stdenv-bootstrap-tools: Fix lib*_asneeded problem on gcc16 (#545658)

(texlive-bin-big is not a real attribute, but it does not appear to be
actually exposed as an attribute. we're building this as a dependency of
`texlivePackages.texlive-scripts`.)

autoconf 2.72 has a bug where AC_PROG_CXX would reject c++20 compilers,
and attempts to switch to c++98 or c++11 instead of using the compiler's
default. when using gcc 16, which defaults to c++20, this causes
texlive-bin-big to be built with c++20, causing issues with some of the
included icu4c headers. this bug was fixed in autoconf 2.73, so we
regenerate the autoconf declarations with the newest version of autconf
(currently 2.73). once the configure scripts distributed with the source
are regenerated with autoconf 2.73+, the `reautoconf` call should be
removed.

.editorconfig

@@ -23,15 +23,15 @@ insert_final_newline = false
 
 # see https://nixos.org/nixpkgs/manual/#chap-conventions
 
-[*.{bash,css,js,json,lock,md,nix,pl,pm,py,rb,sh,ts,xml}]
+[*.{bash,css,js,json,lock,md,nix,pl,pm,py,rb,sh,xml}]
 indent_style = space
 
 # Match docbook files, set indent width of one
 [*.xml]
 indent_size = 1
 
-# Match js/json/lockfiles/markdown/nix/ruby/ts files, set indent width of two
-[*.{js,json,lock,md,nix,rb,ts}]
+# Match json/lockfiles/markdown/nix/ruby files, set indent width of two
+[*.{js,json,lock,md,nix,rb}]
 indent_size = 2
 
 # Match all the Bash code in Nix files, set indent width of two

.github/actions/checkout/action.yml

@@ -13,7 +13,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+    - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
       env:
         MERGED_SHA: ${{ inputs.merged-as-untrusted-at }}
         TARGET_SHA: ${{ inputs.target-as-trusted-at }}

.github/dependabot.yml

@@ -1,9 +1,7 @@
 version: 2
 updates:
   - package-ecosystem: "github-actions"
-    directories:
-      - "/"
-      - ".github/actions/*/*"
+    directory: "/"
     schedule:
       interval: "weekly"
     labels: []

.github/labeler.yml

@@ -43,6 +43,14 @@
               - .github/**/*
               - ci/**/*.*
 
+"6.topic: coq":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - pkgs/applications/science/logic/coq/**/*
+              - pkgs/development/coq-modules/**/*
+              - pkgs/top-level/coq-packages.nix
+
 "6.topic: COSMIC":
   - any:
       - changed-files:
@@ -458,18 +466,6 @@
           - any-glob-to-any-file:
               - pkgs/development/rocm-modules/**/*
 
-"6.topic: rocq":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/applications/science/logic/coq/**/*
-              - pkgs/applications/science/logic/rocq-core/**/*
-              - pkgs/build-support/coq/**/*
-              - pkgs/build-support/rocq/**/*
-              - pkgs/development/rocq-modules/**/*
-              - pkgs/top-level/coq-packages.nix
-              - pkgs/top-level/rocq-packages.nix
-
 "6.topic: ruby":
   - any:
       - changed-files:

.github/workflows/backport.yml

@@ -39,8 +39,6 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ github.event.pull_request.head.sha }}
-          # Avoid materializing full nixpkgs tree
-          sparse-checkout: .
           token: ${{ steps.app-token.outputs.token }}
           persist-credentials: true
 

.github/workflows/bot.yml

@@ -88,7 +88,7 @@ jobs:
           GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
         run: gh api /rate_limit | jq
 
-      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
+      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
         name: Labels from touched files
         if: |
           github.event_name == 'pull_request_target' &&
@@ -98,7 +98,7 @@ jobs:
           configuration-path: .github/labeler.yml # default
           sync-labels: true
 
-      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
+      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
         name: Labels from touched files (no sync)
         if: |
           github.event_name == 'pull_request_target' &&
@@ -108,7 +108,7 @@ jobs:
           configuration-path: .github/labeler-no-sync.yml
           sync-labels: false
 
-      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
+      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
         name: Labels from touched files (development branches)
         # Development branches like staging-next, haskell-updates and python-updates get special labels.
         # This is to avoid the mass of labels there, which is mostly useless - and really annoying for

.github/workflows/eval.yml

@@ -375,7 +375,7 @@ jobs:
         with:
           github-token: ${{ steps.app-token.outputs.token || github.token }}
           script: |
-            require('./nixpkgs/trusted/ci/github-script/check-target-branch.ts')({
+            require('./nixpkgs/trusted/ci/github-script/check-target-branch.js')({
               github,
               context,
               core,

.github/workflows/test.yml

@@ -77,7 +77,7 @@ jobs:
               '.github/workflows/pull-request-target.yml',
               '.github/workflows/test.yml',
               'ci/github-script/bot.js',
-              'ci/github-script/check-target-branch.ts',
+              'ci/github-script/check-target-branch.js',
               'ci/github-script/commits.js',
               'ci/github-script/get-pr-commit-details.js',
               'ci/github-script/lint-commits.js',

CONTRIBUTING.md

@@ -571,10 +571,7 @@ If a contributor does not want committers to push to their branch, they must unc
 
 ### Release notes
 
-If you add or remove a NixOS module, or make other breaking or significant NixOS changes, write about it in the next NixOS release notes in [`nixos/doc/manual/release-notes`](./nixos/doc/manual/release-notes).
-
-If you make major or breaking changes to a package (other than removal), write about it in the next Nixpkgs release notes in [`doc/release-notes`](./doc/release-notes).
-Package removals should not get a Nixpkgs release note, [a throwing alias should be added instead](./pkgs/README.md#steps-to-remove-a-package-from-nixpkgs).
+If you removed packages or made some major NixOS changes, write about it in the next release notes in [`nixos/doc/manual/release-notes`](./nixos/doc/manual/release-notes).
 
 ### File naming and organisation
 

ci/OWNERS

@@ -211,7 +211,7 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @Artturin @Ericson2314 @lo
 /pkgs/development/perl-modules      @stigtsp @marcusramberg
 
 # R
-/pkgs/by-name/r/R   @jbedo
+/pkgs/applications/science/math/R   @jbedo
 /pkgs/development/r-modules         @jbedo
 
 # Rust
@@ -263,15 +263,15 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /lib/licenses @alyssais @emilazy @jopejoe1
 
 # Qt
-/pkgs/development/libraries/qt-5 @NixOS/qt-kde
-/pkgs/development/libraries/qt-6 @NixOS/qt-kde
+/pkgs/development/libraries/qt-5 @K900 @NickCao @SuperSandro2000
+/pkgs/development/libraries/qt-6 @K900 @NickCao @SuperSandro2000
 
 # KDE Frameworks 5
-/pkgs/development/libraries/kde-frameworks @NixOS/qt-kde
+/pkgs/development/libraries/kde-frameworks @K900 @NickCao @SuperSandro2000
 
 # KDE / Plasma 6
-/pkgs/kde @NixOS/qt-kde
-/maintainers/scripts/kde @NixOS/qt-kde
+/pkgs/kde @K900 @NickCao @SuperSandro2000
+/maintainers/scripts/kde @K900 @NickCao @SuperSandro2000
 
 # PostgreSQL and related stuff
 /pkgs/by-name/po/postgresqlTestHook @NixOS/postgres
@@ -466,8 +466,9 @@ nixos/tests/incus/                      @adamcstephens
 pkgs/by-name/in/incus/                  @adamcstephens
 pkgs/by-name/lx/lxc*                    @adamcstephens
 
-# Flutter
+# ExpidusOS, Flutter
 /pkgs/development/compilers/flutter @RossComputerGuy
+/pkgs/desktops/expidus              @RossComputerGuy
 
 # GNU Tar & Zip
 /pkgs/by-name/gn/gnutar        @RossComputerGuy

ci/github-script/.gitignore

@@ -1,4 +1,2 @@
-comparison
-comparison.zip
 node_modules
 step-summary.md

ci/github-script/bot.js

@@ -1,4 +1,3 @@
-// @ts-nocheck
 module.exports = async ({ github, context, core, dry }) => {
   const path = require('node:path')
   const { DefaultArtifactClient } = await import('@actions/artifact')

ci/github-script/check-target-branch.js

@@ -1,6 +1,4 @@
-import type * as actionsCore from '@actions/core'
-import type { context as actionsContext } from '@actions/github'
-import type { GitHub } from '@actions/github/lib/utils'
+/// @ts-check
 
 // TODO: should this be combined with the branch checks in prepare.js?
 // They do seem quite similar, but this needs to run after eval,
@@ -11,47 +9,39 @@ const { readFile } = require('node:fs/promises')
 const { postReview, dismissReviews } = require('./reviews.js')
 
 const reviewKey = 'check-target-branch'
-
-type ChangedPaths = {
-  attrdiff: {
-    added: string[]
-    changed: string[]
-    removed: string[]
-  }
-  attrdiffByKernel: Record<
-    string,
-    {
-      added: string[]
-      changed: string[]
-      removed: string[]
-    }
-  >
-  attrdiffByPlatform: Record<
-    string,
-    {
-      added: string[]
-      changed: string[]
-      removed: string[]
-    }
-  >
-  labels: Record<string, boolean>
-  rebuildCountByKernel: Record<string, number>
-  rebuildsByKernel: Record<string, string[]>
-  rebuildsByPlatform: Record<string, string[]>
-}
-
-async function checkTargetBranch({
-  github,
-  context,
-  core,
-  dry,
-}: {
-  github: InstanceType<typeof GitHub>
-  context: typeof actionsContext
-  core: typeof actionsCore
-  dry: boolean
-}) {
-  const changed: ChangedPaths = JSON.parse(
+/**
+ * @param {{
+ *  github: InstanceType<import('@actions/github/lib/utils').GitHub>,
+ *  context: import('@actions/github/lib/context').Context
+ *  core: import('@actions/core')
+ *  dry: boolean
+ * }} CheckTargetBranchProps
+ */
+async function checkTargetBranch({ github, context, core, dry }) {
+  /**
+   * @type {{
+   *  attrdiff: {
+   *   added: string[],
+   *   changed: string[],
+   *   removed: string[],
+   *  },
+   *  attrdiffByKernel: Record<string, {
+   *   added: string[],
+   *   changed: string[],
+   *   removed: string[],
+   *  }>,
+   *  attrdiffByPlatform: Record<string, {
+   *   added: string[],
+   *   changed: string[],
+   *   removed: string[],
+   *  }>,
+   *  labels: Record<string, boolean>,
+   *  rebuildCountByKernel: Record<string, number>,
+   *  rebuildsByKernel: Record<string, string[]>,
+   *  rebuildsByPlatform: Record<string, string[]>,
+   * }}
+   */
+  const changed = JSON.parse(
     await readFile('comparison/changed-paths.json', 'utf-8'),
   )
   const pull_number = context.payload.pull_request?.number
@@ -165,7 +155,7 @@ async function checkTargetBranch({
       reviewKey,
     })
   } else if (rebuildsAllTests && !isExemptKernelUpdate) {
-    let branchText: string
+    let branchText
     if (base === 'master' && maxRebuildCount >= 500) {
       branchText = '(probably either `staging-nixos` or `staging`)'
     } else if (base === 'master') {

ci/github-script/commits.js

@@ -1,4 +1,3 @@
-// @ts-nocheck
 module.exports = async ({ github, context, core, dry, cherryPicks }) => {
   const { execFileSync } = require('node:child_process')
   const { classify } = require('../supportedBranches.js')

ci/github-script/get-pr-commit-details.js

@@ -1,4 +1,4 @@
-// @ts-nocheck
+// @ts-check
 const { promisify } = require('node:util')
 const execFile = promisify(require('node:child_process').execFile)
 
@@ -16,7 +16,7 @@ const execFile = promisify(require('node:child_process').execFile)
 /**
  * @param {{
  *  args: string[]
- *  core: typeof import('@actions/core'),
+ *  core: import('@actions/core'),
  *  quiet?: boolean,
  *  repoPath?: string,
  * }} RunGitProps
@@ -40,7 +40,7 @@ async function runGit({ args, repoPath, core, quiet }) {
  * of 250 commits and doesn't return the changed files.
  *
  * @param {{
- *  core: typeof import('@actions/core'),
+ *  core: import('@actions/core'),
  *  pr: Awaited<ReturnType<InstanceType<import('@actions/github/lib/utils').GitHub>["rest"]["pulls"]["get"]>>["data"]
  *  repoPath?: string,
  * }} GetCommitMessagesForPRProps
@@ -76,7 +76,7 @@ async function getCommitDetailsForPR({ core, pr, repoPath }) {
 
   return Promise.all(
     shas.map(async (sha) => {
-      // Subject, author name, author email, committer name, committer email (all tab-separated)
+      // Subject, author name, author email, committer name, committer email (all tab-seperated)
       // then a blank line, then filenames.
       const result = (
         await runGit({

ci/github-script/get-teams.js

@@ -1,4 +1,3 @@
-// @ts-nocheck
 const excludeTeams = [
   /^voters.*$/,
   /^nixpkgs-maintainers$/,

ci/github-script/lint-commits.js

@@ -1,3 +1,4 @@
+// @ts-check
 const { classify } = require('../supportedBranches.js')
 const { getCommitDetailsForPR } = require('./get-pr-commit-details.js')
 
@@ -5,9 +6,9 @@ const { getCommitDetailsForPR } = require('./get-pr-commit-details.js')
 
 /**
  * @param {{
- *  github: InstanceType<typeof import('@actions/github/lib/utils').GitHub>,
+ *  github: InstanceType<import('@actions/github/lib/utils').GitHub>,
  *  context: typeof import('@actions/github').context,
- *  core: typeof import('@actions/core'),
+ *  core: import('@actions/core'),
  *  repoPath?: string,
  * }} LintCommitsProps
  */
@@ -56,7 +57,7 @@ async function lintCommits({ github, context, core, repoPath }) {
 /**
  * @param {{
  *  commits: Commit[],
- *  core: typeof import('@actions/core'),
+ *  core: import('@actions/core'),
  * }} CheckCommitMessagesProps
  */
 async function checkCommitMessages({ commits, core }) {
@@ -169,7 +170,7 @@ async function checkCommitMessages({ commits, core }) {
 /**
  * @param {{
  *  commits: Commit[],
- *  core: typeof import('@actions/core'),
+ *  core: import('@actions/core'),
  * }} CheckGitFieldsProps
  */
 async function checkCommitMetadata({ commits, core }) {

ci/github-script/manual-file-edits.js

@@ -1,11 +1,12 @@
+// @ts-check
 const { classify } = require('../supportedBranches.js')
 const { getCommitDetailsForPR } = require('./get-pr-commit-details')
 
 /**
  * @param {{
- *  github: InstanceType<typeof import('@actions/github/lib/utils').GitHub>,
- *  context: typeof import('@actions/github').context,
- *  core: typeof import('@actions/core'),
+ *  github: InstanceType<import('@actions/github/lib/utils').GitHub>,
+ *  context: import('@actions/github/lib/context').Context,
+ *  core: import('@actions/core'),
  *  repoPath?: string,
  *  dry: boolean,
  * }} CheckManualFileEditsProps

ci/github-script/merge.js

@@ -1,4 +1,3 @@
-// @ts-nocheck
 const { classify } = require('../supportedBranches.js')
 
 function runChecklist({

ci/github-script/package-lock.json

@@ -10,11 +10,6 @@
         "@actions/github": "9.1.0",
         "bottleneck": "2.19.5",
         "commander": "14.0.3"
-      },
-      "devDependencies": {
-        "@tsconfig/node24": "24.0.4",
-        "@types/node": "24.13.3",
-        "typescript": "7.0.2"
       }
     },
     "node_modules/@actions/artifact": {
@@ -593,19 +588,6 @@
         "protoc-gen-ts": "bin/protoc-gen-ts"
       }
     },
-    "node_modules/@protobuf-ts/plugin/node_modules/typescript": {
-      "version": "3.9.10",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-3.9.10.tgz",
-      "integrity": "sha512-w6fIxVE/H1PkLKcCPsFqKE7Kv7QUwhU8qQY2MueZXWx5cPZdwFupLgKK3vntcK98BtNHZtAF4LA/yl2a7k8R6Q==",
-      "license": "Apache-2.0",
-      "bin": {
-        "tsc": "bin/tsc",
-        "tsserver": "bin/tsserver"
-      },
-      "engines": {
-        "node": ">=4.2.0"
-      }
-    },
     "node_modules/@protobuf-ts/protoc": {
       "version": "2.11.1",
       "resolved": "https://registry.npmjs.org/@protobuf-ts/protoc/-/protoc-2.11.1.tgz",
@@ -630,343 +612,6 @@
         "@protobuf-ts/runtime": "^2.11.1"
       }
     },
-    "node_modules/@tsconfig/node24": {
-      "version": "24.0.4",
-      "resolved": "https://registry.npmjs.org/@tsconfig/node24/-/node24-24.0.4.tgz",
-      "integrity": "sha512-2A933l5P5oCbv6qSxHs7ckKwobs8BDAe9SJ/Xr2Hy+nDlwmLE1GhFh/g/vXGRZWgxBg9nX/5piDtHR9Dkw/XuA==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@types/node": {
-      "version": "24.13.3",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.3.tgz",
-      "integrity": "sha512-Dh8vAsV36ig5wa9OX4pXvMc9D3Veibfw2wix0CUwYODLD8nkj9UsLjASr49nPg+2eKzxhBV+v7L8pXvT4e639Q==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "undici-types": "~7.18.0"
-      }
-    },
-    "node_modules/@typescript/typescript-aix-ppc64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-aix-ppc64/-/typescript-aix-ppc64-7.0.2.tgz",
-      "integrity": "sha512-MTKKkWB7p/0E9xi1d1tHtZ5PiLkGEMIq88pK2CubZjOsLtYTLqhgIgi6zepFa+9GHZ6h05NMCkQxGKiPXMxXtQ==",
-      "cpu": [
-        "ppc64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "aix"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-darwin-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-arm64/-/typescript-darwin-arm64-7.0.2.tgz",
-      "integrity": "sha512-gowzar9MwS/aRWp6f3a4KUqzRjAZjOsmGNCM6LcTgXum+dBfgsBVMN+AgvOCCbguXyick6LJhpBszxMebJ8syA==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-darwin-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-x64/-/typescript-darwin-x64-7.0.2.tgz",
-      "integrity": "sha512-SZ9xZInqApNlNGc9s0W1VSsktYSOe9cFqNOIqmN1Gs8SmkjKZYFt017G4VwPxASInODuAdbTW7sXiFUf893RgA==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-freebsd-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-arm64/-/typescript-freebsd-arm64-7.0.2.tgz",
-      "integrity": "sha512-W5NH4y/J0plIIS5b2xvTEkU7JFxyqdMAOgf+Ilhl0vHQXKO5dZoxd+C/jEtq56c4F3wk71RB4BMRQ2XdI+bwYQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-freebsd-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-x64/-/typescript-freebsd-x64-7.0.2.tgz",
-      "integrity": "sha512-UMGDx5sTpzNw3WiPebH7l90IWfJggEd+egHt/q6p7/Cm3zqoV7VxkGXt+3DxPIw8CcmvAB0j3sVVfbhX+M4Tpw==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-arm": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm/-/typescript-linux-arm-7.0.2.tgz",
-      "integrity": "sha512-gffT3xPz9sR7j/YJExkyPntrI0P2EP9XbOyWzth2/Gs0RstK+90RBcO0ncXoXy/beYll1SXw846Nf2zdnEz0QQ==",
-      "cpu": [
-        "arm"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm64/-/typescript-linux-arm64-7.0.2.tgz",
-      "integrity": "sha512-Qh4eU4/y3yDjnfjjyPYihMj5/ODIlmt+Bzu17OI+fiSRDW57QmU5SiN63exPRNJPKUzcc1INa1NXdrJ+MqHjUQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-loong64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-loong64/-/typescript-linux-loong64-7.0.2.tgz",
-      "integrity": "sha512-uEHck9i8hoAzXPiYRib1O7miOnz23SxIeVl6F4LXox+qov1K35jHcEW6VHKvZI+pyvl7fZEP4MCU5LYvIq1GuQ==",
-      "cpu": [
-        "loong64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-mips64el": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-mips64el/-/typescript-linux-mips64el-7.0.2.tgz",
-      "integrity": "sha512-R4KvAMnE43W5Qeqb0Ly56O3mWMWIAgsMyz36DCaycd5nbg/9kzm0liw3JocfRqyJY0KPmzFjbswozXyW0DnIYA==",
-      "cpu": [
-        "mips64el"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-ppc64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-ppc64/-/typescript-linux-ppc64-7.0.2.tgz",
-      "integrity": "sha512-DORx5b3sd/4S7eayxm4FQv+A7CrkUIGRaHiwI8oiHTAI1fAPWhF4J0vAlkC8biAlHSVVwxMQ3tjZ2/DVbnQiiA==",
-      "cpu": [
-        "ppc64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-riscv64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-riscv64/-/typescript-linux-riscv64-7.0.2.tgz",
-      "integrity": "sha512-wf0jqEDOjrPRnKwYRyyJDRo11KMbvMFrU+q4zqKyChODBzvlkbhNQfKvLxQCcwTpdDaXSHZTVuh0JoCrKCUMHQ==",
-      "cpu": [
-        "riscv64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-s390x": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-s390x/-/typescript-linux-s390x-7.0.2.tgz",
-      "integrity": "sha512-IkwJc3L7yhytWd/ewjyxNDfOmswCm9GWMJT/ue/dU4aZNbwZeYAetq42VyLmsmSjvoX7z74X6ZaYCtzAr0EuGw==",
-      "cpu": [
-        "s390x"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-x64/-/typescript-linux-x64-7.0.2.tgz",
-      "integrity": "sha512-EYdf2cNg7rgCWJnxCdJ+F3V39O8ihb37eHAu1LK8oAFizgTQbPOK7zHHXbPt8rX24COqODXeI3sIf0fCXG7H/A==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-netbsd-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-arm64/-/typescript-netbsd-arm64-7.0.2.tgz",
-      "integrity": "sha512-+polYF4MF04aPpO5FTkHran9yUQDSXqy5GiSDKpsll5jy3l3+g9QLhpf39T+ePtefhXLOGrLl0QIjkQP6VnelA==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-netbsd-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-x64/-/typescript-netbsd-x64-7.0.2.tgz",
-      "integrity": "sha512-8YIT0EHM/3dq10ZOVF/A7pc/YSMtbcecct4rWtexrnSCHOPcpC2KTLXfTCR6vDpnSiY12heNb1GiN/wu+T/FyA==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-openbsd-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-arm64/-/typescript-openbsd-arm64-7.0.2.tgz",
-      "integrity": "sha512-APT8+ClYnuYm1u9+kgGXoMj2VzWzcymwh2gNSQVySHfkRDGOTVkoWLjCmOQSaO+PoqQ57B0flRp9SA+7GnnkzQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-openbsd-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-x64/-/typescript-openbsd-x64-7.0.2.tgz",
-      "integrity": "sha512-yX7s+Q0Dln0Dt9tEzZsAjXXR/+ytBM7AlglaqyeMPxQszJ1JhlJdZ6jLA+IzldHtflX81em7lDao1xXu+aRRkg==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-sunos-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-sunos-x64/-/typescript-sunos-x64-7.0.2.tgz",
-      "integrity": "sha512-dLJDGaLZ1D4HPQn62u1n8mBDkJREwMsAkCdkwd4Ieqw+x3TUyTsqY0YiBCtE6H6OzzgGk3iuZ3vFWRS+E8/d1g==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "sunos"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-win32-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-arm64/-/typescript-win32-arm64-7.0.2.tgz",
-      "integrity": "sha512-Gyl1Vy6OsWesLzmq+EP0Fb7b4Nid5232AvcA2SFcdYreldpNtYFFofPjnt62y9hQy7VTaZp65ICJjuAQRaVcIQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-win32-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-x64/-/typescript-win32-x64-7.0.2.tgz",
-      "integrity": "sha512-0BQ3HkAHHlKLSp1qRvf3SUhGpGsDuhB/jgFw75guyqbxJqEaS0Cw/VFO8i2nHglJUzQCRtMMR/IBAKE3ETMC4g==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
     "node_modules/@typescript/vfs": {
       "version": "1.6.1",
       "resolved": "https://registry.npmjs.org/@typescript/vfs/-/vfs-1.6.1.tgz",
@@ -2012,37 +1657,16 @@
       }
     },
     "node_modules/typescript": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-7.0.2.tgz",
-      "integrity": "sha512-8FYau96o3NKOhbjKi/qNvG/W5jhzxkbdm5sj9AbZ/5T5sWqn3hJgLfGx27sRKZWTvyzCP8dLRBTf5tBTSRVUNA==",
+      "version": "3.9.10",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-3.9.10.tgz",
+      "integrity": "sha512-w6fIxVE/H1PkLKcCPsFqKE7Kv7QUwhU8qQY2MueZXWx5cPZdwFupLgKK3vntcK98BtNHZtAF4LA/yl2a7k8R6Q==",
       "license": "Apache-2.0",
       "bin": {
-        "tsc": "bin/tsc"
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
       },
       "engines": {
-        "node": ">=16.20.0"
-      },
-      "optionalDependencies": {
-        "@typescript/typescript-aix-ppc64": "7.0.2",
-        "@typescript/typescript-darwin-arm64": "7.0.2",
-        "@typescript/typescript-darwin-x64": "7.0.2",
-        "@typescript/typescript-freebsd-arm64": "7.0.2",
-        "@typescript/typescript-freebsd-x64": "7.0.2",
-        "@typescript/typescript-linux-arm": "7.0.2",
-        "@typescript/typescript-linux-arm64": "7.0.2",
-        "@typescript/typescript-linux-loong64": "7.0.2",
-        "@typescript/typescript-linux-mips64el": "7.0.2",
-        "@typescript/typescript-linux-ppc64": "7.0.2",
-        "@typescript/typescript-linux-riscv64": "7.0.2",
-        "@typescript/typescript-linux-s390x": "7.0.2",
-        "@typescript/typescript-linux-x64": "7.0.2",
-        "@typescript/typescript-netbsd-arm64": "7.0.2",
-        "@typescript/typescript-netbsd-x64": "7.0.2",
-        "@typescript/typescript-openbsd-arm64": "7.0.2",
-        "@typescript/typescript-openbsd-x64": "7.0.2",
-        "@typescript/typescript-sunos-x64": "7.0.2",
-        "@typescript/typescript-win32-arm64": "7.0.2",
-        "@typescript/typescript-win32-x64": "7.0.2"
+        "node": ">=4.2.0"
       }
     },
     "node_modules/undici": {
@@ -2057,13 +1681,6 @@
         "node": ">=14.0"
       }
     },
-    "node_modules/undici-types": {
-      "version": "7.18.2",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.18.2.tgz",
-      "integrity": "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/universal-user-agent": {
       "version": "7.0.3",
       "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.3.tgz",

ci/github-script/package.json

@@ -10,10 +10,5 @@
     "@actions/github": "9.1.0",
     "bottleneck": "2.19.5",
     "commander": "14.0.3"
-  },
-  "devDependencies": {
-    "@tsconfig/node24": "24.0.4",
-    "@types/node": "24.13.3",
-    "typescript": "7.0.2"
   }
 }

ci/github-script/prepare.js

@@ -1,4 +1,3 @@
-// @ts-nocheck
 const { classify } = require('../supportedBranches.js')
 const { postReview, dismissReviews } = require('./reviews.js')
 const reviewKey = 'prepare'

ci/github-script/reviewers.js

@@ -1,4 +1,3 @@
-// @ts-nocheck
 async function handleReviewers({
   github,
   context,

ci/github-script/reviews.js

@@ -1,3 +1,5 @@
+// @ts-check
+
 const eventToState = {
   COMMENT: 'COMMENTED',
   REQUEST_CHANGES: 'CHANGES_REQUESTED',
@@ -14,7 +16,7 @@ const reviewUsers = [
 ]
 
 /**
- * @typedef {InstanceType<typeof import('@actions/github/lib/utils').GitHub>} GitHub
+ * @typedef {InstanceType<import('@actions/github/lib/utils').GitHub>} GitHub
  * @typedef {typeof import('@actions/github').context} Context
  *
  * @typedef {Awaited<ReturnType<GitHub['rest']['pulls']['listReviews']>>['data'][number]} Review
@@ -25,7 +27,7 @@ const reviewUsers = [
  * @param {{
  *  github: GitHub,
  *  context: Context,
- *  core: typeof import('@actions/core'),
+ *  core: import('@actions/core'),
  *  dry: boolean,
  *  reviewKey?: string,
  * }} DismissReviewsProps
@@ -163,10 +165,10 @@ async function dismissReviews({ github, context, core, dry, reviewKey }) {
  * @param {{
  *  github: GitHub,
  *  context: Context,
- *  core: typeof import('@actions/core'),
+ *  core: import('@actions/core'),
  *  dry: boolean,
  *  body: string,
- *  event: keyof typeof eventToState,
+ *  event: keyof eventToState,
  *  reviewKey: string,
  * }} PostReviewProps
  */

ci/github-script/run

@@ -112,8 +112,8 @@ program
   .argument('<repo>', 'Name of the GitHub repository to run on (Example: nixpkgs)')
   .argument('<pr>', 'Number of the Pull Request to run on')
   .action(async (owner, repo, pr, options) => {
-    const checkTargetBranch = (await import('./check-target-branch.ts')).default
-    await run(checkTargetBranch, owner, repo, pr, options)
+    const checkCommitMessages = (await import('./check-target-branch.js')).default
+    await run(checkCommitMessages, owner, repo, pr, options)
   })
 
 program

ci/github-script/supportedSystems.js

@@ -1,4 +1,3 @@
-// @ts-nocheck
 module.exports = async ({ github, context, targetSha }) => {
   const { content, encoding } = (
     await github.rest.repos.getContent({

ci/github-script/tsconfig.json

@@ -1,26 +0,0 @@
-{
-  "compilerOptions": {
-    "lib": [
-      "es2024",
-      "ESNext.Array",
-      "ESNext.Collection",
-      "ESNext.Error",
-      "ESNext.Iterator",
-      "ESNext.Promise"
-    ],
-    "module": "nodenext",
-    "target": "es2024",
-
-    "strict": true,
-    "esModuleInterop": true,
-    "skipLibCheck": true,
-    "moduleResolution": "node16",
-
-    "allowImportingTsExtensions": true,
-    "allowJs": true,
-    "checkJs": true,
-    "erasableSyntaxOnly": true,
-    "verbatimModuleSyntax": true,
-    "noEmit": true,
-  }
-}

ci/github-script/withRateLimit.js

@@ -1,4 +1,3 @@
-// @ts-nocheck
 module.exports = async ({ github, core, maxConcurrent = 1 }, callback) => {
   const Bottleneck = require('bottleneck')
 

ci/pinned.json

@@ -9,22 +9,9 @@
       },
       "branch": "nixpkgs-unstable",
       "submodules": false,
-      "revision": "7525d999cd850b9a488817abc89c75dc733acf17",
-      "url": "https://github.com/NixOS/nixpkgs/archive/7525d999cd850b9a488817abc89c75dc733acf17.tar.gz",
-      "hash": "sha256-4IHyyLgLBdKefkljdKod4IMn023pQiDXAWJA187cmdY="
-    },
-    "nixpkgs-26.05-darwin": {
-      "type": "Git",
-      "repository": {
-        "type": "GitHub",
-        "owner": "NixOS",
-        "repo": "nixpkgs"
-      },
-      "branch": "nixpkgs-26.05-darwin",
-      "submodules": false,
-      "revision": "51fe96f9107566e6b8eeb7fc4ba696c01e548b04",
-      "url": "https://github.com/NixOS/nixpkgs/archive/51fe96f9107566e6b8eeb7fc4ba696c01e548b04.tar.gz",
-      "hash": "sha256-yj0LPLnsmYoLmA3FGANjeTEwej0/DHjZBXWnDQDUuIs="
+      "revision": "421eebfd0ec7bccd4abe826ce62d7e6e83129493",
+      "url": "https://github.com/NixOS/nixpkgs/archive/421eebfd0ec7bccd4abe826ce62d7e6e83129493.tar.gz",
+      "hash": "sha256:1lxfhfgiv1sz2v7fg43gny57sa6wf59n98q7ldsyb2p06f4sal7w"
     }
   },
   "version": 8

ci/supportedBranches.js

@@ -2,7 +2,6 @@
 /*
 #!nix-shell -i node -p nodejs
 */
-// @ts-nocheck
 
 const typeConfig = {
   master: ['development', 'primary'],

doc/README.md

@@ -14,12 +14,17 @@ Use **examples** first to show how to get something done. Keep **Explanation** l
 
 Use our [styleguide](./styleguide.md) for more in depth guidance on writing good documentation.
 
-Documentation about Nixpkgs belongs here, this includes 'getting-started'-guides and 'onboarding-guides' for *using* Nixpkgs and the language frameworks it ships.
+This directory contains **guides** and **reference** documentation for Nixpkgs.
 
-Write **guides** task-first: lead with a working example, then explain in prose.
-Write **reference** as the specification of functions and attributes.
+Borrowing from [Diátaxis framework](https://diataxis.fr/) what suits our needs:
 
-We are actively working to generate reference documentation from the [doc-comments](https://github.com/NixOS/rfcs/blob/master/rfcs/0145-doc-strings.md) present in code, which also lets you view it locally with `:doc` in `nix repl`.
+**Guides** are task-oriented. They can be tutorial-style walkthroughs or how-to sections.
+Explanations appear as prose after examples.
+
+**Reference** documentation is the specification of functions and attributes.
+
+We are actively working to generate **all** reference documentation from the [doc-comments](https://github.com/NixOS/rfcs/blob/master/rfcs/0145-doc-strings.md) present in code.
+This also provides the benefit of using `:doc` in the `nix repl` to view reference documentation locally on the fly.
 
 See [Document structure](#document-structure) for a structural template.
 
@@ -193,15 +198,15 @@ watermelon
 - If creating a commit purely for documentation changes, format the commit message in the following way:
 
   ```
-  doc/component: (documentation summary)
+  doc: (documentation summary)
 
   (Motivation for change, relevant links, additional information.)
   ```
 
   Examples:
 
-  * doc/stdenv: update the kernel config documentation to use `nix-shell`
-  * doc/getting-started: add information about `nix-update-script`
+  * doc: update the kernel config documentation to use `nix-shell`
+  * doc: add information about `nix-update-script`
 
     Closes #216321.
 

doc/build-helpers/fetchers.chapter.md

@@ -853,7 +853,7 @@ Used with CVS. Expects `cvsRoot`, `tag`, and `hash`.
 
 Used with Mercurial. Expects `url`, `rev`, `hash`, overridable with [`<pkg>.overrideAttrs`](#sec-pkg-overrideAttrs).
 
-A number of fetcher functions wrap lower-level fetchers such as `fetchurl`, `fetchzip`, and `fetchgit`. They are mainly convenience functions intended for commonly used destinations of source code in Nixpkgs. These wrapper fetchers are listed below.
+A number of fetcher functions wrap part of `fetchurl` and `fetchzip`. They are mainly convenience functions intended for commonly used destinations of source code in Nixpkgs. These wrapper fetchers are listed below.
 
 ## `fetchFromGitea`, `fetchFromForgejo` and `fetchFromCodeberg` {#fetchfromgitea}
 
@@ -876,45 +876,6 @@ However, `fetchFromGitHub` will automatically switch to using `fetchgit` in any
 
 When `fetchgit` is used, refer to the `fetchgit` section for documentation of its available options.
 
-## `fetchFromHuggingFace` {#fetchfromhuggingface}
-
-`fetchFromHuggingFace` fetches repositories from Hugging Face Hub. It expects
-`repoId`, exactly one of `rev` or `tag`, and `hash`.
-
-`repoId` must be in the form `repo` or `owner/repo`, so repositories such as
-`gpt2` work as well.
-
-::: {.example #ex-fetchfromhuggingface}
-
-# Fetching a model repository from Hugging Face
-
-```nix
-fetchFromHuggingFace {
-  repoId = "hf-internal-testing/tiny-random-gpt2";
-  rev = "71034c5d8bde858ff824298bdedc65515b97d2b9";
-  backend = "lfs";
-  hash = "sha256-8K9B/C62GW5lXC0c8QQpQ9QAE1UMoG+kYqvGhnWIp64=";
-}
-```
-
-:::
-
-The optional `repoType` argument selects which Hugging Face Hub repository type
-to use:
-
-- `"model"` (default) fetches from `https://huggingface.co/<repo-id>`
-- `"dataset"` fetches from `https://huggingface.co/datasets/<repo-id>`
-- `"space"` fetches from `https://huggingface.co/spaces/<repo-id>`
-
-To use a different Hugging Face Hub instance, use `domain`
-(defaults to `"huggingface.co"`).
-
-The optional `backend` argument defaults to `"xet"`. Because the Xet backend is
-not implemented yet, callers must currently set `backend = "lfs"`, which uses
-`fetchgit` with Git LFS enabled and defaults `fetchSubmodules` to `false`.
-`rootDir`, `sparseCheckout`, and low-level `fetchgit` options such as
-`deepClone`, `fetchTags`, `leaveDotGit`, and `branchName` are also supported.
-
 ## `fetchFromGitLab` {#fetchfromgitlab}
 
 This is used with GitLab repositories. It behaves similarly to `fetchFromGitHub`, and expects `owner`, `repo`, `rev`, and `hash`.

doc/build-helpers/images/appimagetools.section.md

@@ -28,7 +28,7 @@ However, [those were unified early 2020](https://github.com/NixOS/nixpkgs/pull/8
 
 ```nix
 { appimageTools, fetchurl }:
-appimageTools.wrapType2 {
+let
   pname = "nuclear";
   version = "0.6.30";
 
@@ -36,7 +36,8 @@ appimageTools.wrapType2 {
     url = "https://github.com/nukeop/nuclear/releases/download/v${version}/nuclear-v${version}.AppImage";
     hash = "sha256-he1uGC1M/nFcKpMM9JKY4oeexJcnzV0ZRxhTjtJz6xw=";
   };
-}
+in
+appimageTools.wrapType2 { inherit pname version src; }
 ```
 
 :::
@@ -55,7 +56,7 @@ There are a few ways to learn which dependencies an application needs:
 
 ```nix
 { appimageTools, fetchurl }:
-appimageTools.wrapType2 {
+let
   pname = "irccloud";
   version = "0.16.0";
 
@@ -63,7 +64,9 @@ appimageTools.wrapType2 {
     url = "https://github.com/irccloud/irccloud-desktop/releases/download/v${version}/IRCCloud-${version}-linux-x86_64.AppImage";
     hash = "sha256-/hMPvYdnVB1XjKgU2v47HnVvW4+uC3rhRjbucqin4iI=";
   };
-
+in
+appimageTools.wrapType2 {
+  inherit pname version src;
   extraPkgs = pkgs: [ pkgs.at-spi2-core ];
 }
 ```
@@ -85,12 +88,12 @@ However, [those were unified early 2020](https://github.com/NixOS/nixpkgs/pull/8
 
 # Extracting an AppImage to install extra files
 
-`wrapType2` automatically extracts the AppImage for you and makes it available via the `contents` attribute.
-Note how `finalAttrs.contents` is used in `extraInstallCommands` to install additional files that were extracted from the AppImage.
+This example was adapted from a real package in Nixpkgs to show how `extract` is usually used in combination with `wrapType2`.
+Note how `appimageContents` is used in `extraInstallCommands` to install additional files that were extracted from the AppImage.
 
 ```nix
 { appimageTools, fetchurl }:
-appimageTools.wrapType2 (finalAttrs: {
+let
   pname = "irccloud";
   version = "0.16.0";
 
@@ -99,24 +102,27 @@ appimageTools.wrapType2 (finalAttrs: {
     hash = "sha256-/hMPvYdnVB1XjKgU2v47HnVvW4+uC3rhRjbucqin4iI=";
   };
 
+  appimageContents = appimageTools.extract { inherit pname version src; };
+in
+appimageTools.wrapType2 {
+  inherit pname version src;
+
   extraPkgs = pkgs: [ pkgs.at-spi2-core ];
 
   extraInstallCommands = ''
     mv $out/bin/irccloud-${version} $out/bin/irccloud
-    install -m 444 -D ${finalAttrs.contents}/irccloud.desktop $out/share/applications/irccloud.desktop
-    install -m 444 -D ${finalAttrs.contents}/usr/share/icons/hicolor/512x512/apps/irccloud.png \
+    install -m 444 -D ${appimageContents}/irccloud.desktop $out/share/applications/irccloud.desktop
+    install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/512x512/apps/irccloud.png \
       $out/share/icons/hicolor/512x512/apps/irccloud.png
     substituteInPlace $out/share/applications/irccloud.desktop \
       --replace-fail 'Exec=AppRun' 'Exec=irccloud'
   '';
-})
+}
 ```
 
 :::
 
-`appimageTools` also exposes the `extract` function should you need to do it manually, requiring `pname`, `version`, and `src` arguments (`src` being the AppImage file to extract).
-
-The arguments passed to `extract` can also contain a `postExtract` attribute, which allows you to execute additional commands after the files are extracted from the AppImage.
+The argument passed to `extract` can also contain a `postExtract` attribute, which allows you to execute additional commands after the files are extracted from the AppImage.
 `postExtract` must be a string with commands to run.
 
 :::{.warning}
@@ -132,7 +138,7 @@ This is a rewrite of [](#ex-extracting-appimage) to use `postExtract` and `wrapA
 
 ```nix
 { appimageTools, fetchurl }:
-appimageTools.wrapAppImage (finalAttrs: {
+let
   pname = "irccloud";
   version = "0.16.0";
 
@@ -141,22 +147,30 @@ appimageTools.wrapAppImage (finalAttrs: {
     hash = "sha256-/hMPvYdnVB1XjKgU2v47HnVvW4+uC3rhRjbucqin4iI=";
   };
 
-  contents = appimageTools.extract {
-    inherit (finalAttrs) pname version src;
+  appimageContents = appimageTools.extract {
+    inherit pname version src;
     postExtract = ''
       substituteInPlace $out/irccloud.desktop --replace-fail 'Exec=AppRun' 'Exec=irccloud'
     '';
   };
+in
+appimageTools.wrapAppImage {
+  inherit pname version;
+
+  src = appimageContents;
 
   extraPkgs = pkgs: [ pkgs.at-spi2-core ];
 
   extraInstallCommands = ''
     mv $out/bin/irccloud-${version} $out/bin/irccloud
-    install -m 444 -D ${finalAttrs.contents}/irccloud.desktop $out/share/applications/irccloud.desktop
-    install -m 444 -D ${finalAttrs.contents}/usr/share/icons/hicolor/512x512/apps/irccloud.png \
+    install -m 444 -D ${appimageContents}/irccloud.desktop $out/share/applications/irccloud.desktop
+    install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/512x512/apps/irccloud.png \
       $out/share/icons/hicolor/512x512/apps/irccloud.png
   '';
-})
+
+  # specify src archive for nix-update
+  passthru.src = src;
+}
 ```
 
 :::

doc/build-helpers/images/portableservice.section.md

@@ -68,7 +68,7 @@ See [](#ex-portableService-hello) to understand how to use the output of `portab
 
 : Allows you to override the package that provides {manpage}`mksquashfs(1)`, which is used internally by `portableService`.
 
-  _Default value:_ `pkgs.squashfs-tools`.
+  _Default value:_ `pkgs.squashfsTools`.
 
 `squash-compression` (String; _optional_)
 

doc/doc-support/package.nix

@@ -118,7 +118,7 @@ stdenvNoCC.mkDerivation (
         --script ./anchor.min.js \
         --script ./anchor-use.js \
         --sidebar-depth 3 \
-        --experimental-config ./nav.json \
+        --nav ./nav.json \
         --header ${./header.html}\
         --no-navheader \
         manual.md \

doc/getting-started/dev-environments.md

@@ -1,49 +0,0 @@
-# Dev environments {#dev-environments}
-
-Create a `shell.nix` with the following:
-
-```nix
-# shell.nix
-let
-  nixpkgs = fetchTarball "https://github.com/NixOS/nixpkgs/archive/nixos-unstable.tar.gz";
-  pkgs = import nixpkgs { };
-in
-pkgs.mkShell {
-  packages = [ pkgs.python3 ];
-  shellHook = ''
-    echo "Welcome in my nix shell"
-  '';
-}
-```
-
-run
-
-```sh
-nix-shell
-```
-
-This activates your `shell.nix` and you should see:
-
-```sh
-unpacking 'https://github.com/NixOS/nixpkgs/archive/nixos-unstable.tar.gz' into the Git cache...
-Welcome in your nix shell
-```
-
-python3 is available
-
-```sh
-$ python3 --version
-```
-
-To leave the shell
-
-```bash
-ctrl+D
-```
-
-:::{.note}
-You should use [pinned nixpkgs](https://nix.dev/guides/recipes/dependency-management.html).
-The example used `unstable` here for demonstration purposes only
-:::
-
-For further information check out [nix-shell](https://nix.dev/manual/nix/stable/command-ref/nix-shell)

doc/getting-started/getting-started.part.md

@@ -1,6 +0,0 @@
-# Getting started {#getting-started}
-
-```{=include=} chapters
-first-package.chapter.md
-dev-environments.md
-```

doc/languages-frameworks/android.section.md

@@ -116,7 +116,7 @@ options:
 For each requested system image we can specify the following options:
 
 * `systemImageTypes` specifies what kind of system images should be included.
-  Defaults to: `google_apis`, `google_apis_playstore`, `google_apis_ps16k` and `google_apis_playstore_ps16k`.
+  Defaults to: `default`.
 * `abiVersions` specifies what kind of ABI version of each system image should
   be included. Defaults to `armeabi-v7a` and `arm64-v8a`.
 

doc/languages-frameworks/beam.section.md

@@ -206,7 +206,7 @@ Here is how your `default.nix` file would look for a Phoenix project.
   # beam27Packages or beam29Packages is available if you need a particular version
   beamPackages,
 }:
-beamPackages.mixRelease (finalAttrs: {
+let
   pname = "your_project";
   version = "0.0.1";
 
@@ -215,6 +215,24 @@ beamPackages.mixRelease (finalAttrs: {
     rev = "replace_with_your_commit";
   };
 
+  # if using mix2nix you can use the mixNixDeps attribute
+  mixFodDeps = beamPackages.fetchMixDeps {
+    pname = "mix-deps-${pname}";
+    inherit src version;
+    # nix will complain and tell you the right value to replace this with
+    hash = lib.fakeHash;
+    mixEnv = ""; # default is "prod", when empty includes all dependencies, such as "dev", "test".
+    # if you have build time environment variables add them here
+    MY_ENV_VAR = "my_value";
+  };
+in
+beamPackages.mixRelease {
+  inherit
+    src
+    pname
+    version
+    mixFodDeps
+    ;
   # if you have build time environment variables add them here
   MY_ENV_VAR = "my_value";
 
@@ -224,18 +242,7 @@ beamPackages.mixRelease (finalAttrs: {
     mix do deps.loadpaths --no-deps-check, phx.digest
     mix phx.digest --no-deps-check
   '';
-
-  # if using mix2nix you can use the mixNixDeps attribute
-  mixFodDeps = beamPackages.fetchMixDeps {
-    pname = "mix-deps-${finalAttrs.pname}";
-    inherit (finalAttrs) src version;
-    # nix will complain and tell you the right value to replace this with
-    hash = lib.fakeHash;
-    mixEnv = ""; # default is "prod", when empty includes all dependencies, such as "dev", "test".
-    # if you have build time environment variables add them here
-    MY_ENV_VAR = "my_value";
-  };
-})
+}
 ```
 
 Setup will require the following steps:

doc/languages-frameworks/neovim.section.md

@@ -267,13 +267,13 @@ You can install the standalone parsers and queries directly without installing `
 ### Treesitter setup using WASM parsers and queries {#neovim-plugin-treesitter-wasm}
 
 Neovim can load WASM parsers when it is built with Wasmtime support.
-In nixpkgs, WASM parser plugins are available from the `wasm32-wasip1` cross package set:
+In nixpkgs, WASM parser plugins are available from the `wasi32` cross package set:
 
 ```nix
 (pkgs.wrapNeovim (pkgs.neovim-unwrapped.override { wasmSupport = true; }) {
   configure = {
     packages.myPlugins =
-      with pkgs.pkgsCross.wasm32-wasip1.vimPlugins;
+      with pkgs.pkgsCross.wasi32.vimPlugins;
       let
         # Select the grammars you need
         treesitter-grammars = with nvim-treesitter-parsers; [
@@ -296,7 +296,7 @@ In nixpkgs, WASM parser plugins are available from the `wasm32-wasip1` cross pac
 
 Do not install both native and WASM parsers for the same language.
 For example, installing both `pkgs.vimPlugins.nvim-treesitter-parsers.nix` and
-`pkgs.pkgsCross.wasm32-wasip1.vimPlugins.nvim-treesitter-parsers.nix` is invalid because Neovim
+`pkgs.pkgsCross.wasi32.vimPlugins.nvim-treesitter-parsers.nix` is invalid because Neovim
 loads the first `parser/nix.*` found on `runtimepath`.
 
 Use `:checkhealth vim.treesitter` to verify Nix-managed WASM parsers.

doc/languages-frameworks/ocaml.section.md

@@ -59,9 +59,6 @@ Here is a simple package example.
 - The library will be installed using the `angstrom.install` file that dune
   generates.
 
-- It also accepts an optional `dunePackages` argument, if there is more than one
-  dune package that needs to be built (see `zipperposition`)
-
 ```nix
 {
   lib,

doc/languages-frameworks/rocq.section.md

@@ -3,12 +3,11 @@
 Note that "The Rocq Prover" (Rocq for short) is the new name of the
 proof assistant formerly known as Coq. The `coq` and `coqPackages`
 derivations currently remain for both older versions of Coq, but also
-as compatibility aliases for some versions of Rocq. In both cases, the
-`coq` and `rocq-core` attributes exist. In the case of Coq (< 9),
-`rocq-core` is just an alias for `coq`, while in the case of Rocq (>= 9),
-`rocq-core` is the main Rocq derivation, while `coq` provides
-compatibility binaries (`coqc`, `coqtop`, etc.) for packages that still
-depend on them.
+some versions of Rocq during the renaming transition. In the latter
+case, the `coq` derivation encompasses the compatibility binaries
+(`coqtop`, `coqc`, etc.) in addition to the `rocq` binary. The packages
+only in `coqPackages` are the ones which currently still depend on these
+compatibility binaries.
 
 ## Rocq derivation: `rocq-core` {#rocq-derivation-rocq}
 
@@ -18,18 +17,18 @@ The Rocq derivation is overridable through the `rocq-core.override overrides`, w
 * `customOCamlPackages` (optional, defaults to `null`, which lets Rocq choose a version automatically), which can be set to any of the ocaml packages attribute of `ocaml-ng` (such as `ocaml-ng.ocamlPackages_4_14` which is the default for Rocq 9.1 for example).
 * `rocq-version` (optional, defaults to the short version e.g. "9.1"), is a version number of the form "x.y" that indicates which Rocq's version build behavior to mimic when using a source which is not a release. E.g. `rocq-core.override { version = "40be8435e132aab2231a79091f011ebc3e64a753"; rocq-version = "9.1"; }`.
 
-## Creating custom Coq environments with `rocq-core.withPackages` {#coq-withPackages}
+## Creating custom Coq environments with `coq.withPackages` {#coq-withPackages}
 
-The `rocq-core.withPackages` function provides a convenient way to create a Rocq environment that includes additional Rocq packages. This is similar to how `python.withPackages` works for Python environments.
+The `coq.withPackages` function provides a convenient way to create a Coq environment that includes additional Coq packages. This is similar to how `python.withPackages` works for Python environments.
 
-The function takes a function that receives the Rocq package set and returns a list of packages. It returns a wrapped Rocq environment where the Rocq binaries (`rocq`, etc.) are configured with the appropriate environment variables to find the packages.
+The function takes a function that receives the Coq package set and returns a list of packages. It returns a wrapped Coq environment where all Coq binaries (`coqtop`, `coqc`, `coqdep`, `coqchk`, `coqide`, etc.) are configured with the appropriate environment variables to find the packages.
 
 ### Usage {#coq-withPackages-usage}
 
-Here is an example of creating a Rocq environment with specific packages.
+Here is an example of creating a Coq environment with specific packages.
 
 ```nix
-rocq-core.withPackages (
+coq.withPackages (
   ps: with ps; [
     mathcomp
     bignums
@@ -37,9 +36,7 @@ rocq-core.withPackages (
 )
 ```
 
-If you install the `vsrocq-language-server` or `rocq-lsp` server, make sure to list them as part of the above `rocq-core.withPackages` expression instead of installing them separately if you want them to find your Rocq packages.
-
-For versions prior to Rocq 9.0, a similar `coq.withPackages` function is available.
+If you install the `vsrocq-language-server` or `rocq-lsp` server, make sure to list them as part of the above `coq.withPackages` expression instead of installing them separately if you want them to find your Coq/Rocq packages.
 
 ## Rocq packages attribute sets: `rocqPackages` {#rocq-packages-attribute-sets-rocqpackages}
 
@@ -133,7 +130,7 @@ mkRocqDerivation {
     mathcomp.boot
     mathcomp.algebra
     mathcomp-finmap
-    mathcomp.finite-group
+    mathcomp.fingroup
     mathcomp-bigenough
   ];
 

doc/languages-frameworks/rust.section.md

@@ -739,7 +739,7 @@ stdenv.mkDerivation (finalAttrs: {
 ### Compiling `wasm32-wasip1` package {#compiling-wasm32-wasip1-package}
 
 ```nix
-pkgsCross.wasm32-wasip1.callPackage (
+pkgsCross.wasi32.callPackage (
   {
     fetchFromGitHub,
     rustPlatform,

doc/manual.md.in

@@ -3,10 +3,10 @@
 
 ```{=include=} chapters
 preface.chapter.md
+first-package.chapter.md
 ```
 
 ```{=include=} parts
-getting-started/getting-started.part.md
 using-nixpkgs.md
 lib.md
 stdenv.md

doc/nav.json

@@ -1,4 +1,3 @@
 {
-  "open": [],
-  "items": []
+  "open": []
 }

doc/packages/darwin-builder.section.md

@@ -83,57 +83,6 @@ $ sudo launchctl kickstart -k system/org.nixos.nix-daemon
 
 Note that if the builder is running and you have created the above ssh conf file, you can ssh into the builder with `sudo ssh builder@linux-builder`.
 
-## Using the Virtualization.framework backend {#sec-darwin-builder-vz}
-
-`darwin.linux-builder-vz` is a variant of `darwin.linux-builder` that runs the same
-NixOS guest on Apple's Virtualization.framework (via `pkgs.vzvm`) instead of QEMU.
-Instead of emulating x86_64, it exposes Rosetta to the guest, so `x86_64-linux`
-builds are translated rather than emulated, which is substantially faster. It
-requires an Apple silicon host (`aarch64-darwin`) running macOS 13 or newer, with
-Rosetta installed:
-
-```ShellSession
-$ softwareupdate --install-rosetta --agree-to-license
-```
-
-The builder refuses to start when Rosetta is missing, rather than silently dropping
-`x86_64-linux` support; set `virtualisation.vz.rosetta.enable = false` to run
-without it.
-
-It is a drop-in replacement: it listens on the same host port (31022) and presents
-the same host key as the QEMU builder, so the `nix.conf` and SSH configuration
-described above apply unchanged; only the transport behind the port changes, from
-TCP forwarding to vsock. Since a single builder VM handles both architectures
-through Rosetta, list both systems in your `builders` entry
-(`aarch64-linux,x86_64-linux`), or with nix-darwin:
-
-```nix
-{
-  nix.linux-builder = {
-    enable = true;
-    package = pkgs.darwin.linux-builder-vz;
-    systems = [
-      "aarch64-linux"
-      "x86_64-linux"
-    ];
-  };
-}
-```
-
-When switching an existing QEMU builder over, delete its data disk first (e.g.
-`sudo rm /var/lib/linux-builder/nixos.qcow2`): the vz builder reuses the file name
-but writes a raw image, and refuses to misread a genuine qcow2 left behind.
-
-The guest console goes to the macOS unified log by default; read it with:
-
-```ShellSession
-$ /usr/bin/log show --last 5m --predicate 'subsystem == "systems.applicative.vzvm"'
-```
-
-The `virtualisation.vz.*` NixOS options configure the backend further, e.g.
-`virtualisation.vz.nestedVirtualization` gives the guest a working `/dev/kvm` for
-running NixOS integration tests on the builder (macOS 15+, M3 or newer).
-
 ## Example flake usage {#sec-darwin-builder-example-flake}
 
 ```nix

doc/redirects.json

@@ -105,9 +105,6 @@
   "cuda-writing-tests": [
     "index.html#cuda-writing-tests"
   ],
-  "dev-environments": [
-    "index.html#dev-environments"
-  ],
   "ex-build-helpers-extendMkDerivation": [
     "index.html#ex-build-helpers-extendMkDerivation"
   ],
@@ -152,9 +149,6 @@
   "friction-graphics-wayland": [
     "index.html#friction-graphics-wayland"
   ],
-  "getting-started": [
-    "index.html#getting-started"
-  ],
   "ghc-deprecation-policy": [
     "index.html#ghc-deprecation-policy"
   ],
@@ -446,9 +440,6 @@
   "sec-darwin-availability-checks": [
     "index.html#sec-darwin-availability-checks"
   ],
-  "sec-darwin-builder-vz": [
-    "index.html#sec-darwin-builder-vz"
-  ],
   "sec-darwin-libcxx-deployment-targets": [
     "index.html#sec-darwin-libcxx-deployment-targets"
   ],
@@ -2071,12 +2062,6 @@
   "fetchfromgithub": [
     "index.html#fetchfromgithub"
   ],
-  "fetchfromhuggingface": [
-    "index.html#fetchfromhuggingface"
-  ],
-  "ex-fetchfromhuggingface": [
-    "index.html#ex-fetchfromhuggingface"
-  ],
   "fetchfromgitlab": [
     "index.html#fetchfromgitlab"
   ],

doc/release-notes/rl-2611.section.md

@@ -16,14 +16,12 @@
   +nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.zst";
   ```
 
-- `sing-box` now supports NaïveProxy outbounds.
+- GCC has been updated from GCC 15 to GCC 16. This introduces some backwards-incompatible changes. Refer to the [upstream porting guide](https://gcc.gnu.org/gcc-16/porting_to.html) for details.
 
 ## Backward Incompatibilities {#sec-nixpkgs-release-26.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- `moon` has been updated to `2.x` and needs manual migration. See the [migration guide](https://moonrepo.dev/docs/migrate/2.0) for instructions.
-
 - []{#x86_64-darwin-26.11}
 
   Support for `x86_64-darwin` has been dropped, due to Apple’s deprecation of the platform and limited build infrastructure and developer time.
@@ -42,8 +40,6 @@
 
 - `hurl` has been updated to `8.x.x` which has some breaking changes. See [upstream changelog](https://github.com/Orange-OpenSource/hurl/releases/tag/8.0.0) for details.
 
-- The existing `wasm32-wasi` target has become `wasm32-wasip1` and `pkgsCross.wasi32` has become `pkgsCross.wasm32-wasip1`, aligning with LLVM's nomenclature. Aliases are in place and old forms will continue to be parsed but there might be some breakage if you're relying on the exact form of these (e.g., in sysroot paths).
-
 - `gotosocial` has been updated to 0.22.0. This release contains a very long database migration, which should not be cancelled or interrupted under any circumstances.
  -  Postgres users: Following the migration, if you encounter slowdown on Postgres specifically (ie., timing out while loading timelines) you may need to run some manual database maintenance steps. Please check https://docs.gotosocial.org/en/stable/admin/database_maintenance/#postgres.
 
@@ -59,10 +55,6 @@
 
 - `fflogs` has been removed because it was no longer functional. Users should switch to `archon-lite`.
 
-- `keycloak.plugins.scim-for-keycloak` has been removed. The upstream open-source project is [end-of-life](https://github.com/Captain-P-Goldfish/scim-for-keycloak) and its last release targets Keycloak 20, which is incompatible with the packaged Keycloak.
-
-- `keycloak.plugins.scim-keycloak-user-storage-spi` has been removed. Upstream has moved the plugin into Keycloak itself as the experimental `ipatuura` federation provider and no longer maintains the standalone repository.
-
 - `services.mysql` now sets `root@localhost` authentication to `auth_socket` when used with `mysql` or `percona-server`.
   Existing deployments will also be adjusted if possible. See the [security advisory GHSA-6qxx-6rg8-c4p8](https://github.com/NixOS/nixpkgs/security/advisories/GHSA-6qxx-6rg8-c4p8) for more information.
 
@@ -72,18 +64,10 @@
 
 - `alps` has been rewritten upstream, see [upstream repository](https://github.com/migadu/alps) for documentation.
 
-- `bosun` has been removed as it is no longer maintained upstream. the corresponding monitoring options has been removed.
-
 - `uhttpmock` providing 0.0 ABI was removed. `uhttpmock_1_0` providing 1.0 ABI was renamed to `uhttpmock` and `uhttpmock_1_0` was kept as an alias.
 
-- `himalaya` has been updated from `v1.2.0` to `v2.0.0`, which introduces breaking changes. See the [release notes](https://github.com/pimalaya/himalaya/releases/tag/v2.0.0) and the [migration guide](https://github.com/pimalaya/himalaya/blob/master/MIGRATION.md).
-
-- `tengine` has been removed as it has seen seriously delayed responses to security vulnerabilities.
-
 - `nix-serve-ng` (and `haskellPackages.nix-serve-ng`) is now built against Lix instead of CppNix, following upstream which has switched to Lix as its supported Nix implementation.
 
-- `buildPythonPackage` and `buildPythonApplication` now set `__structuredAttrs = true` by default. You can explicitly set `__structuredAttrs = false` in packages broken by this change.
-
 - Linux kernel configuration has been moved out of the `linux-kernel` field of the platform structure into the kernel builders:
   - `linux-kernel.name` has been removed.
   - `linux-kernel.target` is available as the `target` parameter and passthru attribute on the kernel builders.
@@ -101,8 +85,6 @@
 
 - `pdns` has been updated from `5.0.x` to `5.1.x`. Please be sure to review the [Upgrade Notes](https://doc.powerdns.com/authoritative/upgrading.html#to-5-1-0) before upgrading. Namely LUA record updates are no longer allowed by default, and the embedded webserver no longer includes a `access-control-allow-origin: *` header by default.
 
-- `davmail` no longer supports building with GTK 2, and the `preferGtk3` override flag has been removed as GTK 3 is always used.
-
 - Support for the legacy U‐Boot image format has been removed from the Linux kernel builders, as it is deprecated upstream and no longer used by any platform in Nixpkgs.
 
 - `etcd_3_4` package was dropped, as it's gone EOL. Please upgrade to either 3.5 or 3.6. See [migration notes](https://etcd.io/docs/v3.6/upgrades/upgrade_3_6/) for incompatibilities and upgrade procedure.
@@ -115,12 +97,8 @@
 
 - `buildFHSEnvChroot` has been removed after deprecation in 23.05.
 
-- `leafnode` has been removed, as it was an unmaintained alpha-release of leafnode 2 and has a dependency on the EOL PRCE-library. Consider using `leafnode1` instead, which is still maintained.
-
 - `gh-actions-cache` has been removed since its functionality has been integrated directly into `gh` (`gh cache`). See [upstream readme](https://github.com/actions/gh-actions-cache).
 
-- The OCaml-based Xen Store Daemon has been split off the `xen` package, and is now present in the `ocamlPackages.oxenstored` package.
-
 - `requireFile` now sets `meta.license = lib.licenses.unfree` by default. Users of `requireFile`-based derivations that preserve this default will need to explicitly allow their evaluation as described in [](#sec-allow-unfree).
 
 - `texlive.combine` is deprecated and scheduled for removal in 27.05. Please migrate to `texliveSmall.withPackages` (see [](#sec-language-texlive-user-guide)).
@@ -129,8 +107,6 @@
 
 - `librest` providing 0.7 ABI was removed. `librest_1_0` providing 1.0 ABI was renamed to `librest` and `librest_1_0` was kept as an alias.
 
-- `luaPackages.lrexlib-pcre` has been removed as part of the process to fully migrate from the end-of-life PRCE library to PCRE2. `luaPackages.lrexlib-pcre2` and multiple other versions of lrexlib can be used instead.
-
 - `pnpm_10` was upgraded to version 10.34.1+, which introduced stricter integrity checks. If you encounter `ERR_PNPM_MISSING_TARBALL_INTEGRITY`, you can fall back to the older `pnpm_10_34_0`.
 
 - `fetchPnpmDeps`' `fetcherVersion = 1` and `fetcherVersion = 2` have been
@@ -140,8 +116,6 @@
   [pnpm `fetcherVersion` section](#javascript-pnpm-fetcherVersion) of the manual
   for details.
 
-- `makeSetupHook` now uses structured attributes and only makes substitutions based on the values of the `substitutions` argument - other derivation attributes are no longer considered.
-
 - `rebuilderd` has been updated to 0.27.0 introducing breaking changes. See upstream changelog for details: [0.26.0](https://github.com/kpcyrd/rebuilderd/releases/tag/v0.26.0), [0.27.0](https://github.com/kpcyrd/rebuilderd/releases/tag/v0.27.0)
 
 - Starting with v14, `flameshot` will primarily utilise xdg-desktop-portal calls for screenshotting. This will directly affect users on X11 window managers due to the lack of a compatible portal with Screenshot feature. See [upstream changelog](https://github.com/flameshot-org/flameshot/releases/tag/v14.0.0) or [NixOS Flameshot](https://wiki.nixos.org/wiki/Flameshot) wiki page for workarounds.
@@ -151,26 +125,18 @@
 
 - `vimacs` has been removed, as it has not been maintained in 10 years and was built for an old version of vim (6.0).
 
-- The deprecated `appimageTools.extractType1`, `appimageTools.extractType2`, and `appimageTools.wrapType1` aliases now emit warnings. Use `appimageTools.extract` and `appimageTools.wrapType2` instead.
-
 ## Other Notable Changes {#sec-nixpkgs-release-26.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
 - `super-productivity` has been updated. The binary has been renamed from `super-productivity` to `superproductivity`. A symlink from the old name is provided for backward compatibility.
 
-- `buildFHSEnv`, `appimageTools.wrapAppImage`, and `appimageTools.wrapType2` now support the `finalAttrs` pattern. When using `wrapAppImage`, it is now recommended to pass the extracted AppImage to the `contents` attribute (instead of `src`), to avoid shadowing `src`. Passing the extracted contents to `src` is now deprecated and will be removed in a future release.
-
 - Package-URL (PURL, https://github.com/package-url/purl-spec) metadata identifier has been added for `fetchgit`, `fetchpypi` and `fetchFromGithub` fetchers.
   `mkDerivation` has been adjusted to reuse this information.
   Package-URLs allow reliably identifying and locating software packages.
   Maintainers of derivations using the adapted fetchers should rely on the `drv.src.meta.identifiers.v1.purl` default identifier and can enhance their `drv.meta.identifiers.v1.purls` list once they would like to have additional identifiers.
   Maintainers using `fetchurl` for `drv.src` are urged to adapt their `drv.meta.identifiers.purlParts` for proper identification.
 
-- The fwts efi-runtime kernel module was removed.
-
-- `homebox` v0.26.0 introduced a new, required value to be set, `HBOX_AUTH_API_KEY_PEPPER`. If one is not provided the module will create one, it is recommended that you back this up as it is part of API Key generation and validation.
-
 - Emacs loads the `early-default` library after `early-init.el`.
   Users can add `early-init.el` via `emacs.pkgs.withPackages`
   by packaging `early-init.el` into a library named `early-default`.

doc/style.css

@@ -465,8 +465,7 @@ div.appendix .variablelist .term {
   font-display: swap;
 }
 
-div.chapter,
-div.page {
+.chapter {
   content-visibility: auto;
 }
 

flake.nix

@@ -199,8 +199,7 @@
         && system != "riscv64-linux"
         # Exclude x86_64-freebsd because "Package ‘go-1.22.12-freebsd-amd64-bootstrap’ in /nix/store/0yw40qnrar3lvc5hax5n49abl57apjbn-source/pkgs/development/compilers/go/binary.nix:50 is not available on the requested hostPlatform"
         && system != "x86_64-freebsd"
-        # TODO: revert to importing fmt.pkg directly from ./ci when support for 26.05 ends
-      ) (forAllSystems (system: (import ./shell.nix { inherit system; }).formatter));
+      ) (forAllSystems (system: (import ./ci { inherit system; }).fmt.pkg));
 
       /**
         A nested structure of [packages](https://nix.dev/manual/nix/latest/glossary#package-attribute-set) and other values.

lib/asserts.nix

@@ -7,9 +7,6 @@ let
   inherit (lib.lists)
     filter
     ;
-  inherit (lib.attrsets)
-    catAttrs
-    ;
   inherit (lib.trivial)
     showWarnings
     ;
@@ -195,7 +192,7 @@ rec {
   checkAssertWarn =
     assertions: warnings: val:
     let
-      failedAssertions = catAttrs "message" (filter (x: !x.assertion) assertions);
+      failedAssertions = map (x: x.message) (filter (x: !x.assertion) assertions);
     in
     if failedAssertions != [ ] then
       throw "\nFailed assertions:\n${concatStringsSep "\n" (map (x: "- ${x}") failedAssertions)}"

lib/attrsets.nix

@@ -333,8 +333,8 @@ rec {
     :::
   */
   getAttrFromPath =
-    attrPath:
-    attrByPath attrPath (abort ("cannot find attribute '" + concatStringsSep "." attrPath + "'"));
+    attrPath: set:
+    attrByPath attrPath (abort ("cannot find attribute '" + concatStringsSep "." attrPath + "'")) set;
 
   /**
     Map each attribute in the given set and merge them into a new attribute set.
@@ -832,7 +832,9 @@ rec {
   */
   foldAttrs =
     op: nul: list_of_attrs:
-    mapAttrs (name: foldr op nul) (zipAttrs list_of_attrs);
+    foldr (
+      n: a: foldr (name: o: o // { ${name} = op n.${name} (a.${name} or nul); }) a (attrNames n)
+    ) { } list_of_attrs;
 
   /**
     Recursively collect sets that verify a given predicate named `pred`
@@ -871,18 +873,13 @@ rec {
     :::
   */
   collect =
-    pred:
-    let
-      recurse =
-        attrs:
-        if pred attrs then
-          [ attrs ]
-        else if isAttrs attrs then
-          concatMap recurse (attrValues attrs)
-        else
-          [ ];
-    in
-    recurse;
+    pred: attrs:
+    if pred attrs then
+      [ attrs ]
+    else if isAttrs attrs then
+      concatMap (collect pred) (attrValues attrs)
+    else
+      [ ];
 
   /**
     Return the cartesian product of attribute set value combinations.
@@ -1161,7 +1158,7 @@ rec {
     mapAttrsRecursive :: ([String] -> a -> b) -> AttrSet -> AttrSet
     ```
   */
-  mapAttrsRecursive = mapAttrsRecursiveCond (as: true);
+  mapAttrsRecursive = f: set: mapAttrsRecursiveCond (as: true) f set;
 
   /**
     Like `mapAttrsRecursive`, but it takes an additional predicate that tells it whether to recurse into an attribute set.
@@ -1348,14 +1345,7 @@ rec {
 
     :::
   */
-  genAttrs =
-    names: f:
-    listToAttrs (
-      map (name: {
-        inherit name;
-        value = f name;
-      }) names
-    );
+  genAttrs = names: f: genAttrs' names (n: nameValuePair n (f n));
 
   /**
     Like `genAttrs`, but allows the name of each attribute to be specified in addition to the value.
@@ -1873,7 +1863,7 @@ rec {
 
     :::
   */
-  overrideExisting = old: new: old // intersectAttrs old new;
+  overrideExisting = old: new: mapAttrs (name: value: new.${name} or value) old;
 
   /**
     Turns a list of strings into a human-readable description of those
@@ -1981,9 +1971,10 @@ rec {
   getFirstOutput =
     candidates: pkg:
     let
-      outputs = filter (name: pkg ? ${name}) candidates;
+      outputs = builtins.filter (name: hasAttr name pkg) candidates;
+      output = builtins.head outputs;
     in
-    if pkg.outputSpecified or false || outputs == [ ] then pkg else pkg.${head outputs};
+    if pkg.outputSpecified or false || outputs == [ ] then pkg else pkg.${output};
 
   /**
     Get a package's `bin` output.
@@ -2218,13 +2209,7 @@ rec {
 
     :::
   */
-  recurseIntoAttrs =
-    let
-      doRecurse = {
-        recurseForDerivations = true;
-      };
-    in
-    attrs: attrs // doRecurse;
+  recurseIntoAttrs = attrs: attrs // { recurseForDerivations = true; };
 
   /**
     Undo the effect of `recurseIntoAttrs`.
@@ -2241,13 +2226,7 @@ rec {
     dontRecurseIntoAttrs :: AttrSet -> AttrSet
     ```
   */
-  dontRecurseIntoAttrs =
-    let
-      dontRecurse = {
-        recurseForDerivations = false;
-      };
-    in
-    attrs: attrs // dontRecurse;
+  dontRecurseIntoAttrs = attrs: attrs // { recurseForDerivations = false; };
 
   /**
     `unionOfDisjoint x y` is equal to `x // y`, but accessing attributes present

lib/customisation.nix

@@ -2,7 +2,6 @@
 
 let
   inherit (builtins)
-    catAttrs
     intersectAttrs
     unsafeGetAttrPos
     ;
@@ -407,7 +406,7 @@ rec {
           ++ [
             {
               name = "all";
-              value = catAttrs "value" outputsList;
+              value = map (x: x.value) outputsList;
             }
           ]
         )

lib/deprecated/misc.nix

@@ -241,7 +241,7 @@ let
   # See https://github.com/NixOS/nixpkgs/pull/194391 for details.
   closePropagationFast =
     list:
-    builtins.catAttrs "val" (
+    map (x: x.val) (
       builtins.genericClosure {
         startSet = map (x: {
           key = x.outPath;

lib/fileset/internal.nix

@@ -349,33 +349,24 @@ rec {
     ```
   */
   _normaliseTreeFilter =
-    let
-      # Recurses into a tree that's already known to be a directory (either a "directory" or an attrset).
-      #
-      # Only directories need to be recursed into:
-      # Files are either null (excluded) or a file type string (included), which are already normalised.
-      #
-      # Checking this in the caller instead of here also avoids the thunk allocation for the path concatenation below.
-      recurse =
-        path: tree:
-        let
-          normalisedSubtrees = mapAttrs (
-            name: subtree:
-            if subtree == "directory" || isAttrs subtree then recurse (path + "/${name}") subtree else subtree
-          ) (_directoryEntries path tree);
-          subtreeValues = attrValues normalisedSubtrees;
-        in
-        # This triggers either when all files in a directory are filtered out
-        # Or when the directory doesn't contain any files at all
-        if all isNull subtreeValues then
-          null
-        # Triggers when we have the same as a `readDir path`, so we can turn it back into an equivalent "directory".
-        else if all isString subtreeValues then
-          "directory"
-        else
-          normalisedSubtrees;
-    in
-    path: tree: if tree == "directory" || isAttrs tree then recurse path tree else tree;
+    path: tree:
+    if tree == "directory" || isAttrs tree then
+      let
+        entries = _directoryEntries path tree;
+        normalisedSubtrees = mapAttrs (name: _normaliseTreeFilter (path + "/${name}")) entries;
+        subtreeValues = attrValues normalisedSubtrees;
+      in
+      # This triggers either when all files in a directory are filtered out
+      # Or when the directory doesn't contain any files at all
+      if all isNull subtreeValues then
+        null
+      # Triggers when we have the same as a `readDir path`, so we can turn it back into an equivalent "directory".
+      else if all isString subtreeValues then
+        "directory"
+      else
+        normalisedSubtrees
+    else
+      tree;
 
   /**
     A minimal normalisation of a filesetTree, intended for pretty-printing:
@@ -535,9 +526,6 @@ rec {
         else
           "/" + concatStringsSep "/" fileset._internalBaseComponents + "/";
 
-      getBaseStringPrefix = substring 0 baseLength;
-      removeBaseStringPrefix = substring baseLength (-1);
-
       baseLength = stringLength baseString;
 
       # Check whether a list of path components under the base path exists in the tree.
@@ -563,12 +551,7 @@ rec {
               # or a string ("directory" or "regular", etc.) in which case it's included
               localTree != null;
         in
-        # Start by recursing into the first element. This is guaranteed to be
-        # safe. components will never be empty (builtins.split can't make an
-        # empty list). Tree can be something other than an attrset, but if so,
-        # the isAttrs check will fail when being passed `or tree`, and the index
-        # being ahead doesn't matter.
-        recurse 2 (tree.${head components} or tree);
+        recurse 0 tree;
 
       # Filter suited when there's no files
       empty = _: _: false;
@@ -586,34 +569,25 @@ rec {
           pathSlash = path + "/";
         in
         (
-          # Same as `hasPrefix baseString pathSlash`, but more efficient.
-          # The path is either the base itself or underneath it,
-          # but only on the few paths above it, so its checked first.
-          # With base /foo/bar this matches /foo/bar and /foo/bar/baz
-          # hasPrefix "/foo/bar/" "/foo/bar/baz/"
-          if getBaseStringPrefix pathSlash == baseString then
-            if pathSlash == baseString then
-              # The path is the base directory itself, which is always included
-              true
-            else
-              # Same as `removePrefix baseString path`, but more efficient.
-              # From the above code we know that hasPrefix baseString pathSlash holds, so this is safe.
-              # We don't use pathSlash here because we only needed the trailing slash for the prefix matching.
-              # With base /foo and path /foo/bar/baz this gives
-              # inTree (split "/" (removePrefix "/foo/" "/foo/bar/baz"))
-              # == inTree (split "/" "bar/baz")
-              # == inTree [ "bar" "baz" ]
-              inTree (split "/" (removeBaseStringPrefix path))
           # Same as `hasPrefix pathSlash baseString`, but more efficient.
-          # The path is a proper ancestor of the base, which needs to be included for the base to be reachable:
           # With base /foo/bar we need to include /foo:
           # hasPrefix "/foo/" "/foo/bar/"
-          else if substring 0 (stringLength pathSlash) baseString == pathSlash then
+          if substring 0 (stringLength pathSlash) baseString == pathSlash then
             true
-          else
-            # The path is unrelated to the base, so nothing from it is included
-            # With base /foo/bar this matches e.g. /baz
+          # Same as `! hasPrefix baseString pathSlash`, but more efficient.
+          # With base /foo/bar we need to exclude /baz
+          # ! hasPrefix "/baz/" "/foo/bar/"
+          else if substring 0 baseLength pathSlash != baseString then
             false
+          else
+            # Same as `removePrefix baseString path`, but more efficient.
+            # From the above code we know that hasPrefix baseString pathSlash holds, so this is safe.
+            # We don't use pathSlash here because we only needed the trailing slash for the prefix matching.
+            # With base /foo and path /foo/bar/baz this gives
+            # inTree (split "/" (removePrefix "/foo/" "/foo/bar/baz"))
+            # == inTree (split "/" "bar/baz")
+            # == inTree [ "bar" "baz" ]
+            inTree (split "/" (substring baseLength (-1) path))
         )
         # This is a way have an additional check in case the above is true without any significant performance cost
         && (
@@ -828,34 +802,21 @@ rec {
   */
   _unionTrees =
     trees:
-    if length trees == 1 then
-      # The union of a single tree simply returns the first element
-      head trees
-    else
-      let
-        # Like lib.findFirstIndex but without indexing.
-        # This is a hot path so the indexing arithmetic adds up.
-        firstStr = foldl' (
-          found: tree:
-          if found != null then
-            found
-          else if isString tree then
-            tree
-          else
-            found # null
-        ) null trees;
-        nonNulls = filter (tree: tree != null) trees;
-      in
+    let
+      stringIndex = findFirstIndex isString null trees;
+      withoutNull = filter (tree: tree != null) trees;
+    in
+    if stringIndex != null then
       # If there's a string, it's always a fully included tree (dir or file),
       # no need to look at other elements
-      if firstStr != null then
-        firstStr
-      else if nonNulls == [ ] then
-        null
-      else
-        # The non-null elements have to be attribute sets representing partial trees
-        # We need to recurse into those
-        zipAttrsWith (name: _unionTrees) nonNulls;
+      elemAt trees stringIndex
+    else if withoutNull == [ ] then
+      # If all trees are null, then the resulting tree is also null
+      null
+    else
+      # The non-null elements have to be attribute sets representing partial trees
+      # We need to recurse into those
+      zipAttrsWith (name: _unionTrees) withoutNull;
 
   /**
     Computes the intersection of two filesets.

lib/filesystem.nix

@@ -375,8 +375,6 @@ in
         recurseIntoAttrs
         removeSuffix
         ;
-      isNixFile = hasSuffix ".nix";
-      removeNixSuffix = removeSuffix ".nix";
 
       # Generate an attrset corresponding to a given directory.
       # This function is outside `packagesFromDirectoryRecursive`'s lambda expression,
@@ -399,10 +397,10 @@ in
                 }
               );
             }
-          else if type == "regular" && isNixFile name then
+          else if type == "regular" && hasSuffix ".nix" name then
             {
               # call .nix files
-              "${removeNixSuffix name}" = callPackage path { };
+              "${removeSuffix ".nix" name}" = callPackage path { };
             }
           else if type == "regular" then
             {

lib/gvariant.nix

@@ -14,7 +14,6 @@
 
 let
   inherit (lib)
-    catAttrs
     concatMapStringsSep
     concatStrings
     escape
@@ -410,7 +409,7 @@ rec {
     elems:
     let
       gvarElems = map mkValue elems;
-      tupleType = type.tupleOf (catAttrs "type" gvarElems);
+      tupleType = type.tupleOf (map (e: e.type) gvarElems);
     in
     mkPrimitive tupleType gvarElems
     // {

lib/licenses/licenses.nix

@@ -178,11 +178,6 @@ lib.mapAttrs mkLicense (
       fullName = "Baekmuk License";
     };
 
-    bisonException22 = {
-      spdxId = "Bison-exception-2.2";
-      fullName = "Bison exception 2.2";
-    };
-
     bitstreamCharter = {
       spdxId = "Bitstream-Charter";
       fullName = "Bitstream Charter Font License";
@@ -203,11 +198,6 @@ lib.mapAttrs mkLicense (
       fullName = " BitTorrent Open Source License v1.1";
     };
 
-    blessing = {
-      spdxId = "blessing";
-      fullName = "SQLite Blessing";
-    };
-
     boehmGC = {
       spdxId = "Boehm-GC";
       fullName = "Boehm-Demers-Weiser GC License";
@@ -325,11 +315,6 @@ lib.mapAttrs mkLicense (
       fullName = "Buddy License";
     };
 
-    bugroff = {
-      spdxId = "Bugroff";
-      fullName = "Bugroff License";
-    };
-
     bzip2 = {
       spdxId = "bzip2-1.0.6";
       fullName = "bzip2 and libbzip2 License v1.0.6";
@@ -709,11 +694,6 @@ lib.mapAttrs mkLicense (
       url = "https://geant4.web.cern.ch/geant4/license/LICENSE.html";
     };
 
-    gccException31 = {
-      spdxId = "GCC-exception-3.1";
-      fullName = "GCC Runtime Library exception 3.1";
-    };
-
     geogebra = {
       fullName = "GeoGebra Non-Commercial License Agreement";
       url = "https://www.geogebra.org/license";
@@ -945,16 +925,6 @@ lib.mapAttrs mkLicense (
       redistributable = true;
     };
 
-    fsfap = {
-      spdxId = "FSFAP";
-      fullName = "FSF All Permissive License";
-    };
-
-    fsfullr = {
-      spdxId = "FSFULLR";
-      fullName = "FSF Unlimited License (with License Retention)";
-    };
-
     hl3 = {
       fullName = "Hippocratic License v3.0";
       url = "https://firstdonoharm.dev/version/3/0/core.txt";
@@ -1049,9 +1019,9 @@ lib.mapAttrs mkLicense (
       fullName = "Licence Libre du Québec – Permissive version 1.1";
     };
 
-    llgplPreamble = {
-      spdxId = "LLGPL";
-      fullName = "LLGPL Preamble"; # Only used together with LGPL (clarifying C-centric terms of LGPL in context of Lisp), SPDX tracks it separately
+    llgpl21 = {
+      fullName = "Lisp LGPL; GNU Lesser General Public License version 2.1 with Franz Inc. preamble for clarification of LGPL terms in context of Lisp";
+      url = "https://opensource.franz.com/preamble.html";
     };
 
     llvm-exception = {
@@ -1289,11 +1259,6 @@ lib.mapAttrs mkLicense (
       fullName = "SIL Open Font License 1.1";
     };
 
-    ogluk30 = {
-      spdxId = "OGL-UK-3.0";
-      fullName = "Open Government Licence v3.0";
-    };
-
     oml = {
       spdxId = "OML";
       fullName = "Open Market License";
@@ -1380,16 +1345,6 @@ lib.mapAttrs mkLicense (
       fullName = "Q Public License 1.0";
     };
 
-    qtGplException10 = {
-      spdxId = "Qt-GPL-exception-1.0";
-      fullName = "Qt GPL exception 1.0";
-    };
-
-    qtLgplException11 = {
-      spdxId = "Qt-LGPL-exception-1.1";
-      fullName = "Qt LPL exception 1.1";
-    };
-
     qwtException = {
       spdxId = "Qwt-exception-1.0";
       fullName = "Qwt exception 1.0";
@@ -1466,8 +1421,9 @@ lib.mapAttrs mkLicense (
     };
 
     stk = {
-      spdxId = "MIT-STK";
-      fullName = "MIT-STK License";
+      shortName = "stk";
+      fullName = "Synthesis Tool Kit 4.3";
+      url = "https://github.com/thestk/stk/blob/master/LICENSE";
     };
 
     sudo = {
@@ -1622,13 +1578,6 @@ lib.mapAttrs mkLicense (
       fullName = "Universal Permissive License";
     };
 
-    valveSDK = {
-      fullName = "Valve Corporation Steamworks SDK Access Agreement";
-      url = "https://partner.steamgames.com/documentation/sdk_access_agreement";
-      free = false;
-      redistributable = true;
-    };
-
     vim = {
       spdxId = "Vim";
       fullName = "Vim License";
@@ -1674,11 +1623,6 @@ lib.mapAttrs mkLicense (
       fullName = "W3C Software Notice and License (1998-07-20)";
     };
 
-    w3c-20150513 = {
-      spdxId = "W3C-20150513";
-      fullName = "W3C Software Notice and Document License (2015-05-13)";
-    };
-
     wadalab = {
       fullName = "Wadalab Font License";
       url = "https://fedoraproject.org/wiki/Licensing:Wadalab?rd=Licensing/Wadalab";

lib/lists.nix

@@ -646,28 +646,11 @@ rec {
     :::
   */
   findFirst =
-    let
-      init = {
-        found = false;
-      };
-    in
     pred: default: list:
     let
-      result = foldl' (
-        acc: el:
-        if !acc.found && pred el then
-          # We haven't found a match yet, and the current element passes the
-          # predicate!
-          {
-            found = true;
-            value = el;
-          }
-        else
-          # There's already a match, or the current element fails the predicate
-          acc
-      ) init list;
+      index = findFirstIndex pred null list;
     in
-    if result.found then result.value else default;
+    if index == null then default else elemAt list index;
 
   /**
     Returns true if function `pred` returns true for at least one

lib/meta-types.nix

@@ -16,7 +16,6 @@ let
     any
     attrNames
     attrValues
-    catAttrs
     concatMap
     isFunction
     isBool
@@ -142,10 +141,10 @@ lib.fix (self: {
     assert all isTypeDef types;
     let
       # Store a list of functions so we don't have to pay the cost of attrset lookups at runtime.
-      funcs = catAttrs "verify" types;
+      funcs = map (t: t.verify) types;
     in
     {
-      name = "union<${concatStringsSep "," (catAttrs "name" types)}>";
+      name = "union<${concatStringsSep "," (map (t: t.name) types)}>";
       verify = v: any (func: func v) funcs;
     };
 
@@ -154,10 +153,10 @@ lib.fix (self: {
     assert all isTypeDef types;
     let
       # Store a list of functions so we don't have to pay the cost of attrset lookups at runtime.
-      funcs = catAttrs "verify" types;
+      funcs = map (t: t.verify) types;
     in
     {
-      name = "intersection<${concatStringsSep "," (catAttrs "name" types)}>";
+      name = "intersection<${concatStringsSep "," (map (t: t.name) types)}>";
       verify = v: all (func: func v) funcs;
     };
 

lib/modules.nix

@@ -566,7 +566,7 @@ let
         let
           keyFilter = filter (attrs: !isDisabled modulesPath disabled attrs);
         in
-        catAttrs "module" (genericClosure {
+        map (attrs: attrs.module) (genericClosure {
           startSet = keyFilter modules;
           operator = attrs: keyFilter attrs.modules;
         });
@@ -1148,8 +1148,8 @@ let
     // {
       value = addErrorContext "while evaluating the option `${showOption loc}':" value;
       inherit (res.defsFinal') highestPrio;
-      definitions = catAttrs "value" res.defsFinal;
-      files = catAttrs "file" res.defsFinal;
+      definitions = map (def: def.value) res.defsFinal;
+      files = map (def: def.file) res.defsFinal;
       definitionsWithLocations = res.defsFinal;
       inherit (res) isDefined;
       inherit (res.checkedAndMerged) valueMeta;

lib/options.nix

@@ -29,7 +29,6 @@ let
     ;
   inherit (lib.attrsets)
     attrByPath
-    catAttrs
     optionalAttrs
     showAttrPath
     ;
@@ -540,7 +539,7 @@ rec {
 
     :::
   */
-  getValues = catAttrs "value";
+  getValues = map (x: x.value);
 
   /**
     Extracts values of all `file` keys of the given list
@@ -562,7 +561,7 @@ rec {
 
     :::
   */
-  getFiles = catAttrs "file";
+  getFiles = map (x: x.file);
 
   # Generate documentation template from the list of option declaration like
   # the set generated with filterOptionSets.

lib/services/service.nix

@@ -12,31 +12,7 @@
 }:
 let
   inherit (lib) mkEnableOption mkOption types;
-
-  # Paths are interpolated rather than `toString`ed on purpose: interpolation
-  # copies the path into the store, so the resulting argument still resolves on
-  # the machine that runs the service. `toString` would yield the path of the
-  # source tree the configuration was evaluated from, which is not there at
-  # runtime.
   pathOrStr = types.coercedTo types.path (x: "${x}") types.str;
-
-  # `argv` and `flags` share a single `lib.mkOrder` space, so flags need a
-  # priority. This one sits between `lib.modules.defaultOrderPriority` (1000,
-  # what an unadorned `argv` definition gets) and `lib.mkAfter` (1500): plain
-  # flags follow plain `argv` entries, while `lib.mkAfter` on `argv` still lands
-  # after the flags. See the `flags` option description.
-  unadornedFlagPriority = 1250;
-
-  # `attrListWith` re-emits every flag wrapped in `lib.mkOrder`, using
-  # `lib.modules.defaultOrderPriority` for flags that carried no ordering
-  # property of their own. Rewrite exactly that priority; anything else is an
-  # explicit `lib.mkOrder` from the user and is passed through verbatim.
-  atFlagPriority =
-    def:
-    if def.value._type or null == "order" && def.value.priority == lib.modules.defaultOrderPriority then
-      def // { value = lib.mkOrder unadornedFlagPriority def.value.content; }
-    else
-      def;
 in
 {
   # https://nixos.org/manual/nixos/unstable/#modular-services
@@ -73,100 +49,6 @@ in
           This is a raw command-line that should not contain any shell escaping.
           If expansion of environmental variables is required then use
           a shell script or `importas` from `pkgs.execline`.
-
-          When `flags` are set, the arguments rendered from them are merged into
-          `argv`. See `flags` for how the two are ordered against each other.
-        '';
-      };
-
-      flagFormat = mkOption {
-        type = types.functionTo (types.attrsOf types.anything);
-        default = name: {
-          option = name;
-          sep = null;
-          explicitBool = false;
-        };
-        description = ''
-          Function mapping flag names to option format specs
-          for `lib.cli.toCommandLine`.
-
-          Receives the flag name and returns `{ option, sep, explicitBool, formatArg? }`.
-        '';
-        example = lib.literalExpression ''
-          name: {
-            option = name;
-            sep = "=";
-            explicitBool = false;
-          }
-        '';
-      };
-
-      flags = mkOption {
-        type = types.attrListWith {
-          elemType = types.nullOr (
-            types.oneOf [
-              types.bool
-              types.int
-              # `pathOrStr`, not `types.path`: `lib.cli.toCommandLine` renders
-              # values with `lib.generators.mkValueStringDefault`, which has no
-              # case for paths and would abort.
-              pathOrStr
-            ]
-          );
-          asAttrs = true;
-        };
-        default = { };
-        description = ''
-          Flags to pass to the service process.
-          The key is the flag name (e.g. `"--port"`), the value is the flag value.
-
-          Each `name = value` pair is rendered via `lib.cli.toCommandLine`
-          using `flagFormat`.
-
-          - `null`: the flag is omitted (regardless of `flagFormat`)
-          - bool: rendered per `flagFormat.explicitBool`
-            - `explicitBool = false` (default): `true` emits the bare flag,
-              `false` is omitted
-            - `explicitBool = true`: both `true` and `false` are rendered as
-              explicit arguments via `flagFormat.formatArg`
-          - string / path / int: rendered as the option's argument, joined to the
-            option name per `flagFormat.sep` and stringified by
-            `flagFormat.formatArg`
-
-          To pass the same flag multiple times, use the list form with
-          repeated keys, e.g.
-          `[ { "--host" = "a"; } { "--host" = "b"; } ]`.
-
-          The rendered arguments are merged into `argv`, so `argv` and `flags`
-          share a single `lib.mkOrder` space:
-
-          - A flag with no ordering property of its own is placed at priority
-            1250, between `lib.modules.defaultOrderPriority` (1000, which is
-            what an unadorned `argv` definition gets) and `lib.mkAfter` (1500).
-            Plain flags therefore follow the command name and any other plain
-            `argv` arguments.
-          - `lib.mkAfter` on `argv` still lands after the flags, which is how
-            trailing positional arguments are expressed.
-          - `lib.mkOrder` on a flag is honoured verbatim against `argv`, so a
-            sub-command can be placed between two groups of flags.
-
-          Because 1250 is substituted for flags that carry no ordering property,
-          `lib.mkOrder 1000` on a flag is indistinguishable from leaving that
-          flag unadorned. To order a flag around plain `argv` entries, pick a
-          priority next to 1000, such as 999 or 1001.
-        '';
-        example = lib.literalExpression ''
-          {
-            "--port" = "8080";
-            "--verbose" = true;
-            # ordered ahead of the unadorned flags above
-            "--config" = lib.mkOrder 1100 "/etc/foo.conf";
-          }
-          # or, for repeated flags:
-          [
-            { "--host" = "localhost"; }
-            { "--host" = "0.0.0.0"; }
-          ]
         '';
       };
 
@@ -221,9 +103,5 @@ in
     process.reloadCommand = lib.mkIf (config.process.reloadSignal != null) (
       lib.mkDefault "${pkgs.coreutils}/bin/kill -${config.process.reloadSignal} $MAINPID"
     );
-
-    process.argv = lib.modules.mapDefinitionValue (
-      attr: lib.cli.toCommandLine config.process.flagFormat attr
-    ) (lib.mkMerge (map atFlagPriority options.process.flags.valueMeta.definitions));
   };
 }

lib/services/test.nix

@@ -77,60 +77,6 @@ let
           ];
         };
       };
-      # The default `flagFormat`, and one flag of every supported value kind.
-      flagsDefault = {
-        process = {
-          argv = [ "/bin/flagged" ];
-          flags = {
-            "--bool-off" = false;
-            "--bool-on" = true;
-            "--config" = ./test.nix;
-            "--count" = 3;
-            "--name" = "example";
-            "--unset" = null;
-          };
-        };
-      };
-      # A `flagFormat` that joins with `=` and spells out booleans.
-      flagsCustomFormat = {
-        process = {
-          argv = [ "/bin/flagged" ];
-          flagFormat = name: {
-            option = "--${name}";
-            sep = "=";
-            explicitBool = true;
-          };
-          flags = {
-            port = 8080;
-            quiet = false;
-            verbose = true;
-          };
-        };
-      };
-      # The list form, which allows a flag to be repeated.
-      flagsRepeated = {
-        process = {
-          argv = [ "/bin/flagged" ];
-          flags = [
-            { "--host" = "a"; }
-            { "--host" = "b"; }
-          ];
-        };
-      };
-      # `argv` and `flags` share one `lib.mkOrder` space.
-      flagsOrdering = {
-        process = {
-          argv = lib.mkMerge [
-            (lib.mkBefore [ "/bin/gt" ])
-            (lib.mkOrder 800 [ "server" ])
-            (lib.mkAfter [ "TRAILING" ])
-          ];
-          flags = lib.mkMerge [
-            { "--listen" = "a"; }
-            { "--disable-landlock" = lib.mkOrder 600 true; }
-          ];
-        };
-      };
     };
   };
 
@@ -145,16 +91,10 @@ let
     ];
   };
 
-  # Every service carries some assertions that hold; only the violated ones are of interest here.
-  failures = lib.filter (a: !a.assertion);
-
   filterEval =
     config:
     lib.optionalAttrs (config ? process) {
-      inherit (config) warnings;
-      assertions = failures config.assertions;
-      # Only `argv` is relevant here; `process` also carries the reload options.
-      process = { inherit (config.process) argv; };
+      inherit (config) assertions warnings process;
     }
     // {
       services = lib.mapAttrs (k: filterEval) config.services;
@@ -216,65 +156,6 @@ let
             assertions = [ ];
             warnings = [ ];
           };
-          flagsDefault = {
-            process = {
-              argv = [
-                "/bin/flagged"
-                "--bool-on"
-                "--config"
-                "${./test.nix}"
-                "--count"
-                "3"
-                "--name"
-                "example"
-              ];
-            };
-            services = { };
-            assertions = [ ];
-            warnings = [ ];
-          };
-          flagsCustomFormat = {
-            process = {
-              argv = [
-                "/bin/flagged"
-                "--port=8080"
-                "--quiet=false"
-                "--verbose=true"
-              ];
-            };
-            services = { };
-            assertions = [ ];
-            warnings = [ ];
-          };
-          flagsRepeated = {
-            process = {
-              argv = [
-                "/bin/flagged"
-                "--host"
-                "a"
-                "--host"
-                "b"
-              ];
-            };
-            services = { };
-            assertions = [ ];
-            warnings = [ ];
-          };
-          flagsOrdering = {
-            process = {
-              argv = [
-                "/bin/gt"
-                "--disable-landlock"
-                "server"
-                "--listen"
-                "a"
-                "TRAILING"
-              ];
-            };
-            services = { };
-            assertions = [ ];
-            warnings = [ ];
-          };
         };
       };
 
@@ -284,7 +165,7 @@ let
       ];
 
     assert
-      failures (portable-lib.getAssertions [ "service1" ] exampleEval.config.services.service1) == [
+      portable-lib.getAssertions [ "service1" ] exampleEval.config.services.service1 == [
         {
           message = "in service1: you can't enable this for that reason";
           assertion = false;
@@ -296,7 +177,7 @@ let
         "in service3.services.exclacow: The `bar' service is deprecated and will go away soon!"
       ];
     assert
-      failures (portable-lib.getAssertions [ "service3" ] exampleEval.config.services.service3) == [
+      portable-lib.getAssertions [ "service3" ] exampleEval.config.services.service3 == [
         {
           message = "in service3.services.exclacow: you can't enable this for such reason";
           assertion = false;

lib/sources.nix

@@ -34,8 +34,6 @@ let
     pathIsRegularFile
     ;
 
-  removeSlashSuffix = removeSuffix "/";
-
   /**
     A basic filter for `cleanSourceWith` that removes
     directories of version control system, backup files (`*~`)
@@ -364,7 +362,7 @@ let
               gitDir = absolutePath (dirOf path) (head m);
               commonDir'' =
                 if pathIsRegularFile "${gitDir}/commondir" then fileContents "${gitDir}/commondir" else gitDir;
-              commonDir' = removeSlashSuffix commonDir'';
+              commonDir' = removeSuffix "/" commonDir'';
               commonDir = absolutePath gitDir commonDir';
               refFile = removePrefix "${commonDir}/" "${gitDir}/${file}";
             in
@@ -462,7 +460,7 @@ let
   urlToName =
     url:
     let
-      base = baseNameOf (removeSlashSuffix (last (splitString ":" (toString url))));
+      base = baseNameOf (removeSuffix "/" (last (splitString ":" (toString url))));
       # chop away one git or archive-related extension
       removeExt =
         name:

lib/strings.nix

@@ -808,7 +808,7 @@ rec {
   hasPrefix =
     pref:
     let
-      getGivenPrefix = substring 0 (stringLength pref);
+      lenPrefix = stringLength pref;
     in
     if isPath pref then
       # Before 23.05, paths would be copied to the store before converting them
@@ -817,7 +817,7 @@ rec {
         lib.strings.hasPrefix: The first argument (${toString pref}) is a path value, but only strings are supported.
             You might want to use `lib.path.hasPrefix` instead, which correctly supports paths.''
     else
-      str: getGivenPrefix str == pref;
+      str: substring 0 lenPrefix str == pref;
 
   /**
     Determine whether a string has given suffix.
@@ -905,7 +905,7 @@ rec {
   hasInfix =
     infix:
     let
-      matchGivenInfix = builtins.match ".*${escapeRegex infix}.*";
+      escapedInfix = escapeRegex infix;
     in
     if isPath infix then
       # Before 23.05, paths would be copied to the store before converting them
@@ -915,7 +915,7 @@ rec {
             There is almost certainly a bug in the calling code, since this function always returns `false` in such a case.
             This function also copies the path to the Nix store, which may not be what you want.''
     else
-      content: matchGivenInfix "${content}" != null;
+      content: builtins.match ".*${escapedInfix}.*" "${content}" != null;
 
   /**
     Convert a string `s` to a list of characters (i.e. singleton strings).
@@ -2871,11 +2871,7 @@ rec {
 
     :::
   */
-  fileContents =
-    let
-      removeNewlineSuffix = removeSuffix "\n";
-    in
-    file: removeNewlineSuffix (readFile file);
+  fileContents = file: removeSuffix "\n" (readFile file);
 
   /**
     Creates a valid derivation name from a potentially invalid one.

lib/systems/default.nix

@@ -151,24 +151,7 @@ let
           );
 
         # Derived meta-data
-        useLLVM =
-          final.isFreeBSD
-          || final.isOpenBSD
-          || final.isUefi
-          || final.isMsvc
-          ||
-            # because GCC does not support this platform yet
-            (with final; isWindows && isAarch64);
-
-        # Use the split GCC package set (`gccNGPackages`) instead of the
-        # monolithic `gcc`. No platform selects it yet; it is opt-in, set
-        # explicitly on a platform spec, so that the split set can be exercised
-        # before anything depends on it.
-        #
-        # I (@Ericson2314) plan on making obscure low-tier platforms (e.g.
-        # NetBSD) use it soon, so we can dogfood GCC NG and thereby iron out its
-        # bugs.
-        useGccNG = false;
+        useLLVM = final.isFreeBSD || final.isOpenBSD;
 
         libc =
           if final.isDarwin then
@@ -187,13 +170,13 @@ let
             "relibc"
           else if final.isMusl then
             "musl"
-          else if final.isPicolibc then
-            "picolibc"
           else if final.isUClibc then
             "uclibc"
           else if final.isAndroid then
             "bionic"
-          else if final.isLinux then
+          else if
+            final.isLinux # default
+          then
             "glibc"
           else if final.isFreeBSD then
             "fblibc"
@@ -205,8 +188,6 @@ let
             "avrlibc"
           else if final.isGhcjs then
             null
-          else if final.isUefi then
-            null
           else if final.isNone then
             "newlib"
           # TODO(@Ericson2314) think more about other operating systems
@@ -264,7 +245,7 @@ let
               netbsd = "NetBSD";
               freebsd = "FreeBSD";
               openbsd = "OpenBSD";
-              wasip1 = "WasiP1";
+              wasi = "Wasi";
               redox = "Redox";
               genode = "Genode";
             }
@@ -489,8 +470,6 @@ let
                   rust.platform.os or "none"
                 else if final.isDarwin then
                   "macos"
-                else if final.isWasi then
-                  "wasi"
                 else if final.isWasm && !final.isWasi then
                   "unknown" # Needed for {wasm32,wasm64}-unknown-unknown.
                 else
@@ -549,7 +528,11 @@ let
                   abi.name;
 
               inferred =
-                if final.isWasiP1 then
+                if final.isWasi then
+                  # Rust uses `wasm32-wasip?` rather than `wasm32-unknown-wasi`.
+                  # We cannot know which subversion does the user want, and
+                  # currently use WASI 0.1 as default for compatibility. Custom
+                  # users can set `rust.rustcTargetSpec` to override it.
                   "${cpu_}-wasip1"
                 else
                   "${cpu_}-${vendor_}-${kernel.name}${optionalString (abi.name != "unknown") "-${abi_}"}";
@@ -602,7 +585,6 @@ let
               "i686" = "386";
               "loongarch64" = "loong64";
               "mips" = "mips";
-              "mips64" = "mips64";
               "mips64el" = "mips64le";
               "mipsel" = "mipsle";
               "powerpc64" = "ppc64";
@@ -613,7 +595,7 @@ let
               "wasm32" = "wasm";
             }
             .${final.parsed.cpu.name} or null;
-          GOOS = if final.isWasiP1 then "wasip1" else final.parsed.kernel.name;
+          GOOS = if final.isWasi then "wasip1" else final.parsed.kernel.name;
 
           # See https://go.dev/wiki/GoArm
           GOARM = toString (lib.intersectLists [ (final.parsed.cpu.version or "") ] [ "5" "6" "7" ]);

lib/systems/doubles.nix

@@ -112,8 +112,8 @@ let
     "x86_64-redox"
 
     # WASI
-    "wasm64-wasip1"
-    "wasm32-wasip1"
+    "wasm64-wasi"
+    "wasm32-wasi"
 
     # Windows
     "aarch64-windows"

lib/systems/examples.nix

@@ -93,6 +93,7 @@ rec {
     config = "aarch64-unknown-linux-android";
     androidSdkVersion = "35";
     androidNdkVersion = "27";
+    libc = "bionic";
     useAndroidPrebuilt = false;
     useLLVM = true;
   };
@@ -168,18 +169,22 @@ rec {
 
   riscv64-embedded = {
     config = "riscv64-none-elf";
+    libc = "newlib";
   };
 
   riscv32-embedded = {
     config = "riscv32-none-elf";
+    libc = "newlib";
   };
 
   mips64-embedded = {
     config = "mips64-none-elf";
+    libc = "newlib";
   };
 
   mips-embedded = {
     config = "mips-none-elf";
+    libc = "newlib";
   };
 
   # https://github.com/loongson/la-softdev-convention/blob/master/la-softdev-convention.adoc#10-operating-system-package-build-requirements
@@ -196,17 +201,17 @@ rec {
 
   mmix = {
     config = "mmix-unknown-mmixware";
-    # Not `isNone`: the OS here is `mmixware`, so the bare-metal default does
-    # not apply.
     libc = "newlib";
   };
 
   rx-embedded = {
     config = "rx-none-elf";
+    libc = "newlib";
   };
 
   msp430 = {
     config = "msp430-elf";
+    libc = "newlib";
   };
 
   avr = {
@@ -215,10 +220,12 @@ rec {
 
   vc4 = {
     config = "vc4-elf";
+    libc = "newlib";
   };
 
   or1k = {
     config = "or1k-elf";
+    libc = "newlib";
   };
 
   m68k = {
@@ -243,6 +250,7 @@ rec {
 
   arm-embedded = {
     config = "arm-none-eabi";
+    libc = "newlib";
   };
   arm-embedded-nano = {
     config = "arm-none-eabi";
@@ -250,6 +258,7 @@ rec {
   };
   armhf-embedded = {
     config = "arm-none-eabihf";
+    libc = "newlib";
     # GCC8+ does not build without this
     # (https://www.mail-archive.com/gcc-bugs@gcc.gnu.org/msg552339.html):
     gcc = {
@@ -260,31 +269,38 @@ rec {
 
   aarch64-embedded = {
     config = "aarch64-none-elf";
+    libc = "newlib";
     rust.rustcTarget = "aarch64-unknown-none";
   };
 
   aarch64be-embedded = {
     config = "aarch64_be-none-elf";
+    libc = "newlib";
   };
 
   ppc-embedded = {
     config = "powerpc-none-eabi";
+    libc = "newlib";
   };
 
   ppcle-embedded = {
     config = "powerpcle-none-eabi";
+    libc = "newlib";
   };
 
   i686-embedded = {
     config = "i686-elf";
+    libc = "newlib";
   };
 
   x86_64-embedded = {
     config = "x86_64-elf";
+    libc = "newlib";
   };
 
   microblaze-embedded = {
     config = "microblazeel-none-elf";
+    libc = "newlib";
   };
 
   #
@@ -322,10 +338,16 @@ rec {
 
   x86_64-unknown-uefi = {
     config = "x86_64-unknown-uefi";
+    libc = null;
+    useLLVM = true;
+    linker = "lld";
   };
 
   aarch64-unknown-uefi = {
     config = "aarch64-unknown-uefi";
+    libc = null;
+    useLLVM = true;
+    linker = "lld";
   };
 
   #
@@ -360,11 +382,12 @@ rec {
   };
 
   # mingw-w64 with ucrt for Aarch64, default compiler (which is LLVM
-  # see ./default.nix).
+  # because GCC does not support this platform yet).
   mingw-ucrt-aarch64 = {
     config = "aarch64-w64-mingw32";
     libc = "ucrt";
     rust.rustcTarget = "aarch64-pc-windows-gnullvm";
+    useLLVM = true;
   };
 
   # mingw-64 back compat
@@ -377,10 +400,12 @@ rec {
   # Target the MSVC ABI
   x86_64-windows = {
     config = "x86_64-pc-windows-msvc";
+    useLLVM = true;
   };
 
   aarch64-windows = {
     config = "aarch64-pc-windows-msvc";
+    useLLVM = true;
   };
 
   x86_64-cygwin = {
@@ -391,10 +416,12 @@ rec {
 
   aarch64-freebsd = {
     config = "aarch64-unknown-freebsd";
+    useLLVM = true;
   };
 
   x86_64-freebsd = {
     config = "x86_64-unknown-freebsd";
+    useLLVM = true;
   };
 
   x86_64-netbsd = {
@@ -416,14 +443,8 @@ rec {
   # WASM
   #
 
-  wasm32-wasip1 = {
-    config = "wasm32-unknown-wasip1";
-    useLLVM = true;
-  };
-
-  # Historical-reasons alias for wasm32-wasip1.
   wasi32 = {
-    config = "wasm32-unknown-wasip1";
+    config = "wasm32-unknown-wasi";
     useLLVM = true;
   };
 

lib/systems/inspect.nix

@@ -27,8 +27,6 @@ let
     execFormats
     ;
 
-  hasArmv7Prefix = hasPrefix "armv7";
-
   # Based on lib.attrsets.matchAttrs, but with:
   # - the initial isAttrs assertion removed, since this function is only ever
   # called with attrsets
@@ -139,7 +137,7 @@ rec {
       {
         cpu = { inherit arch; };
       }
-    ) (filter (cpu: cpu ? arch && hasArmv7Prefix cpu.arch) (attrValues cpuTypes));
+    ) (filter (cpu: hasPrefix "armv7" cpu.arch or "") (attrValues cpuTypes));
     isAarch64 = {
       cpu = {
         family = "arm";
@@ -392,11 +390,8 @@ rec {
       kernel = kernels.windows;
       abi = abis.msvc;
     };
-    isWasi = [
-      { kernel = kernels.wasip1; }
-    ];
-    isWasiP1 = {
-      kernel = kernels.wasip1;
+    isWasi = {
+      kernel = kernels.wasi;
     };
     isRedox = {
       kernel = kernels.redox;
@@ -435,9 +430,6 @@ rec {
         muslabin32
         muslabi64
       ];
-    isPicolibc = {
-      abi = abis.picolibc;
-    };
     isUClibc =
       with abis;
       map (a: { abi = a; }) [

lib/systems/parse.nix

@@ -601,7 +601,7 @@ rec {
         execFormat = elf;
         families = { };
       };
-      wasip1 = {
+      wasi = {
         execFormat = wasm;
         families = { };
       };
@@ -640,7 +640,6 @@ rec {
       darwin = kernels.macos;
       watchos = kernels.ios;
       tvos = kernels.ios;
-      wasi = kernels.wasip1;
       win32 = kernels.windows;
     };
 
@@ -743,8 +742,6 @@ rec {
     };
     musl = { };
 
-    picolibc = { };
-
     uclibceabi = {
       float = "soft";
       eabi = true;

lib/types.nix

@@ -91,9 +91,6 @@ let
     in
     if pos == null then "" else " at ${pos.file}:${toString pos.line}:${toString pos.column}";
 
-  hasColonInfix = hasInfix ":";
-  hasNewlineInfix = hasInfix "\n";
-
   # Internal functor to help for migrating functor.wrapped to functor.payload.elemType
   # Note that individual attributes can be overridden if needed.
   elemTypeFunctor =
@@ -536,14 +533,13 @@ rec {
   singleLineStr =
     let
       inherit (strMatching "[^\n\r]*\n?") check merge;
-      removeNewlineSuffix = lib.removeSuffix "\n";
     in
     mkOptionType {
       name = "singleLineStr";
       description = "(optionally newline-terminated) single-line string";
       descriptionClass = "noun";
       inherit check;
-      merge = loc: defs: removeNewlineSuffix (merge loc defs);
+      merge = loc: defs: lib.removeSuffix "\n" (merge loc defs);
     };
 
   strMatching =
@@ -584,7 +580,7 @@ rec {
 
   passwdEntry =
     entryType:
-    addCheck entryType (str: !(hasColonInfix str || hasNewlineInfix str))
+    addCheck entryType (str: !(hasInfix ":" str || hasInfix "\n" str))
     // {
       name = "passwdEntry ${entryType.name}";
       description = "${
@@ -608,7 +604,7 @@ rec {
     description = "fileset";
     descriptionClass = "noun";
     check = isFileset;
-    merge = loc: defs: unions (getValues defs);
+    merge = loc: defs: unions (map (x: x.value) defs);
     emptyValue.value = empty;
   };
 

maintainers/github-teams.json

@@ -2,10 +2,11 @@
   "acme": {
     "description": "Maintain ACME-related packages and modules.",
     "id": 3806126,
-    "maintainers": {},
+    "maintainers": {
+      "emilazy": 18535642
+    },
     "members": {
       "arianvp": 628387,
-      "emilazy": 18535642,
       "m1cr0man": 3044438
     },
     "name": "ACME"
@@ -59,20 +60,11 @@
       "adamcstephens": 2071575,
       "ankhers": 750786,
       "gleber": 33185,
+      "minijackson": 1200507,
       "yurrriq": 1866448
     },
     "name": "Beam"
   },
-  "boot-security": {
-    "description": "Maintain support for boot security technologies like Secure Boot",
-    "id": 18686947,
-    "maintainers": {},
-    "members": {
-      "ElvishJerricco": 1365692,
-      "emilazy": 18535642
-    },
-    "name": "Boot security"
-  },
   "bootstrapping": {
     "description": "coordinates efforts towards bootstrappable builds (see https://bootstrappable.org/)",
     "id": 9141350,
@@ -95,8 +87,8 @@
       "fgaz": 8182846,
       "natsukium": 25083790,
       "philiptaron": 43863,
-      "tomodachi94": 68489118,
-      "tr3foil": 29682759
+      "pyrotelekinetic": 29682759,
+      "tomodachi94": 68489118
     },
     "members": {},
     "name": "Categorization"
@@ -181,6 +173,7 @@
     "description": "Improve Darwin-support across Nixpkgs and help maintainers without access to Darwin hardware. Apply to join through https://github.com/NixOS/nixpkgs/issues/323144 to keep the process transparent.",
     "id": 2385202,
     "maintainers": {
+      "emilazy": 18535642,
       "toonn": 1486805
     },
     "members": {
@@ -199,7 +192,6 @@
       "Prince213": 25235514,
       "Samasaur1": 30577766,
       "Steven0351": 24440751,
-      "TyceHerrman": 22066434,
       "afh": 16507,
       "azuwis": 9315,
       "booxter": 90200,
@@ -207,12 +199,11 @@
       "cideM": 4246921,
       "cidkidnix": 67574902,
       "copumpkin": 2623,
-      "delafthi": 50531499,
       "devusb": 4951663,
       "domenkozar": 126339,
+      "donn": 12652988,
       "dwt": 57199,
       "eclairevoyant": 848000,
-      "emilazy": 18535642,
       "ethancedwards8": 60861925,
       "fiddlerwoaroof": 808745,
       "fulsomenko": 14945057,
@@ -378,9 +369,7 @@
     "maintainers": {
       "jtojnar": 705123
     },
-    "members": {
-      "Hythera": 87016780
-    },
+    "members": {},
     "name": "Freedesktop"
   },
   "geospatial": {
@@ -416,13 +405,10 @@
     "description": "Maintain GNOME desktop environment and platform.",
     "id": 3806133,
     "maintainers": {
-      "bobby285271": 20080233,
       "jtojnar": 705123
     },
     "members": {
-      "nekowinston": 79978224,
-      "theCapypara": 3512122,
-      "thunze": 22795263
+      "bobby285271": 20080233
     },
     "name": "GNOME"
   },
@@ -578,11 +564,11 @@
     "id": 9955829,
     "maintainers": {
       "RossComputerGuy": 19699320,
-      "alyssais": 2768870
+      "alyssais": 2768870,
+      "emilazy": 18535642
     },
     "members": {
       "Ericson2314": 1055245,
-      "emilazy": 18535642,
       "peterwaller-arm": 52030119,
       "rrbutani": 7833358
     },
@@ -754,6 +740,16 @@
     },
     "name": "Nixpkgs CI"
   },
+  "nixpkgs-core": {
+    "description": "Provides leadership for and has authority over Nixpkgs.",
+    "id": 14317027,
+    "maintainers": {
+      "alyssais": 2768870,
+      "emilazy": 18535642
+    },
+    "members": {},
+    "name": "Nixpkgs core"
+  },
   "nixpkgs-merge-bot": {
     "description": "This team exists as a target for triggering the nixpkgs merge bot.",
     "id": 13926892,
@@ -989,11 +985,12 @@
     "id": 11265412,
     "maintainers": {
       "RossComputerGuy": 19699320,
+      "emilazy": 18535642,
       "philiptaron": 43863
     },
     "members": {
+      "Artturin": 56650223,
       "Ericson2314": 1055245,
-      "emilazy": 18535642,
       "reckenrode": 7413633
     },
     "name": "stdenv"

maintainers/scripts/dep-licenses.sh

@@ -36,7 +36,7 @@ sed '
 
 if test $(wc -l "$tmp/filter.sed" | sed 's/ .*//') == 0; then
   echo 1>&2 "
-No derivation mentioned in the stack trace.  Either your derivation does
+No derivation mentionned in the stack trace.  Either your derivation does
 not use stdenv.mkDerivation or you forgot to use the stdenv adapter named
 traceDrvLicenses.
 

maintainers/scripts/haskell/update-stackage.sh

@@ -34,7 +34,7 @@ fi
 # Stackage solver to use, LTS or Nightly
 # (should be capitalized like the display name)
 SOLVER=LTS
-# Stackage solver version, if any. Use latest if empty
+# Stackage solver verson, if any. Use latest if empty
 VERSION=
 TMP_TEMPLATE=update-stackage.XXXXXXX
 readonly SOLVER

maintainers/scripts/luarocks-packages.csv

@@ -23,7 +23,6 @@ digestif,,,,,5.3,
 dkjson,,,,,,
 enet,,,,,,ulysseszhan
 etlua,,,,,,ulysseszhan
-fallo,,,,,,mrcjkb
 fennel,,,,,,misterio77
 fidget.nvim,,,,,5.1,mrcjkb
 fifo,,,,,,
@@ -52,6 +51,7 @@ lpeg_patterns,,,,,,
 lpeglabel,,,,1.6.0,,
 lrexlib-gnu,,,,,,
 lrexlib-oniguruma,,,,,,junestepp
+lrexlib-pcre,,,,,,
 lrexlib-pcre2,,,,,,wishstudio
 lrexlib-posix,,,,,,
 lsp-progress.nvim,,,,,5.1,gepbird
@@ -156,7 +156,6 @@ rest.nvim,,,,,5.1,teto
 rocks-config.nvim,,,,,5.1,mrcjkb
 rocks-dev.nvim,,,,,5.1,mrcjkb
 rocks-git.nvim,,,,,5.1,mrcjkb
-rocks-lazy.nvim,,,,,,teto
 rocks.nvim,,,,,5.1,mrcjkb
 rtp.nvim,,,,,5.1,mrcjkb
 rustaceanvim,,,,,5.1,mrcjkb

maintainers/scripts/nixpkgs-lint.nix

@@ -10,9 +10,6 @@ stdenv.mkDerivation {
   pname = "nixpkgs-lint";
   version = "1";
 
-  __structuredAttrs = true;
-  strictDeps = true;
-
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [
     perl
@@ -23,20 +20,16 @@ stdenv.mkDerivation {
   dontBuild = true;
 
   installPhase = ''
-    runHook preInstall
-
     mkdir -p $out/bin
     cp ${./nixpkgs-lint.pl} $out/bin/nixpkgs-lint
     # make the built version hermetic
     substituteInPlace  $out/bin/nixpkgs-lint \
       --replace-fail "#! /usr/bin/env nix-shell" "#! ${lib.getExe perl}"
     wrapProgram $out/bin/nixpkgs-lint --set PERL5LIB $PERL5LIB
-
-    runHook postInstall
   '';
 
   meta = {
-    description = "Utility for Nixpkgs contributors to check Nixpkgs for common errors";
+    description = "A utility for Nixpkgs contributors to check Nixpkgs for common errors";
     mainProgram = "nixpkgs-lint";
     platforms = lib.platforms.unix;
   };

maintainers/scripts/sha-to-sri.py

@@ -166,7 +166,7 @@ def atomicFileUpdate(target: Path):
 
     Yields a pair `(original, new)` of open files.
     `original` is the pre-existing file at `target`, open for reading;
-    `new` is an empty, temporary file in the same folder, open for writing.
+    `new` is an empty, temporary file in the same filder, open for writing.
 
     Upon exiting the context, the files are closed; if no exception was
     raised, `new` (atomically) replaces the `target`, otherwise it is deleted.

maintainers/scripts/update-octave-packages

@@ -30,7 +30,7 @@ INDEX = "https://raw.githubusercontent.com/gnu-octave/packages/main/packages"
 """url of Octave packages' source on GitHub"""
 
 EXTENSIONS = ['tar.gz', 'tar.bz2', 'tar', 'zip']
-"""Permitted file extensions. These are evaluated from left to right and the first occurrence is returned."""
+"""Permitted file extensions. These are evaluated from left to right and the first occurance is returned."""
 
 PRERELEASES = False
 

maintainers/team-list.nix

@@ -402,7 +402,6 @@ with lib.maintainers;
       GaetanLepage
       natsukium
       thomasjm
-      haansn08
     ];
     scope = "Maintain Jupyter and related packages.";
     shortName = "Jupyter";
@@ -520,6 +519,7 @@ with lib.maintainers;
     members = [
       alejandrosame
       aleksi
+      artturin
       emilytrau
       ericson2314
       jk
@@ -551,7 +551,6 @@ with lib.maintainers;
       dotlambda
       ma27
       provokateurin
-      staticdev
     ];
     scope = "Maintain Nextcloud, its tests and the integration of applications.";
     shortName = "Nextcloud";
@@ -655,16 +654,6 @@ with lib.maintainers;
     enableFeatureFreezePing = true;
   };
 
-  pulumi = {
-    scope = "Maintains the Pulumi IaC tool and its language-specific SDKs";
-    shortName = "Pulumi";
-    members = [
-      nicoo
-      tie
-      untio11
-    ];
-  };
-
   python = {
     members = [
       hexa
@@ -711,6 +700,7 @@ with lib.maintainers;
 
   sage = {
     members = [
+      timokau
       raskin
       collares
     ];

nixos/README-modular-services.md

@@ -43,7 +43,7 @@ When reviewing a modular service, you should check the following. Details and ra
 ### NixOS VM test
 
 See the initial [Modular Services PR](https://github.com/NixOS/nixpkgs/pull/372170) for an [example](https://github.com/NixOS/nixpkgs/pull/372170/files#diff-e7fe16489cf3cd08ecc22b2c7896039d407a329b75691c046c95447423b3153f) of a NixOS VM test.
-Best practices: keep tests minimal and focused (boot a VM, enable the service, and assert a basic request succeeds). For general guidance, see the [NixOS Tests chapter](https://nixos.org/manual/nixos/unstable/#sec-nixos-tests).
+TBD: describe best practices here.
 
 ### `_class = "service"`
 

nixos/doc/manual/development/settings-options.section.md

@@ -395,7 +395,7 @@ have a predefined type and string generator already declared under
 
     `mkRaw pythonCode`
 
-    :   Outputs the given string as raw Python code. Note that the final result will be stripped of any comments.
+    :   Outputs the given string as raw Python code
 
     `_imports`
 

nixos/doc/manual/development/state-revision.section.md

@@ -1,57 +0,0 @@
-# State revision {#sec-state-revision}
-
-NixOS includes a {option}`system.stateVersion` option, used by some modules for a
-variety of reasons related to non-backward-compatible changes to software or
-the module itself.
-Module authors are discouraged from adding new uses of
-{option}`system.stateVersion` to their module.
-
-However, when the alternatives are impractical, modules that wish to consume
-{option}`system.stateVersion` should instead define their own `stateRevision`
-option using `utils.mkStateRevisionOption`.
-There should be no uses of `config.system.stateVersion` directly in the module.
-
-(Note the name difference: the {option}`system.stateVersion` option, with a V,
-takes a value that looks like "YY.MM".
-A `stateRevision` option, with an R, takes a non-negative integer value.)
-
-Modules should also add the value of their `stateRevision` option to
-`system.moduleStateRevisions."your.module.stateRevision"`, when the module is
-enabled.
-This is a purely informative option that exists to help describe the effects of
-changing {option}`system.stateVersion`.
-
-Example:
-
-```nix
-{
-  lib,
-  config,
-  utils,
-  ...
-}:
-let
-  cfg = config.services.whatever;
-in
-{
-  options.services.whatever = {
-    enable = lib.mkEnableOption "whatever, a service that does whatever";
-    stateRevision = utils.mkStateRevisionOption {
-      descriptionName = "the whatever service";
-      migrations = {
-        "26.05" = "Rename `/var/lib/old_name` to `/var/lib/new_name`.";
-      };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    systemd.services.whatever = {
-      # ...
-      serviceConfig.StateDirectory = if cfg.stateRevision < 1 then "old_name" else "new_name";
-    };
-
-    # Important: this is inside the `lib.mkIf cfg.enable`
-    system.moduleStateRevisions."services.whatever.stateRevision" = cfg.stateRevision;
-  };
-}
-```

nixos/doc/manual/development/writing-modules.chapter.md

@@ -220,5 +220,4 @@ importing-modules.section.md
 replace-modules.section.md
 freeform-modules.section.md
 settings-options.section.md
-state-revision.section.md
 ```

nixos/doc/manual/development/writing-nixos-tests.section.md

@@ -276,15 +276,12 @@ with foo_running:
 
 `polling_condition` takes the following (optional) arguments:
 
-`interval`
+`seconds_interval`
 
-:   specifies how often the condition should be polled, as a `datetime.timedelta`:
+:   specifies how often the condition should be polled:
 
 ```py
-import datetime as dt
-
-
-@polling_condition(interval=dt.timedelta(seconds=10))
+@polling_condition(seconds_interval=10)
 def foo_running():
     machine.succeed("pgrep -x foo")
 ```

nixos/doc/manual/installation/upgrading.chapter.md

@@ -41,22 +41,8 @@ supported stable release.
 When you first install NixOS, you're automatically subscribed to the
 NixOS channel that corresponds to your installation source. For
 instance, if you installed from a 26.05 ISO, you will be subscribed to
-the `nixos-26.05` channel.
-
-Commands below are prefixed with `#` and have to be run as root in a
-login shell:
-
-```ShellSession
-$ sudo -i
-```
-
-Without `sudo`:
-
-```ShellSession
-$ su -
-```
-
-To see which NixOS channel you're subscribed to, run:
+the `nixos-26.05` channel. To see which NixOS channel you're subscribed
+to, run the following as root:
 
 ```ShellSession
 # nix-channel --list | grep nixos
@@ -98,15 +84,9 @@ by running
 which is equivalent to the more verbose `nix-channel --update nixos; nixos-rebuild switch`.
 
 ::: {.note}
-Channels are set per user. `nix-channel` reads and writes
-`$HOME/.nix-channels`, so it acts on the channels of whoever owns the
-current `$HOME`. A login shell sets `$HOME` to `/root`, which is why the
-commands above act on root's channels — the ones
-`/etc/nixos/configuration.nix` uses.
-
-Plain `sudo` and `su` keep your own `$HOME`. `nix-channel --list` then
-lists your own channels, and prints nothing when you have none.
-`nix-channel --add` adds the channel for your user alone.
+Channels are set per user. This means that running `nix-channel --add`
+as a non root user (or without sudo) will not affect
+configuration in `/etc/nixos/configuration.nix`
 :::
 
 ::: {.warning}

nixos/doc/manual/preface.md

@@ -7,5 +7,5 @@ Additional information regarding the Nix package manager and the Nixpkgs project
 If you encounter problems, please report them on the [`Discourse`](https://discourse.nixos.org), the [Matrix room](https://matrix.to/#/%23nix:nixos.org), or on the [`#nixos` channel on Libera.Chat](irc://irc.libera.chat/#nixos). Alternatively, consider [contributing to this manual](#chap-contributing). Bugs should be reported in [NixOS’ GitHub issue tracker](https://github.com/NixOS/nixpkgs/issues).
 
 ::: {.note}
-Commands prefixed with `#` have to be run as root.
+Commands prefixed with `#` have to be run as root, either requiring to login as root user or temporarily switching to it using `sudo` for example.
 :::

nixos/doc/manual/redirects.json

@@ -1,10 +1,4 @@
 {
-  "module-services-portmaster": [
-    "index.html#module-services-portmaster"
-  ],
-  "module-services-portmaster-declarative-configuration": [
-    "index.html#module-services-portmaster-declarative-configuration"
-  ],
   "module-hardware-facter": [
     "index.html#module-hardware-facter"
   ],
@@ -71,24 +65,6 @@
   "module-services-keycloak-unix-socket": [
     "index.html#module-services-keycloak-unix-socket"
   ],
-  "module-services-lxmd": [
-    "index.html#module-services-lxmd"
-  ],
-  "module-services-lxmd-communication-backbone": [
-    "index.html#module-services-lxmd-communication-backbone"
-  ],
-  "module-services-lxmd-communication-rpc": [
-    "index.html#module-services-lxmd-communication-rpc"
-  ],
-  "module-services-lxmd-communication-with-rnsd": [
-    "index.html#module-services-lxmd-communication-with-rnsd"
-  ],
-  "module-services-lxmd-health-check": [
-    "index.html#module-services-lxmd-health-check"
-  ],
-  "module-services-lxmd-quickstart": [
-    "index.html#module-services-lxmd-quickstart"
-  ],
   "module-services-mautrix-discord": [
     "index.html#module-services-mautrix-discord"
   ],
@@ -128,18 +104,6 @@
   "module-services-onedrive": [
     "index.html#module-services-onedrive"
   ],
-  "module-services-rnsd": [
-    "index.html#module-services-rnsd"
-  ],
-  "module-services-rnsd-hardware-access": [
-    "index.html#module-services-rnsd-hardware-access"
-  ],
-  "module-services-rnsd-health-check": [
-    "index.html#module-services-rnsd-health-check"
-  ],
-  "module-services-rnsd-quickstart": [
-    "index.html#module-services-rnsd-quickstart"
-  ],
   "module-services-tandoor-recipes-migrating-media-option-move": [
     "index.html#module-services-tandoor-recipes-migrating-media-option-move",
     "index.html#module-services-tandoor-recipes-migrating-media-option-1"
@@ -214,24 +178,6 @@
   "module-services-tdarr-server-only": [
     "index.html#module-services-tdarr-server-only"
   ],
-  "module-services-zapret2": [
-    "index.html#module-services-zapret2"
-  ],
-  "module-services-zapret2-configuration": [
-    "index.html#module-services-zapret2-configuration"
-  ],
-  "module-services-zapret2-configuration-firewall": [
-    "index.html#module-services-zapret2-configuration-firewall"
-  ],
-  "module-services-zapret2-configuration-lua-files": [
-    "index.html#module-services-zapret2-configuration-lua-files"
-  ],
-  "module-services-zapret2-configuration-profiles": [
-    "index.html#module-services-zapret2-configuration-profiles"
-  ],
-  "module-services-zapret2-quick-start": [
-    "index.html#module-services-zapret2-quick-start"
-  ],
   "module-virtualisation-xen": [
     "index.html#module-virtualisation-xen"
   ],
@@ -253,9 +199,6 @@
   "sec-override-nixos-test": [
     "index.html#sec-override-nixos-test"
   ],
-  "sec-state-revision": [
-    "index.html#sec-state-revision"
-  ],
   "sec-wireless-declarative": [
     "index.html#sec-wireless-declarative"
   ],
@@ -394,9 +337,6 @@
   "module-services-crab-hole-upstream-options": [
     "index.html#module-services-crab-hole-upstream-options"
   ],
-  "module-services-firefox-syncserver-database": [
-    "index.html#module-services-firefox-syncserver-database"
-  ],
   "module-services-firefox-syncserver-clients": [
     "index.html#module-services-firefox-syncserver-clients"
   ],
@@ -1481,9 +1421,6 @@
   "module-services-gitlab-maintenance-rake": [
     "index.html#module-services-gitlab-maintenance-rake"
   ],
-  "module-services-gitlab-registry-database-migration": [
-    "index.html#module-services-gitlab-registry-database-migration"
-  ],
   "module-services-gitlab-runner": [
     "index.html#module-services-gitlab-runner"
   ],

nixos/doc/manual/release-notes/rl-2305.section.md

@@ -139,7 +139,7 @@ In addition to numerous new and updated packages, this release has the following
 
 - [readarr](https://github.com/Readarr/Readarr), book manager and automation (Sonarr for ebooks). Available as [services.readarr](options.html#opt-services.readarr.enable).
 
-- [ReGreet](https://github.com/rharish101/ReGreet), a clean and customizable greeter for greetd. Available as `programs.regreet.enable`.
+- [ReGreet](https://github.com/rharish101/ReGreet), a clean and customizable greeter for greetd. Available as [programs.regreet](#opt-programs.regreet.enable).
 
 - [rshim](https://github.com/Mellanox/rshim-user-space), the user-space rshim driver for the BlueField SoC. Available as [services.rshim](options.html#opt-services.rshim.enable).
 

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -129,7 +129,7 @@
 
 - [nvme-rs](https://github.com/liberodark/nvme-rs), NVMe monitoring [services.nvme-rs](#opt-services.nvme-rs.enable).
 
-- [Overseerr](https://overseerr.dev), a request management and media discovery tool for the Plex ecosystem. Available as {option}`opt-services.overseerr.enable`.
+- [Overseerr](https://overseerr.dev), a request management and media discovery tool for the Plex ecosystem. Available as [services.overseerr](#opt-services.overseerr.enable).
 
 - [PairDrop](https://github.com/schlagmichdoch/pairdrop), a peer-to-peer file transfer web app. Available as [services.pairdrop](#opt-services.pairdrop.enable).
 

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -84,7 +84,7 @@
 
 - [PdfDing](https://www.pdfding.com/), manage, view and edit your PDFs seamlessly on all your devices wherever you are. Available as [services.pdfding](#opt-services.pdfding.enable).
 
-- [mangowc](https://github.com/DreamMaoMao/mangowc), a lightweight and feature-rich Wayland compositor based on dwl. Available as [programs.mangowc](#opt-programs.mango.enable).
+- [mangowc](https://github.com/DreamMaoMao/mangowc), a lightweight and feature-rich Wayland compositor based on dwl. Available as [programs.mangowc](#opt-programs.mangowc.enable).
 
 - [reaction](https://reaction.ppom.me/), a daemon that scans program outputs for repeated patterns, and takes action. A common usage is to scan ssh and webserver logs, and to ban hosts that cause multiple authentication errors. A modern alternative to fail2ban. Available as [services.reaction](#opt-services.reaction.enable).
 

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -18,97 +18,50 @@
   +nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.zst";
   ```
 
-- `sing-box` now supports NaïveProxy outbounds.
-
 ## New Modules {#sec-release-26.11-new-modules}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- [Portmaster](https://safing.io/portmaster/), a privacy-focused application
-  firewall, is available through
-  [services.portmaster](#opt-services.portmaster.enable).
-
-- [btrfs-heatmap](https://github.com/knorrie/btrfs-heatmap), setcap wrapper for `btrfs-heatmap` package, a visualizer of how a btrfs filesystem is using the underlying disk space of the block devices. Available as [programs.btrfs-heatmap](#opt-programs.btrfs-heatmap.enable)
-
-- [compsize](https://github.com/kilobyte/compsize), setcap wrapper for `compsize` package, a cli utility to to inspect compression type/ratio on BTRFS filesystems. Available as [programs.compsize](#opt-programs.compsize.enable)
-
 - [tranquil](https://tangled.org/tranquil.farm/tranquil-pds) is an ATProto PDS (personal data server) implementation in Rust. A featureful, spec conscious and community driven alternative to the Bluesky reference implementation PDS. Available as [services.tranquil-pds](#opt-services.tranquil-pds.enable).
 
-- [Cardwire](https://github.com/OpenGamingCollective/cardwire), a GPU manager for Linux that uses eBPF+LSM hooks to control GPUs. Available as [services.cardwired](#opt-services.cardwired.enable).
-
 - [Moonlight Qt](https://moonlight-stream.org/), a client for playing your PC games on almost any device. Available as [programs.moonlight-qt](#opt-programs.moonlight-qt.enable).
 
-- [RomM](https://romm.app/), a self-hosted ROM manager and player. Available as [services.romm](#opt-services.romm.enable).
-
 - [scx_loader](https://github.com/sched-ext/scx-loader), a system daemon and DBus-based loader for sched_ext schedulers. `scxctl` is the command-line client for interacting with the loader, allowing users to switch schedulers, modes, and arguments dynamically. Available as [services.scx-loader](#opt-services.scx-loader.enable)
 
 - [tap](https://github.com/bluesky-social/indigo/tree/main/cmd/tap), an ATProtocol firehose synchronisation utility. Available as [services.tap](#opt-services.tap.enable).
 
 - [Nezha](https://github.com/nezhahq/nezha), a self-hosted, lightweight server and website monitoring and O&M tool. Available as [services.nezha](#opt-services.nezha.enable).
 
-- [Noctalia](https://noctalia.dev), a sleek and customizable desktop shell crafted for Wayland. Available as [programs.noctalia](#opt-programs.noctalia.enable).
-
 - [Watt](https://github.com/NotAShelf/watt), a CPU frequency and power management daemon for Linux. Available as [services.watt](#opt-services.watt.enable).
 
 - [mail-tlsa-check-exporter](https://github.com/ietf-tools/mail-tlsa-check-exporter), validates SMTP / IMAP server certificates against a TLSA record as a Prometheus exporter. Available as [services.prometheus.exporters.mail-tlsa-check](#opt-services.prometheus.exporters.mail-tlsa-check.enable).
 
-- [feishin](https://github.com/jeffvli/feishin), a modern self-hosted music player. Available as [services.feishin](#opt-services.feishin.enable).
-
 - [CastSponsorSkip](https://github.com/gabe565/CastSponsorSkip/), skips YouTube sponsorships (and sometimes ads) on all local Google Cast devices.
 
 - [Stump](https://www.stumpapp.dev/), a free and open source comics, manga and digital book server with OPDS support. Available as [services.stump](#opt-services.stump.enable).
 
-- [P2Pool](https://github.com/SChernykh/p2pool), a decentralized mining pool for Monero. Available as [services.p2pool](#opt-services.p2pool.enable).
-
 - [Freescout](https://freescout.net/), a free, open source Helpdesk and shared mailbox. Available as [services.freescout](#opt-services.freescout.enable).
 
-- [Lix TOML remote builders](https://docs.lix.systems/manual/lix/stable/advanced-topics/distributed-builds.html#using-a-toml-configuration), remote builder configuration using lix's TOML format. Available as [lix.buildMachines](#opt-lix.buildMachines). Note: incompatible with `nix.buildMachines`.
-
-- [Forgejo Runner](https://forgejo.org/docs/latest/admin/actions/), a daemon for Forgejo Actions. Available as [services.forgejo-runner](#opt-services.forgejo-runner.instances).
-
 - [Koito](https://koito.io/), a modern, themeable scrobbler that you can use with any program that scrobbles to a custom ListenBrainz URL. Available as [services.koito](#opt-services.koito.enable).
 
-- [Zapret2](https://github.com/bol-van/zapret2), an extensible DPI bypass program. Available as [services.zapret2](#opt-services.zapret2.enable).
-
-- [Solaar](https://github.com/pwr-Solaar/Solaar), a program to control logitech devices.
-
 - [FlapAlerted](https://github.com/Kioubit/FlapAlerted), detects BGP flapping events and provides statistics based on BGP update messages. Available as [services.flap-alerted](#opt-services.flap-alerted.enable).
 
 - [gocron](https://github.com/flohoss/gocron), a task scheduler with web interface. Available as [services.gocron](#opt-services.gocron.enable).
 
 - [Unpackerr](https://unpackerr.zip), extracts downloads for Radarr, Sonarr, Lidarr, Readarr, and/or a Watch folder. Available as [services.unpackerr](#opt-services.unpackerr.enable).
 
-- [ioquake3](https://ioquake3.org), a open-source port of the 3D action shooter Quake 3 Arena. Available as [programs.ioquake3](#opt-programs.ioquake3.enable).
-
 - [Matrix Authentication Service](https://github.com/element-hq/matrix-authentication-service) is an OAuth2.0 and OpenID Connect provider for Matrix homeservers (such as Synapse). It replaces standard password authentication with modern OpenID Connect flows, and can delegate authentication to upstream OIDC providers. Available as [services.matrix-authentication-service](#opt-services.matrix-authentication-service.enable).
 
-- [Krill](https://nlnetlabs.nl/projects/krill/about), RPKI CA and Publication Server written in Rust. Available as [services.krill](#opt-services.krill.enable).
-
 - [stash-clipboard](https://github.com/NotAShelf/stash), a Wayland clipboard "manager" with fast persistent history and multi-media support. Available as [services.stash-clipboard](#opt-services.stash-clipboard.enable).
 
 - [OO7](https://github.com/linux-credentials/oo7) is a desktop-agnostic Secret Service provider. Available as [services.oo7](#opt-services.oo7.enable)
 
 - [NordVPN](https://github.com/NordSecurity/nordvpn-linux), a NordVPN client for linux. Available as [services.nordvpn](options.html#opt-services.nordvpn.enable).
 
-- [RNSD](https://reticulum.network/), the Reticulum Network Stack Daemon. It provides a secure and efficient way to communicate over the Reticulum Network. Available as [services.rnsd](#opt-services.rnsd.enable).
-
-- [LXMD](https://github.com/markqvist/LXMF), a universal, distributed and secure messaging protocol for Reticulum. Available as [services.lxmd](#opt-services.lxmd.enable).
-
-- [Entropy](https://github.com/ergohaven/entropy), a configurator for programmable keyboards and input devices running Vial-QMK/RMK firmware. Available as [programs.entropy](#opt-programs.entropy.enable).
-
-- [Kvrocks](https://kvrocks.apache.org/), a distributed key value NoSQL database compatible with the Redis protocol. Available as [services.kvrocks](#opt-services.kvrocks.enable).
-
-- [kvrocks_exporter](https://github.com/RocksLabs/kvrocks_exporter), a Prometheus exporter for Kvrocks metrics. Available as [services.prometheus.exporters.kvrocks](#opt-services.prometheus.exporters.kvrocks.enable).
-
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- Artalk has been updated to 2.10.0. Its default configuration and data
-  directory discovery changed; see the [upstream migration
-  guide](https://artalk.js.org/en/guide/releases/v2.10.0.html) when invoking
-  `artalk` directly. The `services.artalk` module is unaffected.
-
 - `boot.vesa` has been removed. It was deprecated in 2020 because Xorg now works better with kernel modesetting. If you still need the legacy VESA 800x600 fallback, set `boot.kernelParams = [ "vga=0x317" "nomodeset" ];` directly.
 
 - `authentik` has been updated to 2026.5.3, which changes the default listen address from `0.0.0.0` to `[::]`.
@@ -116,28 +69,12 @@
   Deployments running the server and worker in the same network namespace must also set at least the worker
   `AUTHENTIK_LISTEN__HTTP` address so that the server and worker do not bind to the same address.
 
-- `services.paperless` has been updated to paperless-ngx 3.0, a major release; review the [upstream v3 migration guide](https://docs.paperless-ngx.com/migration-v3/) before upgrading.
-  - paperless-ngx 3 requires a non-default `PAPERLESS_SECRET_KEY`. The module now generates one automatically, reusing the key from earlier NixOS releases so existing sessions keep working; a key set via `environmentFile` still takes precedence.
-  - The full-text search backend changed from Whoosh to Tantivy. The search index is rebuilt automatically on the first start after upgrading, which can take a while for large document sets.
-  - Some settings changed or were removed (for example, an external database now needs an explicit `PAPERLESS_DBENGINE`); review your `services.paperless.settings` against the migration guide.
-
 - `services.alps` has been rewritten, see [upstream repository](https://github.com/migadu/alps) for configuration.
 
-- Nginx no longer includes the unmaintained dav module per default.
-  If you happened to use it via a `dav_*` directive, you can include it with `services.nginx.additionalModules = [ pkgs.nginxModules.dav ]` again.
-
 - Support for the legacy U‐Boot image format has been removed from the initrd generators, as it is deprecated upstream and no longer used by any platform in Nixpkgs.
 
-- `services.pid-fan-controller` no longer provides deep configuration rewriting and adheres now fully to RFC42.
-
-- The `extraArgs` and `check` arguments to `nixos/lib/eval-config.nix` (and therefore to `lib.nixosSystem`) have been removed after being deprecated with a warning since 2021. Passing them is now an evaluation error. Instead of `extraArgs`, set `config._module.args`; instead of `check = false`, set `config._module.check = false`. The `extraArgs` attribute on the resulting configuration has been removed as well.
-
 - Rustical migrates from `settings.http.host` and `settings.http.port` to `settings.http.bind` to support UNIX domain sockets as well as TCP sockets in one setting.
 
-- The `jetty_11` package has been removed as it reached end of life. Use `jetty_12` instead.
-
-- The Mullvad VPN service now has a separate toggle to enable the Mullvad VPN graphical user interface. If you have previously used Mullvad on a desktop by setting `services.mullvad-vpn.package` to `pkgs.mullvad-vpn`, you should now **unset that option**, and enable `services.mullvad-vpn.gui.enable`. The VPN will not work if `services.mullvad-vpn.package` is set to `pkgs.mullvad-vpn`, as `pkgs.mullvad-vpn` no longer contains the Mullvad Daemon; please ensure that `services.mullvad-vpn.package` is set to `pkgs.mullvad`, regardless if you plan to enable the graphical user interface or not.
-
 - A number of options for `services.llama-cpp` have been removed in favor of the structured [](#opt-services.llama-cpp.settings) option, attributes from which are used as arguments to `llama-server` executable, you can see all available options by running `llama-server --help`. Configuring model presets using Nix attribute set via `services.llama-cpp.modelsPreset` is no longer supported, please use `services.llama-cpp.settings.models-preset` with a path to an INI file containing desired options.
 
 - The `NIX_XDG_DESKTOP_PORTAL_DIR` environment variable is no longer used in the `xdg-desktop-portal` package and is therefore no longer set in `xdg.portal` module.
@@ -152,9 +89,9 @@
 
 - Apache Kafka has dropped support for ZooKeeper mode. The `apacheKafka_3_9` and `apacheKafka_4_0` packages have been removed, as every remaining packaged version is KRaft-only. The `services.apache-kafka.zookeeper` option (previously an alias for `services.apache-kafka.settings."zookeeper.connect"`) has been removed; migrate your cluster to [KRaft](#module-services-apache-kafka-kraft) mode instead.
 
-- `virtualisation.containers.registries.block` / `insecure` / `search` were deprecated,
+- `virtualisation.registries.block` / `insecure` / `search` were deprecated,
   because they mapped to the deprecated V1 `registries.conf` format.
-  See the new option {option}`virtualisation.containers.registries.settings`
+  See the new option {option}`virtualisation.registries.settings`
   and [containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)
   to migrate to the new configuration format.
 
@@ -162,18 +99,10 @@
 
 - String values passed to `services.phpfpm.settings`, `services.phpfpm.pools.<name>.phpEnv`, and `services.phpfpm.pools.<name>.settings` are now properly quoted and escaped, except for the `${}` syntax that is left as-is. If you are manually escaping these values, please adjust accordingly.
 
-- GitLab has been updated from 18.x to 19.x and requires PostgreSQL >= 17, as stated in the [documentation](https://docs.gitlab.com/19.1/install/requirements/#postgresql). Check the [upgrade guide](#module-services-postgres-upgrading) in the NixOS manual on how to upgrade your PostgreSQL installation.
-
-- `services.gitlab.registry` has been modified so that the GitLab container registry runs in the `gitlab-container-registry` system user. This behavior can be modified with the `services.gitlab.registry.user` option.
-
-- `fail2ban` has been updated to 1.1.1, which has a few breaking changes compared to 1.1.0 ([changelog](https://github.com/fail2ban/fail2ban/blob/1.1.1/ChangeLog))
-
 - `systemd.user.extraConfig` has been removed in favor of the structured [](#opt-systemd.user.settings.Manager) option. Use `systemd.user.settings.Manager` to set any `systemd-user.conf(5)` option directly. For example, replace `systemd.user.extraConfig = "DefaultTimeoutStartSec=60";` with `systemd.user.settings.Manager.DefaultTimeoutStartSec = 60;`.
 
 - `matrix-appservice-discord` was removed from nixpkgs along with its NixOS module (`services.matrix-appservice-discord`) as it is no longer actively maintained upstream. Use the actively-maintained puppeting bridge [`mautrix-discord`](#opt-services.mautrix-discord.enable) instead.
 
-- Home Assistant 2026.8.0 migrated its HTTP configuration from YAML into the frontend. After upgrading, any options configured under `services.home-assistant.config.http` can be removed. HTTP settings can now be configured from the Home Assistant frontend under [Settings → System → Network](https://my.home-assistant.io/redirect/network). If no HTTP settings were previously configured, Home Assistant will default to listening on all interfaces on port 8123.
-
 - `services.timesyncd.extraConfig` has been removed in favor of the structured [](#opt-services.timesyncd.settings.Time) option. Use `services.timesyncd.settings.Time` to set any `timesyncd.conf(5)` option directly. For example, replace `services.timesyncd.extraConfig = "PollIntervalMaxSec=180";` with `services.timesyncd.settings.Time.PollIntervalMaxSec = 180;`.
 
 - `services.firezone.server.provision` has been removed due to it being unmaintanable. Remove all uses of provisioning and use the WebUI to configure firezone.
@@ -184,31 +113,17 @@
 
 - `services.komodo-periphery` has been updated to support version 2.0.0. Some options have been renamed to match the new configuration structure; compatibility aliases are provided for the renamed options. The `passkeys` and `outbound.onboardingKey` options have been removed; use `passkeyFiles`, `auth.privateKey`/`auth.corePublicKeys`, or `outbound.onboardingKeyFile` instead. New outbound mode configuration is available under `outbound.*`.
 
-- Package `overseerr` has been removed as the `overseerr` and `jellyseerr` projects were merged under `seerr`.
-
-- `slskd` has been updated to v0.25.0, which renames the `global` option to `transfers`. Please review the [changelog](https://github.com/slskd/slskd/releases#release-0.25.0).
-
-- [firefox-syncserver.database.type](#opt-services.firefox-syncserver.database.type) no longer defaults to `"mysql"`. You must now explicitly choose between `"mysql"` and `"postgresql"`. New deployments should prefer PostgreSQL.
-
 ## Other Notable Changes {#sec-release-26.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- `programs.regreet` has been renamed to `services.displayManager.regreet`.
-
 - `komodo` has been updated to the v2 release line (2.x). See the [upstream v1 → v2 upgrade guide](https://github.com/moghtech/komodo/releases/tag/v2.0.0).
 
 - `temporal` has been updated to the 1.31 release line. Always consult the [upstream upgrade
   notes](https://docs.temporal.io/self-hosted-guide/upgrade-server) before upgrading between versions.
 
-- The Xen Project Hypervisor has been [updated to version 4.22](https://wiki.xenproject.org/wiki/Xen_Project_4.22_Release_Notes), after [version 4.21](https://wiki.xenproject.org/wiki/Xen_Project_4.21_Release_Notes) was skipped in 26.05. The module now has a separate option to customise the OCaml-based Xen Store Daemon package, `virtualisation.xen.store.package`.
-
 - The `shell_interact()` function on interactive runs of NixOS VM tests has been deprecated. Use the SSH backdoor instead.
 
-- NixOS VM tests now prefer to express durations and timeouts as `datetime.timedelta` values instead of bare numbers. Methods such as `machine.wait_until_succeeds`, `machine.sleep`, `retry`, and `polling_condition` now accept a `timedelta` (e.g., `machine.wait_for_unit("sshd.service", timeout=datetime.timedelta(minutes=1))`). Passing an `int`/`float` as seconds still works but now emits a deprecation warning. Argument names that explicitly defined units were preserved but have had `timedelta` equivalents introduced (`timeout_seconds` → `timeout`, `secs` → `duration`, `seconds_interval` → `interval`).
-
-- `darwin.linux-builder-vz` has been added: a variant of `darwin.linux-builder` that runs the builder guest on Apple's Virtualization.framework via the new `vzvm` package, translating `x86_64-linux` builds with Rosetta instead of emulating them. Apple silicon hosts only. As part of this, the `nixos/modules/profiles/nix-builder-vm.nix` profile has been split into the backend-neutral `nixos/modules/profiles/nix-builder.nix` and a QEMU-specific part. Existing imports of `nix-builder-vm.nix` keep working unchanged.
-
 - [services.netbox](#opt-services.netbox.enable) has received a number of updates:
   - Default settings can now be introspected at [](#opt-services.netbox.settings).
   - Environment files can now be passed at [](#opt-services.netbox.environmentFiles).
@@ -219,16 +134,12 @@
     and the default changed to a UNIX domain socket.
   - A cookie-cutter nginx vhost can be enabled at [](#opt-services.netbox.nginx.enable).
 
-- The [monero](#opt-services.monero.enable) systemd service has been security hardened.
-
 - `security.run0.enableSudoAlias` now uses the `run0-sudo-shim` instead of a shell-script to improve compatibility.
 
 - With `system.etc.overlay.mutable = false`, NixOS now ships an empty `/etc/machine-id` in the image. Previously the file was absent and systemd logged `System cannot boot: Missing /etc/machine-id and /etc/ is read-only` while `ConditionFirstBoot` fired on every boot. With this change, systemd now overlays a transient ID from `/run/machine-id` for the session, and `systemd-machine-id-commit.service` has `ConditionFirstBoot` so it writes the machine-id through to a persistent backing file when one is bind-mounted over `/etc/machine-id`. To persist the machine-id across reboots, bind-mount a writable file containing `uninitialized` over `/etc/machine-id` from the initrd, or set `systemd.machine_id=` on the kernel command line (use `systemd.machine_id=firmware` to derive a stable ID on hardware that supports it).
 
 - `security.run0.persistentAuth` options have been added to support persistent Authentication of session. Timeout configurable via `security.polkit.settings.Polkitd.ExpirationSeconds`.
 
-- [`virtualisation.qemu.firmware.enable`](#opt-virtualisation.qemu.firmware.enable) has been added to install QEMU firmware descriptors to {file}`/etc/qemu/firmware`, making the corresponding firmware images discoverable by tools such as `systemd-vmspawn`. By default this exposes the firmware bundled with QEMU. Further firmware can be added via [`virtualisation.qemu.firmware.packages`](#opt-virtualisation.qemu.firmware.packages), for example the new `OVMF-amdsev` and `OVMF-inteltdx` packages, which provide UEFI firmware for AMD SEV-SNP and Intel TDX confidential VMs.
-
 - `boot.loader.systemd-boot` gained support for [Automatic Boot Assessment](https://systemd.io/AUTOMATIC_BOOT_ASSESSMENT/) via the new [`boot.loader.systemd-boot.bootCounting`](#opt-boot.loader.systemd-boot.bootCounting.enable) options, allowing automatic detection of and recovery from bad NixOS generations. As part of this change, boot loader entries on the ESP/XBOOTLDR partition are now named `nixos-<content-hash>.conf` instead of `nixos-generation-<n>.conf`; existing entries are migrated automatically on the next `nixos-rebuild boot`/`switch`.
 
 - `services.nginx` gained a [`lua`](#opt-services.nginx.lua.enable) option to enable Lua scripting via OpenResty's lua-nginx-module on a stock nginx, configuring `lua_package_path`/`lua_package_cpath` from the packages listed in [`services.nginx.lua.extraPackages`](#opt-services.nginx.lua.extraPackages). Use this to add Lua to a regular nginx; for the full OpenResty platform (libraries that rely on its bundled lualib, such as `lua-resty-openidc`), set `services.nginx.package` to `pkgs.openresty` instead — the option configures the Lua search path for it too.
@@ -237,18 +148,12 @@
 
 - `boot.supportedFilesystems.ntfs` installs `ntfsprogs-plus` instead of `ntfs3g` on kernel version 7.1 and later, unless `boot.supportedFilesystems.ntfs-3g` is explicitly enabled.
 
-- `services.i2pd` has been refactored to take [RFC42](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md)-compliant `settings`. In order to migrate, you will need to move existing config under `settings` and rename them in accordance with the [upstream config format](https://docs.i2pd.website/en/latest/user-guide/configuration/#available-options). In addition, `inTunnels` and `outTunnels` needs to be renamed to `serverTunnels` and `clientTunnels` respectively.
-
 - The `programs.fuse` module, which provides the `fusermount3` executable and the `/etc/fuse.conf` config file, is now opt-in. The obligation to enable it has been shifted to its various consumers (e.g. gvfs, flatpak, appimage, sshfs). This can break fuse consumers at runtime, that don't explicitly declare that dependency with a module, e.g the mounting functionality in various backup tools (borg, restic, rclone, ...).
 
 - `services.plausible` can now again seed an initial admin user declaratively via [`services.plausible.adminUser.email`](#opt-services.plausible.adminUser.email).
   This makes fully declarative deployments safer: Otherwise the user needed to either accept Plausible's unauthenticated "first launch" setup wizard, which lets anyone reaching the instance create the first admin account, or do more work (deploying with NixOS's default binding to `localhost` without exposing it publicly, going through the wizard, and then deploying Plausible exposed to the Internet).
   This option was previously removed with NixOS 25.05 due to an upstream Plausible change making declarative admin creation more difficult, but this change re-implements the admin creation directly.
 
-- `services.gitlab.registry` now uses PostgreSQL as database storage for new installations and supports old installations that use the filesystem as metadata storage. It creates the required PostgreSQL database and user. Users can manually migrate their filesystem based metadata storage. See [GitLab Container Registry Migration to database metadata store](#module-services-gitlab-registry-database-migration).
-
-- Enabling [`services.userborn`](#opt-services.userborn.enable) on a system that was previously managed by the default `update-users-groups.pl` script now imports the legacy state from `/var/lib/nixos/` on the first switch. Locked stub entries are added to `/etc/passwd` and `/etc/group` for every name recorded in `uid-map`/`gid-map` that no longer has a live entry, so a previously-used UID/GID cannot be reassigned to a different user. If the import fails, userborn does not start and the user database is left untouched. Inspect `journalctl -u userborn-import-legacy.service`, fix or remove the legacy state, and switch again. The import can be skipped entirely with [`services.userborn.importLegacyState`](#opt-services.userborn.importLegacyState)` = false`.
-
 - The `newuidmap` and `newgidmap` security wrappers are now installed with `cap_setuid`/`cap_setgid` file capabilities instead of the setuid-root bit, matching shadow's `--with-fcaps` install mode and other major distributions. Rootless containers (podman, docker-rootless, unprivileged user namespaces) are unaffected. The only behavioural change is that mapping host uid 0 via `/etc/subuid` (which NixOS never configures by default) additionally requires `cap_setfcap`; users who explicitly grant uid 0 in a subuid range can restore the previous behaviour with `security.wrappers.newuidmap.capabilities = lib.mkForce "cap_setuid,cap_setfcap+ep";`.
 
 - The `authelia` module now uses systemd's `LoadCredential` to load all files defined in `secrets`. As such, these files no longer need to be readable by the authelia user and group: they can for example be set to be only readable by the root user.
@@ -263,7 +168,3 @@
   - Please note that Nextcloud prohibits skipping major versions while upgrading. You can upgrade to specific versions by declaring `services.nextcloud.package = pkgs.nextcloud33;`.
 
 - `trilium-desktop` and `trilium-server` have been updated to 0.104.0. This release includes security hardening fixes that may break functionality. [See upstream release note for details](https://github.com/TriliumNext/Trilium/releases/tag/v0.104.0).
-
-- `nix` now supports running in "daemonless" mode by setting `nix.daemon.enable = false`. Under this mode all store operations must go through the [local store type](https://nix.dev/manual/nix/latest/store/types/local-store), which typically requires root permissions.
-
-- [Hister](https://github.com/asciimoo/hister), a web history service offering blazing fast, content-based search across visited websites. Available as [services.hister](#opt-services.hister.enable).

nixos/lib/binfmt-magics.nix

@@ -95,11 +95,11 @@
     magicOrExtension = ''\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x02\x01'';
     mask = ''\xff\xff\xff\xff\xff\xff\xff\xfc\x00\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff'';
   };
-  wasm32-wasip1 = {
+  wasm32-wasi = {
     magicOrExtension = ''\x00asm'';
     mask = ''\xff\xff\xff\xff'';
   };
-  wasm64-wasip1 = {
+  wasm64-wasi = {
     magicOrExtension = ''\x00asm'';
     mask = ''\xff\xff\xff\xff'';
   };

nixos/lib/erofs-store-image.nix

@@ -1,30 +0,0 @@
-# Shell-script fragment that packs a Nix store closure into a read-only erofs
-# image, built on the host when the VM starts. Shared by the VM backends
-# `qemu-vm.nix` and `vz-vm.nix`
-{
-  hostPkgs,
-  # path to a file listing the store paths to pack, one per line
-  storePaths,
-  # filesystem label of the image
-  label,
-  # shell word the image is written to
-  destination,
-}:
-''
-  ${hostPkgs.gnutar}/bin/tar --create \
-    --absolute-names \
-    --verbatim-files-from \
-    --transform 'flags=rSh;s|/nix/store/||' \
-    --transform 'flags=rSh;s|~nix~case~hack~[[:digit:]]\+||g' \
-    --files-from ${storePaths} \
-    | ${hostPkgs.erofs-utils}/bin/mkfs.erofs \
-      --quiet \
-      --force-uid=0 \
-      --force-gid=0 \
-      -L ${label} \
-      -U eb176051-bd15-49b7-9e6b-462e0b467019 \
-      -T 0 \
-      --hard-dereference \
-      --tar=f \
-      ${destination}
-''

nixos/lib/eval-config.nix

@@ -21,16 +21,20 @@ evalConfigArgs@{
   #     of inheritParentConfig.
   baseModules ? import ../modules/module-list.nix,
   # !!! See comment about args in lib/modules.nix
+  extraArgs ? { },
+  # !!! See comment about args in lib/modules.nix
   specialArgs ? { },
   modules,
   modulesLocation ? (builtins.unsafeGetAttrPos "modules" evalConfigArgs).file or null,
+  # !!! See comment about check in lib/modules.nix
+  check ? true,
   prefix ? [ ],
   lib ? import ../../lib,
   extraModules ? [ ],
 }:
 
 let
-  inherit (lib) optional warn;
+  inherit (lib) optional;
 
   evalModulesMinimal =
     (import ./default.nix {
@@ -58,8 +62,15 @@ let
   };
 
   withWarnings =
-    if specialArgs ? pkgs then
-      warn ''
+    x:
+    lib.warnIf (evalConfigArgs ? extraArgs)
+      "The extraArgs argument to eval-config.nix is deprecated. Please set config._module.args instead."
+      lib.warnIf
+      (evalConfigArgs ? check)
+      "The check argument to eval-config.nix is deprecated. Please set config._module.check instead."
+      lib.warnIf
+      (specialArgs ? pkgs)
+      ''
         You have set specialArgs.pkgs, which means that options like nixpkgs.config
         and nixpkgs.overlays will be ignored. If you wish to reuse an already created
         pkgs, which you know is configured correctly for this NixOS configuration,
@@ -67,16 +78,31 @@ let
         `(modulesPath + "/misc/nixpkgs/read-only.nix"), and set `{ nixpkgs.pkgs = <your pkgs>; }`.
         This properly disables the ignored options to prevent future surprises.
       ''
-    else
-      x: x;
+      x;
 
-  userModules =
-    # Add the invoking file (or specified modulesLocation) as error message location
-    # for modules that don't have their own locations; presumably inline modules.
-    if modulesLocation == null then
-      modules
-    else
-      map (lib.setDefaultModuleLocation modulesLocation) modules;
+  legacyModules =
+    lib.optional (evalConfigArgs ? extraArgs) {
+      config = {
+        _module.args = extraArgs;
+      };
+    }
+    ++ lib.optional (evalConfigArgs ? check) {
+      config = {
+        _module.check = lib.mkDefault check;
+      };
+    };
+
+  allUserModules =
+    let
+      # Add the invoking file (or specified modulesLocation) as error message location
+      # for modules that don't have their own locations; presumably inline modules.
+      locatedModules =
+        if modulesLocation == null then
+          modules
+        else
+          map (lib.setDefaultModuleLocation modulesLocation) modules;
+    in
+    locatedModules ++ legacyModules;
 
   noUserModules = evalModulesMinimal {
     inherit prefix specialArgs;
@@ -103,12 +129,13 @@ let
     };
   };
 
-  nixosWithUserModules = noUserModules.extendModules { modules = userModules; };
+  nixosWithUserModules = noUserModules.extendModules { modules = allUserModules; };
 
   withExtraAttrs =
     configuration:
     configuration
     // {
+      inherit extraArgs;
       inherit (configuration._module.args) pkgs;
       inherit lib;
       extendModules = args: withExtraAttrs (configuration.extendModules args);

nixos/lib/make-iso9660-image.nix

@@ -6,7 +6,7 @@
   xorriso,
   syslinux,
   libossp_uuid,
-  squashfs-tools,
+  squashfsTools,
 
   # The file name of the resulting ISO image.
   isoName ? "cd.iso",

nixos/lib/make-squashfs.nix

@@ -1,7 +1,7 @@
 {
   lib,
   stdenv,
-  squashfs-tools,
+  squashfsTools,
   closureInfo,
 
   fileName ? "squashfs",
@@ -31,7 +31,7 @@ stdenv.mkDerivation {
   # to the closure that was used to build it
   unsafeDiscardReferences.out = true;
 
-  nativeBuildInputs = [ squashfs-tools ];
+  nativeBuildInputs = [ squashfsTools ];
 
   buildCommand = ''
     closureInfo=${closureInfo { rootPaths = storeContents; }}

nixos/lib/systemd-lib.nix

@@ -592,43 +592,52 @@ rec {
     }:
     {
       config = {
-        unitConfig = {
-          ${if config.requires != [ ] then "Requires" else null} = toString config.requires;
-          ${if config.wants != [ ] then "Wants" else null} = toString config.wants;
-          ${if config.upholds != [ ] then "Upholds" else null} = toString config.upholds;
-          ${if config.after != [ ] then "After" else null} = toString config.after;
-          ${if config.before != [ ] then "Before" else null} = toString config.before;
-          ${if config.bindsTo != [ ] then "BindsTo" else null} = toString config.bindsTo;
-          ${if config.partOf != [ ] then "PartOf" else null} = toString config.partOf;
-          ${if config.conflicts != [ ] then "Conflicts" else null} = toString config.conflicts;
-          ${if config.requisite != [ ] then "Requisite" else null} = toString config.requisite;
-          ${if config.description != "" then "Description" else null} = config.description;
-          ${if config.documentation != [ ] then "Documentation" else null} = toString config.documentation;
-          ${if config.onFailure != [ ] then "OnFailure" else null} = toString config.onFailure;
-          ${if config.onSuccess != [ ] then "OnSuccess" else null} = toString config.onSuccess;
-          ${if options.startLimitIntervalSec.isDefined then "StartLimitIntervalSec" else null} =
-            toString config.startLimitIntervalSec;
-          ${if options.startLimitBurst.isDefined then "StartLimitBurst" else null} =
-            toString config.startLimitBurst;
-        }
-        // optionalAttrs (config ? restartTriggers && config.restartTriggers != [ ]) {
-          X-Restart-Triggers = "${pkgs.writeText "X-Restart-Triggers-${name}" (
-            pipe config.restartTriggers [
-              flatten
-              (map (x: if isPath x then "${x}" else x))
-              toString
-            ]
-          )}";
-        }
-        // optionalAttrs (config ? reloadTriggers && config.reloadTriggers != [ ]) {
-          X-Reload-Triggers = "${pkgs.writeText "X-Reload-Triggers-${name}" (
-            pipe config.reloadTriggers [
-              flatten
-              (map (x: if isPath x then "${x}" else x))
-              toString
-            ]
-          )}";
-        };
+        unitConfig =
+          optionalAttrs (config.requires != [ ]) { Requires = toString config.requires; }
+          // optionalAttrs (config.wants != [ ]) { Wants = toString config.wants; }
+          // optionalAttrs (config.upholds != [ ]) { Upholds = toString config.upholds; }
+          // optionalAttrs (config.after != [ ]) { After = toString config.after; }
+          // optionalAttrs (config.before != [ ]) { Before = toString config.before; }
+          // optionalAttrs (config.bindsTo != [ ]) { BindsTo = toString config.bindsTo; }
+          // optionalAttrs (config.partOf != [ ]) { PartOf = toString config.partOf; }
+          // optionalAttrs (config.conflicts != [ ]) { Conflicts = toString config.conflicts; }
+          // optionalAttrs (config.requisite != [ ]) { Requisite = toString config.requisite; }
+          // optionalAttrs (config ? restartTriggers && config.restartTriggers != [ ]) {
+            X-Restart-Triggers = "${pkgs.writeText "X-Restart-Triggers-${name}" (
+              pipe config.restartTriggers [
+                flatten
+                (map (x: if isPath x then "${x}" else x))
+                toString
+              ]
+            )}";
+          }
+          // optionalAttrs (config ? reloadTriggers && config.reloadTriggers != [ ]) {
+            X-Reload-Triggers = "${pkgs.writeText "X-Reload-Triggers-${name}" (
+              pipe config.reloadTriggers [
+                flatten
+                (map (x: if isPath x then "${x}" else x))
+                toString
+              ]
+            )}";
+          }
+          // optionalAttrs (config.description != "") {
+            Description = config.description;
+          }
+          // optionalAttrs (config.documentation != [ ]) {
+            Documentation = toString config.documentation;
+          }
+          // optionalAttrs (config.onFailure != [ ]) {
+            OnFailure = toString config.onFailure;
+          }
+          // optionalAttrs (config.onSuccess != [ ]) {
+            OnSuccess = toString config.onSuccess;
+          }
+          // optionalAttrs (options.startLimitIntervalSec.isDefined) {
+            StartLimitIntervalSec = toString config.startLimitIntervalSec;
+          }
+          // optionalAttrs (options.startLimitBurst.isDefined) {
+            StartLimitBurst = toString config.startLimitBurst;
+          };
       };
     };