Release 3.24.0 (2026-10-22)

• Based on upstream Nix 2.35.3.

Security fix: removal of the emSign ECC Root CA - G3 certificate

The CA certificate bundle shipped in the Determinate Nix installer tarball and Docker image has been updated to NSS 3.131.1. This version no longer trusts the emSign ECC Root CA - G3 root certificate, following the compromise of an eMudhra intermediate CA key. Previously, installations that use this bundle trusted TLS certificates issued under this root, e.g. when connecting to binary caches or fetching flake inputs. This change was backported from upstream Nix.

PR: DeterminateSystems/nix-src#724 by @grahamc, cherry-picked from NixOS/nix#16661 by @xokdvium

Parallel instantiation of derivation dependencies

When multi-threaded evaluation is enabled (i.e. when eval-cores is not 1), instantiating a derivation now evaluates and instantiates its dependencies in parallel in the background. This speeds up any evaluation that instantiates derivations, not just the commands that already used multiple threads. For example, nix eval nixpkgs#firefox went from 1.51s to 0.77s, and evaluating Nix’s own development shell went from 2.65s to 1.25s. When the evaluator threads are already busy (e.g. in nix flake show on a large flake), Nix skips this background work to avoid overhead.

PR: DeterminateSystems/nix-src#572

nix top

The new command nix top shows a continuously updating, top-like full-screen view of the active builds and their processes, including the CPU and memory usage of each build and process. It supports scrolling, collapsing process trees, sorting builds by CPU usage, memory usage, wall time or name, and changing the refresh interval.

In addition, nix ps now shows the memory usage (resident set size) of each build and process in a new RSS column, and in new rss fields in its JSON output. On Linux, the memory usage of a build is taken from its cgroup if use-cgroups is enabled.

PRs: DeterminateSystems/nix-src#710, DeterminateSystems/nix-src#715

Faster garbage collection and path registration

Nix now keeps SQLite’s temporary data for the Nix store database in memory rather than in temporary files. Deleting or registering store paths with many references caused SQLite to write large amounts of data to temporary files, e.g. more than 30 GiB when garbage-collecting a store with 192k paths. On such a store, this speeds up garbage collection by 17%, nix-store --register-validity by 32%, and copying 50k paths into the store with nix copy by 20%.

PR: DeterminateSystems/nix-src#717 by @czawistowski-nvidia

Performance improvements

• Fix C API clients (such as FlakeBOM) becoming quadratically slower in the number of store paths written during evaluation by @edolstra in DeterminateSystems/nix-src#716
• Avoid some memory allocations in internal caches by @edolstra in DeterminateSystems/nix-src#711

Miscellaneous changes

• Update sentry-native from 0.13.5 to 0.17.4. Crash reports now include a random per-installation ID (stored in ~/.cache/nix/sentry/installation_id) so that reports from the same installation can be correlated by @edolstra in DeterminateSystems/nix-src#705
• Document the provenance JSON format used by nix path-info --json by @edolstra in DeterminateSystems/nix-src#712
• Disable the wasmtime test suite, which fails when building with -march by @n0099 in DeterminateSystems/nix-src#703
• Fix a random failure in the exact-rev-fetch-bucketed-refs test by @edolstra in DeterminateSystems/nix-src#722

Bug fixes

• Fix nix build and nix flake check aborting when connected to an upstream Nix daemon of version 2.34 or later (e.g. on NixOS 26.05) when a build fails by @edolstra in DeterminateSystems/nix-src#704
• Fix evaluation failing with path '…' is not valid when the garbage collector runs concurrently and deletes a path used by builtins.storePath, builtins.fetchurl or builtins.fetchTarball by @czawistowski-nvidia in DeterminateSystems/nix-src#714
• Messages from the build hook that aren’t JSON log messages no longer corrupt the progress bar, and are now forwarded from the daemon to the client by @edolstra in DeterminateSystems/nix-src#697
• nix profile wipe-history --older-than, nix-env --delete-generations and nix-collect-garbage --delete-older-than no longer crash if generation timestamps don’t increase with the generation number, but skip such generations with a warning by @edolstra in DeterminateSystems/nix-src#700
• Fix nix copy to a binary cache aborting with map::at when a path’s validity changes during the copy by @edolstra in DeterminateSystems/nix-src#708
• Fix nix copy --to file://... crashing instead of printing an error when writing the compressed NAR fails (e.g. because $TMPDIR is full) by @edolstra in DeterminateSystems/nix-src#720
• nix ps no longer shows build processes as owned by root by @edolstra in DeterminateSystems/nix-src#709
• nix ps no longer drops the remaining processes of a build when one of them exits while it’s running by @edolstra in DeterminateSystems/nix-src#713
• nix store --help and nix config --help no longer show some subcommands under an empty heading by @edolstra in DeterminateSystems/nix-src#719

New Contributors

• @n0099 made their first contribution in DeterminateSystems/nix-src#703
• @czawistowski-nvidia made their first contribution in DeterminateSystems/nix-src#717

Full Changelog: v3.23.3…v3.24.0