Flox - Browse /v1.12.0 at SourceForge.net

The interactive file manager requires Javascript. Please enable it or use sftp or scp.
You may still browse the files here.

Name	Modified	Size	InfoDownloads / Week
Parent folder
README.md	2026-05-05	3.0 kB	0
v1.12.0 source code.tar.gz	2026-05-05	5.4 MB	0
v1.12.0 source code.zip	2026-05-05	5.9 MB	1
Totals: 3 Items		11.2 MB	1

Fix for Nix vulnerabilities

This release fixes GHSA-vh5x-56v6-4368 and GHSA-gr92-w2r5-qw5p. For Linux and macOS installations of Flox, GHSA-vh5x-56v6-4368 can allow arbitrary code execution as root. This affects Flox versions >=1.3.12.

Features

The manifest schema was bumped from 1.11.0 to 1.12.0 for the auto-start feature below.

flox activate automatically starts services when auto-start = true is set in the manifest's [services] section, and a new --no-start-services flag suppresses this on individual invocations.
flox publish reports failure-specific error messages for common repository validation issues (missing upstream branch, detached HEAD, SSH/authentication failure, revision not on remote).
flox publish collects narinfo for build outputs and their full closure from the local Nix store when publishing to a metadata-only catalog. This data is required to build a complete SBOM.

Fixes

Propagated packages now respect the priority of their parent package in the manifest's [install] block when activated in "develop" mode.
Manifest builds no longer fail when source files contain special characters in their filenames.
FLOX_FLOXHUB_TOKEN is redacted in log files and verbose output.
flox publish reports a clear error when .flox files are untracked in the build repository, instead of failing with a confusing "could not find environment pointer file" message.
flox publish honors the keep_tempdir setting when a build fails in an ephemeral directory.
flox publish no longer hangs polling for publisher confirmation when running against a metadata-only or NixCopy catalog configuration.
Metadata-only flox publish no longer fails with NoToken when no FloxHub token is configured when using Kerberos Authn.
flox include upgrade no longer unnecessarily migrates manifests with older but still-supported schema versions, avoiding schema version drift in the lockfile.