doc/rl-2505: move some entires from nixos notes

- [testers.shellcheck](https://nixos.org/manual/nixpkgs/unstable/#tester-shellcheck) now warns when `name` is not provided.

  The `name` argument will become mandatory in a future release.

- `tauon` 7.9.0+ when launched for the first time, migrates its database to a new schema that is not backwards compatible. Older versions will refuse to start at all with that database afterwards. If you need to still use older tauon versions, make sure to back up `~/.local/share/TauonMusicBox`.

- `aws-workspaces` has dropped support for PCoiP networking.

- [GIMP 3.0](https://www.gimp.org/news/2025/03/16/gimp-3-0-released/) available as `gimp3`.

- `grafana-agent` and `services.grafana-agent` have been removed in favor of

  `xdragon` is an alias to `dragon-drop` and the package still provides `bin/xdragon`.

  `bin/dragon` is no longer supplied.

- `python3Packages.bpycv` has been removed due to being incompatible with Blender 4 and unmaintained.

- `python3Packages.jaeger-client` was removed because it was deprecated upstream. [OpenTelemetry](https://opentelemetry.io) is the recommended replacement.

- `rocmPackages_6` has been updated to ROCm 6.3.

- `rocmPackages_5` has been removed.

- `rocmPackages.rocm-thunk` has been removed and its functionality has been integrated with the ROCm CLR. Use `rocmPackages.clr` instead.

- `rocmPackages.clang-ocl` has been removed. [It was deprecated by AMD in 2023.](https://github.com/ROCm/clang-ocl)

- `nodePackages.meshcommander` has been removed, as the package was deprecated by Intel.

- The default version of `z3` has been updated from 4.8 to 4.13. There are still a few packages that need specific older versions; those will continue to be maintained as long as other packages depend on them but may be removed in the future.

- The `nixLog*` family of functions made available through the standard environment have been rewritten to prefix messages with both the debug level and the function name of the caller.

  The `nixLog` function, which logs unconditionally, was also re-introduced and modified to prefix messages with the function name of the caller.

  For more information, [see this PR](https://github.com/NixOS/nixpkgs/pull/370742).

  and the [4.2 release](https://github.com/netbox-community/netbox/releases/tag/v4.2.0),

  make the required changes to your database, if needed, then upgrade by setting `services.netbox.package = pkgs.netbox_4_2;` in your configuration.

- `nodePackages.expo-cli` has been removed, as it was deprecated by upstream. The suggested replacement is the `npx expo` command.

- NetBox version 4.0.X available as `netbox_4_0` was removed. Please upgrade to `4.2`.

- `golangci-lint` has reached `v2`. Please read the changes and view the migration guide [here](https://golangci-lint.run/product/changelog/#200).

- `docker_24` has been removed, as it was EOL with vulnerabilities since June 08, 2024.

- Emacs 28 and 29 have been removed.

- Emacs 28 Macport has been removed, while CVEs of Emacs 29 Macport are patched.

- `containerd` has been updated to v2, which contains breaking changes. See the [containerd

- `titaniumenv`, `titanium`, and `titanium-alloy` have been removed due to lack of maintenance in Nixpkgs []{#sec-nixpkgs-release-25.05-incompatibilities-titanium-removed}.

- `octave` (and `octaveFull`) was updated to version `10.x`. The update broke a few `octavePackages`, and `librsb`. See [the PR's commits](https://github.com/NixOS/nixpkgs/pull/394495/commits) for more details.

- androidenv has been improved:

  - All versions specified in composeAndroidPackages now track the latest. Android packages are automatically updated on unstable, and run the androidenv test suite on every update.

  - Many androidenv packages are now searchable on [search.nixos.org](https://search.nixos.org).

- `gerbera` now has wavpack support.

- `buildGoModule` now supports a self-referencing `finalAttrs:` parameter

  containing the final arguments including overrides.

  This allows packaging configuration to be overridden in a consistent manner by

  providing an alternative to `rec {}` syntax.

- GOverlay has been updated to 1.2, please check the [upstream changelog](https://github.com/benjamimgois/goverlay/releases) for more details.

- `tpm2-pkcs11` now has the variant `tpm2-pkcs11-fapi`, which has been patched to default to the Feature API backend. It has also been split into `tpm2-pkcs11-esapi`, which _only_ supports the older Enhanced System API backend. Note the [differences](https://github.com/tpm2-software/tpm2-pkcs11/blob/1.9.1/docs/FAPI.md), and that `tpm2-pkcs11` itself still needs `TPM2_PKCS11_BACKEND=fapi` exported in order to use the Feature API, whereas `tpm2-pkcs11-fapi` does not, and `tpm2-pkcs11-esapi` just does not support fapi entirely.

- For matrix homeserver Synapse we are now following the upstream recommendation to enable jemalloc as the memory allocator by default.

- A new hardening flag, `nostrictaliasing` was made available, corresponding to the gcc/clang option `-fno-strict-aliasing`.

- In `dovecot` package removed hard coding path to module directory.

- `signal-desktop` has been migrated to a from source build. No state migration is necessary. In case there's no working source build available (like on Darwin), the the binary build is still available at `signal-desktop-bin`.

- `services.signald` has been removed as `signald` is unmaintained upstream and has been incompatible to official Signal servers for a long while.

- `tauon` 7.9.0+ when launched for the first time, migrates its database to a new schema that is not backwards compatible. Older versions will refuse to start at all with that database afterwards. If you need to still use older tauon versions, make sure to back up `~/.local/share/TauonMusicBox`.

- `aws-workspaces` has dropped support for PCoiP networking.

- The `earlyoom` service is now using upstream systemd service, which enables

  hardening and filesystem isolation by default. If you need filesystem write

  access or want to access home directory via `killHook`, hardening setting can

- `services.gitlab` now requires the setting of `activeRecordPrimaryKeyFile`, `activeRecordDeterministicKeyFile`, `activeRecordSaltFile` as GitLab introduced Rails ActiveRecord encryption.

- `python3Packages.bpycv` has been removed due to being incompatible with Blender 4 and unmaintained.

- `python3Packages.jaeger-client` was removed because it was deprecated upstream. [OpenTelemetry](https://opentelemetry.io) is the recommended replacement.

- `rocmPackages_6` has been updated to ROCm 6.3.

- `rocmPackages_5` has been removed.

- `rocmPackages.rocm-thunk` has been removed and its functionality has been integrated with the ROCm CLR. Use `rocmPackages.clr` instead.

- `rocmPackages.clang-ocl` has been removed. [It was deprecated by AMD in 2023.](https://github.com/ROCm/clang-ocl)

- `nodePackages.meshcommander` has been removed, as the package was deprecated by Intel.

- The default version of `z3` has been updated from 4.8 to 4.13. There are still a few packages that need specific older versions; those will continue to be maintained as long as other packages depend on them but may be removed in the future.

- `prometheus` has been updated from 2.55.0 to 3.1.0.

  Read the [release blog post](https://prometheus.io/blog/2024/11/14/prometheus-3-0/) and

  [migration guide](https://prometheus.io/docs/prometheus/3.1/migration/).

  [v2.0.0](https://github.com/Aylur/ags/releases/tag/v2.0.0)

  for more information.

- `nodePackages.expo-cli` has been removed, as it was deprecated by upstream. The suggested replacement is the `npx expo` command.

- DokuWiki with the Caddy webserver (`services.dokuwiki.webserver = "caddy"`) now sets up sites with Caddy's automatic HTTPS instead of HTTP-only.

  To keep the old behavior for a site `example.com`, set `services.caddy.virtualHosts."example.com".hostName = "http://example.com"`.

  If you set custom Caddy options for a DokuWiki site, migrate these options by removing `http://` from `services.caddy.virtualHosts."http://example.com"`.

- `security.apparmor.policies.<name>.enforce` and `security.apparmor.policies.<name>.enable` were removed.

  Configuring the state of apparmor policies must now be done using `security.apparmor.policies.<name>.state` tristate option.

- `services.graylog.package` now defaults to `graylog-6_0` as previous default `graylog-5_1` is EOL and therefore removed.

  Check the migration guides on [5.1→5.2](https://go2docs.graylog.org/5-2/upgrading_graylog/upgrading_to_graylog_5.2.x.htm) and [5.2→6.0](https://go2docs.graylog.org/6-0/upgrading_graylog/upgrading_to_graylog_6.0.x.html) for breaking changes.

- `programs.clash-verge.tunMode` was deprecated and removed because now service mode is necessary to start program. Without `programs.clash-verge.enable`, clash-verge-rev will refuse to start.

- `services.discourse` now requires PostgreSQL 15 per default. Please update before upgrading.

- `services.avahi.ipv6` now defaults to true.

- A new hardening flag, `nostrictaliasing` was made available, corresponding to the gcc/clang option `-fno-strict-aliasing`.

- In the `services.xserver.displayManager.startx` module, two new options [generateScript](#opt-services.xserver.displayManager.startx.generateScript) and [extraCommands](#opt-services.xserver.displayManager.startx.extraCommands) have been added to to declaratively configure the .xinitrc script.

- All services that require a root certificate bundle now use the value of a new read-only option, `security.pki.caBundle`.

  Note that all provided plugins must have versions/tags (string after `@`), even if upstream repo does not tag each release. For untagged plugins, you can either create an empty Go project and run `go get <plugin>` and see changes in `go.mod` to get the pseudo-version number, or provide a commit hash in place of version/tag for the first run, and update the plugin string based on the error output.

- `buildGoModule` now supports a self-referencing `finalAttrs:` parameter

  containing the final arguments including overrides.

  This allows packaging configuration to be overridden in a consistent manner by

  providing an alternative to `rec {}` syntax.

- [Mattermost](#opt-services.mattermost.enable), a self-hosted chat collaboration platform supporting calls, playbooks, and boards, has been updated. It now has multiple versions, disabled telemetry, and a native frontend build in nixpkgs, removing all upstream prebuilt blobs.

  - A new `pkgs.mattermost.buildPlugin` function has been added, which allows plugins to be built from source, including webapp frontends with a supported package-lock.json. See the Mattermost NixOS test and [manual](https://nixos.org/manual/nixpkgs/unstable/#sec-mattermost-plugins-build) for an example.

  - Mattermost telemetry reporting is now disabled by default, though security update notifications are enabled. Look at [`services.mattermost.telemetry`](#opt-services.mattermost.telemetry.enableDiagnostics) for options to control this behavior.

- `gerbera` now has wavpack support.

- `octave` (and `octaveFull`) was updated to version `10.x`. The update broke a few `octavePackages`, and `librsb`. See [the PR's commits](https://github.com/NixOS/nixpkgs/pull/394495/commits) for more details.

- A toggle has been added under `users.users.<name>.enable` to allow toggling individual users conditionally. If set to false, the user account will not be created.

- New hooks were added: