does not use any distributed Erlang features, and does not plan to (refer to
  [discussion](https://github.com/NixOS/nixpkgs/pull/130297#issuecomment-1805851333)),
  Thus NixOS disables them now , and the Erlang cookie becomes unnecessary. You
  may delete the file that `releaseCookiePath` was set to.

- `security.sudo.extraRules` includes `root`'s default rule now, with ordering
  priority 400. This is functionally identical for users not specifying rule
  order, or relying on `mkBefore` and `mkAfter`, but may impact users calling
  `mkOrder n` with n ≤ 400.

- X keyboard extension (XKB) options have been reorganized into a single
  attribute set, `services.xserver.xkb`. Specifically,
  `services.xserver.layout` is `services.xserver.xkb.layout` now,
  `services.xserver.extraLayouts` is `services.xserver.xkb.extraLayouts` now,
  `services.xserver.xkbModel` is `services.xserver.xkb.model` now,
  `services.xserver.xkbOptions` is `services.xserver.xkb.options` now ,
  `services.xserver.xkbVariant` is `services.xserver.xkb.variant` now, and
  `services.xserver.xkbDir` is `services.xserver.xkb.dir` now.

- `networking.networkmanager.firewallBackend` was removed as NixOS is now using
  iptables-nftables-compat even when using iptables, therefore Networkmanager
  uses the nftables backend unconditionally now.

- `rome` was removed because it is no longer maintained and is succeeded by
  `biome`.

- The `prometheus-knot-exporter` was migrated to a version maintained by
  CZ.NIC. Various metric names have changed, so checking existing rules is
  recommended.

- The `services.mtr-exporter.target` has been removed in favor of
  `services.mtr-exporter.jobs` which allows specifying multiple targets.

- `blender-with-packages` has been deprecated in favor of
  `blender.withPackages`, for example `blender.withPackages (ps: [ps.bpycv])`.
  It behaves similarly to `python3.withPackages`.

- Setting `nixpkgs.config` options while providing an external `pkgs` instance
  will now raise an error instead of silently ignoring the options. NixOS
  modules no longer set `nixpkgs.config` to accommodate this. This specifically
  affects `services.locate`,
  `services.xserver.displayManager.lightdm.greeters.tiny` and
  `programs.firefox` NixOS modules. No manual intervention should be required
  in most cases, however, configurations relying on those modules affecting
  packages outside the system environment should switch to explicit overlays.

- `privacyidea` (and the corresponding `privacyidea-ldap-proxy`) has been
  removed from nixpkgs because it has severely outdated dependencies that
  became unmaintainable with nixpkgs' python package-set.

- `dagger` was removed because using a package called `dagger` and packaging it
  from source violates their trademark policy.

- `win-virtio` package was renamed to `virtio-win` to be consistent with the upstream package name.

- `ps3netsrv` has been replaced with the webman-mod fork, the executable has
  been renamed from `ps3netsrv++` to `ps3netsrv` and cli parameters have
  changed.

- `ssm-agent` package and module were renamed to `amazon-ssm-agent` to be
  consistent with the upstream package name.

- `services.kea.{ctrl-agent,dhcp-ddns,dhcp,dhcp6}` now use separate runtime
  directories instead of `/run/kea` to work around the runtime directory being
  cleared on service start.

- `mkDerivation` rejects MD5 hashes now.

- The `junicode` font package has been updated to [major
  v2](https://github.com/psb1558/Junicode-font/releases/tag/v2.001), which is
  a font family now. In particular, plain `Junicode.ttf` no longer exists. In
  addition, TrueType font files are now placed in `font/truetype` instead of
  `font/junicode-ttf`; this change does not affect use via `fonts.packages`
  option.

- The `prayer` package as well as `services.prayer` have been removed because
  it's been unmaintained for several years and the author's website has
  vanished.

- The `chrony` NixOS module now tracks the real-time clock drift from the