Release 21.11 ("Porcupine") Highlights

# Release 21.11 (“Porcupine”, 2021/11/30) {#sec-release-21.11} - Support is planned until the end of June 2022, handing over to 22.05. ## Highlights {#sec-release-21.11-highlights} In addition to numerous new and upgraded packages, this release has the following highlights: - Nix has been updated to version 2.4, reference its [release notes](https://discourse.nixos.org/t/nix-2-4-released/15822) for more information on what has changed. The previous version of Nix, 2.3.16, remains available for the time being in the `nix_2_3` package. - `iptables` is now using `nf_tables` under the hood, by using `iptables-nft`, similar to [Debian](https://wiki.debian.org/nftables#Current_status) and [Fedora](https://fedoraproject.org/wiki/Changes/iptables-nft-default). This means, `ip[6]tables`, `arptables` and `ebtables` commands will actually show rules from some specific tables in the `nf_tables` kernel subsystem. In case you're migrating from an older release without rebooting, there might be cases where you end up with iptable rules configured both in the legacy `iptables` kernel backend, as well as in the `nf_tables` backend. This can lead to confusing firewall behaviour. An `iptables-save` after switching will complain about "iptables-legacy tables present". It's probably best to reboot after the upgrade, or manually removing all legacy iptables rules (via the `iptables-legacy` package). - systemd got an `nftables` backend, and configures (networkd) rules in their own `io.systemd.*` tables. Check `nft list ruleset` to see these rules, not `iptables-save` (which only shows `iptables`-created rules. - PHP now defaults to PHP 8.0, updated from 7.4. - kops now defaults to 1.21.1, which uses containerd as the default runtime. - `python3` now defaults to Python 3.9, updated from Python 3.8. - PostgreSQL now defaults to major version 13. - spark now defaults to spark 3, updated from 2. A [migration guide](https://spark.apache.org/docs/latest/core-migration-guide.html#upgrading-from-core-24-to-30) is available. - Improvements have been made to the Hadoop module and package: - HDFS and YARN now support production-ready highly available deployments with automatic failover. - Hadoop now defaults to Hadoop 3, updated from 2. - JournalNode, ZKFS and HTTPFS services have been added. - Activation scripts can now, optionally, be run during a `nixos-rebuild dry-activate` and can detect the dry activation by reading `$NIXOS_ACTION`. This allows activation scripts to output what they would change if the activation was really run. The users/modules activation script supports this and outputs some of is actions. - KDE Plasma now finally works on Wayland. - bash now defaults to major version 5. - Systemd was updated to version 249 (from 247). - Pantheon desktop has been updated to version 6. Due to changes of screen locker, if locking doesn't work for you, please try `gsettings set org.gnome.desktop.lockdown disable-lock-screen false`. - `kubernetes-helm` now defaults to 3.7.0, which introduced some breaking changes to the experimental OCI manifest format. See [HIP 6](https://github.com/helm/community/blob/main/hips/hip-0006.md) for more details. `helmfile` also defaults to 0.141.0, which is the minimum compatible version. - GNOME has been upgraded to 41. Please take a look at their [Release Notes](https://help.gnome.org/misc/release-notes/41.0/) for details. - LXD support was greatly improved: - building LXD images from configurations is now directly possible with just nixpkgs - hydra is now building nixOS LXD images that can be used standalone with full nixos-rebuild support - OpenSSH was updated to version 8.8p1 - This breaks connections to old SSH daemons as ssh-rsa host keys and ssh-rsa public keys that were signed with SHA-1 are disabled by default now - These can be re-enabled, see the [OpenSSH changelog](https://www.openssh.com/txt/release-8.8) for details - ORY Kratos was updated to version 0.8.0-alpha.3

This document outlines the key updates and changes in Release 21.11, codenamed "Porcupine," which is supported until June 2022. Major highlights include updating Nix to version 2.4, `iptables` now using `nf_tables` (with a recommendation to reboot after upgrade to avoid firewall issues), and a new `nftables` backend for systemd. Various software defaults have been updated, such as PHP to 8.0, Python to 3.9, PostgreSQL to 13, Spark to 3, Hadoop to 3, and bash to 5. Desktop environments like KDE Plasma now support Wayland, GNOME has been upgraded to 41, and Pantheon to 6. Other significant updates include kops 1.21.1, kubernetes-helm 3.7.0, improved LXD support, and OpenSSH 8.8p1, which has potential breaking changes for connections to old SSH daemons. Activation scripts can now optionally run during `nixos-rebuild dry-activate`.