Release 2.34.0 (2026-02-27)
Highlights
-
Rust nix-installer in beta
The Rust-based rewrite of the Nix installer is now in beta. We'd love help testing it out!
To test out the new installer, run:
curl -sSfL https://artifacts.nixos.org/nix-installer | sh -s -- installThis installer can be run even when you have an existing, script-based Nix installation without any adjustments.
This new installer also comes with the ability to uninstall your Nix installation; run:
/nix/nix-installer uninstallThis will get rid of your entire Nix installation (even if you installed over an existing, script-based installation).
This installer is a modified version of the Determinate Nix Installer by Determinate Systems. Thanks to Determinate Systems for all the investment they've put into the installer.
Source for the installer is in https://github.com/NixOS/nix-installer. Report any issues in that repo.
For CI usage, a GitHub Action to install Nix using this installer is available at https://github.com/NixOS/nix-installer-action.
-
Stabilisation of
no-url-literalsexperimental feature and new diagnostics infrastructure, withlint-url-literals,lint-short-path-literals, andlint-absolute-path-literalssettings #8738 #10048 #10281 #15326Experimental feature
no-url-literalshas been stabilised and is now controlled by thelint-url-literalsoption. New diagnostics infrastructure has been added for linting discouraged language features.New lint infrastructure
lint-url-literalsThe
no-url-literalsexperimental feature has been stabilised and replaced with a newlint-url-literalssetting.To migrate from the experimental feature, replace:
experimental-features = no-url-literalswith:
lint-url-literals = fatallint-short-path-literalsThe
warn-short-path-literalsboolean setting has been deprecated and replaced withlint-short-path-literals.To migrate, replace:
warn-short-path-literals = truewith:
lint-short-path-literals = warnlint-absolute-path-literalsA new
lint-absolute-path-literalssetting has been added to control handling of absolute path literals (paths starting with/) and home path literals (paths starting with~/).Setting values
All three settings accept three values:
ignore: Allow the feature without emitting any diagnostic (default)warn: Emit a warning when the feature is usedfatal: Treat the feature as a parse error
The defaults may change in future versions.
-
Improved parser error messages #15092
Parser error messages now use legible strings for tokens instead of internal names. For example, malformed expression
a ++ ++ bnow produces the following error:error: syntax error, unexpected '++' at «string»:1:6: 1| a ++ ++ b | ^Instead of:
error: syntax error, unexpected CONCAT at «string»:1:6: 1| a ++ ++ b | ^
New features
-
nix replnow supportsinheritand multiple bindings #15082The
nix replnow supportsinheritstatements and multiple bindings per line:nix-repl> a = { x = 1; y = 2; } nix-repl> inherit (a) x y nix-repl> x + y 3 nix-repl> p = 1; q = 2; nix-repl> p + q 3 nix-repl> foo.bar.baz = 1; nix-repl> foo.bar { baz = 1; } -
New command
nix store roots-daemonfor serving GC roots #15143New command
nix store roots-daemonruns a daemon that serves garbage collector roots over a Unix domain socket. It enables the garbage collector to discover runtime roots when the main Nix daemon doesn't haveCAP_SYS_PTRACEcapability and therefore cannot scan/proc.The garbage collector can be configured to use this daemon via the
use-roots-daemonstore setting.This feature requires the
local-overlay-storeexperimental feature. -
New command
nix-nswrapperinlibexec#15183The new command
libexec/nix-nswrapperis used to run the Nix daemon in an unprivileged user namespace on Linux. In order to use this command, build user UIDs and GIDs must be allocated in/etc/subuidand/etc/subgid.It can be used to run the Nix daemon with full sandboxing without executing as root. Support has been added to Nixpkgs with the new
nix.daemonUserandnix.daemonGroupsettings. -
New setting
ignore-gc-delete-failurefor local stores #15054A new local store setting
ignore-gc-delete-failurehas been added. When enabled, garbage collection will log warnings instead of failing when it cannot delete store paths. This is useful when running Nix as an unprivileged user that may not have write access to all paths in the store.This setting is experimental and requires the
local-overlay-storeexperimental feature. -
New setting
narinfo-cache-meta-ttl#15287The new setting
narinfo-cache-meta-ttlcontrols how long binary cache metadata (i.e./nix-cache-info) is cached locally, in seconds. This was previously hard-coded to 7 days, which is still the default. As a result, you can now usenix store info --refreshto check whether a binary cache is still valid. -
Support HTTPS binary caches using mTLS (client certificate) authentication #13002 #13030
Added support for
tls-certificateandtls-private-keyoptions in substituter URLs.Example:
https://substituter.invalid?tls-certificate=/path/to/cert.pem&tls-private-key=/path/to/key.pemWhen these options are configured, Nix will use this certificate/private key pair to authenticate to the server.
Performance improvements
-
Unpacking tarballs to
~/.cache/nix/tarball-cache-v2is now multithreaded #12087Content-addressed cache for
builtins.fetchTarballand tarball-based flake inputs (e.g.github:NixOS/nixpkgs,https://channels.nixos.org/nixos-25.11/nixexprs.tar.xz) now writes git blobs (files) to thetarball-cache-v2repository concurrently, which significantly reduces the wall time for tarball unpacking (up to ~1.8x faster unpacking forhttps://channels.nixos.org/nixos-25.11/nixexprs.tar.xzin our testing).Currently, Nix doesn't perform any maintenance on the
~/.cache/nix/tarball-cache-v2repository, which will be addressed in future versions. Users that wish to reclaim disk space used by the tarball cache may want to run:rm -rf ~/.cache/nix/tarball-cache # Historical tarball-cache, not used by Nix >= 2.33 cd ~/.cache/nix/tarball-cache-v2 && git multi-pack-index write && git multi-pack-index repack && git multi-pack-index expire -
nix nar lsand other NAR listing operations have been optimised further #15163
C API Changes
-
New store API methods #14766
The C API now includes additional methods:
nix_store_query_path_from_hash_part()- Get the full store path given its hash partnix_store_copy_path()- Copy a single store path between two stores, allows repairs and configuring signature checking
-
Errors returned from your primops are not treated as recoverable by default #13930 #15286
Nix 2.34 by default remembers the error in the thunk that triggered it.
Previously the following sequence of events worked:
- Have a thunk that invokes a primop that's defined through the C API
- The primop returns an error
- Force the thunk again
- The primop returns a value
- The thunk evaluated successfully
Resolution
C API consumers that rely on this must change their recoverable error calls:
-nix_set_err_msg(context, NIX_ERR_*, msg); +nix_set_err_msg(context, NIX_ERR_RECOVERABLE, msg);
Bug fixes
-
Avoid dropping ssh connections with
ssh-ng://stores for store path copying #14998 #6950Due to a bug in how Nix handled Boost.Coroutine2 suspension and resumption, copying from
ssh-ng://stores would drop the SSH connection for each copied path. This issue has been fixed, which improves performance by avoiding multiple SSH/Nix Worker Protocol handshakes. -
S3 binary caches now use virtual-hosted-style addressing by default #15208
S3 binary caches now use virtual-hosted-style URLs (
https://bucket.s3.region.amazonaws.com/key) instead of path-style URLs (https://s3.region.amazonaws.com/bucket/key) when connecting to standard AWS S3 endpoints. This enables HTTP/2 multiplexing and fixes TCP connection exhaustion (TIME_WAIT socket accumulation) under high-concurrency workloads.A new
addressing-stylestore option controls this behavior:auto(default): virtual-hosted-style for standard AWS endpoints, path-style for custom endpoints.path: forces path-style addressing (deprecated by AWS).virtual: forces virtual-hosted-style addressing (bucket names must not contain dots).
Bucket names containing dots (e.g.,
my.bucket.name) automatically fall back to path-style addressing inautomode, because dotted names create multi-level subdomains that break TLS wildcard certificate validation.Example using path-style for backwards compatibility:
s3://my-bucket/key?region=us-east-1&addressing-style=pathAdditionally, TCP keep-alive is now enabled on all HTTP connections, preventing idle connections from being silently dropped by intermediate network devices (NATs, firewalls, load balancers).
-
nix-prefetch-url --unpacknow properly checks for empty archives #15242Prior versions failed to check for empty archives and would crash with a
nullptrdereference when unpacking empty archives. This is now fixed. -
Prevent runaway processes when Nix is killed with
SIGKILLwhen building in a local store with build users #15193When run as root, Nix doesn't run builds via the daemon and is a parent of the forked build processes. Prior versions of Nix failed to preserve the
PR_SET_PDEATHSIGparent-death signal acrosssetuidcalls. This could lead to build processes being reparented and continue running in the background. This has been fixed.
Miscellaneous changes
-
Content-Encoding decompression is now handled by libcurl #14324 #15336
Transparent decompression of HTTP downloads specifying
Content-Encodingheader now uses libcurl. This adds support for previously advertised, but not supporteddeflateencoding as well as deprecatedx-gzipalias. Non-standardxz,bzip2encodings that were previously advertised are no longer supported, as they do not commonly appear in the wild and should not be sent by compliant servers.br,zstd,gzipcontinue to be supported. Distro packaging should ensure that thelibcurldependency is linked against required libraries to support these encodings. By default, the build system now requires libcurl >= 8.17.0, which is not known to have issues around pausing and decompression. -
Static builds now support S3 features (
libstore:s3-aws-authmeson option) #15076
Contributors
This release was made possible by the following 43 contributors:
- Taeer Bar-Yam (@Radvendii)
- Sergei Zimmerman (@xokdvium)
- Jörg Thalheim (@Mic92)
- Graham Dennis (@GrahamDennis)
- Damien Diederen (@ztzg)
- koberbe-jh (@koberbe-jh)
- Robert Hensing (@roberth)
- Bouke van der Bijl (@bouk)
- Lisanna Dettwyler (@lisanna-dettwyler)
- kiara (@KiaraGrouwstra)
- Side Effect (@YawKar)
- dram (@dramforever)
- tomf (@tomfitzhenry)
- Kamil Monicz (@Zaczero)
- Cosima Neidahl (@OPNA2608)
- Siddhant Kumar (@siddhantk232)
- Jens Petersen (@juhp)
- Johannes Kirschbauer (@hsjobeki)
- tomberek (@tomberek)
- Eelco Dolstra (@edolstra)
- Artemis Tosini (@artemist)
- David McFarland (@corngood)
- Tucker Shea (@NoRePercussions)
- Connor Baker (@ConnorBaker)
- Cole Helbling (@cole-h)
- Eveeifyeve (@Eveeifyeve)
- John Ericson (@Ericson2314)
- Graham Christensen (@grahamc)
- Ilja (@iljah)
- Pol Dellaiera (@drupol)
- steelman (@steelman)
- Brian McKenna (@puffnfresh)
- JustAGuyTryingHisBest (@JustAGuyTryingHisBest)
- zowoq (@zowoq)
- Agustín Covarrubias (@agucova)
- Sergei Trofimovich (@trofi)
- Bernardo Meurer (@lovesegfault)
- Peter Bynum (@pkpbynum)
- Amaan Qureshi (@amaanq)
- Michael Hoang (@Enzime)
- Michael Daniels (@mdaniels5757)
- Matthew Kenigsberg (@mkenigs)
- Shea Levy (@shlevy)