diff --git a/doc/release-notes/rl-2505.section.md b/doc/release-notes/rl-2505.section.md index 9112dda5695c..ae591ca87f1c 100644 --- a/doc/release-notes/rl-2505.section.md +++ b/doc/release-notes/rl-2505.section.md @@ -24,11 +24,19 @@ - The Factor programming language packages were reworked. `factor-lang-scope` is now named `factorPackages` and provides a `buildFactorApplication` function to deploy Factor programs as binaries. It has also received proper documentation in the Nixpkgs manual. +- The packaging of Mesa graphics drivers has been significantly reworked, in particular: + - Applications linked against different Mesa versions than installed on the system should now work correctly going forward (however, applications against older Mesa, e.g. from Nixpkgs releases before 25.05, remain broken) + - Packages that used to depend on Mesa for libgbm or libdri should use `libgbm` or `dri-pkgconfig-stub` as inputs, respectively + +- OpenSSH has been updated from 9.9p2 to 10.0p2, dropping support for DSA keys and adding a new `ssh-auth` binary to handle user authentication in a different address space from unauthenticated sessions. Additionally, we now enable a configure option by default that attempts to lock sshd into RAM to prevent it from being swapped out, which may improve performance if the system is under memory pressure. See the [full changelog](https://www.openwall.com/lists/oss-security/2025/04/09/1) for more details. + - Emacs has been updated to 30.1. This introduces some backwards‐incompatible changes; see the NEWS for details. NEWS can been viewed from Emacs by typing `C-h n`, or by clicking `Help->Emacs News` from the menu bar. It can also be browsed [online](https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-30). +- The `intel` video driver for X.org (from the xf86-video-intel package, which was previously removed because it was non-functional) has been fixed and the driver has been re-introduced. + - The default openexr version has been updated to 3.2.4. - The default PHP version has been updated to 8.4. @@ -56,6 +64,8 @@ The hook can be disabled by providing `dontCheckForBrokenSymlinks = true;` as an argument to `mkDerivation`. For more information, [check the docs](https://nixos.org/manual/nixpkgs/unstable/#no-broken-symlinks.sh) or [see this PR](https://github.com/NixOS/nixpkgs/pull/370750). +- `gkraken` has been removed. The recommended alternative is `coolercontrol`. + - `opensmtpd-extras` has been deprecated by upstream and is not compatible with OpenSMTPD 7.6.0 or later. The package has been removed in favor of a set of new `opensmtpd-table-*` packages. @@ -64,20 +74,42 @@ configuration settings. Notably, it now defaults to listening on a socket rather than a port. See [Migrating from version 1.x](https://github.com/roehling/postsrsd/blob/2.0.10/README.rst#migrating-from-version-1x) and [Postfix Setup](https://github.com/roehling/postsrsd?tab=readme-ov-file#postfix-setup) for details. +- `renovate` was updated to v39. See the [upstream release notes](https://docs.renovatebot.com/release-notes-for-major-versions/#version-39) for breaking changes. + Like upstream's docker images, renovate now runs on NodeJS 22. + - The hand written `perlPackages.SearchXapian` bindings have been dropped in favor of the (mostly compatible) `perlPackages.Xapian`. +- `varnish` was updated from 7.5.0 to 7.7.0, see [Varnish 7.6.0 upgrade guide](https://varnish-cache.org/docs/7.6/whats-new/upgrading-7.6.html) and +[Varnish 7.7.0 upgrade guide](https://varnish-cache.org/docs/7.7/whats-new/upgrading-7.7.html#whatsnew-upgrading-7-7). + - The `config` triple for `aarch64-darwin` has been changed from `aarch64-apple-darwin` to `arm64-apple-darwin` to match the Apple toolchain and LLVM’s expectations. - The `electron` packages will now provide their headers (available via `electron.headers`) in extracted form instead of in a tarball. +- The udev rules of the `libjaylink` package require users to be in the `jlink` instead of `plugdev` group now, since the `plugdev` group is very uncommon for NixOS. Alternatively, access is granted to seat sessions. + - The `ephemeral` package was removed due to upstream archival in early 2022. +- The `gotenberg` package has been updated to 8.16.0, which brings breaking changes to the configuration from version 8.13.0. See the [upstream release notes](https://github.com/gotenberg/gotenberg/releases/tag/v8.13.0) for that release to get all the details. + +- `zammad` has had its support for MySQL removed, since it was never working correctly and is now deprecated upstream. Check the [migration guide](https://docs.zammad.org/en/latest/appendix/migrate-to-postgresql.html) for how to convert your database to PostgreSQL. + - The `vocal` package was removed due to upstream archival. The upstream developer suggests using `gnome-podcasts` or `kasts` instead. +- `timescaledb` requires manual upgrade steps. + After you run ALTER EXTENSION, you must run [this SQL script](https://github.com/timescale/timescaledb-extras/blob/master/utils/2.15.X-fix_hypertable_foreign_keys.sql). For more details, see the following pull requests [#6797](https://github.com/timescale/timescaledb/pull/6797). + PostgreSQL 13 is no longer supported in TimescaleDB v2.16. + +- `paperless-ngx` has been updated to minor version 2.15 which switched the web server from Gunicorn to Granian. If you set Gunicorn specific envs (usually contain GUNICORN) they must be updated. + - [testers.shellcheck](https://nixos.org/manual/nixpkgs/unstable/#tester-shellcheck) now warns when `name` is not provided. The `name` argument will become mandatory in a future release. +- `tauon` 7.9.0+ when launched for the first time, migrates its database to a new schema that is not backwards compatible. Older versions will refuse to start at all with that database afterwards. If you need to still use older tauon versions, make sure to back up `~/.local/share/TauonMusicBox`. + +- `aws-workspaces` has dropped support for PCoiP networking. + - [GIMP 3.0](https://www.gimp.org/news/2025/03/16/gimp-3-0-released/) available as `gimp3`. - `grafana-agent` and `services.grafana-agent` have been removed in favor of @@ -86,10 +118,35 @@ Grafana recommends migrating to `grafana-alloy` (`services.alloy`). See https://grafana.com/docs/alloy/latest/set-up/migrate/ for details. +- `slskd` has been updated to v0.22.3, which includes breaking changes to `script` integrations. Please review the [changelog](https://github.com/slskd/slskd/releases/tag/0.22.3) + and the accompanying [pull request](https://github.com/slskd/slskd/pull/1292). + +- `forgejo` and `forgejo-lts` have been updated to v11. + See upstreams [release blog post](https://forgejo.org/2025-04-release-v11-0/) for more information. + +- `unifi` has been updated to v9.1. + This version should be backward compatible with v8.x, however as a result, `unifi8` package has been removed. + - `xdragon` package has been renamed to `dragon-drop`. `xdragon` is an alias to `dragon-drop` and the package still provides `bin/xdragon`. `bin/dragon` is no longer supplied. +- `python3Packages.bpycv` has been removed due to being incompatible with Blender 4 and unmaintained. + +- `python3Packages.jaeger-client` was removed because it was deprecated upstream. [OpenTelemetry](https://opentelemetry.io) is the recommended replacement. + +- `rocmPackages_6` has been updated to ROCm 6.3. + +- `rocmPackages_5` has been removed. + +- `rocmPackages.rocm-thunk` has been removed and its functionality has been integrated with the ROCm CLR. Use `rocmPackages.clr` instead. + +- `rocmPackages.clang-ocl` has been removed. [It was deprecated by AMD in 2023.](https://github.com/ROCm/clang-ocl) + +- `nodePackages.meshcommander` has been removed, as the package was deprecated by Intel. + +- The default version of `z3` has been updated from 4.8 to 4.13. There are still a few packages that need specific older versions; those will continue to be maintained as long as other packages depend on them but may be removed in the future. + - The `nixLog*` family of functions made available through the standard environment have been rewritten to prefix messages with both the debug level and the function name of the caller. The `nixLog` function, which logs unconditionally, was also re-introduced and modified to prefix messages with the function name of the caller. For more information, [see this PR](https://github.com/NixOS/nixpkgs/pull/370742). @@ -112,6 +169,10 @@ and the [4.2 release](https://github.com/netbox-community/netbox/releases/tag/v4.2.0), make the required changes to your database, if needed, then upgrade by setting `services.netbox.package = pkgs.netbox_4_2;` in your configuration. +- `nodePackages.expo-cli` has been removed, as it was deprecated by upstream. The suggested replacement is the `npx expo` command. + +- The `conduwuit` matrix server implementation has officially been discontinued by upstream and the package has thus been marked as vulnerable, as it is a security-sensitive package that has reached EOL. + - NetBox version 4.0.X available as `netbox_4_0` was removed. Please upgrade to `4.2`. - `golangci-lint` has reached `v2`. Please read the changes and view the migration guide [here](https://golangci-lint.run/product/changelog/#200). @@ -331,6 +392,7 @@ - `docker_24` has been removed, as it was EOL with vulnerabilities since June 08, 2024. - Emacs 28 and 29 have been removed. + - Emacs 28 Macport has been removed, while CVEs of Emacs 29 Macport are patched. - `containerd` has been updated to v2, which contains breaking changes. See the [containerd @@ -381,6 +443,8 @@ - `titaniumenv`, `titanium`, and `titanium-alloy` have been removed due to lack of maintenance in Nixpkgs []{#sec-nixpkgs-release-25.05-incompatibilities-titanium-removed}. +- `octave` (and `octaveFull`) was updated to version `10.x`. The update broke a few `octavePackages`, and `librsb`. See [the PR's commits](https://github.com/NixOS/nixpkgs/pull/394495/commits) for more details. + - androidenv has been improved: - All versions specified in composeAndroidPackages now track the latest. Android packages are automatically updated on unstable, and run the androidenv test suite on every update. - Many androidenv packages are now searchable on [search.nixos.org](https://search.nixos.org). @@ -390,14 +454,71 @@ - `gerbera` now has wavpack support. +- `buildPythonPackage`, `buildPythonApplication` and the Python building setup hooks now support both `__structuredAttrs = true` and `__structuredAttrs = false`. + +- `buildGoModule` now supports a self-referencing `finalAttrs:` parameter + containing the final arguments including overrides. + This allows packaging configuration to be overridden in a consistent manner by + providing an alternative to `rec {}` syntax. + +- Caddy can now be built with plugins by using `caddy.withPlugins`, a `passthru` function that accepts an attribute set as a parameter. The `plugins` argument represents a list of Caddy plugins, with each Caddy plugin being a versioned module. The `hash` argument represents the `vendorHash` of the resulting Caddy source code with the plugins added. + + Example: + ```nix + let + pkgs = import { }; + in + + pkgs.caddy.withPlugins { + plugins = [ + # tagged upstream + "github.com/caddy-dns/powerdns@v1.0.1" + # pseudo-version number generated by Go + "github.com/caddy-dns/cloudflare@v0.0.0-20240703190432-89f16b99c18e" + "github.com/mholt/caddy-webdav@v0.0.0-20241008162340-42168ba04c9d" + ]; + hash = "sha256-wqXSd1Ep9TVpQi570TTb96LwzNYvWL5EBJXMJfYWCAk="; + } + ``` + + To get the necessary hash of the vendored dependencies, omit `hash`. The build will fail and tell you the correct value. + + Note that all provided plugins must have versions/tags (string after `@`), even if upstream repo does not tag each release. For untagged plugins, you can either create an empty Go project and run `go get ` and see changes in `go.mod` to get the pseudo-version number, or provide a commit hash in place of version/tag for the first run, and update the plugin string based on the error output. + + - GOverlay has been updated to 1.2, please check the [upstream changelog](https://github.com/benjamimgois/goverlay/releases) for more details. - `tpm2-pkcs11` now has the variant `tpm2-pkcs11-fapi`, which has been patched to default to the Feature API backend. It has also been split into `tpm2-pkcs11-esapi`, which _only_ supports the older Enhanced System API backend. Note the [differences](https://github.com/tpm2-software/tpm2-pkcs11/blob/1.9.1/docs/FAPI.md), and that `tpm2-pkcs11` itself still needs `TPM2_PKCS11_BACKEND=fapi` exported in order to use the Feature API, whereas `tpm2-pkcs11-fapi` does not, and `tpm2-pkcs11-esapi` just does not support fapi entirely. - For matrix homeserver Synapse we are now following the upstream recommendation to enable jemalloc as the memory allocator by default. +- Mattermost, a self-hosted chat collaboration platform supporting calls, playbooks, and boards, has been updated. It now has multiple versions, disabled telemetry, and a native frontend build in nixpkgs, removing all upstream prebuilt blobs. + - A new `pkgs.mattermost.buildPlugin` function has been added, which allows plugins to be built from source, including webapp frontends with a supported package-lock.json. See the Mattermost NixOS test and [manual](https://nixos.org/manual/nixos/unstable#sec-mattermost-plugins-build) for an example. + - The Mattermost frontend is now built from source and can be overridden. Note that the Mattermost derivation containing both the webapp and server is now wrapped to allow them to be built independently, so overrides to both webapp and server look like `mattermost.overrideAttrs (prev: { webapp = prev.webapp.override { ... }; server = prev.server.override { ... }; })` now. + - `pkgs.mattermost` has been updated from 9.11 to 10.5 to track the latest extended support release, since 9.11 will become end-of-life during the lifetime of NixOS 25.05. + - `pkgs.mattermostLatest` is now an option to track the latest (non-prerelease) Mattermost release. We test upgrade migrations from ESR releases (`pkgs.mattermost`) to `pkgs.mattermostLatest`. + +- A new hardening flag, `nostrictaliasing` was made available, corresponding to the gcc/clang option `-fno-strict-aliasing`. + +- The `stackclashprotection` hardening flag has been enabled by default on compilers that support it. + - In `dovecot` package removed hard coding path to module directory. +- `authelia` version 4.39.0 has made some changes which deprecate older configurations. + They are still expected to be working until future version 5.0.0, but will generate warnings in logs. + Read the [release notes](https://www.authelia.com/blog/4.39-release-notes/) for human readable summaries of the changes. + +- `hddfancontrol` has been updated to major release 2. See the [migration guide](https://github.com/desbma/hddfancontrol/tree/master?tab=readme-ov-file#migrating-from-v1x), as there are breaking changes. + +- `nextcloud-news-updater` is unmaintained and was removed from nixpkgs. + +- KDE Partition Manager `partitionmanager`'s support for ReiserFS is removed. + ReiserFS has not been actively maintained for many years. It has been marked as obsolete since Linux 6.6, and + [is removed](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c01f664e4ca210823b7594b50669bbd9b0a3c3b0) + in Linux 6.13. + +- `gerbera` now has wavpack support. + - `signal-desktop` has been migrated to a from source build. No state migration is necessary. In case there's no working source build available (like on Darwin), the the binary build is still available at `signal-desktop-bin`. - `ddclient` was updated from 3.11.2 to 4.0.0 [Release notes](https://github.com/ddclient/ddclient/releases/tag/v4.0.0) diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md index 774c5f9c9c33..7703a23b3df8 100644 --- a/nixos/doc/manual/release-notes/rl-2505.section.md +++ b/nixos/doc/manual/release-notes/rl-2505.section.md @@ -1,4 +1,4 @@ -# NixOS 25.05 (“Warbler”, 2025.05/??) {#sec-release-25.05} +# Release 25.05 (“Warbler”, 2025.05/??) {#sec-release-25.05} ## Highlights {#sec-release-25.05-highlights} @@ -15,12 +15,7 @@ Alongside many enhancements to NixOS modules and general system improvements, th - `nixos-option` has been rewritten to a Nix expression called by a simple bash script. This lowers our maintenance threshold, makes eval errors less verbose, adds support for flake-based configurations, descending into `attrsOf` and `listOf` submodule options, and `--show-trace`. -- The packaging of Mesa graphics drivers has been significantly reworked, in particular: - - Applications linked against different Mesa versions than installed on the system should now work correctly going forward (however, applications against older Mesa, e.g. from Nixpkgs releases before 25.05, remain broken) - - The global Mesa version can now be managed without a mass rebuild by setting [](#opt-hardware.graphics.package) - - Packages that used to depend on Mesa for libgbm or libdri should use `libgbm` or `dri-pkgconfig-stub` as inputs, respectively - -- OpenSSH has been updated from 9.9p2 to 10.0p2, dropping support for DSA keys and adding a new `ssh-auth` binary to handle user authentication in a different address space from unauthenticated sessions. Additionally, we now enable a configure option by default that attempts to lock sshd into RAM to prevent it from being swapped out, which may improve performance if the system is under memory pressure. See the [full changelog](https://www.openwall.com/lists/oss-security/2025/04/09/1) for more details. +- The global Mesa version can now be managed without a mass rebuild by setting [](#opt-hardware.graphics.package). - GNOME has been updated to version 48. @@ -47,7 +42,6 @@ Alongside many enhancements to NixOS modules and general system improvements, th - [programs.amnezia-vpn](#opt-programs.amnezia-vpn.enable): a GUI client which can also deploy a VPN endpoint to a remote server - {option}`networking.wireguard` adds support for the [AmneziaWG](https://docs.amnezia.org/documentation/amnezia-wg/) variant of the protocol, featuring better masking against Deep Packet Inspection. The variant to be used is set per interface as `networking.wireguard.interfaces..type`, defaulting to wireguard. - - [Bazecor](https://github.com/Dygmalab/Bazecor), the graphical configurator for Dygma Products. - [Bonsai](https://git.sr.ht/~stacyharper/bonsai), a general-purpose event mapper/state machine primarily used to create complex key shortcuts, and as part of the [SXMO](https://sxmo.org/) desktop environment. Available as [services.bonsaid](#opt-services.bonsaid.enable). @@ -260,8 +254,6 @@ Alongside many enhancements to NixOS modules and general system improvements, th and error starting 25.05 with instructions the following instructions: The canonical source for NixOS AMIs is the AWS API. Please see https://nixos.org/download/#nixos-amazon or https://nixos.github.io/amis/ for instructions. -- The udev rules of the libjaylink package require users to be in the `jlink` instead of `plugdev` group now, since the `plugdev` group is very uncommon for NixOS. Alternatively, access is granted to seat sessions. - - The latest available version of Nextcloud is v31 (available as `pkgs.nextcloud31`). The installation logic is as follows: - If [`services.nextcloud.package`](#opt-services.nextcloud.package) is specified explicitly, this package will be installed (**recommended**) - If [`system.stateVersion`](#opt-system.stateVersion) is >=24.11, `pkgs.nextcloud30` will be installed by default. @@ -294,12 +286,6 @@ Alongside many enhancements to NixOS modules and general system improvements, th - `services.paperless` now installs `paperless-manage` as a normal system package instead of creating a symlink in `/var/lib/paperless`. `paperless-manage` now also changes to the appropriate user when being executed. -- The `gotenberg` package has been updated to 8.16.0, which brings breaking changes to the configuration from version 8.13.0. See the [upstream release notes](https://github.com/gotenberg/gotenberg/releases/tag/v8.13.0) - for that release to get all the details. The `services.gotenberg` module has been updated appropriately to ensure your configuration is valid with this new release. - -- `varnish` was updated from 7.5.0 to 7.7.0, see [Varnish 7.6.0 upgrade guide](https://varnish-cache.org/docs/7.6/whats-new/upgrading-7.6.html) and -[Varnish 7.7.0 upgrade guide](https://varnish-cache.org/docs/7.7/whats-new/upgrading-7.7.html#whatsnew-upgrading-7-7). - - `asusd` has been upgraded to version 6 which supports multiple aura devices. To account for this, the single `auraConfig` configuration option has been replaced with `auraConfigs` which is an attribute set of config options per each device. The config files may also be now specified as either source files or text strings; to account for this you will need to specify that `text` is used for your existing configs, e.g.: ```diff -services.asusd.asusdConfig = '''file contents''' @@ -308,24 +294,14 @@ Alongside many enhancements to NixOS modules and general system improvements, th - `linuxPackages.nvidiaPackages.stable` now defaults to the `production` variant instead of `latest`. -- `paperless-ngx` has been updated to minor version 2.15 which switched the web server from Gunicorn to Granian. If you set Gunicorn specific envs (usually contain GUNICORN) they must be updated. Also `services.paperless.address` no longer accepts a domain name and Granian also does not support listening on unix domain sockets. - -- `timescaledb` requires manual upgrade steps. - After you run ALTER EXTENSION, you must run [this SQL script](https://github.com/timescale/timescaledb-extras/blob/master/utils/2.15.X-fix_hypertable_foreign_keys.sql). For more details, see the following pull requests [#6797](https://github.com/timescale/timescaledb/pull/6797). - PostgreSQL 13 is no longer supported in TimescaleDB v2.16. +- `services.paperless.address` no longer accepts a domain name or Unix domain socket. - `networking.wireguard.enable = true` does not always add `wireguard-tools` to system packages anymore. Only when wireguard interfaces are configured, the backing implementation packages are added to system PATH. - `virtualisation/azure-common.nix`'s filesystem and grub configurations have been moved to `virtualisation/azure-image.nix`. This makes `azure-common.nix` more generic so it could be used for users who generate Azure image using other methods (e.g. nixos-generators and disko). For existing users depending on these configurations, please also import `azure-image.nix`. -- `zammad` has had its support for MySQL removed, since it was never working correctly and is now deprecated upstream. Check the [migration guide](https://docs.zammad.org/en/latest/appendix/migrate-to-postgresql.html) for how to convert your database to PostgreSQL. - - `services.signald` has been removed as `signald` is unmaintained upstream and has been incompatible to official Signal servers for a long while. -- `tauon` 7.9.0+ when launched for the first time, migrates its database to a new schema that is not backwards compatible. Older versions will refuse to start at all with that database afterwards. If you need to still use older tauon versions, make sure to back up `~/.local/share/TauonMusicBox`. - -- `aws-workspaces` has dropped support for PCoiP networking. - - The `earlyoom` service is now using upstream systemd service, which enables hardening and filesystem isolation by default. If you need filesystem write access or want to access home directory via `killHook`, hardening setting can @@ -345,60 +321,18 @@ Alongside many enhancements to NixOS modules and general system improvements, th - `services.bird2` has been renamed to `services.bird` and the default bird package has been switched to `bird3`. `bird2` can still be chosen via the `services.bird.package` option. -- `renovate` was updated to v39. See the [upstream release notes](https://docs.renovatebot.com/release-notes-for-major-versions/#version-39) for breaking changes. - Like upstream's docker images, renovate now runs on NodeJS 22. - - The behavior of the `networking.nat.externalIP` and `networking.nat.externalIPv6` options has been changed. `networking.nat.forwardPorts` now only forwards packets destined for the specified IP addresses. - `gitlab` has been updated from 17.x to 18.x and requires `postgresql` >= 16, as stated in the [documentation](https://docs.gitlab.com/18.0/install/requirements/#postgresql). Check the [upgrade guide](#module-services-postgres-upgrading) in the NixOS manual on how to upgrade your PostgreSQL installation. - `services.gitlab` now requires the setting of `activeRecordPrimaryKeyFile`, `activeRecordDeterministicKeyFile`, `activeRecordSaltFile` as GitLab introduced Rails ActiveRecord encryption. -- `python3Packages.bpycv` has been removed due to being incompatible with Blender 4 and unmaintained. - -- `python3Packages.jaeger-client` was removed because it was deprecated upstream. [OpenTelemetry](https://opentelemetry.io) is the recommended replacement. - -- `rocmPackages_6` has been updated to ROCm 6.3. - -- `rocmPackages_5` has been removed. - -- `rocmPackages.rocm-thunk` has been removed and its functionality has been integrated with the ROCm CLR. Use `rocmPackages.clr` instead. - -- `rocmPackages.clang-ocl` has been removed. [It was deprecated by AMD in 2023.](https://github.com/ROCm/clang-ocl) - -- `nodePackages.meshcommander` has been removed, as the package was deprecated by Intel. - -- The default version of `z3` has been updated from 4.8 to 4.13. There are still a few packages that need specific older versions; those will continue to be maintained as long as other packages depend on them but may be removed in the future. - -- `prometheus` has been updated from 2.55.0 to 3.1.0. - Read the [release blog post](https://prometheus.io/blog/2024/11/14/prometheus-3-0/) and - [migration guide](https://prometheus.io/docs/prometheus/3.1/migration/). - - The Mattermost module ([`services.mattermost`](#opt-services.mattermost.enable)) and packages (`mattermost` and `mmctl`) have been substantially updated: - `services.mattermost.listenAddress` has been split into [](#opt-services.mattermost.host) and [](#opt-services.mattermost.port). If your `listenAddress` contained a port, you will need to edit your configuration. This will be the only truly breaking change in this release for most configurations. - [](#opt-services.mattermost.preferNixConfig) now defaults to true if you advance [](#opt-system.stateVersion) to 25.05. This means that if you have [](#opt-services.mattermost.mutableConfig) set, NixOS will override settings set in the Admin Console to those that you define in the module configuration. It is recommended to leave this at the default, even if you used a fully mutable configuration before, because it will ensure that your Mattermost data directories are correct. If you moved your data directories, you may want to review the module changes before upgrading. - Mattermost now supports peer authentication on both MySQL and Postgres database backends. Updating [](#opt-system.stateVersion) to 25.05 or later will result in peer authentication being used by default if the Mattermost server would otherwise be connecting to localhost. This is the recommended configuration. - Note that the Mattermost module will create an account _without_ a well-known UID if the username differs from the default (`mattermost`). If you used Mattermost with a nonstandard username, you may want to review the module changes before upgrading. -- `kanata` was updated to v1.8.0, which introduces several breaking changes. - See the release notes of - [v1.7.0](https://github.com/jtroo/kanata/releases/tag/v1.7.0) and - [v1.8.0](https://github.com/jtroo/kanata/releases/tag/v1.8.0) - for more information. - -- `authelia` version 4.39.0 has made changes on the default claims for ID Tokens, to mirror the standard claims from the specification. - This change may affect some clients in unexpected ways, so manual intervention may be required. - Read the [release notes](https://www.authelia.com/blog/4.39-release-notes/), along with [the guide](https://www.authelia.com/integration/openid-connect/openid-connect-1.0-claims/#restore-functionality-prior-to-claims-parameter) to work around issues that may be encountered. - -- `ags` was updated to v2, which is just a CLI for Astal now. Components are available as a different package set `astal.*`. - If you want to use v1, it is available as `ags_1` package. - - See the release notes of - [v2.0.0](https://github.com/Aylur/ags/releases/tag/v2.0.0) - for more information. - -- `nodePackages.expo-cli` has been removed, as it was deprecated by upstream. The suggested replacement is the `npx expo` command. - - DokuWiki with the Caddy webserver (`services.dokuwiki.webserver = "caddy"`) now sets up sites with Caddy's automatic HTTPS instead of HTTP-only. To keep the old behavior for a site `example.com`, set `services.caddy.virtualHosts."example.com".hostName = "http://example.com"`. If you set custom Caddy options for a DokuWiki site, migrate these options by removing `http://` from `services.caddy.virtualHosts."http://example.com"`. @@ -407,21 +341,10 @@ Alongside many enhancements to NixOS modules and general system improvements, th Given a site example.com, http://example.com now 301 redirects to https://example.com. To keep the old behavior for a site `example.com`, set `services.caddy.virtualHosts."example.com".hostName = "http://example.com"`. -- `slskd` has been updated to v0.22.3, which includes breaking changes to `script` integrations. Please review the [changelog](https://github.com/slskd/slskd/releases/tag/0.22.3) - and the accompanying [pull request](https://github.com/slskd/slskd/pull/1292). - -- `forgejo` and `forgejo-lts` have been updated to v11. - See upstreams [release blog post](https://forgejo.org/2025-04-release-v11-0/) for more information. - -- `unifi` has been updated to v9.1. - This version should be backward compatible with v8.x, however as a result, `unifi8` package has been removed. - - The behavior of `services.hostapd.radios..networks..authentication.enableRecommendedPairwiseCiphers` was changed to not include `CCMP-256` anymore. Since all configured pairwise ciphers have to be supported by the radio, this caused startup failures on many devices which is hard to debug in hostapd. -- The `conduwuit` matrix server implementation has officially been discontinued by upstream and the package has thus been marked as vulnerable, as it is a security-sensitive package that has reached EOL. - -- `gkraken` software and `hardware.gkraken.enable` option have been removed, use `coolercontrol` via `programs.coolercontrol.enable` option instead. +- The `hardware.gkraken` module has been removed. The recommended alternative is [`programs.coolercontrol`](#opt-programs.coolercontrol.enable). - To avoid delaying user logins unnecessarily the `multi-user.target` is no longer ordered after `network-online.target`. System services requiring a connection to start correctly must explicitly state so, i.e. @@ -475,10 +398,10 @@ Alongside many enhancements to NixOS modules and general system improvements, th - `security.apparmor.policies..enforce` and `security.apparmor.policies..enable` were removed. Configuring the state of apparmor policies must now be done using `security.apparmor.policies..state` tristate option. + - `services.graylog.package` now defaults to `graylog-6_0` as previous default `graylog-5_1` is EOL and therefore removed. Check the migration guides on [5.1→5.2](https://go2docs.graylog.org/5-2/upgrading_graylog/upgrading_to_graylog_5.2.x.htm) and [5.2→6.0](https://go2docs.graylog.org/6-0/upgrading_graylog/upgrading_to_graylog_6.0.x.html) for breaking changes. - - `programs.clash-verge.tunMode` was deprecated and removed because now service mode is necessary to start program. Without `programs.clash-verge.enable`, clash-verge-rev will refuse to start. - `services.discourse` now requires PostgreSQL 15 per default. Please update before upgrading. @@ -539,8 +462,6 @@ Alongside many enhancements to NixOS modules and general system improvements, th }; ``` -- The `intel` video driver for X.org (from the xf86-video-intel package, which was previously removed because it was non-functional) has been fixed and the driver has been re-introduced. - - systemd's {manpage}`systemd-ssh-generator(8)` now works out of the box on NixOS. - You can ssh into VMs without any networking configuration if your hypervisor configures the vm to support AF_VSOCK. It still requires the usual ssh authentication methods. @@ -564,21 +485,15 @@ Alongside many enhancements to NixOS modules and general system improvements, th - `networking.wireguard` now has an optional networkd backend. It is enabled by default when `networking.useNetworkd` is enabled, and it can be enabled alongside scripted networking with `networking.wireguard.useNetworkd`. Some `networking.wireguard` options have slightly different behavior with the networkd and script-based backends, documented in each option. -- The `stackclashprotection` hardening flag has been enabled by default on compilers that support it. - - `services.rss-bridge` now has a `package` option as well as support for `caddy` as reverse proxy. - `services.avahi.ipv6` now defaults to true. -- A new hardening flag, `nostrictaliasing` was made available, corresponding to the gcc/clang option `-fno-strict-aliasing`. - - In the `services.xserver.displayManager.startx` module, two new options [generateScript](#opt-services.xserver.displayManager.startx.generateScript) and [extraCommands](#opt-services.xserver.displayManager.startx.extraCommands) have been added to to declaratively configure the .xinitrc script. - All services that require a root certificate bundle now use the value of a new read-only option, `security.pki.caBundle`. -- hddfancontrol has been updated to major release 2. See the [migration guide](https://github.com/desbma/hddfancontrol/tree/master?tab=readme-ov-file#migrating-from-v1x), as there are breaking changes. The settings options have been modified to use an attrset, enabling configurations with multiple instances of the daemon running at once, eg, for two separate drive bays. - -- `nextcloud-news-updater` is unmaintained and was removed from nixpkgs. +- [`services.hddfancontrol`](#opt-services.hddfancontrol.enable) has been modified to use an attribute set for settings, enabling configurations with multiple instances of the daemon running at once (e.g., for two separate drive bays). - `services.cloudflared` now uses a dynamic user, and its `user` and `group` options have been removed. If the user or group is still necessary, they can be created manually. @@ -611,62 +526,17 @@ Alongside many enhancements to NixOS modules and general system improvements, th - `services.k3s` now provides the `autoDeployCharts` option that allows to automatically deploy Helm charts via the k3s Helm controller. -- Caddy can now be built with plugins by using `caddy.withPlugins`, a `passthru` function that accepts an attribute set as a parameter. The `plugins` argument represents a list of Caddy plugins, with each Caddy plugin being a versioned module. The `hash` argument represents the `vendorHash` of the resulting Caddy source code with the plugins added. - - Example: - ```nix - services.caddy = { - enable = true; - package = pkgs.caddy.withPlugins { - plugins = [ - # tagged upstream - "github.com/caddy-dns/powerdns@v1.0.1" - # pseudo-version number generated by Go - "github.com/caddy-dns/cloudflare@v0.0.0-20240703190432-89f16b99c18e" - "github.com/mholt/caddy-webdav@v0.0.0-20241008162340-42168ba04c9d" - ]; - hash = "sha256-wqXSd1Ep9TVpQi570TTb96LwzNYvWL5EBJXMJfYWCAk="; - }; - }; - ``` - - To get the necessary hash of the vendored dependencies, omit `hash`. The build will fail and tell you the correct value. - - Note that all provided plugins must have versions/tags (string after `@`), even if upstream repo does not tag each release. For untagged plugins, you can either create an empty Go project and run `go get ` and see changes in `go.mod` to get the pseudo-version number, or provide a commit hash in place of version/tag for the first run, and update the plugin string based on the error output. - -- `buildGoModule` now supports a self-referencing `finalAttrs:` parameter - containing the final arguments including overrides. - This allows packaging configuration to be overridden in a consistent manner by - providing an alternative to `rec {}` syntax. - - [Mattermost](#opt-services.mattermost.enable), a self-hosted chat collaboration platform supporting calls, playbooks, and boards, has been updated. It now has multiple versions, disabled telemetry, and a native frontend build in nixpkgs, removing all upstream prebuilt blobs. - - A new `pkgs.mattermost.buildPlugin` function has been added, which allows plugins to be built from source, including webapp frontends with a supported package-lock.json. See the Mattermost NixOS test and [manual](https://nixos.org/manual/nixpkgs/unstable/#sec-mattermost-plugins-build) for an example. - Mattermost telemetry reporting is now disabled by default, though security update notifications are enabled. Look at [`services.mattermost.telemetry`](#opt-services.mattermost.telemetry.enableDiagnostics) for options to control this behavior. - - The Mattermost frontend is now built from source and can be overridden. Note that the Mattermost derivation containing both the webapp and server is now wrapped to allow them to be built independently, so overrides to both webapp and server look like `mattermost.overrideAttrs (prev: { webapp = prev.webapp.override { ... }; server = prev.server.override { ... }; })` now. - - `pkgs.mattermost` has been updated from 9.11 to 10.5 to track the latest extended support release, since 9.11 will become end-of-life during the lifetime of NixOS 25.05. - - `pkgs.mattermostLatest` is now an option to track the latest (non-prerelease) Mattermost release. We test upgrade migrations from ESR releases (`pkgs.mattermost`) to `pkgs.mattermostLatest`. - The Mattermost module will produce eval warnings if a database password would end up in the Nix store, and recommend alternatives such as peer authentication or using the environment file. - We now support `mmctl` for Mattermost administration if both [](#opt-services.mattermost.socket.enable) and [](#opt-services.mattermost.socket.export) are set, which export the Mattermost control socket path into the system environment. -- KDE Partition Manager `partitionmanager`'s support for ReiserFS is removed. - ReiserFS has not been actively maintained for many years. It has been marked as obsolete since Linux 6.6, and - [is removed](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c01f664e4ca210823b7594b50669bbd9b0a3c3b0) - in Linux 6.13. - - `services.geoclue2` now uses [beaconDB](https://beacondb.net/) as a default geolocation service, replacing Mozilla Location Services which was [retired in June 2024](https://github.com/mozilla/ichnaea/issues/2065). -- `authelia` version 4.39.0 has made some changes which deprecate older configurations. - They are still expected to be working until future version 5.0.0, but will generate warnings in logs. - Read the [release notes](https://www.authelia.com/blog/4.39-release-notes/) for human readable summaries of the changes. - - `security.acme` now supports renewal using CSRs (Certificate Signing Request) through the options `security.acme.*.csr` and `security.acme.*.csrKey`. - `programs.fzf.keybindings` now supports the fish shell. -- `gerbera` now has wavpack support. - -- `octave` (and `octaveFull`) was updated to version `10.x`. The update broke a few `octavePackages`, and `librsb`. See [the PR's commits](https://github.com/NixOS/nixpkgs/pull/394495/commits) for more details. - - A toggle has been added under `users.users..enable` to allow toggling individual users conditionally. If set to false, the user account will not be created. - New hooks were added: