What's Changed

• nix: 2.35.3 -> 2.35.4 by @xokdvium in #283
  Security: Updates the bundled certificates shipped with the installer to remove the compromised eMudhra certificates.

Re-release of 31.11.3, which was tagged incorrectly.

Full Changelog: v31.11.2...v31.11.3

This tag was incorrectly named. Prefer v31.11.3.

What's Changed

• nix: 2.35.3 -> 2.35.4 by @xokdvium in #283
  Security: Updates the bundled certificates shipped with the installer to remove the compromised eMudhra certificates.

Full Changelog: v31.11.2...31.11.3

Starting with v31, this action will use semantic versioning for releases.
Major tags, like v31, will be bumped to point to the latest minor/patch release.
This is in line with how most GitHub actions manage releases.

What's Changed

• nix: 2.26.3 -> 2.28.2 by @Mic92 in #232

• nix: 2.24.9 -> 2.25.2 by @Mic92 in #218

• ci: fix latest installer tests by @sandydoo in #220

• ci: add ubuntu-24.04-arm to matrix by @msgilligan in #221

• nix: 2.25.2 -> 2.26.2 by @Mic92 in #226

• nix: 2.26.2 -> 2.26.3 by @sandydoo in #228

• feat: Pin actions to hashes by @l0b0 in #201

• chore(deps): bump actions/checkout from 4.1.1 to 4.2.2 by @dependabot in #234

• docs: document how to provide AWS credentials to the nix-daemon by @sandydoo in #235

• nix: 2.28.2 -> 2.28.3 by @Mic92 in #236

• nix: 2.28.3 -> 2.29.0 by @Mic92 in #239
  Release notes: https://nix.dev/manual/nix/latest/release-notes/rl-2.29

• Automate nix updates in CI by @Mic92 in #241

• nix: 2.29.0 -> 2.29.1 by @github-actions in #243
  [SECURITY] https://discourse.nixos.org/t/security-advisory-privilege-escalations-in-nix-lix-and-guix/66017

• nix: 2.29.1 -> 2.30.0 by @github-actions in #244
  Release notes: https://nix.dev/manual/nix/2.30/release-notes/rl-2.30.html

• nix: 2.30.0 -> 2.30.1 by @xokdvium in #245
  [SECURITY] Builds with Nix 2.30.0 on macOS were executed with elevated privileges (root), instead of the build users. GHSA-qc7j-jgf3-qmhg

• docs: add example for nix develop by @jennydaman in #248

• nix: 2.30.2 -> 2.31.0 by @github-actions[bot] in #250
  Release notes: https://discourse.nixos.org/t/nix-2-31-0-released/68465

• nix: 2.31.0 -> 2.31.1 by @github-actions[bot] in #253

• nix: 2.31.1 -> 2.31.2 by @github-actions[bot] in #256

• feat: set up the environment based on the installer shell scripts by @sandydoo in #251
  Adds the bin directory from the user's profile to $PATH.
  Configures the following environment variables:

  • NIX_PROFILES
  • NIX_SSL_CERT_FILE (if not set)

• nix: 2.31.2 -> 2.32.0 by @github-actions[bot] in #257
  Release notes: https://discourse.nixos.org/t/nix-2-32-0-released/70528

• nix: 2.32.0 -> 2.32.1 by @github-actions[bot] in #258

• nix: 2.32.1 -> 2.32.2 by @github-actions[bot] in #259

• nix: 2.32.2 -> 2.32.3 by @github-actions[bot] in #260

• nix: 2.32.3 -> 2.32.4 by @github-actions[bot] in #261

• nix: 2.32.4 -> 2.33.0 by @github-actions[bot] in #264

• nix: 2.33.0 -> 2.33.3 by @github-actions[bot] in #266

• nix: 2.33.3 -> 2.34.0 by @github-actions[bot] in #267
  Release notes: https://discourse.nixos.org/t/nix-2-34-0-released/75818 Rolled back due to reports of issues with cachix-action

• nix: 2.34.0 -> 2.34.1 by @github-actions[bot] in #269
  Fixes a bug introduced in 2.34.0 that made the Nix daemon fail to load authentication keys configured by cachix-action.

• nix: 2.34.1 -> 2.34.2 by @github-actions[bot] in #270

• nix: 2.34.2 -> 2.34.4 by @github-actions[bot] in #271

• nix: 2.34.4 -> 2.34.5 by @github-actions[bot] in #273
  CVE-2026-39860 Fixes a root privilege escalation vulnerability via sandbox escape. Severity: Critical.

• nix: 2.34.5 -> 2.34.6 by @github-actions[bot] in #274

• nix: 2.34.6 -> 2.34.7 by @github-actions[bot] in #275
  GHSA-vh5x-56v6-4368: Fixes a coroutine stack-to-heap overflow via unbounded recursion in the NAR directory parser. Severity: High.
  GHSA-gr92-w2r5-qw5p: Fixes an absolute path traversal vulnerability when unpacking archives to disk. Severity: Moderate.

• nix: 2.34.7 -> 2.34.8 by @github-actions[bot] in #278

• nix: 2.34.8 -> 2.35.1 by @github-actions[bot] in #279
  Release notes: https://discourse.nixos.org/t/nix-2-35-0-released/78914

• nix: 2.35.1 -> 2.35.2 by @github-actions[bot] in #281
  Fixes a crash (Assertion '!awake.empty()' failed) that could abort builds.

• nix: 2.35.2 -> 2.35.3 by @github-actions[bot] in #282
  Security: Fixes a number of vulnerabilities that could be combined to achieve root priviledge escalation.
  See https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547

• nix: 2.35.3 -> 2.35.4 by @xokdvium in #283
  Security: Updates the bundled certificates shipped with the installer to remove the compromised eMudhra certificates.

Full Changelog: v30...v31

What's Changed

• nix: 2.35.2 -> 2.35.3 by @github-actions[bot] in #282
  Security: Fixes a number of vulnerabilities that could be combined to achieve root priviledge escalation.
  See https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547

Full Changelog: v31.11.1...v31.11.2

What's Changed

• nix: 2.35.1 -> 2.35.2 by @github-actions[bot] in #281
  Fixes a crash (Assertion '!awake.empty()' failed) that could abort builds.

Full Changelog: v31.11.0...v31.11.1

What's Changed

• nix: 2.34.8 -> 2.35.1 by @github-actions[bot] in #279
  Release notes: https://discourse.nixos.org/t/nix-2-35-0-released/78914

Full Changelog: v31.10.7...v31.11.0

What's Changed

• nix: 2.34.7 -> 2.34.8 by @github-actions[bot] in #278

Full Changelog: v31.10.6...v31.10.7

What's Changed

• nix: 2.34.6 -> 2.34.7 by @github-actions[bot] in #275
  GHSA-vh5x-56v6-4368: Fixes a coroutine stack-to-heap overflow via unbounded recursion in the NAR directory parser. Severity: High.
  GHSA-gr92-w2r5-qw5p: Fixes an absolute path traversal vulnerability when unpacking archives to disk. Severity: Moderate.

Full Changelog: v31...v31.10.6

What's Changed

• nix: 2.34.5 -> 2.34.6 by @github-actions[bot] in #274

Full Changelog: v31...v31.10.5

What's Changed

• nix: 2.34.4 -> 2.34.5 by @github-actions[bot] in #273
  [SECURITY] Fixes a root privilege escalation vulnerability via sandbox escape GHSA-g3g9-5vj6-r3gj

Full Changelog: v31.10.3...v31.10.4