In addition to numerous new and upgraded packages, this release has the following highlights:

The following new services were added since the last release:

When upgrading from a previous release, please be aware of the following incompatible changes: Dollar signs in options under services.postfix are passed verbatim to Postfix, which will interpret them as the beginning of a parameter expression. This was already true for string-valued options in the previous release, but not for list-valued options. If you need to pass literal dollar signs through Postfix, double them. The postage package (for web-based PostgreSQL administration) has been renamed to pgmanage. The corresponding module has also been renamed. To migrate please rename all services.postage options to services.pgmanage. The OpenSSH service no longer enables support for DSA keys by default, which could cause a system lock out. Update your keys or, unfavorably, re-enable DSA support manually. DSA support was deprecated in OpenSSH 7.0, due to it being too weak. To re-enable support, add PubkeyAcceptedKeyTypes +ssh-dss to the end of your services.openssh.extraConfig. After updating the keys to be stronger, anyone still on a pre-17.03 version is safe to jump to 17.03, as vetted here. cc-wrapperhas been split in two; there is now also a bintools-wrapper. The most commonly used files in nix-support are now split between the two wrappers. Some commonly used ones, like nix-support/dynamic-linker, are duplicated for backwards compatability, even though they rightly belong only in bintools-wrapper. Other more obscure ones are just moved.

ZNC option services.znc.mutable now defaults to true. That means that old configuration is not overwritten by default when update to the znc options are made. The option networking.wireless.networks.<name>.auth has been added for wireless networks with WPA-Enterprise authentication. There is also a new extraConfig option to directly configure wpa_supplicant and hidden to connect to hidden networks. The option services.xserver.desktopManager.default is now none by default. An assertion failure is thrown if WM's and DM's default are none. To explicitly run a plain X session without and DM or WM, the newly introduced option services.xserver.plainX must be set to true. The option services.logstash.listenAddress is now 127.0.0.1 by default. Previously the default behaviour was to listen on all interfaces. services.btrfs.autoScrub has been added, to periodically check btrfs filesystems for data corruption. If there's a correct copy available, it will automatically repair corrupted blocks.