# Flox 1.16.0 is released!

**URL:** <https://discourse.flox.dev/t/flox-1-16-0-is-released/1272>\
**Category:** Announcements\
**Created:** [September 8, 2026, 11:09pm UTC](https://discourse.flox.dev/t/flox-1-16-0-is-released/1272 "2026-09-08T23:09:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mkenigs](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.flox.dev/mkenigs/32/520_2.png) [@mkenigs](https://discourse.flox.dev/u/mkenigs)\
**Post date:** [September 8, 2026, 11:09pm UTC](https://discourse.flox.dev/t/flox-1-16-0-is-released/1272/1 "2026-09-08T23:09:37Z")

</div>

# Flox 1.16.0 is released!

## Services

Flox 1.16.0 introduces a new manifest schema 1.16.0 that includes the service fields `depends-on`, `shutdown.timeout-seconds`, and `shutdown.signal`.

- Services can declare start ordering: `[services.<name>.depends-on]` waits for another service to start or complete before this one starts.
- `[services.<name>.shutdown]` gains `timeout-seconds`, which sets how long a service gets to shut down before it is killed, and `signal`, which sets the signal to deliver.
- Services now start in dependency order, so a service listed before its dependency no longer starts early and ignores `depends-on`.

## `flox run`

`flox run` now provides the ability to run commands solely by providing the command name. For example, use `flox run rg` to run ripgrep.

- The `-p`/`--package` argument is now optional. When several packages provide the same command, Flox prompts asking what package to use if an interactive terminal is available, and remembers the choice for next time.
- `flox run` now accepts `--reselect <COMMAND>`, which clears the choice of what package to use for a command.
- `flox search --command <COMMAND>` lists the packages that provide a named binary, with `--all` to show every result and `--json` for machine-readable output.

## Changes

- `flox develop` no longer activates an environment; use `flox activate` instead. `flox develop` will be used to provide a Nix development shell for Nix expression builds.
- `flox init` now records the environment’s anonymous metrics id in the `env_id` field of `.flox/env.json` instead of a separate `.flox/telemetry_id` file. Existing `telemetry_id` files are still honored. The id is committed with the environment on purpose, so that clones of one environment count as one environment, and it is only submitted when metrics collection is enabled.
- Catalog inputs for expression builds resolve to the latest published versions, independent of `--stability`, which selects only the nixpkgs base package set.
- `nix profile install github:flox/flox` now prefers [cache.nixos.org](http://cache.nixos.org) for upstream packages; cache.flox.dev continues to serve the Flox closures themselves. No action is needed, as the substituter and trusted key shipped in the flake are unchanged apart from the priority parameter.

## Features

- A new Flox NixOS module runs systemd services from Flox environments, with automatic environment provisioning, scheduled updates, and restart-on-change. See [the module README](https://github.com/flox/flox/blob/main/modules/nixos/README.md) for details.
- `auto_activate_environments` keys may now be glob patterns, where `*` matches one directory name and `**` matches any depth, so a single entry can allow or deny auto-activation for many repositories. An exact path always wins, and if matching patterns disagree the directory is denied, as in `flox config --set 'auto_activate_environments."/home/me/work/*"' allow`.
- `flox auth status` displays the active credential expiry when known.
- `flox auth login` now asks the configured FloxHub server where to log in: a deployment serving auth discovery gets the device-grant login against its own identity provider, and a deployment without it keeps today’s Auth0 login unchanged.
- Projects using Nix expression builds may now pin their catalog inputs in a single committed `.flox/catalog.lock`, created explicitly with `flox build update-catalogs`, so every build of a revision uses the same pinned inputs. Without one, builds resolve the built packages’ references fresh on every invocation, and nothing is written into the project tree. `flox publish` submits only the entries relevant to the published package, and a stale committed lock fails the publish with the uncovered references.

## Fixes

- Fixed an intermittent `flox publish` failure, `failed to parse file for lock results`, caused by a race in per-package catalog locking.
- `flox publish` no longer sends the user and password portion of an http(s) git remote URL, or the password portion of an ssh one. Where a remote is configured as `https://<user>:<token>@host/owner/repo`, only `https://host/owner/repo` is sent, and the repository is identified the same way. A credential in a `git://` remote, or in a remote-helper address such as `hg::https://…`, is still sent in full. Source URLs recorded by publishes made before this release may include userinfo for any shape, so rotate any token that was configured in a remote.
- Fixed verbose authentication output so FloxHub credentials are redacted.
- `flox auth token` now prints personal access tokens and other opaque credentials instead of reporting that you are not logged in.
- Setting `auth_notifications = false` now also suppresses the warning about resolving packages while logged out, which previously fired every eight hours regardless of the setting.
- Commands that fail with “Environment not found in FloxHub.” now add “you may need to run ‘flox auth login’” when no FloxHub identity is resolved locally, rather than implying the environment was deleted. This covers `flox pull` in an existing environment directory and the remote-environment commands such as `flox activate -r`. `flox pull <owner>/<name>` into a new directory has its own message and is unchanged.
- Fixed a bug where `flox edit --name` silently reset `.flox/env.json` to owner-only permissions; env.json rewrites now preserve the file’s existing permissions.

## Thank you to our community contributions this release

- Corrected the clone command syntax in `CONTRIBUTING.md` (@esteve)

## Download Links

- [DEB (x86\_64-linux)](https://downloads.flox.dev/by-env/stable/deb/flox-1.16.0.x86_64-linux.deb)
- [DEB (aarch64-linux)](https://downloads.flox.dev/by-env/stable/deb/flox-1.16.0.aarch64-linux.deb)
- [RPM (x86\_64-linux)](https://downloads.flox.dev/by-env/stable/rpm/flox-1.16.0.x86_64-linux.rpm)
- [RPM (aarch64-linux)](https://downloads.flox.dev/by-env/stable/rpm/flox-1.16.0.aarch64-linux.rpm)
- [OSX (x86\_64-darwin)](https://downloads.flox.dev/by-env/stable/osx/flox-1.16.0.x86_64-darwin.pkg)
- [OSX (aarch64-darwin)](https://downloads.flox.dev/by-env/stable/osx/flox-1.16.0.aarch64-darwin.pkg)

> [!NOTE]  
> You can find the [SHA256 checksums for Flox 1.16.0](https://downloads.flox.dev/by-env/stable/flox-1.16.0.SHA256SUMS) and [SHA512 checksums for Flox 1.16.0](https://downloads.flox.dev/by-env/stable/flox-1.16.0.SHA512SUMS) online.

---

<div class="post-metadata">

**Author:** ![robinbrantley](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.flox.dev/robinbrantley/32/39_2.png) [@robinbrantley](https://discourse.flox.dev/u/robinbrantley)\
**Post date:** [September 9, 2026, 9:06am UTC](https://discourse.flox.dev/t/flox-1-16-0-is-released/1272/2 "2026-09-09T09:06:46Z")

</div>



---

<div class="post-metadata">

**Author:** ![jbayer](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.flox.dev/jbayer/32/757_2.png) [@jbayer](https://discourse.flox.dev/u/jbayer)\
**Post date:** [September 22, 2026, 3:28pm UTC](https://discourse.flox.dev/t/flox-1-16-0-is-released/1272/3 "2026-09-22T15:28:41Z")

</div>