From fe79b90055a70f93f8187c436ee31deed466f721 Mon Sep 17 00:00:00 2001
From: Jade Lovelace <lix@jade.fyi>
Date: Fri, 17 Jan 2025 18:47:55 -0800
Subject: [PATCH] doc: add some missing release notes for 2.92

Change-Id: I4861f8885aac53ce76322aae0387facfdd5f3e88
---
 doc/manual/change-authors.yml             |  3 +++
 doc/manual/rl-next/flake-purity-bug.md    | 21 ++++++++++++++++++++
 doc/manual/rl-next/nix-build-out-link.md  |  2 +-
 doc/manual/rl-next/nix-version-verbose.md | 24 +++++++++++++++++++++++
 4 files changed, 49 insertions(+), 1 deletion(-)
 create mode 100644 doc/manual/rl-next/flake-purity-bug.md
 create mode 100644 doc/manual/rl-next/nix-version-verbose.md

diff --git a/doc/manual/change-authors.yml b/doc/manual/change-authors.yml
index 52109f2d5..23ebc94d7 100644
--- a/doc/manual/change-authors.yml
+++ b/doc/manual/change-authors.yml
@@ -82,6 +82,9 @@ jade:
   forgejo: jade
   github: lf-
 
+just1602:
+  forgejo: just1602
+
 kiara:
   github: KiaraGrouwstra
 
diff --git a/doc/manual/rl-next/flake-purity-bug.md b/doc/manual/rl-next/flake-purity-bug.md
new file mode 100644
index 000000000..3f5d4687d
--- /dev/null
+++ b/doc/manual/rl-next/flake-purity-bug.md
@@ -0,0 +1,21 @@
+---
+synopsis: "Flakes/restrict-eval no longer allow reading contents of impure paths"
+category: Fixes
+credits: [horrors]
+---
+
+Flakes and `--restrict-eval` now correctly restrict access to paths as intended.
+In prior versions since at least 2.18, `nix eval --raw .#lol` for the following flake didn't throw an error and acted as if `--impure` was passed.
+
+Thanks to the person who reported this for telling us about it.
+This was handled as a low-severity security bug, but is not a violation of the [documented security model](../installation/multi-user.md) as untrusted Nix code should be assumed to have the privileges of the user running the evaluator.
+To report a security bug, email a report to `security at lix dot systems`.
+
+```nix
+{
+  inputs = {};
+  outputs = {...}: {
+    lol = builtins.readFile "${/etc/passwd}";
+  };
+}
+```
diff --git a/doc/manual/rl-next/nix-build-out-link.md b/doc/manual/rl-next/nix-build-out-link.md
index 64b2ed1da..f8dd7b4ad 100644
--- a/doc/manual/rl-next/nix-build-out-link.md
+++ b/doc/manual/rl-next/nix-build-out-link.md
@@ -5,7 +5,7 @@ category: Fixes
 credits: lilyball
 ---
 
-[`nix-build`](@docroot@/command-ref/nix-build.md)now treats <code>[--out-link](@docroot@/command-ref/nix-build.md#opt-out-link) ''</code>
+[`nix-build`](@docroot@/command-ref/nix-build.md) now treats <code>[--out-link](@docroot@/command-ref/nix-build.md#opt-out-link) ''</code>
 the same as [`--no-out-link`](@docroot@/command-ref/nix-build.md#opt-no-out-link). This matches
 [`nix build`](@docroot@/command-ref/new-cli/nix3-build.md) behavior. Previously when building the default output it
 would have resulted in throwing an error saying the current working directory already exists, and when building any
diff --git a/doc/manual/rl-next/nix-version-verbose.md b/doc/manual/rl-next/nix-version-verbose.md
new file mode 100644
index 000000000..32d5ffe6b
--- /dev/null
+++ b/doc/manual/rl-next/nix-version-verbose.md
@@ -0,0 +1,24 @@
+---
+synopsis: "`nix --version` now shows details about the installation by default"
+category: Improvements
+credits: [just1602]
+cls: 2365
+issues: [fj#620]
+---
+
+This happened with `nix-env --version` by default, but due to [oddities around the nix3 CLI's verbosity](https://gerrit.lix.systems/c/lix/+/1370), it used to be `nix --verbose --version`.
+
+No longer:
+
+```
+$ nix --version
+nix (Lix, like Nix) 2.92.0-dev-pre20250117-0d14c2b
+System type: x86_64-linux
+Additional system types: i686-linux, x86_64-v1-linux, x86_64-v2-linux, x86_64-v3-linux
+Features: gc, signed-caches
+System configuration file: /etc/nix/nix.conf
+User configuration files: /home/jade/.config/nix/nix.conf:/etc/xdg/nix/nix.conf
+Store directory: /nix/store
+State directory: /nix/var/nix
+Data directory: /nix/store/rliimcnqkplrqdgm4z6yqclpr6c32wh6-lix-2.92.0-dev-pre20250117-0d14c2b/share
+```