What's Changed

✨ New Features

• devbox.jsonc is now a recognized config filename — devbox.json has always accepted comments, but editors and GitHub diffs flag them as syntax errors in a .json file. Name your config devbox.jsonc and standard tooling highlights it correctly, and devbox add/rm write back to it instead of creating a stray devbox.json. If a directory has both, devbox.json still wins, by @mikeland73 (#2950)
• Package search now uses www.nixsearch.com by default — devbox search, add, and update resolve packages against www.nixsearch.com instead of search.devbox.sh. Pinned versions resolve to the same commits and store paths as before; @latest resolves against a newer nixpkgs index. Set DEVBOX_SEARCH_HOST to override, by @mikeland73 (#2985)

🐛 Bug Fixes

• Fixed broken documentation links — links pointing at the old jetify.com/devbox/docs/... URLs, which now 404, go to the current docs site. That includes the comment in .envrc files generated by devbox generate direnv and the VS Code extension's WSL warning, by @mikeland73 (#2848)

🧹 Maintenance

• Pinned the Jekyll example's ruby@3.1 back to 3.1.4 to fix a macOS build failure in the nightly test run, by @mikeland73 (#2984)

Full Changelog: 0.18.3...0.18.4

What's Changed

✨ New Features

• Init hooks in "Reopen in Devbox" — devbox integrate vscode gained a --run-init-hook flag that sources your project's init_hook before relaunching the editor, so env vars it exports are present in the reopened window (previously only devbox shell saw them). The VS Code extension (0.1.9) exposes this as an opt-in devbox.runInitHookOnReopen setting; leave it off and older CLIs keep working unchanged. Fixes #2703, by @mikeland73 (#2874, #2975)

🐛 Bug Fixes

• devbox shellenv no longer re-exports your whole environment — only variables Devbox adds or changes are emitted, so eval "$(devbox global shellenv)" no longer fails on distros with read-only shell variables (e.g. PROFILEREAD on openSUSE). Fixes #2826, by @mikeland73 (#2894)
• Nix is detected even when it isn't on $PATH — NixOS and fish users no longer hit "nix binary is not in your PATH" when Nix is installed at a known location; detection now uses the same lookup Devbox already used to run Nix. Fixes #2787, by @mikeland73 (#2903)
• Clear error on Lix ≥ 2.95 — Lix removed builtins.fetchClosure, which Devbox needs for binary-cache installs. Instead of a cryptic attribute 'fetchClosure' missing, Devbox now says it's incompatible and points you at upstream Nix. Fixes #2946, by @mikeland73 (#2949)
• A slow or unreachable cache.nixos.org no longer fails devbox shell/run outright — narinfo lookup errors are treated as a cache miss and Nix builds or substitutes the package as usual, by @mikeland73 (#2973).
• devbox services ls now lists services started with --process-compose-file instead of reporting "No services found". Fixes #2611, by @mikeland73 (#2920).
• Editing a file referenced by a local plugin's create_files now regenerates it on the next devbox shell; the plugin hash includes the file contents, not just plugin.json. Fixes #2755, by @mikeland73 (#2871).
• devbox generate readme lists scripts in the order they appear in devbox.json instead of alphabetically. Fixes #1991, by @mikeland73 (#2875).
• Plugin fixes — Poetry: the in-project .venv is activated in the shell, so console scripts installed by poetry install are on PATH again without poetry run (Fixes #2676, #2958). PHP: the plugin references the flake's php output explicitly so it resolves alongside composer (Fixes #2788, #2900). Nginx: mime.types is created next to nginx.conf so the include resolves and nginx starts (Fixes #2908, #2929). All by @mikeland73.

🧹 Maintenance

• Dependency security updates: Go modules (#2977), the VS Code extension (#2978, #2980), and the example projects (#2979), by @mikeland73.
• Devbox packages refreshed across all projects (#2974), golangci-lint bumped to v2.13.2 (#2976), and explicit permissions added to the release and stale workflows (#2981), by @mikeland73.

Full Changelog: 0.18.2...0.18.3

What's Changed

✨ New Features

• Generated READMEs now document services — devbox generate readme adds a Services section listing the project's services and how to start them, by @mikeland73 (#2934)

🐛 Bug Fixes

• Projects in paths with spaces now work with services — plugin service commands quote their path env vars, so a project directory like ~/My Projects/app no longer breaks devbox services up, by @mikeland73 (#2960)
• Services re-invoke the right devbox — service definitions call back into devbox by its executable path instead of a hardcoded devbox name, so they work when the binary is renamed, run from a build dir, or not on PATH (#1321), by @mikeland73 (#2936)
• Package shell completions work out of the box — the Devbox profile's share dir is added to XDG_DATA_DIRS, so completions shipped by installed packages (e.g. kubectl <TAB>) are picked up by bash-completion (#2776), by @mikeland73 (#2926)
• Multi-line env values no longer break shellenv — eval "$(devbox global shellenv)" failed with ambiguous redirect on every prompt when the shell had a multi-line PROMPT_COMMAND (e.g. via bash-preexec); literal newlines in exported values are now preserved (#2814), by @mikeland73 (#2846)
• SOURCE_DATE_EPOCH no longer leaks into the shell — nixpkgs' fixed 1980 build timestamp was exported into every devbox shell, so Docker images built inside it showed up as created "45 years ago" and tar/gzip output got stale timestamps (#2597), by @mikeland73 (#2935)
• Missing env_from files warn instead of failing — a referenced env file that doesn't exist yet (e.g. a gitignored .env) no longer blocks the shell from starting, by @mikeland73 (#2901)
• Flakes from subdirectories of the same git repo are kept distinct — two packages pointing at different ?dir= paths in one repo no longer collapse into a single input (#2704), by @mikeland73 (#2877)
• devbox update --no-install no longer calls Nix — it only updates the lockfile, as documented (#2585), by @mikeland73 (#2913)
• Nix detection fixes — Nix versions without a patch component (e.g. 2.30) now parse instead of being treated as unparseable (#2924), and a freshly mounted /nix volume in a container (which only contains lost+found) is no longer reported as a broken install and gets Nix installed into it as intended (#2601, #2939), by @mikeland73.
• Node.js plugin warns when Corepack is missing — with DEVBOX_COREPACK_ENABLED set on a Node package that doesn't bundle Corepack (nodejs-slim, Node 25+), you now get a warning pointing at the corepack package instead of a cryptic yarn: command not found later (#2791), by @mikeland73 (#2888)
• devbox generate fixes — the generated dev Dockerfile no longer runs nix-store --optimise, which failed with cannot rename: Stale file handle on Docker's overlay2 driver so the image didn't build out of the box (#2616, #2933), and the generated README uses relative paths for env vars instead of absolute paths from the author's machine (#2865), by @mikeland73.
• Plugin docs — documented the project-root placeholder and corrected the DevboxDirRoot docs, by @mikeland73 (#2895)

🧹 Maintenance

• Docs: devbox run scripts and commands run from the project root (#2948); Go example documents GOPATH/GOROOT and warns against GOPATH=$PWD (#2923), by @mikeland73.
• Release tooling: bump flake.nix to 0.18.2 (#2970), add a claude skills symlink (#2972), and make the release script resume cleanly after a flake bump and not block on an in-progress cli-tests run (#2971), by @mikeland73.

Full Changelog: 0.18.1...0.18.2

• ci: test against Nix 2.35.2 by @mikeland73 in #2955
• feat(release): auto-open the flake bump PR, and fix preflight ordering by @mikeland73 in #2956
• php(plugin): set default session.save_path to devbox sessions dir by @jefft in #2963
• fix(nix): check per-output binary-cache status in InputAddressedPathForOutput (#2921) by @mikeland73 in #2922
• remove excessive comment in Package.InputAddressedPathForOutput by @savil in #2966
• Add Claude Code GitHub Workflow by @mikeland73 in #2968
• chore: bump process-compose from v1.110.0 to v1.116.0 (#2915) by @jefft in #2916
• Add devbox global info command by @humtta in #2959
• examples: bump process-compose flake in remote flakes example to v1.122.0 by @mikeland73 in #2967
• Add readiness_probe to all service plugins, enabling service dependencies (#2915) by @jefft in #2917
• fix(release): stop goreleaser creating a duplicate draft for the same tag by @mikeland73 in #2957
• chore(release): bump flake lastTag to 0.18.1 by @mikeland73 in #2969

Full Changelog: 0.18.0...0.18.1

What's Changed

Remove jetify cloud functionality from devbox. These features are being sunsetted and will no longer work.

💥 Breaking Changes

• The Jetify Nix cache is gone — the devbox cache command tree (upload/copy, configure, credentials, enable, info) is removed, and nix build no longer receives extra substituters. Package lookups now query only the public https://cache.nixos.org. The nightly cache-upload workflow goes with it, by @mikeland73 (#2940)
• Jetify Cloud secrets are gone — the devbox secrets command tree (alias envsec) is removed, along with devbox auth whoami, whose implementation lived there. Projects that still set env_from to jetify-cloud (or the legacy envsec / jetpack-cloud spellings) keep starting: Devbox now warns and skips those secrets instead of failing, so you don't have to edit an existing devbox.json first. Move those secrets into a .env file, by @mikeland73 (#2941)
• devbox global push / pull now require an argument — the no-argument form synced your global profile to Jetify-hosted storage and has been removed. Every source that needs no account still works: push takes a git repo, pull takes a git repo, an http(s) archive, a devbox.json URL, or a local path. Cobra rejects the bare form outright, so the failure is immediate rather than a confusing cloud error, by @mikeland73 (#2942)
• devbox auth is gone — login, logout, and tokens new are removed, along with the browser OAuth flow, the session stored under $XDG_CACHE_HOME/jetify/auth, and the DEVBOX_API_TOKEN exchange. Telemetry no longer reads any token from disk: user_id now derives only from the GITHUB_USER_NAME hash and org_id is dropped. DO_NOT_TRACK and everything else about telemetry is unchanged, by @mikeland73 (#2943)

🐛 Bug Fixes

• The zig example builds on macOS again — zig is now pinned at 0.16.0 (it was pinned at 0.11.0, whose Mach-O linker emits binaries modern dyld refuses to load), and build.zig is migrated to the current root_module API. This test gated the whole release pipeline, by @mikeland73 (#2951)

🧹 Maintenance

• Dropped the dependencies left over from the account features — the AWS SDK v2 modules, envsec, typeid, go-jose, oauth2, heredoc, and tablewriter, by @mikeland73 (#2944)
• Scripted the release flow behind devbox run draft-release / publish-release, which fixes the draft-versus-tag ordering that produced 0.17.5's bare-SHA release notes and broke the Docker build on 0.17.3 and 0.17.5. Also fixes Sentry release naming, prereleases overwriting the Docker latest tag, and a fail-fast test matrix that cancelled every shard when one failed, by @mikeland73 (#2952) and (#2954)

Full Changelog: 0.17.5...0.18.0

Changelog

• be5b810 Revert "fix(direnv): set DEVBOX_SHELL_ENABLED when entering env via shellenv --init-hook" (#2890)

0.0.0-edge.2026-06-25 edge release

What's Changed

✨ New Features

• DEVBOX_CONFIG environment variable — you can now set the --config flag via the DEVBOX_CONFIG env var, making it easier to point devbox at a config in a non-default location without passing the flag on every command, by @mikeland73 (#2838)

🐛 Bug Fixes

• Shells in paths with spaces now work — quoted the shellrc source guard so a ZDOTDIR containing spaces no longer breaks the shell (#2860), and quoted templated hook paths so plugins work when the project directory contains spaces (#2876), by @mikeland73.
• Skip env vars with invalid names instead of breaking the shell, by @mikeland73 (#2883).
• Node.js Corepack fixes — rewrote `setup-corepack` as an ESM `.mjs` module (#2857) and fixed Corepack setup failing in projects with `"type": "module"` (#2873), by @mikeland73.
• `direnv`: set `DEVBOX_SHELL_ENABLED` when entering the env via `shellenv --init-hook`, by @mikeland73 (#2861).
• `devbox generate` now emits fully-qualified `docker.io` images in generated Dockerfiles, by @mikeland73 (#2847).
• Fix indentation in the default `devbox.json` config, by @humtta (#2851).
• Examples: drop the unused `cowboy` dependency from the Elixir example (#2882), and declare the `csv`/`base64`/`logger` gems in the Jekyll example for Ruby 3.4 (#2881), by @mikeland73.

🧹 Maintenance

• Restore the devbox logo, by @humtta (#2852).
• docs: fix broken jetify.com documentation links in the README, by @mikeland73 (#2850).
• Bump `lastTag` to 0.17.3 and update `flake.lock` (#2858); update `devbox.lock` files (#2879), by @mikeland73.
• CI/release pipeline hardening — guard `cli-post-release` on `cli-release` success for the same tag (#2854), reuse the existing draft release in goreleaser (#2855), fix GitHub API 403 rate-limiting by writing access-tokens to the system `nix.conf` (#2884), upgrade GitHub Actions off the deprecated Node.js 20 runtime (#2886), and replace the unmaintained `github-tag-action` with plain `git tag`/`push` (#2887), by @mikeland73.
• Faster CI tests — shard testscripts across runners to speed up `cli-tests` (#2885), use cached GNU hello instead of process-compose in the flakeref test (#2878), and remove the dead nix-version matrix from the `cli-tests` job (#2880), by @mikeland73.

New Contributors

• @humtta made their first contribution in #2852

Full Changelog: 0.17.3...0.17.4

What's Changed

✨ New Features

• Shell aliases in devbox.json — a new top-level aliases map lets you define shell aliases declaratively instead of hand-writing them in your init_hook. They work both in the interactive devbox shell (injected after the init hook, compatible across bash/zsh/fish) and via devbox run <alias>, which expands the alias even without an interactive shell. Aliases merge across plugins and the parent config, with the parent taking precedence. (#2835)
• Automatic Corepack activation for Node.js — when Corepack is enabled, the nodejs plugin reads the packageManager field from your package.json and runs corepack prepare --activate so the pinned pnpm/yarn/npm version is ready in your shell automatically. Opt out with DEVBOX_DISABLE_NODEJS_PACKAGE_MANAGER_AUTODETECT=1. (#2845)
• use-devbox agent skill — adds a skill so AI coding agents can discover a project's devbox environment and run commands inside it. (#2837)

🐛 Bug Fixes

• Fix devbox update not refreshing locked revisions for flake refs, by @Lagoja (#2825)
• nginx plugin now includes mime.types, so static files are served with the correct Content-Type (#2844)
• Bump process-compose version and fix extra stderr output in services (#2832)

🧹 Maintenance

• Fix tests (#2833)
• Refresh README demo screencast for the current devbox experience (#2842)

Full Changelog: 0.17.2...0.17.3

What's new in this release:

• devbox update <pkg> will now only update and install the specified package, instead of reinstalling all your packages
• Updated devbox to Go 1.26.1

Changelog

• 52670c4 Bump lastTag version to 0.17.2 (#2821)
• e3599e6 Bump Go from 1.24.5 to 1.26.1 (#2819)
• 858d3a3 Fix update installing all packages instead of target (#2816)