--- title: How safe is follows? | daily.dev description: Analysis using the omniflake index (12,000+ Nix flakes) investigates whether the 'follows' attribute, which consolidates flake inputs to a single nixpkgs... canonical: https://daily.dev/posts/how-safe-is-follows--4wmacyttd twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How safe is follows? | daily.dev og:description: Analysis using the omniflake index (12,000+ Nix flakes) investigates whether the 'follows' attribute, which consolidates flake inputs to a single nixpkgs... og:url: https://daily.dev/posts/how-safe-is-follows--4wmacyttd og:image: https://api.daily.dev/og/posts/4wmACYTtd.png og:image:alt: How safe is follows? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How safe is follows? **[Farid Zakaria’s Blog](https://daily.dev/sources/fzakaria)** · 7 min read · 4 upvotes · 0 comments ## Summary Analysis using the omniflake index (12,000+ Nix flakes) investigates whether the 'follows' attribute, which consolidates flake inputs to a single nixpkgs revision, is risky in practice. Half of all flakes pin a nixpkgs revision older than 506 days, and one in twenty are over five years stale as of the writeup date. However, four in five of those revisions were actual published channel bumps tested by Hydra and available from the binary cache, and most authors originally picked a nixpkgs less than three weeks old at write time—staleness accrues mainly from neglect (flakes not being updated) rather than deliberate old pins. The author concludes follows remains a powerful but risky primitive, especially with nix-darwin, and no definitive safety verdict is reached. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What does the follows attribute do in a Nix flake input? The follows attribute consolidates a flake's inputs to a single shared source, most commonly nixpkgs, so multiple dependencies resolve to the same revision instead of each locking their own. This reduces the number of distinct nixpkgs revisions in the dependency graph, which speeds up evaluation and shrinks the overall closure size, but can build a flake against a nixpkgs revision its author never tested. _Anyone tuning flake evaluation speed can compare follows trade-offs and Nix patterns on daily.dev._ ### Is it risky to use follows to consolidate nixpkgs inputs in Nix flakes? It carries real but often overstated risk: across 10,754 indexed flakes locking nixpkgs, half are pinned to a revision more than 506 days old and one in twenty exceed 1,768 days (five years), meaning a follows consolidation typically asks a flake to build against a nixpkgs roughly a year and a half newer than what its author tested. Still, four in five of those revisions were actual Hydra-tested channel bumps available from the binary cache, and staleness mostly stems from flakes never being updated rather than deliberately old pins. _Developers weighing Nix dependency pinning strategies can follow ecosystem data like this on daily.dev._ ## Similar posts on daily.dev - [One flake to rule them all](https://daily.dev/posts/one-flake-to-rule-them-all-oyz5p8fiz) · Farid Zakaria’s Blog · 1 upvotes · 1 comments - [The Great Nix Flake Check](https://daily.dev/posts/the-great-nix-flake-check-joelq4xlg) · Lobsters · 0 upvotes · 0 comments --- Tags: [#open-source](https://daily.dev/tags/open-source) [View this post on daily.dev](https://daily.dev/posts/how-safe-is-follows--4wmacyttd) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How safe is follows?","url":"https://daily.dev/posts/how-safe-is-follows--4wmacyttd","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-safe-is-follows--4wmacyttd"},"datePublished":"2026-08-31T23:56:50.773Z","dateModified":"2026-09-01T00:11:19.075Z","description":"Analysis using the omniflake index (12,000+ Nix flakes) investigates whether the 'follows' attribute, which consolidates flake inputs to a single nixpkgs...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/984d4b0e839aec35b3a58390c96a6058?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/984d4b0e839aec35b3a58390c96a6058?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Farid Zakaria’s Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Farid Zakaria’s Blog","logo":"https://media.daily.dev/image/upload/s--YqqvRt90--/f_auto/v1723789280/logos/fzakaria","url":"https://daily.dev/sources/fzakaria"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-safe-is-follows--4wmacyttd","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":4},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"open-source","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Farid Zakaria’s Blog","item":"https://daily.dev/sources/fzakaria"},{"@type":"ListItem","position":3,"name":"How safe is follows?"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-safe-is-follows--4wmacyttd#faq","mainEntity":[{"@type":"Question","name":"What does the follows attribute do in a Nix flake input?","acceptedAnswer":{"@type":"Answer","text":"The follows attribute consolidates a flake's inputs to a single shared source, most commonly nixpkgs, so multiple dependencies resolve to the same revision instead of each locking their own. This reduces the number of distinct nixpkgs revisions in the dependency graph, which speeds up evaluation and shrinks the overall closure size, but can build a flake against a nixpkgs revision its author never tested. Anyone tuning flake evaluation speed can compare follows trade-offs and Nix patterns on daily.dev."}},{"@type":"Question","name":"Is it risky to use follows to consolidate nixpkgs inputs in Nix flakes?","acceptedAnswer":{"@type":"Answer","text":"It carries real but often overstated risk: across 10,754 indexed flakes locking nixpkgs, half are pinned to a revision more than 506 days old and one in twenty exceed 1,768 days (five years), meaning a follows consolidation typically asks a flake to build against a nixpkgs roughly a year and a half newer than what its author tested. Still, four in five of those revisions were actual Hydra-tested channel bumps available from the binary cache, and staleness mostly stems from flakes never being updated rather than deliberately old pins. Developers weighing Nix dependency pinning strategies can follow ecosystem data like this on daily.dev."}}]} ```