v3.21.5

Release 3.21.5 (2026-07-08)

• Based on upstream Nix 2.34.8.

Binary cache performance improvements

This release includes a number of async rewrites from upstream Nix that make querying missing paths much faster. PR: DeterminateSystems/nix-src#514

Remote store performance improvements

Registering temporary roots on remote stores (e.g. when doing nix copy to a remote store over ssh-ng) is now much faster. PR: DeterminateSystems/nix-src#538

Computing closures (e.g. nix-store -qR) is now much faster on high-latency ssh-ng stores. PR: DeterminateSystems/nix-src#539

Parallel evaluation performance improvements

This release delivers a number of performance improvements to parallel evaluation.

PRs: DeterminateSystems/nix-src#531, DeterminateSystems/nix-src#535, DeterminateSystems/nix-src#536, DeterminateSystems/nix-src#537, DeterminateSystems/nix-src#546

Miscellaneous improvements

• nix search now prints the total number of derivations, in addition to the number of matching derivations. PR: DeterminateSystems/nix-src#532

Bug fixes and other changes

• Allow local networking in libmicrohttpd and functional tests by @lilyinstarlight in DeterminateSystems/nix-src#518
• Don't ignore substitution failures for BasicDerivation inputSrcs by @edolstra in DeterminateSystems/nix-src#520
• Sync with upstream 2.34-maintenance by @edolstra in DeterminateSystems/nix-src#521
• fixup: make binary cache nuclear option more general by @cole-h in DeterminateSystems/nix-src#524
• NarInfoDiskCache: Support arbitrary nix-cache-info fields by @edolstra in DeterminateSystems/nix-src#525
• ci: update DSP on releases by @cole-h in DeterminateSystems/nix-src#526
• Add some calls to addTempRoot() by @edolstra in DeterminateSystems/nix-src#527
• flake.lock: Update by @edolstra in DeterminateSystems/nix-src#529

New Contributors

• @lilyinstarlight made their first contribution in DeterminateSystems/nix-src#518

Full Changelog: v3.21.2...v3.21.5

v3.21.4

What's Changed

• Allow local networking in libmicrohttpd and functional tests by @lilyinstarlight in #518
• Make queryMissing(), computeClosure() etc async by @edolstra in #514
• Don't ignore substitution failures for BasicDerivation inputSrcs by @edolstra in #520
• Sync with upstream 2.34-maintenance by @edolstra in #521
• fixup: make binary cache nuclear option more general by @cole-h in #524
• NarInfoDiskCache: Support arbitrary nix-cache-info fields by @edolstra in #525
• ci: update DSP on releases by @cole-h in #526
• Add some calls to addTempRoot() by @edolstra in #527
• flake.lock: Update by @edolstra in #529
• Fix INITIAL_MARK_STACK_SIZE override in boehm-gc by @edolstra in #531
• nix search: Print total number of derivations by @edolstra in #532
• Make zipAttrsWith more parallel-eval friendly by @edolstra in #535
• builtins.groupBy: Drop ValueVectorMap by @edolstra in #536
• ExprAttrs::eval: Don't write to the shared empty Bindings by @edolstra in #537
• Fix very slow remote temp root registration in copyPaths() by @edolstra in #538
• Make computeFSClosure() much faster over SSH by @edolstra in #539
• Sync with upstream 2.34.8 by @edolstra in #541
• computeFSClosure(): Recurse rather than loop by @edolstra in #542
• Release v3.21.3 by @github-actions[bot] in #540
• fixup: publish step by @cole-h in #543
• Release v3.21.4 by @github-actions[bot] in #545

New Contributors

• @lilyinstarlight made their first contribution in #518

Full Changelog: v3.21.2...v3.21.4

v3.21.3

What's Changed

• Allow local networking in libmicrohttpd and functional tests by @lilyinstarlight in #518
• Make queryMissing(), computeClosure() etc async by @edolstra in #514
• Don't ignore substitution failures for BasicDerivation inputSrcs by @edolstra in #520
• Sync with upstream 2.34-maintenance by @edolstra in #521
• fixup: make binary cache nuclear option more general by @cole-h in #524
• NarInfoDiskCache: Support arbitrary nix-cache-info fields by @edolstra in #525
• ci: update DSP on releases by @cole-h in #526
• Add some calls to addTempRoot() by @edolstra in #527
• flake.lock: Update by @edolstra in #529
• Fix INITIAL_MARK_STACK_SIZE override in boehm-gc by @edolstra in #531
• nix search: Print total number of derivations by @edolstra in #532
• Make zipAttrsWith more parallel-eval friendly by @edolstra in #535
• builtins.groupBy: Drop ValueVectorMap by @edolstra in #536
• ExprAttrs::eval: Don't write to the shared empty Bindings by @edolstra in #537
• Fix very slow remote temp root registration in copyPaths() by @edolstra in #538
• Make computeFSClosure() much faster over SSH by @edolstra in #539
• Sync with upstream 2.34.8 by @edolstra in #541
• computeFSClosure(): Recurse rather than loop by @edolstra in #542
• Release v3.21.3 by @github-actions[bot] in #540

New Contributors

• @lilyinstarlight made their first contribution in #518

Full Changelog: v3.21.2...v3.21.3

v3.21.2

What's Changed

• Add missing manpages by @edolstra in #490
• SQLiteStmt::Use: Rename operator() -> apply() by @edolstra in #491
• Make optimiseStore() multi-threaded by @edolstra in #492
• Binary cache info by @edolstra in #493
• Fix running hydraJobs in CI by @edolstra in #494
• ci: include output paths in FlakeHub upload by @cole-h in #495
• fixup: don't include linux-only drvs if not on linux by @cole-h in #496
• Improve error message when user isn't allowed access to the daemon by @edolstra in #498
• Daemon: Ignore interrupts between accept() and child start by @edolstra in #502
• Build all the archs without DSP by @grahamc in #503
• Mirror to nix-artifacts on release of tags by @grahamc in #501
• nario tweaks by @edolstra in #499
• Fix crash in builtins.break by @edolstra in #505
• Fix SSH connection sharing by @edolstra in #506
• Move the srcToStore cache into fetchToStore() by @edolstra in #507
• Replace select() by poll() by @edolstra in #504
• LocalStore::doAddToStore(): Check NAR size before NAR hash by @edolstra in #512
• Increase the sourceToSink/sinkToSource coroutine stack sizes by @edolstra in #511
• Fix LocalStore::addMultipleToStore SinkToSource destructor unsoundness by @cole-h in #513
• ci: fixup mirroring by @cole-h in #515
• Fix exceptions not being caught in nix::Pid::~Pid by @cole-h in #516
• Release v3.21.2 by @github-actions[bot] in #517

Full Changelog: v3.21.1...v3.21.2

v3.21.1

Release 3.21.1 (2026-06-08)

• Based on upstream Nix 2.34.7.

Faster nix copy

Previously, nix copy processed store paths in topological order, meaning that if store path A depends on B, then Nix wouldn't even start the fetch of store path A from the source store, or the writing of store path A to the destination store, until store path B had been added to the destination store.

Now, Nix can start fetching and writing store paths before their dependencies have been added to the destination store. This can provide significant speedups. For instance, the command

# nix copy \
    --from file:///tmp/binary-cache \
    --to file:///tmp/binary-cache-2?compression=xz \
    --no-check-sigs \
    /nix/store/8xyk1qxxjfb8cm62g61yc59phwha92w7-kdenlive-25.08.3

went from 117.7s to 47.2s on a machine with 24 cores.

This optimisation affects copying to binary caches and local stores, but not when going through the Nix daemon. It also does not speed up substitution yet.

PRs: DeterminateSystems/nix-src#477, DeterminateSystems/nix-src#478, DeterminateSystems/nix-src#481, DeterminateSystems/nix-src#480

Determinate Secure Packages

Determinate Nix is now built against Determinate Secure Packages, a distribution of Nixpkgs that adds enterprise-grade security, compliance controls, and managed vulnerability remediation.

Determinate Nix's top-level flake still builds against upstream Nixpkgs. The flake github:DeterminateSystems/nix-src?dir=packaging/secure-packages uses Determinate Secure Packages.

PR: DeterminateSystems/nix-src#288

Flake schema changes

Flakes can now distinguish between schemas for their own outputs (via the schemas output), and schemas that they make available to other flakes (via the exportedSchemas output). If you're using the flake-schemas flake, you should use its exportedSchemas output, e.g.

{
  inputs.flake-schemas.url = "https://flakehub.com/f/DeterminateSystems/flake-schemas/0.5";

  outputs = { self, flake-schemas, ... }: {
    schemas = flake-schemas.exportedSchemas // { ... my own schemas ... }
  };
}

PRs: DeterminateSystems/nix-src#479, DeterminateSystems/nix-src#486,
DeterminateSystems/flake-schemas#63

Various bug fixes

• Stop leaked logger in Finally block by @cole-h in DeterminateSystems/nix-src#472
• Denote empty files in stack traces by @edolstra in DeterminateSystems/nix-src#473
• Input::isRelative(): Fix assertion failure by @edolstra in DeterminateSystems/nix-src#474
• Mark thread-local variables as initial-exec by @edolstra in DeterminateSystems/nix-src#476
• Register temp roots in a few places by @edolstra in DeterminateSystems/nix-src#482
• Sync with upstream 2.34.7 by @edolstra in DeterminateSystems/nix-src#483
• Add a test for nix ps by @edolstra in DeterminateSystems/nix-src#484
• nix develop: Restore hiding the "dirty" notice by @edolstra in DeterminateSystems/nix-src#485

Full Changelog: v3.21.0...v3.21.1

v3.21.0

Release 3.21.0 (2026-05-22)

• Based on upstream Nix 2.34.6.

CNSA 1.0 and 2.0 signing algorithm support

Determinate Nix now supports a subset of CNSA 1.0 and 2.0 signature algorithms: ecdsa-p384, ml-dsa-44, ml-dsa-65, and ml-dsa-87. ML-DSA is a post-quantum cryptography signature scheme.
Support for these algorithms is gated behind the experimental feature cnsa.

To use these signatures, enable the cnsa experimental feature and call nix key generate-secret with --key-type ecdsa-p384|ml-dsa-{44,65,87}.
Otherwise, everything works the same as the existing ed25519 (libsodium) signatures, except that they produce larger keys/signatures (especially ML-DSA).

We've also added commands nix key convert-{public,secret}-to-pem, which may be useful if you want to use the keys with the openssl CLI.

PR: DeterminateSystems/nix-src#449

nix serve command

The new nix serve command provides a built-in binary cache server, similar to nix-serve.
It's mostly intended for testing and to serve as a reference implementation of binary caches.

PR: DeterminateSystems/nix-src#428

Lazy fetchTarball

fetchTarball is now lazy, which can prevent unnecessary copying of source trees into the Nix store.

PRs:

• DeterminateSystems/nix-src#468
• DeterminateSystems/nix-src#469

Various bug fixes

• Restore resBuildResult fields for failed builds DeterminateSystems/nix-src#453
• parseString(): Fix out-of-bounds read DeterminateSystems/nix-src#454
• filetransfer: handle exceptions thrown from enqueueItem DeterminateSystems/nix-src#348
• libfetchers: verify git-lfs returns the same objects as git DeterminateSystems/nix-src#456
• HttpBinaryCacheStore: Don't ignore 401/407 errors DeterminateSystems/nix-src#461
• Remove non-atomically initialised variable vImportedDrvToDerivation DeterminateSystems/nix-src#464
• Re-enable TCP keep-alive and handle S3's XML errors DeterminateSystems/nix-src#463
• Fix logging segfault by leaking logger DeterminateSystems/nix-src#470

Full Changelog: v3.20.0...v3.21.0

v3.20.0

Release 3.20.0 (2026-05-07)

• Based on upstream Nix 2.34.6.

Support resuming from binary caches that don't support ranged requests

Previously, Nix would just fail a download if something happened in the TCP or TLS layer, meaning a flaky proxy could fail to download a store path and fall back to building, when a retry might have not been flaky.

Now, Determinate Nix will retry these failed substitutions, so you don't have to waste time building something that was cached but some proxy decided to cut you off early.

PR: DeterminateSystems/nix-src#445

Add a session ID to JSON log messages

Determinate Nix now includes a freeform string session ID (sid) in its JSON log messages, which allows a anything that consumes these log messages to see which messages belong to the same session.

By default, every Nix command invocation is its own session, but you can use the session-id setting to give a group of invocations the same session (otherwise, a random UUIDv7 like 019e037b-f603-7443-8071-cfd8585ec8c6 is set as the session ID).

PR: DeterminateSystems/nix-src#440

Full Changelog: v3.19.1...v3.20.0

v3.19.1

Release 3.19.1 (2026-05-04)

• Based on upstream Nix 2.34.6.

What's Changed

Fix for GHSA-vh5x-56v6-4368: Coroutine stack-to-heap overflow via unbounded recursion in NAR directory parser

Unbounded recursion in the NAR (Nix Archive) parser could lead to a stack-to-heap overflow when the parser is run on a coroutine stack. The stack was allocated without a guard page, which meant that a stack overflow could overwrite memory on the heap and could allow for arbitrary code execution as the Nix daemon (run as root in multi-user installations) if ASLR hardening is bypassed. This vulnerability can be exploited by all users able to connect to the Nix daemon (configurable via allowed-users setting - all users by default).

The vulnerability is present since 2.24.4.

For more details, see the upstream advisory GHSA-vh5x-56v6-4368.

Many thanks to edef for reporting this issue and to Sergei Zimmerman and edef for implementing the fix and several hardening improvements.

Fix for GHSA-gr92-w2r5-qw5p: Absolute path traversal when unpacking archives to disk

When an archive (e.g. a tarball) contains entries with absolute paths, nix-prefetch-url --unpack, nix store prefetch-file --unpack commands would write to a location outside the extraction root. This also affects builtin:unpack-channel builtin derivation builder, but it's sandboxed the same way as regular derivations builds, so in sandboxed builds it can't be used to achieve an arbitrary file write on the host filesystem.

Other archive unpacking (builtins.fetchTarball, builtins.fetchTree and tarball-based flake inputs) is not affected, since Nix stores the unpacked tarball in a bare git repository (.cache/nix/tarball-cache or .cache/nix/tarball-cache-v2).

This primarily affects packagers running nix-prefetch-url --unpack on untrusted archives.

The vulnerability is present since 2.24.7.

For more details, see the upstream advisory GHSA-gr92-w2r5-qw5p.

Many thanks to edef for reporting this issue and to Sergei Zimmerman for implementing the fix.

Bug fixes

• A fix for random crashes on exit in the curlFileTransfer destructor. DeterminateSystems/nix-src#444

Full Changelog: v3.19.0...v3.19.1

v3.19.0

Release 3.19.0 (2026-04-28)

• Based on upstream Nix 2.34.6.

What's Changed

Provenance is preserved when copying paths to the daemon

Previously, nix copy would not forward provenance information to the recipient.

This has been fixed, such that building a derivation on machine A and nix copying it to machine B will show the same provenance.

PR: DeterminateSystems/nix-src#399

Full Changelog: v3.18.1...v3.19.0

v3.18.1

Release 3.18.1 (2026-04-23)

• Based on upstream Nix 2.33.4.

What's Changed

Sentry integration improvements

This release includes fixes for a couple of issues with the Sentry integration:

• Ensures the chroot helper starts before the Sentry thread, allowing chroot stores to work again
• Resets Mach exception ports on macOS, so that exec'd programs do not communicate with Determinate Nix's crashpad_handler

Additionally, Determinate Nix now includes the Nix command and subcommand to Sentry reports to make it easier to discern where an issue happened.
Not that this does not include any command-line arguments other than the command (such as nix-daemon and nix) and subcommand (such as flake show).

PRs:

• DeterminateSystems/nix-src#433
• DeterminateSystems/nix-src#432
• DeterminateSystems/nix-src#436

Full Changelog: v3.18.0...v3.18.1