End of support is planned for end of October 2018, handing over to 18.09.

Platform support: x86_64-linux and x86_64-darwin since release time (the latter isn't NixOS, really). Binaries for aarch64-linux are available, but no channel exists yet, as it's waiting for some test fixes, etc.

Nix now defaults to 2.0; see its release notes.

Core version changes: linux: 4.9 -> 4.14, glibc: 2.25 -> 2.26, gcc: 6 -> 7, systemd: 234 -> 237.

Desktop version changes: gnome: 3.24 -> 3.26, (KDE) plasma-desktop: 5.10 -> 5.12.

MariaDB 10.2, updated from 10.1, is now the default MySQL implementation. While upgrading a few changes have been made to the infrastructure involved:

PHP now defaults to PHP 7.2, updated from 7.1.

./config/krb5/default.nix

./hardware/digitalbitbox.nix

./misc/label.nix

./programs/ccache.nix

./programs/criu.nix

./programs/digitalbitbox/default.nix

./programs/less.nix

./programs/npm.nix

./programs/plotinus.nix

./programs/rootston.nix

./programs/systemtap.nix

./programs/sway.nix

./programs/udevil.nix

./programs/way-cooler.nix

./programs/yabar.nix

./programs/zsh/zsh-autoenv.nix

./services/backup/borgbackup.nix

./services/backup/crashplan-small-business.nix

./services/desktops/dleyna-renderer.nix

./services/desktops/dleyna-server.nix

./services/desktops/pipewire.nix

./services/desktops/gnome3/chrome-gnome-shell.nix

./services/desktops/gnome3/tracker-miners.nix

./services/hardware/fwupd.nix

./services/hardware/interception-tools.nix

./services/hardware/u2f.nix

./services/hardware/usbmuxd.nix

./services/mail/clamsmtp.nix

./services/mail/dkimproxy-out.nix

./services/mail/pfix-srsd.nix

./services/misc/gitea.nix

./services/misc/home-assistant.nix

./services/misc/ihaskell.nix

./services/misc/logkeys.nix

./services/misc/novacomd.nix

./services/misc/osrm.nix

./services/misc/plexpy.nix

./services/misc/pykms.nix

./services/misc/tzupdate.nix

./services/monitoring/fusion-inventory.nix

./services/monitoring/prometheus/exporters.nix

./services/network-filesystems/beegfs.nix

./services/network-filesystems/davfs2.nix

./services/network-filesystems/openafs/client.nix

./services/network-filesystems/openafs/server.nix

./services/network-filesystems/ceph.nix

./services/networking/aria2.nix

./services/networking/monero.nix

./services/networking/nghttpx/default.nix

./services/networking/nixops-dns.nix

./services/networking/rxe.nix

./services/networking/stunnel.nix

./services/web-apps/matomo.nix

./services/web-apps/restya-board.nix

./services/web-servers/mighttpd2.nix

./services/x11/fractalart.nix

./system/boot/binfmt.nix

./system/boot/grow-partition.nix

./tasks/filesystems/ecryptfs.nix

./virtualisation/hyperv-guest.nix

sound.enable now defaults to false.

Dollar signs in options under services.postfix are passed verbatim to Postfix, which will interpret them as the beginning of a parameter expression. This was already true for string-valued options in the previous release, but not for list-valued options. If you need to pass literal dollar signs through Postfix, double them.

The postage package (for web-based PostgreSQL administration) has been renamed to pgmanage. The corresponding module has also been renamed. To migrate please rename all services.postage options to services.pgmanage.

Package attributes starting with a digit have been prefixed with an underscore sign. This is to avoid quoting in the configuration and other issues with command-line tools like nix-env. The change affects the following packages:

The OpenSSH service no longer enables support for DSA keys by default, which could cause a system lock out. Update your keys or, unfavorably, re-enable DSA support manually.

DSA support was deprecated in OpenSSH 7.0, due to it being too weak. To re-enable support, add PubkeyAcceptedKeyTypes +ssh-dss to the end of your services.openssh.extraConfig.

After updating the keys to be stronger, anyone still on a pre-17.03 version is safe to jump to 17.03, as vetted here.

The openssh package now includes Kerberos support by default; the openssh_with_kerberos package is now a deprecated alias. If you do not want Kerberos support, you can do openssh.override { withKerberos = false; }. Note, this also applies to the openssh_hpn package.

cc-wrapper has been split in two; there is now also a bintools-wrapper. The most commonly used files in nix-support are now split between the two wrappers. Some commonly used ones, like nix-support/dynamic-linker, are duplicated for backwards compatability, even though they rightly belong only in bintools-wrapper. Other more obscure ones are just moved.

The propagation logic has been changed. The new logic, along with new types of dependencies that go with, is thoroughly documented in the "Specifying dependencies" section of the "Standard Environment" chapter of the nixpkgs manual. The old logic isn't but is easy to describe: dependencies were propagated as the same type of dependency no matter what. In practice, that means that many propagatedNativeBuildInputs should instead be propagatedBuildInputs. Thankfully, that was and is the least used type of dependency. Also, it means that some propagatedBuildInputs should instead be depsTargetTargetPropagated. Other types dependencies should be unaffected.

lib.addPassthru drv passthru is removed. Use lib.extendDerivation true passthru drv instead.

The memcached service no longer accept dynamic socket paths via services.memcached.socket. Unix sockets can be still enabled by services.memcached.enableUnixSocket and will be accessible at /run/memcached/memcached.sock.

The hardware.amdHybridGraphics.disable option was removed for lack of a maintainer. If you still need this module, you may wish to include a copy of it from an older version of nixos in your imports.

The merging of config options for services.postfix.config was buggy. Previously, if other options in the Postfix module like services.postfix.useSrs were set and the user set config options that were also set by such options, the resulting config wouldn't include all options that were needed. They are now merged correctly. If config options need to be overridden, lib.mkForce or lib.mkOverride can be used.

The following changes apply if the stateVersion is changed to 18.03 or higher. For stateVersion = "17.09" or lower the old behavior is preserved.

The jid package has been removed, due to maintenance overhead of a go package having non-versioned dependencies.

When using services.xserver.libinput (enabled by default in GNOME), it now handles all input devices, not just touchpads. As a result, you might need to re-evaluate any custom Xorg configuration. In particular, Option "XkbRules" "base" may result in broken keyboard layout.

The attic package was removed. A maintained fork called Borg should be used instead. Migration instructions can be found here.

The Piwik analytics software was renamed to Matomo:

nodejs-4_x is end-of-life. nodejs-4_x, nodejs-slim-4_x and nodePackages_4_x are removed.

The pump.io NixOS module was removed. It is now maintained as an external module.

The Prosody XMPP server has received a major update. The following modules were renamed:

Many new modules are now core modules, most notably services.prosody.modules.carbons and services.prosody.modules.mam.

The better-performing libevent backend is now enabled by default.

withCommunityModules now passes through the modules to services.prosody.extraModules. Use withOnlyInstalledCommunityModules for modules that should not be enabled directly, e.g lib_ldap.

All prometheus exporter modules are now defined as submodules. The exporters are configured using services.prometheus.exporters.

ZNC option services.znc.mutable now defaults to true. That means that old configuration is not overwritten by default when update to the znc options are made.

The option networking.wireless.networks.<name>.auth has been added for wireless networks with WPA-Enterprise authentication. There is also a new extraConfig option to directly configure wpa_supplicant and hidden to connect to hidden networks.

In the module networking.interfaces.<name> the following options have been removed:

To assign static addresses to an interface the options ipv4.addresses and ipv6.addresses should be used instead. The options ip4 and ip6 have been renamed to ipv4.addresses ipv6.addresses respectively. The new options ipv4.routes and ipv6.routes have been added to set up static routing.

The option services.logstash.listenAddress is now 127.0.0.1 by default. Previously the default behaviour was to listen on all interfaces.

services.btrfs.autoScrub has been added, to periodically check btrfs filesystems for data corruption. If there's a correct copy available, it will automatically repair corrupted blocks.

displayManager.lightdm.greeters.gtk.clock-format. has been added, the clock format string (as expected by strftime, e.g. %H:%M) to use with the lightdm gtk greeter panel.

If set to null the default clock format is used.

displayManager.lightdm.greeters.gtk.indicators has been added, a list of allowed indicator modules to use with the lightdm gtk greeter panel.

Built-in indicators include ~a11y, ~language, ~session, ~power, ~clock, ~host, ~spacer. Unity indicators can be represented by short name (e.g. sound, power), service file name, or absolute path.

If set to null the default indicators are used.

In order to have the previous default configuration add

  services.xserver.displayManager.lightdm.greeters.gtk.indicators = [
    "~host" "~spacer"
    "~clock" "~spacer"
    "~session"
    "~language"
    "~a11y"
    "~power"
  ];

to your configuration.nix.

The NixOS test driver supports user services declared by systemd.user.services. The methods waitForUnit, getUnitInfo, startJob and stopJob provide an optional $user argument for that purpose.

Enabling bash completion on NixOS, programs.bash.enableCompletion, will now also enable completion for the Nix command line tools by installing the nix-bash-completions package.

The GNOME version is now 3.24. KDE Plasma was upgraded to 5.10, KDE Applications to 17.08.1 and KDE Frameworks to 5.37.

The user handling now keeps track of deallocated UIDs/GIDs. When a user or group is revived, this allows it to be allocated the UID/GID it had before. A consequence is that UIDs and GIDs are no longer reused.

The module option services.xserver.xrandrHeads now causes the first head specified in this list to be set as the primary head. Apart from that, it's now possible to also set additional options by using an attribute set, for example:

{ services.xserver.xrandrHeads = [
    "HDMI-0"
    {
      output = "DVI-0";
      primary = true;
      monitorConfig = ''
        Option "Rotate" "right"
      '';
    }
  ];
}

This will set the DVI-0 output to be the primary head, even though HDMI-0 is the first head in the list.

The handling of SSL in the services.nginx module has been cleaned up, renaming the misnamed enableSSL to onlySSL which reflects its original intention. This is not to be used with the already existing forceSSL which creates a second non-SSL virtual host redirecting to the SSL virtual host. This by chance had worked earlier due to specific implementation details. In case you had specified both please remove the enableSSL option to keep the previous behaviour.

Another addSSL option has been introduced to configure both a non-SSL virtual host and an SSL virtual host with the same configuration.

Options to configure resolver options and upstream blocks have been introduced. See their information for further details.

The port option has been replaced by a more generic listen option which makes it possible to specify multiple addresses, ports and SSL configs dependant on the new SSL handling mentioned above.

config/fonts/fontconfig-penultimate.nix

config/fonts/fontconfig-ultimate.nix

config/terminfo.nix

hardware/sensor/iio.nix

hardware/nitrokey.nix

hardware/raid/hpsa.nix

programs/browserpass.nix

programs/gnupg.nix

programs/qt5ct.nix

programs/slock.nix

programs/thefuck.nix

security/auditd.nix

security/lock-kernel-modules.nix

service-managers/docker.nix

service-managers/trivial.nix

services/admin/salt/master.nix

services/admin/salt/minion.nix

services/audio/slimserver.nix

services/cluster/kubernetes/default.nix

services/cluster/kubernetes/dns.nix

services/cluster/kubernetes/dashboard.nix

services/continuous-integration/hail.nix

services/databases/clickhouse.nix

services/databases/postage.nix

services/desktops/gnome3/gnome-disks.nix

services/desktops/gnome3/gpaste.nix

services/logging/SystemdJournal2Gelf.nix

services/logging/heartbeat.nix

services/logging/journalwatch.nix

services/logging/syslogd.nix

services/mail/mailhog.nix

services/mail/nullmailer.nix

services/misc/airsonic.nix

services/misc/autorandr.nix

services/misc/exhibitor.nix

services/misc/fstrim.nix

services/misc/gollum.nix

services/misc/irkerd.nix

services/misc/jackett.nix

services/misc/radarr.nix

services/misc/snapper.nix

services/monitoring/osquery.nix

services/monitoring/prometheus/collectd-exporter.nix

services/monitoring/prometheus/fritzbox-exporter.nix

services/network-filesystems/kbfs.nix

services/networking/dnscache.nix

services/networking/fireqos.nix

services/networking/iwd.nix

services/networking/keepalived/default.nix

services/networking/keybase.nix

services/networking/lldpd.nix

services/networking/matterbridge.nix

services/networking/squid.nix

services/networking/tinydns.nix

services/networking/xrdp.nix

services/security/shibboleth-sp.nix

services/security/sks.nix

services/security/sshguard.nix

services/security/torify.nix

services/security/usbguard.nix

services/security/vault.nix

services/system/earlyoom.nix

services/system/saslauthd.nix

services/web-apps/nexus.nix

services/web-apps/pgpkeyserver-lite.nix

services/web-apps/piwik.nix

services/web-servers/lighttpd/collectd.nix

services/web-servers/minio.nix

services/x11/display-managers/xpra.nix

services/x11/xautolock.nix

tasks/filesystems/bcachefs.nix

tasks/powertop.nix

In an Qemu-based virtualization environment, the network interface names changed from i.e. enp0s3 to ens3.

This is due to a kernel configuration change. The new naming is consistent with those of other Linux distributions with systemd. See #29197 for more information.

A machine is affected if the virt-what tool either returns qemu or kvm and has interface names used in any part of its NixOS configuration, in particular if a static network configuration with networking.interfaces is used.

Before rebooting affected machines, please ensure:

The following changes apply if the stateVersion is changed to 17.09 or higher. For stateVersion = "17.03" or lower the old behavior is preserved.

The aiccu package was removed. This is due to SixXS sunsetting its IPv6 tunnel.

The fanctl package and fan module have been removed due to the developers not upstreaming their iproute2 patches and lagging with compatibility to recent iproute2 versions.

Top-level idea package collection was renamed. All JetBrains IDEs are now at jetbrains.

flexget's state database cannot be upgraded to its new internal format, requiring removal of any existing db-config.sqlite which will be automatically recreated.

The ipfs service now doesn't ignore the dataDir option anymore. If you've ever set this option to anything other than the default you'll have to either unset it (so the default gets used) or migrate the old data manually with

dataDir=<valueOfDataDir>
mv /var/lib/ipfs/.ipfs/* $dataDir
rmdir /var/lib/ipfs/.ipfs

The caddy service was previously using an extra .caddy directory in the data directory specified with the dataDir option. The contents of the .caddy directory are now expected to be in the dataDir.

The ssh-agent user service is not started by default anymore. Use programs.ssh.startAgent to enable it if needed. There is also a new programs.gnupg.agent module that creates a gpg-agent user service. It can also serve as a SSH agent if enableSSHSupport is set.

The services.tinc.networks.<name>.listenAddress option had a misleading name that did not correspond to its behavior. It now correctly defines the ip to listen for incoming connections on. To keep the previous behaviour, use services.tinc.networks.<name>.bindToAddress instead. Refer to the description of the options for more details.

tlsdate package and module were removed. This is due to the project being dead and not building with openssl 1.1.

wvdial package and module were removed. This is due to the project being dead and not building with openssl 1.1.

cc-wrapper's setup-hook now exports a number of environment variables corresponding to binutils binaries, (e.g. LD, STRIP, RANLIB, etc). This is done to prevent packages' build systems guessing, which is harder to predict, especially when cross-compiling. However, some packages have broken due to this—their build systems either not supporting, or claiming to support without adequate testing, taking such environment variables as parameters.

services.firefox.syncserver now runs by default as a non-root user. To accomodate this change, the default sqlite database location has also been changed. Migration should work automatically. Refer to the description of the options for more details.

The compiz window manager and package was removed. The system support had been broken for several years.

Touchpad support should now be enabled through libinput as synaptics is now deprecated. See the option services.xserver.libinput.enable.

grsecurity/PaX support has been dropped, following upstream's decision to cease free support. See upstream's announcement for more information. No complete replacement for grsecurity/PaX is available presently.

services.mysql now has declarative configuration of databases and users with the ensureDatabases and ensureUsers options.

These options will never delete existing databases and users, especially not when the value of the options are changed.

The MySQL users will be identified using Unix socket authentication. This authenticates the Unix user with the same name only, and that without the need for a password.

If you have previously created a MySQL root user with a password, you will need to add root user for unix socket authentication before using the new options. This can be done by running the following SQL script:

CREATE USER 'root'@'%' IDENTIFIED BY '';
GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' WITH GRANT OPTION;
FLUSH PRIVILEGES;

-- Optionally, delete the password-authenticated user:
-- DROP USER 'root'@'localhost';

services.mysqlBackup now works by default without any user setup, including for users other than mysql.

By default, the mysql user is no longer the user which performs the backup. Instead a system account mysqlbackup is used.

The mysqlBackup service is also now using systemd timers instead of cron.

Therefore, the services.mysqlBackup.period option no longer exists, and has been replaced with services.mysqlBackup.calendar, which is in the format of systemd.time(7).

If you expect to be sent an e-mail when the backup fails, consider using a script which monitors the systemd journal for errors. Regretfully, at present there is no built-in functionality for this.

You can check that backups still work by running systemctl start mysql-backup then systemctl status mysql-backup.

Templated systemd services e.g container@name are now handled currectly when switching to a new configuration, resulting in them being reloaded.

Steam: the newStdcpp parameter was removed and should not be needed anymore.

Redis has been updated to version 4 which mandates a cluster mass-restart, due to changes in the network handling, in order to ensure compatibility with networks NATing traffic.

Modules can now be disabled by using disabledModules, allowing another to take it's place. This can be used to import a set of modules from another channel while keeping the rest of the system on a stable release.

Updated to FreeType 2.7.1, including a new TrueType engine. The new engine replaces the Infinality engine which was the default in NixOS. The default font rendering settings are now provided by fontconfig-penultimate, replacing fontconfig-ultimate; the new defaults are less invasive and provide rendering that is more consistent with other systems and hopefully with each font designer's intent. Some system-wide configuration has been removed from the Fontconfig NixOS module where user Fontconfig settings are available.

ZFS/SPL have been updated to 0.7.0, zfsUnstable, splUnstable have therefore been removed.

The time.timeZone option now allows the value null in addition to timezone strings. This value allows changing the timezone of a system imperatively using timedatectl set-timezone. The default timezone is still UTC.

Nixpkgs overlays may now be specified with a file as well as a directory. The value of <nixpkgs-overlays> may be a file, and ~/.config/nixpkgs/overlays.nix can be used instead of the ~/.config/nixpkgs/overlays directory.

See the overlays chapter of the Nixpkgs manual for more details.

Definitions for /etc/hosts can now be specified declaratively with networking.hosts.

Two new options have been added to the installer loader, in addition to the default having changed. The kernel log verbosity has been lowered to the upstream default for the default options, in order to not spam the console when e.g. joining a network.

This therefore leads to adding a new debug option to set the log level to the previous verbose mode, to make debugging easier, but still accessible easily.

Additionally a copytoram option has been added, which makes it possible to remove the install medium after booting. This allows tethering from your phone after booting from it.

services.gitlab-runner.configOptions has been added to specify the configuration of gitlab-runners declaratively.

services.jenkins.plugins has been added to install plugins easily, this can be generated with jenkinsPlugins2nix.

services.postfix.config has been added to specify the main.cf with NixOS options. Additionally other options have been added to the postfix module and has been improved further.

The GitLab package and module have been updated to the latest 10.0 release.

The systemd-boot boot loader now lists the NixOS version, kernel version and build date of all bootable generations.

The dnscrypt-proxy service now defaults to using a random upstream resolver, selected from the list of public non-logging resolvers with DNSSEC support. Existing configurations can be migrated to this mode of operation by omitting the services.dnscrypt-proxy.resolverName option or setting it to "random".

Nixpkgs is now extensible through overlays. See the Nixpkgs manual for more information.

This release is based on Glibc 2.25, GCC 5.4.0 and systemd 232. The default Linux kernel is 4.9 and Nix is at 1.11.8.

The default desktop environment now is KDE's Plasma 5. KDE 4 has been removed

The setuid wrapper functionality now supports setting capabilities.

X.org server uses branch 1.19. Due to ABI incompatibilities, ati_unfree keeps forcing 1.17 and amdgpu-pro starts forcing 1.18.

Cross compilation has been rewritten. See the nixpkgs manual for details. The most obvious breaking change is that in derivations there is no .nativeDrv nor .crossDrv are now cross by default, not native.

The overridePackages function has been rewritten to be replaced by overlays

Packages in nixpkgs can be marked as insecure through listed vulnerabilities. See the Nixpkgs manual for more information.

PHP now defaults to PHP 7.1

hardware/ckb.nix

hardware/mcelog.nix

hardware/usb-wwan.nix

hardware/video/capture/mwprocapture.nix

programs/adb.nix

programs/chromium.nix

programs/gphoto2.nix

programs/java.nix

programs/mtr.nix

programs/oblogout.nix

programs/vim.nix

programs/wireshark.nix

security/dhparams.nix

services/audio/ympd.nix

services/computing/boinc/client.nix

services/continuous-integration/buildbot/master.nix

services/continuous-integration/buildbot/worker.nix

services/continuous-integration/gitlab-runner.nix

services/databases/riak-cs.nix

services/databases/stanchion.nix

services/desktops/gnome3/gnome-terminal-server.nix

services/editors/infinoted.nix

services/hardware/illum.nix

services/hardware/trezord.nix

services/logging/journalbeat.nix

services/mail/offlineimap.nix

services/mail/postgrey.nix

services/misc/couchpotato.nix

services/misc/docker-registry.nix

services/misc/errbot.nix

services/misc/geoip-updater.nix

services/misc/gogs.nix

services/misc/leaps.nix

services/misc/nix-optimise.nix

services/misc/ssm-agent.nix

services/misc/sssd.nix

services/monitoring/arbtt.nix

services/monitoring/netdata.nix

services/monitoring/prometheus/default.nix

services/monitoring/prometheus/alertmanager.nix

services/monitoring/prometheus/blackbox-exporter.nix

services/monitoring/prometheus/json-exporter.nix

services/monitoring/prometheus/nginx-exporter.nix

services/monitoring/prometheus/node-exporter.nix

services/monitoring/prometheus/snmp-exporter.nix

services/monitoring/prometheus/unifi-exporter.nix

services/monitoring/prometheus/varnish-exporter.nix

services/monitoring/sysstat.nix

services/monitoring/telegraf.nix

services/monitoring/vnstat.nix

services/network-filesystems/cachefilesd.nix

services/network-filesystems/glusterfs.nix

services/network-filesystems/ipfs.nix

services/networking/dante.nix

services/networking/dnscrypt-wrapper.nix

services/networking/fakeroute.nix

services/networking/flannel.nix

services/networking/htpdate.nix

services/networking/miredo.nix

services/networking/nftables.nix

services/networking/powerdns.nix

services/networking/pdns-recursor.nix

services/networking/quagga.nix

services/networking/redsocks.nix

services/networking/wireguard.nix

services/system/cgmanager.nix

services/torrent/opentracker.nix

services/web-apps/atlassian/confluence.nix

services/web-apps/atlassian/crowd.nix

services/web-apps/atlassian/jira.nix

services/web-apps/frab.nix

services/web-apps/nixbot.nix

services/web-apps/selfoss.nix

services/web-apps/quassel-webserver.nix

services/x11/unclutter-xfixes.nix

services/x11/urxvtd.nix

system/boot/systemd-nspawn.nix

virtualisation/ecs-agent.nix

virtualisation/lxcfs.nix

virtualisation/openstack/keystone.nix

virtualisation/openstack/glance.nix

Derivations have no .nativeDrv nor .crossDrv and are now cross by default, not native.

stdenv.overrides is now expected to take self and super arguments. See lib.trivial.extends for what those parameters represent.

ansible now defaults to ansible version 2 as version 1 has been removed due to a serious vulnerability unpatched by upstream.

gnome alias has been removed along with gtk, gtkmm and several others. Now you need to use versioned attributes, like gnome3.

The attribute name of the Radicale daemon has been changed from pythonPackages.radicale to radicale.

The stripHash bash function in stdenv changed according to its documentation; it now outputs the stripped name to stdout instead of putting it in the variable strippedName.

PHP now scans for extra configuration .ini files in /etc/php.d instead of /etc. This prevents accidentally loading non-PHP .ini files that may be in /etc.

Two lone top-level dict dbs moved into dictdDBs. This affects: dictdWordnet which is now at dictdDBs.wordnet and dictdWiktionary which is now at dictdDBs.wiktionary

Parsoid service now uses YAML configuration format. service.parsoid.interwikis is now called service.parsoid.wikis and is a list of either API URLs or attribute sets as specified in parsoid's documentation.

Ntpd was replaced by systemd-timesyncd as the default service to synchronize system time with a remote NTP server. The old behavior can be restored by setting services.ntp.enable to true. Upstream time servers for all NTP implementations are now configured using networking.timeServers.

service.nylon is now declared using named instances. As an example:

  services.nylon = {
    enable = true;
    acceptInterface = "br0";
    bindInterface = "tun1";
    port = 5912;
  };

should be replaced with:

  services.nylon.myvpn = {
    enable = true;
    acceptInterface = "br0";
    bindInterface = "tun1";
    port = 5912;
  };

this enables you to declare a SOCKS proxy for each uplink.

overridePackages function no longer exists. It is replaced by overlays. For example, the following code:

  let
    pkgs = import <nixpkgs> {};
  in
    pkgs.overridePackages (self: super: ...)

should be replaced by:

  let
    pkgs = import <nixpkgs> {};
  in
    import pkgs.path { overlays = [(self: super: ...)]; }

Autoloading connection tracking helpers is now disabled by default. This default was also changed in the Linux kernel and is considered insecure if not configured properly in your firewall. If you need connection tracking helpers (i.e. for active FTP) please enable networking.firewall.autoLoadConntrackHelpers and tune networking.firewall.connectionTrackingModules to suit your needs.

local_recipient_maps is not set to empty value by Postfix service. It's an insecure default as stated by Postfix documentation. Those who want to retain this setting need to set it via services.postfix.extraConfig.

Iputils no longer provide ping6 and traceroute6. The functionality of these tools has been integrated into ping and traceroute respectively. To enforce an address family the new flags -4 and -6 have been added. One notable incompatibility is that specifying an interface (for link-local IPv6 for instance) is no longer done with the -I flag, but by encoding the interface into the address (ping fe80::1%eth0).

The socket handling of the services.rmilter module has been fixed and refactored. As rmilter doesn't support binding to more than one socket, the options bindUnixSockets and bindInetSockets have been replaced by services.rmilter.bindSocket.*. The default is still a unix socket in /run/rmilter/rmilter.sock. Refer to the options documentation for more information.

The fetch* functions no longer support md5, please use sha256 instead.

The dnscrypt-proxy module interface has been streamlined around the extraArgs option. Where possible, legacy option declarations are mapped to extraArgs but will emit warnings. The resolverList has been outright removed: to use an unlisted resolver, use the customResolver option.

torbrowser now stores local state under ~/.local/share/tor-browser by default. Any browser profile data from the old location, ~/.torbrowser4, must be migrated manually.

The ihaskell, monetdb, offlineimap and sitecopy services have been removed.

Module type system have a new extensible option types feature that allow to extend certain types, such as enum, through multiple option declarations of the same option across multiple modules.

jre now defaults to GTK+ UI by default. This improves visual consistency and makes Java follow system font style, improving the situation on HighDPI displays. This has a cost of increased closure size; for server and other headless workloads it's recommended to use jre_headless.

Python 2.6 interpreter and package set have been removed.

The Python 2.7 interpreter does not use modules anymore. Instead, all CPython interpreters now include the whole standard library except for `tkinter`, which is available in the Python package set.

Python 2.7, 3.5 and 3.6 are now built deterministically and 3.4 mostly. Minor modifications had to be made to the interpreters in order to generate deterministic bytecode. This has security implications and is relevant for those using Python in a nix-shell. See the Nixpkgs manual for details.

The Python package sets now use a fixed-point combinator and the sets are available as attributes of the interpreters.

The Python function buildPythonPackage has been improved and can be used to build from Setuptools source, Flit source, and precompiled Wheels.

When adding new or updating current Python libraries, the expressions should be put in separate files in pkgs/development/python-modules and called from python-packages.nix.

The dnscrypt-proxy service supports synchronizing the list of public resolvers without working DNS resolution. This fixes issues caused by the resolver list becoming outdated. It also improves the viability of DNSCrypt only configurations.

Containers using bridged networking no longer lose their connection after changes to the host networking.

ZFS supports pool auto scrubbing.

The bind DNS utilities (e.g. dig) have been split into their own output and are now also available in pkgs.dnsutils and it is no longer necessary to pull in all of bind to use them.

Per-user configuration was moved from ~/.nixpkgs to ~/.config/nixpkgs. The former is still valid for config.nix for backwards compatibility.