nixpkgs/nixos/doc/manual/release-notes/rl-1609.xml

<section xmlns="http://docbook.org/ns/docbook"
         xmlns:xlink="http://www.w3.org/1999/xlink"
         xmlns:xi="http://www.w3.org/2001/XInclude"
         version="5.0"
         xml:id="sec-release-16.09">

<title>Release 16.09 (“Flounder”, 2016/09/??)</title>

<para>In addition to numerous new and upgraded packages, this release
has the following highlights: </para>

<itemizedlist>

  <listitem>
    <para>PXE "netboot" media has landed in <link xlink:href="https://github.com/NixOS/nixpkgs/pull/14740" />.
    See <xref linkend="sec-booting-from-pxe" /> for documentation.</para>
  </listitem>

  <listitem>
    <para>Xorg-server-1.18.*. If you choose <literal>"ati_unfree"</literal> driver,
    1.17.* is still used due to ABI incompatibility.</para>
  </listitem>
</itemizedlist>

<para>The following new services were added since the last release:</para>

  <itemizedlist>
    <listitem><para><literal>(this will get automatically generated at release time)</literal></para></listitem>
  </itemizedlist>


<para>When upgrading from a previous release, please be aware of the
following incompatible changes:</para>

<itemizedlist>

  <listitem>
    <para>A large number of packages have been converted to use the multiple outputs feature
      of Nix to greatly reduce the amount of required disk space. This may require changes
      to any custom packages to make them build again; see the relevant chapter in the
      Nixpkgs manual for more information. (Additional caveat to packagers: some packaging conventions
      related to multiple-output packages
      <link xlink:href="https://github.com/NixOS/nixpkgs/pull/14766">were changed</link>
      late (August 2016) in the release cycle and differ from the initial introduction of multiple outputs.)
    </para>
  </listitem>

  <listitem>
    <para>Shell aliases for systemd sub-commands
    <link xlink:href="https://github.com/NixOS/nixpkgs/pull/15598">were dropped</link>:
    <command>start</command>, <command>stop</command>,
    <command>restart</command>, <command>status</command>.</para>
  </listitem>

  <listitem>
    <para>Redis now binds to 127.0.0.1 only instead of listening to all network interfaces. This is the default
    behavior of Redis 3.2</para>
  </listitem>

  <listitem>
    <para>/var/setuid-wrappers/
      <link xlink:href="https://github.com/NixOS/nixpkgs/pull/18124">is now a symlink so
      it can be atomically updated</link>
      and it's not mounted as tmpfs anymore since setuid binaries are located on /run/ as tmpfs.
    </para>
  </listitem>

  <listitem>
    <para>Gitlab's maintainence script gitlab-runner was removed and split up into the more clearer
      gitlab-run and gitlab-rake scripts because gitlab-runner is a component of Gitlab CI.</para>
  </listitem>

  <listitem>
    <para><literal>services.xserver.libinput.accelProfile</literal> default
    changed from <literal>flat</literal> to <literal>adaptive</literal>,
    as per <link xlink:href="https://wayland.freedesktop.org/libinput/doc/latest/group__config.html#gad63796972347f318b180e322e35cee79">
    official documentation</link>.</para>
  </listitem>

  <listitem>
    <para><literal>fonts.fontconfig.ultimate.rendering</literal> was removed
    because our presets were obsolete for some time. New presets are hardcoded
    into freetype; one selects a preset via <literal>fonts.fontconfig.ultimate.preset</literal>.
    You can customize those presets via ordinary environment variables, using
    <literal>environment.variables</literal>.</para>
  </listitem>

  <listitem>
    <para>The <literal>audit</literal> service is no longer enabled by default.
    Use <literal>security.audit.enable = true;</literal> to explicitly enable it.</para>
  </listitem>

  <listitem>
    <para>
      <literal>pkgs.linuxPackages.virtualbox</literal> now contains only the
      kernel modules instead of the VirtualBox user space binaries.
      If you want to reference the user space binaries, you have to use the new
      <literal>pkgs.virtualbox</literal> instead.
    </para>
  </listitem>

  <listitem>
    <para><literal>goPackages</literal> was replaced with separated Go applications
    in appropriate <literal>nixpkgs</literal> categories. Each Go package uses its own
    dependency set defined in nix. There's also a new <literal>go2nix</literal>
    tool introduced to generate Go package definition from its Go source automatically.</para>
  </listitem>

</itemizedlist>


<para>Other notable improvements:</para>

<itemizedlist>

  <listitem><para>Revamped grsecurity/PaX support.  There is now only a single
  general-purpose distribution kernel and the configuration interface has been
  streamlined.  Desktop users should be able to simply set
  <programlisting>security.grsecurity.enable = true</programlisting> to get
  a reasonably secure system without having to sacrifice too much
  functionality.  See <xref linkend="sec-grsecurity" /> for documentation
  </para></listitem>

  <listitem><para>Special filesystems, like <literal>/proc</literal>,
  <literal>/run</literal> and others, now have the same mount options as
  recommended by systemd. They are now unified across different places in NixOS.
  Options are also updated on the system switch if possible. One benefit from
  this is improved security -- most such filesystems are now mounted with
  <literal>noexec</literal>, <literal>nodev</literal> and/or
  <literal>nosuid</literal> options.</para></listitem>

  <listitem><para>The reverse path filter was interfering with DHCPv4 server
  operation in the past. An exception for DHCPv4 and a new option to log
  packets that were dropped due to the reverse path filter was added
  (<literal>networking.firewall.logReversePathDrops</literal>) for easier
  debugging.</para></listitem>

</itemizedlist>


</section>