In addition to numerous new and upgraded packages, this release has the following highlights: Nixpkgs is now extensible through overlays. See the Nixpkgs manual for more information. The setuid wrapper functionality now supports setting capabilities. X.org server uses branch 1.19. Due to ABI incompatibilities, ati_unfree keeps forcing 1.17 and amdgpu-pro starts forcing 1.18. PHP now defaults to PHP 7.1 Packages in nixpkgs can be marked as insecure through listed vulnerabilities. See the Nixpkgs manual for more information. The following new services were added since the last release: When upgrading from a previous release, please be aware of the following incompatible changes: Cross compilation has been rewritten. See the nixpkgs manual for details. The most obvious breaking change is that derivations absent a .nativeDrv or .crossDrv are now cross by default, not native. stdenv.overrides is now expected to take self and super arguments. See lib.trivial.extends for what those parameters represent. ansible now defaults to ansible version 2 as version 1 has been removed due to a serious vulnerability unpatched by upstream. gnome alias has been removed along with gtk, gtkmm and several others. Now you need to use versioned attributes, like gnome3. The attribute name of the Radicale daemon has been changed from pythonPackages.radicale to radicale. The stripHash bash function in stdenv changed according to its documentation; it now outputs the stripped name to stdout instead of putting it in the variable strippedName. PHP now scans for extra configuration .ini files in /etc/php.d instead of /etc. This prevents accidentally loading non-PHP .ini files that may be in /etc. Two lone top-level dict dbs moved into dictdDBs. This affects: dictdWordnet which is now at dictdDBs.wordnet and dictdWiktionary which is now at dictdDBs.wiktionary Parsoid service now uses YAML configuration format. service.parsoid.interwikis is now called service.parsoid.wikis and is a list of either API URLs or attribute sets as specified in parsoid's documentation. Ntpd was replaced by systemd-timesyncd as the default service to synchronize system time with a remote NTP server. The old behavior can be restored by setting services.ntp.enable to true. Upstream time servers for all NTP implementations are now configured using networking.timeServers. service.nylon is now declared using named instances. As an example: services.nylon = { enable = true; acceptInterface = "br0"; bindInterface = "tun1"; port = 5912; }; should be replaced with: services.nylon.myvpn = { enable = true; acceptInterface = "br0"; bindInterface = "tun1"; port = 5912; }; this enables you to declare a SOCKS proxy for each uplink. overridePackages function no longer exists. It is replaced by overlays. For example, the following code: let pkgs = import <nixpkgs> {}; in pkgs.overridePackages (self: super: ...) should be replaced by: let pkgs = import <nixpkgs> {}; in import pkgs.path { overlays = [(self: super: ...)] } Autoloading connection tracking helpers is now disabled by default. This default was also changed in the Linux kernel and is considered insecure if not configured properly in your firewall. If you need connection tracking helpers (i.e. for active FTP) please enable networking.firewall.autoLoadConntrackHelpers and tune networking.firewall.connectionTrackingModules to suit your needs. local_recipient_maps is not set to empty value by Postfix service. It's an insecure default as stated by Postfix documentation. Those who want to retain this setting need to set it via services.postfix.extraConfig. Iputils no longer provide ping6 and traceroute6. The functionality of these tools have been integrated into ping and traceroute respectively. To enforce an address family the new flags -4 and -6 have been added. One notable incompatibility is that specifying an interface (for link-local IPv6 for instance) is no longer done with the -I flag, but by encoding the interface into the address (ping fe80::1%eth0). The socket handling of the services.rmilter module has been fixed and refactored. As rmilter doesn't support binding to more than one socket, the options bindUnixSockets and bindInetSockets have been replaced by services.rmilter.bindSocket.*. The default is still a unix socket in /run/rmilter/rmilter.sock. Refer to the options documentation for more information. The fetch* functions no longer support md5, please use sha256 instead. Other notable changes: Module type system have a new extensible option types feature that allow to extend certain types, such as enum, through multiple option declarations of the same option across multiple modules. jre now defaults to GTK+ UI by default. This improves visual consistency and makes Java follow system font style, improving the situation on HighDPI displays. This has a cost of increased closure size; for server and other headless workloads it's recommended to use jre_headless. Python 2.6 interpreter and package set have been removed. The Python 2.7 interpreter does not use modules anymore. Instead, all CPython interpreters now include the whole standard library except for `tkinter`, which is available in the Python package set. Python 2.7, 3.5 and 3.6 are now built deterministically and 3.4 mostly. Minor modifications had to be made to the interpreters in order to generate deterministic bytecode. This has security implications and is relevant for those using Python in a nix-shell. See the Nixpkgs manual for details. The Python package sets now use a fixed-point combinator and the sets are available as attributes of the interpreters. The Python function `buildPythonPackage` has been improved and can be used to build from Setuptools source, Flit source, and precompiled Wheels. When adding new or updating current Python libraries, the expressions should be put in separate files in pkgs/development/python-modules and called from python-packages.nix.