Breaking changes announcement for unstable

Development
103

3 posts were split to a new topic: Tt-rss project is ending, what alternatives exist?

104

pkgs.formats.systemd was earlier an attrset containing the relevant format functionality. It has been changed into a function taking an attrset as its argument, conforming to the usual pattern of items in pkgs.formats.

6 Likes
105

systemd-boot 258 on unstable is bricking certain devices with infinite boot loops.

A fix has landed in 258.1 which is currently on staging-next and should land in unstable soon

https://nixpk.gs/pr-tracker.html?pr=453713

15 Likes
106

I’ve not had chance to check why, but today’s update to 258 does not ask for the zfs password so I cannot boot. Sorry not sure if it is the same issue…

1 Like
107

As announced in the release notes for 25.05, the minimum supported version of macOS has been increased to 14.0. The default SDK is now 14.4.

Older versions of the SDK have been moved to darwin-aliases.nix and are no longer available. Packages that used them have been updated to use the default SDK.

Availability warnings are now errors by default when compiling with Clang on Darwin to ensure that packages do not unconditionally use newer APIs than the configured deployment target.

9 Likes
108

services.onlyoffice.securityNonceFile is now a mandatory option for onlyoffice due to Hardcoded credentials in onlyoffice module · Advisory · NixOS/nixpkgs · GitHub

3 Likes
109

My Radeon 680M doesn’t work anymore with Vulkan after a system update, and I’m pretty sure it’s due to this: amdvlk,nixos/amdvlk: drop by pyrox0 · Pull Request #444693 · NixOS/nixpkgs · GitHub

Just for whoever else notices problems with their (older) AMD gpus recently.

Edit: I asked about how to bring this driver/module back on the PR: amdvlk,nixos/amdvlk: drop by pyrox0 · Pull Request #444693 · NixOS/nixpkgs · GitHub

Edit2: Actually my GPU is fully supported by the new open-source driver, just had to give the project I was working on a flake update it seems :slight_smile:

2 Likes
110

My Radeon 680M doesn’t work anymore with Vulkan after a system update, and I’m pretty sure it’s due to this

I think this has caused OpenCL to stop working on my 780M with Davinci Resolve. I’ve messed around with Rusticl via mesa.opencl and the Radeon ICD option to no avail. My solution was to use Davincibox, a Distrobox container. The only difference I see between my config now and from the last time I used Resolve is the lack of AMDVLK, since it was removed.

1 Like
111

asio (standalone version of boost::asio) has been updated from 1.24.0 to 1.36.0. Some breaking changes were introduced between these two versions, and the one affected most was the removal of asio::io_service in favor of asio::io_context in 1.33.0. asio_1_32_0 is retained for packages that have not completed migration. asio_1_10 has been removed as no packages depend on it anymore. asio also no longer propagates boost as it is used independent from boost in most cases.

7 Likes
112

Are there any plans to make it possible to use custom OVMF builds again?

113

Is there a way to silence messages (and their email notifications) like mine or the above, that are off topic?

PS: I’m sorry for those who are impacted again right now.

And why do even I have permission to post here?

114

There is no way to silence off-topic messages, but if you want to ask a question related to one of these breaking changes, you should follow one of these methods to ensure that people are not unnecessarily notified.

  • If your question is related to a PR, you can just ask your question in the PR thread; OR
  • You can create an issue in the nixpkgs repository; OR
  • You can click “reply”, then select the top-left arrow in the reply box and click “Reply as linked topic”. This way, a new topic is created just for discussion around that item and people can unsubscribe from that topic.

And why do even I have permission to post here?

Anyone can create PRs with breaking changes, and therefore everyone should be able to post messages in this topic.

11 Likes
115

services.openssh.settings.AcceptEnv now explicitly defined as an option that takes a list of strings, to facilitate option merging. Setting it to a string value is no longer supported.

9 Likes
116

The networking.wireless module has been security hardened: the wpa_supplicant daemon now runs under an unprivileged user with restricted access to the system.

Some backward incompatibilities:

  • /etc/wpa_supplicant.conf has been deprecated: the NixOS-generated configuration file is now linked to /etc/wpa_supplicant/nixos.conf and /etc/wpa_supplicant/imperative.conf has been added for imperatively configuring wpa_supplicant or when using networking.wireless.allowAuxiliaryImperativeNetworks.

  • If client certificates, keys or other files are needed, these should be stored under /etc/wpa_supplicant and owned by wpa_supplicant to ensure the daemon can read them.

  • the networking.wireless.userControlled.group option has been removed since there is now a dedicated wpa_supplicant group to control the daemon, and networking.wireless.userControlled.enable has been renamed to networking.wireless.userControlled.

No functionality should have been impacted by these changes (including controlling via wpa_cli, integration with NetworkManager or connman), but if you find any problems, please open an issue on GitHub.

Note for NetworkManager users: before this changes NetworkManager spawned its own wpa_supplicant daemon, but now it uses networking.wireless. So, if you have a networking.wireless.enable = false in your configuration, you should remove that line.

link to PR: nixos/wpa_supplicant: harden and run as unprivileged user by rnhmjoj · Pull Request #427528 · NixOS/nixpkgs · GitHub

23 Likes
117

ecryptfs has been removed due to questionable maintenance.

This following options are no longer be available:

  • security.pam.enableFscrypt
  • programs.ecryptfs`

If you were using them, please consider moving to a move maintained alternative, such as fscrypt, gocryptfs or cryfs.

link to PR: ecryptfs: drop by Sigmanificient · Pull Request #479934 · NixOS/nixpkgs · GitHub

6 Likes
118

just wanted to say this was one of the first times i’ve updated to unstable that broke my setup, preventing me from connecting to wifi. i will now redo my entire wifi setup. thanks!

119

I don’t know if this is related to this or a bug in KDE but roughly since updating to a version that includes this hardening, kde’s network-manager UI simply doesn’t remember VPN passwords anymore. The degradation in UX is quite annoying TBH.

But since I don’t know where it originates, I can’t submit a bug report for it either.

1 Like
120

Open an issue on github, ping me and we’ll try to figure it out.

I don’t think this has anything to do with wpa_supplicant, but if you want to be sure you can try setting networking.networkmanager.wifi.backend to iwd.

Also, it’s still useful to open an issue even if you haven’t identified the root of a problem: other users can find it and someone may help with triage.

Finally, please don’t reply to posts in this thread: you are pinging hundreds of people that subscribed for updates.

15 Likes
121

The Traefik module has been refactored and all configurations should be migrated to the new syntax. Instructions are available in the 26.05 release notes. See #482512 for more details.

[EDIT 2026-02-16]: This PR has been reverted due to unforeseen issues with more complex Traefik configurations.

5 Likes