pyrox.dev
1# Release 23.11 (“Tapir”, 2023.11/29) {#sec-release-23.11}
2
3The NixOS release team is happy to announce a new version of NixOS. The release is called NixOS 23.11 ("Tapir").
4
5NixOS is a Linux distribution, whose set of packages can also be used on other Linux systems and macOS.
6
7Support is planned until the end of June 2024, handing over to NixOS 24.05.
8
9To upgrade to the latest release, follow the upgrade chapter and check the [Breaking Changes](#sec-release-23.11-nixos-breaking-changes)
10section for packages and services used in your configuration.
11
12The team is excited about the many software updates and improvements in this release. Just to name a few, do check the updates
13for `GNOME` packages, `systemd`, `glibc`, the `ROCM` package set, and `hostapd` (which brings support for WiFi6 (IEEE 802.11ax) and WPA3-SAE-PK).
14
15Make sure to also check the many updates in the [Nixpkgs library](#sec-release-23.11-nixpkgs-lib) when developing your own packages.
16
17## Table of Contents {#sec-release-23.11-toc}
18
19- [NixOS](#sec-release-23.11-nixos)
20 - [Breaking Changes](#sec-release-23.11-nixos-breaking-changes)
21 - [New Services](#sec-release-23.11-nixos-new-services)
22 - [Other Notable Changes](#sec-release-23.11-nixos-notable-changes)
23- [Nixpkgs Library](#sec-release-23.11-nixpkgs-lib)
24 - [Breaking Changes](#sec-release-23.11-lib-breaking)
25 - [Additions and Improvements](#sec-release-23.11-lib-additions-improvements)
26 - [Deprecations](#sec-release-23.11-lib-deprecations)
27
28## NixOS {#sec-release-23.11-nixos}
29
30
31### Breaking Changes {#sec-release-23.11-nixos-breaking-changes}
32
33- `services.postgresql.ensurePermissions` has been deprecated in favor of
34 `services.postgresql.ensureUsers.*.ensureDBOwnership` which simplifies the
35 setup of database owned by a certain system user in local database contexts
36 (which make use of peer authentication via UNIX sockets), migration
37 guidelines were provided in the NixOS manual, please refer to them if you are
38 affected by a PostgreSQL 15 changing the way `GRANT ALL PRIVILEGES` is
39 working. `services.postgresql.ensurePermissions` will be removed in 24.05.
40 All NixOS modules were migrated using one of the strategy, e.g.
41 `ensureDBOwnership` or `postStart`. Refer to the [PR
42 #266270](https://github.com/NixOS/nixpkgs/pull/266270) for more details.
43
44- `network-online.target` has been fixed to no longer time out for systems with
45 `networking.useDHCP = true` and `networking.useNetworkd = true`. Workarounds
46 for this can be removed.
47
48- The `boot.loader.raspberryPi` options have been marked deprecated, with
49 intent of removal for NixOS 24.11. They had a limited use-case, and do not
50 work like people expect. They required either very old installs from ([before
51 mid-2019](https://github.com/NixOS/nixpkgs/pull/62462)) or customized builds
52 out of scope of the standard and generic AArch64 support. That option set
53 never supported the Raspberry Pi 4 family of devices.
54
55- `python3.pkgs.sequoia` was removed in favor of `python3.pkgs.pysequoia`. The
56 latter package is based on upstream's dedicated repository for sequoia's
57 Python bindings, where the Python bindings from
58 [gitlab:sequoia-pgp/sequoia](https://gitlab.com/sequoia-pgp/sequoia) were
59 removed long ago.
60
61- `writeTextFile` requires `executable` to be boolean now, values like `null`
62 or `""` will fail to evaluate now.
63
64- The latest version of `clonehero` now stores custom content in
65 `~/.clonehero`. Refer to the [migration
66 instructions](https://clonehero.net/2022/11/29/v23-to-v1-migration-instructions.html)
67 for more details. Typically, these content files would exist along side the
68 binary, but the previous build used a wrapper script that would store them in
69 `~/.config/unity3d/srylain Inc_/Clone Hero`.
70
71- `services.mastodon` doesn't support providing a TCP port to its `streaming`
72 component anymore, as upstream implemented parallelization by running
73 multiple instances instead of running multiple processes in one instance.
74 Please create a PR if you are interested in this feature.\
75 Due to this, the desired number of such instances
76 {option}`services.mastodon.streamingProcesses` now needs to be declared explicitly.
77
78- The `services.hostapd` module was rewritten to support `passwordFile` like
79 options, WPA3-SAE, and management of multiple interfaces. This breaks
80 compatibility with older configurations.
81 - `hostapd` is now started with additional systemd sandbox/hardening options
82 for better security.
83 - `services.hostapd.interface` was replaced with a per-radio and per-bss
84 configuration scheme using
85 [services.hostapd.radios](#opt-services.hostapd.radios).
86 - `services.hostapd.wpa` has been replaced by
87 [services.hostapd.radios.<name>.networks.<name>.authentication.wpaPassword](#opt-services.hostapd.radios._name_.networks._name_.authentication.wpaPassword)
88 and
89 [services.hostapd.radios.<name>.networks.<name>.authentication.saePasswords](#opt-services.hostapd.radios._name_.networks._name_.authentication.saePasswords)
90 which configure WPA2-PSK and WP3-SAE respectively.
91 - The default authentication has been changed to WPA3-SAE. Options for other
92 (legacy) schemes are still available.
93
94- `python3.pkgs.fetchPypi` and `python3Packages.fetchPypi` have been
95 deprecated in favor of top-level `fetchPypi`.
96
97- xdg-desktop-portal has been updated to 1.18, which reworked how portal
98 implementations are selected. If you roll your own desktop environment, you
99 should either set `xdg.portal.config` or `xdg.portal.configPackages`, which
100 allow fine-grained control over which portal backend to use for specific
101 interfaces, as described in {manpage}`portals.conf(5)`.
102
103 If you don't provide configurations, a portal backend will only be considered
104 when the desktop you use matches its deprecated `UseIn` key. While some NixOS
105 desktop modules should already ship one for you, it is suggested to test
106 portal availability by trying [Door
107 Knocker](https://flathub.org/apps/xyz.tytanium.DoorKnocker) and [ASHPD
108 Demo](https://flathub.org/apps/com.belmoussaoui.ashpd.demo). If things
109 regressed, you may run `G_MESSAGES_DEBUG=all
110 /path/to/xdg-desktop-portal/libexec/xdg-desktop-portal` for ideas on which
111 config file and which portals are chosen.
112
113- `pass` now does not contain `password-store.el`. Users should get
114 `password-store.el` from Emacs lisp package set `emacs.pkgs.password-store`.
115
116- `services.knot` now supports `.settings` from RFC42. The previous
117 `.extraConfig` still works the same, but it displays a warning now.
118
119- `services.invoiceplane` now supports `.settings` from RFC42. The previous
120 `.extraConfig` still works the same way, but it displays a warning now.
121
122- `mu` does not install `mu4e` files by default now. Users should get `mu4e`
123 from Emacs lisp package set `emacs.pkgs.mu4e`.
124
125- `mariadb` now defaults to `mariadb_1011` instead of `mariadb_106`, meaning
126 the default version was upgraded from v10.6.x to v10.11.x. Refer to the
127 [upgrade
128 notes](https://mariadb.com/kb/en/upgrading-from-mariadb-10-6-to-mariadb-10-11/)
129 for potential issues.
130
131- `getent` has been moved from `glibc`'s `bin` output to its own dedicated
132 output, reducing closure size for many dependents. Dependents using the
133 `getent` alias should not be affected; others should move from using
134 `glibc.bin` or `getBin glibc` to `getent` (which also improves compatibility
135 with non-glibc platforms).
136
137- `maintainers/scripts/update-luarocks-packages` is now a proper package
138 `luarocks-packages-updater` that can be run to maintain out-of-tree luarocks
139 packages.
140
141- The `users.users.<name>.passwordFile` has been renamed to
142 `users.users.<name>.hashedPasswordFile` to avoid possible confusions. The
143 option is in fact the file-based version of `hashedPassword`, not `password`,
144 and expects a file containing the {manpage}`crypt(3)` hash of the user
145 password.
146
147- `chromiumBeta` and `chromiumDev` have been removed due to the lack of
148 maintenance in nixpkgs. Consider using `chromium` instead.
149
150- `google-chrome-beta` and `google-chrome-dev` have been removed due to the
151 lack of maintenance in nixpkgs. Consider using `google-chrome` instead.
152
153- The `services.ananicy.extraRules` option now has the type of `listOf attrs`
154 instead of `string`.
155
156- `buildVimPluginFrom2Nix` has been renamed to `buildVimPlugin`, which now
157 now skips `configurePhase` and `buildPhase`.
158
159- JACK tools (`jack_*` except `jack_control`) have moved from the `jack2`
160 package to `jack-example-tools`.
161
162- The `waagent` service does provisioning now.
163
164- The `matrix-synapse` package & module have undergone some significant
165 internal changes, for most setups no intervention is needed, though:
166 - The option
167 [`services.matrix-synapse.package`](#opt-services.matrix-synapse.package)
168 is read-only now. For modifying the package, use an overlay which modifies
169 `matrix-synapse-unwrapped` instead. More on that below.
170 - The `enableSystemd` & `enableRedis` arguments have been removed and
171 `matrix-synapse` has been renamed to `matrix-synapse-unwrapped`. Also,
172 several optional dependencies (such as `psycopg2` or `authlib`) have been
173 removed.
174 - These optional dependencies are automatically added via a wrapper
175 (`pkgs.matrix-synapse.override { extras = ["redis"]; }` for `hiredis` &
176 `txredisapi` for instance) if the relevant config section is declared in
177 `services.matrix-synapse.settings`. For instance, if
178 `services.matrix-synapse.settings.redis.enabled` is set to `true`,
179 `"redis"` will be automatically added to the `extras` list of
180 `pkgs.matrix-synapse`.
181 - A list of all extras (and the extras enabled by default) can be found at
182 the [option's reference for
183 `services.matrix-synapse.extras`](#opt-services.matrix-synapse.extras).
184 - In some cases (e.g. for running synapse workers) it was necessary to re-use
185 the `PYTHONPATH` of `matrix-synapse.service`'s environment to have all
186 plugins available. This isn't necessary anymore, instead
187 `config.services.matrix-synapse.package` can be used as it points to the
188 wrapper with properly configured `extras` and also all plugins defined via
189 [`services.matrix-synapse.plugins`](#opt-services.matrix-synapse.plugins)
190 available. This is also the reason for why the option is read-only now,
191 it's supposed to be set by the module only.
192
193- `netbox` was updated to v3.6. `services.netbox.package` still defaults
194 to v3.5 if `stateVersion` is earlier than 23.11. Refer to upstream's breaking
195 changes [for
196 v3.6.0](https://github.com/netbox-community/netbox/releases/tag/v3.6.0) and
197 upgrade NetBox by changing `services.netbox.package`. Database migrations
198 will be run automatically.
199
200- `etcd` has been updated to v3.5. Refer to upgrade guides for [v3.3 to
201 v3.4](https://etcd.io/docs/v3.5/upgrades/upgrade_3_4/) and [v3.4 to
202 v3.5](https://etcd.io/docs/v3.5/upgrades/upgrade_3_5/) for more details.
203
204- `gitlab` installations created or updated between versions \[15.11.0,
205 15.11.2] have an incorrect database schema. This will become a problem when
206 upgrading to `gitlab` >=16.2.0. A workaround for affected users can be found
207 in the [GitLab
208 docs](https://docs.gitlab.com/ee/update/versions/gitlab_16_changes.html#undefined-column-error-upgrading-to-162-or-later).
209
210
211- `consul` has been updated to v1.16.0. Refer to the [release
212 note](https://github.com/hashicorp/consul/releases/tag/v1.16.0) for more
213 details. Once a new Consul version has started and upgraded it's data
214 directory, it generally cannot be downgraded to the previous version.
215
216- `llvmPackages_rocm` has been moved to `rocmPackages.llvm`.
217
218- `hip`, `rocm-opencl-runtime`, `rocm-opencl-icd`, and `rocclr` have been
219 combined into `rocmPackages.clr`.
220
221- `clang-ocl`, `clr`, `composable_kernel`, `hipblas`, `hipcc`, `hip-common`, `hipcub`,
222 `hipfft`, `hipfort`, `hipify`, `hipsolver`, `hipsparse`, `migraphx`, `miopen`, `miopengemm`,
223 `rccl`, `rdc`, `rocalution`, `rocblas`, `rocdgbapi`, `rocfft`, `rocgdb`, `rocm-cmake`,
224 `rocm-comgr`, `rocm-core`, `rocm-device-libs`, `rocminfo`, `rocmlir`, `rocm-runtime`,
225 `rocm-smi`, `rocm-thunk`, `rocprim`, `rocprofiler`, `rocrand`, `rocr-debug-agent`,
226 `rocsolver`, `rocsparse`, `rocthrust`, `roctracer`, `rocwmma`, and `tensile`
227 have been moved to `rocmPackages`.
228
229- `himalaya` has been updated to v0.8.0, which drops the native TLS support
230 (in favor of Rustls) and add OAuth 2.0 support. Refer to the [release
231 note](https://github.com/soywod/himalaya/releases/tag/v0.8.0) for more
232 details.
233
234
235- `nix-prefetch-git` now ignores global and user git config, to improve
236 reproducibility.
237
238- The [services.caddy.acmeCA](#opt-services.caddy.acmeCA) option defaults
239 to `null` instead of `"https://acme-v02.api.letsencrypt.org/directory"` now.
240 To use all of Caddy's default ACME CAs and enable Caddy's automatic issuer
241 fallback feature by default, as recommended by upstream.
242
243- The default priorities of
244 [`services.nextcloud.phpOptions`](#opt-services.nextcloud.phpOptions) have
245 changed. This means that e.g.
246 `services.nextcloud.phpOptions."opcache.interned_strings_buffer" = "23";`
247 doesn't discard all of the other defaults from this option anymore. The
248 attribute values of `phpOptions` are still defaults, these can be overridden
249 as shown here.
250
251 To override all of the options (including including `upload_max_filesize`,
252 `post_max_size` and `memory_limit` which all point to
253 [`services.nextcloud.maxUploadSize`](#opt-services.nextcloud.maxUploadSize)
254 by default) can be done like this:
255
256 ```nix
257 {
258 services.nextcloud.phpOptions = lib.mkForce {
259 /* ... */
260 };
261 }
262 ```
263
264- `php80` is no longer supported due to upstream not supporting this version
265 anymore.
266
267- PHP defaults to PHP 8.2 now, updated from v8.1.
268
269- GraalVM has been updated to the latest version, and this brings significant
270 changes. Upstream don't release multiple versions targeting different JVMs
271 anymore, so now we only have one GraalVM derivation (`graalvm-ce`). While at
272 first glance the version may seem a downgrade (v22.3.1 -> v21.0.0), the major
273 version is now following the JVM it targets (so this latest version targets
274 JVM 21). Also some products like `llvm-installable-svm` and
275 `native-image-svm` were incorporate to the main GraalVM derivation, so
276 they're included by default.
277
278- GraalPy (`graalCEPackages.graalpy`), TruffleRuby
279 (`graalCEPackages.truffleruby`), GraalJS (`graalCEPackages.graaljs`) and
280 GraalNodeJS (`grallCEPackages.graalnodejs`) are now independent from the main
281 GraalVM derivation.
282
283- The ISC DHCP package and corresponding module have been removed, because they
284 are EOL upstream. Refer [to this
285 post](https://www.isc.org/blogs/isc-dhcp-eol/) for details and switch to a
286 different DHCP implementation like kea or dnsmasq.
287
288- `prometheus-unbound-exporter` has been replaced by the Let's Encrypt
289 maintained version, since the previous version was archived. This requires
290 some changes to the module configuration, most notable `controlInterface`
291 needs migration towards `unbound.host` and requires either the `tcp://` or
292 `unix://` URI scheme.
293
294- `odoo` defaults to v16 now, updated from v15.
295
296- `varnish` was upgraded from v7.2.x to v7.4.x. Refer to upgrade guides vor
297 [v7.3](https://varnish-cache.org/docs/7.3/whats-new/upgrading-7.3.html) and
298 [v7.4](https://varnish-cache.org/docs/7.4/whats-new/upgrading-7.4.html). The
299 current LTS version is still offered as `varnish60`.
300
301- `util-linux` is now supported on Darwin and is no longer an alias to
302 `unixtools`. Use the `unixtools.util-linux` package for access to the Apple
303 variants of the utilities.
304
305- `services.keyd` changed API. Now you can create multiple configuration files.
306
307- `baloo`, the file indexer and search engine used by KDE now has a patch to
308 prevent files from constantly being reindexed when the device IDs of the
309 their underlying storage change. This happens frequently when using btrfs or
310 LVM. The patch has not yet been accepted upstream but it provides a
311 significantly improved experience. When upgrading, reset baloo to get a clean
312 index: `balooctl disable ; balooctl purge ; balooctl enable`.
313
314- The `vlock` program from the `kbd` package has been moved into its own
315 package output and should now be referenced explicitly as `kbd.vlock` or
316 replaced with an alternative such as the standalone `vlock` package or
317 `physlock`.
318
319- `fileSystems.<name>.autoFormat` now uses `systemd-makefs`, which does not
320 accept formatting options. Therefore, `fileSystems.<name>.formatOptions` has
321 been removed.
322
323- `fileSystems.<name>.autoResize` uses `systemd-growfs` to resize the file
324 system online in Stage 2 now. This means that `f2fs` and `ext2` can no longer
325 be auto resized, while `xfs` and `btrfs` now can be.
326
327- `fuse3` has been updated from v3.11.0 to v3.16.2. Refer to the
328 [changelog](https://github.com/libfuse/libfuse/blob/fuse-3.16.2/ChangeLog.rst#libfuse-3162-2023-10-10)
329 for an overview of the changes.
330
331 Unsupported mount options are no longer silently accepted [(since
332 3.15.0)](https://github.com/libfuse/libfuse/blob/fuse-3.16.2/ChangeLog.rst#libfuse-3150-2023-06-09).
333 The [affected mount
334 options](https://github.com/libfuse/libfuse/commit/dba6b3983af34f30de01cf532dff0b66f0ed6045)
335 are: `atime`, `diratime`, `lazytime`, `nolazytime`, `relatime`, `norelatime`,
336 `strictatime`.
337
338 For example,
339
340 ```bash
341 $ sshfs 127.0.0.1:/home/test/testdir /home/test/sshfs_mnt -o atime
342 ```
343
344 would previously terminate successfully with the mount point established, now
345 it outputs the error message ``fuse: unknown option(s): `-o atime'`` and
346 terminates with exit status 1.
347
348- `nixos-rebuild {switch,boot,test,dry-activate}` runs the system
349 activation inside `systemd-run` now, creating an ephemeral systemd service
350 and protecting the system switch against issues like network disconnections
351 during remote (e.g. SSH) sessions. This has the side effect of running the
352 switch in an isolated environment, that could possible break post-switch
353 scripts that depends on things like environment variables being set. If you
354 want to opt-out from this behavior for now, you may set the
355 `NIXOS_SWITCH_USE_DIRTY_ENV` environment variable before running
356 `nixos-rebuild`. However, keep in mind that this option will be removed in
357 the future.
358
359- The `services.vaultwarden.config` option default value was changed to make
360 Vaultwarden only listen on localhost, following the [secure defaults for most
361 NixOS services](https://github.com/NixOS/nixpkgs/issues/100192).
362
363- `services.lemmy.settings.federation` was removed in v0.17.0 and no longer has
364 any effect. To enable federation, the hostname must be set in the
365 configuration file and then federation must be enabled in the admin web UI.
366 Refer to the [release
367 notes](https://github.com/LemmyNet/lemmy/blob/c32585b03429f0f76d1e4ff738786321a0a9df98/RELEASES.md#upgrade-instructions)
368 for more details.
369
370- `pict-rs` was upgraded from v0.3 to v0.4 and contains an incompatible database
371 & configuration change. To upgrade on systems with `stateVersion = "23.05";`
372 or older follow the migration steps from
373 https://git.asonix.dog/asonix/pict-rs#user-content-0-3-to-0-4-migration-guide
374 and set `services.pict-rs.package = pkgs.pict-rs;`.
375
376- The following packages in `haskellPackages` have a separate bin output now:
377 `cabal-fmt`, `calligraphy`, `eventlog2html`, `ghc-debug-brick`, `hindent`,
378 `nixfmt`, `releaser`. This means you need to replace e.g.
379 `"${pkgs.haskellPackages.nixfmt}/bin/nixfmt"` with `"${lib.getBin
380 pkgs.haskellPackages.nixfmt}/bin/nixfmt"` or `"${lib.getExe
381 pkgs.haskellPackages.nixfmt}"`. The binaries also won’t be in scope if you
382 rely on them being installed e.g. via `ghcWithPackages`.
383 `environment.packages` picks the `bin` output automatically, so for normal
384 installation no intervention is required. Also, toplevel attributes like
385 `pkgs.nixfmt` are not impacted negatively by this change.
386
387- `spamassassin` no longer supports the `Hashcash` module. The module needs to
388 be removed from the `loadplugin` list if it was copied over from the default
389 `initPreConf` option.
390
391- `nano` was removed from `environment.defaultPackages`. To not leave systems
392 without a editor, now `programs.nano.enable` is enabled by default.
393
394- `programs.nano.nanorc` and `programs.nano.syntaxHighlight` no longer have an
395 effect unless `programs.nano.enable` is set to true which is the default.
396
397- `services.outline.sequelizeArguments` has been removed, as `outline` no
398 longer executes database migrations via the `sequelize` cli.
399
400- The binary of the package `cloud-sql-proxy` has changed from
401 `cloud_sql_proxy` to `cloud-sql-proxy`.
402
403- The module `services.apache-kafka` was largely rewritten and has certain
404 breaking changes. To be precise, this means that the following things have
405 changed:
406 - Most settings have been migrated to
407 [services.apache-kafka.settings](#opt-services.apache-kafka.settings).
408 - Care must be taken when adapting an existing cluster to these changes,
409 see [](#module-services-apache-kafka-migrating-to-settings).
410 - By virtue of being less opinionated, it is now possible to use the module
411 to run Apache Kafka in KRaft mode instead of Zookeeper mode.
412 - [A few options](#module-services-apache-kafka-kraft) have been added to
413 assist in this mode.
414
415- Garage has been upgraded to v0.9.x. `services.garage.package` needs to be
416 explicitly set now, so version upgrades can be done in a controlled fashion.
417 For this, we expose `garage_x_y` attributes which can be set here.
418
419- `voms` and `xrootd` now moves the `$out/etc` content to the `$etc` output
420 instead of `$out/etc.orig`, when input argument `externalEtc` is not `null`.
421
422- The `woodpecker-*` CI packages have been updated to v1.0.0. This release is
423 wildly incompatible with the v0.15.x versions that were previously packaged.
424 Refer to [upstream's
425 documentation](https://woodpecker-ci.org/docs/next/migrations#100) to learn
426 how to update your CI configurations.
427
428- Meilisearch was updated from v1.3.1 to v1.5.0. The update has breaking
429 changes about backslashes and filtering. Refer to the [release
430 announcement](https://blog.meilisearch.com/v1-4-release/) for more
431 details.
432
433- The Caddy module gained a new option named `services.caddy.enableReload`
434 which is enabled by default. It allows reloading the service instead of
435 restarting it, if only a config file has changed. This option must be
436 disabled if you have turned off the [Caddy admin
437 API](https://caddyserver.com/docs/caddyfile/options#admin). If you keep this
438 option enabled, you should consider setting
439 [`grace_period`](https://caddyserver.com/docs/caddyfile/options#grace-period)
440 to a non-infinite value to prevent Caddy from delaying the reload
441 indefinitely.
442
443- mdraid support is optional now. This reduces initramfs size and prevents the
444 potentially undesired automatic detection and activation of software RAID
445 pools. It is disabled by default in new configurations (determined by
446 `stateVersion`), but the appropriate settings will be generated by
447 `nixos-generate-config` when installing to a software RAID device, so the
448 standard installation procedure should be unaffected. If you have custom
449 configs relying on mdraid, ensure that you use `stateVersion` correctly or
450 set `boot.swraid.enable` manually. On systems with an updated `stateVersion`
451 we now also emit warnings if `mdadm.conf` does not contain the minimum
452 required configuration necessary to run the dynamically enabled monitoring
453 daemons.
454
455- The `go-ethereum` package has been updated to v1.12.0. This drops support for
456 proof-of-work. Its GraphQL API now encodes all numeric values as hex strings
457 and the GraphQL UI is updated to v2.0. The default database has changed from
458 `leveldb` to `pebble` but `leveldb` can be forced with the
459 --db.engine=leveldb flag. The `checkpoint-admin` command was [removed along
460 with trusted
461 checkpoints](https://github.com/ethereum/go-ethereum/pull/27147).
462
463- The `aseprite-unfree` package has been upgraded from v1.2.16.3 to v1.2.40.
464 The free version of aseprite has been dropped because it is EOL and the
465 package attribute now points to the unfree version. A maintained fork of the
466 last free version of Aseprite, named 'LibreSprite', is available in the
467 `libresprite` package.
468
469- The default `kops` version is v1.28.0 now and support for v1.25 and older have
470 been dropped.
471
472- `pharo` has been updated to latest stable v10.0.8, which is compatible with
473 the latest stable and oldstable images (Pharo 10 and 11). The VM in question
474 is the 64bit Spur. The 32bit version has been dropped due to lack of
475 maintenance. The Cog VM has been deleted because it is severily outdated.
476 Finally, the `pharo-launcher` package has been deleted because it was not
477 compatible with the newer VM, and due to lack of maintenance.
478
479- Emacs mainline v29 was introduced. This new version includes many major
480 additions, most notably `tree-sitter` support (enabled by default) and
481 the pgtk variant (useful for Wayland users), which is available under the
482 attribute `emacs29-pgtk`.
483
484- Emacs macport version 29 was introduced.
485
486- The option `services.networking.networkmanager.enableFccUnlock` was removed
487 in favor of `networking.networkmanager.fccUnlockScripts`, which allows
488 specifying unlock scripts explicitly. The previous option enabled all unlock
489 scripts bundled with ModemManager, which is risky, and didn't allow using
490 vendor-provided unlock scripts at all.
491
492- The `html-proofer` package has been updated from major version 3 to major
493 version 5, which includes [breaking
494 changes](https://github.com/gjtorikian/html-proofer/blob/v5.0.8/UPGRADING.md).
495
496- `kratos` has been updated from v0.10.1 to the first stable v1.0.0, please
497 read the [v0.10.1 to
498 v0.11.0](https://github.com/ory/kratos/releases/tag/v0.11.0), [v0.11.0 to
499 v0.11.1](https://github.com/ory/kratos/releases/tag/v0.11.1), [v0.11.1 to
500 v0.13.0](https://github.com/ory/kratos/releases/tag/v0.13.0) and [v0.13.0 to
501 v1.0.0](https://github.com/ory/kratos/releases/tag/v1.0.0) upgrade guides.
502 The most notable breaking change is the introduction of one-time passwords
503 (`code`) and update of the default recovery strategy from `link` to `code`.
504
505- The `hail` module was removed, as `hail` was unmaintained since 2017.
506
507- Package `noto-fonts-emoji` was renamed to `noto-fonts-color-emoji`. Refer to
508 [PR #221181](https://github.com/NixOS/nixpkgs/issues/221181) for more
509 details.
510
511- Package `cloud-sql-proxy` was renamed to `google-cloud-sql-proxy` as it
512 cannot be used with other cloud providers.
513
514- Package `pash` was removed due to being archived upstream. Use `powershell`
515 as an alternative.
516
517- The option `services.plausible.releaseCookiePath` has been removed. Plausible
518 does not use any distributed Erlang features, and does not plan to (refer to
519 [discussion](https://github.com/NixOS/nixpkgs/pull/130297#issuecomment-1805851333)),
520 Thus NixOS disables them now , and the Erlang cookie becomes unnecessary. You
521 may delete the file that `releaseCookiePath` was set to.
522
523- `security.sudo.extraRules` includes `root`'s default rule now, with ordering
524 priority 400. This is functionally identical for users not specifying rule
525 order, or relying on `mkBefore` and `mkAfter`, but may impact users calling
526 `mkOrder n` with n ≤ 400.
527
528- X keyboard extension (XKB) options have been reorganized into a single
529 attribute set, `services.xserver.xkb`. Specifically,
530 `services.xserver.layout` is `services.xserver.xkb.layout` now,
531 `services.xserver.extraLayouts` is `services.xserver.xkb.extraLayouts` now,
532 `services.xserver.xkbModel` is `services.xserver.xkb.model` now,
533 `services.xserver.xkbOptions` is `services.xserver.xkb.options` now ,
534 `services.xserver.xkbVariant` is `services.xserver.xkb.variant` now, and
535 `services.xserver.xkbDir` is `services.xserver.xkb.dir` now.
536
537- `networking.networkmanager.firewallBackend` was removed as NixOS is now using
538 iptables-nftables-compat even when using iptables, therefore Networkmanager
539 uses the nftables backend unconditionally now.
540
541- `rome` was removed because it is no longer maintained and is succeeded by
542 `biome`.
543
544- The `prometheus-knot-exporter` was migrated to a version maintained by
545 CZ.NIC. Various metric names have changed, so checking existing rules is
546 recommended.
547
548- The `services.mtr-exporter.target` has been removed in favor of
549 `services.mtr-exporter.jobs` which allows specifying multiple targets.
550
551- `blender-with-packages` has been deprecated in favor of
552 `blender.withPackages`, for example `blender.withPackages (ps: [ps.bpycv])`.
553 It behaves similarly to `python3.withPackages`.
554
555- Setting `nixpkgs.config` options while providing an external `pkgs` instance
556 will now raise an error instead of silently ignoring the options. NixOS
557 modules no longer set `nixpkgs.config` to accommodate this. This specifically
558 affects `services.locate`,
559 `services.xserver.displayManager.lightdm.greeters.tiny` and
560 `programs.firefox` NixOS modules. No manual intervention should be required
561 in most cases, however, configurations relying on those modules affecting
562 packages outside the system environment should switch to explicit overlays.
563
564- `privacyidea` (and the corresponding `privacyidea-ldap-proxy`) has been
565 removed from nixpkgs because it has severely outdated dependencies that
566 became unmaintainable with nixpkgs' python package-set.
567
568- `dagger` was removed because using a package called `dagger` and packaging it
569 from source violates their trademark policy.
570
571- `win-virtio` package was renamed to `virtio-win` to be consistent with the upstream package name.
572
573- `ps3netsrv` has been replaced with the webman-mod fork, the executable has
574 been renamed from `ps3netsrv++` to `ps3netsrv` and cli parameters have
575 changed.
576
577- `ssm-agent` package and module were renamed to `amazon-ssm-agent` to be
578 consistent with the upstream package name.
579
580- `services.kea.{ctrl-agent,dhcp-ddns,dhcp,dhcp6}` now use separate runtime
581 directories instead of `/run/kea` to work around the runtime directory being
582 cleared on service start.
583
584- `mkDerivation` rejects MD5 hashes now.
585
586- The `junicode` font package has been updated to [major
587 v2](https://github.com/psb1558/Junicode-font/releases/tag/v2.001), which is
588 a font family now. In particular, plain `Junicode.ttf` no longer exists. In
589 addition, TrueType font files are now placed in `font/truetype` instead of
590 `font/junicode-ttf`; this change does not affect use via `fonts.packages`
591 option.
592
593- The `prayer` package as well as `services.prayer` have been removed because
594 it's been unmaintained for several years and the author's website has
595 vanished.
596
597- The `chrony` NixOS module now tracks the real-time clock drift from the
598 system clock with `rtcfile` and automatically adjusts it with `rtcautotrim`
599 when it exceeds the maximum error specified in
600 `services.chrony.autotrimThreshold` (defaults to 30 seconds). If you enabled
601 `rtcsync` in `extraConfig`, you should remove RTC related options from
602 `extraConfig`. If you do not want chrony configured to keep the RTC in check,
603 you can set `services.chrony.enableRTCTrimming = false;`.
604
605- `trilium-desktop` and `trilium-server` have been updated to
606 [v0.61](https://github.com/zadam/trilium/releases/tag/v0.61.12). For existing
607 installations, upgrading to this version is supported only after running
608 v0.60.x at least once. If you are still on an older version, make sure to
609 update to v0.60 (available in NixOS 23.05) first and only then to v0.61
610 (available in NixOS 23.11).
611
612- Cassandra now defaults to v4.x, updated from v3.11.x.
613
614
615- FoundationDB now defaults to major version 7.
616
617- [glibc](https://www.gnu.org/software/libc/) has been updated from v2.37 to
618 v2.38. Refer to the [the release
619 notes](https://sourceware.org/glibc/wiki/Release/2.38) for more details.
620
621- `linuxPackages_testing_bcachefs` is now soft-deprecated by
622 `linuxPackages_testing`.
623 - Please consider changing your NixOS configuration's `boot.kernelPackages`
624 to `linuxPackages_testing` until a stable kernel with bcachefs support is
625 released.
626
627- PostgreSQL now defaults to major version 15.
628
629- All [ROCm](https://rocm.docs.amd.com/en/latest/) packages have been updated
630 to v5.7.0.
631 - [ROCm](https://rocm.docs.amd.com/en/latest/) package attribute sets are
632 versioned: `rocmPackages` -> `rocmPackages_5`.
633
634- [systemd](https://systemd.io) has been updated from v253 to v254, refer to
635 [the release
636 notes](https://github.com/systemd/systemd/blob/v254/NEWS#L3-L659) for more
637 details.
638 - `boot.resumeDevice` **must be specified** when hibernating if not in EFI
639 mode.
640 - systemd may warn your system about the permissions of your ESP partition
641 (often `/boot`), this warning can be ignored for now, we are looking into
642 a satisfying solution regarding this problem.
643 - Updating with `nixos-rebuild boot` and rebooting is recommended, since in
644 some rare cases the `nixos-rebuild switch` into the new generation on a
645 live system might fail due to missing mount units.
646
647- If the user has a custom shell enabled via `users.users.${USERNAME}.shell =
648 ${CUSTOMSHELL}`, the assertion will require them to also set
649 `programs.${CUSTOMSHELL}.enable = true`. This is generally safe behavior, but
650 for anyone needing to opt out from the check
651 `users.users.${USERNAME}.ignoreShellProgramCheck = true` will do the job.
652
653- `yarn-berry` has been updated to v4.0.1. This means that NodeJS versions less
654 v18.12 are no longer supported by it. Refer to the [upstream
655 changelog](https://github.com/yarnpkg/berry/blob/master/CHANGELOG.md) for
656 more details.
657
658- GNOME has been updated to v45. Refer to the [release
659 notes](https://release.gnome.org/45/) for more details. Notably, Loupe has
660 replaced Eye of GNOME as the default image viewer, Snapshot has replaced
661 Cheese as the default camera application, and Photos will no longer be
662 installed.
663
664- The module [services.ankisyncd](#opt-services.ankisyncd.package) has been
665 switched to
666 [anki-sync-server-rs](https://github.com/ankicommunity/anki-sync-server-rs).
667 The former version written in Python was difficult to update, did not receive
668 updates in a while, and did not support recent versions of Anki.
669
670 Unfortunately all servers supporting new clients do not support the older
671 sync protocol that was used in the old server. This includes newer version of
672 anki-sync-server, Anki's built in sync server and this new Rust package. Thus
673 old clients will also need updating. In particular nixpkgs's Anki package is
674 also being updated in this release.
675
676 The module update takes care of the new config syntax. The data itself (i.e.
677 user login and card information) is compatible. Thus users of the module will
678 be able to simply log in again after updating both client and server without
679 any extra action needed to be taken.
680
681- The argument `vendorSha256` of `buildGoModule` is deprecated. Use
682 `vendorHash` instead. Refer to [PR
683 \#259999](https://github.com/NixOS/nixpkgs/pull/259999)) for more details.
684
685- `go-modules` in `buildGoModule` attrs has been renamed to `goModules`.
686
687- The package `cawbird` is dropped from nixpkgs. It broke by the Twitter API
688 closing down and has been abandoned upstream.
689
690- The Cinnamon module now enables XDG desktop integration by default. If you
691 are experiencing collisions related to xdg-desktop-portal-gtk you can safely
692 remove `xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];` from your
693 NixOS configuration.
694
695- GNOME, Pantheon, Cinnamon modules no longer force Qt applications to use
696 Adwaita style. This implemantion was buggy and is no longer maintained
697 upstream. Specifically, Cinnamon defaults to the gtk2 style instead now,
698 following the default in Linux Mint). If you still want Adwaita used, you may
699 add the following options to your configuration. Please be aware, that it
700 will probably be removed eventually.
701
702 ```nix
703 {
704 qt = {
705 enable = true;
706 platformTheme = "gnome";
707 style = "adwaita";
708 };
709 }
710 ```
711
712- DocBook option documentation is no longer supported, all module documentation
713 now uses Markdown.
714
715- Docker defaults to v24 now, as 20.10 is stopping to receive security updates
716 and bug fixes after [December 10,
717 2023](https://github.com/moby/moby/discussions/45104).
718
719- Elixir defaults to v1.15 now. Refer to their
720 [changelog](https://elixir-lang.org/blog/2023/06/19/elixir-v1-15-0-released/)
721 for more details.
722
723- The `extend` function of `llvmPackages` has been removed due it coming from
724 the `tools` attrset thus only extending the `tool` attrset. A possible
725 replacement is to construct the set from `libraries` and `tools`, or patch
726 nixpkgs.
727
728- `ffmpeg` defaults to `ffmpeg_6` now, upgrading from `ffmpeg_5`.
729
730- `fontconfig` defaults to using greyscale antialiasing now. Previously
731 subpixel antialiasing was used because of a [recommendation from one of the
732 downstreams](https://gitlab.freedesktop.org/fontconfig/fontconfig/-/issues/337).
733 You can change this value by configuring
734 [](#opt-fonts.fontconfig.subpixel.rgba) accordingly.
735
736- The `fonts.fonts` and `fonts.enableDefaultFonts` options have been renamed to
737 `fonts.packages` and `fonts.enableDefaultPackages` respectively.
738
739- `services.hedgedoc` has been heavily refactored, reducing the amount of
740 declared options in the module. Most of the options should still work without
741 any changes to the configuration. Some options have been deprecated, as they
742 no longer have any effect. Refer to [PR
743 #244941](https://github.com/NixOS/nixpkgs/pull/244941) for more details.
744
745- `jq` was updated to v1.7. This is its [first release in 5
746 years](https://github.com/jqlang/jq/releases/tag/jq-1.7).
747
748- [`lib.attrsets.foldlAttrs`](https://nixos.org/manual/nixpkgs/stable#function-library-lib.attrsets.foldlAttrs)
749 now always evaluates the initial accumulator argument first.
750
751- [`lib.lists.foldl'`](https://nixos.org/manual/nixpkgs/stable#function-library-lib.lists.foldl-prime)
752 now always evaluates the initial accumulator argument first. If you depend on
753 the lazier behavior, consider using
754 [`lib.lists.foldl`](https://nixos.org/manual/nixpkgs/stable#function-library-lib.lists.foldl)
755 or
756 [`builtins.foldl'`](https://nixos.org/manual/nix/stable/language/builtins.html#builtins-foldl')
757 instead.
758
759- Now `magma` defaults to `magma-hip` instead of `magma-cuda`. It also
760 respects the `config.cudaSupport` and `config.rocmSupport` options.
761
762- The MariaDB C client library was upgraded from v3.2.x to v3.3.x. Refer to the
763 [upstream release
764 notes](https://mariadb.com/kb/en/mariadb-connector-c-33-release-notes/) for
765 more details.
766
767- Mattermost has been upgraded to extended support version 8.1 as the previously
768 packaged extended support version 7.8 is [reaching end-of-life](https://docs.mattermost.com/upgrade/extended-support-release.html).
769 Migration may take some time, refer to the [changelog](https://docs.mattermost.com/install/self-managed-changelog.html#release-v8-1-extended-support-release)
770 and [important upgrade notes](https://docs.mattermost.com/upgrade/important-upgrade-notes.html).
771
772- The `netdata` package disables cloud support by default now. To enable it use the `netdataCloud` package.
773
774- `networking.nftables` is no longer flushing all rulesets on every reload.
775 Use `networking.nftables.flushRuleset = true;` to enable the previous behaviour.
776
777- Node.js v14, v16 has been removed as they were end of life. Any dependent packages that contributors were not able to reasonably upgrade were dropped after a month of notice to their maintainers, were **removed**.
778 - This includes VSCode Server.
779 - This includes Kibana 7 as the ELK stack is unmaintained in nixpkgs and is marked for slow removal.
780
781- The application firewall `opensnitch` uses the process monitor method eBPF as
782 default now. This is recommended by upstream. The method may be changed with
783 the setting
784 [services.opensnitch.settings.ProcMonitorMethod](#opt-services.opensnitch.settings.ProcMonitorMethod).
785
786- `paperwork` is updated to v2.2. Documents scanned with this version will not
787 be visible to previous versions if you downgrade. Refer to the [upstream
788 announcement](https://forum.openpaper.work/t/paperwork-2-2-testing-phase/316#important-switch-from-jpeg-to-png-for-new-pages-2)
789 for details and workarounds.
790
791- The latest available version of Nextcloud is v27 (available as
792 `pkgs.nextcloud27`). The installation logic is as follows:
793 - If [`services.nextcloud.package`](#opt-services.nextcloud.package) is
794 specified explicitly, this package will be installed (**recommended**)
795 - If [`system.stateVersion`](#opt-system.stateVersion) is >=23.11,
796 `pkgs.nextcloud27` will be installed by default.
797 - If [`system.stateVersion`](#opt-system.stateVersion) is >=23.05,
798 `pkgs.nextcloud26` will be installed by default.
799 - Please note that an upgrade from v25 (or older) to v27 is not possible
800 directly. Please upgrade to `nextcloud26` (or earlier) first. Nextcloud
801 prohibits skipping major versions while upgrading. You may upgrade by
802 declaring [`services.nextcloud.package =
803 pkgs.nextcloud26;`](options.html#opt-services.nextcloud.package) inbetween.
804
805- `postgresql_11` has been removed since it'll stop receiving fixes on November
806 9th 2023.
807
808- `programs.gnupg.agent.pinentryFlavor` is set in `/etc/gnupg/gpg-agent.conf`
809 now. It will no longer take precedence over a `pinentry-program` set in
810 `~/.gnupg/gpg-agent.conf`.
811
812- `python3.pkgs.flitBuildHook` has been removed. Use `flit-core` and `format =
813 "pyproject"` instead.
814
815- Certificate generation via the `security.acme` limits the concurrent number
816 of running certificate renewals and generation jobs now. This is to avoid
817 spiking resource usage when processing many certificates at once. The limit
818 defaults to *5* and can be adjusted via `maxConcurrentRenewals`. Setting the
819 value to *0* disables the limits altogether.
820
821- `services.borgmatic.settings.location` and
822 `services.borgmatic.configurations.<name>.location` are deprecated, please
823 move your options out of sections to the global scope.
824
825- `services.fail2ban.jails` can be configured with attribute sets now, defining
826 settings and filters instead of lines. The stringed options `daemonConfig`
827 and `extraSettings` have respectively been replaced by `daemonSettings` and
828 `jails.DEFAULT.settings`. Those use attribute sets.
829
830- The `services.mbpfan` module has the option `aggressive` enabled by default
831 now. This is for better heat moderation. To get the upstream defaults you may
832 disable this.
833
834- Apptainer/Singularity defaults to using `"$out/var/lib"` for the
835 `LOCALSTATEDIR` configuration option instead of the top-level `"/var/lib"`
836 now. This change impacts the `SESSIONDIR` (container-run-time mount point)
837 configuration, which is set to `$LOCALSTATEDIR/<apptainer or
838 singularity>/mnt/session`. This detaches the packages from the top-level
839 directory, rendering the NixOS module optional.
840
841 The default behavior of the NixOS module `programs.singularity` stays
842 unchanged. We add a new option
843 `programs.singularity.enableExternalSysConfDir` (default to `true`) to
844 specify whether to set the top-level `"/var/lib"` as `LOCALSTATEDIR` or not.
845
846- The `services.sslh` module has been updated to follow [RFC
847 0042](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md).
848 As such, several options have been moved to the freeform attribute set
849 [services.sslh.settings](#opt-services.sslh.settings), which allows to change
850 any of the settings in {manpage}`sslh(8)`.
851
852 In addition, the newly added option
853 [services.sslh.method](#opt-services.sslh.method) allows to switch between
854 the {manpage}`fork(2)`, {manpage}`select(2)` and `libev`-based connection
855 handling method. Refer to the [sslh
856 docs](https://github.com/yrutschle/sslh/blob/master/doc/INSTALL.md#binaries)
857 for a comparison.
858
859- Suricata was upgraded from v6.0 to v7.0 and no longer considers HTTP/2
860 support as experimental. Refer to [upstream release
861 notes](https://forum.suricata.io/t/suricata-7-0-0-released/3715) for more
862 details.
863
864- `teleport` has been upgraded from major version 12 to major version 14.
865 Refer to upstream [upgrade
866 instructions](https://goteleport.com/docs/management/operations/upgrading/)
867 and release notes for
868 [v13](https://goteleport.com/docs/changelog/#1300-050823) and
869 [v14](https://goteleport.com/docs/changelog/#1400-092023). Note that Teleport
870 does not officially support upgrades across more than one major version at a
871 time. If you're running Teleport server components, it is recommended to
872 first upgrade to an intermediate v13.x version by setting
873 `services.teleport.package = pkgs.teleport_13`. Afterwards, this option can
874 be removed to upgrade to the default version (14).
875
876- `zfs` was updated from v2.1.x to v2.2.0, [enabling newer kernel support and
877 adding new features](https://github.com/openzfs/zfs/releases/tag/zfs-2.2.0).
878
879- The use of `sourceRoot = "source";`, `sourceRoot = "source/subdir";`, and
880 similar lines in package derivations using the default `unpackPhase` is
881 deprecated as it requires `unpackPhase` to always produce a directory named
882 "source". Use `sourceRoot = src.name`, `sourceRoot = "${src.name}/subdir";`,
883 or `setSourceRoot = "sourceRoot=$(echo */subdir)";` or similar instead.
884
885- The `django` alias in the python package set was upgraded to Django v4.x.
886 Applications that consume Django should always pin their python environment
887 to a compatible major version, so they can move at their own pace.
888
889 ```nix
890 {
891 python = python3.override {
892 packageOverrides = self: super: {
893 django = super.django_3;
894 };
895 };
896 }
897 ```
898
899- The `qemu-vm.nix` module by default now identifies block devices via
900 persistent names available in `/dev/disk/by-*`. Because the rootDevice is
901 identified by its filesystem label, it needs to be formatted before the VM is
902 started. The functionality of automatically formatting the rootDevice in the
903 initrd is removed from the QEMU module. However, for tests that depend on
904 this functionality, a test utility for the scripted initrd is added
905 (`nixos/tests/common/auto-format-root-device.nix`). To use this in a NixOS
906 test, import the module, e.g. `imports = [
907 ./common/auto-format-root-device.nix ];` When you use the systemd initrd, you
908 can automatically format the root device by setting
909 `virtualisation.fileSystems."/".autoFormat = true;`.
910
911- The `electron` packages places its application files in
912 `$out/libexec/electron` instead of `$out/lib/electron` now. Packages using
913 electron-builder will fail to build and need to be adjusted by changing `lib`
914 to `libexec`.
915
916### New Services {#sec-release-23.11-nixos-new-services}
917
918- [MCHPRS](https://github.com/MCHPR/MCHPRS), a multithreaded Minecraft server
919 built for redstone. Available as
920 [services.mchprs](#opt-services.mchprs.enable).
921
922- [acme-dns](https://github.com/joohoi/acme-dns), a limited DNS server to
923 handle ACME DNS challenges easily and securely. Available as
924 [services.acme-dns](#opt-services.acme-dns.enable).
925
926- [frp](https://github.com/fatedier/frp), a fast reverse proxy to help you
927 expose a local server behind a NAT or firewall to the Internet. Available as
928 [services.frp](#opt-services.frp.enable).
929
930- [river](https://github.com/riverwm/river), A dynamic tiling wayland
931 compositor. Available as [programs.river](#opt-programs.river.enable).
932
933- [wayfire](https://wayfire.org), a modular and extensible wayland compositor.
934 Available as [programs.wayfire](#opt-programs.wayfire.enable).
935
936- [mautrix-whatsapp](https://docs.mau.fi/bridges/go/whatsapp/index.html), a
937 Matrix-WhatsApp puppeting bridge. Available as
938 [services.mautrix-whatsapp](#opt-services.mautrix-whatsapp.enable).
939
940- [hddfancontrol](https://github.com/desbma/hddfancontrol), a service to
941 regulate fan speeds based on hard drive temperature. Available as
942 [services.hddfancontrol](#opt-services.hddfancontrol.enable).
943
944- [seatd](https://sr.ht/~kennylevinsen/seatd/), A minimal seat management
945 daemon. Available as [services.seatd](#opt-services.seatd.enable).
946
947- [GoToSocial](https://gotosocial.org/), an ActivityPub social network server
948 written in Golang. Available as
949 [services.gotosocial](#opt-services.gotosocial.enable).
950
951- [Castopod](https://castopod.org/), an open-source hosting platform made for
952 podcasters who want to engage and interact with their audience. Available as
953 [services.castopod](#opt-services.castopod.enable).
954
955- [Typesense](https://github.com/typesense/typesense), a fast, typo-tolerant
956 search engine for building delightful search experiences. Available as
957 [services.typesense](#opt-services.typesense.enable).
958
959* [NS-USBLoader](https://github.com/developersu/ns-usbloader/), an all-in-one
960 tool for managing Nintendo Switch homebrew. Available as
961 [programs.ns-usbloader](#opt-programs.ns-usbloader.enable).
962
963- [athens](https://github.com/gomods/athens), a Go module datastore and proxy. Available as [services.athens](#opt-services.athens.enable).
964
965- [Mobilizon](https://joinmobilizon.org/), a Fediverse platform for publishing
966 events. Available as [services.mobilizon](#opt-services.mobilizon.enable).
967
968- [Anuko Time Tracker](https://github.com/anuko/timetracker), a simple, easy to
969 use, open source time tracking system. Available as
970 [services.anuko-time-tracker](#opt-services.anuko-time-tracker.enable).
971
972- [Prometheus MySQL exporter](https://github.com/prometheus/mysqld_exporter), a
973 MySQL server exporter for Prometheus. Available as
974 [services.prometheus.exporters.mysqld](#opt-services.prometheus.exporters.mysqld.enable).
975
976- [LibreNMS](https://www.librenms.org), a auto-discovering PHP/MySQL/SNMP based
977 network monitoring. Available as
978 [services.librenms](#opt-services.librenms.enable).
979
980- [Livebook](https://livebook.dev/), an interactive notebook with support for
981 Elixir, graphs, machine learning, and more. Available as
982 [services.livebook](#opt-services.livebook.enableUserService).
983
984- [sitespeed-io](https://sitespeed.io), a tool that can generate metrics such
985 as timings and diagnostics for websites. Available as
986 [services.sitespeed-io](#opt-services.sitespeed-io.enable).
987
988- [stalwart-mail](https://stalw.art), an all-in-one email server (SMTP, IMAP,
989 JMAP). Available as
990 [services.stalwart-mail](#opt-services.stalwart-mail.enable).
991
992
993- [tang](https://github.com/latchset/tang), a server for binding data to
994 network presence. Available as [services.tang](#opt-services.tang.enable).
995
996- [Jool](https://nicmx.github.io/Jool/en/index.html), a kernelspace NAT64 and
997 SIIT implementation providing translation between IPv4 and IPv6. Available as
998 [networking.jool.enable](#opt-networking.jool.enable).
999
1000- [Home Assistant
1001 Satellite](https://github.com/synesthesiam/homeassistant-satellite), a
1002 streaming audio satellite for Home Assistant voice pipelines, where you can
1003 reuse existing mic and speaker hardware. Available as
1004 `services.homeassistant-satellite`.
1005
1006- [Apache Guacamole](https://guacamole.apache.org/), a cross-platform,
1007 clientless remote desktop gateway. Available as
1008 [services.guacamole-server](#opt-services.guacamole-server.enable) and
1009 [services.guacamole-client](#opt-services.guacamole-client.enable) services.
1010
1011- [pgBouncer](https://www.pgbouncer.org), a PostgreSQL connection pooler.
1012 Available as [services.pgbouncer](#opt-services.pgbouncer.enable).
1013
1014- [Goss](https://goss.rocks/), a YAML based serverspec alternative tool for
1015 validating a server's configuration. Available as
1016 [services.goss](#opt-services.goss.enable).
1017
1018- [trust-dns](https://trust-dns.org/), a Rust based DNS server built to be safe
1019 and secure from the ground up. Available as
1020 [services.trust-dns](#opt-services.trust-dns.enable).
1021
1022- [osquery](https://www.osquery.io/), a SQL powered operating system
1023 instrumentation, monitoring, and analytics. Available as
1024 [services.osquery](#opt-services.osquery.enable).
1025
1026- [ebusd](https://ebusd.eu), a daemon for handling communication with eBUS
1027 devices connected to a 2-wire bus system ("energy bus" used by numerous
1028 heating systems). Available as [services.ebusd](#opt-services.ebusd.enable).
1029
1030- [systemd-sysupdate](https://www.freedesktop.org/software/systemd/man/systemd-sysupdate.html),
1031 atomically updates the host OS, container images, portable service images or
1032 other sources. Available as [systemd.sysupdate](opt-systemd.sysupdate).
1033
1034- [eris-server](https://codeberg.org/eris/eris-go), an implementation of the
1035 Encoding for Robust Immutable Storage (ERIS). Available as
1036 [services.eris-server](#opt-services.eris-server.enable).
1037
1038- [forgejo](https://forgejo.org/), a git forge and drop-in replacement for
1039 Gitea. Available as [services.forgejo](#opt-services.forgejo.enable).
1040
1041- `hardware/infiniband.nix` adds infiniband subnet manager support using an
1042 [opensm](https://github.com/linux-rdma/opensm) systemd-template service,
1043 instantiated on card guids. The module also adds kernel modules and cli
1044 tooling to help administrators debug and measure performance. Available as
1045 [hardware.infiniband.enable](#opt-hardware.infiniband.enable).
1046
1047- [zwave-js](https://github.com/zwave-js/zwave-js-server), a small server
1048 wrapper around Z-Wave JS to access it via a WebSocket. Available as
1049 [services.zwave-js](#opt-services.zwave-js.enable).
1050
1051- [Honk](https://humungus.tedunangst.com/r/honk), a complete ActivityPub server
1052 with minimal setup and support costs. Available as
1053 [services.honk](#opt-services.honk.enable).
1054
1055- [ferretdb](https://www.ferretdb.io/), an open-source proxy, converting the
1056 MongoDB 6.0+ wire protocol queries to PostgreSQL or SQLite. Available as
1057 [services.ferretdb](options.html#opt-services.ferretdb.enable).
1058
1059- [MicroBin](https://microbin.eu/), a feature rich, performant and secure text
1060 and file sharing web application, a "paste bin". Available as
1061 [services.microbin](#opt-services.microbin.enable).
1062
1063- [NNCP](http://www.nncpgo.org/), nncp-daemon and nncp-caller services.
1064 Available as [programs.nncp.settings](#opt-programs.nncp.settings) and
1065 [services.nncp](#opt-services.nncp.caller.enable).
1066
1067- [FastNetMon Advanced](https://fastnetmon.com/product-overview/), a commercial
1068 high performance DDoS detector and sensor. Available as
1069 [services.fastnetmon-advanced](#opt-services.fastnetmon-advanced.enable).
1070
1071- [tuxedo-rs](https://github.com/AaronErhardt/tuxedo-rs), Rust utilities for
1072 interacting with hardware from TUXEDO Computers. Available as
1073 [hardware.tuxedo-rs](#opt-hardware.tuxedo-rs.enable).
1074
1075- [certspotter](https://github.com/SSLMate/certspotter), a certificate
1076 transparency log monitor. Available as
1077 [services.certspotter](#opt-services.certspotter.enable).
1078
1079- [audiobookshelf](https://github.com/advplyr/audiobookshelf/), a self-hosted
1080 audiobook and podcast server. Available as
1081 [services.audiobookshelf](#opt-services.audiobookshelf.enable).
1082
1083- [ZITADEL](https://zitadel.com), a turnkey identity and access management
1084 platform. Available as [services.zitadel](#opt-services.zitadel.enable).
1085
1086- [exportarr](https://github.com/onedr0p/exportarr), Prometheus Exporters for
1087 Bazarr, Lidarr, Prowlarr, Radarr, Readarr, and Sonarr. Available as
1088 [services.prometheus.exporters.exportarr-bazarr](#opt-services.prometheus.exporters.exportarr-bazarr.enable)/[services.prometheus.exporters.exportarr-lidarr](#opt-services.prometheus.exporters.exportarr-lidarr.enable)/[services.prometheus.exporters.exportarr-prowlarr](#opt-services.prometheus.exporters.exportarr-prowlarr.enable)/[services.prometheus.exporters.exportarr-radarr](#opt-services.prometheus.exporters.exportarr-radarr.enable)/[services.prometheus.exporters.exportarr-readarr](#opt-services.prometheus.exporters.exportarr-readarr.enable)/[services.prometheus.exporters.exportarr-sonarr](#opt-services.prometheus.exporters.exportarr-sonarr.enable).
1089
1090- [netclient](https://github.com/gravitl/netclient), an automated WireGuard
1091 Management Client. Available as
1092 [services.netclient](#opt-services.netclient.enable).
1093
1094- [trunk-ng](https://github.com/ctron/trunk), A fork of `trunk`: Build, bundle
1095 & ship your Rust WASM application to the web
1096
1097- [virt-manager](https://virt-manager.org/), an UI for managing virtual
1098 machines in libvirt. Available as
1099 [programs.virt-manager](#opt-programs.virt-manager.enable).
1100
1101- [Soft Serve](https://github.com/charmbracelet/soft-serve), a tasty,
1102 self-hostable Git server for the command line. Available as
1103 [services.soft-serve](#opt-services.soft-serve.enable).
1104
1105- [Rosenpass](https://rosenpass.eu/), a service for post-quantum-secure VPNs
1106 with WireGuard. Available as
1107 [services.rosenpass](#opt-services.rosenpass.enable).
1108
1109- [c2FmZQ](https://github.com/c2FmZQ/c2FmZQ/), an application that can securely
1110 encrypt, store, and share files, including but not limited to pictures and
1111 videos. Available as
1112 [services.c2fmzq-server](#opt-services.c2fmzq-server.enable).
1113
1114- [preload](http://sourceforge.net/projects/preload), a service that makes
1115 applications run faster by prefetching binaries and shared objects.
1116 Available as [services.preload](#opt-services.preload.enable).
1117
1118### Other Notable Changes {#sec-release-23.11-nixos-notable-changes}
1119
1120- The new option `system.switch.enable` was added. It is enabled by default.
1121 Disabling it makes the system unable to be reconfigured via `nixos-rebuild`.
1122 This is of advantage for image based appliances where updates are handled
1123 outside the image.
1124
1125- `services.searx` receives new options for better SearXNG support. This
1126 includes options for the built-in rate limiter, bot protection and
1127 automatically configuring a local Redis server.
1128
1129- The iptables firewall module installs the `nixos-firewall-tool` now which
1130 allows the user to easily temporarily open ports through the firewall.
1131
1132- A new option was added to the virtualisation module that enables specifying
1133 explicitly named network interfaces in QEMU VMs. The existing
1134 `virtualisation.vlans` is still supported for cases where the name of the
1135 network interface is irrelevant.
1136
1137- `services.outline` can be configured to use local filesystem storage now.
1138 Previously ony S3 storage was possible. This may be set using
1139 [services.outline.storage.storageType](#opt-services.outline.storage.storageType).
1140
1141- `pkgs.openvpn3` optionally supports systemd-resolved now. `programs.openvpn3`
1142 will automatically enable systemd-resolved support if
1143 [services.resolved.enable](#opt-services.resolved.enable) is set to true.
1144
1145- The
1146 [services.woodpecker-server.environmentFile](#opt-services.woodpecker-server.environmentFile)
1147 type was changed to list of paths to be more consistent to the
1148 woodpecker-agent module
1149
1150- `services.matrix-synapse` has new options to configure worker processes for
1151 matrix-synapse using
1152 [`services.matrix-synapse.workers`](#opt-services.matrix-synapse.workers).
1153 Configuring a local redis server using
1154 [`services.matrix-synapse.configureRedisLocally`](#opt-services.matrix-synapse.configureRedisLocally)
1155 is also possible now.
1156
1157- The `services.nginx` module gained a `defaultListen` option at server-level
1158 with support for PROXY protocol listeners. Also `proxyProtocol` is exposed in
1159 the `services.nginx.virtualHosts.<name>.listen` option now. This it is
1160 possible to run PROXY listeners and non-PROXY listeners at a server-level.
1161 Refer to [PR #213510](https://github.com/NixOS/nixpkgs/pull/213510/) for more
1162 details.
1163
1164- `services.restic.backups` adds wrapper scripts to your system path now. This
1165 wrapper script sets the same environment variables as the service, so restic
1166 operations can easily be run from the command line. This behavior can be
1167 disabled by setting `createWrapper` to `false`, for each backup
1168 configuration.
1169
1170- `services.prometheus.exporters` has a new exporter to monitor electrical
1171 power consumption based on PowercapRAPL sensor called
1172 [Scaphandre](https://github.com/hubblo-org/scaphandre). Refer to [PR
1173 #239803](https://github.com/NixOS/nixpkgs/pull/239803) for more details.
1174
1175- The `services.calibre-server` module has new options to configure the `host`,
1176 `port`, `auth.enable`, `auth.mode` and `auth.userDb` path. Refer to [PR
1177 #216497](https://github.com/NixOS/nixpkgs/pull/216497/) for more details.
1178
1179- `services.prometheus.exporters` has a new
1180 [exporter](https://github.com/hipages/php-fpm_exporter) to monitor PHP-FPM
1181 processes. Refer to [PR
1182 #240394](https://github.com/NixOS/nixpkgs/pull/240394) for more details.
1183
1184- `services.github-runner` and `services.github-runners.<name>` gained the
1185 option `nodeRuntimes`. This option defaults to `[ "node20" ]`. I.e., the
1186 service supports Node.js 20 GitHub Actions only. The list of Node.js versions
1187 accepted by `nodeRuntimes` tracks the versions the upstream GitHub Actions
1188 runner supports. Refer to [PR
1189 #249103](https://github.com/NixOS/nixpkgs/pull/249103) for details.
1190
1191- `programs.gnupg` has the option `agent.settings` now. This allows setting
1192 verbatim config values in `/etc/gnupg/gpg-agent.conf`.
1193
1194- `dockerTools.buildImage`, `dockerTools.buildLayeredImage` and
1195 `dockerTools.streamLayeredImage` use `lib.makeOverridable` now . This allows
1196 `dockerTools`-based images to be customized more efficiently at the Nix
1197 level.
1198
1199- `services.influxdb2` supports doing an automatic initial setup and
1200 provisioning of users, organizations, buckets and authentication tokens now.
1201 Refer to [PR #249502](https://github.com/NixOS/nixpkgs/pull/249502) for more
1202 details.
1203
1204- `wrapHelm` exposes `passthru.pluginsDir` now which can be passed to
1205 `helmfile`. For convenience, a top-level package `helmfile-wrapped` has been
1206 added, which inherits `passthru.pluginsDir` from `kubernetes-helm-wrapped`.
1207 Refer to [PR #217768](https://github.com/NixOS/nixpkgs/issues/217768) for
1208 more details.
1209
1210- The `boot.initrd.network.udhcp.enable` option allows control over DHCP during
1211 Stage 1 regardless of what `networking.useDHCP` is set to.
1212
1213- `networking.nftables` has the option `networking.nftables.table.<table>` now. This creates tables
1214 and have them be updated atomically, instead of flushing the ruleset.
1215
1216- `hardware.nvidia` gained `datacenter` options for enabling NVIDIA Data Center
1217 drivers and configuration of NVLink/NVSwitch topologies through
1218 `nv-fabricmanager`.
1219
1220- The new `boot.bcache.enable` option allows completely removing `bcache`
1221 mount support. It is enabled by default.
1222
1223- `security.sudo` provides two extra options now, while not changing the
1224 module's default behaviour:
1225 - `defaultOptions` controls the options used for the default rules;
1226 - `keepTerminfo` controls whether `TERMINFO` and `TERMINFO_DIRS` are preserved
1227 for `root` and the `wheel` group.
1228
1229- `virtualisation.googleComputeImage` provides a `efi` option to support UEFI
1230 booting now.
1231
1232- CoreDNS may be built with external plugins now. This may be done by
1233 overriding `externalPlugins` and `vendorHash` arguments like this:
1234
1235 ```nix
1236 {
1237 services.coredns = {
1238 enable = true;
1239 package = pkgs.coredns.override {
1240 externalPlugins = [
1241 {name = "fanout"; repo = "github.com/networkservicemesh/fanout"; version = "v1.9.1";}
1242 ];
1243 vendorHash = "<SRI hash>";
1244 };
1245 };
1246 }
1247 ```
1248
1249 To get the necessary SRI hash, set `vendorHash = "";`. The build will fail
1250 and produce the correct `vendorHash` in the error message.
1251
1252 If you use this feature, updates to CoreDNS may require updating `vendorHash`
1253 by following these steps again.
1254
1255- Using `fusuma` enables the following plugins now:
1256 [appmatcher](https://github.com/iberianpig/fusuma-plugin-appmatcher),
1257 [keypress](https://github.com/iberianpig/fusuma-plugin-keypress),
1258 [sendkey](https://github.com/iberianpig/fusuma-plugin-sendkey),
1259 [tap](https://github.com/iberianpig/fusuma-plugin-tap) and
1260 [wmctrl](https://github.com/iberianpig/fusuma-plugin-wmctrl).
1261
1262- The Home Assistant module offers support for installing custom components and
1263 lovelace modules now. Available at
1264 [`services.home-assistant.customComponents`](#opt-services.home-assistant.customComponents)
1265 and
1266 [`services.home-assistant.customLovelaceModules`](#opt-services.home-assistant.customLovelaceModules).
1267
1268- TeX Live environments can now be built with the new `texlive.withPackages`.
1269 The procedure for creating custom TeX packages has been changed. Refer to the
1270 [Nixpkgs
1271 manual](https://nixos.org/manual/nixpkgs/stable/#sec-language-texlive-custom-packages)
1272 for more details.
1273
1274- In `wxGTK32`, the webkit module `wxWebView` has been enabled on all builds.
1275 Prior releases only enabled this on Darwin.
1276
1277- Support for WiFi6 (IEEE 802.11ax) and WPA3-SAE-PK was enabled in the
1278 `hostapd` package, along with a significant rework of the hostapd module.
1279
1280- LXD supports virtual machine instances now to complement the existing
1281 container support.
1282
1283- The `nixos-rebuild` command has been given a `list-generations` subcommand.
1284 Refer to `man nixos-rebuild` for more details.
1285
1286- [`sudo-rs`], a reimplementation of `sudo` in Rust, is now supported.
1287 An experimental new module `security.sudo-rs` was added.
1288 Switching to it (via ` security.sudo-rs.enable = true;`) introduces
1289 slight changes in sudo behaviour, due to `sudo-rs`' current limitations:
1290 - terminfo-related environment variables aren't preserved for `root` and `wheel`;
1291 - `root` and `wheel` are not given the ability to set (or preserve)
1292 arbitrary environment variables.
1293
1294 **Note:** The `sudo-rs` module only takes configuration through `security.sudo-rs`,
1295 and in particular does not automatically use previously-set rules; this could be
1296 achieved with `security.sudo-rs.extraRules = security.sudo.extraRules;` for instance.
1297
1298[`sudo-rs`]: https://github.com/memorysafety/sudo-rs/
1299
1300- There is a new NixOS option when writing NixOS tests
1301 `testing.initrdBackdoor`, that enables `backdoor.service` in initrd. Requires
1302 `boot.initrd.systemd.enable` to be enabled. Boot will pause in Stage 1 at
1303 `initrd.target`, and will listen for commands from the `Machine` python
1304 interface, just like Stage 2 normally does. This enables commands to be sent
1305 to test and debug Stage 1. Use `machine.switch_root()` to leave Stage 1 and
1306 proceed to Stage 2.
1307
1308- The Linux kernel module `msr` (refer to
1309 [`msr(4)`](https://man7.org/linux/man-pages/man4/msr.4.html)), which provides
1310 an interface to read and write the model-specific registers (MSRs) of an x86
1311 CPU, can now be configured via `hardware.cpu.x86.msr`.
1312
1313- The `qemu-vm.nix` module now supports disabling overriding `fileSystems` with
1314 `virtualisation.fileSystems`. This enables the user to boot VMs from
1315 "external" disk images not created by the qemu-vm module. You can stop the
1316 qemu-vm module from overriding `fileSystems` by setting
1317 `virtualisation.fileSystems = lib.mkForce { };`.
1318
1319- When using [split parity files](https://www.snapraid.it/manual#7.1) in `snapraid`,
1320 the snapraid-sync systemd service will no longer fail to run.
1321
1322- `wpa_supplicant`'s configuration file cannot be read by non-root users, and
1323 secrets (such as Pre-Shared Keys) can safely be passed via
1324 `networking.wireless.environmentFile`.
1325
1326 The configuration file could previously be read, when `userControlled.enable` (non-default),
1327 by users who are in both `wheel` and `userControlled.group` (defaults to `wheel`)
1328
1329
1330## Nixpkgs Library {#sec-release-23.11-nixpkgs-lib}
1331
1332### Breaking Changes {#sec-release-23.11-lib-breaking}
1333
1334- [`lib.lists.foldl'`](https://nixos.org/manual/nixpkgs/stable#function-library-lib.lists.foldl-prime)
1335 now always evaluates the initial accumulator argument first. If you depend on
1336 the lazier behavior, consider using
1337 [`lib.lists.foldl`](https://nixos.org/manual/nixpkgs/stable#function-library-lib.lists.foldl)
1338 or
1339 [`builtins.foldl'`](https://nixos.org/manual/nix/stable/language/builtins.html#builtins-foldl')
1340 instead.
1341- [`lib.attrsets.foldlAttrs`](https://nixos.org/manual/nixpkgs/stable#function-library-lib.attrsets.foldlAttrs)
1342 now always evaluates the initial accumulator argument first.
1343- Now that the internal NixOS transition to Markdown documentation is complete,
1344 `lib.options.literalDocBook` has been removed after deprecation in 22.11.
1345- `lib.types.string` is now fully deprecated and gives a warning when used.
1346
1347### Additions and Improvements {#sec-release-23.11-lib-additions-improvements}
1348
1349- [`lib.fileset`](https://nixos.org/manual/nixpkgs/stable#sec-functions-library-fileset):
1350 A new sub-library to select local files to use for sources, designed to be
1351 easy and safe to use.
1352
1353 This aims to be a replacement for `lib.sources`-based filtering. To learn
1354 more about it, see [the blog
1355 post](https://www.tweag.io/blog/2023-11-28-file-sets/) or [the
1356 tutorial](https://nix.dev/tutorials/file-sets).
1357
1358- [`lib.gvariant`](https://nixos.org/manual/nixpkgs/stable#sec-functions-library-gvariant):
1359 A partial and basic implementation of GVariant formatted strings. See
1360 [GVariant Format
1361 Strings](https://docs.gtk.org/glib/gvariant-format-strings.html) for details.
1362
1363 :::{.warning}
1364 This API is not considered fully stable and it might therefore
1365 change in backwards incompatible ways without prior notice.
1366 :::
1367
1368- [`lib.asserts`](https://nixos.org/manual/nixpkgs/stable#sec-functions-library-asserts):
1369 New function:
1370 [`assertEachOneOf`](https://nixos.org/manual/nixpkgs/stable#function-library-lib.asserts.assertEachOneOf).
1371- [`lib.attrsets`](https://nixos.org/manual/nixpkgs/stable#sec-functions-library-attrsets):
1372 New function:
1373 [`attrsToList`](https://nixos.org/manual/nixpkgs/stable#function-library-lib.attrsets.attrsToList).
1374- [`lib.customisation`](https://nixos.org/manual/nixpkgs/stable#sec-functions-library-customisation):
1375 New function:
1376 [`makeScopeWithSplicing'`](https://nixos.org/manual/nixpkgs/stable#function-library-lib.customisation.makeScopeWithSplicing-prime).
1377- [`lib.fixedPoints`](https://nixos.org/manual/nixpkgs/stable#sec-functions-library-fixedPoints):
1378 Documentation improvements for
1379 [`lib.fixedPoints.fix`](https://nixos.org/manual/nixpkgs/stable#function-library-lib.fixedPoints.fix).
1380- `lib.generators`: New functions:
1381 [`mkDconfKeyValue`](https://nixos.org/manual/nixpkgs/stable#function-library-lib.generators.mkDconfKeyValue),
1382 [`toDconfINI`](https://nixos.org/manual/nixpkgs/stable#function-library-lib.generators.toDconfINI).
1383
1384 `lib.generators.toKeyValue` now supports the `indent` attribute in its first
1385 argument.
1386- [`lib.lists`](https://nixos.org/manual/nixpkgs/stable#sec-functions-library-lists):
1387 New functions:
1388 [`findFirstIndex`](https://nixos.org/manual/nixpkgs/stable#function-library-lib.lists.findFirstIndex),
1389 [`hasPrefix`](https://nixos.org/manual/nixpkgs/stable#function-library-lib.lists.hasPrefix),
1390 [`removePrefix`](https://nixos.org/manual/nixpkgs/stable#function-library-lib.lists.removePrefix),
1391 [`commonPrefix`](https://nixos.org/manual/nixpkgs/stable#function-library-lib.lists.commonPrefix),
1392 [`allUnique`](https://nixos.org/manual/nixpkgs/stable#function-library-lib.lists.allUnique).
1393
1394 Documentation improvements for
1395 [`lib.lists.foldl'`](https://nixos.org/manual/nixpkgs/stable#function-library-lib.lists.foldl-prime).
1396- [`lib.meta`](https://nixos.org/manual/nixpkgs/stable#sec-functions-library-meta):
1397 Documentation of functions now gets rendered
1398- [`lib.path`](https://nixos.org/manual/nixpkgs/stable#sec-functions-library-path):
1399 New functions:
1400 [`hasPrefix`](https://nixos.org/manual/nixpkgs/stable#function-library-lib.path.hasPrefix),
1401 [`removePrefix`](https://nixos.org/manual/nixpkgs/stable#function-library-lib.path.removePrefix),
1402 [`splitRoot`](https://nixos.org/manual/nixpkgs/stable#function-library-lib.path.splitRoot),
1403 [`subpath.components`](https://nixos.org/manual/nixpkgs/stable#function-library-lib.path.subpath.components).
1404- [`lib.strings`](https://nixos.org/manual/nixpkgs/stable#sec-functions-library-strings):
1405 New functions:
1406 [`replicate`](https://nixos.org/manual/nixpkgs/stable#function-library-lib.strings.replicate),
1407 [`cmakeOptionType`](https://nixos.org/manual/nixpkgs/stable#function-library-lib.strings.cmakeOptionType),
1408 [`cmakeBool`](https://nixos.org/manual/nixpkgs/stable#function-library-lib.strings.cmakeBool),
1409 [`cmakeFeature`](https://nixos.org/manual/nixpkgs/stable#function-library-lib.strings.cmakeFeature).
1410- [`lib.trivial`](https://nixos.org/manual/nixpkgs/stable#sec-functions-library-trivial):
1411 New function:
1412 [`mirrorFunctionArgs`](https://nixos.org/manual/nixpkgs/stable#function-library-lib.trivial.mirrorFunctionArgs).
1413- `lib.systems`: New function:
1414 [`equals`](https://nixos.org/manual/nixpkgs/stable#function-library-lib.systems.equals).
1415- [`lib.options`](https://nixos.org/manual/nixpkgs/stable#sec-functions-library-options):
1416 Improved documentation for
1417 [`mkPackageOption`](https://nixos.org/manual/nixpkgs/stable#function-library-lib.options.mkPackageOption).
1418
1419 [`mkPackageOption`](https://nixos.org/manual/nixpkgs/stable#function-library-lib.options.mkPackageOption).
1420 now also supports the `pkgsText` attribute.
1421
1422Module system:
1423- Options in the `options` module argument now have the `declarationPositions`
1424 attribute containing the position where the option was declared:
1425 ```
1426 $ nix-repl -f '<nixpkgs/nixos>' [...]
1427 nix-repl> :p options.environment.systemPackages.declarationPositions
1428 [ {
1429 column = 7;
1430 file = "/nix/store/vm9zf9wvfd628cchj0hdij1g4hzjrcz9-source/nixos/modules/config/system-path.nix";
1431 line = 62;
1432 } ]
1433 ```
1434
1435 Not to be confused with `definitionsWithLocations`, which is the same but for option _definitions_.
1436- Improved error message for option declarations missing `mkOption`
1437
1438### Deprecations {#sec-release-23.11-lib-deprecations}
1439
1440- `lib.meta.getExe pkg` (also available as `lib.getExe`) now gives a warning if
1441 `pkg.meta.mainProgram` is not set, but it continues to default to the
1442 derivation name. Nixpkgs accepts PRs that set `meta.mainProgram` on packages
1443 where it makes sense. Use `lib.getExe' pkg "some-command"` to avoid the
1444 warning and/or select a different executable.