# Flox 1.19.4 is Released!

**URL:** <https://discourse.flox.dev/t/flox-1-19-4-is-released/1305>\
**Category:** Announcements\
**Created:** [November 5, 2026, 10:44pm UTC](https://discourse.flox.dev/t/flox-1-19-4-is-released/1305 "2026-11-05T22:44:28Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![stephenyeargin](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.flox.dev/stephenyeargin/32/842_2.png) [@stephenyeargin](https://discourse.flox.dev/u/stephenyeargin)\
**Post date:** [November 5, 2026, 10:44pm UTC](https://discourse.flox.dev/t/flox-1-19-4-is-released/1305/1 "2026-11-05T22:44:28Z")

</div>

**Flox 1.19.4 is Released!**

**Important**

If Flox reached 1.19.1 or 1.19.2 on your Mac through `brew upgrade`, a plain `brew upgrade flox` to 1.19.4 will still fail, because Homebrew runs the old release’s uninstall script first. Run the recovery script included below instead; it repairs the installation and upgrades Flox to the latest release available through Homebrew. The script uses sudo but shouldn’t be run as root, since `brew` refuses to run as root.

```auto
curl -fsSL https://github.com/flox/flox/releases/download/v1.19.4/recover-brew-upgrade.sh | sh

```

**Important**

If you build or publish packages with Nix expressions, this release changes two things. An existing v1 `.flox/catalog.lock` must be regenerated with `flox build update-catalogs`, and `flox publish` refuses shallow checkouts, so GitHub Actions using `actions/checkout` must set `fetch-depth: 0`.

## **Features**

- `flox publish` asks you to confirm a source lineage change before building, rather than after building and uploading.
- Custom builds can select a default FloxHub authentication mode with `defaultAuthnMode`. Builds without this option continue to default to token authentication.
- Base catalog source builds use the nixpkgs host recorded in the lockfile. Public GitHub fetching remains compatible with existing cache entries.
- `nix profile install github:flox/flox` and local `nix develop` can now substitute paths built by Flox CI from `cache.floxsdlc.com`, tried after [cache.nixos.org](http://cache.nixos.org) and cache.flox.dev. It uses the same trusted key as cache.flox.dev.

## **Changes**

- `.flox/catalog.lock` now uses format version 2. Nix expression operations that use an existing v1 lock require `flox build update-catalogs`, and no automatic migration occurs.
- `flox publish` requires a checked-out branch with an upstream, complete history and a revision contained in that upstream’s advertised tip. Shallow checkouts are refused, so GitHub Actions using `actions/checkout` must set `fetch-depth: 0`.
- If the remote branch has advanced and its tip is not in the local clone, `flox publish` stops and asks you to run `git fetch <remote> <branch>`, then retry.
- Zsh and tcsh no longer auto-activate an environment for a `cd` inside a subshell, such as `(cd project && make)`, which matches bash. To run one command in another project’s environment, use `flox activate -d project -- make`.

## **Fixes**

- Zsh and tcsh shells no longer lose their attachment to an auto-activated environment when a subshell changes directory, most commonly after tab-completing `cd ../…` in zsh. This caused `PID … is not attached to the activation` errors and could stop an environment’s services while the shell was still using it.
- `flox containerize` now honours `[options] cuda-detection`. Previously CUDA detection was disabled in every containerized environment regardless of the manifest, so GPU workloads silently fell back to CPU.
- Container images now contain real `/etc/passwd` and `/etc/group` files instead of symlinks into the Nix store. Images built previously could fail to start on containerd 2.2.0–2.2.7, and on 2.3.0–2.3.4 outside the overlay/bind fast path, with `open etc/passwd: path escapes from parent`.

## **Thank you to our community contributions this release**

- `hook.on-deactivate` no longer runs when `hook.on-activate` failed. (**[@fzakaria](https://github.com/fzakaria)**)

## **Download Links**

- [DEB (x86\_64-linux)](https://downloads.flox.dev/by-env/stable/deb/flox-1.19.4.x86_64-linux.deb)
- [DEB (aarch64-linux)](https://downloads.flox.dev/by-env/stable/deb/flox-1.19.4.aarch64-linux.deb)
- [RPM (x86\_64-linux)](https://downloads.flox.dev/by-env/stable/rpm/flox-1.19.4.x86_64-linux.rpm)
- [RPM (aarch64-linux)](https://downloads.flox.dev/by-env/stable/rpm/flox-1.19.4.aarch64-linux.rpm)
- [OSX (x86\_64-darwin)](https://downloads.flox.dev/by-env/stable/osx/flox-1.19.4.x86_64-darwin.pkg)
- [OSX (aarch64-darwin)](https://downloads.flox.dev/by-env/stable/osx/flox-1.19.4.aarch64-darwin.pkg)

Note

You can find the [SHA256 checksums for Flox 1.19.4](https://downloads.flox.dev/by-env/stable/flox-1.19.4.SHA256SUMS) and [SHA512 checksums for Flox 1.19.4](https://downloads.flox.dev/by-env/stable/flox-1.19.4.SHA512SUMS) online.

---

<div class="post-metadata">

**Author:** ![robinbrantley](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.flox.dev/robinbrantley/32/39_2.png) [@robinbrantley](https://discourse.flox.dev/u/robinbrantley)\
**Post date:** [November 5, 2026, 11:48pm UTC](https://discourse.flox.dev/t/flox-1-19-4-is-released/1305/2 "2026-11-05T23:48:11Z")

</div>

Made this a banner on November 5, 2026, 11:48pm UTC. It will appear at the top of every page until it is dismissed by the user.