hostName = "smtp.example:587";
      authUser = "someone";
      authPassFile = "/secrets/password.txt";
    };

    # Equivalent msmtp configuration:
    programs.msmtp = {
      enable = true;
      accounts.default = {
        tls = true;
        tls_starttls = true;
        auth = true;
        host = "smtp.example";
        port = 587;
        user = "someone";
        passwordeval = "cat /secrets/password.txt";
      };
    };
  }
  ```

- `services.kubernetes.addons.dashboard` was removed due to it being an outdated version.

- `services.kubernetes.scheduler.{port,address}` now set `--secure-port` and `--bind-address` instead of `--port` and `--address`, since the former have been deprecated and are no longer functional in kubernetes>=1.23. Ensure that you are not relying on the insecure behaviour before upgrading.

- In the PowerDNS Recursor module (`services.pdns-recursor`), default values of several IP address-related NixOS options have been updated to match the default upstream behavior.
  In particular, Recursor by default will:
    - listen on (and allows connections from) both IPv4 and IPv6 addresses
      (`services.pdns-recursor.dns.address`, `services.pdns-recursor.dns.allowFrom`);
    - allow only local connections to the REST API server (`services.pdns-recursor.api.allowFrom`).

- In the ncdns module, the default value of `services.ncdns.address` has been changed to the IPv6 loopback address (`::1`).

- `openldap` (and therefore the slapd LDAP server) were updated to version 2.6.2. The project introduced backwards-incompatible changes, namely the removal of the bdb, hdb, ndb, and shell backends in slapd. Therefore before updating, dump your database `slapcat -n 1` in LDIF format, and reimport it after updating your `services.openldap.settings`, which represents your `cn=config`.

  Additionally with 2.5 the argon2 module was included in the standard distribution and renamed from `pw-argon2` to `argon2`. Remember to update your `olcModuleLoad` entry in `cn=config`.

- `openssh` has been update to 8.9p1, changing the FIDO security key middleware interface.

- `git` no longer hardcodes the path to openssh' ssh binary to reduce the amount of rebuilds. If you are using git with ssh remotes and do not have a ssh binary in your environment consider adding `openssh` to it or switching to `gitFull`.

- `services.k3s.enable` no longer implies `systemd.enableUnifiedCgroupHierarchy = false`, and will default to the 'systemd' cgroup driver when using `services.k3s.docker = true`.
  This change may require a reboot to take effect, and k3s may not be able to run if the boot cgroup hierarchy does not match its configuration.
  The previous behavior may be retained by explicitly setting `systemd.enableUnifiedCgroupHierarchy = false` in your configuration.

- `fonts.fonts` no longer includes ancient bitmap fonts when both `config.services.xserver.enable` and `config.nixpkgs.config.allowUnfree` are enabled.
  If you still want these fonts, use:

  ```nix
  {
    fonts.fonts = [
      pkgs.xorg.fontbhlucidatypewriter100dpi
      pkgs.xorg.fontbhlucidatypewriter75dpi
      pkgs.xorg.fontbh100dpi
    ];
  }
  ```

- `services.prometheus.alertManagerTimeout` has been removed as it has been deprecated upstream and has no effect.

- The DHCP server (`services.dhcpd4`, `services.dhcpd6`) has been hardened.
  The service is now using the systemd's `DynamicUser` mechanism to run as an unprivileged dynamically-allocated user with limited capabilities.
  The dhcpd state files are now always stored in `/var/lib/dhcpd{4,6}` and the `services.dhcpd4.stateDir` and `service.dhcpd6.stateDir` options have been removed.
  If you were depending on root privileges or set{uid,gid,cap} binaries in dhcpd shell hooks, you may give dhcpd more capabilities with e.g. `systemd.services.dhcpd6.serviceConfig.AmbientCapabilities`.

- The `mailpile` email webclient (`services.mailpile`) has been removed due to its reliance on python2.

- `services.ipfs.extraFlags` is now escaped with `utils.escapeSystemdExecArgs`. If you rely on systemd interpolating `extraFlags` in the service `ExecStart`, this will no longer work.