Release 26.11 ("Zokor", 2026.11/??)

Highlights

tranquil is an ATProto PDS (personal data server) implementation in Rust. A featureful, spec conscious and community driven alternative to the Bluesky reference implementation PDS. Available as services.tranquil-pds.
FlapAlerted, detects BGP flapping events and provides statistics based on BGP update messages. Available as services.flap-alerted.

boot.vesa has been removed. It was deprecated in 2020 because Xorg now works better with kernel modesetting. If you still need the legacy VESA 800x600 fallback, set boot.kernelParams = [ "vga=0x317" "nomodeset" ]; directly.
Support for the legacy U‐Boot image format has been removed from the initrd generators, as it is deprecated upstream and no longer used by any platform in Nixpkgs.
Python 2 has been removed from the top-level package set, as it is long past end-of-life. The python2, python27, python2Full, python27Full, python2Packages, and python27Packages attributes, along with the legacy python, pythonFull, and pythonPackages aliases, now throw an error directing you to python3. The isPy2 and isPy27 package flags have been removed accordingly. The only remaining Python 2 interpreter is vendored inside the resholve package for its oil dependency and is not exposed for general use.
services.timesyncd.extraConfig has been removed in favor of the structured option. Use services.timesyncd.settings.Time to set any timesyncd.conf(5) option directly. For example, replace services.timesyncd.extraConfig = "PollIntervalMaxSec=180"; with services.timesyncd.settings.Time.PollIntervalMaxSec = 180;.

boot.loader.systemd-boot gained support for Automatic Boot Assessment via the new boot.loader.systemd-boot.bootCounting options, allowing automatic detection of and recovery from bad NixOS generations. As part of this change, boot loader entries on the ESP/XBOOTLDR partition are now named nixos-<content-hash>.conf instead of nixos-generation-<n>.conf; existing entries are migrated automatically on the next nixos-rebuild boot/switch.
The newuidmap and newgidmap security wrappers are now installed with cap_setuid/cap_setgid file capabilities instead of the setuid-root bit, matching shadow's --with-fcaps install mode and other major distributions. Rootless containers (podman, docker-rootless, unprivileged user namespaces) are unaffected. The only behavioural change is that mapping host uid 0 via /etc/subuid (which NixOS never configures by default) additionally requires cap_setfcap; users who explicitly grant uid 0 in a subuid range can restore the previous behaviour with security.wrappers.newuidmap.capabilities = lib.mkForce "cap_setuid,cap_setfcap+ep";.