qbit/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
master
nixpkgs/nixos/doc/manual/release-notes/rl-2411.section.md

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

978 lines
74 KiB
Markdown
Raw Permalink Normal View History

doc/release-notes: update codename
2024-05-22 10:48:39 -06:00
# Release 24.11 (“Vicuña”, 2024.11/??) {#sec-release-24.11}
24.05 is Vicuña
2024-05-22 10:15:34 -06:00
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
## Highlights {#sec-release-24.11-highlights}
nixos/rl-2411: Add Nix update
2024-08-17 06:15:07 -06:00
- Nix was updated to 2.24, which brings a lot of improvements and fixes. See the release notes for
[2.19](https://nix.dev/manual/nix/latest/release-notes/rl-2.19),
[2.20](https://nix.dev/manual/nix/latest/release-notes/rl-2.20),
[2.21](https://nix.dev/manual/nix/latest/release-notes/rl-2.21),
[2.22](https://nix.dev/manual/nix/latest/release-notes/rl-2.22),
[2.23](https://nix.dev/manual/nix/latest/release-notes/rl-2.23),
[2.24](https://nix.dev/manual/nix/latest/release-notes/rl-2.24).
doc/release-notes: cleanup highlights The main goal is to make these highlights a bit more concise, consistently link to newly introduced option definitions, and (somewhat subjectively) improve word choice to avoid repetition and have a better flow
2024-10-02 20:41:27 -06:00
Notable changes include improvements to Git fetching, documentation comment support in `nix-repl> :doc`, as well as many quality of life additions.
nixos/doc/rl-2411: warn about upcoming macOS version requirement For a long time now, the SDK and minimum target version for `x86_64-darwin` has been stuck on macOS 10.12. In the past, the minimum SDK was updated quite regularly; at first, the current situation was just because updating the SDKs was excessively burdensome and nobody was up for doing the work, but the introduction of `aarch64-darwin` with its macOS 11 default SDK has resulted in a long‐term fracture of the two platforms. Per <https://endoflife.date/macos>, macOS 10.12 has not received an update since 2017 and went out of security support 5 years ago. Trying to support it in Nixpkgs has been a large burden on the Darwin maintainers, resulting in workarounds, porting work, and even patching functionality out of applications. The existence of Nix users using a macOS version this old is, to my knowledge, entirely theoretical, and we pay in both maintenance costs and functionality: for instance, applications built for `x86_64-darwin` do not support automatic dark mode switching by default. This situation has always been suboptimal, but it is now becoming untenable. Python, a critical component of the Nixpkgs standard environment for builds, is dropping support for versions older than 10.13 in 3.13: <https://www.python.org/downloads/release/python-3130rc1/>. Qt 6 only supports macOS 11 and newer. libuv only supports the versions Apple does, and is a ticking time bomb due to its use in the standard environment. QEMU only supports the last two macOS releases, and won’t build with an SDK older than macOS 12; we previously vendored a set of backporting changes and functionality‐removing reverts to keep it building for 10.12, but this also became overly onerous, and we gave up in <https://github.com/NixOS/nixpkgs/pull/338598>. `x86_64-darwin` is a platform with a limited upstream future. Apple no longer sells any hardware that runs it natively, and it is unclear how much longer they will support it in the operating system. There are still many users of the platform, myself included, so we shouldn’t drop support for it prematurely, but it’s unreasonable to try and patch the entire world to keep it supporting insecure versions of the OS that only run on hardware that is no longer sold. Therefore, this adds a release note to warn users ahead of time that 25.05 will only support macOS 11 and newer, as suggested by the 24.05 release team when the possibility of bumping the required version was raised. Why target Big Sur, rather than any other version? The reason is simple: it’s the same SDK and deployment target as `aarch64-darwin`. There are many packages that work on `aarch64-darwin` but not `x86_64-darwin`, and Darwin maintainers frequently need to be called in to fix things that work fine on the newer platform but not the older one. This change will increase the health of `x86_64-darwin` by aligning the SDK versions and support between the two platforms; the vast majority of packages that work on one will Just Work on the other. macOS 11 is almost four years old and has itself been out of security support for a year now, but as the first version to support Apple Silicon, it’s a far more compatible base for us to build our Darwin packages for. Any future change in supported versions should be synchronized between the two Darwin architectures. When 25.05 is released, users on old, unsupported versions of macOS will have the following options: * Update to a new macOS version. For users that are on hardware that Apple has dropped support for, OpenCore Legacy Patcher (<https://dortania.github.io/OpenCore-Legacy-Patcher/>) can enable the use of newer macOS versions on hardware even older than 10.12 supports. * Install NixOS. That obviously precludes the use of macOS software (though most of that software has already dropped support for 10.12), but will give users a secure, supported operating system that we can actually own the support for going forward. * Keep using 24.11 forever. Since they’re not getting updates to their OS and core applications anyway, this is likely to be acceptable to many users. * Switch to MacPorts. They support all the way back to 10.6 for `x86_64-darwin` by building packages separately for every OS release, though not every package is available for every version. * Send patches. We *may* accept non‐invasive patches to keep certain critical packages (such as the core `stdenv` packages) building for old OS versions, on a case‐by‐case basis, but we can’t guarantee it. This will ultimately have to be a decision made by package maintainers and personally I doubt this will be a viable path to sustainably support older versions.
2024-08-31 16:29:08 -06:00
nixos/doc/rl-2411: add highlight for the Darwin changes
2024-11-17 03:52:51 -07:00
- There have been significant changes to macOS support.
- The build environment has been redesigned to be closer to a native Xcode toolchain, enabling us to provide all SDKs from macOS Sierra 10.12 to macOS Sequoia 15, simplify build definitions, and build more software without hacks or patching.
Although compatibility shims for the old SDK scheme are provided, some builds may break, and the old mechanisms will be removed by 25.11 at the latest.
See the [Darwin section](https://nixos.org/manual/nixpkgs/stable/#sec-darwin) of the Nixpkgs manual for details of the new scheme and how to use it, and [the announcement on Discourse](https://discourse.nixos.org/t/the-darwin-sdks-have-been-updated/55295) for more information on the changes and benefits.
- **This will be the last release of Nixpkgs to support macOS Sierra 10.12 to macOS Catalina 10.15.**
Starting with release 25.05, the minimum supported version will be macOS Big Sur 11, and we cannot guarantee that packages will continue to work on older versions of macOS.
Users on old macOS versions should consider upgrading to a supported version (potentially using [OpenCore Legacy Patcher](https://dortania.github.io/OpenCore-Legacy-Patcher/) for old hardware) or installing NixOS.
If neither of those options are viable and you require new versions of software, [MacPorts](https://www.macports.org/) supports versions back to Mac OS X Snow Leopard 10.6.
cudaPackages_{10*,11*}: warn about upcoming removal We currently package all CUDA versions from 10.0 onwards. In some cases, CUDA is the only thing preventing us from removing old versions of GCC. Since we currently don’t deprecate or remove CUDA versions, this will be an increasing drag on compiler maintenance in Nixpkgs going forward unless we establish a sensible policy. After discussing this with @SomeoneSerge in the context of old versions of GCC, I learned that there was already a desire to remove at least versions prior to 11.3, as those versions were only packaged in the old “runfile” format, but that it was blocked on someone doing the work to warn about the upcoming deprecation for a release cycle. This change adds a release note and warnings indicating that CUDA 10.x and 11.x will be removed in Nixpkgs 25.05, about 8 months from now. I chose this version cut‐off because these versions of CUDA require GCC < 12. GCC releases a major version every year, and seems to support about four releases at a time, releasing the last update to the oldest version and marking it as unsupported on their site around the time of the release of the next major version. Therefore, by the time of the 25.05 release, we should expect GCC 15 to be released and GCC 11 to become unsupported. Adding a warning and communicating the policy of only shipping CUDA versions that work with supported compilers in the release notes means that we should be able to clean up old versions as required without any issue or extensive deprecation period in future, without obligating us to do so if there is a strongly compelling reason to be more lenient. That should help solve both shipping an indefinitely‐growing list of CUDA versions and an indefinitely‐growing list of GCC and LLVM versions. As I’m not a user of CUDA myself, I can’t be sure of how sensible this version support policy is, but I think it’s fair to say that it’s reasonable for Nixpkgs to choose not to maintain compiler versions that are unsupported upstream just for the sake of versions of CUDA that are also unmaintained. CUDA 11.x has not received an update for two years already, and would only become unsupported in Nixpkgs in over half a year’s time. CUDA 10.x is currently unused in‐tree except for the unmaintained Caffe and NVIDIA DCGM, which depends on multiple CUDA versions solely so that it can provide plugins for those versions. The latest DCGM version has already removed support for CUDA 10.x and is just awaiting an update in Nixpkgs. They maintain a list of supported versions to build plugins for in their CMake build system, so it should be simple enough for us to only build support for the versions of CUDA that we support in Nixpkgs. From what I can tell, CUDA 11.x is currently used by the following packages other than DCGM: * `catboost`, because of <https://github.com/catboost/catboost/issues/2540>. It looks like upstream has since redesigned this part of their build system, so perhaps the problem is no longer present, or would be easier to fix. * `magma_2_6_2`, an old version from before upstream added CUDA 12 support. This seems okay to break to me; that version is not maintained and will never be updated for new CUDA versions, and the CUDA support is optional. * `paddlepaddle`, which, uh, also requires OpenSSL 1.1 of all things. <https://github.com/PaddlePaddle/Paddle/issues/67571> states that PaddlePaddle supports up to 12.3. * `python3Packages.cupy`, which is listed as “possibly incompatible with cutensor 2.0 that comes with `cudaPackages_12`”. I’m not sure what the “possibly” means here, but according to <https://github.com/cupy/cupy/tree/v13.3.0?tab=readme-ov-file#installation> they ship binary wheels using CUDA 12.x so I think this should be fine. * `python3Packages.tensorrt`, which supports CUDA 12.x going by <https://github.com/NVIDIA/TensorRT/blob/release/10.4/CMakeLists.txt#L111>. * TensorFlow, which has a link to <https://www.tensorflow.org/install/source#gpu> above the `python3Packages.tensorflow-bin` definition, but that page lists the versions we package as supporting CUDA 12.x. Given the years since CUDA 11.x received any update upstream, and the seemingly very limited set of packages that truly require it, I think the policy of being able to drop versions that require unsupported compilers starting from the next Nixpkgs release is a reasonable one, but of course I’m open to feedback from the CUDA maintainers about this.
2024-09-15 10:16:06 -06:00
- This will be the last release of Nixpkgs to support versions of CUDA prior to CUDA 12.0.
These versions only work with old compiler versions that will be unsupported by the time of the Nixpkgs 25.05 release.
doc/release-notes: cleanup highlights The main goal is to make these highlights a bit more concise, consistently link to newly introduced option definitions, and (somewhat subjectively) improve word choice to avoid repetition and have a better flow
2024-10-02 20:41:27 -06:00
In the future, users should expect CUDA versions to be dropped as the compiler versions they require leave upstream support windows.
- Convenience options for `amdgpu`, the open source driver for Radeon cards, are now available under [`hardware.amdgpu`](#opt-hardware.amdgpu.initrd.enable).
cudaPackages_{10*,11*}: warn about upcoming removal We currently package all CUDA versions from 10.0 onwards. In some cases, CUDA is the only thing preventing us from removing old versions of GCC. Since we currently don’t deprecate or remove CUDA versions, this will be an increasing drag on compiler maintenance in Nixpkgs going forward unless we establish a sensible policy. After discussing this with @SomeoneSerge in the context of old versions of GCC, I learned that there was already a desire to remove at least versions prior to 11.3, as those versions were only packaged in the old “runfile” format, but that it was blocked on someone doing the work to warn about the upcoming deprecation for a release cycle. This change adds a release note and warnings indicating that CUDA 10.x and 11.x will be removed in Nixpkgs 25.05, about 8 months from now. I chose this version cut‐off because these versions of CUDA require GCC < 12. GCC releases a major version every year, and seems to support about four releases at a time, releasing the last update to the oldest version and marking it as unsupported on their site around the time of the release of the next major version. Therefore, by the time of the 25.05 release, we should expect GCC 15 to be released and GCC 11 to become unsupported. Adding a warning and communicating the policy of only shipping CUDA versions that work with supported compilers in the release notes means that we should be able to clean up old versions as required without any issue or extensive deprecation period in future, without obligating us to do so if there is a strongly compelling reason to be more lenient. That should help solve both shipping an indefinitely‐growing list of CUDA versions and an indefinitely‐growing list of GCC and LLVM versions. As I’m not a user of CUDA myself, I can’t be sure of how sensible this version support policy is, but I think it’s fair to say that it’s reasonable for Nixpkgs to choose not to maintain compiler versions that are unsupported upstream just for the sake of versions of CUDA that are also unmaintained. CUDA 11.x has not received an update for two years already, and would only become unsupported in Nixpkgs in over half a year’s time. CUDA 10.x is currently unused in‐tree except for the unmaintained Caffe and NVIDIA DCGM, which depends on multiple CUDA versions solely so that it can provide plugins for those versions. The latest DCGM version has already removed support for CUDA 10.x and is just awaiting an update in Nixpkgs. They maintain a list of supported versions to build plugins for in their CMake build system, so it should be simple enough for us to only build support for the versions of CUDA that we support in Nixpkgs. From what I can tell, CUDA 11.x is currently used by the following packages other than DCGM: * `catboost`, because of <https://github.com/catboost/catboost/issues/2540>. It looks like upstream has since redesigned this part of their build system, so perhaps the problem is no longer present, or would be easier to fix. * `magma_2_6_2`, an old version from before upstream added CUDA 12 support. This seems okay to break to me; that version is not maintained and will never be updated for new CUDA versions, and the CUDA support is optional. * `paddlepaddle`, which, uh, also requires OpenSSL 1.1 of all things. <https://github.com/PaddlePaddle/Paddle/issues/67571> states that PaddlePaddle supports up to 12.3. * `python3Packages.cupy`, which is listed as “possibly incompatible with cutensor 2.0 that comes with `cudaPackages_12`”. I’m not sure what the “possibly” means here, but according to <https://github.com/cupy/cupy/tree/v13.3.0?tab=readme-ov-file#installation> they ship binary wheels using CUDA 12.x so I think this should be fine. * `python3Packages.tensorrt`, which supports CUDA 12.x going by <https://github.com/NVIDIA/TensorRT/blob/release/10.4/CMakeLists.txt#L111>. * TensorFlow, which has a link to <https://www.tensorflow.org/install/source#gpu> above the `python3Packages.tensorflow-bin` definition, but that page lists the versions we package as supporting CUDA 12.x. Given the years since CUDA 11.x received any update upstream, and the seemingly very limited set of packages that truly require it, I think the policy of being able to drop versions that require unsupported compilers starting from the next Nixpkgs release is a reasonable one, but of course I’m open to feedback from the CUDA maintainers about this.
2024-09-15 10:16:06 -06:00
doc/release-notes: cleanup highlights The main goal is to make these highlights a bit more concise, consistently link to newly introduced option definitions, and (somewhat subjectively) improve word choice to avoid repetition and have a better flow
2024-10-02 20:41:27 -06:00
- [AMDVLK](https://github.com/GPUOpen-Drivers/AMDVLK), AMD's open source Vulkan driver, is now available to be configured under the [`hardware.amdgpu.amdvlk`](#opt-hardware.amdgpu.amdvlk.enable) option.
This also allows configuring runtime settings for AMDVLK, including enabling experimental features.
docs/release-notes: 24.11: add amdgpu module
2024-06-14 12:12:13 -06:00
doc/release-notes: cleanup highlights The main goal is to make these highlights a bit more concise, consistently link to newly introduced option definitions, and (somewhat subjectively) improve word choice to avoid repetition and have a better flow
2024-10-02 20:41:27 -06:00
- The `moonlight-qt` package (for [Moonlight game streaming](https://moonlight-stream.org/)) now has HDR support on Linux systems.
24.05 is Vicuña
2024-05-22 10:15:34 -06:00
nixos/release-notes-24.11: add scx module
2024-10-30 01:35:18 -06:00
- [Sched-ext](https://github.com/sched-ext/scx), a Linux kernel feature to run schedulers in userspace, is now available [`services.scx`](options.html#opt-services.scx.enable).
Requires Linux kernel version 6.12 or later.
postgresql: 15 -> 16 for 24.11+ Upgrade default postgresql for stateVersion >=24.11. This also rebuilds all packages linking against `libpq.so` to use postgresql 16. After re-reading https://www.postgresql.org/docs/16/release-16.html I don't see any major risks about doing that.
2024-07-24 02:43:02 -06:00
- PostgreSQL now defaults to major version 16.
nixos/rl-2411: Mention GNOME 47
2024-10-02 19:28:32 -06:00
- GNOME has been updated to version 47. Refer to the [release notes](https://release.gnome.org/47/) for more details.
authelia: 4.37.5 -> 4.38.9
2024-03-27 10:42:29 -06:00
- `authelia` has been upgraded to version 4.38. This version brings several features and improvements which are detailed in the [release blog post](https://www.authelia.com/blog/4.38-release-notes/).
doc/release-notes: cleanup highlights The main goal is to make these highlights a bit more concise, consistently link to newly introduced option definitions, and (somewhat subjectively) improve word choice to avoid repetition and have a better flow
2024-10-02 20:41:27 -06:00
This release also deprecates some configuration keys which are likely to be removed in version 5.0.0.
authelia: 4.37.5 -> 4.38.9
2024-03-27 10:42:29 -06:00
nixos/netbird: fix port conflict on metrics endpoint
2024-11-18 15:38:40 -07:00
- `netbird` has been updated to 0.31.1. This adds a built-in relay server which is not yet supported by the NixOS module, as well as a metrics endpoint for both the management and signal services. The default metrics port for the `signal` service has been changed from `9090` to `9091` to prevent a port conflict with the management server. This can be changed with their respective `metricsPort` as needed. Refer to the [release notes](https://github.com/netbirdio/netbird/releases/tag/v0.31.1) and [this pull request](https://github.com/NixOS/nixpkgs/pull/354032#issuecomment-2480925927) for more information.
add compressDrv and compressDrvWeb *compressDrv* compresses files in a given derivation. *compressDrvWeb* compresses a derivation for a loosely-defined pre-compressed "web server" usage. This intends to replace the `passthru.data-compressed` derivations that have accumulated in nixpkgs with something more reusable.
2024-02-29 04:53:30 -07:00
- `compressDrv` can compress selected files in a derivation. `compressDrvWeb` compresses files for common web server usage (`.gz` with `zopfli`, `.br` with `brotli`).
doc/release-notes: cleanup highlights The main goal is to make these highlights a bit more concise, consistently link to newly introduced option definitions, and (somewhat subjectively) improve word choice to avoid repetition and have a better flow
2024-10-02 20:41:27 -06:00
- [`hardware.display`](#opt-hardware.display.edid.enable) is a new module implementing workarounds for misbehaving monitors
by setting up custom EDID files and forcing kernel/framebuffer modes.
nixos/hardware.display: init
2024-01-22 03:46:33 -07:00
doc/release-notes: cleanup highlights The main goal is to make these highlights a bit more concise, consistently link to newly introduced option definitions, and (somewhat subjectively) improve word choice to avoid repetition and have a better flow
2024-10-02 20:41:27 -06:00
- [`services.displayManager.ly`](#opt-services.displayManager.ly.enable) is a new module for configuring the display manager [ly](https://github.com/fairyglade/ly),
a TUI-based replacement for SDDM and LightDM meant for window manager users.
nixos/ly: init module
2024-03-20 02:48:22 -06:00
doc/rl-2411: Document srcOnly changes
2024-09-28 16:43:20 -06:00
- `srcOnly` was rewritten to be more readable, have additional warnings in the event that something is probably wrong, use the `stdenv` provided by the derivation, and Noogle-compatible documentation was added.
doc/rl-2411: add PipeWire note
2024-09-04 04:50:52 -06:00
- The default sound server for most graphical sessions has been switched from PulseAudio to PipeWire.
doc/release-notes: cleanup highlights The main goal is to make these highlights a bit more concise, consistently link to newly introduced option definitions, and (somewhat subjectively) improve word choice to avoid repetition and have a better flow
2024-10-02 20:41:27 -06:00
Users that want to keep using PulseAudio will want to set `services.pipewire.enable = false;` and `hardware.pulseaudio.enable = true;`.
doc/rl-2411: add PipeWire note
2024-09-04 04:50:52 -06:00
There is currently no plan to fully deprecate and remove PulseAudio, however, PipeWire should generally be preferred for new installs.
nixos: switch to `switch-to-configuration-ng` by default The Rust `switch-to-configuration-ng` rewrite was carefully written to be compatible with the original Perl script, has been checked against NixOS VM tests, and has been available on an opt‐in basis for testing for the 24.05 release cycle. The next step towards replacing the Perl script entirely is to switch it on by default so that we can get real‐world testing from a much greater number of users. Maintaining two implementations in parallel is becoming a burden; we are having to adjust the systemd service activation behaviour slightly to fix a long‐standing bug, and backporting the changes to the Perl script is an unpleasant process. We will do it anyway to ensure that the Rust and Perl implementations keep parity with each other throughout the 24.11 release cycle, but we think the time has come to flip the switch. Taking this step now will give us two to three months to test this in the wild before the 24.11 release and gain confidence that there are no regressions. If any non‐trivial problems arise before the final release, we will revert to the Perl implementation by default. Doing this switch ASAP will help to disentangle any problems that might arise from the Rust implementation from problems that arise from the systemd service activation changes, or the upcoming switch to using systemd in stage 1 by default. The main concern that was raised about replacing the Perl script in the PR that added `switch-to-configuration-ng` was that it is currently possible to run NixOS on systems that cannot natively host a Rust compiler. This does not apply to any platforms that have official support from NixOS, and as far as I know we do not know of any such systems with users that are not cross‐compiling anyway. My understanding is that these systems are already broken by default anyway, as `systemd.shutdownRamfs.enable` is on by default and uses `make-initrd-ng`, which is also written in Rust. Switching the default while keeping the Perl implementation around will give us at least an entire release cycle to find out if there are any users that will be affected by this and decide what to do about it if so. There is currently one known inconsistency between the Perl and Rust implementations, as documented in <https://github.com/NixOS/nixpkgs/issues/312297>; the Rust implementation has more accurate handling of failed systemd units. We slightly adjust the semantics of `system.switch.enable{,Ng}` to not conflict with each other, so that `system.switch.enableNg` is on by default, but turning off `system.switch.enable` still results in no `switch-to-configuration` implementation being used. This won’t break the configuration of anyone who already opted in to `system.switch.enableNg` and is probably how the option should have worked to begin with.
2024-09-04 23:47:55 -06:00
- The Rust rewrite of the `switch-to-configuration` program is now used for system activation by default.
If you experience any issues, please report them.
nixos/switchable-system: add evaluation warning when using perl stc
2024-10-24 07:27:14 -06:00
The original Perl script is deprecated and is planned for removal in the 25.05 release. It will remain accessible until then by setting `system.switch.enableNg` to `false`.
nixos: switch to `switch-to-configuration-ng` by default The Rust `switch-to-configuration-ng` rewrite was carefully written to be compatible with the original Perl script, has been checked against NixOS VM tests, and has been available on an opt‐in basis for testing for the 24.05 release cycle. The next step towards replacing the Perl script entirely is to switch it on by default so that we can get real‐world testing from a much greater number of users. Maintaining two implementations in parallel is becoming a burden; we are having to adjust the systemd service activation behaviour slightly to fix a long‐standing bug, and backporting the changes to the Perl script is an unpleasant process. We will do it anyway to ensure that the Rust and Perl implementations keep parity with each other throughout the 24.11 release cycle, but we think the time has come to flip the switch. Taking this step now will give us two to three months to test this in the wild before the 24.11 release and gain confidence that there are no regressions. If any non‐trivial problems arise before the final release, we will revert to the Perl implementation by default. Doing this switch ASAP will help to disentangle any problems that might arise from the Rust implementation from problems that arise from the systemd service activation changes, or the upcoming switch to using systemd in stage 1 by default. The main concern that was raised about replacing the Perl script in the PR that added `switch-to-configuration-ng` was that it is currently possible to run NixOS on systems that cannot natively host a Rust compiler. This does not apply to any platforms that have official support from NixOS, and as far as I know we do not know of any such systems with users that are not cross‐compiling anyway. My understanding is that these systems are already broken by default anyway, as `systemd.shutdownRamfs.enable` is on by default and uses `make-initrd-ng`, which is also written in Rust. Switching the default while keeping the Perl implementation around will give us at least an entire release cycle to find out if there are any users that will be affected by this and decide what to do about it if so. There is currently one known inconsistency between the Perl and Rust implementations, as documented in <https://github.com/NixOS/nixpkgs/issues/312297>; the Rust implementation has more accurate handling of failed systemd units. We slightly adjust the semantics of `system.switch.enable{,Ng}` to not conflict with each other, so that `system.switch.enableNg` is on by default, but turning off `system.switch.enable` still results in no `switch-to-configuration` implementation being used. This won’t break the configuration of anyone who already opted in to `system.switch.enableNg` and is probably how the option should have worked to begin with.
2024-09-04 23:47:55 -06:00
nixos: add support for dm-verity Co-authored-by: nikstur <nikstur@outlook.com> Co-authored-by: WilliButz <willibutz@posteo.de>
2024-09-06 08:06:15 -06:00
- Support for mounting filesystems from block devices protected with [dm-verity](https://docs.kernel.org/admin-guide/device-mapper/verity.html)
doc/release-notes: cleanup highlights The main goal is to make these highlights a bit more concise, consistently link to newly introduced option definitions, and (somewhat subjectively) improve word choice to avoid repetition and have a better flow
2024-10-02 20:41:27 -06:00
was added through the [`boot.initrd.systemd.dmVerity`](#opt-boot.initrd.systemd.dmVerity.enable) option.
nixos: add support for dm-verity Co-authored-by: nikstur <nikstur@outlook.com> Co-authored-by: WilliButz <willibutz@posteo.de>
2024-09-06 08:06:15 -06:00
treewide: rename Xen to Xen Project Xen is a trademark of the Cloud Software Group; we're not packaging Xen(Server), we're packaging the Xen Project Hypervisor, which is open source and owned by the Linux Foundation. This is based on advice from Kelly Choi, the Xen Project Community Manager, who has assisted us in the branding aspects of pacakaging. Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
2024-09-26 10:01:52 -06:00
- The [Xen Project Hypervisor](https://xenproject.org) is once again available as a virtualisation option under [`virtualisation.xen`](#opt-virtualisation.xen.enable).
release-notes: remove mentions to xen-slim or 4.18 They were removed during the great Xen deletion. Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
2024-10-05 17:53:11 -06:00
- This release includes Xen [4.19.0](https://wiki.xenproject.org/wiki/Xen_Project_4.19_Release_Notes) and support for booting the hypervisor on EFI systems.
nixos/xen: refactor dom0 configuration - Cleans up downstream systemd units in favour of using upstream units. - Xen 4.18 on Nixpkgs now supports EFI booting, so we have an EFI boot builder here that runs after systemd-boot-builder.py. - Add more options for setting up dom0 resource limits. - Adds options for the declarative configuration of oxenstored. - Disables the automatic bridge configuration, as it was broken. - Drops legacy BIOS boot - Adds an EFI boot entry builder script. Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net> Co-authored-by: Yaroslav Bolyukin <iam@lach.pw>
2024-09-17 14:20:50 -06:00
::: {.warning}
treewide: rename Xen to Xen Project Xen is a trademark of the Cloud Software Group; we're not packaging Xen(Server), we're packaging the Xen Project Hypervisor, which is open source and owned by the Linux Foundation. This is based on advice from Kelly Choi, the Xen Project Community Manager, who has assisted us in the branding aspects of pacakaging. Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
2024-09-26 10:01:52 -06:00
Booting into the Xen Project Hypervisor through a legacy BIOS bootloader or with the legacy script-based Stage 1 initrd have been **deprecated**. Only EFI booting and the new systemd-based Stage 1 initrd are supported.
nixos/xen: refactor dom0 configuration - Cleans up downstream systemd units in favour of using upstream units. - Xen 4.18 on Nixpkgs now supports EFI booting, so we have an EFI boot builder here that runs after systemd-boot-builder.py. - Add more options for setting up dom0 resource limits. - Adds options for the declarative configuration of oxenstored. - Disables the automatic bridge configuration, as it was broken. - Drops legacy BIOS boot - Adds an EFI boot entry builder script. Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net> Co-authored-by: Yaroslav Bolyukin <iam@lach.pw>
2024-09-17 14:20:50 -06:00
:::
release-notes: remove mentions to xen-slim or 4.18 They were removed during the great Xen deletion. Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
2024-10-05 17:53:11 -06:00
- The `qemu-xen-traditional` component has been deprecated by the upstream Xen Project, and is no longer included in the Xen build.
nixos/xen: refactor dom0 configuration - Cleans up downstream systemd units in favour of using upstream units. - Xen 4.18 on Nixpkgs now supports EFI booting, so we have an EFI boot builder here that runs after systemd-boot-builder.py. - Add more options for setting up dom0 resource limits. - Adds options for the declarative configuration of oxenstored. - Disables the automatic bridge configuration, as it was broken. - Drops legacy BIOS boot - Adds an EFI boot entry builder script. Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net> Co-authored-by: Yaroslav Bolyukin <iam@lach.pw>
2024-09-17 14:20:50 -06:00
- The OCaml-based Xen Store can now be configured using [`virtualisation.xen.store.settings`](#opt-virtualisation.xen.store.settings).
- The `virtualisation.xen.bridge` options have been deprecated in this release cycle. Users who need network bridges are encouraged to set up their own networking configurations.
nixos/systemd: allow using writeShellApplication for systemd unit scripts
2023-11-30 02:54:09 -07:00
- A new option [`systemd.enableStrictShellChecks`](#opt-systemd.enableStrictShellChecks) has been added. When enabled, all systemd scripts generated by NixOS will
be checked with [shellcheck](https://www.shellcheck.net) and any errors or warnings will cause the build to fail.
This affects all scripts that have been created through the `script`, `reload`, `preStart`, `postStart`, `preStop` and `postStop` options for systemd services.
This does not affect commandlines passed directly to `ExecStart`, `ExecReload`, `ExecStartPre`, `ExecStartPost`, `ExecStop` or `ExecStopPost`.
It therefore also does not affect systemd units that are coming from packages and that are not defined through the NixOS config.
This option is disabled by default, and although some services have already been fixed, it is still likely that you will encounter build failures when enabling this.
We encourage people to enable this option when they are willing and able to submit fixes for potential build failures to nixpkgs.
The option can also be enabled or disabled for individual services using the `enableStrictShellChecks` option on the service itself, which will take precedence over the global setting.
doc/release-notes: change "New Services" to "New Modules"
2024-08-28 11:29:06 -06:00
## New Modules {#sec-release-24.11-new-modules}
24.05 is Vicuña
2024-05-22 10:15:34 -06:00
nixos/coral: init Provides a small wrapper to enable support for Coral USB and PCIe devices.
2024-11-21 06:56:52 -07:00
- [Coral](https://coral.ai/), hardware support for Coral.ai Edge TPU devices. Available as [hardware.coral.usb.enable](#opt-hardware.coral.usb.enable) and [hardware.coral.pcie.enable](#opt-hardware.coral.pcie.enable).
nixos/docs: add services.cyrus-imap to rl-2411
2024-10-19 07:54:20 -06:00
- [Cyrus IMAP](https://github.com/cyrusimap/cyrus-imapd), an email, contacts and calendar server. Available as [services.cyrus-imap](#opt-services.cyrus-imap.enable) service.
doc/release-notes: use more concise descriptions in new modules section
2024-10-02 20:22:05 -06:00
- [TaskChampion Sync-Server](https://github.com/GothenburgBitFactory/taskchampion-sync-server), a [Taskwarrior 3](https://taskwarrior.org/docs/upgrade-3/) sync server. Available as [services.taskchampion-sync-server](#opt-services.taskchampion-sync-server.enable).
doc: mention Taskwarrior 3 in taskserver module docs & in release notes
2024-08-13 08:59:09 -06:00
doc/release-notes: improve consistency and grammar in new modules section
2024-10-02 20:12:34 -06:00
- [FlareSolverr](https://github.com/FlareSolverr/FlareSolverr), a proxy server to bypass Cloudflare protection. Available as [services.flaresolverr](#opt-services.flaresolverr.enable).
nixos/flaresolverr: initial commit
2024-07-05 14:06:17 -06:00
nixos/gancio: init module
2024-05-03 02:35:19 -06:00
- [Gancio](https://gancio.org/), a shared agenda for local communities. Available as [services.gancio](#opt-services.gancio.enable).
nixos/goatcounter: Fix typo in link
2024-11-19 19:20:57 -07:00
- [Goatcounter](https://www.goatcounter.com/), an easy web analytics platform with no tracking of personal data. Available as [services.goatcounter](options.html#opt-services.goatcounter.enable).
nixos/goatcounter: init
2024-07-14 13:14:11 -06:00
doc/release-notes: improve consistency and grammar in new modules section
2024-10-02 20:12:34 -06:00
- [Privatebin](https://github.com/PrivateBin/PrivateBin/), a minimalist, open source online pastebin where the server has zero knowledge of pasted data. Available as [services.privatebin](#opt-services.privatebin.enable).
nixos/privatebin: init
2024-09-23 11:40:35 -06:00
doc/release-notes: improve consistency and grammar in new modules section
2024-10-02 20:12:34 -06:00
- [UWSM](https://github.com/Vladimir-csp/uwsm), a wayland session manager to wrap Wayland compositors into useful systemd units such as `graphical-session.target`. Available as [programs.uwsm](#opt-programs.uwsm.enable).
nixos/uwsm: init [UWSM](https://github.com/Vladimir-csp/uwsm) is a session manager that wraps a wayland window compositor with useful systemd units like `graphical-session-pre.target`, `graphical-session.target`, `xdg-desktop-autostart.target`. This is useful for Wayland Compositors that do not start these units on these own. Example for Hyprland: ```nix programs.hyprland.enable = true; programs.uwsm.enable = true; programs.uwsm.waylandCompositors = { hyprland = { compositorPrettyName = "Hyprland"; compositorComment = "Hyprland compositor managed by UWSM"; compositorBinPath = "/run/current-system/sw/bin/Hyprland"; }; }; ``` Co-authored-by: Kai Norman Clasen <k.clasen@protonmail.com>
2024-08-18 07:52:34 -06:00
doc/release-notes: improve consistency and grammar in new modules section
2024-10-02 20:12:34 -06:00
- [Open-WebUI](https://github.com/open-webui/open-webui), a user-friendly WebUI for LLMs. Available as [services.open-webui](#opt-services.open-webui.enable).
24.05 is Vicuña
2024-05-22 10:15:34 -06:00
doc/release-notes: improve consistency and grammar in new modules section
2024-10-02 20:12:34 -06:00
- [Quickwit](https://quickwit.io), a sub-second search & analytics engine on cloud storage. Available as [services.quickwit](options.html#opt-services.quickwit.enable).
doc/release-notes: 24.11: Added Quickwit item to new services.
2024-06-04 03:05:12 -06:00
nixos/doc: add release notes for userborn
2024-08-26 05:52:30 -06:00
- [Userborn](https://github.com/nikstur/userborn), a service for declarative
user management. This can be used instead of the `update-users-groups.pl`
doc/release-notes: use more concise descriptions in new modules section
2024-10-02 20:22:05 -06:00
Perl script and/or systemd-sysusers. This is now recommended over
systemd-sysusers to achieve a system without Perl, as it can create normal
users and change passwords. Available as [services.userborn](#opt-services.userborn.enable).
nixos/doc: add release notes for userborn
2024-08-26 05:52:30 -06:00
nixos/release-notes-24.11: add g810-led
2024-11-15 05:28:12 -07:00
- [g810-led](https://github.com/MatMoul/g810-led), a LED controller for Logitech G keyboards. Available as [services.g810-led](options.html#opt-services.g810-led.enable).
doc/release-notes: improve consistency and grammar in new modules section
2024-10-02 20:12:34 -06:00
- [Hatsu](https://github.com/importantimport/hatsu), a self-hosted bridge that interacts with Fediverse on behalf of your static site. Available as [services.hatsu](options.html#opt-services.hatsu.enable).
nixos/hatsu: init module
2024-09-30 10:33:38 -06:00
nixos/release-notes-24.11: add soteria module
2024-11-14 08:24:31 -07:00
- [Soteria](https://github.com/ImVaskel/soteria), a polkit authentication agent to handle elevated prompts for any desktop environment. Normally this should only be used on DEs or WMs that do not provide a graphical polkit frontend on their own. Available as [`security.soteria`](#opt-security.soteria.enable).
doc/release-notes: improve consistency and grammar in new modules section
2024-10-02 20:12:34 -06:00
- [Flood](https://flood.js.org/), a beautiful WebUI for various torrent clients. Available as [services.flood](options.html#opt-services.flood.enable).
nixos/doc: add services.flood to rl-2411
2024-06-17 10:43:33 -06:00
nixos/niri: init module
2024-10-12 22:54:16 -06:00
- [Niri](https://github.com/YaLTeR/niri), a scrollable-tiling Wayland compositor. Available as [programs.niri](options.html#opt-programs.niri.enable).
doc/release-notes: improve consistency and grammar in new modules section
2024-10-02 20:12:34 -06:00
- [Firefly-iii Data Importer](https://github.com/firefly-iii/data-importer), a data importer for Firefly-III. Available as [services.firefly-iii-data-importer](options.html#opt-services.firefly-iii-data-importer.enable).
Added changelog entry for firefly-iii-data-importer
2024-08-02 11:39:55 -06:00
nixos/dashy: init module
2024-10-15 17:41:58 -06:00
- [Dashy](https://dashy.to), an open source, highly customizable, easy to use, privacy-respecting dashboard app. Available as [services.dashy](options.html#opt-services.dashy).
nixos/doc/rl-2411: Document nixos/qgroundcontrol
2024-07-09 15:26:10 -06:00
- [QGroundControl], a ground station support and configuration manager for the PX4 and APM Flight Stacks. Available as [programs.qgroundcontrol](options.html#opt-programs.qgroundcontrol.enable).
doc/release-notes: improve consistency and grammar in new modules section
2024-10-02 20:12:34 -06:00
- [Eintopf](https://eintopf.info), a community event and calendar web application. Available as [services.eintopf](options.html#opt-services.eintopf.enable).
nixos/eintopf: init
2024-07-02 15:37:01 -06:00
nixos/pay-respects: init module Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
2024-11-13 08:58:18 -07:00
- [`pay-respects`](https://codeberg.org/iff/pay-respects), a terminal command correction program, alternative to `thefuck`, written in Rust. Available as [programs.pay-respects](options.html#opt-programs.pay-respects).
nixos/radicle: init services
2024-05-24 18:23:48 -06:00
- [Radicle](https://radicle.xyz), an open source, peer-to-peer code collaboration stack built on Git. Available as [services.radicle](#opt-services.radicle.enable).
doc/release-notes: improve consistency and grammar in new modules section
2024-10-02 20:12:34 -06:00
- [ddns-updater](https://github.com/qdm12/ddns-updater), a service with a WebUI to update DNS records periodically for many providers. Available as [services.ddns-updater](#opt-services.ddns-updater.enable).
ddns-updater: Add module, test, update script
2024-07-16 11:45:02 -06:00
nixos/programs.immersed-vr: rename to programs.immersed
2024-09-11 16:51:54 -06:00
- [Immersed](https://immersed.com/), a closed-source coworking platform. Available as [programs.immersed](#opt-programs.immersed.enable).
nixos/doc/rl-2411: Document programs.immersed-vr
2024-07-11 15:01:05 -06:00
doc/release-notes: improve consistency and grammar in new modules section
2024-10-02 20:12:34 -06:00
- [HomeBox](https://github.com/sysadminsmedia/homebox), an inventory and organization system built for the home user. Available as [services.homebox](#opt-services.homebox.enable).
nixos/homebox: init
2024-06-15 07:19:11 -06:00
nixos/evremap: init module
2024-10-31 16:11:07 -06:00
- [evremap](https://github.com/wez/evremap), a keyboard input remapper for Linux/Wayland systems. Available as [services.evremap](options.html#opt-services.evremap).
nixos/matrix-hookshot: init module
2024-06-28 11:01:51 -06:00
- [matrix-hookshot](https://matrix-org.github.io/matrix-hookshot), a Matrix bot for connecting to external services. Available as [services.matrix-hookshot](#opt-services.matrix-hookshot.enable).
doc/release-notes: improve consistency and grammar in new modules section
2024-10-02 20:12:34 -06:00
- [Renovate](https://github.com/renovatebot/renovate), a dependency updating tool for various Git forges and language ecosystems. Available as [services.renovate](#opt-services.renovate.enable).
nixos/renovate: init
2024-06-08 09:56:52 -06:00
doc/release-notes: use more concise descriptions in new modules section
2024-10-02 20:22:05 -06:00
- [Music Assistant](https://music-assistant.io/), a music library manager for your offline and online music sources that can stream to a wide range of supported players. Available as [services.music-assistant](#opt-services.music-assistant.enable).
nixos/doc/rl-2411: add music-assistant
2024-07-14 18:19:35 -06:00
nixos/zeronsd: init module and package (#253610) * zeronsd: init at 0.5.2 * nixos/zeronsd: init at 0.5.2 This is the module for the new zeronsd package.
2024-07-26 07:20:56 -06:00
- [zeronsd](https://github.com/zerotier/zeronsd), a DNS server for ZeroTier users. Available with [services.zeronsd.servedNetworks](#opt-services.zeronsd.servedNetworks).
nixos/agorakit: init module
2024-10-14 15:25:01 -06:00
- [agorakit](https://github.com/agorakit/agorakit), an organization tool for citizens' collectives. Available with [services.agorakit](#opt-services.agorakit.enable).
nixos/collabora-online: init
2024-06-12 21:33:57 -06:00
- [Collabora Online](https://www.collaboraonline.com/), a collaborative online office suite based on LibreOffice technology. Available as [services.collabora-online](options.html#opt-services.collabora-online.enable).
nixos/zeronsd: init module and package (#253610) * zeronsd: init at 0.5.2 * nixos/zeronsd: init at 0.5.2 This is the module for the new zeronsd package.
2024-07-26 07:20:56 -06:00
doc/release-notes: improve consistency and grammar in new modules section
2024-10-02 20:12:34 -06:00
- [wg-access-server](https://github.com/freifunkMUC/wg-access-server/), an all-in-one WireGuard VPN solution with a WebUI for connecting devices. Available as [services.wg-access-server](#opt-services.wg-access-server.enable).
wg-access-server: add release notes entry
2024-06-25 03:03:02 -06:00
nixos/pingvin-share: add release note
2024-02-09 13:04:09 -07:00
- [Pingvin Share](https://github.com/stonith404/pingvin-share), a self-hosted file sharing platform and an alternative for WeTransfer. Available as [services.pingvin-share](#opt-services.pingvin-share.enable).
nixos/doc/rl-2411: Document programs.envision
2024-07-01 15:13:23 -06:00
- [Envision](https://gitlab.com/gabmus/envision), a UI for building, configuring and running Monado, the open source OpenXR runtime. Available as [programs.envision](#opt-programs.envision.enable).
nixos/doc/rl-2411: Document programs.localsend
2024-07-11 14:35:20 -06:00
- [Localsend](https://localsend.org/), an open source cross-platform alternative to AirDrop. Available as [programs.localsend](#opt-programs.localsend.enable).
nixos/gatus: init module
2024-09-19 13:34:10 -06:00
- [Gatus](https://github.com/TwiN/gatus), an automated developer-oriented status page. Available as [services.gatus](#opt-services.gatus.enable).
doc/release-notes: use more concise descriptions in new modules section
2024-10-02 20:22:05 -06:00
- [cryptpad](https://cryptpad.org/), a privacy-oriented collaborative office suite, has been added back. Available as [services.cryptpad](#opt-services.cryptpad.enable).
nixos/cryptpad: init This is a full rewrite independent of the previously removed cryptpad module, managing cryptpad's config in RFC0042 along with a shiny test. Upstream cryptpad provides two nginx configs, with many optimizations and complex settings; this uses the easier variant for now but improvements (e.g. serving blocks and js files directly through nginx) should be possible with a bit of work and care about http headers. the /checkup page of cryptpad passes all tests except HSTS, we don't seem to have any nginx config with HSTS enabled in nixpkgs so leave this as is for now. Co-authored-by: Pol Dellaiera <pol.dellaiera@protonmail.com> Co-authored-by: Michael Smith <shmitty@protonmail.com>
2024-07-19 06:45:19 -06:00
doc/release-notes: improve consistency and grammar in new modules section
2024-10-02 20:12:34 -06:00
- [realm](https://github.com/zhboner/realm), a simple, high performance relay server written in Rust. Available as [services.realm](#opt-services.realm.enable).
nixos/realm: add release note
2024-06-02 18:40:16 -06:00
doc/release-notes: improve consistency and grammar in new modules section
2024-10-02 20:12:34 -06:00
- [Gotenberg](https://gotenberg.dev), an API server for converting files to PDFs that can be used alongside Paperless-ngx. Available as [services.gotenberg](options.html#opt-services.gotenberg.enable).
nixos/gotenberg: init
2024-07-11 01:07:40 -06:00
doc/release-notes: improve consistency and grammar in new modules section
2024-10-02 20:12:34 -06:00
- [Suricata](https://suricata.io/), a free and open source, mature, fast and robust network threat detection engine. Available as [services.suricata](options.html#opt-services.suricata.enable).
nixos/suricata: init module
2024-05-22 06:45:16 -06:00
doc/release-notes: improve consistency and grammar in new modules section
2024-10-02 20:12:34 -06:00
- [Playerctld](https://github.com/altdesktop/playerctl), a daemon to track media player activity. Available as [services.playerctld](option.html#opt-services.playerctld.enable).
doc/release-notes: add note about new service playerctld
2024-06-26 13:30:08 -06:00
doc/release-notes: improve consistency and grammar in new modules section
2024-10-02 20:12:34 -06:00
- [Glance](https://github.com/glanceapp/glance), a self-hosted dashboard that puts all your feeds in one place. Available as [services.glance](option.html#opt-services.glance.enable).
nixos/glance: init module
2024-07-01 01:32:41 -06:00
doc/release-notes: improve consistency and grammar in new modules section
2024-10-02 20:12:34 -06:00
- [Apache Tika](https://github.com/apache/tika), a toolkit that detects and extracts metadata and text from over a thousand different file types. Available as [services.tika](option.html#opt-services.tika.enable).
nixos/tika: init module
2024-07-12 04:59:00 -06:00
doc/release-notes: improve consistency and grammar in new modules section
2024-10-02 20:12:34 -06:00
- [Misskey](https://misskey-hub.net/en/), an interplanetary microblogging platform. Available as [services.misskey](options.html#opt-services.misskey.enable).
nixos/misskey: init
2024-06-12 09:34:42 -06:00
doc/release-notes: improve consistency and grammar in new modules section
2024-10-02 20:12:34 -06:00
- [Improved File Manager (IFM)](https://github.com/misterunknown/ifm), a single-file web-based file manager. Available as [services.ifm](options.html#opt-services.ifm.enable).
Init IFM service at version 4.0.2 Signed-off-by: Litchi Pi <litchi.pi@proton.me>
2024-07-18 09:17:36 -06:00
nixos/opengfw: init
2024-06-25 01:30:03 -06:00
- [OpenGFW](https://github.com/apernet/OpenGFW), an implementation of the Great Firewall on Linux. Available as [services.opengfw](#opt-services.opengfw.enable).
nixos/rathole: init module Adds a module for rathole package. The package itself and this module is very similar to frp, so the options and tests are not very far off from those for frp.
2024-07-27 16:25:01 -06:00
- [Rathole](https://github.com/rapiz1/rathole), a lightweight and high-performance reverse proxy for NAT traversal. Available as [services.rathole](#opt-services.rathole.enable).
doc/release-notes: improve consistency and grammar in new modules section
2024-10-02 20:12:34 -06:00
- [Proton Mail bridge](https://proton.me/mail/bridge), a desktop application that runs in the background, encrypting and decrypting messages as they enter and leave your computer. Available as [services.protonmail-bridge](#opt-services.protonmail-bridge.enable).
nixos/modules/services/mail: add protonmail-bridge
2024-08-05 16:57:22 -06:00
doc/release-notes: improve consistency and grammar in new modules section
2024-10-02 20:12:34 -06:00
- [chromadb](https://www.trychroma.com/), an open-source AI application database with batteries included. Available as [services.chromadb](options.html#opt-services.chromadb.enable).
nixos/chromadb: init
2024-08-16 10:14:15 -06:00
doc/release-notes: improve consistency and grammar in new modules section
2024-10-02 20:12:34 -06:00
- [bitmagnet](https://bitmagnet.io/), a self-hosted BitTorrent indexer, DHT crawler, content classifier and torrent search engine with WebUI, GraphQL API and Servarr stack integration. Available as [services.bitmagnet](options.html#opt-services.bitmagnet.enable).
nixos/bitmagnet: init module
2024-08-25 12:25:44 -06:00
nixos/wakapi: init module
2024-08-19 10:16:01 -06:00
- [Wakapi](https://wakapi.dev/), a time tracking software for programmers. Available as [services.wakapi](#opt-services.wakapi.enable).
nixos/foot: init
2024-08-09 01:49:48 -06:00
- [foot](https://codeberg.org/dnkl/foot), a fast, lightweight and minimalistic Wayland terminal emulator. Available as [programs.foot](#opt-programs.foot.enable).
doc/release-notes: improve consistency and grammar in new modules section
2024-10-02 20:12:34 -06:00
- [ToDesk](https://www.todesk.com/linux.html), a remote desktop application. Available as [services.todesk](#opt-services.todesk.enable).
nixos/todesk: init
2024-08-24 08:26:00 -06:00
doc/release-notes: improve consistency and grammar in new modules section
2024-10-02 20:12:34 -06:00
- [Dependency Track](https://dependencytrack.org/), an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Available as [services.dependency-track](option.html#opt-services.dependency-track.enable).
nixos/dependency-track: init module
2024-07-20 13:25:05 -06:00
nixos/immich: init module
2024-07-02 10:34:36 -06:00
- [Immich](https://github.com/immich-app/immich), a self-hosted photo and video backup solution. Available as [services.immich](#opt-services.immich.enable).
doc/release-notes: improve consistency and grammar in new modules section
2024-10-02 20:12:34 -06:00
- [saunafs](https://saunafs.com), a distributed POSIX file system. Available as [services.saunafs](options.html#opt-services.saunafs.enable).
nixos/release-notes: add saunafs under "New modules" sections
2024-10-08 14:18:19 -06:00
doc/release-notes: improve consistency and grammar in new modules section
2024-10-02 20:12:34 -06:00
- [obs-studio](https://obsproject.com/), a free and open source software for video recording and live streaming. Available as [programs.obs-studio](#opt-programs.obs-studio.enable).
modules/obs-studio: optionally enable v4l2loopback (#312112) * modules/obs-studio: optionally enable v4l2loopback * add test * added documentation to 24.11 changelog
2024-09-28 11:43:06 -06:00
doc/release-notes: improve consistency and grammar in new modules section
2024-10-02 20:12:34 -06:00
- [Veilid](https://veilid.com), a privacy-focused, headless server for data sharing and messaging on a peer-to-peer network. Available as [services.veilid](#opt-services.veilid.enable).
nixos/veilid: add release notes
2024-10-01 23:09:34 -06:00
nixos/fedimintd: init services
2024-06-26 23:17:12 -06:00
- [Fedimint](https://github.com/fedimint/fedimint), a module based system for building federated applications (Federated E-Cash Mint). Available as [services.fedimintd](#opt-services.fedimintd).
nixos/apple-touchbar: init module (#350219)
2024-10-23 09:14:34 -06:00
- [tiny-dfr](https://github.com/WhatAmISupposedToPutHere/tiny-dfr), a dynamic function row daemon for the Touch Bar found on some Apple laptops. Available as [hardware.apple.touchBar.enable](options.html#opt-hardware.apple.touchBar.enable).
doc/release-notes: improve consistency and grammar in new modules section
2024-10-02 20:12:34 -06:00
- [Swapspace](https://github.com/Tookmund/Swapspace), a dynamic swap space manager that turns your unused free space into swap automatically. Available as [services.swapspace](#opt-services.swapspace.enable).
- [Zapret](https://github.com/bol-van/zapret), a DPI bypass tool. Available as [services.zapret](option.html#opt-services.zapret.enable).
nixos/swapspace: init module Signed-off-by: phanirithvij <phanirithvij2000@gmail.com> Co-authored-by: Luflosi <luflosi@luflosi.de>
2024-10-14 11:17:34 -06:00
nixos/glances: init module
2024-04-01 14:44:08 -06:00
- [Glances](https://github.com/nicolargo/glances), an open-source system cross-platform monitoring tool. Available as [services.glances](option.html#opt-services.glances).
24.05 is Vicuña
2024-05-22 10:15:34 -06:00
## Backward Incompatibilities {#sec-release-24.11-incompatibilities}
lib/minver: bump to 2.3.17 The first version that supports zstd compression, to create the option to eventually switch compression for the binary cache. It was released one year ago on 2023-11-03 and first shipped in NixOS 23.11.
2024-11-08 13:30:21 -07:00
- Nixpkgs now requires Nix 2.3.17 or newer to allow for zstd compressed binary artifacts.
doc: 24.11: move most impactful incompatibilities to the top Apply suggestions from code review Co-authored-by: Jörg Thalheim <Mic92@users.noreply.github.com>
2024-09-26 08:45:17 -06:00
- The `sound` options have been removed or renamed, as they had a lot of unintended side effects. See [below](#sec-release-24.11-migration-sound) for details.
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- The NVIDIA driver no longer defaults to the proprietary kernel module with versions >= 560. You will need to manually set `hardware.nvidia.open` to select the proprietary or open modules.
doc: 24.11: move most impactful incompatibilities to the top Apply suggestions from code review Co-authored-by: Jörg Thalheim <Mic92@users.noreply.github.com>
2024-09-26 08:45:17 -06:00
rl-2411.section.md: update to inform the removal of (buildPythonPackage { ... }).overrideDerivation Clean up the leftover of commit 58bfe7412308 ("buildPython*: Deprecate and remove (buildPython* { ... }).override")
2024-10-20 20:25:50 -06:00
- The `(buildPythonPackage { ... }).override` and `(buildPythonPackage { ... }).overrideDerivation` attributes is now deprecated and removed in favour of `overridePythonAttrs` and `lib.overrideDerivation`.
buildPython*: Deprecate and remove (buildPython* { ... }).override Deprecate (buildPythonPackage { ... }).override for Python packages in favour of overridePythonAttrs. This change does not affect the override interface of most Python packages, as the override interface is provided by callPackage and shadows the locally defined override attribute.
2024-08-10 06:12:00 -06:00
This change does not affect the override interface of most Python packages, as [`<pkg>.override`](https://nixos.org/manual/nixpkgs/unstable/#sec-pkg-override) provided by `callPackage` shadows such a locally-defined `override` attribute.
rl-2411.section.md: update to inform the removal of (buildPythonPackage { ... }).overrideDerivation Clean up the leftover of commit 58bfe7412308 ("buildPython*: Deprecate and remove (buildPython* { ... }).override")
2024-10-20 20:25:50 -06:00
The `<pkg>.overrideDerivation` attribute of Python packages called with `callPackage` will also remain available after this change.
buildPython*: Deprecate and remove (buildPython* { ... }).override Deprecate (buildPythonPackage { ... }).override for Python packages in favour of overridePythonAttrs. This change does not affect the override interface of most Python packages, as the override interface is provided by callPackage and shadows the locally defined override attribute.
2024-08-10 06:12:00 -06:00
doc: 24.11: move most impactful incompatibilities to the top Apply suggestions from code review Co-authored-by: Jörg Thalheim <Mic92@users.noreply.github.com>
2024-09-26 08:45:17 -06:00
- All Cinnamon and XApp packages have been moved to top-level (i.e., `cinnamon.nemo` is now `nemo`).
- All GNOME packages have been moved to top-level (i.e., `gnome.nautilus` is now `nautilus`).
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `transmission` has been aliased with a `trace` warning to `transmission_3`, since [Transmission 4 has been released last year](https://github.com/transmission/transmission/releases/tag/4.0.0) and Transmission 3 will eventually go away -- this is meant to make people aware of the new version. `services.transmission.package` now also defaults to `transmission_3`, as the upgrade can cause data loss in some cases (examples: [#5153](https://github.com/transmission/transmission/issues/5153), [#6796](https://github.com/transmission/transmission/issues/6796)). Please make sure to back up to your data directory if you may be affected:
transmission_3: rename from transmission
2024-06-10 01:54:49 -06:00
- `transmission-gtk`: `~/.config/transmission`
- `transmission-daemon` using NixOS module: `${config.services.transmission.home}/.config/transmission-daemon` (defaults to `/var/lib/transmission/.config/transmission-daemon`)
mongodb: mongodb-5_0 -> mongodb-7_0
2024-09-30 18:27:51 -06:00
- The default `mongodb` version has been updated from 5.0 to 7.0.
For more information, see the compatibility changes for MongoDB [6.0](https://www.mongodb.com/docs/manual/release-notes/6.0-compatibility/) and [7.0](https://www.mongodb.com/docs/manual/release-notes/7.0-compatibility/).
unifi7: drop
2024-10-01 07:57:32 -06:00
- `unifi` has been updated to UniFi 8.
`unifi7` was removed as it is vulnerable to CVE-2024-42025 and required a version of MongoDB that has reached end of life.
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `androidenv.androidPkgs_9_0` has been removed. It is replaced with `androidenv.androidPkgs` for a more complete Android SDK, including support for Android 9 and later.
android-studio-full: move changelog; fix duplicate merged line
2024-06-16 00:42:09 -06:00
nixos/doc/rl-2411: note VirtualBox demo appliance removal
2024-11-07 10:47:47 -07:00
- The VirtualBox demo installer appliance has been removed.
Please use the standard installer ISOs instead.
nixos/rl-2411: fix version Grafana has been updated to
2024-11-16 10:57:15 -07:00
- `grafana` has been updated to version 11.3. This version doesn't support setting `http_addr` to a hostname anymore, an IP address is expected.
nixos/rl-2411: document breaking change in grafana
2024-06-29 11:01:36 -06:00
deno_1: drop Upstream do not plan to support this version (see <https://github.com/NixOS/nixpkgs/pull/347484#issuecomment-2404777102>), so we should not package a version that will surely accumulate CVEs from V8 etc. in 24.11. As this package was only added yesterday, I don’t think there’s any need for a compatibility alias.
2024-10-11 12:46:23 -06:00
- `deno` has been updated to Deno 2, which has breaking changes.
See the [migration guide](https://docs.deno.com/runtime/reference/migration_guide/) for details.
deno: 1.46.3 -> 2.0.0 Updates deno to v2. Slight refactor of fetcher code for grabbing librusty_v8. Updated the update scripts to use new Deno v2 interfaces and pull latest toml dependency from jsr rather than the deno.land registry. Added release note.
2024-10-10 04:47:29 -06:00
gogs: remove Upstream development has stalled and several critical vulnerabilities that weren't addressed within a year[1][2]. Back then it was fair to mark it as insecure, but given nothing has happened since, it's time to remove it. [1] https://forgejo.org/2023-11-release-v1-20-5-1/ [2] https://github.com/gogs/gogs/issues/7777
2024-10-12 02:34:27 -06:00
- `gogs` has been removed. Upstream development has stalled and it has several
[critical vulnerabilities](https://github.com/gogs/gogs/issues/7777) that weren't addressed
within a year. Consider migrating to `forgejo` or `gitea`.
nixos/doc/rl-24.11: knot 3.4.0 migration guide
2024-09-02 07:22:13 -06:00
- `knot-dns` has been updated to version 3.4.x. Check the [migration guide](https://www.knot-dns.cz/docs/latest/html/migration.html#upgrade-3-3-x-to-3-4-x) for breaking changes.
mutmut: 2.2.0 -> 3.2.0 With dependencies from the upstream requirements file <https://github.com/boxed/mutmut/blob/3.2.0/requirements.txt>.
2024-10-20 18:46:34 -06:00
- `mutmut` has been updated to version 3.0.5.
nixos/kubernetes: allow setting multiple kubelet dns resolvers The current kubernetes module only allows you to set a single DNS resolver for the kubelet. Historically, this has not mattered as the value was passed to a cli argument as a string and as per the kubelet's configuration parsing mechanism, multiple values could be passed as a comma-delimited string. However, recently, the module was refactored to make configure kubernetes components via configuration files rather than the deprecated command-line arguments. These files more strongly-typed than CLI arguments and to pass multiple values, one must define a list in the file. When this change was made, an incorrect assumption was made that only a single DNS server could be specified and forced a single-item list into this configuration file. We need to introduce a breaking change to the module in order to allow the user to supply their own list with however many dns resolvers they wish to use.
2024-08-30 20:17:00 -06:00
- `services.kubernetes.kubelet.clusterDns` now accepts a list of DNS resolvers rather than a single string, bringing the module more in line with the upstream Kubelet configuration schema.
bluemap: 3.21 -> 5.3
2024-08-04 07:05:33 -06:00
- `bluemap` has changed the format used to store map tiles, and the database layout has been heavily modified. Upstream recommends a clean reinstallation: <https://github.com/BlueMap-Minecraft/BlueMap/releases/tag/v5.2>. Unless you are using an SQL storage backend, this should only entail deleting the contents of `config.services.bluemap.coreSettings.data` (defaults to `/var/lib/bluemap`) and `config.services.bluemap.webRoot` (defaults to `/var/lib/bluemap/web`).
nixos/wstunnel: Add a mention in the release notes
2024-06-17 04:08:53 -06:00
- `wstunnel` has had a major version upgrade that entailed rewriting the program in Rust.
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
The module was updated to accommodate for breaking changes and breaking changes to the
module options were minimised as much as possible. Nonetheless, some were inevitable due
to changes in the upstream CLI. Certain options were moved from separate CLI arguments into
the forward specifications, and those options were also removed from the module's options.
Please consult the wstunnel man page for more details.
nixos/wstunnel: Add a mention in the release notes
2024-06-17 04:08:53 -06:00
Also be aware that if you have set additional options in `services.wstunnel.{clients,servers}.<name>.extraArgs`,
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
they may have been modified or removed upstream.
nixos/wstunnel: Add a mention in the release notes
2024-06-17 04:08:53 -06:00
gnat: 12.4.0 -> 13.3.0 This matches the default gcc version.
2024-11-01 09:18:01 -06:00
- `gnat` and `gnatPackages` now use GNAT 13 instead of GNAT 12. This matches
the default `gcc` version.
percona: release notes for 8.4 LTS release
2024-10-02 10:35:03 -06:00
- `percona-server_8_4` and `mysql84` now have password authentication via the deprecated `mysql_native_password` disabled by default. This authentication plugin can be enabled via a CLI argument again, for detailed instructions and alternative authentication methods [see upstream documentation](https://dev.mysql.com/doc/refman/8.4/en/native-pluggable-authentication.html). The config file directive `default_authentication_plugin` has been removed.
percona: deprecate innovation/lts release flavours Percona upstream has decided not to create releases or each MySQL innovation upstream release, but just for LTS releases. https://www.percona.com/blog/no-mysql-9-x-innovation-releases-from-percona/
2024-10-13 12:34:54 -06:00
- Percona has decided not to follow the LTS/ Innovation release scheme of upstream MySQL and thus [will only create releases for MySQL LTS versions](https://www.percona.com/blog/no-mysql-9-x-innovation-releases-from-percona/). Hence, the package names `percona-server_lts`, `percona-server_innovation`, `percona-xtrabackup_lts` and `percona-xtrabackup_innovation` are deprecated.
- `percona-server` and `percona-server_lts` now point towards the new LTS release `percona-server_8_4`. The previous LTS continues to be supported and is available as `percona-server_8_0`. The same is true for the supporting `percona-xtrabackup` tooling.
percona: release notes for 8.4 LTS release
2024-10-02 10:35:03 -06:00
clang-tools: add release note entry about moving into llvmPackages Add 24.11 release note entry about moving clang-tools into llvmPackages and making clang-tools_<version> aliases.
2024-05-15 15:39:31 -06:00
- `clang-tools_<version>` packages have been moved into `llvmPackages_<version>` (i.e. `clang-tools_18` is now `llvmPackages_18.clang-tools`).
- For convenience, the top-level `clang-tools` attribute remains and is now bound to `llvmPackages.clang-tools`.
- Top-level `clang_tools_<version>` attributes are now aliases; these will be removed in a future release.
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `buildbot` was updated to 4.0 and the AngularJS frontend replaced by a React frontend. See the [upstream release notes](https://docs.buildbot.net/current/manual/upgrading/4.0-upgrade.html).
buildbot: 3.11.3 -> 4.0.0 sometimes takes a while for upstream to publish on pypi so switch to using github source for master, pkg, worker and github releases for the plugins which require built assets
2024-06-22 18:41:24 -06:00
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `headscale` has been updated to version 0.23.0 which reworked large parts of the configuration, including DNS, Magic DNS prefixes and ACL policy files. See the [upstream changelog](https://github.com/juanfont/headscale/releases/tag/v0.23.0) for details.
nixos/release-notes: add entry for headscale 0.23.0
2024-10-01 12:07:53 -06:00
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `nginx` package no longer includes the `gd` and `geoip` dependencies. To re-enable them, override `nginx` with the options `withImageFilter = true;` and `withGeoIP = true;`.
nixos/doc/rl-2411: nginx now has gd, geoip as an optional
2024-05-25 09:12:50 -06:00
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `systemd.enableUnifiedCgroupHierarchy` has been removed.
In systemd 256, support for cgroup v1 ('legacy' and 'hybrid' hierarchies) is now considered obsolete and systemd will refuse to boot under it by default.
To forcibly re-enable cgroup v1 support, you can set `boot.kernelParams = [ "systemd.unified_cgroup_hierarchy=0" "SYSTEMD_CGROUP_ENABLE_LEGACY_FORCE=1" ]`.
This is not an officially supported configuration and might cause your system to become unbootable in future versions. You are on your own.
docs/release-notes: 24.11: add note about removal of systemd.enableUnifiedCgroupHierarchy
2024-07-31 04:12:07 -06:00
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `nrfutil` -- which previously pointed to the now-deprecated `pc-nrfutil` Python package -- has been repackaged under the same name with the new nrfutil tool.
nixos/doc: add release note about nrfutil repackaging
2024-09-17 14:36:20 -06:00
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `openssh` and `openssh_hpn` are now compiled without Kerberos 5 / GSSAPI support in an effort to reduce the attack surface of the components. Users needing this support can
use the new `opensshWithKerberos` and `openssh_hpnWithKerberos` package flavors (e.g. `programs.ssh.package = pkgs.openssh_gssapi`).
openssh: move Kerberos support into a dedicated package The `openssh` and `openssh_hpn` packages are now built without the Kerberos support by default in an effort to reduce the attack surface. The Kerberos support is likely used only by a fraction of the total users (I'm guessing mainly users integrating SSH in an Active Directory env) so dropping it should not impact too many users. It should also be noted that the Kerberos/GSSAPI auth is disabled by default in the configuration. `opensshWithKerberos` and `openssh_hpnWithKerberos` are added in order to provide an easy migration path for users needing this support. The `openssh_gssapi` package is kept untouched.
2024-04-08 16:29:07 -06:00
nixos/ipa: Make ipa_hostname configurable (#321588) Some sites put hosts in domains outside of the IPA server's default domain, so this needs to be user-configurable. The default is to use the system's FQDN if it is configured, otherwise fallback to the previous default behaviour of assuming the IPA's server's domain.
2024-06-22 09:29:54 -06:00
- `security.ipa.ipaHostname` now defaults to the value of `networking.fqdn` if
it is set, instead of the previous hardcoded default of
`${networking.hostName}.${security.ipa.domain}`.
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- The `MSMTP_QUEUE` and `MSMTP_LOG` environment variables accepted by `msmtpq` have been renamed to `MSMTPQ_Q` and `MSMTPQ_LOG` respectively.
msmtp: 1.8.22 -> 1.8.25 msmtpq patches had to be recreated: - removal of the executable check and addition of systemd logging were kept and split into two patches. - renaming of queue and log files was removed as the upstream script had renamed these to add the `MSMTPQ_` prefix (noted as a backwards incompatible change).
2024-03-17 12:03:24 -06:00
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- The logrotate service has been hardened and now requires enabling `allowNetworking` if network access is required.
nixos/doc/rl-2411: add logrotate breaking change
2024-09-08 18:32:49 -06:00
mautrix-whatsapp: 0.10.9 -> 0.11.0 https://github.com/mautrix/whatsapp/releases/tag/v0.11.0
2024-10-18 03:33:50 -06:00
- `mautrix-whatsapp` has been updated to version 0.11.0, which is a major rewrite of the bridge. Config file changes are required.
qbittorrent: 4.6.7 -> 5.0.0
2024-09-30 14:38:32 -06:00
- qBittorrent has been updated to major version 5, which drops support for Qt 5.
The `qbittorrent-qt5` package has been removed.
nixos/fcgiwrap: refactor for multiple instances This allows configuring and starting independent instances of the fgciwrap service, each with their own settings and running user, instead of having to share a global one. I could not use `mkRenamedOptionModule` on the previous options because the aliases conflict with `attrsOf submodule` now defined at `services.fcgiwrap`. This makes this change not backward compatible.
2024-06-08 14:34:13 -06:00
- The fcgiwrap module now allows multiple instances running as distinct users.
The option `services.fgciwrap` now takes an attribute set of the
configuration of each individual instance.
This requires migrating any previous configuration keys from
nixos/fcgiwrap: add option migration instruction errors This adds migration instructions for the removed global shared instance configuration of fcgiwrap. Adding those explicit messages to the previous options requires moving the newly defined options from `services.fcgiwrap.*` to `services.fcgiwrap.instances.*` due to an option namespace clash. `mkRenamedOptionModule` was not used because the previous options do not directly map to the new ones. In particular, `user` and `group` were described as setting the socket's permission, but were actually setting the process' running user. Co-authored-by: Minijackson <minijackson@riseup.net>
2024-07-05 17:49:10 -06:00
`services.fcgiwrap.*` to `services.fcgiwrap.instances.some-instance.*`.
nixos/fcgiwrap: add unix socket owner, private by default This adds a few options to properly set the ownership and permissions on UNIX local sockets, set to private by default. Previously, the created UNIX local sockets could be used by any local user. This was especially problematic when fcgiwrap is running as root (the default).
2024-06-08 15:07:30 -06:00
The ownership and mode of the UNIX sockets created by this service are now
configurable and private by default.
nixos/fcgiwrap: do not run as root by default Use a dynamic user instead unless one is specified.
2024-06-08 15:07:33 -06:00
Processes also now run as a dynamically allocated user by default instead of
root.
nixos/fcgiwrap: refactor for multiple instances This allows configuring and starting independent instances of the fgciwrap service, each with their own settings and running user, instead of having to share a global one. I could not use `mkRenamedOptionModule` on the previous options because the aliases conflict with `attrsOf submodule` now defined at `services.fcgiwrap`. This makes this change not backward compatible.
2024-06-08 14:34:13 -06:00
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- The `mautrix-signal` module was adapted to incorporate the configuration changes that resulted from the update to the mautrix bridgev2 architecture. Pre-0.7.0 configurations should continue to work.
In case you want to update your configuration, make sure to check the NixOS manual.
nixos/mautrix-signal: Adapt to new configuration With mautrix-signal v0.7.0 the bridge is built upon the bridgev2 architecture. With this, the configuration file was slightly rearranged. Options like login_shared_secret_map and double_puppet_server_map were dropped.
2024-09-01 23:12:50 -06:00
doc/release-notes: document cargo-tauri v2
2024-10-03 17:41:28 -06:00
- `cargo-tauri` has been updated to major version 2. Please review [the migration guide](https://tauri.app/start/migrate/from-tauri-1/).
v1 of `cargo-tauri` is still available as `cargo-tauri_1`, but will be removed in future releases.
nixos/nvidia: make the nvidia driver variant a mandatory user choice fixes #329450
2024-08-25 10:04:04 -06:00
- The nvidia driver no longer defaults to the proprietary driver starting with version 560. You will need to manually set `hardware.nvidia.open` to select the proprietary or open driver.
postgresql_12: remove This will be EOL at the end of November, so there's little reason to keep it in 24.11[1]. As discussed, we'd like to keep it for as long as possible to make sure there's a state in nixpkgs that has the latest minor of postgresql_12 available with the most recent CVEs fixed for people who cannot upgrade[2]. This aspect has been made explicit in the manual now for the next .11 release. During the discussions it has been brought up that if people just do `services.postgresql.enable = true;` and let the code decide the postgresql version based on `system.stateVersion`, there's a chance that such EOL dates will be missed. To make this harder, a warning will now be raised when using the stateVersion-condition and the oldest still available major is selected. Additionally regrouped the postgresql things in the release notes to make sure these are all shown consecutively. Otherwise it's a little hard to keep track of all the changes made to postgresql in 24.11. [1] https://endoflife.date/postgresql [2] https://github.com/NixOS/nixpkgs/pull/353158#issuecomment-2453056692
2024-11-02 09:52:02 -06:00
- `postgresql_12` has been removed since it reached its end of life.
postgresql: remove deprecated enableSystemd override This was deprecated in e6bfabf366b7dfdf67e24877dc5a24c5c1f8e62e, where we agreed on removing this after one release in [1]. Time has come! [1]: https://github.com/NixOS/nixpkgs/pull/292993#discussion_r1518883146
2024-09-24 12:04:32 -06:00
- `postgresql` no longer accepts the `enableSystemd` override. Use `systemdSupport` instead.
postgresql_12: remove This will be EOL at the end of November, so there's little reason to keep it in 24.11[1]. As discussed, we'd like to keep it for as long as possible to make sure there's a state in nixpkgs that has the latest minor of postgresql_12 available with the most recent CVEs fixed for people who cannot upgrade[2]. This aspect has been made explicit in the manual now for the next .11 release. During the discussions it has been brought up that if people just do `services.postgresql.enable = true;` and let the code decide the postgresql version based on `system.stateVersion`, there's a chance that such EOL dates will be missed. To make this harder, a warning will now be raised when using the stateVersion-condition and the oldest still available major is selected. Additionally regrouped the postgresql things in the release notes to make sure these are all shown consecutively. Otherwise it's a little hard to keep track of all the changes made to postgresql in 24.11. [1] https://endoflife.date/postgresql [2] https://github.com/NixOS/nixpkgs/pull/353158#issuecomment-2453056692
2024-11-02 09:52:02 -06:00
- `postgresql` was split into default and -dev outputs. To make this work without circular dependencies, the output of the `pg_config` system view has been removed. The `pg_config` binary is provided in the -dev output and still works as expected.
- The arguments from [](#opt-services.postgresql.initdbArgs) now get shell-escaped.
- `postgresql` is now [hardened by default](#module-services-postgres-hardening) using the common `systemd` settings for that.
nixos/release-notes: mention dhcpcd changes
2023-12-26 02:52:34 -07:00
- The dhcpcd service (`networking.useDHCP`) has been hardened and now runs exclusively as the "dhcpcd" user.
Users that were relying on the root privileges in `networking.dhcpcd.runHook` will have to write specific [sudo](security.sudo.extraRules) or [polkit](security.polkit.extraConfig) rules to allow dhcpcd to perform privileged actions.
As part of these changes, the DHCP lease files directory has also been moved from `/var/db/dhcpcd` to `/var/lib/dhcpcd`. This migration is performed automatically, but users may have to update their backup configuration.
singularity-tools: drop override argument storeDir
2023-04-03 08:38:17 -06:00
- `singularity-tools` have the `storeDir` argument removed from its override interface and use `builtins.storeDir` instead.
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- The `mkLayer` and `shellScript` build helpers in `singularity-tools` are deprecated, as they are no longer involved in image-building. Maintainers will remove them in future releases.
singularity-tools: deprecate build helpers mkLayer and shellScript Deprecate singularity-tools.mkLayer and singularity-tools.shellScript, for they are no longer related to image building. Use writers.writeBash instead of singularity-tools.shellScript.
2024-08-05 02:36:56 -06:00
nixos/doc/rl-2411: document "rust" deprecations
2024-09-02 11:51:47 -06:00
- The `rust.toTargetArch`, `rust.toTargetOs`, `rust.toTargetFamily`, `rust.toTargetVendor`, `rust.toRustTarget`, `rust.toRustTargetSpec`, `rust.toRustTargetSpecShort`, and `rust.IsNoStdTarget` functions are deprecated in favour of the `rust.platform.arch`, `rust.platform.os`, `rust.platform.target-family`, `rust.platform.vendor`, `rust.rustcTarget`, `rust.rustcTargetSpec`, `rust.cargoShortTarget`, `rust.cargoEnvVarTarget`, and `rust.isNoStdTarget` platform attributes respectively.
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- All Budgie and `budgiePlugins` packages have been moved to top-level (i.e.,
`budgie.budgie-desktop` is now `budgie-desktop` and `budgiePlugins.budgie-media-player-applet`
is now `budgie-media-player-applet`).
nixos/doc/rl-2411: `budgie` and `budgiePlugins` have been removed
2024-07-12 18:14:16 -06:00
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- The method of safely handling secrets in the `networking.wireless` module has been changed to benefit from a [new feature](https://w1.fi/cgit/hostap/commit/?id=e680a51e94a33591f61edb210926bcb71217a21a) of `wpa_supplicant`.
nixos/release-notes: mention networking.wireless changes
2022-07-09 10:39:19 -06:00
The syntax to refer to secrets has changed slightly and the option `networking.wireless.environmentFile` has been replaced by `networking.wireless.secretsFile`; see the description of the latter for how to upgrade.
netbox: switch to netbox_4_1, mark netbox_3_7 as EOL also switch the netbox-upgrade test to check upgrade from 3.7 -> 4.1
2024-08-02 03:32:32 -06:00
- NetBox was updated to `>= 4.1.0`.
Have a look at the breaking changes
of the [4.0 release](https://github.com/netbox-community/netbox/releases/tag/v4.0.0)
and the [4.1 release](https://github.com/netbox-community/netbox/releases/tag/v4.1.0),
make the required changes to your database, if needed,
then upgrade by setting `services.netbox.package = pkgs.netbox_4_1;`
in your configuration.
nixos/cgit: configurable user instead of root This allows running cgit instances using dedicated users instead of root. This is now set to "cgit" by default.
2024-06-08 15:08:55 -06:00
- `services.cgit` now runs as the cgit user by default instead of root.
This change requires granting access to the repositories to this user or
setting the appropriate one through `services.cgit.some-instance.user`.
oracle{jdk,jre}: drop "Unmaintained security disaster" -anonymous Nixpkgs maintainer
2024-11-01 20:42:27 -06:00
- All Oracle JDKs and JREs (`oraclejdk`, `oraclejdk8`, `oraclejre`, `oraclejre8`,
`jrePlugin`, `jre8Plugin`, `jdkdistro`, `oraclejdk8distro`, and `oraclejdk11`)
were dropped due to being unmaintained and heavily insecure. OpenJDK provides
compatible replacements for JDKs and JREs.
gradle_6: drop Unmaintained since 10 Feb 2023: https://endoflife.date/gradle Numerous security vulnerabilities: #352236
2024-10-30 17:02:41 -06:00
- `gradle_6` was removed due to being [unsupported upstream as of 10 Feb 2023](https://endoflife.date/gradle).
Additionally, it had numerous security vulnerabilities that were only patched
in later versions, such as [CVE-2021-29429](https://nvd.nist.gov/vuln/detail/CVE-2021-32751),
[CVE-2021-29427](https://nvd.nist.gov/vuln/detail/CVE-2021-29427), [CVE-2021-29428](https://nvd.nist.gov/vuln/detail/CVE-2021-29428), and [CVE-2021-32751](https://nvd.nist.gov/vuln/detail/CVE-2021-32751).
nvimpager: 0.12.0 -> 0.13.0
2024-05-20 15:50:54 -06:00
- `nvimpager` was updated to version 0.13.0, which changes the order of user and
nvimpager settings: user commands in `-c` and `--cmd` now override the
respective default settings because they are executed later.
24.05 is Vicuña
2024-05-22 10:15:34 -06:00
javacard-devkit: drop Had a dependency on the Oracle JDK, as well as being several years out-of-date.
2024-11-01 20:17:32 -06:00
- `javacard-devkit` was dropped due to having a dependency on the Oracle JDK,
as well as being several years out-of-date.
nixos/kubernetes: refactor feature gates to attrsOf bool, making it possible to disable featureGates This is a breaking change, requiring users of `featureGates` to change from a `listOf str` to `attrsOf bool`. Before: ```nix featureGates = [ "EphemeralContainers" ]; extraOpts = pkgs.lib.concatStringsSep " " ( [ "--container-runtime=remote" ''--feature-gates="CSIMigration=false"'' }); ``` After: ```nix featureGates = {EphemeralContainers = true; CSIMigration=false;}; ``` This is much nicer, and sets us up for later work of migrating to configuration files for other services, like e.g. has been happening with kubelet (see: #290119). Signed-off-by: Christina Sørensen <christina@cafkafk.com>
2024-07-17 01:10:17 -06:00
- Kubernetes `featureGates` have changed from a `listOf str` to `attrsOf bool`.
This refactor makes it possible to also disable feature gates, without having
to use `extraOpts` flags.
A previous configuration may have looked like this:
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
nixos/kubernetes: refactor feature gates to attrsOf bool, making it possible to disable featureGates This is a breaking change, requiring users of `featureGates` to change from a `listOf str` to `attrsOf bool`. Before: ```nix featureGates = [ "EphemeralContainers" ]; extraOpts = pkgs.lib.concatStringsSep " " ( [ "--container-runtime=remote" ''--feature-gates="CSIMigration=false"'' }); ``` After: ```nix featureGates = {EphemeralContainers = true; CSIMigration=false;}; ``` This is much nicer, and sets us up for later work of migrating to configuration files for other services, like e.g. has been happening with kubelet (see: #290119). Signed-off-by: Christina Sørensen <christina@cafkafk.com>
2024-07-17 01:10:17 -06:00
```nix
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
{
featureGates = [ "EphemeralContainers" ];
extraOpts = pkgs.lib.concatStringsSep " " (
[
''--feature-gates="CSIMigration=false"''
]
);
}
nixos/kubernetes: refactor feature gates to attrsOf bool, making it possible to disable featureGates This is a breaking change, requiring users of `featureGates` to change from a `listOf str` to `attrsOf bool`. Before: ```nix featureGates = [ "EphemeralContainers" ]; extraOpts = pkgs.lib.concatStringsSep " " ( [ "--container-runtime=remote" ''--feature-gates="CSIMigration=false"'' }); ``` After: ```nix featureGates = {EphemeralContainers = true; CSIMigration=false;}; ``` This is much nicer, and sets us up for later work of migrating to configuration files for other services, like e.g. has been happening with kubelet (see: #290119). Signed-off-by: Christina Sørensen <christina@cafkafk.com>
2024-07-17 01:10:17 -06:00
```
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
Using an attribute set instead, the new configuration would be:
nixos/kubernetes: refactor feature gates to attrsOf bool, making it possible to disable featureGates This is a breaking change, requiring users of `featureGates` to change from a `listOf str` to `attrsOf bool`. Before: ```nix featureGates = [ "EphemeralContainers" ]; extraOpts = pkgs.lib.concatStringsSep " " ( [ "--container-runtime=remote" ''--feature-gates="CSIMigration=false"'' }); ``` After: ```nix featureGates = {EphemeralContainers = true; CSIMigration=false;}; ``` This is much nicer, and sets us up for later work of migrating to configuration files for other services, like e.g. has been happening with kubelet (see: #290119). Signed-off-by: Christina Sørensen <christina@cafkafk.com>
2024-07-17 01:10:17 -06:00
```nix
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
{
featureGates = {
EphemeralContainers = true;
CSIMigration=false;
};
}
nixos/kubernetes: refactor feature gates to attrsOf bool, making it possible to disable featureGates This is a breaking change, requiring users of `featureGates` to change from a `listOf str` to `attrsOf bool`. Before: ```nix featureGates = [ "EphemeralContainers" ]; extraOpts = pkgs.lib.concatStringsSep " " ( [ "--container-runtime=remote" ''--feature-gates="CSIMigration=false"'' }); ``` After: ```nix featureGates = {EphemeralContainers = true; CSIMigration=false;}; ``` This is much nicer, and sets us up for later work of migrating to configuration files for other services, like e.g. has been happening with kubelet (see: #290119). Signed-off-by: Christina Sørensen <christina@cafkafk.com>
2024-07-17 01:10:17 -06:00
```
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `pkgs.nextcloud27` has been removed as it has reached EOL.
nextcloud27: remove Version will be EOL by the end of 2024-06.
2024-06-25 06:08:15 -06:00
nixos: remove environment.noXlibs
2024-09-13 16:03:03 -06:00
- The `environment.noXlibs` option has been removed. It was a common source of unexpected rebuilds and breakage that was often hard to diagnose.
If you need to disable certain libraries, you're encouraged to add your own overlay to your configuration that targets the packages you care about.
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `frigate` was updated past 0.14.0. This release includes various breaking changes, so please review the [release notes](https://github.com/blakeblackshear/frigate/releases/tag/v0.14.0).
Most prominently, access to the web interface and API are now protected by authentication. Retrieve the auto-created
nixos/doc/rl-2411: frigate breaking changes
2024-08-30 20:58:27 -06:00
admin account from the `frigate.service` journal after upgrading.
{nodePackages,vimPlugins}.coc-python: drop See notice in the README: https://github.com/neoclide/coc-python > WARNING: it's recommended to use coc-pyright if > you're using python3 or use coc-jedi if you're using jedi, > the code of coc-python is too hard to maintain! If that isn't convincing, the repo was archived on 2020-12-24. Part of #229475
2024-10-15 23:44:39 -06:00
- `nodePackages.coc-python` was dropped, as [its upstream is unmaintained](https://github.com/neoclide/coc-python). The associated `vimPlugins.coc-python` was also dropped.
The upstream project recommends using `coc-pyright` or `coc-jedi` as replacements.
forgejo: 8.0.3 -> 9.0.0 Forgejo v9 is now licensed under GPL-3.0-or-later. Release notes: https://codeberg.org/forgejo/forgejo/milestone/7235
2024-10-06 06:20:23 -06:00
- `forgejo` has been upgraded from version 7.0 to version 9.0, see the release notes for [8.0](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#8-0-0) and [9.0](https://codeberg.org/forgejo/forgejo/milestone/7235).
nixos/rl-2411: add `services.forgejo.secrets` and the accompanying `services.forgejo.mailerPasswordFile` deprecation.
2024-06-04 17:03:10 -06:00
- `services.forgejo.mailerPasswordFile` has been deprecated by the drop-in replacement `services.forgejo.secrets.mailer.PASSWD`,
which is part of the new free-form `services.forgejo.secrets` option.
`services.forgejo.secrets` is a small wrapper over systemd's `LoadCredential=`. It has the same structure (sections/keys) as
`services.forgejo.settings` but takes file paths that will be read before service startup instead of some plaintext value.
forgejo: 8.0.3 -> 9.0.0 Forgejo v9 is now licensed under GPL-3.0-or-later. Release notes: https://codeberg.org/forgejo/forgejo/milestone/7235
2024-10-06 06:20:23 -06:00
`services.forgejo.package` now defaults to `forgejo-lts`, the Long Term Support version of Forgejo.
nixos/rl-2411: add `services.forgejo.secrets` and the accompanying `services.forgejo.mailerPasswordFile` deprecation.
2024-06-04 17:03:10 -06:00
forgejo,forgejo-lts: remove PAM support https://forgejo.org/docs/latest/user/authentication/#pam-pluggable-authentication-module PAM support has to be enabled at compile time and upstream considers it opt-in. Official upstream binaries have it disabled. We enabled it by default because we simply inherited most of it from Gitea when the split in nixpkgs happened. Reasons why it had been enabled in nixpkgs for Gitea are unknown. See 9406f240a7b5ed68e8e633b8c764cfd69c470696. There is reason to believe not a single Forgejo instance running on NixOS uses this feature because it literally segfaults due to our sandboxing.
2024-08-17 13:07:23 -06:00
- `forgejo` and `forgejo-lts` no longer support the opt-in feature [PAM (Pluggable Authentication Module)](https://forgejo.org/docs/latest/user/authentication/#pam-pluggable-authentication-module).
nixos/release-notes: fix md link in section about gitea Reported in https://github.com/NixOS/nixpkgs/pull/336995#discussion_r1760042825.
2024-09-15 08:38:13 -06:00
- `gitea` no longer supports the opt-in feature [PAM (Pluggable Authentication Module)](https://docs.gitea.com/usage/authentication#pam-pluggable-authentication-module).
gitea: drop PAM support Strongly inspired by the forgejo counterpart[1], for the following reasons: * The feature is broken with the current module and crashes on authentication with the following stacktrace (with a PAM service `gitea` added): server # Stack trace of thread 1008: server # #0 0x00007f3116917dfb __nptl_setxid (libc.so.6 + 0x8ddfb) server # #1 0x00007f3116980ae6 setuid (libc.so.6 + 0xf6ae6) server # #2 0x00007f30cc80f420 _unix_run_helper_binary (pam_unix.so + 0x5420) server # #3 0x00007f30cc8108c9 _unix_verify_password (pam_unix.so + 0x68c9) server # #4 0x00007f30cc80e1b5 pam_sm_authenticate (pam_unix.so + 0x41b5) server # #5 0x00007f3116a84e5b _pam_dispatch (libpam.so.0 + 0x3e5b) server # #6 0x00007f3116a846a3 pam_authenticate (libpam.so.0 + 0x36a3) server # #7 0x00000000029b1e7a n/a (.gitea-wrapped + 0x25b1e7a) server # #8 0x000000000047c7e4 n/a (.gitea-wrapped + 0x7c7e4) server # ELF object binary architecture: AMD x86-64 server # server # [ 42.420827] gitea[897]: pam_unix(gitea:auth): unix_chkpwd abnormal exit: 159 server # [ 42.423142] gitea[897]: pam_unix(gitea:auth): authentication failure; logname= uid=998 euid=998 tty= ruser= rhost= user=snenskek It only worked after turning off multiple sandbox settings and adding `shadow` as supplementary group to `gitea.service`. I'm not willing to maintain additional multiple sandbox settings for different features, especially given that it was probably not used for quite a long time: * There was no PR or bugreport about sandboxing issues related to PAM. * Ever since the module exists, it used the user `gitea`, i.e. it had never read-access to `/etc/shadow`. * Upstream has it disabled by default[2]. If somebody really needs it, it can still be brought back by an overlay updating `tags` accordingly and modifying the systemd service config. [1] 07641a91c96ddb9030ac13d62e3a3e0bb1495842 [2] https://docs.gitea.com/usage/authentication#pam-pluggable-authentication-module
2024-08-24 05:12:21 -06:00
vuze: drop No releases since early 2017: https://en.wikipedia.org/wiki/Vuze#Development_hiatus_and_fork Vulnerable to CVE-2018-13417 BiglyBT (`biglybt`) is a maintained fork.
2024-11-22 21:20:06 -07:00
- `vuze` was removed because it is unmaintained upstream and insecure (CVE-2018-13417).
BiglyBT is a maintained fork.
nixos/ddclient: deprecate `use`, implement `use{v4,v6}` Upstream replaced `use` with `use{v4,v6}`: https://github.com/ddclient/ddclient/blob/4a1b06630b90b3e6ff1d837b849bdbc68a2f53f9/ChangeLog.md#new-features
2024-05-09 03:02:08 -06:00
- `services.ddclient.use` has been deprecated: `ddclient` now supports separate IPv4 and IPv6 configuration. Use `services.ddclient.usev4` and `services.ddclient.usev6` instead.
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `services.pgbouncer` systemd service is now configured with `Type=notify-reload` and allows reloading configuration without process restart. PgBouncer configuration options were moved to the freeform type option under [`services.pgbouncer.settings`](#opt-services.pgbouncer.settings).
nixos/pgbouncer: add services.pgbouncer.settings option This change adds services.pgbouncer.settings option as per [RFC 0042] and deprecates other options that were previously used to generate configuration file. In addition to that, we also place the configuration file under environment.etc to allow reloading configuration without service restart. [RFC 0042]: https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md
2024-05-02 21:22:23 -06:00
docear: drop Upstream itself says it is not actively developed: https://docear.org/2017/10/05/update-for-the-google-scholar-parser-library-to-fetch-metadata-for-pdf-files/ The sole Nixpkgs maintainer has not used Docear in 4 years: https://github.com/NixOS/nixpkgs/pull/353043#discussion_r1826528473
2024-11-01 20:21:10 -06:00
- Docear was removed because it was unmaintained upstream.
JabRef, Zotero, or Mendeley are potential replacements.
{nodePackages,vimPlugins}.coc-metals: drop Upstream deprecated it: https://github.com/scalameta/coc-metals Upstream recommends vimPlugins.nvim-metals instead. Part of #229475
2024-10-16 12:01:49 -06:00
- `nodePackages.coc-metals` was removed due to being deprecated upstream.
`vimPlugins.nvim-metals` is its official replacement.
matrix-sliding-sync: drop On the 2024 matrix conference the EOL for the sliding-sync-proxy was announced to be 2024-10-15. While the repo does not yet reflect that state, we should not be taking the the sliding-sync proxy into NixOS 24.11 under any circumstances.
2024-10-20 14:48:29 -06:00
- `matrix-sliding-sync` was removed because it has been replaced by the simplified sliding sync functionality introduced in matrix-synapse 114.0.
{nodePackages,vimPlugins}.coc-tslint{,-plugin}: drop Both deprecated upstream: https://github.com/neoclide/coc-tslint https://github.com/neoclide/coc-tslint-plugin coc-eslint provides comparable features and is maintained. Part of #229475
2024-10-18 17:41:34 -06:00
- `nodePackages.coc-tslint`, `vimPlugins.coc-tslint`, `nodePackages.coc-tslint-plugin`,
and `vimPlugins.coc-tslint-plugin` were removed due to being deprecated upstream. The
`nodePackages.coc-eslint` and `vimPlugins.coc-eslint` packages offer comparable
features for `eslint`, which replaced `tslint`.
release-notes: Mention the new tclPackages scope
2024-10-25 14:21:03 -06:00
- Tcl packages have been moved into the `tclPackages` scope.
teleport_16: init at 16.0.4
2024-07-04 11:28:15 -06:00
- `teleport` has been upgraded from major version 15 to major version 16.
Refer to upstream [upgrade instructions](https://goteleport.com/docs/management/operations/upgrading/)
and [release notes for v16](https://goteleport.com/docs/changelog/#1600-061324).
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `tests.overriding`'s `passthru.tests` has been restructured as an attribute set instead of a list, making individual tests accessible by their names.
tests.overriding: structure tests as an attribut set Make individual tests accessible via tests.override.tests.<name>
2024-07-25 13:07:48 -06:00
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `skk-dict` was split into multiple packages under `skkDictionaries`.
If in doubt of what to use, try `skkDictionaries.l`. As part of this change, the dictionaries
were moved from `$out/share` to `$out/share/skk`. The dictionaries also won't
be converted to UTF-8 unless the `useUtf8` package option is enabled; UTF-8
skkDictionaries: replace skk-dicts
2023-11-07 11:42:25 -07:00
converted dictionaries will have the .utf8 suffix appended to its filename.
nixos/vaultwarden: harden systemd unit Drops the capability to bind to privileged ports.
2024-06-10 18:42:39 -06:00
- `vaultwarden` lost the capability to bind to privileged ports. If you rely on
this behavior, override the systemd unit to allow `CAP_NET_BIND_SERVICE` in
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
your configuration.
nixos/vaultwarden: harden systemd unit Drops the capability to bind to privileged ports.
2024-06-10 18:42:39 -06:00
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `services.invoiceplane.sites.<name>.extraConfig` was removed. Configuration must now be done
through the structured `services.invoiceplane.sites.<name>.settings` option.
nixos/invoiceplane: Remove deprecated extraConfig
2023-12-09 02:46:27 -07:00
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `services.ollama.sandbox` has been replaced with options to configure
a static `user` and `group`. The `writablePaths` option has also been removed and
nixos/doc/rl-2411: add ollama changes
2024-07-21 15:58:41 -06:00
the models directory is now always exempt from sandboxing.
nixos/gns3-server: disable SystemD hardening
2024-09-23 12:46:10 -06:00
- The `gns3-server` service now runs under the `gns3` system user
instead of a dynamically created one via `DynamicUser`.
The use of SUID wrappers is incompatible with SystemD's `DynamicUser` setting,
and GNS3 requires calling ubridge through its SUID wrapper to function properly.
This change requires to manually move the following directories:
* from `/var/lib/private/gns3` to `/var/lib/gns3`
* from `/var/log/private/gns3` to `/var/log/gns3`
and to change the ownership of these directories and their contents to `gns3` (including `/etc/gns3`).
nixos/stalwart-mail: add release notes
2024-05-24 04:25:33 -06:00
- Legacy package `stalwart-mail_0_6` was dropped, please note the
[manual upgrade process](https://github.com/stalwartlabs/mail-server/blob/main/UPGRADING.md)
before changing the package to `pkgs.stalwart-mail` in
[`services.stalwart-mail.package`](#opt-services.stalwart-mail.package).
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `nomad_1_5` and `nomad_1_6` were dropped, as [they have reached end-of-life upstream](https://support.hashicorp.com/hc/en-us/articles/360021185113-Support-Period-and-End-of-Life-EOL-Policy). Evaluating them will throw an error.
add changelog notes for breaking nomad changes
2024-10-16 16:05:56 -06:00
- The default `nomad` package has been updated to 1.8.x. For more information, see [breaking changes for Nomad 1.8](https://developer.hashicorp.com/nomad/docs/upgrade/upgrade-specific#nomad-1-8-0)
nomad_1_5: deprecate
2024-07-20 13:03:04 -06:00
lib.systems.examples: update default android sdk to 33, ndk to 26
2024-06-11 14:18:26 -06:00
- `androidndkPkgs` has been updated to `androidndkPkgs_26`.
- Android NDK version 26 and SDK version 33 are now the default versions used for cross compilation to android.
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `ankisyncd` package and its `services.ankisyncd` have been removed. Use [`services.anki-sync-server`](#opt-services.anki-sync-server.enable) instead.
ankisyncd: remove
2024-08-09 23:21:00 -06:00
nixos/doc/rl-2411: drop nodePackages.vscode-*-bin Packages dropped: * nodePackages.vscode-css-languageserver-bin * nodePackages.vscode-json-languageserver-bin * nodePackages.vscode-html-languageserver-bin
2024-06-26 02:29:02 -06:00
- `nodePackages.vscode-css-languageserver-bin`, `nodePackages.vscode-html-languageserver-bin`,
and `nodePackages.vscode-json-languageserver-bin` were dropped due to an unmaintained upstream.
The `vscode-langservers-extracted` package is a maintained drop-in replacement.
prisma: init at 5.18.0
2024-08-27 12:14:29 -06:00
- `nodePackages.prisma` has been replaced by `prisma`.
fetchNextcloudApp: use fetchurl by default
2024-08-04 05:54:11 -06:00
- `fetchNextcloudApp` has been rewritten to use `fetchurl` rather than
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
`fetchzip`. This invalidates all existing hashes, but you can restore the old
fetchNextcloudApp: use fetchurl by default
2024-08-04 05:54:11 -06:00
behavior by passing it `unpack = true`.
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `haskell.lib.compose.justStaticExecutables` now disallows references to GHC in its
output by default to alert users to closure size issues caused by
haskell.lib.compose.justStaticExecutables: Forbid references to GHC This makes `justStaticExecutables` error if the produced store path contains references to GHC. This is almost always erroneous and due to the generated `Paths_*` module being imported. This helps prevent `justStaticExecutables` from producing binaries with closure sizes in the gigabytes. See: https://github.com/NixOS/nixpkgs/issues/164630 Co-authored-by: sternenseemann <sternenseemann@systemli.org>
2024-04-15 13:45:45 -06:00
[#164630](https://github.com/NixOS/nixpkgs/issues/164630). See ["Packaging
Helpers" in the Haskell section of the Nixpkgs
manual](https://nixos.org/manual/nixpkgs/unstable/#haskell-packaging-helpers)
for information on working around `output '...' is not allowed to refer to
the following paths` errors caused by this change.
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `services.stalwart-mail` now runs under the `stalwart-mail` system user
instead of a dynamic one via `DynamicUser` in order to avoid automatic
ownership changes on its large file store on service restart.
doc/release-notes: migration note for stalwart-mail user This follows 6ee84bcda0a817434597dba0e5789cc8b7232d58. Here I prefer a simple mention in the release notes instead of some automatic migration, which could interfere with all the other changes already potentially requiring some admin interventions. Co-authored-by: Sandro Jäckel <sandro.jaeckel@gmail.com>
2024-06-04 10:14:35 -06:00
This change requires to manually move the state directory from
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
`/var/lib/private/stalwart-mail` to `/var/lib/stalwart-mail`, and to
doc/release-notes: migration note for stalwart-mail user This follows 6ee84bcda0a817434597dba0e5789cc8b7232d58. Here I prefer a simple mention in the release notes instead of some automatic migration, which could interfere with all the other changes already potentially requiring some admin interventions. Co-authored-by: Sandro Jäckel <sandro.jaeckel@gmail.com>
2024-06-04 10:14:35 -06:00
change the ownership of the directory and its content to `stalwart-mail`.
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `services.stalwart-mail` now uses RocksDB as the default storage backend
for `stateVersion` ≥ 24.11. It was previously using SQLite for structured
data and the filesystem for blobs.
nixos/stalwart-mail: rocksdb as default storage This sets RocksDB as the default storage backend for `stateVersion` >= 24.11. For previous `stateVersion`s, the structured data and blobs remain on SQLite and the filesystem respectively. This is closer to the suggested upstream configuration for fully local storage.
2024-05-30 08:22:03 -06:00
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `services.stargazer` has been hardened to improve security, but these
nixos/stargazer: harden systemd service
2024-03-10 13:22:32 -06:00
changes make break certain setups, particularly around traditional CGI.
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `services.stargazer.allowCgiUser` has been added, enabling
nixos/stargazer: harden systemd service
2024-03-10 13:22:32 -06:00
Stargazer's `cgi-user` option to work, which was previously broken.
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `services.shiori` now requires the HTTP secret value `SHIORI_HTTP_SECRET_KEY` to be provided as an environment variable. `services.shiori.environmentFile` has been introduced to handle this:
rl-2411: document new setting required for shiori
2024-06-30 05:48:21 -06:00
```
# This is how a environment file can be generated:
# $ printf "SHIORI_HTTP_SECRET_KEY=%s\n" "$(openssl rand -hex 16)" > /path/to/env-file
services.shiori.environmentFile = "/path/to/env-file";
```
nixos/nano: only link `/share/nano` when nano is enabled
2024-07-10 12:29:50 -06:00
- `/share/nano` is now only linked when `programs.nano.enable` is enabled.
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- PPD files for Utax printers were renamed (spaces replaced by underscores) in the newest `foomatic-db` package. Users of Utax printers might need to adapt their `hardware.printers.ensurePrinters.*.model` value to account for this.
foomatic-db: unstable-2024-05-04 -> unstable-2024-08-13 This update renames Utax ppd files to avoid spaces in filenames. Since this is an incompatible change, we also add a hint in the release notes.
2024-08-13 23:00:47 -06:00
sqldeveloper: drop sqldeveloper was dropped due to being severely out-of-date and having a dependency on JavaFX for Java 8, which we do not support.
2024-11-02 12:11:06 -06:00
- `sqldeveloper` was dropped due to being severely out-of-date and having a dependency on
JavaFX for Java 8, which we do not support.
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- The `kvdo` kernel module package was removed as it was upstreamed in kernel version 6.9, where it is now called `dm-vdo`.
kvdo: drop
2024-07-08 10:55:38 -06:00
release-notes: Mention `libe57format` upgrade
2023-07-01 09:46:53 -06:00
- `libe57format` has been updated to `>= 3.0.0`, which contains some backward-incompatible API changes. See the [release note](https://github.com/asmaloney/libE57Format/releases/tag/v3.0.0) for more details.
nixos/doc/rl-2411: Add a deprecation notice for gitlab
2024-06-19 08:06:19 -06:00
- `gitlab` deprecated support for *runner registration tokens* in GitLab 16.0, disabled their support in GitLab 17.0 and will
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
ultimately remove it in GitLab 18.0 (as outlined in the
[documentation](https://docs.gitlab.com/17.0/ee/ci/runners/new_creation_workflow.html#estimated-time-frame-for-planned-changes)).
nixos/doc/rl-2411: Add a deprecation notice for gitlab
2024-06-19 08:06:19 -06:00
After upgrading to GitLab >= 17.0, it is possible to re-enable support for registration tokens in the UI until GitLab 18.0.
Refer to the manual on [using registration tokens after GitLab 17.0](https://docs.gitlab.com/17.0/ee/ci/runners/new_creation_workflow.html#using-registration-tokens-after-gitlab-170).
GitLab administrators should migrate to the [new runner registration workflow](https://docs.gitlab.com/17.0/ee/ci/runners/new_creation_workflow.html#using-registration-tokens-after-gitlab-170)
with *runner authentication tokens* until the release of GitLab 18.0.
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `gitlab` has been updated from 16.x to 17.x and requires `postgresql` >= 14.9, as stated in the [documentation](https://docs.gitlab.com/17.1/ee/install/requirements.html#postgresql-requirements). Check the [upgrade guide](#module-services-postgres-upgrading) in the NixOS manual on how to upgrade your PostgreSQL installation.
nixos/doc/rl-2411: Mention minimal postgresql requirement for gitlab 17 `gitlab` >= 17.0 requires at least `postgresql` >= 14.9. GitLab users are advised to follow the mentioned steps in the manual to upgrade their PostgreSQL installation.
2024-06-27 04:34:47 -06:00
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `gitaly` (part of `gitlab`) is now using the bundled `git` package instead of `pkgs.git`, to maintain compatibility with GitLab.
nixos/doc/rl-2411: Mention a change in nixos/gitlab `gitaly` is now using the bundled git package instead of `pkgs.git` internally to maintain compatibility with GitLab.
2024-07-08 02:36:08 -06:00
- `nixos/gitlab` no longer adds `pkgs.git` to `environment.systemPackages` by default.
replay-sorcery: remove as it is unmaintained upstream
2024-07-13 12:41:29 -06:00
- The `replay-sorcery` package and module was removed as it unmaintained upstream. Consider using `gpu-screen-recorder` or `obs-studio` instead.
doc/release-notes: RFC 42 -> freeform options "Freeform options" is a term that's a bit more meaningful to regular users who don't follow development, and thus does a better job at describing the changes
2024-10-21 19:51:57 -06:00
- A few options of `services.samba` have been moved from `extraConfig` and `configText` to the new freeform option `settings` and renamed, e.g.:
nixos/samba: migrate to structural settings (RFC42)
2024-04-08 14:34:05 -06:00
- `services.samba.invalidUsers` to `services.samba.settings.global."invalid users"`
- `services.samba.securityType` to `services.samba.settings.global."security type"`
- `services.samba.shares` to `services.samba.settings`
- `services.samba.enableWinbindd` to `services.samba.winbindd.enable`
- `services.samba.enableNmbd` to `services.samba.nmbd.enable`
doc(rl-24.11): zx v8 breaking changes
2024-06-03 15:16:55 -06:00
- `zx` was updated to v8, which introduces several breaking changes.
See the [v8 changelog](https://github.com/google/zx/releases/tag/8.0.0) for more information.
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `feishin` removed support for Navidrome `< v0.53.2` due to an API change. See the [v0.10.0 release notes](https://github.com/jeffvli/feishin/releases/tag/v0.10.0) for more information.
nixos/rl-2411: feishin requirements for Navidrome More in https://github.com/jeffvli/feishin/releases/tag/v0.10.0
2024-09-30 23:10:04 -06:00
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `services.dnscrypt-wrapper` was removed, as the project has been effectively unmaintained since 2018. Moreover, the NixOS module had to rely on an abandoned version of `dnscrypt-proxy` v1 for the rotation of keys.
To wrap a resolver with DNSCrypt, you can instead use `dnsdist`. See `services.dnsdist.dnscrypt`
dnscrypt-wrapper: remove package and NixOS modules
2024-09-14 07:36:12 -06:00
portunus: remove libxcrypt-legacy usage
2024-06-01 02:28:21 -06:00
- The `portunus` package and service do not support weak password hashes anymore.
If you installed Portunus on NixOS 23.11 or earlier, upgrade to NixOS 24.05 first to get support for strong password hashing.
Then, follow the instructions on the [upstream release notes](https://github.com/majewsky/portunus/releases/tag/v2.0.0) to upgrade all existing user accounts to strong password hashes.
If you need to upgrade to 24.11 without having completed the migration, consider the security implications of weak password hashes on your user accounts, and add the following to your configuration:
```nix
services.portunus.package = pkgs.portunus.override { libxcrypt = pkgs.libxcrypt-legacy; };
services.portunus.ldap.package = pkgs.openldap.override { libxcrypt = pkgs.libxcrypt-legacy; };
```
nixos/services.kubernetes.kubelet: handle non-lower case characters in hostname
2024-05-27 10:52:48 -06:00
- The default value of `services.kubernetes.kubelet.hostname` is now lowercased.
Explicitly set `kubelet.hostname` to `networking.fqdnOrHostName` to get back
the old default behavior.
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- Docker now defaults to 27.x, as version 24.x stopped receiving security updates and bug fixes after [February 1, 2024](https://github.com/moby/moby/pull/46772#discussion_r1686464084).
docker: move default from 24.x to 27.x 24.x is no longer maintained as of February 1, 2024[1]. It did not (yet?) receive a fix for CVE-2024-41110. [1] https://github.com/moby/moby/pull/46772#discussion_r1686464084
2024-07-26 01:40:39 -06:00
nixos/keycloak: update options for release 25.0.0 Reference: https://www.keycloak.org/docs/25.0.0/upgrading/
2024-06-10 05:40:05 -06:00
- `keycloak` was updated to version 25, which introduces new hostname related options.
See [Upgrading Guide](https://www.keycloak.org/docs/25.0.1/upgrading/#migrating-to-25-0-0) for instructions.
nixos/vim: add enable option and link `/share/vim-plugins` only when vim is enabled
2024-07-10 12:59:22 -06:00
- `programs.vim.defaultEditor` now only works if `programs.vim.enable` is enabled.
nixos.mautrix-meta: Update config to 0.4 format The package has been updated to 0.4 which will result in an auto-migration of the config. This updates our config to match the new expected format. Assertions have been added to warn users that they need to migrate their configuration.
2024-09-21 16:48:45 -06:00
- `services.mautrix-meta` was updated to [0.4](https://github.com/mautrix/meta/releases/tag/v0.4.0). This release makes significant changes to the settings format. If you have custom settings you should migrate them to the new format. Unfortunately upstream provides little guidance for how to do this, but [the auto-migration code](https://github.com/mautrix/meta/blob/f5440b05aac125b4c95b1af85635a717cbc6dd0e/cmd/mautrix-meta/legacymigrate.go#L23) may serve as a useful reference. The NixOS module should warn you if you still have any old settings configured.
nodePackages.shout: drop shout has been deprecated since 2016: https://github.com/erming/shout/commit/90a62c56af4412c6b0e0ae51fe84f3825f49e226 Also, move the top-level `shout` alias to `pkgs/top-level/aliases.nix`. Part of #229475
2024-10-19 00:56:32 -06:00
- The `nodePackages.shout` package has been removed because it was deprecated upstream in favor of `thelounge`.
The `shout` top-level attribute was an alias to this package.
The associated `services.shout` module has also been removed.
doc/release-notes: correctly place backwards incompatible changes These changes seemed to have been placed in the wrong section
2024-10-02 21:37:42 -06:00
- `prometheus-openldap-exporter` was removed, as it was unmaintained both upstream and in nixpkgs.
indi-full: refactor 3rdparty drivers This splits the 3rdparty drivers into seperate packages as recommended by upstream. This also allows to build a indi-full equivalent with only the needed drivers. Also add indi-full-nonfree with all the nonfree drivers. And remove them from indi-full.
2023-10-29 15:01:59 -06:00
- The `indi-full` package no longer contains non-free drivers.
To get the old collection of drivers use `indi-full-nonfree` or create your own collection of drivers by overriding indi-with-drivers.
E.g.: `pkgs.indi-with-drivers.override {extraDrivers = with pkgs.indi-3rdparty; [indi-gphoto];}`
nixos/vim: add enable option and link `/share/vim-plugins` only when vim is enabled
2024-07-10 12:59:22 -06:00
- `/share/vim-plugins` now only gets linked if `programs.vim.enable` is enabled
nixos/guix: add declarative substituters option
2024-03-10 03:24:45 -06:00
- The `services.guix` module now manages trusted substitute servers
declaratively. Instead of `guix archive --authorize`, list keys with
`services.guix.substituters.authorizedKeys`. Default substitute servers can be
set via `services.guix.substituters.urls`.
tracy: move to wayland, add tracy-x11
2024-06-15 14:52:03 -06:00
- The `tracy` package no longer works on X11, since it's moved to Wayland
support, which is the intended default behavior by Tracy maintainers.
X11 users have to switch to the new package `tracy-x11`.
doc/release-notes: correctly place backwards incompatible changes These changes seemed to have been placed in the wrong section
2024-10-02 21:37:42 -06:00
- `gollum` has been upgraded to major version 6. Please review their [migration notes](https://github.com/gollum/gollum/wiki/6.0-Release-Notes).
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `services.prometheus.exporters.minio` option has been removed, as it's upstream implementation was broken and unmaintained.
nixos/prometheus: remove minio exporter
2024-06-10 09:55:52 -06:00
Minio now has built-in [Prometheus metrics exposure](https://min.io/docs/minio/linux/operations/monitoring/collect-minio-metrics-using-prometheus.html), which can be used instead.
nixos/prometheus: remove tor exporter
2024-10-30 12:20:01 -06:00
- The `services.prometheus.exporters.tor` option has been removed, as its upstream implementation was broken and unmaintained.
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `services.patroni.raft` has been removed, as Raft has been [deprecated by upstream since 3.0.0](https://github.com/patroni/patroni/blob/master/docs/releases.rst#version-300).
nixos/patroni: remove raft
2024-07-03 18:25:48 -06:00
jd-cli: drop JCenter Bintray is dead. This package depends on jd-core, which was only hosted through JCenter Bintray.
2024-10-30 13:14:14 -06:00
- The `jd-cli` package was removed due to an inactive upstream and a dependency on the shut down
JCenter JAR repository.
Java decompilers already packaged in Nixpkgs include `bytecode-viewer` (GUI), `cfr` (CLI), and `procyon` (CLI).
jd-gui: drop Upstream has no commits since 2019: https://github.com/java-decompiler/jd-gui jd-gui uses Gradle 6, which has been EOL since 10 Feb 2023: https://endoflife.date/gradle (The JDK team is working on dropping Gradle 6). Attempting to build with a newer Gradle fails with a nontrivial error. Potential replacements: cfr, bytecode-viewer, procyon
2024-10-30 11:12:50 -06:00
- The `jd-gui` package was removed due to an inactive upstream and a dependency on the end-of-life Gradle 6.
Java decompilers already packaged in Nixpkgs include `bytecode-viewer` (GUI), `cfr` (CLI), and `procyon` (CLI).
nixos/roundcube: adjust maxAttachmentSize, clarify documentation
2024-07-04 10:51:32 -06:00
- `services.roundcube.maxAttachmentSize` will multiply the value set with `1.37` to offset overhead introduced by the base64 encoding applied to attachments.
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `services.mxisd` has been removed as both [mxisd](https://github.com/kamax-matrix/mxisd) and [ma1sd](https://github.com/ma1uta/ma1sd) are no longer maintained.
Consequently, the package `ma1sd` has also been removed.
nixos/mxisd: remove module mxisd and ma1sd are both unmaintained
2024-07-10 10:40:06 -06:00
rss-bridge: Remove pkg patch, adapt nixos service The rss-bridge service changes introduced in f2201789fe442282c7ec17c225a9a78dd1973a09 resp. https://github.com/NixOS/nixpkgs/pull/223148 removes the need for the package patch. This commit removes the patch to ease updating and maintenance. Relevant service functionality was also removed (e.g. the setting of RSSBRIDGE_DATA). The explicit definition of FileCache.path so users can easily see its default value and change it, requires to use a freeformType to let users freely add potentially upcoming config options. This type is restricted to ini types (although we coerce them to environment variables). This however makes the list of enabled_bridges impossible. That was fixed by explicitly introducing this option with a type allowing lists. The default value however should be unset, which is expressed as `null`, which further spurred a change in the environment variable generation to ignore null values (instead of coercing them to an empty string). A breaking change note was added to highlight this change. A check that warns users of the not-application of their existing config file is not easily possible, as people could have only added or changed the config.ini.php file on the file system without changing a nix variable.
2024-07-31 06:38:43 -06:00
- The `rss-bridge` service drops the support to load a configuration file from `${config.services.rss-bridge.dataDir}/config.ini.php`.
Consider using the `services.rss-bridge.config` option instead.
doc/release-notes: correctly place backwards incompatible changes These changes seemed to have been placed in the wrong section
2024-10-02 21:37:42 -06:00
- `mikutter` has been removed, as the package was broken and had no maintainers in nixpkgs.
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `xdg.portal.gtkUsePortal` has been removed, as it had been deprecated for over 2 years. Using the `GTK_USE_PORTAL` environment variable in this manner is not intended nor encouraged by the GTK developers, but can still be done manually via `environment.sessionVariables`.
nixos/xdg/portal: remove deprecated option `gtkUsePortal`
2024-07-31 03:27:11 -06:00
cups-filters: remove support for legacy CUPS browsing and for LDAP Fixes CVE-2024-47176 and CVE-2024-47850. NixOS is not affected by these security issues by default because we do not ship the default configuration file so it fallbacks to `BrowseRemoteProtocols dnssd`. 631/udp is removed from the open firewall ports, it was by the CUPS browsing protocol.
2024-10-07 14:26:24 -06:00
- Support for the legacy CUPS browsing and LDAP have been removed from `services.printing`. If `cups` or `ldap` are in the `BrowseRemoteProtocols` setting in `services.printing.browsedConf`, it needs to be removed.
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `services.trust-dns` has been renamed to `services.hickory-dns`.
hickory-dns: rename from trust-dns
2024-06-30 13:11:30 -06:00
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `services.prometheus.exporters.pgbouncer.connectionStringFile` has been removed since
nixos/prometheus-exporters/pgbouncer: don't leak DB password into cmdline Since `connectionStringFile` reads the file and puts it into the invocation of the exporter, it's part of the cmdline and thus effectively world-readable. Added a new `connectionEnvFile` which is supposed to be an environment file of the form PGBOUNCER_EXPORTER_CONNECTION_STRING=... that will be added to the systemd service. The exporter will read the connection string from that value.
2024-09-05 04:09:05 -06:00
it leaked the connection string (and thus potentially the DB password) into the cmdline
of process making it effectively world-readable.
Use [`services.prometheus.exporters.pgbouncer.connectionEnvFile`](#opt-services.prometheus.exporters.pgbouncer.connectionEnvFile) instead.
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `lsh` and `services.lshd` have been removed as they had no maintainer in Nixpkgs and no upstream release in over a decade. It is recommended to migrate to `openssh` and `services.openssh`.
lsh: drop
2024-08-13 19:05:04 -06:00
rl-2411: Mention Ceph upgrade
2024-10-07 21:25:55 -06:00
- `ceph` has been upgraded to v19. See the [Ceph "squid" release notes](https://docs.ceph.com/en/latest/releases/squid/#v19-2-0-squid) for details and recommended upgrade procedure.
nixos/frr: refactor - use upstream service and scripts - switch to integrated-vtysh-config, abandon per-daemon config - use always daemon names in options (e.g. ospf -> ospfd) - zebra, mgmtd and staticd are always enabled - abandon vtyListenAddress, vtyListenPort options; use just "extraOptions" or "options" instead, respectively - extend test to test staticd - update release-notes - pkgs.servers.frr: fix sbindir and remove FHS PATH - introduce services.frr.openFilesLimit option
2024-07-10 03:42:34 -06:00
- `services.frr` has been refactored to use upstream service scripts. The per-daemon configurations
have been removed in favour of an `integrated-vtysh-config` style config. The daemon submodules
now use the daemon name (e.g. `ospfd`) instead of the protocol name (`ospf`). The daemons `zebra`,
`mgmtd` and `staticd` are always enabled if a config is present. The `vtyListenAddress` and
`vtyListenPort` options have been removed; use `options` or `extraOptions` instead, respectively.
opencv{2,3}: drop
2024-08-20 12:11:58 -06:00
- `opencv2` and `opencv3` have been removed, as they are obsolete and
were not used by any other package. External users are encouraged to
migrate to OpenCV 4.
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `tvheadend` package and the `services.tvheadend` module have been
removed due to lack of maintenance in Nixpkgs and being stuck on
an unmaintained version that required FFmpeg 4. Please see the related [pull
tvheadend: drop Closes: #332259
2024-08-21 13:56:34 -06:00
request #332259](https://github.com/NixOS/nixpkgs/pull/332259) if you
are interested in maintaining a newer version.
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `antennas` and `services.antennas` have been removed as they only work with `tvheadend` (see above).
antennas: drop
2024-08-21 13:58:01 -06:00
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `system.build.brightboxImage` has been removed as it no longer built and has not seen any maintenance in over 7 years (excluding tree-wide changes).
brightboxImage: remove, as it seems unmaintained ...and is broken/flaky on master, due to custom script with mknod usage.
2024-09-05 06:40:29 -06:00
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `services.syncplay` now exposes all currently available command-line arguments for `syncplay-server` as options, as well as a `useACMEHost` option for easy TLS setup.
nixos/syncplay: add missing options Exposes all currently available command-line arguments that were missing, including some that were impossible to use with the catch-all option `extraArgs` alone, requiring changes to other parts of the system. Those are now all self-contained in the module. The service now uses systemd's `DynamicUsers`.
2024-08-31 02:11:56 -06:00
The systemd service now uses `DynamicUser`/`StateDirectory` and the `user` and `group` options have been deprecated.
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `openlens` was removed. It is recommended to use `lens-desktop` instead.
openlens: remove package
2024-09-04 08:27:22 -06:00
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `services.dnsmasq.extraConfig` has been removed, as it had been deprecated for over 2 years. This option has been replaced by `services.dnsmasq.settings`.
nixos/dnsmasq: remove deprecated option "extraConfig"
2024-08-19 18:54:01 -06:00
nixos/installer: drop support for ReiserFS and JFS ReiserFS has not been actively maintained for many years. It has been marked as obsolete since Linux 6.6, and is scheduled for removal in 2025. A warning is logged informing users of this every time a ReiserFS file system is mounted. It suffers from unfixable issues like the year 2038 problem. JFS is a slightly more ambiguous case. It also has not been actively maintained for years; even in 2008 questions were being raised about its maintenance state and IBM’s commitment to it, and some enterprise distributions were opting not to ship support for it as a result. It will [indefinitely postpone journal writes], leading to data loss over potentially arbitrary amounts of time. Kernel developers [considered marking it as deprecated] last year, but no concrete decision was made. There have been [occasional fixes] to the code since then, but even the developer of much of those was not opposed to deprecating it. [considered marking it as deprecated]: https://lore.kernel.org/lkml/Y8DvK281ii6yPRcW@infradead.org/ [indefinitely postpone journal writes]: https://www.usenix.org/legacy/events/usenix05/tech/general/full_papers/prabhakaran/prabhakaran.pdf [occasional fixes]: https://www.phoronix.com/news/JFS-Linux-6.7-Improvements Regardless of whether JFS should be removed from the kernel, with all the implications for existing installations that entails, I think it’s safe to say that no new Linux installation should be using either of these file systems, and that it’s a waste of space and potential footgun to be shipping support for them on our standard installation media. We’re lagging behind other distributions on this decision; neither is supported by Fedora’s installation media. (It also just so happens that `jfsutils` is the one remaining package in the minimal installer ISO that has reproducibility issues, due to some cursed toolchain bug, but I’m not trying to Goodhart’s law this or anything. I just think we shouldn’t be shipping it anyway.)
2024-09-05 08:26:13 -06:00
- The NixOS installation media no longer support the ReiserFS or JFS file systems by default.
nixos/release-small: remove minimal installer ISOs These take up 2 GiB every time anything in the minimal installer changes, or up to 4 GiB per day. We already stopped building Amazon images in 9426d90c6784aa19f11a8cfc5171a46f0b21cd94. Meaningful installer changes are rare enough, and the couple of days it takes for them to trickle down to the large channel acceptable enough, that this is mostly a waste of space. This should buy enough slack to build `stdenv` on `staging` without contributing to cache size growth.
2024-08-30 10:25:24 -06:00
- Minimal installer ISOs are no longer built on the small channel.
Please obtain installer images from the full release channels.
ffmpeg_7: 7.0.2 -> 7.1
2024-10-04 16:02:08 -06:00
- The default FFmpeg version is now 7.1, and FFmpeg 5 has been removed.
ffmpeg: ffmpeg_6 -> ffmpeg_7
2024-08-27 15:32:16 -06:00
Please prefer using the package variants without a version suffix,
or pin FFmpeg 6 or 4 if necessary for compatibility.
Note that we keep old versions around only as required
to support packages in the tree,
and FFmpeg 4 especially should be avoided in favour of newer versions
as it may be removed soon.
mention new OpenSSL default version in release notes The new OpenSSL default 3.3.x increased the default security level, mention this in release notes. Signed-off-by: Markus Theil <theil.markus@gmail.com>
2024-09-07 02:57:46 -06:00
- `openssl` now defaults to the latest version line `3.3.x`, instead of `3.0.x` before. While there should be no major code incompatibilities, newer OpenSSL versions typically strengthen the default security level. This means that you may have to explicitly allow weak ciphers, hashes and key lengths if necessary. See: [OpenSSL security level documentation](https://docs.openssl.org/3.3/man3/SSL_CTX_set_security_level/).
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `isync` has been updated to version `1.5.0`, which introduces some breaking changes. See the [compatibility concerns](https://sourceforge.net/projects/isync/files/isync/1.5.0/) for more details.
doc: 24.11: document `isync` version bump
2024-08-02 10:34:09 -06:00
Revert "globalprotect-openconnect: remove deprecated 1.x package" This reverts commit b08d6a664f548c86446439a1e24e484b0ee140ea. Signed-off-by: Rahul Rameshbabu <sergeantsagara@protonmail.com>
2024-11-13 14:41:34 -07:00
- Two new packages -- `gpauth` and `gpclient` from the 2.x version of the
GlobalProtect-openconnect project -- are added in parallel to
`globalprotect-openconnect`. The GUI components related to the project are
non-free and not packaged.
globalprotect-openconnect: remove deprecated 1.x package The 1.x iteration of globalprotect-openconnect is no longer being developed. Remove related components from nixpkgs. Signed-off-by: Rahul Rameshbabu <sergeantsagara@protonmail.com>
2024-06-01 11:49:32 -06:00
nixos/doc: add release note for DT matching changes See #341883.
2024-09-24 05:19:54 -06:00
- Compatible string matching for `hardware.deviceTree.overlays` has been changed to a more correct behavior. See [below](#sec-release-24.11-migration-dto-compatible) for details.
doc/release-notes: cleanup backward incompatibilities section The main goal is to make these points a bit more concise, have better consistency in how removals and deprecations are described, and improve grammar/flow
2024-10-02 21:26:56 -06:00
- `rustic` was upgraded to `0.9.0`, which contains [breaking changes to the config file format](https://github.com/rustic-rs/rustic/releases/tag/v0.9.0).
rustic: 0.8.1 -> 0.9.1
2024-10-04 14:10:08 -06:00
formats.ini: disable merging as list by default Previously, setting listsAsDuplicateKeys or listToValue would make it so merging these treat all values as lists, by coercing non-lists via lib.singleton. Some programs (such as gamemode; see #345121), allow some values to be repeated but not others, which can lead to unexpected behavior when non-list values are merged like this rather than throwing an error. This now makes that behavior opt-in via the mergeAsList option. Setting mergeAsList (to either true or false) without setting either listsAsDuplicateKeys or listToValue is an error, since lists are meaningless in this case.
2024-10-03 19:28:24 -06:00
- `pkgs.formats.ini` and `pkgs.formats.iniWithGlobalSection` with
`listsAsDuplicateKeys` or `listToValue` no longer merge non-list values into
lists by default. Backwards-compatible behavior can be enabled with
`atomsCoercedToLists`.
atlassian-{bamboo,confluence,crowd,jira}: drop Support for the Atlassian Server products ended in February 2024 and there was insufficient interest in maintaining the Atlassian Data Center replacements c.f. https://github.com/NixOS/nixpkgs/pull/353043#issuecomment-2452825826
2024-11-02 14:36:14 -06:00
- Atlassian Server products have been removed, as support for the Atlassian Server
products ended in February 2024 and there was insufficient interest in
maintaining the Atlassian Data Center replacements:
- The `atlassian-bamboo` package
- The `atlassian-confluence` package and its `services.confluence` NixOS module
- The `atlassian-crowd` package and its `services.crowd` NixOS module
- The `atlassian-jira` package and its `services.jira` NixOS module
python3{11,12}Packages.nose: drop 🎉 This package has been deprecated and unmaintained upstream for almost a decade, has required extensive patching to keep working on new Python versions, will inevitably break again with Python 3.13 dropping 2to3, is lacking a maintainer in Nixpkgs, is now unused in the tree, and has caused us all far too many headaches lately. Let’s put an end to this! Shout‐outs to mweinelt and jchv for dealing with this situation early on, pyrox0, Sigmanificient, and dotlambda for tackling a bunch of packages, and natsukium for help with reviews. I never thought this would get finished so quickly. We’ve collectively handled almost 1½ packages per day in the three months since I first opened the tracking issue, and sometimes helped move the entire ecosystem forward. Closes: #326513
2024-07-28 07:40:37 -06:00
- `python3Packages.nose` has been removed, as it has been deprecated and unmaintained for almost a decade and does not work on Python 3.12.
Please switch to `pytest` or another test runner/framework.
dotnet: split setup hooks into wrapper for runtime/sdk
2024-09-25 12:54:03 -06:00
- `dotnet-sdk`, `dotnet-runtime`, and all other dotnet packages now use a
wrapper package containing `bin/dotnet`, build hooks, etc. If you need to
reference the underlying dotnet distribution (DOTNET_ROOT) you should use e.g.
`dotnet-runtime.unwrapped`.
dotnet: move dotnet_root to $out/share/dotnet
2024-10-01 19:14:39 -06:00
- The root of dotnet distribution packages (DOTNET_ROOT) is now under e.g.
`${dotnet-sdk.unwrapped}/share/dotnet` instead of directly in the package
root. This is consistent with packaging guidelines and more friendly for FHS
environments.
dotnet-sdk/runtime/aspnetcore: 6.0 -> 8.0
2024-10-27 19:17:17 -06:00
- `dotnet-sdk`, `dotnet-runtime`, and `dotnet-aspnetcore` now point to dotnet 8
rather than dotnet 6. For packages that still need dotnet 6, use
`dotnet-sdk_6`, etc.
torq: drop
2024-11-24 04:40:15 -07:00
- torq has been removed because upstreamed went closed source.
24.05 is Vicuña
2024-05-22 10:15:34 -06:00
## Other Notable Changes {#sec-release-24.11-notable-changes}
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
imgui: mention cmake integration in release notes
2024-05-27 09:12:55 -06:00
nixos/doc/rl-2411: `zerocallusedregs` hardening flag enabled by default
2024-06-03 15:02:18 -06:00
- The `zerocallusedregs` hardening flag is enabled by default on compilers that support it.
doc/release-notes: 24.11: addition of stackclashprotection hardening flag
2024-06-07 16:55:33 -06:00
- The `stackclashprotection` hardening flag has been added, though disabled by default.
cc-wrapper: add support for pacret hardening flag on aarch64
2024-06-08 08:58:54 -06:00
- The `pacret` hardening flag has been added, though disabled by default.
nixos/doc/rl-2411: mention cargoSha256 deprecation
2024-07-03 07:24:07 -06:00
- `cargoSha256` in `rustPlatform.buildRustPackage` has been deprecated in favor
of `cargoHash` which supports SRI hashes. See
[buildRustPackage: Compiling Rust applications with Cargo](https://nixos.org/manual/nixpkgs/unstable/#compiling-rust-applications-with-cargo)
for more information.
buildGoModule: fix overrideAttrs overriding Fix overriding of vendorHash and various attributes via the fixed point attribute support of stdenv.mkDerivation. Pass as derivation attributes goModules, modRoot, vendorHash, deleteVendor, and proxyVendor. Move goModules and vendorHash out of passthru. Co-authored-by: Doron Behar <doron.behar@gmail.com>
2024-07-28 13:15:12 -06:00
- The `vendorHash` of Go packages built with `buildGoModule` can now be overridden with `overrideAttrs`.
`goModules`, `modRoot`, `vendorHash`, `deleteVendor`, and `proxyVendor` are now passed as derivation attributes.
rl-2411.section.md: fix typo
2024-08-16 14:17:27 -06:00
`goModules` and `vendorHash` are no longer placed under `passthru`.
buildGoModule: fix overrideAttrs overriding Fix overriding of vendorHash and various attributes via the fixed point attribute support of stdenv.mkDerivation. Pass as derivation attributes goModules, modRoot, vendorHash, deleteVendor, and proxyVendor. Move goModules and vendorHash out of passthru. Co-authored-by: Doron Behar <doron.behar@gmail.com>
2024-07-28 13:15:12 -06:00
docs/release-notes: document deprecations in Go ecosystem Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2024-10-18 02:21:50 -06:00
- `buildFlags`/`buildFlagsArray` on `buildGoModule` have been deprecated. 24.11 is the last release where `buildGoModule` accepts these flags (while throwing a warning).
Use the [`ldflags`](https://nixos.org/manual/nixpkgs/unstable/#var-go-ldflags) and/or [`tags`](https://nixos.org/manual/nixpkgs/unstable/#var-go-tags) attributes or
[the environment](https://nixos.org/manual/nixpkgs/unstable/#ssec-go-environment) instead.
- `buildGoPackage` has been deprecated. 24.11 is the last release with `buildGoPackage` available.
hareHook: init Co-authored-by: Colin <colin@uninsane.org>
2024-05-16 16:58:37 -06:00
- `hareHook` has been added as the language framework for Hare. From now on, it,
not the `hare` package, should be added to `nativeBuildInputs` when building
Hare programs.
lib: deprecate mkPackageOptionMD
2024-06-26 21:11:19 -06:00
- [`lib.options.mkPackageOptionMD`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.options.mkPackageOptionMD) is now obsolete; use the identical [`lib.options.mkPackageOption`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.options.mkPackageOption) instead.
lib/deprecated: print deprecation warning for mapAttrsFlatten
2024-07-24 04:01:58 -06:00
- `lib.misc.mapAttrsFlatten` is now formally deprecated and will be removed in future releases; use the identical [`lib.attrsets.mapAttrsToList`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.attrsets.mapAttrsToList) instead.
nixos/docker: keep live-restore disabled by default See https://docs.docker.com/engine/daemon/live-restore/ See https://discourse.nixos.org/t/docker-hanging-on-reboot/18270/5 Closes https://github.com/NixOS/nixpkgs/issues/182916 Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
2024-10-16 02:50:05 -06:00
- `virtualisation.docker.liveRestore` has been renamed to `virtualisation.docker.daemon.settings."live-restore"` and turned off by default for state versions of at least 24.11.
nixos/tailscale: add authKeyParameters Adds `config.services.tailscale.authKeyParameters`
2024-08-30 17:48:17 -06:00
- Tailscale's `authKeyFile` can now have its corresponding parameters set through `config.services.tailscale.authKeyParameters`, allowing for non-ephemeral unsupervised deployment and more.
See [Registering new nodes using OAuth credentials](https://tailscale.com/kb/1215/oauth-clients#registering-new-nodes-using-oauth-credentials) for the supported options.
nixos/testing: Add ipv6 configuration This contribution enables a working IPv6 setup by default. This works analog to the current automatic IPv4 setup.
2024-06-12 05:24:42 -06:00
- `nixosTests` now provide a working IPv6 setup for VLAN 1 by default.
nixos/kanidm: add provisioning of groups, persons and oauth2 systems
2024-03-10 14:32:24 -06:00
- Kanidm can now be provisioned using the new [`services.kanidm.provision`] option, but requires using a patched version available via `pkgs.kanidm.withSecretProvisioning`.
nixos/kanidm: fix systemd service type
2024-08-26 12:16:10 -06:00
- Kanidm previously had an incorrect systemd service type, causing dependent units with an `after` and `requires` directive to start before `kanidm*` finished startup. The module has now been updated in line with upstream recommendations.
nixos/kubernetes: add extraConfig to kubelet config Every now and then, kubernetes adds new configuration parameters to the kubelet configuration. Since this is defined using a nix attrset which is then converted to json/yaml, it would be nice to have an escape hatch similar to the extraOpts one that exists for additional CLI arguments. The typical use case would be to configure new settings before they are officially supported in the nixos module.
2024-08-30 20:12:40 -06:00
- The kubelet configuration file can now be amended with arbitrary additional content using the `services.kubernetes.kubelet.extraConfig` option.
nixos/seafile: add persistent user, configurable storage path, gc service
2024-09-27 17:58:34 -06:00
- The `services.seafile` module was updated to major version 11.
- As part of this upgrade, the database backend will be migrated to MySQL.
This process should be automatic, but in case of a botched migration,
old sqlite files are not removed and can be used to manually migrate the database.
- Additionally, the updated CSRF protection may prevent some users from logging in.
Specific origin addresses can be whitelisted using the `services.seafile.seahubExtraConf` option
(e.g. `services.seafile.seahubExtraConf = ''CSRF_TRUSTED_ORIGINS = ["https://example.com"]'';`).
Note that first solution of the [official FAQ answer](https://cloud.seatable.io/dtable/external-links/7b976c85f504491cbe8e/?tid=0000&vid=0000&row-id=BQhH-2HSQs68Nq2EW91DBA)
is not allowed by the `services.nginx` module's config-checker.
nextcloud30: init at 30.0.0
2024-10-01 04:46:58 -06:00
- The latest available version of Nextcloud is v30 (available as `pkgs.nextcloud30`). The installation logic is as follows:
- If [`services.nextcloud.package`](#opt-services.nextcloud.package) is specified explicitly, this package will be installed (**recommended**)
nextcloud: correct stateversion logic
2024-10-01 04:44:35 -06:00
- If [`system.stateVersion`](#opt-system.stateVersion) is >=24.05, `pkgs.nextcloud29` will be installed by default.
nextcloud30: init at 30.0.0
2024-10-01 04:46:58 -06:00
- If [`system.stateVersion`](#opt-system.stateVersion) is >=24.11, `pkgs.nextcloud30` will be installed by default.
- Please note that an upgrade from v28 (or older) to v30 directly is not possible. Please upgrade to `nextcloud29` (or earlier) first. Nextcloud prohibits skipping major versions while upgrading. You can upgrade by declaring [`services.nextcloud.package = pkgs.nextcloud29;`](options.html#opt-services.nextcloud.package).
imgui: mention cmake integration in release notes
2024-05-27 09:12:55 -06:00
- To facilitate dependency injection, the `imgui` package now builds a static archive using vcpkg' CMake rules.
The derivation now installs "impl" headers selectively instead of by a wildcard.
Use `imgui.src` if you just want to access the unpacked sources.
nixos/doc/rl-2411: Add a deprecation notice for gitlab-runner
2024-06-19 08:07:29 -06:00
doc/release-notes: cleanup notable changes section The main goal is to make these points a bit more concise, fix errors, and (somewhat subjectively) improve word choice to avoid repetition and have a better flow
2024-10-02 21:33:27 -06:00
- The new `boot.loader.systemd-boot.windows` option makes setting up dual-booting with Windows on a different drive easier.
nixos/systemd-boot: add windows option for easy dual-booting When installing NixOS on a machine with Windows, the "easiest" solution to dual-boot is re-using the existing EFI System Partition (ESP), which allows systemd-boot to detect Windows automatically. However, if there are multiple ESPs, maybe even on multiple disks, systemd-boot is unable to detect the other OSes, and you either have to use Grub and os-prober, or do a tedious manual configuration as described in the wiki: https://wiki.nixos.org/w/index.php?title=Dual_Booting_NixOS_and_Windows&redirect=no#EFI_with_multiple_disks This commit automates and documents this properly so only a single line like boot.loader.systemd-boot.windows."10".efiDeviceHandle = "HD0c2"; is required. In the future, we might want to try automatically detecting this during installation, but finding the correct device handle while the kernel is running is tricky.
2024-09-24 17:07:46 -06:00
nixos: remove boot.loader.raspberryPi This has been announced for 24.11 in #241534, so let's follow through.
2024-11-17 03:52:23 -07:00
- The `boot.loader.raspberryPi` options were marked as deprecated in 23.11 and have now been removed.
doc/release-notes: cleanup notable changes section The main goal is to make these points a bit more concise, fix errors, and (somewhat subjectively) improve word choice to avoid repetition and have a better flow
2024-10-02 21:33:27 -06:00
- Linux 4.19 has been removed because it will reach its end of life within the lifespan of 24.11.
linux_4_19: drop since it will reach EOL within NixOS 24.11
2024-09-21 09:58:36 -06:00
linux/common-config: restrict access to dmesg `SECURITY_DMESG_RESTRICT` is enabled by default by a lot of other distributions for a quite a while now, NixOS is a bit of an outlier. The main justification to enable it is that kernel log might leak kernel pointers which can then be used by exploits to defeat KASLR (NixOS also enables `kernel.kptr_restrict` by default since 2013).
2024-05-31 06:24:56 -06:00
- Unprivileged access to the kernel syslog via `dmesg` is now restricted by default. Users wanting to keep an
unrestricted access to it can set `boot.kernel.sysctl."kernel.dmesg_restrict" = false`.
nixos/input-method: deprecate .enabled option; add .type and .enable options This commit introduces two new properties: `enable` and `type`, to replace the `enabled` property. `enable` has the same meaning as is common across nixpkgs. `type` has the same meaning as the existing `enabled` property. `enabled` property is now deprecated and will be removed in a future release. Fixes #180654
2024-05-10 01:46:04 -06:00
- The `i18n.inputMethod` module introduces two new properties:
`enable` and `type`, for declaring whether to enable an alternative input method and defining which input method respectfully. The options available in `type` are the same as the existing `enabled` option. `enabled` is now deprecated, and will be removed in a future release.
doc/release-notes: RFC 42 -> freeform options "Freeform options" is a term that's a bit more meaningful to regular users who don't follow development, and thus does a better job at describing the changes
2024-10-21 19:51:57 -06:00
- `security.pam.u2f` now uses freeform options; all module options are now configurable through `security.pam.u2f.settings`.
nixos/pam/u2f: implement RFC0042 This module has a lot of options, so it's a good candidate for freeform settings.
2023-12-22 10:02:46 -07:00
doc/release-notes: correctly place backwards incompatible changes These changes seemed to have been placed in the wrong section
2024-10-02 21:37:42 -06:00
- `mikutter` was removed as the package was broken and had no maintainers.
mikutter: remove This package was broken and had no maintainers.
2024-09-30 10:49:57 -06:00
doc/release-notes: correctly place backwards incompatible changes These changes seemed to have been placed in the wrong section
2024-10-02 21:37:42 -06:00
- `services.getty.autologinOnce` was added to limit the automatic login to once per boot and on the first tty only.
nixos/getty: add option to autologin once per boot, take 2 Another attempt to bring ae48df3e while avoiding the Nix symlink bug[1]. I guess the bug was triggered by the sbin -> bin symlink in util-linux. [1]: https://github.com/NixOS/nix/issues/9579
2024-10-13 04:07:52 -06:00
When using full disk encryption, this option allows to unlock the system without retyping the passphrase while keeping the other ttys protected.
gollum: 5.3.3 -> 6.0.1 Changelog: https://github.com/gollum/gollum/releases
2024-07-29 04:33:09 -06:00
- Gollum was upgraded to major version 6. Read their [migration notes](https://github.com/gollum/gollum/wiki/6.0-Release-Notes).
doc: mention yarn hooks in release notes
2024-07-03 10:47:09 -06:00
- The hooks `yarnConfigHook` and `yarnBuildHook` were added. These should replace `yarn2nix.mkYarnPackage` and other `yarn2nix` related tools. The motivation to get rid of `yarn2nix` tools is the fact that they are too complex and hard to maintain, and they rely upon too much Nix evaluation which is problematic if import-from-derivation is not allowed (see more details at [#296856](https://github.com/NixOS/nixpkgs/issues/296856). The transition from `mkYarnPackage` to `yarn{Config,Build}Hook` is tracked at [#324246](https://github.com/NixOS/nixpkgs/issues/324246).
nixos/timesyncd: allow NTP servers advertised by DHCP to be used - add option `fallbackServers` with default to `networking.timeServers` - option `servers` now default to null Fix #335050
2024-08-16 02:56:01 -06:00
- `services.timesyncd.servers` now defaults to `null`, allowing systemd-timesyncd to use NTP servers advertised by DHCP.
- `services.timesyncd.fallbackServers` was added and defaults to `networking.timeServers`.
doc/release-notes: cleanup notable changes section The main goal is to make these points a bit more concise, fix errors, and (somewhat subjectively) improve word choice to avoid repetition and have a better flow
2024-10-02 21:33:27 -06:00
- Cinnamon has been updated to 6.2. Please check [upstream announcement](https://www.linuxmint.com/rel_wilma_whatsnew.php) for more details.
Following Mint 22 defaults, the Cinnamon module no longer ships `geary` and `hexchat` by default.
nixos/doc/rl-2411: Mention Cinnamon 6.2 update
2024-06-29 09:56:38 -06:00
zfs: deprecate latestCompatibleLinuxPackages Using zfs.latestCompatibleLinuxPackages can result in downgrades to the kernel on a system, potentially causing breakage. This breakage may not be apparent during build and switch, but only after attempting to reboot into the updated generation. By forcing users to explicitly manage their kernel version, we can ensure that the breakage will be apparent at build time instead.
2024-09-13 08:17:26 -06:00
- `zfs.latestCompatibleLinuxPackages` is deprecated and is now pointing at the default kernel. If using the stable LTS kernel (default `linuxPackages` is not possible then you must explicitly pin a specific kernel release. For example, `boot.kernelPackages = pkgs.linuxPackages_6_6`. Please be aware that non-LTS kernels are likely to go EOL before ZFS supports the latest supported non-LTS release, requiring manual intervention.
cc-wrapper: add support for shadowstack hardening flag
2024-07-11 16:11:13 -06:00
- The `shadowstack` hardening flag has been added, though disabled by default.
doc/release-notes: cleanup notable changes section The main goal is to make these points a bit more concise, fix errors, and (somewhat subjectively) improve word choice to avoid repetition and have a better flow
2024-10-02 21:33:27 -06:00
- `xxd` is now provided by the `tinyxxd` package rather than `vim.xxd` to reduce closure size and vulnerability impact. Since it has the same options and semantics as Vim's `xxd` utility, there is no user impact. Vim's `xxd` remains available as the `vim.xxd` package.
doc: add release note about `xxd` now being provided by `tinyxxd` instead of `vim.xxd`
2024-08-16 18:17:44 -06:00
doc/release-notes: cleanup notable changes section The main goal is to make these points a bit more concise, fix errors, and (somewhat subjectively) improve word choice to avoid repetition and have a better flow
2024-10-02 21:33:27 -06:00
- `restic` module now has an option for inhibiting system sleep while backups are running, defaulting to off (not inhibiting sleep). Available as [`services.restic.backups.<name>.inhibitsSleep`](#opt-services.restic.backups._name_.inhibitsSleep).
nixos/restic: add option to inhibit going to sleep
2024-03-17 10:05:59 -06:00
mattermost: add release-notes entry
2024-10-13 19:55:34 -06:00
- Mattermost has been updated from 9.5 to 9.11 ESR. See the [changelog](https://docs.mattermost.com/about/mattermost-v9-changelog.html#release-v9-11-extended-support-release) for more details.
doc/release-notes: add section on `cargo-tauri.hook`
2024-08-19 01:38:38 -06:00
- `cargo-tauri.hook` was introduced to help users build [Tauri](https://tauri.app/) projects. It is meant to be used alongside
`rustPlatform.buildRustPackage` and Node hooks such as `npmConfigHook`, `pnpm.configHook`, and the new `yarnConfig`
nixos/release-notes: add power.ups entry
2024-09-28 12:57:05 -06:00
- `power.ups` now powers off UPSs during a power outage event.
This saves UPS battery and ensures that host(s) get back up again when power comes back, even in the scenario when the UPS would have had enough capacity to keep power on during the whole power outage.
If you like the old behaviour of keeping the UPSs on (and emptying the battery) after the host(s) have shut down, and risk not getting a power cycle event to get the host(s) back up, set `power.ups.upsmon.settings.POWERDOWNFLAG = null;`.
nixos-firewall-tool: add nftables support Co-authored-by: Rvfg <i@rvf6.com>
2024-07-04 10:30:48 -06:00
- `nixos-firewall-tool` now supports nftables in addition to iptables and is installed by default when NixOS firewall is enabled.
nixos/doc/rl-2411: Add a deprecation notice for gitlab-runner
2024-06-19 08:07:29 -06:00
- Support for *runner registration tokens* has been [deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/380872)
in `gitlab-runner` 15.6 and is expected to be removed in `gitlab-runner` 18.0. Configuration of existing runners
should be changed to using *runner authentication tokens* by configuring
{option}`services.gitlab-runner.services.<name>.authenticationTokenConfigFile` instead of the former
{option}`services.gitlab-runner.services.<name>.registrationConfigFile` option.
nixos/alsa: kill sound.enable and friends with fire
2024-07-13 04:56:18 -06:00
iproute2: add libbpf support
2024-06-22 06:06:17 -06:00
- `iproute2` now has libbpf support.
Merge branch 'staging-next' into staging
2024-07-14 00:35:35 -06:00
nixos/doc: mention postgresql hardening
2024-11-01 08:44:27 -06:00
If you use extensions that are not packaged in nixpkgs, please review whether it still works
with the current settings and adjust accordingly if needed.
nixos/nix-channel: don't set `nix-path` (#327683) Otherwise, the empty path in `nix.conf` takes precedence over `NIX_PATH`, and by extension the `nix.nixPath` configuration option. Introduced in 61afc4d1662fe426f02b28e386f2e053f887b6d6.
2024-07-26 13:19:38 -06:00
- `nix.channel.enable = false` no longer implies `nix.settings.nix-path = []`.
doc/release-notes: fix typos
2024-10-01 23:38:50 -06:00
Since Nix 2.13, a `nix-path` set in `nix.conf` cannot be overridden by the `NIX_PATH` configuration variable.
nixos/nix-channel: don't set `nix-path` (#327683) Otherwise, the empty path in `nix.conf` takes precedence over `NIX_PATH`, and by extension the `nix.nixPath` configuration option. Introduced in 61afc4d1662fe426f02b28e386f2e053f887b6d6.
2024-07-26 13:19:38 -06:00
rl-notes/24.11: Add note about ZFS import being in `postResumeCommands`
2024-10-03 15:06:02 -06:00
- ZFS now imports its pools in `postResumeCommands` rather than `postDeviceCommands`. If you had `postDeviceCommands` scripts that depended on ZFS pools being imported, those now need to be in `postResumeCommands`.
nixos/automatic-timezoned: set time.timeZone to null to avoid silent overriding Currently if a timezone was selected explicitly, the service will silently override the value, essentially ignoring what is meant to be a a deliberate choice of option. This may cause confusion as to why the option is not doing anything when this service is enabled, particularly in more complex set-ups after some time. This will simply make the choice deliberate from the user's part, either by having to remove the option or lowering its priority as a recognition that it may be ignored. This change was inspired by the `services.tzupdate` module, which does the same. [1]: <https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/misc/tzupdate.nix#L24>
2024-10-07 20:34:11 -06:00
- `services.automatic-timezoned.enable = true` will now set `time.timeZone = null`.
This is to avoid silently shadowing a user's explicitly defined timezone without recognition on the user's part.
nixos/localtimed: set time.timeZone to null to avoid silent overriding Currently if a timezone was selected explicitly, the service will silently override the value, essentially ignoring what is meant to be a a deliberate choice of option. This may cause confusion as to why the option is not doing anything when this service is enabled, particularly in more complex set-ups after some time. This will simply make the choice deliberate from the user's part, either by having to remove the option or lowering its priority as a recognition that it may be ignored. This change was inspired by the `services.tzupdate` module, which does the same. [1]: <https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/misc/tzupdate.nix#L24>
2024-10-07 21:36:31 -06:00
- `services.localtimed.enable = true` will now set `time.timeZone = null`.
This is to avoid silently shadowing a user's explicitly defined timezone without recognition on the user's part.
qgis: don't build with grass by default Update nixos/doc/manual/release-notes/rl-2411.section.md Co-authored-by: zi3m5f <113244000+zi3m5f@users.noreply.github.com>
2024-10-21 04:03:11 -06:00
- `qgis` and `qgis-ltr` are now built without `grass` by default. `grass` support can be enabled with `qgis.override { withGrass = true; }`.
nixos/incus: add incus-user service and socket
2024-11-13 03:56:12 -07:00
- `virtualisation.incus` module gained new `incus-user.service` and `incus-user.socket` systemd units. It is now possible to add a user to `incus` group instead of `incus-admin` for increased security.
doc: notice freecad customization an changelog Change-Id: If019f12696db1c1661580e51b1920e637c52efec
2024-11-06 11:47:24 -07:00
- `freecad` now supports addons and custom configuration in nix-way, which can be used by calling `freecad.customize`.
nixos/bind: Fix cacheNetworks option services.bind.cacheNetworks should only apply to recursive queryies, as per the option documentation: > Note that this is for recursive queries – all networks are allowed to > query zones configured with the zones option by default [...]. This would correspond to the `allow-query-cache` option in named.conf, as per the BIND docs[1]: > Specifies which hosts (an IP address list) can access this server’s > cache and thus effectively controls recursion. And not `allow-query`, which restricts all requests (including requests where the server has authority) [2]: > Specifies which hosts (an IP address list) are allowed to send queries > to this resolver. > [...] > Note: > `allow-query-cache` is used to specify access to the cache. [1]: https://bind9.readthedocs.io/en/v9.20.0/reference.html#namedconf-statement-allow-query-cache [2]: https://bind9.readthedocs.io/en/v9.20.0/reference.html#namedconf-statement-allow-query
2024-08-19 08:07:59 -06:00
- `bind.cacheNetworks` now only controls access for recursive queries, where it previously controlled access for all queries.
## Detailed migration information {#sec-release-24.11-migration}
nixos/alsa: kill sound.enable and friends with fire
2024-07-13 04:56:18 -06:00
### `sound` options removal {#sec-release-24.11-migration-sound}
The `sound` options have been largely removed, as they are unnecessary for most modern setups, and cause issues when enabled.
If you set `sound.enable` in your configuration:
- If you are using Pulseaudio or PipeWire, simply remove that option
- If you are not using an external sound server, and want volumes to be persisted across shutdowns, set `hardware.alsa.enablePersistence = true` instead
If you set `sound.enableOSSEmulation` in your configuration:
- Make sure it is still necessary, as very few applications actually use OSS
- If necessary, set `boot.kernelModules = [ "snd_pcm_oss" ]`
If you set `sound.extraConfig` in your configuration:
- If you are using another sound server, like Pulseaudio, JACK or PipeWire, migrate your configuration to that
- If you are not using an external sound server, set `environment.etc."asound.conf".text = yourExtraConfig` instead
If you set `sound.mediaKeys` in your configuration:
- Preferably switch to handling media keys in your desktop environment/compositor
- If you want to maintain the exact behavior of the option, use the following snippet
```nix
services.actkbd = let
volumeStep = "1%";
in {
enable = true;
bindings = [
# "Mute" media key
{ keys = [ 113 ]; events = [ "key" ]; command = "${alsa-utils}/bin/amixer -q set Master toggle"; }
# "Lower Volume" media key
{ keys = [ 114 ]; events = [ "key" "rep" ]; command = "${alsa-utils}/bin/amixer -q set Master ${volumeStep}- unmute"; }
# "Raise Volume" media key
{ keys = [ 115 ]; events = [ "key" "rep" ]; command = "${alsa-utils}/bin/amixer -q set Master ${volumeStep}+ unmute"; }
# "Mic Mute" media key
{ keys = [ 190 ]; events = [ "key" ]; command = "${alsa-utils}/bin/amixer -q set Capture toggle"; }
];
};
```
nixos/doc: add release note for DT matching changes See #341883.
2024-09-24 05:19:54 -06:00
### `hardware.deviceTree.overlays` compatible string matching {#sec-release-24.11-migration-dto-compatible}
The original compatible string implementation in older NixOS versions relied on substring matching,
which is incorrect for overlays with multiple compatible strings and other cases.
The new behavior is consistent with what other tools already do - the overlay is considered applicable if,
and only if, _any_ of the compatible strings in the overlay match _any_ of the compatible strings in the DT.
To provide some examples:
| Overlay `compatible` | DT `compatible` | Pre-24.11 behavior | Correct behavior | Notes |
|----------------------|-----------------|--------------------|------------------|--------------------------------------------|
| `"foo"` | `"foo", "bar"` | match | match | Most common use case does not change |
| `"foo"` | `"foobar"` | match | no match | Substrings should not be matched |
| `"foo bar"` | `"foo", "bar"` | match | no match | Separators should not be matched to spaces |
| `"foo", "bar"` | `"baz", "bar"` | no match | match | One compatible string matching is enough |
Note that this also allows writing overlays that explicitly apply to multiple boards.
Reference in New Issue Copy Permalink