staging-next 2026-03-07 (#497493)

- `python3Packages.gradio` has been updated to version 6. See upstream's migration guide at https://www.gradio.app/main/guides/gradio-6-migration-guide.

- `python3Packages.pikepdf` no longer builds with mupdf support by default, which may be nice in Jupyter and iPython. Build with `withMupdf = true` if this is required.

- `vicinae` has been updated to v0.20. This includes, among several other breaking changes, a complete overhaul of the configuration system. For update instructions, see the [upstream configuration documentation](https://docs.vicinae.com/config#migration-from-v0-16-x-to-v0-17-x).

- The `man-pages` package's outputs have been split. The manual pages are installed into the `man` output, which is installed by default. Binaries (including `diffman-git`, `mansect`, `pdfman`, and `sortman`) are installed into the `out` output, which is not installed by default.

  If your SQLite database is corrupted, the migration might fail and require [manual intervention](https://github.com/louislam/uptime-kuma/issues/5281).

  See the [migration guide](https://github.com/louislam/uptime-kuma/wiki/Migration-From-v1-To-v2) for more information.

- The `libcxxhardeningextensive` hardening flag has been **disabled** by default. Enabling it by default in 25.11 was unintentional and may have had a negative effect on performance in some cases. `libcxxhardeningfast` remains enabled by default.

- Switch inhibitors were introduced, which add a pre-switch check that compares a list of strings between the previous and the new generation, and refuses to switch into the new generation when there is a difference between the two lists. This allows to avoid switching into a system when for instance the systemd version changed by adding `config.systemd.package.version` to the switch inhibitors for your system. You can still forcefully switch into any generation by setting `NIXOS_NO_CHECK=1`.

- GNU Taler has been updated to version 1.3.

- `fetchPnpmDeps` and `pnpmConfigHook` were added as top-level attributes, replacing the now deprecated `pnpm.fetchDeps` and `pnpm.configHook` attributes.

- `buildNpmPackage` now supports `npmDepsCacheVersion`. Set to `2` to enable packument caching, which fixes builds for projects using npm workspaces.

- `buildNpmPackage` now supports `npmDepsFetcherVersion` (and `fetchNpmDeps` now supports `fetcherVersion`). Set to `2` to enable packument caching, which fixes builds for projects using npm workspaces.

- Added `dell-bios-fan-control` package and service.

This flag adds the `-fstack-clash-protection` compiler option, which causes growth of a program's stack to access each successive page in order. This should force the guard page to be accessed and cause an attempt to "jump over" this guard page to crash.

### Hardening flags disabled by default {#sec-hardening-flags-disabled-by-default}

The following flags are disabled by default and should be enabled with `hardeningEnable` for packages that take untrusted input like network services.

#### `libcxxhardeningfast` {#libcxxhardeningfast}

#### `nostrictaliasing` {#nostrictaliasing}

Adds the `-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_FAST` compiler flag. This flag only has an effect on libc++ targets, and when defined, enables a set of assertions that prevent undefined behavior caused by violating preconditions of the standard library. libc++ provides several hardening modes, and this "fast" mode contains a set of security-critical checks that can be done with relatively little overhead in constant time.

This flag adds the `-fno-strict-aliasing` compiler option, which prevents the compiler from assuming code has been written strictly following the standard in regards to pointer aliasing and therefore performing optimizations that may be unsafe for code that has not followed these rules.

Disabling `libcxxhardeningfast` implies disablement of checks from `libcxxhardeningextensive`.

#### `strictflexarrays1` {#strictflexarrays1}

Disabling `strictflexarrays1` implies disablement of `strictflexarrays3`.

### Hardening flags disabled by default {#sec-hardening-flags-disabled-by-default}

The following flags are disabled by default and should be enabled with `hardeningEnable` for packages that take untrusted input like network services.

#### `nostrictaliasing` {#nostrictaliasing}

This flag adds the `-fno-strict-aliasing` compiler option, which prevents the compiler from assuming code has been written strictly following the standard in regards to pointer aliasing and therefore performing optimizations that may be unsafe for code that has not followed these rules.

#### `strictflexarrays3` {#strictflexarrays3}

This flag adds the `-fstrict-flex-arrays=3` compiler option, which reduces the cases the compiler treats as "flexible arrays" to only those declared with length as (the correct) `[]`. This increases the coverage of fortify checks, because such arrays declared as the trailing element of a structure can normally not have their intended length determined by the compiler.

These checks may have an impact on performance in some cases.

#### `libcxxhardeningfast` {#libcxxhardeningfast}

Adds the `-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_FAST` compiler flag. This flag only has an effect on libc++ targets, and when defined, enables a set of assertions that prevent undefined behavior caused by violating preconditions of the standard library. libc++ provides several hardening modes, and this "fast" mode contains a set of security-critical checks that can be done with relatively little overhead in constant time.

Disabling `libcxxhardeningfast` implies disablement of checks from `libcxxhardeningextensive`.

#### `libcxxhardeningextensive` {#libcxxhardeningextensive}

Adds the `-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_EXTENSIVE` compiler flag. This flag only has an effect on libc++ targets, and when defined, enables a set of assertions that prevent undefined behavior caused by violating preconditions of the standard library. libc++ provides several hardening modes, and this "extensive" mode adds checks for undefined behavior that incur relatively little overhead but aren’t security-critical. The additional rigour impacts performance more than fast mode: benchmarking is recommended to determine if it is acceptable for a particular application.

    github = "karaolidis";

    githubId = 46189100;

  };

  karlbeecken = {

    name = "Karl Beecken";

    email = "karl@beecken.berlin";

    github = "karlbeecken";

    githubId = 32744028;

    keys = [ { fingerprint = "7577 13A4 9609 0C2F 51C4  018C B5C8 89A2 F195 28F6"; } ];

  };

  KarlJoad = {

    email = "karl@hallsby.com";

    github = "KarlJoad";

>>>

```

::: {.note}

Tests using `systemd-nspawn` container machines require root privileges to run interactively,

since the driver calls `systemd-nspawn` directly to start the containers:

```

$ sudo ./result/bin/nixos-test-driver

[...]

>>>

```

:::

::: {.note}

By executing the test driver in this way,

the VMs executed may gain network & Internet access via their backdoor control interface,

you to inspect the state of the VMs after the test (e.g. to debug the

test script).

## Shell access in interactive mode {#sec-nixos-test-shell-access}

## Shell access to VMs in interactive mode {#sec-nixos-test-shell-access}

The function `<yourmachine>.shell_interact()` grants access to a shell running

inside a virtual machine. To use it, replace `<yourmachine>` with the name of a

Once the connection is established, you can enter commands in the socat terminal

where socat is running.

## SSH Access for test machines {#sec-nixos-test-ssh-access}

## SSH Access for test VMs {#sec-nixos-test-ssh-access}

An SSH-based backdoor to log into machines can be enabled with

## Reuse VM state {#sec-nixos-test-reuse-vm-state}

You can re-use the VM states coming from a previous run by setting the

`--keep-vm-state` flag.

`--keep-machine-state` flag.

```ShellSession

$ ./result/bin/nixos-test-driver --keep-vm-state

$ ./result/bin/nixos-test-driver --keep-machine-state

```

The machine state is stored in the `$TMPDIR/vm-state-machinename`

## System Requirements {#sec-running-nixos-tests-requirements}

NixOS tests require virtualization support.

NixOS tests using QEMU virtual machine [`nodes`](#test-opt-nodes) require virtualization support.

This means that the machine must have `kvm` in its [system features](https://nixos.org/manual/nix/stable/command-ref/conf-file.html?highlight=system-features#conf-system-features) list, or `apple-virt` in case of macOS.

These features are autodetected locally, but `apple-virt` is only autodetected since Nix 2.19.0.

Features of **remote builders** must additionally be configured manually on the client, e.g. on NixOS with [`nix.buildMachines.*.supportedFeatures`](https://search.nixos.org/options?show=nix.buildMachines.*.supportedFeatures&sort=alpha_asc&query=nix.buildMachines) or through general [Nix configuration](https://nixos.org/manual/nix/stable/advanced-topics/distributed-builds).

If you run the tests on a **macOS** machine, you also need a "remote" builder for Linux; possibly a VM. [nix-darwin](https://daiderd.com/nix-darwin/) users may enable [`nix.linux-builder.enable`](https://daiderd.com/nix-darwin/manual/index.html#opt-nix.linux-builder.enable) to launch such a VM.

NixOS tests using `systemd-nspawn` [`containers`](#test-opt-containers) require the Nix daemon to be

configured with the following settings:

```nix

{

  nix.settings = {

    auto-allocate-uids = true;

    extra-system-features = [ "uid-range" ];

    experimental-features = [

      "auto-allocate-uids"

      "cgroups"

    ];

  };

}

```

See the documentation of the settings

[`auto-allocate-uids`](https://nix.dev/manual/nix/stable/command-ref/conf-file#conf-auto-allocate-uids),

[`uid-range`](https://nix.dev/manual/nix/stable/command-ref/conf-file.html?highlight=uid-range#conf-system-features), and

[`cgroups`](https://nix.dev/manual/nix/stable/development/experimental-features#xp-feature-cgroups)

for more information.

If the test uses both `systemd-nspawn` [`containers`](#test-opt-containers) and QEMU virtual machine [`nodes`](#test-opt-nodes)

and requires them share a common VLAN,

`/dev/net` must be present in the sandbox.

This allows them to be bridged over a TAP interface.

To make this path available, set the following option:

```nix

{

  nix.settings.sandbox-paths = [ "/dev/net" ];

}

```