--- title: Changelog: an important security fix, nix top , faster... description: Determinate Nix 3.24.1 ships a security fix, a new live build monitor, and several performance improvements. It updates Brotli to 1.2.1 to patch the... canonical: https://daily.dev/posts/changelog-an-important-security-fix-nix-top-faster-garbage-collection-parallel-instantiation-a-2kt4na6nw twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Changelog: an important security fix, nix top , faster garbage collection, parallel instantiation, and more | daily.dev og:description: Determinate Nix 3.24.1 ships a security fix, a new live build monitor, and several performance improvements. It updates Brotli to 1.2.1 to patch the... og:url: https://daily.dev/posts/changelog-an-important-security-fix-nix-top-faster-garbage-collection-parallel-instantiation-a-2kt4na6nw og:image: https://api.daily.dev/og/posts/2Kt4na6nw.png og:image:alt: Changelog: an important security fix, nix top , faster garbage collection, parallel instantiation, and more og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Changelog: an important security fix, nix top , faster garbage collection, parallel instantiation, and more **[Determinate Systems](https://daily.dev/sources/determinate-systems)** · 9 min read · 0 upvotes · 0 comments ## Summary Determinate Nix 3.24.1 ships a security fix, a new live build monitor, and several performance improvements. It updates Brotli to 1.2.1 to patch the Broccoli2Shell out-of-bounds write (CVE-2026-111497), and an upgrade is strongly recommended. A new 'nix top' command shows a live, top-like view of active builds, and 'nix ps' now reports memory usage. A garbage collection regression introduced in 3.23.0 is fixed, cutting total CPU time across 249 test flakes from 7,014 to 806 seconds when evaluated on a single thread. Parallel instantiation of derivation dependencies roughly halves the time to evaluate a single package, and garbage collection and path registration are up to 32% faster on large stores. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What does the Broccoli2Shell vulnerability in Nix's Brotli decoder affect? Broccoli2Shell (CVE-2026-111497) is an out-of-bounds write in the Brotli decoder that can be triggered by malicious data, potentially crashing the process or allowing remote code execution. Nix decompresses Brotli data from untrusted sources like binary cache files and HTTP responses with 'Content-Encoding: br', so it affects every Determinate Nix user. Determinate Nix 3.24.1 fixes it by updating Brotli to version 1.2.1. _Developers patching Brotli-related CVEs can track fixes like this one on daily.dev._ ### Why did Nix evaluations suddenly get much slower in garbage collection? A change picked up in Determinate Nix 3.23.0 limited the Boehm-Demers-Weiser garbage collector to only one 16 MiB heap expansion per collection, so once the heap grew past its 4 GiB initial size, every 16 MiB allocated triggered a full collection. One CI job's evaluation time went from about 2 minutes to 40 minutes. Version 3.24.1 restores the previous heuristic, dropping total CPU time across 249 test flakes from 7,014 to 806 seconds. _Engineers debugging GC regressions in build tooling follow fixes like this on daily.dev._ ### How much faster is Nix evaluation with parallel instantiation of derivation dependencies? With parallel evaluation enabled, Determinate Nix instantiates a derivation's dependencies in parallel instead of one at a time, roughly halving single-package evaluation time. Running 'nix eval nixpkgs#firefox' went from 1.51 seconds to 0.77 seconds, and evaluating Nix's own development shell dropped from 2.65 seconds to 1.25 seconds. _Teams optimizing build evaluation speed track performance wins like this on daily.dev._ ## Similar posts on daily.dev - [Changelog: security fixes, OpenTelemetry tracing, baked flakes, fiber-based parallel evaluation, and more](https://daily.dev/posts/changelog-security-fixes-opentelemetry-tracing-baked-flakes-fiber-based-parallel-evaluation-and-zawrucen6) · Determinate Systems · 0 upvotes · 0 comments - [Changelog: Determinate Nix 3.21.7](https://daily.dev/posts/changelog-determinate-nix-3-21-7-spb0ixqhl) · Determinate Systems · 0 upvotes · 0 comments - [Changelog: a new upstream base, GC roots for nix eval, and a faster nix copy](https://daily.dev/posts/changelog-a-new-upstream-base-gc-roots-for-nix-eval-and-a-faster-nix-copy-a9ytihpvx) · Determinate Systems · 0 upvotes · 0 comments - [Announcing Lix 2.96 “Bingsu”](https://daily.dev/posts/announcing-lix-2-96-bingsu--mvsleovth) · Lobsters · 2 upvotes · 0 comments - [NixOS 25.11 released](https://daily.dev/posts/nixos-25-11-released-2moau4idt) · Hacker News · 1 upvotes · 0 comments --- Tags: [#sqlite](https://daily.dev/tags/sqlite) [View this post on daily.dev](https://daily.dev/posts/changelog-an-important-security-fix-nix-top-faster-garbage-collection-parallel-instantiation-a-2kt4na6nw) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Changelog: an important security fix, nix top , faster garbage collection, parallel instantiation, and more","url":"https://daily.dev/posts/changelog-an-important-security-fix-nix-top-faster-garbage-collection-parallel-instantiation-a-2kt4na6nw","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/changelog-an-important-security-fix-nix-top-faster-garbage-collection-parallel-instantiation-a-2kt4na6nw"},"datePublished":"2026-10-28T19:52:32.775Z","dateModified":"2026-10-28T21:34:38.716Z","description":"Determinate Nix 3.24.1 ships a security fix, a new live build monitor, and several performance improvements. It updates Brotli to 1.2.1 to patch the...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/24196a379946898ef3c9deb1727eba11?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/24196a379946898ef3c9deb1727eba11?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Determinate Systems","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Determinate Systems","logo":"https://media.daily.dev/image/upload/s--E2qrkc9w--/c_limit,w_256/f_auto,q_auto/v1785052094/logos/determinate-systems?_a=BAMAMicg0","url":"https://daily.dev/sources/determinate-systems"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/changelog-an-important-security-fix-nix-top-faster-garbage-collection-parallel-instantiation-a-2kt4na6nw","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"sqlite","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Determinate Systems","item":"https://daily.dev/sources/determinate-systems"},{"@type":"ListItem","position":3,"name":"Changelog: an important security fix, nix top , faster garbage collection, parallel instantiation, and more"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/changelog-an-important-security-fix-nix-top-faster-garbage-collection-parallel-instantiation-a-2kt4na6nw#faq","mainEntity":[{"@type":"Question","name":"What does the Broccoli2Shell vulnerability in Nix's Brotli decoder affect?","acceptedAnswer":{"@type":"Answer","text":"Broccoli2Shell (CVE-2026-111497) is an out-of-bounds write in the Brotli decoder that can be triggered by malicious data, potentially crashing the process or allowing remote code execution. Nix decompresses Brotli data from untrusted sources like binary cache files and HTTP responses with 'Content-Encoding: br', so it affects every Determinate Nix user. Determinate Nix 3.24.1 fixes it by updating Brotli to version 1.2.1. Developers patching Brotli-related CVEs can track fixes like this one on daily.dev."}},{"@type":"Question","name":"Why did Nix evaluations suddenly get much slower in garbage collection?","acceptedAnswer":{"@type":"Answer","text":"A change picked up in Determinate Nix 3.23.0 limited the Boehm-Demers-Weiser garbage collector to only one 16 MiB heap expansion per collection, so once the heap grew past its 4 GiB initial size, every 16 MiB allocated triggered a full collection. One CI job's evaluation time went from about 2 minutes to 40 minutes. Version 3.24.1 restores the previous heuristic, dropping total CPU time across 249 test flakes from 7,014 to 806 seconds. Engineers debugging GC regressions in build tooling follow fixes like this on daily.dev."}},{"@type":"Question","name":"How much faster is Nix evaluation with parallel instantiation of derivation dependencies?","acceptedAnswer":{"@type":"Answer","text":"With parallel evaluation enabled, Determinate Nix instantiates a derivation's dependencies in parallel instead of one at a time, roughly halving single-package evaluation time. Running 'nix eval nixpkgs#firefox' went from 1.51 seconds to 0.77 seconds, and evaluating Nix's own development shell dropped from 2.65 seconds to 1.25 seconds. Teams optimizing build evaluation speed track performance wins like this on daily.dev."}}]} ```