# Workflow: bump a version

Goal: update a package to a newer upstream version.

1. **Check what's current:**
   ```
   curl 'https://solnix.io/api/v1/packages/<attr>'
   ```
2. **Edit the recipe row** (`conventions/recipe-schema.md`): new `version`, `url`,
   and `sha256`. Leave `out` for the build to fill.
3. **Mind dependency chains.** Toolchain-adjacent packages (e.g. Rust) are built
   through a **stage chain** (seed → stage → wrapper). Bump the stage first, then
   the wrapper; a wrapper that references the stage as a bare string (not a real
   Nix reference) will be rejected — see `conventions/recipe-schema.md`.
4. **Rebuild dependents if needed.** If the bump changes an interface, dependents
   must rebuild. The rebuild queue carries reasons like `upstream-newer`,
   `dep-rebuilt`.
5. **Send the patch** to `hackers@` (signed), build reproducibly, submit
   (`workflows/submit-a-package.md`).
6. **For a security bump**, use the CVE lane instead — `workflows/report-a-cve.md`.

High-blast-radius bumps (stdenv, seed, compiler) need an **owner quorum**, not a
single approval (see `steering/email-patch-governance.md`).