staging-next 2025-07-04

.editorconfig

@@ -24,15 +24,15 @@ insert_final_newline = false
 # see https://nixos.org/nixpkgs/manual/#chap-conventions
 
 # Match json/lockfiles/markdown/nix/perl/python/ruby/shell/docbook files, set indent to spaces
-[*.{bash,json,lock,md,nix,pl,pm,py,rb,sh,xml}]
+[*.{bash,js,json,lock,md,nix,pl,pm,py,rb,sh,xml}]
 indent_style = space
 
 # Match docbook files, set indent width of one
 [*.xml]
 indent_size = 1
 
 # Match json/lockfiles/markdown/nix/ruby files, set indent width of two
-[*.{json,lock,md,nix,rb}]
+[*.{js,json,lock,md,nix,rb}]
 indent_size = 2
 
 # Match all the Bash code in Nix files, set indent width of two

doc/hooks/meson.section.md

@@ -91,3 +91,4 @@ Meson setup hook.
 
 - `prefixKey`
 - `enableParallelBuilding`
+- `enableParallelChecking`

doc/hooks/versionCheckHook.section.md

@@ -31,7 +31,7 @@ It does so in a clean environment (using `env --ignore-environment`), and it che
 The variables that this phase control are:
 
 - `dontVersionCheck`: Disable adding this hook to the [`preInstallCheckHooks`](#ssec-installCheck-phase). Useful if you do want to load the bash functions of the hook, but run them differently.
-- `versionCheckProgram`: The full path to the program that should print the `${version}` string. Defaults roughly to `${placeholder "out"}/bin/${pname}`. Using `$out` in the value of this variable won't work, as environment variables from this variable are not expanded by the hook. Hence using `placeholder` is unavoidable.
+- `versionCheckProgram`: The full path to the program that should print the `${version}` string. Defaults to using the first non-empty value `$binary` out of `${NIX_MAIN_PROGRAM}` and `${pname}`, in that order, to build roughly `${placeholder "out"}/bin/$binary`. `${NIX_MAIN_PROGRAM}`'s value comes from `meta.mainProgram`, and does not normally need to be set explicitly. When setting `versionCheckProgram`, using `$out` directly won't work, as environment variables from this variable are not expanded by the hook. Hence using `placeholder "out"` is unavoidable.
 - `versionCheckProgramArg`: The argument that needs to be passed to `versionCheckProgram`. If undefined the hook tries first `--help` and then `--version`. Examples: `version`, `-V`, `-v`.
 - `versionCheckKeepEnvironment`: A list of environment variables to keep and pass to the command. Only those variables should be added to this list that are actually required for the version command to work. If it is not feasible to explicitly list all these environment variables you can set this parameter to the special value `"*"` to disable the `--ignore-environment` flag and thus keep all environment variables.
 - `preVersionCheck`: A hook to run before the check is done.

doc/release-notes/rl-2511.section.md

@@ -20,6 +20,8 @@
 - `space-orbit` package has been removed due to lack of upstream maintenance. Debian upstream stopped tracking it in 2011.
 - `command-not-found` package is now disabled by default; it works only for nix-channels based systems, and requires setup for it to work.
 
+- Derivations setting both `separateDebugInfo` and one of `allowedReferences`, `allowedRequistes`, `disallowedReferences` or `disallowedRequisites` must now set `__structuredAttrs` to `true`. The effect of reference whitelisting or blacklisting will be disabled on the `debug` output created by `separateDebugInfo`.
+
 - `victoriametrics` no longer contains VictoriaLogs components. These have been separated into the new package `victorialogs`.
 
 - `gnome-keyring` no longer ships with an SSH agent anymore because it has been deprecated upstream. You should use `gcr_4` instead, which provides the same features. More information on why this was done can be found on [the relevant GCR upstream PR](https://gitlab.gnome.org/GNOME/gcr/-/merge_requests/67).
@@ -54,6 +56,19 @@
 - `gramps` has been updated to 6.0.0
   Upstream recommends [backing up your Family Trees](https://gramps-project.org/wiki/index.php/Gramps_6.0_Wiki_Manual_-_Manage_Family_Trees#Backing_up_a_Family_Tree) before upgrading.
 
+- `meta.mainProgram`: Changing this `meta` entry can lead to a package rebuild due to being used to determine the `NIX_MAIN_PROGRAM` environment variable.
+
+- `versionCheckHook`: Packages that previously relied solely on `pname` to locate the program used to version check, but have a differing `meta.mainProgram` entry, might now fail.
+
+
+- The debug outputs produced by `separateDebugInfo = true;` now contain symlinks mapping build-ids to the original source and ELF file.
+  Specifically, if `$out/bin/ninja` has build-id `483bd7f7229bdb06462222e1e353e4f37e15c293`, then
+  * `$debug/lib/debug/.build-id/48/3bd7f7229bdb06462222e1e353e4f37e15c293.executable` is a symlink to `$out/bin/ninja`
+  * `$debug/lib/debug/.build-id/48/3bd7f7229bdb06462222e1e353e4f37e15c293.source` is a symlink to the value of `$src` during build
+  * `$debug/lib/debug/.build-id/48/3bd7f7229bdb06462222e1e353e4f37e15c293.sourceoverlay` is a symlink to a directory with the same structure as the expanded `$sourceRoot` but containing only a copy of files which were patched during the build
+  * `$debug/lib/debug/.build-id/48/3bd7f7229bdb06462222e1e353e4f37e15c293.debug` is the file containing debug symbols (like before).
+
+
 ## Nixpkgs Library {#sec-nixpkgs-release-25.11-lib}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

doc/stdenv/stdenv.chapter.md

@@ -1415,7 +1415,7 @@ This setup hook checks for, reports, and (by default) fails builds when "broken"
 This hook can be disabled by setting `dontCheckForBrokenSymlinks`.
 
 ::: {.note}
-The hook only considers symlinks with targets inside the Nix store.
+The hook only considers symlinks with targets inside the Nix store or $TMPDIR directory (typically /nix/store and /build in the builder environment, the later being where build is executed).
 :::
 
 ::: {.note}

maintainers/maintainer-list.nix

@@ -8868,6 +8868,12 @@
     github = "fzakaria";
     githubId = 605070;
   };
+  fzdslr = {
+    name = "FZDSLR";
+    email = "fzdslr@outlook.com";
+    github = "fzdslr";
+    githubId = 62922415;
+  };
   gabesoft = {
     email = "gabesoft@gmail.com";
     github = "gabesoft";

maintainers/scripts/haskell/regenerate-hackage-packages.sh

@@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i bash -p coreutils haskellPackages.cabal2nix-unstable git nix nixfmt-rfc-style -I nixpkgs=.
+#! nix-shell -i bash -p coreutils haskellPackages.cabal2nix-unstable git nixfmt-rfc-style -I nixpkgs=.
 
 set -euo pipefail
 

maintainers/scripts/haskell/regenerate-transitive-broken-packages.sh

@@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i bash -p coreutils jq nix -I nixpkgs=.
+#! nix-shell -i bash -p coreutils jq -I nixpkgs=.
 
 set -euo pipefail
 

maintainers/scripts/haskell/update-hackage.sh

@@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i bash -p nix curl jq git gnused -I nixpkgs=.
+#! nix-shell -i bash -p curl jq git gnused -I nixpkgs=.
 
 # See regenerate-hackage-packages.sh for details on the purpose of this script.
 

maintainers/scripts/haskell/update-stackage.sh

@@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i bash -p nix curl jq git gnused gnugrep -I nixpkgs=.
+#! nix-shell -i bash -p curl jq git gnused gnugrep -I nixpkgs=.
 # shellcheck shell=bash
 
 set -eu -o pipefail

maintainers/scripts/haskell/upload-nixos-package-list-to-hackage.sh

@@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i bash -p nix curl gnused -I nixpkgs=.
+#! nix-shell -i bash -p curl gnused -I nixpkgs=.
 
 # On Hackage every package description shows a category "Distributions" which
 # lists a "NixOS" version.

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -66,6 +66,8 @@
 
 - The Perl implementation of the `switch-to-configuration` program is removed. All switchable systems now use the Rust rewrite. Any prior usage of `system.switch.enableNg` must now be removed. If you have any outstanding issues with the new implementation, please open an issue on GitHub.
 
+- The `no-broken-symlink` build hook now also fails builds whose output derivation contains links to $TMPDIR (typically /build, which contains the build directory).
+
 - The `services.polipo` module has been removed as `polipo` is unmaintained and archived upstream.
 
 - The Pocket ID module ([`services.pocket-id`][#opt-services.pocket-id.enable]) and package (`pocket-id`) has been updated to 1.0.0. Some environment variables have been changed or removed, see the [migration guide](https://pocket-id.org/docs/setup/migrate-to-v1/).

nixos/modules/services/cluster/spark/default.nix

@@ -104,7 +104,7 @@ in
           path = with pkgs; [
             procps
             openssh
-            nettools
+            net-tools
           ];
           description = "spark master service.";
           after = [ "network.target" ];
@@ -133,7 +133,7 @@ in
           path = with pkgs; [
             procps
             openssh
-            nettools
+            net-tools
             rsync
           ];
           description = "spark master service.";

nixos/modules/services/continuous-integration/hydra/default.nix

@@ -424,7 +424,7 @@ in
       ];
       path = [
         hydra-package
-        pkgs.nettools
+        pkgs.net-tools
         pkgs.openssh
         pkgs.bzip2
         config.nix.package
@@ -459,7 +459,7 @@ in
       ];
       path = with pkgs; [
         hydra-package
-        nettools
+        net-tools
         jq
       ];
       restartTriggers = [ hydraConf ];

nixos/modules/services/desktops/profile-sync-daemon.nix

@@ -43,7 +43,7 @@ in
               rsync
               kmod
               gawk
-              nettools
+              net-tools
               util-linux
               profile-sync-daemon
             ];
@@ -69,7 +69,7 @@ in
               rsync
               kmod
               gawk
-              nettools
+              net-tools
               util-linux
               profile-sync-daemon
             ];

nixos/modules/services/misc/zoneminder.nix

@@ -45,7 +45,7 @@ let
   defaultsFile = pkgs.writeText "60-defaults.conf" ''
     # 01-system-paths.conf
     ${dirStanzas home}
-    ZM_PATH_ARP=${lib.getBin pkgs.nettools}/bin/arp
+    ZM_PATH_ARP=${lib.getBin pkgs.net-tools}/bin/arp
     ZM_PATH_LOGS=/var/log/${dirName}
     ZM_PATH_MAP=/dev/shm
     ZM_PATH_SOCKS=/run/${dirName}

nixos/modules/services/monitoring/zabbix-agent.nix

@@ -59,9 +59,9 @@ in
 
       extraPackages = mkOption {
         type = types.listOf types.package;
-        default = with pkgs; [ nettools ];
-        defaultText = literalExpression "with pkgs; [ nettools ]";
-        example = literalExpression "with pkgs; [ nettools mysql ]";
+        default = with pkgs; [ net-tools ];
+        defaultText = literalExpression "with pkgs; [ net-tools ]";
+        example = literalExpression "with pkgs; [ net-tools mysql ]";
         description = ''
           Packages to be added to the Zabbix {env}`PATH`.
           Typically used to add executables for scripts, but can be anything.

nixos/modules/services/monitoring/zabbix-proxy.nix

@@ -91,11 +91,11 @@ in
       extraPackages = mkOption {
         type = types.listOf types.package;
         default = with pkgs; [
-          nettools
+          net-tools
           nmap
           traceroute
         ];
-        defaultText = literalExpression "[ nettools nmap traceroute ]";
+        defaultText = literalExpression "[ net-tools nmap traceroute ]";
         description = ''
           Packages to be added to the Zabbix {env}`PATH`.
           Typically used to add executables for scripts, but can be anything.

nixos/modules/services/monitoring/zabbix-server.nix

@@ -88,11 +88,11 @@ in
       extraPackages = mkOption {
         type = types.listOf types.package;
         default = with pkgs; [
-          nettools
+          net-tools
           nmap
           traceroute
         ];
-        defaultText = literalExpression "[ nettools nmap traceroute ]";
+        defaultText = literalExpression "[ net-tools nmap traceroute ]";
         description = ''
           Packages to be added to the Zabbix {env}`PATH`.
           Typically used to add executables for scripts, but can be anything.

nixos/modules/services/networking/libreswan.nix

@@ -165,7 +165,7 @@ in
         procps
         nssTools
         iptables
-        nettools
+        net-tools
       ];
       preStart = lib.optionalString cfg.disableRedirects ''
         # Disable send/receive redirects

nixos/modules/services/networking/openvpn.nix

@@ -74,7 +74,7 @@ let
       path = [
         pkgs.iptables
         pkgs.iproute2
-        pkgs.nettools
+        pkgs.net-tools
       ];
 
       serviceConfig.ExecStart = "@${openvpn}/sbin/openvpn openvpn --suppress-timestamps --config ${configFile}";

nixos/modules/services/networking/tetrd.nix

@@ -80,8 +80,8 @@
             builtins.storeDir
             "/etc/ssl"
             "/etc/static/ssl"
-            "${pkgs.nettools}/bin/route:/usr/bin/route"
-            "${pkgs.nettools}/bin/ifconfig:/usr/bin/ifconfig"
+            "${pkgs.net-tools}/bin/route:/usr/bin/route"
+            "${pkgs.net-tools}/bin/ifconfig:/usr/bin/ifconfig"
           ];
 
           BindPaths = [

nixos/modules/services/system/cloud-init.nix

@@ -11,7 +11,7 @@ let
     [
       cloud-init
       iproute2
-      nettools
+      net-tools
       openssh
       shadow
       util-linux

nixos/modules/services/x11/terminal-server.nix

@@ -36,7 +36,7 @@ with lib;
         pkgs.which
         pkgs.openssl
         pkgs.xorg.xauth
-        pkgs.nettools
+        pkgs.net-tools
         pkgs.shadow
         pkgs.procps
         pkgs.util-linux

nixos/modules/virtualisation/digital-ocean-config.nix

@@ -144,7 +144,7 @@ with lib;
         systemd.services.digitalocean-set-hostname = mkIf (hostName == "") {
           path = [
             pkgs.curl
-            pkgs.nettools
+            pkgs.net-tools
           ];
           description = "Set hostname provided by Digitalocean";
           wantedBy = [ "network.target" ];

nixos/modules/virtualisation/vagrant-guest.nix

@@ -23,7 +23,7 @@ in
   environment.systemPackages = with pkgs; [
     findutils
     iputils
-    nettools
+    net-tools
     netcat
     nfs-utils
     rsync

nixos/modules/virtualisation/waagent.nix

@@ -351,7 +351,7 @@ in
           parted
 
           # for hostname
-          nettools
+          net-tools
           # for pidof
           procps
           # for useradd, usermod

pkgs/applications/audio/mopidy/tidal.nix

@@ -29,7 +29,7 @@ python3Packages.buildPythonApplication rec {
     pytest-mock
   ];
 
-  pytestFlagsArray = [ "tests/" ];
+  enabledTestPaths = [ "tests/" ];
 
   meta = {
     description = "Mopidy extension for playing music from Tidal";

pkgs/applications/audio/mpg123/default.nix

@@ -21,11 +21,11 @@ assert withConplay -> !libOnly;
 
 stdenv.mkDerivation rec {
   pname = "${lib.optionalString libOnly "lib"}mpg123";
-  version = "1.32.10";
+  version = "1.33.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/mpg123/mpg123-${version}.tar.bz2";
-    hash = "sha256-h7LBf+DJedPvOO7O/2Nis1sorIWJ+/GFS1vnXJq2VXw=";
+    hash = "sha256-IpDjrt5vTRY+GhdFIWWvM8qtS18JSPmUKc+i2Dhfqp0=";
   };
 
   outputs = [

pkgs/applications/editors/vim/common.nix

@@ -1,6 +1,6 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.1.1401";
+  version = "9.1.1475";
 
   outputs = [
     "out"
@@ -11,7 +11,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-oYde6i5coECUzQQEMo0dvkOXFimKe4y2aGoV2nVLx58=";
+    hash = "sha256-KKUzS0dS9K/jlfP+igyLX1Fwjb7Y5ZAzGLjqHvkA3bs=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/graphics/inkscape/extensions/silhouette/default.nix

@@ -58,7 +58,7 @@ python3.pkgs.buildPythonApplication rec {
     umockdev
   ];
 
-  pytestFlagsArray = [
+  enabledTestPaths = [
     "test"
   ];
 

pkgs/applications/misc/electrum/default.nix

@@ -134,7 +134,7 @@ python3.pkgs.buildPythonApplication rec {
     pycryptodomex
   ];
 
-  pytestFlagsArray = [ "tests" ];
+  enabledTestPaths = [ "tests" ];
 
   postCheck = ''
     $out/bin/electrum help >/dev/null

pkgs/applications/misc/electrum/ltc.nix

@@ -159,7 +159,7 @@ python3.pkgs.buildPythonApplication {
   ];
   buildInputs = lib.optional stdenv.hostPlatform.isLinux qtwayland;
 
-  pytestFlagsArray = [ "electrum_ltc/tests" ];
+  enabledTestPaths = [ "electrum_ltc/tests" ];
 
   disabledTests = [
     "test_loop" # test tries to bind 127.0.0.1 causing permission error

pkgs/applications/misc/mbutil/default.nix

@@ -23,7 +23,7 @@ buildPythonApplication rec {
   build-system = [ setuptools ];
 
   nativeCheckInputs = [ pytestCheckHook ];
-  pytestFlagsArray = [ "test/test.py" ];
+  enabledTestPaths = [ "test/test.py" ];
 
   meta = {
     description = "Importer and exporter for MBTiles";