# Nix 2.24.8 released fixing builtin:fetchurl credentials leak, severity 5.9 (moderate)

**URL:** https://discourse.nixos.org/t/nix-2-24-8-released-fixing-builtin-fetchurl-credentials-leak-severity-5-9-moderate/52732
**Category:** Security
**Created:** [September 26, 2024, 8:56am UTC](https://discourse.nixos.org/t/nix-2-24-8-released-fixing-builtin-fetchurl-credentials-leak-severity-5-9-moderate/52732 "2024-09-26T08:56:42Z")
**Posts on this page:** 1
**Showing post:** 12

<div class="post-metadata">

### Author: ![asymmetric](https://discourse.nixos.org/user_avatar/discourse.nixos.org/asymmetric/32/790_2.png) [@asymmetric](https://discourse.nixos.org/u/asymmetric)
#### Post date: [September 26, 2024, 10:57am UTC](https://discourse.nixos.org/t/nix-2-24-8-released-fixing-builtin-fetchurl-credentials-leak-severity-5-9-moderate/52732/12 "2024-09-26T10:57:03Z")

</div>

Sure, but without the advisory, most affected people would’ve felt less urgency to update to a just-released Nix version.

The only people who would’ve been “in the know” between Tweet and advisory are:

- those who instantly check the release notes of every Nix release (and it’s [not even clear](https://discourse.nixos.org/t/nix-2-24-released/49986/10) where [to find them](https://nix.dev/manual/nix/2.24/release-notes/rl-2.24))
- those who follow DetSys on Twitter

It seems unfair that those who subscribe to security advisories on the Nix repo should be at a disadvantage here. And I’m sure it won’t inspire confidence in the professionalism of the team.

I think this is a pretty clear cut issue, @edolstra – don’t announce security fixes in the DetSys Twitter first!

---

_[View the full topic](https://discourse.nixos.org/t/nix-2-24-8-released-fixing-builtin-fetchurl-credentials-leak-severity-5-9-moderate/52732)._