← All distributions
Updated 20:01
Determinate Secure Packages distribution
secure-packages-rollingSupportedFIPS supported
Built on Nixpkgs master. Available for use in production environments and covered by our standard service-level agreement (SLA).
Fixed in the last 30 days
234
Fixed in the last 7 days
119
In progress
370
Use this distribution
Customers onlyDeterminate Secure Packages is available through FlakeHub to organizations with access. Not a customer yet? Get in touch to gain access or schedule a demo.
Standardflake.nix
{
inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-rolling/0";
}FIPS variant
FIPS variantflake.nix
{
inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-rolling-fips/0";
}The FIPS variant is the package set with Federal Information Processing Standards (FIPS) mode enabled. Using the FIPS variant has the details.
604 CVEs tracked
| CVE | Status | Severity | Summary | Fixed |
|---|---|---|---|---|
| In progress | High | PYSEC-2026-3697: Comment-only SQL causes O(n^2) in sqlparse group_comments; DoS bypasses MAX_GROUPING_TOKENS cap | — | |
| In progress | Medium | PYSEC-2026-3923: sqlparse reindent tuple-list formatting triggers CPU DoS from repeated statement-prefix offset calculations | — | |
| In progress | High | GHSA-pwgv-4x5q-6m9f: sqlparse DoS: TokenList.__init__ str(self) triggers O(n*depth) on nested groups | — | |
| In progress | Medium | PYSEC-2026-3696: sqlparse python/php output filters allow code injection via improper backslash/quote escaping | — |
Make CVE remediation our job, not yours.
Tell us what you run. We'll show you what Determinate Secure Packages covers, how the SLA applies, and how to get started.