staging-next 2026-02-08

doc/release-notes/rl-2605.section.md

@@ -9,6 +9,9 @@
 - Node.js default version has been updated from 22 LTS to 24 LTS.
   This introduces some breaking changes; Refer to the [upstream migration article](https://nodejs.org/en/blog/migrations/v22-to-v24) for details.
 
+- Ruby default version has been updated from 3.3 to 3.4.
+  Refer to the [upstream release announcement](https://www.ruby-lang.org/en/news/2024/12/25/ruby-3-4-0-released/) for details.
+
 - The Factor programming language has been updated to Version 0.101 bringing various improvements to UI rendering and HiDPI support as well as support for Unicode 17.0.0.
   Starting from Version 0.100, the Factor VM is compiled with Clang.
 
@@ -160,6 +163,8 @@
 
 - `services.openssh.settings.AcceptEnv` now explicitly defined as an option that takes a list of strings, to facilitate option merging. Setting it to a string value is no longer supported.
 
+- `nodejs-slim` has a `npm` and a `corepack` outputs, and `nodejs` no longer has a `libv8` output.
+
 - All Xfce packages have been moved to top level (e.g. if you previously added `pkgs.xfce.xfce4-whiskermenu-plugin` to `environment.systemPackages`, you will need to change it to `pkgs.xfce4-whiskermenu-plugin`). The `xfce` scope will be removed in NixOS 26.11.
 
 - `vimPlugins.nvim-treesitter` has been updated to `main` branch, which is a full and incompatible rewrite. If you can't or don't want to update, you should use `vimPlugins.nvim-treesitter-legacy`.
@@ -184,6 +189,8 @@
 
 - `fetchPnpmDeps` and `pnpmConfigHook` were added as top-level attributes, replacing the now deprecated `pnpm.fetchDeps` and `pnpm.configHook` attributes.
 
+- `buildNpmPackage` now supports `npmDepsCacheVersion`. Set to `2` to enable packument caching, which fixes builds for projects using npm workspaces.
+
 - Added `dell-bios-fan-control` package and service.
 
 - `openrgb` was updated to 1.0rc2, which now uses Plugin API version 4.

maintainers/scripts/luarocks-packages.csv

@@ -80,7 +80,7 @@ luaepnf,,,,,,
 luaevent,,,,,,
 luaexpat,,,,1.4.1-1,,arobyn flosse
 luaffi,,,https://luarocks.org/dev,,,
-luafilesystem,,,,1.8.0-1,,flosse
+luafilesystem,,,,,,flosse
 lualdap,,,,,,aanderse
 lualine.nvim,,,https://luarocks.org/dev,,,
 lualogging,,,,,,

nixos/modules/services/hardware/pcscd.nix

@@ -106,6 +106,8 @@ in
 
     services.pcscd.plugins = [ pkgs.ccid ];
 
+    services.udev.packages = [ pkgs.ccid ];
+
     systemd.sockets.pcscd.wantedBy = [ "sockets.target" ];
 
     systemd.services.pcscd = {
@@ -134,5 +136,12 @@ in
         "${lib.getExe package} -f -x -c ${cfgFile} ${lib.escapeShellArgs cfg.extraArgs}"
       ];
     };
+
+    users.users.pcscd = {
+      isSystemUser = true;
+      group = "pcscd";
+    };
+
+    users.groups.pcscd = { };
   };
 }

nixos/modules/services/home-automation/deye-dummycloud.nix

@@ -37,7 +37,7 @@ in
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
         WorkingDirectory = "${pkgs.deye-dummycloud}/lib/node_modules/deye-dummycloud";
-        ExecStart = "${pkgs.nodejs}/bin/node app.js";
+        ExecStart = "${pkgs.lib.getExe pkgs.nodejs-slim} app.js";
         Restart = "always";
         User = "deye-dummycloud";
         DynamicUser = true;

nixos/modules/services/matrix/appservice-irc.nix

@@ -229,7 +229,7 @@ in
           sed -i "s/^as_token:.*$/$as_token/g" ${registrationFile}
         fi
         if ! [ -f "${cfg.settings.ircService.mediaProxy.signingKeyPath}" ]; then
-          ${lib.getExe pkgs.nodejs} ${pkg}/lib/generate-signing-key.js > "${cfg.settings.ircService.mediaProxy.signingKeyPath}"
+          ${lib.getExe pkgs.nodejs-slim} ${pkg}/lib/generate-signing-key.js > "${cfg.settings.ircService.mediaProxy.signingKeyPath}"
         fi
         # Allow synapse access to the registration
         if ${pkgs.getent}/bin/getent group matrix-synapse > /dev/null; then

nixos/modules/services/misc/atuin.nix

@@ -104,7 +104,7 @@ in
       wantedBy = [ "multi-user.target" ];
 
       serviceConfig = {
-        ExecStart = "${lib.getExe cfg.package} server start";
+        ExecStart = "${lib.getExe' cfg.package "atuin-server"} start";
         RuntimeDirectory = "atuin";
         RuntimeDirectoryMode = "0700";
         DynamicUser = true;

nixos/modules/services/monitoring/uptime.nix

@@ -97,7 +97,7 @@ in
           NODE_PATH = "${pkgs.nodePackages.node-uptime}/lib/node_modules/node-uptime/node_modules";
         };
         preStart = "mkdir -p /var/lib/uptime";
-        serviceConfig.ExecStart = "${pkgs.nodejs}/bin/node ${pkgs.nodePackages.node-uptime}/lib/node_modules/node-uptime/app.js";
+        serviceConfig.ExecStart = "${pkgs.lib.getExe pkgs.nodejs-slim} ${pkgs.nodePackages.node-uptime}/lib/node_modules/node-uptime/app.js";
       };
 
       services.mongodb.enable = mkIf (!cfg.usesRemoteMongo) true;
@@ -115,7 +115,7 @@ in
         };
         # Ugh, need to wait for web service to be up
         preStart = if cfg.enableWebService then "sleep 1s" else "mkdir -p /var/lib/uptime";
-        serviceConfig.ExecStart = "${pkgs.nodejs}/bin/node ${pkgs.nodePackages.node-uptime}/lib/node_modules/node-uptime/monitor.js";
+        serviceConfig.ExecStart = "${pkgs.lib.getExe pkgs.nodejs-slim} ${pkgs.nodePackages.node-uptime}/lib/node_modules/node-uptime/monitor.js";
       };
     })
   ];

nixos/modules/services/web-apps/jitsi-meet.nix

@@ -25,7 +25,7 @@ let
       userJson = pkgs.writeText "user.json" (builtins.toJSON userCfg);
     in
     (pkgs.runCommand "${varName}.js" { } ''
-      ${pkgs.nodejs}/bin/node ${extractor} ${source} ${varName} > default.json
+      ${pkgs.lib.getExe pkgs.nodejs-slim} ${extractor} ${source} ${varName} > default.json
       (
         echo "var ${varName} = "
         ${pkgs.jq}/bin/jq -s '.[0] * .[1]' default.json ${userJson}

nixos/modules/services/web-apps/lemmy.nix

@@ -377,7 +377,7 @@ in
         serviceConfig = {
           DynamicUser = true;
           WorkingDirectory = "${cfg.ui.package}";
-          ExecStart = "${pkgs.nodejs}/bin/node ${cfg.ui.package}/dist/js/server.js";
+          ExecStart = "${pkgs.lib.getExe pkgs.nodejs-slim} ${cfg.ui.package}/dist/js/server.js";
         };
       };
     };

nixos/tests/all-tests.nix

@@ -1234,6 +1234,7 @@ in
   pass-secret-service = runTest ./pass-secret-service.nix;
   password-option-override-ordering = runTest ./password-option-override-ordering.nix;
   patroni = handleTestOn [ "x86_64-linux" ] ./patroni.nix { };
+  pcsclite = runTest ./pcsclite.nix;
   pdfding = import ./web-apps/pdfding {
     inherit (pkgs) lib;
     inherit runTest;

nixos/tests/installed-tests/appstream-qt.nix

@@ -1,7 +1,7 @@
 { pkgs, makeInstalledTest, ... }:
 
 makeInstalledTest {
-  tested = pkgs.libsForQt5.appstream-qt;
+  tested = pkgs.kdePackages.appstream-qt;
 
   testConfig = {
     appstream.enable = true;

nixos/tests/pcsclite.nix

@@ -0,0 +1,29 @@
+{
+  lib,
+  ...
+}:
+
+{
+  name = "pcsclite";
+  meta.maintainers = [ lib.maintainers.bjornfor ];
+
+  nodes = {
+    machine =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = [
+          pkgs.pcsc-tools
+        ];
+        services.pcscd = {
+          enable = true;
+        };
+      };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("pcscd.socket")
+
+    with subtest("client can connect"):
+        machine.succeed("pcsc_scan -r")
+  '';
+}

nixos/tests/web-apps/sshwifty/default.nix

@@ -25,7 +25,7 @@
     machine.wait_for_unit("sshwifty.service")
     machine.wait_for_open_port(80)
     machine.wait_until_succeeds("curl --fail -6 http://localhost/", timeout=60)
-    machine.wait_until_succeeds("${lib.getExe pkgs.nodejs} ${./sshwifty-test.js}", timeout=60)
+    machine.wait_until_succeeds("${lib.getExe pkgs.nodejs-slim} ${./sshwifty-test.js}", timeout=60)
   '';
 
   meta.maintainers = [ lib.maintainers.ungeskriptet ];

pkgs/applications/editors/vim/common.nix

@@ -1,6 +1,6 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.1.2035";
+  version = "9.1.2109";
 
   outputs = [
     "out"
@@ -11,7 +11,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-x7WosfqYApaY2Vv1X9+2at/A/KqfacuPy53MGtnxk9w=";
+    hash = "sha256-Lglu940Uf0ZOaitoI41XK4Xgk7e1UeXsfdIxOMgNQ18=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/editors/vim/plugins/non-generated/vim-clap/default.nix

@@ -33,6 +33,8 @@ let
     pname = "maple";
     inherit version src meta;
 
+    strictDeps = false;
+
     cargoHash = "sha256-RMDlLpPWDLHCRWLz7NAAQhp6FhKA7aNYqx9MCqR8vYM=";
 
     cargoPatches = [
@@ -59,6 +61,8 @@ vimUtils.buildVimPlugin {
   pname = "vim-clap";
   inherit version src meta;
 
+  strictDeps = false;
+
   postInstall = ''
     ln -s ${maple}/bin/maple $out/bin/maple
   '';

pkgs/applications/radio/gnuradio/default.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   # Remove gcc and python references
   removeReferencesTo,
@@ -309,6 +310,14 @@ stdenv.mkDerivation (
       patches = [
         # Not accepted upstream, see https://github.com/gnuradio/gnuradio/pull/5227
         ./modtool-newmod-permissions.patch
+
+        # Finding `boost_system` fails because the stub compiled library of
+        # Boost.System, which has been a header-only library since 1.69, was
+        # removed in 1.89.
+        (fetchpatch {
+          url = "https://github.com/gnuradio/gnuradio/commit/d8814e0c3ef68372e5a1093603ef602e2119cd8a.patch";
+          hash = "sha256-TQxqsce1AhSjdwaG2IP11QTeOgdJHN6cAAnznBl8eM8=";
+        })
       ];
       passthru = shared.passthru // {
         # Deps that are potentially overridden and are used inside GR plugins - the same version must

pkgs/build-support/bintools-wrapper/setup-hook.sh

@@ -55,7 +55,7 @@ fi
 export NIX_BINTOOLS${role_post}=@out@
 
 for cmd in \
-    ar as ld nm objcopy objdump readelf ranlib strip strings size windres
+    ar as ld nm objcopy objdump readelf ranlib strip strings size windres rc
 do
     if
         PATH=$_PATH type -p "@targetPrefix@${cmd}" > /dev/null
@@ -64,6 +64,16 @@ do
     fi
 done
 
+# If there is no `<prefix>rc`, but there is a `<prefix>windres`, define
+# `RC<suffix>=${WINDRES<suffix>}`.
+if
+    [[ ! -v "RC${role_post}" ]] && [[ -v "WINDRES${role_post}" ]]
+then
+    windres_var="WINDRES${role_post}"
+    export "RC${role_post}=${!windres_var}"
+    unset -v windres_var
+fi
+
 # If unset, assume the default hardening flags.
 : ${NIX_HARDENING_ENABLE="@default_hardening_flags_str@"}
 export NIX_HARDENING_ENABLE

pkgs/build-support/node/build-npm-package/default.nix

@@ -26,6 +26,9 @@ lib.extendMkDerivation {
       # The output hash of the dependencies for this project.
       # Can be calculated in advance with prefetch-npm-deps.
       npmDepsHash ? "",
+      # Fetcher format version for npmDeps. Set to 2 to enable packument caching
+      # for workspace support. Changing this will invalidate npmDepsHash.
+      npmDepsFetcherVersion ? 1,
       # Whether to force the usage of Git dependencies that have install scripts, but not a lockfile.
       # Use with care.
       forceGitDeps ? false,
@@ -66,6 +69,7 @@ lib.extendMkDerivation {
           ;
         name = "${name}-npm-deps";
         hash = npmDepsHash;
+        fetcherVersion = npmDepsFetcherVersion;
       },
       # Custom npmConfigHook
       npmConfigHook ? null,
@@ -85,6 +89,10 @@ lib.extendMkDerivation {
     {
       inherit npmDeps npmBuildScript;
 
+      env = (args.env or { }) // {
+        NIX_NPM_FETCHER_VERSION = npmDepsFetcherVersion;
+      };
+
       nativeBuildInputs =
         nativeBuildInputs
         ++ [

pkgs/build-support/node/build-npm-package/hooks/npm-config-hook.sh

@@ -28,6 +28,29 @@ npmConfigHook() {
         exit 1
     fi
 
+    if [[ -e "$npmDeps/.fetcher-version" ]]; then
+      local -r fetcherVersion=$(cat "$npmDeps/.fetcher-version")
+    else
+      local -r fetcherVersion="1"
+    fi
+
+    # Only run this in buildNpmPackage, this is just for a nicer error message; we trust that
+    # people using the setup hook directly also know how FODs work. ;)
+    if [[ -n ${NIX_NPM_FETCHER_VERSION+x} ]] && [[ $NIX_NPM_FETCHER_VERSION != $fetcherVersion ]]; then
+      echo
+      echo "ERROR: npmDepsHash is out of date"
+      echo
+      echo "The fetcher version in the arguments to buildNpmPackage ($NIX_NPM_FETCHER_VERSION) is not the same as the one in $npmDeps ($fetcherVersion)."
+      echo
+      echo "To fix the issue:"
+      echo '1. Use `lib.fakeHash` as the npmDepsHash value'
+      echo "2. Build the derivation and wait for it to fail with a hash mismatch"
+      echo "3. Copy the 'got: sha256-' value back into the npmDepsHash field"
+      echo
+
+      exit 1
+    fi
+
     local -r cacheLockfile="$npmDeps/package-lock.json"
     if [[ -f npm-shrinkwrap.json ]]; then
         local -r srcLockfile="$PWD/npm-shrinkwrap.json"
@@ -78,7 +101,11 @@ npmConfigHook() {
 
     local cachePath
 
-    if [ -z "${makeCacheWritable-}" ]; then
+    # When a given cache key has multiple entries (which is the case with
+    # fetcher version 2), npm always needs to write to the cache.
+    #
+    # TODO(winter): report upstream?
+    if [ -z "${makeCacheWritable-}" ] && (( fetcherVersion == 1 )); then
         cachePath="$npmDeps"
     else
         echo "Making cache writable"
@@ -100,9 +127,10 @@ npmConfigHook() {
         echo "ERROR: npm failed to install dependencies"
         echo
         echo "Here are a few things you can try, depending on the error:"
-        echo '1. Set `makeCacheWritable = true`'
+        echo '1. Set `npmDepsFetcherVersion = 2` (and update `npmDepsHash`)'
+        echo '2. Set `makeCacheWritable = true`'
         echo "  Note that this won't help if npm is complaining about not being able to write to the logs directory -- look above that for the actual error."
-        echo '2. Set `npmFlags = [ "--legacy-peer-deps" ]`'
+        echo '3. Set `npmFlags = [ "--legacy-peer-deps" ]`'
         echo
 
         exit 1

pkgs/build-support/node/prefetch-npm-deps/default.nix

@@ -215,6 +215,10 @@
       # A string with a JSON attrset specifying registry mirrors, for example
       #   {"registry.example.org": "my-mirror.local/registry.example.org"}
       npmRegistryOverridesString ? config.npmRegistryOverridesString,
+      # Fetcher format version. Bump this to invalidate all existing hashes.
+      # Version 1: original format (tarballs only)
+      # Version 2: includes packuments for workspace support
+      fetcherVersion ? 1,
       ...
     }@args:
     let
@@ -272,6 +276,10 @@
 
         NIX_NPM_REGISTRY_OVERRIDES = npmRegistryOverridesString;
 
+        # Fetcher version controls which features are enabled in prefetch-npm-deps
+        # Version 2+ enables packument fetching for workspace support
+        NPM_FETCHER_VERSION = toString fetcherVersion;
+
         SSL_CERT_FILE =
           if
             (