staging-next 2026-04-07

ci/OWNERS

@@ -479,7 +479,7 @@ pkgs/by-name/lx/lxc*                    @adamcstephens
 /pkgs/development/compilers/flutter @RossComputerGuy
 
 # GNU Tar & Zip
-/pkgs/tools/archivers/gnutar        @RossComputerGuy
+/pkgs/by-name/gn/gnutar        @RossComputerGuy
 /pkgs/by-name/zi/zip           @RossComputerGuy
 
 # SELinux

doc/build-helpers/special.md

@@ -3,6 +3,7 @@
 This chapter describes several special build helpers.
 
 ```{=include=} sections
+special/buildenv.section.md
 special/fakenss.section.md
 special/fhs-environments.section.md
 special/makesetuphook.section.md

doc/build-helpers/special/buildenv.section.md

@@ -0,0 +1,101 @@
+# buildEnv {#sec-buildEnv}
+
+`buildEnv` constructs a derivation containing directories and symbolic links, which resembles the profile layout where a list of derivations or store paths are installed.
+
+Unlike [`symlinkJoin`](#trivial-builder-symlinkJoin), `buildEnv` takes special care of the outputs to link and checks for content collisions across the paths by default.
+A common use case for `buildEnv` is constructing environment wrappers, such as an interpreter with modules or a program with extensions.
+For example, [`python.withPackage`](#attributes-on-interpreters-packages) is based on `buildEnv`.
+
+## Arguments {#sec-buildEnv-arguments}
+
+`buildEnv` takes [fixed-point arguments (`buildEnv (finalAttrs: { })`)](#chap-build-helpers-finalAttrs) as well as a plain attribute set.
+
+Unless otherwise noted, arguments can be overridden directly using [`<pkg>.overrideAttrs`](#sec-pkg-overrideAttrs).
+
+`buildEnv` enforces [structured attributes (`{ __structuredAttrs = true; }`)](https://nix.dev/manual/nix/2.18/language/advanced-attributes.html#adv-attr-structuredAttrs).
+
+- `name` or `pname` and `version` (required):
+    The name of the environment.
+
+- `paths` (required):
+    The derivations or store paths to symlink ("install").
+
+    The elements can be any path-like object that string-interpolates to a store path.
+    The priority of each path is taken from `<path>.meta.priority` and falls back to `lib.meta.defaultPriority` if not set.
+
+    The argument `paths` is passed as attribute `passthru.paths` to prevent unexpected context pollution.
+    `passthru.paths` can be overridden with `<pkg>.overrideAttrs`.
+
+-   `extraOutputsToInstall` (default to `[ ]`):
+    Package outputs to include in addition to what `meta.outputsToInstall` specifies.
+
+-   `includeClosures` (default to `false`):
+    Whether to include closures of all input paths.
+    The list of the closure paths are constructed with `writeClosure`.
+    They are installed with lower priority and with build-time exceptions silenced.
+
+-   `extraPrefix` (default to `""`):
+    Root the result in directory `"$out${extraPrefix}"`, e.g. `"/share"`.
+
+-   `ignoreCollisions` (default: `false`):
+    Don't fail the build upon content collisions.
+
+-   `checkCollisionContents` (default: `true`):
+    If there is a collision, check whether the contents and permissions match; and only if not, throw a collision error.
+
+-   `ignoreSingleFileOutputs` (default: `false`):
+    Don't fail the build upon single-file outputs.
+
+-   `manifest` (default: `""`):
+    The manifest file (if any). A symlink `$out/manifest` will be created to it.
+
+-   `pathsToLink` (default: `[ "/" ]`):
+    The paths (relative to each element of `paths`) that we want to symlink (e.g., `["/bin"]`).
+    Any file outside the directories in this list won't be symlinked into the produced environment.
+
+-   `postBuild` (default: `""`):
+    Shell commands to run after building the symlink tree.
+
+-   `passthru` and `meta` (default: `{ }`):
+    `stdenv.mkDerivation`-supported attributes not passing down to `builtins.derivation`.
+
+-   `derivationArgs` (default: `{ }`):
+    Additional `stdenv.mkDerivation` arguments, such as `nativeBuildInputs`/`buildInputs` for `postBuild` dependencies and setup hooks.
+
+    `derivationArgs` is not passed down to `stdenv.mkDerivation`.
+    Override its attributes directly via `<pkg>.overrideAttrs` and reference directly via `finalAttrs`.
+
+## Build-time exceptions {#sec-buildEnv-exceptions}
+
+There are situations where the specified `paths` might not produce sensible profile layout.
+By default, the builder fails early upon detecting these exceptions.
+`buildEnv` provides arguments to fine-tune or ignore certain exceptions.
+
+### Path collisions {#ssec-buildEnv-collisions}
+
+Path collisions occur when files provided by two more output paths with the same priority overlap with each other, making the result profile layout potentially affected by the order of elements of `paths`.
+This is undesirable in several use cases, such as when `paths` are determined by merging Nix modules.
+
+If the argument `checkCollisionContents` is `true`, the builder checks whether the overlapping paths share the same content and mode, and fails only if not.
+
+The argument `ignoreCollisions` silence the collision checks and allow the files to be overwritten based on the order of chosen output paths.
+
+In addition to silencing this exception with `ignoreCollisions`, one can also adjust the priority of colliding packages and store paths.
+Store paths can specify priority in the form
+
+```nix
+{
+  outPath = <path>;
+  meta.priority = <priority>;
+}
+```
+
+And [`lib.meta.setPrio`](#function-library-lib.meta.setPrio)-related Nixpkgs Library functions also apply to a string-like attribute set (`{ outPath = <path>; }`).
+
+### Single-file outputs {#ssec-buildEnv-singleFileOutputs}
+
+When an output path provides a single file instead of a directory, it inherently cannot merge into the result layout.
+All discoverable packages should configure their `meta.outputsToInstall` correctly, so that single-file outputs won't be installed into a profile.
+
+Set `ignoreSingleFileOutputs` to `true` to drop all single-file output paths silently.
+This option is useful when the specified paths contain the output paths of package tests.

doc/hooks/npm-config-hook.section.md

@@ -13,7 +13,7 @@ Primarily made for a multi-language environment.
 
 #### `npmDeps` {#npm-config-hook-deps}
 
-Derivation that contains the NPM package dependencies.
+Derivation that contains the npm package dependencies.
 Usually built with `fetchNpmDeps`.
 This attribute is required or the hook will abort the build.
 

doc/languages-frameworks/tcl.section.md

@@ -13,7 +13,8 @@ Tcl packages are typically built with `tclPackages.mkTclDerivation`.
 Tcl dependencies go in `buildInputs`/`nativeBuildInputs`/... like other packages.
 For more complex package definitions, such as packages with mixed languages, use `tcl.tclPackageHook`.
 
-Where possible, make sure to enable stubs for maximum compatibility, usually with the `--enable-stubs` configure flag.
+Where possible, make sure to enable stubs for maximum compatibility.
+If you are using `mkTclDerivation`, `--enable-stubs` will be automatically added to `configureFlags`.
 
 Here is a simple package example to be called with `tclPackages.callPackage`.
 
@@ -33,7 +34,6 @@ mkTclDerivation rec {
 
   configureFlags = [
     "--with-ssl-dir=${openssl.dev}"
-    "--enable-stubs"
   ];
 
   meta = {
@@ -52,3 +52,35 @@ Its use is documented in `pkgs/development/tcl-modules/by-name/README.md`.
 
 All Tcl applications reside elsewhere.
 In case a package is used as both a library and an application (for example `expect`), it should be defined in `tcl-packages.nix`, with an alias elsewhere.
+
+### Using tclRequiresCheck {#using-tclrequirescheck}
+
+Although unit tests are highly preferred to validate correctness of a package, not
+all packages have test suites that can be run easily, and some have none at all.
+To help ensure the package still works, [`tclRequiresCheck`](#using-tclrequirescheck) can attempt to `package require`
+the listed modules.
+
+```nix
+{
+  tclRequiresCheck = [
+    "json"
+    "doctools"
+  ];
+}
+```
+
+roughly translates to:
+
+```nix
+{
+  preDist = ''
+    TCLLIBPATH="$out/lib $TCLLIBPATH"
+    tclsh <<<'exit [catch {package require json; package require doctools}]'
+  '';
+}
+```
+
+However, this is done in its own phase, and not dependent on whether [`doCheck = true;`](#var-stdenv-doCheck).
+
+This can also be useful in verifying that the package doesn't assume commonly
+present packages (e.g. `tcllib`).

doc/redirects.json

@@ -379,6 +379,9 @@
   "sec-build-helper-extendMkDerivation": [
     "index.html#sec-build-helper-extendMkDerivation"
   ],
+  "sec-buildEnv-exceptions": [
+    "index.html#sec-buildEnv-exceptions"
+  ],
   "sec-building-packages-with-llvm": [
     "index.html#sec-building-packages-with-llvm"
   ],
@@ -770,6 +773,12 @@
   "sec-treefmt-options-reference": [
     "index.html#sec-treefmt-options-reference"
   ],
+  "ssec-buildEnv-collisions": [
+    "index.html#ssec-buildEnv-collisions"
+  ],
+  "ssec-buildEnv-singleFileOutputs": [
+    "index.html#ssec-buildEnv-singleFileOutputs"
+  ],
   "ssec-cosmic-common-issues": [
     "index.html#ssec-cosmic-common-issues"
   ],
@@ -878,6 +887,9 @@
   "typst-package-scope-and-usage": [
     "index.html#typst-package-scope-and-usage"
   ],
+  "using-tclrequirescheck": [
+    "index.html#using-tclrequirescheck"
+  ],
   "var-go-buildTestBinaries": [
     "index.html#var-go-buildTestBinaries"
   ],
@@ -2182,6 +2194,12 @@
   "chap-special": [
     "index.html#chap-special"
   ],
+  "sec-buildEnv": [
+    "index.html#sec-buildEnv"
+  ],
+  "sec-buildEnv-arguments": [
+    "index.html#sec-buildEnv-arguments"
+  ],
   "sec-fakeNss": [
     "index.html#sec-fakeNss"
   ],

doc/release-notes/rl-2511.section.md

@@ -324,6 +324,13 @@ and [release notes for v18](https://goteleport.com/docs/changelog/#1800-070325).
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- `buildEnv` now takes fixed-point arguments (`finalAttrs: { }`).
+  The custom overrider `<env-pkg>.override` is deprecated but kept in this release. It will be removed in future releases after tree-wide transition.
+  The argument `paths` is passed as `passthru.paths` to avoid bringing in unexpected context.
+
+- `buildEnv` now takes `derivationArgs` for additional arguments to pass to `stdenv.mkDerivation`.
+  A compatibility layer is added for directly-specified arguments `nativeBuildInputs` and `buildInputs`.
+
 - Added `rewriteURL` attribute to the nixpkgs `config`, to allow for rewriting the URLs downloaded by `fetchurl`.
 
 - Added `hashedMirrors` attribute to the nixpkgs `config`, to allow for customization of the hashed mirrors used by `fetchurl`.
@@ -348,7 +355,7 @@ and [release notes for v18](https://goteleport.com/docs/changelog/#1800-070325).
 
 - `fetchgit` now accepts a `rootDir` argument to limit the resulting source to one subdirectory of the whole Git repository. Corresponding `--root-dir` option added to `nix-prefetch-git`.
 
-- `fetchNpmDeps` now accepts a `npmRegistryOverridesString` argument to pass NPM registry overrides to the fetcher.
+- `fetchNpmDeps` now accepts a `npmRegistryOverridesString` argument to pass npm registry overrides to the fetcher.
 
 - `ffmpeg_8`, `ffmpeg_8-headless`, and `ffmpeg_8-full` have been added. The default version of FFmpeg is now `ffmpeg_8`. You can install previous versions from package attributes such as `ffmpeg_7`.
 

doc/release-notes/rl-2605.section.md

@@ -80,6 +80,8 @@
 
 - Note that the above `nodePackages` removal also coincides with the removal of `node2nix` and its tooling, which have been deprecated for a long time.
 
+- `buildEnv`-constructed packages now take only [structured attributes (`{ __structuredAttrs = true; }`)](https://nix.dev/manual/nix/2.18/language/advanced-attributes.html#adv-attr-structuredAttrs).
+
 - `xfce.mkXfceDerivation` has been deprecated (i.e. conditioned behind `nixpkgs.config.allowAliases`)
   and will be removed in NixOS 26.11, please use `stdenv.mkDerivation` directly. You can migrate by
   adding `pkg-config`, `xfce4-dev-tools`, and `wrapGAppsHook3` to your `nativeBuildInputs` and

maintainers/scripts/haskell/dependencies.nix

@@ -1,6 +1,6 @@
 # Nix script to calculate the Haskell dependencies of every haskellPackage. Used by ./hydra-report.hs.
 let
-  pkgs = import ../../.. { };
+  pkgs = import ../../.. { config.allowAliases = false; };
   inherit (pkgs) lib;
   getDeps =
     _: pkg:

maintainers/scripts/haskell/regenerate-transitive-broken-packages.sh

@@ -20,6 +20,6 @@ cat > $tmpfile << EOF
 dont-distribute-packages:
 EOF
 
-nix-instantiate --eval --option restrict-eval true -I . --strict --json maintainers/scripts/haskell/transitive-broken-packages.nix | jq -r . | LC_ALL=C.UTF-8 sort --ignore-case >> $tmpfile
+nix-instantiate --show-trace --eval --option restrict-eval true -I . --strict --json maintainers/scripts/haskell/transitive-broken-packages.nix | jq -r . | LC_ALL=C.UTF-8 sort --ignore-case >> $tmpfile
 
 mv $tmpfile $config_file

maintainers/scripts/haskell/transitive-broken-packages.nix

@@ -1,11 +1,16 @@
 let
   nixpkgs = import ../../..;
   inherit (nixpkgs { }) pkgs lib;
+  isVersioned = attr: builtins.match "[A-Za-z0-9-]+(_[0-9]+)+" attr != null;
   getEvaluating =
     x:
-    builtins.attrNames (
+    lib.mapAttrsToList (_: v: v.pname) (
       lib.filterAttrs (
-        _: v: (builtins.tryEval (v.outPath or null)).success && lib.isDerivation v && !v.meta.broken
+        n: v:
+        !(isVersioned n)
+        && (builtins.tryEval (v.outPath or null)).success
+        && lib.isDerivation v
+        && !v.meta.broken
       ) x
     );
   brokenDeps = lib.subtractLists (getEvaluating pkgs.haskellPackages) (

maintainers/scripts/haskell/update-stackage.sh

@@ -111,4 +111,9 @@ sed -r \
 # ShellCheck: latest version of command-line dev tool.
 # Agda: The Agda community is fast-moving; we strive to always include the newest versions of Agda and the Agda packages in nixpkgs.
 
+# Work around Stackage LTS including a bogus version of cassava which has been deprecated on Hackage.
+# See <https://github.com/haskell-hvr/cassava/issues/248>.
+# TODO(@sternenseemann): drop this once the situation has been resolved in Stackage LTS
+sed -e 's/cassava ==0.5.5.0/cassava >= 0.5.4.0 && (> 0.5.5.0 || < 0.5.5.0) && < 0.6.0.0/' -i "$stackage_config"
+
 echo "$old_version -> $version"

nixos/doc/manual/configuration/mattermost.chapter.md

@@ -99,7 +99,7 @@ these assumptions the best it can.
 
 Here is how to build the above Todo plugin. Note that we rely on
 package-lock.json being assembled correctly, so must use a version where it is!
-If there is no lockfile or the lockfile is incorrect, Nix cannot fetch NPM build
+If there is no lockfile or the lockfile is incorrect, Nix cannot fetch npm build
 and runtime dependencies for a sandbox build.
 
 ```nix

nixos/doc/manual/redirects.json

@@ -1466,6 +1466,24 @@
   "module-services-mailman-other-mtas": [
     "index.html#module-services-mailman-other-mtas"
   ],
+  "test-opt-requiredFeatures": [
+    "index.html#test-opt-requiredFeatures"
+  ],
+  "test-opt-requiredFeatures.apple-virt": [
+    "index.html#test-opt-requiredFeatures.apple-virt"
+  ],
+  "test-opt-requiredFeatures.devnet": [
+    "index.html#test-opt-requiredFeatures.devnet"
+  ],
+  "test-opt-requiredFeatures.kvm": [
+    "index.html#test-opt-requiredFeatures.kvm"
+  ],
+  "test-opt-requiredFeatures.nixos-test": [
+    "index.html#test-opt-requiredFeatures.nixos-test"
+  ],
+  "test-opt-requiredFeatures.uid-range": [
+    "index.html#test-opt-requiredFeatures.uid-range"
+  ],
   "trezor": [
     "index.html#trezor"
   ],

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -42,6 +42,15 @@
 
 - The default kernel package has been updated from 6.12 to 6.18. All supported kernels remain available.
 
+- The default D-Bus implementation has been switched from `dbus` to `dbus-broker`. dbus-broker provides
+  higher performance and reliability while maintaining compatibility with the D-Bus reference implementation.
+
+  Note that changing `services.dbus.implementation` is a **switch inhibitor**: switching between
+  implementations requires a reboot rather than just `nixos-rebuild switch`, because restarting D-Bus
+  mid-session is unsafe.
+
+  Users who wish to keep the classic daemon can set: `services.dbus.implementation = "dbus";`
+
 ## New Modules {#sec-release-26.05-new-modules}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->