mirror of
https://github.com/NixOS/nixpkgs.git
synced 2026-08-27 02:34:53 +00:00
202 lines
17 KiB
Markdown
202 lines
17 KiB
Markdown
# Nixpkgs 26.11 ("Zokor", 2026.11/??) {#sec-nixpkgs-release-26.11}
|
||
|
||
## Highlights {#sec-nixpkgs-release-26.11-highlights}
|
||
|
||
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
|
||
|
||
- The {file}`nixexprs.tar.xz` tarball will be discontinued together with Nixpkgs
|
||
27.05 after 2027-12-31. Migrate to the {file}`nixexprs.tar.zst` tarball
|
||
instead.
|
||
|
||
This affects for example users who pull Nixpkgs as a flake input from
|
||
https://channels.nixos.org:
|
||
|
||
```diff
|
||
-nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.xz";
|
||
+nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.zst";
|
||
```
|
||
|
||
- `sing-box` now supports NaïveProxy outbounds.
|
||
|
||
## Backward Incompatibilities {#sec-nixpkgs-release-26.11-incompatibilities}
|
||
|
||
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
|
||
|
||
- `moon` has been updated to `2.x` and needs manual migration. See the [migration guide](https://moonrepo.dev/docs/migrate/2.0) for instructions.
|
||
|
||
- []{#x86_64-darwin-26.11}
|
||
|
||
Support for `x86_64-darwin` has been dropped, due to Apple’s deprecation of the platform and limited build infrastructure and developer time.
|
||
We will no longer build packages for the platform or support building them from source.
|
||
|
||
The Nixpkgs 26.05 stable branch will still maintain platform support and binaries will be built until it goes out of support at the end of 2026.
|
||
Users of `x86_64-darwin` will receive an error message explaining how to switch to 26.05.
|
||
|
||
By the time of this release, Homebrew will offer only limited [Tier 3](https://docs.brew.sh/Support-Tiers#tier-3) support for the platform, but MacPorts will likely continue to support it for a long time.
|
||
We also recommend users consider installing NixOS, which should continue to run on essentially all Intel Macs, especially after Apple stops security support for macOS 26 in 2028.
|
||
|
||
- `bundlerApp` now sets `__structuredAttrs = true` for its result package.
|
||
Out-of-tree packages passing `postBuild` to `bundlerApp` should examine if their `postBuild` commands are compatible with structured attributes.
|
||
|
||
- `databricks-cli` has been updated from `0.290.2` to `1.x.x`, the first major release. OAuth tokens for interactive logins (`auth_type = databricks-cli`) are now stored in the OS-native secure store by default (Secret Service on Linux) instead of `~/.databricks/token-cache.json`; cached tokens from older versions are not migrated, so run `databricks auth login` once per profile after upgrading. To keep the previous file-backed storage, set `DATABRICKS_AUTH_STORAGE=plaintext` or add `auth_storage = plaintext` under `[__settings__]` in `~/.databrickscfg`. Additionally, the `vector_search_endpoints` DABs resource renamed `min_qps` to `target_qps` (and the `vector-search-endpoints` command renamed `--min-qps` to `--target-qps`). See the [upstream changelog](https://github.com/databricks/cli/blob/main/CHANGELOG.md) for details.
|
||
|
||
- `hurl` has been updated to `8.x.x` which has some breaking changes. See [upstream changelog](https://github.com/Orange-OpenSource/hurl/releases/tag/8.0.0) for details.
|
||
|
||
- The existing `wasm32-wasi` target has become `wasm32-wasip1` and `pkgsCross.wasi32` has become `pkgsCross.wasm32-wasip1`, aligning with LLVM's nomenclature. Aliases are in place and old forms will continue to be parsed but there might be some breakage if you're relying on the exact form of these (e.g., in sysroot paths).
|
||
|
||
- `gotosocial` has been updated to 0.22.0. This release contains a very long database migration, which should not be cancelled or interrupted under any circumstances.
|
||
- Postgres users: Following the migration, if you encounter slowdown on Postgres specifically (ie., timing out while loading timelines) you may need to run some manual database maintenance steps. Please check https://docs.gotosocial.org/en/stable/admin/database_maintenance/#postgres.
|
||
|
||
- `xsecurelock` no longer supports authentication via htaccess files (`~/.xsecurelock.pw`) or via the `pamtester` program by default. Only the recommended PAM module is supported unless rebuilt with `withHtaccess` or `withPamtester`.
|
||
|
||
- `python3Packages.django-health-check` has been updated to major version 4. See its [migration guide](https://codingjoe.dev/django-health-check/migrate-to-v4/) and [changelog](https://github.com/codingjoe/django-health-check/releases/tag/4.0.0) for breaking changes.
|
||
|
||
- `jmtpfs` has been removed due to lack of maintenance and fuse3 support.
|
||
|
||
- `libgdata` has been removed, as it was archived upstream and relied on the insecure libsoup 2.4.
|
||
|
||
- `mcphost` has been removed, as it was archived upstream and declared unmaintained.
|
||
|
||
- `fflogs` has been removed because it was no longer functional. Users should switch to `archon-lite`.
|
||
|
||
- `keycloak.plugins.scim-for-keycloak` has been removed. The upstream open-source project is [end-of-life](https://github.com/Captain-P-Goldfish/scim-for-keycloak) and its last release targets Keycloak 20, which is incompatible with the packaged Keycloak.
|
||
|
||
- `keycloak.plugins.scim-keycloak-user-storage-spi` has been removed. Upstream has moved the plugin into Keycloak itself as the experimental `ipatuura` federation provider and no longer maintains the standalone repository.
|
||
|
||
- `services.mysql` now sets `root@localhost` authentication to `auth_socket` when used with `mysql` or `percona-server`.
|
||
Existing deployments will also be adjusted if possible. See the [security advisory GHSA-6qxx-6rg8-c4p8](https://github.com/NixOS/nixpkgs/security/advisories/GHSA-6qxx-6rg8-c4p8) for more information.
|
||
|
||
- `zerofs` has been updated from `1.x` to `2.x` which is a breaking change. Volumes created by earlier releases are refused at open with a clear error. There is no migration tool; older volumes remain readable and writable by the release that created them.
|
||
|
||
- `keycloak.plugins.keycloak-metrics-spi` has been removed. Keycloak exposes Prometheus metrics natively on its management interface; enable them with the `metrics-enabled` setting (and `event-metrics-user-enabled` for login and event counters). See [Gaining insights with metrics](https://www.keycloak.org/observability/configuration-metrics).
|
||
|
||
- `alps` has been rewritten upstream, see [upstream repository](https://github.com/migadu/alps) for documentation.
|
||
|
||
- `bosun` has been removed as it is no longer maintained upstream. the corresponding monitoring options has been removed.
|
||
|
||
- `uhttpmock` providing 0.0 ABI was removed. `uhttpmock_1_0` providing 1.0 ABI was renamed to `uhttpmock` and `uhttpmock_1_0` was kept as an alias.
|
||
|
||
- `himalaya` has been updated from `v1.2.0` to `v2.0.0`, which introduces breaking changes. See the [release notes](https://github.com/pimalaya/himalaya/releases/tag/v2.0.0) and the [migration guide](https://github.com/pimalaya/himalaya/blob/master/MIGRATION.md).
|
||
|
||
- `tengine` has been removed as it has seen seriously delayed responses to security vulnerabilities.
|
||
|
||
- `nix-serve-ng` (and `haskellPackages.nix-serve-ng`) is now built against Lix instead of CppNix, following upstream which has switched to Lix as its supported Nix implementation.
|
||
|
||
- `buildPythonPackage` and `buildPythonApplication` now set `__structuredAttrs = true` by default. You can explicitly set `__structuredAttrs = false` in packages broken by this change.
|
||
|
||
- Linux kernel configuration has been moved out of the `linux-kernel` field of the platform structure into the kernel builders:
|
||
- `linux-kernel.name` has been removed.
|
||
- `linux-kernel.target` is available as the `target` parameter and passthru attribute on the kernel builders.
|
||
- `linux-kernel.installTarget` has been removed, as it should not be necessary to customize.
|
||
- `linux-kernel.DTB` is available as the `buildDTBs` parameter and passthru attribute on the kernel builders.
|
||
- `linux-kernel.{autoModules,preferBuiltin,extraConfig}` were already available as kernel builder parameters.
|
||
|
||
- The `img` argument of `vmTools` has been renamed to `kernelImage`, as it collided with the top-level `img` package.
|
||
Additionally, the kernel module tree used inside the VM has been split out of the `kernel` argument into a new `kernelModules` argument (defaulting to `kernel`).
|
||
Callers that overrode `kernel` with a module tree (e.g. from `pkgs.aggregateModules`) to make extra modules available must now pass it via `kernelModules` instead, keeping `kernel` pointing at a bootable kernel derivation.
|
||
|
||
- The ARMv5 Linux kernel build now uses a standard configuration and generates a standard compressed image instead of the deprecated legacy U‐Boot image format.
|
||
`lib.systems.{examples,platforms}.{sheevaplug,pogoplug4}` have been unified into `lib.systems.examples.armv5tel-multiplatform`.
|
||
Note that there is no official support for ARMv5 and it is not possible to build even a simple NixOS configuration out of the box.
|
||
|
||
- `pdns` has been updated from `5.0.x` to `5.1.x`. Please be sure to review the [Upgrade Notes](https://doc.powerdns.com/authoritative/upgrading.html#to-5-1-0) before upgrading. Namely LUA record updates are no longer allowed by default, and the embedded webserver no longer includes a `access-control-allow-origin: *` header by default.
|
||
|
||
- `davmail` no longer supports building with GTK 2, and the `preferGtk3` override flag has been removed as GTK 3 is always used.
|
||
|
||
- Support for the legacy U‐Boot image format has been removed from the Linux kernel builders, as it is deprecated upstream and no longer used by any platform in Nixpkgs.
|
||
|
||
- `etcd_3_4` package was dropped, as it's gone EOL. Please upgrade to either 3.5 or 3.6. See [migration notes](https://etcd.io/docs/v3.6/upgrades/upgrade_3_6/) for incompatibilities and upgrade procedure.
|
||
|
||
- `rke2` retires ingress-nginx and transitions to Traefik starting in `rke2_1_36`. Because ingress-nginx was retired upstream as of March 2026, Traefik is now the default
|
||
for new clusters starting in v1.36 (existing clusters will keep their current ingress upon upgrade to avoid breakage). This transition brings the following structural changes:
|
||
- Airgapped Environments: The rke2-images-core tarball now contains Traefik images instead of ingress-nginx. The standalone rke2-images-traefik tarball has been removed.
|
||
Users who must continue using ingress-nginx will now need to manually provide the rke2-images-ingress-nginx tarball.
|
||
- Future Removal: The ingress-nginx chart will not receive any additional updates and will be completely removed in v1.37 for community users.
|
||
|
||
- `buildFHSEnvChroot` has been removed after deprecation in 23.05.
|
||
|
||
- `leafnode` has been removed, as it was an unmaintained alpha-release of leafnode 2 and has a dependency on the EOL PRCE-library. Consider using `leafnode1` instead, which is still maintained.
|
||
|
||
- `gh-actions-cache` has been removed since its functionality has been integrated directly into `gh` (`gh cache`). See [upstream readme](https://github.com/actions/gh-actions-cache).
|
||
|
||
- The OCaml-based Xen Store Daemon has been split off the `xen` package, and is now present in the `ocamlPackages.oxenstored` package.
|
||
|
||
- `requireFile` now sets `meta.license = lib.licenses.unfree` by default. Users of `requireFile`-based derivations that preserve this default will need to explicitly allow their evaluation as described in [](#sec-allow-unfree).
|
||
|
||
- `texlive.combine` is deprecated and scheduled for removal in 27.05. Please migrate to `texliveSmall.withPackages` (see [](#sec-language-texlive-user-guide)).
|
||
|
||
- `keycloak` was updated to >= 26.7.0 and includes some breaking internal (API) changes. See the [upstream migration guide](https://www.keycloak.org/docs/latest/upgrading/#migrating-to-26-7-0) for more information.
|
||
|
||
- `librest` providing 0.7 ABI was removed. `librest_1_0` providing 1.0 ABI was renamed to `librest` and `librest_1_0` was kept as an alias.
|
||
|
||
- `luaPackages.lrexlib-pcre` has been removed as part of the process to fully migrate from the end-of-life PRCE library to PCRE2. `luaPackages.lrexlib-pcre2` and multiple other versions of lrexlib can be used instead.
|
||
|
||
- `pnpm_10` was upgraded to version 10.34.1+, which introduced stricter integrity checks. If you encounter `ERR_PNPM_MISSING_TARBALL_INTEGRITY`, you can fall back to the older `pnpm_10_34_0`.
|
||
|
||
- `fetchPnpmDeps`' `fetcherVersion = 1` and `fetcherVersion = 2` have been
|
||
removed, as announced in the 26.05 release. Packages still using them now
|
||
throw an evaluation error and must migrate to `fetcherVersion = 3` (or later)
|
||
and regenerate their hashes. See the
|
||
[pnpm `fetcherVersion` section](#javascript-pnpm-fetcherVersion) of the manual
|
||
for details.
|
||
|
||
- `makeSetupHook` now uses structured attributes and only makes substitutions based on the values of the `substitutions` argument - other derivation attributes are no longer considered.
|
||
|
||
- `rebuilderd` has been updated to 0.27.0 introducing breaking changes. See upstream changelog for details: [0.26.0](https://github.com/kpcyrd/rebuilderd/releases/tag/v0.26.0), [0.27.0](https://github.com/kpcyrd/rebuilderd/releases/tag/v0.27.0)
|
||
|
||
- Starting with v14, `flameshot` will primarily utilise xdg-desktop-portal calls for screenshotting. This will directly affect users on X11 window managers due to the lack of a compatible portal with Screenshot feature. See [upstream changelog](https://github.com/flameshot-org/flameshot/releases/tag/v14.0.0) or [NixOS Flameshot](https://wiki.nixos.org/wiki/Flameshot) wiki page for workarounds.
|
||
- `nim1` and respective aliases have been removed due to entering EOL; please migrate to `nim` or `nim-unwrapped` (nim 2).
|
||
- `nim-2_0` & `nim-2_2` and respective aliases have been removed; please migrate to `nim` or `nim-unwrapped` (nim 2.2.10).
|
||
- `domoticz` has been updated from `2024.7` to `2026.x`, breaking third party applications and scripts using the old RType calls. Review the [release notes](https://github.com/domoticz/domoticz/blob/2026.2/History.txt#L398) for more information.
|
||
|
||
- `vimacs` has been removed, as it has not been maintained in 10 years and was built for an old version of vim (6.0).
|
||
|
||
- The deprecated `appimageTools.extractType1`, `appimageTools.extractType2`, and `appimageTools.wrapType1` aliases now emit warnings. Use `appimageTools.extract` and `appimageTools.wrapType2` instead.
|
||
|
||
## Other Notable Changes {#sec-nixpkgs-release-26.11-notable-changes}
|
||
|
||
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
|
||
|
||
- `super-productivity` has been updated. The binary has been renamed from `super-productivity` to `superproductivity`. A symlink from the old name is provided for backward compatibility.
|
||
|
||
- `buildFHSEnv`, `appimageTools.wrapAppImage`, and `appimageTools.wrapType2` now support the `finalAttrs` pattern. When using `wrapAppImage`, it is now recommended to pass the extracted AppImage to the `contents` attribute (instead of `src`), to avoid shadowing `src`. Passing the extracted contents to `src` is now deprecated and will be removed in a future release.
|
||
|
||
- Package-URL (PURL, https://github.com/package-url/purl-spec) metadata identifier has been added for `fetchgit`, `fetchpypi` and `fetchFromGithub` fetchers.
|
||
`mkDerivation` has been adjusted to reuse this information.
|
||
Package-URLs allow reliably identifying and locating software packages.
|
||
Maintainers of derivations using the adapted fetchers should rely on the `drv.src.meta.identifiers.v1.purl` default identifier and can enhance their `drv.meta.identifiers.v1.purls` list once they would like to have additional identifiers.
|
||
Maintainers using `fetchurl` for `drv.src` are urged to adapt their `drv.meta.identifiers.purlParts` for proper identification.
|
||
|
||
- The fwts efi-runtime kernel module was removed.
|
||
|
||
- `homebox` v0.26.0 introduced a new, required value to be set, `HBOX_AUTH_API_KEY_PEPPER`. If one is not provided the module will create one, it is recommended that you back this up as it is part of API Key generation and validation.
|
||
|
||
- Emacs loads the `early-default` library after `early-init.el`.
|
||
Users can add `early-init.el` via `emacs.pkgs.withPackages`
|
||
by packaging `early-init.el` into a library named `early-default`.
|
||
To prevent loading the `early-default` library,
|
||
set `inhibit-early-default-init` in `early-init.el`.
|
||
|
||
- `services.ceph` enabled the generation of Ceph log files at `/var/log/ceph/`.
|
||
They were missing before because Ceph omitted logs when this directory was missing.
|
||
Ceph logs can grow large, so you may want to configure rotation of these logs.
|
||
|
||
## Nixpkgs Library {#sec-nixpkgs-release-26.11-lib}
|
||
|
||
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
|
||
|
||
### Breaking changes {#sec-nixpkgs-release-26.11-lib-breaking}
|
||
|
||
- `fittrackee` 1.0.0 now requires postgres with postgis. The [upgrade guide](https://docs.fittrackee.org/en/upgrading-to-1.0.0.html) has steps to prepare for this upgrade.
|
||
|
||
### Deprecations {#sec-nixpkgs-release-26.11-lib-deprecations}
|
||
|
||
- Setting `config.allowBrokenPredicate` is deprecated in favor of
|
||
using `config.problems.handlers.PackageName.broken = "warn"` (or `=
|
||
"ignore"`). For more information see [](#sec-allow-broken).
|
||
|
||
|
||
### Additions and Improvements {#sec-nixpkgs-release-26.11-lib-additions-improvements}
|
||
|
||
- Create the first release note entry in this section!
|