NixOS · vcunat · Jan 22, 2026 · Jan 8, 2026 · Jan 8, 2026 · Jan 8, 2026
diff --git a/ci/OWNERS b/ci/OWNERS
@@ -434,7 +434,7 @@ pkgs/by-name/fo/forgejo/                @adamcstephens @bendlas @emilylange
 
 # Node.js
 /pkgs/build-support/node/build-npm-package      @winterqt
-/pkgs/build-support/node/fetch-npm-deps         @winterqt
+/pkgs/build-support/node/prefetch-npm-deps      @winterqt
 /doc/languages-frameworks/javascript.section.md @winterqt
 /pkgs/development/tools/pnpm                    @Scrumplex @gepbird
 /pkgs/build-support/node/fetch-pnpm-deps        @Scrumplex @gepbird

diff --git a/lib/licenses.nix b/lib/licenses.nix
@@ -742,6 +742,18 @@ lib.mapAttrs mkLicense (
       fullName = "Historical Permission Notice and Disclaimer - sell xserver variant with MIT disclaimer";
     };
 
+    hpndSellVariantSafetyClause = {
+      fullName = "HPND - sell variant with safety critical systems clause";
+      url = "https://gitlab.freedesktop.org/xorg/driver/xf86-video-voodoo/-/blob/68a5b6d98ae34749cca889f4373b4043d00bfe6a/src/voodoo_dga.c#L12-33";
+      # TODO: if the license gets accepted to spdx then
+      #   add spdxId
+      # else
+      #   remove license
+      #   && replace reference with whatever this license is supposed to be then
+      # https://github.com/spdx/license-list-XML/issues/2922
+      # spdxId = "HPND-sell-variant-safety-clause";
+    };
+
     hpndDec = {
       fullName = "Historical Permission Notice and Disclaimer - DEC variant";
       spdxId = "HPND-DEC";

diff --git a/lib/systems/platforms.nix b/lib/systems/platforms.nix
@@ -85,7 +85,6 @@ rec {
         BLK_DEV_DM m
         DM_CRYPT m
         MD y
-        REISERFS_FS m
         BTRFS_FS m
         XFS_FS m
         JFS_FS m
@@ -430,7 +429,6 @@ rec {
         BLK_DEV_DM m
         DM_CRYPT m
         MD y
-        REISERFS_FS m
         EXT4_FS m
         USB_STORAGE_CYPRESS_ATACB m
 
@@ -475,7 +473,6 @@ rec {
         FRAMEBUFFER_CONSOLE y
         EXT2_FS y
         EXT3_FS y
-        REISERFS_FS y
         MAGIC_SYSRQ y
 
         # The kernel doesn't boot at all, with FTRACE

diff --git a/maintainers/scripts/bootstrap-files/README.md b/maintainers/scripts/bootstrap-files/README.md
@@ -11,10 +11,53 @@ These are called "bootstrap files".
 
 Bootstrap files should always be fetched from hydra and uploaded to `tarballs.nixos.org` to guarantee that all the binaries were built from the code committed into `nixpkgs` repository.
 
-The uploads to `tarballs.nixos.org` are done by `@lovesegfault` today.
+The uploads to `tarballs.nixos.org` are done by `@NixOS/infra` team members who have S3 write access.
 
 This document describes the procedure of updating bootstrap files in `nixpkgs`.
 
+## How to upload bootstrap files (for infra team)
+
+When a PR updates bootstrap files, the commit message contains the upload commands.
+Infra team members with S3 access can upload as follows:
+
+1. Clone or navigate to the [nixos-infra](https://github.com/NixOS/nixos-infra) repository and enter the `terraform` directory:
+
+   ```
+   $ cd nixos-infra/terraform
+   ```
+
+2. Authenticate with AWS SSO:
+
+   ```
+   $ aws sso login
+   ```
+
+3. Realize the build output locally (fetch from hydra cache):
+
+   ```
+   $ nix-store --realize /nix/store/<hash>-stdenv-bootstrap-tools
+   ```
+
+4. Upload to S3 with public-read ACL:
+
+   ```
+   $ aws s3 cp --recursive --acl public-read \
+       /nix/store/<hash>-stdenv-bootstrap-tools/on-server/ \
+       s3://nixpkgs-tarballs/stdenv/<target>/<nixpkgs-revision>/
+   ```
+
+5. Verify the upload by downloading and checking hashes:
+
+   ```
+   $ aws s3 cp --recursive s3://nixpkgs-tarballs/stdenv/<target>/<nixpkgs-revision>/ ./
+   $ sha256sum bootstrap-tools.tar.xz busybox
+   $ sha256sum /nix/store/<hash>-stdenv-bootstrap-tools/on-server/*
+   ```
+
+   Compare these hashes with those shown in the PR's commit message.
+
+The exact paths and hashes are provided in each bootstrap update commit message generated by `refresh-tarballs.bash`.
+
 ## How to request the bootstrap seed update
 
 To get the tarballs updated let's use an example `i686-unknown-linux-gnu` target:
@@ -34,7 +77,7 @@ To get the tarballs updated let's use an example `i686-unknown-linux-gnu` target
    To validate cross-targets `binfmt` `NixOS` helper can be useful.
    For `riscv64-unknown-linux-gnu` the `/etc/nixos/configuration.nix` entry would be `boot.binfmt.emulatedSystems = [ "riscv64-linux" ]`.
 
-3. Propose the commit as a PR to update bootstrap tarballs, tag people who can help you test the updated architecture and once reviewed tag `@lovesegfault` to upload the tarballs.
+3. Propose the commit as a PR to update bootstrap tarballs, tag people who can help you test the updated architecture and once reviewed tag `@NixOS/infra-build` to upload the tarballs.
 
 ## How to add bootstrap files for a new target
 

diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -120,3 +120,41 @@ of pulling the upstream container image from Docker Hub. If you want the old beh
 - `services.openssh` now supports generating host SSH keys by setting `services.openssh.generateHostKeys = true` while leaving `services.openssh.enable` disabled.  This is particularly useful for systems that have no need of an SSH daemon but want SSH host keys for other purposes such as using agenix or sops-nix.
 
 - `services.slurm` now supports slurmrestd usage through the `services.slurm.rest` NixOS options.
+
+- `glibc` has been updated to version 2.42.
+
+  This version no longer makes the stack executable when a shared library requires this. A symptom
+  is an error like
+
+  > cannot enable executable stack as shared object requires: Invalid argument
+
+  This is usually a bug. Please consider reporting it to the software maintainers.
+
+  In a lot of cases, the library requires the execstack by mistake only. The following workarounds exist:
+
+  * When building the shared library in question from source, use the following linker flags to force turning off the
+    executable flag:
+
+    ```nix
+    mkDerivation {
+      # …
+
+      env.NIX_LDFLAGS = "-z,noexecstack";
+    }
+    ```
+
+  * If the sources are not available, the execstack-flag can be cleared with `patchelf`:
+
+    ```
+    patchelf --clear-execstack binary-only.so
+    ```
+
+  * If the shared library to be loaded actually requires an executable stack and it isn't turned
+    on by the application loading it, you may force allowing that behavior by setting the
+    following environment variable:
+
+    ```
+    GLIBC_TUNABLES=glibc.rtld.execstack=2
+    ```
+
+    **Do not set this globally!** This makes your setup inherently less secure.
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
@@ -1929,7 +1929,6 @@
   ./tasks/filesystems/nfs.nix
   ./tasks/filesystems/ntfs.nix
   ./tasks/filesystems/overlayfs.nix
-  ./tasks/filesystems/reiserfs.nix
   ./tasks/filesystems/squashfs.nix
   ./tasks/filesystems/sshfs.nix
   ./tasks/filesystems/unionfs-fuse.nix

diff --git a/nixos/modules/security/polkit.nix b/nixos/modules/security/polkit.nix
@@ -78,6 +78,8 @@ in
     ];
     systemd.services.polkit.stopIfChanged = false;
 
+    systemd.sockets."polkit-agent-helper".wantedBy = [ "sockets.target" ];
+
     # The polkit daemon reads action/rule files
     environment.pathsToLink = [ "/share/polkit-1" ];
 
@@ -94,19 +96,11 @@ in
 
     security.pam.services.polkit-1 = { };
 
-    security.wrappers = {
-      pkexec = {
-        setuid = true;
-        owner = "root";
-        group = "root";
-        source = "${cfg.package.bin}/bin/pkexec";
-      };
-      polkit-agent-helper-1 = {
-        setuid = true;
-        owner = "root";
-        group = "root";
-        source = "${cfg.package.out}/lib/polkit-1/polkit-agent-helper-1";
-      };
+    security.wrappers.pkexec = {
+      setuid = true;
+      owner = "root";
+      group = "root";
+      source = "${cfg.package.bin}/bin/pkexec";
     };
 
     systemd.tmpfiles.rules = [

diff --git a/nixos/modules/services/desktop-managers/gnome.nix b/nixos/modules/services/desktop-managers/gnome.nix
@@ -390,6 +390,10 @@ in
       systemd.packages = [
         pkgs.gnome-session
         pkgs.gnome-shell
+      ]
+      ++ removeExcluded [
+        pkgs.xdg-user-dirs # Update user dirs as described in https://freedesktop.org/wiki/Software/xdg-user-dirs/
+        pkgs.xdg-user-dirs-gtk # Used to create the default bookmarks
       ];
 
       services.udev.packages = [

diff --git a/nixos/modules/tasks/filesystems.nix b/nixos/modules/tasks/filesystems.nix
@@ -284,7 +284,6 @@ let
       ++ lib.optionals (!config.boot.initrd.checkJournalingFS) [
         "ext3"
         "ext4"
-        "reiserfs"
         "xfs"
         "jfs"
         "f2fs"

diff --git a/nixos/modules/tasks/filesystems/reiserfs.nix b/nixos/modules/tasks/filesystems/reiserfs.nix
diff --git a/nixos/tests/systemd-boot.nix b/nixos/tests/systemd-boot.nix
@@ -158,7 +158,8 @@ in
     }
   );
 
-  basicXbootldr = runTest (
+  # TODO: Fix on aarch64-linux
+  basicXbootldr = runTestOn [ "x86_64-linux" ] (
     { lib, ... }:
     {
       name = "systemd-boot-xbootldr";
@@ -282,7 +283,8 @@ in
     }
   );
 
-  update = runTest (
+  # TODO: Fix on aarch64-linux
+  update = runTestOn [ "x86_64-linux" ] (
     { lib, ... }:
     {
       name = "systemd-boot-update";
@@ -457,7 +459,8 @@ in
     }
   );
 
-  entryFilenameXbootldr = runTest (
+  # TODO: Fix on aarch64-linux
+  entryFilenameXbootldr = runTestOn [ "x86_64-linux" ] (
     { lib, ... }:
     {
       name = "systemd-boot-entry-filename-xbootldr";

diff --git a/pkgs/applications/audio/magnetophonDSP/VoiceOfFaust/default.nix b/pkgs/applications/audio/magnetophonDSP/VoiceOfFaust/default.nix
@@ -5,7 +5,6 @@
   faust2jack,
   faust2lv2,
   helmholtz,
-  mrpeach,
   puredata-with-plugins,
   jack-example-tools,
 }:
@@ -22,7 +21,6 @@ stdenv.mkDerivation rec {
 
   plugins = [
     helmholtz
-    mrpeach
   ];
 
   pitchTracker = puredata-with-plugins plugins;

diff --git a/pkgs/applications/audio/mpg123/default.nix b/pkgs/applications/audio/mpg123/default.nix
@@ -21,11 +21,11 @@ assert withConplay -> !libOnly;
 
 stdenv.mkDerivation rec {
   pname = "${lib.optionalString libOnly "lib"}mpg123";
-  version = "1.33.3";
+  version = "1.33.4";
 
   src = fetchurl {
     url = "mirror://sourceforge/mpg123/mpg123-${version}.tar.bz2";
-    hash = "sha256-agxkct0VbiE8IGj0ARXru3OXjC2HPma64qJQ4tIZjSY=";
+    hash = "sha256-OujJ/4Cpe/wOIuifvNdGh+yk/B2zFbEmB/J/ActaR9k=";
   };
 
   outputs = [

diff --git a/pkgs/applications/editors/neovim/wrapper.nix b/pkgs/applications/editors/neovim/wrapper.nix
@@ -198,6 +198,8 @@ let
         inherit pname version;
         inherit plugins;
 
+        strictDeps = true;
+
         __structuredAttrs = true;
         dontUnpack = true;
         inherit

diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
@@ -1,6 +1,6 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.1.1918";
+  version = "9.1.2035";
 
   outputs = [
     "out"
@@ -11,7 +11,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-NU/A7yWcLaC+wqsfiHYVhnSZHGDao6+Oib/bSFNSVyQ=";
+    hash = "sha256-x7WosfqYApaY2Vv1X9+2at/A/KqfacuPy53MGtnxk9w=";
   };
 
   enableParallelBuilding = true;

diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -85,13 +85,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.2-11";
+  version = "7.1.2-12";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     tag = finalAttrs.version;
-    hash = "sha256-RFiE23VW8AbVb7iglxjQMT6njDw+P7vLW6+nSKqN0p8=";
+    hash = "sha256-0X8Zpr4frknRbWzAu1nprok2ceScTHV8d4+ktnBpQF0=";
   };
 
   outputs = [

diff --git a/pkgs/applications/terminal-emulators/rxvt-unicode/default.nix b/pkgs/applications/terminal-emulators/rxvt-unicode/default.nix
@@ -135,12 +135,16 @@ stdenv.mkDerivation {
   ]
   ++ lib.optional emojiSupport "--enable-wide-glyphs";
 
-  LDFLAGS = [
-    "-lfontconfig"
-    "-lXrender"
-    "-lpthread"
-  ];
-  CFLAGS = [ "-I${freetype.dev}/include/freetype2" ];
+  env = {
+    LDFLAGS = toString [
+      "-lfontconfig"
+      "-lXrender"
+      "-lpthread"
+    ];
+    CFLAGS = toString [
+      "-I${freetype.dev}/include/freetype2"
+    ];
+  };
 
   preConfigure = ''
     # without this the terminfo won't be compiled by tic, see man tic
-Original file line number
+Diff line change
@@ Expand Up / @@ -284,7 +284,6 @@ let @@
           ++ lib.optionals (!config.boot.initrd.checkJournalingFS) [
             "ext3"
             "ext4"
-            "reiserfs"
             "xfs"
             "jfs"
             "f2fs"
@@ Expand Down @@