NixOS · vcunat · Dec 30, 2025 · Dec 19, 2025 · Dec 19, 2025 · Dec 19, 2025
diff --git a/doc/hooks/versionCheckHook.section.md b/doc/hooks/versionCheckHook.section.md
@@ -30,7 +30,7 @@ The variables that this phase control are:
 
 - `dontVersionCheck`: Disable adding this hook to the [`preInstallCheckHooks`](#ssec-installCheck-phase). Useful if you do want to load the bash functions of the hook, but run them differently.
 - `versionCheckProgram`: The full path to the program that should print the `${version}` string. Defaults to using the first non-empty value `$binary` out of `${NIX_MAIN_PROGRAM}` and `${pname}`, in that order, to build roughly `${placeholder "out"}/bin/$binary`. `${NIX_MAIN_PROGRAM}`'s value comes from `meta.mainProgram`, and does not normally need to be set explicitly. When setting `versionCheckProgram`, using `$out` directly won't work, as environment variables from this variable are not expanded by the hook. Hence using `placeholder "out"` is unavoidable.
-- `versionCheckProgramArg`: The argument that needs to be passed to `versionCheckProgram`. If undefined the hook tries first `--help` and then `--version`. Examples: `version`, `-V`, `-v`.
+- `versionCheckProgramArg`: The argument that needs to be passed to `versionCheckProgram`. If undefined the hook tries first `--version` and then `--help`. Examples: `version`, `-V`, `-v`.
 - `versionCheckKeepEnvironment`: A list of environment variables to keep and pass to the command. Only those variables should be added to this list that are actually required for the version command to work. If it is not feasible to explicitly list all these environment variables you can set this parameter to the special value `"*"` to disable the `--ignore-environment` flag and thus keep all environment variables.
 - `preVersionCheck`: A hook to run before the check is done.
 - `postVersionCheck`: A hook to run after the check is done.

diff --git a/doc/languages-frameworks/perl.section.md b/doc/languages-frameworks/perl.section.md
@@ -71,7 +71,7 @@ To install it with `nix-env` instead: `nix-env -f. -iA perlPackages.ClassC3`.
 So what does `buildPerlPackage` do? It does the following:
 
 1. In the configure phase, it calls `perl Makefile.PL` to generate a Makefile. You can set the variable `makeMakerFlags` to pass flags to `Makefile.PL`
-2. It adds the contents of the `PERL5LIB` environment variable to `#! .../bin/perl` line of Perl scripts as `-Idir` flags. This ensures that a script can find its dependencies. (This can cause this shebang line to become too long for Darwin to handle; see the note below.)
+2. It adds the contents of the `PERL5LIB` environment variable to a use lib statement at the start of Perl scripts. This ensures that a script can find its dependencies.
 3. In the fixup phase, it writes the propagated build inputs (`propagatedBuildInputs`) to the file `$out/nix-support/propagated-user-env-packages`. `nix-env` recursively installs all packages listed in this file when you install a package that has it. This ensures that a Perl package can find its dependencies.
 
 `buildPerlPackage` is built on top of `stdenv`, so everything can be customised in the usual way. For instance, the `BerkeleyDB` module has a `preConfigure` hook to generate a configuration file used by `Makefile.PL`:
@@ -120,37 +120,6 @@ Dependencies on other Perl packages can be specified in the `buildInputs` and `p
 }
 ```
 
-On Darwin, if a script has too many `-Idir` flags in its first line (its “shebang line”), it will not run. This can be worked around by calling the `shortenPerlShebang` function from the `postInstall` phase:
-
-```nix
-{
-  lib,
-  stdenv,
-  buildPerlPackage,
-  fetchurl,
-  shortenPerlShebang,
-}:
-
-{
-  ImageExifTool = buildPerlPackage {
-    pname = "Image-ExifTool";
-    version = "12.50";
-
-    src = fetchurl {
-      url = "https://exiftool.org/Image-ExifTool-${version}.tar.gz";
-      hash = "sha256-vOhB/FwQMC8PPvdnjDvxRpU6jAZcC6GMQfc0AH4uwKg=";
-    };
-
-    nativeBuildInputs = lib.optional stdenv.hostPlatform.isDarwin shortenPerlShebang;
-    postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
-      shortenPerlShebang $out/bin/exiftool
-    '';
-  };
-}
-```
-
-This will remove the `-I` flags from the shebang line, rewrite them in the `use lib` form, and put them on the next line instead. This function can be given any number of Perl scripts as arguments; it will modify them in-place.
-
 ### Generation from CPAN {#ssec-generation-from-CPAN}
 
 Nix expressions for Perl packages can be generated (almost) automatically from CPAN. This is done by the program `nix-generate-from-cpan`, which can be installed as follows:

diff --git a/doc/languages-frameworks/qt.section.md b/doc/languages-frameworks/qt.section.md
@@ -25,15 +25,7 @@ stdenv.mkDerivation {
 
 The same goes for Qt 5 where libraries and tools are under `libsForQt5`.
 
-Any Qt package should include `wrapQtAppsHook` or `wrapQtAppsNoGuiHook` in `nativeBuildInputs`, or explicitly set `dontWrapQtApps` to bypass generating the wrappers.
-
-::: {.note}
-
-`wrapQtAppsHook` propagates plugins and QML components from `qtwayland` on platforms that support it, to allow applications to act as native Wayland clients. It should be used for all graphical applications.
-
-`wrapQtAppsNoGuiHook` does not propagate `qtwayland` to reduce closure size for purely command-line applications.
-
-:::
+Any Qt package should include `wrapQtAppsHook` in `nativeBuildInputs`, or explicitly set `dontWrapQtApps` to bypass generating the wrappers.
 
 ## Packages supporting multiple Qt versions {#qt-versions}
 

diff --git a/doc/languages-frameworks/typst.section.md b/doc/languages-frameworks/typst.section.md
@@ -22,7 +22,7 @@ Since **Typst Universe** does not provide a way to fetch a package with a specif
 ```nix
 typst.withPackages.override
   (old: {
-    typstPackages = old.typstPackages.extend (
+    typstPackages = old.typstPackages.overrideScope (
       _: previous: {
         polylux_0_4_0 = previous.polylux_0_4_0.overrideAttrs (oldPolylux: {
           src = oldPolylux.src.overrideAttrs { outputHash = YourUpToDatePolyluxHash; };

diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md
@@ -3,7 +3,11 @@
 ## Highlights {#sec-nixpkgs-release-26.05-highlights}
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- Create the first release note entry in this section!
+- GCC has been updated from GCC 14 to GCC 15.
+  This introduces some backwards incompatible changes; Refer to the [upstream porting guide](https://gcc.gnu.org/gcc-15/porting_to.html) for details.
+
+- Node.js default version has been updated from 22 LTS to 24 LTS.
+  This introduces some breaking changes; Refer to the [upstream migration article](https://nodejs.org/en/blog/migrations/v22-to-v24) for details.
 
 ## Backward Incompatibilities {#sec-nixpkgs-release-26.05-incompatibilities}
 

diff --git a/lib/licenses.nix b/lib/licenses.nix
@@ -64,6 +64,11 @@ lib.mapAttrs mkLicense (
       free = false;
     };
 
+    adobeDisplayPostScript = {
+      spdxId = "Adobe-Display-PostScript";
+      fullName = "Adobe Display PostScript License";
+    };
+
     adobeUtopia = {
       fullName = "Adobe Utopia Font License";
       spdxId = "Adobe-Utopia";
@@ -501,6 +506,11 @@ lib.mapAttrs mkLicense (
       fullName = "curl License";
     };
 
+    dec3Clause = {
+      spdxId = "DEC-3-Clause";
+      fullName = "DEC 3-Clause License";
+    };
+
     doc = {
       spdxId = "DOC";
       fullName = "DOC License";
@@ -727,6 +737,11 @@ lib.mapAttrs mkLicense (
       spdxId = "HPND-sell-variant";
     };
 
+    hpndSellVariantMitDisclaimerXserver = {
+      spdxId = "HPND-sell-MIT-disclaimer-xserver";
+      fullName = "Historical Permission Notice and Disclaimer - sell xserver variant with MIT disclaimer";
+    };
+
     hpndDec = {
       fullName = "Historical Permission Notice and Disclaimer - DEC variant";
       spdxId = "HPND-DEC";
@@ -1113,6 +1128,13 @@ lib.mapAttrs mkLicense (
       fullName = "Non-Profit Open Software License 3.0";
     };
 
+    # NTP is basically HPND, but spdx and the OSI recognize it
+    # hpnd says "and without fee", ntp "with or without fee"
+    ntp = {
+      spdxId = "NTP";
+      fullName = "NTP License";
+    };
+
     nvidiaCuda = {
       shortName = "CUDA EULA";
       fullName = "CUDA Toolkit End User License Agreement (EULA)";

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
@@ -29461,6 +29461,12 @@
     email = "rasmus@liaskar.net";
     githubId = 152716976;
   };
+  zivarah = {
+    name = "Brian Lyles";
+    github = "zivarah";
+    email = "brianmlyles@gmail.com";
+    githubId = 1123282;
+  };
   zlepper = {
     name = "Rasmus Hansen";
     github = "zlepper";

diff --git a/nixos/tests/lvm2/default.nix b/nixos/tests/lvm2/default.nix
@@ -4,11 +4,11 @@
   pkgs ? import ../../.. { inherit system config; },
   lib ? pkgs.lib,
   kernelVersionsToTest ? [
-    "5.4"
     "5.10"
     "5.15"
     "6.1"
     "6.6"
+    "6.12"
     "latest"
   ],
 }:

diff --git a/pkgs/applications/blockchains/bitcoin-knots/default.nix b/pkgs/applications/blockchains/bitcoin-knots/default.nix
@@ -187,7 +187,6 @@ stdenv.mkDerivation (finalAttrs: {
     versionCheckHook
   ];
   versionCheckProgram = "${placeholder "out"}/bin/bitcoin-cli";
-  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   meta = {

diff --git a/pkgs/applications/blockchains/bitcoin/default.nix b/pkgs/applications/blockchains/bitcoin/default.nix
@@ -187,7 +187,6 @@ stdenv.mkDerivation (finalAttrs: {
     versionCheckHook
   ];
   versionCheckProgram = "${placeholder "out"}/bin/bitcoin-cli";
-  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   passthru.tests = {

diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
@@ -1,6 +1,6 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.1.1869";
+  version = "9.1.1918";
 
   outputs = [
     "out"
@@ -11,7 +11,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-AHx4AHsJAsEE5LRzKgBeV3LoCaoHUB+0/gq7kOHObMk=";
+    hash = "sha256-NU/A7yWcLaC+wqsfiHYVhnSZHGDao6+Oib/bSFNSVyQ=";
   };
 
   enableParallelBuilding = true;

diff --git a/pkgs/applications/editors/vim/plugins/non-generated/cord-nvim/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/cord-nvim/default.nix
@@ -32,7 +32,6 @@ let
     nativeInstallCheckInputs = [
       versionCheckHook
     ];
-    versionCheckProgramArg = "--version";
     doInstallCheck = false;
 
     meta.mainProgram = "cord";

diff --git a/pkgs/applications/emulators/wine/sources.nix b/pkgs/applications/emulators/wine/sources.nix
@@ -82,6 +82,16 @@ let
     })
   ];
 
+  # Fix build with GCC 15
+  # https://bugs.winehq.org/show_bug.cgi?id=58191
+  patches-add-truncf-to-the-import-library = [
+    (pkgs.fetchpatch {
+      name = "add-truncf-to-the-import-library.patch";
+      url = "https://gitlab.winehq.org/wine/wine/-/commit/ed66bd5c97ecc17c42a4942dafac7d406c1e5120.patch";
+      hash = "sha256-mn0fRZ840MYk1WZsBLcachUzyNmBUSlvf50t9jFGXp0=";
+    })
+  ];
+
   inherit (pkgs) writeShellScript;
 in
 rec {
@@ -114,7 +124,8 @@ rec {
       # Also look for root certificates at $NIX_SSL_CERT_FILE
       ./cert-path.patch
     ]
-    ++ patches-binutils-2_44-fix-wine-older-than-10_2;
+    ++ patches-binutils-2_44-fix-wine-older-than-10_2
+    ++ patches-add-truncf-to-the-import-library;
 
     updateScript = writeShellScript "update-wine-stable" ''
       ${updateScriptPreamble}
@@ -133,9 +144,9 @@ rec {
 
   unstable = fetchurl rec {
     # NOTE: Don't forget to change the hash for staging as well.
-    version = "10.18";
+    version = "10.19";
     url = "https://dl.winehq.org/wine/source/10.x/wine-${version}.tar.xz";
-    hash = "sha256-Uftyc9ZdCd6gMsSl4hl7EnJLJ8o2DhpiKyNz0e5QrXs=";
+    hash = "sha256-fOxYMjxvKq7nrKk1Fzecu/75biwsWAxo/4XdAAy73UY=";
 
     patches = [
       # Also look for root certificates at $NIX_SSL_CERT_FILE
@@ -145,7 +156,7 @@ rec {
     # see https://gitlab.winehq.org/wine/wine-staging
     staging = fetchFromGitLab {
       inherit version;
-      hash = "sha256-vhIjeEbWLpcKtkBd/KeAeaLKOUZt7LAkH6GTebs3ROM=";
+      hash = "sha256-GmHeqHZPnFZkntMOJJzRDUN9H+G1qXdacy/Al6T5eZU=";
       domain = "gitlab.winehq.org";
       owner = "wine";
       repo = "wine-staging";
@@ -204,7 +215,8 @@ rec {
       # Also look for root certificates at $NIX_SSL_CERT_FILE
       ./cert-path.patch
     ]
-    ++ patches-binutils-2_44-fix-wine-older-than-10_2;
+    ++ patches-binutils-2_44-fix-wine-older-than-10_2
+    ++ patches-add-truncf-to-the-import-library;
 
     # see https://gitlab.winehq.org/wine/wine-staging
     staging = fetchFromGitLab {

diff --git a/pkgs/applications/gis/qgis/default.nix b/pkgs/applications/gis/qgis/default.nix
@@ -14,14 +14,12 @@
 }:
 let
   qgis-unwrapped = libsForQt5.callPackage ./unwrapped.nix {
-    withGrass = withGrass;
-    withServer = withServer;
-    withWebKit = withWebKit;
+    inherit withGrass withServer withWebKit;
   };
 in
 
 symlinkJoin {
-  inherit (qgis-unwrapped) version src;
+  inherit (qgis-unwrapped) version outputs src;
   pname = "qgis";
 
   paths = [ qgis-unwrapped ];
@@ -42,6 +40,8 @@ symlinkJoin {
         --prefix PATH : $program_PATH \
         --set PYTHONPATH $program_PYTHONPATH
     done
+
+    ln -s ${qgis-unwrapped.man} $man
   '';
 
   passthru = {

diff --git a/pkgs/applications/gis/qgis/unwrapped.nix b/pkgs/applications/gis/qgis/unwrapped.nix
@@ -83,6 +83,10 @@ in
 mkDerivation rec {
   version = "3.44.5";
   pname = "qgis-unwrapped";
+  outputs = [
+    "out"
+    "man"
+  ];
 
   src = fetchFromGitHub {
     owner = "qgis";
@@ -181,7 +185,7 @@ mkDerivation rec {
   dontWrapGApps = true; # wrapper params passed below
 
   postFixup = lib.optionalString withGrass ''
-    # GRASS has to be availble on the command line even though we baked in
+    # GRASS has to be available on the command line even though we baked in
     # the path at build time using GRASS_PREFIX.
     # Using wrapGAppsHook also prevents file dialogs from crashing the program
     # on non-NixOS.

diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -85,13 +85,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.2-8";
+  version = "7.1.2-11";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     tag = finalAttrs.version;
-    hash = "sha256-2jSQ59Wi6/1dbS/AgM1DfW6WlwoYuJlnTLoM8Mc6Ji8=";
+    hash = "sha256-RFiE23VW8AbVb7iglxjQMT6njDw+P7vLW6+nSKqN0p8=";
   };
 
   outputs = [

diff --git a/pkgs/applications/networking/cluster/helm/plugins/helm-schema.nix b/pkgs/applications/networking/cluster/helm/plugins/helm-schema.nix
@@ -46,7 +46,6 @@ buildGoModule (finalAttrs: {
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgram = "${placeholder "out"}/helm-schema/bin/schema";
-  versionCheckProgramArg = "--version";
 
   passthru.updateScript = nix-update-script { };
 

diff --git a/pkgs/applications/networking/cluster/k3s/builder.nix b/pkgs/applications/networking/cluster/k3s/builder.nix
@@ -456,7 +456,6 @@ buildGoModule (finalAttrs: {
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
-  versionCheckProgramArg = "--version";
 
   passthru = {
     inherit

diff --git a/pkgs/applications/networking/cluster/kubectl-view-allocations/default.nix b/pkgs/applications/networking/cluster/kubectl-view-allocations/default.nix
@@ -21,7 +21,6 @@ rustPlatform.buildRustPackage rec {
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
-  versionCheckProgramArg = "--version";
 
   meta = {
     description = "kubectl plugin to list allocations (cpu, memory, gpu,... X utilization, requested, limit, allocatable,...)";

diff --git a/pkgs/applications/networking/instant-messengers/linphone/bc-mbedtls/default.nix b/pkgs/applications/networking/instant-messengers/linphone/bc-mbedtls/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitLab,
+  fetchpatch,
 
   cmake,
   ninja,
@@ -27,6 +28,17 @@ stdenv.mkDerivation {
     fetchSubmodules = true;
   };
 
+  patches = [
+    # Fix build with gcc15
+    # https://www.github.com/Mbed-TLS/mbedtls/pull/10215
+    (fetchpatch {
+      name = "linphone-mbedtls-fix-unterminated-string-initialization.patch";
+      url = "https://github.com/Mbed-TLS/mbedtls/commit/d593c54b3cbfc3c806476a725e7d82763da0da9e.patch";
+      hash = "sha256-hh2cGzL75fEqlFNhEyL2fI9qsBW2Eq43DdWFD9qLsKE=";
+      excludes = [ "ChangeLog.d/unterminated-string-initialization.txt" ];
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     ninja

diff --git a/pkgs/applications/networking/irc/weechat/default.nix b/pkgs/applications/networking/irc/weechat/default.nix
@@ -174,7 +174,6 @@ stdenv.mkDerivation rec {
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
-  versionCheckProgramArg = "--version";
 
   passthru.updateScript = writeScript "update-weechat" ''
     #!/usr/bin/env nix-shell

diff --git a/pkgs/applications/networking/mullvad/mullvad.nix b/pkgs/applications/networking/mullvad/mullvad.nix
@@ -110,7 +110,6 @@ rustPlatform.buildRustPackage rec {
   nativeInstallCheckInputs = [
     versionCheckHook
   ];
-  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   passthru = {