Release 3.24.1 (2026-10-25)
- Based on upstream Nix 2.35.3.
Security fix for brotli (Broccoli2Shell)
Determinate Nix now uses brotli 1.2.1, which fixes CVE-2026-111497 (“Broccoli2Shell”). This is an out-of-bounds write in the brotli decoder that can be triggered by malicious compressed data. It can crash the process and may allow remote code execution. Nix decompresses brotli data from untrusted sources, such as binary cache files that use brotli compression and HTTP responses with Content-Encoding: br, so we recommend that all users upgrade.
Garbage collection performance regression fix
Since Determinate Nix 3.23.0, large evaluations could spend most of their time in garbage collection: once the heap grew beyond 4 GiB, a full collection was triggered after every 16 MiB of allocation. In one of our CI jobs, this made evaluation go from about 2 minutes to about 40 minutes. The garbage collector once again allows the heap to grow several times between collections, as it did before 3.23.0.
In our flake regression tests (249 flakes, single-threaded evaluation), the total CPU time dropped from 7014 to 806 seconds. The effect is concentrated in flakes that need a large heap, at the cost of a somewhat higher peak memory usage:
| Flake | Elapsed time | CPU time | Peak memory |
|---|---|---|---|
Mic92/sops-nix/8b89f44 | 283s → 52s | 3097s → 66s | 9.8 GiB → 11.0 GiB |
NixOS/nix/2.21.2 | 292s → 94s | 2582s → 119s | 9.5 GiB → 10.7 GiB |
zhaofengli/attic/0.1.165 | 37s → 33s | 90s → 35s | 4.7 GiB → 5.4 GiB |
PR: DeterminateSystems/nix-src#725
Bug fixes
- Fix a deadlock in
builtins.wasmwhen using parallel evaluation by @edolstra in DeterminateSystems/nix-src#731 - Fix an assertion failure when using path literals like
~/.., which are now canonicalized like other path literals, by @edolstra in DeterminateSystems/nix-src#727, cherry-picked from NixOS/nix#16651 by @Filippo-Galli nix psno longer shows a daemon process that is about to start a builder as part of the build by @edolstra in DeterminateSystems/nix-src#729
Miscellaneous changes
- CI: Bump actions/checkout and actions-netlify to Node.js 24 versions by @edolstra in DeterminateSystems/nix-src#726
- CI: Aggregate resource usage statistics of the flake-regressions tests by @edolstra in DeterminateSystems/nix-src#728
Full Changelog: v3.24.0…v3.24.1