diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index cbcfc7bd5531..fef00b09a902 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -55,10 +55,14 @@ jobs:
             })).map(file => file.filename)
 
             if (files.some(file => [
+              '.github/workflows/build.yml',
+              '.github/workflows/check.yml',
               '.github/workflows/eval.yml',
               '.github/workflows/lint.yml',
               '.github/workflows/merge-group.yml',
               '.github/workflows/test.yml',
+              'ci/github-script/supportedSystems.js',
+              'ci/supportedBranches.js',
             ].includes(file))) core.setOutput('merge-group', true)
 
             if (files.some(file => [
@@ -71,8 +75,16 @@ jobs:
               '.github/workflows/pull-request-target.yml',
               '.github/workflows/test.yml',
               'ci/github-script/bot.js',
+              'ci/github-script/check-target-branch.js',
+              'ci/github-script/commits.js',
+              'ci/github-script/lint-commits.js',
               'ci/github-script/merge.js',
+              'ci/github-script/prepare.js',
+              'ci/github-script/reviewers.js',
+              'ci/github-script/reviews.js',
+              'ci/github-script/supportedSystems.js',
               'ci/github-script/withRateLimit.js',
+              'ci/supportedBranches.js',
             ].includes(file))) core.setOutput('pr', true)
 
   merge-group:
diff --git a/ci/eval/compare/default.nix b/ci/eval/compare/default.nix
index f1473367a7d9..ed1129d75f2e 100644
--- a/ci/eval/compare/default.nix
+++ b/ci/eval/compare/default.nix
@@ -123,9 +123,7 @@ let
   # - values: lists of `packagePlatformPath`s
   diffAttrs = builtins.fromJSON (builtins.readFile "${combined}/combined-diff.json");
 
-  changedPackagePlatformAttrs = convertToPackagePlatformAttrs diffAttrs.changed;
   rebuildsPackagePlatformAttrs = convertToPackagePlatformAttrs diffAttrs.rebuilds;
-  removedPackagePlatformAttrs = convertToPackagePlatformAttrs diffAttrs.removed;
 
   changed-paths =
     let
@@ -162,9 +160,10 @@ let
 
   inherit
     (callPackage ./maintainers.nix {
-      changedattrs = lib.attrNames (lib.groupBy (a: a.name) changedPackagePlatformAttrs);
-      changedpathsjson = touchedFilesJson;
-      removedattrs = lib.attrNames (lib.groupBy (a: a.name) removedPackagePlatformAttrs);
+      affectedAttrPaths = map (a: a.packagePath) (
+        convertToPackagePlatformAttrs (diffAttrs.changed ++ diffAttrs.removed)
+      );
+      changedFiles = lib.importJSON touchedFilesJson;
     })
     users
     teams
@@ -181,7 +180,7 @@ runCommand "compare"
     ];
     users = builtins.toJSON users;
     teams = builtins.toJSON teams;
-    packages = builtins.toJSON packages;
+    packages = builtins.toJSON (lib.map (lib.concatStringsSep ".") packages);
     passAsFile = [
       "users"
       "teams"
diff --git a/ci/eval/compare/maintainers.nix b/ci/eval/compare/maintainers.nix
index daecc1c154da..903e42f733f6 100644
--- a/ci/eval/compare/maintainers.nix
+++ b/ci/eval/compare/maintainers.nix
@@ -1,70 +1,54 @@
+# Figure out which maintainers (users/teams) are relevant for a PR:
+# - All maintainers that can be linked directly to changedFiles
+# - Maintainers of affectedAttrPaths if a file directly related to the attribute is in changedFiles
+#
+# Files and attributes are linked in various ways:
+# - pkgs/by-name/<attr>/* is linked to pkgs.<attr>
+# - The file position of various attributes of pkgs.<attr>
+# - Explicitly specified file positions in derivations
+#
+# Test with
+#   nix-instantiate --eval --strict --json test.nix -A result | jq
+#
+# Empty list as an output means success
 {
-  lib,
-  changedattrs,
-  changedpathsjson,
-  removedattrs,
-}:
-let
-  pkgs = import ../../.. {
+  # Files that were changed
+  # Type: ListOf (Nixpkgs-root-relative path)
+  changedFiles,
+  # Attributes whose value was affected by the change
+  # Type: ListOf (ListOf String)
+  affectedAttrPaths,
+
+  pkgs ? import ../../.. {
     system = "x86_64-linux";
     # We should never try to ping maintainers through package aliases, this can only lead to errors.
     # One example case is, where an attribute is a throw alias, but then re-introduced in a PR.
     # This would trigger the throw. By disabling aliases, we can fallback gracefully below.
     config.allowAliases = false;
-  };
+    overlays = [ ];
+  },
+  lib,
+}:
+let
+  nixpkgsRoot = toString ../../.. + "/";
+  stripNixpkgsRootFromKeys = lib.mapAttrs' (
+    file: value: lib.nameValuePair (lib.removePrefix nixpkgsRoot file) value
+  );
 
-  changedpaths = lib.importJSON changedpathsjson;
+  moduleMeta = (pkgs.nixos { }).config.meta;
 
-  # Extract attributes that changed from by-name paths.
-  # This allows pinging reviewers for pure refactors.
-  touchedattrs = lib.pipe changedpaths [
-    (lib.filter (changed: lib.hasPrefix "pkgs/by-name/" changed && changed != "pkgs/by-name/README.md"))
-    (map (lib.splitString "/"))
-    (map (path: lib.elemAt path 3))
-    lib.unique
-  ];
+  # Currently just nixos module maintainers, but in the future we can use this for code owners too
+  fileUsers = stripNixpkgsRootFromKeys moduleMeta.maintainers;
+  fileTeams = stripNixpkgsRootFromKeys moduleMeta.teams;
 
-  anyMatchingFile = filename: lib.any (lib.hasPrefix filename) changedpaths;
+  anyMatchingFile = filename: lib.any (lib.hasPrefix filename) changedFiles;
 
   anyMatchingFiles = files: lib.any anyMatchingFile files;
 
-  sharded = name: "${lib.substring 0 2 name}/${name}";
-
-  attrsWithMaintainers = lib.pipe (changedattrs ++ removedattrs ++ touchedattrs) [
-    # An attribute can appear in changed/removed *and* touched
-    lib.unique
-    (map (
-      name:
-      let
-        path = lib.splitString "." name;
-        # Some packages might be reported as changed on a different platform, but
-        # not even have an attribute on the platform the maintainers are requested on.
-        # Fallback to `null` for these to filter them out below.
-        package = lib.attrByPath path null pkgs;
-      in
-      {
-        inherit name package;
-        # Adds all files in by-name to each package, no matter whether they are discoverable
-        # via meta attributes below. For example, this allows pinging maintainers for
-        # updates to .json files.
-        # TODO: Support by-name package sets.
-        filenames = lib.optional (lib.length path == 1) "pkgs/by-name/${sharded (lib.head path)}/";
-        # meta.maintainers also contains all individual team members.
-        # We only want to ping individuals if they're added individually as maintainers, not via teams.
-        users = package.meta.nonTeamMaintainers or [ ];
-        teams = package.meta.teams or [ ];
-      }
-    ))
-    # No need to match up packages without maintainers with their files.
-    # This also filters out attributes where `package = null`, which is the
-    # case for libintl, for example.
-    (lib.filter (pkg: pkg.users != [ ] || pkg.teams != [ ]))
-  ];
-
   relevantFilenames =
     drv:
     (lib.unique (
-      map (pos: lib.removePrefix "${toString ../../..}/" pos.file) (
+      map (pos: lib.removePrefix nixpkgsRoot pos.file) (
         lib.filter (x: x != null) [
           (drv.meta.maintainersPosition or null)
           (drv.meta.teamsPosition or null)
@@ -87,50 +71,82 @@ let
       )
     ));
 
-  attrsWithFilenames = map (
-    pkg: pkg // { filenames = pkg.filenames ++ relevantFilenames pkg.package; }
-  ) attrsWithMaintainers;
+  relevantAffectedAttrPaths = lib.filter (
+    attrPath:
+    # Some packages might be reported as changed on a different platform, but
+    # not even have an attribute on the platform the maintainers are requested on.
+    # Fallback to `null` for these to filter them out
+    let
+      package = lib.attrByPath attrPath null pkgs;
+    in
+    package != null && anyMatchingFiles (relevantFilenames package)
+  ) affectedAttrPaths;
 
-  attrsWithModifiedFiles = lib.filter (pkg: anyMatchingFiles pkg.filenames) attrsWithFilenames;
+  # Extract attributes that changed from by-name paths.
+  # This allows pinging reviewers for pure refactors.
+  changedByNameAttrPaths = lib.pipe changedFiles [
+    (lib.filter (changed: lib.hasPrefix "pkgs/by-name/" changed))
+    (map (lib.splitString "/"))
+    # Filters out e.g. pkgs/by-name/README.md
+    (lib.filter (path: lib.length path > 3))
+    (map (path: lib.elemAt path 3))
+    (map lib.singleton)
+  ];
+
+  # An attribute can appear in affected *and* touched
+  attrPathsToGetMaintainersFor = lib.unique (relevantAffectedAttrPaths ++ changedByNameAttrPaths);
+
+  attrPathEntities = lib.concatMap (
+    attrPath:
+    let
+      package = lib.getAttrFromPath attrPath pkgs;
+    in
+    # meta.maintainers also contains all individual team members.
+    # We only want to ping individuals if they're added individually as maintainers, not via teams.
+    userPings { inherit attrPath; } (package.meta.nonTeamMaintainers or [ ])
+    ++ lib.concatMap (teamPings { inherit attrPath; }) (package.meta.teams or [ ])
+  ) attrPathsToGetMaintainersFor;
+
+  changedFileEntities = lib.concatMap (
+    file:
+    userPings { inherit file; } (fileUsers.${file} or [ ])
+    ++ lib.concatMap (teamPings { inherit file; }) (fileTeams.${file} or [ ])
+  ) changedFiles;
 
   userPings =
-    pkg:
+    context:
     map (maintainer: {
       type = "user";
       userId = maintainer.githubId;
-      packageName = pkg.name;
+      inherit context;
     });
 
   teamPings =
-    pkg: team:
-    if team ? github then
+    context: team:
+    if team ? githubId then
       [
         {
           type = "team";
           teamId = team.githubId;
-          packageName = pkg.name;
+          inherit context;
         }
       ]
     else
-      userPings pkg team.members;
+      userPings context team.members;
 
-  maintainersToPing = lib.concatMap (
-    pkg: userPings pkg pkg.users ++ lib.concatMap (teamPings pkg) pkg.teams
-  ) attrsWithModifiedFiles;
-
-  byType = lib.groupBy (ping: ping.type) maintainersToPing;
+  byType = lib.groupBy (ping: ping.type) (attrPathEntities ++ changedFileEntities);
 
   byUser = lib.pipe (byType.user or [ ]) [
     (lib.groupBy (ping: toString ping.userId))
-    (lib.mapAttrs (_user: lib.map (pkg: pkg.packageName)))
+    (lib.mapAttrs (_user: lib.map (pkg: pkg.context)))
   ];
   byTeam = lib.pipe (byType.team or [ ]) [
     (lib.groupBy (ping: toString ping.teamId))
-    (lib.mapAttrs (_team: lib.map (pkg: pkg.packageName)))
+    (lib.mapAttrs (_team: lib.map (pkg: pkg.context)))
   ];
 in
 {
   users = byUser;
   teams = byTeam;
-  packages = lib.catAttrs "name" attrsWithModifiedFiles;
+  packages = attrPathsToGetMaintainersFor;
 }
diff --git a/ci/eval/compare/test.nix b/ci/eval/compare/test.nix
new file mode 100644
index 000000000000..323d71d87680
--- /dev/null
+++ b/ci/eval/compare/test.nix
@@ -0,0 +1,228 @@
+{
+  pkgs ? import ../../.. {
+    config = { };
+    overlays = [ ];
+  },
+  lib ? pkgs.lib,
+}:
+let
+  fun = import ./maintainers.nix;
+
+  mockPkgs =
+    {
+      packages ? [ ],
+      modules ? [ ],
+      githubTeams ? true,
+    }:
+    lib.updateManyAttrsByPath
+      (lib.imap0 (i: p: {
+        path = p;
+        update = _: {
+          meta.maintainersPosition.file = lib.concatStringsSep "/" p;
+          meta.nonTeamMaintainers = [ { githubId = i; } ];
+          meta.teams =
+            if githubTeams then [ { githubId = i + 100; } ] else [ { members = [ { githubId = i + 100; } ]; } ];
+        };
+      }) packages)
+      {
+        nixos =
+          { }:
+          {
+            config.meta.maintainers = lib.listToAttrs (
+              lib.imap0 (i: m: lib.nameValuePair m [ { githubId = i; } ]) modules
+            );
+            config.meta.teams = lib.listToAttrs (
+              lib.imap0 (
+                i: m:
+                lib.nameValuePair m (
+                  if githubTeams then [ { githubId = i + 100; } ] else [ { members = [ { githubId = i + 100; } ]; } ]
+                )
+              ) modules
+            );
+          };
+      };
+
+  tests = {
+    testEmpty = {
+      expr = fun {
+        pkgs = mockPkgs { };
+        inherit lib;
+        changedFiles = [ ];
+        affectedAttrPaths = [ ];
+      };
+      expected = {
+        packages = [ ];
+        teams = { };
+        users = { };
+      };
+    };
+    testNonExistentAffected = {
+      expr = fun {
+        pkgs = mockPkgs { };
+        inherit lib;
+        changedFiles = [ "a" ];
+        affectedAttrPaths = [ [ "b" ] ];
+      };
+      expected = {
+        packages = [ ];
+        teams = { };
+        users = { };
+      };
+    };
+    testIrrelevantAffected = {
+      expr = fun {
+        pkgs = mockPkgs {
+          packages = [ [ "b" ] ];
+        };
+        inherit lib;
+        changedFiles = [ "a" ];
+        affectedAttrPaths = [ [ "b" ] ];
+      };
+      expected = {
+        packages = [ ];
+        teams = { };
+        users = { };
+      };
+    };
+    testRelevantAffected = {
+      expr = fun {
+        pkgs = mockPkgs {
+          packages = [ [ "b" ] ];
+        };
+        inherit lib;
+        # Also tests that subpaths work
+        changedFiles = [ "b/c" ];
+        affectedAttrPaths = [ [ "b" ] ];
+      };
+      expected = {
+        packages = [ [ "b" ] ];
+        teams."100" = [
+          { attrPath = [ "b" ]; }
+        ];
+        users."0" = [
+          { attrPath = [ "b" ]; }
+        ];
+      };
+    };
+    testRelevantAffectedNonGitHub = {
+      expr = fun {
+        pkgs = mockPkgs {
+          packages = [ [ "b" ] ];
+          githubTeams = false;
+        };
+        inherit lib;
+        changedFiles = [ "b/c" ];
+        affectedAttrPaths = [ [ "b" ] ];
+      };
+      expected = {
+        packages = [ [ "b" ] ];
+        teams = { };
+        users."0" = [
+          { attrPath = [ "b" ]; }
+        ];
+        users."100" = [
+          { attrPath = [ "b" ]; }
+        ];
+      };
+    };
+    testByNameChanged = {
+      expr = fun {
+        pkgs = mockPkgs {
+          packages = [ [ "hello" ] ];
+        };
+        inherit lib;
+        changedFiles = [ "pkgs/by-name/he/hello/sources.json" ];
+        affectedAttrPaths = [ ];
+      };
+      expected = {
+        packages = [ [ "hello" ] ];
+        teams."100" = [
+          { attrPath = [ "hello" ]; }
+        ];
+        users."0" = [
+          { attrPath = [ "hello" ]; }
+        ];
+      };
+    };
+    testByNameReadmeChanged = {
+      expr = fun {
+        pkgs = mockPkgs {
+          packages = [ [ "hello" ] ];
+        };
+        inherit lib;
+        changedFiles = [ "pkgs/by-name/README.md" ];
+        affectedAttrPaths = [ ];
+      };
+      expected = {
+        packages = [ ];
+        teams = { };
+        users = { };
+      };
+    };
+    testNoDuplicates = {
+      expr = fun {
+        pkgs = mockPkgs {
+          packages = [ [ "hello" ] ];
+        };
+        inherit lib;
+        changedFiles = [
+          "hello"
+          "pkgs/by-name/he/hello/sources.json"
+        ];
+        affectedAttrPaths = [ [ "hello" ] ];
+      };
+      expected = {
+        packages = [ [ "hello" ] ];
+        teams."100" = [
+          { attrPath = [ "hello" ]; }
+        ];
+        users."0" = [
+          { attrPath = [ "hello" ]; }
+        ];
+      };
+    };
+    testModuleMaintainers = {
+      expr = fun {
+        pkgs = mockPkgs {
+          modules = [ "a" ];
+        };
+        inherit lib;
+        changedFiles = [ "a" ];
+        affectedAttrPaths = [ ];
+      };
+      expected = {
+        packages = [ ];
+        teams."100" = [
+          { file = "a"; }
+        ];
+        users."0" = [
+          { file = "a"; }
+        ];
+      };
+    };
+    testModuleMaintainersNonGithub = {
+      expr = fun {
+        pkgs = mockPkgs {
+          modules = [ "a" ];
+          githubTeams = false;
+        };
+        inherit lib;
+        changedFiles = [ "a" ];
+        affectedAttrPaths = [ ];
+      };
+      expected = {
+        packages = [ ];
+        teams = { };
+        users."100" = [
+          { file = "a"; }
+        ];
+        users."0" = [
+          { file = "a"; }
+        ];
+      };
+    };
+  };
+in
+{
+  result = lib.runTests tests;
+}
diff --git a/modules/generic/meta-maintainers.nix b/modules/generic/meta-maintainers.nix
index f9e8a19aea82..ce37dae03db6 100644
--- a/modules/generic/meta-maintainers.nix
+++ b/modules/generic/meta-maintainers.nix
@@ -4,39 +4,12 @@
 let
   inherit (lib)
     mkOption
-    mkOptionType
     types
     ;
 
-  maintainer = mkOptionType {
-    name = "maintainer";
-    check = email: lib.elem email (lib.attrValues lib.maintainers);
-    merge = loc: defs: {
-      # lib.last: Perhaps this could be merged instead, if "at most once per module"
-      # is a problem (see option description).
-      ${(lib.last defs).file} = (lib.last defs).value;
-    };
-  };
-
-  listOfMaintainers = types.listOf maintainer // {
-    merge =
-      loc: defs:
-      lib.zipAttrs (
-        lib.flatten (
-          lib.imap1 (
-            n: def:
-            lib.imap1 (
-              m: def':
-              maintainer.merge (loc ++ [ "[${toString n}-${toString m}]" ]) [
-                {
-                  inherit (def) file;
-                  value = def';
-                }
-              ]
-            ) def.value
-          ) defs
-        )
-      );
+  # The resulting value of this type shows where all values were defined
+  sourceList = types.listOf types.raw // {
+    merge = loc: defs: lib.listToAttrs (lib.map ({ file, value }: lib.nameValuePair file value) defs);
   };
 in
 {
@@ -44,7 +17,14 @@ in
   options = {
     meta = {
       maintainers = mkOption {
-        type = listOfMaintainers;
+        type =
+          let
+            allMaintainers = lib.attrValues lib.maintainers;
+          in
+          lib.types.addCheck sourceList (lib.all (v: lib.elem v allMaintainers))
+          // {
+            description = "list of lib.maintainers";
+          };
         default = [ ];
         example = lib.literalExpression "[ lib.maintainers.alice lib.maintainers.bob ]";
         description = ''
@@ -54,6 +34,22 @@ in
           The option value is not a list of maintainers, but an attribute set that maps module file names to lists of maintainers.
         '';
       };
+      teams = mkOption {
+        type =
+          let
+            allTeams = lib.attrValues lib.teams;
+          in
+          lib.types.addCheck sourceList (lib.all (v: lib.elem v allTeams))
+          // {
+            description = "list of lib.teams";
+          };
+        default = [ ];
+        example = lib.literalExpression "[ lib.teams.acme lib.teams.haskell ]";
+        description = ''
+          List of team maintainers of each module.
+          This option should be defined at most once per module.
+        '';
+      };
     };
   };
   meta.maintainers = with lib.maintainers; [
diff --git a/modules/generic/meta-maintainers/test.nix b/modules/generic/meta-maintainers/test.nix
index e4b37780ca83..a9859a6ee2dc 100644
--- a/modules/generic/meta-maintainers/test.nix
+++ b/modules/generic/meta-maintainers/test.nix
@@ -14,9 +14,17 @@ let
   };
 in
 rec {
-  lib = import ../../../lib;
+  # Inject ghost into lib.maintainers so it passes the addCheck validation
+  lib = (import ../../../lib).extend (
+    final: prev: {
+      maintainers = prev.maintainers // {
+        inherit ghost;
+      };
+    }
+  );
 
   example = lib.evalModules {
+    specialArgs.lib = lib;
     modules = [
       ../meta-maintainers.nix
       {
diff --git a/nixos/modules/config/vte.nix b/nixos/modules/config/vte.nix
index 8ed746d4966d..f3ec58012b0d 100644
--- a/nixos/modules/config/vte.nix
+++ b/nixos/modules/config/vte.nix
@@ -22,7 +22,7 @@ in
 {
 
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   options = {
diff --git a/nixos/modules/config/xdg/autostart.nix b/nixos/modules/config/xdg/autostart.nix
index 8fc3cb9920fa..8310c377d43b 100644
--- a/nixos/modules/config/xdg/autostart.nix
+++ b/nixos/modules/config/xdg/autostart.nix
@@ -1,7 +1,7 @@
 { config, lib, ... }:
 {
   meta = {
-    maintainers = lib.teams.freedesktop.members;
+    teams = [ lib.teams.freedesktop ];
   };
 
   options = {
diff --git a/nixos/modules/config/xdg/icons.nix b/nixos/modules/config/xdg/icons.nix
index 7810c57ef386..41eee42767f4 100644
--- a/nixos/modules/config/xdg/icons.nix
+++ b/nixos/modules/config/xdg/icons.nix
@@ -6,7 +6,7 @@
 }:
 {
   meta = {
-    maintainers = lib.teams.freedesktop.members;
+    teams = [ lib.teams.freedesktop ];
   };
 
   options = {
diff --git a/nixos/modules/config/xdg/menus.nix b/nixos/modules/config/xdg/menus.nix
index 6c05d49189ad..efbfdc5f2383 100644
--- a/nixos/modules/config/xdg/menus.nix
+++ b/nixos/modules/config/xdg/menus.nix
@@ -1,7 +1,7 @@
 { config, lib, ... }:
 {
   meta = {
-    maintainers = lib.teams.freedesktop.members;
+    teams = [ lib.teams.freedesktop ];
   };
 
   options = {
diff --git a/nixos/modules/config/xdg/mime.nix b/nixos/modules/config/xdg/mime.nix
index 79955a03ef2f..59d62a32010b 100644
--- a/nixos/modules/config/xdg/mime.nix
+++ b/nixos/modules/config/xdg/mime.nix
@@ -13,7 +13,7 @@ in
 
 {
   meta = {
-    maintainers = lib.teams.freedesktop.members ++ [ ];
+    teams = [ lib.teams.freedesktop ];
   };
 
   options = {
diff --git a/nixos/modules/config/xdg/portal.nix b/nixos/modules/config/xdg/portal.nix
index 5fd9d7fdd1bb..6bc6ce5e33e7 100644
--- a/nixos/modules/config/xdg/portal.nix
+++ b/nixos/modules/config/xdg/portal.nix
@@ -32,7 +32,7 @@ in
   ];
 
   meta = {
-    maintainers = teams.freedesktop.members;
+    teams = [ teams.freedesktop ];
   };
 
   options.xdg.portal = {
diff --git a/nixos/modules/config/xdg/portals/lxqt.nix b/nixos/modules/config/xdg/portals/lxqt.nix
index 77a5f144730d..423fcae1b2b1 100644
--- a/nixos/modules/config/xdg/portals/lxqt.nix
+++ b/nixos/modules/config/xdg/portals/lxqt.nix
@@ -10,7 +10,7 @@ let
 in
 {
   meta = {
-    maintainers = lib.teams.lxqt.members;
+    teams = [ lib.teams.lxqt ];
   };
 
   options.xdg.portal.lxqt = {
diff --git a/nixos/modules/config/xdg/sounds.nix b/nixos/modules/config/xdg/sounds.nix
index 8b5bb67e4109..e23ced7f76dd 100644
--- a/nixos/modules/config/xdg/sounds.nix
+++ b/nixos/modules/config/xdg/sounds.nix
@@ -6,7 +6,7 @@
 }:
 {
   meta = {
-    maintainers = lib.teams.freedesktop.members;
+    teams = [ lib.teams.freedesktop ];
   };
 
   options = {
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 8ea3e232594a..0e98f50ab6e7 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1758,6 +1758,7 @@
   ./services/web-apps/snipe-it.nix
   ./services/web-apps/snips-sh.nix
   ./services/web-apps/sogo.nix
+  ./services/web-apps/speedtest-tracker.nix
   ./services/web-apps/sshwifty.nix
   ./services/web-apps/stash.nix
   ./services/web-apps/stirling-pdf.nix
diff --git a/nixos/modules/programs/dsearch.nix b/nixos/modules/programs/dsearch.nix
index f1597189fa38..5e99478054d3 100644
--- a/nixos/modules/programs/dsearch.nix
+++ b/nixos/modules/programs/dsearch.nix
@@ -49,5 +49,5 @@ in
     systemd.user.services.dsearch.wantedBy = mkIf cfg.systemd.enable [ cfg.systemd.target ];
   };
 
-  meta.maintainers = lib.teams.danklinux.members;
+  meta.teams = [ lib.teams.danklinux ];
 }
diff --git a/nixos/modules/programs/geary.nix b/nixos/modules/programs/geary.nix
index 0cbfe5b0605c..6c881dc8ccaf 100644
--- a/nixos/modules/programs/geary.nix
+++ b/nixos/modules/programs/geary.nix
@@ -11,7 +11,7 @@ let
 in
 {
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   options = {
diff --git a/nixos/modules/programs/gnome-disks.nix b/nixos/modules/programs/gnome-disks.nix
index e6f93c6fdfe6..c6de53d844f3 100644
--- a/nixos/modules/programs/gnome-disks.nix
+++ b/nixos/modules/programs/gnome-disks.nix
@@ -10,7 +10,7 @@
 {
 
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   ###### interface
diff --git a/nixos/modules/programs/gnome-terminal.nix b/nixos/modules/programs/gnome-terminal.nix
index aea0e97c3634..f7ade6a184c4 100644
--- a/nixos/modules/programs/gnome-terminal.nix
+++ b/nixos/modules/programs/gnome-terminal.nix
@@ -16,7 +16,7 @@ in
 {
 
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   options = {
diff --git a/nixos/modules/programs/nm-applet.nix b/nixos/modules/programs/nm-applet.nix
index 7aecbadd2ebf..a1c69f52f624 100644
--- a/nixos/modules/programs/nm-applet.nix
+++ b/nixos/modules/programs/nm-applet.nix
@@ -10,7 +10,7 @@ let
 in
 {
   meta = {
-    maintainers = lib.teams.freedesktop.members;
+    teams = [ lib.teams.freedesktop ];
   };
 
   options.programs.nm-applet = {
diff --git a/nixos/modules/programs/steam.nix b/nixos/modules/programs/steam.nix
index 6fa66f681457..2ae30243c432 100644
--- a/nixos/modules/programs/steam.nix
+++ b/nixos/modules/programs/steam.nix
@@ -285,5 +285,5 @@ in
     ];
   };
 
-  meta.maintainers = lib.teams.steam.members;
+  meta.teams = [ lib.teams.steam ];
 }
diff --git a/nixos/modules/programs/thunar.nix b/nixos/modules/programs/thunar.nix
index 76da7d94c67c..c565f3ef1cec 100644
--- a/nixos/modules/programs/thunar.nix
+++ b/nixos/modules/programs/thunar.nix
@@ -11,7 +11,7 @@ let
 in
 {
   meta = {
-    maintainers = lib.teams.xfce.members;
+    teams = [ lib.teams.xfce ];
   };
 
   options = {
diff --git a/nixos/modules/programs/wayland/dms-shell.nix b/nixos/modules/programs/wayland/dms-shell.nix
index 53f84c1a41b1..b24253b57c23 100644
--- a/nixos/modules/programs/wayland/dms-shell.nix
+++ b/nixos/modules/programs/wayland/dms-shell.nix
@@ -226,5 +226,5 @@ in
     hardware.graphics.enable = lib.mkDefault true;
   };
 
-  meta.maintainers = lib.teams.danklinux.members;
+  meta.teams = [ lib.teams.danklinux ];
 }
diff --git a/nixos/modules/programs/wayland/hyprland.nix b/nixos/modules/programs/wayland/hyprland.nix
index 44aedc3d248e..744f7af70fe5 100644
--- a/nixos/modules/programs/wayland/hyprland.nix
+++ b/nixos/modules/programs/wayland/hyprland.nix
@@ -130,5 +130,5 @@ in
     ] "Nvidia patches are no longer needed")
   ];
 
-  meta.maintainers = lib.teams.hyprland.members;
+  meta.teams = [ lib.teams.hyprland ];
 }
diff --git a/nixos/modules/programs/wayland/hyprlock.nix b/nixos/modules/programs/wayland/hyprlock.nix
index e05d8f826a4c..c1ba14ddf771 100644
--- a/nixos/modules/programs/wayland/hyprlock.nix
+++ b/nixos/modules/programs/wayland/hyprlock.nix
@@ -26,5 +26,5 @@ in
     security.pam.services.hyprlock = { };
   };
 
-  meta.maintainers = lib.teams.hyprland.members;
+  meta.teams = [ lib.teams.hyprland ];
 }
diff --git a/nixos/modules/programs/xfconf.nix b/nixos/modules/programs/xfconf.nix
index cc9b6ddf7ac7..74a05cc1a798 100644
--- a/nixos/modules/programs/xfconf.nix
+++ b/nixos/modules/programs/xfconf.nix
@@ -11,7 +11,7 @@ let
 in
 {
   meta = {
-    maintainers = lib.teams.xfce.members;
+    teams = [ lib.teams.xfce ];
   };
 
   options = {
diff --git a/nixos/modules/security/acme/default.nix b/nixos/modules/security/acme/default.nix
index 1b262e285e19..cb3a0010a758 100644
--- a/nixos/modules/security/acme/default.nix
+++ b/nixos/modules/security/acme/default.nix
@@ -1218,7 +1218,7 @@ in
   ];
 
   meta = {
-    maintainers = lib.teams.acme.members;
+    teams = [ lib.teams.acme ];
     doc = ./default.md;
   };
 }
diff --git a/nixos/modules/security/apparmor.nix b/nixos/modules/security/apparmor.nix
index 6b059c2bd522..d446bb37a722 100644
--- a/nixos/modules/security/apparmor.nix
+++ b/nixos/modules/security/apparmor.nix
@@ -272,5 +272,5 @@ in
     };
   };
 
-  meta.maintainers = lib.teams.apparmor.members;
+  meta.teams = [ lib.teams.apparmor ];
 }
diff --git a/nixos/modules/services/cluster/rancher/default.nix b/nixos/modules/services/cluster/rancher/default.nix
index 3ed0f75d081e..c511da5a62f5 100644
--- a/nixos/modules/services/cluster/rancher/default.nix
+++ b/nixos/modules/services/cluster/rancher/default.nix
@@ -962,5 +962,6 @@ in
       (import ./rke2.nix args)
     ];
 
-  meta.maintainers = pkgs.rke2.meta.maintainers ++ lib.teams.k3s.members;
+  meta.teams = [ lib.teams.k3s ];
+  meta.maintainers = pkgs.rke2.meta.maintainers;
 }
diff --git a/nixos/modules/services/continuous-integration/buildbot/master.nix b/nixos/modules/services/continuous-integration/buildbot/master.nix
index 42e88e9ddbe3..1cf585604b5e 100644
--- a/nixos/modules/services/continuous-integration/buildbot/master.nix
+++ b/nixos/modules/services/continuous-integration/buildbot/master.nix
@@ -313,5 +313,5 @@ in
     '')
   ];
 
-  meta.maintainers = lib.teams.buildbot.members;
+  meta.teams = [ lib.teams.buildbot ];
 }
diff --git a/nixos/modules/services/continuous-integration/buildbot/worker.nix b/nixos/modules/services/continuous-integration/buildbot/worker.nix
index b1e1e7e254b5..c16720b0bf67 100644
--- a/nixos/modules/services/continuous-integration/buildbot/worker.nix
+++ b/nixos/modules/services/continuous-integration/buildbot/worker.nix
@@ -196,6 +196,6 @@ in
     };
   };
 
-  meta.maintainers = lib.teams.buildbot.members;
+  meta.teams = [ lib.teams.buildbot ];
 
 }
diff --git a/nixos/modules/services/continuous-integration/gitlab-runner/runner.nix b/nixos/modules/services/continuous-integration/gitlab-runner/runner.nix
index b95d30ceea4a..693229b87d97 100644
--- a/nixos/modules/services/continuous-integration/gitlab-runner/runner.nix
+++ b/nixos/modules/services/continuous-integration/gitlab-runner/runner.nix
@@ -893,5 +893,5 @@ in
     )
   ];
 
-  meta.maintainers = teams.gitlab.members;
+  meta.teams = [ teams.gitlab ];
 }
diff --git a/nixos/modules/services/databases/clickhouse.nix b/nixos/modules/services/databases/clickhouse.nix
index de9371de513a..50c291a10be6 100644
--- a/nixos/modules/services/databases/clickhouse.nix
+++ b/nixos/modules/services/databases/clickhouse.nix
@@ -13,7 +13,7 @@ let
 in
 {
 
-  meta.maintainers = [ "thevar1able" ];
+  meta.maintainers = with lib.maintainers; [ thevar1able ];
 
   ###### interface
 
diff --git a/nixos/modules/services/databases/redis.nix b/nixos/modules/services/databases/redis.nix
index 157a6c6b84e3..d55658bb25b2 100644
--- a/nixos/modules/services/databases/redis.nix
+++ b/nixos/modules/services/databases/redis.nix
@@ -335,7 +335,23 @@ in
                       If the master is password protected (using the requirePass configuration)
                       it is possible to tell the slave to authenticate before starting the replication synchronization
                       process, otherwise the master will refuse the slave request.
-                      (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE)'';
+                      (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE)
+                    '';
+                  };
+
+                  masterAuthFile = lib.mkOption {
+                    type = with types; nullOr path;
+                    default = null;
+                    description = "File with password for the master user.";
+                    example = "/run/keys/redis-master-password";
+                  };
+
+                  masterUser = lib.mkOption {
+                    type = with types; nullOr str;
+                    default = null;
+                    description = ''
+                      If the master is password protected via ACLs this option can be used to specify
+                      the Redis user that is used by replicas.'';
                   };
 
                   requirePass = lib.mkOption {
@@ -355,6 +371,43 @@ in
                     example = "/run/keys/redis-password";
                   };
 
+                  sentinelAuthPassFile = lib.mkOption {
+                    type = with types; nullOr path;
+                    default = null;
+                    description = "File with password for connecting to other Sentinel instances.";
+                    example = "/run/keys/sentinel-password";
+                  };
+
+                  sentinelAuthUser = lib.mkOption {
+                    type = with types; nullOr str;
+                    default = null;
+                    description = "The username to use to monitor a master from Sentinel.";
+                  };
+
+                  sentinelMasterHost = lib.mkOption {
+                    type = with types; nullOr str;
+                    default = null;
+                    description = "The IP address (recommended) or hostname of the Redis master that Sentinel will monitor.";
+                  };
+
+                  sentinelMasterName = lib.mkOption {
+                    type = with types; nullOr str;
+                    default = null;
+                    description = "The master name of the Redis master that Sentinel will monitor.";
+                  };
+
+                  sentinelMasterPort = lib.mkOption {
+                    type = with types; nullOr int;
+                    default = null;
+                    description = "The TCP port of the Redis master that Sentinel will monitor.";
+                  };
+
+                  sentinelMasterQuorum = lib.mkOption {
+                    type = with types; nullOr int;
+                    default = null;
+                    description = "The Sentinel quorum (minimum number of Sentinel nodes online for failover)";
+                  };
+
                   appendOnly = lib.mkOption {
                     type = types.bool;
                     default = false;
@@ -452,14 +505,55 @@ in
 
   config = lib.mkIf (enabledServers != { }) {
 
-    assertions = lib.attrValues (
-      lib.mapAttrs (name: conf: {
-        assertion = conf.requirePass != null -> conf.requirePassFile == null;
-        message = ''
-          You can only set one services.redis.servers.${name}.requirePass
-          or services.redis.servers.${name}.requirePassFile
-        '';
-      }) enabledServers
+    assertions = lib.concatLists (
+      lib.mapAttrsToList (name: conf: [
+        {
+          assertion = conf.requirePass != null -> conf.requirePassFile == null;
+          message = ''
+            You can only set one of services.redis.servers.${name}.requirePass
+            or services.redis.servers.${name}.requirePassFile
+          '';
+        }
+        {
+          assertion = conf.masterAuth != null -> conf.masterAuthFile == null;
+          message = ''
+            You can only set one of services.redis.servers.${name}.masterAuth
+            or services.redis.servers.${name}.masterAuthFile
+          '';
+        }
+        {
+          assertion = conf.masterUser != null -> (conf.masterAuth != null || conf.masterAuthFile != null);
+          message = ''
+            If using services.redis.servers.${name}.masterUser, either
+            services.redis.servers.${name}.masterAuthFile or
+            services.redis.servers.${name}.masterAuth must be provided
+          '';
+        }
+        {
+          assertion =
+            conf.sentinelMasterName != null
+            -> (
+              conf.sentinelMasterHost != null
+              && conf.sentinelMasterPort != null
+              && conf.sentinelMasterQuorum != null
+            );
+          message = ''
+            For Sentinel,
+            services.redis.servers.${name}.sentinelMasterName,
+            services.redis.servers.${name}.sentinelMasterHost,
+            services.redis.servers.${name}.sentinelMasterPort,
+            and services.redis.servers.${name}.sentinelMasterQuorum
+            must all be provided
+          '';
+        }
+        {
+          assertion = conf.sentinelAuthPassFile != null -> conf.sentinelMasterName != null;
+          message = ''
+            For Sentinel authentication, services.redis.servers.${name}.sentinelMasterName,
+            must be provided
+          '';
+        }
+      ]) enabledServers
     );
 
     boot.kernel.sysctl = lib.mkIf cfg.vmOverCommit {
@@ -498,6 +592,17 @@ in
           ExecStart = "${cfg.package}/bin/${
             cfg.package.serverBin or "redis-server"
           } /var/lib/${redisName name}/redis.conf ${lib.escapeShellArgs conf.extraParams}";
+
+          # NOTE: Redis/Valkey Sentinel persists dynamic cluster state by rewriting its
+          # configuration file at runtime (redis.conf). This includes monitors,
+          # authentication credentials, and failover metadata, and this behaviour
+          # cannot be disabled.
+          # As a result, a fully declarative configuration is not possible for
+          # Sentinel-managed options. The preStart logic below appends sentinel
+          # configuration only if it is not already present, in order to avoid
+          # overwriting state that is owned and maintained by Sentinel itself.
+          # This is an intentional deviation from strict declarative semantics and
+          # is required for correct Sentinel operation.
           ExecStartPre =
             "+"
             + pkgs.writeShellScript "${redisName name}-prep-conf" (
@@ -515,10 +620,40 @@ in
                 fi
                 echo 'include "${redisConfStore}"' > "${redisConfRun}"
                 ${lib.optionalString (conf.requirePassFile != null) ''
-                  {
-                    echo -n "requirepass "
-                    cat ${lib.escapeShellArg conf.requirePassFile}
-                  } >> "${redisConfRun}"
+                  echo "requirepass $(cat ${lib.escapeShellArg conf.requirePassFile})" >> "${redisConfRun}"
+                ''}
+                ${lib.optionalString (conf.masterUser != null) ''
+                  echo "masteruser ${conf.masterUser}" >> "${redisConfRun}"
+                ''}
+                ${lib.optionalString (conf.masterAuthFile != null) ''
+                  echo "masterauth $(cat ${lib.escapeShellArg conf.masterAuthFile})" >> "${redisConfRun}"
+                ''}
+                ${lib.optionalString (conf.sentinelMasterHost != null) ''
+                  sentinel_monitor_line="sentinel monitor ${conf.sentinelMasterName} ${conf.sentinelMasterHost} ${toString conf.sentinelMasterPort} ${toString conf.sentinelMasterQuorum}"
+                  if grep -qE "^sentinel monitor ${conf.sentinelMasterName}\b" "${redisConfVar}"; then
+                    sed -i \
+                      "s|^sentinel monitor ${conf.sentinelMasterName}\b.*|$sentinel_monitor_line|" "${redisConfVar}"
+                  else
+                    echo "$sentinel_monitor_line" >> "${redisConfVar}"
+                  fi
+                ''}
+                ${lib.optionalString (conf.sentinelAuthUser != null) ''
+                  sentinel_auth_user_line="sentinel auth-user ${conf.sentinelMasterName} ${conf.sentinelAuthUser}"
+                  if grep -qE "^sentinel auth-user ${conf.sentinelMasterName}\b" "${redisConfVar}"; then
+                    sed -i \
+                      "s|^sentinel auth-user ${conf.sentinelMasterName}\b.*|$sentinel_auth_user_line|" "${redisConfVar}"
+                  else
+                    echo "$sentinel_auth_user_line" >> "${redisConfVar}"
+                  fi
+                ''}
+                ${lib.optionalString (conf.sentinelAuthPassFile != null) ''
+                  sentinel_auth_pass_line="sentinel auth-pass ${conf.sentinelMasterName} $(cat ${lib.escapeShellArg conf.sentinelAuthPassFile})"
+                  if grep -qE "^sentinel auth-pass ${conf.sentinelMasterName}\b" "${redisConfVar}"; then
+                    sed -i \
+                      "s|^sentinel auth-pass ${conf.sentinelMasterName}\b.*|$sentinel_auth_pass_line|" "${redisConfVar}"
+                  else
+                    echo "$sentinel_auth_pass_line" >> "${redisConfVar}"
+                  fi
                 ''}
               ''
             );
diff --git a/nixos/modules/services/desktop-managers/budgie.nix b/nixos/modules/services/desktop-managers/budgie.nix
index 160ac04ecd6d..36f2946970bd 100644
--- a/nixos/modules/services/desktop-managers/budgie.nix
+++ b/nixos/modules/services/desktop-managers/budgie.nix
@@ -61,7 +61,7 @@ let
   notExcluded = pkg: utils.disablePackageByName pkg config.environment.budgie.excludePackages;
 in
 {
-  meta.maintainers = lib.teams.budgie.members;
+  meta.teams = [ lib.teams.budgie ];
 
   imports = [
     (lib.mkRenamedOptionModule
diff --git a/nixos/modules/services/desktop-managers/cosmic.nix b/nixos/modules/services/desktop-managers/cosmic.nix
index 26b185cc7742..c780a5164922 100644
--- a/nixos/modules/services/desktop-managers/cosmic.nix
+++ b/nixos/modules/services/desktop-managers/cosmic.nix
@@ -44,7 +44,7 @@ let
     ];
 in
 {
-  meta.maintainers = lib.teams.cosmic.members;
+  meta.teams = [ lib.teams.cosmic ];
 
   options = {
     services.desktopManager.cosmic = {
diff --git a/nixos/modules/services/desktop-managers/gnome.nix b/nixos/modules/services/desktop-managers/gnome.nix
index 5c11388eb97b..ddd13354612e 100644
--- a/nixos/modules/services/desktop-managers/gnome.nix
+++ b/nixos/modules/services/desktop-managers/gnome.nix
@@ -82,7 +82,7 @@ in
 {
   meta = {
     doc = ./gnome.md;
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   imports = [
diff --git a/nixos/modules/services/desktop-managers/lomiri.nix b/nixos/modules/services/desktop-managers/lomiri.nix
index b82c194be92c..1f40afb3732a 100644
--- a/nixos/modules/services/desktop-managers/lomiri.nix
+++ b/nixos/modules/services/desktop-managers/lomiri.nix
@@ -292,5 +292,5 @@ in
     })
   ];
 
-  meta.maintainers = lib.teams.lomiri.members;
+  meta.teams = [ lib.teams.lomiri ];
 }
diff --git a/nixos/modules/services/desktop-managers/pantheon.nix b/nixos/modules/services/desktop-managers/pantheon.nix
index 1fe99c0f66ac..b9498a0adb83 100644
--- a/nixos/modules/services/desktop-managers/pantheon.nix
+++ b/nixos/modules/services/desktop-managers/pantheon.nix
@@ -25,7 +25,7 @@ in
 
   meta = {
     doc = ./pantheon.md;
-    maintainers = teams.pantheon.members;
+    teams = [ teams.pantheon ];
   };
 
   imports = [
diff --git a/nixos/modules/services/desktops/accountsservice.nix b/nixos/modules/services/desktops/accountsservice.nix
index 758f7383ca63..fd328e357ce2 100644
--- a/nixos/modules/services/desktops/accountsservice.nix
+++ b/nixos/modules/services/desktops/accountsservice.nix
@@ -7,7 +7,7 @@
 }:
 {
   meta = {
-    maintainers = lib.teams.freedesktop.members;
+    teams = [ lib.teams.freedesktop ];
   };
 
   ###### interface
diff --git a/nixos/modules/services/desktops/geoclue2.nix b/nixos/modules/services/desktops/geoclue2.nix
index ffc48d6b9435..e44816cf2542 100644
--- a/nixos/modules/services/desktops/geoclue2.nix
+++ b/nixos/modules/services/desktops/geoclue2.nix
@@ -373,6 +373,6 @@ in
   };
 
   meta = {
-    maintainers = [ ] ++ lib.teams.pantheon.members;
+    teams = [ lib.teams.pantheon ];
   };
 }
diff --git a/nixos/modules/services/desktops/gnome/at-spi2-core.nix b/nixos/modules/services/desktops/gnome/at-spi2-core.nix
index 293a3166b187..77070843e04e 100644
--- a/nixos/modules/services/desktops/gnome/at-spi2-core.nix
+++ b/nixos/modules/services/desktops/gnome/at-spi2-core.nix
@@ -10,7 +10,7 @@
 {
 
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   ###### interface
diff --git a/nixos/modules/services/desktops/gnome/evolution-data-server.nix b/nixos/modules/services/desktops/gnome/evolution-data-server.nix
index 539fcf25342e..4437be835604 100644
--- a/nixos/modules/services/desktops/gnome/evolution-data-server.nix
+++ b/nixos/modules/services/desktops/gnome/evolution-data-server.nix
@@ -10,7 +10,7 @@
 {
 
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   ###### interface
diff --git a/nixos/modules/services/desktops/gnome/gcr-ssh-agent.nix b/nixos/modules/services/desktops/gnome/gcr-ssh-agent.nix
index d88f1a618049..eb1bad3b15c4 100644
--- a/nixos/modules/services/desktops/gnome/gcr-ssh-agent.nix
+++ b/nixos/modules/services/desktops/gnome/gcr-ssh-agent.nix
@@ -13,7 +13,7 @@ let
 in
 {
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   options = {
diff --git a/nixos/modules/services/desktops/gnome/glib-networking.nix b/nixos/modules/services/desktops/gnome/glib-networking.nix
index 558abca0aa31..048db8cf54a3 100644
--- a/nixos/modules/services/desktops/gnome/glib-networking.nix
+++ b/nixos/modules/services/desktops/gnome/glib-networking.nix
@@ -10,7 +10,7 @@
 {
 
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   ###### interface
diff --git a/nixos/modules/services/desktops/gnome/gnome-browser-connector.nix b/nixos/modules/services/desktops/gnome/gnome-browser-connector.nix
index 335ebc9a144d..17c1dd9045e8 100644
--- a/nixos/modules/services/desktops/gnome/gnome-browser-connector.nix
+++ b/nixos/modules/services/desktops/gnome/gnome-browser-connector.nix
@@ -16,7 +16,7 @@ in
 
 {
   meta = {
-    maintainers = teams.gnome.members;
+    teams = [ teams.gnome ];
   };
 
   options = {
diff --git a/nixos/modules/services/desktops/gnome/gnome-initial-setup.nix b/nixos/modules/services/desktops/gnome/gnome-initial-setup.nix
index 3df01b59738d..e72574795e65 100644
--- a/nixos/modules/services/desktops/gnome/gnome-initial-setup.nix
+++ b/nixos/modules/services/desktops/gnome/gnome-initial-setup.nix
@@ -48,7 +48,7 @@ in
 {
 
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   ###### interface
diff --git a/nixos/modules/services/desktops/gnome/gnome-keyring.nix b/nixos/modules/services/desktops/gnome/gnome-keyring.nix
index 550c6ba8eff5..9140d261a770 100644
--- a/nixos/modules/services/desktops/gnome/gnome-keyring.nix
+++ b/nixos/modules/services/desktops/gnome/gnome-keyring.nix
@@ -12,7 +12,7 @@ in
 {
 
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   options = {
diff --git a/nixos/modules/services/desktops/gnome/gnome-online-accounts.nix b/nixos/modules/services/desktops/gnome/gnome-online-accounts.nix
index 920c4cf8133e..7ec9c7e06296 100644
--- a/nixos/modules/services/desktops/gnome/gnome-online-accounts.nix
+++ b/nixos/modules/services/desktops/gnome/gnome-online-accounts.nix
@@ -10,7 +10,7 @@
 {
 
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   ###### interface
diff --git a/nixos/modules/services/desktops/gnome/gnome-remote-desktop.nix b/nixos/modules/services/desktops/gnome/gnome-remote-desktop.nix
index 6e685557ecf0..958fbb546dc3 100644
--- a/nixos/modules/services/desktops/gnome/gnome-remote-desktop.nix
+++ b/nixos/modules/services/desktops/gnome/gnome-remote-desktop.nix
@@ -8,7 +8,7 @@
 
 {
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   ###### interface
diff --git a/nixos/modules/services/desktops/gnome/gnome-settings-daemon.nix b/nixos/modules/services/desktops/gnome/gnome-settings-daemon.nix
index 06d001ab8134..7d6f7f7f3478 100644
--- a/nixos/modules/services/desktops/gnome/gnome-settings-daemon.nix
+++ b/nixos/modules/services/desktops/gnome/gnome-settings-daemon.nix
@@ -16,7 +16,7 @@ in
 {
 
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   ###### interface
diff --git a/nixos/modules/services/desktops/gnome/gnome-software.nix b/nixos/modules/services/desktops/gnome/gnome-software.nix
index ced2549a9e21..6bbe4d5487ab 100644
--- a/nixos/modules/services/desktops/gnome/gnome-software.nix
+++ b/nixos/modules/services/desktops/gnome/gnome-software.nix
@@ -7,7 +7,7 @@
 
 {
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   options = {
diff --git a/nixos/modules/services/desktops/gnome/gnome-user-share.nix b/nixos/modules/services/desktops/gnome/gnome-user-share.nix
index c6d0f723c047..eb869106c818 100644
--- a/nixos/modules/services/desktops/gnome/gnome-user-share.nix
+++ b/nixos/modules/services/desktops/gnome/gnome-user-share.nix
@@ -10,7 +10,7 @@
 {
 
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   ###### interface
diff --git a/nixos/modules/services/desktops/gnome/localsearch.nix b/nixos/modules/services/desktops/gnome/localsearch.nix
index 9160d1f06431..90018c557ec1 100644
--- a/nixos/modules/services/desktops/gnome/localsearch.nix
+++ b/nixos/modules/services/desktops/gnome/localsearch.nix
@@ -7,7 +7,7 @@
 
 {
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   imports = [
diff --git a/nixos/modules/services/desktops/gnome/rygel.nix b/nixos/modules/services/desktops/gnome/rygel.nix
index e8a147ed6e76..410550b8990c 100644
--- a/nixos/modules/services/desktops/gnome/rygel.nix
+++ b/nixos/modules/services/desktops/gnome/rygel.nix
@@ -14,7 +14,7 @@ in
 
 {
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   ###### interface
diff --git a/nixos/modules/services/desktops/gnome/sushi.nix b/nixos/modules/services/desktops/gnome/sushi.nix
index ea99c7ce30f0..d8aff2a7a0bd 100644
--- a/nixos/modules/services/desktops/gnome/sushi.nix
+++ b/nixos/modules/services/desktops/gnome/sushi.nix
@@ -10,7 +10,7 @@
 {
 
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   ###### interface
diff --git a/nixos/modules/services/desktops/gnome/tinysparql.nix b/nixos/modules/services/desktops/gnome/tinysparql.nix
index 551b5800e84c..3811780ddbc4 100644
--- a/nixos/modules/services/desktops/gnome/tinysparql.nix
+++ b/nixos/modules/services/desktops/gnome/tinysparql.nix
@@ -10,7 +10,7 @@ let
 in
 {
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   imports = [
diff --git a/nixos/modules/services/desktops/gvfs.nix b/nixos/modules/services/desktops/gvfs.nix
index 315141705546..004810327798 100644
--- a/nixos/modules/services/desktops/gvfs.nix
+++ b/nixos/modules/services/desktops/gvfs.nix
@@ -16,7 +16,7 @@ in
 {
 
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   ###### interface
diff --git a/nixos/modules/services/desktops/pipewire/pipewire.nix b/nixos/modules/services/desktops/pipewire/pipewire.nix
index 3f4cf2af05b2..77cdfa9a573e 100644
--- a/nixos/modules/services/desktops/pipewire/pipewire.nix
+++ b/nixos/modules/services/desktops/pipewire/pipewire.nix
@@ -85,7 +85,8 @@ let
   };
 in
 {
-  meta.maintainers = teams.freedesktop.members ++ [ maintainers.k900 ];
+  meta.teams = [ teams.freedesktop ];
+  meta.maintainers = [ maintainers.k900 ];
 
   ###### interface
   options = {
diff --git a/nixos/modules/services/desktops/tumbler.nix b/nixos/modules/services/desktops/tumbler.nix
index 12b0184d42c9..9143466fafef 100644
--- a/nixos/modules/services/desktops/tumbler.nix
+++ b/nixos/modules/services/desktops/tumbler.nix
@@ -18,7 +18,7 @@ in
   ];
 
   meta = {
-    maintainers = [ ] ++ lib.teams.pantheon.members;
+    teams = [ lib.teams.pantheon ];
   };
 
   ###### interface
diff --git a/nixos/modules/services/desktops/zeitgeist.nix b/nixos/modules/services/desktops/zeitgeist.nix
index 227287dd2377..fe065c4a4d7a 100644
--- a/nixos/modules/services/desktops/zeitgeist.nix
+++ b/nixos/modules/services/desktops/zeitgeist.nix
@@ -8,7 +8,7 @@
 {
 
   meta = {
-    maintainers = [ ] ++ lib.teams.pantheon.members;
+    teams = [ lib.teams.pantheon ];
   };
 
   ###### interface
diff --git a/nixos/modules/services/display-managers/cosmic-greeter.nix b/nixos/modules/services/display-managers/cosmic-greeter.nix
index 8886a4766e4e..93320b9be90a 100644
--- a/nixos/modules/services/display-managers/cosmic-greeter.nix
+++ b/nixos/modules/services/display-managers/cosmic-greeter.nix
@@ -16,7 +16,7 @@ let
 in
 
 {
-  meta.maintainers = lib.teams.cosmic.members;
+  meta.teams = [ lib.teams.cosmic ];
 
   options.services.displayManager.cosmic-greeter = {
     enable = lib.mkEnableOption "COSMIC greeter";
diff --git a/nixos/modules/services/display-managers/dms-greeter.nix b/nixos/modules/services/display-managers/dms-greeter.nix
index d049daa9b24f..abdd6e2ddf3b 100644
--- a/nixos/modules/services/display-managers/dms-greeter.nix
+++ b/nixos/modules/services/display-managers/dms-greeter.nix
@@ -321,5 +321,5 @@ in
     services.libinput.enable = mkDefault true;
   };
 
-  meta.maintainers = lib.teams.danklinux.members;
+  meta.teams = [ lib.teams.danklinux ];
 }
diff --git a/nixos/modules/services/display-managers/gdm.nix b/nixos/modules/services/display-managers/gdm.nix
index e46c8cf72fe7..9fc92e91018c 100644
--- a/nixos/modules/services/display-managers/gdm.nix
+++ b/nixos/modules/services/display-managers/gdm.nix
@@ -105,7 +105,7 @@ in
   ];
 
   meta = {
-    maintainers = lib.teams.gnome.members;
+    teams = [ lib.teams.gnome ];
   };
 
   ###### interface
diff --git a/nixos/modules/services/home-automation/home-assistant.nix b/nixos/modules/services/home-automation/home-assistant.nix
index dc1900f52c1e..eb4b475d4187 100644
--- a/nixos/modules/services/home-automation/home-assistant.nix
+++ b/nixos/modules/services/home-automation/home-assistant.nix
@@ -171,7 +171,7 @@ in
 
   meta = {
     buildDocsInSandbox = false;
-    maintainers = lib.teams.home-assistant.members;
+    teams = [ lib.teams.home-assistant ];
   };
 
   options.services.home-assistant = {
diff --git a/nixos/modules/services/matrix/dendrite.nix b/nixos/modules/services/matrix/dendrite.nix
index 2c31266457df..302bd42b5e37 100644
--- a/nixos/modules/services/matrix/dendrite.nix
+++ b/nixos/modules/services/matrix/dendrite.nix
@@ -341,5 +341,5 @@ in
       };
     };
   };
-  meta.maintainers = lib.teams.matrix.members;
+  meta.teams = [ lib.teams.matrix ];
 }
diff --git a/nixos/modules/services/misc/forgejo.nix b/nixos/modules/services/misc/forgejo.nix
index 9b85fc8dc133..6834ca2008ea 100644
--- a/nixos/modules/services/misc/forgejo.nix
+++ b/nixos/modules/services/misc/forgejo.nix
@@ -849,5 +849,5 @@ in
   };
 
   meta.doc = ./forgejo.md;
-  meta.maintainers = lib.teams.forgejo.members;
+  meta.teams = [ lib.teams.forgejo ];
 }
diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix
index c353caed9e03..0601454e9b2e 100644
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@@ -1911,5 +1911,5 @@ in
   };
 
   meta.doc = ./gitlab.md;
-  meta.maintainers = teams.gitlab.members;
+  meta.teams = [ teams.gitlab ];
 }
diff --git a/nixos/modules/services/networking/epmd.nix b/nixos/modules/services/networking/epmd.nix
index c17a7c974fa7..d2aceb5a9bb1 100644
--- a/nixos/modules/services/networking/epmd.nix
+++ b/nixos/modules/services/networking/epmd.nix
@@ -63,5 +63,5 @@ in
     };
   };
 
-  meta.maintainers = lib.teams.beam.members;
+  meta.teams = [ lib.teams.beam ];
 }
diff --git a/nixos/modules/services/networking/jibri/default.nix b/nixos/modules/services/networking/jibri/default.nix
index e07bf5131a92..861a6713b017 100644
--- a/nixos/modules/services/networking/jibri/default.nix
+++ b/nixos/modules/services/networking/jibri/default.nix
@@ -444,5 +444,5 @@ in
     };
   };
 
-  meta.maintainers = lib.teams.jitsi.members;
+  meta.teams = [ lib.teams.jitsi ];
 }
diff --git a/nixos/modules/services/networking/jicofo.nix b/nixos/modules/services/networking/jicofo.nix
index 9d0fbfd74081..9c2139eff1ab 100644
--- a/nixos/modules/services/networking/jicofo.nix
+++ b/nixos/modules/services/networking/jicofo.nix
@@ -166,5 +166,5 @@ in
       lib.mkDefault "${pkgs.jicofo}/etc/jitsi/jicofo/logging.properties-journal";
   };
 
-  meta.maintainers = lib.teams.jitsi.members;
+  meta.teams = [ lib.teams.jitsi ];
 }
diff --git a/nixos/modules/services/networking/jigasi.nix b/nixos/modules/services/networking/jigasi.nix
index 54b2f36685f6..c6bcbd28dead 100644
--- a/nixos/modules/services/networking/jigasi.nix
+++ b/nixos/modules/services/networking/jigasi.nix
@@ -243,5 +243,5 @@ in
       lib.mkDefault "${stateDir}/logging.properties-journal";
   };
 
-  meta.maintainers = lib.teams.jitsi.members;
+  meta.teams = [ lib.teams.jitsi ];
 }
diff --git a/nixos/modules/services/networking/jitsi-videobridge.nix b/nixos/modules/services/networking/jitsi-videobridge.nix
index a55760d5cae2..bd9692e6338a 100644
--- a/nixos/modules/services/networking/jitsi-videobridge.nix
+++ b/nixos/modules/services/networking/jitsi-videobridge.nix
@@ -331,5 +331,5 @@ in
     ];
   };
 
-  meta.maintainers = lib.teams.jitsi.members;
+  meta.teams = [ lib.teams.jitsi ];
 }
diff --git a/nixos/modules/services/networking/modemmanager.nix b/nixos/modules/services/networking/modemmanager.nix
index fefee7a448eb..604340fd0748 100644
--- a/nixos/modules/services/networking/modemmanager.nix
+++ b/nixos/modules/services/networking/modemmanager.nix
@@ -9,7 +9,7 @@ let
 in
 {
   meta = {
-    maintainers = lib.teams.freedesktop.members;
+    teams = [ lib.teams.freedesktop ];
   };
 
   options = with lib; {
diff --git a/nixos/modules/services/networking/networkmanager.nix b/nixos/modules/services/networking/networkmanager.nix
index 1f3773c70b00..2cb3532471c8 100644
--- a/nixos/modules/services/networking/networkmanager.nix
+++ b/nixos/modules/services/networking/networkmanager.nix
@@ -142,9 +142,8 @@ in
 {
 
   meta = {
-    maintainers = teams.freedesktop.members ++ [
-      lib.maintainers.frontear
-    ];
+    teams = [ lib.teams.freedesktop ];
+    maintainers = [ lib.maintainers.frontear ];
   };
 
   ###### interface
diff --git a/nixos/modules/services/networking/shadowsocks.nix b/nixos/modules/services/networking/shadowsocks.nix
index 79d749abb9d5..79a0b66d260c 100644
--- a/nixos/modules/services/networking/shadowsocks.nix
+++ b/nixos/modules/services/networking/shadowsocks.nix
@@ -29,8 +29,15 @@ let
 
   configFile = pkgs.writeText "shadowsocks.json" (builtins.toJSON opts);
 
+  executablesMap = {
+    "${getName pkgs.shadowsocks-libev}" = {
+      server = "ss-server";
+    };
+    "${getName pkgs.shadowsocks-rust}" = {
+      server = "ssserver";
+    };
+  };
 in
-
 {
 
   ###### interface
@@ -47,14 +54,25 @@ in
         '';
       };
 
+      package = mkPackageOption pkgs "Shadowsocks" {
+        default = "shadowsocks-libev";
+      };
+
       localAddress = mkOption {
-        type = types.coercedTo types.str singleton (types.listOf types.str);
+        type =
+          with types;
+          oneOf [
+            str
+            (listOf str)
+          ];
+        # Keeped for compatibility
         default = [
           "[::0]"
           "0.0.0.0"
         ];
         description = ''
           Local addresses to which the server binds.
+          Note: shadowsocks-rust accepts only string parameter.
         '';
       };
 
@@ -163,14 +181,19 @@ in
           (noPasswd && !noPasswdFile) || (!noPasswd && noPasswdFile);
         message = "Option `password` or `passwordFile` must be set and cannot be set simultaneously";
       }
+      {
+        # Ensure localAddress is a string if package is shadowsocks-rust
+        assertion = !(getName cfg.package == "shadowsocks-rust" && !lib.strings.isString cfg.localAddress);
+        message = "Option `localAddress` must be a string when using shadowsocks-rust.";
+      }
     ];
 
-    systemd.services.shadowsocks-libev = {
-      description = "shadowsocks-libev Daemon";
+    systemd.services.${getName cfg.package} = {
+      description = "${getName cfg.package} Daemon";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
       path = [
-        pkgs.shadowsocks-libev
+        cfg.package
       ]
       ++ optional (cfg.plugin != null) cfg.plugin
       ++ optional (cfg.passwordFile != null) pkgs.jq;
@@ -179,7 +202,9 @@ in
         ${optionalString (cfg.passwordFile != null) ''
           cat ${configFile} | jq --arg password "$(cat "${cfg.passwordFile}")" '. + { password: $password }' > /tmp/shadowsocks.json
         ''}
-        exec ss-server -c ${if cfg.passwordFile != null then "/tmp/shadowsocks.json" else configFile}
+        exec ${(executablesMap.${getName cfg.package}).server} -c ${
+          if cfg.passwordFile != null then "/tmp/shadowsocks.json" else configFile
+        }
       '';
     };
   };
diff --git a/nixos/modules/services/search/meilisearch.nix b/nixos/modules/services/search/meilisearch.nix
index 17b6931fcc87..80aca66daf17 100644
--- a/nixos/modules/services/search/meilisearch.nix
+++ b/nixos/modules/services/search/meilisearch.nix
@@ -121,6 +121,9 @@ in
         Path to file which contains the master key.
         By doing so, all routes will be protected and will require a key to be accessed.
         If no master key is provided, all routes can be accessed without requiring any key.
+
+        You can generate a master key by running `openssl rand -base64 36`.
+        Alternatively, you can start Meilisearch without a master key and use the pre-generated key from the service's logs that can be obtained by `journalctl -u meilisearch | grep -- --master-key`.
       '';
       default = null;
       type = lib.types.nullOr lib.types.path;
diff --git a/nixos/modules/services/security/reaction.nix b/nixos/modules/services/security/reaction.nix
index 039e507ae57f..ba0cc6581dbc 100644
--- a/nixos/modules/services/security/reaction.nix
+++ b/nixos/modules/services/security/reaction.nix
@@ -299,10 +299,8 @@ in
       environment.systemPackages = [ cfg.package ];
     };
 
-  meta.maintainers =
-    with lib.maintainers;
-    [
-      ppom
-    ]
-    ++ lib.teams.ngi.members;
+  meta.teams = [ lib.teams.ngi ];
+  meta.maintainers = with lib.maintainers; [
+    ppom
+  ];
 }
diff --git a/nixos/modules/services/wayland/hypridle.nix b/nixos/modules/services/wayland/hypridle.nix
index 4ccb126b56f2..29e77c6be34f 100644
--- a/nixos/modules/services/wayland/hypridle.nix
+++ b/nixos/modules/services/wayland/hypridle.nix
@@ -28,5 +28,5 @@ in
     };
   };
 
-  meta.maintainers = lib.teams.hyprland.members;
+  meta.teams = [ lib.teams.hyprland ];
 }
diff --git a/nixos/modules/services/web-apps/jitsi-meet.nix b/nixos/modules/services/web-apps/jitsi-meet.nix
index b7993cfc46dc..18da068fa5c6 100644
--- a/nixos/modules/services/web-apps/jitsi-meet.nix
+++ b/nixos/modules/services/web-apps/jitsi-meet.nix
@@ -756,5 +756,5 @@ in
   };
 
   meta.doc = ./jitsi-meet.md;
-  meta.maintainers = lib.teams.jitsi.members;
+  meta.teams = [ lib.teams.jitsi ];
 }
diff --git a/nixos/modules/services/web-apps/librechat.nix b/nixos/modules/services/web-apps/librechat.nix
index 95f684a491f6..120d6d092268 100644
--- a/nixos/modules/services/web-apps/librechat.nix
+++ b/nixos/modules/services/web-apps/librechat.nix
@@ -6,6 +6,7 @@
 }:
 let
   cfg = config.services.librechat;
+  meiliCfg = config.services.meilisearch;
   format = pkgs.formats.yaml { };
   configFile = format.generate "librechat.yaml" cfg.settings;
   exportCredentials = n: _: ''export ${n}="$(${pkgs.systemd}/bin/systemd-creds cat ${n}_FILE)"'';
@@ -155,6 +156,26 @@ in
     };
 
     enableLocalDB = lib.mkEnableOption "a local mongodb instance";
+
+    meilisearch = lib.mkOption {
+      type = lib.types.submodule {
+        options = {
+          enable = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            example = true;
+            description = ''
+              Whether to enable and configure Meilisearch locally for Librechat.
+              You will manually need to set `services.meilisearch.masterKeyFile`.
+            '';
+          };
+        };
+      };
+      default = { };
+      description = ''
+        See [LibreChat search feature](https://www.librechat.ai/docs/features/search).
+      '';
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -178,6 +199,12 @@ in
           You can use https://www.librechat.ai/toolkit/creds_generator to generate these.
         '';
       }
+      {
+        assertion = cfg.meilisearch.enable -> meiliCfg.masterKeyFile != null;
+        message = ''
+          LibreChat's Meilisearch integration requires `services.meilisearch.masterKeyFile` to be set.
+        '';
+      }
     ];
 
     networking.firewall.allowedTCPPorts = lib.optional cfg.openFirewall cfg.port;
@@ -192,7 +219,8 @@ in
       after = [
         "tmpfiles.target"
       ]
-      ++ lib.optional cfg.enableLocalDB "mongodb.service";
+      ++ lib.optional cfg.meilisearch.enable "meilisearch.service";
+      wants = lib.optional cfg.meilisearch.enable "meilisearch.service";
       description = "Open-source app for all your AI conversations, fully customizable and compatible with any AI provider";
       environment = cfg.env;
       script = # sh
@@ -249,6 +277,11 @@ in
 
     services.librechat.env.MONGO_URI = lib.mkIf cfg.enableLocalDB "mongodb://localhost:27017";
     services.mongodb.enable = lib.mkIf cfg.enableLocalDB true;
+
+    services.meilisearch.enable = lib.mkIf cfg.meilisearch.enable true;
+    services.librechat.env.SEARCH = lib.mkIf cfg.meilisearch.enable true;
+    services.librechat.env.MEILI_HOST = lib.mkIf cfg.meilisearch.enable "http://${meiliCfg.settings.http_addr}";
+    services.librechat.credentials.MEILI_MASTER_KEY = lib.mkIf cfg.meilisearch.enable meiliCfg.masterKeyFile;
   };
 
   meta.maintainers = with lib.maintainers; [
diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index cff0f6ff1872..d069480f3d70 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -1774,5 +1774,5 @@ in
   );
 
   meta.doc = ./nextcloud.md;
-  meta.maintainers = lib.teams.nextcloud.members;
+  meta.teams = [ lib.teams.nextcloud ];
 }
diff --git a/nixos/modules/services/web-apps/peertube-runner.nix b/nixos/modules/services/web-apps/peertube-runner.nix
index 9b126b7fa97c..4756569d9d9c 100644
--- a/nixos/modules/services/web-apps/peertube-runner.nix
+++ b/nixos/modules/services/web-apps/peertube-runner.nix
@@ -252,5 +252,5 @@ in
     };
   };
 
-  meta.maintainers = lib.teams.ngi.members;
+  meta.teams = [ lib.teams.ngi ];
 }
diff --git a/nixos/modules/services/web-apps/speedtest-tracker.nix b/nixos/modules/services/web-apps/speedtest-tracker.nix
new file mode 100644
index 000000000000..310fbb52012b
--- /dev/null
+++ b/nixos/modules/services/web-apps/speedtest-tracker.nix
@@ -0,0 +1,429 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.services.speedtest-tracker;
+
+  user = cfg.user;
+  group = cfg.group;
+
+  defaultUser = "speedtest-tracker";
+  defaultGroup = "speedtest-tracker";
+
+  artisan = "${cfg.package}/artisan";
+
+  env-file-values = lib.mapAttrs' (n: v: {
+    name = lib.removeSuffix "_FILE" n;
+    value = v;
+  }) (lib.filterAttrs (n: v: v != null && lib.match ".+_FILE" n != null) cfg.settings);
+
+  env-nonfile-values = lib.filterAttrs (n: v: lib.match ".+_FILE" n == null) cfg.settings;
+
+  speedtest-tracker-maintenance = pkgs.writeShellScript "speedtest-tracker-maintenance.sh" ''
+    set -a
+    ${lib.toShellVars env-nonfile-values}
+    ${lib.concatLines (lib.mapAttrsToList (n: v: "${n}=\"$(< ${v})\"") env-file-values)}
+    set +a
+    ${lib.optionalString (
+      cfg.settings.DB_CONNECTION == "sqlite"
+    ) "touch ${cfg.dataDir}/storage/database/database.sqlite"}
+    rm -f ${cfg.dataDir}/cache/*.php
+    ${artisan} package:discover
+    ${artisan} migrate --force
+    ${artisan} optimize:clear
+    ${artisan} view:cache
+    ${artisan} config:cache
+  '';
+
+  speedtest-tracker-env-script =
+    command:
+    pkgs.writeShellScript "speedtest-tracker-${builtins.replaceStrings [ ":" " " ] [ "-" "-" ] command}.sh" ''
+      set -a
+      ${lib.toShellVars env-nonfile-values}
+      ${lib.concatLines (lib.mapAttrsToList (n: v: "${n}=\"$(< ${v})\"") env-file-values)}
+      set +a
+      exec ${artisan} ${command}
+    '';
+
+  commonServiceConfig = {
+    Type = "oneshot";
+    User = user;
+    Group = group;
+    StateDirectory = "speedtest-tracker";
+    ReadWritePaths = [ cfg.dataDir ];
+    WorkingDirectory = cfg.package;
+    PrivateTmp = true;
+    PrivateDevices = true;
+    CapabilityBoundingSet = "";
+    AmbientCapabilities = "";
+    ProtectSystem = "strict";
+    ProtectKernelTunables = true;
+    ProtectKernelModules = true;
+    ProtectControlGroups = true;
+    ProtectClock = true;
+    ProtectHostname = true;
+    ProtectHome = "tmpfs";
+    ProtectKernelLogs = true;
+    ProtectProc = "invisible";
+    ProcSubset = "pid";
+    PrivateNetwork = false;
+    RestrictAddressFamilies = "AF_INET AF_INET6 AF_UNIX";
+    SystemCallArchitectures = "native";
+    SystemCallFilter = [
+      "@system-service @resources"
+      "~@obsolete @privileged"
+    ];
+    RestrictSUIDSGID = true;
+    RemoveIPC = true;
+    NoNewPrivileges = true;
+    RestrictRealtime = true;
+    RestrictNamespaces = true;
+    LockPersonality = true;
+    PrivateUsers = true;
+  };
+
+in
+{
+  options.services.speedtest-tracker = {
+
+    enable = lib.mkEnableOption "Speedtest Tracker: A self-hosted internet performance tracking application";
+
+    package =
+      lib.mkPackageOption pkgs "speedtest-tracker" { }
+      // lib.mkOption {
+        apply =
+          speedtest-tracker:
+          speedtest-tracker.override (prev: {
+            dataDir = cfg.dataDir;
+          });
+      };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = defaultUser;
+      description = "User account under which Speedtest Tracker runs.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = if cfg.enableNginx then "nginx" else defaultGroup;
+      defaultText = "If `services.speedtest-tracker.enableNginx` is true then `nginx` else ${defaultGroup}";
+      description = ''
+        Group under which Speedtest Tracker runs. It is best to set this to the group
+        of whatever webserver is being used as the frontend.
+      '';
+    };
+
+    dataDir = lib.mkOption {
+      type = lib.types.path;
+      default = "/var/lib/speedtest-tracker";
+      description = ''
+        The place where Speedtest Tracker stores its state.
+      '';
+    };
+
+    enableNginx = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Whether to enable nginx or not. If enabled, an nginx virtual host will
+        be created for access to Speedtest Tracker. If not enabled, then you may use
+        `''${config.services.speedtest-tracker.package}` as your document root in
+        whichever webserver you wish to setup.
+      '';
+    };
+
+    virtualHost = lib.mkOption {
+      type = lib.types.str;
+      default = "localhost";
+      description = ''
+        The hostname at which you wish Speedtest Tracker to be served. If you have
+        enabled nginx using `services.speedtest-tracker.enableNginx` then this will
+        be used.
+      '';
+    };
+
+    poolConfig = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.oneOf [
+          lib.types.str
+          lib.types.int
+          lib.types.bool
+        ]
+      );
+      default = { };
+      defaultText = ''
+        {
+          "pm" = "dynamic";
+          "pm.max_children" = 32;
+          "pm.start_servers" = 2;
+          "pm.min_spare_servers" = 2;
+          "pm.max_spare_servers" = 4;
+          "pm.max_requests" = 500;
+        }
+      '';
+      description = ''
+        Options for the Speedtest Tracker PHP pool. See the documentation on `php-fpm.conf`
+        for details on configuration directives.
+      '';
+    };
+
+    settings = lib.mkOption {
+      default = { };
+      description = ''
+        Options for Speedtest Tracker configuration. Refer to
+        <https://github.com/alexjustesen/speedtest-tracker> for
+        details on supported values. All `_FILE` values are supported:
+        append `_FILE` to the setting name to provide a path to a file
+        containing the secret value.
+      '';
+      example = lib.literalExpression ''
+        {
+          APP_KEY_FILE = "/var/secrets/speedtest-tracker-app-key.txt";
+          DB_CONNECTION = "mysql";
+          DB_HOST = "db";
+          DB_PORT = 3306;
+          DB_DATABASE = "speedtest-tracker";
+          DB_USERNAME = "speedtest-tracker";
+          DB_PASSWORD_FILE = "/var/secrets/speedtest-tracker-mysql-password.txt";
+        }
+      '';
+      type = lib.types.submodule {
+        freeformType = lib.types.attrsOf (
+          lib.types.oneOf [
+            lib.types.str
+            lib.types.int
+            lib.types.bool
+          ]
+        );
+        options = {
+          APP_KEY_FILE = lib.mkOption {
+            type = lib.types.path;
+            description = ''
+              The path to your appkey. The file should contain a 32 character
+              random app key. This may be set using `echo "base64:$(head -c 32
+              /dev/urandom | base64)" > /path/to/key-file`.
+            '';
+          };
+          APP_URL = lib.mkOption {
+            type = lib.types.str;
+            default =
+              if cfg.virtualHost == "localhost" then
+                "http://${cfg.virtualHost}"
+              else
+                "https://${cfg.virtualHost}";
+            defaultText = ''
+              http(s)://''${config.services.speedtest-tracker.virtualHost}
+            '';
+            description = ''
+              The APP_URL used by Speedtest Tracker internally. Please make sure this
+              URL matches the external URL of your installation. It is used to
+              validate specific requests and to generate URLs in notifications.
+            '';
+          };
+          DB_CONNECTION = lib.mkOption {
+            type = lib.types.enum [
+              "sqlite"
+              "mysql"
+              "mariadb"
+              "pgsql"
+            ];
+            default = "sqlite";
+            example = "pgsql";
+            description = ''
+              The type of database you wish to use. Can be one of "sqlite",
+              "mysql", "mariadb" or "pgsql".
+            '';
+          };
+          DB_HOST = lib.mkOption {
+            type = lib.types.str;
+            default = "localhost";
+            description = ''
+              The IP or hostname which hosts your database.
+            '';
+          };
+          DB_PORT = lib.mkOption {
+            type = lib.types.nullOr lib.types.int;
+            default =
+              if cfg.settings.DB_CONNECTION == "pgsql" then
+                5432
+              else if cfg.settings.DB_CONNECTION == "mysql" || cfg.settings.DB_CONNECTION == "mariadb" then
+                3306
+              else
+                null;
+            defaultText = ''
+              `null` if DB_CONNECTION is "sqlite", `3306` if "mysql" or "mariadb", `5432` if "pgsql"
+            '';
+            description = ''
+              The port your database is listening at. sqlite does not require
+              this value to be filled.
+            '';
+          };
+          DB_DATABASE = lib.mkOption {
+            type = lib.types.str;
+            default =
+              if cfg.settings.DB_CONNECTION == "sqlite" then
+                "${cfg.dataDir}/storage/database/database.sqlite"
+              else
+                "speedtest-tracker";
+            defaultText = ''
+              "''${config.services.speedtest-tracker.dataDir}/storage/database/database.sqlite" if DB_CONNECTION is "sqlite", "speedtest-tracker" otherwise
+            '';
+            description = ''
+              The name of the database, or path to the sqlite file.
+            '';
+          };
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    services.phpfpm.pools.speedtest-tracker = {
+      inherit user group;
+      phpPackage = cfg.package.phpPackage;
+      phpOptions = ''
+        log_errors = on
+      '';
+      settings = {
+        "listen.mode" = lib.mkDefault "0660";
+        "listen.owner" = lib.mkDefault user;
+        "listen.group" = lib.mkDefault group;
+        "pm" = lib.mkDefault "dynamic";
+        "pm.max_children" = lib.mkDefault 32;
+        "pm.start_servers" = lib.mkDefault 2;
+        "pm.min_spare_servers" = lib.mkDefault 2;
+        "pm.max_spare_servers" = lib.mkDefault 4;
+        "pm.max_requests" = lib.mkDefault 500;
+      }
+      // cfg.poolConfig;
+    };
+
+    systemd.services.speedtest-tracker-setup = {
+      after = [
+        "postgresql.target"
+        "mysql.service"
+      ];
+      requiredBy = [ "phpfpm-speedtest-tracker.service" ];
+      before = [ "phpfpm-speedtest-tracker.service" ];
+      serviceConfig = {
+        ExecStart = speedtest-tracker-maintenance;
+        RemainAfterExit = true;
+      }
+      // commonServiceConfig;
+      unitConfig.JoinsNamespaceOf = "phpfpm-speedtest-tracker.service";
+      restartTriggers = [ cfg.package ];
+      partOf = [ "phpfpm-speedtest-tracker.service" ];
+    };
+
+    systemd.services.speedtest-tracker-scheduler = {
+      after = [ "speedtest-tracker-setup.service" ];
+      wants = [ "speedtest-tracker-setup.service" ];
+      description = "Speedtest Tracker scheduler";
+      path = [ pkgs.ookla-speedtest ];
+      serviceConfig = {
+        ExecStart = speedtest-tracker-env-script "schedule:run";
+      }
+      // commonServiceConfig;
+    };
+
+    systemd.timers.speedtest-tracker-scheduler = {
+      description = "Speedtest Tracker scheduler timer";
+      timerConfig = {
+        OnCalendar = "minutely";
+        Persistent = true;
+      };
+      wantedBy = [ "timers.target" ];
+      restartTriggers = [ cfg.package ];
+    };
+
+    systemd.services.speedtest-tracker-queue-worker = {
+      after = [ "speedtest-tracker-setup.service" ];
+      wants = [ "speedtest-tracker-setup.service" ];
+      wantedBy = [ "multi-user.target" ];
+      description = "Speedtest Tracker queue worker";
+      path = [ pkgs.ookla-speedtest ];
+      serviceConfig = commonServiceConfig // {
+        Type = "simple";
+        Restart = "always";
+        ExecStart = speedtest-tracker-env-script "queue:work --sleep=3 --tries=3";
+      };
+    };
+
+    services.nginx = lib.mkIf cfg.enableNginx {
+      enable = true;
+      recommendedTlsSettings = lib.mkDefault true;
+      recommendedOptimisation = lib.mkDefault true;
+      recommendedGzipSettings = lib.mkDefault true;
+      virtualHosts.${cfg.virtualHost} = {
+        root = "${cfg.package}/public";
+        locations = {
+          "/" = {
+            tryFiles = "$uri $uri/ /index.php?$query_string";
+            index = "index.php";
+            extraConfig = ''
+              sendfile off;
+            '';
+          };
+          "~ \\.php$" = {
+            extraConfig = ''
+              include ${config.services.nginx.package}/conf/fastcgi_params;
+              fastcgi_param SCRIPT_FILENAME $request_filename;
+              fastcgi_param modHeadersAvailable true;
+              fastcgi_pass unix:${config.services.phpfpm.pools.speedtest-tracker.socket};
+            '';
+          };
+          "~ \\.(js|css|gif|png|ico|jpg|jpeg)$" = {
+            extraConfig = "expires 365d;";
+          };
+        };
+      };
+    };
+
+    systemd.tmpfiles.settings."10-speedtest-tracker" =
+      lib.genAttrs
+        [
+          "${cfg.dataDir}/storage"
+          "${cfg.dataDir}/storage/app"
+          "${cfg.dataDir}/storage/database"
+          "${cfg.dataDir}/storage/framework"
+          "${cfg.dataDir}/storage/framework/cache"
+          "${cfg.dataDir}/storage/framework/sessions"
+          "${cfg.dataDir}/storage/framework/views"
+          "${cfg.dataDir}/storage/logs"
+          "${cfg.dataDir}/cache"
+        ]
+        (n: {
+          d = {
+            inherit group;
+            mode = "0700";
+            inherit user;
+          };
+        })
+      // {
+        "${cfg.dataDir}".d = {
+          inherit group;
+          mode = "0710";
+          inherit user;
+        };
+      };
+
+    users = {
+      users = lib.mkIf (user == defaultUser) {
+        ${defaultUser} = {
+          inherit group;
+          isSystemUser = true;
+          home = cfg.dataDir;
+        };
+      };
+      groups = lib.mkIf (group == defaultGroup) { ${defaultGroup} = { }; };
+    };
+  };
+
+  meta.maintainers = pkgs.speedtest-tracker.meta.maintainers;
+}
diff --git a/nixos/modules/services/x11/desktop-managers/enlightenment.nix b/nixos/modules/services/x11/desktop-managers/enlightenment.nix
index bc5c2b0273e7..df132f95e95c 100644
--- a/nixos/modules/services/x11/desktop-managers/enlightenment.nix
+++ b/nixos/modules/services/x11/desktop-managers/enlightenment.nix
@@ -25,7 +25,7 @@ in
 
 {
   meta = {
-    maintainers = teams.enlightenment.members;
+    teams = [ teams.enlightenment ];
   };
 
   imports = [
diff --git a/nixos/modules/services/x11/desktop-managers/lumina.nix b/nixos/modules/services/x11/desktop-managers/lumina.nix
index 74fabced3af3..a0cd79f7aae7 100644
--- a/nixos/modules/services/x11/desktop-managers/lumina.nix
+++ b/nixos/modules/services/x11/desktop-managers/lumina.nix
@@ -16,7 +16,7 @@ in
 
 {
   meta = {
-    maintainers = teams.lumina.members;
+    teams = [ teams.lumina ];
   };
 
   options = {
diff --git a/nixos/modules/services/x11/desktop-managers/lxqt.nix b/nixos/modules/services/x11/desktop-managers/lxqt.nix
index 1ccaa28f8642..8948eff23d46 100644
--- a/nixos/modules/services/x11/desktop-managers/lxqt.nix
+++ b/nixos/modules/services/x11/desktop-managers/lxqt.nix
@@ -15,7 +15,7 @@ in
 
 {
   meta = {
-    maintainers = teams.lxqt.members;
+    teams = [ teams.lxqt ];
   };
 
   options = {
diff --git a/nixos/modules/services/x11/desktop-managers/xfce.nix b/nixos/modules/services/x11/desktop-managers/xfce.nix
index 55da49799e31..2d53eb58f287 100644
--- a/nixos/modules/services/x11/desktop-managers/xfce.nix
+++ b/nixos/modules/services/x11/desktop-managers/xfce.nix
@@ -15,7 +15,7 @@ let
 in
 {
   meta = {
-    maintainers = teams.xfce.members;
+    teams = [ teams.xfce ];
   };
 
   imports = [
diff --git a/nixos/modules/services/x11/display-managers/account-service-util.nix b/nixos/modules/services/x11/display-managers/account-service-util.nix
index 0f4d1c0729ad..697d5b9e940d 100644
--- a/nixos/modules/services/x11/display-managers/account-service-util.nix
+++ b/nixos/modules/services/x11/display-managers/account-service-util.nix
@@ -40,6 +40,6 @@ python3.pkgs.buildPythonApplication {
   '';
 
   meta = {
-    maintainers = [ ] ++ lib.teams.pantheon.members;
+    teams = [ lib.teams.pantheon ];
   };
 }
diff --git a/nixos/modules/services/x11/display-managers/lightdm-greeters/lomiri.nix b/nixos/modules/services/x11/display-managers/lightdm-greeters/lomiri.nix
index 387f485e2fea..d8db7706d89f 100644
--- a/nixos/modules/services/x11/display-managers/lightdm-greeters/lomiri.nix
+++ b/nixos/modules/services/x11/display-managers/lightdm-greeters/lomiri.nix
@@ -13,7 +13,7 @@ let
 
 in
 {
-  meta.maintainers = lib.teams.lomiri.members;
+  meta.teams = [ lib.teams.lomiri ];
 
   options = {
     services.xserver.displayManager.lightdm.greeters.lomiri = {
diff --git a/nixos/modules/services/x11/display-managers/lightdm-greeters/pantheon.nix b/nixos/modules/services/x11/display-managers/lightdm-greeters/pantheon.nix
index 05e03befdad6..3c61ba1556c8 100644
--- a/nixos/modules/services/x11/display-managers/lightdm-greeters/pantheon.nix
+++ b/nixos/modules/services/x11/display-managers/lightdm-greeters/pantheon.nix
@@ -16,7 +16,7 @@ let
 in
 {
   meta = {
-    maintainers = [ ] ++ lib.teams.pantheon.members;
+    teams = [ lib.teams.pantheon ];
   };
 
   options = {
diff --git a/nixos/modules/services/x11/display-managers/lightdm.nix b/nixos/modules/services/x11/display-managers/lightdm.nix
index 1ace9c1b8c1f..467207ecd92b 100644
--- a/nixos/modules/services/x11/display-managers/lightdm.nix
+++ b/nixos/modules/services/x11/display-managers/lightdm.nix
@@ -73,7 +73,7 @@ let
 in
 {
   meta = {
-    maintainers = [ ] ++ lib.teams.pantheon.members;
+    teams = [ lib.teams.pantheon ];
   };
 
   # Note: the order in which lightdm greeter modules are imported
diff --git a/nixos/modules/services/x11/touchegg.nix b/nixos/modules/services/x11/touchegg.nix
index def3dac738e0..cb1b9eb4adc8 100644
--- a/nixos/modules/services/x11/touchegg.nix
+++ b/nixos/modules/services/x11/touchegg.nix
@@ -13,7 +13,7 @@ let
 in
 {
   meta = {
-    maintainers = teams.pantheon.members;
+    teams = [ teams.pantheon ];
   };
 
   ###### interface
diff --git a/nixos/modules/virtualisation/containers.nix b/nixos/modules/virtualisation/containers.nix
index a0c7e826223d..6386a57079f2 100644
--- a/nixos/modules/virtualisation/containers.nix
+++ b/nixos/modules/virtualisation/containers.nix
@@ -13,7 +13,7 @@ let
 in
 {
   meta = {
-    maintainers = [ ] ++ lib.teams.podman.members;
+    teams = [ lib.teams.podman ];
   };
 
   options.virtualisation.containers = {
diff --git a/nixos/modules/virtualisation/cri-o.nix b/nixos/modules/virtualisation/cri-o.nix
index ddaccf8199a1..68cfc2ccaad9 100644
--- a/nixos/modules/virtualisation/cri-o.nix
+++ b/nixos/modules/virtualisation/cri-o.nix
@@ -21,7 +21,7 @@ let
 in
 {
   meta = {
-    maintainers = teams.podman.members;
+    teams = [ teams.podman ];
   };
 
   options.virtualisation.cri-o = {
diff --git a/nixos/modules/virtualisation/incus-agent.nix b/nixos/modules/virtualisation/incus-agent.nix
index bfb9eeb75d33..34c08e8ee014 100644
--- a/nixos/modules/virtualisation/incus-agent.nix
+++ b/nixos/modules/virtualisation/incus-agent.nix
@@ -10,7 +10,7 @@ let
 in
 {
   meta = {
-    maintainers = lib.teams.lxc.members;
+    teams = [ lib.teams.lxc ];
   };
 
   options = {
diff --git a/nixos/modules/virtualisation/incus-virtual-machine.nix b/nixos/modules/virtualisation/incus-virtual-machine.nix
index 8899fc34bb85..d714b7fdc36c 100644
--- a/nixos/modules/virtualisation/incus-virtual-machine.nix
+++ b/nixos/modules/virtualisation/incus-virtual-machine.nix
@@ -10,7 +10,7 @@ let
 in
 {
   meta = {
-    maintainers = lib.teams.lxc.members;
+    teams = [ lib.teams.lxc ];
   };
 
   imports = [
diff --git a/nixos/modules/virtualisation/incus.nix b/nixos/modules/virtualisation/incus.nix
index 7101407fb5bc..1b8908d0d3d6 100644
--- a/nixos/modules/virtualisation/incus.nix
+++ b/nixos/modules/virtualisation/incus.nix
@@ -176,7 +176,7 @@ let
 in
 {
   meta = {
-    maintainers = lib.teams.lxc.members;
+    teams = [ lib.teams.lxc ];
   };
 
   options = {
diff --git a/nixos/modules/virtualisation/lxc-container.nix b/nixos/modules/virtualisation/lxc-container.nix
index a6964b8b2c9a..ec206d6a5ece 100644
--- a/nixos/modules/virtualisation/lxc-container.nix
+++ b/nixos/modules/virtualisation/lxc-container.nix
@@ -7,7 +7,7 @@
 
 {
   meta = {
-    maintainers = lib.teams.lxc.members;
+    teams = [ lib.teams.lxc ];
   };
 
   imports = [
diff --git a/nixos/modules/virtualisation/lxc-image-metadata.nix b/nixos/modules/virtualisation/lxc-image-metadata.nix
index d27f476a59b8..1ac1bd2e4e5e 100644
--- a/nixos/modules/virtualisation/lxc-image-metadata.nix
+++ b/nixos/modules/virtualisation/lxc-image-metadata.nix
@@ -71,7 +71,7 @@ in
   ];
 
   meta = {
-    maintainers = lib.teams.lxc.members;
+    teams = [ lib.teams.lxc ];
   };
 
   options = {
diff --git a/nixos/modules/virtualisation/lxc-instance-common.nix b/nixos/modules/virtualisation/lxc-instance-common.nix
index ff27b1931f8b..d3056be46fe3 100644
--- a/nixos/modules/virtualisation/lxc-instance-common.nix
+++ b/nixos/modules/virtualisation/lxc-instance-common.nix
@@ -2,7 +2,7 @@
 
 {
   meta = {
-    maintainers = lib.teams.lxc.members;
+    teams = [ lib.teams.lxc ];
   };
 
   imports = [
diff --git a/nixos/modules/virtualisation/lxc.nix b/nixos/modules/virtualisation/lxc.nix
index 903006a6dabf..eca2eb8115ab 100644
--- a/nixos/modules/virtualisation/lxc.nix
+++ b/nixos/modules/virtualisation/lxc.nix
@@ -13,7 +13,7 @@ in
 
 {
   meta = {
-    maintainers = lib.teams.lxc.members;
+    teams = [ lib.teams.lxc ];
   };
 
   options.virtualisation.lxc = {
diff --git a/nixos/modules/virtualisation/lxcfs.nix b/nixos/modules/virtualisation/lxcfs.nix
index f7347af19148..711bcf655d22 100644
--- a/nixos/modules/virtualisation/lxcfs.nix
+++ b/nixos/modules/virtualisation/lxcfs.nix
@@ -12,7 +12,7 @@ let
 in
 {
   meta = {
-    maintainers = lib.teams.lxc.members;
+    teams = [ lib.teams.lxc ];
   };
 
   ###### interface
diff --git a/nixos/modules/virtualisation/podman/default.nix b/nixos/modules/virtualisation/podman/default.nix
index 63cc4c5e3f63..c0acbe4cac3d 100644
--- a/nixos/modules/virtualisation/podman/default.nix
+++ b/nixos/modules/virtualisation/podman/default.nix
@@ -63,7 +63,7 @@ in
   ];
 
   meta = {
-    maintainers = lib.teams.podman.members;
+    teams = [ lib.teams.podman ];
   };
 
   options.virtualisation.podman = {
diff --git a/nixos/modules/virtualisation/podman/network-socket-ghostunnel.nix b/nixos/modules/virtualisation/podman/network-socket-ghostunnel.nix
index d5b4bef5f0d9..962ca39b1598 100644
--- a/nixos/modules/virtualisation/podman/network-socket-ghostunnel.nix
+++ b/nixos/modules/virtualisation/podman/network-socket-ghostunnel.nix
@@ -35,5 +35,6 @@ in
 
   };
 
-  meta.maintainers = lib.teams.podman.members ++ [ lib.maintainers.roberth ];
+  meta.teams = [ lib.teams.podman ];
+  meta.maintainers = [ lib.maintainers.roberth ];
 }
diff --git a/nixos/modules/virtualisation/podman/network-socket.nix b/nixos/modules/virtualisation/podman/network-socket.nix
index 39434216d780..d3a49d204f8a 100644
--- a/nixos/modules/virtualisation/podman/network-socket.nix
+++ b/nixos/modules/virtualisation/podman/network-socket.nix
@@ -95,5 +95,6 @@ in
     networking.firewall.allowedTCPPorts = lib.optional (cfg.enable && cfg.openFirewall) cfg.port;
   };
 
-  meta.maintainers = lib.teams.podman.members ++ [ lib.maintainers.roberth ];
+  meta.teams = [ lib.teams.podman ];
+  meta.maintainers = [ lib.maintainers.roberth ];
 }
diff --git a/nixos/modules/virtualisation/xen-dom0.nix b/nixos/modules/virtualisation/xen-dom0.nix
index bbd6bfb57751..2cc939631f84 100644
--- a/nixos/modules/virtualisation/xen-dom0.nix
+++ b/nixos/modules/virtualisation/xen-dom0.nix
@@ -937,6 +937,6 @@ in
   };
   meta = {
     doc = ./xen.md;
-    maintainers = teams.xen.members;
+    teams = [ teams.xen ];
   };
 }
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 763441391abb..8985130a6f8d 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1493,6 +1493,7 @@ in
   sonic-server = runTest ./sonic-server.nix;
   spacecookie = runTest ./spacecookie.nix;
   spark = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./spark { };
+  speedtest-tracker = runTest ./speedtest-tracker.nix;
   spiped = runTest ./spiped.nix;
   spire = runTest ./spire.nix;
   sqlite3-to-mysql = runTest ./sqlite3-to-mysql.nix;
diff --git a/nixos/tests/librechat.nix b/nixos/tests/librechat.nix
index e737c139844f..28f0ab7ac3af 100644
--- a/nixos/tests/librechat.nix
+++ b/nixos/tests/librechat.nix
@@ -17,6 +17,7 @@
       credsIvFile = pkgs.writeText "librechat-creds-iv" "7c09a571f65ac793611685cc9ab1dbe7";
       jwtSecret = pkgs.writeText "librechat-jwt-secret" "29c4dc7f7de15306accf5eddb4cb8a70eb233d9fba4301f8f47f14c8c047ac81";
       jwtRefreshSecret = pkgs.writeText "librechat-jwt-refresh-secret" "f2c1685561f2f570b3e7955df267b5c602ee099f14dc5caa0dacc320580ea180";
+      meilisearchMasterKeyFile = pkgs.writeText "meilisearch-master-key" "xHkP3Bzcf98fw7FiSCR82g5ULLGrXc4frK1qkEfN8St/3kJZ";
     in
     {
       services.librechat = {
@@ -32,13 +33,19 @@
           JWT_REFRESH_SECRET = jwtRefreshSecret;
         };
         enableLocalDB = true;
+        meilisearch.enable = true;
       };
+
+      services.meilisearch.masterKeyFile = meilisearchMasterKeyFile;
     };
 
   testScript = ''
     machine.start()
 
     machine.succeed("grep -qF 'ALLOW_REGISTRATION=true' /etc/systemd/system/librechat.service")
+    machine.succeed("grep -qF 'SEARCH=true' /etc/systemd/system/librechat.service")
+    machine.succeed("grep -qF 'MEILI_HOST=http://localhost:7700' /etc/systemd/system/librechat.service")
+    machine.succeed("grep -qG 'MEILI_MASTER_KEY_FILE:/nix/store/.*meilisearch-master-key' /etc/systemd/system/librechat.service")
 
     machine.wait_for_unit("librechat.service")
     machine.wait_for_open_port(3080)
diff --git a/nixos/tests/shadowsocks/common.nix b/nixos/tests/shadowsocks/common.nix
index 298483f36b8f..1ce54101a8be 100644
--- a/nixos/tests/shadowsocks/common.nix
+++ b/nixos/tests/shadowsocks/common.nix
@@ -1,11 +1,13 @@
 {
   name,
+  package,
   plugin ? null,
   pluginOpts ? "",
 }:
 
 import ../make-test-python.nix (
   { pkgs, lib, ... }:
+
   {
     inherit name;
     meta = {
@@ -27,9 +29,10 @@ import ../make-test-python.nix (
         networking.firewall.allowedUDPPorts = [ 8488 ];
         services.shadowsocks = {
           enable = true;
+          package = package;
           encryptionMethod = "chacha20-ietf-poly1305";
           password = "pa$$w0rd";
-          localAddress = [ "0.0.0.0" ];
+          localAddress = "0.0.0.0";
           port = 8488;
           fastOpen = false;
           mode = "tcp_and_udp";
@@ -78,7 +81,7 @@ import ../make-test-python.nix (
     testScript = ''
       start_all()
 
-      server.wait_for_unit("shadowsocks-libev.service")
+      server.wait_for_unit("${lib.getName package}.service")
       server.wait_for_unit("nginx.service")
       client.wait_for_unit("shadowsocks-client.service")
 
diff --git a/nixos/tests/shadowsocks/default.nix b/nixos/tests/shadowsocks/default.nix
index 3587ffb0edc5..62e67d59afd6 100644
--- a/nixos/tests/shadowsocks/default.nix
+++ b/nixos/tests/shadowsocks/default.nix
@@ -5,12 +5,26 @@
 }:
 
 {
-  "basic" = import ./common.nix {
-    name = "basic";
+  "basic-libev" = import ./common.nix {
+    name = "basic-libev";
+    package = pkgs.shadowsocks-libev;
   };
 
-  "v2ray-plugin" = import ./common.nix {
-    name = "v2ray-plugin";
+  "basic-rust" = import ./common.nix {
+    name = "basic-rust";
+    package = pkgs.shadowsocks-rust;
+  };
+
+  "v2ray-plugin-libev" = import ./common.nix {
+    name = "v2ray-plugin-libev";
+    package = pkgs.shadowsocks-libev;
+    plugin = "${pkgs.shadowsocks-v2ray-plugin}/bin/v2ray-plugin";
+    pluginOpts = "host=nixos.org";
+  };
+
+  "v2ray-plugin-rust" = import ./common.nix {
+    name = "v2ray-plugin-rust";
+    package = pkgs.shadowsocks-rust;
     plugin = "${pkgs.shadowsocks-v2ray-plugin}/bin/v2ray-plugin";
     pluginOpts = "host=nixos.org";
   };
diff --git a/nixos/tests/speedtest-tracker.nix b/nixos/tests/speedtest-tracker.nix
new file mode 100644
index 000000000000..5d5c42957300
--- /dev/null
+++ b/nixos/tests/speedtest-tracker.nix
@@ -0,0 +1,33 @@
+{ lib, pkgs, ... }:
+
+let
+  app-key = "base64:VGVzdFRlc3RUZXN0VGVzdFRlc3RUZXN0VGVzdFRlc3Q=";
+in
+{
+  name = "speedtest-tracker";
+  meta = {
+    maintainers = pkgs.speedtest-tracker.meta.maintainers;
+    platforms = lib.platforms.linux;
+  };
+
+  nodes.sqlite = {
+    environment.etc."speedtest-tracker-appkey".text = app-key;
+    services.speedtest-tracker = {
+      enable = true;
+      enableNginx = true;
+      settings = {
+        APP_KEY_FILE = "/etc/speedtest-tracker-appkey";
+      };
+    };
+  };
+
+  testScript = ''
+    sqlite.wait_for_unit("phpfpm-speedtest-tracker.service")
+    sqlite.wait_for_unit("nginx.service")
+    sqlite.wait_for_unit("speedtest-tracker-queue-worker.service")
+
+    sqlite.succeed("curl -Ls -o /dev/null -w '%{http_code}' http://localhost/admin/login | grep '200'")
+    sqlite.succeed("curl -Ls http://localhost/admin/login | grep -i 'login'")
+    sqlite.succeed("systemctl start speedtest-tracker-scheduler.service")
+  '';
+}
diff --git a/pkgs/applications/audio/reaper/default.nix b/pkgs/applications/audio/reaper/default.nix
index c1f1ae485654..793ecb7a443a 100644
--- a/pkgs/applications/audio/reaper/default.nix
+++ b/pkgs/applications/audio/reaper/default.nix
@@ -17,6 +17,7 @@
   xdg-utils,
   xdotool,
   which,
+  openssl,
 
   jackSupport ? stdenv.hostPlatform.isLinux,
   jackLibrary,
@@ -59,7 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     which
     autoPatchelfHook
-    xdg-utils # Required for desktop integration
+    xdg-utils # Required for install script
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     undmg
@@ -112,6 +113,7 @@ stdenv.mkDerivation (finalAttrs: {
         # We opt for wrapping the executable with LD_LIBRARY_PATH prefix.
         # Note that libcurl and libxml2_13 are needed for ReaPack to run.
         wrapProgram $out/opt/REAPER/reaper \
+          --prefix PATH : "${lib.makeBinPath [ xdg-utils ]}" \
           --prefix LD_LIBRARY_PATH : "${
             lib.makeLibraryPath [
               curl
@@ -121,6 +123,7 @@ stdenv.mkDerivation (finalAttrs: {
               vlc
               xdotool
               stdenv.cc.cc
+              openssl
             ]
           }"
 
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index fead5d0e4b99..de805ea1be44 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -27,13 +27,13 @@
     "vendorHash": null
   },
   "aiven_aiven": {
-    "hash": "sha256-lNDorhkIngyZ8S51lyuI3LRtnFtzVG01Nzo1vRPytbQ=",
+    "hash": "sha256-2kv5cBEogQXmWcN/fzg0Rxf/SuqLpeOr8O2NoOg57+c=",
     "homepage": "https://registry.terraform.io/providers/aiven/aiven",
     "owner": "aiven",
     "repo": "terraform-provider-aiven",
-    "rev": "v4.51.0",
+    "rev": "v4.52.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-c4eCY/iQ8v/gBX55j22TRxWIeoevi5EJs4TtN9xXfKA="
+    "vendorHash": "sha256-mUBHjGpDE7aFiyUovi7/doOrrZelmNJC+QYF5+2dxt0="
   },
   "akamai_akamai": {
     "hash": "sha256-vC7hVV/p28y7cv9PONEfRVj5uKgumtbq4HpbOYq9vBQ=",
@@ -580,13 +580,13 @@
     "vendorHash": "sha256-v/XHGUEpAIpGHErv7GPqfosVLL3xaqBwZHbJKS8fkn4="
   },
   "hashicorp_google-beta": {
-    "hash": "sha256-ypC8av5GnFBlUp2eVDZWqnPGrZT8QihYnxsIHw8g+oA=",
+    "hash": "sha256-wIAgFDHBVErm2NMiQszhnwJ6nWJA4qqDY/a6JdUrmyA=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
     "owner": "hashicorp",
     "repo": "terraform-provider-google-beta",
-    "rev": "v7.21.0",
+    "rev": "v7.22.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-KnB6R5yrEeaf4Z+LzQjCeQJjAgHK0kJEJzT1rb3pimY="
+    "vendorHash": "sha256-YZQMUGScsYjBkhAQ4DXYlBpAw805iKgX/iXDMTpRr6c="
   },
   "hashicorp_helm": {
     "hash": "sha256-S4Fe65f+gEWWxRMC+/i93dwwe7QigPccx4wiqNBpcL8=",
diff --git a/pkgs/by-name/ba/bagels/package.nix b/pkgs/by-name/ba/bagels/package.nix
index ef4d5aa3adc6..b924959fdfbe 100644
--- a/pkgs/by-name/ba/bagels/package.nix
+++ b/pkgs/by-name/ba/bagels/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "bagels";
-  version = "0.3.9";
+  version = "0.3.12";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "EnhancedJax";
     repo = "bagels";
     tag = finalAttrs.version;
-    hash = "sha256-LlEQ0by6Si37e8FvC4agjLy8eanizSA1iq44BaQ8D5o=";
+    hash = "sha256-w7Q7yCKffya2SyuHUaTWOugkeyTZbL9JNj/Ir3tnafE=";
   };
 
   build-system = with python3Packages; [
@@ -80,13 +80,23 @@ python3Packages.buildPythonApplication (finalAttrs: {
     # AttributeError: 'NoneType' object has no attribute 'defaults'
     "test_basic_balance_calculation"
     "test_combined_balance_calculation"
+    "test_create_template"
+    "test_create_multiple_templates"
+    "test_delete_template"
+    "test_get_adjacent_template"
+    "test_get_all_templates"
     "test_get_days_in_period"
     "test_get_period_average"
     "test_get_period_figures"
     "test_get_start_end_of_period"
     "test_get_start_end_of_week"
+    "test_get_template_by_id"
     "test_split_balance_calculation"
+    "test_swap_template_order"
+    "test_swap_template_order_edge_cases"
+    "test_template_validation"
     "test_transfer_balance_calculation"
+    "test_update_template"
   ];
 
   meta = {
diff --git a/pkgs/by-name/bu/buildstream/package.nix b/pkgs/by-name/bu/buildstream/package.nix
index 116e151c3b9b..134d77e4c660 100644
--- a/pkgs/by-name/bu/buildstream/package.nix
+++ b/pkgs/by-name/bu/buildstream/package.nix
@@ -2,7 +2,7 @@
   lib,
   python3Packages,
   fetchFromGitHub,
-  nix-update-script,
+  gitUpdater,
 
   # buildInputs
   buildbox,
@@ -119,7 +119,9 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   versionCheckProgram = "${placeholder "out"}/bin/bst";
 
-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = gitUpdater {
+    ignoredVersions = "dev";
+  };
 
   meta = {
     description = "Powerful software integration tool";
diff --git a/pkgs/by-name/co/conan/package.nix b/pkgs/by-name/co/conan/package.nix
index 47c7bc473609..56147185caed 100644
--- a/pkgs/by-name/co/conan/package.nix
+++ b/pkgs/by-name/co/conan/package.nix
@@ -12,18 +12,19 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "conan";
-  version = "2.22.2";
+  version = "2.26.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "conan-io";
     repo = "conan";
     tag = finalAttrs.version;
-    hash = "sha256-4OKrAfhHgtAS606P88JFYCjgYYlSAH8RReqFs6N2V5s=";
+    hash = "sha256-PBrVt8SM3AFdi/w18c4ZExzNnfTANtAdTUHIquk1At0=";
   };
 
   pythonRelaxDeps = [
     "distro"
+    "patch-ng"
     "urllib3"
   ];
 
@@ -82,6 +83,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     "test_shared_windows_find_libraries"
     # 'cmake' tool version 'Any' is not available
     "test_build"
+    "test_conan_new"
     "test_conan_new_compiles"
     # 'cmake' tool version '3.27' is not available
     "test_metabuild"
@@ -104,6 +106,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     # Requires cmake, meson, autotools, apt-get, etc.
     "test/functional/command/runner_test.py"
     "test/functional/command/test_install_deploy.py"
+    "test/functional/command/test_new.py"
     "test/functional/layout/test_editable_cmake.py"
     "test/functional/layout/test_editable_cmake_components.py"
     "test/functional/layout/test_in_subfolder.py"
@@ -113,12 +116,16 @@ python3Packages.buildPythonApplication (finalAttrs: {
     "test/functional/toolchains/"
     "test/functional/tools/scm/test_git.py"
     "test/functional/tools/system/package_manager_test.py"
+    "test/functional/sbom/test_cyclonedx.py"
+    "test/functional/workspace/test_workspace.py"
     "test/functional/tools_versions_test.py"
     "test/functional/util/test_cmd_args_to_string.py"
-    "test/performance/test_large_graph.py"
+
+    # Requires network access to PyPI
+    "test/functional/tools/system/python_manager_test.py"
+
+    # Test failure
     "test/unittests/tools/env/test_env_files.py"
-    # pipenv will attempt to access the network.
-    "test/functional/tools/system/pip_manager_test.py"
   ];
 
   meta = {
diff --git a/pkgs/by-name/da/dataexplorer/package.nix b/pkgs/by-name/da/dataexplorer/package.nix
index f9c8890fc3f9..14cf687bcc53 100644
--- a/pkgs/by-name/da/dataexplorer/package.nix
+++ b/pkgs/by-name/da/dataexplorer/package.nix
@@ -3,33 +3,34 @@
   stdenv,
   fetchurl,
   ant,
-  # executable fails to start for jdk > 17
-  jdk17,
+  openjdk25,
   swt,
   makeWrapper,
   strip-nondeterminism,
   udevCheckHook,
 }:
 let
-  swt-jdk17 = swt.override { jdk = jdk17; };
+  swt-jdk = swt.override { jdk = openjdk25; };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "dataexplorer";
-  version = "3.9.3";
+  version = "4.0.2";
 
   src = fetchurl {
     url = "mirror://savannah/dataexplorer/dataexplorer-${finalAttrs.version}-src.tar.gz";
-    hash = "sha256-NfbhamhRx78MW5H4BpKMDfrV2d082UkaIBFfbemOSOY=";
+    hash = "sha256-HaupE8tCbmlUVMd0ZFt7QwY1AKEx+op21fUeGBpR+UY=";
   };
 
   nativeBuildInputs = [
     ant
-    jdk17
+    openjdk25
     makeWrapper
     strip-nondeterminism
     udevCheckHook
   ];
 
+  dontConfigure = true;
+
   buildPhase = ''
     runHook preBuild
     ant -f build/build.xml dist
@@ -49,18 +50,18 @@ stdenv.mkDerivation (finalAttrs: {
 
     ant -Dprefix=$out/share/ -f build/build.xml install
     # Use SWT from nixpkgs
-    ln -sf '${swt-jdk17}/jars/swt.jar' "$out/share/DataExplorer/java/ext/swt.jar"
+    ln -sf '${swt-jdk}/jars/swt.jar' "$out/share/DataExplorer/java/ext/swt.jar"
 
     # The sources contain a wrapper script in $out/share/DataExplorer/DataExplorer
     # but it hardcodes bash shebang and does not pin the java path.
     # So we create our own wrapper, using similar cmdline args as upstream.
     mkdir -p $out/bin
-    makeWrapper ${jdk17}/bin/java $out/bin/DataExplorer \
-      --prefix LD_LIBRARY_PATH : '${swt-jdk17}/lib' \
+    makeWrapper ${openjdk25}/bin/java $out/bin/DataExplorer \
+      --prefix LD_LIBRARY_PATH : '${swt-jdk}/lib' \
       --add-flags "-Xms64m -Xmx3092m -jar $out/share/DataExplorer/DataExplorer.jar" \
       --set SWT_GTK3 0
 
-    makeWrapper ${jdk17}/bin/java $out/bin/DevicePropertiesEditor \
+    makeWrapper ${openjdk25}/bin/java $out/bin/DevicePropertiesEditor \
       --add-flags "-Xms32m -Xmx512m -classpath $out/share/DataExplorer/DataExplorer.jar gde.ui.dialog.edit.DevicePropertiesEditor" \
       --set SWT_GTK3 0 \
       --set LIBOVERLAY_SCROLLBAR 0
diff --git a/pkgs/by-name/da/davmail/package.nix b/pkgs/by-name/da/davmail/package.nix
index c4deac4af9bb..4f84ba6f1ab6 100644
--- a/pkgs/by-name/da/davmail/package.nix
+++ b/pkgs/by-name/da/davmail/package.nix
@@ -35,9 +35,8 @@ stdenv.mkDerivation (finalAttrs: {
   buildPhase = ''
     runHook preBuild
 
-    ant compile prepare-dist
-    cp -Rv dist/{lib,davmail{,.jar}} .
-    sed -i -e '/^JAVA_OPTS/d' davmail
+    ant prepare-dist
+    sed -i -e '/^JAVA_OPTS/d' ./dist/davmail
 
     runHook postBuild
   '';
@@ -55,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
     runHook preInstall
 
     mkdir -p $out/share/davmail
-    cp -vR ./{lib,davmail{,.jar}} $out/share/davmail
+    cp -R ./dist/{lib,davmail{,.jar}} $out/share/davmail
     chmod +x $out/share/davmail/davmail
     makeWrapper $out/share/davmail/davmail $out/bin/davmail \
       --set-default JAVA_OPTS "-Xmx512M -Dsun.net.inetaddr.ttl=60 -Djdk.gtk.version=${lib.versions.major gtk'.version}" \
diff --git a/pkgs/by-name/ev/evcc/package.nix b/pkgs/by-name/ev/evcc/package.nix
index 15d503b9e69d..c55c80dd44bd 100644
--- a/pkgs/by-name/ev/evcc/package.nix
+++ b/pkgs/by-name/ev/evcc/package.nix
@@ -17,13 +17,13 @@
 }:
 
 let
-  version = "0.301.2";
+  version = "0.302.0";
 
   src = fetchFromGitHub {
     owner = "evcc-io";
     repo = "evcc";
     tag = version;
-    hash = "sha256-14qIWgHLQCz+d0PlIavw4F7XEWpx9jJL43XbCpZb4XA=";
+    hash = "sha256-NW18HD6d7RD6a5DhyvI+eZIVmjBr3Q5g+F+O4N508Go=";
   };
 
   vendorHash = "sha256-t70o3VWfypvWOLMCqC4I8GXywzrDgNKUi5yAaB0NdZw=";
diff --git a/pkgs/by-name/go/goarista/package.nix b/pkgs/by-name/go/goarista/package.nix
index fbb9ba440143..cb5de911aad4 100644
--- a/pkgs/by-name/go/goarista/package.nix
+++ b/pkgs/by-name/go/goarista/package.nix
@@ -18,6 +18,8 @@ buildGoModule {
 
   vendorHash = "sha256-n+P3L3dT2kYuTyI2qX/nrLRgFIUsP3kkwNZmRQ8EFRs=";
 
+  passthru.updateScript = ./update.sh;
+
   checkFlags =
     let
       skippedTests = [
diff --git a/pkgs/by-name/go/goarista/update.sh b/pkgs/by-name/go/goarista/update.sh
new file mode 100755
index 000000000000..900cb5dc9643
--- /dev/null
+++ b/pkgs/by-name/go/goarista/update.sh
@@ -0,0 +1,11 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix-update gnused
+
+set -eou pipefail
+
+nix-update pkgs.goarista --version branch
+
+# The last github release in 2020 was named ockafka-v0.0.5.
+# I don't want this in the version name, it's from when Arista
+# was doing per-package releases in the repo, and not just trunk
+sed -i 's/ockafka-v0\.0\.5-/0-/' pkgs/by-name/go/goarista/package.nix
diff --git a/pkgs/by-name/hy/hyprproxlock/package.nix b/pkgs/by-name/hy/hyprproxlock/package.nix
new file mode 100644
index 000000000000..6fb6c49d8d9c
--- /dev/null
+++ b/pkgs/by-name/hy/hyprproxlock/package.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+
+  # nativeBuildInputs
+  pkg-config,
+
+  # buildInputs
+  dbus,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "hyprproxlock";
+  version = "0.1.1";
+
+  src = fetchFromGitHub {
+    owner = "Da4ndo";
+    repo = "hyprproxlock";
+    tag = finalAttrs.version;
+    hash = "sha256-EoMxYMQBRP1fDfUorrkrgKDrVI88Ctusp2+1a7tnSU0=";
+  };
+
+  cargoHash = "sha256-rBZ3acHStmUzEU+lsFhNYvLVPeeZe6P+4OHyxHRe4CU=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    dbus
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    homepage = "https://github.com/Da4ndo/hyprproxlock";
+    description = "Proximity-based daemon for Hyprland that triggers screen locking and unlocking through hyprlock based on Bluetooth device proximity";
+    longDescription = ''
+      A proximity-based daemon for Hyprland that triggers screen locking and unlocking through hyprlock based on Bluetooth device proximity.
+      It monitors connected devices' signal strength to automatically control your screen lock state.
+    '';
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ shymega ];
+    mainProgram = "hyprproxlock";
+  };
+})
diff --git a/pkgs/by-name/li/librechat/0003-upload-paths.patch b/pkgs/by-name/li/librechat/0003-upload-paths.patch
index 50ec5380c545..cbba178f2bf9 100644
--- a/pkgs/by-name/li/librechat/0003-upload-paths.patch
+++ b/pkgs/by-name/li/librechat/0003-upload-paths.patch
@@ -10,7 +10,8 @@ index 165e9e6..fc85083 100644
 +  uploads: path.resolve('.', 'uploads'),
    clientPath: path.resolve(__dirname, '..', '..', 'client'),
    dist: path.resolve(__dirname, '..', '..', 'client', 'dist'),
-   publicPath: path.resolve(__dirname, '..', '..', 'client', 'public'),
+-  publicPath: path.resolve(__dirname, '..', '..', 'client', 'public'),
++  publicPath: path.resolve('.'),
    fonts: path.resolve(__dirname, '..', '..', 'client', 'public', 'fonts'),
    assets: path.resolve(__dirname, '..', '..', 'client', 'public', 'assets'),
 -  imageOutput: path.resolve(__dirname, '..', '..', 'client', 'public', 'images'),
diff --git a/pkgs/by-name/mt/mtproxy/package.nix b/pkgs/by-name/mt/mtproxy/package.nix
new file mode 100644
index 000000000000..aea7ba1d370f
--- /dev/null
+++ b/pkgs/by-name/mt/mtproxy/package.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  openssl,
+  zlib,
+}:
+stdenv.mkDerivation {
+  pname = "mtproxy";
+  version = "1-unstable-2025-11-04";
+  src = fetchFromGitHub {
+    owner = "TelegramMessenger";
+    repo = "MTProxy";
+    rev = "cafc3380a81671579ce366d0594b9a8e450827e9";
+    hash = "sha256-tY2iwNAQIL8sCUuddy9Lm/d/W1notL27HhRtOa25VsE=";
+  };
+  buildInputs = [
+    openssl
+    zlib
+  ];
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin
+    cp objs/bin/mtproto-proxy $out/bin/
+    runHook postInstall
+  '';
+  meta = {
+    description = "Simple MT-Proto proxy";
+    mainProgram = "mtproto-proxy";
+    homepage = "https://github.com/TelegramMessenger/MTProxy";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ nix-julia ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/by-name/ne/nerva/package.nix b/pkgs/by-name/ne/nerva/package.nix
new file mode 100644
index 000000000000..55173202f9cb
--- /dev/null
+++ b/pkgs/by-name/ne/nerva/package.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "nerva";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "praetorian-inc";
+    repo = "nerva";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-EZQQLXN9eixL3BUSn6VAaKPe9uA3uW1l6zfzq3bG+vk=";
+  };
+
+  vendorHash = "sha256-h3pxl84P7dUmXJJ9t/Rnzx0oJcGnA+7ytGWhk401ecY=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=main.version=${finalAttrs.version}"
+    "-X=main.commit=${finalAttrs.src.rev}"
+    "-X=main.date=1970-01-01T00:00:00Z"
+  ];
+
+  # Tests require a docker setup
+  doCheck = false;
+
+  meta = {
+    description = "Fingerprinting CLI tool for various protocols";
+    homepage = "https://github.com/praetorian-inc/nerva";
+    changelog = "https://github.com/praetorian-inc/nerva/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "nerva";
+  };
+})
diff --git a/pkgs/by-name/pu/pupdate/deps.json b/pkgs/by-name/pu/pupdate/deps.json
index ddcb1a19d8bd..2fc7ef863962 100644
--- a/pkgs/by-name/pu/pupdate/deps.json
+++ b/pkgs/by-name/pu/pupdate/deps.json
@@ -1,4 +1,9 @@
 [
+  {
+    "pname": "Aspose.Zip",
+    "version": "24.11.0",
+    "hash": "sha256-wPxD7K7bc0K1BqJweWgEaXJOX4F/hgRjrFSXLs+UnMs="
+  },
   {
     "pname": "CommandLineParser",
     "version": "2.9.1",
@@ -14,165 +19,15 @@
     "version": "1.2.0",
     "hash": "sha256-sMQNIppJXHU2mULn5b//uRbbPMyguH9QlG6HKVIYUmE="
   },
-  {
-    "pname": "Libuv",
-    "version": "1.9.1",
-    "hash": "sha256-bQdVn50eId1GzSQa9CFth0meKAQMYCFQ98zLN9pqL0k="
-  },
-  {
-    "pname": "Microsoft.AspNetCore.App.Ref",
-    "version": "7.0.20",
-    "hash": "sha256-OEDXXjQ1HDRPiA4Y1zPr1xUeH6wlzTCJpts+DZL61wI="
-  },
-  {
-    "pname": "Microsoft.AspNetCore.App.Runtime.linux-arm64",
-    "version": "7.0.20",
-    "hash": "sha256-ewal9R6o20GV0R02ylSijVFdWZAbdN8TK1PCc/ltHBQ="
-  },
-  {
-    "pname": "Microsoft.AspNetCore.App.Runtime.linux-x64",
-    "version": "7.0.20",
-    "hash": "sha256-vq59xMfrET8InzUhkAsbs2xp3ML+SO9POsbwAiYKzkA="
-  },
-  {
-    "pname": "Microsoft.CodeAnalysis.Analyzers",
-    "version": "1.1.0",
-    "hash": "sha256-7KrZfK3kUbmeT82eVadvHurZcaFq3FDj4qkIIeExJiM="
-  },
-  {
-    "pname": "Microsoft.CodeAnalysis.Common",
-    "version": "1.3.0",
-    "hash": "sha256-Jcw54WWyfPKdkeqRAG4xjihiGP/djjAkvpR6KM2I+CQ="
-  },
-  {
-    "pname": "Microsoft.CodeAnalysis.CSharp",
-    "version": "1.3.0",
-    "hash": "sha256-OqqvMHNj9Xql4YTEPMlzoGXXELoLC7JkRGjS0pil+m4="
-  },
-  {
-    "pname": "Microsoft.CodeAnalysis.VisualBasic",
-    "version": "1.3.0",
-    "hash": "sha256-lIKN1dG59aY8zeYgkY8Kdnv4UBgSwVbghz5ngPyEzKA="
-  },
-  {
-    "pname": "Microsoft.CSharp",
-    "version": "4.0.1",
-    "hash": "sha256-0huoqR2CJ3Z9Q2peaKD09TV3E6saYSqDGZ290K8CrH8="
-  },
-  {
-    "pname": "Microsoft.NET.ILLink.Analyzers",
-    "version": "7.0.100-1.23401.1",
-    "hash": "sha256-jGyhmj7DZxTv9Hir6YonkpL+SDsRore8Ph4RNN+2q94="
-  },
-  {
-    "pname": "Microsoft.NET.ILLink.Tasks",
-    "version": "7.0.100-1.23401.1",
-    "hash": "sha256-n95rHugj0BOtCBvv5209zJ5ttPX0A2+RWLjEwwtxgRA="
-  },
-  {
-    "pname": "Microsoft.NETCore.App",
-    "version": "1.0.4",
-    "hash": "sha256-NqJEOTW98eO0UlbiZcIVrsZCY4MUa+CkSmtAx3e2g3k="
-  },
-  {
-    "pname": "Microsoft.NETCore.App.Host.linux-arm64",
-    "version": "7.0.20",
-    "hash": "sha256-/20dMbO1Ft0WVhl+Lv1916Thvr4kPP9LuuX4bKE+czE="
-  },
-  {
-    "pname": "Microsoft.NETCore.App.Host.linux-x64",
-    "version": "7.0.20",
-    "hash": "sha256-Y1Dg8Sqhya86xD+9aJOuznT4mJUyFmoF/YZc0+5LBdc="
-  },
-  {
-    "pname": "Microsoft.NETCore.App.Ref",
-    "version": "7.0.20",
-    "hash": "sha256-W9RU3bja4BQLAbsaIhANQPJJh6DycDiBR+WZ3mK6Zrs="
-  },
-  {
-    "pname": "Microsoft.NETCore.App.Runtime.linux-arm64",
-    "version": "7.0.20",
-    "hash": "sha256-TemMvbNrDzJVHWwxVgnNN2CnTyI6TcvvZDpF4ts6IAw="
-  },
-  {
-    "pname": "Microsoft.NETCore.App.Runtime.linux-x64",
-    "version": "7.0.20",
-    "hash": "sha256-L+WaGvoXVMT3tZ7R5xFE06zaLcC3SI7LEf4ATBkUAGQ="
-  },
-  {
-    "pname": "Microsoft.NETCore.DotNetHost",
-    "version": "1.0.1",
-    "hash": "sha256-yiyZ4KGVRDZRgAuoSl4ZNWnRR3ityniyRPvzS799JOM="
-  },
-  {
-    "pname": "Microsoft.NETCore.DotNetHostPolicy",
-    "version": "1.0.3",
-    "hash": "sha256-doP+2c5SFVldt/EzgWW3nqKK+NNZKvBnanJbn2SKr2Q="
-  },
-  {
-    "pname": "Microsoft.NETCore.DotNetHostResolver",
-    "version": "1.0.1",
-    "hash": "sha256-hGJLA8Q6R+up9zHzk+Up2KF1a+fXZeEWrAZ+iNfQP4E="
-  },
-  {
-    "pname": "Microsoft.NETCore.Jit",
-    "version": "1.0.6",
-    "hash": "sha256-MuphzrzUdSpgyB3ZU2Ly3DwaGSRuLUvonovIzBasB6o="
-  },
-  {
-    "pname": "Microsoft.NETCore.Platforms",
-    "version": "1.0.2",
-    "hash": "sha256-YLJ2+BONtCWb0lY4Rttdqzbcm4z+5N5uNr3byRWQOZ8="
-  },
   {
     "pname": "Microsoft.NETCore.Platforms",
     "version": "1.1.0",
     "hash": "sha256-FeM40ktcObQJk4nMYShB61H/E8B7tIKfl9ObJ0IOcCM="
   },
   {
-    "pname": "Microsoft.NETCore.Runtime.CoreCLR",
-    "version": "1.0.6",
-    "hash": "sha256-iZnxpUpUJDoEE/NjktTFfOYmi25RwC32NMu/OKXG3gA="
-  },
-  {
-    "pname": "Microsoft.NETCore.Targets",
-    "version": "1.0.1",
-    "hash": "sha256-lxxw/Gy32xHi0fLgFWNj4YTFBSBkjx5l6ucmbTyf7V4="
-  },
-  {
-    "pname": "Microsoft.NETCore.Targets",
-    "version": "1.1.0",
-    "hash": "sha256-0AqQ2gMS8iNlYkrD+BxtIg7cXMnr9xZHtKAuN4bjfaQ="
-  },
-  {
-    "pname": "Microsoft.NETCore.Windows.ApiSets",
-    "version": "1.0.1",
-    "hash": "sha256-6PR4o/wQxBaJ5eRdt/awSO80EP3QqpWIk0XkCR9kaJo="
-  },
-  {
-    "pname": "Microsoft.VisualBasic",
-    "version": "10.0.1",
-    "hash": "sha256-7HHzZcWLVTTQ1K1rCIyoB+UxLHMvOIz+O5av6XDa22A="
-  },
-  {
-    "pname": "Microsoft.Win32.Primitives",
-    "version": "4.0.1",
-    "hash": "sha256-B4t5El/ViBdxALMcpZulewc4j/3SIXf71HhJWhm4Ctk="
-  },
-  {
-    "pname": "Microsoft.Win32.Primitives",
-    "version": "4.3.0",
-    "hash": "sha256-mBNDmPXNTW54XLnPAUwBRvkIORFM7/j0D0I2SyQPDEg="
-  },
-  {
-    "pname": "Microsoft.Win32.Registry",
-    "version": "4.0.0",
-    "hash": "sha256-M/06F/Z2wTHCh4pZOgtCjUGLD1FJXEJKCmzOeFMl7uo="
-  },
-  {
-    "pname": "NETStandard.Library",
-    "version": "1.6.0",
-    "hash": "sha256-ExWI1EKDCRishcfAeHVS/RoJphqSqohmJIC/wz3ZtVo="
+    "pname": "Microsoft.NETCore.Platforms",
+    "version": "2.0.0",
+    "hash": "sha256-IEvBk6wUXSdyCnkj6tHahOJv290tVVT8tyemYcR0Yro="
   },
   {
     "pname": "NETStandard.Library",
@@ -184,759 +39,19 @@
     "version": "13.0.3",
     "hash": "sha256-hy/BieY4qxBWVVsDqqOPaLy1QobiIapkbrESm6v2PHc="
   },
-  {
-    "pname": "runtime.any.System.Collections",
-    "version": "4.3.0",
-    "hash": "sha256-4PGZqyWhZ6/HCTF2KddDsbmTTjxs2oW79YfkberDZS8="
-  },
-  {
-    "pname": "runtime.any.System.Diagnostics.Tools",
-    "version": "4.3.0",
-    "hash": "sha256-8yLKFt2wQxkEf7fNfzB+cPUCjYn2qbqNgQ1+EeY2h/I="
-  },
-  {
-    "pname": "runtime.any.System.Diagnostics.Tracing",
-    "version": "4.3.0",
-    "hash": "sha256-dsmTLGvt8HqRkDWP8iKVXJCS+akAzENGXKPV18W2RgI="
-  },
-  {
-    "pname": "runtime.any.System.Globalization",
-    "version": "4.3.0",
-    "hash": "sha256-PaiITTFI2FfPylTEk7DwzfKeiA/g/aooSU1pDcdwWLU="
-  },
-  {
-    "pname": "runtime.any.System.Globalization.Calendars",
-    "version": "4.3.0",
-    "hash": "sha256-AYh39tgXJVFu8aLi9Y/4rK8yWMaza4S4eaxjfcuEEL4="
-  },
-  {
-    "pname": "runtime.any.System.IO",
-    "version": "4.3.0",
-    "hash": "sha256-vej7ySRhyvM3pYh/ITMdC25ivSd0WLZAaIQbYj/6HVE="
-  },
-  {
-    "pname": "runtime.any.System.Reflection",
-    "version": "4.3.0",
-    "hash": "sha256-ns6f++lSA+bi1xXgmW1JkWFb2NaMD+w+YNTfMvyAiQk="
-  },
-  {
-    "pname": "runtime.any.System.Reflection.Extensions",
-    "version": "4.3.0",
-    "hash": "sha256-Y2AnhOcJwJVYv7Rp6Jz6ma0fpITFqJW+8rsw106K2X8="
-  },
-  {
-    "pname": "runtime.any.System.Reflection.Primitives",
-    "version": "4.3.0",
-    "hash": "sha256-LkPXtiDQM3BcdYkAm5uSNOiz3uF4J45qpxn5aBiqNXQ="
-  },
-  {
-    "pname": "runtime.any.System.Resources.ResourceManager",
-    "version": "4.3.0",
-    "hash": "sha256-9EvnmZslLgLLhJ00o5MWaPuJQlbUFcUF8itGQNVkcQ4="
-  },
-  {
-    "pname": "runtime.any.System.Runtime",
-    "version": "4.3.0",
-    "hash": "sha256-qwhNXBaJ1DtDkuRacgHwnZmOZ1u9q7N8j0cWOLYOELM="
-  },
-  {
-    "pname": "runtime.any.System.Runtime.Handles",
-    "version": "4.3.0",
-    "hash": "sha256-PQRACwnSUuxgVySO1840KvqCC9F8iI9iTzxNW0RcBS4="
-  },
-  {
-    "pname": "runtime.any.System.Runtime.InteropServices",
-    "version": "4.3.0",
-    "hash": "sha256-Kaw5PnLYIiqWbsoF3VKJhy7pkpoGsUwn4ZDCKscbbzA="
-  },
-  {
-    "pname": "runtime.any.System.Text.Encoding",
-    "version": "4.3.0",
-    "hash": "sha256-Q18B9q26MkWZx68exUfQT30+0PGmpFlDgaF0TnaIGCs="
-  },
-  {
-    "pname": "runtime.any.System.Text.Encoding.Extensions",
-    "version": "4.3.0",
-    "hash": "sha256-6MYj0RmLh4EVqMtO/MRqBi0HOn5iG4x9JimgCCJ+EFM="
-  },
-  {
-    "pname": "runtime.any.System.Threading.Tasks",
-    "version": "4.3.0",
-    "hash": "sha256-agdOM0NXupfHbKAQzQT8XgbI9B8hVEh+a/2vqeHctg4="
-  },
-  {
-    "pname": "runtime.any.System.Threading.Timer",
-    "version": "4.3.0",
-    "hash": "sha256-BgHxXCIbicVZtpgMimSXixhFC3V+p5ODqeljDjO8hCs="
-  },
-  {
-    "pname": "runtime.debian.8-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.0",
-    "hash": "sha256-LXUPLX3DJxsU1Pd3UwjO1PO9NM2elNEDXeu2Mu/vNps="
-  },
-  {
-    "pname": "runtime.fedora.23-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.0",
-    "hash": "sha256-qeSqaUI80+lqw5MK4vMpmO0CZaqrmYktwp6L+vQAb0I="
-  },
-  {
-    "pname": "runtime.fedora.24-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.0",
-    "hash": "sha256-SrHqT9wrCBsxILWtaJgGKd6Odmxm8/Mh7Kh0CUkZVzA="
-  },
-  {
-    "pname": "runtime.native.System",
-    "version": "4.0.0",
-    "hash": "sha256-bmaM0ovT4X4aqDJOR255Yda/u3fmHZskU++lMnsy894="
-  },
-  {
-    "pname": "runtime.native.System",
-    "version": "4.3.0",
-    "hash": "sha256-ZBZaodnjvLXATWpXXakFgcy6P+gjhshFXmglrL5xD5Y="
-  },
-  {
-    "pname": "runtime.native.System.IO.Compression",
-    "version": "4.1.0",
-    "hash": "sha256-085JrZxNEwIHdBWKKKFsh1JzpF0AblvrUsz5T8kH4jQ="
-  },
-  {
-    "pname": "runtime.native.System.IO.Compression",
-    "version": "4.3.0",
-    "hash": "sha256-DWnXs4vlKoU6WxxvCArTJupV6sX3iBbZh8SbqfHace8="
-  },
-  {
-    "pname": "runtime.native.System.Net.Http",
-    "version": "4.0.1",
-    "hash": "sha256-5nWnTQrA1T6t9r8MqIiV4yTNu+IH0of2OX1qteoS+8E="
-  },
-  {
-    "pname": "runtime.native.System.Net.Security",
-    "version": "4.0.1",
-    "hash": "sha256-E64W+qCHZGYbhzQOEeToCob/4K8cTg3uOO7ltZG7ZNo="
-  },
-  {
-    "pname": "runtime.native.System.Security.Cryptography",
-    "version": "4.0.0",
-    "hash": "sha256-6Q8eYzC32BbGIiTHoQaE6B3cD81vYQcH5SCswYRSp0w="
-  },
-  {
-    "pname": "runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.0",
-    "hash": "sha256-Jy01KhtcCl2wjMpZWH+X3fhHcVn+SyllWFY8zWlz/6I="
-  },
-  {
-    "pname": "runtime.opensuse.13.2-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.0",
-    "hash": "sha256-wyv00gdlqf8ckxEdV7E+Ql9hJIoPcmYEuyeWb5Oz3mM="
-  },
-  {
-    "pname": "runtime.opensuse.42.1-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.0",
-    "hash": "sha256-zi+b4sCFrA9QBiSGDD7xPV27r3iHGlV99gpyVUjRmc4="
-  },
-  {
-    "pname": "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.0",
-    "hash": "sha256-gybQU6mPgaWV3rBG2dbH6tT3tBq8mgze3PROdsuWnX0="
-  },
-  {
-    "pname": "runtime.rhel.7-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.0",
-    "hash": "sha256-VsP72GVveWnGUvS/vjOQLv1U80H2K8nZ4fDAmI61Hm4="
-  },
-  {
-    "pname": "runtime.ubuntu.14.04-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.0",
-    "hash": "sha256-4yKGa/IrNCKuQ3zaDzILdNPD32bNdy6xr5gdJigyF5g="
-  },
-  {
-    "pname": "runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.0",
-    "hash": "sha256-HmdJhhRsiVoOOCcUvAwdjpMRiyuSwdcgEv2j9hxi+Zc="
-  },
-  {
-    "pname": "runtime.ubuntu.16.10-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.0",
-    "hash": "sha256-pVFUKuPPIx0edQKjzRon3zKq8zhzHEzko/lc01V/jdw="
-  },
-  {
-    "pname": "runtime.unix.Microsoft.Win32.Primitives",
-    "version": "4.3.0",
-    "hash": "sha256-LZb23lRXzr26tRS5aA0xyB08JxiblPDoA7HBvn6awXg="
-  },
-  {
-    "pname": "runtime.unix.System.Console",
-    "version": "4.3.0",
-    "hash": "sha256-AHkdKShTRHttqfMjmi+lPpTuCrM5vd/WRy6Kbtie190="
-  },
-  {
-    "pname": "runtime.unix.System.Diagnostics.Debug",
-    "version": "4.3.0",
-    "hash": "sha256-ReoazscfbGH+R6s6jkg5sIEHWNEvjEoHtIsMbpc7+tI="
-  },
-  {
-    "pname": "runtime.unix.System.IO.FileSystem",
-    "version": "4.3.0",
-    "hash": "sha256-Pf4mRl6YDK2x2KMh0WdyNgv0VUNdSKVDLlHqozecy5I="
-  },
-  {
-    "pname": "runtime.unix.System.Net.Primitives",
-    "version": "4.3.0",
-    "hash": "sha256-pHJ+I6i16MV6m77uhTC6GPY6jWGReE3SSP3fVB59ti0="
-  },
-  {
-    "pname": "runtime.unix.System.Net.Sockets",
-    "version": "4.3.0",
-    "hash": "sha256-IvgOeA2JuBjKl5yAVGjPYMPDzs9phb3KANs95H9v1w4="
-  },
-  {
-    "pname": "runtime.unix.System.Private.Uri",
-    "version": "4.3.0",
-    "hash": "sha256-c5tXWhE/fYbJVl9rXs0uHh3pTsg44YD1dJvyOA0WoMs="
-  },
-  {
-    "pname": "runtime.unix.System.Runtime.Extensions",
-    "version": "4.3.0",
-    "hash": "sha256-l8S9gt6dk3qYG6HYonHtdlYtBKyPb29uQ6NDjmrt3V4="
-  },
-  {
-    "pname": "System.AppContext",
-    "version": "4.1.0",
-    "hash": "sha256-v6YfyfrKmhww+EYHUq6cwYUMj00MQ6SOfJtcGVRlYzs="
-  },
   {
     "pname": "System.Buffers",
-    "version": "4.0.0",
-    "hash": "sha256-+YUymoyS0O+xVyF2+LiAdZlMww8nofPN4ja9ylYqRo8="
+    "version": "4.5.1",
+    "hash": "sha256-wws90sfi9M7kuCPWkv1CEYMJtCqx9QB/kj0ymlsNaxI="
   },
   {
-    "pname": "System.Buffers",
-    "version": "4.3.0",
-    "hash": "sha256-XqZWb4Kd04960h4U9seivjKseGA/YEIpdplfHYHQ9jk="
-  },
-  {
-    "pname": "System.Collections",
-    "version": "4.0.11",
-    "hash": "sha256-puoFMkx4Z55C1XPxNw3np8nzNGjH+G24j43yTIsDRL0="
-  },
-  {
-    "pname": "System.Collections",
-    "version": "4.3.0",
-    "hash": "sha256-afY7VUtD6w/5mYqrce8kQrvDIfS2GXDINDh73IjxJKc="
-  },
-  {
-    "pname": "System.Collections.Concurrent",
-    "version": "4.0.12",
-    "hash": "sha256-zIEM7AB4SyE9u6G8+o+gCLLwkgi6+3rHQVPdn/dEwB8="
-  },
-  {
-    "pname": "System.Collections.Immutable",
-    "version": "1.2.0",
-    "hash": "sha256-FQ3l+ulbLSPhQ0JcQCC4D4SzjTnHsRqcOj56Ywy7pMo="
-  },
-  {
-    "pname": "System.ComponentModel",
-    "version": "4.0.1",
-    "hash": "sha256-X5T36S49q1odsn6wAET6EGNlsxOyd66naMr5T3G9mGw="
-  },
-  {
-    "pname": "System.ComponentModel.Annotations",
-    "version": "4.1.0",
-    "hash": "sha256-jhvr6zS+iC4OXBkdXr+S8rPy/5nfhZtDVVJiAc0f1VA="
-  },
-  {
-    "pname": "System.Console",
-    "version": "4.0.0",
-    "hash": "sha256-jtZfT/TpJtLisV/y5Mk3IfCpE79zwhBYXtyGP9jC3Xo="
-  },
-  {
-    "pname": "System.Diagnostics.Debug",
-    "version": "4.0.11",
-    "hash": "sha256-P+rSQJVoN6M56jQbs76kZ9G3mAWFdtF27P/RijN8sj4="
-  },
-  {
-    "pname": "System.Diagnostics.Debug",
-    "version": "4.3.0",
-    "hash": "sha256-fkA79SjPbSeiEcrbbUsb70u9B7wqbsdM9s1LnoKj0gM="
-  },
-  {
-    "pname": "System.Diagnostics.DiagnosticSource",
-    "version": "4.0.0",
-    "hash": "sha256-dYh9UoFesuGcHY+ewsI+z2WnNy+bwHPsHQ3t85cbzNg="
-  },
-  {
-    "pname": "System.Diagnostics.FileVersionInfo",
-    "version": "4.0.0",
-    "hash": "sha256-Yy94jPhDXF2QHOF7qTmqKkn1048K9xkKryuBeDzsu+g="
-  },
-  {
-    "pname": "System.Diagnostics.Process",
-    "version": "4.1.0",
-    "hash": "sha256-OgW6ogQ+oYADYS0PHmwXdhrOKQJpqXlwzSvmfjTLNBg="
-  },
-  {
-    "pname": "System.Diagnostics.StackTrace",
-    "version": "4.0.1",
-    "hash": "sha256-gqqCAwpDsca242nli+fejgqwPAuwROv3NoNeOnFXSWA="
-  },
-  {
-    "pname": "System.Diagnostics.Tools",
-    "version": "4.0.1",
-    "hash": "sha256-vSBqTbmWXylvRa37aWyktym+gOpsvH43mwr6A962k6U="
-  },
-  {
-    "pname": "System.Diagnostics.Tracing",
-    "version": "4.1.0",
-    "hash": "sha256-JA0jJcLbU3zh52ub3zweob2EVHvxOqiC6SCYHrY5WbQ="
-  },
-  {
-    "pname": "System.Diagnostics.Tracing",
-    "version": "4.3.0",
-    "hash": "sha256-hCETZpHHGVhPYvb4C0fh4zs+8zv4GPoixagkLZjpa9Q="
-  },
-  {
-    "pname": "System.Dynamic.Runtime",
-    "version": "4.0.11",
-    "hash": "sha256-qWqFVxuXioesVftv2RVJZOnmojUvRjb7cS3Oh3oTit4="
-  },
-  {
-    "pname": "System.Globalization",
-    "version": "4.0.11",
-    "hash": "sha256-rbSgc2PIEc2c2rN6LK3qCREAX3DqA2Nq1WcLrZYsDBw="
-  },
-  {
-    "pname": "System.Globalization",
-    "version": "4.3.0",
-    "hash": "sha256-caL0pRmFSEsaoeZeWN5BTQtGrAtaQPwFi8YOZPZG5rI="
-  },
-  {
-    "pname": "System.Globalization.Calendars",
-    "version": "4.0.1",
-    "hash": "sha256-EJN3LbN+b0O9Dr2eg7kfThCYpne0iJ/H/GIyUTNVYC8="
-  },
-  {
-    "pname": "System.Globalization.Extensions",
-    "version": "4.0.1",
-    "hash": "sha256-zLtkPryJwqTGcJqMC6zoMMvMrT+aAL5GoumjmMtqUEI="
-  },
-  {
-    "pname": "System.IO",
-    "version": "4.1.0",
-    "hash": "sha256-V6oyQFwWb8NvGxAwvzWnhPxy9dKOfj/XBM3tEC5aHrw="
-  },
-  {
-    "pname": "System.IO",
-    "version": "4.3.0",
-    "hash": "sha256-ruynQHekFP5wPrDiVyhNiRIXeZ/I9NpjK5pU+HPDiRY="
-  },
-  {
-    "pname": "System.IO.Compression",
-    "version": "4.1.0",
-    "hash": "sha256-UT4KEfJNZOk7b4X0AqLFUsqfHu6myVH/BhbRKYc+1Uc="
-  },
-  {
-    "pname": "System.IO.Compression",
-    "version": "4.3.0",
-    "hash": "sha256-f5PrQlQgj5Xj2ZnHxXW8XiOivaBvfqDao9Sb6AVinyA="
-  },
-  {
-    "pname": "System.IO.Compression.ZipFile",
-    "version": "4.3.0",
-    "hash": "sha256-WQl+JgWs+GaRMeiahTFUbrhlXIHapzcpTFXbRvAtvvs="
-  },
-  {
-    "pname": "System.IO.FileSystem",
-    "version": "4.0.1",
-    "hash": "sha256-4VKXFgcGYCTWVXjAlniAVq0dO3o5s8KHylg2wg2/7k0="
-  },
-  {
-    "pname": "System.IO.FileSystem",
-    "version": "4.3.0",
-    "hash": "sha256-vNIYnvlayuVj0WfRfYKpDrhDptlhp1pN8CYmlVd2TXw="
-  },
-  {
-    "pname": "System.IO.FileSystem.Primitives",
-    "version": "4.0.1",
-    "hash": "sha256-IpigKMomqb6pmYWkrlf0ZdpILtRluX2cX5sOKVW0Feg="
-  },
-  {
-    "pname": "System.IO.FileSystem.Primitives",
-    "version": "4.3.0",
-    "hash": "sha256-LMnfg8Vwavs9cMnq9nNH8IWtAtSfk0/Fy4s4Rt9r1kg="
-  },
-  {
-    "pname": "System.IO.FileSystem.Watcher",
-    "version": "4.0.0",
-    "hash": "sha256-OcLhbiHvn453sJsZBHe6RmtDlCaaarcqRB439HGU7mU="
-  },
-  {
-    "pname": "System.IO.MemoryMappedFiles",
-    "version": "4.0.0",
-    "hash": "sha256-1VQa8FoMUNAsja31OvOn7ungif+IPusAe9YcR+kRF6o="
-  },
-  {
-    "pname": "System.IO.UnmanagedMemoryStream",
-    "version": "4.0.1",
-    "hash": "sha256-Sx60QjHjvXQMAL7O4aN81321gu13LE0XzCRtt7hFTwQ="
-  },
-  {
-    "pname": "System.Linq",
-    "version": "4.1.0",
-    "hash": "sha256-ZQpFtYw5N1F1aX0jUK3Tw+XvM5tnlnshkTCNtfVA794="
-  },
-  {
-    "pname": "System.Linq.Expressions",
-    "version": "4.1.1",
-    "hash": "sha256-nwRmq03bvyYhohaDJtCYj4Z6hHsp0AlhjFJzuw7fsdk="
-  },
-  {
-    "pname": "System.Linq.Parallel",
-    "version": "4.0.1",
-    "hash": "sha256-TV1F3KYFipPmPnWFjX6hOZQNFsG2m729EdgPSFzqY0Q="
-  },
-  {
-    "pname": "System.Linq.Queryable",
-    "version": "4.0.1",
-    "hash": "sha256-XOFRO+lyoxsWtIUJfg5JCqv9Gx35ASOc94WIR8ZMVoY="
-  },
-  {
-    "pname": "System.Net.Http",
-    "version": "4.1.1",
-    "hash": "sha256-+JTAbEt2BicpnP3ooKXludoS5nClzBOnUyI9C/XxyyM="
-  },
-  {
-    "pname": "System.Net.NameResolution",
-    "version": "4.0.0",
-    "hash": "sha256-EAO67qEDqrtxEa+J3xccA5/lgCJ0PiRU9DYZsO++QzY="
-  },
-  {
-    "pname": "System.Net.Primitives",
-    "version": "4.0.11",
-    "hash": "sha256-2YSijNhCdw/ZU2yfH7vE+ReA8pgxRCXPnWr+ab36v4M="
-  },
-  {
-    "pname": "System.Net.Requests",
-    "version": "4.0.11",
-    "hash": "sha256-MLXxaUhHQC3pId/6r4q0EF37CIExt0+4Na8ZpUtRs44="
-  },
-  {
-    "pname": "System.Net.Security",
-    "version": "4.0.0",
-    "hash": "sha256-65Vqr/B5B336KEW69aM95+f7s5u2Q7/OiJmBarV2fnk="
-  },
-  {
-    "pname": "System.Net.Sockets",
-    "version": "4.1.0",
-    "hash": "sha256-muK7oXIX7ykqhXskuUt0KX6Hzg5VogJhUS0JiOB2BY0="
-  },
-  {
-    "pname": "System.Net.WebHeaderCollection",
-    "version": "4.0.1",
-    "hash": "sha256-uJSV6kmL+V/9/ot1LhHXGCd8Ndcu6zk+AJ8wgGS/fYE="
-  },
-  {
-    "pname": "System.Numerics.Vectors",
-    "version": "4.1.1",
-    "hash": "sha256-Kv4FrStml5+X7hGDCLhJJaIwJDvdJdYMBfcCcOjNf/Y="
-  },
-  {
-    "pname": "System.ObjectModel",
-    "version": "4.0.12",
-    "hash": "sha256-MudZ/KYcvYsn2cST3EE049mLikrNkmE7QoUoYKKby+s="
-  },
-  {
-    "pname": "System.Private.Uri",
-    "version": "4.3.0",
-    "hash": "sha256-fVfgcoP4AVN1E5wHZbKBIOPYZ/xBeSIdsNF+bdukIRM="
-  },
-  {
-    "pname": "System.Reflection",
-    "version": "4.1.0",
-    "hash": "sha256-idZHGH2Yl/hha1CM4VzLhsaR8Ljo/rV7TYe7mwRJSMs="
-  },
-  {
-    "pname": "System.Reflection",
-    "version": "4.3.0",
-    "hash": "sha256-NQSZRpZLvtPWDlvmMIdGxcVuyUnw92ZURo0hXsEshXY="
-  },
-  {
-    "pname": "System.Reflection.DispatchProxy",
-    "version": "4.0.1",
-    "hash": "sha256-GdjA81UywW1yeAyNi+MR5agmOXl859GrWwiOui2jT9U="
-  },
-  {
-    "pname": "System.Reflection.Emit",
-    "version": "4.0.1",
-    "hash": "sha256-F1MvYoQWHCY89/O4JBwswogitqVvKuVfILFqA7dmuHk="
-  },
-  {
-    "pname": "System.Reflection.Emit.ILGeneration",
-    "version": "4.0.1",
-    "hash": "sha256-YG+eJBG5P+5adsHiw/lhJwvREnvdHw6CJyS8ZV4Ujd0="
-  },
-  {
-    "pname": "System.Reflection.Emit.Lightweight",
-    "version": "4.0.1",
-    "hash": "sha256-uVvNOnL64CPqsgZP2OLqNmxdkZl6Q0fTmKmv9gcBi+g="
-  },
-  {
-    "pname": "System.Reflection.Extensions",
-    "version": "4.0.1",
-    "hash": "sha256-NsfmzM9G/sN3H8X2cdnheTGRsh7zbRzvegnjDzDH/FQ="
-  },
-  {
-    "pname": "System.Reflection.Metadata",
-    "version": "1.3.0",
-    "hash": "sha256-a/RQr++mSsziWaOTknicfIQX/zJrwPFExfhK6PM0tfg="
-  },
-  {
-    "pname": "System.Reflection.Primitives",
-    "version": "4.0.1",
-    "hash": "sha256-SFSfpWEyCBMAOerrMCOiKnpT+UAWTvRcmoRquJR6Vq0="
-  },
-  {
-    "pname": "System.Reflection.Primitives",
-    "version": "4.3.0",
-    "hash": "sha256-5ogwWB4vlQTl3jjk1xjniG2ozbFIjZTL9ug0usZQuBM="
-  },
-  {
-    "pname": "System.Reflection.TypeExtensions",
-    "version": "4.1.0",
-    "hash": "sha256-R0YZowmFda+xzKNR4kKg7neFoE30KfZwp/IwfRSKVK4="
-  },
-  {
-    "pname": "System.Resources.Reader",
-    "version": "4.0.0",
-    "hash": "sha256-NOax26EYc/L4bfedL2a33fg4sFXVkBwzVTQ41saJTsk="
-  },
-  {
-    "pname": "System.Resources.ResourceManager",
-    "version": "4.0.1",
-    "hash": "sha256-cZ2/3/fczLjEpn6j3xkgQV9ouOVjy4Kisgw5xWw9kSw="
-  },
-  {
-    "pname": "System.Resources.ResourceManager",
-    "version": "4.3.0",
-    "hash": "sha256-idiOD93xbbrbwwSnD4mORA9RYi/D/U48eRUsn/WnWGo="
-  },
-  {
-    "pname": "System.Runtime",
-    "version": "4.1.0",
-    "hash": "sha256-FViNGM/4oWtlP6w0JC0vJU+k9efLKZ+yaXrnEeabDQo="
-  },
-  {
-    "pname": "System.Runtime",
-    "version": "4.3.0",
-    "hash": "sha256-51813WXpBIsuA6fUtE5XaRQjcWdQ2/lmEokJt97u0Rg="
-  },
-  {
-    "pname": "System.Runtime.Extensions",
-    "version": "4.1.0",
-    "hash": "sha256-X7DZ5CbPY7jHs20YZ7bmcXs9B5Mxptu/HnBUvUnNhGc="
-  },
-  {
-    "pname": "System.Runtime.Extensions",
-    "version": "4.3.0",
-    "hash": "sha256-wLDHmozr84v1W2zYCWYxxj0FR0JDYHSVRaRuDm0bd/o="
-  },
-  {
-    "pname": "System.Runtime.Handles",
-    "version": "4.0.1",
-    "hash": "sha256-j2QgVO9ZOjv7D1het98CoFpjoYgxjupuIhuBUmLLH7w="
-  },
-  {
-    "pname": "System.Runtime.Handles",
-    "version": "4.3.0",
-    "hash": "sha256-KJ5aXoGpB56Y6+iepBkdpx/AfaJDAitx4vrkLqR7gms="
-  },
-  {
-    "pname": "System.Runtime.InteropServices",
-    "version": "4.1.0",
-    "hash": "sha256-QceAYlJvkPRJc/+5jR+wQpNNI3aqGySWWSO30e/FfQY="
-  },
-  {
-    "pname": "System.Runtime.InteropServices",
-    "version": "4.3.0",
-    "hash": "sha256-8sDH+WUJfCR+7e4nfpftj/+lstEiZixWUBueR2zmHgI="
-  },
-  {
-    "pname": "System.Runtime.InteropServices.RuntimeInformation",
-    "version": "4.0.0",
-    "hash": "sha256-5j53amb76A3SPiE3B0llT2XPx058+CgE7OXL4bLalT4="
-  },
-  {
-    "pname": "System.Runtime.Loader",
-    "version": "4.0.0",
-    "hash": "sha256-gE5/ehU3Qq5phhSxGuPmSv1DFVQeiyl1/+YyrO+I7lI="
-  },
-  {
-    "pname": "System.Runtime.Numerics",
-    "version": "4.0.1",
-    "hash": "sha256-1pJt5ZGxLPTX1mjOi8qZPXyyOMkYV0NstoUCv91HYPg="
-  },
-  {
-    "pname": "System.Security.Claims",
-    "version": "4.0.1",
-    "hash": "sha256-xqI0HHahNAd9g3jqgnLKH4P/pIueef6cy3qvRDQFvA0="
-  },
-  {
-    "pname": "System.Security.Cryptography.Algorithms",
-    "version": "4.2.0",
-    "hash": "sha256-BelNIpEyToEp/VYKnje/q1P7KNEpQNtOzGPU18pLGpE="
-  },
-  {
-    "pname": "System.Security.Cryptography.Cng",
-    "version": "4.2.0",
-    "hash": "sha256-7F+m3HnmBsgE4xWF8FeCGlaEgQM3drqA6HEaQr6MEoU="
-  },
-  {
-    "pname": "System.Security.Cryptography.Csp",
-    "version": "4.0.0",
-    "hash": "sha256-WHyR6vVK3zaT4De7jgQFUar1P5fiX9ECwiVkJDFFm7M="
-  },
-  {
-    "pname": "System.Security.Cryptography.Encoding",
-    "version": "4.0.0",
-    "hash": "sha256-ZO7ha39J5uHkIF2RoEKv/bW/bLbVvYMO4+rWyYsKHik="
-  },
-  {
-    "pname": "System.Security.Cryptography.OpenSsl",
-    "version": "4.0.0",
-    "hash": "sha256-mLijAozynzjiOMyh2P5BHcfVq3Ovd0T/phG08SIbXZs="
-  },
-  {
-    "pname": "System.Security.Cryptography.Primitives",
-    "version": "4.0.0",
-    "hash": "sha256-sEdPftfTxQd/8DpdpqUZC2XWC0SjVCPqAkEleLl17EQ="
-  },
-  {
-    "pname": "System.Security.Cryptography.X509Certificates",
-    "version": "4.1.0",
-    "hash": "sha256-sBUUhJP+yYDXvcjNMKqNpn8yzGUpVABwK9vVUvYKjzI="
-  },
-  {
-    "pname": "System.Security.Principal",
-    "version": "4.0.1",
-    "hash": "sha256-9wBgPnJfFOtrhKZ7wDXZ4q12GklQ49Ka02/9v7Frf9k="
-  },
-  {
-    "pname": "System.Security.Principal.Windows",
-    "version": "4.0.0",
-    "hash": "sha256-38wEUCB889Mpm4WgRFEQBB+4HtE0X0wu+knrDyJie7Q="
-  },
-  {
-    "pname": "System.Text.Encoding",
-    "version": "4.0.11",
-    "hash": "sha256-PEailOvG05CVgPTyKLtpAgRydlSHmtd5K0Y8GSHY2Lc="
-  },
-  {
-    "pname": "System.Text.Encoding",
-    "version": "4.3.0",
-    "hash": "sha256-GctHVGLZAa/rqkBNhsBGnsiWdKyv6VDubYpGkuOkBLg="
+    "pname": "System.Runtime.CompilerServices.Unsafe",
+    "version": "4.5.0",
+    "hash": "sha256-g9jIdQtXSAhY+ezQtYNgHEUoQR3HzznHs3JMzD9bip4="
   },
   {
     "pname": "System.Text.Encoding.CodePages",
-    "version": "4.0.1",
-    "hash": "sha256-wxtwWQSTv5tuFP79KhUAhaL6bL4d8lSzSWkCn9aolwM="
-  },
-  {
-    "pname": "System.Text.Encoding.Extensions",
-    "version": "4.0.11",
-    "hash": "sha256-+kf7J3dEhgCbnCM5vHYlsTm5/R/Ud0Jr6elpHm922iI="
-  },
-  {
-    "pname": "System.Text.Encoding.Extensions",
-    "version": "4.3.0",
-    "hash": "sha256-vufHXg8QAKxHlujPHHcrtGwAqFmsCD6HKjfDAiHyAYc="
-  },
-  {
-    "pname": "System.Text.RegularExpressions",
-    "version": "4.1.0",
-    "hash": "sha256-x6OQN6MCN7S0fJ6EFTfv4rczdUWjwuWE9QQ0P6fbh9c="
-  },
-  {
-    "pname": "System.Threading",
-    "version": "4.0.11",
-    "hash": "sha256-mob1Zv3qLQhQ1/xOLXZmYqpniNUMCfn02n8ZkaAhqac="
-  },
-  {
-    "pname": "System.Threading",
-    "version": "4.3.0",
-    "hash": "sha256-ZDQ3dR4pzVwmaqBg4hacZaVenQ/3yAF/uV7BXZXjiWc="
-  },
-  {
-    "pname": "System.Threading.Overlapped",
-    "version": "4.0.1",
-    "hash": "sha256-CAWZlavcuBQHs+kaSX9CmkpHF7wC8rFrug3XPb5KJzo="
-  },
-  {
-    "pname": "System.Threading.Tasks",
-    "version": "4.0.11",
-    "hash": "sha256-5SLxzFg1df6bTm2t09xeI01wa5qQglqUwwJNlQPJIVs="
-  },
-  {
-    "pname": "System.Threading.Tasks",
-    "version": "4.3.0",
-    "hash": "sha256-Z5rXfJ1EXp3G32IKZGiZ6koMjRu0n8C1NGrwpdIen4w="
-  },
-  {
-    "pname": "System.Threading.Tasks.Dataflow",
-    "version": "4.6.0",
-    "hash": "sha256-YYrT3GRzVBdendxt8FUDCnOBJi0nw/CJ9VrzcPJWLSg="
-  },
-  {
-    "pname": "System.Threading.Tasks.Extensions",
-    "version": "4.0.0",
-    "hash": "sha256-+YdcPkMhZhRbMZHnfsDwpNbUkr31X7pQFGxXYcAPZbE="
-  },
-  {
-    "pname": "System.Threading.Tasks.Parallel",
-    "version": "4.0.1",
-    "hash": "sha256-5VyRZ97Fug4reK/cQ6wsCrJ5jH53aGu1a4ZkKMZrnIQ="
-  },
-  {
-    "pname": "System.Threading.Thread",
-    "version": "4.0.0",
-    "hash": "sha256-7EtSJuKqcW107FYA5Ko9NFXEWUPIzNDtlfKaQV2pvb8="
-  },
-  {
-    "pname": "System.Threading.ThreadPool",
-    "version": "4.0.10",
-    "hash": "sha256-/fowWjM/0ZZFC1Rwu0i5N71iRxV2JOd3jQV2Jn0wuTk="
-  },
-  {
-    "pname": "System.Threading.Timer",
-    "version": "4.0.1",
-    "hash": "sha256-5lU6zt1O9JDSPr2KAHw4BYgysHnt0yyZrMNa5IIjxZY="
-  },
-  {
-    "pname": "System.Xml.ReaderWriter",
-    "version": "4.0.11",
-    "hash": "sha256-haZAFFQ9Sl2DhfvEbdx2YRqKEoxNMU5STaqpMmXw0zA="
-  },
-  {
-    "pname": "System.Xml.XDocument",
-    "version": "4.0.11",
-    "hash": "sha256-KPz1kxe0RUBM+aoktJ/f9p51GudMERU8Pmwm//HdlFg="
-  },
-  {
-    "pname": "System.Xml.XmlDocument",
-    "version": "4.0.1",
-    "hash": "sha256-gdoFrPo54v1LjkBF79f8EvtltVVjHz9ZI9kc5ve0GkY="
-  },
-  {
-    "pname": "System.Xml.XPath",
-    "version": "4.0.1",
-    "hash": "sha256-lQCoK2M51SGRuGjfiuIW26Y2goABY2RLE6cZ4816WDo="
-  },
-  {
-    "pname": "System.Xml.XPath.XDocument",
-    "version": "4.0.1",
-    "hash": "sha256-H/zyMMB1YB8vd+StYJr99KLqWmSHhaP7RHDLRcFhzbo="
-  },
-  {
-    "pname": "UrlCombine",
-    "version": "2.0.0",
-    "hash": "sha256-yvBqXgZsqre+JIyxY/e8y+oBs2+K7PtJkITR3YEtHlU="
+    "version": "4.5.0",
+    "hash": "sha256-Q+7R7EVSOtsXIzKjjfCnvfNul6AE1NxzJZirG0JCo6c="
   }
 ]
diff --git a/pkgs/by-name/pu/pupdate/package.nix b/pkgs/by-name/pu/pupdate/package.nix
index b33a17e6a5cf..774e8793efaf 100644
--- a/pkgs/by-name/pu/pupdate/package.nix
+++ b/pkgs/by-name/pu/pupdate/package.nix
@@ -11,13 +11,13 @@
 
 buildDotnetModule rec {
   pname = "pupdate";
-  version = "3.20.0";
+  version = "4.7.0";
 
   src = fetchFromGitHub {
     owner = "mattpannella";
     repo = "pupdate";
     rev = "${version}";
-    hash = "sha256-kdxqG1Vw6jRT/YyRLi60APpayYyLG73KqAFga8N9G2A=";
+    hash = "sha256-KodDuTVw06IFfwVOgbVwgNp74czjEcgu/T9rgYXlASQ=";
   };
 
   buildInputs = [
@@ -30,7 +30,7 @@ buildDotnetModule rec {
   patches = [ ./add-runtime-identifier.patch ];
   postPatch = ''
     substituteInPlace pupdate.csproj \
-      --replace @RuntimeIdentifier@ "${dotnetCorePackages.systemToDotnetRid stdenv.hostPlatform.system}"
+      --replace-fail @RuntimeIdentifier@ "${dotnetCorePackages.systemToDotnetRid stdenv.hostPlatform.system}"
   '';
 
   projectFile = "pupdate.csproj";
@@ -45,8 +45,8 @@ buildDotnetModule rec {
     "-p:PackageRuntime=${dotnetCorePackages.systemToDotnetRid stdenv.hostPlatform.system} -p:TrimMode=partial"
   ];
 
-  dotnet-sdk = dotnetCorePackages.sdk_8_0;
-  dotnet-runtime = dotnetCorePackages.runtime_8_0;
+  dotnet-sdk = dotnetCorePackages.sdk_9_0;
+  dotnet-runtime = dotnetCorePackages.runtime_9_0;
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/by-name/re/reqable/package.nix b/pkgs/by-name/re/reqable/package.nix
index 66b6eedce418..ab612c501383 100644
--- a/pkgs/by-name/re/reqable/package.nix
+++ b/pkgs/by-name/re/reqable/package.nix
@@ -4,7 +4,7 @@
   fetchurl,
   dpkg,
   autoPatchelfHook,
-  makeBinaryWrapper,
+  wrapGAppsHook3,
   fontconfig,
   atk,
   cairo,
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     dpkg
     autoPatchelfHook
-    makeBinaryWrapper
+    wrapGAppsHook3
   ];
 
   buildInputs = [
@@ -72,11 +72,12 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  dontWrapGApps = true;
+
   preFixup = ''
-    mkdir $out/bin
     makeWrapper $out/share/reqable/reqable $out/bin/reqable \
       --prefix LD_LIBRARY_PATH : $out/share/reqable/lib \
-      --set GIO_MODULE_DIR "${glib.out}/lib/gio/modules"
+      ''${gappsWrapperArgs[@]}
   '';
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/by-name/ru/ruffle/package.nix b/pkgs/by-name/ru/ruffle/package.nix
index d49a2e6ead28..f0977cebb46b 100644
--- a/pkgs/by-name/ru/ruffle/package.nix
+++ b/pkgs/by-name/ru/ruffle/package.nix
@@ -27,13 +27,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruffle";
-  version = "0.2.0-nightly-2026-02-23";
+  version = "0.2.0-nightly-2026-03-04";
 
   src = fetchFromGitHub {
     owner = "ruffle-rs";
     repo = "ruffle";
     tag = lib.strings.removePrefix "0.2.0-" finalAttrs.version;
-    hash = "sha256-q7d4Nb967W0O42lr5T6AltlKumgmBZ8cHN0lIO5i6Xk=";
+    hash = "sha256-IEldR8Pze17scKkKAfLrAPyZW7aak/6EKHSaO2t5MxY=";
   };
 
   postPatch =
@@ -49,7 +49,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
                        "OpenH264Version(${major}, ${minor}, ${patch})"
     '';
 
-  cargoHash = "sha256-ZZ5Utf2awzOLZP27fzGqKVChMwy1UesEkF5WAnXi1WE=";
+  cargoHash = "sha256-w2uzH9b/zuWPeRBpo/KgAXYUOC2OnFRSHGewsbfVVww=";
   cargoBuildFlags = lib.optional withRuffleTools "--workspace";
 
   env =
diff --git a/pkgs/by-name/sk/sketchybar-app-font/package.nix b/pkgs/by-name/sk/sketchybar-app-font/package.nix
index 71a55def26b7..428e4c9a04d2 100644
--- a/pkgs/by-name/sk/sketchybar-app-font/package.nix
+++ b/pkgs/by-name/sk/sketchybar-app-font/package.nix
@@ -10,13 +10,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "sketchybar-app-font";
-  version = "2.0.53";
+  version = "2.0.55";
 
   src = fetchFromGitHub {
     owner = "kvndrsslr";
     repo = "sketchybar-app-font";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4ZiFJDNb/VyQhxCbvp1H/BZG0Kc0zffYc3xtUJ6W/IU=";
+    hash = "sha256-Gr0+wPvVeRF4GztRPIsdOhknoq5xjaj8lcLnClIzZ/U=";
   };
 
   pnpmDeps = fetchPnpmDeps {
diff --git a/pkgs/by-name/sp/speedtest-tracker/package.nix b/pkgs/by-name/sp/speedtest-tracker/package.nix
new file mode 100644
index 000000000000..e27192d78402
--- /dev/null
+++ b/pkgs/by-name/sp/speedtest-tracker/package.nix
@@ -0,0 +1,71 @@
+{
+  lib,
+  fetchFromGitHub,
+  stdenvNoCC,
+  nodejs,
+  fetchNpmDeps,
+  buildPackages,
+  php84,
+  nixosTests,
+  dataDir ? "/var/lib/speedtest-tracker",
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "speedtest-tracker";
+  version = "1.13.10";
+
+  src = fetchFromGitHub {
+    owner = "alexjustesen";
+    repo = "speedtest-tracker";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-X/ShdTGAb7qPqYlZ71rxGzAetPRexlaDQ4AYvwouddc=";
+  };
+
+  buildInputs = [ php84 ];
+
+  nativeBuildInputs = [
+    nodejs
+    buildPackages.npmHooks.npmConfigHook
+    php84.packages.composer
+    php84.composerHooks2.composerInstallHook
+  ];
+
+  composerVendor = php84.mkComposerVendor {
+    inherit (finalAttrs) pname src version;
+    composerNoScripts = true;
+    composerStrictValidation = false;
+    strictDeps = true;
+    vendorHash = "sha256-fS0Wstv6uHOE5WaDWSL4nbgpHCLM442zmPoER7ZRhfg=";
+  };
+
+  npmDeps = fetchNpmDeps {
+    inherit (finalAttrs) src;
+    name = "${finalAttrs.pname}-npm-deps";
+    hash = "sha256-qWBVonPKqyB6OrDkR1ihtVac/b0Qd++Q/W4nk/VPm9E=";
+  };
+
+  preInstall = ''
+    npm run build
+  '';
+
+  postInstall = ''
+    chmod -R u+w $out/share
+    mv $out/share/php/speedtest-tracker/* $out/
+    rm -R $out/share $out/storage $out/bootstrap/cache $out/node_modules
+    ln -s ${dataDir}/storage $out/storage
+    ln -s ${dataDir}/cache $out/bootstrap/cache
+  '';
+
+  passthru = {
+    phpPackage = php84;
+    tests = nixosTests.speedtest-tracker;
+  };
+
+  meta = {
+    description = "Speedtest Tracker is a self-hosted application that monitors the performance and uptime of your internet connection";
+    homepage = "https://github.com/alexjustesen/speedtest-tracker";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ katexochen ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/st/stremio-linux-shell/allow-local-network-access.patch b/pkgs/by-name/st/stremio-linux-shell/allow-local-network-access.patch
new file mode 100644
index 000000000000..524d20502b3b
--- /dev/null
+++ b/pkgs/by-name/st/stremio-linux-shell/allow-local-network-access.patch
@@ -0,0 +1,15 @@
+diff --git a/src/webview/app/mod.rs b/src/webview/app/mod.rs
+index 2c6125e..26ab73f 100644
+--- a/src/webview/app/mod.rs
++++ b/src/webview/app/mod.rs
+@@ -23,6 +23,10 @@ cef_impl!(
+                 CMD_SWITCHES.iter().for_each(|switch| {
+                     line.append_switch(Some(&CefString::from(switch.to_owned())));
+                 });
++                line.append_switch_with_value(
++                    Some(&CefString::from("disable-features")),
++                    Some(&CefString::from("LocalNetworkAccessChecks")),
++                );
+             }
+         }
+ 
diff --git a/pkgs/by-name/st/stremio-linux-shell/better-server-path.patch b/pkgs/by-name/st/stremio-linux-shell/better-server-path.patch
new file mode 100644
index 000000000000..8e7cb8d1370b
--- /dev/null
+++ b/pkgs/by-name/st/stremio-linux-shell/better-server-path.patch
@@ -0,0 +1,13 @@
+diff --git a/src/config.rs b/src/config.rs
+index 4eda395..679699f 100644
+--- a/src/config.rs
++++ b/src/config.rs
+@@ -70,7 +70,7 @@ pub struct ServerConfig {
+ 
+ impl ServerConfig {
+     pub fn new(current_dir: &Path) -> Self {
+-        let file = current_dir.join(SERVER_FILE);
++        let file = Path::new("@serverjs@").to_path_buf();
+ 
+         Self { file }
+     }
diff --git a/pkgs/by-name/st/stremio-linux-shell/fix-getshaderinfolog-call.patch b/pkgs/by-name/st/stremio-linux-shell/fix-getshaderinfolog-call.patch
new file mode 100644
index 000000000000..6a0af3cb1953
--- /dev/null
+++ b/pkgs/by-name/st/stremio-linux-shell/fix-getshaderinfolog-call.patch
@@ -0,0 +1,21 @@
+diff --git a/src/shared/renderer/utils.rs b/src/shared/renderer/utils.rs
+index be4a65d..1b944ad 100644
+--- a/src/shared/renderer/utils.rs
++++ b/src/shared/renderer/utils.rs
+@@ -1,6 +1,6 @@
+ use std::{mem, ptr};
+ 
+-use gl::types::{GLenum, GLfloat, GLint, GLsizei, GLsizeiptr, GLuint};
++use gl::types::{GLchar, GLenum, GLfloat, GLint, GLsizei, GLsizeiptr, GLuint};
+ 
+ use super::constants::BYTES_PER_PIXEL;
+ 
+@@ -139,7 +139,7 @@ pub fn compile_shader(kind: GLenum, src: &str) -> GLuint {
+             gl::GetShaderiv(shader, gl::INFO_LOG_LENGTH, &mut len);
+ 
+             let mut buffer = vec![0u8; len as usize];
+-            gl::GetShaderInfoLog(shader, len, ptr::null_mut(), buffer.as_mut_ptr() as *mut i8);
++            gl::GetShaderInfoLog(shader, len, ptr::null_mut(), buffer.as_mut_ptr() as *mut GLchar);
+ 
+             panic!(
+                 "Shader compile error: {}",
diff --git a/pkgs/by-name/st/stremio-linux-shell/package.nix b/pkgs/by-name/st/stremio-linux-shell/package.nix
new file mode 100644
index 000000000000..f22d7e6bfc23
--- /dev/null
+++ b/pkgs/by-name/st/stremio-linux-shell/package.nix
@@ -0,0 +1,142 @@
+{
+  lib,
+  symlinkJoin,
+  rustPlatform,
+  fetchFromGitHub,
+  versionCheckHook,
+  gitUpdater,
+
+  # buildInputs
+  atk,
+  cef-binary,
+  gtk3,
+  libayatana-appindicator,
+  libxkbcommon,
+  mpv,
+  openssl,
+
+  # nativeBuildInputs
+  makeBinaryWrapper,
+  pkg-config,
+  wrapGAppsHook4,
+
+  # Wrapper
+  addDriverRunpath,
+  libGL,
+  nodejs,
+}:
+
+let
+  # Stremio expects CEF files in a specific layout
+  cef = symlinkJoin {
+    name = "stremio-linux-shell-cef";
+    paths = [
+      "${cef-binary}/Resources"
+      "${cef-binary}/Release"
+    ];
+  };
+in
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "stremio-linux-shell";
+  version = "1.0.0-beta.13";
+
+  src = fetchFromGitHub {
+    owner = "Stremio";
+    repo = "stremio-linux-shell";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-1f9IBNo5gxpSqTSIf8QuQOlf+sfRhohOmQTLRbX/OU8=";
+  };
+
+  cargoHash = "sha256-wx5oF4uF9UMtKzfGxZKsy6mVjYaRD40dLuvaRtz8yE4=";
+
+  patches = [
+    # Chromium 142 stopped allowing local network access by default, which
+    # breaks the app's ability to communicate with the Stremio server.
+    ./allow-local-network-access.patch
+
+    # GLchar is u8 on aarch64
+    # Upstream PR: https://github.com/Stremio/stremio-linux-shell/pull/40
+    ./fix-getshaderinfolog-call.patch
+
+    # Patch server.js path so that we don't have to install it in $out/bin
+    ./better-server-path.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace src/config.rs \
+      --replace-fail "@serverjs@" "${placeholder "out"}/share/stremio/server.js"
+
+    substituteInPlace $cargoDepsCopy/libappindicator-sys-*/src/lib.rs \
+      --replace-fail "libayatana-appindicator3.so.1" "${libayatana-appindicator}/lib/libayatana-appindicator3.so.1"
+    substituteInPlace $cargoDepsCopy/xkbcommon-dl-*/src/lib.rs \
+      --replace-fail "libxkbcommon.so.0" "${libxkbcommon}/lib/libxkbcommon.so.0"
+    substituteInPlace $cargoDepsCopy/xkbcommon-dl-*/src/x11.rs \
+      --replace-fail "libxkbcommon-x11.so.0" "${libxkbcommon}/lib/libxkbcommon-x11.so.0"
+  '';
+
+  # Don't download CEF during build
+  buildFeatures = [ "offline-build" ];
+
+  buildInputs = [
+    atk
+    cef
+    gtk3
+    libayatana-appindicator
+    libxkbcommon
+    mpv
+    openssl
+  ];
+
+  nativeBuildInputs = [
+    makeBinaryWrapper
+    pkg-config
+    wrapGAppsHook4
+  ];
+
+  env.CEF_PATH = "${cef}";
+
+  postInstall = ''
+    mkdir -p $out/share/applications
+    cp data/com.stremio.Stremio.desktop $out/share/applications/com.stremio.Stremio.desktop
+
+    mkdir -p $out/share/icons/hicolor/scalable/apps
+    cp data/icons/com.stremio.Stremio.svg $out/share/icons/hicolor/scalable/apps/com.stremio.Stremio.svg
+
+    mkdir -p $out/share/stremio
+    cp data/server.js $out/share/stremio/server.js
+
+    mv $out/bin/stremio-linux-shell $out/bin/stremio
+  '';
+
+  # Node.js is required to run `server.js`
+  # Add to `gappsWrapperArgs` to avoid two layers of wrapping.
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix LD_LIBRARY_PATH : "${addDriverRunpath.driverLink}/lib" \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ libGL ]}" \
+      --prefix PATH : "${lib.makeBinPath [ nodejs ]}"
+    )
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru = {
+    inherit cef;
+    updateScript = gitUpdater { rev-prefix = "v"; };
+  };
+
+  meta = {
+    description = "Modern media center that gives you the freedom to watch everything you want";
+    homepage = "https://www.stremio.com/";
+    license = with lib.licenses; [
+      gpl3Only
+      # server.js is unfree
+      unfree
+    ];
+    maintainers = with lib.maintainers; [ thunze ];
+    platforms = lib.platforms.linux;
+    mainProgram = "stremio";
+  };
+})
diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix
index d6049ce4f3c1..7be071bd5555 100644
--- a/pkgs/by-name/ty/ty/package.nix
+++ b/pkgs/by-name/ty/ty/package.nix
@@ -14,14 +14,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ty";
-  version = "0.0.20";
+  version = "0.0.21";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ty";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-NJ2RA12NZDmYdrSK9p+KfYiE36KA1RkolSchMRU7pHQ=";
+    hash = "sha256-/R0nw9V0IhuTxRaZNydvk/xGC5V1gYHQxBkAU/Cjsmw=";
   };
 
   # For Darwin platforms, remove the integration test for file notifications,
@@ -35,7 +35,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoBuildFlags = [ "--package=ty" ];
 
-  cargoHash = "sha256-xUYjlSl9uKsk+Wk3xxK6wPrKhFHuqpJNgQ2TSkcGpYE=";
+  cargoHash = "sha256-NaWWX6EAVkEg/KQ+Up0t2fh/24fnTo6i5dDZoOWErjg=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/uh/uhttpd/package.nix b/pkgs/by-name/uh/uhttpd/package.nix
new file mode 100644
index 000000000000..1326eb93aabf
--- /dev/null
+++ b/pkgs/by-name/uh/uhttpd/package.nix
@@ -0,0 +1,66 @@
+{
+  lib,
+  stdenv,
+  fetchgit,
+  cmake,
+  pkg-config,
+  lua5_1,
+  json_c,
+  libubox-wolfssl,
+  ubus,
+  libxcrypt,
+  unstableGitUpdater,
+  makeWrapper,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "uhttpd";
+  version = "0-unstable-2025-12-24";
+
+  src = fetchgit {
+    url = "https://git.openwrt.org/project/uhttpd.git";
+    rev = "506e24987b97fbc866005bfb71316bd63601a1ef";
+    hash = "sha256-x5hbbEcyxWhCjjqiHvAxvI1eHewqRlXuAGqXNw+c4sA=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    makeWrapper
+  ];
+
+  buildInputs = [
+    lua5_1
+    json_c
+    libubox-wolfssl
+    ubus
+    libxcrypt
+  ];
+
+  cmakeFlags = [
+    "-DUCODE_SUPPORT=off"
+    "-DTLS_SUPPORT=on"
+    "-DLUA_SUPPORT=on"
+  ];
+
+  NIX_LDFLAGS = "-lcrypt";
+
+  postInstall = ''
+    wrapProgram $out/bin/uhttpd \
+      --prefix LD_LIBRARY_PATH : $out/lib/uhttpd
+  '';
+
+  passthru.updateScript = unstableGitUpdater {
+    branch = "master";
+    hardcodeZeroVersion = true;
+  };
+
+  meta = {
+    description = "Tiny HTTP server from OpenWrt project";
+    homepage = "https://openwrt.org/docs/guide-user/services/webserver/uhttpd";
+    license = lib.licenses.isc;
+    platforms = lib.platforms.unix;
+    maintainers = [ lib.maintainers.haylin ];
+    mainProgram = "uhttpd";
+  };
+})
diff --git a/pkgs/by-name/un/unityhub/package.nix b/pkgs/by-name/un/unityhub/package.nix
index e1e425c5f734..b63409e0f537 100644
--- a/pkgs/by-name/un/unityhub/package.nix
+++ b/pkgs/by-name/un/unityhub/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "unityhub";
-  version = "3.16.2";
+  version = "3.16.3";
 
   src = fetchurl {
     url = "https://hub-dist.unity3d.com/artifactory/hub-debian-prod-local/pool/main/u/unity/unityhub_amd64/UnityHubSetup-${version}-amd64.deb";
-    hash = "sha256-SvHnIIqNfT2PhyNuKliBl7CsokZE4lrsnbhwtf+1YsA=";
+    hash = "sha256-Sfgzx2K+38T0v31K4SdtbMS6alAVuOyTS9O89OYjozU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ya/yazi/package.nix b/pkgs/by-name/ya/yazi/package.nix
index 2b08089ee729..917605f0bfc6 100644
--- a/pkgs/by-name/ya/yazi/package.nix
+++ b/pkgs/by-name/ya/yazi/package.nix
@@ -93,7 +93,17 @@ let
 in
 runCommand yazi-unwrapped.name
   {
-    inherit (yazi-unwrapped) pname version meta;
+    inherit (yazi-unwrapped) pname version;
+
+    meta = {
+      inherit (yazi-unwrapped.meta)
+        description
+        homepage
+        license
+        maintainers
+        mainProgram
+        ;
+    };
 
     nativeBuildInputs = [ makeWrapper ];
   }
diff --git a/pkgs/development/beam-modules/elvis-erlang/default.nix b/pkgs/development/beam-modules/elvis-erlang/default.nix
index 9de2d3cd2c2b..cb80d7e3b3ca 100644
--- a/pkgs/development/beam-modules/elvis-erlang/default.nix
+++ b/pkgs/development/beam-modules/elvis-erlang/default.nix
@@ -11,12 +11,12 @@
 rebar3Relx rec {
   releaseType = "escript";
   pname = "elvis-erlang";
-  version = "4.2.1";
+  version = "4.2.3";
 
   src = fetchFromGitHub {
     owner = "inaka";
     repo = "elvis";
-    hash = "sha256-/a7wcST0CYVebX7XVZLaDXNJX6fsFCCoidhSqcs+mNI=";
+    hash = "sha256-4hStLm76HZmO3vk/RdeRGJPJ3gevUkjVO2jGpVff32Q=";
     tag = version;
   };
 
diff --git a/pkgs/development/beam-modules/elvis-erlang/rebar-deps.nix b/pkgs/development/beam-modules/elvis-erlang/rebar-deps.nix
index 715e6ff43a51..43985a064e84 100644
--- a/pkgs/development/beam-modules/elvis-erlang/rebar-deps.nix
+++ b/pkgs/development/beam-modules/elvis-erlang/rebar-deps.nix
@@ -44,11 +44,11 @@ let
     };
     elvis_core = builder {
       name = "elvis_core";
-      version = "4.2.1";
+      version = "4.2.3";
       src = fetchHex {
         pkg = "elvis_core";
-        version = "4.2.1";
-        sha256 = "sha256-D3dLiR5kqMuZSf9PVUhclgjBFEFIEDqDOhAUk7l8J7I=";
+        version = "4.2.3";
+        sha256 = "sha256-xy4xinPab51p3uDxh/h5dHH57kbPTdrO36LJ+byxjqA=";
       };
       beamDeps = [
         katana_code
diff --git a/pkgs/development/python-modules/buildstream-plugins/default.nix b/pkgs/development/python-modules/buildstream-plugins/default.nix
index 201db0932bab..1159c4cafab5 100644
--- a/pkgs/development/python-modules/buildstream-plugins/default.nix
+++ b/pkgs/development/python-modules/buildstream-plugins/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  gitUpdater,
   setuptools,
   cython,
 }:
@@ -29,6 +30,10 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "buildstream_plugins" ];
 
+  passthru.updateScript = gitUpdater {
+    ignoredVersions = "dev";
+  };
+
   meta = {
     description = "BuildStream plugins";
     homepage = "https://github.com/apache/buildstream-plugins";
diff --git a/pkgs/development/python-modules/dogpile-cache/default.nix b/pkgs/development/python-modules/dogpile-cache/default.nix
index a68fcad4bdb3..ebea5ee74068 100644
--- a/pkgs/development/python-modules/dogpile-cache/default.nix
+++ b/pkgs/development/python-modules/dogpile-cache/default.nix
@@ -3,6 +3,7 @@
   buildPythonPackage,
   fetchPypi,
   setuptools,
+  pytest-xdist,
   pytestCheckHook,
   mako,
   decorator,
@@ -31,8 +32,14 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    pytestCheckHook
     mako
+    pytest-xdist
+    pytestCheckHook
+  ];
+
+  disabledTestPaths = lib.optionals stdenv.hostPlatform.isLinux [
+    # flaky
+    "tests/cache/test_dbm_backend.py"
   ];
 
   disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
@@ -44,6 +51,8 @@ buildPythonPackage rec {
     "test_get_value_plus_created_registry_safe_cache_slow"
     "test_get_value_plus_created_registry_unsafe_cache"
     "test_quick"
+    "test_region_set_get_value"
+    "test_region_set_multiple_values"
     "test_return_while_in_progress"
     "test_slow"
   ];
diff --git a/pkgs/development/python-modules/google-cloud-spanner/default.nix b/pkgs/development/python-modules/google-cloud-spanner/default.nix
index b8ada5017686..3981cb83c107 100644
--- a/pkgs/development/python-modules/google-cloud-spanner/default.nix
+++ b/pkgs/development/python-modules/google-cloud-spanner/default.nix
@@ -13,6 +13,7 @@
   google-cloud-testutils,
   grpc-google-iam-v1,
   grpc-interceptor,
+  opentelemetry-resourcedetector-gcp,
   proto-plus,
   protobuf,
   sqlparse,
@@ -31,16 +32,16 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "google-cloud-spanner";
-  version = "3.58.0";
+  version = "3.63.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "python-spanner";
-    tag = "v${version}";
-    hash = "sha256-bIagQjQv+oatIo8mkA8t5wP9igMnorkiudgyWkVnJcg=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-QWBl7X/cKGds617IrHKaIteOnqgwB83jgfi8j/ESUws=";
   };
 
   build-system = [ setuptools ];
@@ -51,6 +52,7 @@ buildPythonPackage rec {
     google-cloud-core
     grpc-google-iam-v1
     grpc-interceptor
+    opentelemetry-resourcedetector-gcp
     proto-plus
     protobuf
     sqlparse
@@ -79,7 +81,7 @@ buildPythonPackage rec {
     pytest-asyncio
     pytestCheckHook
   ]
-  ++ lib.concatAttrValues optional-dependencies;
+  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
 
   preCheck = ''
     # prevent google directory from shadowing google imports
@@ -97,6 +99,9 @@ buildPythonPackage rec {
     "test_snapshot_read_concurrent"
     # Flaky, can retry too quickly and fail
     "test_retry_helper"
+    # Flaky, system speed sensitive
+    "test_transaction_for_concurrent_statement_should_begin_one_transaction_with_query"
+    "test_transaction_for_concurrent_statement_should_begin_one_transaction_with_read"
   ];
 
   disabledTestPaths = [
@@ -130,8 +135,8 @@ buildPythonPackage rec {
   meta = {
     description = "Cloud Spanner API client library";
     homepage = "https://github.com/googleapis/python-spanner";
-    changelog = "https://github.com/googleapis/python-spanner/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/googleapis/python-spanner/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = [ lib.maintainers.sarahec ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/opentelemetry-resourcedetector-gcp/default.nix b/pkgs/development/python-modules/opentelemetry-resourcedetector-gcp/default.nix
new file mode 100644
index 000000000000..02b3917a0cfa
--- /dev/null
+++ b/pkgs/development/python-modules/opentelemetry-resourcedetector-gcp/default.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  opentelemetry-api,
+  opentelemetry-sdk,
+  requests,
+  typing-extensions,
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "opentelemetry-resourcedetector-gcp";
+  version = "1.11.0a0";
+  pyproject = true;
+
+  # Use PyPi instead of GitHub because the GitHub tags are inaccurate
+  # (GitHub tags lack the alpha suffix)
+  src = fetchPypi {
+    pname = "opentelemetry_resourcedetector_gcp";
+    inherit (finalAttrs) version;
+    hash = "sha256-kVodb9FdrKnu3T/FKw9wU3UFTy7xQOLnprTMqVpHzbE=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    opentelemetry-api
+    opentelemetry-sdk
+    requests
+    typing-extensions
+  ];
+
+  pythonImportsCheck = [
+    "opentelemetry.resourcedetector.gcp_resource_detector"
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  disabledTestPaths = [
+    # These require a 4-year-old syrupy version
+    "tests/test_mapping.py"
+    "tests/test_gcp_resource_detector.py"
+  ];
+
+  meta = {
+    description = "Google Cloud resource detector for OpenTelemetry";
+    homepage = "https://pypi.org/project/opentelemetry-resourcedetector-gcp";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      sarahec
+    ];
+  };
+})
diff --git a/pkgs/development/python-modules/oslo-utils/default.nix b/pkgs/development/python-modules/oslo-utils/default.nix
index 167fa70622d9..95c299a205b6 100644
--- a/pkgs/development/python-modules/oslo-utils/default.nix
+++ b/pkgs/development/python-modules/oslo-utils/default.nix
@@ -16,7 +16,6 @@
   psutil,
   pyparsing,
   pytz,
-  tzdata,
 
   # tests
   ddt,
@@ -31,17 +30,18 @@
   stdenv,
   stestr,
   testscenarios,
+  tzdata,
 }:
 
 buildPythonPackage rec {
   pname = "oslo-utils";
-  version = "9.2.0";
+  version = "10.0.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "oslo_utils";
     inherit version;
-    hash = "sha256-H0IAbea5KRoDBQJfXM24kHEg2I7X68N4ShRyozKASKs=";
+    hash = "sha256-u0ZxPnYNlERqCE9elMHPJzk1NpMIrYjuW1OReSPZw5M=";
   };
 
   postPatch =
@@ -71,7 +71,6 @@ buildPythonPackage rec {
     psutil
     pyparsing
     pytz
-    tzdata
   ];
 
   nativeCheckInputs = [
@@ -84,6 +83,7 @@ buildPythonPackage rec {
     qemu-utils
     stestr
     testscenarios
+    tzdata
   ];
 
   # disabled tests:
diff --git a/pkgs/development/python-modules/tempest/default.nix b/pkgs/development/python-modules/tempest/default.nix
index b5050fa94bb6..c3fe3ad2cfbd 100644
--- a/pkgs/development/python-modules/tempest/default.nix
+++ b/pkgs/development/python-modules/tempest/default.nix
@@ -32,12 +32,12 @@
 
 buildPythonPackage rec {
   pname = "tempest";
-  version = "46.0.0";
+  version = "46.1.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ddm1OE7BDwDM4T9GIB0+qK8WvU/+aC+FBIGWDm3ObHM=";
+    hash = "sha256-E61jqj0Wy1f81ackoFnnEZI2UCw70YIGYxQA1ME++xU=";
   };
 
   postPatch = ''
@@ -88,6 +88,11 @@ buildPythonPackage rec {
     chmod +x bin/*
 
     stestr --test-path tempest/tests run -e <(echo "
+      tempest.tests.common.test_concurrency.TestConcurrency.test_run_concurrent_tasks_dict_return_values
+      tempest.tests.common.test_concurrency.TestConcurrency.test_run_concurrent_tasks_multiple_workers
+      tempest.tests.common.test_concurrency.TestConcurrency.test_run_concurrent_tasks_single_process
+      tempest.tests.common.test_concurrency.TestConcurrency.test_run_concurrent_tasks_success
+      tempest.tests.common.test_concurrency.TestConcurrency.test_run_concurrent_tasks_with_exception
       tempest.tests.lib.cli.test_execute.TestExecute.test_execute_with_prefix
     ")
   '';
diff --git a/pkgs/tools/compression/gzip/default.nix b/pkgs/tools/compression/gzip/default.nix
index 85b452f2260b..446e5fab0af8 100644
--- a/pkgs/tools/compression/gzip/default.nix
+++ b/pkgs/tools/compression/gzip/default.nix
@@ -48,6 +48,10 @@ stdenv.mkDerivation (finalAttrs: {
     "ZLESS_PROG=zless"
   ];
 
+  env = lib.optionalAttrs (stdenv.hostPlatform.isMusl && stdenv.hostPlatform.isx86_32) {
+    NIX_CFLAGS_LINK = "-no-pie";
+  };
+
   nativeCheckInputs = [
     less
     perl
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 05e6defbee83..58e77ee3429b 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -11678,6 +11678,10 @@ self: super: with self; {
 
   opentelemetry-proto = callPackage ../development/python-modules/opentelemetry-proto { };
 
+  opentelemetry-resourcedetector-gcp =
+    callPackage ../development/python-modules/opentelemetry-resourcedetector-gcp
+      { };
+
   opentelemetry-sdk = callPackage ../development/python-modules/opentelemetry-sdk { };
 
   opentelemetry-semantic-conventions =