v3.23.2

Release 3.23.2 (2026-10-13)

• Based on upstream Nix 2.35.3.

Fix GHSA-25vp-6h23-hj3g, GHSA-92x5-h528-wrmw, GHSA-jwvx-xq5j-gc56, GHSA-m4vq-qf6v-82pj

This release contains critical fixes for security vulnerabilities on Linux and macOS that allows for out-of-bounds heap writes (Linux and macOS), local privilege escalation (Linux and macOS), and Seatbelt sandbox escape (macOS).
These vulnerabilities affect all versions of Determinate Nix prior to 3.23.2, and all versions of upstream Nix prior to 2.35.3, 2.34.9, 2.31.6, 2.30.6, and 2.28.8.
For more details, see the upstream advisories:

• GHSA-25vp-6h23-hj3g
• GHSA-92x5-h528-wrmw
• GHSA-jwvx-xq5j-gc56
• GHSA-m4vq-qf6v-82pj

Many thanks to Guthrie McAfee Armstrong, joaoviictorti, faukah, Moritz Theile, and any others for reporting these issues, and thanks to RaitoBezarius, Lisanna Dettwyler, xokdvium, and any others for implementing, verifying, and backporting the fixes.

Bug fixes

• bash completion: Handle redirections DeterminateSystems/nix-src#675

Crash fixes

• Fix crash in the GC roots server on fd reuse DeterminateSystems/nix-src#672
• Record the Nix call depth in Sentry crash reports DeterminateSystems/nix-src#676
• SimpleUserLock: Throw an error if the build users group has GID 0 DeterminateSystems/nix-src#679
• ExprSelect::eval(): Don't evaluate the attribute path inside a catch handler DeterminateSystems/nix-src#680
• fromJSON: Fix GC losing values allocated during a parse DeterminateSystems/nix-src#683
• Update bdwgc: don't abort on GC log write errors on the default stderr DeterminateSystems/nix-src#682
• enqueueFileTransfer(): Don't throw from a noexcept function DeterminateSystems/nix-src#681
• nix repl: Make the values of loaded installables visible to the GC DeterminateSystems/nix-src#685
• nix store info --json: Don't print the result from a Finally DeterminateSystems/nix-src#687

Full Changelog: v3.23.1...v3.23.2