanidm.unix.sshIntegration = true`.
 
-- `mdbook-linkcheck` has been removed as it is unmaintained and incompatible with the latest version of `mdbook`. Users can instead migrate to `mdbook-linkcheck2`.
-
-- `glibc` has been updated to version 2.42.
-
-  This version no longer makes the stack executable when a shared library requires this. A symptom
-  is an error like
-
-  > cannot enable executable stack as shared object requires: Invalid argument
-
-  This is usually a bug. Please consider reporting it to the software maintainers.
-
-  In a lot of cases, the library requires the execstack by mistake only. The following workarounds exist:
-
-  * When building the shared library in question from source, use the following linker flags to force turning off the
-    executable flag:
-
-    ```nix
-    mkDerivation {
-      # …
-
-      env.NIX_LDFLAGS = "-z,noexecstack";
-    }
-    ```
-
-  * If the sources are not available, the execstack-flag can be cleared with `patchelf`:
-
-    ```
-    patchelf --clear-execstack binary-only.so
-    ```
-
-  * If the shared library to be loaded actually requires an executable stack and it isn't turned
-    on by the application loading it, you may force allowing that behavior by setting the
-    following environment variable:
-
-    ```
-    GLIBC_TUNABLES=glibc.rtld.execstack=2
-    ```
-
-    **Do not set this globally!** This makes your setup inherently less secure.
-
-- `services.radicle` now supports importing the private key and passphrase as systemd creds.
+- [services.radicle](#opt-services.radicle.enable) now supports importing the private key and passphrase as systemd creds.

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -1,4 +1,4 @@
-# Release 26.11 ("Zokor", 2026.11/??) {#sec-release-26.11}
+# Release 26.11 (2026.11/??) {#sec-release-26.11}
 
 ## Highlights {#sec-release-26.11-highlights}
 
@@ -12,11 +12,15 @@
 
 - Create the first release note entry in this section!
 
+- [Nezha](https://github.com/nezhahq/nezha), a self-hosted, lightweight server and website monitoring and O&M tool. Available as [services.nezha](#opt-services.nezha.enable).
+
+- [FlapAlerted](https://github.com/Kioubit/FlapAlerted), detects BGP flapping events and provides statistics based on BGP update messages. Available as [services.flap-alerted](#opt-services.flap-alerted.enable).
+
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- `boot.vesa` has been removed. It was deprecated in 2020 because Xorg now works better with kernel modesetting. If you still need the legacy VESA 800x600 fallback, set `boot.kernelParams = [ "vga=0x317" "nomodeset" ];` directly.
+- Create the first release note entry in this section!
 
 ## Other Notable Changes {#sec-release-26.11-notable-changes}
 

nixos/lib/systemd-lib.nix

@@ -78,13 +78,16 @@ rec {
         {
           preferLocalBuild = true;
           allowSubstitutes = false;
-          text = unit.text or "";
-          __structuredAttrs = true;
+          # unit.text can be null. But variables that are null listed in
+          # passAsFile are ignored by nix, resulting in no file being created,
+          # making the mv operation fail.
+          text = optionalString (unit.text != null) unit.text;
+          passAsFile = [ "text" ];
         }
         ''
           name=${shellEscape name}
           mkdir -p "$out/$(dirname -- "$name")"
-          printf "%s" "$text" > "$out/$name"
+          mv "$textPath" "$out/$name"
         ''
     else
       pkgs.runCommand "unit-${mkPathSafeName name}-disabled"

nixos/lib/test-driver/src/test_driver/machine/__init__.py

@@ -1586,7 +1586,7 @@ class NspawnMachine(BaseMachine):
         # NOTE If the test calls switch-to-configuration (with a differently configured specialization)
         # this will use the /etc/profile of the new specialisation while `QemuMachine` nodes
         # will continue to use the original /etc/profile.
-        command = f"set -eo pipefail; source /etc/profile; set -u; {command}"
+        command = f"set -eo pipefail; USER=root HOME=/root source /etc/profile; set -u; {command}"
 
         cp = subprocess.run(
             [

nixos/lib/testing/network.nix

@@ -135,8 +135,13 @@ let
       );
       udevRules = map (
         interface:
-        # MAC Addresses for QEMU network devices are lowercase, and udev string comparison is case-sensitive.
-        ''SUBSYSTEM=="net",ACTION=="add",ATTR{address}=="${toLower (qemu-common.qemuNicMac interface.vlan config.virtualisation.test.nodeNumber)}",NAME="${interface.name}"''
+        lib.concatStringsSep ", " [
+          ''SUBSYSTEM=="net"''
+          ''ACTION=="add"''
+          # MAC Addresses for QEMU network devices are lowercase, and udev string comparison is case-sensitive.
+          ''ATTR{address}=="${toLower (qemu-common.qemuNicMac interface.vlan config.virtualisation.test.nodeNumber)}"''
+          ''NAME="${interface.name}"''
+        ]
       ) interfaces;
     in
     {

nixos/lib/utils.nix

@@ -14,6 +14,7 @@ let
     escapeShellArg
     filter
     flatten
+    foldl'
     getName
     hasPrefix
     hasSuffix
@@ -31,13 +32,13 @@ let
     nameValuePair
     optionalString
     removePrefix
-    removeSuffix
     replaceStrings
+    splitString
     stringToCharacters
     types
     ;
 
-  inherit (lib.strings) toJSON normalizePath escapeC;
+  inherit (lib.strings) toJSON escapeC;
 in
 
 let
@@ -98,26 +99,60 @@ let
       || hasPrefix a'.mountPoint b'.mountPoint
       || any (hasPrefix a'.mountPoint) b'.depends;
 
-    # Escape a path according to the systemd rules. FIXME: slow
+    # Escape a path according to the systemd rules.
     # The rules are described in systemd.unit(5) as follows:
     # The escaping algorithm operates as follows: given a string, any "/" character is replaced by "-", and all other characters which are not ASCII alphanumerics, ":", "_" or "." are replaced by C-style "\x2d" escapes. In addition, "." is replaced with such a C-style escape when it would appear as the first character in the escaped string.
     # When the input qualifies as absolute file system path, this algorithm is extended slightly: the path to the root directory "/" is encoded as single dash "-". In addition, any leading, trailing or duplicate "/" characters are removed from the string before transformation. Example: /foo//bar/baz/ becomes "foo-bar-baz".
     escapeSystemdPath =
-      s:
       let
+        # These don't depend on the path being escaped, so build them once
+        # rather than on every call.
+        escapeChar = escapeC (stringToCharacters " !\"#$%&'()*+,;<=>?@[\\]^`{|}~-");
+        escapeLeadingDot = escapeC [ "." ] ".";
+        slashesToDashes = replaceStrings [ "/" ] [ "-" ];
         replacePrefix =
           p: r: s:
-          (if (hasPrefix p s) then r + (removePrefix p s) else s);
-        trim = s: removeSuffix "/" (removePrefix "/" s);
-        normalizedPath = normalizePath s;
+          (if hasPrefix p s then r + removePrefix p s else s);
       in
-      replaceStrings [ "/" ] [ "-" ] (
-        replacePrefix "." (escapeC [ "." ] ".") (
-          escapeC (stringToCharacters " !\"#$%&'()*+,;<=>=@[\\]^`{|}~-") (
-            if normalizedPath == "/" then normalizedPath else trim normalizedPath
-          )
-        )
-      );
+      s:
+      let
+        isAbsolute = hasPrefix "/" s;
+        # path_simplify(): collapse duplicate slashes and drop "." components.
+        rawComponents = filter (c: c != "" && c != ".") (splitString "/" s);
+        # systemd accepts ".." only where it is redundant: a leading ".." in an
+        # absolute path refers to the root's parent, i.e. the root itself, and is
+        # dropped. Any other ".." cannot be resolved without the filesystem, so
+        # the path is not normalized and systemd-escape errors on it.
+        simplified =
+          foldl'
+            (
+              acc: c:
+              if c == ".." then
+                # A leading ".." in an absolute path is the only redundant case.
+                if isAbsolute && acc.components == [ ] then acc else acc // { normalized = false; }
+              else
+                acc // { components = acc.components ++ [ c ]; }
+            )
+            {
+              components = [ ];
+              normalized = true;
+            }
+            rawComponents;
+        notNormalized = throw "escapeSystemdPath: ${s} is not a normalized path";
+        simplifiedPath =
+          if !simplified.normalized then
+            notNormalized
+          else if simplified.components != [ ] then
+            concatStringsSep "/" simplified.components
+          # The root directory, and - matching systemd-escape - the empty string.
+          else if isAbsolute || s == "" then
+            "/"
+          # A relative path that reduces to nothing (e.g. "."), which has no
+          # valid escaping.
+          else
+            notNormalized;
+      in
+      slashesToDashes (replacePrefix "." escapeLeadingDot (escapeChar simplifiedPath));
 
     # Quotes an argument for use in Exec* service lines.
     # systemd accepts "-quoted strings with escape sequences, toJSON produces

nixos/modules/config/console.nix

@@ -217,7 +217,7 @@ in
           # When imperative, seed /etc/vconsole.conf on first boot from declared
           # defaults so the keymap isn't lost before localectl is ever used
           systemd.tmpfiles.rules = lib.mkIf i18nCfg.imperativeLocale [
-            "C /etc/vconsole.conf - - - - ${vconsoleConf true}"
+            "C /etc/vconsole.conf - - - - ${vconsoleConf}"
           ];
 
           systemd.services.reload-systemd-vconsole-setup = {

nixos/modules/config/fonts/packages.nix

@@ -47,6 +47,8 @@ in
         gyre-fonts # TrueType substitutes for standard PostScript fonts
         liberation_ttf
         unifont
+        noto-fonts-cjk-sans
+        noto-fonts-cjk-serif
         noto-fonts-color-emoji
       ]
     );

nixos/modules/config/nix-channel.nix

@@ -70,7 +70,7 @@ in
       defaultChannel = mkOption {
         internal = true;
         type = types.str;
-        default = "https://channels.nixos.org/nixos-unstable";
+        default = "https://channels.nixos.org/nixos-26.05";
         description = "Default NixOS channel to which the root user is subscribed.";
       };
     };

nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares-plasma6.nix

@@ -21,11 +21,6 @@
     };
   };
 
-  environment.systemPackages = [
-    # provide onscreen keyboard
-    pkgs.kdePackages.plasma-keyboard
-  ];
-
   environment.plasma6.excludePackages = [
     # Optional wallpapers that add 126 MiB to the graphical installer
     # closure. They will still need to be downloaded when installing a

nixos/modules/installer/cd-dvd/iso-image.nix

@@ -787,9 +787,10 @@ in
       options = [ "mode=0755" ];
     };
 
-    # Note that /dev/root is a symlink to the actual root device
-    # specified on the kernel command line, created in the stage 1
-    # init script.
+    # With systemd stage 1, the ISO is identified by its volume label.
+    # With the scripted stage 1, /dev/root is a symlink to the actual
+    # root device specified on the kernel command line, created by the
+    # stage 1 init script.
     "/iso" = lib.mkImageMediaOverride {
       device =
         if config.boot.initrd.systemd.enable then

nixos/modules/installer/tools/nixos-generate-config.pl

@@ -505,7 +505,7 @@ EOF
     # This should work for single and multi-device systems.
     # still needs subvolume support
     if ($fsType eq "bcachefs") {
-        my ($status, @info) = runCommand("@bcachefs@ fs usage $rootDir$mountPoint");
+        my ($status, @info) = runCommand("bcachefs fs usage $rootDir$mountPoint");
         my $UUID = $info[0];
 
         if ($status == 0 && $UUID =~ /^Filesystem:[ \t\n]*([0-9a-z-]+)/) {

nixos/modules/installer/tools/tools.nix

@@ -30,20 +30,15 @@ let
     name = "nixos-generate-config";
     src = ./nixos-generate-config.pl;
     replacements = {
-      perl = lib.getExe (
+      perl = "${
         pkgs.perl.withPackages (p: [
           p.FileSlurp
           p.ConfigIniFiles
         ])
-      );
+      }/bin/perl";
       hostPlatformSystem = pkgs.stdenv.hostPlatform.system;
-      detectvirt = lib.getExe' config.systemd.package "systemd-detect-virt";
-      bcachefs =
-        if pkgs.bcachefs-tools.meta.broken then
-          lib.getExe' pkgs.coreutils "false"
-        else
-          lib.getExe pkgs.bcachefs-tools;
-      btrfs = lib.getExe pkgs.btrfs-progs;
+      detectvirt = "${config.systemd.package}/bin/systemd-detect-virt";
+      btrfs = "${pkgs.btrfs-progs}/bin/btrfs";
       inherit (config.system.nixos-generate-config) configuration desktopConfiguration flake;
       xserverEnabled = config.services.xserver.enable;
     };

nixos/modules/misc/version.nix

@@ -51,6 +51,7 @@ let
       VENDOR_URL = optionalString isNixos "https://nixos.org/";
       DOCUMENTATION_URL = optionalString isNixos "https://nixos.org/learn.html";
       SUPPORT_URL = optionalString isNixos "https://nixos.org/community.html";
+      SUPPORT_END = "2026-12-31";
       BUG_REPORT_URL = optionalString isNixos "https://github.com/NixOS/nixpkgs/issues";
       ANSI_COLOR = optionalString isNixos "0;38;2;126;186;228";
       IMAGE_ID = optionalString (config.system.image.id != null) config.system.image.id;

nixos/modules/module-list.nix

@@ -733,7 +733,6 @@
   ./services/home-automation/home-assistant.nix
   ./services/home-automation/homebridge.nix
   ./services/home-automation/matter-server.nix
-  ./services/home-automation/matterjs-server.nix
   ./services/home-automation/openthread-border-router.nix
   ./services/home-automation/wyoming/faster-whisper.nix
   ./services/home-automation/wyoming/openwakeword.nix
@@ -888,6 +887,7 @@
   ./services/misc/ihaskell.nix
   ./services/misc/iio-niri.nix
   ./services/misc/input-remapper.nix
+  ./services/misc/inventree.nix
   ./services/misc/invidious-router.nix
   ./services/misc/irkerd.nix
   ./services/misc/jackett.nix
@@ -1018,6 +1018,7 @@
   ./services/monitoring/das_watchdog.nix
   ./services/monitoring/datadog-agent.nix
   ./services/monitoring/do-agent.nix
+  ./services/monitoring/flap-alerted.nix
   ./services/monitoring/fluent-bit.nix
   ./services/monitoring/fusion-inventory.nix
   ./services/monitoring/gatus.nix
@@ -1048,6 +1049,7 @@
   ./services/monitoring/nagios.nix
   ./services/monitoring/netdata.nix
   ./services/monitoring/nezha-agent.nix
+  ./services/monitoring/nezha.nix
   ./services/monitoring/ocsinventory-agent.nix
   ./services/monitoring/opentelemetry-collector.nix
   ./services/monitoring/osquery.nix

nixos/modules/programs/gamemode.nix

@@ -15,8 +15,6 @@ in
     programs.gamemode = {
       enable = lib.mkEnableOption "GameMode to optimise system performance on demand";
 
-      package = lib.mkPackageOption pkgs "gamemode" { };
-
       enableRenice =
         lib.mkEnableOption "CAP_SYS_NICE on gamemoded to support lowering process niceness"
         // {
@@ -55,7 +53,7 @@ in
 
   config = lib.mkIf cfg.enable {
     environment = {
-      systemPackages = [ cfg.package ];
+      systemPackages = [ pkgs.gamemode ];
       etc."gamemode.ini".source = configFile;
     };
 
@@ -65,14 +63,14 @@ in
         gamemoded = {
           owner = "root";
           group = "root";
-          source = "${cfg.package}/bin/gamemoded";
+          source = "${pkgs.gamemode}/bin/gamemoded";
           capabilities = "cap_sys_nice+ep";
         };
       };
     };
 
     systemd = {
-      packages = [ cfg.package ];
+      packages = [ pkgs.gamemode ];
       user.services.gamemoded = {
         # Use pkexec from the security wrappers to allow users to
         # run libexec/cpugovctl & libexec/gpuclockctl as root with

nixos/modules/programs/gamescope.nix

@@ -26,8 +26,6 @@ in
 
     package = lib.mkPackageOption pkgs "gamescope" { };
 
-    enableWsi = lib.mkEnableOption "gamescope-wsi, the Vulkan WSI layer, alongside gamescope";
-
     capSysNice = lib.mkOption {
       type = lib.types.bool;
       default = false;
@@ -78,11 +76,6 @@ in
     };
 
     environment.systemPackages = lib.mkIf (!cfg.capSysNice) [ gamescope ];
-
-    hardware.graphics = lib.optionalAttrs cfg.enableWsi {
-      extraPackages = with pkgs; [ gamescope-wsi ];
-      extraPackages32 = with pkgs; [ pkgsi686Linux.gamescope-wsi ];
-    };
   };
 
   meta.maintainers = [ ];

nixos/modules/programs/sniffnet.nix

@@ -17,6 +17,8 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.sniffnet ];
+
     security.wrappers.sniffnet = {
       owner = "root";
       group = "root";

nixos/modules/programs/throne.nix

@@ -23,7 +23,7 @@ in
         enable = lib.mkEnableOption "TUN mode of Throne";
 
         setuid = lib.mkEnableOption ''
-          setting suid bit for ThroneCore to run as root, which is less
+          setting suid bit for throne-core to run as root, which is less
           secure than default setcap method but closer to upstream assumptions.
           Enable this if you find the default setcap method configured in
           this module doesn't work for you
@@ -36,8 +36,8 @@ in
 
     environment.systemPackages = [ cfg.package ];
 
-    security.wrappers."ThroneCore" = lib.mkIf cfg.tunMode.enable {
-      source = "${cfg.package}/share/throne/ThroneCore";
+    security.wrappers.throne-core = lib.mkIf cfg.tunMode.enable {
+      source = "${cfg.package}/share/throne/Core";
       owner = "root";
       group = "root";
       setuid = lib.mkIf cfg.tunMode.setuid true;
@@ -49,7 +49,7 @@ in
 
     # avoid resolvectl password prompt popping up three times
     # https://github.com/SagerNet/sing-tun/blob/0686f8c4f210f4e7039c352d42d762252f9d9cf5/tun_linux.go#L1062
-    # We use a hack here to determine whether the requested process is ThroneCore
+    # We use a hack here to determine whether the requested process is throne-core
     # Detect whether its capabilities contain at least `net_admin` and `net_raw`.
     # This does not reduce security, as we can already bypass `resolved` with them.
     # Alternatives to consider:
@@ -61,7 +61,7 @@ in
     #    change its own cmdline. `/proc/<pid>/exe` is reliable but kernel forbids
     #    checking that entry of process from different users, and polkit runs `spawn`
     #    as an unprivileged user.
-    # 3. Put ThroneCore into a systemd service, and let polkit check service name.
+    # 3. Put throne-core into a systemd service, and let polkit check service name.
     #    This is the most secure and convenient way but requires heavy modification
     #    to Throne source code. Would be good to let upstream support that eventually.
     security.polkit.extraConfig =
@@ -69,7 +69,6 @@ in
         ''
           polkit.addRule(function(action, subject) {
             const allowedActionIds = [
-              "org.freedesktop.resolve1.revert",
               "org.freedesktop.resolve1.set-domains",
               "org.freedesktop.resolve1.set-default-route",
               "org.freedesktop.resolve1.set-dns-servers"

nixos/modules/programs/zsh/zsh.nix

@@ -249,8 +249,8 @@ in
         setopt ${builtins.concatStringsSep " " cfg.setOptions}
       ''}
 
-      # Determine current fqdn hostname
-      HOST=$(hostname --fqdn)
+      # Alternative method of determining short and full hostname.
+      HOST=${config.networking.fqdnOrHostName}
 
       # Setup command line history.
       # Don't export these, otherwise other shells (bash) will try to use same HISTFILE.

nixos/modules/security/default.nix

@@ -1,4 +1,8 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 let
   cfg = config.security;
 in
@@ -16,10 +20,16 @@ in
   config = lib.mkMerge [
     {
       # We set the default LSM's here due to them not being present if set when enabling AppArmor.
-      security.lsm = [
-        "landlock"
-        "yama"
-        "bpf"
+      security.lsm = lib.mkMerge [
+        [
+          "landlock"
+          "yama"
+        ]
+        # Load BPF last unconditionally. See: https://github.com/NixOS/nixpkgs/pull/533428.
+        # Apparmor (and potentially other modules) will load incorrectly if they are not before BPF.
+        # It is believed that there was a regression between kernel 6.12 and 6.18 which caused the
+        # passthrough stub or LSM stacking of the BPF module to interact with other modules incorrectly.
+        (lib.mkAfter [ "bpf" ])
       ];
     }
     (lib.mkIf (lib.lists.length cfg.lsm > 0) {

nixos/modules/security/pam.nix

@@ -8,21 +8,6 @@
   ...
 }:
 let
-  inherit (lib)
-    attrNames
-    catAttrs
-    concatLines
-    concatMap
-    filter
-    unique
-    flip
-    elem
-    attrValues
-    concatMapStrings
-    hasPrefix
-    concatStringsSep
-    sort
-    ;
 
   moduleSettingsType =
     with lib.types;
@@ -896,30 +881,41 @@ let
 
         text =
           let
+            ensureUniqueOrder =
+              type: rules:
+              let
+                checkPair =
+                  a: b:
+                  assert lib.assertMsg (a.order != b.order)
+                    "security.pam.services.${name}.rules.${type}: rules '${a.name}' and '${b.name}' cannot have the same order value (${toString a.order})";
+                  b;
+                checked = lib.zipListsWith checkPair rules (lib.drop 1 rules);
+              in
+              lib.take 1 rules ++ checked;
             # Formats a string for use in `module-arguments`. See `man pam.conf`.
             formatModuleArgument =
               token: if lib.hasInfix " " token then "[${lib.replaceStrings [ "]" ] [ "\\]" ] token}]" else token;
-
             formatRules =
               type:
-              concatStringsSep "\n" (
-                map
-                  (
-                    rule:
-                    "${type} ${rule.control} ${rule.modulePath}${
-                      if rule.args == [ ] then "" else " " + concatStringsSep " " (map formatModuleArgument rule.args)
-                    } # ${rule.name} (order ${toString rule.order})"
+              lib.pipe cfg.rules.${type} [
+                lib.attrValues
+                (lib.filter (rule: rule.enable))
+                (lib.sort (a: b: a.order < b.order))
+                (ensureUniqueOrder type)
+                (map (
+                  rule:
+                  lib.concatStringsSep " " (
+                    [
+                      type
+                      rule.control
+                      rule.modulePath
+                    ]
+                    ++ map formatModuleArgument rule.args
+                    ++ [ "# ${rule.name} (order ${toString rule.order})" ]
                   )
-                  (
-                    sort (
-                      a: b:
-                      if a.order != b.order then
-                        a.order < b.order
-                      else
-                        throw "security.pam.services.${name}.rules.${type}: rules '${a.name}' and '${b.name}' cannot have the same order value (${toString a.order})"
-                    ) (filter (rule: rule.enable) (attrValues cfg.rules.${type}))
-                  )
-              );
+                ))
+                (lib.concatStringsSep "\n")
+              ];
           in
           lib.mkDefault ''
             # Account management.
@@ -2641,29 +2637,35 @@ in
     };
 
     security.apparmor.includes."abstractions/pam" =
-      concatMapStrings (name: "r ${config.environment.etc."pam.d/${name}".source},\n") (
-        attrNames enabledServices
+      lib.concatMapStrings (name: "r ${config.environment.etc."pam.d/${name}".source},\n") (
+        lib.attrNames enabledServices
       )
       + (
-        let
-          types = concatMap attrValues (catAttrs "rules" (attrValues enabledServices));
-          rules = concatMap attrValues types;
-
-          isDirect = flip elem [
-            "include"
-            "substack"
-          ];
-          activeRules = filter (rule: rule.enable && !isDirect rule.control) rules;
-
-          modulePaths = concatMap (
+        with lib;
+        pipe enabledServices [
+          lib.attrValues
+          (catAttrs "rules")
+          (lib.concatMap lib.attrValues)
+          (lib.concatMap lib.attrValues)
+          (lib.filter (rule: rule.enable))
+          (lib.filter (
             rule:
-            if (!hasPrefix "/" rule.modulePath) then
-              throw ''non-absolute PAM modulePath "${rule.modulePath}" is unsupported by apparmor''
-            else
-              [ rule.modulePath ]
-          ) activeRules;
-        in
-        concatLines (map (module: "mr ${module},") (unique modulePaths))
+            !builtins.elem rule.control [
+              "include"
+              "substack"
+            ]
+          ))
+          (lib.catAttrs "modulePath")
+          (map (
+            modulePath:
+            lib.throwIfNot (lib.hasPrefix "/" modulePath)
+              ''non-absolute PAM modulePath "${modulePath}" is unsupported by apparmor''
+              modulePath
+          ))
+          lib.unique
+          (map (module: "mr ${module},"))
+          concatLines
+        ]
       );
 
     security.sudo.extraConfig = optionalSudoConfigForSSHAgentAuth;

nixos/modules/services/databases/mysql.nix

@@ -293,6 +293,19 @@ in
         '';
       };
 
+      secureSuperUserByDefault = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = ''
+          Whether to automatically secure the root@localhost user with auth_socket authentication.
+
+          ::: {.note}
+          When enabled (default), the module will ensure root@localhost uses socket authentication,
+          preventing any local user from connecting as root without proper credentials.
+          :::
+        '';
+      };
+
       replication = {
         role = lib.mkOption {
           type = lib.types.enum [
@@ -411,6 +424,10 @@ in
         assertion = !cfg.galeraCluster.enable || isMariaDB;
         message = "'services.mysql.galeraCluster.enable' expect services.mysql.package to be an mariadb variant";
       }
+      {
+        assertion = !isMariaDB || cfg.secureSuperUserByDefault == true;
+        message = "'services.mysql.secureSuperUserByDefault' has no effect on MariaDB (which is already secure by default)";
+      }
     ]
     # galeraCluster options checks
     ++ lib.optionals cfg.galeraCluster.enable [
@@ -571,6 +588,7 @@ in
         let
           # The super user account to use on *first* run of MySQL server
           superUser = if isMariaDB then cfg.user else "root";
+          isStateVersion2611Plus = lib.versionAtLeast config.system.stateVersion "26.11";
         in
         ''
           ${lib.optionalString isMariaDB ''
@@ -651,9 +669,35 @@ in
                 cat ${toString cfg.initialScript} | ${cfg.package}/bin/mysql -u ${superUser} -N
               ''}
 
+              # Secure root@localhost for MySQL/Percona on first initialization
+              ${lib.optionalString (cfg.secureSuperUserByDefault && !isMariaDB) ''
+                echo "ALTER USER root@localhost IDENTIFIED WITH auth_socket;" | ${cfg.package}/bin/mysql -u ${superUser} -N
+              ''}
+
               rm ${cfg.dataDir}/mysql_init
           fi
 
+          ${lib.optionalString (cfg.secureSuperUserByDefault && !isMariaDB) ''
+            # We try to detect if we are in the default insecure auth mode for MySQL (all users can connect with password)
+            # If the configuration has been moved to the socket-peer credential authentication we do nothing
+            # If we are not able to connect it also means the default setup has been adjusted, so we also skip and do not do any changes
+            if plugin_info=$(${cfg.package}/bin/mysql -u ${superUser} --skip-column-names 2>/dev/null -e "SELECT plugin FROM mysql.user WHERE user = 'root' AND host = 'localhost';"); then
+              case "$plugin_info" in
+                *auth_socket*) ;;
+                *)
+                  ${lib.optionalString isStateVersion2611Plus ''
+                    # Attempt to auto-fix to prevent local authentication without a password
+                    echo "Securing root@localhost with auth_socket to local connection without password, see https://github.com/NixOS/nixpkgs/security/advisories/GHSA-6qxx-6rg8-c4p8" >&2
+                    echo "ALTER USER root@localhost IDENTIFIED WITH auth_socket;" | ${cfg.package}/bin/mysql -u ${superUser} -N
+                  ''}
+                  ${lib.optionalString (!isStateVersion2611Plus) ''
+                    echo "Security warning: root@localhost seems to have open authentication, consider adjusting your configuration. See https://github.com/NixOS/nixpkgs/security/advisories/GHSA-6qxx-6rg8-c4p8" >&2
+                  ''}
+                  ;;
+              esac
+            fi
+          ''}
+
           ${lib.optionalString (cfg.ensureDatabases != [ ]) ''
             (
             ${lib.concatMapStrings (database: ''

nixos/modules/services/desktop-managers/pantheon.nix

@@ -276,8 +276,7 @@ in
         ++ (with pkgs.pantheon; [
           elementary-files
           elementary-settings-daemon
-          # https://github.com/elementary/portals/issues/157
-          # xdg-desktop-portal-pantheon
+          xdg-desktop-portal-pantheon
         ])
       ) config.environment.pantheon.excludePackages;
 

nixos/modules/services/desktop-managers/plasma6.nix

@@ -169,6 +169,9 @@ in
           krdp
           kconfig # required for xdg-terminal from xdg-utils
           qtbase # for qtpaths which is required for xdg-mime from xdg-utils
+          # touch keyboard
+          plasma-keyboard
+          qtvirtualkeyboard # used by plasma-keyboard KCM
         ]
         ++ lib.optional config.networking.networkmanager.enable qrca
         ++ lib.optionals config.hardware.sensor.iio.enable [

nixos/modules/services/display-managers/cosmic-greeter.nix

@@ -26,7 +26,6 @@ in
   config = lib.mkIf cfg.enable {
     environment.systemPackages = [
       pkgs.cosmic-comp
-      pkgs.cosmic-icons
       cfg.package
     ];
 

nixos/modules/services/display-managers/default.nix

@@ -101,16 +101,7 @@ in
       };
 
       defaultSession = lib.mkOption {
-        type = lib.types.nullOr lib.types.str // {
-          description = "session name";
-          check =
-            d:
-            lib.assertMsg (d != null -> (lib.types.str.check d && lib.elem d cfg.sessionData.sessionNames)) ''
-              Default graphical session, '${d}', not found.
-              Valid names for 'services.displayManager.defaultSession' are:
-                ${lib.concatStringsSep "\n  " cfg.sessionData.sessionNames}
-            '';
-        };
+        type = lib.types.nullOr (lib.types.str // { description = "session name"; });
         default = null;
         example = "gnome";
         description = ''
@@ -130,26 +121,12 @@ in
 
       sessionPackages = lib.mkOption {
         type = lib.types.listOf (
-          lib.types.package
+          lib.types.addCheck lib.types.package (
+            p: p ? providedSessions && p.providedSessions != [ ] && lib.all lib.isString p.providedSessions
+          )
           // {
             description = "package with provided sessions";
-            check =
-              p:
-              lib.assertMsg
-                (
-                  lib.types.package.check p
-                  && p ? providedSessions
-                  && p.providedSessions != [ ]
-                  && lib.all lib.isString p.providedSessions
-                )
-                ''
-                  Package, '${p.name}', did not specify any session names, as strings, in
-                  'passthru.providedSessions'. This is required when used as a session package.
-
-                  The session names can be looked up in:
-                    ${p}/share/xsessions
-                    ${p}/share/wayland-sessions
-                '';
+            descriptionClass = "composite";
           }
         );
         default = [ ];
@@ -211,6 +188,14 @@ in
           services.displayManager.autoLogin.enable requires services.displayManager.autoLogin.user to be set
         '';
       }
+      {
+        assertion = cfg.defaultSession == null || lib.elem cfg.defaultSession cfg.sessionData.sessionNames;
+        message = ''
+          Default graphical session, '${toString cfg.defaultSession}', not found.
+          Valid names for 'services.displayManager.defaultSession' are:
+            ${lib.concatStringsSep "\n    " cfg.sessionData.sessionNames}
+        '';
+      }
     ];
 
     # Make xsessions and wayland sessions available in XDG_DATA_DIRS