nixpkgs-ci[bot]
166 lines
14 KiB
Markdown
166 lines
14 KiB
Markdown
# Nixpkgs 26.11 ("Zokor", 2026.11/??) {#sec-nixpkgs-release-26.11}
|
||
|
||
## Highlights {#sec-nixpkgs-release-26.11-highlights}
|
||
|
||
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
|
||
|
||
- The {file}`nixexprs.tar.xz` tarball will be discontinued together with Nixpkgs
|
||
27.05 after 2027-12-31. Migrate to the {file}`nixexprs.tar.zst` tarball
|
||
instead.
|
||
|
||
This affects for example users who pull Nixpkgs as a flake input from
|
||
https://channels.nixos.org:
|
||
|
||
```diff
|
||
-nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.xz";
|
||
+nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.zst";
|
||
```
|
||
|
||
## Backward Incompatibilities {#sec-nixpkgs-release-26.11-incompatibilities}
|
||
|
||
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
|
||
|
||
- []{#x86_64-darwin-26.11}
|
||
|
||
Support for `x86_64-darwin` has been dropped, due to Apple’s deprecation of the platform and limited build infrastructure and developer time.
|
||
We will no longer build packages for the platform or support building them from source.
|
||
|
||
The Nixpkgs 26.05 stable branch will still maintain platform support and binaries will be built until it goes out of support at the end of 2026.
|
||
Users of `x86_64-darwin` will receive an error message explaining how to switch to 26.05.
|
||
|
||
By the time of this release, Homebrew will offer only limited [Tier 3](https://docs.brew.sh/Support-Tiers#tier-3) support for the platform, but MacPorts will likely continue to support it for a long time.
|
||
We also recommend users consider installing NixOS, which should continue to run on essentially all Intel Macs, especially after Apple stops security support for macOS 26 in 2028.
|
||
|
||
- `bundlerApp` now sets `__structuredAttrs = true` for its result package.
|
||
Out-of-tree packages passing `postBuild` to `bundlerApp` should examine if their `postBuild` commands are compatible with structured attributes.
|
||
|
||
- `databricks-cli` has been updated from `0.290.2` to `1.x.x`, the first major release. OAuth tokens for interactive logins (`auth_type = databricks-cli`) are now stored in the OS-native secure store by default (Secret Service on Linux) instead of `~/.databricks/token-cache.json`; cached tokens from older versions are not migrated, so run `databricks auth login` once per profile after upgrading. To keep the previous file-backed storage, set `DATABRICKS_AUTH_STORAGE=plaintext` or add `auth_storage = plaintext` under `[__settings__]` in `~/.databrickscfg`. Additionally, the `vector_search_endpoints` DABs resource renamed `min_qps` to `target_qps` (and the `vector-search-endpoints` command renamed `--min-qps` to `--target-qps`). See the [upstream changelog](https://github.com/databricks/cli/blob/main/CHANGELOG.md) for details.
|
||
|
||
- `hurl` has been updated to `8.x.x` which has some breaking changes. See [upstream changelog](https://github.com/Orange-OpenSource/hurl/releases/tag/8.0.0) for details.
|
||
|
||
- `gotosocial` has been updated to 0.22.0. This release contains a very long database migration, which should not be cancelled or interrupted under any circumstances.
|
||
- Postgres users: Following the migration, if you encounter slowdown on Postgres specifically (ie., timing out while loading timelines) you may need to run some manual database maintenance steps. Please check https://docs.gotosocial.org/en/stable/admin/database_maintenance/#postgres.
|
||
|
||
- `xsecurelock` no longer supports authentication via htaccess files (`~/.xsecurelock.pw`) or via the `pamtester` program by default. Only the recommended PAM module is supported unless rebuilt with `withHtaccess` or `withPamtester`.
|
||
|
||
- `python3Packages.django-health-check` has been updated to major version 4. See its [migration guide](https://codingjoe.dev/django-health-check/migrate-to-v4/) and [changelog](https://github.com/codingjoe/django-health-check/releases/tag/4.0.0) for breaking changes.
|
||
|
||
- `jmtpfs` has been removed due to lack of maintenance and fuse3 support.
|
||
|
||
- `libgdata` has been removed, as it was archived upstream and relied on the insecure libsoup 2.4.
|
||
|
||
- `mcphost` has been removed, as it was archived upstream and declared unmaintained.
|
||
|
||
- `fflogs` has been removed because it was no longer functional. Users should switch to `archon-lite`.
|
||
|
||
- `services.mysql` now sets `root@localhost` authentication to `auth_socket` when used with `mysql` or `percona-server`.
|
||
Existing deployments will also be adjusted if possible. See the [security advisory GHSA-6qxx-6rg8-c4p8](https://github.com/NixOS/nixpkgs/security/advisories/GHSA-6qxx-6rg8-c4p8) for more information.
|
||
|
||
- `zerofs` has been updated from `1.x` to `2.x` which is a breaking change. Volumes created by earlier releases are refused at open with a clear error. There is no migration tool; older volumes remain readable and writable by the release that created them.
|
||
|
||
- `keycloak.plugins.keycloak-metrics-spi` has been removed. Keycloak exposes Prometheus metrics natively on its management interface; enable them with the `metrics-enabled` setting (and `event-metrics-user-enabled` for login and event counters). See [Gaining insights with metrics](https://www.keycloak.org/observability/configuration-metrics).
|
||
|
||
- `alps` has been rewritten upstream, see [upstream repository](https://github.com/migadu/alps) for documentation.
|
||
|
||
- `uhttpmock` providing 0.0 ABI was removed. `uhttpmock_1_0` providing 1.0 ABI was renamed to `uhttpmock` and `uhttpmock_1_0` was kept as an alias.
|
||
|
||
- `nix-serve-ng` (and `haskellPackages.nix-serve-ng`) is now built against Lix instead of CppNix, following upstream which has switched to Lix as its supported Nix implementation.
|
||
|
||
- Linux kernel configuration has been moved out of the `linux-kernel` field of the platform structure into the kernel builders:
|
||
- `linux-kernel.name` has been removed.
|
||
- `linux-kernel.target` is available as the `target` parameter and passthru attribute on the kernel builders.
|
||
- `linux-kernel.installTarget` has been removed, as it should not be necessary to customize.
|
||
- `linux-kernel.DTB` is available as the `buildDTBs` parameter and passthru attribute on the kernel builders.
|
||
- `linux-kernel.{autoModules,preferBuiltin,extraConfig}` were already available as kernel builder parameters.
|
||
|
||
- The `img` argument of `vmTools` has been renamed to `kernelImage`, as it collided with the top-level `img` package.
|
||
Additionally, the kernel module tree used inside the VM has been split out of the `kernel` argument into a new `kernelModules` argument (defaulting to `kernel`).
|
||
Callers that overrode `kernel` with a module tree (e.g. from `pkgs.aggregateModules`) to make extra modules available must now pass it via `kernelModules` instead, keeping `kernel` pointing at a bootable kernel derivation.
|
||
|
||
- The ARMv5 Linux kernel build now uses a standard configuration and generates a standard compressed image instead of the deprecated legacy U‐Boot image format.
|
||
`lib.systems.{examples,platforms}.{sheevaplug,pogoplug4}` have been unified into `lib.systems.examples.armv5tel-multiplatform`.
|
||
Note that there is no official support for ARMv5 and it is not possible to build even a simple NixOS configuration out of the box.
|
||
|
||
- `pdns` has been updated from `5.0.x` to `5.1.x`. Please be sure to review the [Upgrade Notes](https://doc.powerdns.com/authoritative/upgrading.html#to-5-1-0) before upgrading. Namely LUA record updates are no longer allowed by default, and the embedded webserver no longer includes a `access-control-allow-origin: *` header by default.
|
||
|
||
- Support for the legacy U‐Boot image format has been removed from the Linux kernel builders, as it is deprecated upstream and no longer used by any platform in Nixpkgs.
|
||
|
||
- `etcd_3_4` package was dropped, as it's gone EOL. Please upgrade to either 3.5 or 3.6. See [migration notes](https://etcd.io/docs/v3.6/upgrades/upgrade_3_6/) for incompatibilities and upgrade procedure.
|
||
|
||
- `rke2` retires ingress-nginx and transitions to Traefik starting in `rke2_1_36`. Because ingress-nginx was retired upstream as of March 2026, Traefik is now the default
|
||
for new clusters starting in v1.36 (existing clusters will keep their current ingress upon upgrade to avoid breakage). This transition brings the following structural changes:
|
||
- Airgapped Environments: The rke2-images-core tarball now contains Traefik images instead of ingress-nginx. The standalone rke2-images-traefik tarball has been removed.
|
||
Users who must continue using ingress-nginx will now need to manually provide the rke2-images-ingress-nginx tarball.
|
||
- Future Removal: The ingress-nginx chart will not receive any additional updates and will be completely removed in v1.37 for community users.
|
||
|
||
- `buildFHSEnvChroot` has been removed after deprecation in 23.05.
|
||
|
||
- `gh-actions-cache` has been removed since its functionality has been integrated directly into `gh` (`gh cache`). See [upstream readme](https://github.com/actions/gh-actions-cache).
|
||
|
||
- `requireFile` now sets `meta.license = lib.licenses.unfree` by default. Users of `requireFile`-based derivations that preserve this default will need to explicitly allow their evaluation as described in [](#sec-allow-unfree).
|
||
|
||
- `texlive.combine` is deprecated and scheduled for removal in 27.05. Please migrate to `texliveSmall.withPackages` (see [](#sec-language-texlive-user-guide)).
|
||
|
||
- `keycloak` was updated to >= 26.7.0 and includes some breaking internal (API) changes. See the [upstream migration guide](https://www.keycloak.org/docs/latest/upgrading/#migrating-to-26-7-0) for more information.
|
||
|
||
- `librest` providing 0.7 ABI was removed. `librest_1_0` providing 1.0 ABI was renamed to `librest` and `librest_1_0` was kept as an alias.
|
||
|
||
- `pnpm_10` was upgraded to version 10.34.1+, which introduced stricter integrity checks. If you encounter `ERR_PNPM_MISSING_TARBALL_INTEGRITY`, you can fall back to the older `pnpm_10_34_0`.
|
||
|
||
- `fetchPnpmDeps`' `fetcherVersion = 1` and `fetcherVersion = 2` have been
|
||
removed, as announced in the 26.05 release. Packages still using them now
|
||
throw an evaluation error and must migrate to `fetcherVersion = 3` (or later)
|
||
and regenerate their hashes. See the
|
||
[pnpm `fetcherVersion` section](#javascript-pnpm-fetcherVersion) of the manual
|
||
for details.
|
||
|
||
- `rebuilderd` has been updated to 0.27.0 introducing breaking changes. See upstream changelog for details: [0.26.0](https://github.com/kpcyrd/rebuilderd/releases/tag/v0.26.0), [0.27.0](https://github.com/kpcyrd/rebuilderd/releases/tag/v0.27.0)
|
||
|
||
- Starting with v14, `flameshot` will primarily utilise xdg-desktop-portal calls for screenshotting. This will directly affect users on X11 window managers due to the lack of a compatible portal with Screenshot feature. See [upstream changelog](https://github.com/flameshot-org/flameshot/releases/tag/v14.0.0) or [NixOS Flameshot](https://wiki.nixos.org/wiki/Flameshot) wiki page for workarounds.
|
||
- `nim1` and respective aliases have been removed due to entering EOL; please migrate to `nim` or `nim-unwrapped` (nim 2).
|
||
- `nim-2_0` & `nim-2_2` and respective aliases have been removed; please migrate to `nim` or `nim-unwrapped` (nim 2.2.10).
|
||
- `domoticz` has been updated from `2024.7` to `2026.x`, breaking third party applications and scripts using the old RType calls. Review the [release notes](https://github.com/domoticz/domoticz/blob/2026.2/History.txt#L398) for more information.
|
||
|
||
- `vimacs` has been removed, as it has not been maintained in 10 years and was built for an old version of vim (6.0).
|
||
|
||
## Other Notable Changes {#sec-nixpkgs-release-26.11-notable-changes}
|
||
|
||
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
|
||
|
||
- `super-productivity` has been updated. The binary has been renamed from `super-productivity` to `superproductivity`. A symlink from the old name is provided for backward compatibility.
|
||
|
||
- Package-URL (PURL, https://github.com/package-url/purl-spec) metadata identifier has been added for `fetchgit`, `fetchpypi` and `fetchFromGithub` fetchers.
|
||
`mkDerivation` has been adjusted to reuse this information.
|
||
Package-URLs allow reliably identifying and locating software packages.
|
||
Maintainers of derivations using the adapted fetchers should rely on the `drv.src.meta.identifiers.v1.purl` default identifier and can enhance their `drv.meta.identifiers.v1.purls` list once they would like to have additional identifiers.
|
||
Maintainers using `fetchurl` for `drv.src` are urged to adapt their `drv.meta.identifiers.purlParts` for proper identification.
|
||
|
||
- Emacs loads the `early-default` library after `early-init.el`.
|
||
Users can add `early-init.el` via `emacs.pkgs.withPackages`
|
||
by packaging `early-init.el` into a library named `early-default`.
|
||
To prevent loading the `early-default` library,
|
||
set `inhibit-early-default-init` in `early-init.el`.
|
||
|
||
- `services.ceph` enabled the generation of Ceph log files at `/var/log/ceph/`.
|
||
They were missing before because Ceph omitted logs when this directory was missing.
|
||
Ceph logs can grow large, so you may want to configure rotation of these logs.
|
||
|
||
## Nixpkgs Library {#sec-nixpkgs-release-26.11-lib}
|
||
|
||
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
|
||
|
||
### Breaking changes {#sec-nixpkgs-release-26.11-lib-breaking}
|
||
|
||
- `fittrackee` 1.0.0 now requires postgres with postgis. The [upgrade guide](https://docs.fittrackee.org/en/upgrading-to-1.0.0.html) has steps to prepare for this upgrade.
|
||
|
||
### Deprecations {#sec-nixpkgs-release-26.11-lib-deprecations}
|
||
|
||
- Setting `config.allowBrokenPredicate` is deprecated in favor of
|
||
using `config.problems.handlers.PackageName.broken = "warn"` (or `=
|
||
"ignore"`). For more information see [](#sec-allow-broken).
|
||
|
||
|
||
### Additions and Improvements {#sec-nixpkgs-release-26.11-lib-additions-improvements}
|
||
|
||
- Create the first release note entry in this section!
|