gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Files
current
nixpkgs/doc/release-notes/rl-2611.section.md
T

16 KiB
Raw Permalink Blame History

Nixpkgs 26.11 ("Zokor", 2026.11/??)

Highlights

  • The {file}nixexprs.tar.xz tarball will be discontinued together with Nixpkgs 27.05 after 2027-12-31. Migrate to the {file}nixexprs.tar.zst tarball instead.

    This affects for example users who pull Nixpkgs as a flake input from https://channels.nixos.org:

    -nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.xz";
+nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.zst";

  • sing-box now supports NaïveProxy outbounds.

Backward Incompatibilities

  • moon has been updated to 2.x and needs manual migration. See the migration guide for instructions.

  • []{#x86_64-darwin-26.11}

    Support for x86_64-darwin has been dropped, due to Apple’s deprecation of the platform and limited build infrastructure and developer time. We will no longer build packages for the platform or support building them from source.

    The Nixpkgs 26.05 stable branch will still maintain platform support and binaries will be built until it goes out of support at the end of 2026. Users of x86_64-darwin will receive an error message explaining how to switch to 26.05.

    By the time of this release, Homebrew will offer only limited Tier 3 support for the platform, but MacPorts will likely continue to support it for a long time. We also recommend users consider installing NixOS, which should continue to run on essentially all Intel Macs, especially after Apple stops security support for macOS 26 in 2028.

  • bundlerApp now sets __structuredAttrs = true for its result package. Out-of-tree packages passing postBuild to bundlerApp should examine if their postBuild commands are compatible with structured attributes.

  • databricks-cli has been updated from 0.290.2 to 1.x.x, the first major release. OAuth tokens for interactive logins (auth_type = databricks-cli) are now stored in the OS-native secure store by default (Secret Service on Linux) instead of ~/.databricks/token-cache.json; cached tokens from older versions are not migrated, so run databricks auth login once per profile after upgrading. To keep the previous file-backed storage, set DATABRICKS_AUTH_STORAGE=plaintext or add auth_storage = plaintext under [__settings__] in ~/.databrickscfg. Additionally, the vector_search_endpoints DABs resource renamed min_qps to target_qps (and the vector-search-endpoints command renamed --min-qps to --target-qps). See the upstream changelog for details.

  • hurl has been updated to 8.x.x which has some breaking changes. See upstream changelog for details.

  • The existing wasm32-wasi target has become wasm32-wasip1 and pkgsCross.wasi32 has become pkgsCross.wasm32-wasip1, aligning with LLVM's nomenclature. Aliases are in place and old forms will continue to be parsed but there might be some breakage if you're relying on the exact form of these (e.g., in sysroot paths).

  • gotosocial has been updated to 0.22.0. This release contains a very long database migration, which should not be cancelled or interrupted under any circumstances.

  • Postgres users: Following the migration, if you encounter slowdown on Postgres specifically (ie., timing out while loading timelines) you may need to run some manual database maintenance steps. Please check https://docs.gotosocial.org/en/stable/admin/database_maintenance/#postgres.

  • xsecurelock no longer supports authentication via htaccess files (~/.xsecurelock.pw) or via the pamtester program by default. Only the recommended PAM module is supported unless rebuilt with withHtaccess or withPamtester.

  • python3Packages.django-health-check has been updated to major version 4. See its migration guide and changelog for breaking changes.

  • jmtpfs has been removed due to lack of maintenance and fuse3 support.

  • libgdata has been removed, as it was archived upstream and relied on the insecure libsoup 2.4.

  • mcphost has been removed, as it was archived upstream and declared unmaintained.

  • fflogs has been removed because it was no longer functional. Users should switch to archon-lite.

  • keycloak.plugins.scim-for-keycloak has been removed. The upstream open-source project is end-of-life and its last release targets Keycloak 20, which is incompatible with the packaged Keycloak.

  • keycloak.plugins.scim-keycloak-user-storage-spi has been removed. Upstream has moved the plugin into Keycloak itself as the experimental ipatuura federation provider and no longer maintains the standalone repository.

  • services.mysql now sets root@localhost authentication to auth_socket when used with mysql or percona-server. Existing deployments will also be adjusted if possible. See the security advisory GHSA-6qxx-6rg8-c4p8 for more information.

  • zerofs has been updated from 1.x to 2.x which is a breaking change. Volumes created by earlier releases are refused at open with a clear error. There is no migration tool; older volumes remain readable and writable by the release that created them.

  • keycloak.plugins.keycloak-metrics-spi has been removed. Keycloak exposes Prometheus metrics natively on its management interface; enable them with the metrics-enabled setting (and event-metrics-user-enabled for login and event counters). See Gaining insights with metrics.

  • alps has been rewritten upstream, see upstream repository for documentation.

  • bosun has been removed as it is no longer maintained upstream. the corresponding monitoring options has been removed.

  • uhttpmock providing 0.0 ABI was removed. uhttpmock_1_0 providing 1.0 ABI was renamed to uhttpmock and uhttpmock_1_0 was kept as an alias.

  • himalaya has been updated from v1.2.0 to v2.0.0, which introduces breaking changes. See the release notes and the migration guide.

  • tengine has been removed as it has seen seriously delayed responses to security vulnerabilities.

  • nix-serve-ng (and haskellPackages.nix-serve-ng) is now built against Lix instead of CppNix, following upstream which has switched to Lix as its supported Nix implementation.

  • Linux kernel configuration has been moved out of the linux-kernel field of the platform structure into the kernel builders:

    • linux-kernel.name has been removed.
    • linux-kernel.target is available as the target parameter and passthru attribute on the kernel builders.
    • linux-kernel.installTarget has been removed, as it should not be necessary to customize.
    • linux-kernel.DTB is available as the buildDTBs parameter and passthru attribute on the kernel builders.
    • linux-kernel.{autoModules,preferBuiltin,extraConfig} were already available as kernel builder parameters.

  • The img argument of vmTools has been renamed to kernelImage, as it collided with the top-level img package. Additionally, the kernel module tree used inside the VM has been split out of the kernel argument into a new kernelModules argument (defaulting to kernel). Callers that overrode kernel with a module tree (e.g. from pkgs.aggregateModules) to make extra modules available must now pass it via kernelModules instead, keeping kernel pointing at a bootable kernel derivation.

  • The ARMv5 Linux kernel build now uses a standard configuration and generates a standard compressed image instead of the deprecated legacy U‐Boot image format. lib.systems.{examples,platforms}.{sheevaplug,pogoplug4} have been unified into lib.systems.examples.armv5tel-multiplatform. Note that there is no official support for ARMv5 and it is not possible to build even a simple NixOS configuration out of the box.

  • pdns has been updated from 5.0.x to 5.1.x. Please be sure to review the Upgrade Notes before upgrading. Namely LUA record updates are no longer allowed by default, and the embedded webserver no longer includes a access-control-allow-origin: * header by default.

  • davmail no longer supports building with GTK 2, and the preferGtk3 override flag has been removed as GTK 3 is always used.

  • Support for the legacy U‐Boot image format has been removed from the Linux kernel builders, as it is deprecated upstream and no longer used by any platform in Nixpkgs.

  • etcd_3_4 package was dropped, as it's gone EOL. Please upgrade to either 3.5 or 3.6. See migration notes for incompatibilities and upgrade procedure.

  • rke2 retires ingress-nginx and transitions to Traefik starting in rke2_1_36. Because ingress-nginx was retired upstream as of March 2026, Traefik is now the default for new clusters starting in v1.36 (existing clusters will keep their current ingress upon upgrade to avoid breakage). This transition brings the following structural changes:

    • Airgapped Environments: The rke2-images-core tarball now contains Traefik images instead of ingress-nginx. The standalone rke2-images-traefik tarball has been removed. Users who must continue using ingress-nginx will now need to manually provide the rke2-images-ingress-nginx tarball.
    • Future Removal: The ingress-nginx chart will not receive any additional updates and will be completely removed in v1.37 for community users.

  • buildFHSEnvChroot has been removed after deprecation in 23.05.

  • leafnode has been removed, as it was an unmaintained alpha-release of leafnode 2 and has a dependency on the EOL PRCE-library. Consider using leafnode1 instead, which is still maintained.

  • gh-actions-cache has been removed since its functionality has been integrated directly into gh (gh cache). See upstream readme.

  • requireFile now sets meta.license = lib.licenses.unfree by default. Users of requireFile-based derivations that preserve this default will need to explicitly allow their evaluation as described in .

  • texlive.combine is deprecated and scheduled for removal in 27.05. Please migrate to texliveSmall.withPackages (see ).

  • keycloak was updated to >= 26.7.0 and includes some breaking internal (API) changes. See the upstream migration guide for more information.

  • librest providing 0.7 ABI was removed. librest_1_0 providing 1.0 ABI was renamed to librest and librest_1_0 was kept as an alias.

  • luaPackages.lrexlib-pcre has been removed as part of the process to fully migrate from the end-of-life PRCE library to PCRE2. luaPackages.lrexlib-pcre2 and multiple other versions of lrexlib can be used instead.

  • pnpm_10 was upgraded to version 10.34.1+, which introduced stricter integrity checks. If you encounter ERR_PNPM_MISSING_TARBALL_INTEGRITY, you can fall back to the older pnpm_10_34_0.

  • fetchPnpmDeps' fetcherVersion = 1 and fetcherVersion = 2 have been removed, as announced in the 26.05 release. Packages still using them now throw an evaluation error and must migrate to fetcherVersion = 3 (or later) and regenerate their hashes. See the pnpm fetcherVersion section of the manual for details.

  • rebuilderd has been updated to 0.27.0 introducing breaking changes. See upstream changelog for details: 0.26.0, 0.27.0

  • Starting with v14, flameshot will primarily utilise xdg-desktop-portal calls for screenshotting. This will directly affect users on X11 window managers due to the lack of a compatible portal with Screenshot feature. See upstream changelog or NixOS Flameshot wiki page for workarounds.

  • nim1 and respective aliases have been removed due to entering EOL; please migrate to nim or nim-unwrapped (nim 2).

  • nim-2_0 & nim-2_2 and respective aliases have been removed; please migrate to nim or nim-unwrapped (nim 2.2.10).

  • domoticz has been updated from 2024.7 to 2026.x, breaking third party applications and scripts using the old RType calls. Review the release notes for more information.

  • vimacs has been removed, as it has not been maintained in 10 years and was built for an old version of vim (6.0).

Other Notable Changes

  • super-productivity has been updated. The binary has been renamed from super-productivity to superproductivity. A symlink from the old name is provided for backward compatibility.

  • buildFHSEnv, appimageTools.wrapAppImage, and appimageTools.wrapType2 now support the finalAttrs pattern. When using wrapAppImage, it is now recommended to pass the extracted AppImage to the contents attribute (instead of src), to avoid shadowing src. Passing the extracted contents to src is now deprecated and will be removed in a future release.

  • Package-URL (PURL, https://github.com/package-url/purl-spec) metadata identifier has been added for fetchgit, fetchpypi and fetchFromGithub fetchers. mkDerivation has been adjusted to reuse this information. Package-URLs allow reliably identifying and locating software packages. Maintainers of derivations using the adapted fetchers should rely on the drv.src.meta.identifiers.v1.purl default identifier and can enhance their drv.meta.identifiers.v1.purls list once they would like to have additional identifiers. Maintainers using fetchurl for drv.src are urged to adapt their drv.meta.identifiers.purlParts for proper identification.

  • Emacs loads the early-default library after early-init.el. Users can add early-init.el via emacs.pkgs.withPackages by packaging early-init.el into a library named early-default. To prevent loading the early-default library, set inhibit-early-default-init in early-init.el.

  • services.ceph enabled the generation of Ceph log files at /var/log/ceph/. They were missing before because Ceph omitted logs when this directory was missing. Ceph logs can grow large, so you may want to configure rotation of these logs.

Nixpkgs Library

Breaking changes

  • fittrackee 1.0.0 now requires postgres with postgis. The upgrade guide has steps to prepare for this upgrade.

Deprecations

  • Setting config.allowBrokenPredicate is deprecated in favor of using config.problems.handlers.PackageName.broken = "warn" (or = "ignore"). For more information see .

Additions and Improvements

  • Create the first release note entry in this section!
Reference in New Issue View Git Blame Copy Permalink