Nixpkgs core team exits; OpenWrt offload and LuCI XSS

NixOS governance and OpenWrt networking dominated the day. A packaging core team stepped down over burnout while hardware offload progress and a LuCI theme security flaw drew sustained technical debate.

Nixpkgs core team disbands

The Nixpkgs core team announced it has disbanded after about ten months, citing burnout. Steering Committee members and others on the NixOS Discourse debated broader governance failures around the decision. Maintainers and users who rely on Nixpkgs should watch how maintainership and decision paths are reorganized.

NSS offload for IPQ5018 on kernel 6.18

Developers reported working NSS offload for IPQ5018 NAT using the upstream stmmac ethernet stack on Linux 6.18, with public branches and results across multiple boards including the GL-B3000. The long OpenWrt forum thread stayed technical. The work matters for anyone seeking hardware-accelerated networking on Qualcomm IPQ5018 devices without proprietary stacks.

Stored XSS via Footstrap LuCI theme

A thread introducing Footstrap, a new LuCI theme described as twice as fast as bootstrap, also surfaced a stored unauthenticated SVG XSS through wallpaper upload served as image/svg+xml. Participants on the OpenWrt forum examined the vector. Operators who allow theme or wallpaper uploads should treat the path as untrusted until it is closed.

Working group proposed for Dynamic Derivations

A Nix contributor proposed a working group to coordinate Dynamic Derivations experiments, UX refinement, and infrastructure. The early discourse.nixos.org thread is still forming scope. The feature could change how Nix evaluates and builds packages if the experiments stabilize.

Stack buffer overflow in sngrep

A critical stack buffer overflow in sngrep through 1.8.4 via SIP headers was filed as CVE-2026-90558 against the package through the Nixpkgs security tracker. The report is tracked as issue 562879. Packaging and security maintainers need the package patched or otherwise constrained.

Modernized LuCI dashboard rewrite

A contributor submitted a pull request for luci-mod-dashboard, an AI-redesigned LuCI dashboard with charts. Forum feedback focused on style consistency with existing components. The rewrite aims at a cleaner management UI for OpenWrt devices.

Nixpkgs cooldown channels for desktop use

A Discourse thread weighed security trade-offs of Determinate Systems chilled nixpkgs against official channels for desktop NixOS users. Participants argued over whether cooldowns are needed outside higher-assurance setups. Desktop users balancing supply-chain delay against package freshness may find the comparison useful.

Ethernet port order flipping on reboot

Users reported eth0 and eth1 swapping order after reboot or power cycle on an access point. One participant posted an stmmac kernel patch to force interface names from device tree aliases. Stable naming matters for scripts and firewall rules that assume fixed port numbers.