stdenv-bootstrap-tools: Fix lib*_asneeded problem on gcc16 (#545658)

(texlive-bin-big is not a real attribute, but it does not appear to be
actually exposed as an attribute. we're building this as a dependency of
`texlivePackages.texlive-scripts`.)

autoconf 2.72 has a bug where AC_PROG_CXX would reject c++20 compilers,
and attempts to switch to c++98 or c++11 instead of using the compiler's
default. when using gcc 16, which defaults to c++20, this causes
texlive-bin-big to be built with c++20, causing issues with some of the
included icu4c headers. this bug was fixed in autoconf 2.73, so we
regenerate the autoconf declarations with the newest version of autconf
(currently 2.73). once the configure scripts distributed with the source
are regenerated with autoconf 2.73+, the `reautoconf` call should be
removed.

.editorconfig

@@ -23,15 +23,15 @@ insert_final_newline = false
 
 # see https://nixos.org/nixpkgs/manual/#chap-conventions
 
-[*.{bash,css,js,json,lock,md,nix,pl,pm,py,rb,sh,ts,xml}]
+[*.{bash,css,js,json,lock,md,nix,pl,pm,py,rb,sh,xml}]
 indent_style = space
 
 # Match docbook files, set indent width of one
 [*.xml]
 indent_size = 1
 
-# Match js/json/lockfiles/markdown/nix/ruby/ts files, set indent width of two
-[*.{js,json,lock,md,nix,rb,ts}]
+# Match json/lockfiles/markdown/nix/ruby files, set indent width of two
+[*.{js,json,lock,md,nix,rb}]
 indent_size = 2
 
 # Match all the Bash code in Nix files, set indent width of two

.github/actions/checkout/action.yml

@@ -13,7 +13,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+    - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
       env:
         MERGED_SHA: ${{ inputs.merged-as-untrusted-at }}
         TARGET_SHA: ${{ inputs.target-as-trusted-at }}

.github/dependabot.yml

@@ -1,9 +1,7 @@
 version: 2
 updates:
   - package-ecosystem: "github-actions"
-    directories:
-      - "/"
-      - ".github/actions/*/*"
+    directory: "/"
     schedule:
       interval: "weekly"
     labels: []

.github/workflows/backport.yml

@@ -39,8 +39,6 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ github.event.pull_request.head.sha }}
-          # Avoid materializing full nixpkgs tree
-          sparse-checkout: .
           token: ${{ steps.app-token.outputs.token }}
           persist-credentials: true
 

.github/workflows/bot.yml

@@ -88,7 +88,7 @@ jobs:
           GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
         run: gh api /rate_limit | jq
 
-      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
+      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
         name: Labels from touched files
         if: |
           github.event_name == 'pull_request_target' &&
@@ -98,7 +98,7 @@ jobs:
           configuration-path: .github/labeler.yml # default
           sync-labels: true
 
-      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
+      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
         name: Labels from touched files (no sync)
         if: |
           github.event_name == 'pull_request_target' &&
@@ -108,7 +108,7 @@ jobs:
           configuration-path: .github/labeler-no-sync.yml
           sync-labels: false
 
-      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
+      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
         name: Labels from touched files (development branches)
         # Development branches like staging-next, haskell-updates and python-updates get special labels.
         # This is to avoid the mass of labels there, which is mostly useless - and really annoying for

.github/workflows/eval.yml

@@ -375,7 +375,7 @@ jobs:
         with:
           github-token: ${{ steps.app-token.outputs.token || github.token }}
           script: |
-            require('./nixpkgs/trusted/ci/github-script/check-target-branch.ts')({
+            require('./nixpkgs/trusted/ci/github-script/check-target-branch.js')({
               github,
               context,
               core,

.github/workflows/test.yml

@@ -77,7 +77,7 @@ jobs:
               '.github/workflows/pull-request-target.yml',
               '.github/workflows/test.yml',
               'ci/github-script/bot.js',
-              'ci/github-script/check-target-branch.ts',
+              'ci/github-script/check-target-branch.js',
               'ci/github-script/commits.js',
               'ci/github-script/get-pr-commit-details.js',
               'ci/github-script/lint-commits.js',

CONTRIBUTING.md

@@ -571,10 +571,7 @@ If a contributor does not want committers to push to their branch, they must unc
 
 ### Release notes
 
-If you add or remove a NixOS module, or make other breaking or significant NixOS changes, write about it in the next NixOS release notes in [`nixos/doc/manual/release-notes`](./nixos/doc/manual/release-notes).
-
-If you make major or breaking changes to a package (other than removal), write about it in the next Nixpkgs release notes in [`doc/release-notes`](./doc/release-notes).
-Package removals should not get a Nixpkgs release note, [a throwing alias should be added instead](./pkgs/README.md#steps-to-remove-a-package-from-nixpkgs).
+If you removed packages or made some major NixOS changes, write about it in the next release notes in [`nixos/doc/manual/release-notes`](./nixos/doc/manual/release-notes).
 
 ### File naming and organisation
 

ci/OWNERS

@@ -211,7 +211,7 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @Artturin @Ericson2314 @lo
 /pkgs/development/perl-modules      @stigtsp @marcusramberg
 
 # R
-/pkgs/by-name/r/R   @jbedo
+/pkgs/applications/science/math/R   @jbedo
 /pkgs/development/r-modules         @jbedo
 
 # Rust
@@ -263,15 +263,15 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /lib/licenses @alyssais @emilazy @jopejoe1
 
 # Qt
-/pkgs/development/libraries/qt-5 @NixOS/qt-kde
-/pkgs/development/libraries/qt-6 @NixOS/qt-kde
+/pkgs/development/libraries/qt-5 @K900 @NickCao @SuperSandro2000
+/pkgs/development/libraries/qt-6 @K900 @NickCao @SuperSandro2000
 
 # KDE Frameworks 5
-/pkgs/development/libraries/kde-frameworks @NixOS/qt-kde
+/pkgs/development/libraries/kde-frameworks @K900 @NickCao @SuperSandro2000
 
 # KDE / Plasma 6
-/pkgs/kde @NixOS/qt-kde
-/maintainers/scripts/kde @NixOS/qt-kde
+/pkgs/kde @K900 @NickCao @SuperSandro2000
+/maintainers/scripts/kde @K900 @NickCao @SuperSandro2000
 
 # PostgreSQL and related stuff
 /pkgs/by-name/po/postgresqlTestHook @NixOS/postgres

ci/github-script/.gitignore

@@ -1,4 +1,2 @@
-comparison
-comparison.zip
 node_modules
 step-summary.md

ci/github-script/bot.js

@@ -1,4 +1,3 @@
-// @ts-nocheck
 module.exports = async ({ github, context, core, dry }) => {
   const path = require('node:path')
   const { DefaultArtifactClient } = await import('@actions/artifact')

ci/github-script/check-target-branch.js

@@ -1,6 +1,4 @@
-import type * as actionsCore from '@actions/core'
-import type { context as actionsContext } from '@actions/github'
-import type { GitHub } from '@actions/github/lib/utils'
+/// @ts-check
 
 // TODO: should this be combined with the branch checks in prepare.js?
 // They do seem quite similar, but this needs to run after eval,
@@ -11,47 +9,39 @@ const { readFile } = require('node:fs/promises')
 const { postReview, dismissReviews } = require('./reviews.js')
 
 const reviewKey = 'check-target-branch'
-
-type ChangedPaths = {
-  attrdiff: {
-    added: string[]
-    changed: string[]
-    removed: string[]
-  }
-  attrdiffByKernel: Record<
-    string,
-    {
-      added: string[]
-      changed: string[]
-      removed: string[]
-    }
-  >
-  attrdiffByPlatform: Record<
-    string,
-    {
-      added: string[]
-      changed: string[]
-      removed: string[]
-    }
-  >
-  labels: Record<string, boolean>
-  rebuildCountByKernel: Record<string, number>
-  rebuildsByKernel: Record<string, string[]>
-  rebuildsByPlatform: Record<string, string[]>
-}
-
-async function checkTargetBranch({
-  github,
-  context,
-  core,
-  dry,
-}: {
-  github: InstanceType<typeof GitHub>
-  context: typeof actionsContext
-  core: typeof actionsCore
-  dry: boolean
-}) {
-  const changed: ChangedPaths = JSON.parse(
+/**
+ * @param {{
+ *  github: InstanceType<import('@actions/github/lib/utils').GitHub>,
+ *  context: import('@actions/github/lib/context').Context
+ *  core: import('@actions/core')
+ *  dry: boolean
+ * }} CheckTargetBranchProps
+ */
+async function checkTargetBranch({ github, context, core, dry }) {
+  /**
+   * @type {{
+   *  attrdiff: {
+   *   added: string[],
+   *   changed: string[],
+   *   removed: string[],
+   *  },
+   *  attrdiffByKernel: Record<string, {
+   *   added: string[],
+   *   changed: string[],
+   *   removed: string[],
+   *  }>,
+   *  attrdiffByPlatform: Record<string, {
+   *   added: string[],
+   *   changed: string[],
+   *   removed: string[],
+   *  }>,
+   *  labels: Record<string, boolean>,
+   *  rebuildCountByKernel: Record<string, number>,
+   *  rebuildsByKernel: Record<string, string[]>,
+   *  rebuildsByPlatform: Record<string, string[]>,
+   * }}
+   */
+  const changed = JSON.parse(
     await readFile('comparison/changed-paths.json', 'utf-8'),
   )
   const pull_number = context.payload.pull_request?.number
@@ -165,7 +155,7 @@ async function checkTargetBranch({
       reviewKey,
     })
   } else if (rebuildsAllTests && !isExemptKernelUpdate) {
-    let branchText: string
+    let branchText
     if (base === 'master' && maxRebuildCount >= 500) {
       branchText = '(probably either `staging-nixos` or `staging`)'
     } else if (base === 'master') {

ci/github-script/commits.js

@@ -1,4 +1,3 @@
-// @ts-nocheck
 module.exports = async ({ github, context, core, dry, cherryPicks }) => {
   const { execFileSync } = require('node:child_process')
   const { classify } = require('../supportedBranches.js')

ci/github-script/get-pr-commit-details.js

@@ -1,4 +1,4 @@
-// @ts-nocheck
+// @ts-check
 const { promisify } = require('node:util')
 const execFile = promisify(require('node:child_process').execFile)
 
@@ -16,7 +16,7 @@ const execFile = promisify(require('node:child_process').execFile)
 /**
  * @param {{
  *  args: string[]
- *  core: typeof import('@actions/core'),
+ *  core: import('@actions/core'),
  *  quiet?: boolean,
  *  repoPath?: string,
  * }} RunGitProps
@@ -40,7 +40,7 @@ async function runGit({ args, repoPath, core, quiet }) {
  * of 250 commits and doesn't return the changed files.
  *
  * @param {{
- *  core: typeof import('@actions/core'),
+ *  core: import('@actions/core'),
  *  pr: Awaited<ReturnType<InstanceType<import('@actions/github/lib/utils').GitHub>["rest"]["pulls"]["get"]>>["data"]
  *  repoPath?: string,
  * }} GetCommitMessagesForPRProps
@@ -76,7 +76,7 @@ async function getCommitDetailsForPR({ core, pr, repoPath }) {
 
   return Promise.all(
     shas.map(async (sha) => {
-      // Subject, author name, author email, committer name, committer email (all tab-separated)
+      // Subject, author name, author email, committer name, committer email (all tab-seperated)
       // then a blank line, then filenames.
       const result = (
         await runGit({

ci/github-script/get-teams.js

@@ -1,4 +1,3 @@
-// @ts-nocheck
 const excludeTeams = [
   /^voters.*$/,
   /^nixpkgs-maintainers$/,

ci/github-script/lint-commits.js

@@ -1,3 +1,4 @@
+// @ts-check
 const { classify } = require('../supportedBranches.js')
 const { getCommitDetailsForPR } = require('./get-pr-commit-details.js')
 
@@ -5,9 +6,9 @@ const { getCommitDetailsForPR } = require('./get-pr-commit-details.js')
 
 /**
  * @param {{
- *  github: InstanceType<typeof import('@actions/github/lib/utils').GitHub>,
+ *  github: InstanceType<import('@actions/github/lib/utils').GitHub>,
  *  context: typeof import('@actions/github').context,
- *  core: typeof import('@actions/core'),
+ *  core: import('@actions/core'),
  *  repoPath?: string,
  * }} LintCommitsProps
  */
@@ -56,7 +57,7 @@ async function lintCommits({ github, context, core, repoPath }) {
 /**
  * @param {{
  *  commits: Commit[],
- *  core: typeof import('@actions/core'),
+ *  core: import('@actions/core'),
  * }} CheckCommitMessagesProps
  */
 async function checkCommitMessages({ commits, core }) {
@@ -169,7 +170,7 @@ async function checkCommitMessages({ commits, core }) {
 /**
  * @param {{
  *  commits: Commit[],
- *  core: typeof import('@actions/core'),
+ *  core: import('@actions/core'),
  * }} CheckGitFieldsProps
  */
 async function checkCommitMetadata({ commits, core }) {

ci/github-script/manual-file-edits.js

@@ -1,11 +1,12 @@
+// @ts-check
 const { classify } = require('../supportedBranches.js')
 const { getCommitDetailsForPR } = require('./get-pr-commit-details')
 
 /**
  * @param {{
- *  github: InstanceType<typeof import('@actions/github/lib/utils').GitHub>,
- *  context: typeof import('@actions/github').context,
- *  core: typeof import('@actions/core'),
+ *  github: InstanceType<import('@actions/github/lib/utils').GitHub>,
+ *  context: import('@actions/github/lib/context').Context,
+ *  core: import('@actions/core'),
  *  repoPath?: string,
  *  dry: boolean,
  * }} CheckManualFileEditsProps

ci/github-script/merge.js

@@ -1,4 +1,3 @@
-// @ts-nocheck
 const { classify } = require('../supportedBranches.js')
 
 function runChecklist({

ci/github-script/package-lock.json

@@ -10,11 +10,6 @@
         "@actions/github": "9.1.0",
         "bottleneck": "2.19.5",
         "commander": "14.0.3"
-      },
-      "devDependencies": {
-        "@tsconfig/node24": "24.0.4",
-        "@types/node": "24.13.3",
-        "typescript": "7.0.2"
       }
     },
     "node_modules/@actions/artifact": {
@@ -593,19 +588,6 @@
         "protoc-gen-ts": "bin/protoc-gen-ts"
       }
     },
-    "node_modules/@protobuf-ts/plugin/node_modules/typescript": {
-      "version": "3.9.10",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-3.9.10.tgz",
-      "integrity": "sha512-w6fIxVE/H1PkLKcCPsFqKE7Kv7QUwhU8qQY2MueZXWx5cPZdwFupLgKK3vntcK98BtNHZtAF4LA/yl2a7k8R6Q==",
-      "license": "Apache-2.0",
-      "bin": {
-        "tsc": "bin/tsc",
-        "tsserver": "bin/tsserver"
-      },
-      "engines": {
-        "node": ">=4.2.0"
-      }
-    },
     "node_modules/@protobuf-ts/protoc": {
       "version": "2.11.1",
       "resolved": "https://registry.npmjs.org/@protobuf-ts/protoc/-/protoc-2.11.1.tgz",
@@ -630,343 +612,6 @@
         "@protobuf-ts/runtime": "^2.11.1"
       }
     },
-    "node_modules/@tsconfig/node24": {
-      "version": "24.0.4",
-      "resolved": "https://registry.npmjs.org/@tsconfig/node24/-/node24-24.0.4.tgz",
-      "integrity": "sha512-2A933l5P5oCbv6qSxHs7ckKwobs8BDAe9SJ/Xr2Hy+nDlwmLE1GhFh/g/vXGRZWgxBg9nX/5piDtHR9Dkw/XuA==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@types/node": {
-      "version": "24.13.3",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.3.tgz",
-      "integrity": "sha512-Dh8vAsV36ig5wa9OX4pXvMc9D3Veibfw2wix0CUwYODLD8nkj9UsLjASr49nPg+2eKzxhBV+v7L8pXvT4e639Q==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "undici-types": "~7.18.0"
-      }
-    },
-    "node_modules/@typescript/typescript-aix-ppc64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-aix-ppc64/-/typescript-aix-ppc64-7.0.2.tgz",
-      "integrity": "sha512-MTKKkWB7p/0E9xi1d1tHtZ5PiLkGEMIq88pK2CubZjOsLtYTLqhgIgi6zepFa+9GHZ6h05NMCkQxGKiPXMxXtQ==",
-      "cpu": [
-        "ppc64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "aix"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-darwin-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-arm64/-/typescript-darwin-arm64-7.0.2.tgz",
-      "integrity": "sha512-gowzar9MwS/aRWp6f3a4KUqzRjAZjOsmGNCM6LcTgXum+dBfgsBVMN+AgvOCCbguXyick6LJhpBszxMebJ8syA==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-darwin-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-x64/-/typescript-darwin-x64-7.0.2.tgz",
-      "integrity": "sha512-SZ9xZInqApNlNGc9s0W1VSsktYSOe9cFqNOIqmN1Gs8SmkjKZYFt017G4VwPxASInODuAdbTW7sXiFUf893RgA==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-freebsd-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-arm64/-/typescript-freebsd-arm64-7.0.2.tgz",
-      "integrity": "sha512-W5NH4y/J0plIIS5b2xvTEkU7JFxyqdMAOgf+Ilhl0vHQXKO5dZoxd+C/jEtq56c4F3wk71RB4BMRQ2XdI+bwYQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-freebsd-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-x64/-/typescript-freebsd-x64-7.0.2.tgz",
-      "integrity": "sha512-UMGDx5sTpzNw3WiPebH7l90IWfJggEd+egHt/q6p7/Cm3zqoV7VxkGXt+3DxPIw8CcmvAB0j3sVVfbhX+M4Tpw==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-arm": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm/-/typescript-linux-arm-7.0.2.tgz",
-      "integrity": "sha512-gffT3xPz9sR7j/YJExkyPntrI0P2EP9XbOyWzth2/Gs0RstK+90RBcO0ncXoXy/beYll1SXw846Nf2zdnEz0QQ==",
-      "cpu": [
-        "arm"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm64/-/typescript-linux-arm64-7.0.2.tgz",
-      "integrity": "sha512-Qh4eU4/y3yDjnfjjyPYihMj5/ODIlmt+Bzu17OI+fiSRDW57QmU5SiN63exPRNJPKUzcc1INa1NXdrJ+MqHjUQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-loong64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-loong64/-/typescript-linux-loong64-7.0.2.tgz",
-      "integrity": "sha512-uEHck9i8hoAzXPiYRib1O7miOnz23SxIeVl6F4LXox+qov1K35jHcEW6VHKvZI+pyvl7fZEP4MCU5LYvIq1GuQ==",
-      "cpu": [
-        "loong64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-mips64el": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-mips64el/-/typescript-linux-mips64el-7.0.2.tgz",
-      "integrity": "sha512-R4KvAMnE43W5Qeqb0Ly56O3mWMWIAgsMyz36DCaycd5nbg/9kzm0liw3JocfRqyJY0KPmzFjbswozXyW0DnIYA==",
-      "cpu": [
-        "mips64el"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-ppc64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-ppc64/-/typescript-linux-ppc64-7.0.2.tgz",
-      "integrity": "sha512-DORx5b3sd/4S7eayxm4FQv+A7CrkUIGRaHiwI8oiHTAI1fAPWhF4J0vAlkC8biAlHSVVwxMQ3tjZ2/DVbnQiiA==",
-      "cpu": [
-        "ppc64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-riscv64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-riscv64/-/typescript-linux-riscv64-7.0.2.tgz",
-      "integrity": "sha512-wf0jqEDOjrPRnKwYRyyJDRo11KMbvMFrU+q4zqKyChODBzvlkbhNQfKvLxQCcwTpdDaXSHZTVuh0JoCrKCUMHQ==",
-      "cpu": [
-        "riscv64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-s390x": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-s390x/-/typescript-linux-s390x-7.0.2.tgz",
-      "integrity": "sha512-IkwJc3L7yhytWd/ewjyxNDfOmswCm9GWMJT/ue/dU4aZNbwZeYAetq42VyLmsmSjvoX7z74X6ZaYCtzAr0EuGw==",
-      "cpu": [
-        "s390x"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-linux-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-x64/-/typescript-linux-x64-7.0.2.tgz",
-      "integrity": "sha512-EYdf2cNg7rgCWJnxCdJ+F3V39O8ihb37eHAu1LK8oAFizgTQbPOK7zHHXbPt8rX24COqODXeI3sIf0fCXG7H/A==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-netbsd-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-arm64/-/typescript-netbsd-arm64-7.0.2.tgz",
-      "integrity": "sha512-+polYF4MF04aPpO5FTkHran9yUQDSXqy5GiSDKpsll5jy3l3+g9QLhpf39T+ePtefhXLOGrLl0QIjkQP6VnelA==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-netbsd-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-x64/-/typescript-netbsd-x64-7.0.2.tgz",
-      "integrity": "sha512-8YIT0EHM/3dq10ZOVF/A7pc/YSMtbcecct4rWtexrnSCHOPcpC2KTLXfTCR6vDpnSiY12heNb1GiN/wu+T/FyA==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-openbsd-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-arm64/-/typescript-openbsd-arm64-7.0.2.tgz",
-      "integrity": "sha512-APT8+ClYnuYm1u9+kgGXoMj2VzWzcymwh2gNSQVySHfkRDGOTVkoWLjCmOQSaO+PoqQ57B0flRp9SA+7GnnkzQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-openbsd-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-x64/-/typescript-openbsd-x64-7.0.2.tgz",
-      "integrity": "sha512-yX7s+Q0Dln0Dt9tEzZsAjXXR/+ytBM7AlglaqyeMPxQszJ1JhlJdZ6jLA+IzldHtflX81em7lDao1xXu+aRRkg==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-sunos-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-sunos-x64/-/typescript-sunos-x64-7.0.2.tgz",
-      "integrity": "sha512-dLJDGaLZ1D4HPQn62u1n8mBDkJREwMsAkCdkwd4Ieqw+x3TUyTsqY0YiBCtE6H6OzzgGk3iuZ3vFWRS+E8/d1g==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "sunos"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-win32-arm64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-arm64/-/typescript-win32-arm64-7.0.2.tgz",
-      "integrity": "sha512-Gyl1Vy6OsWesLzmq+EP0Fb7b4Nid5232AvcA2SFcdYreldpNtYFFofPjnt62y9hQy7VTaZp65ICJjuAQRaVcIQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/@typescript/typescript-win32-x64": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-x64/-/typescript-win32-x64-7.0.2.tgz",
-      "integrity": "sha512-0BQ3HkAHHlKLSp1qRvf3SUhGpGsDuhB/jgFw75guyqbxJqEaS0Cw/VFO8i2nHglJUzQCRtMMR/IBAKE3ETMC4g==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
     "node_modules/@typescript/vfs": {
       "version": "1.6.1",
       "resolved": "https://registry.npmjs.org/@typescript/vfs/-/vfs-1.6.1.tgz",
@@ -2012,37 +1657,16 @@
       }
     },
     "node_modules/typescript": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-7.0.2.tgz",
-      "integrity": "sha512-8FYau96o3NKOhbjKi/qNvG/W5jhzxkbdm5sj9AbZ/5T5sWqn3hJgLfGx27sRKZWTvyzCP8dLRBTf5tBTSRVUNA==",
+      "version": "3.9.10",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-3.9.10.tgz",
+      "integrity": "sha512-w6fIxVE/H1PkLKcCPsFqKE7Kv7QUwhU8qQY2MueZXWx5cPZdwFupLgKK3vntcK98BtNHZtAF4LA/yl2a7k8R6Q==",
       "license": "Apache-2.0",
       "bin": {
-        "tsc": "bin/tsc"
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
       },
       "engines": {
-        "node": ">=16.20.0"
-      },
-      "optionalDependencies": {
-        "@typescript/typescript-aix-ppc64": "7.0.2",
-        "@typescript/typescript-darwin-arm64": "7.0.2",
-        "@typescript/typescript-darwin-x64": "7.0.2",
-        "@typescript/typescript-freebsd-arm64": "7.0.2",
-        "@typescript/typescript-freebsd-x64": "7.0.2",
-        "@typescript/typescript-linux-arm": "7.0.2",
-        "@typescript/typescript-linux-arm64": "7.0.2",
-        "@typescript/typescript-linux-loong64": "7.0.2",
-        "@typescript/typescript-linux-mips64el": "7.0.2",
-        "@typescript/typescript-linux-ppc64": "7.0.2",
-        "@typescript/typescript-linux-riscv64": "7.0.2",
-        "@typescript/typescript-linux-s390x": "7.0.2",
-        "@typescript/typescript-linux-x64": "7.0.2",
-        "@typescript/typescript-netbsd-arm64": "7.0.2",
-        "@typescript/typescript-netbsd-x64": "7.0.2",
-        "@typescript/typescript-openbsd-arm64": "7.0.2",
-        "@typescript/typescript-openbsd-x64": "7.0.2",
-        "@typescript/typescript-sunos-x64": "7.0.2",
-        "@typescript/typescript-win32-arm64": "7.0.2",
-        "@typescript/typescript-win32-x64": "7.0.2"
+        "node": ">=4.2.0"
       }
     },
     "node_modules/undici": {
@@ -2057,13 +1681,6 @@
         "node": ">=14.0"
       }
     },
-    "node_modules/undici-types": {
-      "version": "7.18.2",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.18.2.tgz",
-      "integrity": "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/universal-user-agent": {
       "version": "7.0.3",
       "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.3.tgz",

ci/github-script/package.json

@@ -10,10 +10,5 @@
     "@actions/github": "9.1.0",
     "bottleneck": "2.19.5",
     "commander": "14.0.3"
-  },
-  "devDependencies": {
-    "@tsconfig/node24": "24.0.4",
-    "@types/node": "24.13.3",
-    "typescript": "7.0.2"
   }
 }

ci/github-script/prepare.js

@@ -1,4 +1,3 @@
-// @ts-nocheck
 const { classify } = require('../supportedBranches.js')
 const { postReview, dismissReviews } = require('./reviews.js')
 const reviewKey = 'prepare'

ci/github-script/reviewers.js

@@ -1,4 +1,3 @@
-// @ts-nocheck
 async function handleReviewers({
   github,
   context,

ci/github-script/reviews.js

@@ -1,3 +1,5 @@
+// @ts-check
+
 const eventToState = {
   COMMENT: 'COMMENTED',
   REQUEST_CHANGES: 'CHANGES_REQUESTED',
@@ -14,7 +16,7 @@ const reviewUsers = [
 ]
 
 /**
- * @typedef {InstanceType<typeof import('@actions/github/lib/utils').GitHub>} GitHub
+ * @typedef {InstanceType<import('@actions/github/lib/utils').GitHub>} GitHub
  * @typedef {typeof import('@actions/github').context} Context
  *
  * @typedef {Awaited<ReturnType<GitHub['rest']['pulls']['listReviews']>>['data'][number]} Review
@@ -25,7 +27,7 @@ const reviewUsers = [
  * @param {{
  *  github: GitHub,
  *  context: Context,
- *  core: typeof import('@actions/core'),
+ *  core: import('@actions/core'),
  *  dry: boolean,
  *  reviewKey?: string,
  * }} DismissReviewsProps
@@ -163,10 +165,10 @@ async function dismissReviews({ github, context, core, dry, reviewKey }) {
  * @param {{
  *  github: GitHub,
  *  context: Context,
- *  core: typeof import('@actions/core'),
+ *  core: import('@actions/core'),
  *  dry: boolean,
  *  body: string,
- *  event: keyof typeof eventToState,
+ *  event: keyof eventToState,
  *  reviewKey: string,
  * }} PostReviewProps
  */

ci/github-script/run

@@ -112,8 +112,8 @@ program
   .argument('<repo>', 'Name of the GitHub repository to run on (Example: nixpkgs)')
   .argument('<pr>', 'Number of the Pull Request to run on')
   .action(async (owner, repo, pr, options) => {
-    const checkTargetBranch = (await import('./check-target-branch.ts')).default
-    await run(checkTargetBranch, owner, repo, pr, options)
+    const checkCommitMessages = (await import('./check-target-branch.js')).default
+    await run(checkCommitMessages, owner, repo, pr, options)
   })
 
 program

ci/github-script/supportedSystems.js

@@ -1,4 +1,3 @@
-// @ts-nocheck
 module.exports = async ({ github, context, targetSha }) => {
   const { content, encoding } = (
     await github.rest.repos.getContent({

ci/github-script/tsconfig.json

@@ -1,26 +0,0 @@
-{
-  "compilerOptions": {
-    "lib": [
-      "es2024",
-      "ESNext.Array",
-      "ESNext.Collection",
-      "ESNext.Error",
-      "ESNext.Iterator",
-      "ESNext.Promise"
-    ],
-    "module": "nodenext",
-    "target": "es2024",
-
-    "strict": true,
-    "esModuleInterop": true,
-    "skipLibCheck": true,
-    "moduleResolution": "node16",
-
-    "allowImportingTsExtensions": true,
-    "allowJs": true,
-    "checkJs": true,
-    "erasableSyntaxOnly": true,
-    "verbatimModuleSyntax": true,
-    "noEmit": true,
-  }
-}

ci/github-script/withRateLimit.js

@@ -1,4 +1,3 @@
-// @ts-nocheck
 module.exports = async ({ github, core, maxConcurrent = 1 }, callback) => {
   const Bottleneck = require('bottleneck')
 

ci/pinned.json

@@ -9,22 +9,9 @@
       },
       "branch": "nixpkgs-unstable",
       "submodules": false,
-      "revision": "7525d999cd850b9a488817abc89c75dc733acf17",
-      "url": "https://github.com/NixOS/nixpkgs/archive/7525d999cd850b9a488817abc89c75dc733acf17.tar.gz",
-      "hash": "sha256-4IHyyLgLBdKefkljdKod4IMn023pQiDXAWJA187cmdY="
-    },
-    "nixpkgs-26.05-darwin": {
-      "type": "Git",
-      "repository": {
-        "type": "GitHub",
-        "owner": "NixOS",
-        "repo": "nixpkgs"
-      },
-      "branch": "nixpkgs-26.05-darwin",
-      "submodules": false,
-      "revision": "51fe96f9107566e6b8eeb7fc4ba696c01e548b04",
-      "url": "https://github.com/NixOS/nixpkgs/archive/51fe96f9107566e6b8eeb7fc4ba696c01e548b04.tar.gz",
-      "hash": "sha256-yj0LPLnsmYoLmA3FGANjeTEwej0/DHjZBXWnDQDUuIs="
+      "revision": "421eebfd0ec7bccd4abe826ce62d7e6e83129493",
+      "url": "https://github.com/NixOS/nixpkgs/archive/421eebfd0ec7bccd4abe826ce62d7e6e83129493.tar.gz",
+      "hash": "sha256:1lxfhfgiv1sz2v7fg43gny57sa6wf59n98q7ldsyb2p06f4sal7w"
     }
   },
   "version": 8

ci/supportedBranches.js

@@ -2,7 +2,6 @@
 /*
 #!nix-shell -i node -p nodejs
 */
-// @ts-nocheck
 
 const typeConfig = {
   master: ['development', 'primary'],

doc/README.md

@@ -14,12 +14,17 @@ Use **examples** first to show how to get something done. Keep **Explanation** l
 
 Use our [styleguide](./styleguide.md) for more in depth guidance on writing good documentation.
 
-Documentation about Nixpkgs belongs here, this includes 'getting-started'-guides and 'onboarding-guides' for *using* Nixpkgs and the language frameworks it ships.
+This directory contains **guides** and **reference** documentation for Nixpkgs.
 
-Write **guides** task-first: lead with a working example, then explain in prose.
-Write **reference** as the specification of functions and attributes.
+Borrowing from [Diátaxis framework](https://diataxis.fr/) what suits our needs:
 
-We are actively working to generate reference documentation from the [doc-comments](https://github.com/NixOS/rfcs/blob/master/rfcs/0145-doc-strings.md) present in code, which also lets you view it locally with `:doc` in `nix repl`.
+**Guides** are task-oriented. They can be tutorial-style walkthroughs or how-to sections.
+Explanations appear as prose after examples.
+
+**Reference** documentation is the specification of functions and attributes.
+
+We are actively working to generate **all** reference documentation from the [doc-comments](https://github.com/NixOS/rfcs/blob/master/rfcs/0145-doc-strings.md) present in code.
+This also provides the benefit of using `:doc` in the `nix repl` to view reference documentation locally on the fly.
 
 See [Document structure](#document-structure) for a structural template.
 
@@ -193,15 +198,15 @@ watermelon
 - If creating a commit purely for documentation changes, format the commit message in the following way:
 
   ```
-  doc/component: (documentation summary)
+  doc: (documentation summary)
 
   (Motivation for change, relevant links, additional information.)
   ```
 
   Examples:
 
-  * doc/stdenv: update the kernel config documentation to use `nix-shell`
-  * doc/getting-started: add information about `nix-update-script`
+  * doc: update the kernel config documentation to use `nix-shell`
+  * doc: add information about `nix-update-script`
 
     Closes #216321.
 

doc/build-helpers/fetchers.chapter.md

@@ -853,7 +853,7 @@ Used with CVS. Expects `cvsRoot`, `tag`, and `hash`.
 
 Used with Mercurial. Expects `url`, `rev`, `hash`, overridable with [`<pkg>.overrideAttrs`](#sec-pkg-overrideAttrs).
 
-A number of fetcher functions wrap lower-level fetchers such as `fetchurl`, `fetchzip`, and `fetchgit`. They are mainly convenience functions intended for commonly used destinations of source code in Nixpkgs. These wrapper fetchers are listed below.
+A number of fetcher functions wrap part of `fetchurl` and `fetchzip`. They are mainly convenience functions intended for commonly used destinations of source code in Nixpkgs. These wrapper fetchers are listed below.
 
 ## `fetchFromGitea`, `fetchFromForgejo` and `fetchFromCodeberg` {#fetchfromgitea}
 
@@ -876,45 +876,6 @@ However, `fetchFromGitHub` will automatically switch to using `fetchgit` in any
 
 When `fetchgit` is used, refer to the `fetchgit` section for documentation of its available options.
 
-## `fetchFromHuggingFace` {#fetchfromhuggingface}
-
-`fetchFromHuggingFace` fetches repositories from Hugging Face Hub. It expects
-`repoId`, exactly one of `rev` or `tag`, and `hash`.
-
-`repoId` must be in the form `repo` or `owner/repo`, so repositories such as
-`gpt2` work as well.
-
-::: {.example #ex-fetchfromhuggingface}
-
-# Fetching a model repository from Hugging Face
-
-```nix
-fetchFromHuggingFace {
-  repoId = "hf-internal-testing/tiny-random-gpt2";
-  rev = "71034c5d8bde858ff824298bdedc65515b97d2b9";
-  backend = "lfs";
-  hash = "sha256-8K9B/C62GW5lXC0c8QQpQ9QAE1UMoG+kYqvGhnWIp64=";
-}
-```
-
-:::
-
-The optional `repoType` argument selects which Hugging Face Hub repository type
-to use:
-
-- `"model"` (default) fetches from `https://huggingface.co/<repo-id>`
-- `"dataset"` fetches from `https://huggingface.co/datasets/<repo-id>`
-- `"space"` fetches from `https://huggingface.co/spaces/<repo-id>`
-
-To use a different Hugging Face Hub instance, use `domain`
-(defaults to `"huggingface.co"`).
-
-The optional `backend` argument defaults to `"xet"`. Because the Xet backend is
-not implemented yet, callers must currently set `backend = "lfs"`, which uses
-`fetchgit` with Git LFS enabled and defaults `fetchSubmodules` to `false`.
-`rootDir`, `sparseCheckout`, and low-level `fetchgit` options such as
-`deepClone`, `fetchTags`, `leaveDotGit`, and `branchName` are also supported.
-
 ## `fetchFromGitLab` {#fetchfromgitlab}
 
 This is used with GitLab repositories. It behaves similarly to `fetchFromGitHub`, and expects `owner`, `repo`, `rev`, and `hash`.

doc/build-helpers/images/appimagetools.section.md

@@ -28,7 +28,7 @@ However, [those were unified early 2020](https://github.com/NixOS/nixpkgs/pull/8
 
 ```nix
 { appimageTools, fetchurl }:
-appimageTools.wrapType2 {
+let
   pname = "nuclear";
   version = "0.6.30";
 
@@ -36,7 +36,8 @@ appimageTools.wrapType2 {
     url = "https://github.com/nukeop/nuclear/releases/download/v${version}/nuclear-v${version}.AppImage";
     hash = "sha256-he1uGC1M/nFcKpMM9JKY4oeexJcnzV0ZRxhTjtJz6xw=";
   };
-}
+in
+appimageTools.wrapType2 { inherit pname version src; }
 ```
 
 :::
@@ -55,7 +56,7 @@ There are a few ways to learn which dependencies an application needs:
 
 ```nix
 { appimageTools, fetchurl }:
-appimageTools.wrapType2 {
+let
   pname = "irccloud";
   version = "0.16.0";
 
@@ -63,7 +64,9 @@ appimageTools.wrapType2 {
     url = "https://github.com/irccloud/irccloud-desktop/releases/download/v${version}/IRCCloud-${version}-linux-x86_64.AppImage";
     hash = "sha256-/hMPvYdnVB1XjKgU2v47HnVvW4+uC3rhRjbucqin4iI=";
   };
-
+in
+appimageTools.wrapType2 {
+  inherit pname version src;
   extraPkgs = pkgs: [ pkgs.at-spi2-core ];
 }
 ```
@@ -85,12 +88,12 @@ However, [those were unified early 2020](https://github.com/NixOS/nixpkgs/pull/8
 
 # Extracting an AppImage to install extra files
 
-`wrapType2` automatically extracts the AppImage for you and makes it available via the `contents` attribute.
-Note how `finalAttrs.contents` is used in `extraInstallCommands` to install additional files that were extracted from the AppImage.
+This example was adapted from a real package in Nixpkgs to show how `extract` is usually used in combination with `wrapType2`.
+Note how `appimageContents` is used in `extraInstallCommands` to install additional files that were extracted from the AppImage.
 
 ```nix
 { appimageTools, fetchurl }:
-appimageTools.wrapType2 (finalAttrs: {
+let
   pname = "irccloud";
   version = "0.16.0";
 
@@ -99,24 +102,27 @@ appimageTools.wrapType2 (finalAttrs: {
     hash = "sha256-/hMPvYdnVB1XjKgU2v47HnVvW4+uC3rhRjbucqin4iI=";
   };
 
+  appimageContents = appimageTools.extract { inherit pname version src; };
+in
+appimageTools.wrapType2 {
+  inherit pname version src;
+
   extraPkgs = pkgs: [ pkgs.at-spi2-core ];
 
   extraInstallCommands = ''
     mv $out/bin/irccloud-${version} $out/bin/irccloud
-    install -m 444 -D ${finalAttrs.contents}/irccloud.desktop $out/share/applications/irccloud.desktop
-    install -m 444 -D ${finalAttrs.contents}/usr/share/icons/hicolor/512x512/apps/irccloud.png \
+    install -m 444 -D ${appimageContents}/irccloud.desktop $out/share/applications/irccloud.desktop
+    install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/512x512/apps/irccloud.png \
       $out/share/icons/hicolor/512x512/apps/irccloud.png
     substituteInPlace $out/share/applications/irccloud.desktop \
       --replace-fail 'Exec=AppRun' 'Exec=irccloud'
   '';
-})
+}
 ```
 
 :::
 
-`appimageTools` also exposes the `extract` function should you need to do it manually, requiring `pname`, `version`, and `src` arguments (`src` being the AppImage file to extract).
-
-The arguments passed to `extract` can also contain a `postExtract` attribute, which allows you to execute additional commands after the files are extracted from the AppImage.
+The argument passed to `extract` can also contain a `postExtract` attribute, which allows you to execute additional commands after the files are extracted from the AppImage.
 `postExtract` must be a string with commands to run.
 
 :::{.warning}
@@ -132,7 +138,7 @@ This is a rewrite of [](#ex-extracting-appimage) to use `postExtract` and `wrapA
 
 ```nix
 { appimageTools, fetchurl }:
-appimageTools.wrapAppImage (finalAttrs: {
+let
   pname = "irccloud";
   version = "0.16.0";
 
@@ -141,22 +147,30 @@ appimageTools.wrapAppImage (finalAttrs: {
     hash = "sha256-/hMPvYdnVB1XjKgU2v47HnVvW4+uC3rhRjbucqin4iI=";
   };
 
-  contents = appimageTools.extract {
-    inherit (finalAttrs) pname version src;
+  appimageContents = appimageTools.extract {
+    inherit pname version src;
     postExtract = ''
       substituteInPlace $out/irccloud.desktop --replace-fail 'Exec=AppRun' 'Exec=irccloud'
     '';
   };
+in
+appimageTools.wrapAppImage {
+  inherit pname version;
+
+  src = appimageContents;
 
   extraPkgs = pkgs: [ pkgs.at-spi2-core ];
 
   extraInstallCommands = ''
     mv $out/bin/irccloud-${version} $out/bin/irccloud
-    install -m 444 -D ${finalAttrs.contents}/irccloud.desktop $out/share/applications/irccloud.desktop
-    install -m 444 -D ${finalAttrs.contents}/usr/share/icons/hicolor/512x512/apps/irccloud.png \
+    install -m 444 -D ${appimageContents}/irccloud.desktop $out/share/applications/irccloud.desktop
+    install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/512x512/apps/irccloud.png \
       $out/share/icons/hicolor/512x512/apps/irccloud.png
   '';
-})
+
+  # specify src archive for nix-update
+  passthru.src = src;
+}
 ```
 
 :::

doc/doc-support/package.nix

@@ -118,7 +118,7 @@ stdenvNoCC.mkDerivation (
         --script ./anchor.min.js \
         --script ./anchor-use.js \
         --sidebar-depth 3 \
-        --experimental-config ./nav.json \
+        --nav ./nav.json \
         --header ${./header.html}\
         --no-navheader \
         manual.md \

doc/getting-started/dev-environments.md

@@ -1,49 +0,0 @@
-# Dev environments {#dev-environments}
-
-Create a `shell.nix` with the following:
-
-```nix
-# shell.nix
-let
-  nixpkgs = fetchTarball "https://github.com/NixOS/nixpkgs/archive/nixos-unstable.tar.gz";
-  pkgs = import nixpkgs { };
-in
-pkgs.mkShell {
-  packages = [ pkgs.python3 ];
-  shellHook = ''
-    echo "Welcome in my nix shell"
-  '';
-}
-```
-
-run
-
-```sh
-nix-shell
-```
-
-This activates your `shell.nix` and you should see:
-
-```sh
-unpacking 'https://github.com/NixOS/nixpkgs/archive/nixos-unstable.tar.gz' into the Git cache...
-Welcome in your nix shell
-```
-
-python3 is available
-
-```sh
-$ python3 --version
-```
-
-To leave the shell
-
-```bash
-ctrl+D
-```
-
-:::{.note}
-You should use [pinned nixpkgs](https://nix.dev/guides/recipes/dependency-management.html).
-The example used `unstable` here for demonstration purposes only
-:::
-
-For further information check out [nix-shell](https://nix.dev/manual/nix/stable/command-ref/nix-shell)

doc/getting-started/getting-started.part.md

@@ -1,6 +0,0 @@
-# Getting started {#getting-started}
-
-```{=include=} chapters
-first-package.chapter.md
-dev-environments.md
-```

doc/languages-frameworks/android.section.md

@@ -116,7 +116,7 @@ options:
 For each requested system image we can specify the following options:
 
 * `systemImageTypes` specifies what kind of system images should be included.
-  Defaults to: `google_apis`, `google_apis_playstore`, `google_apis_ps16k` and `google_apis_playstore_ps16k`.
+  Defaults to: `default`.
 * `abiVersions` specifies what kind of ABI version of each system image should
   be included. Defaults to `armeabi-v7a` and `arm64-v8a`.
 

doc/languages-frameworks/neovim.section.md

@@ -267,13 +267,13 @@ You can install the standalone parsers and queries directly without installing `
 ### Treesitter setup using WASM parsers and queries {#neovim-plugin-treesitter-wasm}
 
 Neovim can load WASM parsers when it is built with Wasmtime support.
-In nixpkgs, WASM parser plugins are available from the `wasm32-wasip1` cross package set:
+In nixpkgs, WASM parser plugins are available from the `wasi32` cross package set:
 
 ```nix
 (pkgs.wrapNeovim (pkgs.neovim-unwrapped.override { wasmSupport = true; }) {
   configure = {
     packages.myPlugins =
-      with pkgs.pkgsCross.wasm32-wasip1.vimPlugins;
+      with pkgs.pkgsCross.wasi32.vimPlugins;
       let
         # Select the grammars you need
         treesitter-grammars = with nvim-treesitter-parsers; [
@@ -296,7 +296,7 @@ In nixpkgs, WASM parser plugins are available from the `wasm32-wasip1` cross pac
 
 Do not install both native and WASM parsers for the same language.
 For example, installing both `pkgs.vimPlugins.nvim-treesitter-parsers.nix` and
-`pkgs.pkgsCross.wasm32-wasip1.vimPlugins.nvim-treesitter-parsers.nix` is invalid because Neovim
+`pkgs.pkgsCross.wasi32.vimPlugins.nvim-treesitter-parsers.nix` is invalid because Neovim
 loads the first `parser/nix.*` found on `runtimepath`.
 
 Use `:checkhealth vim.treesitter` to verify Nix-managed WASM parsers.

doc/languages-frameworks/rust.section.md

@@ -739,7 +739,7 @@ stdenv.mkDerivation (finalAttrs: {
 ### Compiling `wasm32-wasip1` package {#compiling-wasm32-wasip1-package}
 
 ```nix
-pkgsCross.wasm32-wasip1.callPackage (
+pkgsCross.wasi32.callPackage (
   {
     fetchFromGitHub,
     rustPlatform,

doc/manual.md.in

@@ -3,10 +3,10 @@
 
 ```{=include=} chapters
 preface.chapter.md
+first-package.chapter.md
 ```
 
 ```{=include=} parts
-getting-started/getting-started.part.md
 using-nixpkgs.md
 lib.md
 stdenv.md

doc/nav.json

@@ -1,4 +1,3 @@
 {
-  "open": [],
-  "items": []
+  "open": []
 }

doc/packages/darwin-builder.section.md

@@ -83,57 +83,6 @@ $ sudo launchctl kickstart -k system/org.nixos.nix-daemon
 
 Note that if the builder is running and you have created the above ssh conf file, you can ssh into the builder with `sudo ssh builder@linux-builder`.
 
-## Using the Virtualization.framework backend {#sec-darwin-builder-vz}
-
-`darwin.linux-builder-vz` is a variant of `darwin.linux-builder` that runs the same
-NixOS guest on Apple's Virtualization.framework (via `pkgs.vzvm`) instead of QEMU.
-Instead of emulating x86_64, it exposes Rosetta to the guest, so `x86_64-linux`
-builds are translated rather than emulated, which is substantially faster. It
-requires an Apple silicon host (`aarch64-darwin`) running macOS 13 or newer, with
-Rosetta installed:
-
-```ShellSession
-$ softwareupdate --install-rosetta --agree-to-license
-```
-
-The builder refuses to start when Rosetta is missing, rather than silently dropping
-`x86_64-linux` support; set `virtualisation.vz.rosetta.enable = false` to run
-without it.
-
-It is a drop-in replacement: it listens on the same host port (31022) and presents
-the same host key as the QEMU builder, so the `nix.conf` and SSH configuration
-described above apply unchanged; only the transport behind the port changes, from
-TCP forwarding to vsock. Since a single builder VM handles both architectures
-through Rosetta, list both systems in your `builders` entry
-(`aarch64-linux,x86_64-linux`), or with nix-darwin:
-
-```nix
-{
-  nix.linux-builder = {
-    enable = true;
-    package = pkgs.darwin.linux-builder-vz;
-    systems = [
-      "aarch64-linux"
-      "x86_64-linux"
-    ];
-  };
-}
-```
-
-When switching an existing QEMU builder over, delete its data disk first (e.g.
-`sudo rm /var/lib/linux-builder/nixos.qcow2`): the vz builder reuses the file name
-but writes a raw image, and refuses to misread a genuine qcow2 left behind.
-
-The guest console goes to the macOS unified log by default; read it with:
-
-```ShellSession
-$ /usr/bin/log show --last 5m --predicate 'subsystem == "systems.applicative.vzvm"'
-```
-
-The `virtualisation.vz.*` NixOS options configure the backend further, e.g.
-`virtualisation.vz.nestedVirtualization` gives the guest a working `/dev/kvm` for
-running NixOS integration tests on the builder (macOS 15+, M3 or newer).
-
 ## Example flake usage {#sec-darwin-builder-example-flake}
 
 ```nix

doc/redirects.json

@@ -105,9 +105,6 @@
   "cuda-writing-tests": [
     "index.html#cuda-writing-tests"
   ],
-  "dev-environments": [
-    "index.html#dev-environments"
-  ],
   "ex-build-helpers-extendMkDerivation": [
     "index.html#ex-build-helpers-extendMkDerivation"
   ],
@@ -152,9 +149,6 @@
   "friction-graphics-wayland": [
     "index.html#friction-graphics-wayland"
   ],
-  "getting-started": [
-    "index.html#getting-started"
-  ],
   "ghc-deprecation-policy": [
     "index.html#ghc-deprecation-policy"
   ],
@@ -446,9 +440,6 @@
   "sec-darwin-availability-checks": [
     "index.html#sec-darwin-availability-checks"
   ],
-  "sec-darwin-builder-vz": [
-    "index.html#sec-darwin-builder-vz"
-  ],
   "sec-darwin-libcxx-deployment-targets": [
     "index.html#sec-darwin-libcxx-deployment-targets"
   ],
@@ -2071,12 +2062,6 @@
   "fetchfromgithub": [
     "index.html#fetchfromgithub"
   ],
-  "fetchfromhuggingface": [
-    "index.html#fetchfromhuggingface"
-  ],
-  "ex-fetchfromhuggingface": [
-    "index.html#ex-fetchfromhuggingface"
-  ],
   "fetchfromgitlab": [
     "index.html#fetchfromgitlab"
   ],

doc/release-notes/rl-2611.section.md

@@ -16,14 +16,12 @@
   +nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.zst";
   ```
 
-- `sing-box` now supports NaïveProxy outbounds.
+- GCC has been updated from GCC 15 to GCC 16. This introduces some backwards-incompatible changes. Refer to the [upstream porting guide](https://gcc.gnu.org/gcc-16/porting_to.html) for details.
 
 ## Backward Incompatibilities {#sec-nixpkgs-release-26.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- `moon` has been updated to `2.x` and needs manual migration. See the [migration guide](https://moonrepo.dev/docs/migrate/2.0) for instructions.
-
 - []{#x86_64-darwin-26.11}
 
   Support for `x86_64-darwin` has been dropped, due to Apple’s deprecation of the platform and limited build infrastructure and developer time.
@@ -42,8 +40,6 @@
 
 - `hurl` has been updated to `8.x.x` which has some breaking changes. See [upstream changelog](https://github.com/Orange-OpenSource/hurl/releases/tag/8.0.0) for details.
 
-- The existing `wasm32-wasi` target has become `wasm32-wasip1` and `pkgsCross.wasi32` has become `pkgsCross.wasm32-wasip1`, aligning with LLVM's nomenclature. Aliases are in place and old forms will continue to be parsed but there might be some breakage if you're relying on the exact form of these (e.g., in sysroot paths).
-
 - `gotosocial` has been updated to 0.22.0. This release contains a very long database migration, which should not be cancelled or interrupted under any circumstances.
  -  Postgres users: Following the migration, if you encounter slowdown on Postgres specifically (ie., timing out while loading timelines) you may need to run some manual database maintenance steps. Please check https://docs.gotosocial.org/en/stable/admin/database_maintenance/#postgres.
 
@@ -59,10 +55,6 @@
 
 - `fflogs` has been removed because it was no longer functional. Users should switch to `archon-lite`.
 
-- `keycloak.plugins.scim-for-keycloak` has been removed. The upstream open-source project is [end-of-life](https://github.com/Captain-P-Goldfish/scim-for-keycloak) and its last release targets Keycloak 20, which is incompatible with the packaged Keycloak.
-
-- `keycloak.plugins.scim-keycloak-user-storage-spi` has been removed. Upstream has moved the plugin into Keycloak itself as the experimental `ipatuura` federation provider and no longer maintains the standalone repository.
-
 - `services.mysql` now sets `root@localhost` authentication to `auth_socket` when used with `mysql` or `percona-server`.
   Existing deployments will also be adjusted if possible. See the [security advisory GHSA-6qxx-6rg8-c4p8](https://github.com/NixOS/nixpkgs/security/advisories/GHSA-6qxx-6rg8-c4p8) for more information.
 
@@ -72,14 +64,8 @@
 
 - `alps` has been rewritten upstream, see [upstream repository](https://github.com/migadu/alps) for documentation.
 
-- `bosun` has been removed as it is no longer maintained upstream. the corresponding monitoring options has been removed.
-
 - `uhttpmock` providing 0.0 ABI was removed. `uhttpmock_1_0` providing 1.0 ABI was renamed to `uhttpmock` and `uhttpmock_1_0` was kept as an alias.
 
-- `himalaya` has been updated from `v1.2.0` to `v2.0.0`, which introduces breaking changes. See the [release notes](https://github.com/pimalaya/himalaya/releases/tag/v2.0.0) and the [migration guide](https://github.com/pimalaya/himalaya/blob/master/MIGRATION.md).
-
-- `tengine` has been removed as it has seen seriously delayed responses to security vulnerabilities.
-
 - `nix-serve-ng` (and `haskellPackages.nix-serve-ng`) is now built against Lix instead of CppNix, following upstream which has switched to Lix as its supported Nix implementation.
 
 - Linux kernel configuration has been moved out of the `linux-kernel` field of the platform structure into the kernel builders:
@@ -99,8 +85,6 @@
 
 - `pdns` has been updated from `5.0.x` to `5.1.x`. Please be sure to review the [Upgrade Notes](https://doc.powerdns.com/authoritative/upgrading.html#to-5-1-0) before upgrading. Namely LUA record updates are no longer allowed by default, and the embedded webserver no longer includes a `access-control-allow-origin: *` header by default.
 
-- `davmail` no longer supports building with GTK 2, and the `preferGtk3` override flag has been removed as GTK 3 is always used.
-
 - Support for the legacy U‐Boot image format has been removed from the Linux kernel builders, as it is deprecated upstream and no longer used by any platform in Nixpkgs.
 
 - `etcd_3_4` package was dropped, as it's gone EOL. Please upgrade to either 3.5 or 3.6. See [migration notes](https://etcd.io/docs/v3.6/upgrades/upgrade_3_6/) for incompatibilities and upgrade procedure.
@@ -113,8 +97,6 @@
 
 - `buildFHSEnvChroot` has been removed after deprecation in 23.05.
 
-- `leafnode` has been removed, as it was an unmaintained alpha-release of leafnode 2 and has a dependency on the EOL PRCE-library. Consider using `leafnode1` instead, which is still maintained.
-
 - `gh-actions-cache` has been removed since its functionality has been integrated directly into `gh` (`gh cache`). See [upstream readme](https://github.com/actions/gh-actions-cache).
 
 - `requireFile` now sets `meta.license = lib.licenses.unfree` by default. Users of `requireFile`-based derivations that preserve this default will need to explicitly allow their evaluation as described in [](#sec-allow-unfree).
@@ -125,8 +107,6 @@
 
 - `librest` providing 0.7 ABI was removed. `librest_1_0` providing 1.0 ABI was renamed to `librest` and `librest_1_0` was kept as an alias.
 
-- `luaPackages.lrexlib-pcre` has been removed as part of the process to fully migrate from the end-of-life PRCE library to PCRE2. `luaPackages.lrexlib-pcre2` and multiple other versions of lrexlib can be used instead.
-
 - `pnpm_10` was upgraded to version 10.34.1+, which introduced stricter integrity checks. If you encounter `ERR_PNPM_MISSING_TARBALL_INTEGRITY`, you can fall back to the older `pnpm_10_34_0`.
 
 - `fetchPnpmDeps`' `fetcherVersion = 1` and `fetcherVersion = 2` have been
@@ -145,24 +125,18 @@
 
 - `vimacs` has been removed, as it has not been maintained in 10 years and was built for an old version of vim (6.0).
 
-- The deprecated `appimageTools.extractType1`, `appimageTools.extractType2`, and `appimageTools.wrapType1` aliases now emit warnings. Use `appimageTools.extract` and `appimageTools.wrapType2` instead.
-
 ## Other Notable Changes {#sec-nixpkgs-release-26.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
 - `super-productivity` has been updated. The binary has been renamed from `super-productivity` to `superproductivity`. A symlink from the old name is provided for backward compatibility.
 
-- `buildFHSEnv`, `appimageTools.wrapAppImage`, and `appimageTools.wrapType2` now support the `finalAttrs` pattern. When using `wrapAppImage`, it is now recommended to pass the extracted AppImage to the `contents` attribute (instead of `src`), to avoid shadowing `src`. Passing the extracted contents to `src` is now deprecated and will be removed in a future release.
-
 - Package-URL (PURL, https://github.com/package-url/purl-spec) metadata identifier has been added for `fetchgit`, `fetchpypi` and `fetchFromGithub` fetchers.
   `mkDerivation` has been adjusted to reuse this information.
   Package-URLs allow reliably identifying and locating software packages.
   Maintainers of derivations using the adapted fetchers should rely on the `drv.src.meta.identifiers.v1.purl` default identifier and can enhance their `drv.meta.identifiers.v1.purls` list once they would like to have additional identifiers.
   Maintainers using `fetchurl` for `drv.src` are urged to adapt their `drv.meta.identifiers.purlParts` for proper identification.
 
-- The fwts efi-runtime kernel module was removed.
-
 - Emacs loads the `early-default` library after `early-init.el`.
   Users can add `early-init.el` via `emacs.pkgs.withPackages`
   by packaging `early-init.el` into a library named `early-default`.

doc/style.css

@@ -465,8 +465,7 @@ div.appendix .variablelist .term {
   font-display: swap;
 }
 
-div.chapter,
-div.page {
+.chapter {
   content-visibility: auto;
 }
 

flake.nix

@@ -199,8 +199,7 @@
         && system != "riscv64-linux"
         # Exclude x86_64-freebsd because "Package ‘go-1.22.12-freebsd-amd64-bootstrap’ in /nix/store/0yw40qnrar3lvc5hax5n49abl57apjbn-source/pkgs/development/compilers/go/binary.nix:50 is not available on the requested hostPlatform"
         && system != "x86_64-freebsd"
-        # TODO: revert to importing fmt.pkg directly from ./ci when support for 26.05 ends
-      ) (forAllSystems (system: (import ./shell.nix { inherit system; }).formatter));
+      ) (forAllSystems (system: (import ./ci { inherit system; }).fmt.pkg));
 
       /**
         A nested structure of [packages](https://nix.dev/manual/nix/latest/glossary#package-attribute-set) and other values.

lib/asserts.nix

@@ -7,9 +7,6 @@ let
   inherit (lib.lists)
     filter
     ;
-  inherit (lib.attrsets)
-    catAttrs
-    ;
   inherit (lib.trivial)
     showWarnings
     ;
@@ -195,7 +192,7 @@ rec {
   checkAssertWarn =
     assertions: warnings: val:
     let
-      failedAssertions = catAttrs "message" (filter (x: !x.assertion) assertions);
+      failedAssertions = map (x: x.message) (filter (x: !x.assertion) assertions);
     in
     if failedAssertions != [ ] then
       throw "\nFailed assertions:\n${concatStringsSep "\n" (map (x: "- ${x}") failedAssertions)}"

lib/attrsets.nix

@@ -333,8 +333,8 @@ rec {
     :::
   */
   getAttrFromPath =
-    attrPath:
-    attrByPath attrPath (abort ("cannot find attribute '" + concatStringsSep "." attrPath + "'"));
+    attrPath: set:
+    attrByPath attrPath (abort ("cannot find attribute '" + concatStringsSep "." attrPath + "'")) set;
 
   /**
     Map each attribute in the given set and merge them into a new attribute set.
@@ -832,7 +832,9 @@ rec {
   */
   foldAttrs =
     op: nul: list_of_attrs:
-    mapAttrs (name: foldr op nul) (zipAttrs list_of_attrs);
+    foldr (
+      n: a: foldr (name: o: o // { ${name} = op n.${name} (a.${name} or nul); }) a (attrNames n)
+    ) { } list_of_attrs;
 
   /**
     Recursively collect sets that verify a given predicate named `pred`
@@ -871,18 +873,13 @@ rec {
     :::
   */
   collect =
-    pred:
-    let
-      recurse =
-        attrs:
-        if pred attrs then
-          [ attrs ]
-        else if isAttrs attrs then
-          concatMap recurse (attrValues attrs)
-        else
-          [ ];
-    in
-    recurse;
+    pred: attrs:
+    if pred attrs then
+      [ attrs ]
+    else if isAttrs attrs then
+      concatMap (collect pred) (attrValues attrs)
+    else
+      [ ];
 
   /**
     Return the cartesian product of attribute set value combinations.
@@ -1161,7 +1158,7 @@ rec {
     mapAttrsRecursive :: ([String] -> a -> b) -> AttrSet -> AttrSet
     ```
   */
-  mapAttrsRecursive = mapAttrsRecursiveCond (as: true);
+  mapAttrsRecursive = f: set: mapAttrsRecursiveCond (as: true) f set;
 
   /**
     Like `mapAttrsRecursive`, but it takes an additional predicate that tells it whether to recurse into an attribute set.
@@ -1348,14 +1345,7 @@ rec {
 
     :::
   */
-  genAttrs =
-    names: f:
-    listToAttrs (
-      map (name: {
-        inherit name;
-        value = f name;
-      }) names
-    );
+  genAttrs = names: f: genAttrs' names (n: nameValuePair n (f n));
 
   /**
     Like `genAttrs`, but allows the name of each attribute to be specified in addition to the value.
@@ -1873,7 +1863,7 @@ rec {
 
     :::
   */
-  overrideExisting = old: new: old // intersectAttrs old new;
+  overrideExisting = old: new: mapAttrs (name: value: new.${name} or value) old;
 
   /**
     Turns a list of strings into a human-readable description of those
@@ -1981,9 +1971,10 @@ rec {
   getFirstOutput =
     candidates: pkg:
     let
-      outputs = filter (name: pkg ? ${name}) candidates;
+      outputs = builtins.filter (name: hasAttr name pkg) candidates;
+      output = builtins.head outputs;
     in
-    if pkg.outputSpecified or false || outputs == [ ] then pkg else pkg.${head outputs};
+    if pkg.outputSpecified or false || outputs == [ ] then pkg else pkg.${output};
 
   /**
     Get a package's `bin` output.
@@ -2218,13 +2209,7 @@ rec {
 
     :::
   */
-  recurseIntoAttrs =
-    let
-      doRecurse = {
-        recurseForDerivations = true;
-      };
-    in
-    attrs: attrs // doRecurse;
+  recurseIntoAttrs = attrs: attrs // { recurseForDerivations = true; };
 
   /**
     Undo the effect of `recurseIntoAttrs`.
@@ -2241,13 +2226,7 @@ rec {
     dontRecurseIntoAttrs :: AttrSet -> AttrSet
     ```
   */
-  dontRecurseIntoAttrs =
-    let
-      dontRecurse = {
-        recurseForDerivations = false;
-      };
-    in
-    attrs: attrs // dontRecurse;
+  dontRecurseIntoAttrs = attrs: attrs // { recurseForDerivations = false; };
 
   /**
     `unionOfDisjoint x y` is equal to `x // y`, but accessing attributes present

lib/customisation.nix

@@ -2,7 +2,6 @@
 
 let
   inherit (builtins)
-    catAttrs
     intersectAttrs
     unsafeGetAttrPos
     ;
@@ -407,7 +406,7 @@ rec {
           ++ [
             {
               name = "all";
-              value = catAttrs "value" outputsList;
+              value = map (x: x.value) outputsList;
             }
           ]
         )

lib/deprecated/misc.nix

@@ -241,7 +241,7 @@ let
   # See https://github.com/NixOS/nixpkgs/pull/194391 for details.
   closePropagationFast =
     list:
-    builtins.catAttrs "val" (
+    map (x: x.val) (
       builtins.genericClosure {
         startSet = map (x: {
           key = x.outPath;

lib/filesystem.nix

@@ -375,8 +375,6 @@ in
         recurseIntoAttrs
         removeSuffix
         ;
-      isNixFile = hasSuffix ".nix";
-      removeNixSuffix = removeSuffix ".nix";
 
       # Generate an attrset corresponding to a given directory.
       # This function is outside `packagesFromDirectoryRecursive`'s lambda expression,
@@ -399,10 +397,10 @@ in
                 }
               );
             }
-          else if type == "regular" && isNixFile name then
+          else if type == "regular" && hasSuffix ".nix" name then
             {
               # call .nix files
-              "${removeNixSuffix name}" = callPackage path { };
+              "${removeSuffix ".nix" name}" = callPackage path { };
             }
           else if type == "regular" then
             {

lib/gvariant.nix

@@ -14,7 +14,6 @@
 
 let
   inherit (lib)
-    catAttrs
     concatMapStringsSep
     concatStrings
     escape
@@ -410,7 +409,7 @@ rec {
     elems:
     let
       gvarElems = map mkValue elems;
-      tupleType = type.tupleOf (catAttrs "type" gvarElems);
+      tupleType = type.tupleOf (map (e: e.type) gvarElems);
     in
     mkPrimitive tupleType gvarElems
     // {

lib/licenses/licenses.nix

@@ -178,11 +178,6 @@ lib.mapAttrs mkLicense (
       fullName = "Baekmuk License";
     };
 
-    bisonException22 = {
-      spdxId = "Bison-exception-2.2";
-      fullName = "Bison exception 2.2";
-    };
-
     bitstreamCharter = {
       spdxId = "Bitstream-Charter";
       fullName = "Bitstream Charter Font License";
@@ -320,11 +315,6 @@ lib.mapAttrs mkLicense (
       fullName = "Buddy License";
     };
 
-    bugroff = {
-      spdxId = "Bugroff";
-      fullName = "Bugroff License";
-    };
-
     bzip2 = {
       spdxId = "bzip2-1.0.6";
       fullName = "bzip2 and libbzip2 License v1.0.6";
@@ -704,11 +694,6 @@ lib.mapAttrs mkLicense (
       url = "https://geant4.web.cern.ch/geant4/license/LICENSE.html";
     };
 
-    gccException31 = {
-      spdxId = "GCC-exception-3.1";
-      fullName = "GCC Runtime Library exception 3.1";
-    };
-
     geogebra = {
       fullName = "GeoGebra Non-Commercial License Agreement";
       url = "https://www.geogebra.org/license";
@@ -940,16 +925,6 @@ lib.mapAttrs mkLicense (
       redistributable = true;
     };
 
-    fsfap = {
-      spdxId = "FSFAP";
-      fullName = "FSF All Permissive License";
-    };
-
-    fsfullr = {
-      spdxId = "FSFULLR";
-      fullName = "FSF Unlimited License (with License Retention)";
-    };
-
     hl3 = {
       fullName = "Hippocratic License v3.0";
       url = "https://firstdonoharm.dev/version/3/0/core.txt";
@@ -1044,9 +1019,9 @@ lib.mapAttrs mkLicense (
       fullName = "Licence Libre du Québec – Permissive version 1.1";
     };
 
-    llgplPreamble = {
-      spdxId = "LLGPL";
-      fullName = "LLGPL Preamble"; # Only used together with LGPL (clarifying C-centric terms of LGPL in context of Lisp), SPDX tracks it separately
+    llgpl21 = {
+      fullName = "Lisp LGPL; GNU Lesser General Public License version 2.1 with Franz Inc. preamble for clarification of LGPL terms in context of Lisp";
+      url = "https://opensource.franz.com/preamble.html";
     };
 
     llvm-exception = {
@@ -1284,11 +1259,6 @@ lib.mapAttrs mkLicense (
       fullName = "SIL Open Font License 1.1";
     };
 
-    ogluk30 = {
-      spdxId = "OGL-UK-3.0";
-      fullName = "Open Government Licence v3.0";
-    };
-
     oml = {
       spdxId = "OML";
       fullName = "Open Market License";
@@ -1375,16 +1345,6 @@ lib.mapAttrs mkLicense (
       fullName = "Q Public License 1.0";
     };
 
-    qtGplException10 = {
-      spdxId = "Qt-GPL-exception-1.0";
-      fullName = "Qt GPL exception 1.0";
-    };
-
-    qtLgplException11 = {
-      spdxId = "Qt-LGPL-exception-1.1";
-      fullName = "Qt LPL exception 1.1";
-    };
-
     qwtException = {
       spdxId = "Qwt-exception-1.0";
       fullName = "Qwt exception 1.0";
@@ -1461,8 +1421,9 @@ lib.mapAttrs mkLicense (
     };
 
     stk = {
-      spdxId = "MIT-STK";
-      fullName = "MIT-STK License";
+      shortName = "stk";
+      fullName = "Synthesis Tool Kit 4.3";
+      url = "https://github.com/thestk/stk/blob/master/LICENSE";
     };
 
     sudo = {
@@ -1662,11 +1623,6 @@ lib.mapAttrs mkLicense (
       fullName = "W3C Software Notice and License (1998-07-20)";
     };
 
-    w3c-20150513 = {
-      spdxId = "W3C-20150513";
-      fullName = "W3C Software Notice and Document License (2015-05-13)";
-    };
-
     wadalab = {
       fullName = "Wadalab Font License";
       url = "https://fedoraproject.org/wiki/Licensing:Wadalab?rd=Licensing/Wadalab";

lib/lists.nix

@@ -646,28 +646,11 @@ rec {
     :::
   */
   findFirst =
-    let
-      init = {
-        found = false;
-      };
-    in
     pred: default: list:
     let
-      result = foldl' (
-        acc: el:
-        if !acc.found && pred el then
-          # We haven't found a match yet, and the current element passes the
-          # predicate!
-          {
-            found = true;
-            value = el;
-          }
-        else
-          # There's already a match, or the current element fails the predicate
-          acc
-      ) init list;
+      index = findFirstIndex pred null list;
     in
-    if result.found then result.value else default;
+    if index == null then default else elemAt list index;
 
   /**
     Returns true if function `pred` returns true for at least one

lib/meta-types.nix

@@ -16,7 +16,6 @@ let
     any
     attrNames
     attrValues
-    catAttrs
     concatMap
     isFunction
     isBool
@@ -142,10 +141,10 @@ lib.fix (self: {
     assert all isTypeDef types;
     let
       # Store a list of functions so we don't have to pay the cost of attrset lookups at runtime.
-      funcs = catAttrs "verify" types;
+      funcs = map (t: t.verify) types;
     in
     {
-      name = "union<${concatStringsSep "," (catAttrs "name" types)}>";
+      name = "union<${concatStringsSep "," (map (t: t.name) types)}>";
       verify = v: any (func: func v) funcs;
     };
 
@@ -154,10 +153,10 @@ lib.fix (self: {
     assert all isTypeDef types;
     let
       # Store a list of functions so we don't have to pay the cost of attrset lookups at runtime.
-      funcs = catAttrs "verify" types;
+      funcs = map (t: t.verify) types;
     in
     {
-      name = "intersection<${concatStringsSep "," (catAttrs "name" types)}>";
+      name = "intersection<${concatStringsSep "," (map (t: t.name) types)}>";
       verify = v: all (func: func v) funcs;
     };
 

lib/modules.nix

@@ -566,7 +566,7 @@ let
         let
           keyFilter = filter (attrs: !isDisabled modulesPath disabled attrs);
         in
-        catAttrs "module" (genericClosure {
+        map (attrs: attrs.module) (genericClosure {
           startSet = keyFilter modules;
           operator = attrs: keyFilter attrs.modules;
         });
@@ -1148,8 +1148,8 @@ let
     // {
       value = addErrorContext "while evaluating the option `${showOption loc}':" value;
       inherit (res.defsFinal') highestPrio;
-      definitions = catAttrs "value" res.defsFinal;
-      files = catAttrs "file" res.defsFinal;
+      definitions = map (def: def.value) res.defsFinal;
+      files = map (def: def.file) res.defsFinal;
       definitionsWithLocations = res.defsFinal;
       inherit (res) isDefined;
       inherit (res.checkedAndMerged) valueMeta;

lib/options.nix

@@ -29,7 +29,6 @@ let
     ;
   inherit (lib.attrsets)
     attrByPath
-    catAttrs
     optionalAttrs
     showAttrPath
     ;
@@ -540,7 +539,7 @@ rec {
 
     :::
   */
-  getValues = catAttrs "value";
+  getValues = map (x: x.value);
 
   /**
     Extracts values of all `file` keys of the given list
@@ -562,7 +561,7 @@ rec {
 
     :::
   */
-  getFiles = catAttrs "file";
+  getFiles = map (x: x.file);
 
   # Generate documentation template from the list of option declaration like
   # the set generated with filterOptionSets.

lib/services/service.nix

@@ -12,31 +12,7 @@
 }:
 let
   inherit (lib) mkEnableOption mkOption types;
-
-  # Paths are interpolated rather than `toString`ed on purpose: interpolation
-  # copies the path into the store, so the resulting argument still resolves on
-  # the machine that runs the service. `toString` would yield the path of the
-  # source tree the configuration was evaluated from, which is not there at
-  # runtime.
   pathOrStr = types.coercedTo types.path (x: "${x}") types.str;
-
-  # `argv` and `flags` share a single `lib.mkOrder` space, so flags need a
-  # priority. This one sits between `lib.modules.defaultOrderPriority` (1000,
-  # what an unadorned `argv` definition gets) and `lib.mkAfter` (1500): plain
-  # flags follow plain `argv` entries, while `lib.mkAfter` on `argv` still lands
-  # after the flags. See the `flags` option description.
-  unadornedFlagPriority = 1250;
-
-  # `attrListWith` re-emits every flag wrapped in `lib.mkOrder`, using
-  # `lib.modules.defaultOrderPriority` for flags that carried no ordering
-  # property of their own. Rewrite exactly that priority; anything else is an
-  # explicit `lib.mkOrder` from the user and is passed through verbatim.
-  atFlagPriority =
-    def:
-    if def.value._type or null == "order" && def.value.priority == lib.modules.defaultOrderPriority then
-      def // { value = lib.mkOrder unadornedFlagPriority def.value.content; }
-    else
-      def;
 in
 {
   # https://nixos.org/manual/nixos/unstable/#modular-services
@@ -73,100 +49,6 @@ in
           This is a raw command-line that should not contain any shell escaping.
           If expansion of environmental variables is required then use
           a shell script or `importas` from `pkgs.execline`.
-
-          When `flags` are set, the arguments rendered from them are merged into
-          `argv`. See `flags` for how the two are ordered against each other.
-        '';
-      };
-
-      flagFormat = mkOption {
-        type = types.functionTo (types.attrsOf types.anything);
-        default = name: {
-          option = name;
-          sep = null;
-          explicitBool = false;
-        };
-        description = ''
-          Function mapping flag names to option format specs
-          for `lib.cli.toCommandLine`.
-
-          Receives the flag name and returns `{ option, sep, explicitBool, formatArg? }`.
-        '';
-        example = lib.literalExpression ''
-          name: {
-            option = name;
-            sep = "=";
-            explicitBool = false;
-          }
-        '';
-      };
-
-      flags = mkOption {
-        type = types.attrListWith {
-          elemType = types.nullOr (
-            types.oneOf [
-              types.bool
-              types.int
-              # `pathOrStr`, not `types.path`: `lib.cli.toCommandLine` renders
-              # values with `lib.generators.mkValueStringDefault`, which has no
-              # case for paths and would abort.
-              pathOrStr
-            ]
-          );
-          asAttrs = true;
-        };
-        default = { };
-        description = ''
-          Flags to pass to the service process.
-          The key is the flag name (e.g. `"--port"`), the value is the flag value.
-
-          Each `name = value` pair is rendered via `lib.cli.toCommandLine`
-          using `flagFormat`.
-
-          - `null`: the flag is omitted (regardless of `flagFormat`)
-          - bool: rendered per `flagFormat.explicitBool`
-            - `explicitBool = false` (default): `true` emits the bare flag,
-              `false` is omitted
-            - `explicitBool = true`: both `true` and `false` are rendered as
-              explicit arguments via `flagFormat.formatArg`
-          - string / path / int: rendered as the option's argument, joined to the
-            option name per `flagFormat.sep` and stringified by
-            `flagFormat.formatArg`
-
-          To pass the same flag multiple times, use the list form with
-          repeated keys, e.g.
-          `[ { "--host" = "a"; } { "--host" = "b"; } ]`.
-
-          The rendered arguments are merged into `argv`, so `argv` and `flags`
-          share a single `lib.mkOrder` space:
-
-          - A flag with no ordering property of its own is placed at priority
-            1250, between `lib.modules.defaultOrderPriority` (1000, which is
-            what an unadorned `argv` definition gets) and `lib.mkAfter` (1500).
-            Plain flags therefore follow the command name and any other plain
-            `argv` arguments.
-          - `lib.mkAfter` on `argv` still lands after the flags, which is how
-            trailing positional arguments are expressed.
-          - `lib.mkOrder` on a flag is honoured verbatim against `argv`, so a
-            sub-command can be placed between two groups of flags.
-
-          Because 1250 is substituted for flags that carry no ordering property,
-          `lib.mkOrder 1000` on a flag is indistinguishable from leaving that
-          flag unadorned. To order a flag around plain `argv` entries, pick a
-          priority next to 1000, such as 999 or 1001.
-        '';
-        example = lib.literalExpression ''
-          {
-            "--port" = "8080";
-            "--verbose" = true;
-            # ordered ahead of the unadorned flags above
-            "--config" = lib.mkOrder 1100 "/etc/foo.conf";
-          }
-          # or, for repeated flags:
-          [
-            { "--host" = "localhost"; }
-            { "--host" = "0.0.0.0"; }
-          ]
         '';
       };
 
@@ -221,9 +103,5 @@ in
     process.reloadCommand = lib.mkIf (config.process.reloadSignal != null) (
       lib.mkDefault "${pkgs.coreutils}/bin/kill -${config.process.reloadSignal} $MAINPID"
     );
-
-    process.argv = lib.modules.mapDefinitionValue (
-      attr: lib.cli.toCommandLine config.process.flagFormat attr
-    ) (lib.mkMerge (map atFlagPriority options.process.flags.valueMeta.definitions));
   };
 }

lib/services/test.nix

@@ -77,60 +77,6 @@ let
           ];
         };
       };
-      # The default `flagFormat`, and one flag of every supported value kind.
-      flagsDefault = {
-        process = {
-          argv = [ "/bin/flagged" ];
-          flags = {
-            "--bool-off" = false;
-            "--bool-on" = true;
-            "--config" = ./test.nix;
-            "--count" = 3;
-            "--name" = "example";
-            "--unset" = null;
-          };
-        };
-      };
-      # A `flagFormat` that joins with `=` and spells out booleans.
-      flagsCustomFormat = {
-        process = {
-          argv = [ "/bin/flagged" ];
-          flagFormat = name: {
-            option = "--${name}";
-            sep = "=";
-            explicitBool = true;
-          };
-          flags = {
-            port = 8080;
-            quiet = false;
-            verbose = true;
-          };
-        };
-      };
-      # The list form, which allows a flag to be repeated.
-      flagsRepeated = {
-        process = {
-          argv = [ "/bin/flagged" ];
-          flags = [
-            { "--host" = "a"; }
-            { "--host" = "b"; }
-          ];
-        };
-      };
-      # `argv` and `flags` share one `lib.mkOrder` space.
-      flagsOrdering = {
-        process = {
-          argv = lib.mkMerge [
-            (lib.mkBefore [ "/bin/gt" ])
-            (lib.mkOrder 800 [ "server" ])
-            (lib.mkAfter [ "TRAILING" ])
-          ];
-          flags = lib.mkMerge [
-            { "--listen" = "a"; }
-            { "--disable-landlock" = lib.mkOrder 600 true; }
-          ];
-        };
-      };
     };
   };
 
@@ -145,16 +91,10 @@ let
     ];
   };
 
-  # Every service carries some assertions that hold; only the violated ones are of interest here.
-  failures = lib.filter (a: !a.assertion);
-
   filterEval =
     config:
     lib.optionalAttrs (config ? process) {
-      inherit (config) warnings;
-      assertions = failures config.assertions;
-      # Only `argv` is relevant here; `process` also carries the reload options.
-      process = { inherit (config.process) argv; };
+      inherit (config) assertions warnings process;
     }
     // {
       services = lib.mapAttrs (k: filterEval) config.services;
@@ -216,65 +156,6 @@ let
             assertions = [ ];
             warnings = [ ];
           };
-          flagsDefault = {
-            process = {
-              argv = [
-                "/bin/flagged"
-                "--bool-on"
-                "--config"
-                "${./test.nix}"
-                "--count"
-                "3"
-                "--name"
-                "example"
-              ];
-            };
-            services = { };
-            assertions = [ ];
-            warnings = [ ];
-          };
-          flagsCustomFormat = {
-            process = {
-              argv = [
-                "/bin/flagged"
-                "--port=8080"
-                "--quiet=false"
-                "--verbose=true"
-              ];
-            };
-            services = { };
-            assertions = [ ];
-            warnings = [ ];
-          };
-          flagsRepeated = {
-            process = {
-              argv = [
-                "/bin/flagged"
-                "--host"
-                "a"
-                "--host"
-                "b"
-              ];
-            };
-            services = { };
-            assertions = [ ];
-            warnings = [ ];
-          };
-          flagsOrdering = {
-            process = {
-              argv = [
-                "/bin/gt"
-                "--disable-landlock"
-                "server"
-                "--listen"
-                "a"
-                "TRAILING"
-              ];
-            };
-            services = { };
-            assertions = [ ];
-            warnings = [ ];
-          };
         };
       };
 
@@ -284,7 +165,7 @@ let
       ];
 
     assert
-      failures (portable-lib.getAssertions [ "service1" ] exampleEval.config.services.service1) == [
+      portable-lib.getAssertions [ "service1" ] exampleEval.config.services.service1 == [
         {
           message = "in service1: you can't enable this for that reason";
           assertion = false;
@@ -296,7 +177,7 @@ let
         "in service3.services.exclacow: The `bar' service is deprecated and will go away soon!"
       ];
     assert
-      failures (portable-lib.getAssertions [ "service3" ] exampleEval.config.services.service3) == [
+      portable-lib.getAssertions [ "service3" ] exampleEval.config.services.service3 == [
         {
           message = "in service3.services.exclacow: you can't enable this for such reason";
           assertion = false;

lib/sources.nix

@@ -34,8 +34,6 @@ let
     pathIsRegularFile
     ;
 
-  removeSlashSuffix = removeSuffix "/";
-
   /**
     A basic filter for `cleanSourceWith` that removes
     directories of version control system, backup files (`*~`)
@@ -364,7 +362,7 @@ let
               gitDir = absolutePath (dirOf path) (head m);
               commonDir'' =
                 if pathIsRegularFile "${gitDir}/commondir" then fileContents "${gitDir}/commondir" else gitDir;
-              commonDir' = removeSlashSuffix commonDir'';
+              commonDir' = removeSuffix "/" commonDir'';
               commonDir = absolutePath gitDir commonDir';
               refFile = removePrefix "${commonDir}/" "${gitDir}/${file}";
             in
@@ -462,7 +460,7 @@ let
   urlToName =
     url:
     let
-      base = baseNameOf (removeSlashSuffix (last (splitString ":" (toString url))));
+      base = baseNameOf (removeSuffix "/" (last (splitString ":" (toString url))));
       # chop away one git or archive-related extension
       removeExt =
         name:

lib/strings.nix

@@ -808,7 +808,7 @@ rec {
   hasPrefix =
     pref:
     let
-      getGivenPrefix = substring 0 (stringLength pref);
+      lenPrefix = stringLength pref;
     in
     if isPath pref then
       # Before 23.05, paths would be copied to the store before converting them
@@ -817,7 +817,7 @@ rec {
         lib.strings.hasPrefix: The first argument (${toString pref}) is a path value, but only strings are supported.
             You might want to use `lib.path.hasPrefix` instead, which correctly supports paths.''
     else
-      str: getGivenPrefix str == pref;
+      str: substring 0 lenPrefix str == pref;
 
   /**
     Determine whether a string has given suffix.
@@ -905,7 +905,7 @@ rec {
   hasInfix =
     infix:
     let
-      matchGivenInfix = builtins.match ".*${escapeRegex infix}.*";
+      escapedInfix = escapeRegex infix;
     in
     if isPath infix then
       # Before 23.05, paths would be copied to the store before converting them
@@ -915,7 +915,7 @@ rec {
             There is almost certainly a bug in the calling code, since this function always returns `false` in such a case.
             This function also copies the path to the Nix store, which may not be what you want.''
     else
-      content: matchGivenInfix "${content}" != null;
+      content: builtins.match ".*${escapedInfix}.*" "${content}" != null;
 
   /**
     Convert a string `s` to a list of characters (i.e. singleton strings).
@@ -2871,11 +2871,7 @@ rec {
 
     :::
   */
-  fileContents =
-    let
-      removeNewlineSuffix = removeSuffix "\n";
-    in
-    file: removeNewlineSuffix (readFile file);
+  fileContents = file: removeSuffix "\n" (readFile file);
 
   /**
     Creates a valid derivation name from a potentially invalid one.

lib/systems/default.nix

@@ -170,8 +170,6 @@ let
             "relibc"
           else if final.isMusl then
             "musl"
-          else if final.isPicolibc then
-            "picolibc"
           else if final.isUClibc then
             "uclibc"
           else if final.isAndroid then
@@ -247,7 +245,7 @@ let
               netbsd = "NetBSD";
               freebsd = "FreeBSD";
               openbsd = "OpenBSD";
-              wasip1 = "WasiP1";
+              wasi = "Wasi";
               redox = "Redox";
               genode = "Genode";
             }
@@ -472,8 +470,6 @@ let
                   rust.platform.os or "none"
                 else if final.isDarwin then
                   "macos"
-                else if final.isWasi then
-                  "wasi"
                 else if final.isWasm && !final.isWasi then
                   "unknown" # Needed for {wasm32,wasm64}-unknown-unknown.
                 else
@@ -532,7 +528,11 @@ let
                   abi.name;
 
               inferred =
-                if final.isWasiP1 then
+                if final.isWasi then
+                  # Rust uses `wasm32-wasip?` rather than `wasm32-unknown-wasi`.
+                  # We cannot know which subversion does the user want, and
+                  # currently use WASI 0.1 as default for compatibility. Custom
+                  # users can set `rust.rustcTargetSpec` to override it.
                   "${cpu_}-wasip1"
                 else
                   "${cpu_}-${vendor_}-${kernel.name}${optionalString (abi.name != "unknown") "-${abi_}"}";
@@ -585,7 +585,6 @@ let
               "i686" = "386";
               "loongarch64" = "loong64";
               "mips" = "mips";
-              "mips64" = "mips64";
               "mips64el" = "mips64le";
               "mipsel" = "mipsle";
               "powerpc64" = "ppc64";
@@ -596,7 +595,7 @@ let
               "wasm32" = "wasm";
             }
             .${final.parsed.cpu.name} or null;
-          GOOS = if final.isWasiP1 then "wasip1" else final.parsed.kernel.name;
+          GOOS = if final.isWasi then "wasip1" else final.parsed.kernel.name;
 
           # See https://go.dev/wiki/GoArm
           GOARM = toString (lib.intersectLists [ (final.parsed.cpu.version or "") ] [ "5" "6" "7" ]);

lib/systems/doubles.nix

@@ -112,8 +112,8 @@ let
     "x86_64-redox"
 
     # WASI
-    "wasm64-wasip1"
-    "wasm32-wasip1"
+    "wasm64-wasi"
+    "wasm32-wasi"
 
     # Windows
     "aarch64-windows"

lib/systems/examples.nix

@@ -443,14 +443,8 @@ rec {
   # WASM
   #
 
-  wasm32-wasip1 = {
-    config = "wasm32-unknown-wasip1";
-    useLLVM = true;
-  };
-
-  # Historical-reasons alias for wasm32-wasip1.
   wasi32 = {
-    config = "wasm32-unknown-wasip1";
+    config = "wasm32-unknown-wasi";
     useLLVM = true;
   };
 

lib/systems/inspect.nix

@@ -27,8 +27,6 @@ let
     execFormats
     ;
 
-  hasArmv7Prefix = hasPrefix "armv7";
-
   # Based on lib.attrsets.matchAttrs, but with:
   # - the initial isAttrs assertion removed, since this function is only ever
   # called with attrsets
@@ -139,7 +137,7 @@ rec {
       {
         cpu = { inherit arch; };
       }
-    ) (filter (cpu: cpu ? arch && hasArmv7Prefix cpu.arch) (attrValues cpuTypes));
+    ) (filter (cpu: hasPrefix "armv7" cpu.arch or "") (attrValues cpuTypes));
     isAarch64 = {
       cpu = {
         family = "arm";
@@ -392,11 +390,8 @@ rec {
       kernel = kernels.windows;
       abi = abis.msvc;
     };
-    isWasi = [
-      { kernel = kernels.wasip1; }
-    ];
-    isWasiP1 = {
-      kernel = kernels.wasip1;
+    isWasi = {
+      kernel = kernels.wasi;
     };
     isRedox = {
       kernel = kernels.redox;
@@ -435,9 +430,6 @@ rec {
         muslabin32
         muslabi64
       ];
-    isPicolibc = {
-      abi = abis.picolibc;
-    };
     isUClibc =
       with abis;
       map (a: { abi = a; }) [

lib/systems/parse.nix

@@ -601,7 +601,7 @@ rec {
         execFormat = elf;
         families = { };
       };
-      wasip1 = {
+      wasi = {
         execFormat = wasm;
         families = { };
       };
@@ -640,7 +640,6 @@ rec {
       darwin = kernels.macos;
       watchos = kernels.ios;
       tvos = kernels.ios;
-      wasi = kernels.wasip1;
       win32 = kernels.windows;
     };
 
@@ -743,8 +742,6 @@ rec {
     };
     musl = { };
 
-    picolibc = { };
-
     uclibceabi = {
       float = "soft";
       eabi = true;

lib/types.nix

@@ -91,9 +91,6 @@ let
     in
     if pos == null then "" else " at ${pos.file}:${toString pos.line}:${toString pos.column}";
 
-  hasColonInfix = hasInfix ":";
-  hasNewlineInfix = hasInfix "\n";
-
   # Internal functor to help for migrating functor.wrapped to functor.payload.elemType
   # Note that individual attributes can be overridden if needed.
   elemTypeFunctor =
@@ -536,14 +533,13 @@ rec {
   singleLineStr =
     let
       inherit (strMatching "[^\n\r]*\n?") check merge;
-      removeNewlineSuffix = lib.removeSuffix "\n";
     in
     mkOptionType {
       name = "singleLineStr";
       description = "(optionally newline-terminated) single-line string";
       descriptionClass = "noun";
       inherit check;
-      merge = loc: defs: removeNewlineSuffix (merge loc defs);
+      merge = loc: defs: lib.removeSuffix "\n" (merge loc defs);
     };
 
   strMatching =
@@ -584,7 +580,7 @@ rec {
 
   passwdEntry =
     entryType:
-    addCheck entryType (str: !(hasColonInfix str || hasNewlineInfix str))
+    addCheck entryType (str: !(hasInfix ":" str || hasInfix "\n" str))
     // {
       name = "passwdEntry ${entryType.name}";
       description = "${
@@ -608,7 +604,7 @@ rec {
     description = "fileset";
     descriptionClass = "noun";
     check = isFileset;
-    merge = loc: defs: unions (getValues defs);
+    merge = loc: defs: unions (map (x: x.value) defs);
     emptyValue.value = empty;
   };
 

maintainers/github-teams.json

@@ -2,10 +2,11 @@
   "acme": {
     "description": "Maintain ACME-related packages and modules.",
     "id": 3806126,
-    "maintainers": {},
+    "maintainers": {
+      "emilazy": 18535642
+    },
     "members": {
       "arianvp": 628387,
-      "emilazy": 18535642,
       "m1cr0man": 3044438
     },
     "name": "ACME"
@@ -59,20 +60,11 @@
       "adamcstephens": 2071575,
       "ankhers": 750786,
       "gleber": 33185,
+      "minijackson": 1200507,
       "yurrriq": 1866448
     },
     "name": "Beam"
   },
-  "boot-security": {
-    "description": "Maintain support for boot security technologies like Secure Boot",
-    "id": 18686947,
-    "maintainers": {},
-    "members": {
-      "ElvishJerricco": 1365692,
-      "emilazy": 18535642
-    },
-    "name": "Boot security"
-  },
   "bootstrapping": {
     "description": "coordinates efforts towards bootstrappable builds (see https://bootstrappable.org/)",
     "id": 9141350,
@@ -95,8 +87,8 @@
       "fgaz": 8182846,
       "natsukium": 25083790,
       "philiptaron": 43863,
-      "tomodachi94": 68489118,
-      "tr3foil": 29682759
+      "pyrotelekinetic": 29682759,
+      "tomodachi94": 68489118
     },
     "members": {},
     "name": "Categorization"
@@ -181,6 +173,7 @@
     "description": "Improve Darwin-support across Nixpkgs and help maintainers without access to Darwin hardware. Apply to join through https://github.com/NixOS/nixpkgs/issues/323144 to keep the process transparent.",
     "id": 2385202,
     "maintainers": {
+      "emilazy": 18535642,
       "toonn": 1486805
     },
     "members": {
@@ -199,7 +192,6 @@
       "Prince213": 25235514,
       "Samasaur1": 30577766,
       "Steven0351": 24440751,
-      "TyceHerrman": 22066434,
       "afh": 16507,
       "azuwis": 9315,
       "booxter": 90200,
@@ -207,12 +199,11 @@
       "cideM": 4246921,
       "cidkidnix": 67574902,
       "copumpkin": 2623,
-      "delafthi": 50531499,
       "devusb": 4951663,
       "domenkozar": 126339,
+      "donn": 12652988,
       "dwt": 57199,
       "eclairevoyant": 848000,
-      "emilazy": 18535642,
       "ethancedwards8": 60861925,
       "fiddlerwoaroof": 808745,
       "fulsomenko": 14945057,
@@ -378,9 +369,7 @@
     "maintainers": {
       "jtojnar": 705123
     },
-    "members": {
-      "Hythera": 87016780
-    },
+    "members": {},
     "name": "Freedesktop"
   },
   "geospatial": {
@@ -416,13 +405,10 @@
     "description": "Maintain GNOME desktop environment and platform.",
     "id": 3806133,
     "maintainers": {
-      "bobby285271": 20080233,
       "jtojnar": 705123
     },
     "members": {
-      "nekowinston": 79978224,
-      "theCapypara": 3512122,
-      "thunze": 22795263
+      "bobby285271": 20080233
     },
     "name": "GNOME"
   },
@@ -578,11 +564,11 @@
     "id": 9955829,
     "maintainers": {
       "RossComputerGuy": 19699320,
-      "alyssais": 2768870
+      "alyssais": 2768870,
+      "emilazy": 18535642
     },
     "members": {
       "Ericson2314": 1055245,
-      "emilazy": 18535642,
       "peterwaller-arm": 52030119,
       "rrbutani": 7833358
     },
@@ -754,6 +740,16 @@
     },
     "name": "Nixpkgs CI"
   },
+  "nixpkgs-core": {
+    "description": "Provides leadership for and has authority over Nixpkgs.",
+    "id": 14317027,
+    "maintainers": {
+      "alyssais": 2768870,
+      "emilazy": 18535642
+    },
+    "members": {},
+    "name": "Nixpkgs core"
+  },
   "nixpkgs-merge-bot": {
     "description": "This team exists as a target for triggering the nixpkgs merge bot.",
     "id": 13926892,
@@ -989,11 +985,12 @@
     "id": 11265412,
     "maintainers": {
       "RossComputerGuy": 19699320,
+      "emilazy": 18535642,
       "philiptaron": 43863
     },
     "members": {
+      "Artturin": 56650223,
       "Ericson2314": 1055245,
-      "emilazy": 18535642,
       "reckenrode": 7413633
     },
     "name": "stdenv"

maintainers/maintainer-list.nix

@@ -1173,12 +1173,6 @@
       }
     ];
   };
-  albfsg = {
-    name = "Alberto Francisco Solaz García";
-    github = "albfsg";
-    githubId = 227897008;
-    email = "albfsg@proton.me";
-  };
   alch-emi = {
     email = "emi@alchemi.dev";
     github = "Alch-Emi";
@@ -1966,13 +1960,6 @@
     githubId = 143312793;
     name = "Annin";
   };
-  annoyingrains = {
-    email = "avali@avali.zone";
-    matrix = "@avali:avali.zone";
-    github = "AnnoyingRain5";
-    githubId = 35289650;
-    name = "AnnoyingRains";
-  };
   anntnzrb = {
     github = "anntnzrb";
     githubId = 51257127;
@@ -2193,12 +2180,6 @@
     githubId = 8436007;
     name = "Aria Edmonds";
   };
-  ar4m1s = {
-    name = "Aramis";
-    github = "Ar4m1s";
-    githubId = 59250656;
-    matrix = "@vegardbm:matrix.org";
-  };
   arbel-arad = {
     email = "arbel@spacetime.technology";
     github = "arbel-arad";
@@ -2301,6 +2282,12 @@
     githubId = 225423001;
     name = "Argos Nothing";
   };
+  argrat = {
+    email = "n.bertazzo@protonmail.com";
+    github = "brtz-cs";
+    githubId = 98821629;
+    name = "Nicolò Bertazzo";
+  };
   arian-d = {
     email = "arianxdehghani@gmail.com";
     github = "Arian-D";
@@ -2942,12 +2929,6 @@
     githubId = 22575913;
     name = "Anish Lakhwara";
   };
-  ayushthoren = {
-    email = "ayushthoren@gmail.com";
-    github = "ayushthoren";
-    githubId = 29691296;
-    name = "Ayush Thoren";
-  };
   azahi = {
     name = "Azat Bahawi";
     email = "azat@bahawi.net";
@@ -3442,6 +3423,13 @@
     githubId = 32903896;
     keys = [ { fingerprint = "CB5C 7B3C 3E6F 2A59 A583  A90A 8A60 0376 7BE9 5976"; } ];
   };
+  benesim = {
+    name = "Benjamin Isbarn";
+    email = "benjamin.isbarn@gmail.com";
+    github = "BeneSim";
+    githubId = 29384538;
+    keys = [ { fingerprint = "D35E C9CE E631 638F F1D8  B401 6F0E 410D C3EE D02"; } ];
+  };
   bengsparks = {
     email = "benjamin.sparks@protonmail.com";
     github = "bengsparks";
@@ -4248,12 +4236,6 @@
     matrix = "@brsvh:mozilla.org";
     name = "Burgess Chang";
   };
-  brw = {
-    email = "hi@bas.sh";
-    github = "brw";
-    githubId = 7560938;
-    name = "Bas van den Wollenberg";
-  };
   bryango = {
     name = "Bryan Lai";
     email = "bryanlais@gmail.com";
@@ -4768,6 +4750,7 @@
   cbarrete = {
     github = "cbarrete";
     githubId = 62146989;
+    matrix = "@cedric:cbarrete.com";
     name = "Cédric Barreteau";
   };
   cbleslie = {
@@ -5417,12 +5400,6 @@
     githubId = 718298;
     name = "Michael Livshin";
   };
-  cnst = {
-    name = "cnst";
-    email = "mail@cnst.dev";
-    github = "cnsta";
-    githubId = 61944575;
-  };
   CnTeng = {
     name = "CnTeng";
     email = "me@snakepi.xyz";
@@ -5750,11 +5727,6 @@
     githubId = 3077118;
     name = "David McFarland";
   };
-  corps-fini = {
-    github = "corps-fini";
-    githubId = 44802527;
-    name = "corps-fini";
-  };
   costrouc = {
     email = "chris.ostrouchov@gmail.com";
     github = "costrouc";
@@ -5982,7 +5954,7 @@
     name = "Serg Nesterov";
     keys = [ { fingerprint = "6E7D BA30 DB5D BA60 693C  3BE3 1512 F6EB 84AE CC8C"; } ];
   };
-  cve = {
+  cvengler = {
     name = "Clara Engler";
     github = "cvengler";
     githubId = 12272949;
@@ -6220,12 +6192,6 @@
     githubId = 24708079;
     name = "Dan Eads";
   };
-  daneov = {
-    github = "daneov";
-    githubId = 7900887;
-    matrix = "@daneov:mozilla.org";
-    name = "daneov";
-  };
   danid3v = {
     email = "sch220233@spengergasse.at";
     github = "DaniD3v";
@@ -6343,13 +6309,6 @@
     github = "darkyzhou";
     githubId = 7220778;
   };
-  daroche = {
-    name = "daroche";
-    email = "him@daroche.me";
-    matrix = "@him:daroche.me";
-    github = "RealDaroche";
-    githubId = 94007359;
-  };
   darshancode2005 = {
     name = "Darshan Thakare";
     email = "darshanthakaregsoc2023@gmail.com";
@@ -6865,12 +6824,6 @@
     githubId = 27348469;
     name = "Cat";
   };
-  denzonl = {
-    email = "dennis@bogers.xyz";
-    github = "DenzoNL";
-    githubId = 7504556;
-    name = "Dennis Bogers";
-  };
   derchris = {
     email = "derchris@me.com";
     github = "derchrisuk";
@@ -7100,12 +7053,6 @@
     githubId = 265220;
     name = "David Leung";
   };
-  dhogenson = {
-    email = "dallin.hogenson@icloud.com";
-    github = "dhogenson";
-    githubId = 167140817;
-    name = "Dallin Hogenson";
-  };
   diadatp = {
     email = "nixpkgs@diadatp.com";
     github = "diadatp";
@@ -7393,13 +7340,6 @@
     githubId = 39825;
     name = "Dominik Honnef";
   };
-  donottellmetonottellyou = {
-    name = "Jade Masker";
-    email = "donottellmetonottellyou@gmail.com";
-    github = "donottellmetonottellyou";
-    githubId = 115233539;
-    keys = [ { fingerprint = "5C8B 7128 4AB3 000D 4AC6  6234 9B81 35A2 4A75 CB86"; } ];
-  };
   donovanglover = {
     github = "donovanglover";
     githubId = 2374245;
@@ -7468,12 +7408,6 @@
     githubId = 974130;
     name = "David Pätzel";
   };
-  dpaulat = {
-    email = "dpaulat@gmail.com";
-    name = "Dan Paulat";
-    github = "dpaulat";
-    githubId = 2886605;
-  };
   dpc = {
     email = "dpc@dpc.pw";
     github = "dpc";
@@ -7984,12 +7918,6 @@
     github = "edlimerkaj";
     githubId = 71988351;
   };
-  edoars = {
-    name = "Edoardo Signorini";
-    email = "mail@edoars.me";
-    github = "edoars";
-    githubId = 44139791;
-  };
   edrex = {
     email = "ericdrex@gmail.com";
     github = "edrex";
@@ -8270,12 +8198,6 @@
     githubId = 1365692;
     name = "Will Fancher";
   };
-  elzorrorebelde = {
-    name = "Jorge Javier Araya Navarro";
-    email = "jorge@esavara.cr";
-    github = "elzorrorebelde";
-    githubId = 1055216;
-  };
   emaiax = {
     email = "github@emaiax.dev";
     github = "emaiax";
@@ -9255,13 +9177,6 @@
     githubId = 41450706;
     name = "fin-w";
   };
-  findus = {
-    email = "findus-nix@trsk.cc";
-    github = "findus";
-    githubId = 7995019;
-    matrix = "@findus:stratum0.org";
-    name = "findus";
-  };
   fiona = {
     email = "mail@fiona.hamburg";
     github = "Fiona42069";
@@ -9324,12 +9239,6 @@
     github = "fkautz";
     githubId = 135706;
   };
-  fkomarek = {
-    name = "Filip Komárek";
-    github = "filip2cz";
-    githubId = 82812634;
-    email = "filip@fkomarek.eu";
-  };
   FKouhai = {
     name = "Fran Cirka";
     email = "frandres00@gmail.com";
@@ -9460,12 +9369,6 @@
     githubId = 844574;
     name = "Daniel Austin";
   };
-  flupke = {
-    email = "luper.rouch@gmail.com";
-    github = "flupke";
-    githubId = 188962;
-    name = "Luper Rouch";
-  };
   flyfloh = {
     email = "nix@halbmastwurf.de";
     github = "flyfloh";
@@ -10073,13 +9976,6 @@
     githubId = 34658064;
     name = "Grace Dinh";
   };
-  geekiot-hub = {
-    email = "geekiot@proton.me";
-    github = "geekiot-hub";
-    githubId = 227938479;
-    name = "Kirill Samoylenkov";
-    keys = [ { fingerprint = "955B 97C5 78A3 DF03 D818  25EB 8E40 5DD2 CF84 CCE0"; } ];
-  };
   genga898 = {
     email = "genga898@gmail.com";
     github = "genga898";
@@ -11289,11 +11185,6 @@
     github = "HigherOrderLogic";
     githubId = 73709188;
   };
-  highghlow = {
-    name = "Alex Kravchenko";
-    github = "unhighghlow";
-    githubId = 132668972;
-  };
   hirenashah = {
     email = "hiren@hiren.io";
     github = "hirenashah";
@@ -12055,13 +11946,6 @@
     githubId = 7685264;
     name = "Indexyz";
   };
-  indium114 = {
-    name = "indium114";
-    github = "indium114";
-    githubId = 156162907;
-    matrix = "@indium114:matrix.org";
-    keys = [ { fingerprint = "FEC7 A1E4 0F1A 528B 865C  A0B8 6249 5C16 5883 2CF0"; } ];
-  };
   ineol = {
     email = "leo.stefanesco@gmail.com";
     github = "ineol";
@@ -12163,12 +12047,6 @@
     githubId = 157678;
     keys = [ { fingerprint = "E864 BDFA AB55 36FD C905  5195 DBF2 52AF FB26 19FD"; } ];
   };
-  irgendeinwer = {
-    name = "Irgendeinwer";
-    email = "irgendeinwer@proton.me";
-    github = "Irgendeinwer";
-    githubId = 175053643;
-  };
   ironicbadger = {
     email = "alexktz@gmail.com";
     github = "ironicbadger";
@@ -12582,12 +12460,6 @@
     github = "james-atkins";
     githubId = 9221409;
   };
-  jamesbrink = {
-    email = "dev.urandom.io@gmail.com";
-    name = "James Brink";
-    github = "jamesbrink";
-    githubId = 646361;
-  };
   jamespeapen = {
     name = "James Eapen";
     email = "james.eapen@vai.org";
@@ -13088,6 +12960,11 @@
     name = "Jez Cope";
     keys = [ { fingerprint = "D9DA 3E47 E8BD 377D A317  B3D0 9E42 CE07 1C45 59D1"; } ];
   };
+  jf-uu = {
+    github = "jf-uu";
+    githubId = 181011550;
+    name = "jf-uu";
+  };
   jfchevrette = {
     email = "jfchevrette@gmail.com";
     github = "jfchevrette";
@@ -13704,12 +13581,6 @@
     name = "Jonas Wunderlich";
     matrix = "@matrix:03j.de";
   };
-  jonascarpay = {
-    name = "Jonas Carpay";
-    email = "jonascarpay@gmail.com";
-    github = "jonascarpay";
-    githubId = 3593851;
-  };
   jonasfranke = {
     name = "Jonas Franke";
     email = "info@jonasfranke.xyz";
@@ -14023,12 +13894,6 @@
     name = "John Soo";
     githubId = 10039785;
   };
-  jsqu4re = {
-    email = "johannes.jeising@gmail.com";
-    github = "jsqu4re";
-    githubId = 35706792;
-    name = "Johannes Jeising";
-  };
   jsusk = {
     email = "joshua@suskalo.org";
     github = "IGJoshua";
@@ -14899,11 +14764,6 @@
     githubId = 12160;
     name = "Kirill Radzikhovskyy";
   };
-  kiryuulight = {
-    github = "KiryuuLight";
-    githubId = 70501251;
-    name = "Luis Ortiz";
-  };
   kiskae = {
     github = "Kiskae";
     githubId = 546681;
@@ -15091,11 +14951,6 @@
     githubId = 361496;
     name = "Nikola Knežević";
   };
-  koalalorenzo = {
-    name = "Lorenzo Setale";
-    github = "koalalorenzo";
-    githubId = 33528;
-  };
   koffydrop = {
     github = "koffydrop";
     githubId = 67888720;
@@ -16455,19 +16310,6 @@
     github = "i-am-logger";
     githubId = 1440852;
   };
-  logn = {
-    name = "Logan Devine";
-    github = "thetayloredman";
-    githubId = 26350849;
-
-    email = "nixpkgs@zirco.dev";
-    matrix = "@logn:zirco.dev";
-    keys = [
-      {
-        fingerprint = "67FA AA65 5DBD 691E 7957  E095 1594 E544 D8F8 F21E";
-      }
-    ];
-  };
   logo = {
     email = "logo4poop@protonmail.com";
     matrix = "@logo4poop:matrix.org";
@@ -16666,7 +16508,6 @@
     name = "Lewis";
   };
   lubsch = {
-    matrix = "@lubsch:matrix.org";
     github = "lubsch";
     githubId = 33580245;
     name = "Benjamin Lohmar";
@@ -17121,11 +16962,6 @@
     githubId = 401263;
     keys = [ { fingerprint = "1147 43F1 E707 6F3E 6F4B  2C96 B9A8 B592 F126 F8E8"; } ];
   };
-  macaquinyho = {
-    github = "macaquinyho";
-    githubId = 14185777;
-    name = "Arnau Valls";
-  };
   macbucheron = {
     name = "Nathan Deprat";
     github = "Macbucheron1";
@@ -17325,16 +17161,6 @@
     githubId = 117918464;
     keys = [ { fingerprint = "B5ED 595C 8C7E 133C 6B68  63C8 CFEF 1E35 0351 F72D"; } ];
   };
-  malix = {
-    name = "Malix - Alix Brunet";
-    github = "Malix-Labs";
-    githubId = 76160668;
-    email = "alixbrunetcontact+nixpkgs@gmail.com";
-    keys = [
-      { fingerprint = "cgtiI0dV+OGTuIFFuuCPWZPgF5OaiSkmZzobIdoWQO0"; } # SSH
-      { fingerprint = "369E2AB995539B6F30AAC24C600394C79ED874E5"; } # OpenPGP
-    ];
-  };
   malo = {
     email = "mbourgon@gmail.com";
     github = "malob";
@@ -18109,12 +17935,6 @@
     githubId = 94081214;
     name = "Jose Colomer";
   };
-  mcmah309 = {
-    email = "dillonmcmahon79@gmail.com";
-    github = "mcmah309";
-    githubId = 56412856;
-    name = "Dillon H. McMahon";
-  };
   mcmtroffaes = {
     email = "matthias.troffaes@gmail.com";
     github = "mcmtroffaes";
@@ -18334,11 +18154,6 @@
     github = "merrkry";
     githubId = 124278440;
   };
-  mershl = {
-    name = "Mershl";
-    github = "mershl";
-    githubId = 520251;
-  };
   mert-kurttutan = {
     email = "mert-kurttutan@gmail.com";
     name = "Mert Kurttutan";
@@ -19053,16 +18868,6 @@
     githubId = 45770;
     name = "Mitsuhiro Nakamura";
   };
-  mnixry = {
-    github = "mnixry";
-    githubId = 32300164;
-    name = "Mix";
-  };
-  MNThomson = {
-    github = "MNThomson";
-    githubId = 73045936;
-    name = "Max Thomson";
-  };
   moaxcp = {
     email = "moaxcp@gmail.com";
     github = "moaxcp";
@@ -19675,9 +19480,8 @@
     keys = [ { fingerprint = "086E EF20 D54E D348 E5BA  6263 16E9 43E6 596F FB4E"; } ];
   };
   myul = {
-    email = "hdx0729@gmail.com";
-    github = "mtul0729";
-    githubId = 52401682;
+    github = "myul";
+    githubId = 27887735;
     name = "myul";
   };
   myypo = {
@@ -20478,12 +20282,6 @@
     github = "niklaskorz";
     githubId = 590517;
   };
-  niklasravnsborg = {
-    name = "Niklas Ravnsborg";
-    github = "niklasravnsborg";
-    githubId = 6717303;
-    keys = [ { fingerprint = "0C90 DD8A 0EE9 93DF 8D58  7AF9 8360 E6C5 8AE8 F3ED"; } ];
-  };
   niklasthorild = {
     name = "Niklas Thorild";
     email = "niklas@thorild.se";
@@ -20902,7 +20700,7 @@
     name = "nova madeline";
   };
   novaviper = {
-    email = "code4nova@aluwux.me";
+    email = "coder.nova99@mailbox.org";
     github = "novaviper";
     githubId = 7191115;
     name = "Nova Leary";
@@ -20987,12 +20785,6 @@
     githubId = 1839979;
     name = "Niklas Thörne";
   };
-  ntsk = {
-    email = "ntsk@ntsk.jp";
-    github = "ntsk";
-    githubId = 5681281;
-    name = "ntsk";
-  };
   nudelsalat = {
     email = "nudelsalat@clouz.de";
     name = "Fabian Dreßler";
@@ -23208,12 +23000,6 @@
     githubId = 142632643;
     name = "purrpurrn";
   };
-  push-f = {
-    name = "Martin Fischer";
-    email = "martin@push-f.com";
-    github = "not-my-profile";
-    githubId = 73739153;
-  };
   putchar = {
     email = "slim.cadoux@gmail.com";
     matrix = "@putch4r:matrix.org";
@@ -23485,11 +23271,6 @@
     githubId = 52847440;
     name = "Ryan Burns";
   };
-  r0chd = {
-    github = "r0chd";
-    githubId = 100892812;
-    name = "Oskar Rochowiak";
-  };
   r17x = {
     email = "hi@rin.rocks";
     github = "r17x";
@@ -23534,13 +23315,6 @@
     github = "DaRacci";
     githubId = 90304606;
   };
-  rachalaraj = {
-    name = "Rachala Raj Kumar";
-    email = "rachaalaraj@gmail.com";
-    matrix = "@rachalaraj:matrix.org";
-    github = "rachalaraj";
-    githubId = 124191100;
-  };
   RadxaYuntian = {
     # This is the work account for @MakiseKurisu
     name = "ZHANG Yuntian";
@@ -24145,12 +23919,6 @@
     githubId = 12279531;
     name = "Ricardo Guevara";
   };
-  rharish = {
-    email = "harish.rajagopals@gmail.com";
-    github = "rharish101";
-    githubId = 25344287;
-    name = "Harish Rajagopal";
-  };
   rhelmot = {
     name = "Audrey Dutcher";
     github = "rhelmot";
@@ -24169,12 +23937,6 @@
     githubId = 6047658;
     name = "Ryan Horiguchi";
   };
-  rhousand = {
-    email = "rhousand@gmail.com";
-    github = "rhousand";
-    githubId = 6124540;
-    name = "Ryan Housand";
-  };
   rhydianjenkins = {
     name = "Rhydian Jenkins";
     github = "RhydianJenkins";
@@ -24637,12 +24399,6 @@
     name = "Roosembert (Roosemberth) Palacios";
     keys = [ { fingerprint = "78D9 1871 D059 663B 6117  7532 CAAA ECE5 C224 2BB7"; } ];
   };
-  rootile = {
-    email = "lix+nixpkgs@rootile.de";
-    github = "CommentatorForAll";
-    githubId = 46420447;
-    name = "rootile";
-  };
   rople380 = {
     name = "rople380";
     github = "rople380";
@@ -24884,13 +24640,6 @@
     githubId = 6445619;
     name = "Ruben Cano Diaz";
   };
-  Ruddickmg = {
-    name = "Marcus Ruddick";
-    github = "Ruddickmg";
-    githubId = 8334416;
-    email = "ruddickmg@gmail.com";
-    keys = [ { fingerprint = "74FF 0519 D478 AD06 9C23  4F93 343E 322A 4E3B 4C82"; } ];
-  };
   RudiOnTheAir = {
     name = "Rüdiger Schwoon";
     email = "wolf@schwoon.info";
@@ -25986,6 +25735,12 @@
     githubId = 5512096;
     name = "Sébastien Guimmara";
   };
+  shackra = {
+    name = "Jorge Javier Araya Navarro";
+    email = "jorge@esavara.cr";
+    github = "shackra";
+    githubId = 1055216;
+  };
   shadaj = {
     github = "shadaj";
     githubId = 543055;
@@ -26238,13 +25993,6 @@
     githubId = 819413;
     name = "Benedict Aas";
   };
-  showhyt = {
-    email = "mirantuten@yandex.com";
-    github = "ShowhyT";
-    githubId = 109768004;
-    keys = [ { fingerprint = "94AD E7C4 73B5 3DC7 7615  D946 3E76 7D8C 58D4 8C78"; } ];
-    name = "Miran Tuten";
-  };
   shunueda = {
     name = "Shun Ueda";
     github = "shunueda";
@@ -26538,12 +26286,6 @@
     githubId = 848812;
     name = "Stephan Jau";
   };
-  sjcobb = {
-    email = "sjcobb2003@gmail.com";
-    github = "sjcobb2022";
-    githubId = 68509699;
-    name = "sjcobb";
-  };
   sjfloat = {
     email = "steve+nixpkgs@jonescape.com";
     github = "sjfloat";
@@ -26563,12 +26305,6 @@
     githubId = 617130;
     keys = [ { fingerprint = "C4F7 46C7 B560 38D8 210F  0288 5877 DEE9 7428 557F"; } ];
   };
-  skirlez = {
-    name = "skirlez";
-    email = "skirlez3@gmail.com";
-    github = "skirlez";
-    githubId = 17904548;
-  };
   skohtv = {
     name = "Skoh";
     email = "contact@skoh.dev";
@@ -27466,17 +27202,6 @@
     githubId = 285829;
     keys = [ { fingerprint = "09BE 3BAE 8D55 D4CD 8579  285A 9675 EAC3 4897 E6E2"; } ];
   };
-  stzx = {
-    name = "Stzx";
-    github = "Stzx";
-    githubId = 19950702;
-    email = "silence.m@hotmail.com";
-  };
-  subham-roy = {
-    github = "SUBHAM-ROY";
-    githubId = 7468505;
-    name = "Subham Roy";
-  };
   SubhrajyotiSen = {
     email = "subhrajyoti12@gmail.com";
     github = "SubhrajyotiSen";
@@ -27814,12 +27539,6 @@
     githubId = 129148;
     name = "Tad Fisher";
   };
-  tadomika_ari = {
-    email = "lucasee558@gmail.com";
-    github = "Tadomika-Ari";
-    githubId = 124564764;
-    name = "Lucas Eeckhoutte";
-  };
   taeer = {
     email = "taeer@necsi.edu";
     github = "Radvendii";
@@ -27935,12 +27654,6 @@
     githubId = 51232929;
     name = "Taito Horiuchi";
   };
-  tallesCoelho = {
-    email = "talles.hoc@gmail.com";
-    github = "tallesCoelho";
-    githubId = 7442204;
-    name = "Talles Coelho";
-  };
   talyz = {
     email = "kim.lindberger@gmail.com";
     matrix = "@talyz:matrix.org";
@@ -28829,13 +28542,6 @@
     githubId = 1334474;
     name = "Timothy Stott";
   };
-  tincotema = {
-    email = "tincotema@tincotema.org";
-    github = "tincotema";
-    githubId = 41209208;
-    name = "tincotema";
-    keys = [ { fingerprint = "F9D5 F663 E497 5CB1 66B5  FEA2 A961 39D7 C110 556C"; } ];
-  };
   tiptenbrink = {
     email = "tip@tenbrinkmeijs.com";
     github = "tiptenbrink";
@@ -29199,12 +28905,6 @@
     githubId = 10110;
     name = "Travis B. Hartwell";
   };
-  travisty- = {
-    email = "travis@traviskinney.co";
-    github = "travisty-";
-    githubId = 10015877;
-    name = "Travis Kinney";
-  };
   traxys = {
     email = "quentin+dev@familleboyer.net";
     github = "traxys";
@@ -29672,11 +29372,6 @@
     github = "UnsolvedCypher";
     githubId = 3170853;
   };
-  untio11 = {
-    name = "Robin Kneepkens";
-    github = "untio11";
-    githubId = 14060658;
-  };
   uralbash = {
     email = "root@uralbash.ru";
     github = "uralbash";
@@ -29701,12 +29396,6 @@
     github = "username-generic";
     githubId = 202454830;
   };
-  Username404-59 = {
-    name = "Charlie Quinet";
-    email = "charlie.quinet@gmail.com";
-    github = "Username404-59";
-    githubId = 53659497;
-  };
   usertam = {
     name = "Samuel Tam";
     email = "code@usertam.dev";
@@ -30010,13 +29699,6 @@
     githubId = 116078858;
     keys = [ { fingerprint = "CDEA 7E04 69E3 0885 A754  4B05 0104 BC05 F41B 77B8"; } ];
   };
-  vherrmann = {
-    name = "Valentin Herrmann";
-    email = "me@valentin-herrmann.de";
-    github = "vherrmann";
-    githubId = 50072577;
-    keys = [ { fingerprint = "309D A29B 4070 FDFD C01A  3AB4 9E60 CB44 5C4B BC4C"; } ];
-  };
   videl = {
     email = "thibaut.smith@mailbox.org";
     github = "videl";
@@ -30146,12 +29828,6 @@
     githubId = 59029586;
     name = "Vitor Pavan";
   };
-  vitrial = {
-    email = "111700bh@gmail.com";
-    github = "xZecora";
-    githubId = 63205921;
-    name = "Bryant Collins";
-  };
   vizid = {
     email = "mail@vizqq.cc";
     github = "ViZiD";
@@ -30576,12 +30252,6 @@
     github = "wentasah";
     githubId = 140542;
   };
-  weriomat = {
-    name = "Elias Engel";
-    email = "nixpkgs@weriomat.com";
-    github = "weriomat";
-    githubId = 59094810;
-  };
   wesleyjrz = {
     email = "dev@wesleyjrz.com";
     name = "Wesley V. Santos Jr.";
@@ -30827,12 +30497,6 @@
     githubId = 36118348;
     keys = [ { fingerprint = "69C9 876B 5797 1B2E 11C5  7C39 80A1 F76F C9F9 54AE"; } ];
   };
-  WitteShadovv = {
-    name = "WitteShadovv";
-    email = "contact@witteshadovv.dev";
-    github = "WitteShadovv";
-    githubId = 26429638;
-  };
   wiyba = {
     name = "Dmitry Shmakov";
     email = "contact@wiyba.org";
@@ -30940,13 +30604,6 @@
     githubId = 1595132;
     name = "Kranium Gikos Mendoza";
   };
-  WOnder93 = {
-    email = "omosnacek@gmail.com";
-    github = "WOnder93";
-    githubId = 3041388;
-    matrix = "@omos:fedora.im";
-    name = "Ondrej Mosnáček";
-  };
   workflow = {
     email = "4farlion@gmail.com";
     github = "workflow";
@@ -31258,12 +30915,6 @@
     githubId = 3028542;
     name = "Guillermo NWDD";
   };
-  xoconoch = {
-    email = "github@cordovault.com";
-    github = "xoconoch";
-    githubId = 93692082;
-    name = "Xoconoch";
-  };
   xokdvium = {
     email = "sergei@zimmerman.foo";
     github = "xokdvium";
@@ -31393,13 +31044,9 @@
   };
   yarn = {
     name = "yarncat";
-    email = "nix@yarncat.moe";
     github = "yaaaarn";
     githubId = 30006414;
-    matrix = "@y:mx.yarncat.moe";
-    keys = [
-      { fingerprint = "6611 1CEA 8D78 A13E C6D6 FD13 7900 447A E348 FF4D"; }
-    ];
+    email = "nix@yarncat.moe";
   };
   yarny = {
     github = "Yarny0";
@@ -32060,11 +31707,6 @@
       { fingerprint = "E22F 760E E074 E57A 21CB  1733 8DD2 9BB5 2C25 EA09"; }
     ];
   };
-  zinzilulo = {
-    name = "zinzilulo";
-    github = "zinzilulo";
-    githubId = 214774502;
-  };
   Zirconium419122 = {
     name = "Rasmus Liaskar";
     github = "Zirconium419122";

maintainers/scripts/dep-licenses.sh

@@ -36,7 +36,7 @@ sed '
 
 if test $(wc -l "$tmp/filter.sed" | sed 's/ .*//') == 0; then
   echo 1>&2 "
-No derivation mentioned in the stack trace.  Either your derivation does
+No derivation mentionned in the stack trace.  Either your derivation does
 not use stdenv.mkDerivation or you forgot to use the stdenv adapter named
 traceDrvLicenses.
 

maintainers/scripts/haskell/update-stackage.sh

@@ -34,7 +34,7 @@ fi
 # Stackage solver to use, LTS or Nightly
 # (should be capitalized like the display name)
 SOLVER=LTS
-# Stackage solver version, if any. Use latest if empty
+# Stackage solver verson, if any. Use latest if empty
 VERSION=
 TMP_TEMPLATE=update-stackage.XXXXXXX
 readonly SOLVER

maintainers/scripts/luarocks-packages.csv

@@ -51,6 +51,7 @@ lpeg_patterns,,,,,,
 lpeglabel,,,,1.6.0,,
 lrexlib-gnu,,,,,,
 lrexlib-oniguruma,,,,,,junestepp
+lrexlib-pcre,,,,,,
 lrexlib-pcre2,,,,,,wishstudio
 lrexlib-posix,,,,,,
 lsp-progress.nvim,,,,,5.1,gepbird
@@ -155,7 +156,6 @@ rest.nvim,,,,,5.1,teto
 rocks-config.nvim,,,,,5.1,mrcjkb
 rocks-dev.nvim,,,,,5.1,mrcjkb
 rocks-git.nvim,,,,,5.1,mrcjkb
-rocks-lazy.nvim,,,,,,teto
 rocks.nvim,,,,,5.1,mrcjkb
 rtp.nvim,,,,,5.1,mrcjkb
 rustaceanvim,,,,,5.1,mrcjkb

maintainers/scripts/sha-to-sri.py

@@ -166,7 +166,7 @@ def atomicFileUpdate(target: Path):
 
     Yields a pair `(original, new)` of open files.
     `original` is the pre-existing file at `target`, open for reading;
-    `new` is an empty, temporary file in the same folder, open for writing.
+    `new` is an empty, temporary file in the same filder, open for writing.
 
     Upon exiting the context, the files are closed; if no exception was
     raised, `new` (atomically) replaces the `target`, otherwise it is deleted.

maintainers/scripts/update-octave-packages

@@ -30,7 +30,7 @@ INDEX = "https://raw.githubusercontent.com/gnu-octave/packages/main/packages"
 """url of Octave packages' source on GitHub"""
 
 EXTENSIONS = ['tar.gz', 'tar.bz2', 'tar', 'zip']
-"""Permitted file extensions. These are evaluated from left to right and the first occurrence is returned."""
+"""Permitted file extensions. These are evaluated from left to right and the first occurance is returned."""
 
 PRERELEASES = False
 

maintainers/team-list.nix

@@ -519,6 +519,7 @@ with lib.maintainers;
     members = [
       alejandrosame
       aleksi
+      artturin
       emilytrau
       ericson2314
       jk
@@ -550,7 +551,6 @@ with lib.maintainers;
       dotlambda
       ma27
       provokateurin
-      staticdev
     ];
     scope = "Maintain Nextcloud, its tests and the integration of applications.";
     shortName = "Nextcloud";
@@ -654,16 +654,6 @@ with lib.maintainers;
     enableFeatureFreezePing = true;
   };
 
-  pulumi = {
-    scope = "Maintains the Pulumi IaC tool and its language-specific SDKs";
-    shortName = "Pulumi";
-    members = [
-      nicoo
-      tie
-      untio11
-    ];
-  };
-
   python = {
     members = [
       hexa

nixos/README-modular-services.md

@@ -43,7 +43,7 @@ When reviewing a modular service, you should check the following. Details and ra
 ### NixOS VM test
 
 See the initial [Modular Services PR](https://github.com/NixOS/nixpkgs/pull/372170) for an [example](https://github.com/NixOS/nixpkgs/pull/372170/files#diff-e7fe16489cf3cd08ecc22b2c7896039d407a329b75691c046c95447423b3153f) of a NixOS VM test.
-Best practices: keep tests minimal and focused (boot a VM, enable the service, and assert a basic request succeeds). For general guidance, see the [NixOS Tests chapter](https://nixos.org/manual/nixos/unstable/#sec-nixos-tests).
+TBD: describe best practices here.
 
 ### `_class = "service"`
 

nixos/doc/manual/development/writing-nixos-tests.section.md

@@ -276,15 +276,12 @@ with foo_running:
 
 `polling_condition` takes the following (optional) arguments:
 
-`interval`
+`seconds_interval`
 
-:   specifies how often the condition should be polled, as a `datetime.timedelta`:
+:   specifies how often the condition should be polled:
 
 ```py
-import datetime as dt
-
-
-@polling_condition(interval=dt.timedelta(seconds=10))
+@polling_condition(seconds_interval=10)
 def foo_running():
     machine.succeed("pgrep -x foo")
 ```

nixos/doc/manual/redirects.json

@@ -1,10 +1,4 @@
 {
-  "module-services-portmaster": [
-    "index.html#module-services-portmaster"
-  ],
-  "module-services-portmaster-declarative-configuration": [
-    "index.html#module-services-portmaster-declarative-configuration"
-  ],
   "module-hardware-facter": [
     "index.html#module-hardware-facter"
   ],
@@ -71,24 +65,6 @@
   "module-services-keycloak-unix-socket": [
     "index.html#module-services-keycloak-unix-socket"
   ],
-  "module-services-lxmd": [
-    "index.html#module-services-lxmd"
-  ],
-  "module-services-lxmd-communication-backbone": [
-    "index.html#module-services-lxmd-communication-backbone"
-  ],
-  "module-services-lxmd-communication-rpc": [
-    "index.html#module-services-lxmd-communication-rpc"
-  ],
-  "module-services-lxmd-communication-with-rnsd": [
-    "index.html#module-services-lxmd-communication-with-rnsd"
-  ],
-  "module-services-lxmd-health-check": [
-    "index.html#module-services-lxmd-health-check"
-  ],
-  "module-services-lxmd-quickstart": [
-    "index.html#module-services-lxmd-quickstart"
-  ],
   "module-services-mautrix-discord": [
     "index.html#module-services-mautrix-discord"
   ],
@@ -128,18 +104,6 @@
   "module-services-onedrive": [
     "index.html#module-services-onedrive"
   ],
-  "module-services-rnsd": [
-    "index.html#module-services-rnsd"
-  ],
-  "module-services-rnsd-hardware-access": [
-    "index.html#module-services-rnsd-hardware-access"
-  ],
-  "module-services-rnsd-health-check": [
-    "index.html#module-services-rnsd-health-check"
-  ],
-  "module-services-rnsd-quickstart": [
-    "index.html#module-services-rnsd-quickstart"
-  ],
   "module-services-tandoor-recipes-migrating-media-option-move": [
     "index.html#module-services-tandoor-recipes-migrating-media-option-move",
     "index.html#module-services-tandoor-recipes-migrating-media-option-1"
@@ -214,24 +178,6 @@
   "module-services-tdarr-server-only": [
     "index.html#module-services-tdarr-server-only"
   ],
-  "module-services-zapret2": [
-    "index.html#module-services-zapret2"
-  ],
-  "module-services-zapret2-configuration": [
-    "index.html#module-services-zapret2-configuration"
-  ],
-  "module-services-zapret2-configuration-firewall": [
-    "index.html#module-services-zapret2-configuration-firewall"
-  ],
-  "module-services-zapret2-configuration-lua-files": [
-    "index.html#module-services-zapret2-configuration-lua-files"
-  ],
-  "module-services-zapret2-configuration-profiles": [
-    "index.html#module-services-zapret2-configuration-profiles"
-  ],
-  "module-services-zapret2-quick-start": [
-    "index.html#module-services-zapret2-quick-start"
-  ],
   "module-virtualisation-xen": [
     "index.html#module-virtualisation-xen"
   ],
@@ -391,9 +337,6 @@
   "module-services-crab-hole-upstream-options": [
     "index.html#module-services-crab-hole-upstream-options"
   ],
-  "module-services-firefox-syncserver-database": [
-    "index.html#module-services-firefox-syncserver-database"
-  ],
   "module-services-firefox-syncserver-clients": [
     "index.html#module-services-firefox-syncserver-clients"
   ],
@@ -1478,9 +1421,6 @@
   "module-services-gitlab-maintenance-rake": [
     "index.html#module-services-gitlab-maintenance-rake"
   ],
-  "module-services-gitlab-registry-database-migration": [
-    "index.html#module-services-gitlab-registry-database-migration"
-  ],
   "module-services-gitlab-runner": [
     "index.html#module-services-gitlab-runner"
   ],

nixos/doc/manual/release-notes/rl-2305.section.md

@@ -139,7 +139,7 @@ In addition to numerous new and updated packages, this release has the following
 
 - [readarr](https://github.com/Readarr/Readarr), book manager and automation (Sonarr for ebooks). Available as [services.readarr](options.html#opt-services.readarr.enable).
 
-- [ReGreet](https://github.com/rharish101/ReGreet), a clean and customizable greeter for greetd. Available as `programs.regreet.enable`.
+- [ReGreet](https://github.com/rharish101/ReGreet), a clean and customizable greeter for greetd. Available as [programs.regreet](#opt-programs.regreet.enable).
 
 - [rshim](https://github.com/Mellanox/rshim-user-space), the user-space rshim driver for the BlueField SoC. Available as [services.rshim](options.html#opt-services.rshim.enable).
 

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -129,7 +129,7 @@
 
 - [nvme-rs](https://github.com/liberodark/nvme-rs), NVMe monitoring [services.nvme-rs](#opt-services.nvme-rs.enable).
 
-- [Overseerr](https://overseerr.dev), a request management and media discovery tool for the Plex ecosystem. Available as {option}`opt-services.overseerr.enable`.
+- [Overseerr](https://overseerr.dev), a request management and media discovery tool for the Plex ecosystem. Available as [services.overseerr](#opt-services.overseerr.enable).
 
 - [PairDrop](https://github.com/schlagmichdoch/pairdrop), a peer-to-peer file transfer web app. Available as [services.pairdrop](#opt-services.pairdrop.enable).
 

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -84,7 +84,7 @@
 
 - [PdfDing](https://www.pdfding.com/), manage, view and edit your PDFs seamlessly on all your devices wherever you are. Available as [services.pdfding](#opt-services.pdfding.enable).
 
-- [mangowc](https://github.com/DreamMaoMao/mangowc), a lightweight and feature-rich Wayland compositor based on dwl. Available as [programs.mangowc](#opt-programs.mango.enable).
+- [mangowc](https://github.com/DreamMaoMao/mangowc), a lightweight and feature-rich Wayland compositor based on dwl. Available as [programs.mangowc](#opt-programs.mangowc.enable).
 
 - [reaction](https://reaction.ppom.me/), a daemon that scans program outputs for repeated patterns, and takes action. A common usage is to scan ssh and webserver logs, and to ban hosts that cause multiple authentication errors. A modern alternative to fail2ban. Available as [services.reaction](#opt-services.reaction.enable).
 

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -18,58 +18,38 @@
   +nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.zst";
   ```
 
-- `sing-box` now supports NaïveProxy outbounds.
-
 ## New Modules {#sec-release-26.11-new-modules}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- [Portmaster](https://safing.io/portmaster/), a privacy-focused application
-  firewall, is available through
-  [services.portmaster](#opt-services.portmaster.enable).
-
 - [tranquil](https://tangled.org/tranquil.farm/tranquil-pds) is an ATProto PDS (personal data server) implementation in Rust. A featureful, spec conscious and community driven alternative to the Bluesky reference implementation PDS. Available as [services.tranquil-pds](#opt-services.tranquil-pds.enable).
 
 - [Moonlight Qt](https://moonlight-stream.org/), a client for playing your PC games on almost any device. Available as [programs.moonlight-qt](#opt-programs.moonlight-qt.enable).
 
-- [RomM](https://romm.app/), a self-hosted ROM manager and player. Available as [services.romm](#opt-services.romm.enable).
-
 - [scx_loader](https://github.com/sched-ext/scx-loader), a system daemon and DBus-based loader for sched_ext schedulers. `scxctl` is the command-line client for interacting with the loader, allowing users to switch schedulers, modes, and arguments dynamically. Available as [services.scx-loader](#opt-services.scx-loader.enable)
 
 - [tap](https://github.com/bluesky-social/indigo/tree/main/cmd/tap), an ATProtocol firehose synchronisation utility. Available as [services.tap](#opt-services.tap.enable).
 
 - [Nezha](https://github.com/nezhahq/nezha), a self-hosted, lightweight server and website monitoring and O&M tool. Available as [services.nezha](#opt-services.nezha.enable).
 
-- [Noctalia](https://noctalia.dev), a sleek and customizable desktop shell crafted for Wayland. Available as [programs.noctalia](#opt-programs.noctalia.enable).
-
 - [Watt](https://github.com/NotAShelf/watt), a CPU frequency and power management daemon for Linux. Available as [services.watt](#opt-services.watt.enable).
 
 - [mail-tlsa-check-exporter](https://github.com/ietf-tools/mail-tlsa-check-exporter), validates SMTP / IMAP server certificates against a TLSA record as a Prometheus exporter. Available as [services.prometheus.exporters.mail-tlsa-check](#opt-services.prometheus.exporters.mail-tlsa-check.enable).
 
-- [feishin](https://github.com/jeffvli/feishin), a modern self-hosted music player. Available as [services.feishin](#opt-services.feishin.enable).
-
 - [CastSponsorSkip](https://github.com/gabe565/CastSponsorSkip/), skips YouTube sponsorships (and sometimes ads) on all local Google Cast devices.
 
 - [Stump](https://www.stumpapp.dev/), a free and open source comics, manga and digital book server with OPDS support. Available as [services.stump](#opt-services.stump.enable).
 
-- [P2Pool](https://github.com/SChernykh/p2pool), a decentralized mining pool for Monero. Available as [services.p2pool](#opt-services.p2pool.enable).
-
 - [Freescout](https://freescout.net/), a free, open source Helpdesk and shared mailbox. Available as [services.freescout](#opt-services.freescout.enable).
 
-- [Lix TOML remote builders](https://docs.lix.systems/manual/lix/stable/advanced-topics/distributed-builds.html#using-a-toml-configuration), remote builder configuration using lix's TOML format. Available as [lix.buildMachines](#opt-lix.buildMachines). Note: incompatible with `nix.buildMachines`.
-
 - [Koito](https://koito.io/), a modern, themeable scrobbler that you can use with any program that scrobbles to a custom ListenBrainz URL. Available as [services.koito](#opt-services.koito.enable).
 
-- [Zapret2](https://github.com/bol-van/zapret2), an extensible DPI bypass program. Available as [services.zapret2](#opt-services.zapret2.enable).
-
 - [FlapAlerted](https://github.com/Kioubit/FlapAlerted), detects BGP flapping events and provides statistics based on BGP update messages. Available as [services.flap-alerted](#opt-services.flap-alerted.enable).
 
 - [gocron](https://github.com/flohoss/gocron), a task scheduler with web interface. Available as [services.gocron](#opt-services.gocron.enable).
 
 - [Unpackerr](https://unpackerr.zip), extracts downloads for Radarr, Sonarr, Lidarr, Readarr, and/or a Watch folder. Available as [services.unpackerr](#opt-services.unpackerr.enable).
 
-- [ioquake3](https://ioquake3.org), a open-source port of the 3D action shooter Quake 3 Arena. Available as [programs.ioquake3](#opt-programs.ioquake3.enable).
-
 - [Matrix Authentication Service](https://github.com/element-hq/matrix-authentication-service) is an OAuth2.0 and OpenID Connect provider for Matrix homeservers (such as Synapse). It replaces standard password authentication with modern OpenID Connect flows, and can delegate authentication to upstream OIDC providers. Available as [services.matrix-authentication-service](#opt-services.matrix-authentication-service.enable).
 
 - [stash-clipboard](https://github.com/NotAShelf/stash), a Wayland clipboard "manager" with fast persistent history and multi-media support. Available as [services.stash-clipboard](#opt-services.stash-clipboard.enable).
@@ -78,21 +58,10 @@
 
 - [NordVPN](https://github.com/NordSecurity/nordvpn-linux), a NordVPN client for linux. Available as [services.nordvpn](options.html#opt-services.nordvpn.enable).
 
-- [RNSD](https://reticulum.network/), the Reticulum Network Stack Daemon. It provides a secure and efficient way to communicate over the Reticulum Network. Available as [services.rnsd](#opt-services.rnsd.enable).
-
-- [LXMD](https://github.com/markqvist/LXMF), a universal, distributed and secure messaging protocol for Reticulum. Available as [services.lxmd](#opt-services.lxmd.enable).
-
-- [Entropy](https://github.com/ergohaven/entropy), a configurator for programmable keyboards and input devices running Vial-QMK/RMK firmware. Available as [programs.entropy](#opt-programs.entropy.enable).
-
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- Artalk has been updated to 2.10.0. Its default configuration and data
-  directory discovery changed; see the [upstream migration
-  guide](https://artalk.js.org/en/guide/releases/v2.10.0.html) when invoking
-  `artalk` directly. The `services.artalk` module is unaffected.
-
 - `boot.vesa` has been removed. It was deprecated in 2020 because Xorg now works better with kernel modesetting. If you still need the legacy VESA 800x600 fallback, set `boot.kernelParams = [ "vga=0x317" "nomodeset" ];` directly.
 
 - `authentik` has been updated to 2026.5.3, which changes the default listen address from `0.0.0.0` to `[::]`.
@@ -100,26 +69,12 @@
   Deployments running the server and worker in the same network namespace must also set at least the worker
   `AUTHENTIK_LISTEN__HTTP` address so that the server and worker do not bind to the same address.
 
-- `services.paperless` has been updated to paperless-ngx 3.0, a major release; review the [upstream v3 migration guide](https://docs.paperless-ngx.com/migration-v3/) before upgrading.
-  - paperless-ngx 3 requires a non-default `PAPERLESS_SECRET_KEY`. The module now generates one automatically, reusing the key from earlier NixOS releases so existing sessions keep working; a key set via `environmentFile` still takes precedence.
-  - The full-text search backend changed from Whoosh to Tantivy. The search index is rebuilt automatically on the first start after upgrading, which can take a while for large document sets.
-  - Some settings changed or were removed (for example, an external database now needs an explicit `PAPERLESS_DBENGINE`); review your `services.paperless.settings` against the migration guide.
-
 - `services.alps` has been rewritten, see [upstream repository](https://github.com/migadu/alps) for configuration.
 
-- Nginx no longer includes the unmaintained dav module per default.
-  If you happened to use it via a `dav_*` directive, you can include it with `services.nginx.additionalModules = [ pkgs.nginxModules.dav ]` again.
-
 - Support for the legacy U‐Boot image format has been removed from the initrd generators, as it is deprecated upstream and no longer used by any platform in Nixpkgs.
 
-- `services.pid-fan-controller` no longer provides deep configuration rewriting and adheres now fully to RFC42.
-
-- The `extraArgs` and `check` arguments to `nixos/lib/eval-config.nix` (and therefore to `lib.nixosSystem`) have been removed after being deprecated with a warning since 2021. Passing them is now an evaluation error. Instead of `extraArgs`, set `config._module.args`; instead of `check = false`, set `config._module.check = false`. The `extraArgs` attribute on the resulting configuration has been removed as well.
-
 - Rustical migrates from `settings.http.host` and `settings.http.port` to `settings.http.bind` to support UNIX domain sockets as well as TCP sockets in one setting.
 
-- The Mullvad VPN service now has a separate toggle to enable the Mullvad VPN graphical user interface. If you have previously used Mullvad on a desktop by setting `services.mullvad-vpn.package` to `pkgs.mullvad-vpn`, you should now **unset that option**, and enable `services.mullvad-vpn.gui.enable`. The VPN will not work if `services.mullvad-vpn.package` is set to `pkgs.mullvad-vpn`, as `pkgs.mullvad-vpn` no longer contains the Mullvad Daemon; please ensure that `services.mullvad-vpn.package` is set to `pkgs.mullvad`, regardless if you plan to enable the graphical user interface or not.
-
 - A number of options for `services.llama-cpp` have been removed in favor of the structured [](#opt-services.llama-cpp.settings) option, attributes from which are used as arguments to `llama-server` executable, you can see all available options by running `llama-server --help`. Configuring model presets using Nix attribute set via `services.llama-cpp.modelsPreset` is no longer supported, please use `services.llama-cpp.settings.models-preset` with a path to an INI file containing desired options.
 
 - The `NIX_XDG_DESKTOP_PORTAL_DIR` environment variable is no longer used in the `xdg-desktop-portal` package and is therefore no longer set in `xdg.portal` module.
@@ -134,9 +89,9 @@
 
 - Apache Kafka has dropped support for ZooKeeper mode. The `apacheKafka_3_9` and `apacheKafka_4_0` packages have been removed, as every remaining packaged version is KRaft-only. The `services.apache-kafka.zookeeper` option (previously an alias for `services.apache-kafka.settings."zookeeper.connect"`) has been removed; migrate your cluster to [KRaft](#module-services-apache-kafka-kraft) mode instead.
 
-- `virtualisation.containers.registries.block` / `insecure` / `search` were deprecated,
+- `virtualisation.registries.block` / `insecure` / `search` were deprecated,
   because they mapped to the deprecated V1 `registries.conf` format.
-  See the new option {option}`virtualisation.containers.registries.settings`
+  See the new option {option}`virtualisation.registries.settings`
   and [containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)
   to migrate to the new configuration format.
 
@@ -144,14 +99,10 @@
 
 - String values passed to `services.phpfpm.settings`, `services.phpfpm.pools.<name>.phpEnv`, and `services.phpfpm.pools.<name>.settings` are now properly quoted and escaped, except for the `${}` syntax that is left as-is. If you are manually escaping these values, please adjust accordingly.
 
-- `services.gitlab.registry` has been modified so that the GitLab container registry runs in the `gitlab-container-registry` system user. This behavior can be modified with the `services.gitlab.registry.user` option.
-
 - `systemd.user.extraConfig` has been removed in favor of the structured [](#opt-systemd.user.settings.Manager) option. Use `systemd.user.settings.Manager` to set any `systemd-user.conf(5)` option directly. For example, replace `systemd.user.extraConfig = "DefaultTimeoutStartSec=60";` with `systemd.user.settings.Manager.DefaultTimeoutStartSec = 60;`.
 
 - `matrix-appservice-discord` was removed from nixpkgs along with its NixOS module (`services.matrix-appservice-discord`) as it is no longer actively maintained upstream. Use the actively-maintained puppeting bridge [`mautrix-discord`](#opt-services.mautrix-discord.enable) instead.
 
-- Home Assistant 2026.8.0 migrated its HTTP configuration from YAML into the frontend. After upgrading, any options configured under `services.home-assistant.config.http` can be removed. HTTP settings can now be configured from the Home Assistant frontend under [Settings → System → Network](https://my.home-assistant.io/redirect/network). If no HTTP settings were previously configured, Home Assistant will default to listening on all interfaces on port 8123.
-
 - `services.timesyncd.extraConfig` has been removed in favor of the structured [](#opt-services.timesyncd.settings.Time) option. Use `services.timesyncd.settings.Time` to set any `timesyncd.conf(5)` option directly. For example, replace `services.timesyncd.extraConfig = "PollIntervalMaxSec=180";` with `services.timesyncd.settings.Time.PollIntervalMaxSec = 180;`.
 
 - `services.firezone.server.provision` has been removed due to it being unmaintanable. Remove all uses of provisioning and use the WebUI to configure firezone.
@@ -162,18 +113,10 @@
 
 - `services.komodo-periphery` has been updated to support version 2.0.0. Some options have been renamed to match the new configuration structure; compatibility aliases are provided for the renamed options. The `passkeys` and `outbound.onboardingKey` options have been removed; use `passkeyFiles`, `auth.privateKey`/`auth.corePublicKeys`, or `outbound.onboardingKeyFile` instead. New outbound mode configuration is available under `outbound.*`.
 
-- Package `overseerr` has been removed as the `overseerr` and `jellyseerr` projects were merged under `seerr`.
-
-- `slskd` has been updated to v0.25.0, which renames the `global` option to `transfers`. Please review the [changelog](https://github.com/slskd/slskd/releases#release-0.25.0).
-
-- [firefox-syncserver.database.type](#opt-services.firefox-syncserver.database.type) no longer defaults to `"mysql"`. You must now explicitly choose between `"mysql"` and `"postgresql"`. New deployments should prefer PostgreSQL.
-
 ## Other Notable Changes {#sec-release-26.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- `programs.regreet` has been renamed to `services.displayManager.regreet`.
-
 - `komodo` has been updated to the v2 release line (2.x). See the [upstream v1 → v2 upgrade guide](https://github.com/moghtech/komodo/releases/tag/v2.0.0).
 
 - `temporal` has been updated to the 1.31 release line. Always consult the [upstream upgrade
@@ -181,10 +124,6 @@
 
 - The `shell_interact()` function on interactive runs of NixOS VM tests has been deprecated. Use the SSH backdoor instead.
 
-- NixOS VM tests now prefer to express durations and timeouts as `datetime.timedelta` values instead of bare numbers. Methods such as `machine.wait_until_succeeds`, `machine.sleep`, `retry`, and `polling_condition` now accept a `timedelta` (e.g., `machine.wait_for_unit("sshd.service", timeout=datetime.timedelta(minutes=1))`). Passing an `int`/`float` as seconds still works but now emits a deprecation warning. Argument names that explicitly defined units were preserved but have had `timedelta` equivalents introduced (`timeout_seconds` → `timeout`, `secs` → `duration`, `seconds_interval` → `interval`).
-
-- `darwin.linux-builder-vz` has been added: a variant of `darwin.linux-builder` that runs the builder guest on Apple's Virtualization.framework via the new `vzvm` package, translating `x86_64-linux` builds with Rosetta instead of emulating them. Apple silicon hosts only. As part of this, the `nixos/modules/profiles/nix-builder-vm.nix` profile has been split into the backend-neutral `nixos/modules/profiles/nix-builder.nix` and a QEMU-specific part. Existing imports of `nix-builder-vm.nix` keep working unchanged.
-
 - [services.netbox](#opt-services.netbox.enable) has received a number of updates:
   - Default settings can now be introspected at [](#opt-services.netbox.settings).
   - Environment files can now be passed at [](#opt-services.netbox.environmentFiles).
@@ -195,16 +134,12 @@
     and the default changed to a UNIX domain socket.
   - A cookie-cutter nginx vhost can be enabled at [](#opt-services.netbox.nginx.enable).
 
-- The [monero](#opt-services.monero.enable) systemd service has been security hardened.
-
 - `security.run0.enableSudoAlias` now uses the `run0-sudo-shim` instead of a shell-script to improve compatibility.
 
 - With `system.etc.overlay.mutable = false`, NixOS now ships an empty `/etc/machine-id` in the image. Previously the file was absent and systemd logged `System cannot boot: Missing /etc/machine-id and /etc/ is read-only` while `ConditionFirstBoot` fired on every boot. With this change, systemd now overlays a transient ID from `/run/machine-id` for the session, and `systemd-machine-id-commit.service` has `ConditionFirstBoot` so it writes the machine-id through to a persistent backing file when one is bind-mounted over `/etc/machine-id`. To persist the machine-id across reboots, bind-mount a writable file containing `uninitialized` over `/etc/machine-id` from the initrd, or set `systemd.machine_id=` on the kernel command line (use `systemd.machine_id=firmware` to derive a stable ID on hardware that supports it).
 
 - `security.run0.persistentAuth` options have been added to support persistent Authentication of session. Timeout configurable via `security.polkit.settings.Polkitd.ExpirationSeconds`.
 
-- [`virtualisation.qemu.firmware.enable`](#opt-virtualisation.qemu.firmware.enable) has been added to install QEMU firmware descriptors to {file}`/etc/qemu/firmware`, making the corresponding firmware images discoverable by tools such as `systemd-vmspawn`. By default this exposes the firmware bundled with QEMU. Further firmware can be added via [`virtualisation.qemu.firmware.packages`](#opt-virtualisation.qemu.firmware.packages), for example the new `OVMF-amdsev` and `OVMF-inteltdx` packages, which provide UEFI firmware for AMD SEV-SNP and Intel TDX confidential VMs.
-
 - `boot.loader.systemd-boot` gained support for [Automatic Boot Assessment](https://systemd.io/AUTOMATIC_BOOT_ASSESSMENT/) via the new [`boot.loader.systemd-boot.bootCounting`](#opt-boot.loader.systemd-boot.bootCounting.enable) options, allowing automatic detection of and recovery from bad NixOS generations. As part of this change, boot loader entries on the ESP/XBOOTLDR partition are now named `nixos-<content-hash>.conf` instead of `nixos-generation-<n>.conf`; existing entries are migrated automatically on the next `nixos-rebuild boot`/`switch`.
 
 - `services.nginx` gained a [`lua`](#opt-services.nginx.lua.enable) option to enable Lua scripting via OpenResty's lua-nginx-module on a stock nginx, configuring `lua_package_path`/`lua_package_cpath` from the packages listed in [`services.nginx.lua.extraPackages`](#opt-services.nginx.lua.extraPackages). Use this to add Lua to a regular nginx; for the full OpenResty platform (libraries that rely on its bundled lualib, such as `lua-resty-openidc`), set `services.nginx.package` to `pkgs.openresty` instead — the option configures the Lua search path for it too.
@@ -219,8 +154,6 @@
   This makes fully declarative deployments safer: Otherwise the user needed to either accept Plausible's unauthenticated "first launch" setup wizard, which lets anyone reaching the instance create the first admin account, or do more work (deploying with NixOS's default binding to `localhost` without exposing it publicly, going through the wizard, and then deploying Plausible exposed to the Internet).
   This option was previously removed with NixOS 25.05 due to an upstream Plausible change making declarative admin creation more difficult, but this change re-implements the admin creation directly.
 
-- `services.gitlab.registry` now uses PostgreSQL as database storage for new installations and supports old installations that use the filesystem as metadata storage. It creates the required PostgreSQL database and user. Users can manually migrate their filesystem based metadata storage. See [GitLab Container Registry Migration to database metadata store](#module-services-gitlab-registry-database-migration).
-
 - The `newuidmap` and `newgidmap` security wrappers are now installed with `cap_setuid`/`cap_setgid` file capabilities instead of the setuid-root bit, matching shadow's `--with-fcaps` install mode and other major distributions. Rootless containers (podman, docker-rootless, unprivileged user namespaces) are unaffected. The only behavioural change is that mapping host uid 0 via `/etc/subuid` (which NixOS never configures by default) additionally requires `cap_setfcap`; users who explicitly grant uid 0 in a subuid range can restore the previous behaviour with `security.wrappers.newuidmap.capabilities = lib.mkForce "cap_setuid,cap_setfcap+ep";`.
 
 - The `authelia` module now uses systemd's `LoadCredential` to load all files defined in `secrets`. As such, these files no longer need to be readable by the authelia user and group: they can for example be set to be only readable by the root user.
@@ -235,5 +168,3 @@
   - Please note that Nextcloud prohibits skipping major versions while upgrading. You can upgrade to specific versions by declaring `services.nextcloud.package = pkgs.nextcloud33;`.
 
 - `trilium-desktop` and `trilium-server` have been updated to 0.104.0. This release includes security hardening fixes that may break functionality. [See upstream release note for details](https://github.com/TriliumNext/Trilium/releases/tag/v0.104.0).
-
-- `nix` now supports running in "daemonless" mode by setting `nix.daemon.enable = false`. Under this mode all store operations must go through the [local store type](https://nix.dev/manual/nix/latest/store/types/local-store), which typically requires root permissions.

nixos/lib/binfmt-magics.nix

@@ -95,11 +95,11 @@
     magicOrExtension = ''\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x02\x01'';
     mask = ''\xff\xff\xff\xff\xff\xff\xff\xfc\x00\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff'';
   };
-  wasm32-wasip1 = {
+  wasm32-wasi = {
     magicOrExtension = ''\x00asm'';
     mask = ''\xff\xff\xff\xff'';
   };
-  wasm64-wasip1 = {
+  wasm64-wasi = {
     magicOrExtension = ''\x00asm'';
     mask = ''\xff\xff\xff\xff'';
   };

nixos/lib/erofs-store-image.nix

@@ -1,30 +0,0 @@
-# Shell-script fragment that packs a Nix store closure into a read-only erofs
-# image, built on the host when the VM starts. Shared by the VM backends
-# `qemu-vm.nix` and `vz-vm.nix`
-{
-  hostPkgs,
-  # path to a file listing the store paths to pack, one per line
-  storePaths,
-  # filesystem label of the image
-  label,
-  # shell word the image is written to
-  destination,
-}:
-''
-  ${hostPkgs.gnutar}/bin/tar --create \
-    --absolute-names \
-    --verbatim-files-from \
-    --transform 'flags=rSh;s|/nix/store/||' \
-    --transform 'flags=rSh;s|~nix~case~hack~[[:digit:]]\+||g' \
-    --files-from ${storePaths} \
-    | ${hostPkgs.erofs-utils}/bin/mkfs.erofs \
-      --quiet \
-      --force-uid=0 \
-      --force-gid=0 \
-      -L ${label} \
-      -U eb176051-bd15-49b7-9e6b-462e0b467019 \
-      -T 0 \
-      --hard-dereference \
-      --tar=f \
-      ${destination}
-''

nixos/lib/eval-config.nix

@@ -21,16 +21,20 @@ evalConfigArgs@{
   #     of inheritParentConfig.
   baseModules ? import ../modules/module-list.nix,
   # !!! See comment about args in lib/modules.nix
+  extraArgs ? { },
+  # !!! See comment about args in lib/modules.nix
   specialArgs ? { },
   modules,
   modulesLocation ? (builtins.unsafeGetAttrPos "modules" evalConfigArgs).file or null,
+  # !!! See comment about check in lib/modules.nix
+  check ? true,
   prefix ? [ ],
   lib ? import ../../lib,
   extraModules ? [ ],
 }:
 
 let
-  inherit (lib) optional warn;
+  inherit (lib) optional;
 
   evalModulesMinimal =
     (import ./default.nix {
@@ -58,8 +62,15 @@ let
   };
 
   withWarnings =
-    if specialArgs ? pkgs then
-      warn ''
+    x:
+    lib.warnIf (evalConfigArgs ? extraArgs)
+      "The extraArgs argument to eval-config.nix is deprecated. Please set config._module.args instead."
+      lib.warnIf
+      (evalConfigArgs ? check)
+      "The check argument to eval-config.nix is deprecated. Please set config._module.check instead."
+      lib.warnIf
+      (specialArgs ? pkgs)
+      ''
         You have set specialArgs.pkgs, which means that options like nixpkgs.config
         and nixpkgs.overlays will be ignored. If you wish to reuse an already created
         pkgs, which you know is configured correctly for this NixOS configuration,
@@ -67,16 +78,31 @@ let
         `(modulesPath + "/misc/nixpkgs/read-only.nix"), and set `{ nixpkgs.pkgs = <your pkgs>; }`.
         This properly disables the ignored options to prevent future surprises.
       ''
-    else
-      x: x;
+      x;
 
-  userModules =
-    # Add the invoking file (or specified modulesLocation) as error message location
-    # for modules that don't have their own locations; presumably inline modules.
-    if modulesLocation == null then
-      modules
-    else
-      map (lib.setDefaultModuleLocation modulesLocation) modules;
+  legacyModules =
+    lib.optional (evalConfigArgs ? extraArgs) {
+      config = {
+        _module.args = extraArgs;
+      };
+    }
+    ++ lib.optional (evalConfigArgs ? check) {
+      config = {
+        _module.check = lib.mkDefault check;
+      };
+    };
+
+  allUserModules =
+    let
+      # Add the invoking file (or specified modulesLocation) as error message location
+      # for modules that don't have their own locations; presumably inline modules.
+      locatedModules =
+        if modulesLocation == null then
+          modules
+        else
+          map (lib.setDefaultModuleLocation modulesLocation) modules;
+    in
+    locatedModules ++ legacyModules;
 
   noUserModules = evalModulesMinimal {
     inherit prefix specialArgs;
@@ -103,12 +129,13 @@ let
     };
   };
 
-  nixosWithUserModules = noUserModules.extendModules { modules = userModules; };
+  nixosWithUserModules = noUserModules.extendModules { modules = allUserModules; };
 
   withExtraAttrs =
     configuration:
     configuration
     // {
+      inherit extraArgs;
       inherit (configuration._module.args) pkgs;
       inherit lib;
       extendModules = args: withExtraAttrs (configuration.extendModules args);

nixos/lib/systemd-lib.nix

@@ -592,43 +592,52 @@ rec {
     }:
     {
       config = {
-        unitConfig = {
-          ${if config.requires != [ ] then "Requires" else null} = toString config.requires;
-          ${if config.wants != [ ] then "Wants" else null} = toString config.wants;
-          ${if config.upholds != [ ] then "Upholds" else null} = toString config.upholds;
-          ${if config.after != [ ] then "After" else null} = toString config.after;
-          ${if config.before != [ ] then "Before" else null} = toString config.before;
-          ${if config.bindsTo != [ ] then "BindsTo" else null} = toString config.bindsTo;
-          ${if config.partOf != [ ] then "PartOf" else null} = toString config.partOf;
-          ${if config.conflicts != [ ] then "Conflicts" else null} = toString config.conflicts;
-          ${if config.requisite != [ ] then "Requisite" else null} = toString config.requisite;
-          ${if config.description != "" then "Description" else null} = config.description;
-          ${if config.documentation != [ ] then "Documentation" else null} = toString config.documentation;
-          ${if config.onFailure != [ ] then "OnFailure" else null} = toString config.onFailure;
-          ${if config.onSuccess != [ ] then "OnSuccess" else null} = toString config.onSuccess;
-          ${if options.startLimitIntervalSec.isDefined then "StartLimitIntervalSec" else null} =
-            toString config.startLimitIntervalSec;
-          ${if options.startLimitBurst.isDefined then "StartLimitBurst" else null} =
-            toString config.startLimitBurst;
-        }
-        // optionalAttrs (config ? restartTriggers && config.restartTriggers != [ ]) {
-          X-Restart-Triggers = "${pkgs.writeText "X-Restart-Triggers-${name}" (
-            pipe config.restartTriggers [
-              flatten
-              (map (x: if isPath x then "${x}" else x))
-              toString
-            ]
-          )}";
-        }
-        // optionalAttrs (config ? reloadTriggers && config.reloadTriggers != [ ]) {
-          X-Reload-Triggers = "${pkgs.writeText "X-Reload-Triggers-${name}" (
-            pipe config.reloadTriggers [
-              flatten
-              (map (x: if isPath x then "${x}" else x))
-              toString
-            ]
-          )}";
-        };
+        unitConfig =
+          optionalAttrs (config.requires != [ ]) { Requires = toString config.requires; }
+          // optionalAttrs (config.wants != [ ]) { Wants = toString config.wants; }
+          // optionalAttrs (config.upholds != [ ]) { Upholds = toString config.upholds; }
+          // optionalAttrs (config.after != [ ]) { After = toString config.after; }
+          // optionalAttrs (config.before != [ ]) { Before = toString config.before; }
+          // optionalAttrs (config.bindsTo != [ ]) { BindsTo = toString config.bindsTo; }
+          // optionalAttrs (config.partOf != [ ]) { PartOf = toString config.partOf; }
+          // optionalAttrs (config.conflicts != [ ]) { Conflicts = toString config.conflicts; }
+          // optionalAttrs (config.requisite != [ ]) { Requisite = toString config.requisite; }
+          // optionalAttrs (config ? restartTriggers && config.restartTriggers != [ ]) {
+            X-Restart-Triggers = "${pkgs.writeText "X-Restart-Triggers-${name}" (
+              pipe config.restartTriggers [
+                flatten
+                (map (x: if isPath x then "${x}" else x))
+                toString
+              ]
+            )}";
+          }
+          // optionalAttrs (config ? reloadTriggers && config.reloadTriggers != [ ]) {
+            X-Reload-Triggers = "${pkgs.writeText "X-Reload-Triggers-${name}" (
+              pipe config.reloadTriggers [
+                flatten
+                (map (x: if isPath x then "${x}" else x))
+                toString
+              ]
+            )}";
+          }
+          // optionalAttrs (config.description != "") {
+            Description = config.description;
+          }
+          // optionalAttrs (config.documentation != [ ]) {
+            Documentation = toString config.documentation;
+          }
+          // optionalAttrs (config.onFailure != [ ]) {
+            OnFailure = toString config.onFailure;
+          }
+          // optionalAttrs (config.onSuccess != [ ]) {
+            OnSuccess = toString config.onSuccess;
+          }
+          // optionalAttrs (options.startLimitIntervalSec.isDefined) {
+            StartLimitIntervalSec = toString config.startLimitIntervalSec;
+          }
+          // optionalAttrs (options.startLimitBurst.isDefined) {
+            StartLimitBurst = toString config.startLimitBurst;
+          };
       };
     };
 

nixos/lib/test-driver/src/test_driver/__init__.py

@@ -89,11 +89,6 @@ def main() -> None:
         type=Path,
         required=True,
     )
-    arg_parser.add_argument(
-        "--test-script",
-        help="path to a test script to run, taking precedence over the one defined in the config file",
-        type=Path,
-    )
     arg_parser.add_argument(
         "--keep-vm-state",
         help=argparse.SUPPRESS,
@@ -168,12 +163,8 @@ def main() -> None:
     if args.debug_hook_attach is not None:
         debugger = Debug(logger, args.debug_hook_attach)
 
-    config = load_driver_configuration(args.config)
-    if args.test_script is not None:
-        config.test_script = args.test_script
-
     with Driver(
-        config=config,
+        config=load_driver_configuration(args.config),
         out_dir=output_directory,
         logger=logger,
         keep_machine_state=args.keep_machine_state,

nixos/lib/test-driver/src/test_driver/driver.py

@@ -1,4 +1,3 @@
-import datetime as dt
 import json
 import os
 import re
@@ -8,7 +7,6 @@ import sys
 import tempfile
 import threading
 import traceback
-import warnings
 from collections.abc import Callable, Generator, Iterator
 from contextlib import AbstractContextManager, contextmanager
 from dataclasses import dataclass
@@ -20,7 +18,6 @@ from colorama import Style
 from pydantic import BaseModel
 
 from test_driver.debug import DebugAbstract, DebugNop
-from test_driver.duration import as_timedelta
 from test_driver.errors import MachineError, RequestedAssertionFailed
 from test_driver.logger import AbstractLogger
 from test_driver.machine import (
@@ -43,7 +40,7 @@ class DriverConfiguration(BaseModel):
     vms: dict[str, NodeConfiguration]
     containers: dict[str, NodeConfiguration]
     vlans: list[int]
-    global_timeout: dt.timedelta
+    global_timeout: int
     enable_ssh_backdoor: bool
     test_script: Path
 
@@ -169,7 +166,7 @@ class Driver:
 
     def __enter__(self) -> "Driver":
         self.race_timer = threading.Timer(
-            self.config.global_timeout.total_seconds(), self.terminate_test
+            self.config.global_timeout, self.terminate_test
         )
         tmp_dir = get_tmp_dir()
 
@@ -431,7 +428,7 @@ class Driver:
     def run_tests(self) -> None:
         """Run the test script (for non-interactive test runs)"""
         self.logger.info(
-            f"Test will time out and terminate in {self.config.global_timeout.total_seconds()} seconds"
+            f"Test will time out and terminate in {self.config.global_timeout} seconds"
         )
         self.race_timer.start()
         self.test_script()
@@ -530,33 +527,18 @@ class Driver:
         self,
         fun_: Callable | None = None,
         *,
-        seconds_interval: float | dt.timedelta | None = None,
-        interval: dt.timedelta | None = None,
+        seconds_interval: float = 2.0,
         description: str | None = None,
     ) -> Callable[[Callable], AbstractContextManager] | AbstractContextManager:
         driver = self
 
-        if seconds_interval is not None:
-            if interval is not None:
-                raise TypeError(
-                    "polling_condition() got both 'interval' and 'seconds_interval' arguments. Pass only 'interval'"
-                )
-            if not isinstance(seconds_interval, dt.timedelta):
-                warnings.warn(
-                    "polling_condition(): The 'seconds_interval' argument is deprecated. Use 'interval' instead.",
-                )
-            interval = as_timedelta(seconds_interval)
-
-        if interval is None:
-            interval = dt.timedelta(seconds=2)
-
         class Poll:
             def __init__(self, fun: Callable):
                 self.condition = PollingCondition(
                     fun,
                     driver.logger,
-                    description=description,
-                    interval=interval,
+                    seconds_interval,
+                    description,
                 )
 
             def __enter__(self) -> None:
@@ -566,25 +548,7 @@ class Driver:
                 res = driver.polling_conditions.pop()
                 assert res is self.condition
 
-            def wait(
-                self,
-                timeout_seconds: int | dt.timedelta | None = None,
-                timeout: dt.timedelta | None = None,
-            ) -> None:
-                if timeout_seconds is not None:
-                    if timeout is not None:
-                        raise TypeError(
-                            "wait() got both 'timeout' and 'timeout_seconds' arguments. Pass only 'timeout'"
-                        )
-                    if not isinstance(timeout_seconds, dt.timedelta):
-                        warnings.warn(
-                            "wait(): The 'timeout_seconds' argument is deprecated. Use 'timeout' instead.",
-                        )
-                    timeout = as_timedelta(timeout_seconds)
-
-                if timeout is None:
-                    timeout = dt.timedelta(minutes=15)
-
+            def wait(self, timeout: int = 900) -> None:
                 def condition(last: bool) -> bool:
                     if last:
                         driver.logger.info(
@@ -598,7 +562,7 @@ class Driver:
                     return ret
 
                 with driver.logger.nested(f"waiting for {self.condition.description}"):
-                    retry(condition, timeout=timeout)
+                    retry(condition, timeout_seconds=timeout)
 
         if fun_ is None:
             return Poll

nixos/lib/test-driver/src/test_driver/duration.py

@@ -1,42 +0,0 @@
-import datetime as dt
-import warnings
-
-# A duration accepted by the public test-driver API.
-# `datetime.timedelta` is the preferred form. Bare `int`/`float` values are still
-# accepted for backwards compatibility (interpreted as a number of seconds),
-# but doing so is deprecated: use `datetime.timedelta` instead.
-Duration = dt.timedelta | int | float
-
-
-def as_timedelta(duration: Duration) -> dt.timedelta:
-    """Coerce a `Duration` into a `datetime.timedelta`.
-
-    Bare numbers are interpreted as seconds. This keeps existing test scripts
-    that pass plain integers working while `datetime.timedelta` becomes the preferred
-    way to express durations.
-    """
-    if isinstance(duration, dt.timedelta):
-        return duration
-    if isinstance(duration, bool):
-        raise TypeError(f"expected a duration, got bool: {duration!r}")
-    if isinstance(duration, (int, float)):
-        return dt.timedelta(seconds=duration)
-    raise TypeError(
-        f"expected a timedelta, int, or float duration, got {type(duration).__name__}"
-    )
-
-
-def as_seconds(duration: Duration) -> float:
-    """Coerce a `Duration` into a floating-point number of seconds."""
-    return as_timedelta(duration).total_seconds()
-
-
-def _warn_if_numeric_duration(duration: Duration | None, func_name: str) -> None:
-    """Emit a warning if `duration` is a bare number instead of a `timedelta`."""
-    if duration is None or isinstance(duration, bool):
-        return
-    if isinstance(duration, (int, float)):
-        warnings.warn(
-            f"{func_name}(): passing a bare int/float as a duration is "
-            "deprecated. Use datetime.timedelta instead.",
-        )

nixos/lib/test-driver/src/test_driver/machine/__init__.py

@@ -1,5 +1,4 @@
 import base64
-import datetime as dt
 import io
 import os
 import platform
@@ -23,12 +22,6 @@ from pathlib import Path
 from queue import Queue
 from typing import Any
 
-from test_driver.duration import (
-    Duration,
-    _warn_if_numeric_duration,
-    as_seconds,
-    as_timedelta,
-)
 from test_driver.efi import EfiVariable, EfiVars
 from test_driver.errors import MachineError, RequestedAssertionFailed
 from test_driver.logger import AbstractLogger
@@ -106,46 +99,24 @@ def make_command(args: list) -> str:
     return " ".join(map(shlex.quote, (map(str, args))))
 
 
-def retry(
-    fn: Callable,
-    timeout_seconds: int | dt.timedelta | None = None,
-    timeout: dt.timedelta | None = None,
-) -> None:
+def retry(fn: Callable, timeout_seconds: int = 900) -> None:
     """Call the given function repeatedly, with a one second interval between
     retries, until it returns True or a timeout is reached.
 
     Note that the timeout shown will include the time of the last attempted run.
-
-    Has a default timeout of 15 minutes which can be modified.
-    The ``timeout_seconds`` argument is deprecated. Use ``timeout`` instead.
     """
-    if timeout_seconds is not None:
-        if timeout is not None:
-            raise TypeError(
-                "retry() got both 'timeout' and 'timeout_seconds' arguments. Pass only 'timeout'"
-            )
-        if not isinstance(timeout_seconds, dt.timedelta):
-            warnings.warn(
-                "retry(): The 'timeout_seconds' argument is deprecated. Use 'timeout' instead.",
-            )
-        timeout = as_timedelta(timeout_seconds)
-
-    if timeout is None:
-        timeout = dt.timedelta(minutes=15)
     start_time = time.monotonic()
 
-    def elapsed() -> dt.timedelta:
-        return dt.timedelta(seconds=time.monotonic() - start_time)
-
-    while elapsed() < timeout:
+    while time.monotonic() - start_time < timeout_seconds:
         if fn(False):
             return
         time.sleep(1)
 
+    elapsed = time.monotonic() - start_time
+
     if not fn(True):
         raise RequestedAssertionFailed(
-            f"action timed out after {elapsed().total_seconds():.2f} seconds "
-            f"(timeout={timeout.total_seconds()})"
+            f"action timed out after {elapsed:.2f} seconds (timeout={timeout_seconds})"
         )
 
 
@@ -370,17 +341,13 @@ class BaseMachine(ABC):
         return self.execute(f"systemctl {q}")
 
     def wait_for_unit(
-        self,
-        unit: str,
-        user: str | None = None,
-        timeout: Duration = dt.timedelta(minutes=15),
+        self, unit: str, user: str | None = None, timeout: int = 900
     ) -> None:
         """
         Wait for a systemd unit to get into "active" state.
         Throws exceptions on "failed" and "inactive" states as well as after
         timing out.
         """
-        _warn_if_numeric_duration(timeout, "wait_for_unit")
 
         def check_active(_last_try: bool) -> bool:
             state = self.get_unit_property(unit, "ActiveState", user)
@@ -402,7 +369,7 @@ class BaseMachine(ABC):
             f"waiting for unit {unit}"
             + (f" with user {user}" if user is not None else "")
         ):
-            retry(check_active, as_timedelta(timeout))
+            retry(check_active, timeout)
 
     def get_unit_info(self, unit: str, user: str | None = None) -> dict[str, str]:
         """
@@ -476,14 +443,13 @@ class BaseMachine(ABC):
                     f"'{require_state}' but it is in state '{state}'"
                 )
 
-    def succeed(self, *commands: str, timeout: Duration | None = None) -> str:
+    def succeed(self, *commands: str, timeout: int | None = None) -> str:
         """
         Execute a shell command, raising an exception if the exit status is
         not zero, otherwise returning the standard output. Similar to `execute`,
         except that the timeout is `None` by default. See `execute` for details on
         command execution.
         """
-        _warn_if_numeric_duration(timeout, "succeed")
         output = ""
         for command in commands:
             with self.nested(f"must succeed: {command}"):
@@ -496,12 +462,11 @@ class BaseMachine(ABC):
                 output += out
         return output
 
-    def fail(self, *commands: str, timeout: Duration | None = None) -> str:
+    def fail(self, *commands: str, timeout: int | None = None) -> str:
         """
         Like `succeed`, but raising an exception if the command returns a zero
         status.
         """
-        _warn_if_numeric_duration(timeout, "fail")
         output = ""
         for command in commands:
             with self.nested(f"must fail: {command}"):
@@ -513,23 +478,14 @@ class BaseMachine(ABC):
                 output += out
         return output
 
-    def wait_until_succeeds(
-        self, command: str, timeout: Duration = dt.timedelta(minutes=15)
-    ) -> str:
+    def wait_until_succeeds(self, command: str, timeout: int = 900) -> str:
         """
-        Repeat a shell command on 1-second intervals until it succeeds.
-        Has a default timeout of 15 minutes which can be modified.
-        Example:
-            ```py
-            import datetime as dt
-
-            wait_until_succeeds(cmd, timeout=dt.timedelta(seconds=10))
-            ```
-        A bare number is still accepted and interpreted as a number of seconds.
-        See `execute` for details on command execution.
+        Repeat a shell command with 1-second intervals until it succeeds.
+        Has a default timeout of 900 seconds which can be modified, e.g.
+        `wait_until_succeeds(cmd, timeout=10)`. See `execute` for details on
+        command execution.
         Throws an exception on timeout.
         """
-        _warn_if_numeric_duration(timeout, "wait_until_succeeds")
         output = ""
 
         def check_success(_last_try: bool) -> bool:
@@ -538,16 +494,13 @@ class BaseMachine(ABC):
             return status == 0
 
         with self.nested(f"waiting for success: {command}"):
-            retry(check_success, as_timedelta(timeout))
+            retry(check_success, timeout)
             return output
 
-    def wait_until_fails(
-        self, command: str, timeout: Duration = dt.timedelta(minutes=15)
-    ) -> str:
+    def wait_until_fails(self, command: str, timeout: int = 900) -> str:
         """
         Like `wait_until_succeeds`, but repeating the command until it fails.
         """
-        _warn_if_numeric_duration(timeout, "wait_until_fails")
         output = ""
 
         def check_failure(_last_try: bool) -> bool:
@@ -556,76 +509,47 @@ class BaseMachine(ABC):
             return status != 0
 
         with self.nested(f"waiting for failure: {command}"):
-            retry(check_failure, as_timedelta(timeout))
+            retry(check_failure, timeout)
             return output
 
-    def sleep(
-        self,
-        secs: dt.timedelta | int | None = None,
-        duration: dt.timedelta | None = None,
-    ) -> None:
-        if secs is not None:
-            if duration is not None:
-                raise TypeError(
-                    "sleep() got both 'duration' and 'secs'. Pass only 'duration'"
-                )
-            if not isinstance(secs, dt.timedelta):
-                warnings.warn(
-                    "sleep(): The 'secs' argument is deprecated. Use 'duration' instead.",
-                )
-            duration = as_timedelta(secs)
-
-        if duration is None:
-            raise TypeError("sleep() missing required argument 'duration'")
-
+    def sleep(self, secs: int) -> None:
         # We want to sleep in *guest* time, not *host* time.
-        self.succeed(f"sleep {as_seconds(duration)}")
+        self.succeed(f"sleep {secs}")
 
-    def wait_for_file(
-        self, filename: str, timeout: Duration = dt.timedelta(minutes=15)
-    ) -> None:
+    def wait_for_file(self, filename: str, timeout: int = 900) -> None:
         """
         Waits until the file exists in the machine's file system.
         """
-        _warn_if_numeric_duration(timeout, "wait_for_file")
 
         def check_file(_last_try: bool) -> bool:
             status, _ = self.execute(f"test -e {filename}")
             return status == 0
 
         with self.nested(f"waiting for file '{filename}'"):
-            retry(check_file, as_timedelta(timeout))
+            retry(check_file, timeout)
 
     def wait_for_open_port(
-        self,
-        port: int,
-        addr: str = "localhost",
-        timeout: Duration = dt.timedelta(minutes=15),
+        self, port: int, addr: str = "localhost", timeout: int = 900
     ) -> None:
         """
         Wait until a process is listening on the given TCP port and IP address
         (default `localhost`).
         """
-        _warn_if_numeric_duration(timeout, "wait_for_open_port")
 
         def port_is_open(_last_try: bool) -> bool:
             status, _ = self.execute(f"nc -z {addr} {port}")
             return status == 0
 
         with self.nested(f"waiting for TCP port {port} on {addr}"):
-            retry(port_is_open, as_timedelta(timeout))
+            retry(port_is_open, timeout)
 
     def wait_for_open_unix_socket(
-        self,
-        addr: str,
-        is_datagram: bool = False,
-        timeout: Duration = dt.timedelta(minutes=15),
+        self, addr: str, is_datagram: bool = False, timeout: int = 900
     ) -> None:
         """
         Wait until a process is listening on the given UNIX-domain socket
         (default to a UNIX-domain stream socket).
         """
-        _warn_if_numeric_duration(timeout, "wait_for_open_unix_socket")
 
         nc_flags = [
             "-z",
@@ -639,26 +563,22 @@ class BaseMachine(ABC):
         with self.nested(
             f"waiting for UNIX-domain {'datagram' if is_datagram else 'stream'} on '{addr}'"
         ):
-            retry(socket_is_open, as_timedelta(timeout))
+            retry(socket_is_open, timeout)
 
     def wait_for_closed_port(
-        self,
-        port: int,
-        addr: str = "localhost",
-        timeout: Duration = dt.timedelta(minutes=15),
+        self, port: int, addr: str = "localhost", timeout: int = 900
     ) -> None:
         """
         Wait until nobody is listening on the given TCP port and IP address
         (default `localhost`).
         """
-        _warn_if_numeric_duration(timeout, "wait_for_closed_port")
 
         def port_is_closed(_last_try: bool) -> bool:
             status, _ = self.execute(f"nc -z {addr} {port}")
             return status != 0
 
         with self.nested(f"waiting for TCP port {port} on {addr} to be closed"):
-            retry(port_is_closed, as_timedelta(timeout))
+            retry(port_is_closed, timeout)
 
     def start_job(self, jobname: str, user: str | None = None) -> tuple[int, str]:
         """
@@ -677,7 +597,7 @@ class BaseMachine(ABC):
         command: str,
         check_return: bool = True,
         check_output: bool = True,
-        timeout: Duration | None = dt.timedelta(minutes=15),
+        timeout: int | None = 900,
     ) -> tuple[int, str]:
         """
         Execute a shell command, returning a list `(status, stdout)`.
@@ -707,23 +627,16 @@ class BaseMachine(ABC):
         the machine and would therefore break the pipe that would be used for
         retrieving the return code.
 
-        Has a default timeout of 15 minutes which can be modified.
-        Example:
-            ```py
-            import datetime as dt
-
-            execute(cmd, timeout=dt.timedelta(seconds=10))
-            execute(cmd, timeout=None)
-            ```
-        A bare number is still accepted and interpreted as a number of seconds.
+        A timeout for the command can be specified (in seconds) using the optional
+        `timeout` parameter, e.g., `execute(cmd, timeout=10)` or
+        `execute(cmd, timeout=None)`. The default is 900 seconds.
         """
-        _warn_if_numeric_duration(timeout, "execute")
         self.run_callbacks()
         return self._execute(
             command=command,
             check_return=check_return,
             check_output=check_output,
-            timeout=as_timedelta(timeout) if timeout is not None else None,
+            timeout=timeout,
         )
 
     @abstractmethod
@@ -732,7 +645,7 @@ class BaseMachine(ABC):
         command: str,
         check_return: bool = True,
         check_output: bool = True,
-        timeout: dt.timedelta | None = dt.timedelta(minutes=15),
+        timeout: int | None = 900,
     ) -> tuple[int, str]: ...
 
     def run_callbacks(self) -> None:
@@ -747,22 +660,25 @@ class BaseMachine(ABC):
     def copy_from_machine(self, source: str, target_dir: str = "") -> None:
         """Copy a file from the machine (specified by an in-machine source path) to a path
         relative to `$out`. The file is copied via the `shared_dir` shared among
-        all the machines.
+        all the machines (using a temporary directory).
         """
         # Compute the source, target, and intermediate shared file names
         vm_src = Path(source)
-        vm_intermediate = Path("/tmp/shared") / target_dir / vm_src.name
-        intermediate = self.shared_dir / target_dir / vm_src.name
-        # Copy the file to the shared directory inside machines
-        self.succeed(make_command(["mkdir", "-p", vm_intermediate.parent]))
-        self.succeed(make_command(["cp", "-r", vm_src, vm_intermediate]))
-        abs_target = self.out_dir / target_dir / vm_src.name
-        abs_target.parent.mkdir(exist_ok=True, parents=True)
-        # Copy the file from the shared directory outside machines
-        if intermediate.is_dir():
-            shutil.copytree(intermediate, abs_target)
-        else:
-            shutil.copy(intermediate, abs_target)
+        with tempfile.TemporaryDirectory(dir=self.shared_dir) as shared_td:
+            shared_temp = Path(shared_td)
+            vm_shared_temp = Path("/tmp/shared") / shared_temp.name
+            vm_intermediate = vm_shared_temp / vm_src.name
+            intermediate = shared_temp / vm_src.name
+            # Copy the file to the shared directory inside machines
+            self.succeed(make_command(["mkdir", "-p", vm_shared_temp]))
+            self.succeed(make_command(["cp", "-r", vm_src, vm_intermediate]))
+            abs_target = self.out_dir / target_dir / vm_src.name
+            abs_target.parent.mkdir(exist_ok=True, parents=True)
+            # Copy the file from the shared directory outside machines
+            if intermediate.is_dir():
+                shutil.copytree(intermediate, abs_target)
+            else:
+                shutil.copy(intermediate, abs_target)
 
     @warnings.deprecated("Use copy_from_machine() instead")
     def copy_from_vm(self, source: str, target_dir: str = "") -> None:
@@ -948,13 +864,10 @@ class QemuMachine(BaseMachine):
         )
         return output
 
-    def wait_until_tty_matches(
-        self, tty: str, regexp: str, timeout: Duration = dt.timedelta(minutes=15)
-    ) -> None:
+    def wait_until_tty_matches(self, tty: str, regexp: str, timeout: int = 900) -> None:
         """Wait until the visible output on the chosen TTY matches regular
         expression. Throws an exception on timeout.
         """
-        _warn_if_numeric_duration(timeout, "wait_until_tty_matches")
         matcher = re.compile(regexp)
 
         def tty_matches(last_try: bool) -> bool:
@@ -967,7 +880,7 @@ class QemuMachine(BaseMachine):
             return len(matcher.findall(text)) > 0
 
         with self.nested(f"waiting for {regexp} to appear on tty {tty}"):
-            retry(tty_matches, as_timedelta(timeout))
+            retry(tty_matches, timeout)
 
     def dump_tty_contents(self, tty: str) -> None:
         """Debugging: Dump the contents of the TTY<n>"""
@@ -978,7 +891,7 @@ class QemuMachine(BaseMachine):
         command: str,
         check_return: bool = True,
         check_output: bool = True,
-        timeout: dt.timedelta | None = dt.timedelta(minutes=15),
+        timeout: int | None = 900,
     ) -> tuple[int, str]:
         self.connect()
 
@@ -987,7 +900,7 @@ class QemuMachine(BaseMachine):
 
         timeout_str = ""
         if timeout is not None:
-            timeout_str = f"timeout {timeout.total_seconds()}"
+            timeout_str = f"timeout {timeout}"
 
         # While sh is bash on NixOS, this is not the case for every distro.
         # We explicitly call bash here to allow for the driver to boot other distros as well.
@@ -1079,9 +992,7 @@ class QemuMachine(BaseMachine):
             self.connected = False
 
     def wait_for_qmp_event(
-        self,
-        event_filter: Callable[[dict[str, Any]], bool],
-        timeout: Duration = dt.timedelta(minutes=10),
+        self, event_filter: Callable[[dict[str, Any]], bool], timeout: int = 60 * 10
     ) -> dict[str, Any]:
         """
         Wait for a QMP event which you can filter with the `event_filter` function.
@@ -1091,64 +1002,56 @@ class QemuMachine(BaseMachine):
         It will skip all events received in the meantime, if you want to keep them,
         you have to do the bookkeeping yourself and store them somewhere.
 
-        By default, it will wait up to 10 minutes.
+        By default, it will wait up to 10 minutes, `timeout` is in seconds.
         """
-        _warn_if_numeric_duration(timeout, "wait_for_qmp_event")
         if self.qmp_client is None:
             raise RuntimeError("QMP API is not ready yet, is the VM ready?")
 
-        timeout = as_timedelta(timeout)
-        start = time.monotonic()
+        start = time.time()
         while True:
             evt = self.qmp_client.wait_for_event(timeout=timeout)
             if event_filter(evt):
                 return evt
 
-            elapsed = dt.timedelta(seconds=time.monotonic() - start)
+            elapsed = time.time() - start
             if elapsed >= timeout:
                 raise TimeoutError
 
-    def send_chars(
-        self, chars: str, delay: Duration | None = dt.timedelta(milliseconds=10)
-    ) -> None:
+    def send_chars(self, chars: str, delay: float | None = 0.01) -> None:
         r"""
         Simulate typing a sequence of characters on the virtual keyboard,
         e.g., `send_chars("foobar\n")` will type the string `foobar`
         followed by the Enter key.
         """
-        _warn_if_numeric_duration(delay, "send_chars")
         with self.nested(f"sending keys {repr(chars)}"):
             for char in chars:
                 self.send_key(char, delay, log=False)
 
-    def wait_for_file(
-        self, filename: str, timeout: Duration = dt.timedelta(minutes=15)
-    ) -> None:
+    def wait_for_file(self, filename: str, timeout: int = 900) -> None:
         """
         Waits until the file exists in the machine's file system.
         """
-        _warn_if_numeric_duration(timeout, "wait_for_file")
 
         def check_file(_last_try: bool) -> bool:
             status, _ = self.execute(f"test -e {filename}")
             return status == 0
 
         with self.nested(f"waiting for file '{filename}'"):
-            retry(check_file, as_timedelta(timeout))
+            retry(check_file, timeout)
 
     def connect(self) -> None:
         """
         Wait for a connection to the guest root shell
         """
 
-        def shell_ready(timeout: dt.timedelta) -> bool:
+        def shell_ready(timeout_secs: int) -> bool:
             """We sent some data from the backdoor service running on the guest
             to indicate that the backdoor shell is ready.
             As soon as we read some data from the socket here, we assume that
             our root shell is operational.
             """
             assert self.shell
-            (ready, _, _) = select.select([self.shell], [], [], timeout.total_seconds())
+            (ready, _, _) = select.select([self.shell], [], [], timeout_secs)
             return bool(ready)
 
         if self.connected:
@@ -1162,7 +1065,7 @@ class QemuMachine(BaseMachine):
             tic = time.time()
 
             for _ in range(10):
-                if shell_ready(timeout=dt.timedelta(seconds=30)):
+                if shell_ready(timeout_secs=30):
                     break
                 self.log("Guest root shell did not produce any data yet...")
                 self.log(
@@ -1247,9 +1150,7 @@ class QemuMachine(BaseMachine):
         with self._managed_screenshot() as screenshot_path:
             return perform_ocr_on_screenshot(screenshot_path)
 
-    def wait_for_text(
-        self, regex: str, timeout: Duration = dt.timedelta(minutes=15)
-    ) -> None:
+    def wait_for_text(self, regex: str, timeout: int = 900) -> None:
         """
         Wait until the supplied regular expressions matches the textual
         contents of the screen by using optical character recognition (see
@@ -1259,7 +1160,6 @@ class QemuMachine(BaseMachine):
         This requires [`enableOCR`](#test-opt-enableOCR) to be set to `true`.
         :::
         """
-        _warn_if_numeric_duration(timeout, "wait_for_text")
 
         def screen_matches(last_try: bool) -> bool:
             variants = self.get_screen_text_variants()
@@ -1273,11 +1173,9 @@ class QemuMachine(BaseMachine):
             return False
 
         with self.nested(f"waiting for {regex} to appear on screen"):
-            retry(screen_matches, as_timedelta(timeout))
+            retry(screen_matches, timeout)
 
-    def wait_for_console_text(
-        self, regex: str, timeout: Duration | None = None
-    ) -> None:
+    def wait_for_console_text(self, regex: str, timeout: int | None = None) -> None:
         """
         Wait until the supplied regular expressions match a line of the
         serial console output.
@@ -1285,7 +1183,6 @@ class QemuMachine(BaseMachine):
 
         When this method returns, the console output that includes the match has already become part of get_console_log().
         """
-        _warn_if_numeric_duration(timeout, "wait_for_console_text")
         # Buffer the console output, this is needed
         # to match multiline regexes.
         console = io.StringIO()
@@ -1306,7 +1203,7 @@ class QemuMachine(BaseMachine):
 
         with self.nested(f"waiting for {regex} to appear on console"):
             if timeout is not None:
-                retry(console_matches, as_timedelta(timeout))
+                retry(console_matches, timeout)
             else:
                 console_matches(False, block=True)
 
@@ -1318,10 +1215,7 @@ class QemuMachine(BaseMachine):
         return "\n".join(self.full_console_log)
 
     def send_key(
-        self,
-        key: str,
-        delay: Duration | None = dt.timedelta(milliseconds=10),
-        log: bool | None = True,
+        self, key: str, delay: float | None = 0.01, log: bool | None = True
     ) -> None:
         """
         Simulate pressing keys on the virtual keyboard, e.g.,
@@ -1330,13 +1224,12 @@ class QemuMachine(BaseMachine):
         Please also refer to the QEMU documentation for more information on the
         input syntax: https://en.wikibooks.org/wiki/QEMU/Monitor#sendkey_keys
         """
-        _warn_if_numeric_duration(delay, "send_key")
         key = CHAR_TO_KEY.get(key, key)
         context = self.nested(f"sending key {repr(key)}") if log else nullcontext()
         with context:
             self.send_monitor_command(f"sendkey {key}")
             if delay is not None:
-                time.sleep(as_seconds(delay))
+                time.sleep(delay)
 
     def send_console(self, chars: str) -> None:
         r"""
@@ -1465,11 +1358,10 @@ class QemuMachine(BaseMachine):
         self.send_key("ctrl-alt-delete")
         self.connected = False
 
-    def wait_for_x(self, timeout: Duration = dt.timedelta(minutes=15)) -> None:
+    def wait_for_x(self, timeout: int = 900) -> None:
         """
         Wait until it is possible to connect to the X server.
         """
-        _warn_if_numeric_duration(timeout, "wait_for_x")
 
         def check_x(_last_try: bool) -> bool:
             cmd = (
@@ -1483,21 +1375,18 @@ class QemuMachine(BaseMachine):
             return status == 0
 
         with self.nested("waiting for the X11 server"):
-            retry(check_x, as_timedelta(timeout))
+            retry(check_x, timeout)
 
     def get_window_names(self) -> list[str]:
         return self.succeed(
             r"xwininfo -root -tree | sed 's/.*0x[0-9a-f]* \"\([^\"]*\)\".*/\1/; t; d'"
         ).splitlines()
 
-    def wait_for_window(
-        self, regexp: str, timeout: Duration = dt.timedelta(minutes=15)
-    ) -> None:
+    def wait_for_window(self, regexp: str, timeout: int = 900) -> None:
         """
         Wait until an X11 window has appeared whose name matches the given
         regular expression, e.g., `wait_for_window("Terminal")`.
         """
-        _warn_if_numeric_duration(timeout, "wait_for_window")
         pattern = re.compile(regexp)
 
         def window_is_visible(last_try: bool) -> bool:
@@ -1511,7 +1400,7 @@ class QemuMachine(BaseMachine):
             return any(pattern.search(name) for name in names)
 
         with self.nested("waiting for a window to appear"):
-            retry(window_is_visible, as_timedelta(timeout))
+            retry(window_is_visible, timeout)
 
     def forward_port(self, host_port: int = 8080, guest_port: int = 80) -> None:
         """
@@ -1761,7 +1650,7 @@ class NspawnMachine(BaseMachine):
         command: str,
         check_return: bool = True,
         check_output: bool = True,
-        timeout: dt.timedelta | None = dt.timedelta(minutes=15),
+        timeout: int | None = 900,
     ) -> tuple[int, str]:
         self.start()
 
@@ -1793,7 +1682,7 @@ class NspawnMachine(BaseMachine):
                 command,
             ],
             env={},
-            timeout=timeout.total_seconds() if timeout is not None else None,
+            timeout=timeout,
             stdout=subprocess.PIPE,
             text=True,
         )

nixos/lib/test-driver/src/test_driver/machine/qmp.py

@@ -1,4 +1,3 @@
-import datetime as dt
 import json
 import logging
 import os
@@ -75,19 +74,15 @@ class QMPSession:
         else:
             raise QMPAPIError(evt_or_result)
 
-    def wait_for_event(
-        self, timeout: dt.timedelta = dt.timedelta(seconds=10)
-    ) -> dict[str, Any]:
+    def wait_for_event(self, timeout: int = 10) -> dict[str, Any]:
         while self.pending_events.empty():
             self.read_pending_messages()
 
-        return self.pending_events.get(timeout=timeout.total_seconds())
+        return self.pending_events.get(timeout=timeout)
 
-    def events(
-        self, timeout: dt.timedelta = dt.timedelta(seconds=10)
-    ) -> Iterator[dict[str, Any]]:
+    def events(self, timeout: int = 10) -> Iterator[dict[str, Any]]:
         while not self.pending_events.empty():
-            yield self.pending_events.get(timeout=timeout.total_seconds())
+            yield self.pending_events.get(timeout=timeout)
 
     def send(self, cmd: str, args: dict[str, str] = {}) -> dict[str, str]:
         self.read_pending_messages()

nixos/lib/test-driver/src/test_driver/polling_condition.py

@@ -1,10 +1,7 @@
-import datetime as dt
 import time
-import warnings
 from collections.abc import Callable
 from math import isfinite
 
-from test_driver.duration import as_timedelta
 from test_driver.logger import AbstractLogger
 
 
@@ -14,7 +11,7 @@ class PollingConditionError(Exception):
 
 class PollingCondition:
     condition: Callable[[], bool]
-    interval: dt.timedelta
+    seconds_interval: float
     description: str | None
     logger: AbstractLogger
 
@@ -25,23 +22,11 @@ class PollingCondition:
         self,
         condition: Callable[[], bool | None],
         logger: AbstractLogger,
-        seconds_interval: float | None = None,
+        seconds_interval: float = 2.0,
         description: str | None = None,
-        *,
-        interval: dt.timedelta | None = None,
     ):
-        if seconds_interval is not None:
-            if interval is not None:
-                raise TypeError(
-                    "PollingCondition() got both 'interval' and 'seconds_interval' arguments. Pass only 'interval'"
-                )
-            warnings.warn(
-                "PollingCondition(): The 'seconds_interval' argument is deprecated. Use 'interval' instead.",
-            )
-            interval = as_timedelta(seconds_interval)
-
         self.condition = condition  # ty: ignore[invalid-assignment]
-        self.interval = interval if interval is not None else dt.timedelta(seconds=2)
+        self.seconds_interval = seconds_interval
         self.logger = logger
 
         if description is None:
@@ -93,11 +78,7 @@ class PollingCondition:
 
     @property
     def overdue(self) -> bool:
-        if not isfinite(self.last_called):
-            # `last_called` is `-inf` until the condition has run at least once.
-            return True
-        time_since_last = dt.timedelta(seconds=time.monotonic() - self.last_called)
-        return time_since_last > self.interval
+        return self.last_called + self.seconds_interval < time.monotonic()
 
     @property
     def entered(self) -> bool:

nixos/lib/test-script-prepend.py

@@ -1,7 +1,6 @@
 # This file contains type hints that can be prepended to Nix test scripts so they can be type
 # checked.
 
-import datetime as dt
 from contextlib import contextmanager
 from typing import Any, Callable, ContextManager, Generator, List, Optional, Union
 from unittest import TestCase
@@ -33,11 +32,10 @@ class CreateMachineProtocol(Protocol):
 class PollingConditionProtocol(Protocol):
     def __call__(
         self,
-        fun_: Callable | None = None,
+        fun_: Optional[Callable] = None,
         *,
-        seconds_interval: dt.timedelta | float | None = None,
-        interval: dt.timedelta | None = None,
-        description: str | None = None,
+        seconds_interval: float = 2.0,
+        description: Optional[str] = None,
     ) -> Union[Callable[[Callable], ContextManager], ContextManager]:
         raise Exception("This is just type information for the Nix test driver")
 
@@ -100,20 +98,12 @@ log: AbstractLogger = CompositeLogger([])
 
 
 def polling_condition(
-    fun_: Callable | None = None,
-    *,
-    seconds_interval: float | dt.timedelta | None = None,
-    interval: dt.timedelta | None = None,
-    description: str | None = None,
+    fun: Callable | None, seconds_interval: float = 0.0, description: str | None = None
 ):
     pass
 
 
-def retry(
-    fn: Callable,
-    timeout_seconds: int | dt.timedelta | None = None,
-    timeout: dt.timedelta | None = None,
-) -> None:
+def retry(fn: Callable, timeout_seconds: int = 900) -> None:
     pass
 
 

nixos/lib/testing/driver.nix

@@ -68,11 +68,9 @@ let
         ++ lib.optionals (!config.skipTypeCheck) [ hostPkgs.ty ]
         ++ lib.optionals (!config.skipLint) [ hostPkgs.ruff ];
         buildInputs = [ testDriver ];
+        testScript = config.testScriptString;
         preferLocalBuild = true;
-        passthru = config.passthru // {
-          # testScript used to be a part of the derivation attributes, kept for backwards compat.
-          testScript = config.testScriptString;
-        };
+        passthru = config.passthru;
         meta = config.meta // {
           mainProgram = "nixos-test-driver";
         };
@@ -84,7 +82,7 @@ let
           # prepend type hints so the test script can be type checked with ty
           cat "${../test-script-prepend.py}" >> testScriptWithTypes
           echo "${toString typeHints}" >> testScriptWithTypes
-          cat "${config.driverConfiguration.test_script}" >> testScriptWithTypes
+          echo -n "$testScript" >> testScriptWithTypes
         ''}
 
         ${lib.optionalString (!config.skipTypeCheck) ''

nixos/lib/testing/network.nix

@@ -93,7 +93,7 @@ let
               # We also want to test router protocols that enable connections
               # between nodes even if they don't share a VLAN, so we include
               # the primary IPs of all machines in the hosts file.
-              primaryIPs = lib.remove "" [
+              primaryIPs = [
                 remoteConfig.networking.primaryIPAddress
                 remoteConfig.networking.primaryIPv6Address
               ];

nixos/lib/utils.nix

@@ -42,29 +42,6 @@ let
 in
 
 let
-  hasSlashSuffix = hasSuffix "/";
-  isAbsolute = hasPrefix "/";
-
-  # normalisePath adds a slash at the end of the path if it didn't already
-  # have one.
-  #
-  # The reason slashes are added at the end of each path is to prevent `b`
-  # from accidentally depending on `a` in cases like
-  #    a = { mountPoint = "/aaa"; ... }
-  #    b = { device     = "/aaaa"; ... }
-  # Here a.mountPoint *is* a prefix of b.device even though a.mountPoint is
-  # *not* a parent of b.device. If we add a slash at the end of each string,
-  # though, this is not a problem: "/aaa/" is not a prefix of "/aaaa/".
-  normalisePath = path: "${path}${optionalString (!hasSlashSuffix path) "/"}";
-  normalise =
-    mount:
-    mount
-    // {
-      device = normalisePath (toString mount.device);
-      mountPoint = normalisePath mount.mountPoint;
-      depends = map normalisePath mount.depends;
-    };
-
   utils = rec {
 
     # Copy configuration files to avoid having the entire sources in the system closure
@@ -94,8 +71,29 @@ let
     fsBefore =
       a: b:
       let
+        # normalisePath adds a slash at the end of the path if it didn't already
+        # have one.
+        #
+        # The reason slashes are added at the end of each path is to prevent `b`
+        # from accidentally depending on `a` in cases like
+        #    a = { mountPoint = "/aaa"; ... }
+        #    b = { device     = "/aaaa"; ... }
+        # Here a.mountPoint *is* a prefix of b.device even though a.mountPoint is
+        # *not* a parent of b.device. If we add a slash at the end of each string,
+        # though, this is not a problem: "/aaa/" is not a prefix of "/aaaa/".
+        normalisePath = path: "${path}${optionalString (!(hasSuffix "/" path)) "/"}";
+        normalise =
+          mount:
+          mount
+          // {
+            device = normalisePath (toString mount.device);
+            mountPoint = normalisePath mount.mountPoint;
+            depends = map normalisePath mount.depends;
+          };
+
         a' = normalise a;
         b' = normalise b;
+
       in
       hasPrefix a'.mountPoint b'.device
       || hasPrefix a'.mountPoint b'.mountPoint
@@ -118,6 +116,7 @@ let
       in
       s:
       let
+        isAbsolute = hasPrefix "/" s;
         # path_simplify(): collapse duplicate slashes and drop "." components.
         rawComponents = filter (c: c != "" && c != ".") (splitString "/" s);
         # systemd accepts ".." only where it is redundant: a leading ".." in an
@@ -130,7 +129,7 @@ let
               acc: c:
               if c == ".." then
                 # A leading ".." in an absolute path is the only redundant case.
-                if isAbsolute s && acc.components == [ ] then acc else acc // { normalized = false; }
+                if isAbsolute && acc.components == [ ] then acc else acc // { normalized = false; }
               else
                 acc // { components = acc.components ++ [ c ]; }
             )
@@ -146,7 +145,7 @@ let
           else if simplified.components != [ ] then
             concatStringsSep "/" simplified.components
           # The root directory, and - matching systemd-escape - the empty string.
-          else if isAbsolute s || s == "" then
+          else if isAbsolute || s == "" then
             "/"
           # A relative path that reduces to nothing (e.g. "."), which has no
           # valid escaping.

nixos/modules/config/lix-remote-build.nix

@@ -1,220 +0,0 @@
-/*
-  Manages the remote build configuration toml as designed by lix, /etc/nix/machines.toml
-
-  See also
-   - ./nix.nix
-   - nixos/modules/services/system/nix-daemon.nix
-*/
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  inherit (lib)
-    any
-    concatMapStrings
-    concatStringsSep
-    filter
-    getVersion
-    mkIf
-    mkOption
-    optional
-    optionalString
-    types
-    versionAtLeast
-    ;
-
-  cfg = config.lix;
-
-  format = pkgs.formats.toml { };
-  configFile = format.generate "machines.toml" (
-    lib.filterAttrsRecursive (_: v: v != null) cfg.buildMachines
-  );
-
-in
-{
-  meta.maintainers = with lib.maintainers; [ rootile ];
-  options = {
-    lix.buildMachines = lib.mkOption {
-      default = { };
-      description = ''
-        Lix TOML configuration for remote builders
-      '';
-      type = types.submodule {
-        options = {
-          version = mkOption {
-            type = types.int;
-            default = 1;
-            example = 2;
-            description = ''
-              version of the TOML format.
-            '';
-            internal = true;
-          };
-          machines = mkOption {
-            type = types.attrsOf (
-              types.submodule {
-                freeformType = format.type;
-                options = {
-                  uri = mkOption {
-                    type = types.str;
-                    example = "ssh-ng://andesite@andesite.lix.systems";
-                    description = ''
-                      The URI of the remote store in the format
-                      `ssh[-ng]://[username@]hostname[?port=<port>]`, e.g. `ssh://nix@mac` or `ssh://mac`.
-                      If the ssh server is not listening on port 22 (e.g. port 1337 in this case)
-                      the URI would be `ssh[-ng]://nix@mac?port=1337`. The hostname
-                      may be an alias defined in your `~/.ssh/config`.
-                    '';
-                  };
-                  system-types = mkOption {
-                    type = types.nullOr (types.listOf types.str);
-                    default = null;
-                    example = [
-                      "x86_64-linux"
-                      "aarch64-linux"
-                    ];
-                    description = ''
-                      A list of Nix platform type identifiers, such as
-                      `x86_64-darwin`. It is possible for a machine to support multiple
-                      platform types, e.g., `i686-linux` and `x86_64-linux`.
-
-                    '';
-                  };
-                  ssh-key = mkOption {
-                    type = types.nullOr types.path;
-                    default = null;
-                    example = "/root/.ssh/id_buildhost_builduser";
-                    description = ''
-                      The path to the SSH private key with which to authenticate on
-                      the build machine. The private key must not have a passphrase.
-                      If null, the building user (root on NixOS machines) must have an
-                      appropriate ssh configuration to log in non-interactively.
-                    '';
-                  };
-                  jobs = mkOption {
-                    type = types.ints.u32;
-                    default = 1;
-                    description = ''
-                      The maximum number of builds that Lix will execute in parallel on
-                      the machine. Typically, this should be equal to the number of CPU
-                      cores divided by the cores within the target machines configuration, i.e. `jobs * cores ~= cpu cores`
-                    '';
-                  };
-                  speed-factor = mkOption {
-                    type = types.numbers.positive;
-                    default = 1;
-                    description = ''
-                      The “speed factor”, indicating the relative speed of the machine. If
-                      there are multiple machines of the right type, Lix will prefer the
-                      fastest, taking load into account.
-                    '';
-                  };
-                  mandatory-features = mkOption {
-                    type = types.nullOr (types.listOf types.str);
-                    default = null;
-                    example = [ "big-parallel" ];
-                    description = ''
-                      A list of *mandatory features*. A machine will only
-                      be used to build a derivation if all the machine’s mandatory
-                      features appear in the derivation’s `requiredSystemFeatures`
-                      attribute.
-                    '';
-                  };
-                  supported-features = mkOption {
-                    type = types.nullOr (types.listOf types.str);
-                    default = null;
-                    example = [
-                      "kvm"
-                      "big-parallel"
-                    ];
-                    description = ''
-                      A list of *supported features*. If a derivation has
-                      the `requiredSystemFeatures` attribute, then Lix will only schedule
-                      the derivation on a machine that has the specified features. For
-                      example, the attribute
-
-                      ```nix
-                      requiredSystemFeatures = [ "kvm" ];
-                      ```
-
-                      will cause the build to be performed on a machine that has the `kvm`
-                      feature.
-                    '';
-                  };
-                  ssh-public-host-key = mkOption {
-                    type = types.nullOr types.str;
-                    default = null;
-                    description = ''
-                      The public host key of this builder.
-                      If null, SSH will use its regular known-hosts file when connecting.
-                    '';
-                  };
-                  enable = mkOption {
-                    type = types.bool;
-                    default = true;
-                    description = ''
-                      Whether to enable this machine statically.
-                    '';
-                  };
-                };
-              }
-            );
-            default = { };
-            description = ''
-              This option lists the machines to be used if distributed builds are
-              enabled (see {option}`nix.distributedBuilds`).
-              Nix will perform derivations on those machines via SSH by copying the
-              inputs to the Nix store on the remote machine, starting the build,
-              then copying the output back to the local Nix store.
-            '';
-          };
-        };
-        freeformType = format.type;
-      };
-    };
-  };
-
-  config = mkIf (config.nix.enable && cfg.buildMachines.machines != { }) {
-    assertions =
-      let
-        badMachine = m: m.system-types == null || m.system-types == [ ];
-      in
-      [
-        {
-          assertion = !(any badMachine (builtins.attrValues cfg.buildMachines.machines));
-          message = ''
-            At least one system type (via `system-types`) must be set for every build machine.
-              Invalid machine specifications:
-          ''
-          + "      "
-          + (concatStringsSep "\n      " (
-            builtins.attrNames (lib.filterAttrs (_: badMachine) cfg.buildMachines.machines)
-          ));
-        }
-        {
-          assertion = config.nix.package.pname == "lix";
-          message = ''
-            TOML configuration of remote builders is only supported in lix.
-          '';
-        }
-        {
-          assertion = lib.versionAtLeast config.nix.package.version "2.95";
-          message = ''
-            TOML configuration was introduced in lix 2.95.0. Current version is ${config.nix.package.version}
-          '';
-        }
-        {
-          assertion = config.nix.buildMachines == [ ];
-          message = ''
-            mix-matching between lix and nix build machines is not supported.
-          '';
-        }
-      ];
-
-    nix.settings.builders = "@${configFile}";
-  };
-}

nixos/modules/config/nix.nix

@@ -91,25 +91,6 @@ let
       "nix.conf"
       cfg.settings;
 
-  makeNixBuildUser = nr: {
-    name = "nixbld${toString nr}";
-    value = {
-      description = "Nix build user ${toString nr}";
-
-      /*
-        For consistency with the setgid(2), setuid(2), and setgroups(2)
-        calls in `libstore/build.cc', don't add any supplementary group
-        here except "nixbld".
-      */
-      uid = builtins.add config.ids.uids.nixbld nr;
-      isSystemUser = true;
-      group = "nixbld";
-      extraGroups = [ "nixbld" ];
-    };
-  };
-
-  nixbldUsers = lib.listToAttrs (map makeNixBuildUser (lib.range 1 cfg.nrBuildUsers));
-
 in
 {
   imports = [
@@ -154,24 +135,6 @@ in
 
   options = {
     nix = {
-      enable = lib.mkOption {
-        type = lib.types.bool;
-        default = true;
-        description = ''
-          Whether to enable Nix.
-          Disabling Nix makes the system hard to modify and the Nix programs and configuration will not be made available by NixOS itself.
-        '';
-      };
-
-      package = lib.mkOption {
-        type = lib.types.package;
-        default = pkgs.nix;
-        defaultText = lib.literalExpression "pkgs.nix";
-        description = ''
-          This option specifies the Nix package instance to use throughout the system.
-        '';
-      };
-
       checkConfig = mkOption {
         type = types.bool;
         default = true;
@@ -198,16 +161,6 @@ in
         description = "Additional text appended to {file}`nix.conf`.";
       };
 
-      nrBuildUsers = lib.mkOption {
-        type = lib.types.int;
-        description = ''
-          Number of `nixbld` user accounts created to
-          perform secure concurrent builds.  If you receive an error
-          message saying that “all build users are currently in use”,
-          you should increase this value.
-        '';
-      };
-
       settings = mkOption {
         type = types.submodule {
           freeformType = semanticConfType;
@@ -413,20 +366,6 @@ in
   };
 
   config = mkIf cfg.enable {
-    environment.systemPackages = [
-      nixPackage
-      pkgs.nix-info
-    ]
-    ++ lib.optional config.programs.bash.completion.enable pkgs.nix-bash-completions;
-
-    systemd.tmpfiles.rules = [
-      "d  /nix/var                           0755 root root - -"
-      "L+ /nix/var/nix/gcroots/booted-system 0755 root root - /run/booted-system"
-      # Boot-time cleanup
-      "R! /nix/var/nix/gcroots/tmp           -    -    -    - -"
-      "R! /nix/var/nix/temproots             -    -    -    - -"
-    ];
-
     environment.etc."nix/nix.conf".source = nixConf;
     nix.settings = {
       trusted-public-keys = [ "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" ];
@@ -434,19 +373,5 @@ in
       substituters = mkAfter [ "https://cache.nixos.org/" ];
       system-features = defaultSystemFeatures;
     };
-
-    nix.nrBuildUsers = lib.mkDefault (
-      if cfg.settings.auto-allocate-uids or false then
-        0
-      else
-        lib.max 32 (if cfg.settings.max-jobs == "auto" then 0 else cfg.settings.max-jobs)
-    );
-
-    users.users = nixbldUsers;
-
-    services.displayManager.hiddenUsers = lib.attrNames nixbldUsers;
-
-    # Legacy configuration conversion.
-    nix.settings.sandbox-fallback = false;
   };
 }

nixos/modules/config/xdg/portals/wlr.nix

@@ -12,7 +12,7 @@ let
 in
 {
   meta = {
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ minijackson ];
   };
 
   options.xdg.portal.wlr = {

nixos/modules/hardware/nfc-nci.nix

@@ -181,6 +181,10 @@ in
       config.boot.kernelPackages.nxp-pn5xx
     ];
 
+    boot.kernelModules = [
+      "nxp-pn5xx"
+    ];
+
     # libnfc-nci calls sched_setscheduler via pthread_setschedparam, which would be blocked by upstream SystemCallFilter=~@resources
     systemd.services.pcscd.serviceConfig.SystemCallFilter = lib.mkIf cfg.enableIFD [
       "sched_setscheduler"