The nixexprs.tar.xz tarball will be discontinued together with Nixpkgs 27.05 after 2027-12-31. Migrate to the nixexprs.tar.zst tarball instead.

This affects for example users who pull Nixpkgs as a flake input from https://channels.nixos.org:

-nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.xz";
+nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.zst";

Support for x86_64-darwin has been dropped, due to Apple’s deprecation of the platform and limited build infrastructure and developer time. We will no longer build packages for the platform or support building them from source.

The Nixpkgs 26.05 stable branch will still maintain platform support and binaries will be built until it goes out of support at the end of 2026. Users of x86_64-darwin will receive an error message explaining how to switch to 26.05.

By the time of this release, Homebrew will offer only limited Tier 3 support for the platform, but MacPorts will likely continue to support it for a long time. We also recommend users consider installing NixOS, which should continue to run on essentially all Intel Macs, especially after Apple stops security support for macOS 26 in 2028.

bundlerApp now sets __structuredAttrs = true for its result package. Out-of-tree packages passing postBuild to bundlerApp should examine if their postBuild commands are compatible with structured attributes.

databricks-cli has been updated from 0.290.2 to 1.x.x, the first major release. OAuth tokens for interactive logins (auth_type = databricks-cli) are now stored in the OS-native secure store by default (Secret Service on Linux) instead of ~/.databricks/token-cache.json; cached tokens from older versions are not migrated, so run databricks auth login once per profile after upgrading. To keep the previous file-backed storage, set DATABRICKS_AUTH_STORAGE=plaintext or add auth_storage = plaintext under [__settings__] in ~/.databrickscfg. Additionally, the vector_search_endpoints DABs resource renamed min_qps to target_qps (and the vector-search-endpoints command renamed --min-qps to --target-qps). See the upstream changelog for details.

hurl has been updated to 8.x.x which has some breaking changes. See upstream changelog for details.

gotosocial has been updated to 0.22.0. This release contains a very long database migration, which should not be cancelled or interrupted under any circumstances.

Postgres users: Following the migration, if you encounter slowdown on Postgres specifically (ie., timing out while loading timelines) you may need to run some manual database maintenance steps. Please check https://docs.gotosocial.org/en/stable/admin/database_maintenance/#postgres.

xsecurelock no longer supports authentication via htaccess files (~/.xsecurelock.pw) or via the pamtester program by default. Only the recommended PAM module is supported unless rebuilt with withHtaccess or withPamtester.

python3Packages.django-health-check has been updated to major version 4. See its migration guide and changelog for breaking changes.

jmtpfs has been removed due to lack of maintenance and fuse3 support.

libgdata has been removed, as it was archived upstream and relied on the insecure libsoup 2.4.

mcphost has been removed, as it was archived upstream and declared unmaintained.

fflogs has been removed because it was no longer functional. Users should switch to archon-lite.

services.mysql now sets root@localhost authentication to auth_socket when used with mysql or percona-server. Existing deployments will also be adjusted if possible. See the security advisory GHSA-6qxx-6rg8-c4p8 for more information.

zerofs has been updated from 1.x to 2.x which is a breaking change. Volumes created by earlier releases are refused at open with a clear error. There is no migration tool; older volumes remain readable and writable by the release that created them.

keycloak.plugins.keycloak-metrics-spi has been removed. Keycloak exposes Prometheus metrics natively on its management interface; enable them with the metrics-enabled setting (and event-metrics-user-enabled for login and event counters). See Gaining insights with metrics.

alps has been rewritten upstream, see upstream repository for documentation.

uhttpmock providing 0.0 ABI was removed. uhttpmock_1_0 providing 1.0 ABI was renamed to uhttpmock and uhttpmock_1_0 was kept as an alias.

nix-serve-ng (and haskellPackages.nix-serve-ng) is now built against Lix instead of CppNix, following upstream which has switched to Lix as its supported Nix implementation.

Linux kernel configuration has been moved out of the linux-kernel field of the platform structure into the kernel builders:

The img argument of vmTools has been renamed to kernelImage, as it collided with the top-level img package. Additionally, the kernel module tree used inside the VM has been split out of the kernel argument into a new kernelModules argument (defaulting to kernel). Callers that overrode kernel with a module tree (e.g. from pkgs.aggregateModules) to make extra modules available must now pass it via kernelModules instead, keeping kernel pointing at a bootable kernel derivation.

The ARMv5 Linux kernel build now uses a standard configuration and generates a standard compressed image instead of the deprecated legacy U‐Boot image format. lib.systems.{examples,platforms}.{sheevaplug,pogoplug4} have been unified into lib.systems.examples.armv5tel-multiplatform. Note that there is no official support for ARMv5 and it is not possible to build even a simple NixOS configuration out of the box.

pdns has been updated from 5.0.x to 5.1.x. Please be sure to review the Upgrade Notes before upgrading. Namely LUA record updates are no longer allowed by default, and the embedded webserver no longer includes a access-control-allow-origin: * header by default.

Support for the legacy U‐Boot image format has been removed from the Linux kernel builders, as it is deprecated upstream and no longer used by any platform in Nixpkgs.

etcd_3_4 package was dropped, as it’s gone EOL. Please upgrade to either 3.5 or 3.6. See migration notes for incompatibilities and upgrade procedure.

rke2 retires ingress-nginx and transitions to Traefik starting in rke2_1_36. Because ingress-nginx was retired upstream as of March 2026, Traefik is now the default for new clusters starting in v1.36 (existing clusters will keep their current ingress upon upgrade to avoid breakage). This transition brings the following structural changes:

buildFHSEnvChroot has been removed after deprecation in 23.05.

gh-actions-cache has been removed since its functionality has been integrated directly into gh (gh cache). See upstream readme.

requireFile now sets meta.license = lib.licenses.unfree by default. Users of requireFile-based derivations that preserve this default will need to explicitly allow their evaluation as described in the section called “Installing unfree packages”.

texlive.combine is deprecated and scheduled for removal in 27.05. Please migrate to texliveSmall.withPackages (see the section called “User’s guide”).

keycloak was updated to >= 26.7.0 and includes some breaking internal (API) changes. See the upstream migration guide for more information.

librest providing 0.7 ABI was removed. librest_1_0 providing 1.0 ABI was renamed to librest and librest_1_0 was kept as an alias.

pnpm_10 was upgraded to version 10.34.1+, which introduced stricter integrity checks. If you encounter ERR_PNPM_MISSING_TARBALL_INTEGRITY, you can fall back to the older pnpm_10_34_0.

fetchPnpmDeps’ fetcherVersion = 1 and fetcherVersion = 2 have been removed, as announced in the 26.05 release. Packages still using them now throw an evaluation error and must migrate to fetcherVersion = 3 (or later) and regenerate their hashes. See the pnpm fetcherVersion section of the manual for details.

rebuilderd has been updated to 0.27.0 introducing breaking changes. See upstream changelog for details: 0.26.0, 0.27.0

Starting with v14, flameshot will primarily utilise xdg-desktop-portal calls for screenshotting. This will directly affect users on X11 window managers due to the lack of a compatible portal with Screenshot feature. See upstream changelog or NixOS Flameshot wiki page for workarounds.

nim1 and respective aliases have been removed due to entering EOL; please migrate to nim or nim-unwrapped (nim 2).

nim-2_0 & nim-2_2 and respective aliases have been removed; please migrate to nim or nim-unwrapped (nim 2.2.10).

domoticz has been updated from 2024.7 to 2026.x, breaking third party applications and scripts using the old RType calls. Review the release notes for more information.

vimacs has been removed, as it has not been maintained in 10 years and was built for an old version of vim (6.0).

super-productivity has been updated. The binary has been renamed from super-productivity to superproductivity. A symlink from the old name is provided for backward compatibility.

Package-URL (PURL, https://github.com/package-url/purl-spec) metadata identifier has been added for fetchgit, fetchpypi and fetchFromGithub fetchers. mkDerivation has been adjusted to reuse this information. Package-URLs allow reliably identifying and locating software packages. Maintainers of derivations using the adapted fetchers should rely on the drv.src.meta.identifiers.v1.purl default identifier and can enhance their drv.meta.identifiers.v1.purls list once they would like to have additional identifiers. Maintainers using fetchurl for drv.src are urged to adapt their drv.meta.identifiers.purlParts for proper identification.

Emacs loads the early-default library after early-init.el. Users can add early-init.el via emacs.pkgs.withPackages by packaging early-init.el into a library named early-default. To prevent loading the early-default library, set inhibit-early-default-init in early-init.el.

services.ceph enabled the generation of Ceph log files at /var/log/ceph/. They were missing before because Ceph omitted logs when this directory was missing. Ceph logs can grow large, so you may want to configure rotation of these logs.

GCC has been updated from GCC 14 to GCC 15. This introduces some backwards incompatible changes; Refer to the upstream porting guide for details.

glibc has been updated to version 2.42.

This version no longer makes the stack executable when a shared library requires this. A symptom is an error like

This is usually a bug. Please consider reporting it to the software maintainers.

In a lot of cases, the library requires the execstack by mistake only. The following workarounds exist:

Node.js default version has been updated from 22 LTS to 24 LTS. This introduces some breaking changes; Refer to the upstream migration article for details.

Ruby default version has been updated from 3.3 to 3.4. Refer to the upstream release announcement for details.

This will be the last release of Nixpkgs to support x86_64-darwin. Platform support will be maintained and binaries built until Nixpkgs 26.05 goes out of support at the end of 2026. For 26.11, due to Apple’s deprecation of the platform and limited build infrastructure and developer time, we will no longer build packages for x86_64-darwin or support building them from source.

By the time of 26.11’s release, Homebrew will offer only limited Tier 3 support for the platform, but MacPorts will likely continue to support it for a long time. We also recommend users consider installing NixOS, which should continue to run on essentially all Intel Macs, especially after Apple stops security support for macOS 26 in 2028.

A warning will be displayed for x86_64-darwin users; you can set allowDeprecatedx86_64Darwin in the Nixpkgs configuration to silence it. The ~/.config/nixpkgs/config.nix file will not work for users of flakes, who can instead replace nixpkgs.legacyPackages.x86_64-darwin with

import nixpkgs {
  system = "x86_64-darwin";
  config.allowDeprecatedx86_64Darwin = true;
}

nix-darwin users can set nixpkgs.config.allowDeprecatedx86_64Darwin in their system configurations.

The Factor programming language has been updated to Version 0.101 bringing various improvements to UI rendering and HiDPI support as well as support for Unicode 17.0.0. Starting from Version 0.100, the Factor VM is compiled with Clang.

This brings along some backwards compatibility issues in the language further detailed here. Additionally, the FUEL Emacs module is no longer part of the factor-lang package. It is part of the MELPA package set for a while already and must be taken from there. This does not affect factor-lang packages Version 0.99 and 0.100. Using the official MELPA package now puts the burden of providing the path to /lib/factor in factor-root-dir on the user. Make sure to use the extraVocabs package attribute to compose a special vocabulary tree if necessary. You can refer to the generated tree of vocabulary roots via the newly exposed vocabTree attribute, as described in the documentation.

Nixpkgs configuration, specified for NixOS using nixpkgs.config, or using the config argument when importing nixpkgs, has learned to accept a lib argument as well as pkgs, which allows the configuration to be computed without depending on the pkgs fixed point. If you are referencing licenses in lib.licenses by having this configuration be a function taking a pkgs arg, you may wish to change to using lib for faster computation and to avoid infinite recursion errors if pkgs depends on parts of the computed configuration in future.

For example, if you currently have configuration that looks like this:

  { pkgs, ... }:
  {
    allowlistedLicenses = [ pkgs.lib.licenses.nasa13 ];
    blocklistedLicenses = with pkgs.lib.licenses; [ gpl3Only gpl3Plus ];
  }

You may wish to update it to something like this:

  { lib, ... }:
  {
    allowlistedLicenses = [ lib.licenses.nasa13 ];
    blocklistedLicenses = with lib.licenses; [ gpl3Only gpl3Plus ];
  }

Or, if you need configuration that works with both 26.05 and 25.11:

  { pkgs, lib ? pkgs.lib, ... }:
  {
    allowlistedLicenses = [ lib.licenses.nasa13 ];
    blocklistedLicenses = with lib.licenses; [ gpl3Only gpl3Plus ];
  }

mdbook-linkcheck has been removed as it is unmaintained and incompatible with the latest version of mdbook. Users can instead migrate to mdbook-linkcheck2.

The nodePackages package set has been removed entirely from nixpkgs. This package set was created to ease the maintenance burden of maintaining lots of NodeJS-based packages within nixpkgs, but became a burden itself. Over the past several releases, there has been a focus on removing it in favor of the more modern nixpkgs packaging strategies. After a long time, this package set has been deprecated and removed. If you are using its package set in your own config, please use the top-level packages instead.(i.e pkgs.package-name instead of pkgs.nodePackages.package-name).

Note that the above nodePackages removal also coincides with the removal of node2nix and its tooling, which have been deprecated for a long time.

buildEnv-constructed packages now take only structured attributes ({ __structuredAttrs = true; }).

xfce.mkXfceDerivation has been deprecated (i.e. conditioned behind nixpkgs.config.allowAliases) and will be removed in NixOS 26.11, please use stdenv.mkDerivation directly. You can migrate by adding pkg-config, xfce4-dev-tools, and wrapGAppsHook3 to your nativeBuildInputs and --enable-maintainer-mode to your configureFlags.

yarn2nix/yarn2nix-moretea and its tooling(mkYarnPackage, mkYarnModules, and fixup_yarn_lock) have been removed as they were unmaintainable in nixpkgs. If you want to build with Yarn V1 going forward, use the hooks instead(yarnBuildHook, yarnConfigHook, and yarnInstallHook). See the yarn v1 documentation in the nixpkgs manual for more details.

albert has been updated to version 34.0.5. This release redesigns the query system to support stateful asynchronous handlers and infinite scrolling, and adds internationalized tokenization. This update introduces several breaking changes: the Python plugin interface is now v5.0, the PATH plugin has been renamed to Commandline, and the QStylesheets-based widgets box model frontend has been removed. For more information read the changelog for 34.0.0.

asciinema_3 is now renamed to asciinema and the old asciinema version 2.x.x written in python was removed.

sing-box has been updated to 1.13.0, which has removed some deprecated options. See upstream documentation for details and migration options.

cargo-codspeed has been updated from 3.0.5 to 4.2.0. Version 4.0.0 includes breaking changes. For more information read the changelog for 4.0.0.

commafeed has been updated to version 7.0.0, which includes changes impacting its security. Please see upstream’s release notes for details.

corepack_latest has been removed, as Corepack is no longer distributed with Node.js.

spoof has been removed, as there are many issues upstream with it working on modern OS versions, and it appears to be unmaintained.

duckstation package has been removed, as it was requested by upstream and build sources were changed to be incompatible with NixOS.

nodePackages.coc-go and nodePackages.coc-tsserver, along with their vim plugins, have been removed from nixpkgs due to being unmaintained.

nodePackages.wavedrom-cli has been removed, as it was unmaintained within nixpkgs.

MATE packages have been moved to top level (e.g. if you previously added pkgs.mate.caja to environment.systemPackages, you will need to change it to pkgs.caja).

kratos has been updated from 1.3.1 to 25.4.0. Upstream switched to a new versioning scheme (year.major.minor). Notable breaking changes:

pdns has been updated to version v5.0.x, which introduces breaking changes. Check out the Upgrade Notes for details.

geph package’s built-in GUI geph5-client-gui has been removed by the upstream. All users who wish to continue using the GUI should install the gephgui-wry, which is consistent with the official release version.

xfsprogs was updated to version 6.18.0, which enables parent pointers and exchange-range by default. Upstream recommends not to use these features with kernels older than 6.18. GRUB2 is likely unable to boot from filesystems with these features enabled.

lunarvim package has been removed, as it was abandoned upstream and relied on an old version of neovim to work properly.

requireFile now treats any message or url argument as a literal string, rather than subjecting it to Bash here-doc expansion. This allows including strings like $PWD in the message without needing to know about and handle the undocumented Bash expansion.

nodePackages.browserify has been removed, as it was unmaintained within nixpkgs.

command-not-found package will be enabled by default if the source of nixpkgs contains the file programs.sqlite. This is the case if a nixpkgs tarball from https://channels.nixos.org is used. This usage will also make the database of command-not-found stateless.

nodePackages.sass has been removed, as it was unmaintained within nixpkgs.

All @tailwindcss packages in the nodePackages set have been removed, as they are libraries that should instead be locked by JS projects that utilize them.

arti has been updated to major version 2, which removed the long-deprecated proxy.socks_port and proxy.dns_port and the legacy syntax for specifying directory authorities. For more information, see the changelog for 2.0.0.

kanata now requires karabiner-dk version 6.0+ or later. The package has been updated to use the new karabiner-dk package and the darwinDriver output stays at the version defined in the package.

Keycloak has been updated to 26.6.X, bringing a lot of new features like federated client authentication, JWT authorization grants, workflows and the ability to do zero-downtime patch releases. Read more about all the exciting new capabilities in keycloak 26.6 here and consult the migration guide to 26.6 to find out whether this is a breaking change for your keycloak instance.

elegant-sddm has been updated to be Qt6 compatible. Themes for SDDM are slightly different so read the wiki for more.

forgejo-lts has been updated to major version 15. For more information, see the release blog post and full release notes

pulsar has finally migrated from electron v12 to v30, backup ~/.pulsar before upgrading. See Pulsar on Electron 30: what it means for you.

mactracker has been updated to major version 8, which now requires macOS 11 Big Sur or later. The previous version supported Mac OS X 10.6.8 or later.

net-news-wire has been updated from 6.x to 7.x, which now requires macOS 15 (Sequoia) or newer. The previous version supported macOS 13 and newer.

bartender has been updated to major version 6. This removes support for MacOS Sonoma (and adds support for Tahoe). For more information, see the release notes or the Bartender 6 support page.

lima has been updated from 1.x to 2.x. This major update includes several breaking changes, such as /tmp/lima no longer being mounted by default.

Varnish Cache has been updated to major version 8, varnish now refers to varnish80. That release contains breaking changes, see Upgrading to Varnish-Cache 8.0. Note that the Varnish 6 LTS release remains available as varnish60. The Varnish Cache open-source project renamed itself to Vinyl Cache. Please migrate to vinyl-cache. See the vinyl-cache release notes entry for more information. Varnish 8 is not supported for the entire NixOS 26.05 release cycle.

Vinyl Cache has been introduced with the major version 9 as the Varnish Cache open source project renamed itself to Vinyl Cache. Please migrate to Vinyl Cache 9 when you still use Varnish Cache. A new module has also been introduced for this migration: services.vinyl-cache. This release contains breaking changes, see Upgrading to Vinyl Cache 9.0. The varnish-modules project is currently not packaged for Vinyl Cache, as it is incompatible.

eslint has been updated from version 9 to version 10. Please see https://eslint.org/blog/2026/02/eslint-v10.0.0-released/ for details about the breaking changes included in the update.

minio has been abandoned by upstream and security issues won’t be fixed. minio_legacy_fs has also been removed. Both are scheduled for full removal in 26.11. Users should migrate to alternatives such as Garage, SeaweedFS, or Ceph. S3-compatible clients such as rclone can be used to move data.

mercure has been updated to 0.21.4 (or later). Version 0.21.0 and 0.21.2 introduce breaking changes to the package.

mozc and mozc-ut no longer contain the IBus front-end, which is now provided by ibus-engines.mozc and ibus-engines.mozc-ut.

nemorosa has been updated from 0.4.3 to 0.5.0. Version 0.5.0 introduced breaking changes to the package configuration.

n8n has been updated to version 2. You can find the breaking changes here: https://docs.n8n.io/2-0-breaking-changes/.

nomad has been updated to v1.11. Refer to the release note for more details. Once a new Nomad version has started and upgraded its data directory, it generally cannot be downgraded to the previous version.

The default NVIDIA drivers no longer support Maxwell (GTX 1xxx) or older GPUs. Pin the nvidia package to config.boot.kernelPackages.nvidiaPackages.legacy_580 for continued support.

gurk-rs has been updated from 0.6.4 to 0.8.0. Version 0.8.0 includes breaking changes. For more information read the release notes for 0.8.0.

iroh has been removed and split up into iroh-dns-server and iroh-relay.

The xorg package set has been deprecated, packages have moved to the top level.

python3Packages.buildPythonPackage and python3Packages.buildPythonApplication now throw errors in the presence of pytestFlagsArray. Please use pytestFlags and (enabled|disabled)(TestPaths|Tests|TestMarks) instead. If modifying the Nix expression is not feasible, users can remediate the error by overriding pytestFlagsArray with null or [ ].

python3Packages.pygame has been renamed to python3Packages.pygame-original, the attribute python3Packages.pygame will from python 3.14 default to the more actively maintained python3Packages.pygame-ce.

fastly has been updated to major version 14. For more information, you can check the release notes.

peertube has been updated from 7.3.0 to 8.0.2, introducing several breaking changes. Some notable new features include channel collaboration and video player redesign with a new theme. For details on how to upgrade, see the IMPORTANT NOTES section of the v8.0.0 CHANGELOG entry.

python3Packages.gradio has been updated to version 6. See upstream’s migration guide at https://www.gradio.app/main/guides/gradio-6-migration-guide.

python3Packages.pikepdf no longer builds with mupdf support by default, which may be nice in Jupyter and iPython. Build with withMupdf = true if this is required.

olive-editor has been dropped as upstream development ceased and no longer builds.

python3Packages.django-mdeditor has been removed, as it was unmaintained upstream and the latest release was vulnerable to a critical security vulnerability.

vicinae has been updated to v0.20. This includes, among several other breaking changes, a complete overhaul of the configuration system. For update instructions, see the upstream configuration documentation.

percona-server_8_4 has been removed. Please update to percona-server_8_0, mysql84 or mariadb.

The man-pages package’s outputs have been split. The manual pages are installed into the man output, which is installed by default. Binaries (including diffman-git, mansect, pdfman, and sortman) are installed into the out output, which is not installed by default.

All Log4Shell vulnerability scanners were removed, as they were all unmaintained upstream and are no longer relevant given that the vulnerability has been fixed upstream for several years.

Plugins for the JetBrains IDEs have been removed from Nixpkgs.

spacetimedb has been updated from 1.12.0 to 2.0.3. Breaking changes and migration notes from 1.0 to 2.0 can be found here.

jetbrains.plugins.addPlugins no longer supports plugin names or ID strings. You can still use addPlugins with plugin derivations, such as plugins packaged outside of Nixpkgs.

NetBox was updated to >= 4.5.5. Have a look at the breaking changes of the 4.5 release, make the required changes to your database, if needed, then upgrade by setting services.netbox.package = pkgs.netbox_4_5; in your configuration.

pocket-id has been updated to version 2 that contains breaking changes.

asio (standalone version of boost::asio) has been updated from 1.24.0 to 1.36.0. Some breaking changes were introduced between these two versions, and the one affected most was the removal of asio::io_service in favor of asio::io_context in 1.33.0. asio_1_32_0 is retained for packages that have not completed migration. asio_1_10 has been removed as no packages depend on it anymore. asio also no longer propagates boost as it is used independent from boost in most cases.

docker-color-output has been updated from major version 2 to 3. One breaking change is, that they switched to YAML-based configuration files.

dasel has been updated from v2.8.1 to v3. There were significant breaking changes:

Example migration:

stalwart-mail has been renamed to stalwart

Ethercalc and its associated module have been removed, as the package is unmaintained and cannot be installed from source with npm now.

coreth has been removed, as upstream has moved it into avalanchego.

nodePackages.prebuild-install was removed because it appeared to be unmaintained upstream. See upstream’s recommendations for alternatives.

davis made changes to the IMAP_AUTH_URL option. The flags are now standalone parameters that you need to fill:

python3Packages.pillow-avif-plugin has been removed as the functionality is included in python3Packages.pillow directly since version 11.3.

wasistlos (previously known as whatsapp-for-linux) has been removed because it was unmaintained and archived upstream. Multiple alternatives exist: karere, whatsie and zapzap among others.

light has been removed because it was unmaintained. brightnessctl and acpilight provide similar functionality.

opensmtpd-filter-dkimsign is now installed into libexec/smtpd instead of libexec/opensmtpd so that now it is properly linked into the environment built by services.opensmtpd.procPackages. If you hardcoded path to filter-dkimsign please consider using this option.

shisho has been removed because it’s archived. semgrep, opengrep, and ast-grep provide similar functionality.

All Xfce packages have been moved to top level (e.g. if you previously added pkgs.xfce.xfce4-whiskermenu-plugin to environment.systemPackages, you will need to change it to pkgs.xfce4-whiskermenu-plugin). The xfce scope will be removed in NixOS 26.11.

The Dovecot IMAP server has been updated to version 2.4, with the dovecot attribute now referring to this backwards-incompatible version. The attribute dovecot_2_3 refers to the previous version. The Pigeonhole plugin has been similarly updated to 2.4, with the version compatible with Dovecot 2.3 being at dovecot_pigeonhole_0_5. See https://doc.dovecot.org/latest/installation/upgrade/2.3-to-2.4.html for more information on how to upgrade.

spacefm was removed because it appeared to be unmaintained upstream.

neofetch has been removed because it was unmaintained upstream. Consider using the updated fork neowofetch provided by the hyfetch package or the alternative fastfetch instead.

vimPlugins.nvim-treesitter has been updated to main branch, which is a full and incompatible rewrite. If you can’t or don’t want to update, you should use vimPlugins.nvim-treesitter-legacy.

Package jellyseerr has been renamed to seerr following the upstream rename.

The pie hardening flag has been removed and will now error, after being deprecated in 25.11. Compilers are expected to enable PIE by default, as has been common practice since 2016 outside of Nixpkgs. If a package needs pie disabled pass -no-pie in CFLAGS. It is unlikely this will be necessary in many cases; due to the prevalence of default PIE toolchains, most packages incompatible with PIE already pass -no-pie.

pqos-wrapper was removed as it has been unmaintained since 2022 and not widely used.

nvidia-x11 proprietary kernel modules are now provided separately as nvidia_x11.mod, while nvidia_x11.open remains the open-source kernel module package.

linuxPackages.nvidiaPackages now follows NVIDIA’s official release branches by exposing production, new_feature, and beta. The convenience aliases latest (newer of production and new_feature) and bleeding_edge (newer of latest and beta) are provided; note that beta now refers strictly to the beta branch.

stestrCheckHook was added: This test hook runs stestr run. You can disable tests with disabledTests and disabledTestsRegex.

balatro now supports the Google Play and Xbox PC versions of the game. Pass the apk or Assets.zip as balatro.override { src = "…" }.

uptime-kuma has been updated to v2, which requires an automated migration that can take a few hours. A backup is highly recommended. If your SQLite database is corrupted, the migration might fail and require manual intervention. See the migration guide for more information.

incus-lts has been updated from v6 to v7

The libcxxhardeningextensive hardening flag has been disabled by default. Enabling it by default in 25.11 was unintentional and may have had a negative effect on performance in some cases. libcxxhardeningfast remains enabled by default.

Wine has been updated to the 11.0 branch. Please check the upstream announcement for more details.

Cinnamon has been updated to 6.6, please check the upstream announcement for more details.

rspamd has been updated to 4.0. Please check the upstream migration documentation, especially if you run a sharded Redis deployment.

hyphen now supports over 40 language variants through hyphenDicts and now allows to enable all supported languages through hyphenDicts.all.

budgie has been updated to 10.10, please check the upstream announcement for more details.

The packages ibtool, actool and re-plistbuddy have been added, providing reimplementations of the corresponding proprietary Apple tools. They are more compatible with the originals than the previously existing xcbuild package, and should enable more darwin software to be built from source.

GNU Taler has been updated to version 1.3. This release focuses on getting everything ready for a deployment of GNU Taler by Magnet bank. For more details, see the upstream release notes.

collabora-desktop The desktop version of Collabora Office is now available, package version 25.05.9.2-2.

The services.geoserver NixOS module has been added to allow running Geoserver as a service.

fetchPnpmDeps and pnpmConfigHook were added as top-level attributes, replacing the now deprecated pnpm.fetchDeps and pnpm.configHook attributes.

fetchPnpmDeps’ fetcherVersion = 1 and fetcherVersion = 2 are deprecated and scheduled for removal in the 26.11 release. A deprecation warning has been added. Packages still on fetcherVersion = 1 or fetcherVersion = 2 should migrate to fetcherVersion = 3 and regenerate their hashes. See the pnpm fetcherVersion section of the manual for details.

buildNpmPackage now supports npmDepsFetcherVersion (and fetchNpmDeps now supports fetcherVersion). Set to 2 to enable packument caching, which fixes builds for projects using npm workspaces.

Added dell-bios-fan-control package and service.

Added lovr package, a Lua-based game engine for VR and XR applications.

Updated wsjtx from 2.7.0 to 3.0.0 for amateur radio hobbyists who use FT8 and other related digital modes. See the release notes for the changelog.

openrgb was updated to 1.0rc2, which now uses Plugin API version 4. Some existing OpenRGB plugins may be incompatible or require updates.

wrapNeovimUnstable now sets provider-related configuration in its generated config rather than as wrapper arguments. It should not affect configuration unless you set wrapRc to false or are using the legacyWrapper.

Neovim Lua dependencies are now set in the generated init.lua instead of modifying LUA_PATH in the wrapper. Commands run pre-vimrc via nvim --cmd "require'LUA_MODULE'" may not find their lua dependencies anymore. Use nvim -c "lua require'LUA_MODULE'" instead to run these commands after loading init.lua. If you use wrapNeovim with wrapRc set to false, you may lose the lua dependencies if you are not loading the generated init.lua.

We now use the upstream wrapper script for Gradle, supporting both the JAVA_HOME and GRADLE_OPTS environment variables.

Updated gonic to 0.21.0. A full (“slow”) scan is recommended after upgrading to v0.21.0 to pick up the newly scanned fields (contributors, ISRCs, record labels, per-track years, ARTIST_CREDIT).

Added haskell.packages.microhs, a set of Haskell packages built with MicroHs.

gnuradio: Overriding the .pkgs package set is now possible with a packageOverrides function, like with python.pkgs and other language-specific package sets. Example:

The initial work to support native compilation on LoongArch64 has completed, with further changes currently in preparation. In accordance with the Software Development and Build Convention for LoongArch Architectures, this release sets the default march level to la64v1.0, covering the desktop and server processors of 3X5000 and newer series. However, embedded chips without LSX (Loongson SIMD eXtension), such as 2K0300 SoC, are not supported. pkgsCross.loongarch64-linux-embedded can be used to build software and systems for these platforms.

The official Nix formatter nixfmt is now stable and available as pkgs.nixfmt, deprecating the temporary pkgs.nixfmt-rfc-style attribute. The classic nixfmt will stay available for some more time as pkgs.nixfmt-classic.

The default GHC version has been updated from 9.8 to 9.10. haskellPackages correspondingly uses Stackage LTS 24 (instead of LTS 23) as a baseline.

This release of Nixpkgs requires macOS Sonoma 14.0 or newer, as announced in the 25.05 release notes. The default SDK is now 14.4, but the minimum version is 14.0. cc-wrapper will enforce that availability annotations are used or an appropriate deployment target is set. See the Darwin platform notes for details.

We expect to drop support for x86_64-darwin by Nixpkgs 26.11, in light of Apple’s announcement that macOS 26 will be the final version to support Intel Macs. When support is fully removed, we will no longer build packages for the platform or guarantee that it can build at all. This may happen in stages, depending on our available build and maintenance resources and decisions made by projects we rely on.

By the time of 26.11’s release, Homebrew will offer only limited Tier 3 support for the platform, but MacPorts will likely continue to support it for a long time. We also recommend users consider installing NixOS, which should continue to run on essentially all Intel Macs, especially after Apple stops security support for macOS 26 in 2028.

Darwin has switched to using the system libc++. This was done for improved compatibility and to avoid ODR violations. If a newer C++ library feature is not available on the default deployment target, you will need to increase the deployment target. See the Darwin platform documentation for more details.

LLVM has been updated from 19 to 21.

adminneo has been updated to version 5.1.1. Version 5 breaks compatibility with adminer and changes how plugins and configuration work. See the Upgrade Guide for details. Those changes also led to changes in the arguments of the package.

android-udev-rules has been removed, as it is effectively superseded by built-in uaccess rules in systemd.

ansible-later has been removed because it was discontinued by the author.

asciidoctor-with-extension had its asciidoctor-mathematical extension removed, because it fails to build, and it is not maintained properly.

base16-builder node package has been removed due to lack of upstream maintenance.

budgie-desktop has been updated to 10.9.4. This changes XDG_CURRENT_DESKTOP from Budgie:GNOME to Budgie and contains ABI bumps for libpeas2 migration.

buildGoModule removes the compatibility layer of CGO_ENABLED not specified via env. Specifying CGO_ENABLED directly now results in an error.

buildGoModule now warns if <pkg>.passthru.overrideModAttrs is lost during the overriding of its result packages.

cardboard has been removed due to the package having been broken since at least November 2024.

carla no longer supports gtk2 override.

chatgpt-retrieval-plugin has been removed due to the package having been broken since at least November 2024.

conduwuit was removed due to upstream ceasing development and deleting their repository. For existing data, a migration to matrix-conduit, matrix-continuwuity or matrix-tuwunel may be possible.

conftest since 0.60.0 has moved to use rego v1 as default. To continue using v0 use --rego-version v0. For more information about upgrading to Rego v1 syntax, see the upstream docs.

CUDA versions below 12.6 have been removed, as they are unmaintained upstream and depend on end‐of‐life compilers.

cudaPackages.cudatoolkit-legacy-runfile has been removed.

ddccontrol service now enables hardware.i2c by default, and adds ddcci_backlight to the kernel modules, based on experiences reported on discourse.

deadbeef no longer supports gtk2.

Derivations setting both separateDebugInfo and one of allowedReferences, allowedRequisites, disallowedReferences or disallowedRequisites must now set __structuredAttrs to true. The effect of reference whitelisting or blacklisting will be disabled on the debug output created by separateDebugInfo.

emacs-macport has been moved to a fork of Mitsuharu Yamamoto’s patched source code starting with Emacs v30 as the original project seems to be currently dormant. All older versions of this package have been dropped. This introduces some backwards‐incompatible changes; see the NEWS for details. NEWS can be viewed from Emacs by typing C-h n, or by clicking Help->Emacs News from the menu bar. It can also be browsed online.

Everything related to bower was removed, as it is deprecated and not used by anything in nixpkgs.

fetchFromBitBucket has gained a fetchgit backend when passing in git-related arguments similar to fetchFromGitHub.

fetchtorrent, when using the “rqbit” backend, erroneously started fetching files into a subdirectory in Nixpkgs 24.11. The original behaviour – which matches the behaviour using the “transmission” backend – has now been restored. Users reliant on the erroneous behaviour can temporarily maintain it by adding flatten = false to the fetchtorrent arguments; Nix will produce an evaluation warning for anyone using backend = "rqbit" without flatten = true.

floorp has been replaced with a binary build, available as floorp-bin. Due to major changes in the upstream project structure and build system, building Floorp from source has become unfeasible. No configuration or state migration is necessary.

forgejo main program has been renamed to bin/forgejo from the previous bin/gitea.

GCC 9, 10, 11, and 12 have been removed, as they have reached end‐of‐life upstream and are no longer supported.

gentium package now provides Gentium-*.ttf files, and not GentiumPlus-*.ttf files like before. The font identifiers Gentium Plus* are available in the gentium-plus package. If you want to use the more recently updated package gentium by SIL, you should update your configuration files to use the Gentium font identifier.

GHCJS 8.10, exposed via haskell.compiler.ghcjs and haskell.compiler.ghcjs810, has been removed. Downstream users should migrate their projects to the new JavaScript backend of GHC proper which can be used via pkgsCross.ghcjs from Nixpkgs. Haskell packaging code, like haskellPackages.mkDerivation, ghcWithPackages and hoogleWithPackages, also no longer supports GHCJS.

GHC 8.6, 8.10, 9.0, 9.2, and their package sets have been removed.

gnome-keyring no longer ships with an SSH agent anymore because it has been deprecated upstream. You should use gcr_4 instead, which provides the same features. More information on why this was done can be found on the relevant GCR upstream PR.

go-mockery has been updated to v3. For migration instructions see the upstream documentation. If v2 is still required go-mockery_v2 has been added but will be removed on or before 2029-12-31 in-line with its upstream support lifecycle.

gradience has been removed because it was archived upstream.

Greetd and its original greeters (tuigreet, gtkgreet, qtgreet, regreet, wlgreet) were moved from greetd namespace to top level (greetd.tuigreet -> tuigreet, greetd.greetd -> greetd, etc). The original attrs are available for compatibility as passthrus of greetd, but will emit a warning. They will be removed in future releases.

haskellPackages and the package sets under haskell.packages no longer expose an llvmPackages attribute, though it can still be accessed via ghc.llvmPackages (from the same package set). Haskell packages usually only need to depend on an LLVM version matching GHC if they force the use the LLVM backend even if NCG is available. In this case, it is best to use the forceLlvmCodegenBackend helper. In all other cases, like linking against libLLVM, Haskell packages should use the appropriate version of llvmPackages from pkgs.

hiawata has been removed, due to lack of active development upstream, lack of maintainership downstream and upcoming security issues.

hsd has been upgraded to version 8. See their changelog for important instructions before upgrading.

inspircd has been updated to the v4 release series. Please refer to the upstream documentation for general information and a list of breaking changes.

installShellFiles now allows installManPage to take a piped input, add the --name flag for renaming the file when installed. You can also append -- to opt-out of all subsequent parsing.

kbd package’s outputs now include a man and scripts outputs. The unicode_start and unicode_stop Bash scripts are now part of the scripts output, allowing most usages of the kbd package to not pull in bash.

k2pdfopt has been removed, as it’s broken.

k3s airgap images passthru attributes have changed:

LLVM 12, 13, 14, 15, 16, and 17 have been removed, as they have reached end‐of‐life upstream and are no longer supported.

lima package now only includes the guest agent for the host’s architecture by default. If your guest VM’s architecture differs from your Lima host’s, you’ll need to enable the lima-additional-guestagents package by setting withAdditionalGuestAgents = true when overriding lima with this input.

libpinyin, which is used for Chinese character input, has migrated from the unmaintained BDB database format to the newer KyotoCabinet database format. If you want to migrate your user input statistics, you can consider using bdbtokyotodb.

linux and all other Linux kernel packages have moved all in-tree kernel modules into a new modules output.

lxde scope has been removed, and its packages have been moved to the top-level.

mariadb now defaults to mariadb_114 instead of mariadb_1011, meaning the default version was upgraded from 10.11.x to 11.4.x. See the upgrade notes for potential issues.

mealie has been updated to 3.0.2: This update introduces breaking changes in some API endpoints (see the release changelog).

meilisearch_1_11 has been removed, as it is no longer supported.

moar has been updated from 1.33.0 to 2.0.0, and renamed to moor following an upstream decision. See the release notes for more.

mongodb-6_0 was removed as it is end of life as of 2025-07-31.

mono4 and mono5 have been removed. Use mono6 or mono instead.

mx-puppet-discord was removed from Nixpkgs along with its NixOS module as it was unmaintained and was the only user of sha1 hashes in tree.

navidrome 0.58.0 introduces multi-library support and backwards incompatible database migrations. Ensure backups are valid and run a Full Scan after starting the new version.

NetBox was updated to >= 4.4.0. You should review the breaking changes of the 4.3 release the 4.4 release, make the required changes to your database (if needed), and then upgrade by setting services.netbox.package = pkgs.netbox_4_4; in your configuration.

neovimUtils.makeNeovimConfig now uses customLuaRC parameter instead of accepting luaRcContent. The old usage is deprecated but still works with a warning.

nixVersions.nix_2_3 has been dropped because it was insecure and unmaintained.

nodePackages.rimraf has been removed, as it is a Javascript library, and packages that want to use it should depend directly on it instead.

notary has been removed because it was archived upstream. Upstream recommends notation instead.

nuget-to-nix has been removed as it was deprecated in favor of nuget-to-json. Out-of-tree packages that were using nuget-to-nix should migrate to use nuget-to-json instead for generating .NET dependency lock files.

odoo16 has been dropped due to end of support by upstream, consider upgrading supported version.

oink service no longer accepts settings.apiKey and settings.secretApiKey options as these have been replaced by apiKeyFile and secretApiKeyFile.

opensoldat binaries and user configuration directory names have been prefixed by ‘open’, becoming opensoldat and opensoldatserver. Configuration will be moved automatically before launch when possible.

orjail package has been removed as it is broken by the latest firejail release and seems unmaintained.

python3Packages.bugwarrior has been updated to major version 2.0.0 which will likely require manual intervention. See release notes.

pcp has been removed because the upstream repo was archived and it hasn’t been updated since 2021.

podofo has been updated from 0.9.8 to 1.0.0. These releases are by nature very incompatible due to major API changes. The legacy versions can be found under podofo_0_10 and podofo_0_9. Changelog: https://github.com/podofo/podofo/blob/1.0.0/CHANGELOG.md, API-Migration-Guide: https://github.com/podofo/podofo/blob/1.0.0/API-MIGRATION.md.

privatebin has been updated to 2.0.0. This release changes configuration defaults including switching the template and removing legacy features. See the v2.0.0 changelog entry for details on how to upgrade.

private-gpt service has been removed by lack of maintenance upstream.

proton-caller has been removed due to lack of upstream maintenance.

prometheus-script-exporter has been updated to use a new maintained alternative. This release updates from 1.2.0 -> 3.0.1 and largely changes configuration options formats from json to yaml, among other changes.

pulsemeeter has been updated to 2.0.0. The configuration file from older versions has to be deleted. For more information and instructions see the v2.0.0 changelog entry.

purple-matrix has been removed, since it has been unmaintained since April 2022 and upstream does not recommend using it anymore.

python3Full and its versioned attributes (python3xxFull) have been removed. Bluetooth support is now enabled in the default python3 attributes. The X11 support built the tkinter module, which is available as a dedicated attribute on the package set.

python3Packages.bjoern has been removed, as the upstream is unmaintained and it depends on a 14-year-old version of http-parser with numerous vulnerabilities.

python3Packages.duckduckgo-search has been updated to v9+ and renamed to python3Packages.ddgs. See release note for v9.0.0.

python3Packages.heif-image-plugin has been dropped due to lack of upstream maintenance and breakage. Use python3Packages.pillow-heif instead.

python3Packages.triton no longer takes an enableRocm argument and supports ROCm in all build configurations via runtime binding. In most cases no action will be needed. If triton is unable to find the HIP SDK add rocmPackages.clr as a build input or set the environment variable HIP_PATH="${rocmPackages.clr}".

python3Packages.pyheif has been dropped due to lack of upstream maintenance and breakage. Use python3Packages.pillow-heif instead.

python3Packages.pyocr no longer supports cuneiform on Linux by default. It is still possible to enable it using withCuneiformSupport override.

qt5.full and qt6.full aliases have been removed. Their use has always been discouraged, and downstream projects should use qtN.env with the right set of packages.

rabbitmq-server has been updated from 4.0.9 to 4.1.4. The 4.1.0 release includes breaking changes. For more information read the changelog of 4.1.0.

reaction has been updated to version 2, which includes some breaking changes. For more information, check the release article.

renovate was updated to v41. See the upstream release notes for v40 and v41 for breaking changes.

river 0.3.x has been renamed to river-classic following an upstream decision.

rocmPackages.triton has been removed in favor of python3Packages.triton.

rofi has been updated to 2.0.0. rofi-wayland and rofi-wayland-unwrapped have been merged into rofi and rofi-unwrapped respectively. For more information and instructions see the v2.0.0 changelog entry.

rofi-emoji-wayland has been merged into rofi-emoji as rofi has been updated to 2.0.0 and supports both X11 & Wayland.

sail-riscv 0.8 follows upstream and provides only a single binary, sail_riscv_sim.

sing-box has been updated to 1.12.3, which includes a number of breaking changes, old configurations may need updating or they will cause the tool to fail to run. See the change log for details and migration for how to update old configurations.

space-orbit package has been removed due to lack of upstream maintenance. Debian upstream stopped tracking it in 2011.

spidermonkey_91 has been removed, as it has been EOL since September 2022.

stalwart-mail since 0.13.0 “introduces a significant redesign of the MTA’s delivery and queueing subsystem”. See the upgrading announcement for the 0.13.0 release.

stdenv.mkDerivation and other derivation builders that use it no longer allow the value of env to be anything but an attribute set, for the purpose of setting environment variables that are available to the builder process. An environment variable called env can still be provided by means of mkDerivation { env.env = ...; }, though we recommend to use a more specific name than “env”.

steamcontroller has been removed due to lack of upstream maintenance. Consider using sc-controller instead.

sublime-music has been removed because upstream has announced it is no longer maintained. Upstream suggests using supersonic instead.

Support for bootstrapping native GHC compilers on 32‐bit ARM and little‐endian 64-bit PowerPC has been dropped. The latter was probably broken anyway. If there is interest in restoring support for these architectures, it should be possible to cross‐compile a bootstrap GHC binary.

telegram-desktop packages now uses Telegram for its binary. The previous name was telegram-desktop. This is due to an upstream decision to make the name consistent with other platforms.

teleport has been upgraded from major version 17 to major version 18. Refer to upstream upgrade instructions and release notes for v18.

The asterisk-lts package was changed to v22 from v18. The default asterisk package was changed to v22 from v20. Asterisk version 18 has been dropped due to being EOL. The asterisk-stable (v20) package was unchanged. You may need to update /var/lib/asterisk to match the template files in ${asterisk-...}/var/lib/asterisk.

The archipelago-minecraft package was removed, as upstream no longer provides support for the Minecraft APWorld.

The default Android NDK version has been raised to 27, and the default SDK version to 35. NDK 21–26 have been removed, as they are end‐of‐life.

The default glibc ELF ABI for the powerpc64-linux platform has been changed from ELFv2 back to ELFv1, due to the latter having less remaining issues when bootstrapping & building Nixpkgs packages on hardware. If glibc ELFv2 is desired, use a fuller target triplet like powerpc64-unknown-linux-gnuabielfv2 or the provided ppc64-elfv2 platform example.

The ghcInfo and controlPhases functions have been removed from haskell.lib.compose and haskell.lib. They were unused and would return incorrect results.

The haskellPackages.mkDerivation builder now converts packages’ cabal files to Unix line endings before patchPhase. This behavior can be disabled using dontConvertCabalFileToUnix.

The default kops version is now 1.33.0 and versions 1.30 and older have been dropped. See Upgrading Kubernetes for instructions on how to update kOps.

The license of duckstation has changed from gpl3Only to cc-by-nc-nd-40 making it unfree in newer releases. The duckstation package has been overhauled to support the new releases and duckstation-bin has been aliased to duckstation to support darwin binary builds.

The main binary of tomlq has been renamed from tomlq to tq.

The minimum version of Nix required to evaluate Nixpkgs has been raised from 2.3 to 2.18.

The no-broken-symlink build hook now also fails builds whose output derivation contains links to $TMPDIR (typically /build, which contains the build directory).

The non-LTS Forgejo package (forgejo) has been updated to 12.0.0. This release contains breaking changes, see the release blog post for all the details and how to ensure smooth upgrades.

The offrss package was removed due to lack of upstream maintenance since 2012. It’s recommended for users to migrate to another RSS reader.

The pie hardening flag has been removed. Compilers are expected to enable PIE by default, as has been common practice since 2016 outside of Nixpkgs. If a package needs pie disabled pass -no-pie in CFLAGS. It is unlikely this will be necessary in many cases; due to the prevalence of default PIE toolchains, most packages incompatible with PIE already pass -no-pie.

The vlock output from kbd has been removed. Instead a new package kbdVlock has been introduced. Use this package now instead of the output.

tooling-language-server has been renamed to deputy (both the package and binary), following the rename of the upstream project.

victoriametrics no longer contains VictoriaLogs components. These have been separated into the new package victorialogs.

vmware-horizon-client was renamed to omnissa-horizon-client, following VMware’s sale of their end-user business to Omnissa. The binary has been renamed from vmware-view to horizon-client.

uw-ttyp0 has been updated to version 2.1. The filenames of the OTB and PSF fonts have been changed to match the upstream naming convention. If you were loading a font by path, for example in the console.font NixOS option, remember to update the filename accordingly.

wayclip now uses the ext-data-control-v1 Wayland protocol instead of wlr-data-control-unstable-v1.

webfontkitgenerator has been renamed to webfont-bundler, following the rename of the upstream project. The binary name remains webfontkitgenerator. The webfontkitgenerator package is an alias to webfont-bundler.

webkitgtk_4_0 has been removed because it depends on an unmaintained version of security-critical libsoup library (libsoup_2) and the support will be dropped upstream soon.

yehawn was removed due to the package being broken and unmaintained upstream.

yggdrasil-jumper has been updated to v0.4, changing traversal protocol. See release notes.

zig_0_12 has been removed.

zigbee2mqtt was updated to version 2.x, which contains breaking changes. See the discussion for further information.

buildEnv now takes fixed-point arguments (finalAttrs: { }). The custom overrider <env-pkg>.override is deprecated but kept in this release. It will be removed in future releases after tree-wide transition. The argument paths is passed as passthru.paths to avoid bringing in unexpected context.

buildEnv now takes derivationArgs for additional arguments to pass to stdenv.mkDerivation. A compatibility layer is added for directly-specified arguments nativeBuildInputs and buildInputs.

Added rewriteURL attribute to the nixpkgs config, to allow for rewriting the URLs downloaded by fetchurl.

Added hashedMirrors attribute to the nixpkgs config, to allow for customization of the hashed mirrors used by fetchurl.

Added gitConfig and gitConfigFile option to the nixpkgs config, to allow for setting a default gitConfigFile for all fetchgit invocations.

Added npmRegistryOverrides and npmRegistryOverridesString option to the nixpkgs config, to allow for setting a default npmRegistryOverridesString for all fetchNpmDeps invocations.

buildPythonPackage and buildPythonApplication now default to nix-update-script as their default updateScript. This should improve automated updates, since nix-update is better maintained than the in-tree update script and has more robust fetcher support.

cloudflare-ddns has been added.

Direct use of pkgs.formats.systemd has been deprecated, and should now be instantiated with pkgs.formats.systemd { } similarly to other items in pkgs.formats.

dragonflydb has been updated from version 0.1.0 to version 1.34.2.

emacs now disables the GC mark trace buffer by default. This improves GC performance by 5%, but can make GC issues harder to debug. This is configurable with withGcMarkTrace.

etcd package was upgraded to 3.6, see migration notes for incompatibilities and upgrade procedure.

fetchgit now accepts a gitConfigFile argument to set a git config (via $GIT_CONFIG_GLOBAL) for the fetcher.

fetchgit now accepts a rootDir argument to limit the resulting source to one subdirectory of the whole Git repository. Corresponding --root-dir option added to nix-prefetch-git.

fetchNpmDeps now accepts a npmRegistryOverridesString argument to pass npm registry overrides to the fetcher.

ffmpeg_8, ffmpeg_8-headless, and ffmpeg_8-full have been added. The default version of FFmpeg is now ffmpeg_8. You can install previous versions from package attributes such as ffmpeg_7.

forgejo-runner has been upgraded to version 11, which brings a license change from MIT to GPLv3-or-later.

GIMP now defaults to version 3. Use gimp2 for the old version.

gitversion was updated to 6.3.0, which includes a number of breaking changes, old configurations may need updating or they will cause the tool to fail to run. See the 6.0.0 release notes for GitVersion for details on the breaking changes, the documentation on the configuration format for the new configuration specification, and the documentation on version variables for what is now supported.

gramps has been updated to 6.0.0 Upstream recommends backing up your Family Trees before upgrading.

homebox 0.20.0 changed how assets are stored and hashed. It is recommended to back up your database before this update. In particular, --storage-data was replaced with --storage-conn-string and --storage-prefix-path. If your configuration set HBOX_STORAGE_DATA manually, you must migrate it to HBOX_STORAGE_CONN_STRING and HBOX_STORAGE_PREFIX_PATH.

HTTP3 support has been enabled in in nginx, openresty, angie and tengine. The nginxQuic and angieQuic package flavors have been removed.

idris2 supports being instantiated with a package environment with idris.withPackages (p: [ ]).

installShellCompletion now supports Nushell completion files.

jellyfin was updated to 10.11.x, which includes heavy backend changes. Make sure to backup your data and configuration directories and read the Jellyfin 10.11.0 release announcement. Important: make sure you’re running Jellyfin version 10.10.7 before upgrading, and beware that the migration may take several hours depending on your library size and state. The process must not be interrupted.

lisp-modules were brought in sync with the June 2025 Quicklisp release.

meta.mainProgram is now used to determine the NIX_MAIN_PROGRAM environment variable. This means that changing it can now lead to a package rebuild.

neovim now has support for the vim.o.exrc option, the VIMINIT environment variable, and sourcing of sysinit.vim. See the neovim help page :help startup for more information, as well as the nixpkgs neovim wrapper documentation.

New hardening flags strictflexarrays1, strictflexarrays3, glibcxxassertions, libcxxhardeningfast and libcxxhardeningextensive were made available.

nix-prefetch-git now has a --no-add-path argument to disable adding the path to the store. This is useful when working with a read-only store.

Passing stdenv to buildPythonPackage or buildPythonApplication has been deprecated and will trigger an error in a future release. Instead, you should override the python build helper, e.g., (buildPythonPackage.override { stdenv = customStdenv; }). See the section called “Overriding build helpers”.

php81 was removed.

plasma6: Fixed the ksycoca cache not being re-built when $XDG_CACHE_HOME is set to something that isn’t $HOME/.cache.

prl-tools has been moved out of linuxPackages because Parallels Guest Tools become driverless since 26.1.0.

sftpman has been updated to version 2, a rewrite in Rust which is mostly backward compatible but does include some changes to the CLI. For more information, check the project’s README.

slurm no longer supports gtk2.

sparkleshare has been removed as it no longer builds and has been abandoned upstream.

strongSwan has been updated to 6.0. See strongSwan 6.0.0 release notes for a complete list of changes.

simplesamlphp has been removed since the package was severely outdated, unmaintained in Nixpkgs and having known vulnerabilities.

The clickhouse package now track the stable upstream version per upstream’s recommendation. Users can continue to use the clickhouse-lts package if desired.

The debug outputs produced by separateDebugInfo = true; now contain symlinks mapping build-ids to the original source and ELF file. Specifically, if $out/bin/ninja has build-id 483bd7f7229bdb06462222e1e353e4f37e15c293, then

The dockerTools.streamLayeredImage builder now uses a better algorithm for generating layered docker images, such that much more sharing is possible when the number of store paths exceeds the layer limit. It gives each of the largest store paths its own layer and adds dependencies to those layers when they aren’t used elsewhere.

The open-webui package’s postgres support has been moved to optional dependencies to comply with upstream changes in 0.6.26.

The systemd initrd will now respect x-systemd.wants and x-systemd.requires for reliably unlocking multi-disk bcachefs volumes.

The third-party ant-contrib is no longer included in the ant package.

Packages using versionCheckHook that previously relied solely on pname to locate the program used to version check, but have a differing meta.mainProgram entry, might now fail.

waydroid-nftables is a new variant of waydroid that supports nftables instead of iptables.

searx was updated to use envsubst instead of sed for parsing secrets from environment variables. If your previous configuration included a secret reference like server.secret_key = "@SEARX_SECRET_KEY@", you must migrate to the new envsubst syntax: server.secret_key = "$SEARX_SECRET_KEY".

This release of Nixpkgs requires macOS Big Sur 11.3 or newer, as announced in the 24.11 release notes. We cannot guarantee that packages will continue to work on older versions of macOS. Future Nixpkgs releases will only support macOS versions supported by Apple; this means that Nixpkgs 25.11 will require macOS Sonoma 14 or newer. Users on old macOS versions should consider upgrading to a supported version (potentially using OpenCore Legacy Patcher for old hardware) or installing NixOS. If neither of those options are viable and you require new versions of software, MacPorts supports versions back to Mac OS X Snow Leopard 10.6.

The default kernel package has been updated from 6.6 to 6.12. All supported kernels remain available.

GCC has been updated from GCC 13 to GCC 14. This introduces some backwards‐incompatible changes; see the upstream porting guide for details.

The default GHC version has been updated from 9.6 to 9.8. haskellPackages also uses Stackage LTS 23 (instead of LTS 22) as a baseline. We aim to remove the old GHC versions 8.10, 9.0 and 9.2 in the next release in accordance with the new GHC deprecation policy.

LLVM has been updated from LLVM 16 (on Darwin) and LLVM 18 (on other platforms) to LLVM 19. This introduces some backwards‐incompatible changes; see the upstream release notes for details.

The Factor programming language packages were reworked. factor-lang-scope is now named factorPackages and provides a buildFactorApplication function to deploy Factor programs as binaries. It has also received proper documentation in the Nixpkgs manual.

The packaging of Mesa graphics drivers has been significantly reworked, in particular:

GNU Taler has been updated to version 1.0. This marks a significant milestone as the GNU Taler payment system is now available in Swiss Francs for individuals and businesses in Switzerland. For more details, see the upstream release notes.

OpenSSH has been updated from 9.9p2 to 10.0p2, dropping support for DSA keys and adding a new ssh-auth binary to handle user authentication in a different address space from unauthenticated sessions. See the full changelog for more details.

Emacs has been updated to 30.1. This introduces some backwards‐incompatible changes; see the NEWS for details. NEWS can be viewed from Emacs by typing C-h n, or by clicking Help->Emacs News from the menu bar. It can also be browsed online.

The intel video driver for X.org (from the xf86-video-intel package, which was previously removed because it was non-functional) has been fixed and the driver has been re-introduced.

The default openexr version has been updated to 3.2.4.

The default PHP version has been updated to 8.4.

The default Erlang OTP version has been updated to 27.

The default Elixir version has been updated to 1.18.

apptainer and singularity deprecate the workaround of overriding vendorHash and related attributes via <pkg>.override, in favour of the unified overriding of the same group of attributes via <pkg>.overrideAttrs. The compatibility layer will be removed in future releases.

squid has been updated to version 7, this release includes multiple breaking changes, like ESI removal. For more information, check the release notes.

postgresql and libpq don’t provide pg_config by default anymore. Instead, pg_config is available via postgresql.pg_config or libpq.pg_config. This allowed implementing it as a shell script, which can be built for both the build and host systems when cross-compiling. If your build fails to find pg_config, add postgresql.pg_config or libpq.pg_config to nativeBuildInputs.

postgresql_13 has been removed since it reached its end of life.

The no-broken-symlinks hook was added to catch builds containing dangling or reflexive symlinks, as these are indicative of problems with packaging. The hook can be disabled by providing dontCheckForBrokenSymlinks = true; as an argument to mkDerivation. For more information, check the docs or see this PR.

gkraken has been removed. The recommended alternative is coolercontrol.

opensmtpd-extras has been deprecated by upstream and is not compatible with OpenSMTPD 7.6.0 or later. The package has been removed in favor of a set of new opensmtpd-table-* packages.

postsrsd upgraded to >= 2.0.0, with some different behaviors and configuration settings. Notably, it now defaults to listening on a socket rather than a port. See Migrating from version 1.x and Postfix Setup for details.

renovate was updated to v39. See the upstream release notes for breaking changes. Like upstream’s Docker images, renovate now runs on NodeJS 22.

The handwritten perlPackages.SearchXapian bindings have been dropped in favor of the (mostly compatible) perlPackages.Xapian.

varnish was updated from 7.5.0 to 7.7.0, see Varnish 7.6.0 upgrade guide and Varnish 7.7.0 upgrade guide.

The config triple for aarch64-darwin has been changed from aarch64-apple-darwin to arm64-apple-darwin to match the Apple toolchain and LLVM’s expectations.

The electron packages will now provide their headers (available via electron.headers) in extracted form instead of in a tarball.

The udev rules of the libjaylink package require users to be in the jlink instead of plugdev group now, since the plugdev group is very uncommon for NixOS. Alternatively, access is granted to seat sessions.

The ephemeral package was removed due to upstream archival in early 2022.

The gotenberg package has been updated to 8.16.0, which brings breaking changes to the configuration from version 8.13.0. See the upstream release notes for that release to get all the details.

zammad has had its support for MySQL removed, since it was never working correctly and is now deprecated upstream. Check the migration guide for how to convert your database to PostgreSQL.

The vocal package was removed due to upstream archival. The upstream developer suggests using gnome-podcasts or kasts instead.

timescaledb requires manual upgrade steps. After you run ALTER EXTENSION, you must run this SQL script. For more details, see the following pull requests #6797. PostgreSQL 13 is no longer supported in TimescaleDB v2.16.

paperless-ngx has been updated to minor version 2.15 which switched the web server from Gunicorn to Granian. If you set Gunicorn specific envs (usually contain GUNICORN) they must be updated.

testers.shellcheck now warns when name is not provided. The name argument will become mandatory in a future release.

tauon 7.9.0+ when launched for the first time, migrates its database to a new schema that is not backwards compatible. Older versions will refuse to start at all with that database afterwards. If you need to still use older tauon versions, make sure to back up ~/.local/share/TauonMusicBox.

aws-workspaces has dropped support for PCoiP networking.

GIMP 3.0 available as gimp3.

grafana-agent and services.grafana-agent have been removed in favor of Grafana Alloy (grafana-alloy and services.alloy), as they depend on an EOL compiler version and will become EOL during the 25.05 lifecycle. Grafana recommends migrating to grafana-alloy (services.alloy). See https://grafana.com/docs/alloy/latest/set-up/migrate/ for details.

slskd has been updated to v0.22.3, which includes breaking changes to script integrations. Please review the changelog and the accompanying pull request.

forgejo and forgejo-lts have been updated to v11. See upstreams release blog post for more information.

unifi has been updated to v9.1. This version should be backward compatible with v8.x, however as a result, unifi8 package has been removed.

xdragon package has been renamed to dragon-drop. xdragon is an alias to dragon-drop and the package still provides bin/xdragon. bin/dragon is no longer supplied.

python3Packages.bpycv has been removed due to being incompatible with Blender 4 and unmaintained.

python3Packages.jaeger-client was removed because it was deprecated upstream. OpenTelemetry is the recommended replacement.

rocmPackages_6 has been updated to ROCm 6.3.

rocmPackages_5 has been removed.

rocmPackages.rocm-thunk has been removed and its functionality has been integrated with the ROCm CLR. Use rocmPackages.clr instead.

rocmPackages.clang-ocl has been removed. It was deprecated by AMD in 2023.

nodePackages.meshcommander has been removed, as the package was deprecated by Intel.

The default version of z3 has been updated from 4.8 to 4.13. There are still a few packages that need specific older versions; those will continue to be maintained as long as other packages depend on them but may be removed in the future.

The nixLog* family of functions made available through the standard environment have been rewritten to prefix messages with both the debug level and the function name of the caller. The nixLog function, which logs unconditionally, was also re-introduced and modified to prefix messages with the function name of the caller. For more information, see this PR.

postgresql’s pythonSupport argument has been changed. It is now enabled by default, but to use PL/Python the extension needs to be added explicitly with postgresql.withPackages. If you were using postgresql.override { pythonSupport = true; } before, change it to postgresql.withPackages (ps: [ ps.plpython3 ]). The same applies to perlSupport/plperl and tclSupport/pltcl respectively.

Rust packages will need to regenerate their cargoHash. Cargo 1.84.0 changed the format of cargo vendor output, which invalidated all existing rustPlatform.fetchCargoTarball hashes. To preserve Nix’s invariants, it has been replaced with rustPlatform.fetchCargoVendor, an independent implementation prioritizing format stability. rustPlatform.buildRustPackage now uses rustPlatform.fetchCargoVendor by default; a hash mismatch error is expected in third‐party Rust packages when updating to Nixpkgs 25.05. Packages wishing to maintain compatibility with Nixpkgs 24.11 must explicitly set useFetchCargoVendor to true. rustPlatform.importCargoLock may also be appropriate in some circumstances.

cassandra_3_0 and cassandra_3_11 have been removed as they have reached end-of-life. Please update to cassandra_4. See the changelog for more information about the upgrade process.

mariadb_105 has been removed as it has reached end-of-life in 2025-06. Please update to mariadb_106.

NetBox was updated to >= 4.2.0. Have a look at the breaking changes of the 4.1 release and the 4.2 release, make the required changes to your database, if needed, then upgrade by setting services.netbox.package = pkgs.netbox_4_2; in your configuration.

nodePackages.expo-cli has been removed, as it was deprecated by upstream. The suggested replacement is the npx expo command.

The conduwuit matrix server implementation has officially been discontinued by upstream and the package has thus been marked as vulnerable, as it is a security-sensitive package that has reached EOL.

NetBox version 4.0.X available as netbox_4_0 was removed. Please upgrade to 4.2.

golangci-lint has reached v2. Please read the changes and view the migration guide here.

i3status-rust-package no longer enables notmuch by default. It can be enabled via withNotmuch.

ocis-bin has been renamed to ocis_5-bin. Future versions will have the major version suffix.

All support for 32‐bit Darwin systems has been dropped.

substituteAll and substituteAllFiles have been deprecated in favor of replaceVars and will be removed in the next release.

Default ICU version updated from 74 to 76

The packages signald, signaldctl and purple-signald have been dropped as they are unmaintained upstream and have been incompatible with the official Signal servers for a long while.

Apache Kafka was updated to >= 4.0.0. Please note that this is the first release which operates entirely without Apache ZooKeeper support, and all clusters need to be migrated to KRaft mode. See the release announcement for more details.

ast-grep removes the sg command to prevent conflict with the sg command from shadow-utils. If you need legacy sg command compatibility with old code, you can use ast-grep.override { enableLegacySg = true; }

rename package wtf to wtfutil.

python3Packages.beancount was updated to 3.1.0. Previous major version remains available as python3Packages.beancount_2.

wastebin has been updated to 3.0.0. See the Changelog for breaking changes to the configuration.

binwalk was updated to 3.1.0, which has been rewritten in Rust. The Python module is no longer available. See the release notes of 3.1.0 for more information.

pkgs.nextcloud28 and pkgs.nextcloud29 have been removed since they are out of support upstream.

centrifugo was updated to v6, which uses a new config format. See upstream documentation for migration.

teleport has been upgraded from major version 16 to major version 17. Refer to upstream upgrade instructions and release notes for v17.

Emacs lisp build helpers, such as emacs.pkgs.melpaBuild, now enables __structuredAttrs by default. Environment variables have to be passed via the env attribute.

buildGoModule now passes environment variables via the env attribute. CGO_ENABLED should now be specified with env.CGO_ENABLED when passing to buildGoModule. Direct specification of CGO_ENABLED is now redirected by a compatibility layer with a warning, but will become an error in future releases.

Go-related environment variables previously shadowed by buildGoModule now results in errors when specified directly. Such variables include GOOS and GOARCH.

Third-party projects supporting both stable and unstable channels could detect this change through the absence of the CGO_ENABLED function argument in buildGoModule (!((lib.functionArgs buildGoModule) ? CGO_ENABLED)).

buildGoPackage has been removed. Use buildGoModule instead. See the Go section in the nixpkgs manual for details.

buildGoModule now supports a goSum attribute (null by default) to optionally provide a path to go.sum and correctly enabling rebuilds when the file changes.

The newly added aliases go_latest and buildGoLatestModule are now available and can be used to prevent packages like gopls from breaking whenever the default toolchain minor version is lagging behind. It can also be used outside of Nixpkgs to get fast access to new Go minor versions without having to wait for a staging cycle that will update the default builder/toolchain.

A policy documenting the details of Go toolchain and builder upgrades in Nixpkgs, as well as rules related to using non-default builders like buildGo1xxModule and buildGoLatestModule has been added in-tree.

top-level playwright now refers to the github Microsoft/playwright package instead of the python tester launcher. You can still refer to the python launcher via python3Packages.toPythonApplication python3Packages.playwright

The representation of the flags attributes as shell/environment variables for most Python building setup hooks are now the same as stdenv.mkDerivation and other build helpers – they are space-separated environment variables when __structuredAttrs = false and Bash arrays when __structuredAttrs = true, and are concatenated to the command without Bash-evaluation. The following behaviour changes are introduced during the conversion:

The haka package and module has been removed because the package was broken and unmaintained for 9 years.

The gsignond package, plugins and module have been removed because they were unmaintained for 6 years.

strawberry has been updated to 1.2, which drops support for the VLC backend and Qt 5. The strawberry-qt5 package and withGstreamer/withVlc override options have been removed due to this.

nexusmods-app has been upgraded from version 0.6.3. If you were running a version older than 0.7.0, then before upgrading, you must reset all app state (mods, games, settings, etc). Otherwise, NexusMods.App will crash due to app state files incompatibility.

nezha and its agent nezha-agent have been updated to v1, which contains breaking changes. See the official wiki for more details.

ps3-disc-dumper was updated to 4.2.5, which removed the CLI project and now exclusively offers the GUI

kmonad is now hardened by default using common systemd settings. If KMonad is used to execute shell commands, hardening may make some of them fail. In that case, you can disable hardening using the services.kmonad.keyboards.<name>.enableHardening option.

isd was updated from 0.2.0 to 0.5.1, the new version may crash with a previously generated config, try moving or deleting ~/.config/isd/schema.json.

uwsgi no longer supports Python 2 plugins.

Support for CUDA 10 has been dropped, as announced in the 24.11 release notes.

mepo was updated to version 1.3.3. The manual page was removed, a new JSON API was introduced to replace Mepolang for configuration, and a few default key bindings were changed. See the 1.3.0 changelog for more details.

mkBinaryCache now defaults to using zstd compression for the binary caches it creates. The previous xz compression method can be used by passing compression = "xz";.

nodejs_latest was updated from 23.x to 24.x. nodejs_23 has been removed in favor of nodejs_24.

nodejs_18 package was removed due to upstream End-of-Life in April 2025.

nodePackages."@commitlint/config-conventional" has been removed, as it is a library, and projects should depend on it instead.

zigbee2mqtt is now available in version 2.x as zigbee2mqtt_2. In NixOS 25.11 we’ll remove zigbee2mqtt_1 and default to zigbee2mqtt_2. See the breaking changes announcement for 2.0.0.

nodePackages.vls has been deprecated, as the upstream consumer of it, vetur, has been deprecated by upstream. Upstream suggests migrating to Volar for Vue LSP tooling instead.

nodePackages.create-react-native-app has been removed, as it is deprecated. Upstream suggests using a framework for React Native apps instead.

nodePackages.insect has been removed, as it’s deprecated by upstream. The suggested replacement is numbat.

nodePackages.webpack-dev-server has been removed, as it should be installed in projects that use it instead.

nodePackages.copy-webpack-plugin has been removed, as it should be installed in projects that use it instead.

himalaya has been updated from v1.0.0-beta.4 to v1.1.0, which introduces breaking changes. Check out the release notes for details.

linuxPackages.nvidiaPackages.dc_520 has been removed since it is marked broken and there are better newer alternatives.

pnpm was updated to version 10. If your project is incompatible, you can install the previous version from the package attribute pnpm_9.

dwarf-fortress-packages now only contains one minor version for each major version since version 0.44. Saves should still be compatible, but you may have to change which minor version you were using if it was one other than the newest.

tpm2-pkcs11 now is compiled without abrmd (Access Broker and Resource Manager Daemon) support by default, preferring the kernel resource manager. Use tpm2-pkcs11.abrmd if you would like a version with abrmd support. Note that the NixOS module picks the correct one automatically based on security.tpm2.abrmd.

zig_0_9 and zig_0_10 have been removed, you should upgrade to zig_0_13 (also available as just zig), zig_0_12 or zig_0_11 instead.

webpack-cli was updated to major version 6, which has breaking changes from the previous version 5.1.4. See the upstream release notes for details on these changes.

minetest has been renamed to luanti to match the upstream name change but aliases have been added. The new name hasn’t resulted in many changes as of yet but older references to minetest should be sunset. See the new name announcement for more details.

poac has been renamed to cabinpkg to match the upstream name change but an alias has been added. See the new name announcement for more details.

serious-sans has been removed because upstream changed its name to Serious Shanns, which is not currently packaged.

racket_7_9 has been removed, as it is insecure. It is recommended to use Racket 8 instead.

rofi has been updated from 1.7.5 to 1.7.6 which introduces some breaking changes to binary plugins, and also contains a lot of new features and bug fixes. This is highlighted because the patch version bump does not indicate the volume of changes by itself. See the upstream release notes for the full list of changes.

ente-auth now uses the name enteauth for its binary. The previous name was ente_auth.

foundationdb was upgraded to 7.3.

fluxus has been removed, as it depends on racket_7_9 and had no updates in 9 years.

meilisearch has been upgraded from 1.11.3 to 1.14.0, which requires manually dumping and importing the data. See Meilisearch’s upgrade guide for more information.

sm64ex-coop has been removed as it was archived upstream. Consider migrating to sm64coopdx.

tldr now uses tldr-python-client instead of tldr-c-client which is unmaintained.

The behavior of the networking.nat.externalIP and networking.nat.externalIPv6 options has been changed. networking.nat.forwardPorts now only forwards packets destined for the specified IP addresses.

python3Packages.bpycv has been removed due to being incompatible with Blender 4 and unmaintained.

python3Packages.jaeger-client was removed because it was deprecated upstream. OpenTelemetry is the recommended replacement.

nodePackages.meshcommander has been removed, as the package was deprecated by Intel.

The default version of z3 has been updated from 4.8 to 4.15, and all old versions have been dropped. Note that fstar still depends on specific versions, and maintains them as overrides.

prometheus has been updated from 2.55.0 to 3.1.0. Read the release blog post and migration guide.

kanata was updated to v1.8.0, which introduces several breaking changes. See the release notes of v1.7.0 and v1.8.0 for more information.

authelia version 4.39.0 has made changes on the default claims for ID Tokens, to mirror the standard claims from the specification. This change may affect some clients in unexpected ways, so manual intervention may be required. Read the release notes, along with the guide to work around issues that may be encountered.

ags was updated to v2, which is just a CLI for Astal now. Components are available as a different package set astal.*. If you want to use v1, it is available as ags_1 package.

See the release notes of v2.0.0 for more information.

nodePackages.expo-cli has been removed, as it was deprecated by upstream. The suggested replacement is the npx expo command.

open-policy-agent has been updated to 1.0.0+. This major release makes the rego.v1 syntax the default. This is a breaking change for those using v0 Rego. See the upgrade documentation for more details. For those unable to upgrade yet, there is a v0 compatibility mode available too.

helmfile was updated to v1.0.0, which introduces several breaking changes. See the release notes of v1.0.0 for more information.

vscode-utils.buildVscodeExtension now requires pname as an argument

nerdfonts has been separated into individual font packages under the namespace nerd-fonts. The directories for font files have changed from $out/share/fonts/{opentype,truetype}/NerdFonts to $out/share/fonts/{opentype,truetype}/NerdFonts/<fontDirName>, where <fontDirName> can be found in the official website as the titles in preview images, with the “Nerd Font” suffix and any whitespaces trimmed. Configuration changes are required, see build output.

retroarch has been refactored and the older retroarch.override { cores = [ ... ]; } to create a RetroArch derivation with custom cores doesn’t work anymore, use retroarch.withCores (cores: [ ... ]) instead. If you need more customization (e.g.: custom settings), use wrapRetroArch instead.

borgmatic has been updated from 1.8.14 to 1.9.5, please check the upstream changelog for more details, especially for a few possibly breaking changes noted in the 1.9.0 changelog.

nodePackages.ganache has been removed, as the package has been deprecated by upstream.

matomo now defaults to version 5 (previously available as matomo_5). Version 4 has been removed as it reached EOL on December 19, 2024.

matomo-beta has been removed as the version of the matomo package can now be easily overridden through overrideAttrs (see PR #374022)

docker_24 has been removed, as it was EOL with vulnerabilities since June 08, 2024.

Emacs 28 and 29 have been removed.

Emacs 28 Macport has been removed, while CVEs of Emacs 29 Macport are patched.

containerd has been updated to v2, which contains breaking changes. See the containerd 2.0 documentation for more details.

The tinycc package now has the dev, doc and lib outputs, thus, tinycc.out may now only provide the tcc and cross compilers binaries.

The testTarget argument of haskellPackages.mkDerivation has been deprecated in favour of testTargets. testTarget took a space separated string of targets, whereas the new testTargets argument takes a list of targets. For instance, testTarget = "foo bar baz" should become testTargets = [ "foo" "bar" "baz" ].

rustPlatform.buildRustPackage stops handling the deprecated argument cargoSha256. Out-of-tree packages that haven’t migrated from cargoSha256 to cargoHash now receive errors.

nodePackages.stackdriver-statsd-backend has been removed, as the StackDriver service has been discontinued by Google, and therefore the package no longer works.

python3Packages.opentracing has been removed due to being unmaintained upstream. OpenTelemetry is the recommended replacement.

the notmuch vim plugin now lives in a separate output of the notmuch package. Installing notmuch will not bring the notmuch vim package anymore, add vimPlugins.notmuch-vim to your (Neo)vim configuration if you want the vim plugin.

The fileSystems (e.g., fileSystems."/") are now set by NixOS-implemented modules using lib.mkDefault, allowing wholesale overrides, but this means that overriding individual attributes (like fsType or options) without explicitly specifying device may result in missing required fields and errors such as No device specified for mount point '/' (https://github.com/NixOS/nixpkgs/pull/377406).

prisma and prisma-engines have been updated to version 6.7.0, which introduces several breaking changes. See the Prisma ORM upgrade guide for more information.

dependency-track no longer bundles the UI inside the jar. This bundling functionality is deprecated by upstream and causes UI assets not being served after weeks of runtime.

nq was updated to 1.0, which renames the fq and tq utilities to nqtail and nqterm respectively.

zf was updated to 0.10.2, which includes breaking changes from the 0.10.0 release. zf no longer does Unicode normalization of the input and no longer supports terminal escape sequences in the ZF_PROMPT environment variable.

confluent-cli was updated from 3.60.0 to 4.16.0, which includes several breaking changes as detailed in Confluent’s release notes.

siduck76-st has been renamed to st-snazzy, like the project’s flake. An alias for the old name has been added.

python3Packages.jax now directly depends on python3Packages.jaxlib. As a result, packages that depend on jax no longer need to include jaxlib to their dependencies. There is also a breaking change in the handling of CUDA. Instead of using a CUDA-compatible jaxlib as before, you can use plugins like python3Packages.jax-cuda12-plugin.

Added allowVariants to gate availability of package sets like pkgsLLVM, pkgsMusl, pkgsZig, etc. This was done in an effort to decrease evaluation times by limiting the number of instances of nixpkgs to evaluate. The option will be removed in the future as a new mechanism is in the works for handling cross compilation.

i18n module improvements:

Plasma 5 and Qt 5 based versions of associated software are deprecated in NixOS 25.05, and will be removed in NixOS 25.11. Users are encouraged to upgrade to Plasma 6.

titaniumenv, titanium, and titanium-alloy have been removed due to lack of maintenance in Nixpkgs .

Cursor — a vscode-based editor that uses AI to help you write code faster — has been packaged as cursor.

octave (and octaveFull) was updated to version 10.x. The update broke a few octavePackages, and librsb. See the PR’s commits for more details.

androidenv has been improved:

dwarf-fortress audio now works again. Additionally, the dfhack and dwarf-fortress-full packages are now exposed at toplevel, making it easier to install and play Dwarf Fortress. Note that dwarf-fortress-full is the Nixpkgs equivalent of the Dwarf Fortress Lazy Pack.

gerbera now has wavpack support.

buildPythonPackage, buildPythonApplication and the Python building setup hooks now support both __structuredAttrs = true and __structuredAttrs = false.

buildGoModule now supports a self-referencing finalAttrs: parameter containing the final arguments including overrides. This allows packaging configuration to be overridden in a consistent manner by providing an alternative to rec {} syntax.

Caddy can now be built with plugins by using caddy.withPlugins, a passthru function that accepts an attribute set as a parameter. The plugins argument represents a list of Caddy plugins, with each Caddy plugin being a versioned module. The hash argument represents the vendorHash of the resulting Caddy source code with the plugins added.

Example:

let
  pkgs = import <nixpkgs> { };

in
pkgs.caddy.withPlugins {
  plugins = [
    # tagged upstream
    "github.com/caddy-dns/powerdns@v1.0.1"
    # pseudo-version number generated by Go
    "github.com/caddy-dns/cloudflare@v0.0.0-20240703190432-89f16b99c18e"
    "github.com/mholt/caddy-webdav@v0.0.0-20241008162340-42168ba04c9d"
  ];
  hash = "sha256-wqXSd1Ep9TVpQi570TTb96LwzNYvWL5EBJXMJfYWCAk=";
}

To get the necessary hash of the vendored dependencies, omit hash. The build will fail and tell you the correct value.

Note that all provided plugins must have versions/tags (string after @), even if upstream repo does not tag each release. For untagged plugins, you can either create an empty Go project and run go get <plugin> and see changes in go.mod to get the pseudo-version number, or provide a commit hash in place of version/tag for the first run, and update the plugin string based on the error output.

The godot-export-templates package now has its content at share/godot/export_templates/$version instead of the output root. This makes it more convenient for symlinking into ~/.local, but scripts expecting the old layout will need to be changed.

GOverlay has been updated to 1.2, please check the upstream changelog for more details.

tpm2-pkcs11 now has the variant tpm2-pkcs11-fapi, which has been patched to default to the Feature API backend. It has also been split into tpm2-pkcs11-esapi, which only supports the older Enhanced System API backend. Note the differences, and that tpm2-pkcs11 itself still needs TPM2_PKCS11_BACKEND=fapi exported in order to use the Feature API, whereas tpm2-pkcs11-fapi does not, and tpm2-pkcs11-esapi just does not support fapi entirely.

For matrix homeserver Synapse we are now following the upstream recommendation to enable jemalloc as the memory allocator by default.

Mattermost, a self-hosted chat collaboration platform supporting calls, playbooks, and boards, has been updated. It now has multiple versions, disabled telemetry, and a native frontend build in nixpkgs, removing all upstream prebuilt blobs.

A new hardening flag, nostrictaliasing was made available, corresponding to the gcc/clang option -fno-strict-aliasing.

The stackclashprotection hardening flag has been enabled by default on compilers that support it.

In dovecot package, the hardcoded path to the module directory has been removed.

authelia version 4.39.0 has made some changes which deprecate older configurations. They are still expected to be working until future version 5.0.0, but will generate warnings in logs. Read the release notes for human readable summaries of the changes.

hddfancontrol has been updated to major release 2. See the migration guide, as there are breaking changes.

nextcloud-news-updater is unmaintained and was removed from Nixpkgs.

KDE Partition Manager partitionmanager’s support for ReiserFS is removed. ReiserFS has not been actively maintained for many years. It has been marked as obsolete since Linux 6.6, and is removed in Linux 6.13.

gerbera now has wavpack support.

signal-desktop has been migrated to a from source build. No state migration is necessary. In case there’s no working source build available (like on Darwin), the binary build is still available at signal-desktop-bin.

ddclient was updated from 3.11.2 to 4.0.0 Release notes