Merge commit 41b88f48c1 into haskell-updates

2025-10-02 09:55:47 +02:00
parent efcc55998f 41b88f48c1
commit 932b4a5f4f
952 changed files with 12139 additions and 8854 deletions
@@ -52,7 +52,7 @@ jobs:
        with:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}

-      - uses: cachix/install-nix-action@a809471b5c7c913aa67bec8f459a11a0decc3fce # v31
+      - uses: cachix/install-nix-action@9280e7aca88deada44c930f1e2c78e21c3ae3edd # v31
        with:
          # Sandbox is disabled on MacOS by default.
          extra_nix_config: sandbox = true
@@ -12,17 +12,12 @@ on:
      mergedSha:
        required: true
        type: string
-      ownersCanFail:
-        required: true
-        type: boolean
      targetSha:
        required: true
        type: string
    secrets:
      CACHIX_AUTH_TOKEN:
        required: true
-      OWNER_RO_APP_PRIVATE_KEY:
-        required: true

 permissions: {}

@@ -72,19 +67,8 @@ jobs:
          GH_TOKEN: ${{ github.token }}
        run: gh api /rate_limit | jq

-  # For checking code owners, this job depends on a GitHub App with the following permissions:
-  # - Permissions:
-  #   - Repository > Administration: read-only
-  #   - Organization > Members: read-only
-  # - Install App on this repository, setting these variables:
-  #   - OWNER_RO_APP_ID (variable)
-  #   - OWNER_RO_APP_PRIVATE_KEY (secret)
-  #
-  # This should not use the same app as the job to request reviewers, because this job requires
-  # handling untrusted PR input.
  owners:
    runs-on: ubuntu-24.04-arm
-    continue-on-error: ${{ inputs.ownersCanFail }}
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
@@ -94,9 +78,8 @@ jobs:
        uses: ./.github/actions/checkout
        with:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}
-          target-as-trusted-at: ${{ inputs.targetSha }}

-      - uses: cachix/install-nix-action@a809471b5c7c913aa67bec8f459a11a0decc3fce # v31
+      - uses: cachix/install-nix-action@9280e7aca88deada44c930f1e2c78e21c3ae3edd # v31

      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
        with:
@@ -107,36 +90,15 @@ jobs:
          pushFilter: -source$

      - name: Build codeowners validator
-        run: nix-build nixpkgs/trusted/ci --arg nixpkgs ./nixpkgs/trusted-pinned -A codeownersValidator
-
-      - uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
-        if: github.event_name == 'pull_request_target' && vars.OWNER_RO_APP_ID
-        id: app-token
-        with:
-          app-id: ${{ vars.OWNER_RO_APP_ID }}
-          private-key: ${{ secrets.OWNER_RO_APP_PRIVATE_KEY }}
-          permission-administration: read
-          permission-members: read
-
-      - name: Log current API rate limits
-        if: steps.app-token.outputs.token
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: gh api /rate_limit | jq
+        run: nix-build nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A codeownersValidator

      - name: Validate codeowners
-        if: steps.app-token.outputs.token
        env:
          OWNERS_FILE: nixpkgs/untrusted/ci/OWNERS
-          GITHUB_ACCESS_TOKEN: ${{ steps.app-token.outputs.token }}
          REPOSITORY_PATH: nixpkgs/untrusted
-          OWNER_CHECKER_REPOSITORY: ${{ github.repository }}
+          # Omits "owners", which checks whether GitHub handles exist, but fails with nested team
+          # structures.
+          CHECKS: "duppatterns,files,syntax"
          # Set this to "notowned,avoid-shadowing" to check that all files are owned by somebody
          EXPERIMENTAL_CHECKS: "avoid-shadowing"
        run: result/bin/codeowners-validator
-
-      - name: Log current API rate limits
-        if: steps.app-token.outputs.token
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: gh api /rate_limit | jq
@@ -47,7 +47,7 @@ jobs:
            ci/pinned.json

      - name: Install Nix
-        uses: cachix/install-nix-action@a809471b5c7c913aa67bec8f459a11a0decc3fce # v31
+        uses: cachix/install-nix-action@9280e7aca88deada44c930f1e2c78e21c3ae3edd # v31

      - name: Load supported versions
        id: versions
@@ -92,7 +92,7 @@ jobs:
          target-as-trusted-at: ${{ inputs.targetSha }}

      - name: Install Nix
-        uses: cachix/install-nix-action@a809471b5c7c913aa67bec8f459a11a0decc3fce # v31
+        uses: cachix/install-nix-action@9280e7aca88deada44c930f1e2c78e21c3ae3edd # v31

      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
        with:
@@ -190,7 +190,7 @@ jobs:
          merge-multiple: true

      - name: Install Nix
-        uses: cachix/install-nix-action@a809471b5c7c913aa67bec8f459a11a0decc3fce # v31
+        uses: cachix/install-nix-action@9280e7aca88deada44c930f1e2c78e21c3ae3edd # v31

      - name: Combine all output paths and eval stats
        run: |
@@ -350,7 +350,7 @@ jobs:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}

      - name: Install Nix
-        uses: cachix/install-nix-action@a809471b5c7c913aa67bec8f459a11a0decc3fce # v31
+        uses: cachix/install-nix-action@9280e7aca88deada44c930f1e2c78e21c3ae3edd # v31

      - name: Run misc eval tasks in parallel
        run: |
@@ -32,7 +32,7 @@ jobs:
        with:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}

-      - uses: cachix/install-nix-action@a809471b5c7c913aa67bec8f459a11a0decc3fce # v31
+      - uses: cachix/install-nix-action@9280e7aca88deada44c930f1e2c78e21c3ae3edd # v31

      # TODO: Figure out how to best enable caching for the treefmt job. Cachix won't work well,
      # because the cache would be invalidated on every commit - treefmt checks every file.
@@ -66,7 +66,7 @@ jobs:
        with:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}

-      - uses: cachix/install-nix-action@a809471b5c7c913aa67bec8f459a11a0decc3fce # v31
+      - uses: cachix/install-nix-action@9280e7aca88deada44c930f1e2c78e21c3ae3edd # v31

      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
        with:
@@ -94,7 +94,7 @@ jobs:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}
          target-as-trusted-at: ${{ inputs.targetSha }}

-      - uses: cachix/install-nix-action@a809471b5c7c913aa67bec8f459a11a0decc3fce # v31
+      - uses: cachix/install-nix-action@9280e7aca88deada44c930f1e2c78e21c3ae3edd # v31

      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
        with:
@@ -11,8 +11,6 @@ on:
      OWNER_APP_PRIVATE_KEY:
        # The Test workflow should not actually request reviews from owners.
        required: false
-      OWNER_RO_APP_PRIVATE_KEY:
-        required: true

 concurrency:
  group: pr-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
@@ -59,13 +57,11 @@ jobs:
      pull-requests: write
    secrets:
      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
-      OWNER_RO_APP_PRIVATE_KEY: ${{ secrets.OWNER_RO_APP_PRIVATE_KEY }}
    with:
      baseBranch: ${{ needs.prepare.outputs.baseBranch }}
      headBranch: ${{ needs.prepare.outputs.headBranch }}
      mergedSha: ${{ needs.prepare.outputs.mergedSha }}
      targetSha: ${{ needs.prepare.outputs.targetSha }}
-      ownersCanFail: ${{ !contains(fromJSON(needs.prepare.outputs.touched), 'owners') }}

  lint:
    name: Lint
@@ -33,7 +33,7 @@ jobs:
          sparse-checkout: ci

      - name: Install Nix
-        uses: cachix/install-nix-action@a809471b5c7c913aa67bec8f459a11a0decc3fce # v31
+        uses: cachix/install-nix-action@9280e7aca88deada44c930f1e2c78e21c3ae3edd # v31

      - name: Build the requestReviews derivation
        run: nix-build trusted/ci -A requestReviews
@@ -98,7 +98,6 @@ jobs:
    secrets:
      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
      NIXPKGS_CI_APP_PRIVATE_KEY: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
-      OWNER_RO_APP_PRIVATE_KEY: ${{ secrets.OWNER_RO_APP_PRIVATE_KEY }}

  push:
    if: needs.prepare.outputs.push
@@ -221,7 +221,6 @@ module.exports = async ({ github, context, core, dry }) => {

    const touched = []
    if (files.includes('ci/pinned.json')) touched.push('pinned')
-    if (files.includes('ci/OWNERS')) touched.push('owners')
    core.setOutput('touched', touched)

    return
@@ -3,7 +3,7 @@
 Building software with Nix often requires downloading source code and other files from the internet.
 To this end, we use functions that we call _fetchers_, which obtain remote sources via various protocols and services.

-Nix provides built-in fetchers such as [`builtins.fetchTarball`](https://nixos.org/manual/nix/stable/language/builtins.html#builtins-fetchTarball).
+Nix provides built-in fetchers such as [`fetchTarball`](https://nixos.org/manual/nix/stable/language/builtins.html#builtins-fetchTarball).
 Nixpkgs provides its own fetchers, which work differently:

 - A built-in fetcher will download and cache files at evaluation time and produce a [store path](https://nixos.org/manual/nix/stable/glossary#gloss-store-path).
@@ -163,7 +163,7 @@ Nixpkgs provides the following functions for producing derivations which write t
 They are useful for creating files from Nix expression, and are all implemented as convenience wrappers around `writeTextFile`.

 Each of these functions will cause a derivation to be produced.
-When you coerce the result of each of these functions to a string with [string interpolation](https://nixos.org/manual/nix/stable/language/string-interpolation) or [`builtins.toString`](https://nixos.org/manual/nix/stable/language/builtins#builtins-toString), it will evaluate to the [store path](https://nixos.org/manual/nix/stable/store/store-path) of this derivation.
+When you coerce the result of each of these functions to a string with [string interpolation](https://nixos.org/manual/nix/stable/language/string-interpolation) or [`toString`](https://nixos.org/manual/nix/stable/language/builtins#builtins-toString), it will evaluate to the [store path](https://nixos.org/manual/nix/stable/store/store-path) of this derivation.

 :::: {.note}
 Some of these functions will put the resulting files within a directory inside the [derivation output](https://nixos.org/manual/nix/stable/language/derivations#attr-outputs).
@@ -344,7 +344,7 @@ Write a text file to the Nix store.
 `allowSubstitutes` (Bool, _optional_)

 : Whether to allow substituting from a binary cache.
-  Passed through to [`allowSubstitutes`](https://nixos.org/manual/nix/stable/language/advanced-attributes#adv-attr-allowSubstitutes) of the underlying call to `builtins.derivation`.
+  Passed through to [`allowSubstitutes`](https://nixos.org/manual/nix/stable/language/advanced-attributes#adv-attr-allowSubstitutes) of the underlying call to `derivation`.

  It defaults to `false`, as running the derivation's simple `builder` executable locally is assumed to be faster than network operations.
  Set it to true if the `checkPhase` step is expensive.
@@ -355,7 +355,7 @@ Write a text file to the Nix store.

 : Whether to prefer building locally, even if faster [remote build machines](https://nixos.org/manual/nix/stable/command-ref/conf-file#conf-substituters) are available.

-  Passed through to [`preferLocalBuild`](https://nixos.org/manual/nix/stable/language/advanced-attributes#adv-attr-preferLocalBuild) of the underlying call to `builtins.derivation`.
+  Passed through to [`preferLocalBuild`](https://nixos.org/manual/nix/stable/language/advanced-attributes#adv-attr-preferLocalBuild) of the underlying call to `derivation`.

  It defaults to `true` for the same reason `allowSubstitutes` defaults to `false`.

@@ -24,19 +24,19 @@ let

  libset =
    toplib:
-    builtins.map (subsetname: {
+    map (subsetname: {
      subsetname = subsetname;
      functions = libDefPos [ ] toplib.${subsetname};
-    }) (builtins.map (x: x.name) libsets);
+    }) (map (x: x.name) libsets);

  flattenedLibSubset =
    { subsetname, functions }:
-    builtins.map (fn: {
+    map (fn: {
      name = "lib.${subsetname}.${fn.name}";
      value = fn.location;
    }) functions;

-  locatedlibsets = libs: builtins.map flattenedLibSubset (libset libs);
+  locatedlibsets = libs: map flattenedLibSubset (libset libs);
  removeFilenamePrefix =
    prefix: filename:
    let
@@ -46,7 +46,7 @@ let
    in
    substr;

-  removeNixpkgs = removeFilenamePrefix (builtins.toString nixpkgsPath);
+  removeNixpkgs = removeFilenamePrefix (toString nixpkgsPath);

  liblocations = builtins.filter (elem: elem.value != null) (lib.lists.flatten (locatedlibsets lib));

@@ -59,19 +59,19 @@ let
      };
    };

-  relativeLocs = (builtins.map fnLocationRelative liblocations);
+  relativeLocs = (map fnLocationRelative liblocations);
  sanitizeId = builtins.replaceStrings [ "'" ] [ "-prime" ];

  urlPrefix = "https://github.com/NixOS/nixpkgs/blob/${revision}";
  jsonLocs = builtins.listToAttrs (
-    builtins.map (
+    map (
      { name, value }:
      {
        name = sanitizeId name;
        value =
          let
-            text = "${value.file}:${builtins.toString value.line}";
-            target = "${urlPrefix}/${value.file}#L${builtins.toString value.line}";
+            text = "${value.file}:${toString value.line}";
+            target = "${urlPrefix}/${value.file}#L${toString value.line}";
          in
          "[${text}](${target}) in `<nixpkgs>`";
      }
@@ -89,7 +89,7 @@ buildDhallPackage {
 # ./example.nix

 let
-  nixpkgs = builtins.fetchTarball {
+  nixpkgs = fetchTarball {
    url = "https://github.com/NixOS/nixpkgs/archive/94b2848559b12a8ed1fe433084686b2a81123c99.tar.gz";
    hash = "sha256-B4Q3c6IvTLg3Q92qYa8y+i4uTaphtFdjp+Ir3QQjdN0=";
  };
@@ -316,7 +316,7 @@ buildNpmPackage {
 `importNpmLock` uses the following fetchers:

 - `pkgs.fetchurl` for `http(s)` dependencies
- `builtins.fetchGit` for `git` dependencies
+- `fetchGit` for `git` dependencies

 It is possible to provide additional arguments to individual fetchers as needed:

@@ -374,7 +374,7 @@ stdenv.mkDerivation (finalAttrs: {
  pname = "maven-demo";
  version = "1.0";

-  src = builtins.fetchTarball "https://github.com/fzakaria/nixos-maven-example/archive/main.tar.gz";
+  src = fetchTarball "https://github.com/fzakaria/nixos-maven-example/archive/main.tar.gz";
  buildInputs = [ maven ];

  buildPhase = ''
@@ -445,7 +445,7 @@ stdenv.mkDerivation (finalAttrs: {
  pname = "maven-demo";
  version = "1.0";

-  src = builtins.fetchTarball "https://github.com/fzakaria/nixos-maven-example/archive/main.tar.gz";
+  src = fetchTarball "https://github.com/fzakaria/nixos-maven-example/archive/main.tar.gz";
  nativeBuildInputs = [ makeWrapper ];
  buildInputs = [ maven ];

@@ -538,7 +538,7 @@ stdenv.mkDerivation (finalAttrs: {
  pname = "maven-demo";
  version = "1.0";

-  src = builtins.fetchTarball "https://github.com/fzakaria/nixos-maven-example/archive/main.tar.gz";
+  src = fetchTarball "https://github.com/fzakaria/nixos-maven-example/archive/main.tar.gz";
  nativeBuildInputs = [ makeWrapper ];
  buildInputs = [ maven ];

@@ -11,7 +11,6 @@
 - The official Nix formatter `nixfmt` is now stable and available as `pkgs.nixfmt`, deprecating the temporary `pkgs.nixfmt-rfc-style` attribute. The classic `nixfmt` will stay available for some more time as `pkgs.nixfmt-classic`.
 - The default GHC version has been updated from 9.8 to 9.10.
  `haskellPackages` correspondingly uses Stackage LTS 24 (instead of LTS 23) as a baseline.
- Added `nixos-init`, a Rust-based bashless initialization system for systemd initrd. This allows to build NixOS systems without any interpreter. Enable via `system.nixos-init.enable = true;`.

 ## Backward Incompatibilities {#sec-nixpkgs-release-25.11-incompatibilities}

@@ -52,6 +51,8 @@
 - `uw-ttyp0` has been updated to version 2.1. The filenames of the OTB and PSF fonts have been changed to match the upstream naming convention.
  If you were loading a font by path, for example in the `console.font` NixOS option, remember to update the filename accordingly.

+- `adminneo` has been updated to version 5.1.1. Version 5 breaks compatibility with `adminer` and changes how plugins and configuration work. See the [Upgrade Guide](https://www.adminneo.org/upgrade#v5.0.0) for details. Those changes also led to changes in the arguments of the package.
+
 - `base16-builder` node package has been removed due to lack of upstream maintenance.

 - `python3Packages.bjoern` has been removed, as the upstream is unmaintained and it depends on a 14-year-old version of http-parser with numerous vulnerabilities.
@@ -129,6 +130,8 @@

 - The `archipelago-minecraft` package was removed, as upstream no longer provides support for the Minecraft APWorld.

+- `pcp` has been removed because the upstream repo was archived and it hasn't been updated since 2021.
+
 - `navidrome` 0.58.0 introduces [multi-library support](https://www.navidrome.org/docs/usage/multi-library/)
    and backwards incompatible database migrations. Ensure backups are valid and run a Full Scan after
    starting the new version.
@@ -151,6 +154,8 @@

 - `inspircd` has been updated to the v4 release series. Please refer to the upstream documentation for [general information](https://docs.inspircd.org/4/overview/#v4-overview) and a list of [breaking changes](https://docs.inspircd.org/4/breaking-changes/).

+- `proton-caller` has been removed due to lack of upstream maintenance.
+
 - `lima` package now only includes the guest agent for the host's architecture by default. If your guest VM's architecture differs from your Lima host's, you'll need to enable the `lima-additional-guestagents` package by setting `withAdditionalGuestAgents = true` when overriding lima with this input.

 - `mongodb-6_0` was removed as it is end of life as of 2025-07-31.
@@ -172,6 +177,8 @@
  of the [4.3 release](https://github.com/netbox-community/netbox/releases/tag/v4.2.0),
  make the required changes to your database, if needed, then upgrade by setting `services.netbox.package = pkgs.netbox_4_3;` in your configuration.

+- `pkgs.nextcloud30` has been removed since it's out of support upstream.
+
 - `privatebin` has been updated to `2.0.0`. This release changes configuration defaults including switching the template and removing legacy features. See the [v2.0.0 changelog entry](https://github.com/PrivateBin/PrivateBin/releases/tag/2.0.0) for details on how to upgrade.

 - `rocmPackages.triton` has been removed in favor of `python3Packages.triton`.
@@ -207,6 +214,8 @@

 - Added `rewriteURL` attribute to the nixpkgs `config`, to allow for rewriting the URLs downloaded by `fetchurl`.

+- Added `gitConfig` and `gitConfigFile` option to the nixpkgs `config`, to allow for setting a default `gitConfigFile` for all `fetchgit` invocations.
+
 - The `dockerTools.streamLayeredImage` builder now uses a better algorithm for generating layered docker images, such that much more sharing is possible when the number of store paths exceeds the layer limit. It gives each of the largest store paths its own layer and adds dependencies to those layers when they aren't used elsewhere.

 - The systemd initrd will now respect `x-systemd.wants` and `x-systemd.requires` for reliably unlocking multi-disk bcachefs volumes.
@@ -243,8 +252,12 @@
  * `$debug/lib/debug/.build-id/48/3bd7f7229bdb06462222e1e353e4f37e15c293.sourceoverlay` is a symlink to a directory with the same structure as the expanded `$sourceRoot` but containing only a copy of files which were patched during the build
  * `$debug/lib/debug/.build-id/48/3bd7f7229bdb06462222e1e353e4f37e15c293.debug` is the file containing debug symbols (like before).

+- `fetchgit`: Add `gitConfigFile` argument to set a git config (via `$GIT_CONFIG_GLOBAL`) for the fetcher.
+
 - `fetchgit`: Add `rootDir` argument to limit the resulting source to one subdirectory of the whole Git repository. Corresponding `--root-dir` option added to `nix-prefetch-git`.

+- `nix-prefetch-git`: Added a `--no-add-path` argument to disable adding the path to the store; this is useful when working with a [read-only store](https://nix.dev/manual/nix/2.28/command-ref/new-cli/nix3-help-stores#store-experimental-local-overlay-store-read-only).
+
 - `sftpman` has been updated to version 2, a rewrite in Rust which is mostly backward compatible but does include some changes to the CLI.
  For more information, [check the project's README](https://github.com/spantaleev/sftpman-rs#is-sftpman-v2-compatible-with-sftpman-v1).

@@ -47,7 +47,7 @@ rec {
    :::
  */
  # TODO(Profpatsch): add tests that check stderr
-  assertMsg = pred: msg: pred || builtins.throw msg;
+  assertMsg = pred: msg: pred || throw msg;

  /**
    Specialized `assertMsg` for checking if `val` is one of the elements
@@ -2149,7 +2149,7 @@ rec {
    chooseDevOutputs :: [Derivation] -> [Derivation]
    ```
  */
-  chooseDevOutputs = builtins.map getDev;
+  chooseDevOutputs = map getDev;

  /**
    Make various Nix tools consider the contents of the resulting
@@ -2230,7 +2230,7 @@ rec {
      intersection = builtins.intersectAttrs x y;
      collisions = lib.concatStringsSep " " (builtins.attrNames intersection);
      mask = builtins.mapAttrs (
-        name: value: builtins.throw "unionOfDisjoint: collision on ${name}; complete list: ${collisions}"
+        name: value: throw "unionOfDisjoint: collision on ${name}; complete list: ${collisions}"
      ) intersection;
    in
    (x // y) // mask;
@@ -3,6 +3,7 @@
 let
  inherit (builtins)
    intersectAttrs
+    unsafeGetAttrPos
    ;
  inherit (lib)
    functionArgs
@@ -303,7 +304,7 @@ rec {
      errorForArg =
        arg:
        let
-          loc = builtins.unsafeGetAttrPos arg fargs;
+          loc = unsafeGetAttrPos arg fargs;
        in
        "Function called without required argument \"${arg}\" at "
        + "${loc.file}:${toString loc.line}${prettySuggestions (getSuggestions arg)}";
@@ -250,9 +250,9 @@ let
  # See https://github.com/NixOS/nixpkgs/pull/194391 for details.
  closePropagationFast =
    list:
-    builtins.map (x: x.val) (
+    map (x: x.val) (
      builtins.genericClosure {
-        startSet = builtins.map (x: {
+        startSet = map (x: {
          key = x.outPath;
          val = x;
        }) (builtins.filter (x: x != null) list);
@@ -1406,10 +1406,10 @@ echo '{ fs }: fs.toSource { root = ./.; fileset = fs.gitTracked ./.; }' > defaul
 git add .

 ## We can evaluate it locally just fine, `fetchGit` is used underneath to filter git-tracked files
-expectEqual '(import ./. { fs = lib.fileset; }).outPath' '(builtins.fetchGit ./.).outPath'
+expectEqual '(import ./. { fs = lib.fileset; }).outPath' '(fetchGit ./.).outPath'

 ## We can also evaluate when importing from fetched store paths
-storePath=$(expectStorePath 'builtins.fetchGit ./.')
+storePath=$(expectStorePath 'fetchGit ./.')
 expectEqual '(import '"$storePath"' { fs = lib.fileset; }).outPath' \""$storePath"\"

 ## But it fails if the path is imported with a fetcher that doesn't remove .git (like just using "${./.}")
@@ -1429,13 +1429,13 @@ echo '{ fs }: fs.toSource { root = ./.; fileset = fs.gitTracked ./.; }' > sub/de
 git -C sub add .

 ## We can evaluate it locally just fine, `fetchGit` is used underneath to filter git-tracked files
-expectEqual '(import ./. { fs = lib.fileset; }).outPath' '(builtins.fetchGit { url = ./.; submodules = true; }).outPath'
-expectEqual '(import ./sub { fs = lib.fileset; }).outPath' '(builtins.fetchGit ./sub).outPath'
+expectEqual '(import ./. { fs = lib.fileset; }).outPath' '(fetchGit { url = ./.; submodules = true; }).outPath'
+expectEqual '(import ./sub { fs = lib.fileset; }).outPath' '(fetchGit ./sub).outPath'

 ## We can also evaluate when importing from fetched store paths
-storePathWithSub=$(expectStorePath 'builtins.fetchGit { url = ./.; submodules = true; }')
+storePathWithSub=$(expectStorePath 'fetchGit { url = ./.; submodules = true; }')
 expectEqual '(import '"$storePathWithSub"' { fs = lib.fileset; }).outPath' \""$storePathWithSub"\"
-storePathSub=$(expectStorePath 'builtins.fetchGit ./sub')
+storePathSub=$(expectStorePath 'fetchGit ./sub')
 expectEqual '(import '"$storePathSub"' { fs = lib.fileset; }).outPath' \""$storePathSub"\"

 ## But it fails if the path is imported with a fetcher that doesn't remove .git (like just using "${./.}")
@@ -150,7 +150,7 @@ rec {
        ) intConstructors;
      in
      throw ''
-        The GVariant type for number “${builtins.toString v}” is unclear.
+        The GVariant type for number “${toString v}” is unclear.
        Please wrap the value with one of the following, depending on the value type in GSettings schema:

        ${lib.concatMapStringsSep "\n" (
@@ -399,7 +399,7 @@ rec {
    => true
    lib.getLicenseFromSpdxIdOr "MY LICENSE" null
    => null
-    lib.getLicenseFromSpdxIdOr "MY LICENSE" (builtins.throw "No SPDX ID matches MY LICENSE")
+    lib.getLicenseFromSpdxIdOr "MY LICENSE" (throw "No SPDX ID matches MY LICENSE")
    => error: No SPDX ID matches MY LICENSE
    ```
    :::
@@ -1135,7 +1135,7 @@ rec {
        "."
        "~"
      ];
-      toEscape = builtins.removeAttrs asciiTable unreserved;
+      toEscape = removeAttrs asciiTable unreserved;
    in
    replaceStrings (builtins.attrNames toEscape) (
      lib.mapAttrsToList (_: c: "%${fixedWidthString 2 "0" (lib.toHexString c)}") toEscape
@@ -75,7 +75,7 @@ let

      # Those two will always be derived from "config", if given, so they should NOT
      # be overridden further down with "// args".
-      args = builtins.removeAttrs allArgs [
+      args = removeAttrs allArgs [
        "parsed"
        "system"
      ];
@@ -124,6 +124,8 @@ let
            "ucrt"
          else if final.isMinGW then
            "msvcrt"
+          else if final.isCygwin then
+            "cygwin"
          else if final.isWasi then
            "wasilibc"
          else if final.isWasm && !final.isWasi then
@@ -183,7 +185,7 @@ let
            sharedLibrary =
              if final.isDarwin then
                ".dylib"
-              else if final.isWindows then
+              else if (final.isWindows || final.isCygwin) then
                ".dll"
              else
                ".so";
@@ -191,7 +193,7 @@ let
          // {
            staticLibrary = if final.isWindows then ".lib" else ".a";
            library = if final.isStatic then final.extensions.staticLibrary else final.extensions.sharedLibrary;
-            executable = if final.isWindows then ".exe" else "";
+            executable = if (final.isWindows || final.isCygwin) then ".exe" else "";
          };
        # Misc boolean options
        useAndroidPrebuilt = false;
@@ -204,6 +206,7 @@ let
            {
              linux = "Linux";
              windows = "Windows";
+              cygwin = "CYGWIN_NT";
              darwin = "Darwin";
              netbsd = "NetBSD";
              freebsd = "FreeBSD";
@@ -603,7 +606,7 @@ let
              "openbsd"
            else if final.isSunOS then
              "sunos"
-            else if final.isWindows then
+            else if (final.isWindows || final.isCygwin) then
              "win32"
            else
              null;
@@ -388,6 +388,10 @@ rec {
    useLLVM = true;
  };

+  x86_64-cygwin = {
+    config = "x86_64-pc-cygwin";
+  };
+
  # BSDs

  aarch64-freebsd = {
@@ -337,8 +337,7 @@ rec {
      kernel = kernels.windows;
    };
    isCygwin = {
-      kernel = kernels.windows;
-      abi = abis.cygnus;
+      kernel = kernels.cygwin;
    };
    isMinGW = {
      kernel = kernels.windows;
@@ -42,6 +42,7 @@ let
    isLinux
    isPower64
    isWindows
+    isCygwin
    ;

  inherit (lib.types)
@@ -617,6 +618,10 @@ rec {
        execFormat = pe;
        families = { };
      };
+      cygwin = {
+        execFormat = pe;
+        families = { };
+      };
      ghcjs = {
        execFormat = unknown;
        families = { };
@@ -650,7 +655,6 @@ rec {
  types.abi = enum (attrValues abis);

  abis = setTypes types.openAbi {
-    cygnus = { };
    msvc = { };

    # Note: eabi is specific to ARM and PowerPC.
@@ -783,11 +787,11 @@ rec {
          throw "system string '${lib.concatStringsSep "-" l}' with 1 component is ambiguous";
      "2" = # We only do 2-part hacks for things Nix already supports
        if elemAt l 1 == "cygwin" then
-          {
-            cpu = elemAt l 0;
-            kernel = "windows";
-            abi = "cygnus";
-          }
+          mkSkeletonFromList [
+            (elemAt l 0)
+            "pc"
+            "cygwin"
+          ]
        # MSVC ought to be the default ABI so this case isn't needed. But then it
        # becomes difficult to handle the gnu* variants for Aarch32 correctly for
        # minGW. So it's easier to make gnu* the default for the MinGW, but
@@ -851,6 +855,13 @@ rec {
              else
                elemAt l 2;
          }
+        # lots of tools expect a triplet for Cygwin, even though the vendor is just "pc"
+        else if elemAt l 2 == "cygwin" then
+          {
+            cpu = elemAt l 0;
+            vendor = elemAt l 1;
+            kernel = "cygwin";
+          }
        else
          throw "system string '${lib.concatStringsSep "-" l}' with 3 components is ambiguous";
      "4" = {
@@ -891,7 +902,7 @@ rec {
            getVendor args.vendor
          else if isDarwin parsed then
            vendors.apple
-          else if isWindows parsed then
+          else if (isWindows parsed || isCygwin parsed) then
            vendors.pc
          else
            vendors.unknown;
@@ -933,12 +944,7 @@ rec {
      abi,
      ...
    }:
-    if abi == abis.cygnus then
-      "${cpu.name}-cygwin"
-    else if kernel.families ? darwin then
-      "${cpu.name}-darwin"
-    else
-      "${cpu.name}-${kernelName kernel}";
+    if kernel.families ? darwin then "${cpu.name}-darwin" else "${cpu.name}-${kernelName kernel}";

  tripleFromSystem =
    {
@@ -326,7 +326,7 @@ in
  coerce_str_to_int_coercer_ouput = getMatrix {
    outerTypeName = "coercedTo";
    innerTypeName = "int->str";
-    getType = a: b: a.coercedTo b.int builtins.toString a.str;
+    getType = a: b: a.coercedTo b.int toString a.str;
    value = [ ];
    testAttrs = {
      expectedError = {
@@ -4488,7 +4488,7 @@ runTests {
    expr = packagesFromDirectoryRecursive {
      callPackage = path: overrides: import path overrides;
      # Do NOT remove the `builtins.toString` call here!!!
-      directory = builtins.toString ./packages-from-directory/plain;
+      directory = toString ./packages-from-directory/plain;
    };
    expected = {
      a = "a";
@@ -3,7 +3,7 @@
 {
  options = {
    value = lib.mkOption {
-      type = lib.types.coercedTo lib.types.int builtins.toString lib.types.str;
+      type = lib.types.coercedTo lib.types.int toString lib.types.str;
    };
  };
 }
@@ -4,7 +4,7 @@
  options = {
    value = lib.mkOption {
      default = 42;
-      type = lib.types.coercedTo lib.types.int builtins.toString lib.types.str;
+      type = lib.types.coercedTo lib.types.int toString lib.types.str;
    };
  };
 }
@@ -9,7 +9,7 @@

  _module.args.result =
    let
-      r = builtins.removeAttrs config [ "_module" ];
+      r = removeAttrs config [ "_module" ];
    in
    builtins.trace (builtins.deepSeq r r) (
      r == {
@@ -49,6 +49,7 @@ lib.runTests (
      ++ illumos
      ++ wasi
      ++ windows
+      ++ cygwin
      ++ embedded
      ++ mmix
      ++ js
@@ -202,8 +203,6 @@ lib.runTests (
      "x86_64-openbsd"
    ];
    testwindows = mseteq windows [
-      "i686-cygwin"
-      "x86_64-cygwin"
      "aarch64-windows"
      "i686-windows"
      "x86_64-windows"
@@ -769,7 +769,7 @@ in
    importTOML :: path -> any
    ```
  */
-  importTOML = path: builtins.fromTOML (builtins.readFile path);
+  importTOML = path: fromTOML (builtins.readFile path);

  /**
    `warn` *`message`* *`value`*
@@ -975,7 +975,7 @@ in
      unexpected = lib.subtractLists valid given;
    in
    lib.throwIfNot (unexpected == [ ])
-      "${msg}: ${builtins.concatStringsSep ", " (builtins.map builtins.toString unexpected)} unexpected; valid ones: ${builtins.concatStringsSep ", " (builtins.map builtins.toString valid)}";
+      "${msg}: ${builtins.concatStringsSep ", " (map toString unexpected)} unexpected; valid ones: ${builtins.concatStringsSep ", " (map toString valid)}";

  info = msg: builtins.trace "INFO: ${msg}";

@@ -1144,7 +1144,7 @@ in
      match = builtins.match "(0x)?([0-7]?[0-9A-Fa-f]{1,15})" str;
    in
    if match != null then
-      (builtins.fromTOML "v=0x${builtins.elemAt match 1}").v
+      (fromTOML "v=0x${builtins.elemAt match 1}").v
    else
      # TODO: Turn this into a `throw` in 26.05.
      assert lib.warn "fromHexString: ${
@@ -1153,7 +1153,7 @@ in
      let
        noPrefix = lib.strings.removePrefix "0x" (lib.strings.toLower str);
      in
-      (builtins.fromTOML "v=0x${noPrefix}").v;
+      (fromTOML "v=0x${noPrefix}").v;

  /**
    Convert the given positive integer to a string of its hexadecimal
@@ -1373,7 +1373,7 @@ let
            if builtins.isString v then
              ''"${v}"''
            else if builtins.isInt v then
-              builtins.toString v
+              toString v
            else if builtins.isBool v then
              boolToString v
            else
@@ -155,8 +155,15 @@ When reviewing changes to a team, read the team's scope and the context around t
 In any case, request reviews from the existing team members.
 If the team lists no specific membership policy, feel free to merge changes to the team after giving the existing members a few days to respond.

-*Important:* If a team says it is a closed group, do not merge additions to the team without an approval by at least one existing member.
+> [!IMPORTANT]
+> If a team says it is a closed group, do not merge additions to the team without an approval by at least one existing member.

+A corresponding GitHub team can be created by any org member.
+When creating the team it should be created with the `nixpkgs-maintainers` team as parent.
+Once approved, the team will have the right privileges to be pinged and requested for review in Nixpkgs.
+
+> [!TIP]
+> The team name should be as short as possible; because it is nested under the maintainers group, no -maintainers suffix is needed.

 # Maintainer scripts

@@ -1642,12 +1642,6 @@
    githubId = 106511;
    name = "Andrew Kelley";
  };
-  andrewsmith = {
-    email = "andrew@velvet.software";
-    github = "andrewsmith";
-    githubId = 29887;
-    name = "Andrew Smith";
-  };
  Andy3153 = {
    name = "Andrei Dobrete";
    email = "andy3153@protonmail.com";
@@ -7650,6 +7644,12 @@
    name = "Zhenbo Li";
    matrix = "@zhenbo:matrix.org";
  };
+  enkarterisi = {
+    name = "xNefas";
+    email = "enkarterisi@proton.me";
+    github = "xNefas";
+    githubId = 199727225;
+  };
  enorris = {
    name = "Eric Norris";
    email = "erictnorris@gmail.com";
@@ -7925,6 +7925,12 @@
    name = "Elis Hirwing";
    keys = [ { fingerprint = "67FE 98F2 8C44 CF22 1828  E12F D57E FA62 5C9A 925F"; } ];
  };
+  etwas = {
+    email = "ein@etwas.me";
+    github = "eetwas";
+    githubId = 74488187;
+    name = "etwas";
+  };
  eu90h = {
    email = "stefan@eu90h.com";
    github = "eu90h";
@@ -9392,6 +9398,11 @@
    githubId = 5549373;
    name = "Jochen Kiemes";
  };
+  ginkogruen = {
+    name = "Jasper Wolter";
+    github = "ginkogruen";
+    githubId = 93037574;
+  };
  giodamelio = {
    name = "Giovanni d'Amelio";
    email = "gio@damelio.net";
@@ -18056,6 +18067,12 @@
    matrix = "@n3t:matrix.org";
    name = "Adrian Sadłocha";
  };
+  Necoro = {
+    email = "nix@necoro.dev";
+    github = "Necoro";
+    githubId = 68708;
+    name = "René Neumann";
+  };
  necrophcodr = {
    email = "nc@scalehost.eu";
    github = "necrophcodr";
@@ -18104,12 +18121,6 @@
    githubId = 50854675;
    name = "Nelson Jeppesen";
  };
-  neonfuz = {
-    email = "neonfuz@gmail.com";
-    github = "neonfuz";
-    githubId = 2590830;
-    name = "Sage Raflik";
-  };
  neosimsim = {
    email = "me@abn.sh";
    github = "neosimsim";
@@ -19981,12 +19992,6 @@
    githubId = 63069986;
    name = "Per Stark";
  };
-  petee = {
-    name = "Pete Erickson";
-    email = "pete.perickson@gmail.com";
-    github = "petee";
-    githubId = 89916;
-  };
  Peter3579 = {
    github = "Peter3579";
    githubId = 170885528;
@@ -21577,6 +21582,12 @@
    github = "i-am-logger";
    githubId = 1440852;
  };
+  rebmit = {
+    name = "Lu Wang";
+    email = "rebmit@rebmit.moe";
+    github = "rebmit";
+    githubId = 188659765;
+  };
  reckenrode = {
    name = "Randy Eckenrode";
    email = "randy@largeandhighquality.com";
@@ -24485,14 +24496,6 @@
    githubId = 18124752;
    email = "m@rvinvogt.com";
  };
-  srxl = {
-    name = "Ruby Iris Juric";
-    email = "ruby@srxl.me";
-    matrix = "@ruby:isincredibly.gay";
-    github = "Sorixelle";
-    githubId = 38685302;
-    keys = [ { fingerprint = "2D76 76C7 A28E 16FC 75C7  268D 1B55 6ED8 4B0E 303A"; } ];
-  };
  Srylax = {
    name = "Srylax";
    email = "srylax+nixpkgs@srylax.dev";
@@ -28058,12 +28061,6 @@
    github = "x123";
    githubId = 5481629;
  };
-  x3ro = {
-    name = "^x3ro";
-    email = "nix@x3ro.dev";
-    github = "x3rAx";
-    githubId = 2268851;
-  };
  x807x = {
    name = "x807x";
    email = "s10855168@gmail.com";
@@ -28707,6 +28704,12 @@
    githubId = 10415894;
    name = "Zahrun";
  };
+  zainkergaye = {
+    email = "zain@zkergaye.me";
+    github = "zainkergaye";
+    githubId = 62440012;
+    name = "Zain Kergaye";
+  };
  zakame = {
    email = "zakame@zakame.net";
    github = "zakame";
@@ -91,16 +91,7 @@ All successfully loaded drivers are exposed to the application as
 different GPUs. In NixOS, there are two ways to make ICD files visible
 to Vulkan applications: an environment variable and a module option.

-The first option is through the `VK_ICD_FILENAMES` environment variable.
-This variable can contain multiple JSON files, separated by `:`. For
-example:
-
-```ShellSession
-$ export \
-  VK_ICD_FILENAMES=`nix-build '<nixpkgs>' --no-out-link -A amdvlk`/share/vulkan/icd.d/amd_icd64.json
-```
-
-The second mechanism is to add the Vulkan driver package to
+The way to do this is to add the Vulkan driver package to
 [](#opt-hardware.graphics.extraPackages).
 This links the ICD file under `/run/opengl-driver`, where it will be
 visible to the ICD loader.
@@ -129,25 +120,7 @@ vulkan-tools package.

 Modern AMD [Graphics Core
 Next](https://en.wikipedia.org/wiki/Graphics_Core_Next) (GCN) GPUs are
-supported through either radv, which is part of mesa, or the amdvlk
-package. Adding the amdvlk package to
-[](#opt-hardware.graphics.extraPackages)
-makes amdvlk the default driver and hides radv and lavapipe from the device list.
-A specific driver can be forced as follows:
-
-```nix
-{
-  hardware.graphics.extraPackages = [ pkgs.amdvlk ];
-
-  # To enable Vulkan support for 32-bit applications, also add:
-  hardware.graphics.extraPackages32 = [ pkgs.driversi686Linux.amdvlk ];
-
-  # Force radv
-  environment.variables.AMD_VULKAN_ICD = "RADV";
-  # Or
-  environment.variables.VK_ICD_FILENAMES = "/run/opengl-driver/share/vulkan/icd.d/radeon_icd.x86_64.json";
-}
-```
+supported through the RADV driver, which is part of mesa.

 ## VA-API {#sec-gpu-accel-va-api}

@@ -358,6 +358,37 @@ have a predefined type and string generator already declared under

    :   Outputs the xml with header.

+`pkgs.formats.pythonVars` { }
+
+:   A function taking an empty attribute set (for future extensibility)
+    and returning a set with python variable specific attributes `type`, `lib`, and
+    `generate` as specified [below](#pkgs-formats-result).
+
+    The `lib` attribute contains functions to be used in settings, for
+    generating special Python values:
+
+    `mkRaw pythonCode`
+
+    :   Outputs the given string as raw Python code
+
+    `_imports`
+
+    `_imports` is a special value you can set to specify additional modules to be
+    imported on top of the file.
+
+    `Example usage:`
+
+    ```nix
+      let
+        format = pkgs.formats.pythonVars { };
+      in {
+        _imports = [ "re" ];
+
+        conditional = format.lib.mkRaw "1 if True else 2";
+        function_result = format.lib.mkRaw "re.findall(r'\\bf[a-z]*', 'which foot or hand fell fastest')";
+      }
+    ```
+
 `pkgs.formats.cdn` { }

 :   A function taking an empty attribute set (for future extensibility)
@@ -40,12 +40,18 @@ An example of how to build an image:
 }
 ```

-## Nix Store Partition {#sec-image-repart-store-partition}
+## Nix Store Paths {#sec-image-repart-store-paths}
+
+If you want to rewrite Nix store paths, e.g., to remove the `/nix/store` prefix
+or to nest it below a parent path, you can do that through the
+`nixStorePrefix` option.
+
+### Nix Store Partition {#sec-image-repart-store-partition}

 You can define a partition that only contains the Nix store and then mount it
 under `/nix/store`. Because the `/nix/store` part of the paths is already
-determined by the mount point, you have to set `stripNixStorePrefix = true;` so
-that the prefix is stripped from the paths before copying them into the image.
+determined by the mount point, you have to set `nixStorePrefix = "/"` so
+that `/nix/store` is stripped from the paths before copying them into the image.

 ```nix
 {
@@ -54,7 +60,7 @@ that the prefix is stripped from the paths before copying them into the image.
  image.repart.partitions = {
    "store" = {
      storePaths = [ config.system.build.toplevel ];
-      stripNixStorePrefix = true;
+      nixStorePrefix = "/";
      repartConfig = {
        Type = "linux-generic";
        Label = "nix-store";
@@ -65,6 +71,42 @@ that the prefix is stripped from the paths before copying them into the image.
 }
 ```

+### Nix Store Subvolume {#sec-image-repart-store-subvolume}
+
+Alternatively, you can create a Btrfs subvolume `/@nix-store` containing the
+Nix store and mount it on `/nix/store`:
+
+```nix
+{
+  fileSystems."/" = {
+    device = "/dev/disk/by-partlabel/root";
+    fsType = "btrfs";
+    options = [ "subvol=/@" ];
+  };
+
+  fileSystems."/nix/store" = {
+    device = "/dev/disk/by-partlabel/root";
+    fsType = "btrfs";
+    options = [ "subvol=/@nix-store" ];
+  };
+
+  image.repart.partitions = {
+    "root" = {
+      storePaths = [ config.system.build.toplevel ];
+      nixStorePrefix = "/@nix-store";
+      repartConfig = {
+        Type = "root";
+        Label = "root";
+        Format = "btrfs";
+        Subvolumes = "/@ /@nix-store";
+        MakeDirectories = "/@ /@nix-store";
+        # ...
+      };
+    };
+  };
+}
+```
+
 ## Appliance Image {#sec-image-repart-appliance}

 The `image/repart.nix` module can also be used to build self-contained [software
@@ -302,9 +302,15 @@
  "sec-image-repart": [
    "index.html#sec-image-repart"
  ],
+  "sec-image-repart-store-paths": [
+    "index.html#sec-image-repart-store-paths"
+  ],
  "sec-image-repart-store-partition": [
    "index.html#sec-image-repart-store-partition"
  ],
+  "sec-image-repart-store-subvolume": [
+    "index.html#sec-image-repart-store-subvolume"
+  ],
  "sec-image-repart-appliance": [
    "index.html#sec-image-repart-appliance"
  ],
@@ -29,7 +29,7 @@

 - Convenience options for `amdgpu`, the open source driver for Radeon cards, are now available under [`hardware.amdgpu`](#opt-hardware.amdgpu.initrd.enable).

- [AMDVLK](https://github.com/GPUOpen-Drivers/AMDVLK), AMD's open source Vulkan driver, is now available to be configured under the [`hardware.amdgpu.amdvlk`](#opt-hardware.amdgpu.amdvlk.enable) option.
+- [AMDVLK](https://github.com/GPUOpen-Drivers/AMDVLK), AMD's open source Vulkan driver, is now available to be configured under the {option}`hardware.amdgpu.amdvlk` option.
  This also allows configuring runtime settings for AMDVLK, including enabling experimental features.

 - The `moonlight-qt` package (for [Moonlight game streaming](https://moonlight-stream.org/)) now has HDR support on Linux systems.
@@ -12,6 +12,8 @@

 - The default PostgreSQL version for new NixOS installations (i.e. with `system.stateVersion >= 25.11`) is v17.

+- Added `nixos-init`, a Rust-based bashless initialization system for systemd initrd. This allows to build NixOS systems without any interpreter. Enable via `system.nixos-init.enable = true;`.
+
 - The NetworkManager module does not ship with a default set of VPN plugins anymore. All required VPN plugins must now be explicitly configured in [`networking.networkmanager.plugins`](#opt-networking.networkmanager.plugins).

 - The Qt 5-based versions of KDE Gear, Plasma, Maui and Deepin have been removed. Users are advised to migrate to Plasma 6 and Gear 25.08, available under `kdePackages`.
@@ -148,6 +150,8 @@

 - The `no-broken-symlink` build hook now also fails builds whose output derivation contains links to $TMPDIR (typically /build, which contains the build directory).

+- `hardware.amdgpu.amdvlk` and the `amdvlk` package have been removed, as they have been deprecated by AMD. These have been replaced with the RADV driver from Mesa, which is enabled by default.
+
 - The `services.polipo` module has been removed as `polipo` is unmaintained and archived upstream.

 - `virtualisation.lxd` has been removed due to lack of Nixpkgs maintenance. Users can migrate to `virtualisation.incus`, a fork of LXD, as a replacement. See [Incus migration documentation](https://linuxcontainers.org/incus/docs/main/howto/server_migrate_lxd/) for migration information.
@@ -170,10 +174,14 @@
 - The zookeeper project changed their logging tool to logback, therefore `services.zookeeper.logging` option has been updated to expect a logback compatible string.
 - The `dovecot` systemd service was renamed from `dovecot2` to `dovecot`. The former is now just an alias. Update any overrides on the systemd unit to the new name.

- Configurations with `boot.initrd.systend.enable && !boot.initrd.enable` will have their `init` script at `$toplevel/init` instead of `$toplevel/prepare-root`. This is because it does not make sense for systemd stage 1 to affect the `init` script when stage 1 is entirely disabled (e.g. containers).
+- Configurations with `boot.initrd.systemd.enable && !boot.initrd.enable` will have their `init` script at `$toplevel/init` instead of `$toplevel/prepare-root`. This is because it does not make sense for systemd stage 1 to affect the `init` script when stage 1 is entirely disabled (e.g. containers).

 - `programs.goldwarden` has been removed, due to the software not working with newer versions of the Bitwarden and Vaultwarden servers, as well as it being abandoned upstream.

+- The `chatgpt-retrieval-plugin` package and `services.chatgpt-retrieval-plugin` module were removed due to the package having been broken since at least November 2024.
+
+- The `cardboard` package and `programs.cardboard` module were removed due to the package having been broken since at least November 2024.
+
 - The default `kops` version is now 1.33.0 and versions 1.30 and older have been dropped. See [Upgrading Kubernetes](https://kops.sigs.k8s.io/tutorial/upgrading-kubernetes/) for instructions on how to update kOps.

 - `programs.skim.fuzzyCompletions` has been removed in favor of adding the completions to the package itself.
@@ -192,6 +200,8 @@

 - The `services.postgresql` module now sets up a systemd unit `postgresql.target`. Depending on `postgresql.target` guarantees that postgres is in read-write mode and initial/ensure scripts were executed. Depending on `postgresql.service` only guarantees a read-only connection.

+- The `services.mysql` module now restarts the database `on-abnormal`, which means that it now will be restarted in certain situations, it wasn't before. For example an OOM-kill.
+
 - The `services.siproxd` module has been removed as `siproxd` is unmaintained and broken with libosip 5.x.

 - `services.tor.torsocks.enable` no longer defaults to true if Tor and Tor client functionality is enabled.
@@ -268,6 +268,7 @@ in
          sw:
          let
            realDevice' = utils.escapeSystemdPath sw.realDevice;
+            btrfsInSystem = config.boot.supportedFilesystems.btrfs or false;
          in
          lib.nameValuePair "mkswap-${sw.deviceName}" {
            description = "Initialisation of swap device ${sw.device}";
@@ -287,6 +288,7 @@ in
              pkgs.util-linux
              pkgs.e2fsprogs
            ]
+            ++ lib.optional btrfsInSystem pkgs.btrfs-progs
            ++ lib.optional sw.randomEncryption.enable pkgs.cryptsetup;

            environment.DEVICE = sw.device;
@@ -295,13 +297,19 @@ in
              ${lib.optionalString (sw.size != null) ''
                currentSize=$(( $(stat -c "%s" "$DEVICE" 2>/dev/null || echo 0) / 1024 / 1024 ))
                if [[ ! -b "$DEVICE" && "${toString sw.size}" != "$currentSize" ]]; then
-                  # Disable CoW for CoW based filesystems like BTRFS.
-                  truncate --size 0 "$DEVICE"
-                  chattr +C "$DEVICE" 2>/dev/null || true
+                  if [[ $(stat -f -c %T $(dirname "$DEVICE")) == "btrfs" ]]; then
+                    # Use btrfs mkswapfile to speed up the creation of swapfile.
+                    rm -f "$DEVICE"
+                    btrfs filesystem mkswapfile --size "${toString sw.size}M" --uuid clear "$DEVICE"
+                  else
+                    # Disable CoW for CoW based filesystems.
+                    truncate --size 0 "$DEVICE"
+                    chattr +C "$DEVICE" 2>/dev/null || true

-                  echo "Creating swap file using dd and mkswap."
-                  dd if=/dev/zero of="$DEVICE" bs=1M count=${toString sw.size} status=progress
-                  ${lib.optionalString (!sw.randomEncryption.enable) "mkswap ${sw.realDevice}"}
+                    echo "Creating swap file using dd and mkswap."
+                    dd if=/dev/zero of="$DEVICE" bs=1M count=${toString sw.size} status=progress
+                    ${lib.optionalString (!sw.randomEncryption.enable) "mkswap ${sw.realDevice}"}
+                  fi
                fi
              ''}
              ${lib.optionalString sw.randomEncryption.enable ''
@@ -53,18 +53,16 @@ in

    boot.blacklistedKernelModules = cfg.blacklistedKernelModules;

-    systemd.user.services.opentabletdriver =
-      with pkgs;
-      lib.mkIf cfg.daemon.enable {
-        description = "Open source, cross-platform, user-mode tablet driver";
-        wantedBy = [ "graphical-session.target" ];
-        partOf = [ "graphical-session.target" ];
+    systemd.user.services.opentabletdriver = lib.mkIf cfg.daemon.enable {
+      description = "Open source, cross-platform, user-mode tablet driver";
+      wantedBy = [ "graphical-session.target" ];
+      partOf = [ "graphical-session.target" ];

-        serviceConfig = {
-          Type = "simple";
-          ExecStart = "${cfg.package}/bin/otd-daemon";
-          Restart = "on-failure";
-        };
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = lib.getExe' cfg.package "otd-daemon";
+        Restart = "on-failure";
      };
+    };
  };
 }
@@ -36,11 +36,11 @@ def add_contents_to_definition(


 def add_closure_to_definition(
-    definition: Path, closure: Path | None, strip_nix_store_prefix: bool | None
+    definition: Path, closure: Path | None, nix_store_prefix: str | None
 ) -> None:
    """Add CopyFiles= instructions to a definition for all paths in the closure.

-    If strip_nix_store_prefix is True, `/nix/store` is stripped from the target path.
+    Replace `/nix/store` with the value of nix_store_prefix.
    """
    if not closure:
        return
@@ -52,10 +52,12 @@ def add_closure_to_definition(
                continue

            source = Path(line.strip())
-            target = str(source.relative_to("/nix/store/"))
-            target = f":/{target}" if strip_nix_store_prefix else ""
+            option = f"CopyFiles={source}"
+            if nix_store_prefix:
+                target = nix_store_prefix / source.relative_to("/nix/store/")
+                option = f"{option}:{target}"

-            copy_files_lines.append(f"CopyFiles={source}{target}\n")
+            copy_files_lines.append(f"{option}\n")

    with open(definition, "a") as f:
        f.writelines(copy_files_lines)
@@ -102,8 +104,8 @@ def main() -> None:
        add_contents_to_definition(definition, contents)

        closure = config.get("closure")
-        strip_nix_store_prefix = config.get("stripNixStorePrefix")
-        add_closure_to_definition(definition, closure, strip_nix_store_prefix)
+        nix_store_prefix = config.get("nixStorePrefix")
+        add_closure_to_definition(definition, closure, nix_store_prefix)

    print(target_dir.absolute())

@@ -30,7 +30,7 @@
  # arguments
  name,
  version,
-  imageFileBasename,
+  baseName,
  compression,
  fileSystems,
  finalPartitions,
@@ -205,7 +205,7 @@ stdenvNoCC.mkDerivation (
      echo "Building image with systemd-repart..."
      unshare --map-root-user fakeroot systemd-repart \
        ''${systemdRepartFlags[@]} \
-        ${imageFileBasename}.raw \
+        ${baseName}.raw \
        | tee repart-output.json

      runHook postBuild
@@ -220,14 +220,14 @@ stdenvNoCC.mkDerivation (
    # separate derivation to allow users to save disk space. Disk images are
    # already very space intensive so we want to allow users to mitigate this.
    + lib.optionalString compression.enable ''
-      for f in ${imageFileBasename}*; do
+      for f in ${baseName}*; do
        echo "Compressing $f with ${compression.algorithm}..."
        # Keep the original file when compressing and only delete it afterwards
        ${compressionCommand} $f && rm $f
      done
    ''
    + ''
-      mv -v repart-output.json ${imageFileBasename}* $out
+      mv -v repart-output.json ${baseName}* $out

      runHook postInstall
    '';
@@ -194,8 +194,8 @@ in
                  | assert_uki_repart_match.py "${config.system.build.intermediateImage}/repart-output.json"

                # copy the uncompressed intermediate image, so that systemd-repart picks it up
-                cp -v ${config.system.build.intermediateImage}/${config.image.repart.imageFileBasename}.raw .
-                chmod +w ${config.image.repart.imageFileBasename}.raw
+                cp -v ${config.system.build.intermediateImage}/${config.image.baseName}.raw .
+                chmod +w ${config.image.baseName}.raw
              '';

              # replace "TBD" with the original roothash values
@@ -15,69 +15,83 @@ let

  inherit (utils.systemdUtils.lib) GPTMaxLabelLength;

-  partitionOptions = {
-    options = {
-      storePaths = lib.mkOption {
-        type = with lib.types; listOf path;
-        default = [ ];
-        description = "The store paths to include in the partition.";
-      };
-
-      stripNixStorePrefix = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = ''
-          Whether to strip `/nix/store/` from the store paths. This is useful
-          when you want to build a partition that only contains store paths and
-          is mounted under `/nix/store`.
-        '';
-      };
-
-      contents = lib.mkOption {
-        type =
-          with lib.types;
-          attrsOf (submodule {
-            options = {
-              source = lib.mkOption {
-                type = types.path;
-                description = "Path of the source file.";
-              };
-            };
-          });
-        default = { };
-        example = lib.literalExpression ''
-          {
-            "/EFI/BOOT/BOOTX64.EFI".source =
-              "''${pkgs.systemd}/lib/systemd/boot/efi/systemd-bootx64.efi";
-
-            "/loader/entries/nixos.conf".source = systemdBootEntry;
-          }
-        '';
-        description = "The contents to end up in the filesystem image.";
-      };
-
-      repartConfig = lib.mkOption {
-        type =
-          with lib.types;
-          attrsOf (oneOf [
-            str
-            int
-            bool
-            (listOf str)
-          ]);
-        example = {
-          Type = "home";
-          SizeMinBytes = "512M";
-          SizeMaxBytes = "2G";
+  partitionOptions =
+    { config, ... }:
+    {
+      options = {
+        storePaths = lib.mkOption {
+          type = with lib.types; listOf path;
+          default = [ ];
+          description = "The store paths to include in the partition.";
        };
-        description = ''
-          Specify the repart options for a partiton as a structural setting.
-          See {manpage}`repart.d(5)`
-          for all available options.
-        '';
+
+        # Superseded by `nixStorePrefix`. Unfortunately, `mkChangedOptionModule`
+        # does not support submodules.
+        stripNixStorePrefix = lib.mkOption {
+          default = "_mkMergedOptionModule";
+          visible = false;
+        };
+
+        nixStorePrefix = lib.mkOption {
+          type = lib.types.path;
+          default = "/nix/store";
+          description = ''
+            The prefix to use for store paths. Defaults to `/nix/store`. This is
+            useful when you want to build a partition that only contains store
+            paths and is mounted under `/nix/store` or if you want to create the
+            store paths below a parent path (e.g., `/@nix/nix/store`).
+          '';
+        };
+
+        contents = lib.mkOption {
+          type =
+            with lib.types;
+            attrsOf (submodule {
+              options = {
+                source = lib.mkOption {
+                  type = types.path;
+                  description = "Path of the source file.";
+                };
+              };
+            });
+          default = { };
+          example = lib.literalExpression ''
+            {
+              "/EFI/BOOT/BOOTX64.EFI".source =
+                "''${pkgs.systemd}/lib/systemd/boot/efi/systemd-bootx64.efi";
+
+              "/loader/entries/nixos.conf".source = systemdBootEntry;
+            }
+          '';
+          description = "The contents to end up in the filesystem image.";
+        };
+
+        repartConfig = lib.mkOption {
+          type =
+            with lib.types;
+            attrsOf (oneOf [
+              str
+              int
+              bool
+              (listOf str)
+            ]);
+          example = {
+            Type = "home";
+            SizeMinBytes = "512M";
+            SizeMaxBytes = "2G";
+          };
+          description = ''
+            Specify the repart options for a partiton as a structural setting.
+            See {manpage}`repart.d(5)`
+            for all available options.
+          '';
+        };
+      };
+
+      config = lib.mkIf (config.stripNixStorePrefix == true) {
+        nixStorePrefix = "/";
      };
    };
-  };

  mkfsOptionsToEnv =
    opts:
@@ -350,7 +364,7 @@ in
          }
        ) cfg.partitions;

-        warnings = lib.filter (v: v != null) (
+        warnings = lib.flatten (
          lib.mapAttrsToList (
            fileName: partitionConfig:
            let
@@ -358,20 +372,23 @@ in
              suggestedMaxLabelLength = GPTMaxLabelLength - 2;
              labelLength = builtins.stringLength repartConfig.Label;
            in
-            if (repartConfig ? Label && labelLength >= suggestedMaxLabelLength) then
-              ''
-                The partition label '${repartConfig.Label}'
-                defined for '${fileName}' is ${toString labelLength} characters long.
-                The suggested maximum label length is ${toString suggestedMaxLabelLength}.
+            lib.optional (repartConfig ? Label && labelLength >= suggestedMaxLabelLength) ''
+              The partition label '${repartConfig.Label}'
+              defined for '${fileName}' is ${toString labelLength} characters long.
+              The suggested maximum label length is ${toString suggestedMaxLabelLength}.

-                If you use sytemd-sysupdate style A/B updates, this might
-                not leave enough space to increment the version number included in
-                the label in a future release. For example, if your label is
-                ${toString GPTMaxLabelLength} characters long (the maximum enforced by UEFI) and
-                you're at version 9, you cannot increment this to 10.
-              ''
-            else
-              null
+              If you use sytemd-sysupdate style A/B updates, this might
+              not leave enough space to increment the version number included in
+              the label in a future release. For example, if your label is
+              ${toString GPTMaxLabelLength} characters long (the maximum enforced by UEFI) and
+              you're at version 9, you cannot increment this to 10.
+            ''
+            ++ lib.optional (partitionConfig.stripNixStorePrefix != "_mkMergedOptionModule") ''
+              The option definition `image.repart.paritions.${fileName}.stripNixStorePrefix`
+              has changed to `image.repart.paritions.${fileName}.nixStorePrefix` and now
+              accepts the path to use as prefix directly. Use `nixStorePrefix = "/"` to
+              achieve the same effect as setting `stripNixStorePrefix = true`.
+            ''
          ) cfg.partitions
        );
      };
@@ -391,7 +408,7 @@ in
        mkfsEnv = mkfsOptionsToEnv cfg.mkfsOptions;
        val = pkgs.callPackage ./repart-image.nix {
          systemd = cfg.package;
-          imageFileBasename = config.image.baseName;
+          inherit (config.image) baseName;
          inherit (cfg)
            name
            version
@@ -341,8 +341,6 @@ in
    system.build = {
      inherit nixos-generate-config nixos-install;
      nixos-rebuild = if config.system.rebuild.enableNg then nixos-rebuild-ng else nixos-rebuild;
-      nixos-option = lib.warn "Accessing nixos-option through `config.system.build` is deprecated, use `pkgs.nixos-option` instead." pkgs.nixos-option;
-      nixos-enter = lib.warn "Accessing nixos-enter through `config.system.build` is deprecated, use `pkgs.nixos-enter` instead." pkgs.nixos-enter;
    };
  };
 }
@@ -337,7 +337,6 @@
  ./programs/vivid.nix
  ./programs/vscode.nix
  ./programs/wavemon.nix
-  ./programs/wayland/cardboard.nix
  ./programs/wayland/dwl.nix
  ./programs/wayland/gtklock.nix
  ./programs/wayland/hyprland.nix
@@ -632,7 +631,6 @@
  ./services/hardware/acpid.nix
  ./services/hardware/actkbd.nix
  ./services/hardware/amdgpu.nix
-  ./services/hardware/amdvlk.nix
  ./services/hardware/argonone.nix
  ./services/hardware/asusd.nix
  ./services/hardware/auto-cpufreq.nix
@@ -1237,7 +1235,6 @@
  ./services/networking/mmsd.nix
  ./services/networking/modemmanager.nix
  ./services/networking/monero.nix
-  ./services/networking/morty.nix
  ./services/networking/mosquitto.nix
  ./services/networking/mozillavpn.nix
  ./services/networking/mptcpd.nix
@@ -1554,7 +1551,6 @@
  ./services/web-apps/calibre-web.nix
  ./services/web-apps/castopod.nix
  ./services/web-apps/changedetection-io.nix
-  ./services/web-apps/chatgpt-retrieval-plugin.nix
  ./services/web-apps/chhoto-url.nix
  ./services/web-apps/cloudlog.nix
  ./services/web-apps/code-server.nix
@@ -1,31 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.programs.cardboard;
-in
-{
-  meta.maintainers = with lib.maintainers; [ ];
-
-  options.programs.cardboard = {
-    enable = lib.mkEnableOption "cardboard";
-
-    package = lib.mkPackageOption pkgs "cardboard" { };
-  };
-
-  config = lib.mkIf cfg.enable (
-    lib.mkMerge [
-      {
-        environment.systemPackages = [ cfg.package ];
-
-        # To make a cardboard session available for certain DMs like SDDM
-        services.displayManager.sessionPackages = [ cfg.package ];
-      }
-      (import ./wayland-session.nix { inherit lib pkgs; })
-    ]
-  );
-}
@@ -34,6 +34,11 @@ in
      "fontconfig"
      "penultimate"
    ] "The corresponding package has removed from nixpkgs.")
+    (mkRemovedOptionModule [
+      "hardware"
+      "amdgpu"
+      "amdvlk"
+    ] "'amdvlk' has been removed. The replacement driver RADV, part of Mesa, is enabled by default.")
    (mkRemovedOptionModule [ "hardware" "brightnessctl" ] ''
      The brightnessctl module was removed because newer versions of
      brightnessctl don't require the udev rules anymore (they can use the
@@ -58,6 +63,10 @@ in
      "networking"
      "wicd"
    ] "The corresponding package was removed from nixpkgs.")
+    (mkRemovedOptionModule [
+      "programs"
+      "cardboard"
+    ] "The corresponding package was removed from nixpkgs.")
    (mkRemovedOptionModule [
      "programs"
      "gnome-documents"
@@ -109,6 +118,10 @@ in
      "cgmanager"
      "enable"
    ] "cgmanager was deprecated by lxc and therefore removed from nixpkgs.")
+    (mkRemovedOptionModule [
+      "services"
+      "chatgpt-retrieval-plugin"
+    ] "The corresponding package was removed from nixpkgs.")
    (mkRemovedOptionModule [
      "services"
      "chronos"
@@ -211,6 +224,9 @@ in
      "services"
      "moinmoin"
    ] "The corresponding package was removed from nixpkgs.")
+    (mkRemovedOptionModule [ "services" "morty" ]
+      "services.morty has been removed from NixOS. As the morty package was unmaintained and removed and searxng, its main consumer, dropped support for it."
+    )
    (mkRemovedOptionModule [ "services" "mwlib" ] "The corresponding package was removed from nixpkgs.")
    (mkRemovedOptionModule [ "services" "pantheon" "files" ] ''
      This module was removed, please add pkgs.pantheon.elementary-files to environment.systemPackages directly.
@@ -40,7 +40,7 @@ in
    security.pki.certificateFiles = lib.mkOption {
      type = lib.types.listOf lib.types.path;
      default = [ ];
-      example = lib.literalExpression ''[ "''${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt" ]'';
+      example = lib.literalExpression ''[ "''${pkgs.dn42-cacert}/etc/ssl/certs/dn42-ca.crt" ]'';
      description = ''
        A list of files containing trusted root certificates in PEM
        format. These are concatenated to form
@@ -26,7 +26,7 @@
    default = { };
    type = lib.types.attrsOf (
      lib.types.submodule (
-        { name, ... }:
+        { name, config, ... }:
        {
          options = {
            enable = lib.mkOption {
@@ -186,7 +186,11 @@
              default = { };
            };

-            package = lib.mkPackageOption pkgs "github-runner" { };
+            package = lib.mkPackageOption pkgs "github-runner" { } // {
+              apply =
+                # Support old github-runner versions which don't have the `nodeRuntimes` arg yet.
+                pkg: pkg.override (old: lib.optionalAttrs (old ? nodeRuntimes) { inherit (config) nodeRuntimes; });
+            };

            ephemeral = lib.mkOption {
              type = lib.types.bool;
@@ -41,10 +41,6 @@
        currentConfigTokenFilename = ".current-token";

        workDir = if cfg.workDir == null then runtimeDir else cfg.workDir;
-        # Support old github-runner versions which don't have the `nodeRuntimes` arg yet.
-        package = cfg.package.override (
-          old: lib.optionalAttrs (lib.hasAttr "nodeRuntimes" old) { inherit (cfg) nodeRuntimes; }
-        );
      in
      lib.nameValuePair svcName {
        description = "GitHub Actions runner";
@@ -77,7 +73,7 @@

        serviceConfig = lib.mkMerge [
          {
-            ExecStart = "${package}/bin/Runner.Listener run --startuptype service";
+            ExecStart = "${cfg.package}/bin/Runner.Listener run --startuptype service";

            # Does the following, sequentially:
            # - If the module configuration or the token has changed, purge the state directory,
@@ -196,7 +192,7 @@
                        else
                          args+=(--token "$token")
                        fi
-                        ${package}/bin/Runner.Listener configure "''${args[@]}"
+                        ${cfg.package}/bin/Runner.Listener configure "''${args[@]}"
                        # Move the automatically created _diag dir to the logs dir
                        mkdir -p  "$STATE_DIRECTORY/_diag"
                        cp    -r  "$STATE_DIRECTORY/_diag/." "$LOGS_DIRECTORY/"
@@ -691,7 +691,7 @@ in
      serviceConfig = lib.mkMerge [
        {
          Type = if hasNotify then "notify" else "simple";
-          Restart = "on-abort";
+          Restart = "on-abnormal";
          RestartSec = "5s";

          # User and group
@@ -72,6 +72,8 @@ in
    environment.pathsToLink = [
      "/share/backgrounds"
      "/share/cosmic"
+      "/share/cosmic-layouts"
+      "/share/cosmic-themes"
    ];
    environment.systemPackages = utils.removePackagesByName (
      corePkgs
@@ -321,6 +321,7 @@ in
            elementary-code
            elementary-files
            elementary-mail
+            elementary-maps
            elementary-music
            elementary-photos
            elementary-screenshot
@@ -369,6 +369,9 @@ in
    systemd.user.services.pipewire.environment.LV2_PATH = mkIf (
      !cfg.systemWide
    ) "${lv2Plugins}/lib/lv2";
+    systemd.user.services.filter-chain.environment.LV2_PATH = mkIf (
+      !cfg.systemWide
+    ) "${lv2Plugins}/lib/lv2";

    # Mask pw-pulse if it's not wanted
    systemd.services.pipewire-pulse.enable = cfg.pulse.enable && cfg.systemWide;
@@ -257,6 +257,7 @@ in
      theme = mkOption {
        type = types.str;
        default = "";
+        example = lib.literalExpression "\"\${pkgs.where-is-my-sddm-theme.override { variants = [ \"qt5\" ]; }}/share/sddm/themes/where_is_my_sddm_theme_qt5\"";
        description = ''
          Greeter theme to use.
        '';
@@ -40,7 +40,6 @@ in
    };

    opencl.enable = lib.mkEnableOption ''OpenCL support using ROCM runtime library'';
-    # cfg.amdvlk option is defined in ./amdvlk.nix module
  };

  config = {
@@ -1,65 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.hardware.amdgpu.amdvlk;
-in
-{
-  options.hardware.amdgpu.amdvlk = {
-    enable = lib.mkEnableOption "AMDVLK Vulkan driver";
-
-    package = lib.mkPackageOption pkgs "amdvlk" { };
-
-    supportExperimental.enable = lib.mkEnableOption "Experimental features support";
-
-    support32Bit.enable = lib.mkEnableOption "32-bit driver support";
-    support32Bit.package = lib.mkPackageOption pkgs [ "driversi686Linux" "amdvlk" ] { };
-
-    settings = lib.mkOption {
-      type = with lib.types; attrsOf (either str int);
-      default = { };
-      example = {
-        AllowVkPipelineCachingToDisk = 1;
-        ShaderCacheMode = 1;
-        IFH = 0;
-        EnableVmAlwaysValid = 1;
-        IdleAfterSubmitGpuMask = 1;
-      };
-      description = ''
-        Runtime settings for AMDVLK to be configured {file}`/etc/amd/amdVulkanSettings.cfg`.
-        See [AMDVLK GitHub page](https://github.com/GPUOpen-Drivers/AMDVLK?tab=readme-ov-file#runtime-settings).
-      '';
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    hardware.graphics = {
-      enable = true;
-      extraPackages = [ cfg.package ];
-    }
-    // lib.optionalAttrs cfg.support32Bit.enable {
-      enable32Bit = true;
-      extraPackages32 = [ cfg.support32Bit.package ];
-    };
-
-    environment.sessionVariables = lib.mkIf cfg.supportExperimental.enable {
-      AMDVLK_ENABLE_DEVELOPING_EXT = "all";
-    };
-
-    environment.etc = lib.mkIf (cfg.settings != { }) {
-      "amd/amdVulkanSettings.cfg".text = lib.concatStrings (
-        lib.mapAttrsToList (n: v: ''
-          ${n},${builtins.toString v}
-        '') cfg.settings
-      );
-    };
-  };
-
-  meta = {
-    maintainers = with lib.maintainers; [ johnrtitor ];
-  };
-}
@@ -42,6 +42,7 @@ in

  options = {
    services.hddfancontrol.enable = lib.mkEnableOption "hddfancontrol daemon";
+    services.hddfancontrol.package = lib.mkPackageOption pkgs "hddfancontrol" { };

    services.hddfancontrol.settings = lib.mkOption {
      type = lib.types.attrsWith {
@@ -164,7 +165,7 @@ in
          let
            argString = lib.strings.concatStringsSep " " (args cnf);
          in
-          "${lib.getExe pkgs.hddfancontrol} -v ${cnf.logVerbosity} daemon ${argString}";
+          "${lib.getExe cfg.package} -v ${cnf.logVerbosity} daemon ${argString}";
        serviceConfig = {
          CPUSchedulingPolicy = "rr";
          CPUSchedulingPriority = 49;
@@ -189,7 +190,7 @@ in
      ];
    in
    {
-      systemd.packages = [ pkgs.hddfancontrol ];
+      systemd.packages = [ cfg.package ];

      hardware.sensor.hddtemp = {
        enable = true;
@@ -42,7 +42,7 @@ in

  config = lib.mkIf cfg.enable {

-    # Note: LIRC executables raises a warning, if lirc_options.conf do not exists
+    # Note: LIRC executables raises a warning, if lirc_options.conf does not exist
    environment.etc."lirc/lirc_options.conf".text = cfg.options;

    passthru.lirc.socket = "/run/lirc/lircd";
@@ -190,7 +190,7 @@ in
            ProtectKernelTunables = true;
            ProtectControlGroups = true;
            ProtectProc = "invisible";
-            ProcSubset = "pid";
+            ProcSubset = "all"; # for onnxruntime, which queries cpuinfo
            RestrictAddressFamilies = [
              "AF_INET"
              "AF_INET6"
@@ -1250,7 +1250,7 @@ in
      [ "services" "postfix" "settings" "main" "mynetworks" ]
    )
    (lib.mkRenamedOptionModule
-      [ "services" "postfix" "networkStyle" ]
+      [ "services" "postfix" "networksStyle" ]
      [ "services" "postfix" "settings" "main" "mynetworks_style" ]
    )
    (lib.mkRenamedOptionModule
@@ -21,7 +21,10 @@ frontend proxy:
    virtualHosts."git.example.com" = {
      enableACME = true;
      forceSSL = true;
-      locations."/".proxyPass = "http://unix:/run/gitlab/gitlab-workhorse.socket";
+      locations."/" = {
+        proxyPass = "http://unix:/run/gitlab/gitlab-workhorse.socket";
+        proxyWebsockets = true;
+      };
    };
  };
 }
@@ -21,7 +21,6 @@ in
        description = "Contents of {file}`sssd.conf`.";
        default = ''
          [sssd]
-          config_file_version = 2
          services = nss, pam
          domains = shadowutils

@@ -16,7 +16,7 @@ let
    {
      "--servers" = lib.concatStringsSep "," fe.servers;
      "--domain" = fe.domain;
-      "--listen" = fe.listenAddress;
+      "--listen" = stringOrConcat "," fe.listenAddresses;
      "--proxy-port" = fe.proxyPort;
      "--whois" = fe.whois;
      "--dns-interface" = fe.dnsInterface;
@@ -37,7 +37,7 @@ let
    {
      "--allowed" = lib.concatStringsSep "," px.allowedIPs;
      "--bird" = px.birdSocket;
-      "--listen" = px.listenAddress;
+      "--listen" = stringOrConcat "," px.listenAddresses;
      "--traceroute_bin" = px.traceroute.binary;
      "--traceroute_flags" = lib.concatStringsSep " " px.traceroute.flags;
      "--traceroute_raw" = px.traceroute.rawOutput;
@@ -58,6 +58,17 @@ let
    args: lib.mapAttrsToList (name: value: "${name} " + mkArgValue value) (filterNull args);
 in
 {
+  imports = [
+    (lib.mkRenamedOptionModule
+      [ "services" "bird-lg" "frontend" "listenAddress" ]
+      [ "services" "bird-lg" "frontend" "listenAddresses" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "bird-lg" "proxy" "listenAddress" ]
+      [ "services" "bird-lg" "proxy" "listenAddresses" ]
+    )
+  ];
+
  options = {
    services.bird-lg = {
      package = lib.mkPackageOption pkgs "bird-lg" { };
@@ -77,8 +88,8 @@ in
      frontend = {
        enable = lib.mkEnableOption "Bird Looking Glass Frontend Webserver";

-        listenAddress = lib.mkOption {
-          type = lib.types.str;
+        listenAddresses = lib.mkOption {
+          type = with lib.types; either str (listOf str);
          default = "127.0.0.1:5000";
          description = "Address to listen on.";
        };
@@ -202,8 +213,8 @@ in
      proxy = {
        enable = lib.mkEnableOption "Bird Looking Glass Proxy";

-        listenAddress = lib.mkOption {
-          type = lib.types.str;
+        listenAddresses = lib.mkOption {
+          type = with lib.types; either str (listOf str);
          default = "127.0.0.1:8000";
          description = "Address to listen on.";
        };
@@ -268,8 +268,8 @@ in
        message = "You cannot use both services.ddclient.passwordFile and services.ddclient.secretsFile at the same time.";
      }
      {
-        assertion = !(cfg.protocol == "nsupdate") || (cfg.passwordFile == null && cfg.secretsFile == null);
-        message = "You cannot use services.ddclient.passwordFile and or services.ddclient.secretsFile when services.ddclient.protocol is \"nsupdate\".";
+        assertion = (cfg.protocol != "nsupdate") || (cfg.secretsFile == null);
+        message = "You cannot use services.ddclient.secretsFile when services.ddclient.protocol is \"nsupdate\". Use services.ddclient.passwordFile instead.";
      }
    ];

@@ -143,7 +143,7 @@ let
    };

  commonServiceConfig = {
-    AmbientCapablities = [ ];
+    AmbientCapabilities = [ ];
    CapabilityBoundingSet = [ ];
    LockPersonality = true;
    MemoryDenyWriteExecute = true;
@@ -1,97 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-with lib;
-
-let
-
-  cfg = config.services.morty;
-
-in
-
-{
-
-  ###### interface
-
-  options = {
-
-    services.morty = {
-
-      enable = mkEnableOption "Morty proxy server. See <https://github.com/asciimoo/morty>";
-
-      ipv6 = mkOption {
-        type = types.bool;
-        default = true;
-        description = "Allow IPv6 HTTP requests?";
-      };
-
-      key = mkOption {
-        type = types.str;
-        default = "";
-        description = ''
-          HMAC url validation key (hexadecimal encoded).
-          Leave blank to disable. Without validation key, anyone can
-          submit proxy requests. Leave blank to disable.
-          Generate with `printf %s somevalue | openssl dgst -sha1 -hmac somekey`
-        '';
-      };
-
-      timeout = mkOption {
-        type = types.int;
-        default = 2;
-        description = "Request timeout in seconds.";
-      };
-
-      package = mkPackageOption pkgs "morty" { };
-
-      port = mkOption {
-        type = types.port;
-        default = 3000;
-        description = "Listing port";
-      };
-
-      listenAddress = mkOption {
-        type = types.str;
-        default = "127.0.0.1";
-        description = "The address on which the service listens";
-      };
-
-    };
-
-  };
-
-  ###### Service definition
-
-  config = mkIf config.services.morty.enable {
-
-    users.users.morty = {
-      description = "Morty user";
-      createHome = true;
-      home = "/var/lib/morty";
-      isSystemUser = true;
-      group = "morty";
-    };
-    users.groups.morty = { };
-
-    systemd.services.morty = {
-      description = "Morty sanitizing proxy server.";
-      after = [ "network.target" ];
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        User = "morty";
-        ExecStart = ''
-          ${cfg.package}/bin/morty              \
-                      -listen ${cfg.listenAddress}:${toString cfg.port} \
-                      ${optionalString cfg.ipv6 "-ipv6"}                \
-                      ${optionalString (cfg.key != "") "-key " + cfg.key} \
-        '';
-      };
-    };
-    environment.systemPackages = [ cfg.package ];
-
-  };
-}
@@ -515,34 +515,38 @@ in
              tls.certResolver = "letsencrypt";
            };
            # Integration API router
-            int-api-router-redirect = lib.mkIf (finalSettings.flags.enable_integration_api) {
+            int-api-router-redirect = {
              rule = "Host(`api.${cfg.baseDomain}`)";
              service = "int-api-service";
              entryPoints = [ "web" ];
              middlewares = [ "redirect-to-https" ];
            };
-            int-api-router = lib.mkIf (finalSettings.flags.enable_integration_api) {
+            int-api-router = {
              rule = "Host(`api.${cfg.baseDomain}`)";
              service = "int-api-service";
              entryPoints = [ "websecure" ];
              tls.certResolver = "letsencrypt";
            };
          };
-          # could be map
-          services = {
-            # Next.js server
-            next-service.loadBalancer.servers = [
-              { url = "http://localhost:${toString finalSettings.server.next_port}"; }
-            ];
-            # API/WebSocket server
-            api-service.loadBalancer.servers = [
-              { url = "http://localhost:${toString finalSettings.server.external_port}"; }
-            ];
-            # Integration API server
-            int-api-service.loadBalancer.servers = lib.mkIf (finalSettings.flags.enable_integration_api) [
-              { url = "http://localhost:${toString finalSettings.server.integration_port}"; }
-            ];
-          };
+          # needs to be a mkMerge otherwise will give error about standalone element
+          services = lib.mkMerge [
+            {
+              # Next.js server
+              next-service.loadBalancer.servers = [
+                { url = "http://localhost:${toString finalSettings.server.next_port}"; }
+              ];
+              # API/WebSocket server
+              api-service.loadBalancer.servers = [
+                { url = "http://localhost:${toString finalSettings.server.external_port}"; }
+              ];
+            }
+            (lib.mkIf (finalSettings.flags.enable_integration_api) {
+              # Integration API server
+              int-api-service.loadBalancer.servers = [
+                { url = "http://localhost:${toString finalSettings.server.integration_port}"; }
+              ];
+            })
+          ];
        };
      };
    };
@@ -223,6 +223,9 @@ in
      );

      serviceConfig = {
+        Type = "simple";
+        DynamicUser = true;
+        Restart = "always";
        LoadCredential = lib.mkMerge (
          [
            (lib.mkIf (cfg.masterKeyFile != null) [ "master_key:${cfg.masterKeyFile}" ])
@@ -232,11 +235,15 @@ in
          ) secrets-with-path
        );
        ExecStart = "${lib.getExe cfg.package} --config-file-path \${RUNTIME_DIRECTORY}/config.toml";
-        DynamicUser = true;
        StateDirectory = "meilisearch";
        WorkingDirectory = "%S/meilisearch";
        RuntimeDirectory = "meilisearch";
        RuntimeDirectoryMode = "0700";
+        ReadWritePaths = [
+          cfg.settings.db_path
+          cfg.settings.dump_dir
+          cfg.settings.snapshot_dir
+        ];

        ProtectSystem = "strict";
        ProtectHome = true;
@@ -255,6 +262,7 @@ in
        RestrictSUIDSGID = true;
        LockPersonality = true;
        MemoryDenyWriteExecute = true;
+        RemoveIPC = true;

        # Meilisearch needs to determine cgroup memory limits to set its own memory limits.
        # This means this can't be set to "pid"
@@ -1,118 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-
-with lib;
-
-let
-  cfg = config.services.chatgpt-retrieval-plugin;
-in
-{
-  options.services.chatgpt-retrieval-plugin = {
-    enable = mkEnableOption "chatgpt-retrieval-plugin service";
-
-    port = mkOption {
-      type = types.port;
-      default = 8080;
-      description = "Port the chatgpt-retrieval-plugin service listens on.";
-    };
-
-    host = mkOption {
-      type = types.str;
-      default = "127.0.0.1";
-      example = "0.0.0.0";
-      description = "The hostname or IP address for chatgpt-retrieval-plugin to bind to.";
-    };
-
-    bearerTokenPath = mkOption {
-      type = types.path;
-      description = ''
-        Path to the secret bearer token used for the http api authentication.
-      '';
-      default = "";
-      example = "config.age.secrets.CHATGPT_RETRIEVAL_PLUGIN_BEARER_TOKEN.path";
-    };
-
-    openaiApiKeyPath = mkOption {
-      type = types.path;
-      description = ''
-        Path to the secret openai api key used for embeddings.
-      '';
-      default = "";
-      example = "config.age.secrets.CHATGPT_RETRIEVAL_PLUGIN_OPENAI_API_KEY.path";
-    };
-
-    datastore = mkOption {
-      type = types.enum [
-        "pinecone"
-        "weaviate"
-        "zilliz"
-        "milvus"
-        "qdrant"
-        "redis"
-      ];
-      default = "qdrant";
-      description = "This specifies the vector database provider you want to use to store and query embeddings.";
-    };
-
-    qdrantCollection = mkOption {
-      type = types.str;
-      description = ''
-        name of the qdrant collection used to store documents.
-      '';
-      default = "document_chunks";
-    };
-  };
-
-  config = mkIf cfg.enable {
-
-    assertions = [
-      {
-        assertion = cfg.bearerTokenPath != "";
-        message = "services.chatgpt-retrieval-plugin.bearerTokenPath should not be an empty string.";
-      }
-      {
-        assertion = cfg.openaiApiKeyPath != "";
-        message = "services.chatgpt-retrieval-plugin.openaiApiKeyPath should not be an empty string.";
-      }
-    ];
-
-    systemd.services.chatgpt-retrieval-plugin = {
-      description = "ChatGPT Retrieval Plugin";
-      after = [ "network.target" ];
-      wantedBy = [ "multi-user.target" ];
-
-      serviceConfig = {
-        DynamicUser = true;
-        Restart = "always";
-        LoadCredential = [
-          "BEARER_TOKEN:${cfg.bearerTokenPath}"
-          "OPENAI_API_KEY:${cfg.openaiApiKeyPath}"
-        ];
-        StateDirectory = "chatgpt-retrieval-plugin";
-        StateDirectoryMode = "0755";
-      };
-
-      # it doesn't make sense to pass secrets as env vars, this is a hack until
-      # upstream has proper secret management.
-      script = ''
-        export BEARER_TOKEN=$(${pkgs.systemd}/bin/systemd-creds cat BEARER_TOKEN)
-        export OPENAI_API_KEY=$(${pkgs.systemd}/bin/systemd-creds cat OPENAI_API_KEY)
-        exec ${pkgs.chatgpt-retrieval-plugin}/bin/start --host ${cfg.host} --port ${toString cfg.port}
-      '';
-
-      environment = {
-        DATASTORE = cfg.datastore;
-        QDRANT_COLLECTION = mkIf (cfg.datastore == "qdrant") cfg.qdrantCollection;
-      };
-    };
-
-    systemd.tmpfiles.rules = [
-      # create the directory for static files for fastapi
-      "C /var/lib/chatgpt-retrieval-plugin/.well-known - - - - ${pkgs.chatgpt-retrieval-plugin}/${pkgs.python3Packages.python.sitePackages}/.well-known"
-    ];
-  };
-}
@@ -5,20 +5,18 @@
  ...
 }:

-with lib;
 let
  cfg = config.services.gerrit;

  # NixOS option type for git-like configs
  gitIniType =
-    with types;
    let
-      primitiveType = either str (either bool int);
-      multipleType = either primitiveType (listOf primitiveType);
-      sectionType = lazyAttrsOf multipleType;
-      supersectionType = lazyAttrsOf (either multipleType sectionType);
+      primitiveType = lib.types.either lib.types.str (lib.types.either lib.types.bool lib.types.int);
+      multipleType = lib.types.either primitiveType (lib.types.listOf primitiveType);
+      sectionType = lib.types.lazyAttrsOf multipleType;
+      supersectionType = lib.types.lazyAttrsOf (lib.types.either multipleType sectionType);
    in
-    lazyAttrsOf supersectionType;
+    lib.types.lazyAttrsOf supersectionType;

  gerritConfig = pkgs.writeText "gerrit.conf" (lib.generators.toGitINI cfg.settings);

@@ -64,14 +62,14 @@ in
 {
  options = {
    services.gerrit = {
-      enable = mkEnableOption "Gerrit service";
+      enable = lib.mkEnableOption "Gerrit service";

-      package = mkPackageOption pkgs "gerrit" { };
+      package = lib.mkPackageOption pkgs "gerrit" { };

-      jvmPackage = mkPackageOption pkgs "jdk21_headless" { };
+      jvmPackage = lib.mkPackageOption pkgs "jdk21_headless" { };

-      jvmOpts = mkOption {
-        type = types.listOf types.str;
+      jvmOpts = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
        default = [
          "-Dflogger.backend_factory=com.google.common.flogger.backend.log4j.Log4jBackendFactory#getInstance"
          "-Dflogger.logging_context=com.google.gerrit.server.logging.LoggingContext#getInstance"
@@ -79,16 +77,16 @@ in
        description = "A list of JVM options to start gerrit with.";
      };

-      jvmHeapLimit = mkOption {
-        type = types.str;
+      jvmHeapLimit = lib.mkOption {
+        type = lib.types.str;
        default = "1024m";
        description = ''
          How much memory to allocate to the JVM heap
        '';
      };

-      listenAddress = mkOption {
-        type = types.str;
+      listenAddress = lib.mkOption {
+        type = lib.types.str;
        default = "[::]:8080";
        description = ''
          `hostname:port` to listen for HTTP traffic.
@@ -97,7 +95,7 @@ in
        '';
      };

-      settings = mkOption {
+      settings = lib.mkOption {
        type = gitIniType;
        default = { };
        description = ''
@@ -106,7 +104,7 @@ in
        '';
      };

-      replicationSettings = mkOption {
+      replicationSettings = lib.mkOption {
        type = gitIniType;
        default = { };
        description = ''
@@ -115,8 +113,8 @@ in
        '';
      };

-      plugins = mkOption {
-        type = types.listOf types.package;
+      plugins = lib.mkOption {
+        type = lib.types.listOf lib.types.package;
        default = [ ];
        description = ''
          List of plugins to add to Gerrit. Each derivation is a jar file
@@ -124,8 +122,8 @@ in
        '';
      };

-      builtinPlugins = mkOption {
-        type = types.listOf (types.enum cfg.package.passthru.plugins);
+      builtinPlugins = lib.mkOption {
+        type = lib.types.listOf (lib.types.enum cfg.package.passthru.plugins);
        default = [ ];
        description = ''
          List of builtins plugins to install. Those are shipped in the
@@ -133,8 +131,8 @@ in
        '';
      };

-      serverId = mkOption {
-        type = types.str;
+      serverId = lib.mkOption {
+        type = lib.types.str;
        description = ''
          Set a UUID that uniquely identifies the server.

@@ -145,11 +143,11 @@ in
    };
  };

-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {

    assertions = [
      {
-        assertion = cfg.replicationSettings != { } -> elem "replication" cfg.builtinPlugins;
+        assertion = cfg.replicationSettings != { } -> lib.elem "replication" cfg.builtinPlugins;
        message = "Gerrit replicationSettings require enabling the replication plugin";
      }
    ];
@@ -437,7 +437,6 @@ in
      type = lib.types.package;
      description = "Which package to use for the Nextcloud instance.";
      relatedPackages = [
-        "nextcloud30"
        "nextcloud31"
      ];
    };
@@ -549,7 +548,7 @@ in
        Options for nextcloud's PHP pool. See the documentation on `php-fpm.conf` for details on
        configuration directives. The above are recommended for a server with 4GiB of RAM.

-        It's advisable to read the [section about PHPFPM tuning in the upstream manual](https://docs.nextcloud.com/server/30/admin_manual/installation/server_tuning.html#tune-php-fpm)
+        It's advisable to read the [section about PHPFPM tuning in the upstream manual](https://docs.nextcloud.com/server/latest/admin_manual/installation/server_tuning.html#tune-php-fpm)
        and consider customizing the values.
      '';
    };
@@ -297,7 +297,6 @@ in
    ]);

  meta.maintainers = with lib.maintainers; [
-    srxl
    tmarkus
  ];
 }
@@ -178,8 +178,20 @@ let
 in

 {
-  options.boot.bcachefs.package = lib.mkPackageOption pkgs "bcachefs-tools" { } // {
-    description = "Configured Bcachefs userspace package.";
+  options.boot.bcachefs = {
+    package = lib.mkPackageOption pkgs "bcachefs-tools" {
+      extraDescription = ''
+        This package should also provide a passthru 'kernelModule'
+        attribute to build the out-of-tree kernel module.
+      '';
+    };
+
+    modulePackage = lib.mkOption {
+      type = lib.types.package;
+      # See NOTE in linux-kernels.nix
+      default = config.boot.kernelPackages.callPackage cfg.package.kernelModule { };
+      internal = true;
+    };
  };

  options.services.bcachefs.autoScrub = {
@@ -230,7 +242,7 @@ in
          }
        ];

-        warnings = lib.mkIf config.boot.kernelPackages.bcachefs.meta.broken [
+        warnings = lib.mkIf cfg.modulePackage.meta.broken [
          ''
            Using unmaintained in-tree bcachefs kernel module. This
            will be removed in 26.05. Please use a kernel supported
@@ -245,8 +257,8 @@ in
        system.fsPackages = [ cfg.package ];
        services.udev.packages = [ cfg.package ];

-        boot.extraModulePackages = lib.optionals (!config.boot.kernelPackages.bcachefs.meta.broken) [
-          config.boot.kernelPackages.bcachefs
+        boot.extraModulePackages = lib.optionals (!cfg.modulePackage.meta.broken) [
+          cfg.modulePackage
        ];

        systemd = {
@@ -129,7 +129,7 @@ let
    NIX_DISK_IMAGE=$(readlink -f "''${NIX_DISK_IMAGE:-${toString config.virtualisation.diskImage}}") || test -z "$NIX_DISK_IMAGE"

    if test -n "$NIX_DISK_IMAGE" && ! test -e "$NIX_DISK_IMAGE"; then
-        echo "Disk image do not exist, creating the virtualisation disk image..."
+        echo "Disk image does not exist, creating the virtualisation disk image..."

        ${
          if (cfg.useBootLoader && cfg.useDefaultFilesystems) then
@@ -935,7 +935,6 @@ in
  moosefs = runTest ./moosefs.nix;
  mopidy = runTest ./mopidy.nix;
  morph-browser = runTest ./morph-browser.nix;
-  morty = runTest ./morty.nix;
  mosquitto = runTest ./mosquitto.nix;
  movim = import ./web-apps/movim { inherit recurseIntoAttrs runTest; };
  mpd = runTest ./mpd.nix;
@@ -1418,7 +1417,7 @@ in
  systemd = runTest ./systemd.nix;
  systemd-analyze = runTest ./systemd-analyze.nix;
  systemd-binfmt = handleTestOn [ "x86_64-linux" ] ./systemd-binfmt.nix { };
-  systemd-boot = handleTest ./systemd-boot.nix { };
+  systemd-boot = import ./systemd-boot.nix { inherit runTest runTestOn; };
  systemd-bpf = runTest ./systemd-bpf.nix;
  systemd-capsules = runTest ./systemd-capsules.nix;
  systemd-confinement = handleTest ./systemd-confinement { };
@@ -124,7 +124,7 @@ in
        host1.wait_until_succeeds("ip --json -6 r | jq -e 'map(select(.dst == \"fdff::2\")) | any'")
        host2.wait_until_succeeds("ip --json -6 r | jq -e 'map(select(.dst == \"fdff::1\")) | any'")

-      with subtest("Check fake routes in preCheckConfig do not exists"):
+      with subtest("Check fake routes in preCheckConfig do not exist"):
        host1.fail("ip --json r | jq -e 'map(select(.dst == \"1.2.3.4\")) | any'")
        host2.fail("ip --json r | jq -e 'map(select(.dst == \"1.2.3.4\")) | any'")

@@ -99,6 +99,8 @@ in
      };

      systemd.services.apache-kafka.serviceConfig.StateDirectory = "apache-kafka";
+
+      virtualisation.memorySize = 1024 * 2;
    };
  };

@@ -79,7 +79,7 @@
    with subtest(
        "files created in the hosts container dir in a path where a tmpfs "
        + "file system has been mounted are not visible to the container as "
-        + "the do not exist in the tmpfs"
+        + "they do not exist in the tmpfs"
    ):
        machine.succeed(
            "touch /var/lib/nixos-containers/tmpfs/var/test.file",
@@ -50,6 +50,7 @@ import ../make-test-python.nix (
          services.k3s = {
            enable = true;
            role = "server";
+            package = k3s;
            extraFlags = [
              "--datastore-endpoint=\"http://192.168.1.1:2379\""
              "--disable coredns"
@@ -1,31 +0,0 @@
-{ pkgs, ... }:
-
-{
-  name = "morty";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ leenaars ];
-  };
-
-  nodes = {
-    mortyProxyWithKey =
-
-      { ... }:
-      {
-        services.morty = {
-          enable = true;
-          key = "78a9cd0cfee20c672f78427efb2a2a96036027f0";
-          port = 3001;
-        };
-      };
-
-  };
-
-  testScript =
-    { ... }:
-    ''
-      mortyProxyWithKey.wait_for_unit("default.target")
-      mortyProxyWithKey.wait_for_open_port(3001)
-      mortyProxyWithKey.succeed("curl -fL 127.0.0.1:3001 | grep MortyProxy")
-    '';
-
-}
@@ -139,7 +139,6 @@ let
 in
 listToAttrs (
  concatMap genTests [
-    30
    31
  ]
 )
@@ -203,7 +203,7 @@ in
      with subtest("alice can receive the patch"):
        alice.wait_until_succeeds("test 1 = \"$(rad stats | jq .local.patches)\"")
        alice.succeed(
-          f"cd /tmp/repo && rad patch show {bob_repo_patch1_pid} | grep 'opened by bob'",
+          f"cd /tmp/repo && rad patch show {bob_repo_patch1_pid} | grep -E '{bob_repo_patch1_pid[:7]} @ .+ by bob'",
          f"cd /tmp/repo && rad patch checkout {bob_repo_patch1_pid}"
        )
        assert alice.succeed("cat /tmp/repo/testfile") == "hello alice\n"
@@ -12,7 +12,7 @@
      services.renovate = {
        enable = true;
        settings = {
-          platform = "gitea";
+          platform = "forgejo";
          endpoint = "http://localhost:3000";
          autodiscover = true;
          gitAuthor = "Renovate <renovate@example.com>";
@@ -34,24 +34,24 @@
    };

  testScript = ''
-    def gitea(command):
-      return machine.succeed(f"cd /var/lib/forgejo && sudo --user=forgejo GITEA_WORK_DIR=/var/lib/forgejo GITEA_CUSTOM=/var/lib/forgejo/custom gitea {command}")
+    def forgejo(command):
+      return machine.succeed(f"cd /var/lib/forgejo && sudo --user=forgejo FORGEJO_WORK_DIR=/var/lib/forgejo FORGEJO_CUSTOM=/var/lib/forgejo/custom forgejo {command}")

    machine.wait_for_unit("forgejo.service")
    machine.wait_for_open_port(3000)

    machine.systemctl("stop forgejo.service")

-    gitea("admin user create --username meow --email meow@example.com --password meow")
+    forgejo("admin user create --username meow --email meow@example.com --password meow")

    machine.systemctl("start forgejo.service")
    machine.wait_for_unit("forgejo.service")
    machine.wait_for_open_port(3000)

-    accessToken = gitea("admin user generate-access-token --raw --username meow --scopes all | tr -d '\n'")
+    accessToken = forgejo("admin user generate-access-token --raw --username meow --scopes all | tr -d '\n'")

    machine.succeed(f"tea login add --name default --user meow --token '{accessToken}' --password meow --url http://localhost:3000")
-    machine.succeed("tea repo create --name kitty --init")
+    machine.succeed("tea repo create --login default --name kitty --init")
    machine.succeed("git config --global user.name Meow")
    machine.succeed("git config --global user.email meow@example.com")
    machine.succeed(f"git clone http://meow:{accessToken}@localhost:3000/meow/kitty.git /tmp/kitty")
@@ -63,8 +63,8 @@
    machine.succeed(f"echo '{accessToken}' > /etc/renovate-token")
    machine.systemctl("start --wait renovate.service")

-    machine.succeed("tea pulls list --repo meow/kitty | grep 'Configure Renovate'")
-    machine.succeed("tea pulls merge --repo meow/kitty 1")
+    machine.succeed("tea pulls list --login default --repo meow/kitty | grep 'Configure Renovate'")
+    machine.succeed("tea pulls merge --login default --repo meow/kitty 1")

    machine.systemctl("start --wait renovate.service")
  '';
@@ -50,7 +50,6 @@ in
    '';

  meta.maintainers = with lib.maintainers; [
-    srxl
    tmarkus
  ];
 }
@@ -17,7 +17,9 @@
  aixlog,
  popl,
  pulseaudioSupport ? false,
+  pipewireSupport ? stdenv.hostPlatform.isLinux,
  libpulseaudio,
+  pipewire,
  nixosTests,
  openssl,
 }:
@@ -54,11 +56,15 @@ stdenv.mkDerivation rec {
    openssl
  ]
  ++ lib.optional pulseaudioSupport libpulseaudio
+  ++ lib.optional pipewireSupport pipewire
  ++ lib.optional stdenv.hostPlatform.isLinux alsa-lib;

  TARGET = lib.optionalString stdenv.hostPlatform.isDarwin "MACOS";

-  cmakeFlags = [ (lib.cmakeBool "BUILD_WITH_PULSE" pulseaudioSupport) ];
+  cmakeFlags = [
+    (lib.cmakeBool "BUILD_WITH_PULSE" pulseaudioSupport)
+    (lib.cmakeBool "BUILD_WITH_PIPEWIRE" pipewireSupport)
+  ];

  # Upstream systemd unit files are pretty awful, so we provide our own in a
  # NixOS module. It might make sense to get that upstreamed...
@@ -0,0 +1,85 @@
+diff --git a/cask-bootstrap.el b/cask-bootstrap.el
+--- a/cask-bootstrap.el
+++ b/cask-bootstrap.el
+@@ -27,41 +27,18 @@
+ 
+ ;;; Code:
+ 
+-(require 'package)
+;; Add nix store paths for dependencies to the load-path.
+(let ((paths '(@loadPaths@)))
+  (dolist (path paths)
+    (push path load-path)))
+ 
+-(defvar cask-directory)
+(let ((paths '(@nativeLoadPaths@)))
+  (dolist (path paths)
+    (push path native-comp-eln-load-path)))
+ 
+-(defconst cask-bootstrap-dir
+-  (expand-file-name
+-   (locate-user-emacs-file
+-    (format ".cask/%s.%s/bootstrap" emacs-major-version emacs-minor-version)))
+-  "Path to Cask bootstrap directory.")
+-
+-;; Restore several package- variables and `load-path` after let-scope.
+-(let (package-alist
+-      package-archive-contents
+-      package--initialized
+-      (load-path (add-to-list
+-                  'load-path (expand-file-name "package-build" cask-directory)))
+-      (package-archives '(("gnu" . "https://elpa.gnu.org/packages/")
+-                          ("melpa" . "https://melpa.org/packages/")))
+-      (package-user-dir cask-bootstrap-dir)
+-      (deps '(s f commander git epl shut-up cl-lib cl-generic eieio ansi)))
+-  (package-initialize)
+-  (setq package-archive-contents nil) ;; force refresh, cask#573, cask#559
+-  (unless (package-installed-p 'cl-lib)
+-    ;; package-build depends on cl-lib
+-    (unless package-archive-contents
+-      (package-refresh-contents))
+-    (package-install 'cl-lib))
+-  (require 'package-build)
+(let ((deps '(@depsMod@)))
+   (dolist (pkg deps)
+-    (unless (featurep pkg)
+-      (unless (package-installed-p pkg)
+-        (unless package-archive-contents
+-          (package-refresh-contents))
+-        (package-install pkg))
+-      (require pkg))))
+    (require pkg)))
+ 
+ (provide 'cask-bootstrap)
+ 
+diff --git a/cask-cli.el b/cask-cli.el
+--- a/cask-cli.el
+++ b/cask-cli.el
+@@ -129,25 +129,8 @@ already is installed, it will not be installed again."
+     (cask-install (cask-cli--bundle))))
+ 
+ (defun cask-cli/upgrade-cask ()
+-  "Upgrade Cask itself and its dependencies.
+-
+-This command requires that Cask is installed using Git and that
+-Git is available in `exec-path'."
+-  (unless (f-exists? (f-expand ".no-upgrade" cask-directory))
+-    (unwind-protect
+-        (progn
+-          (epl-change-package-dir cask-bootstrap-dir)
+-          (epl-initialize)
+-          (epl-add-archive "gnu" "https://elpa.gnu.org/packages/")
+-          (epl-add-archive "melpa" "https://melpa.org/packages/")
+-          (epl-refresh)
+-          (epl-upgrade))
+-      (epl-reset))
+-    (require 'git)
+-    (let ((git-repo cask-directory))
+-      (if (s-present? (git-run "status" "--porcelain"))
+-          (error "Cannot update Cask because of dirty tree")
+-        (git-pull)))))
+  "Disabled in Nixpkgs as this function requires that Cask is installed using Git."
+  (princ "Upgrade not available when installed via Nixpkgs.\n"))
+ 
+ (defun cask-cli/exec (&rest _args)
+   "Execute ARGS with correct `exec-path' and `load-path'.")
@@ -4,68 +4,103 @@
  cl-generic,
  cl-lib,
  commander,
-
  epl,
  f,
  fetchFromGitHub,
+  installShellFiles,
  git,
  melpaBuild,
  package-build,
+  replaceVars,
  s,
  shut-up,
 }:
+let
+  formatLoadPath = x: ''"${x}/share/emacs/site-lisp/elpa/${x.ename}-${x.melpaVersion or x.version}"'';
+  formatNativeLoadPath = x: ''"${x}/share/emacs/native-lisp"'';
+  getAllDependenciesOfPkg =
+    pkg:
+    let
+      direct = builtins.filter (x: x != null) (pkg.packageRequires or [ ]);
+      indirect = builtins.concatLists (map getAllDependenciesOfPkg direct);
+    in
+    lib.unique (direct ++ indirect);
+in
+melpaBuild (
+  finalAttrs:
+  let
+    nixpkgDependencies = getAllDependenciesOfPkg finalAttrs.finalPackage;
+    loadPaths = builtins.concatStringsSep " " (map formatLoadPath nixpkgDependencies);
+    nativeLoadPaths = builtins.concatStringsSep " " (
+      map formatNativeLoadPath (nixpkgDependencies ++ [ (placeholder "out") ])
+    );
+    emacsBuiltinDeps = [
+      "cl-lib"
+      "eieio"
+    ];
+    depsMod = builtins.concatStringsSep " " ((map (x: x.ename) nixpkgDependencies) ++ emacsBuiltinDeps);
+  in
+  {
+    pname = "cask";
+    version = "0.9.1";

-melpaBuild (finalAttrs: {
-  pname = "cask";
-  version = "0.9.0";
+    src = fetchFromGitHub {
+      name = "cask-source-${finalAttrs.version}";
+      owner = "cask";
+      repo = "cask";
+      rev = "v${finalAttrs.version}";
+      hash = "sha256-/vinpQ51AuaTbXW4L4MnVonyfzTMvHUF4HViSPBKZxs=";
+    };

-  src = fetchFromGitHub {
-    name = "cask-source-${finalAttrs.version}";
-    owner = "cask";
-    repo = "cask";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-91rJFsp2SLk/JY+v6G5JmXH5bg9QnT+qhI8ccNJlI4A=";
-  };
+    nativeBuildInputs = [ installShellFiles ];

-  patches = [
-    # Uses LISPDIR substitution var
-    ./0000-cask-lispdir.diff
-  ];
+    patches = [
+      # Uses LISPDIR substitution var
+      ./0000-cask-lispdir.diff
+      # Use Nix provided dependencies instead of letting Cask bootstrap itself
+      ./0001-cask-bootstrap.diff
+    ];

-  packageRequires = [
-    ansi
-    cl-generic
-    cl-lib
-    commander
-    epl
-    f
-    git
-    package-build
-    s
-    shut-up
-  ];
+    packageRequires = [
+      ansi
+      cl-generic
+      cl-lib
+      commander
+      epl
+      f
+      git
+      package-build
+      s
+      shut-up
+    ];

-  # use melpaVersion so that it works for unstable releases too
-  postPatch = ''
-    lispdir=$out/share/emacs/site-lisp/elpa/cask-${finalAttrs.melpaVersion} \
-      substituteAllInPlace bin/cask
-  '';
+    postPatch = ''
+      # use melpaVersion so that it works for unstable releases too
+      substituteInPlace bin/cask \
+        --replace-fail @lispdir@ $out/share/emacs/site-lisp/elpa/$ename-$melpaVersion

-  # TODO: use installBin as soon as installBin arrives Master branch
-  postInstall = ''
-    install -D -t $out/bin bin/cask
-  '';
-
-  meta = {
-    homepage = "https://github.com/cask/cask";
-    description = "Project management for Emacs";
-    longDescription = ''
-      Cask is a project management tool for Emacs that helps automate the
-      package development cycle; development, dependencies, testing, building,
-      packaging and more.
+      # using `replaceVars` results in wrong result of `placeholder "out"`
+      substituteInPlace cask-bootstrap.el \
+        --replace-fail @depsMod@ '${depsMod}' \
+        --replace-fail @loadPaths@ '${loadPaths}' \
+        --replace-fail @nativeLoadPaths@ '${nativeLoadPaths}'
    '';
-    license = lib.licenses.gpl3Plus;
-    mainProgram = "cask";
-    maintainers = with lib.maintainers; [ ];
-  };
-})
+
+    postInstall = ''
+      installBin bin/cask
+    '';
+
+    meta = {
+      homepage = "https://github.com/cask/cask";
+      description = "Project management for Emacs";
+      longDescription = ''
+        Cask is a project management tool for Emacs that helps automate the
+        package development cycle; development, dependencies, testing, building,
+        packaging and more.
+      '';
+      license = lib.licenses.gpl3Plus;
+      mainProgram = "cask";
+      maintainers = with lib.maintainers; [ ];
+    };
+  }
+)
@@ -42,6 +42,7 @@ mapAliases (
    blueballs-neovim = throw "`blueballs-neovim` has been removed"; # added 2025-06-17
    BufOnly = BufOnly-vim;
    calendar = calendar-vim;
+    coc-rls = throw "coc-rls has been removed, as rls has been archived since 2022. You should use coc-rust-analyzer instead, as rust-analyzer is maintained."; # addedd 2025-10-01
    coffee-script = vim-coffee-script;
    coffeeScript = vim-coffee-script; # backwards compat, added 2014-10-18
    Solarized = vim-colors-solarized;
@@ -4,6 +4,7 @@
  coc-clangd,
  coc-css,
  coc-diagnostic,
+  coc-docker,
  coc-pyright,
  coc-toml,
 }:
@@ -28,6 +29,11 @@ final: prev: {
    src = "${coc-diagnostic}/lib/node_modules/coc-diagnostic";
  };

+  coc-docker = buildVimPlugin {
+    inherit (coc-docker) pname version meta;
+    src = "${coc-docker}/lib/node_modules/coc-docker";
+  };
+
  coc-pyright = buildVimPlugin {
    pname = "coc-pyright";
    inherit (coc-pyright) version meta;
@@ -12834,12 +12834,12 @@ final: prev: {

  project-nvim = buildVimPlugin {
    pname = "project.nvim";
-    version = "2025-09-26";
+    version = "2025-10-01";
    src = fetchFromGitHub {
      owner = "DrKJeff16";
      repo = "project.nvim";
-      rev = "8010402e3b10264eb832f5ebbeb853decaa97433";
-      sha256 = "0lfyv2hl453pxm3kkmb2d6gq2a7g5c5kycvhhnc1kkgznvr5872z";
+      rev = "7008545417848450c6dad83fcc6b3e58f0450990";
+      sha256 = "sha256-ZGKC/r+1/TcAqZvkzTHPtpcBC7eRfvuuMNTVeMR4qLQ=";
    };
    meta.homepage = "https://github.com/DrKJeff16/project.nvim/";
    meta.hydraPlatforms = [ ];
@@ -13705,6 +13705,19 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  sidekick-nvim = buildVimPlugin {
+    pname = "sidekick.nvim";
+    version = "2025-09-30";
+    src = fetchFromGitHub {
+      owner = "folke";
+      repo = "sidekick.nvim";
+      rev = "7b3d28bbb883e898f6a8b4f2d7a9ab6ad5cef9f8";
+      sha256 = "1m2af27xvagdq6q8kyahcsrbraaw4x2yvrg35xxcpgp0vi0m9h6a";
+    };
+    meta.homepage = "https://github.com/folke/sidekick.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
  sideways-vim = buildVimPlugin {
    pname = "sideways.vim";
    version = "2025-07-28";
@@ -7,7 +7,6 @@ final: prev:
 let
  nodePackageNames = [
    "coc-cmake"
-    "coc-docker"
    "coc-emmet"
    "coc-eslint"
    "coc-explorer"
@@ -26,7 +25,6 @@ let
    "coc-pairs"
    "coc-prettier"
    "coc-r-lsp"
-    "coc-rls"
    "coc-rust-analyzer"
    "coc-sh"
    "coc-smartf"
@@ -73,6 +73,8 @@
  gitMinimal,
  # Preview-nvim dependencies
  md-tui,
+  # sidekick-nvim dependencies
+  copilot-language-server,
  # sved dependencies
  glib,
  gobject-introspection,
@@ -3123,6 +3125,16 @@ assertNoAdditions {
    ];
  };

+  sidekick-nvim = super.sidekick-nvim.overrideAttrs {
+    runtimeDeps = [
+      copilot-language-server
+    ];
+
+    nvimSkipModules = [
+      "sidekick.docs"
+    ];
+  };
+
  skim-vim = super.skim-vim.overrideAttrs {
    dependencies = [ self.skim ];
  };
--- a/Show More
+++ b/Show More