NixOS · K900 · Mar 3, 2026 · Mar 3, 2026 · Mar 3, 2026 · Mar 3, 2026
diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md
@@ -146,6 +146,8 @@
 
 - `python3Packages.gradio` has been updated to version 6. See upstream's migration guide at https://www.gradio.app/main/guides/gradio-6-migration-guide.
 
+- `python3Packages.pikepdf` no longer builds with mupdf support by default, which may be nice in Jupyter and iPython. Build with `withMupdf = true` if this is required.
+
 - `vicinae` has been updated to v0.20. This includes, among several other breaking changes, a complete overhaul of the configuration system. For update instructions, see the [upstream configuration documentation](https://docs.vicinae.com/config#migration-from-v0-16-x-to-v0-17-x).
 
 - The `man-pages` package's outputs have been split. The manual pages are installed into the `man` output, which is installed by default. Binaries (including `diffman-git`, `mansect`, `pdfman`, and `sortman`) are installed into the `out` output, which is not installed by default.
@@ -225,6 +227,8 @@
   If your SQLite database is corrupted, the migration might fail and require [manual intervention](https://github.com/louislam/uptime-kuma/issues/5281).
   See the [migration guide](https://github.com/louislam/uptime-kuma/wiki/Migration-From-v1-To-v2) for more information.
 
+- The `libcxxhardeningextensive` hardening flag has been **disabled** by default. Enabling it by default in 25.11 was unintentional and may have had a negative effect on performance in some cases. `libcxxhardeningfast` remains enabled by default.
+
 - Switch inhibitors were introduced, which add a pre-switch check that compares a list of strings between the previous and the new generation, and refuses to switch into the new generation when there is a difference between the two lists. This allows to avoid switching into a system when for instance the systemd version changed by adding `config.systemd.package.version` to the switch inhibitors for your system. You can still forcefully switch into any generation by setting `NIXOS_NO_CHECK=1`.
 
 - GNU Taler has been updated to version 1.3.
@@ -235,7 +239,7 @@
 
 - `fetchPnpmDeps` and `pnpmConfigHook` were added as top-level attributes, replacing the now deprecated `pnpm.fetchDeps` and `pnpm.configHook` attributes.
 
-- `buildNpmPackage` now supports `npmDepsCacheVersion`. Set to `2` to enable packument caching, which fixes builds for projects using npm workspaces.
+- `buildNpmPackage` now supports `npmDepsFetcherVersion` (and `fetchNpmDeps` now supports `fetcherVersion`). Set to `2` to enable packument caching, which fixes builds for projects using npm workspaces.
 
 - Added `dell-bios-fan-control` package and service.
 

diff --git a/doc/stdenv/stdenv.chapter.md b/doc/stdenv/stdenv.chapter.md
@@ -1631,13 +1631,11 @@ Adds the `-fzero-call-used-regs=used-gpr` compiler option. This causes the gener
 
 This flag adds the `-fstack-clash-protection` compiler option, which causes growth of a program's stack to access each successive page in order. This should force the guard page to be accessed and cause an attempt to "jump over" this guard page to crash.
 
-### Hardening flags disabled by default {#sec-hardening-flags-disabled-by-default}
-
-The following flags are disabled by default and should be enabled with `hardeningEnable` for packages that take untrusted input like network services.
+#### `libcxxhardeningfast` {#libcxxhardeningfast}
 
-#### `nostrictaliasing` {#nostrictaliasing}
+Adds the `-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_FAST` compiler flag. This flag only has an effect on libc++ targets, and when defined, enables a set of assertions that prevent undefined behavior caused by violating preconditions of the standard library. libc++ provides several hardening modes, and this "fast" mode contains a set of security-critical checks that can be done with relatively little overhead in constant time.
 
-This flag adds the `-fno-strict-aliasing` compiler option, which prevents the compiler from assuming code has been written strictly following the standard in regards to pointer aliasing and therefore performing optimizations that may be unsafe for code that has not followed these rules.
+Disabling `libcxxhardeningfast` implies disablement of checks from `libcxxhardeningextensive`.
 
 #### `strictflexarrays1` {#strictflexarrays1}
 
@@ -1647,6 +1645,14 @@ Enabling this flag on packages that still use length declarations of flexible ar
 
 Disabling `strictflexarrays1` implies disablement of `strictflexarrays3`.
 
+### Hardening flags disabled by default {#sec-hardening-flags-disabled-by-default}
+
+The following flags are disabled by default and should be enabled with `hardeningEnable` for packages that take untrusted input like network services.
+
+#### `nostrictaliasing` {#nostrictaliasing}
+
+This flag adds the `-fno-strict-aliasing` compiler option, which prevents the compiler from assuming code has been written strictly following the standard in regards to pointer aliasing and therefore performing optimizations that may be unsafe for code that has not followed these rules.
+
 #### `strictflexarrays3` {#strictflexarrays3}
 
 This flag adds the `-fstrict-flex-arrays=3` compiler option, which reduces the cases the compiler treats as "flexible arrays" to only those declared with length as (the correct) `[]`. This increases the coverage of fortify checks, because such arrays declared as the trailing element of a structure can normally not have their intended length determined by the compiler.
@@ -1683,12 +1689,6 @@ Adds the `-D_GLIBCXX_ASSERTIONS` compiler flag. This flag only has an effect on
 
 These checks may have an impact on performance in some cases.
 
-#### `libcxxhardeningfast` {#libcxxhardeningfast}
-
-Adds the `-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_FAST` compiler flag. This flag only has an effect on libc++ targets, and when defined, enables a set of assertions that prevent undefined behavior caused by violating preconditions of the standard library. libc++ provides several hardening modes, and this "fast" mode contains a set of security-critical checks that can be done with relatively little overhead in constant time.
-
-Disabling `libcxxhardeningfast` implies disablement of checks from `libcxxhardeningextensive`.
-
 #### `libcxxhardeningextensive` {#libcxxhardeningextensive}
 
 Adds the `-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_EXTENSIVE` compiler flag. This flag only has an effect on libc++ targets, and when defined, enables a set of assertions that prevent undefined behavior caused by violating preconditions of the standard library. libc++ provides several hardening modes, and this "extensive" mode adds checks for undefined behavior that incur relatively little overhead but aren’t security-critical. The additional rigour impacts performance more than fast mode: benchmarking is recommended to determine if it is acceptable for a particular application.

diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -239,6 +239,8 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
 
 - `services.caddy` now supports setting `httpPort` and `httpsPort` and opening them in the firewall via `openFirewall`.
 
+- `boot.initrd.secrets` is now deprecated in favour of `boot.initrd.secretPaths` and `boot.initrd.extraSecretsHook`.
+
 - The latest available version of Nextcloud is v33 (available as `pkgs.nextcloud33`). The installation logic is as follows:
   - If [`services.nextcloud.package`](#opt-services.nextcloud.package) is specified explicitly, this package will be installed (**recommended**)
   - If [`system.stateVersion`](#opt-system.stateVersion) is >=26.05, `pkgs.nextcloud33` will be installed by default.

diff --git a/nixos/lib/test-driver/src/test_driver/__init__.py b/nixos/lib/test-driver/src/test_driver/__init__.py
diff --git a/nixos/modules/config/system-path.nix b/nixos/modules/config/system-path.nix
@@ -214,6 +214,7 @@ in
       postBuild = ''
         # Remove wrapped binaries, they shouldn't be accessible via PATH.
         find $out/bin -maxdepth 1 -name ".*-wrapped" -type l -delete
+        find $out/bin -maxdepth 1 -name ".*-wrapped_*" -type l -delete
 
         if [ -x $out/bin/glib-compile-schemas -a -w $out/share/glib-2.0/schemas ]; then
             $out/bin/glib-compile-schemas $out/share/glib-2.0/schemas

diff --git a/nixos/modules/config/unix-odbc-drivers.nix b/nixos/modules/config/unix-odbc-drivers.nix
@@ -1,5 +1,5 @@
 { config, lib, ... }:
-# unixODBC drivers (this solution is not perfect.. Because the user has to
+# unixodbc drivers (this solution is not perfect.. Because the user has to
 # ask the admin to add a driver.. but it's simple and works
 
 let
@@ -17,11 +17,11 @@ in
     environment.unixODBCDrivers = lib.mkOption {
       type = lib.types.listOf lib.types.package;
       default = [ ];
-      example = lib.literalExpression "with pkgs.unixODBCDrivers; [ sqlite psql ]";
+      example = lib.literalExpression "with pkgs.unixodbcDrivers; [ sqlite psql ]";
       description = ''
         Specifies Unix ODBC drivers to be registered in
         {file}`/etc/odbcinst.ini`.  You may also want to
-        add `pkgs.unixODBC` to the system path to get
+        add `pkgs.unixodbc` to the system path to get
         a command line client to connect to ODBC databases.
       '';
     };

diff --git a/nixos/modules/services/home-automation/home-assistant.nix b/nixos/modules/services/home-automation/home-assistant.nix
@@ -566,6 +566,16 @@ in
       '';
     };
 
+    finalPackage = mkOption {
+      default = package;
+      internal = true;
+      readOnly = true;
+      type = types.package;
+      description = ''
+        The final Home Assistant package which is being used in the service.
+      '';
+    };
+
     openFirewall = mkOption {
       default = false;
       type = types.bool;

diff --git a/nixos/modules/services/networking/iscsi/root-initiator.nix b/nixos/modules/services/networking/iscsi/root-initiator.nix
@@ -86,7 +86,7 @@ in
       description = ''
         Append an additional file's contents to `/etc/iscsid.conf`. Use a non-store path
         and store passwords in this file. Note: the file specified here must be available
-        in the initrd, see: `boot.initrd.secrets`.
+        in the initrd, see: `boot.initrd.secretPaths`.
       '';
       default = null;
       type = nullOr str;

diff --git a/nixos/modules/system/activation/bootspec.nix b/nixos/modules/system/activation/bootspec.nix
@@ -14,7 +14,9 @@ let
   children = lib.mapAttrs (
     childName: childConfig: childConfig.configuration.system.build.toplevel
   ) config.specialisation;
-  hasAtLeastOneInitrdSecret = lib.length (lib.attrNames config.boot.initrd.secrets) > 0;
+  hasInitrdSecrets =
+    (lib.length (lib.attrNames config.boot.initrd.secretPaths) > 0)
+    || (config.boot.initrd.extraSecretsHook != "");
   schemas = {
     v1 = rec {
       filename = "boot.json";
@@ -33,7 +35,7 @@ let
               // lib.optionalAttrs config.boot.initrd.enable {
                 initrd = "${config.system.build.initialRamdisk}/${config.system.boot.loader.initrdFile}";
               }
-              // lib.optionalAttrs hasAtLeastOneInitrdSecret {
+              // lib.optionalAttrs hasInitrdSecrets {
                 initrdSecrets = "${config.system.build.initialRamdiskSecretAppender}/bin/append-initrd-secrets";
               };
             }

diff --git a/nixos/modules/system/boot/clevis.nix b/nixos/modules/system/boot/clevis.nix
@@ -99,8 +99,8 @@ in
         sed -i $out/bin/clevis-decrypt-tpm2 -e 's,tpm2_,tpm2 ,'
       '';
 
-      secrets = lib.mapAttrs' (
-        name: value: lib.nameValuePair "/etc/clevis/${name}.jwe" value.secretFile
+      secretPaths = lib.mapAttrs' (
+        name: value: lib.nameValuePair "/etc/clevis/${name}.jwe" { source = value.secretFile; }
       ) cfg.devices;
 
       systemd = {

diff --git a/nixos/modules/system/boot/initrd-openvpn.nix b/nixos/modules/system/boot/initrd-openvpn.nix
@@ -29,7 +29,7 @@ in
     };
 
     boot.initrd.network.openvpn.configuration = mkOption {
-      type = types.path; # Same type as boot.initrd.secrets
+      type = types.path; # Same type as boot.initrd.secretPaths.*.source
       description = ''
         The configuration file for OpenVPN.
 
@@ -74,8 +74,8 @@ in
       "${pkgs.glibc}/lib/libnss_dns.so.2"
     ];
 
-    boot.initrd.secrets = {
-      "/etc/initrd.ovpn" = cfg.configuration;
+    boot.initrd.secretPaths = {
+      "/etc/initrd.ovpn".source = cfg.configuration;
     };
 
     # openvpn --version would exit with 1 instead of 0

diff --git a/nixos/modules/system/boot/initrd-ssh.nix b/nixos/modules/system/boot/initrd-ssh.nix
@@ -302,8 +302,8 @@ in
         fi
       '';
 
-      boot.initrd.secrets = listToAttrs (
-        map (path: nameValuePair (initrdKeyPath path) path) cfg.hostKeys
+      boot.initrd.secretPaths = listToAttrs (
+        map (path: nameValuePair (initrdKeyPath path) { source = path; }) cfg.hostKeys
       );
 
       # Systemd initrd stuff

diff --git a/nixos/modules/system/boot/kernel.nix b/nixos/modules/system/boot/kernel.nix
@@ -414,7 +414,7 @@ in
 
           ln -s ${initrdPath} $out/initrd
 
-          ${optionalString (config.boot.initrd.secrets != { }) ''
+          ${optionalString (config.boot.initrd.secretPaths != { }) ''
             ln -s ${config.system.build.initialRamdiskSecretAppender}/bin/append-initrd-secrets $out
           ''}
 

diff --git a/nixos/modules/system/boot/loader/grub/grub.nix b/nixos/modules/system/boot/loader/grub/grub.nix
@@ -935,21 +935,21 @@ in
     '')
     (mkRemovedOptionModule [ "boot" "loader" "grub" "extraInitrd" ] ''
       This option has been replaced with the bootloader agnostic
-      boot.initrd.secrets option. To migrate to the initrd secrets system,
+      boot.initrd.secretPaths option. To migrate to the initrd secrets system,
       extract the extraInitrd archive into your main filesystem:
 
         # zcat /boot/extra_initramfs.gz | cpio -idvmD /etc/secrets/initrd
         /path/to/secret1
         /path/to/secret2
 
-      then replace boot.loader.grub.extraInitrd with boot.initrd.secrets:
+      then replace boot.loader.grub.extraInitrd with boot.initrd.secretPaths:
 
-        boot.initrd.secrets = {
-          "/path/to/secret1" = "/etc/secrets/initrd/path/to/secret1";
-          "/path/to/secret2" = "/etc/secrets/initrd/path/to/secret2";
+        boot.initrd.secretPaths = {
+          "/path/to/secret1".source = "/etc/secrets/initrd/path/to/secret1";
+          "/path/to/secret2".source = "/etc/secrets/initrd/path/to/secret2";
         };
 
-      See the boot.initrd.secrets option documentation for more information.
+      See the boot.initrd.secretPaths option documentation for more information.
     '')
   ];
 

diff --git a/nixos/modules/system/boot/loader/grub/install-grub.pl b/nixos/modules/system/boot/loader/grub/install-grub.pl
@@ -482,7 +482,7 @@ sub addEntry {
               die "failed to create initrd secrets $!\n";
           } else {
               say STDERR "warning: failed to create initrd secrets for \"$name\", an older generation";
-              say STDERR "note: this is normal after having removed or renamed a file in `boot.initrd.secrets`";
+              say STDERR "note: this is normal after having modified or removed an entry in `boot.initrd.secretPaths`";
           }
         }
         # Check whether any secrets were actually added

diff --git a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
@@ -202,7 +202,7 @@ def write_entry(profile: str | None, generation: int, specialisation: str | None
             print("warning: failed to create initrd secrets "
                   f'for "{title} - Configuration {generation}", an older generation', file=sys.stderr)
             print("note: this is normal after having removed "
-                  "or renamed a file in `boot.initrd.secrets`", file=sys.stderr)
+                  "or modified an entry in `boot.initrd.secretPaths`", file=sys.stderr)
     entry_file = BOOT_MOUNT_POINT / "loader/entries" / generation_conf_filename(profile, generation, specialisation)
     tmp_path = entry_file.with_suffix(".tmp")
     kernel_params = "init=%s " % bootspec.init