staging-next 2026-05-08

doc/languages-frameworks/javascript.section.md

@@ -348,6 +348,48 @@ stdenv.mkDerivation (finalAttrs: {
 })
 ```
 
+It is highly recommended to use a pinned version of pnpm (i.e., `pnpm_9` or `pnpm_10`), to increase future reproducibility. It might also be required to use an older version if the package needs support for a certain lock file version. To do so, you can pass the `pnpm` argument to `fetchPnpmDeps` and override the `pnpm` arg in `pnpmConfigHook`. Here are the changes in the example above to use a pinned pnpm version:
+
+<!-- TODO: Does splicing still work when overriding in nativeBuildInputs here? -->
+
+```diff
+ {
+   fetchPnpmDeps,
+   nodejs,
+-  pnpm,
++  pnpm_10,
+   pnpmConfigHook,
+   stdenv,
+ }:
++let
++  # Optionally override pnpm to use a custom nodejs version
++  # Make sure that the same nodejs version is referenced in nativeBuildInputs
++  # pnpm = pnpm_10.override { nodejs = nodejs-slim_22; };
++in
+ stdenv.mkDerivation (finalAttrs: {
+   pname = "foo";
+   version = "0-unstable-1980-01-01";
+
+   src = {
+     #...
+   };
+
+   nativeBuildInputs = [
+     nodejs # in case scripts are run outside of a pnpm call
+     pnpmConfigHook
+-    pnpm # At least required by pnpmConfigHook, if not other (custom) phases
++    pnpm_10 # At least required by pnpmConfigHook, if not other (custom) phases
+   ];
+
+   pnpmDeps = fetchPnpmDeps {
+     inherit (finalAttrs) pname version src;
++    pnpm = pnpm_10;
+     fetcherVersion = 3;
+     hash = "...";
+   };
+ })
+```
+
 In case you are patching `package.json` or `pnpm-lock.yaml`, make sure to pass `finalAttrs.patches` to the function as well (i.e., `inherit (finalAttrs) patches`.
 
 `pnpmConfigHook` supports adding additional `pnpm install` flags via `pnpmInstallFlags` which can be set to a Nix string array:

doc/release-notes/rl-2605.section.md

@@ -253,6 +253,8 @@
 
 - Ethercalc and its associated module have been removed, as the package is unmaintained and cannot be installed from source with npm now.
 
+- The `services.avahi.wideArea` option now defaults to `false` as a mitigation against [`CVE-2024-52615`/`GHSA-x6vp-f33h-h32g`](https://github.com/avahi/avahi/security/advisories/GHSA-x6vp-f33h-h32g).
+
 - `coreth` has been removed, as upstream has moved it into `avalanchego`.
 
 - `nodePackages.prebuild-install` was removed because it appeared to be unmaintained upstream.
@@ -390,7 +392,7 @@ gnuradioMinimal.override {
 
 ### Breaking changes {#sec-nixpkgs-release-26.05-lib-breaking}
 
-- The `nodejs_latest` alias now points to `nodejs_25` instead of `nodejs_24`.
+- The `nodejs_latest` alias now points to `nodejs_26` instead of `nodejs_24`.
 
 - `nodejs-slim` no longer exposes a `corepack` executable, it has been moved to an ad-hoc output; to restore the previous behavior, `nodejs-slim.corepack` must be explicitly included.
 

maintainers/maintainer-list.nix

@@ -862,6 +862,13 @@
     githubId = 209175;
     name = "Alesya Huzik";
   };
+  Ai-Ya-Ya = {
+    email = "spg2500@gmail.com";
+    github = "Ai-Ya-Ya";
+    githubId = 72513839;
+    matrix = "aiya:catgirl.cloud";
+    name = "aiya";
+  };
   aij = {
     email = "aij+git@mrph.org";
     github = "aij";

maintainers/scripts/haskell/test-configurations.nix

@@ -6,7 +6,7 @@
   and builds all derivations (or at least a reasonable subset) affected by
   these overrides.
 
-  By default, it checks `configuration-{common,nix,ghc-9.8.x}.nix`. You can
+  By default, it checks `configuration-{common,nix,ghc-9.10.x}.nix`. You can
   invoke it like this:
 
     nix-build maintainers/scripts/haskell/test-configurations.nix --keep-going
@@ -55,6 +55,8 @@
   nixpkgsPath ? ../../..,
   config ? {
     allowBroken = true;
+    # TODO(@sternenseemann): better way to workaround throw-ing aliases?
+    allowAliases = false;
   },
   skipEvalErrors ? true,
   skipBinaryGHCs ? true,

maintainers/scripts/haskell/update-stackage.sh

@@ -104,16 +104,12 @@ sed -r \
     -e '/ hledger-lib /d' \
     -e '/ hledger-ui /d' \
     -e '/ hledger-web /d' \
+    -e '/ spacecookie /d' \
     < "${tmpfile_new}" >> $stackage_config
 # Explanations:
 # cabal2nix, distribution-nixpkgs, jailbreak-cabal, language-nix: These are our packages and we know what we are doing.
 # lsp, lsp-types, lsp-test, hie-bios: These are tightly coupled to hls which is not in stackage. They have no rdeps in stackage.
 # ShellCheck: latest version of command-line dev tool.
 # Agda: The Agda community is fast-moving; we strive to always include the newest versions of Agda and the Agda packages in nixpkgs.
 
-# Work around Stackage LTS including a bogus version of cassava which has been deprecated on Hackage.
-# See <https://github.com/haskell-hvr/cassava/issues/248>.
-# TODO(@sternenseemann): drop this once the situation has been resolved in Stackage LTS
-sed -e 's/cassava ==0.5.5.0/cassava >= 0.5.4.0 && (> 0.5.5.0 || < 0.5.5.0) && < 0.6.0.0/' -i "$stackage_config"
-
 echo "$old_version -> $version"

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -191,6 +191,17 @@
 
 - `services.pyload` has been removed because the package it relies on does not exist anymore in nixpkgs due to vulnerabilities and being unmaintained.
 
+- Removed the ability from systemd to start units installed via `nix-env -i`.
+  This feature is hardly used and most units do not work without NixOS specific
+  changes anyways. Removing this allows us to drop a custom systemd patch
+  improving systemd maintainability and update speed.
+
+- Removed the ability from systemd to depend on open-yet-unformatted dm-crypt
+  devices as systemd device units. For example you cannot call systemd-makefs
+  on such devices. This was never implemented upstream but patched into
+  Nixpkgs's systemd. Removing this allows us to drop a custom systemd patch
+  improving systemd maintainability and update speed.
+
 - `linux_hardened` kernel has been removed due to a lack of maintenance.
 
 - `services.tandoor-recipes` now uses a sub-directory for media files by default starting with `26.05`. Existing setups should move media files out of the data directory and adjust `services.tandoor-recipes.extraConfig.MEDIA_ROOT` accordingly. See [Migrating media files for pre 26.05 installations](#module-services-tandoor-recipes-migrating-media).

nixos/modules/config/console.nix

@@ -6,6 +6,7 @@
 }:
 let
   cfg = config.console;
+  i18nCfg = config.i18n;
 
   makeColor = i: lib.concatMapStringsSep "," (x: "0x" + lib.substring (2 * i) 2 x);
 
@@ -164,8 +165,10 @@ in
           environment.systemPackages = [ pkgs.kbd ];
 
           # Let systemd-vconsole-setup.service do the work of setting up the
-          # virtual consoles.
-          environment.etc."vconsole.conf".source = vconsoleConf true;
+          # virtual consoles. Skip when imperative so localectl can manage it.
+          environment.etc."vconsole.conf" = lib.mkIf (!i18nCfg.imperativeLocale) {
+            source = vconsoleConf true;
+          };
           # Provide kbd with additional packages.
           environment.etc.kbd.source = "${consoleEnv pkgs.kbd}/share";
 
@@ -211,13 +214,22 @@ in
             "systemd-vconsole-setup.service"
           ];
 
+          # When imperative, seed /etc/vconsole.conf on first boot from declared
+          # defaults so the keymap isn't lost before localectl is ever used
+          systemd.tmpfiles.rules = lib.mkIf i18nCfg.imperativeLocale [
+            "C /etc/vconsole.conf - - - - ${vconsoleConf}"
+          ];
+
           systemd.services.reload-systemd-vconsole-setup = {
             description = "Reset console on configuration changes";
             wantedBy = [ "multi-user.target" ];
-            restartTriggers = [
-              (config.environment.etc."vconsole.conf".source)
-              (consoleEnv pkgs.kbd)
-            ];
+            restartTriggers =
+              lib.optionals (!i18nCfg.imperativeLocale) [
+                (config.environment.etc."vconsole.conf".source)
+              ]
+              ++ [
+                (consoleEnv pkgs.kbd)
+              ];
             reloadIfChanged = true;
             serviceConfig = {
               RemainAfterExit = true;

nixos/modules/config/i18n.nix

@@ -5,24 +5,29 @@
   ...
 }:
 let
+  cfg = config.i18n;
+  localeConf = pkgs.writeText "locale.conf" ''
+    LANG=${cfg.defaultLocale}
+    ${lib.concatStringsSep "\n" (lib.mapAttrsToList (n: v: "${n}=${v}") cfg.extraLocaleSettings)}
+  '';
   sanitizeUTF8Capitalization =
     lang: (lib.replaceStrings [ "utf8" "utf-8" "UTF8" ] [ "UTF-8" "UTF-8" "UTF-8" ] lang);
   aggregatedLocales =
-    lib.optionals (config.i18n.defaultLocale != "C") [
-      "${config.i18n.defaultLocale}/${config.i18n.defaultCharset}"
+    lib.optionals (cfg.defaultLocale != "C") [
+      "${cfg.defaultLocale}/${cfg.defaultCharset}"
     ]
-    ++ lib.pipe config.i18n.extraLocaleSettings [
+    ++ lib.pipe cfg.extraLocaleSettings [
       # See description of extraLocaleSettings for why is this ignored here.
       (x: lib.removeAttrs x [ "LANGUAGE" ])
       (lib.mapAttrs (n: v: (sanitizeUTF8Capitalization v)))
       # C locales are always installed
       (lib.filterAttrs (n: v: v != "C"))
-      (lib.mapAttrsToList (LCRole: lang: lang + "/" + (config.i18n.localeCharsets.${LCRole} or "UTF-8")))
+      (lib.mapAttrsToList (LCRole: lang: lang + "/" + (cfg.localeCharsets.${LCRole} or "UTF-8")))
     ]
     ++ (map sanitizeUTF8Capitalization (
-      lib.optionals (builtins.isList config.i18n.extraLocales) config.i18n.extraLocales
+      lib.optionals (builtins.isList cfg.extraLocales) cfg.extraLocales
     ))
-    ++ (lib.optional (builtins.isString config.i18n.extraLocales) config.i18n.extraLocales);
+    ++ (lib.optional (builtins.isString cfg.extraLocales) cfg.extraLocales);
 in
 {
   ###### interface
@@ -35,8 +40,8 @@ in
         default =
           if pkgs.glibcLocales != null then
             pkgs.glibcLocales.override {
-              allLocales = lib.elem "all" config.i18n.supportedLocales;
-              locales = config.i18n.supportedLocales;
+              allLocales = lib.elem "all" cfg.supportedLocales;
+              locales = cfg.supportedLocales;
             }
           else
             null;
@@ -150,6 +155,16 @@ in
         '';
       };
 
+      imperativeLocale = lib.mkEnableOption ''
+        imperative locale and keyboard management via localectl.
+
+        When enabled, locale and keyboard settings can be changed at runtime
+        using `localectl set-locale` and `localectl set-keymap`.
+        When disabled (the default), these settings are managed declaratively
+        through {option}`i18n.defaultLocale`, {option}`i18n.extraLocaleSettings`,
+        and {option}`console.keyMap`.
+      '';
+
     };
 
   };
@@ -161,8 +176,8 @@ in
       lib.optional
         (
           !(
-            (lib.subtractLists config.i18n.supportedLocales aggregatedLocales) == [ ]
-            || lib.elem "all" config.i18n.supportedLocales
+            (lib.subtractLists cfg.supportedLocales aggregatedLocales) == [ ]
+            || lib.elem "all" cfg.supportedLocales
           )
         )
         ''
@@ -178,29 +193,36 @@ in
 
     environment.systemPackages =
       # We increase the priority a little, so that plain glibc in systemPackages can't win.
-      lib.optional (config.i18n.glibcLocales != null && config.i18n.supportedLocales != [ ]) (
-        lib.setPrio (-1) config.i18n.glibcLocales
+      lib.optional (cfg.glibcLocales != null && cfg.supportedLocales != [ ]) (
+        lib.setPrio (-1) cfg.glibcLocales
       );
 
     environment.sessionVariables = {
-      LANG = config.i18n.defaultLocale;
       LOCALE_ARCHIVE = "/run/current-system/sw/lib/locale/locale-archive";
     }
-    // config.i18n.extraLocaleSettings;
-
-    systemd.globalEnvironment =
-      lib.mkIf (config.i18n.glibcLocales != null && config.i18n.supportedLocales != [ ])
-        {
-          LOCALE_ARCHIVE = "${config.i18n.glibcLocales}/lib/locale/locale-archive";
-        };
+    # When imperative, leave LANG/LC_* to pam_systemd so /etc/set-environment
+    # does not override what localectl wrote to /etc/locale.conf.
+    // lib.optionalAttrs (!cfg.imperativeLocale) (
+      {
+        LANG = cfg.defaultLocale;
+      }
+      // cfg.extraLocaleSettings
+    );
+
+    systemd.globalEnvironment = lib.mkIf (cfg.glibcLocales != null && cfg.supportedLocales != [ ]) {
+      LOCALE_ARCHIVE = "${cfg.glibcLocales}/lib/locale/locale-archive";
+    };
 
     # ‘/etc/locale.conf’ is used by systemd.
-    environment.etc."locale.conf".source = pkgs.writeText "locale.conf" ''
-      LANG=${config.i18n.defaultLocale}
-      ${lib.concatStringsSep "\n" (
-        lib.mapAttrsToList (n: v: "${n}=${v}") config.i18n.extraLocaleSettings
-      )}
-    '';
+    # If imperative, see below
+    environment.etc."locale.conf" = lib.mkIf (!cfg.imperativeLocale) {
+      source = localeConf;
+    };
 
+    # When imperative, seed /etc/locale.conf on first boot from declared defaults
+    # so the system doesn’t fall back to C.UTF-8
+    systemd.tmpfiles.rules = lib.mkIf cfg.imperativeLocale [
+      "C /etc/locale.conf - - - - ${localeConf}"
+    ];
   };
 }

nixos/modules/config/locale.nix

@@ -86,10 +86,6 @@ in
     # This way services are restarted when tzdata changes.
     systemd.globalEnvironment.TZDIR = tzdir;
 
-    systemd.services.systemd-timedated.environment = lib.optionalAttrs (config.time.timeZone != null) {
-      NIXOS_STATIC_TIMEZONE = "1";
-    };
-
     environment.etc = {
       zoneinfo.source = tzdir;
     }

nixos/modules/services/desktop-managers/gnome.nix

@@ -469,6 +469,7 @@ in
         pkgs.gnome-maps
         pkgs.gnome-music
         pkgs.gnome-system-monitor
+        pkgs.gnome-tecla
         pkgs.gnome-weather
         pkgs.loupe
         pkgs.nautilus

nixos/modules/services/display-managers/gdm.nix

@@ -44,6 +44,10 @@ let
   defaultSessionName = config.services.displayManager.defaultSession;
 
   setSessionScript = pkgs.callPackage ../x11/display-managers/account-service-util.nix { };
+
+  greeterEnvFile = pkgs.writeText "gdm-greeter-env" ''
+    DCONF_PROFILE=gdm
+  '';
 in
 
 {
@@ -103,6 +107,12 @@ in
       [ "services" "xserver" "displayManager" "gdm" "autoLogin" "delay" ]
       [ "services" "displayManager" "gdm" "autoLogin" "delay" ]
     )
+    (lib.mkRemovedOptionModule [
+      "services"
+      "displayManager"
+      "gdm"
+      "wayland"
+    ] "Disabling this option is no longer supported with GNOME 50.")
   ];
 
   meta = {
@@ -128,14 +138,6 @@ in
         '';
       };
 
-      wayland = lib.mkOption {
-        type = lib.types.bool;
-        default = true;
-        description = ''
-          Allow GDM to run on Wayland instead of Xserver.
-        '';
-      };
-
       autoSuspend = lib.mkOption {
         default = true;
         description = ''
@@ -361,7 +363,6 @@ in
     # presented and there's a little delay.
     services.displayManager.gdm.settings = {
       daemon = lib.mkMerge [
-        { WaylandEnable = cfg.wayland; }
         # nested if else didn't work
         (lib.mkIf (config.services.displayManager.autoLogin.enable && cfg.autoLogin.delay != 0) {
           TimedLoginEnable = true;
@@ -455,6 +456,12 @@ in
               settings.conffile = "/etc/pam/environment";
               settings.readenv = 0;
             }
+            {
+              name = "env-greeter";
+              control = "required";
+              modulePath = "${config.security.pam.package}/lib/security/pam_env.so";
+              settings.envfile = greeterEnvFile;
+            }
             {
               name = "systemd";
               control = "optional";