Permission Set Metadata Behavior Change

In API 40.0 and later, when you deploy the output of a retrieval to another org, the target org metadata is now replaced by the metadata in the deployment. In API 39.0 and earlier, when you deploy your retrieved permission set output to another org, the deployment contents are merged with your current org data.
Available in: Salesforce Classic and Lightning Experience
Available in: Contact Manager, Professional, Group, Enterprise, Performance, Unlimited, Developer, and Database.com Editions

We simplified the metadata packaging definition needed to produce consistent permission set outputs. The consistent output lets changes be trackable in standard version control systems. Now transfers of permission set content between production, sandbox, and other related orgs is easier and more predictable. See Updated Metadata Types.

Example

In API version 39.0 and earlier, if your permission set contains the Manage Roles user permission and you deploy a metadata file without this user permission, Manage Roles remains enabled. However, in API version 40.0 and later, if you deploy a metadata file without this user permission, Manage Roles is disabled in the target org.