review

  [fileSystems.overlay](#opt-fileSystems._name_.overlay.lowerdir). See also the

  [NixOS docs](#sec-overlayfs).

- systemd units can now specify the `Upholds=` and `UpheldBy=` unit dependencies via the aptly

  named `upholds` and `upheldBy` options. These options get systemd to enforce that the

  dependencies remain continuosly running for as long as the dependent unit is in a running state.

- `stdenv`: The `--replace` flag in `substitute`, `substituteInPlace`, `substituteAll`, `substituteAllStream`, and `substituteStream` is now deprecated if favor of the new `--replace-fail`, `--replace-warn` and `--replace-quiet`. The deprecated `--replace` equates to `--replace-warn`.

- A new hardening flag, `zerocallusedregs` was made available, corresponding to the gcc/clang option `-fzero-call-used-regs=used-gpr`.

        default = [];

        type = types.listOf unitNameType;

        description = lib.mdDoc ''

          Configures dependencies similar to Wants=, but as long as this unit is up, all units

          listed in Upholds= are started whenever found to be inactive or failed, and no job is

          queued for them. While a Wants= dependency on another unit has a one-time effect when

          this units started, a Upholds= dependency on it has a continuous effect, constantly

          restarting the unit if necessary. This is an alternative to the Restart= setting of

          service units, to ensure they are kept running whatever happens. The restart happens

          without delay, and usual per-unit rate-limit applies.

          Keeps the specified running while this unit is running. A continuous version of `wants`.

        '';

      };