- `wvdial` package and module were removed. This is due to the project being dead and not building with openssl 1.1.

- `cc-wrapper`'s setup-hook now exports a number of environment variables corresponding to binutils binaries, (e.g. `LD`, `STRIP`, `RANLIB`, etc). This is done to prevent packages' build systems guessing, which is harder to predict, especially when cross-compiling. However, some packages have broken due to this---their build systems either not supporting, or claiming to support without adequate testing, taking such environment variables as parameters.

- `services.firefox.syncserver` now runs by default as a non-root user. To accommodate this change, the default sqlite database location has also been changed. Migration should work automatically. Refer to the description of the options for more details.

- The `compiz` window manager and package was removed. The system support had been broken for several years.

- Touchpad support should now be enabled through `libinput` as `synaptics` is now deprecated. See the option `services.xserver.libinput.enable`.

- grsecurity/PaX support has been dropped, following upstream's decision to cease free support. See [ upstream's announcement](https://grsecurity.net/passing_the_baton.php) for more information. No complete replacement for grsecurity/PaX is available presently.

- `services.mysql` now has declarative configuration of databases and users with the `ensureDatabases` and `ensureUsers` options.

  These options will never delete existing databases and users, especially not when the value of the options are changed.

  The MySQL users will be identified using [ Unix socket authentication](https://mariadb.com/kb/en/library/authentication-plugin-unix-socket/). This authenticates the Unix user with the same name only, and that without the need for a password.

  If you have previously created a MySQL `root` user _with a password_, you will need to add `root` user for unix socket authentication before using the new options. This can be done by running the following SQL script:

  ```SQL
  CREATE USER 'root'@'%' IDENTIFIED BY '';
  GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' WITH GRANT OPTION;
  FLUSH PRIVILEGES;

  -- Optionally, delete the password-authenticated user:
  -- DROP USER 'root'@'localhost';
  ```

- `services.mysqlBackup` now works by default without any user setup, including for users other than `mysql`.

  By default, the `mysql` user is no longer the user which performs the backup. Instead a system account `mysqlbackup` is used.

  The `mysqlBackup` service is also now using systemd timers instead of `cron`.

  Therefore, the `services.mysqlBackup.period` option no longer exists, and has been replaced with `services.mysqlBackup.calendar`, which is in the format of [systemd.time(7)](https://www.freedesktop.org/software/systemd/man/systemd.time.html#Calendar%20Events).

  If you expect to be sent an e-mail when the backup fails, consider using a script which monitors the systemd journal for errors. Regretfully, at present there is no built-in functionality for this.

  You can check that backups still work by running `systemctl start mysql-backup` then `systemctl status mysql-backup`.

- Templated systemd services e.g `container@name` are now handled correctly when switching to a new configuration, resulting in them being reloaded.

- Steam: the `newStdcpp` parameter was removed and should not be needed anymore.