Are you feeling lucky? The NixOS community certainly is after, to the best of our knowledge, avoiding a critical backdoor in xz/liblzma (CVE-2024-3094). The security team will still be downgrading the xz package to 5.4.6 to be safe, but this process will result in a mass rebuild of hundreds of thousands of packages meaning that it will take a little more than a week to complete. Note that users can switch the version of the package early if they are willing to perform the builds on their systems. It is not clear whether other vulnerabilities exist in xz or other projects that the attacker has contributed to. A helpful writeup of the events leading up to this point was posted by Evan Boehs and an official page from the original xz author is available here.

With May quickly approaching, a call for a release manager and editor of the 24.05 NixOS release has been made. @figsoda goes into detail about the release process and requirements for these roles. If you are interested in this position, you can get in touch via the announcement’s comments or on Matrix.

The end of this week also saw the creation and move to final comment period of a new, exciting RFC: RFC 0173 FCP; NixOS hotline. The community is urged to read it quickly before it is merged in. What an exciting time to be a NixPkgs contributor!

@cdmistman announced the release of rippkgs, a tool capable of searching NixPkgs in under 30 milliseconds! For more information on how the tool works and what makes it different from other existing programs like nix-index, check out the Replit blog post.

@Mic92 has posted a call for testers for nix-ld-rs, a rewrite of the original nix-ld. If you are currently using nix-ld and/or would like to help make sure the new version is working well, please consider testing out the project and reporting any regressions from the original nix-ld on GitHub.

@reckenrode has started a new thread to share updates on Darwin in NixPkgs, separate from the previous thread cataloguing sponsored work.

@fricklerhandwerk posted a full roadmap for the Nix documentation ecosystem. Documentation has been a pain point for many Nix newcomers as well as veterans and seeing the issues being addressed in a clear outline is great. Thank you to @danielsidhion and everyone else contributing to the improvement of learning and reference materials for Nix.

Last week an important update to the way venv creation in Python environments works was made by @cwp to correct the previous, subtly broken, implementation. This was not mentioned in the previous nixpkgs.news article, but is worth knowing about for anyone using Python with Nix.

New packages added this week:

New modules added this week:

Security fixes this week: