Lix 2.96 deprecates ssh:// store URIs and rewrites flake.nix validation

Serguey Asael Shinder14 October 2026, 09:202 min read

The Lix team released Lix 2.96 "Bingsu" on 13 October 2026, the seventh major version of the community-run Nix implementation. The announcement groups the work under four headings: security, debugger support, quality-of-life changes, and progress towards a new Cap'n'Proto RPC protocol and Rust code in the codebase.

The change that needs planning: ssh:// stores are on their way out. Lix 2.96 deprecates ssh:// store URIs while keeping them working, without printing a warning for now. The project says support will be removed in Lix 2.97; ssh-ng:// stays, and in this release it is declared stable. The team gives two reasons — clearing the way for the RPC work and fixing security inconsistencies between the two transports — and notes that ssh-ng applies stricter checks: untrusted users can no longer copy unsigned outputs to a remote store over it. Anyone relying on ssh:// because ssh-ng lacks a feature is asked to contact the project before 2.97.

Breaking changes in evaluation. Validation of flake.nix now follows a single rule: no function calls outside outputs. That loosens things in one direction — let blocks and string interpolation are now accepted in flake inputs — and the team flags the consequence itself: flakes written this way may not evaluate on other Nix implementations. The floor and ceil builtins now throw instead of silently losing precision when converting large floats to integers, a case the release notes say could turn a positive float into a negative integer. Many nix3 commands also stop building their arguments first, which ends oddities such as nix store delete downloading a missing path just to delete it. Shadowing internal files through Nix search paths, deprecated in 2.95, is now an error unless configured otherwise.

Smaller additions worth knowing. Nested attributes can be passed with --arg and --argstr (so --arg foo.bar.baz 1 now builds a nested set), inputs are fetched by one process at a time when several want the same set, and evaluation links mimalloc, for which the team reports 5–12% faster evaluation. nix doctor now reports system details and can probe configured remote builders. The REPL moved from editline to rustyline, which brings proper UTF-8 input, and the debugger gets relative frame navigation.

What is still experimental. The new RPC protocol ships behind the rpc-sockets experimental feature and needs system setup that the NixOS module does not yet do. A 2.96.1 point release is already planned, with items such as --keep-going for ssh-ng stores and SHA-256 support for Git fetchers.

The team asks users not to upgrade with nix upgrade-nix but with the upgrade script from its installation guide.

Source: Lix, "Announcing Lix 2.96 'Bingsu'" — https://lix.systems/blog/2026-10-13-lix-2.96-release/