diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index 8992d36fb25b..8d37b9c7b39b 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -361,6 +361,22 @@ modifications.
 
 Do pay attention to passing in the right Python version!
 
+#### `mkPythonMetaPackage` function {#mkpythonmetapackage-function}
+
+This will create a meta package containing [metadata files](https://packaging.python.org/en/latest/specifications/recording-installed-packages/) to satisfy a dependency on a package, without it actually having been installed into the environment.
+In nixpkgs this is used to package Python packages with split binary/source distributions such as [psycopg2](https://pypi.org/project/psycopg2/)/[psycopg2-binary](https://pypi.org/project/psycopg2-binary/).
+
+```nix
+mkPythonMetaPackage {
+  pname = "psycopg2-binary";
+  inherit (psycopg2) optional-dependencies version;
+  dependencies = [ psycopg2 ];
+  meta = {
+    inherit (psycopg2.meta) description homepage;
+  };
+}
+```
+
 #### `python.buildEnv` function {#python.buildenv-function}
 
 Python environments can be created using the low-level `pkgs.buildEnv` function.
diff --git a/lib/modules.nix b/lib/modules.nix
index b9e9ca1e5d78..ef0be5b27aaf 100644
--- a/lib/modules.nix
+++ b/lib/modules.nix
@@ -1366,6 +1366,58 @@ let
       ]);
     };
 
+  /**
+    `importApply file arg :: Path -> a -> Module`,  where `import file :: a -> Module`
+
+    `importApply` imports a Nix expression file much like the module system would,
+    after passing an extra positional argument to the function in the file.
+
+    This function should be used when declaring a module in a file that refers to
+    values from a different scope, such as that in a flake.
+
+    It solves the problems of alternative solutions:
+
+    - While `importApply file arg` is _mostly_ equivalent to
+      `import file arg`, the latter returns a module without a location,
+      as `import` only returns the contained expression. This leads to worse
+      error messages.
+
+    - Using `specialArgs` to provide arguments to all modules. This effectively
+      creates an incomplete module, and requires the user of the module to
+      manually pass the `specialArgs` to the configuration, which is error-prone,
+      verbose, and unnecessary.
+
+    The nix file must contain a function that returns a module.
+    A module may itself be a function, so the file is often a function with two
+    positional arguments instead of one. See the example below.
+
+    This function does not add support for deduplication and `disabledModules`,
+    although that could be achieved by wrapping the returned module and setting
+    the `_key` module attribute.
+    The reason for this omission is that the file path is not guaranteed to be
+    a unique identifier for the module, as two instances of the module may
+    reference different `arg`s in their closures.
+
+    Example
+
+        # lib.nix
+        imports = [
+          (lib.modules.importApply ./module.nix { bar = bar; })
+        ];
+
+        # module.nix
+        { bar }:
+        { lib, config, ... }:
+        {
+          options = ...;
+          config = ... bar ...;
+        }
+
+  */
+  importApply =
+    modulePath: staticArg:
+      lib.setDefaultModuleLocation modulePath (import modulePath staticArg);
+
   /* Use this function to import a JSON file as NixOS configuration.
 
      modules.importJSON :: path -> attrs
@@ -1415,6 +1467,7 @@ private //
     filterOverrides'
     fixMergeModules
     fixupOptionType  # should be private?
+    importApply
     importJSON
     importTOML
     mergeDefinitions
diff --git a/lib/tests/modules.sh b/lib/tests/modules.sh
index 3301a3d987ee..09547b2e0e6c 100755
--- a/lib/tests/modules.sh
+++ b/lib/tests/modules.sh
@@ -247,6 +247,14 @@ checkConfigOutput '^true$' "$@" ./define-enable.nix ./define-attrsOfSub-if-foo-e
 checkConfigOutput '^true$' "$@" ./define-enable.nix ./define-attrsOfSub-foo-if-enable.nix
 checkConfigOutput '^true$' "$@" ./define-enable.nix ./define-attrsOfSub-foo-enable-if.nix
 
+# Check importApply
+checkConfigOutput '"abc"' config.value ./importApply.nix
+# importApply does not set a key.
+# Disabling the function file is not sufficient, because importApply can't reasonably assume that the key is unique.
+# e.g. user may call it multiple times with different arguments and expect each of the module to apply.
+# While this is excusable for the disabledModules aspect, it is not for the deduplication of modules.
+checkConfigOutput '"abc"' config.value ./importApply-disabling.nix
+
 # Check disabledModules with config definitions and option declarations.
 set -- config.enable ./define-enable.nix ./declare-enable.nix
 checkConfigOutput '^true$' "$@"
diff --git a/lib/tests/modules/importApply-disabling.nix b/lib/tests/modules/importApply-disabling.nix
new file mode 100644
index 000000000000..016036dd8af5
--- /dev/null
+++ b/lib/tests/modules/importApply-disabling.nix
@@ -0,0 +1,4 @@
+{
+  imports = [ ./importApply.nix ];
+  disabledModules = [ ./importApply-function.nix ];
+}
diff --git a/lib/tests/modules/importApply-function.nix b/lib/tests/modules/importApply-function.nix
new file mode 100644
index 000000000000..7c193a912d49
--- /dev/null
+++ b/lib/tests/modules/importApply-function.nix
@@ -0,0 +1,5 @@
+{ foo }:
+{ lib, config, ... }:
+{
+  value = foo;
+}
diff --git a/lib/tests/modules/importApply.nix b/lib/tests/modules/importApply.nix
new file mode 100644
index 000000000000..d3b893cb34e2
--- /dev/null
+++ b/lib/tests/modules/importApply.nix
@@ -0,0 +1,5 @@
+{ lib, ... }:
+{
+  options.value = lib.mkOption { default = 1; };
+  imports = [ (lib.modules.importApply ./importApply-function.nix { foo = "abc"; }) ];
+}
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 42072e3dad97..0e9b7a45f5cf 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -3812,6 +3812,12 @@
     githubId = 199180;
     name = "Claes Wallin";
   };
+  claes = {
+    email = "claes.holmerson@gmail.com";
+    github = "claes";
+    githubId = 43564;
+    name = "Claes Holmerson";
+  };
   clebs = {
     email = "borja.clemente@gmail.com";
     github = "clebs";
@@ -9258,6 +9264,12 @@
     github = "jankaifer";
     githubId = 12820484;
   };
+  janlikar = {
+    name = "Jan Likar";
+    email = "jan.likar@protonmail.com";
+    github = "janlikar";
+    githubId = 4228250;
+  };
   jansol = {
     email = "jan.solanti@paivola.fi";
     github = "jansol";
@@ -18771,6 +18783,12 @@
     githubId = 307899;
     name = "Gurkan Gur";
   };
+  sequencer = {
+    email = "liu@jiuyang.me";
+    github = "sequencer";
+    githubId = 5791019;
+    name = "Jiuyang Liu";
+  };
   serge = {
     email = "sb@canva.com";
     github = "serge-belov";
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 6534cdcc97b5..d304498ec593 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -315,6 +315,7 @@ with lib.maintainers;
       leona
       osnyx
       ma27
+      laalsaas
     ];
     scope = "Team for Flying Circus employees who collectively maintain packages.";
     shortName = "Flying Circus employees";
diff --git a/nixos/doc/manual/configuration/user-mgmt.chapter.md b/nixos/doc/manual/configuration/user-mgmt.chapter.md
index 7d83121d41e0..2edca78f4a38 100644
--- a/nixos/doc/manual/configuration/user-mgmt.chapter.md
+++ b/nixos/doc/manual/configuration/user-mgmt.chapter.md
@@ -100,6 +100,9 @@ modified using `usermod`. Unix groups can be managed using `groupadd`,
 
 ::: {.note}
 This is experimental.
+
+Please consider using [Userborn](#sec-userborn) over systemd-sysusers as it's
+more feature complete.
 :::
 
 Instead of using a custom perl script to create users and groups, you can use
@@ -112,3 +115,43 @@ systemd-sysusers:
 ```
 
 The primary benefit of this is to remove a dependency on perl.
+
+## Manage users and groups with `userborn` {#sec-userborn}
+
+::: {.note}
+This is experimental.
+:::
+
+Like systemd-sysusers, Userborn adoesn't depend on Perl but offers some more
+advantages over systemd-sysusers:
+
+1. It can create "normal" users (with a GID >= 1000).
+2. It can update some information about users. Most notably it can update their
+   passwords.
+3. It will warn when users use an insecure or unsupported password hashing
+   scheme.
+
+Userborn is the recommended way to manage users if you don't want to rely on
+the Perl script. It aims to eventually replace the Perl script by default.
+
+You can enable Userborn via:
+
+```nix
+services.userborn.enable = true;
+```
+
+You can configure Userborn to store the password files
+(`/etc/{group,passwd,shadow}`) outside of `/etc` and symlink them from this
+location to `/etc`:
+
+```nix
+services.userborn.passwordFilesLocation = "/persistent/etc";
+```
+
+This is useful when you store `/etc` on a `tmpfs` or if `/etc` is immutable
+(e.g. when using `system.etc.overlay.mutable = false;`). In the latter case the
+original files are by default stored in `/var/lib/nixos`.
+
+Userborn implements immutable users by re-mounting the password files
+read-only. This means that unlike when using the Perl script, trying to add a
+new user (e.g. via `useradd`) will fail right away.
diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index a3ed649fb21e..dd8d377e14eb 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -41,6 +41,13 @@
 
 - [Quickwit](https://quickwit.io), sub-second search & analytics engine on cloud storage. Available as [services.quickwit](options.html#opt-services.quickwit).
 
+- [Userborn](https://github.com/nikstur/userborn), a service for declarative
+  user management. This can be used instead of the `update-users-groups.pl`
+  Perl script and instead of systemd-sysusers. To achieve a system without
+  Perl, this is the now recommended tool over systemd-sysusers because it can
+  alos create normal users and change passwords. Available as
+  [services.userborn](#opt-services.userborn.enable)
+
 - [Flood](https://flood.js.org/), a beautiful WebUI for various torrent clients. Available as [services.flood](options.html#opt-services.flood).
 
 - [Firefly-iii Data Importer](https://github.com/firefly-iii/data-importer), a data importer for Firefly-III. Available as [services.firefly-iii-data-importer](options.html#opt-services.firefly-iii-data-importer)
diff --git a/nixos/modules/config/i18n.nix b/nixos/modules/config/i18n.nix
index 9d2d3c23beb3..e94186f19d76 100644
--- a/nixos/modules/config/i18n.nix
+++ b/nixos/modules/config/i18n.nix
@@ -1,26 +1,23 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 {
   ###### interface
 
   options = {
 
     i18n = {
-      glibcLocales = mkOption {
-        type = types.path;
+      glibcLocales = lib.mkOption {
+        type = lib.types.path;
         default = pkgs.glibcLocales.override {
-          allLocales = any (x: x == "all") config.i18n.supportedLocales;
+          allLocales = lib.any (x: x == "all") config.i18n.supportedLocales;
           locales = config.i18n.supportedLocales;
         };
-        defaultText = literalExpression ''
+        defaultText = lib.literalExpression ''
           pkgs.glibcLocales.override {
             allLocales = any (x: x == "all") config.i18n.supportedLocales;
             locales = config.i18n.supportedLocales;
           }
         '';
-        example = literalExpression "pkgs.glibcLocales";
+        example = lib.literalExpression "pkgs.glibcLocales";
         description = ''
           Customized pkg.glibcLocales package.
 
@@ -29,8 +26,8 @@ with lib;
         '';
       };
 
-      defaultLocale = mkOption {
-        type = types.str;
+      defaultLocale = lib.mkOption {
+        type = lib.types.str;
         default = "en_US.UTF-8";
         example = "nl_NL.UTF-8";
         description = ''
@@ -40,8 +37,8 @@ with lib;
         '';
       };
 
-      extraLocaleSettings = mkOption {
-        type = types.attrsOf types.str;
+      extraLocaleSettings = lib.mkOption {
+        type = lib.types.attrsOf lib.types.str;
         default = {};
         example = { LC_MESSAGES = "en_US.UTF-8"; LC_TIME = "de_DE.UTF-8"; };
         description = ''
@@ -51,24 +48,24 @@ with lib;
         '';
       };
 
-      supportedLocales = mkOption {
-        type = types.listOf types.str;
-        default = unique
-          (builtins.map (l: (replaceStrings [ "utf8" "utf-8" "UTF8" ] [ "UTF-8" "UTF-8" "UTF-8" ] l) + "/UTF-8") (
+      supportedLocales = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = lib.unique
+          (builtins.map (l: (lib.replaceStrings [ "utf8" "utf-8" "UTF8" ] [ "UTF-8" "UTF-8" "UTF-8" ] l) + "/UTF-8") (
             [
               "C.UTF-8"
               "en_US.UTF-8"
               config.i18n.defaultLocale
-            ] ++ (attrValues (filterAttrs (n: v: n != "LANGUAGE") config.i18n.extraLocaleSettings))
+            ] ++ (lib.attrValues (lib.filterAttrs (n: v: n != "LANGUAGE") config.i18n.extraLocaleSettings))
           ));
-        defaultText = literalExpression ''
-          unique
-            (builtins.map (l: (replaceStrings [ "utf8" "utf-8" "UTF8" ] [ "UTF-8" "UTF-8" "UTF-8" ] l) + "/UTF-8") (
+        defaultText = lib.literalExpression ''
+          lib.unique
+            (builtins.map (l: (lib.replaceStrings [ "utf8" "utf-8" "UTF8" ] [ "UTF-8" "UTF-8" "UTF-8" ] l) + "/UTF-8") (
               [
                 "C.UTF-8"
                 "en_US.UTF-8"
                 config.i18n.defaultLocale
-              ] ++ (attrValues (filterAttrs (n: v: n != "LANGUAGE") config.i18n.extraLocaleSettings))
+              ] ++ (lib.attrValues (lib.filterAttrs (n: v: n != "LANGUAGE") config.i18n.extraLocaleSettings))
             ))
         '';
         example = ["en_US.UTF-8/UTF-8" "nl_NL.UTF-8/UTF-8" "nl_NL/ISO-8859-1"];
@@ -91,14 +88,14 @@ with lib;
 
     environment.systemPackages =
       # We increase the priority a little, so that plain glibc in systemPackages can't win.
-      optional (config.i18n.supportedLocales != []) (lib.setPrio (-1) config.i18n.glibcLocales);
+      lib.optional (config.i18n.supportedLocales != []) (lib.setPrio (-1) config.i18n.glibcLocales);
 
     environment.sessionVariables =
       { LANG = config.i18n.defaultLocale;
         LOCALE_ARCHIVE = "/run/current-system/sw/lib/locale/locale-archive";
       } // config.i18n.extraLocaleSettings;
 
-    systemd.globalEnvironment = mkIf (config.i18n.supportedLocales != []) {
+    systemd.globalEnvironment = lib.mkIf (config.i18n.supportedLocales != []) {
       LOCALE_ARCHIVE = "${config.i18n.glibcLocales}/lib/locale/locale-archive";
     };
 
@@ -106,7 +103,7 @@ with lib;
     environment.etc."locale.conf".source = pkgs.writeText "locale.conf"
       ''
         LANG=${config.i18n.defaultLocale}
-        ${concatStringsSep "\n" (mapAttrsToList (n: v: "${n}=${v}") config.i18n.extraLocaleSettings)}
+        ${lib.concatStringsSep "\n" (lib.mapAttrsToList (n: v: "${n}=${v}") config.i18n.extraLocaleSettings)}
       '';
 
   };
diff --git a/nixos/modules/config/shells-environment.nix b/nixos/modules/config/shells-environment.nix
index 50796f8bc6f1..9289eced109f 100644
--- a/nixos/modules/config/shells-environment.nix
+++ b/nixos/modules/config/shells-environment.nix
@@ -1,10 +1,6 @@
 # This module defines a global environment configuration and
 # a common configuration for all shells.
-
 { config, lib, utils, pkgs, ... }:
-
-with lib;
-
 let
 
   cfg = config.environment;
@@ -12,27 +8,27 @@ let
   exportedEnvVars =
     let
       absoluteVariables =
-        mapAttrs (n: toList) cfg.variables;
+        lib.mapAttrs (n: lib.toList) cfg.variables;
 
       suffixedVariables =
-        flip mapAttrs cfg.profileRelativeEnvVars (envVar: listSuffixes:
-          concatMap (profile: map (suffix: "${profile}${suffix}") listSuffixes) cfg.profiles
+        lib.flip lib.mapAttrs cfg.profileRelativeEnvVars (envVar: listSuffixes:
+          lib.concatMap (profile: map (suffix: "${profile}${suffix}") listSuffixes) cfg.profiles
         );
 
       allVariables =
-        zipAttrsWith (n: concatLists) [ absoluteVariables suffixedVariables ];
+        lib.zipAttrsWith (n: lib.concatLists) [ absoluteVariables suffixedVariables ];
 
       exportVariables =
-        mapAttrsToList (n: v: ''export ${n}="${concatStringsSep ":" v}"'') allVariables;
+        lib.mapAttrsToList (n: v: ''export ${n}="${lib.concatStringsSep ":" v}"'') allVariables;
     in
-      concatStringsSep "\n" exportVariables;
+      lib.concatStringsSep "\n" exportVariables;
 in
 
 {
 
   options = {
 
-    environment.variables = mkOption {
+    environment.variables = lib.mkOption {
       default = {};
       example = { EDITOR = "nvim"; VISUAL = "nvim"; };
       description = ''
@@ -42,22 +38,22 @@ in
         strings.  The latter is concatenated, interspersed with colon
         characters.
       '';
-      type = with types; attrsOf (oneOf [ (listOf (oneOf [ int str path ])) int str path ]);
+      type = with lib.types; attrsOf (oneOf [ (listOf (oneOf [ int str path ])) int str path ]);
       apply = let
-        toStr = v: if isPath v then "${v}" else toString v;
-      in mapAttrs (n: v: if isList v then concatMapStringsSep ":" toStr v else toStr v);
+        toStr = v: if lib.isPath v then "${v}" else toString v;
+      in lib.mapAttrs (n: v: if lib.isList v then lib.concatMapStringsSep ":" toStr v else toStr v);
     };
 
-    environment.profiles = mkOption {
+    environment.profiles = lib.mkOption {
       default = [];
       description = ''
         A list of profiles used to setup the global environment.
       '';
-      type = types.listOf types.str;
+      type = lib.types.listOf lib.types.str;
     };
 
-    environment.profileRelativeEnvVars = mkOption {
-      type = types.attrsOf (types.listOf types.str);
+    environment.profileRelativeEnvVars = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.listOf lib.types.str);
       example = { PATH = [ "/bin" ]; MANPATH = [ "/man" "/share/man" ]; };
       description = ''
         Attribute set of environment variable.  Each attribute maps to a list
@@ -68,7 +64,7 @@ in
     };
 
     # !!! isn't there a better way?
-    environment.extraInit = mkOption {
+    environment.extraInit = lib.mkOption {
       default = "";
       description = ''
         Shell script code called during global environment initialisation
@@ -76,40 +72,40 @@ in
         This code is assumed to be shell-independent, which means you should
         stick to pure sh without sh word split.
       '';
-      type = types.lines;
+      type = lib.types.lines;
     };
 
-    environment.shellInit = mkOption {
+    environment.shellInit = lib.mkOption {
       default = "";
       description = ''
         Shell script code called during shell initialisation.
         This code is assumed to be shell-independent, which means you should
         stick to pure sh without sh word split.
       '';
-      type = types.lines;
+      type = lib.types.lines;
     };
 
-    environment.loginShellInit = mkOption {
+    environment.loginShellInit = lib.mkOption {
       default = "";
       description = ''
         Shell script code called during login shell initialisation.
         This code is assumed to be shell-independent, which means you should
         stick to pure sh without sh word split.
       '';
-      type = types.lines;
+      type = lib.types.lines;
     };
 
-    environment.interactiveShellInit = mkOption {
+    environment.interactiveShellInit = lib.mkOption {
       default = "";
       description = ''
         Shell script code called during interactive shell initialisation.
         This code is assumed to be shell-independent, which means you should
         stick to pure sh without sh word split.
       '';
-      type = types.lines;
+      type = lib.types.lines;
     };
 
-    environment.shellAliases = mkOption {
+    environment.shellAliases = lib.mkOption {
       example = { l = null; ll = "ls -l"; };
       description = ''
         An attribute set that maps aliases (the top level attribute names in
@@ -117,30 +113,30 @@ in
         aliases are added to all users' shells.
         Aliases mapped to `null` are ignored.
       '';
-      type = with types; attrsOf (nullOr (either str path));
+      type = with lib.types; attrsOf (nullOr (either str path));
     };
 
-    environment.homeBinInPath = mkOption {
+    environment.homeBinInPath = lib.mkOption {
       description = ''
         Include ~/bin/ in $PATH.
       '';
       default = false;
-      type = types.bool;
+      type = lib.types.bool;
     };
 
-    environment.localBinInPath = mkOption {
+    environment.localBinInPath = lib.mkOption {
       description = ''
         Add ~/.local/bin/ to $PATH
       '';
       default = false;
-      type = types.bool;
+      type = lib.types.bool;
     };
 
-    environment.binsh = mkOption {
+    environment.binsh = lib.mkOption {
       default = "${config.system.build.binsh}/bin/sh";
-      defaultText = literalExpression ''"''${config.system.build.binsh}/bin/sh"'';
-      example = literalExpression ''"''${pkgs.dash}/bin/dash"'';
-      type = types.path;
+      defaultText = lib.literalExpression ''"''${config.system.build.binsh}/bin/sh"'';
+      example = lib.literalExpression ''"''${pkgs.dash}/bin/dash"'';
+      type = lib.types.path;
       visible = false;
       description = ''
         The shell executable that is linked system-wide to
@@ -150,15 +146,15 @@ in
       '';
     };
 
-    environment.shells = mkOption {
+    environment.shells = lib.mkOption {
       default = [];
-      example = literalExpression "[ pkgs.bashInteractive pkgs.zsh ]";
+      example = lib.literalExpression "[ pkgs.bashInteractive pkgs.zsh ]";
       description = ''
         A list of permissible login shells for user accounts.
         No need to mention `/bin/sh`
         here, it is placed into this list implicitly.
       '';
-      type = types.listOf (types.either types.shellPackage types.path);
+      type = lib.types.listOf (lib.types.either lib.types.shellPackage lib.types.path);
     };
 
   };
@@ -175,7 +171,7 @@ in
 
     environment.profileRelativeEnvVars = config.environment.profileRelativeSessionVariables;
 
-    environment.shellAliases = mapAttrs (name: mkDefault) {
+    environment.shellAliases = lib.mapAttrs (name: lib.mkDefault) {
       ls = "ls --color=tty";
       ll = "ls -l";
       l  = "ls -alh";
@@ -183,7 +179,7 @@ in
 
     environment.etc.shells.text =
       ''
-        ${concatStringsSep "\n" (map utils.toShellPath cfg.shells)}
+        ${lib.concatStringsSep "\n" (map utils.toShellPath cfg.shells)}
         /bin/sh
       '';
 
@@ -202,17 +198,17 @@ in
 
         ${cfg.extraInit}
 
-        ${optionalString cfg.homeBinInPath ''
+        ${lib.optionalString cfg.homeBinInPath ''
           # ~/bin if it exists overrides other bin directories.
           export PATH="$HOME/bin:$PATH"
         ''}
 
-        ${optionalString cfg.localBinInPath ''
+        ${lib.optionalString cfg.localBinInPath ''
           export PATH="$HOME/.local/bin:$PATH"
         ''}
       '';
 
-    system.activationScripts.binsh = stringAfter [ "stdio" ]
+    system.activationScripts.binsh = lib.stringAfter [ "stdio" ]
       ''
         # Create the required /bin/sh symlink; otherwise lots of things
         # (notably the system() function) won't work.
diff --git a/nixos/modules/config/sysctl.nix b/nixos/modules/config/sysctl.nix
index 34028ce82dd7..1495215db902 100644
--- a/nixos/modules/config/sysctl.nix
+++ b/nixos/modules/config/sysctl.nix
@@ -1,17 +1,14 @@
 { config, lib, ... }:
-
-with lib;
-
 let
 
-  sysctlOption = mkOptionType {
+  sysctlOption = lib.mkOptionType {
     name = "sysctl option value";
     check = val:
       let
-        checkType = x: isBool x || isString x || isInt x || x == null;
+        checkType = x: lib.isBool x || lib.isString x || lib.isInt x || x == null;
       in
         checkType val || (val._type or "" == "override" && checkType val.content);
-    merge = loc: defs: mergeOneOption loc (filterOverrides defs);
+    merge = loc: defs: lib.mergeOneOption loc (lib.filterOverrides defs);
   };
 
 in
@@ -20,33 +17,33 @@ in
 
   options = {
 
-    boot.kernel.sysctl = mkOption {
+    boot.kernel.sysctl = lib.mkOption {
       type = let
-        highestValueType = types.ints.unsigned // {
+        highestValueType = lib.types.ints.unsigned // {
           merge = loc: defs:
-            foldl
+            lib.foldl
               (a: b: if b.value == null then null else lib.max a b.value)
               0
-              (filterOverrides defs);
+              (lib.filterOverrides defs);
         };
-      in types.submodule {
-        freeformType = types.attrsOf sysctlOption;
+      in lib.types.submodule {
+        freeformType = lib.types.attrsOf sysctlOption;
         options = {
-          "net.core.rmem_max" = mkOption {
-            type = types.nullOr highestValueType;
+          "net.core.rmem_max" = lib.mkOption {
+            type = lib.types.nullOr highestValueType;
             default = null;
             description = "The maximum receive socket buffer size in bytes. In case of conflicting values, the highest will be used.";
           };
 
-          "net.core.wmem_max" = mkOption {
-            type = types.nullOr highestValueType;
+          "net.core.wmem_max" = lib.mkOption {
+            type = lib.types.nullOr highestValueType;
             default = null;
             description = "The maximum send socket buffer size in bytes. In case of conflicting values, the highest will be used.";
           };
         };
       };
       default = {};
-      example = literalExpression ''
+      example = lib.literalExpression ''
         { "net.ipv4.tcp_syncookies" = false; "vm.swappiness" = 60; }
       '';
       description = ''
@@ -66,8 +63,8 @@ in
   config = {
 
     environment.etc."sysctl.d/60-nixos.conf".text =
-      concatStrings (mapAttrsToList (n: v:
-        optionalString (v != null) "${n}=${if v == false then "0" else toString v}\n"
+      lib.concatStrings (lib.mapAttrsToList (n: v:
+        lib.optionalString (v != null) "${n}=${if v == false then "0" else toString v}\n"
       ) config.boot.kernel.sysctl);
 
     systemd.services.systemd-sysctl =
@@ -77,10 +74,10 @@ in
 
     # Hide kernel pointers (e.g. in /proc/modules) for unprivileged
     # users as these make it easier to exploit kernel vulnerabilities.
-    boot.kernel.sysctl."kernel.kptr_restrict" = mkDefault 1;
+    boot.kernel.sysctl."kernel.kptr_restrict" = lib.mkDefault 1;
 
     # Improve compatibility with applications that allocate
     # a lot of memory, like modern games
-    boot.kernel.sysctl."vm.max_map_count" = mkDefault 1048576;
+    boot.kernel.sysctl."vm.max_map_count" = lib.mkDefault 1048576;
   };
 }
diff --git a/nixos/modules/hardware/cpu/amd-microcode.nix b/nixos/modules/hardware/cpu/amd-microcode.nix
index 621c7066bfe1..9633478592e8 100644
--- a/nixos/modules/hardware/cpu/amd-microcode.nix
+++ b/nixos/modules/hardware/cpu/amd-microcode.nix
@@ -1,16 +1,11 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 {
-
   ###### interface
-
   options = {
 
-    hardware.cpu.amd.updateMicrocode = mkOption {
+    hardware.cpu.amd.updateMicrocode = lib.mkOption {
       default = false;
-      type = types.bool;
+      type = lib.types.bool;
       description = ''
         Update the CPU microcode for AMD processors.
       '';
@@ -18,12 +13,10 @@ with lib;
 
   };
 
-
   ###### implementation
-
-  config = mkIf config.hardware.cpu.amd.updateMicrocode {
+  config = lib.mkIf config.hardware.cpu.amd.updateMicrocode {
     # Microcode updates must be the first item prepended in the initrd
-    boot.initrd.prepend = mkOrder 1 [ "${pkgs.microcodeAmd}/amd-ucode.img" ];
+    boot.initrd.prepend = lib.mkOrder 1 [ "${pkgs.microcodeAmd}/amd-ucode.img" ];
   };
 
 }
diff --git a/nixos/modules/hardware/cpu/amd-sev.nix b/nixos/modules/hardware/cpu/amd-sev.nix
index d6225bc35a1e..8dae958bf344 100644
--- a/nixos/modules/hardware/cpu/amd-sev.nix
+++ b/nixos/modules/hardware/cpu/amd-sev.nix
@@ -1,24 +1,23 @@
 { config, options, lib, ... }:
-with lib;
 let
   cfgSev = config.hardware.cpu.amd.sev;
   cfgSevGuest = config.hardware.cpu.amd.sevGuest;
 
   optionsFor = device: group: {
-    enable = mkEnableOption "access to the AMD ${device} device";
-    user = mkOption {
+    enable = lib.mkEnableOption "access to the AMD ${device} device";
+    user = lib.mkOption {
       description = "Owner to assign to the ${device} device.";
-      type = types.str;
+      type = lib.types.str;
       default = "root";
     };
-    group = mkOption {
+    group = lib.mkOption {
       description = "Group to assign to the ${device} device.";
-      type = types.str;
+      type = lib.types.str;
       default = group;
     };
-    mode = mkOption {
+    mode = lib.mkOption {
       description = "Mode to set for the ${device} device.";
-      type = types.str;
+      type = lib.types.str;
       default = "0660";
     };
   };
@@ -28,16 +27,16 @@ with lib; {
 
   options.hardware.cpu.amd.sevGuest = optionsFor "SEV guest" "sev-guest";
 
-  config = mkMerge [
+  config = lib.mkMerge [
     # /dev/sev
-    (mkIf cfgSev.enable {
+    (lib.mkIf cfgSev.enable {
       assertions = [
         {
-          assertion = hasAttr cfgSev.user config.users.users;
+          assertion = lib.hasAttr cfgSev.user config.users.users;
           message = "Given user does not exist";
         }
         {
-          assertion = (cfgSev.group == options.hardware.cpu.amd.sev.group.default) || (hasAttr cfgSev.group config.users.groups);
+          assertion = (cfgSev.group == options.hardware.cpu.amd.sev.group.default) || (lib.hasAttr cfgSev.group config.users.groups);
           message = "Given group does not exist";
         }
       ];
@@ -46,7 +45,7 @@ with lib; {
         options kvm_amd sev=1
       '';
 
-      users.groups = optionalAttrs (cfgSev.group == options.hardware.cpu.amd.sev.group.default) {
+      users.groups = lib.optionalAttrs (cfgSev.group == options.hardware.cpu.amd.sev.group.default) {
         "${cfgSev.group}" = { };
       };
 
@@ -56,19 +55,19 @@ with lib; {
     })
 
     # /dev/sev-guest
-    (mkIf cfgSevGuest.enable {
+    (lib.mkIf cfgSevGuest.enable {
       assertions = [
         {
-          assertion = hasAttr cfgSevGuest.user config.users.users;
+          assertion = lib.hasAttr cfgSevGuest.user config.users.users;
           message = "Given user does not exist";
         }
         {
-          assertion = (cfgSevGuest.group == options.hardware.cpu.amd.sevGuest.group.default) || (hasAttr cfgSevGuest.group config.users.groups);
+          assertion = (cfgSevGuest.group == options.hardware.cpu.amd.sevGuest.group.default) || (lib.hasAttr cfgSevGuest.group config.users.groups);
           message = "Given group does not exist";
         }
       ];
 
-      users.groups = optionalAttrs (cfgSevGuest.group == options.hardware.cpu.amd.sevGuest.group.default) {
+      users.groups = lib.optionalAttrs (cfgSevGuest.group == options.hardware.cpu.amd.sevGuest.group.default) {
         "${cfgSevGuest.group}" = { };
       };
 
diff --git a/nixos/modules/hardware/cpu/intel-microcode.nix b/nixos/modules/hardware/cpu/intel-microcode.nix
index acce565fd808..20e8518bf410 100644
--- a/nixos/modules/hardware/cpu/intel-microcode.nix
+++ b/nixos/modules/hardware/cpu/intel-microcode.nix
@@ -1,16 +1,11 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 {
-
   ###### interface
-
   options = {
 
-    hardware.cpu.intel.updateMicrocode = mkOption {
+    hardware.cpu.intel.updateMicrocode = lib.mkOption {
       default = false;
-      type = types.bool;
+      type = lib.types.bool;
       description = ''
         Update the CPU microcode for Intel processors.
       '';
@@ -18,12 +13,10 @@ with lib;
 
   };
 
-
   ###### implementation
-
-  config = mkIf config.hardware.cpu.intel.updateMicrocode {
+  config = lib.mkIf config.hardware.cpu.intel.updateMicrocode {
     # Microcode updates must be the first item prepended in the initrd
-    boot.initrd.prepend = mkOrder 1 [ "${pkgs.microcodeIntel}/intel-ucode.img" ];
+    boot.initrd.prepend = lib.mkOrder 1 [ "${pkgs.microcodeIntel}/intel-ucode.img" ];
   };
 
 }
diff --git a/nixos/modules/hardware/cpu/intel-sgx.nix b/nixos/modules/hardware/cpu/intel-sgx.nix
index c66b43a2ec27..79d0bc1599ee 100644
--- a/nixos/modules/hardware/cpu/intel-sgx.nix
+++ b/nixos/modules/hardware/cpu/intel-sgx.nix
@@ -1,11 +1,10 @@
 { config, lib, ... }:
-with lib;
 let
   cfg = config.hardware.cpu.intel.sgx;
   defaultPrvGroup = "sgx_prv";
 in
 {
-  options.hardware.cpu.intel.sgx.enableDcapCompat = mkOption {
+  options.hardware.cpu.intel.sgx.enableDcapCompat = lib.mkOption {
     description = ''
       Whether to enable backward compatibility for SGX software build for the
       out-of-tree Intel SGX DCAP driver.
@@ -15,43 +14,43 @@ in
       `/dev/sgx/enclave`  and `/dev/sgx/provision`,
       respectively.
     '';
-    type = types.bool;
+    type = lib.types.bool;
     default = true;
   };
 
   options.hardware.cpu.intel.sgx.provision = {
-    enable = mkEnableOption "access to the Intel SGX provisioning device";
-    user = mkOption {
+    enable = lib.mkEnableOption "access to the Intel SGX provisioning device";
+    user = lib.mkOption {
       description = "Owner to assign to the SGX provisioning device.";
-      type = types.str;
+      type = lib.types.str;
       default = "root";
     };
-    group = mkOption {
+    group = lib.mkOption {
       description = "Group to assign to the SGX provisioning device.";
-      type = types.str;
+      type = lib.types.str;
       default = defaultPrvGroup;
     };
-    mode = mkOption {
+    mode = lib.mkOption {
       description = "Mode to set for the SGX provisioning device.";
-      type = types.str;
+      type = lib.types.str;
       default = "0660";
     };
   };
 
-  config = mkMerge [
-    (mkIf cfg.provision.enable {
+  config = lib.mkMerge [
+    (lib.mkIf cfg.provision.enable {
       assertions = [
         {
-          assertion = hasAttr cfg.provision.user config.users.users;
+          assertion = lib.hasAttr cfg.provision.user config.users.users;
           message = "Given user does not exist";
         }
         {
-          assertion = (cfg.provision.group == defaultPrvGroup) || (hasAttr cfg.provision.group config.users.groups);
+          assertion = (cfg.provision.group == defaultPrvGroup) || (lib.hasAttr cfg.provision.group config.users.groups);
           message = "Given group does not exist";
         }
       ];
 
-      users.groups = optionalAttrs (cfg.provision.group == defaultPrvGroup) {
+      users.groups = lib.optionalAttrs (cfg.provision.group == defaultPrvGroup) {
         "${cfg.provision.group}" = { };
       };
 
@@ -59,7 +58,7 @@ in
         SUBSYSTEM=="misc", KERNEL=="sgx_provision", OWNER="${user}", GROUP="${group}", MODE="${mode}"
       '';
     })
-    (mkIf cfg.enableDcapCompat {
+    (lib.mkIf cfg.enableDcapCompat {
       services.udev.extraRules = ''
         SUBSYSTEM=="misc", KERNEL=="sgx_enclave",   SYMLINK+="sgx/enclave"
         SUBSYSTEM=="misc", KERNEL=="sgx_provision", SYMLINK+="sgx/provision"
diff --git a/nixos/modules/hardware/digitalbitbox.nix b/nixos/modules/hardware/digitalbitbox.nix
index 7df15288ecfe..c5c8204e321a 100644
--- a/nixos/modules/hardware/digitalbitbox.nix
+++ b/nixos/modules/hardware/digitalbitbox.nix
@@ -1,29 +1,26 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.hardware.digitalbitbox;
 in
 
 {
   options.hardware.digitalbitbox = {
-    enable = mkOption {
-      type = types.bool;
+    enable = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''
         Enables udev rules for Digital Bitbox devices.
       '';
     };
 
-    package = mkPackageOption pkgs "digitalbitbox" {
+    package = lib.mkPackageOption pkgs "digitalbitbox" {
       extraDescription = ''
         This can be used to install a package with udev rules that differ from the defaults.
       '';
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     services.udev.packages = [ cfg.package ];
   };
 }
diff --git a/nixos/modules/hardware/ksm.nix b/nixos/modules/hardware/ksm.nix
index e0b5949ffb21..41d61e04697c 100644
--- a/nixos/modules/hardware/ksm.nix
+++ b/nixos/modules/hardware/ksm.nix
@@ -1,19 +1,16 @@
 { config, lib, ... }:
-
-with lib;
-
 let
   cfg = config.hardware.ksm;
 
 in {
   imports = [
-    (mkRenamedOptionModule [ "hardware" "enableKSM" ] [ "hardware" "ksm" "enable" ])
+    (lib.mkRenamedOptionModule [ "hardware" "enableKSM" ] [ "hardware" "ksm" "enable" ])
   ];
 
   options.hardware.ksm = {
-    enable = mkEnableOption "Linux kernel Same-Page Merging";
-    sleep = mkOption {
-      type = types.nullOr types.int;
+    enable = lib.mkEnableOption "Linux kernel Same-Page Merging";
+    sleep = lib.mkOption {
+      type = lib.types.nullOr lib.types.int;
       default = null;
       description = ''
         How many milliseconds ksmd should sleep between scans.
@@ -22,14 +19,14 @@ in {
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.enable-ksm = {
       description = "Enable Kernel Same-Page Merging";
       wantedBy = [ "multi-user.target" ];
       script =
         ''
           echo 1 > /sys/kernel/mm/ksm/run
-        '' + optionalString (cfg.sleep != null)
+        '' + lib.optionalString (cfg.sleep != null)
         ''
           echo ${toString cfg.sleep} > /sys/kernel/mm/ksm/sleep_millisecs
         '';
diff --git a/nixos/modules/hardware/ledger.nix b/nixos/modules/hardware/ledger.nix
index 41abe74315a0..8510c97c5e38 100644
--- a/nixos/modules/hardware/ledger.nix
+++ b/nixos/modules/hardware/ledger.nix
@@ -1,14 +1,11 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.hardware.ledger;
 
 in {
-  options.hardware.ledger.enable = mkEnableOption "udev rules for Ledger devices";
+  options.hardware.ledger.enable = lib.mkEnableOption "udev rules for Ledger devices";
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     services.udev.packages = [ pkgs.ledger-udev-rules ];
   };
 }
diff --git a/nixos/modules/hardware/logitech.nix b/nixos/modules/hardware/logitech.nix
index 94a1287e051c..aeb97a2f9d94 100644
--- a/nixos/modules/hardware/logitech.nix
+++ b/nixos/modules/hardware/logitech.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.hardware.logitech;
 
@@ -12,25 +9,25 @@ let
 in
 {
   imports = [
-    (mkRenamedOptionModule [ "hardware" "logitech" "enable" ] [ "hardware" "logitech" "wireless" "enable" ])
-    (mkRenamedOptionModule [ "hardware" "logitech" "enableGraphical" ] [ "hardware" "logitech" "wireless" "enableGraphical" ])
+    (lib.mkRenamedOptionModule [ "hardware" "logitech" "enable" ] [ "hardware" "logitech" "wireless" "enable" ])
+    (lib.mkRenamedOptionModule [ "hardware" "logitech" "enableGraphical" ] [ "hardware" "logitech" "wireless" "enableGraphical" ])
   ];
 
   options.hardware.logitech = {
 
     lcd = {
-      enable = mkEnableOption "support for Logitech LCD Devices";
+      enable = lib.mkEnableOption "support for Logitech LCD Devices";
 
-      startWhenNeeded = mkOption {
-        type = types.bool;
+      startWhenNeeded = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = ''
           Only run the service when an actual supported device is plugged.
         '';
       };
 
-      devices = mkOption {
-        type = types.listOf types.str;
+      devices = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [ "0a07" "c222" "c225" "c227" "c251" ];
         description = ''
           List of USB device ids supported by g15daemon.
@@ -41,10 +38,10 @@ in
     };
 
     wireless = {
-      enable = mkEnableOption "support for Logitech Wireless Devices";
+      enable = lib.mkEnableOption "support for Logitech Wireless Devices";
 
-      enableGraphical = mkOption {
-        type = types.bool;
+      enableGraphical = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Enable graphical support applications.";
       };
diff --git a/nixos/modules/hardware/mcelog.nix b/nixos/modules/hardware/mcelog.nix
index 13ad238870c2..38629c4ba945 100644
--- a/nixos/modules/hardware/mcelog.nix
+++ b/nixos/modules/hardware/mcelog.nix
@@ -1,14 +1,11 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 {
-  meta.maintainers = with maintainers; [ grahamc ];
+  meta.maintainers = with lib.maintainers; [ grahamc ];
   options = {
 
     hardware.mcelog = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Enable the Machine Check Exception logger.
@@ -18,7 +15,7 @@ with lib;
 
   };
 
-  config = mkIf config.hardware.mcelog.enable {
+  config = lib.mkIf config.hardware.mcelog.enable {
     systemd = {
       packages = [ pkgs.mcelog ];
 
diff --git a/nixos/modules/hardware/network/ath-user-regd.nix b/nixos/modules/hardware/network/ath-user-regd.nix
index b5ade5ed5010..4cd3fb69604b 100644
--- a/nixos/modules/hardware/network/ath-user-regd.nix
+++ b/nixos/modules/hardware/network/ath-user-regd.nix
@@ -1,6 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
 let
   kernelVersion = config.boot.kernelPackages.kernel.version;
   linuxKernelMinVersion = "5.8";
@@ -11,9 +9,9 @@ let
   };
 in
 {
-  options.networking.wireless.athUserRegulatoryDomain = mkOption {
+  options.networking.wireless.athUserRegulatoryDomain = lib.mkOption {
     default = false;
-    type = types.bool;
+    type = lib.types.bool;
     description = ''
       If enabled, sets the ATH_USER_REGD kernel config switch to true to
       disable the enforcement of EEPROM regulatory restrictions for ath
@@ -21,9 +19,9 @@ in
     '';
   };
 
-  config = mkIf config.networking.wireless.athUserRegulatoryDomain {
-    assertions = singleton {
-      assertion = lessThan 0 (builtins.compareVersions kernelVersion linuxKernelMinVersion);
+  config = lib.mkIf config.networking.wireless.athUserRegulatoryDomain {
+    assertions = lib.singleton {
+      assertion = lib.lessThan 0 (builtins.compareVersions kernelVersion linuxKernelMinVersion);
       message = "ATH_USER_REGD patch for kernels older than ${linuxKernelMinVersion} not ported yet!";
     };
     boot.kernelPatches = [ kernelPatch ];
diff --git a/nixos/modules/hardware/network/b43.nix b/nixos/modules/hardware/network/b43.nix
index eb03bf223ccf..fc4020c09a5d 100644
--- a/nixos/modules/hardware/network/b43.nix
+++ b/nixos/modules/hardware/network/b43.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let kernelVersion = config.boot.kernelPackages.kernel.version; in
 
 {
@@ -10,9 +7,9 @@ let kernelVersion = config.boot.kernelPackages.kernel.version; in
 
   options = {
 
-    networking.enableB43Firmware = mkOption {
+    networking.enableB43Firmware = lib.mkOption {
       default = false;
-      type = types.bool;
+      type = lib.types.bool;
       description = ''
         Turn on this option if you want firmware for the NICs supported by the b43 module.
       '';
@@ -23,7 +20,7 @@ let kernelVersion = config.boot.kernelPackages.kernel.version; in
 
   ###### implementation
 
-  config = mkIf config.networking.enableB43Firmware {
+  config = lib.mkIf config.networking.enableB43Firmware {
     hardware.firmware = [ pkgs.b43Firmware_5_1_138 ];
   };
 
diff --git a/nixos/modules/hardware/new-lg4ff.nix b/nixos/modules/hardware/new-lg4ff.nix
index 3c7f66f8d89b..ac5d3e77df0b 100644
--- a/nixos/modules/hardware/new-lg4ff.nix
+++ b/nixos/modules/hardware/new-lg4ff.nix
@@ -1,14 +1,11 @@
 { pkgs, lib, config, ... }:
-
-with lib;
-
 let
   cfg = config.hardware.new-lg4ff;
   kernelPackages = config.boot.kernelPackages;
 in {
   options.hardware.new-lg4ff = {
-    enable = mkOption {
-      type = types.bool;
+    enable = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''
         Enables improved Linux module drivers for Logitech driving wheels.
diff --git a/nixos/modules/hardware/nitrokey.nix b/nixos/modules/hardware/nitrokey.nix
index 9bc8da41a4a7..08d6b16790f7 100644
--- a/nixos/modules/hardware/nitrokey.nix
+++ b/nixos/modules/hardware/nitrokey.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   cfg = config.hardware.nitrokey;
@@ -10,8 +7,8 @@ in
 
 {
   options.hardware.nitrokey = {
-    enable = mkOption {
-      type = types.bool;
+    enable = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''
         Enables udev rules for Nitrokey devices. By default grants access
@@ -21,7 +18,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     services.udev.packages = [ pkgs.libnitrokey ];
   };
 }
diff --git a/nixos/modules/hardware/onlykey/default.nix b/nixos/modules/hardware/onlykey/default.nix
index 07358c8a8782..9bf167ba5341 100644
--- a/nixos/modules/hardware/onlykey/default.nix
+++ b/nixos/modules/hardware/onlykey/default.nix
@@ -1,7 +1,4 @@
 { config, lib, ... }:
-
-with lib;
-
 {
 
   ####### interface
@@ -9,8 +6,8 @@ with lib;
   options = {
 
     hardware.onlykey = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Enable OnlyKey device (https://crp.to/p/) support.
@@ -25,7 +22,7 @@ with lib;
 
   ####### implementation
 
-  config = mkIf config.hardware.onlykey.enable {
+  config = lib.mkIf config.hardware.onlykey.enable {
     services.udev.extraRules = builtins.readFile ./onlykey.udev;
   };
 
diff --git a/nixos/modules/hardware/openrazer.nix b/nixos/modules/hardware/openrazer.nix
index 6f61254a60c1..c4a60c619f17 100644
--- a/nixos/modules/hardware/openrazer.nix
+++ b/nixos/modules/hardware/openrazer.nix
@@ -1,7 +1,4 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   cfg = config.hardware.openrazer;
   kernelPackages = config.boot.kernelPackages;
@@ -51,20 +48,20 @@ in
 {
   options = {
     hardware.openrazer = {
-      enable = mkEnableOption ''
+      enable = lib.mkEnableOption ''
         OpenRazer drivers and userspace daemon
       '';
 
-      verboseLogging = mkOption {
-        type = types.bool;
+      verboseLogging = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to enable verbose logging. Logs debug messages.
         '';
       };
 
-      syncEffectsEnabled = mkOption {
-        type = types.bool;
+      syncEffectsEnabled = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = ''
           Set the sync effects flag to true so any assignment of
@@ -72,30 +69,30 @@ in
         '';
       };
 
-      devicesOffOnScreensaver = mkOption {
-        type = types.bool;
+      devicesOffOnScreensaver = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = ''
           Turn off the devices when the systems screensaver kicks in.
         '';
       };
 
-      batteryNotifier = mkOption {
+      batteryNotifier = lib.mkOption {
         description = ''
           Settings for device battery notifications.
         '';
         default = {};
-        type = types.submodule {
+        type = lib.types.submodule {
           options = {
-            enable = mkOption {
-              type = types.bool;
+            enable = lib.mkOption {
+              type = lib.types.bool;
               default = true;
               description = ''
                 Mouse battery notifier.
               '';
             };
-            frequency = mkOption {
-              type = types.int;
+            frequency = lib.mkOption {
+              type = lib.types.int;
               default = 600;
               description = ''
                 How often battery notifications should be shown (in seconds).
@@ -103,8 +100,8 @@ in
               '';
             };
 
-            percentage = mkOption {
-              type = types.int;
+            percentage = lib.mkOption {
+              type = lib.types.int;
               default = 33;
               description = ''
                 At what battery percentage the device should reach before
@@ -115,8 +112,8 @@ in
         };
       };
 
-      keyStatistics = mkOption {
-        type = types.bool;
+      keyStatistics = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Collects number of keypresses per hour per key used to
@@ -124,8 +121,8 @@ in
         '';
       };
 
-      users = mkOption {
-        type = with types; listOf str;
+      users = lib.mkOption {
+        type = with lib.types; listOf str;
         default = [];
         description = ''
           Usernames to be added to the "openrazer" group, so that they
@@ -136,10 +133,10 @@ in
   };
 
   imports = [
-    (mkRenamedOptionModule [ "hardware" "openrazer" "mouseBatteryNotifier" ] [ "hardware" "openrazer" "batteryNotifier" "enable" ])
+    (lib.mkRenamedOptionModule [ "hardware" "openrazer" "mouseBatteryNotifier" ] [ "hardware" "openrazer" "batteryNotifier" "enable" ])
   ];
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     boot.extraModulePackages = [ kernelPackages.openrazer ];
     boot.kernelModules = drivers;
 
diff --git a/nixos/modules/hardware/opentabletdriver.nix b/nixos/modules/hardware/opentabletdriver.nix
index d8958ed4f68d..993d51d87986 100644
--- a/nixos/modules/hardware/opentabletdriver.nix
+++ b/nixos/modules/hardware/opentabletdriver.nix
@@ -1,6 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
 let
   cfg = config.hardware.opentabletdriver;
 in
@@ -9,29 +7,29 @@ in
 
   options = {
     hardware.opentabletdriver = {
-      enable = mkOption {
+      enable = lib.mkOption {
         default = false;
-        type = types.bool;
+        type = lib.types.bool;
         description = ''
           Enable OpenTabletDriver udev rules, user service and blacklist kernel
           modules known to conflict with OpenTabletDriver.
         '';
       };
 
-      blacklistedKernelModules = mkOption {
-        type = types.listOf types.str;
+      blacklistedKernelModules = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [ "hid-uclogic" "wacom" ];
         description = ''
           Blacklist of kernel modules known to conflict with OpenTabletDriver.
         '';
       };
 
-      package = mkPackageOption pkgs "opentabletdriver" { };
+      package = lib.mkPackageOption pkgs "opentabletdriver" { };
 
       daemon = {
-        enable = mkOption {
+        enable = lib.mkOption {
           default = true;
-          type = types.bool;
+          type = lib.types.bool;
           description = ''
             Whether to start OpenTabletDriver daemon as a systemd user service.
           '';
@@ -40,14 +38,14 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     environment.systemPackages = [ cfg.package ];
 
     services.udev.packages = [ cfg.package ];
 
     boot.blacklistedKernelModules = cfg.blacklistedKernelModules;
 
-    systemd.user.services.opentabletdriver = with pkgs; mkIf cfg.daemon.enable {
+    systemd.user.services.opentabletdriver = with pkgs; lib.mkIf cfg.daemon.enable {
       description = "Open source, cross-platform, user-mode tablet driver";
       wantedBy = [ "graphical-session.target" ];
       partOf = [ "graphical-session.target" ];
diff --git a/nixos/modules/hardware/pcmcia.nix b/nixos/modules/hardware/pcmcia.nix
index aef35a28e54d..557925018d68 100644
--- a/nixos/modules/hardware/pcmcia.nix
+++ b/nixos/modules/hardware/pcmcia.nix
@@ -1,53 +1,45 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
-
   pcmciaUtils = pkgs.pcmciaUtils.passthru.function {
     inherit (config.hardware.pcmcia) firmware config;
   };
-
 in
 
-
 {
   ###### interface
-
   options = {
 
     hardware.pcmcia = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Enable this option to support PCMCIA card.
         '';
       };
 
-      firmware = mkOption {
-        type = types.listOf types.path;
+      firmware = lib.mkOption {
+        type = lib.types.listOf lib.types.path;
         default = [];
         description = ''
           List of firmware used to handle specific PCMCIA card.
         '';
       };
 
-      config = mkOption {
+      config = lib.mkOption {
         default = null;
-        type = types.nullOr types.path;
+        type = lib.types.nullOr lib.types.path;
         description = ''
           Path to the configuration file which maps the memory, IRQs
           and ports used by the PCMCIA hardware.
         '';
       };
     };
-
   };
 
   ###### implementation
 
-  config = mkIf config.hardware.pcmcia.enable {
+  config = lib.mkIf config.hardware.pcmcia.enable {
 
     boot.kernelModules = [ "pcmcia" ];
 
diff --git a/nixos/modules/hardware/printers.nix b/nixos/modules/hardware/printers.nix
index ace900d88586..a40822df11f5 100644
--- a/nixos/modules/hardware/printers.nix
+++ b/nixos/modules/hardware/printers.nix
@@ -1,19 +1,18 @@
 { config, lib, pkgs, ... }:
-with lib;
 let
   cfg = config.hardware.printers;
 
   ensurePrinter = p: let
-    args = cli.toGNUCommandLineShell {} ({
+    args = lib.cli.toGNUCommandLineShell {} ({
       p = p.name;
       v = p.deviceUri;
       m = p.model;
-    } // optionalAttrs (p.location != null) {
+    } // lib.optionalAttrs (p.location != null) {
       L = p.location;
-    } // optionalAttrs (p.description != null) {
+    } // lib.optionalAttrs (p.description != null) {
       D = p.description;
-    } // optionalAttrs (p.ppdOptions != {}) {
-      o = mapAttrsToList (name: value: "${name}=${value}") p.ppdOptions;
+    } // lib.optionalAttrs (p.ppdOptions != {}) {
+      o = lib.mapAttrsToList (name: value: "${name}=${value}") p.ppdOptions;
     });
   in ''
     ${pkgs.cups}/bin/lpadmin ${args} -E
@@ -24,22 +23,22 @@ let
   '';
 
   # "graph but not # or /" can't be implemented as regex alone due to missing lookahead support
-  noInvalidChars = str: all (c: c != "#" && c != "/") (stringToCharacters str);
-  printerName = (types.addCheck (types.strMatching "[[:graph:]]+") noInvalidChars)
+  noInvalidChars = str: lib.all (c: c != "#" && c != "/") (lib.stringToCharacters str);
+  printerName = (lib.types.addCheck (lib.types.strMatching "[[:graph:]]+") noInvalidChars)
     // { description = "printable string without spaces, # and /"; };
 
 
 in {
   options = {
     hardware.printers = {
-      ensureDefaultPrinter = mkOption {
-        type = types.nullOr printerName;
+      ensureDefaultPrinter = lib.mkOption {
+        type = lib.types.nullOr printerName;
         default = null;
         description = ''
           Ensures the named printer is the default CUPS printer / printer queue.
         '';
       };
-      ensurePrinters = mkOption {
+      ensurePrinters = lib.mkOption {
         description = ''
           Will regularly ensure that the given CUPS printers are configured as declared here.
           If a printer's options are manually changed afterwards, they will be overwritten eventually.
@@ -49,9 +48,9 @@ in {
           Printers not listed here can still be manually configured.
         '';
         default = [];
-        type = types.listOf (types.submodule {
+        type = lib.types.listOf (lib.types.submodule {
           options = {
-            name = mkOption {
+            name = lib.mkOption {
               type = printerName;
               example = "BrotherHL_Workroom";
               description = ''
@@ -59,25 +58,25 @@ in {
                 May contain any printable characters except "/", "#", and space.
               '';
             };
-            location = mkOption {
-              type = types.nullOr types.str;
+            location = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
               default = null;
               example = "Workroom";
               description = ''
                 Optional human-readable location.
               '';
             };
-            description = mkOption {
-              type = types.nullOr types.str;
+            description = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
               default = null;
               example = "Brother HL-5140";
               description = ''
                 Optional human-readable description.
               '';
             };
-            deviceUri = mkOption {
-              type = types.str;
-              example = literalExpression ''
+            deviceUri = lib.mkOption {
+              type = lib.types.str;
+              example = lib.literalExpression ''
                 "ipp://printserver.local/printers/BrotherHL_Workroom"
                 "usb://HP/DESKJET%20940C?serial=CN16E6C364BH"
               '';
@@ -86,9 +85,9 @@ in {
                 {command}`lpinfo -v` shows a list of supported device URIs and schemes.
               '';
             };
-            model = mkOption {
-              type = types.str;
-              example = literalExpression ''
+            model = lib.mkOption {
+              type = lib.types.str;
+              example = lib.literalExpression ''
                 "gutenprint.''${lib.versions.majorMinor (lib.getVersion pkgs.gutenprint)}://brother-hl-5140/expert"
               '';
               description = ''
@@ -96,8 +95,8 @@ in {
                 {command}`lpinfo -m` shows a list of supported models.
               '';
             };
-            ppdOptions = mkOption {
-              type = types.attrsOf types.str;
+            ppdOptions = lib.mkOption {
+              type = lib.types.attrsOf lib.types.str;
               example = {
                 PageSize = "A4";
                 Duplex = "DuplexNoTumble";
@@ -114,7 +113,7 @@ in {
     };
   };
 
-  config = mkIf (cfg.ensurePrinters != [] && config.services.printing.enable) {
+  config = lib.mkIf (cfg.ensurePrinters != [] && config.services.printing.enable) {
     systemd.services.ensure-printers = {
       description = "Ensure NixOS-configured CUPS printers";
       wantedBy = [ "multi-user.target" ];
@@ -126,13 +125,13 @@ in {
         RemainAfterExit = true;
       };
 
-      script = concatStringsSep "\n" [
-        (concatMapStrings ensurePrinter cfg.ensurePrinters)
-        (optionalString (cfg.ensureDefaultPrinter != null)
+      script = lib.concatStringsSep "\n" [
+        (lib.concatMapStrings ensurePrinter cfg.ensurePrinters)
+        (lib.optionalString (cfg.ensureDefaultPrinter != null)
           (ensureDefaultPrinter cfg.ensureDefaultPrinter))
         # Note: if cupsd is "stateless" the service can't be stopped,
         # otherwise the configuration will be wiped on the next start.
-        (optionalString (with config.services.printing; startWhenNeeded && !stateless)
+        (lib.optionalString (with config.services.printing; startWhenNeeded && !stateless)
           "systemctl stop cups.service")
       ];
     };
diff --git a/nixos/modules/hardware/raid/hpsa.nix b/nixos/modules/hardware/raid/hpsa.nix
index 873a2db38091..2ec2398760b6 100644
--- a/nixos/modules/hardware/raid/hpsa.nix
+++ b/nixos/modules/hardware/raid/hpsa.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   hpssacli = pkgs.stdenv.mkDerivation rec {
     pname = "hpssacli";
@@ -48,13 +45,13 @@ in {
 
   options = {
     hardware.raid.HPSmartArray = {
-      enable = mkEnableOption "HP Smart Array kernel modules and CLI utility";
+      enable = lib.mkEnableOption "HP Smart Array kernel modules and CLI utility";
     };
   };
 
   ###### implementation
 
-  config = mkIf config.hardware.raid.HPSmartArray.enable {
+  config = lib.mkIf config.hardware.raid.HPSmartArray.enable {
 
     boot.initrd.kernelModules = [ "sg" ]; /* hpssacli wants it */
     boot.initrd.availableKernelModules = [ "hpsa" ];
diff --git a/nixos/modules/hardware/sensor/iio.nix b/nixos/modules/hardware/sensor/iio.nix
index 8b3ba87a7d9c..fbdc929390f2 100644
--- a/nixos/modules/hardware/sensor/iio.nix
+++ b/nixos/modules/hardware/sensor/iio.nix
@@ -1,20 +1,17 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 {
   ###### interface
 
   options = {
     hardware.sensor.iio = {
-      enable = mkOption {
+      enable = lib.mkOption {
         description = ''
           Enable this option to support IIO sensors with iio-sensor-proxy.
 
           IIO sensors are used for orientation and ambient light
           sensors on some mobile devices.
         '';
-        type = types.bool;
+        type = lib.types.bool;
         default = false;
       };
     };
@@ -22,7 +19,7 @@ with lib;
 
   ###### implementation
 
-  config = mkIf config.hardware.sensor.iio.enable {
+  config = lib.mkIf config.hardware.sensor.iio.enable {
 
     boot.initrd.availableKernelModules = [ "hid-sensor-hub" ];
 
diff --git a/nixos/modules/hardware/steam-hardware.nix b/nixos/modules/hardware/steam-hardware.nix
index 6218c9ffbb9b..aed008b588e8 100644
--- a/nixos/modules/hardware/steam-hardware.nix
+++ b/nixos/modules/hardware/steam-hardware.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   cfg = config.hardware.steam-hardware;
@@ -10,14 +7,14 @@ in
 
 {
   options.hardware.steam-hardware = {
-    enable = mkOption {
-      type = types.bool;
+    enable = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = "Enable udev rules for Steam hardware such as the Steam Controller, other supported controllers and the HTC Vive";
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     services.udev.packages = [
       pkgs.steamPackages.steam
     ];
diff --git a/nixos/modules/hardware/tuxedo-keyboard.nix b/nixos/modules/hardware/tuxedo-keyboard.nix
index f90dfc6e3134..01ec486fb88f 100644
--- a/nixos/modules/hardware/tuxedo-keyboard.nix
+++ b/nixos/modules/hardware/tuxedo-keyboard.nix
@@ -1,14 +1,11 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.hardware.tuxedo-keyboard;
   tuxedo-keyboard = config.boot.kernelPackages.tuxedo-keyboard;
 in
   {
     options.hardware.tuxedo-keyboard = {
-      enable = mkEnableOption ''
+      enable = lib.mkEnableOption ''
           the tuxedo-keyboard driver.
 
           To configure the driver, pass the options to the {option}`boot.kernelParams` configuration.
@@ -27,7 +24,7 @@ in
       '';
     };
 
-    config = mkIf cfg.enable
+    config = lib.mkIf cfg.enable
     {
       boot.kernelModules = ["tuxedo_keyboard"];
       boot.extraModulePackages = [ tuxedo-keyboard ];
diff --git a/nixos/modules/hardware/ubertooth.nix b/nixos/modules/hardware/ubertooth.nix
index f65c2da25522..98cd0a0fb047 100644
--- a/nixos/modules/hardware/ubertooth.nix
+++ b/nixos/modules/hardware/ubertooth.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.hardware.ubertooth;
 
@@ -10,17 +7,17 @@ let
   };
 in {
   options.hardware.ubertooth = {
-    enable = mkEnableOption "Ubertooth software and its udev rules";
+    enable = lib.mkEnableOption "Ubertooth software and its udev rules";
 
-    group = mkOption {
-      type = types.str;
+    group = lib.mkOption {
+      type = lib.types.str;
       default = "ubertooth";
       example = "wheel";
       description = "Group for Ubertooth's udev rules.";
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     environment.systemPackages = [ ubertoothPkg ];
 
     services.udev.packages = [ ubertoothPkg ];
diff --git a/nixos/modules/hardware/usb-modeswitch.nix b/nixos/modules/hardware/usb-modeswitch.nix
index f36d293a867f..cbce5daa840d 100644
--- a/nixos/modules/hardware/usb-modeswitch.nix
+++ b/nixos/modules/hardware/usb-modeswitch.nix
@@ -1,15 +1,12 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 {
   ###### interface
 
   options = {
 
     hardware.usb-modeswitch = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Enable this option to support certain USB WLAN and WWAN adapters.
@@ -24,10 +21,10 @@ with lib;
   ###### implementation
 
   imports = [
-    (mkRenamedOptionModule ["hardware" "usbWwan" ] ["hardware" "usb-modeswitch" ])
+    (lib.mkRenamedOptionModule ["hardware" "usbWwan" ] ["hardware" "usb-modeswitch" ])
   ];
 
-  config = mkIf config.hardware.usb-modeswitch.enable {
+  config = lib.mkIf config.hardware.usb-modeswitch.enable {
     # Attaches device specific handlers.
     services.udev.packages = with pkgs; [ usb-modeswitch-data ];
 
diff --git a/nixos/modules/hardware/usb-storage.nix b/nixos/modules/hardware/usb-storage.nix
index 6e20b93d2262..8d145ce51c00 100644
--- a/nixos/modules/hardware/usb-storage.nix
+++ b/nixos/modules/hardware/usb-storage.nix
@@ -1,9 +1,7 @@
 { config, lib, pkgs, ... }:
-with lib;
-
 {
-  options.hardware.usbStorage.manageStartStop = mkOption {
-    type = types.bool;
+  options.hardware.usbStorage.manageStartStop = lib.mkOption {
+    type = lib.types.bool;
     default = true;
     description = ''
       Enable this option to gracefully spin-down external storage during shutdown.
@@ -12,7 +10,7 @@ with lib;
     '';
   };
 
-  config = mkIf config.hardware.usbStorage.manageStartStop {
+  config = lib.mkIf config.hardware.usbStorage.manageStartStop {
     services.udev.extraRules = ''
       ACTION=="add|change", SUBSYSTEM=="scsi_disk", DRIVERS=="usb-storage", ATTR{manage_system_start_stop}="1"
     '';
diff --git a/nixos/modules/hardware/video/bumblebee.nix b/nixos/modules/hardware/video/bumblebee.nix
index b6af4f80445a..b5339f0dda53 100644
--- a/nixos/modules/hardware/video/bumblebee.nix
+++ b/nixos/modules/hardware/video/bumblebee.nix
@@ -1,6 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
 let
   cfg = config.hardware.bumblebee;
 
@@ -26,9 +24,9 @@ in
   options = {
     hardware.bumblebee = {
 
-      enable = mkOption {
+      enable = lib.mkOption {
         default = false;
-        type = types.bool;
+        type = lib.types.bool;
         description = ''
           Enable the bumblebee daemon to manage Optimus hybrid video cards.
           This should power off secondary GPU until its use is requested
@@ -36,16 +34,16 @@ in
         '';
       };
 
-      group = mkOption {
+      group = lib.mkOption {
         default = "wheel";
         example = "video";
-        type = types.str;
+        type = lib.types.str;
         description = "Group for bumblebee socket";
       };
 
-      connectDisplay = mkOption {
+      connectDisplay = lib.mkOption {
         default = false;
-        type = types.bool;
+        type = lib.types.bool;
         description = ''
           Set to true if you intend to connect your discrete card to a
           monitor. This option will set up your Nvidia card for EDID
@@ -55,17 +53,17 @@ in
         '';
       };
 
-      driver = mkOption {
+      driver = lib.mkOption {
         default = "nvidia";
-        type = types.enum [ "nvidia" "nouveau" ];
+        type = lib.types.enum [ "nvidia" "nouveau" ];
         description = ''
           Set driver used by bumblebeed. Supported are nouveau and nvidia.
         '';
       };
 
-      pmMethod = mkOption {
+      pmMethod = lib.mkOption {
         default = "auto";
-        type = types.enum [ "auto" "bbswitch" "switcheroo" "none" ];
+        type = lib.types.enum [ "auto" "bbswitch" "switcheroo" "none" ];
         description = ''
           Set preferred power management method for unused card.
         '';
@@ -74,10 +72,10 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     boot.blacklistedKernelModules = [ "nvidia-drm" "nvidia" "nouveau" ];
-    boot.kernelModules = optional useBbswitch "bbswitch";
-    boot.extraModulePackages = optional useBbswitch kernel.bbswitch ++ optional useNvidia kernel.nvidia_x11.bin;
+    boot.kernelModules = lib.optional useBbswitch "bbswitch";
+    boot.extraModulePackages = lib.optional useBbswitch kernel.bbswitch ++ lib.optional useNvidia kernel.nvidia_x11.bin;
 
     environment.systemPackages = [ bumblebee primus ];
 
diff --git a/nixos/modules/hardware/video/capture/mwprocapture.nix b/nixos/modules/hardware/video/capture/mwprocapture.nix
index c63535f0faa7..6ec23249f5c9 100644
--- a/nixos/modules/hardware/video/capture/mwprocapture.nix
+++ b/nixos/modules/hardware/video/capture/mwprocapture.nix
@@ -1,7 +1,4 @@
 { config, lib, ... }:
-
-with lib;
-
 let
 
   cfg = config.hardware.mwProCapture;
@@ -12,9 +9,9 @@ in
 
 {
 
-  options.hardware.mwProCapture.enable = mkEnableOption "the Magewell Pro Capture family kernel module";
+  options.hardware.mwProCapture.enable = lib.mkEnableOption "the Magewell Pro Capture family kernel module";
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     boot.kernelModules = [ "ProCapture" ];
 
diff --git a/nixos/modules/hardware/video/displaylink.nix b/nixos/modules/hardware/video/displaylink.nix
index ce5fbeeae536..32e5eaf2b978 100644
--- a/nixos/modules/hardware/video/displaylink.nix
+++ b/nixos/modules/hardware/video/displaylink.nix
@@ -1,10 +1,7 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
-  enabled = elem "displaylink" config.services.xserver.videoDrivers;
+  enabled = lib.elem "displaylink" config.services.xserver.videoDrivers;
 
   evdi = config.boot.kernelPackages.evdi;
 
@@ -16,7 +13,7 @@ in
 
 {
 
-  config = mkIf enabled {
+  config = lib.mkIf enabled {
 
     boot.extraModulePackages = [ evdi ];
     boot.kernelModules = [ "evdi" ];
diff --git a/nixos/modules/hardware/video/uvcvideo/default.nix b/nixos/modules/hardware/video/uvcvideo/default.nix
index 901ff938d90e..8b9f1244e5b5 100644
--- a/nixos/modules/hardware/video/uvcvideo/default.nix
+++ b/nixos/modules/hardware/video/uvcvideo/default.nix
@@ -1,8 +1,4 @@
-
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   cfg = config.services.uvcvideo;
@@ -19,8 +15,8 @@ in
   options = {
     services.uvcvideo.dynctrl = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to enable {command}`uvcvideo` dynamic controls.
@@ -31,9 +27,9 @@ in
         '';
       };
 
-      packages = mkOption {
-        type = types.listOf types.path;
-        example = literalExpression "[ pkgs.tiscamera ]";
+      packages = lib.mkOption {
+        type = lib.types.listOf lib.types.path;
+        example = lib.literalExpression "[ pkgs.tiscamera ]";
         description = ''
           List of packages containing {command}`uvcvideo` dynamic controls
           rules. All files found in
@@ -45,12 +41,12 @@ in
           the dynamic controls from specified packages to the {command}`uvcvideo`
           driver.
         '';
-        apply = map getBin;
+        apply = map lib.getBin;
       };
     };
   };
 
-  config = mkIf cfg.dynctrl.enable {
+  config = lib.mkIf cfg.dynctrl.enable {
 
     services.udev.packages = [
       (uvcdynctrl-udev-rules cfg.dynctrl.packages)
diff --git a/nixos/modules/hardware/video/webcam/facetimehd.nix b/nixos/modules/hardware/video/webcam/facetimehd.nix
index 1e6e6442c372..06391ea5425e 100644
--- a/nixos/modules/hardware/video/webcam/facetimehd.nix
+++ b/nixos/modules/hardware/video/webcam/facetimehd.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   cfg = config.hardware.facetimehd;
@@ -12,12 +9,12 @@ in
 
 {
 
-  options.hardware.facetimehd.enable = mkEnableOption "the facetimehd kernel module";
+  options.hardware.facetimehd.enable = lib.mkEnableOption "the facetimehd kernel module";
 
-  options.hardware.facetimehd.withCalibration = mkOption {
+  options.hardware.facetimehd.withCalibration = lib.mkOption {
     default = false;
     example = true;
-    type = types.bool;
+    type = lib.types.bool;
     description = ''
       Whether to include sensor calibration files for facetimehd.
       This makes colors look much better but is experimental, see
@@ -26,7 +23,7 @@ in
     '';
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     boot.kernelModules = [ "facetimehd" ];
 
@@ -35,7 +32,7 @@ in
     boot.extraModulePackages = [ kernelPackages.facetimehd ];
 
     hardware.firmware = [ pkgs.facetimehd-firmware ]
-      ++ optional cfg.withCalibration pkgs.facetimehd-calibration;
+      ++ lib.optional cfg.withCalibration pkgs.facetimehd-calibration;
 
     # unload module during suspend/hibernate as it crashes the whole system
     powerManagement.powerDownCommands = ''
diff --git a/nixos/modules/hardware/wooting.nix b/nixos/modules/hardware/wooting.nix
index 56ef77d31ef2..101bd2d32010 100644
--- a/nixos/modules/hardware/wooting.nix
+++ b/nixos/modules/hardware/wooting.nix
@@ -1,11 +1,9 @@
 { config, lib, pkgs, ... }:
-
-with lib;
 {
-  options.hardware.wooting.enable = mkEnableOption ''support for Wooting keyboards.
+  options.hardware.wooting.enable = lib.mkEnableOption ''support for Wooting keyboards.
     Note that users must be in the "input" group for udev rules to apply'';
 
-  config = mkIf config.hardware.wooting.enable {
+  config = lib.mkIf config.hardware.wooting.enable {
     environment.systemPackages = [ pkgs.wootility ];
     services.udev.packages = [ pkgs.wooting-udev-rules ];
   };
diff --git a/nixos/modules/hardware/xone.nix b/nixos/modules/hardware/xone.nix
index bb3b42399d8e..4a8e692001e4 100644
--- a/nixos/modules/hardware/xone.nix
+++ b/nixos/modules/hardware/xone.nix
@@ -1,15 +1,13 @@
 { config, lib, pkgs, ... }:
-
-with lib;
 let
   cfg = config.hardware.xone;
 in
 {
   options.hardware.xone = {
-    enable = mkEnableOption "the xone driver for Xbox One and Xbox Series X|S accessories";
+    enable = lib.mkEnableOption "the xone driver for Xbox One and Xbox Series X|S accessories";
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     boot = {
       blacklistedKernelModules = [ "xpad" "mt76x2u" ];
       extraModulePackages = with config.boot.kernelPackages; [ xone ];
@@ -18,6 +16,6 @@ in
   };
 
   meta = {
-    maintainers = with maintainers; [ rhysmdnz ];
+    maintainers = with lib.maintainers; [ rhysmdnz ];
   };
 }
diff --git a/nixos/modules/hardware/xpadneo.nix b/nixos/modules/hardware/xpadneo.nix
index 474f0f7fcf64..d42164060e83 100644
--- a/nixos/modules/hardware/xpadneo.nix
+++ b/nixos/modules/hardware/xpadneo.nix
@@ -1,20 +1,18 @@
 { config, lib, ... }:
-
-with lib;
 let
   cfg = config.hardware.xpadneo;
 in
 {
   options.hardware.xpadneo = {
-    enable = mkEnableOption "the xpadneo driver for Xbox One wireless controllers";
+    enable = lib.mkEnableOption "the xpadneo driver for Xbox One wireless controllers";
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     boot = {
       # Must disable Enhanced Retransmission Mode to support bluetooth pairing
       # https://wiki.archlinux.org/index.php/Gamepad#Connect_Xbox_Wireless_Controller_with_Bluetooth
       extraModprobeConfig =
-        mkIf
+        lib.mkIf
           (config.hardware.bluetooth.enable &&
             (lib.versionOlder config.boot.kernelPackages.kernel.version "5.12"))
           "options bluetooth disable_ertm=1";
@@ -25,6 +23,6 @@ in
   };
 
   meta = {
-    maintainers = with maintainers; [ kira-bruneau ];
+    maintainers = with lib.maintainers; [ kira-bruneau ];
   };
 }
diff --git a/nixos/modules/i18n/input-method/default.nix b/nixos/modules/i18n/input-method/default.nix
index 15125ceb4a2d..a706b045e377 100644
--- a/nixos/modules/i18n/input-method/default.nix
+++ b/nixos/modules/i18n/input-method/default.nix
@@ -1,10 +1,8 @@
 { config, pkgs, lib, ... }:
-
-with lib;
 let
   cfg = config.i18n.inputMethod;
 
-  allowedTypes = types.enum [ "ibus" "fcitx5" "nabi" "uim" "hime" "kime" ];
+  allowedTypes = lib.types.enum [ "ibus" "fcitx5" "nabi" "uim" "hime" "kime" ];
 
   gtk2_cache = pkgs.runCommand "gtk2-immodule.cache"
     { preferLocalBuild = true;
@@ -30,22 +28,22 @@ in
 {
   options.i18n = {
     inputMethod = {
-      enable = mkEnableOption "an additional input method type" // {
+      enable = lib.mkEnableOption "an additional input method type" // {
         default = cfg.enabled != null;
-        defaultText = literalMD "`true` if the deprecated option `enabled` is set, false otherwise";
+        defaultText = lib.literalMD "`true` if the deprecated option `enabled` is set, false otherwise";
       };
 
-      enabled = mkOption {
-        type    = types.nullOr allowedTypes;
+      enabled = lib.mkOption {
+        type    = lib.types.nullOr allowedTypes;
         default = null;
         example = "fcitx5";
         description = "Deprecated - use `type` and `enable = true` instead";
       };
 
-      type = mkOption {
-        type    = types.nullOr allowedTypes;
+      type = lib.mkOption {
+        type    = lib.types.nullOr allowedTypes;
         default = cfg.enabled;
-        defaultText = literalMD "The value of the deprecated option `enabled`, defaulting to null";
+        defaultText = lib.literalMD "The value of the deprecated option `enabled`, defaulting to null";
         example = "fcitx5";
         description = ''
           Select the enabled input method. Input methods is a software to input symbols that are not available on standard input devices.
@@ -63,9 +61,9 @@ in
         '';
       };
 
-      package = mkOption {
+      package = lib.mkOption {
         internal = true;
-        type     = types.nullOr types.path;
+        type     = lib.types.nullOr lib.types.path;
         default  = null;
         description = ''
           The input method method package.
@@ -74,8 +72,8 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
-    warnings = optional (cfg.enabled != null) "i18n.inputMethod.enabled will be removed in a future release. Please use .type, and .enable = true instead";
+  config = lib.mkIf cfg.enable {
+    warnings = lib.optional (cfg.enabled != null) "i18n.inputMethod.enabled will be removed in a future release. Please use .type, and .enable = true instead";
     environment.systemPackages = [ cfg.package gtk2_cache gtk3_cache ];
   };
 
diff --git a/nixos/modules/i18n/input-method/fcitx5.nix b/nixos/modules/i18n/input-method/fcitx5.nix
index 2678c4a39e4e..a29e26423e06 100644
--- a/nixos/modules/i18n/input-method/fcitx5.nix
+++ b/nixos/modules/i18n/input-method/fcitx5.nix
@@ -1,7 +1,4 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   imcfg = config.i18n.inputMethod;
   cfg = imcfg.fcitx5;
@@ -14,35 +11,35 @@ in
 {
   options = {
     i18n.inputMethod.fcitx5 = {
-      addons = mkOption {
-        type = with types; listOf package;
+      addons = lib.mkOption {
+        type = with lib.types; listOf package;
         default = [ ];
-        example = literalExpression "with pkgs; [ fcitx5-rime ]";
+        example = lib.literalExpression "with pkgs; [ fcitx5-rime ]";
         description = ''
           Enabled Fcitx5 addons.
         '';
       };
-      waylandFrontend = mkOption {
-        type = types.bool;
+      waylandFrontend = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Use the Wayland input method frontend.
           See [Using Fcitx 5 on Wayland](https://fcitx-im.org/wiki/Using_Fcitx_5_on_Wayland).
         '';
       };
-      plasma6Support = mkOption {
-        type = types.bool;
+      plasma6Support = lib.mkOption {
+        type = lib.types.bool;
         default = config.services.desktopManager.plasma6.enable;
-        defaultText = literalExpression "config.services.desktopManager.plasma6.enable";
+        defaultText = lib.literalExpression "config.services.desktopManager.plasma6.enable";
         description = ''
           Use qt6 versions of fcitx5 packages.
           Required for configuring fcitx5 in KDE System Settings.
         '';
       };
-      quickPhrase = mkOption {
-        type = with types; attrsOf str;
+      quickPhrase = lib.mkOption {
+        type = with lib.types; attrsOf str;
         default = { };
-        example = literalExpression ''
+        example = lib.literalExpression ''
           {
             smile = "（・∀・）";
             angry = "(￣ー￣)";
@@ -50,10 +47,10 @@ in
         '';
         description = "Quick phrases.";
       };
-      quickPhraseFiles = mkOption {
-        type = with types; attrsOf path;
+      quickPhraseFiles = lib.mkOption {
+        type = with lib.types; attrsOf path;
         default = { };
-        example = literalExpression ''
+        example = lib.literalExpression ''
           {
             words = ./words.mb;
             numbers = ./numbers.mb;
@@ -87,7 +84,7 @@ in
             The addon configures in `conf` folder in ini format with global sections.
             Each item is written to the corresponding file.
           '';
-          example = literalExpression "{ pinyin.globalSection.EmojiEnabled = \"True\"; }";
+          example = lib.literalExpression "{ pinyin.globalSection.EmojiEnabled = \"True\"; }";
         };
       };
       ignoreUserConfig = lib.mkOption {
@@ -103,12 +100,12 @@ in
   };
 
   imports = [
-    (mkRemovedOptionModule [ "i18n" "inputMethod" "fcitx5" "enableRimeData" ] ''
+    (lib.mkRemovedOptionModule [ "i18n" "inputMethod" "fcitx5" "enableRimeData" ] ''
       RIME data is now included in `fcitx5-rime` by default, and can be customized using `fcitx5-rime.override { rimeDataPkgs = ...; }`
     '')
   ];
 
-  config = mkIf (imcfg.enable && imcfg.type == "fcitx5") {
+  config = lib.mkIf (imcfg.enable && imcfg.type == "fcitx5") {
     i18n.inputMethod.package = fcitx5Package;
 
     i18n.inputMethod.fcitx5.addons = lib.optionals (cfg.quickPhrase != { }) [
@@ -122,15 +119,15 @@ in
     ];
     environment.etc =
       let
-        optionalFile = p: f: v: lib.optionalAttrs (v != { }) {
+        lib.optionalFile = p: f: v: lib.optionalAttrs (v != { }) {
           "xdg/fcitx5/${p}".text = f v;
         };
       in
       lib.attrsets.mergeAttrsList [
-        (optionalFile "config" (lib.generators.toINI { }) cfg.settings.globalOptions)
-        (optionalFile "profile" (lib.generators.toINI { }) cfg.settings.inputMethod)
+        (lib.optionalFile "config" (lib.generators.toINI { }) cfg.settings.globalOptions)
+        (lib.optionalFile "profile" (lib.generators.toINI { }) cfg.settings.inputMethod)
         (lib.concatMapAttrs
-          (name: value: optionalFile
+          (name: value: lib.optionalFile
             "conf/${name}.conf"
             (lib.generators.toINIWithGlobalSection { })
             value)
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index b374cfebbec4..88715af4dc0e 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1348,6 +1348,7 @@
   ./services/system/systembus-notify.nix
   ./services/system/systemd-lock-handler.nix
   ./services/system/uptimed.nix
+  ./services/system/userborn.nix
   ./services/system/zram-generator.nix
   ./services/torrent/deluge.nix
   ./services/torrent/flexget.nix
diff --git a/nixos/modules/profiles/perlless.nix b/nixos/modules/profiles/perlless.nix
index f34c3d2d210b..cb98895743d5 100644
--- a/nixos/modules/profiles/perlless.nix
+++ b/nixos/modules/profiles/perlless.nix
@@ -12,7 +12,7 @@
   # Remove perl from activation
   boot.initrd.systemd.enable = lib.mkDefault true;
   system.etc.overlay.enable = lib.mkDefault true;
-  systemd.sysusers.enable = lib.mkDefault true;
+  services.userborn.enable = lib.mkDefault true;
 
   # Random perl remnants
   system.disableInstallerTools = lib.mkDefault true;
diff --git a/nixos/modules/services/hardware/libinput.nix b/nixos/modules/services/hardware/libinput.nix
index d79055cb8d83..e8169af40637 100644
--- a/nixos/modules/services/hardware/libinput.nix
+++ b/nixos/modules/services/hardware/libinput.nix
@@ -1,14 +1,11 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let cfg = config.services.libinput;
 
     xorgBool = v: if v then "on" else "off";
 
     mkConfigForDevice = deviceType: {
-      dev = mkOption {
-        type = types.nullOr types.str;
+      dev = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         example = "/dev/input/event0";
         description = ''
@@ -17,8 +14,8 @@ let cfg = config.services.libinput;
           '';
       };
 
-      accelProfile = mkOption {
-        type = types.enum [ "flat" "adaptive" "custom" ];
+      accelProfile = lib.mkOption {
+        type = lib.types.enum [ "flat" "adaptive" "custom" ];
         default = "adaptive";
         example = "flat";
         description = ''
@@ -36,8 +33,8 @@ let cfg = config.services.libinput;
           '';
       };
 
-      accelSpeed = mkOption {
-        type = types.nullOr types.str;
+      accelSpeed = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         example = "-0.5";
         description = ''
@@ -46,8 +43,8 @@ let cfg = config.services.libinput;
           '';
       };
 
-      accelPointsFallback = mkOption {
-        type = types.nullOr (types.listOf types.number);
+      accelPointsFallback = lib.mkOption {
+        type = lib.types.nullOr (lib.types.listOf lib.types.number);
         default = null;
         example = [ 0.0 1.0 2.4 2.5 ];
         description = ''
@@ -56,8 +53,8 @@ let cfg = config.services.libinput;
           '';
       };
 
-      accelPointsMotion = mkOption {
-        type = types.nullOr (types.listOf types.number);
+      accelPointsMotion = lib.mkOption {
+        type = lib.types.nullOr (lib.types.listOf lib.types.number);
         default = null;
         example = [ 0.0 1.0 2.4 2.5 ];
         description = ''
@@ -66,8 +63,8 @@ let cfg = config.services.libinput;
           '';
       };
 
-      accelPointsScroll = mkOption {
-        type = types.nullOr (types.listOf types.number);
+      accelPointsScroll = lib.mkOption {
+        type = lib.types.nullOr (lib.types.listOf lib.types.number);
         default = null;
         example = [ 0.0 1.0 2.4 2.5 ];
         description = ''
@@ -76,8 +73,8 @@ let cfg = config.services.libinput;
           '';
       };
 
-      accelStepFallback = mkOption {
-        type = types.nullOr types.number;
+      accelStepFallback = lib.mkOption {
+        type = lib.types.nullOr lib.types.number;
         default = null;
         example = 0.1;
         description = ''
@@ -87,8 +84,8 @@ let cfg = config.services.libinput;
           '';
       };
 
-      accelStepMotion = mkOption {
-        type = types.nullOr types.number;
+      accelStepMotion = lib.mkOption {
+        type = lib.types.nullOr lib.types.number;
         default = null;
         example = 0.1;
         description = ''
@@ -98,8 +95,8 @@ let cfg = config.services.libinput;
           '';
       };
 
-      accelStepScroll = mkOption {
-        type = types.nullOr types.number;
+      accelStepScroll = lib.mkOption {
+        type = lib.types.nullOr lib.types.number;
         default = null;
         example = 0.1;
         description = ''
@@ -109,8 +106,8 @@ let cfg = config.services.libinput;
           '';
       };
 
-      buttonMapping = mkOption {
-        type = types.nullOr types.str;
+      buttonMapping = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         example = "1 6 3 4 5 0 7";
         description = ''
@@ -123,8 +120,8 @@ let cfg = config.services.libinput;
           '';
       };
 
-      calibrationMatrix = mkOption {
-        type = types.nullOr types.str;
+      calibrationMatrix = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         example = "0.5 0 0 0 0.8 0.1 0 0 1";
         description = ''
@@ -133,8 +130,8 @@ let cfg = config.services.libinput;
           '';
       };
 
-      clickMethod = mkOption {
-        type = types.nullOr (types.enum [ "none" "buttonareas" "clickfinger" ]);
+      clickMethod = lib.mkOption {
+        type = lib.types.nullOr (lib.types.enum [ "none" "buttonareas" "clickfinger" ]);
         default = null;
         example = "buttonareas";
         description = ''
@@ -145,14 +142,14 @@ let cfg = config.services.libinput;
           '';
       };
 
-      leftHanded = mkOption {
-        type = types.bool;
+      leftHanded = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Enables left-handed button orientation, i.e. swapping left and right buttons.";
       };
 
-      middleEmulation = mkOption {
-        type = types.bool;
+      middleEmulation = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = ''
             Enables middle button emulation. When enabled, pressing the left and right buttons
@@ -160,14 +157,14 @@ let cfg = config.services.libinput;
           '';
       };
 
-      naturalScrolling = mkOption {
-        type = types.bool;
+      naturalScrolling = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Enables or disables natural scrolling behavior.";
       };
 
-      scrollButton = mkOption {
-        type = types.nullOr types.int;
+      scrollButton = lib.mkOption {
+        type = lib.types.nullOr lib.types.int;
         default = null;
         example = 1;
         description = ''
@@ -176,8 +173,8 @@ let cfg = config.services.libinput;
           '';
       };
 
-      scrollMethod = mkOption {
-        type = types.enum [ "twofinger" "edge" "button" "none" ];
+      scrollMethod = lib.mkOption {
+        type = lib.types.enum [ "twofinger" "edge" "button" "none" ];
         default = "twofinger";
         example = "edge";
         description = ''
@@ -186,8 +183,8 @@ let cfg = config.services.libinput;
           '';
       };
 
-      horizontalScrolling = mkOption {
-        type = types.bool;
+      horizontalScrolling = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = ''
             Enables or disables horizontal scrolling. When disabled, this driver will discard any
@@ -196,8 +193,8 @@ let cfg = config.services.libinput;
           '';
       };
 
-      sendEventsMode = mkOption {
-        type = types.enum [ "disabled" "enabled" "disabled-on-external-mouse" ];
+      sendEventsMode = lib.mkOption {
+        type = lib.types.enum [ "disabled" "enabled" "disabled-on-external-mouse" ];
         default = "enabled";
         example = "disabled";
         description = ''
@@ -206,24 +203,24 @@ let cfg = config.services.libinput;
           '';
       };
 
-      tapping = mkOption {
-        type = types.bool;
+      tapping = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = ''
             Enables or disables tap-to-click behavior.
           '';
       };
 
-      tappingButtonMap = mkOption {
-        type = types.nullOr (types.enum [ "lrm" "lmr" ]);
+      tappingButtonMap = lib.mkOption {
+        type = lib.types.nullOr (lib.types.enum [ "lrm" "lmr" ]);
         default = null;
         description = ''
           Set the button mapping for 1/2/3-finger taps to left/right/middle or left/middle/right, respectively.
         '';
       };
 
-      tappingDragLock = mkOption {
-        type = types.bool;
+      tappingDragLock = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = ''
             Enables or disables drag lock during tapping behavior. When enabled, a finger up during tap-
@@ -232,8 +229,8 @@ let cfg = config.services.libinput;
           '';
       };
 
-      transformationMatrix = mkOption {
-        type = types.nullOr types.str;
+      transformationMatrix = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         example = "0.5 0 0 0 0.8 0.1 0 0 1";
         description = ''
@@ -242,16 +239,16 @@ let cfg = config.services.libinput;
         '';
       };
 
-      disableWhileTyping = mkOption {
-        type = types.bool;
+      disableWhileTyping = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
             Disable input method while typing.
           '';
       };
 
-      additionalOptions = mkOption {
-        type = types.lines;
+      additionalOptions = lib.mkOption {
+        type = lib.types.lines;
         default = "";
         example =
         ''
@@ -269,28 +266,28 @@ let cfg = config.services.libinput;
       Identifier "libinput ${deviceType} configuration"
       MatchDriver "libinput"
       MatchIs${matchIs} "${xorgBool true}"
-      ${optionalString (cfg.${deviceType}.dev != null) ''MatchDevicePath "${cfg.${deviceType}.dev}"''}
+      ${lib.optionalString (cfg.${deviceType}.dev != null) ''MatchDevicePath "${cfg.${deviceType}.dev}"''}
       Option "AccelProfile" "${cfg.${deviceType}.accelProfile}"
-      ${optionalString (cfg.${deviceType}.accelSpeed != null) ''Option "AccelSpeed" "${cfg.${deviceType}.accelSpeed}"''}
-      ${optionalString (cfg.${deviceType}.accelPointsFallback != null) ''Option "AccelPointsFallback" "${toString cfg.${deviceType}.accelPointsFallback}"''}
-      ${optionalString (cfg.${deviceType}.accelPointsMotion != null) ''Option "AccelPointsMotion" "${toString cfg.${deviceType}.accelPointsMotion}"''}
-      ${optionalString (cfg.${deviceType}.accelPointsScroll != null) ''Option "AccelPointsScroll" "${toString cfg.${deviceType}.accelPointsScroll}"''}
-      ${optionalString (cfg.${deviceType}.accelStepFallback != null) ''Option "AccelStepFallback" "${toString cfg.${deviceType}.accelStepFallback}"''}
-      ${optionalString (cfg.${deviceType}.accelStepMotion != null) ''Option "AccelStepMotion" "${toString cfg.${deviceType}.accelStepMotion}"''}
-      ${optionalString (cfg.${deviceType}.accelStepScroll != null) ''Option "AccelStepScroll" "${toString cfg.${deviceType}.accelStepScroll}"''}
-      ${optionalString (cfg.${deviceType}.buttonMapping != null) ''Option "ButtonMapping" "${cfg.${deviceType}.buttonMapping}"''}
-      ${optionalString (cfg.${deviceType}.calibrationMatrix != null) ''Option "CalibrationMatrix" "${cfg.${deviceType}.calibrationMatrix}"''}
-      ${optionalString (cfg.${deviceType}.transformationMatrix != null) ''Option "TransformationMatrix" "${cfg.${deviceType}.transformationMatrix}"''}
-      ${optionalString (cfg.${deviceType}.clickMethod != null) ''Option "ClickMethod" "${cfg.${deviceType}.clickMethod}"''}
+      ${lib.optionalString (cfg.${deviceType}.accelSpeed != null) ''Option "AccelSpeed" "${cfg.${deviceType}.accelSpeed}"''}
+      ${lib.optionalString (cfg.${deviceType}.accelPointsFallback != null) ''Option "AccelPointsFallback" "${toString cfg.${deviceType}.accelPointsFallback}"''}
+      ${lib.optionalString (cfg.${deviceType}.accelPointsMotion != null) ''Option "AccelPointsMotion" "${toString cfg.${deviceType}.accelPointsMotion}"''}
+      ${lib.optionalString (cfg.${deviceType}.accelPointsScroll != null) ''Option "AccelPointsScroll" "${toString cfg.${deviceType}.accelPointsScroll}"''}
+      ${lib.optionalString (cfg.${deviceType}.accelStepFallback != null) ''Option "AccelStepFallback" "${toString cfg.${deviceType}.accelStepFallback}"''}
+      ${lib.optionalString (cfg.${deviceType}.accelStepMotion != null) ''Option "AccelStepMotion" "${toString cfg.${deviceType}.accelStepMotion}"''}
+      ${lib.optionalString (cfg.${deviceType}.accelStepScroll != null) ''Option "AccelStepScroll" "${toString cfg.${deviceType}.accelStepScroll}"''}
+      ${lib.optionalString (cfg.${deviceType}.buttonMapping != null) ''Option "ButtonMapping" "${cfg.${deviceType}.buttonMapping}"''}
+      ${lib.optionalString (cfg.${deviceType}.calibrationMatrix != null) ''Option "CalibrationMatrix" "${cfg.${deviceType}.calibrationMatrix}"''}
+      ${lib.optionalString (cfg.${deviceType}.transformationMatrix != null) ''Option "TransformationMatrix" "${cfg.${deviceType}.transformationMatrix}"''}
+      ${lib.optionalString (cfg.${deviceType}.clickMethod != null) ''Option "ClickMethod" "${cfg.${deviceType}.clickMethod}"''}
       Option "LeftHanded" "${xorgBool cfg.${deviceType}.leftHanded}"
       Option "MiddleEmulation" "${xorgBool cfg.${deviceType}.middleEmulation}"
       Option "NaturalScrolling" "${xorgBool cfg.${deviceType}.naturalScrolling}"
-      ${optionalString (cfg.${deviceType}.scrollButton != null) ''Option "ScrollButton" "${toString cfg.${deviceType}.scrollButton}"''}
+      ${lib.optionalString (cfg.${deviceType}.scrollButton != null) ''Option "ScrollButton" "${toString cfg.${deviceType}.scrollButton}"''}
       Option "ScrollMethod" "${cfg.${deviceType}.scrollMethod}"
       Option "HorizontalScrolling" "${xorgBool cfg.${deviceType}.horizontalScrolling}"
       Option "SendEventsMode" "${cfg.${deviceType}.sendEventsMode}"
       Option "Tapping" "${xorgBool cfg.${deviceType}.tapping}"
-      ${optionalString (cfg.${deviceType}.tappingButtonMap != null) ''Option "TappingButtonMap" "${cfg.${deviceType}.tappingButtonMap}"''}
+      ${lib.optionalString (cfg.${deviceType}.tappingButtonMap != null) ''Option "TappingButtonMap" "${cfg.${deviceType}.tappingButtonMap}"''}
       Option "TappingDragLock" "${xorgBool cfg.${deviceType}.tappingDragLock}"
       Option "DisableWhileTyping" "${xorgBool cfg.${deviceType}.disableWhileTyping}"
       ${cfg.${deviceType}.additionalOptions}
@@ -298,7 +295,7 @@ let cfg = config.services.libinput;
 in {
 
   imports =
-    (map (option: mkRenamedOptionModule ([ "services" "xserver" "libinput" option ]) [ "services" "libinput" "touchpad" option ]) [
+    (map (option: lib.mkRenamedOptionModule ([ "services" "xserver" "libinput" option ]) [ "services" "libinput" "touchpad" option ]) [
       "accelProfile"
       "accelSpeed"
       "buttonMapping"
@@ -318,15 +315,15 @@ in {
       "disableWhileTyping"
       "additionalOptions"
     ]) ++ [
-      (mkRenamedOptionModule [ "services" "xserver" "libinput" "enable" ]   [ "services" "libinput" "enable" ])
-      (mkRenamedOptionModule [ "services" "xserver" "libinput" "mouse" ]    [ "services" "libinput" "mouse" ])
-      (mkRenamedOptionModule [ "services" "xserver" "libinput" "touchpad" ] [ "services" "libinput" "touchpad" ])
+      (lib.mkRenamedOptionModule [ "services" "xserver" "libinput" "enable" ]   [ "services" "libinput" "enable" ])
+      (lib.mkRenamedOptionModule [ "services" "xserver" "libinput" "mouse" ]    [ "services" "libinput" "mouse" ])
+      (lib.mkRenamedOptionModule [ "services" "xserver" "libinput" "touchpad" ] [ "services" "libinput" "touchpad" ])
     ];
 
   options = {
 
     services.libinput = {
-      enable = mkEnableOption "libinput" // {
+      enable = lib.mkEnableOption "libinput" // {
         default = config.services.xserver.enable;
         defaultText = lib.literalExpression "config.services.xserver.enable";
       };
@@ -336,7 +333,7 @@ in {
   };
 
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     services.xserver.modules = [ pkgs.xorg.xf86inputlibinput ];
 
diff --git a/nixos/modules/services/mail/clamsmtp.nix b/nixos/modules/services/mail/clamsmtp.nix
index 5bcf8ecdde1a..d40ed7bf6e2d 100644
--- a/nixos/modules/services/mail/clamsmtp.nix
+++ b/nixos/modules/services/mail/clamsmtp.nix
@@ -1,6 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
 let
   cfg = config.services.clamsmtp;
   clamdSocket = "/run/clamav/clamd.ctl"; # See services/security/clamav.nix
@@ -9,17 +7,17 @@ in
   ##### interface
   options = {
     services.clamsmtp = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Whether to enable clamsmtp.";
       };
 
-      instances = mkOption {
+      instances = lib.mkOption {
         description = "Instances of clamsmtp to run.";
-        type = types.listOf (types.submodule { options = {
-          action = mkOption {
-            type = types.enum [ "bounce" "drop" "pass" ];
+        type = lib.types.listOf (lib.types.submodule { options = {
+          action = lib.mkOption {
+            type = lib.types.enum [ "bounce" "drop" "pass" ];
             default = "drop";
             description = ''
                 Action to take when a virus is detected.
@@ -29,8 +27,8 @@ in
               '';
           };
 
-          header = mkOption {
-            type = types.str;
+          header = lib.mkOption {
+            type = lib.types.str;
             default = "";
             example = "X-Virus-Scanned: ClamAV using ClamSMTP";
             description = ''
@@ -39,8 +37,8 @@ in
               '';
           };
 
-          keepAlives = mkOption {
-            type = types.int;
+          keepAlives = lib.mkOption {
+            type = lib.types.int;
             default = 0;
             description = ''
                 Number of seconds to wait between each NOOP sent to the sending
@@ -51,8 +49,8 @@ in
               '';
           };
 
-          listen = mkOption {
-            type = types.str;
+          listen = lib.mkOption {
+            type = lib.types.str;
             example = "127.0.0.1:10025";
             description = ''
                 Address to wait for incoming SMTP connections on. See
@@ -60,8 +58,8 @@ in
               '';
           };
 
-          quarantine = mkOption {
-            type = types.bool;
+          quarantine = lib.mkOption {
+            type = lib.types.bool;
             default = false;
             description = ''
                 Whether to quarantine files that contain viruses by leaving them
@@ -69,22 +67,22 @@ in
               '';
           };
 
-          maxConnections = mkOption {
-            type = types.int;
+          maxConnections = lib.mkOption {
+            type = lib.types.int;
             default = 64;
             description = "Maximum number of connections to accept at once.";
           };
 
-          outAddress = mkOption {
-            type = types.str;
+          outAddress = lib.mkOption {
+            type = lib.types.str;
             description = ''
                 Address of the SMTP server to send email to once it has been
                 scanned.
               '';
           };
 
-          tempDirectory = mkOption {
-            type = types.str;
+          tempDirectory = lib.mkOption {
+            type = lib.types.str;
             default = "/tmp";
             description = ''
                 Temporary directory that needs to be accessible to both clamd
@@ -92,20 +90,20 @@ in
               '';
           };
 
-          timeout = mkOption {
-            type = types.int;
+          timeout = lib.mkOption {
+            type = lib.types.int;
             default = 180;
             description = "Time-out for network connections.";
           };
 
-          transparentProxy = mkOption {
-            type = types.bool;
+          transparentProxy = lib.mkOption {
+            type = lib.types.bool;
             default = false;
             description = "Enable clamsmtp's transparent proxy support.";
           };
 
-          virusAction = mkOption {
-            type = with types; nullOr path;
+          virusAction = lib.mkOption {
+            type = with lib.types; nullOr path;
             default = null;
             description = ''
                 Command to run when a virus is found. Please see VIRUS ACTION in
@@ -113,8 +111,8 @@ in
               '';
           };
 
-          xClient = mkOption {
-            type = types.bool;
+          xClient = lib.mkOption {
+            type = lib.types.bool;
             default = false;
             description = ''
                 Send the XCLIENT command to the receiving server, for forwarding
@@ -143,19 +141,19 @@ in
         TimeOut: ${toString conf.timeout}
         TransparentProxy: ${if conf.transparentProxy then "on" else "off"}
         User: clamav
-        ${optionalString (conf.virusAction != null) "VirusAction: ${conf.virusAction}"}
+        ${lib.optionalString (conf.virusAction != null) "VirusAction: ${conf.virusAction}"}
         XClient: ${if conf.xClient then "on" else "off"}
       '';
   in
-    mkIf cfg.enable {
+    lib.mkIf cfg.enable {
       assertions = [
         { assertion = config.services.clamav.daemon.enable;
           message = "clamsmtp requires clamav to be enabled";
         }
       ];
 
-      systemd.services = listToAttrs (imap1 (i: conf:
-        nameValuePair "clamsmtp-${toString i}" {
+      systemd.services = lib.listToAttrs (lib.imap1 (i: conf:
+        lib.nameValuePair "clamsmtp-${toString i}" {
           description = "ClamSMTP instance ${toString i}";
           wantedBy = [ "multi-user.target" ];
           script = "exec ${pkgs.clamsmtp}/bin/clamsmtpd -f ${configfile conf}";
diff --git a/nixos/modules/services/mail/davmail.nix b/nixos/modules/services/mail/davmail.nix
index 46ddaedd4bf6..00e1ecb3852b 100644
--- a/nixos/modules/services/mail/davmail.nix
+++ b/nixos/modules/services/mail/davmail.nix
@@ -1,39 +1,36 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   cfg = config.services.davmail;
 
-  configType = with types;
+  configType = with lib.types;
     oneOf [ (attrsOf configType) str int bool ] // {
       description = "davmail config type (str, int, bool or attribute set thereof)";
     };
 
-  toStr = val: if isBool val then boolToString val else toString val;
+  toStr = val: if lib.isBool val then lib.boolToString val else toString val;
 
-  linesForAttrs = attrs: concatMap (name: let value = attrs.${name}; in
-    if isAttrs value
+  linesForAttrs = attrs: lib.concatMap (name: let value = attrs.${name}; in
+    if lib.isAttrs value
       then map (line: name + "." + line) (linesForAttrs value)
       else [ "${name}=${toStr value}" ]
-  ) (attrNames attrs);
+  ) (lib.attrNames attrs);
 
-  configFile = pkgs.writeText "davmail.properties" (concatStringsSep "\n" (linesForAttrs cfg.config));
+  configFile = pkgs.writeText "davmail.properties" (lib.concatStringsSep "\n" (linesForAttrs cfg.config));
 
 in
 
   {
     options.services.davmail = {
-      enable = mkEnableOption "davmail, an MS Exchange gateway";
+      enable = lib.mkEnableOption "davmail, an MS Exchange gateway";
 
-      url = mkOption {
-        type = types.str;
+      url = lib.mkOption {
+        type = lib.types.str;
         description = "Outlook Web Access URL to access the exchange server, i.e. the base webmail URL.";
         example = "https://outlook.office365.com/EWS/Exchange.asmx";
       };
 
-      config = mkOption {
+      config = lib.mkOption {
         type = configType;
         default = {};
         description = ''
@@ -42,7 +39,7 @@ in
           and <http://davmail.sourceforge.net/advanced.html>
           for details on supported values.
         '';
-        example = literalExpression ''
+        example = lib.literalExpression ''
           {
             davmail.allowRemote = true;
             davmail.imapPort = 55555;
@@ -56,10 +53,10 @@ in
       };
     };
 
-    config = mkIf cfg.enable {
+    config = lib.mkIf cfg.enable {
 
       services.davmail.config = {
-        davmail = mapAttrs (name: mkDefault) {
+        davmail = lib.mapAttrs (name: lib.mkDefault) {
           server = true;
           disableUpdateCheck = true;
           logFilePath = "/var/log/davmail/davmail.log";
@@ -73,10 +70,10 @@ in
           smtpPort = 1025;
         };
         log4j = {
-          logger.davmail = mkDefault "WARN";
-          logger.httpclient.wire = mkDefault "WARN";
-          logger.org.apache.commons.httpclient = mkDefault "WARN";
-          rootLogger = mkDefault "WARN";
+          logger.davmail = lib.mkDefault "WARN";
+          logger.httpclient.wire = lib.mkDefault "WARN";
+          logger.org.apache.commons.httpclient = lib.mkDefault "WARN";
+          rootLogger = lib.mkDefault "WARN";
         };
       };
 
diff --git a/nixos/modules/services/mail/dkimproxy-out.nix b/nixos/modules/services/mail/dkimproxy-out.nix
index 48ccf2dda601..1d6a143dc836 100644
--- a/nixos/modules/services/mail/dkimproxy-out.nix
+++ b/nixos/modules/services/mail/dkimproxy-out.nix
@@ -1,6 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
 let
   cfg = config.services.dkimproxy-out;
   keydir = "/var/lib/dkimproxy-out";
@@ -11,8 +9,8 @@ in
   ##### interface
   options = {
     services.dkimproxy-out = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
             Whether to enable dkimproxy_out.
@@ -22,26 +20,26 @@ in
           '';
       };
 
-      listen = mkOption {
-        type = types.str;
+      listen = lib.mkOption {
+        type = lib.types.str;
         example = "127.0.0.1:10027";
         description = "Address:port DKIMproxy should listen on.";
       };
 
-      relay = mkOption {
-        type = types.str;
+      relay = lib.mkOption {
+        type = lib.types.str;
         example = "127.0.0.1:10028";
         description = "Address:port DKIMproxy should forward mail to.";
       };
 
-      domains = mkOption {
-        type = with types; listOf str;
+      domains = lib.mkOption {
+        type = with lib.types; listOf str;
         example = [ "example.org" "example.com" ];
         description = "List of domains DKIMproxy can sign for.";
       };
 
-      selector = mkOption {
-        type = types.str;
+      selector = lib.mkOption {
+        type = lib.types.str;
         example = "selector1";
         description = ''
             The selector to use for DKIM key identification.
@@ -53,8 +51,8 @@ in
           '';
       };
 
-      keySize = mkOption {
-        type = types.int;
+      keySize = lib.mkOption {
+        type = lib.types.int;
         default = 2048;
         description = ''
             Size of the RSA key to use to sign outgoing emails. Note that the
@@ -75,7 +73,7 @@ in
         listen ${cfg.listen}
         relay ${cfg.relay}
 
-        domain ${concatStringsSep "," cfg.domains}
+        domain ${lib.concatStringsSep "," cfg.domains}
         selector ${cfg.selector}
 
         signature dkim(c=relaxed/relaxed)
@@ -83,7 +81,7 @@ in
         keyfile ${privkey}
       '';
   in
-    mkIf cfg.enable {
+    lib.mkIf cfg.enable {
       users.groups.dkimproxy-out = {};
       users.users.dkimproxy-out = {
         description = "DKIMproxy_out daemon";
diff --git a/nixos/modules/services/mail/dspam.nix b/nixos/modules/services/mail/dspam.nix
index b81fe2652402..76bcc0af7e8b 100644
--- a/nixos/modules/services/mail/dspam.nix
+++ b/nixos/modules/services/mail/dspam.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   cfg = config.services.dspam;
@@ -19,7 +16,7 @@ let
     SystemLog on
     UserLog on
 
-    ${optionalString (cfg.domainSocket != null) ''
+    ${lib.optionalString (cfg.domainSocket != null) ''
       ServerDomainSocketPath "${cfg.domainSocket}"
       ClientHost "${cfg.domainSocket}"
     ''}
@@ -35,44 +32,44 @@ in {
 
     services.dspam = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Whether to enable the dspam spam filter.";
       };
 
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = "dspam";
         description = "User for the dspam daemon.";
       };
 
-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
         default = "dspam";
         description = "Group for the dspam daemon.";
       };
 
-      storageDriver = mkOption {
-        type = types.str;
+      storageDriver = lib.mkOption {
+        type = lib.types.str;
         default = "hash";
         description = "Storage driver backend to use for dspam.";
       };
 
-      domainSocket = mkOption {
-        type = types.nullOr types.path;
+      domainSocket = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
         default = defaultSock;
         description = "Path to local domain socket which is used for communication with the daemon. Set to null to disable UNIX socket.";
       };
 
-      extraConfig = mkOption {
-        type = types.lines;
+      extraConfig = lib.mkOption {
+        type = lib.types.lines;
         default = "";
         description = "Additional dspam configuration.";
       };
 
-      maintenanceInterval = mkOption {
-        type = types.nullOr types.str;
+      maintenanceInterval = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         description = "If set, maintenance script will be run at specified (in systemd.timer format) interval";
       };
@@ -84,16 +81,16 @@ in {
 
   ###### implementation
 
-  config = mkIf cfg.enable (mkMerge [
+  config = lib.mkIf cfg.enable (lib.mkMerge [
     {
-      users.users = optionalAttrs (cfg.user == "dspam") {
+      users.users = lib.optionalAttrs (cfg.user == "dspam") {
         dspam = {
           group = cfg.group;
           uid = config.ids.uids.dspam;
         };
       };
 
-      users.groups = optionalAttrs (cfg.group == "dspam") {
+      users.groups = lib.optionalAttrs (cfg.group == "dspam") {
         dspam.gid = config.ids.gids.dspam;
       };
 
@@ -111,8 +108,8 @@ in {
           ExecStart = "${dspam}/bin/dspam --daemon --nofork";
           User = cfg.user;
           Group = cfg.group;
-          RuntimeDirectory = optional (cfg.domainSocket == defaultSock) "dspam";
-          RuntimeDirectoryMode = optional (cfg.domainSocket == defaultSock) "0750";
+          RuntimeDirectory = lib.optional (cfg.domainSocket == defaultSock) "dspam";
+          RuntimeDirectoryMode = lib.optional (cfg.domainSocket == defaultSock) "0750";
           StateDirectory = "dspam";
           StateDirectoryMode = "0750";
           LogsDirectory = "dspam";
@@ -124,7 +121,7 @@ in {
       };
     }
 
-    (mkIf (cfg.maintenanceInterval != null) {
+    (lib.mkIf (cfg.maintenanceInterval != null) {
       systemd.timers.dspam-maintenance = {
         description = "Timer for dspam maintenance script";
         wantedBy = [ "timers.target" ];
diff --git a/nixos/modules/services/mail/goeland.nix b/nixos/modules/services/mail/goeland.nix
index 158b9ef982cc..42f64b3632b5 100644
--- a/nixos/modules/services/mail/goeland.nix
+++ b/nixos/modules/services/mail/goeland.nix
@@ -1,16 +1,13 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.goeland;
   tomlFormat = pkgs.formats.toml { };
 in
 {
   options.services.goeland = {
-    enable = mkEnableOption "goeland, an alternative to rss2email";
+    enable = lib.mkEnableOption "goeland, an alternative to rss2email";
 
-    settings = mkOption {
+    settings = lib.mkOption {
       description = ''
         Configuration of goeland.
         See the [example config file](https://github.com/slurdge/goeland/blob/master/cmd/asset/config.default.toml) for the available options.
@@ -18,14 +15,14 @@ in
       default = { };
       type = tomlFormat.type;
     };
-    schedule = mkOption {
-      type = types.str;
+    schedule = lib.mkOption {
+      type = lib.types.str;
       default = "12h";
       example = "Mon, 00:00:00";
       description = "How often to run goeland, in systemd time format.";
     };
-    stateDir = mkOption {
-      type = types.path;
+    stateDir = lib.mkOption {
+      type = lib.types.path;
       default = "/var/lib/goeland";
       description = ''
         The data directory for goeland where the database will reside if using the unseen filter.
@@ -36,17 +33,17 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     services.goeland.settings.database = "${cfg.stateDir}/goeland.db";
 
     systemd.services.goeland = {
-      serviceConfig = let confFile = tomlFormat.generate "config.toml" cfg.settings; in mkMerge [
+      serviceConfig = let confFile = tomlFormat.generate "config.toml" cfg.settings; in lib.mkMerge [
         {
           ExecStart = "${pkgs.goeland}/bin/goeland run -c ${confFile}";
           User = "goeland";
           Group = "goeland";
         }
-        (mkIf (cfg.stateDir == "/var/lib/goeland") {
+        (lib.mkIf (cfg.stateDir == "/var/lib/goeland") {
           StateDirectory = "goeland";
           StateDirectoryMode = "0750";
         })
@@ -61,7 +58,7 @@ in
     };
     users.groups.goeland = { };
 
-    warnings = optionals (hasAttr "password" cfg.settings.email) [
+    warnings = lib.optionals (lib.hasAttr "password" cfg.settings.email) [
       ''
         It is not recommended to set the "services.goeland.settings.email.password"
         option as it will be in cleartext in the Nix store.
@@ -70,5 +67,5 @@ in
     ];
   };
 
-  meta.maintainers = with maintainers; [ sweenu ];
+  meta.maintainers = with lib.maintainers; [ sweenu ];
 }
diff --git a/nixos/modules/services/mail/listmonk.nix b/nixos/modules/services/mail/listmonk.nix
index 482bc42696f9..82c94ad4bb8f 100644
--- a/nixos/modules/services/mail/listmonk.nix
+++ b/nixos/modules/services/mail/listmonk.nix
@@ -1,6 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
 let
   cfg = config.services.listmonk;
   tomlFormat = pkgs.formats.toml { };
@@ -11,7 +9,7 @@ let
       lib.replaceStrings [ "'" ] [ "''" ] (builtins.toJSON value)
     }' WHERE key = '${key}';";
   updateDatabaseConfigSQL = pkgs.writeText "update-database-config.sql"
-    (concatStringsSep "\n" (mapAttrsToList setDatabaseOption
+    (lib.concatStringsSep "\n" (lib.mapAttrsToList setDatabaseOption
       (if (cfg.database.settings != null) then
         cfg.database.settings
       else
@@ -27,53 +25,53 @@ let
         "${pkgs.postgresql}/bin/psql -d listmonk -f ${updateDatabaseConfigSQL}"}
     '';
 
-  databaseSettingsOpts = with types; {
+  databaseSettingsOpts = with lib.types; {
     freeformType =
       oneOf [ (listOf str) (listOf (attrsOf anything)) str int bool ];
 
     options = {
-      "app.notify_emails" = mkOption {
+      "app.notify_emails" = lib.mkOption {
         type = listOf str;
         default = [ ];
         description = "Administrator emails for system notifications";
       };
 
-      "privacy.exportable" = mkOption {
+      "privacy.exportable" = lib.mkOption {
         type = listOf str;
         default = [ "profile" "subscriptions" "campaign_views" "link_clicks" ];
         description =
           "List of fields which can be exported through an automatic export request";
       };
 
-      "privacy.domain_blocklist" = mkOption {
+      "privacy.domain_blocklist" = lib.mkOption {
         type = listOf str;
         default = [ ];
         description =
           "E-mail addresses with these domains are disallowed from subscribing.";
       };
 
-      smtp = mkOption {
+      smtp = lib.mkOption {
         type = listOf (submodule {
-          freeformType = with types; attrsOf anything;
+          freeformType = with lib.types; attrsOf anything;
 
           options = {
-            enabled = mkEnableOption "this SMTP server for listmonk";
-            host = mkOption {
-              type = types.str;
+            enabled = lib.mkEnableOption "this SMTP server for listmonk";
+            host = lib.mkOption {
+              type = lib.types.str;
               description = "Hostname for the SMTP server";
             };
-            port = mkOption {
-              type = types.port;
+            port = lib.mkOption {
+              type = lib.types.port;
               description = "Port for the SMTP server";
             };
-            max_conns = mkOption {
-              type = types.int;
+            max_conns = lib.mkOption {
+              type = lib.types.int;
               description =
                 "Maximum number of simultaneous connections, defaults to 1";
               default = 1;
             };
-            tls_type = mkOption {
-              type = types.enum [ "none" "STARTTLS" "TLS" ];
+            tls_type = lib.mkOption {
+              type = lib.types.enum [ "none" "STARTTLS" "TLS" ];
               description = "Type of TLS authentication with the SMTP server";
             };
           };
@@ -83,14 +81,14 @@ let
       };
 
       # TODO: refine this type based on the smtp one.
-      "bounce.mailboxes" = mkOption {
+      "bounce.mailboxes" = lib.mkOption {
         type = listOf
-          (submodule { freeformType = with types; listOf (attrsOf anything); });
+          (submodule { freeformType = with lib.types; listOf (attrsOf anything); });
         default = [ ];
         description = "List of bounce mailboxes";
       };
 
-      messengers = mkOption {
+      messengers = lib.mkOption {
         type = listOf str;
         default = [ ];
         description =
@@ -102,23 +100,23 @@ in {
   ###### interface
   options = {
     services.listmonk = {
-      enable = mkEnableOption "Listmonk, this module assumes a reverse proxy to be set";
+      enable = lib.mkEnableOption "Listmonk, this module assumes a reverse proxy to be set";
       database = {
-        createLocally = mkOption {
-          type = types.bool;
+        createLocally = lib.mkOption {
+          type = lib.types.bool;
           default = false;
           description =
             "Create the PostgreSQL database and database user locally.";
         };
 
-        settings = mkOption {
+        settings = lib.mkOption {
           default = null;
-          type = with types; nullOr (submodule databaseSettingsOpts);
+          type = with lib.types; nullOr (submodule databaseSettingsOpts);
           description =
             "Dynamic settings in the PostgreSQL database, set by a SQL script, see <https://github.com/knadh/listmonk/blob/master/schema.sql#L177-L230> for details.";
         };
-        mutableSettings = mkOption {
-          type = types.bool;
+        mutableSettings = lib.mkOption {
+          type = lib.types.bool;
           default = true;
           description = ''
             Database settings will be reset to the value set in this module if this is not enabled.
@@ -126,16 +124,16 @@ in {
           '';
         };
       };
-      package = mkPackageOption pkgs "listmonk" {};
-      settings = mkOption {
-        type = types.submodule { freeformType = tomlFormat.type; };
+      package = lib.mkPackageOption pkgs "listmonk" {};
+      settings = lib.mkOption {
+        type = lib.types.submodule { freeformType = tomlFormat.type; };
         description = ''
           Static settings set in the config.toml, see <https://github.com/knadh/listmonk/blob/master/config.toml.sample> for details.
           You can set secrets using the secretFile option with environment variables following <https://listmonk.app/docs/configuration/#environment-variables>.
         '';
       };
-      secretFile = mkOption {
-        type = types.nullOr types.str;
+      secretFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         description =
           "A file containing secrets as environment variables. See <https://listmonk.app/docs/configuration/#environment-variables> for details on supported values.";
@@ -144,24 +142,24 @@ in {
   };
 
   ###### implementation
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     # Default parameters from https://github.com/knadh/listmonk/blob/master/config.toml.sample
-    services.listmonk.settings."app".address = mkDefault "localhost:9000";
-    services.listmonk.settings."db" = mkMerge [
+    services.listmonk.settings."app".address = lib.mkDefault "localhost:9000";
+    services.listmonk.settings."db" = lib.mkMerge [
       ({
-        max_open = mkDefault 25;
-        max_idle = mkDefault 25;
-        max_lifetime = mkDefault "300s";
+        max_open = lib.mkDefault 25;
+        max_idle = lib.mkDefault 25;
+        max_lifetime = lib.mkDefault "300s";
       })
-      (mkIf cfg.database.createLocally {
-        host = mkDefault "/run/postgresql";
-        port = mkDefault 5432;
-        user = mkDefault "listmonk";
-        database = mkDefault "listmonk";
+      (lib.mkIf cfg.database.createLocally {
+        host = lib.mkDefault "/run/postgresql";
+        port = lib.mkDefault 5432;
+        user = lib.mkDefault "listmonk";
+        database = lib.mkDefault "listmonk";
       })
     ];
 
-    services.postgresql = mkIf cfg.database.createLocally {
+    services.postgresql = lib.mkIf cfg.database.createLocally {
       enable = true;
 
       ensureUsers = [{
@@ -175,11 +173,11 @@ in {
     systemd.services.listmonk = {
       description = "Listmonk - newsletter and mailing list manager";
       after = [ "network.target" ]
-        ++ optional cfg.database.createLocally "postgresql.service";
+        ++ lib.optional cfg.database.createLocally "postgresql.service";
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
         Type = "exec";
-        EnvironmentFile = mkIf (cfg.secretFile != null) [ cfg.secretFile ];
+        EnvironmentFile = lib.mkIf (cfg.secretFile != null) [ cfg.secretFile ];
         ExecStartPre = [
           # StateDirectory cannot be used when DynamicUser = true is set this way.
           # Indeed, it will try to create all the folders and realize one of them already exist.
diff --git a/nixos/modules/services/mail/maddy.nix b/nixos/modules/services/mail/maddy.nix
index 7c67d4e6135e..ab0e1f40f5b0 100644
--- a/nixos/modules/services/mail/maddy.nix
+++ b/nixos/modules/services/mail/maddy.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   name = "maddy";
@@ -138,11 +135,11 @@ in {
   options = {
     services.maddy = {
 
-      enable = mkEnableOption "Maddy, a free an open source mail server";
+      enable = lib.mkEnableOption "Maddy, a free an open source mail server";
 
-      user = mkOption {
+      user = lib.mkOption {
         default = "maddy";
-        type = with types; uniq str;
+        type = with lib.types; uniq str;
         description = ''
           User account under which maddy runs.
 
@@ -154,9 +151,9 @@ in {
         '';
       };
 
-      group = mkOption {
+      group = lib.mkOption {
         default = "maddy";
-        type = with types; uniq str;
+        type = with lib.types; uniq str;
         description = ''
           Group account under which maddy runs.
 
@@ -168,26 +165,26 @@ in {
         '';
       };
 
-      hostname = mkOption {
+      hostname = lib.mkOption {
         default = "localhost";
-        type = with types; uniq str;
+        type = with lib.types; uniq str;
         example = ''example.com'';
         description = ''
           Hostname to use. It should be FQDN.
         '';
       };
 
-      primaryDomain = mkOption {
+      primaryDomain = lib.mkOption {
         default = "localhost";
-        type = with types; uniq str;
+        type = with lib.types; uniq str;
         example = ''mail.example.com'';
         description = ''
           Primary MX domain to use. It should be FQDN.
         '';
       };
 
-      localDomains = mkOption {
-        type = with types; listOf str;
+      localDomains = lib.mkOption {
+        type = with lib.types; listOf str;
         default = ["$(primary_domain)"];
         example = [
           "$(primary_domain)"
@@ -199,8 +196,8 @@ in {
         '';
       };
 
-      config = mkOption {
-        type = with types; nullOr lines;
+      config = lib.mkOption {
+        type = with lib.types; nullOr lines;
         default = defaultConfig;
         description = ''
           Server configuration, see
@@ -215,8 +212,8 @@ in {
       };
 
       tls = {
-        loader = mkOption {
-          type = with types; nullOr (enum [ "off" "file" "acme" ]);
+        loader = lib.mkOption {
+          type = with lib.types; nullOr (enum [ "off" "file" "acme" ]);
           default = "off";
           description = ''
             TLS certificates are obtained by modules called "certificate
@@ -237,18 +234,18 @@ in {
           '';
         };
 
-        certificates = mkOption {
-          type = with types; listOf (submodule {
+        certificates = lib.mkOption {
+          type = with lib.types; listOf (submodule {
             options = {
-              keyPath = mkOption {
-                type = types.path;
+              keyPath = lib.mkOption {
+                type = lib.types.path;
                 example = "/etc/ssl/mx1.example.org.key";
                 description = ''
                   Path to the private key used for TLS.
                 '';
               };
-              certPath = mkOption {
-                type = types.path;
+              certPath = lib.mkOption {
+                type = lib.types.path;
                 example = "/etc/ssl/mx1.example.org.crt";
                 description = ''
                   Path to the certificate used for TLS.
@@ -269,8 +266,8 @@ in {
           '';
         };
 
-        extraConfig = mkOption {
-          type = with types; nullOr lines;
+        extraConfig = lib.mkOption {
+          type = with lib.types; nullOr lines;
           description = ''
             Arguments for the specified certificate loader.
 
@@ -284,16 +281,16 @@ in {
         };
       };
 
-      openFirewall = mkOption {
-        type = types.bool;
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Open the configured incoming and outgoing mail server ports.
         '';
       };
 
-      ensureAccounts = mkOption {
-        type = with types; listOf str;
+      ensureAccounts = lib.mkOption {
+        type = with lib.types; listOf str;
         default = [];
         description = ''
           List of IMAP accounts which get automatically created. Note that for
@@ -307,7 +304,7 @@ in {
         ];
       };
 
-      ensureCredentials = mkOption {
+      ensureCredentials = lib.mkOption {
         default = {};
         description = ''
           List of user accounts which get automatically created if they don't
@@ -319,10 +316,10 @@ in {
           "user1@localhost".passwordFile = /secrets/user1-localhost;
           "user2@localhost".passwordFile = /secrets/user2-localhost;
         };
-        type = types.attrsOf (types.submodule {
+        type = lib.types.attrsOf (lib.types.submodule {
           options = {
-            passwordFile = mkOption {
-              type = types.path;
+            passwordFile = lib.mkOption {
+              type = lib.types.path;
               example = "/path/to/file";
               default = null;
               description = ''
@@ -335,7 +332,7 @@ in {
       };
 
       secrets = lib.mkOption {
-        type = with types; listOf path;
+        type = with lib.types; listOf path;
         description = ''
           A list of files containing the various secrets. Should be in the format
           expected by systemd's `EnvironmentFile` directory. Secrets can be
@@ -347,7 +344,7 @@ in {
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     assertions = [
       {
@@ -387,17 +384,17 @@ in {
         };
         maddy-ensure-accounts = {
           script = ''
-            ${optionalString (cfg.ensureAccounts != []) ''
-              ${concatMapStrings (account: ''
+            ${lib.optionalString (cfg.ensureAccounts != []) ''
+              ${lib.concatMapStrings (account: ''
                 if ! ${pkgs.maddy}/bin/maddyctl imap-acct list | grep "${account}"; then
                   ${pkgs.maddy}/bin/maddyctl imap-acct create ${account}
                 fi
               '') cfg.ensureAccounts}
             ''}
-            ${optionalString (cfg.ensureCredentials != {}) ''
-              ${concatStringsSep "\n" (mapAttrsToList (name: cfg: ''
+            ${lib.optionalString (cfg.ensureCredentials != {}) ''
+              ${lib.concatStringsSep "\n" (lib.mapAttrsToList (name: cfg: ''
                 if ! ${pkgs.maddy}/bin/maddyctl creds list | grep "${name}"; then
-                  ${pkgs.maddy}/bin/maddyctl creds create --password $(cat ${escapeShellArg cfg.passwordFile}) ${name}
+                  ${pkgs.maddy}/bin/maddyctl creds create --password $(cat ${lib.escapeShellArg cfg.passwordFile}) ${name}
                 fi
               '') cfg.ensureCredentials)}
             ''}
@@ -422,9 +419,9 @@ in {
         hostname ${cfg.hostname}
 
         ${if (cfg.tls.loader == "file") then ''
-          tls file ${concatStringsSep " " (
+          tls file ${lib.concatStringsSep " " (
             map (x: x.certPath + " " + x.keyPath
-          ) cfg.tls.certificates)} ${optionalString (cfg.tls.extraConfig != "") ''
+          ) cfg.tls.certificates)} ${lib.optionalString (cfg.tls.extraConfig != "") ''
             { ${cfg.tls.extraConfig} }
           ''}
         '' else if (cfg.tls.loader == "acme") then ''
@@ -441,7 +438,7 @@ in {
       '';
     };
 
-    users.users = optionalAttrs (cfg.user == name) {
+    users.users = lib.optionalAttrs (cfg.user == name) {
       ${name} = {
         isSystemUser = true;
         group = cfg.group;
@@ -449,11 +446,11 @@ in {
       };
     };
 
-    users.groups = optionalAttrs (cfg.group == name) {
+    users.groups = lib.optionalAttrs (cfg.group == name) {
       ${cfg.group} = { };
     };
 
-    networking.firewall = mkIf cfg.openFirewall {
+    networking.firewall = lib.mkIf cfg.openFirewall {
       allowedTCPPorts = [ 25 143 587 ];
     };
 
diff --git a/nixos/modules/services/mail/mail.nix b/nixos/modules/services/mail/mail.nix
index fcc7ff6db91b..afa5b242b298 100644
--- a/nixos/modules/services/mail/mail.nix
+++ b/nixos/modules/services/mail/mail.nix
@@ -1,7 +1,4 @@
 { config, options, lib, ... }:
-
-with lib;
-
 {
 
   ###### interface
@@ -10,8 +7,8 @@ with lib;
 
     services.mail = {
 
-      sendmailSetuidWrapper = mkOption {
-        type = types.nullOr options.security.wrappers.type.nestedTypes.elemType;
+      sendmailSetuidWrapper = lib.mkOption {
+        type = lib.types.nullOr options.security.wrappers.type.nestedTypes.elemType;
         default = null;
         internal = true;
         description = ''
@@ -25,7 +22,7 @@ with lib;
 
   ###### implementation
 
-  config = mkIf (config.services.mail.sendmailSetuidWrapper != null) {
+  config = lib.mkIf (config.services.mail.sendmailSetuidWrapper != null) {
 
     security.wrappers.sendmail = config.services.mail.sendmailSetuidWrapper;
 
diff --git a/nixos/modules/services/mail/mailhog.nix b/nixos/modules/services/mail/mailhog.nix
index 455e5095495e..93400167a209 100644
--- a/nixos/modules/services/mail/mailhog.nix
+++ b/nixos/modules/services/mail/mailhog.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.mailhog;
 
@@ -21,40 +18,40 @@ in
   ###### interface
 
   imports = [
-    (mkRemovedOptionModule [ "services" "mailhog" "user" ] "")
+    (lib.mkRemovedOptionModule [ "services" "mailhog" "user" ] "")
   ];
 
   options = {
 
     services.mailhog = {
-      enable = mkEnableOption "MailHog, web and API based SMTP testing";
+      enable = lib.mkEnableOption "MailHog, web and API based SMTP testing";
 
-      storage = mkOption {
-        type = types.enum [ "maildir" "memory" ];
+      storage = lib.mkOption {
+        type = lib.types.enum [ "maildir" "memory" ];
         default = "memory";
         description = "Store mails on disk or in memory.";
       };
 
-      apiPort = mkOption {
-        type = types.port;
+      apiPort = lib.mkOption {
+        type = lib.types.port;
         default = 8025;
         description = "Port on which the API endpoint will listen.";
       };
 
-      smtpPort = mkOption {
-        type = types.port;
+      smtpPort = lib.mkOption {
+        type = lib.types.port;
         default = 1025;
         description = "Port on which the SMTP endpoint will listen.";
       };
 
-      uiPort = mkOption {
-        type = types.port;
+      uiPort = lib.mkOption {
+        type = lib.types.port;
         default = 8025;
         description = "Port on which the HTTP UI will listen.";
       };
 
-      extraArgs = mkOption {
-        type = types.listOf types.str;
+      extraArgs = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [];
         description = "List of additional arguments to pass to the MailHog process.";
       };
@@ -64,7 +61,7 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     systemd.services.mailhog = {
       description = "MailHog - Web and API based SMTP testing";
diff --git a/nixos/modules/services/mail/mlmmj.nix b/nixos/modules/services/mail/mlmmj.nix
index 80fd6d9f4e57..ea0a7ad3144b 100644
--- a/nixos/modules/services/mail/mlmmj.nix
+++ b/nixos/modules/services/mail/mlmmj.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   concatMapLines = f: l: lib.concatStringsSep "\n" (map f l);
@@ -53,38 +50,38 @@ in
 
     services.mlmmj = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Enable mlmmj";
       };
 
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = "mlmmj";
         description = "mailinglist local user";
       };
 
-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
         default = "mlmmj";
         description = "mailinglist local group";
       };
 
-      listDomain = mkOption {
-        type = types.str;
+      listDomain = lib.mkOption {
+        type = lib.types.str;
         default = "localhost";
         description = "Set the mailing list domain";
       };
 
-      mailLists = mkOption {
-        type = types.listOf types.str;
+      mailLists = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [];
         description = "The collection of hosted maillists";
       };
 
-      maintInterval = mkOption {
-        type = types.str;
+      maintInterval = lib.mkOption {
+        type = lib.types.str;
         default = "20min";
         description = ''
           Time interval between mlmmj-maintd runs, see
@@ -98,7 +95,7 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     users.users.${cfg.user} = {
       description = "mlmmj user";
diff --git a/nixos/modules/services/mail/nullmailer.nix b/nixos/modules/services/mail/nullmailer.nix
index 55a85a354452..eb982ad00bd7 100644
--- a/nixos/modules/services/mail/nullmailer.nix
+++ b/nixos/modules/services/mail/nullmailer.nix
@@ -1,42 +1,39 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 {
 
   options = {
 
     services.nullmailer = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Whether to enable nullmailer daemon.";
       };
 
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = "nullmailer";
         description = ''
           User to use to run nullmailer-send.
         '';
       };
 
-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
         default = "nullmailer";
         description = ''
           Group to use to run nullmailer-send.
         '';
       };
 
-      setSendmail = mkOption {
-        type = types.bool;
+      setSendmail = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = "Whether to set the system sendmail to nullmailer's.";
       };
 
-      remotesFile = mkOption {
-        type = types.nullOr types.str;
+      remotesFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         description = ''
           Path to the `remotes` control file. This file contains a
@@ -48,8 +45,8 @@ with lib;
       };
 
       config = {
-        adminaddr = mkOption {
-          type = types.nullOr types.str;
+        adminaddr = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
           default = null;
           description = ''
             If set, all recipients to users at either "localhost" (the literal string)
@@ -61,16 +58,16 @@ with lib;
           '';
         };
 
-        allmailfrom = mkOption {
-          type = types.nullOr types.str;
+        allmailfrom = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
           default = null;
           description = ''
             If set, content will override the envelope sender on all messages.
           '';
         };
 
-        defaultdomain = mkOption {
-          type = types.nullOr types.str;
+        defaultdomain = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
           default = null;
           description = ''
              The content of this attribute is appended to any host name that
@@ -80,8 +77,8 @@ with lib;
           '';
         };
 
-        defaulthost = mkOption {
-          type = types.nullOr types.str;
+        defaulthost = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
           default = null;
           description = ''
              The content of this attribute is appended to any address that
@@ -90,8 +87,8 @@ with lib;
           '';
         };
 
-        doublebounceto = mkOption {
-          type = types.nullOr types.str;
+        doublebounceto = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
           default = null;
           description = ''
             If the original sender was empty (the original message was a
@@ -100,8 +97,8 @@ with lib;
           '';
         };
 
-        helohost = mkOption {
-          type = types.nullOr types.str;
+        helohost = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
           default = null;
           description = ''
             Sets  the  environment variable $HELOHOST which is used by the
@@ -110,8 +107,8 @@ with lib;
           '';
         };
 
-        idhost = mkOption {
-          type = types.nullOr types.str;
+        idhost = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
           default = null;
           description = ''
             The content of this attribute is used when building the message-id
@@ -119,8 +116,8 @@ with lib;
           '';
         };
 
-        maxpause = mkOption {
-          type = with types; nullOr (oneOf [ str int ]);
+        maxpause = lib.mkOption {
+          type = with lib.types; nullOr (oneOf [ str int ]);
           default = null;
           description = ''
              The maximum time to pause between successive queue runs, in seconds.
@@ -128,8 +125,8 @@ with lib;
           '';
         };
 
-        me = mkOption {
-          type = types.nullOr types.str;
+        me = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
           default = null;
           description = ''
              The fully-qualifiled host name of the computer running nullmailer.
@@ -137,8 +134,8 @@ with lib;
           '';
         };
 
-        pausetime = mkOption {
-          type = with types; nullOr (oneOf [ str int ]);
+        pausetime = lib.mkOption {
+          type = with lib.types; nullOr (oneOf [ str int ]);
           default = null;
           description = ''
             The minimum time to pause between successive queue runs when there
@@ -150,8 +147,8 @@ with lib;
           '';
         };
 
-        remotes = mkOption {
-          type = types.nullOr types.str;
+        remotes = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
           default = null;
           description = ''
             A list of remote servers to which to send each message. Each line
@@ -167,8 +164,8 @@ with lib;
           '';
         };
 
-        sendtimeout = mkOption {
-          type = with types; nullOr (oneOf [ str int ]);
+        sendtimeout = lib.mkOption {
+          type = with lib.types; nullOr (oneOf [ str int ]);
           default = null;
           description = ''
             The  time to wait for a remote module listed above to complete sending
@@ -183,7 +180,7 @@ with lib;
 
   config = let
     cfg = config.services.nullmailer;
-  in mkIf cfg.enable {
+  in lib.mkIf cfg.enable {
 
     assertions = [
       { assertion = cfg.config.remotes == null || cfg.remotesFile == null;
@@ -194,10 +191,10 @@ with lib;
     environment = {
       systemPackages = [ pkgs.nullmailer ];
       etc = let
-        validAttrs = lib.mapAttrs (_: toString) (filterAttrs (_: value: value != null) cfg.config);
+        validAttrs = lib.mapAttrs (_: toString) (lib.filterAttrs (_: value: value != null) cfg.config);
       in
-        (foldl' (as: name: as // { "nullmailer/${name}".text = validAttrs.${name}; }) {} (attrNames validAttrs))
-          // optionalAttrs (cfg.remotesFile != null) { "nullmailer/remotes".source = cfg.remotesFile; };
+        (lib.foldl' (as: name: as // { "nullmailer/${name}".text = validAttrs.${name}; }) {} (lib.attrNames validAttrs))
+          // lib.optionalAttrs (cfg.remotesFile != null) { "nullmailer/remotes".source = cfg.remotesFile; };
     };
 
     users = {
@@ -234,7 +231,7 @@ with lib;
       };
     };
 
-    services.mail.sendmailSetuidWrapper = mkIf cfg.setSendmail {
+    services.mail.sendmailSetuidWrapper = lib.mkIf cfg.setSendmail {
       program = "sendmail";
       source = "${pkgs.nullmailer}/bin/sendmail";
       owner = cfg.user;
diff --git a/nixos/modules/services/mail/offlineimap.nix b/nixos/modules/services/mail/offlineimap.nix
index f1517232c48d..6566a3cee11e 100644
--- a/nixos/modules/services/mail/offlineimap.nix
+++ b/nixos/modules/services/mail/offlineimap.nix
@@ -1,16 +1,13 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.offlineimap;
 in {
 
   options.services.offlineimap = {
-    enable = mkEnableOption "OfflineIMAP, a software to dispose your mailbox(es) as a local Maildir(s)";
+    enable = lib.mkEnableOption "OfflineIMAP, a software to dispose your mailbox(es) as a local Maildir(s)";
 
-    install = mkOption {
-      type = types.bool;
+    install = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''
         Whether to install a user service for Offlineimap. Once
@@ -22,28 +19,28 @@ in {
       '';
     };
 
-    package = mkPackageOption pkgs "offlineimap" { };
+    package = lib.mkPackageOption pkgs "offlineimap" { };
 
-    path = mkOption {
-      type = types.listOf types.path;
+    path = lib.mkOption {
+      type = lib.types.listOf lib.types.path;
       default = [];
-      example = literalExpression "[ pkgs.pass pkgs.bash pkgs.notmuch ]";
+      example = lib.literalExpression "[ pkgs.pass pkgs.bash pkgs.notmuch ]";
       description = "List of derivations to put in Offlineimap's path.";
     };
 
-    onCalendar = mkOption {
-      type = types.str;
+    onCalendar = lib.mkOption {
+      type = lib.types.str;
       default = "*:0/3"; # every 3 minutes
       description = "How often is offlineimap started. Default is '*:0/3' meaning every 3 minutes. See systemd.time(7) for more information about the format.";
     };
 
-    timeoutStartSec = mkOption {
-      type = types.str;
+    timeoutStartSec = lib.mkOption {
+      type = lib.types.str;
       default = "120sec"; # Kill if still alive after 2 minutes
       description = "How long waiting for offlineimap before killing it. Default is '120sec' meaning every 2 minutes. See systemd.time(7) for more information about the format.";
     };
   };
-  config = mkIf (cfg.enable || cfg.install) {
+  config = lib.mkIf (cfg.enable || cfg.install) {
     systemd.user.services.offlineimap = {
       description = "Offlineimap: a software to dispose your mailbox(es) as a local Maildir(s)";
       serviceConfig = {
@@ -62,6 +59,6 @@ in {
         # start immediately after computer is started:
         Persistent = "true";
       };
-    } // optionalAttrs cfg.enable { wantedBy = [ "default.target" ]; };
+    } // lib.optionalAttrs cfg.enable { wantedBy = [ "default.target" ]; };
   };
 }
diff --git a/nixos/modules/services/mail/opendkim.nix b/nixos/modules/services/mail/opendkim.nix
index 0460764ef094..dd29e5035089 100644
--- a/nixos/modules/services/mail/opendkim.nix
+++ b/nixos/modules/services/mail/opendkim.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   cfg = config.services.opendkim;
@@ -15,11 +12,11 @@ let
            "-d" cfg.domains
            "-k" keyFile
            "-s" cfg.selector
-         ] ++ optionals (cfg.configFile != null) [ "-x" cfg.configFile ];
+         ] ++ lib.optionals (cfg.configFile != null) [ "-x" cfg.configFile ];
 
 in {
   imports = [
-    (mkRenamedOptionModule [ "services" "opendkim" "keyFile" ] [ "services" "opendkim" "keyPath" ])
+    (lib.mkRenamedOptionModule [ "services" "opendkim" "keyFile" ] [ "services" "opendkim" "keyPath" ])
   ];
 
   ###### interface
@@ -28,34 +25,34 @@ in {
 
     services.opendkim = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Whether to enable the OpenDKIM sender authentication system.";
       };
 
-      socket = mkOption {
-        type = types.str;
+      socket = lib.mkOption {
+        type = lib.types.str;
         default = defaultSock;
         description = "Socket which is used for communication with OpenDKIM.";
       };
 
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = "opendkim";
         description = "User for the daemon.";
       };
 
-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
         default = "opendkim";
         description = "Group for the daemon.";
       };
 
-      domains = mkOption {
-        type = types.str;
+      domains = lib.mkOption {
+        type = lib.types.str;
         default = "csl:${config.networking.hostName}";
-        defaultText = literalExpression ''"csl:''${config.networking.hostName}"'';
+        defaultText = lib.literalExpression ''"csl:''${config.networking.hostName}"'';
         example = "csl:example.com,mydomain.net";
         description = ''
           Local domains set (see `opendkim(8)` for more information on datasets).
@@ -63,8 +60,8 @@ in {
         '';
       };
 
-      keyPath = mkOption {
-        type = types.path;
+      keyPath = lib.mkOption {
+        type = lib.types.path;
         description = ''
           The path that opendkim should put its generated private keys into.
           The DNS settings will be found in this directory with the name selector.txt.
@@ -72,13 +69,13 @@ in {
         default = "/var/lib/opendkim/keys";
       };
 
-      selector = mkOption {
-        type = types.str;
+      selector = lib.mkOption {
+        type = lib.types.str;
         description = "Selector to use when signing.";
       };
 
-      configFile = mkOption {
-        type = types.nullOr types.path;
+      configFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
         default = null;
         description = "Additional opendkim configuration.";
       };
@@ -90,16 +87,16 @@ in {
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
-    users.users = optionalAttrs (cfg.user == "opendkim") {
+    users.users = lib.optionalAttrs (cfg.user == "opendkim") {
       opendkim = {
         group = cfg.group;
         uid = config.ids.uids.opendkim;
       };
     };
 
-    users.groups = optionalAttrs (cfg.group == "opendkim") {
+    users.groups = lib.optionalAttrs (cfg.group == "opendkim") {
       opendkim.gid = config.ids.gids.opendkim;
     };
 
@@ -126,10 +123,10 @@ in {
       '';
 
       serviceConfig = {
-        ExecStart = "${pkgs.opendkim}/bin/opendkim ${escapeShellArgs args}";
+        ExecStart = "${pkgs.opendkim}/bin/opendkim ${lib.escapeShellArgs args}";
         User = cfg.user;
         Group = cfg.group;
-        RuntimeDirectory = optional (cfg.socket == defaultSock) "opendkim";
+        RuntimeDirectory = lib.optional (cfg.socket == defaultSock) "opendkim";
         StateDirectory = "opendkim";
         StateDirectoryMode = "0700";
         ReadWritePaths = [ cfg.keyPath ];
diff --git a/nixos/modules/services/mail/opensmtpd.nix b/nixos/modules/services/mail/opensmtpd.nix
index 88e7bc0193b5..07cf189fb28e 100644
--- a/nixos/modules/services/mail/opensmtpd.nix
+++ b/nixos/modules/services/mail/opensmtpd.nix
@@ -1,12 +1,9 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   cfg = config.services.opensmtpd;
   conf = pkgs.writeText "smtpd.conf" cfg.serverConfiguration;
-  args = concatStringsSep " " cfg.extraServerArgs;
+  args = lib.concatStringsSep " " cfg.extraServerArgs;
 
   sendmail = pkgs.runCommand "opensmtpd-sendmail" { preferLocalBuild = true; } ''
     mkdir -p $out/bin
@@ -18,29 +15,29 @@ in {
   ###### interface
 
   imports = [
-    (mkRenamedOptionModule [ "services" "opensmtpd" "addSendmailToSystemPath" ] [ "services" "opensmtpd" "setSendmail" ])
+    (lib.mkRenamedOptionModule [ "services" "opensmtpd" "addSendmailToSystemPath" ] [ "services" "opensmtpd" "setSendmail" ])
   ];
 
   options = {
 
     services.opensmtpd = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Whether to enable the OpenSMTPD server.";
       };
 
-      package = mkPackageOption pkgs "opensmtpd" { };
+      package = lib.mkPackageOption pkgs "opensmtpd" { };
 
-      setSendmail = mkOption {
-        type = types.bool;
+      setSendmail = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = "Whether to set the system sendmail to OpenSMTPD's.";
       };
 
-      extraServerArgs = mkOption {
-        type = types.listOf types.str;
+      extraServerArgs = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [];
         example = [ "-v" "-P mta" ];
         description = ''
@@ -49,8 +46,8 @@ in {
         '';
       };
 
-      serverConfiguration = mkOption {
-        type = types.lines;
+      serverConfiguration = lib.mkOption {
+        type = lib.types.lines;
         example = ''
           listen on lo
           accept for any deliver to lmtp localhost:24
@@ -61,8 +58,8 @@ in {
         '';
       };
 
-      procPackages = mkOption {
-        type = types.listOf types.package;
+      procPackages = lib.mkOption {
+        type = lib.types.listOf lib.types.package;
         default = [];
         description = ''
           Packages to search for filters, tables, queues, and schedulers.
@@ -78,7 +75,7 @@ in {
 
   ###### implementation
 
-  config = mkIf cfg.enable rec {
+  config = lib.mkIf cfg.enable rec {
     users.groups = {
       smtpd.gid = config.ids.gids.smtpd;
       smtpq.gid = config.ids.gids.smtpq;
@@ -105,7 +102,7 @@ in {
       source = "${cfg.package}/bin/smtpctl";
     };
 
-    services.mail.sendmailSetuidWrapper = mkIf cfg.setSendmail
+    services.mail.sendmailSetuidWrapper = lib.mkIf cfg.setSendmail
       (security.wrappers.smtpctl // { program = "sendmail"; });
 
     systemd.tmpfiles.rules = [
diff --git a/nixos/modules/services/mail/pfix-srsd.nix b/nixos/modules/services/mail/pfix-srsd.nix
index 7ad2b20454d0..d4176c509d7a 100644
--- a/nixos/modules/services/mail/pfix-srsd.nix
+++ b/nixos/modules/services/mail/pfix-srsd.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 {
 
   ###### interface
@@ -9,25 +6,25 @@ with lib;
   options = {
 
     services.pfix-srsd = {
-      enable = mkOption {
+      enable = lib.mkOption {
         default = false;
-        type = types.bool;
+        type = lib.types.bool;
         description = "Whether to run the postfix sender rewriting scheme daemon.";
       };
 
-      domain = mkOption {
+      domain = lib.mkOption {
         description = "The domain for which to enable srs";
-        type = types.str;
+        type = lib.types.str;
         example = "example.com";
       };
 
-      secretsFile = mkOption {
+      secretsFile = lib.mkOption {
         description = ''
           The secret data used to encode the SRS address.
           to generate, use a command like:
           `for n in $(seq 5); do dd if=/dev/urandom count=1 bs=1024 status=none | sha256sum | sed 's/  -$//' | sed 's/^/          /'; done`
         '';
-        type = types.path;
+        type = lib.types.path;
         default = "/var/lib/pfix-srsd/secrets";
       };
     };
@@ -35,7 +32,7 @@ with lib;
 
   ###### implementation
 
-  config = mkIf config.services.pfix-srsd.enable {
+  config = lib.mkIf config.services.pfix-srsd.enable {
     environment = {
       systemPackages = [ pkgs.pfixtools ];
     };
diff --git a/nixos/modules/services/mail/postfixadmin.nix b/nixos/modules/services/mail/postfixadmin.nix
index 87a9f963b195..7523fa4930ab 100644
--- a/nixos/modules/services/mail/postfixadmin.nix
+++ b/nixos/modules/services/mail/postfixadmin.nix
@@ -1,7 +1,4 @@
 { lib, config, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.postfixadmin;
   fpm = config.services.phpfpm.pools.postfixadmin;
@@ -10,8 +7,8 @@ let
 in
 {
   options.services.postfixadmin = {
-    enable = mkOption {
-      type = types.bool;
+    enable = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''
         Whether to enable postfixadmin.
@@ -22,14 +19,14 @@ in
       '';
     };
 
-    hostName = mkOption {
-      type = types.str;
+    hostName = lib.mkOption {
+      type = lib.types.str;
       example = "postfixadmin.example.com";
       description = "Hostname to use for the nginx vhost";
     };
 
-    adminEmail = mkOption {
-      type = types.str;
+    adminEmail = lib.mkOption {
+      type = lib.types.str;
       example = "postmaster@example.com";
       description = ''
         Defines the Site Admin's email address.
@@ -38,8 +35,8 @@ in
       '';
     };
 
-    setupPasswordFile = mkOption {
-      type = types.path;
+    setupPasswordFile = lib.mkOption {
+      type = lib.types.path;
       description = ''
         Password file for the admin.
         Generate with `php -r "echo password_hash('some password here', PASSWORD_DEFAULT);"`
@@ -47,16 +44,16 @@ in
     };
 
     database = {
-      username = mkOption {
-        type = types.str;
+      username = lib.mkOption {
+        type = lib.types.str;
         default = "postfixadmin";
         description = ''
           Username for the postgresql connection.
           If `database.host` is set to `localhost`, a unix user and group of the same name will be created as well.
         '';
       };
-      host = mkOption {
-        type = types.str;
+      host = lib.mkOption {
+        type = lib.types.str;
         default = "localhost";
         description = ''
           Host of the postgresql server. If this is not set to
@@ -65,25 +62,25 @@ in
           permissions.
         '';
       };
-      passwordFile = mkOption {
-        type = types.path;
+      passwordFile = lib.mkOption {
+        type = lib.types.path;
         description = "Password file for the postgresql connection. Must be readable by user `nginx`.";
       };
-      dbname = mkOption {
-        type = types.str;
+      dbname = lib.mkOption {
+        type = lib.types.str;
         default = "postfixadmin";
         description = "Name of the postgresql database";
       };
     };
 
-    extraConfig = mkOption {
-      type = types.lines;
+    extraConfig = lib.mkOption {
+      type = lib.types.lines;
       default = "";
       description = "Extra configuration for the postfixadmin instance, see postfixadmin's config.inc.php for available options.";
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     environment.etc."postfixadmin/config.local.php".text = ''
       <?php
 
@@ -91,7 +88,7 @@ in
 
       $CONF['database_type'] = 'pgsql';
       $CONF['database_host'] = ${if localDB then "null" else "'${cfg.database.host}'"};
-      ${optionalString localDB "$CONF['database_user'] = '${cfg.database.username}';"}
+      ${lib.optionalString localDB "$CONF['database_user'] = '${cfg.database.username}';"}
       $CONF['database_password'] = ${if localDB then "'dummy'" else "file_get_contents('${cfg.database.passwordFile}')"};
       $CONF['database_name'] = '${cfg.database.dbname}';
       $CONF['configured'] = true;
@@ -109,8 +106,8 @@ in
       enable = true;
       virtualHosts = {
         ${cfg.hostName} = {
-          forceSSL = mkDefault true;
-          enableACME = mkDefault true;
+          forceSSL = lib.mkDefault true;
+          enableACME = lib.mkDefault true;
           locations."/" = {
             root = "${pkgs.postfixadmin}/public";
             index = "index.php";
@@ -127,7 +124,7 @@ in
       };
     };
 
-    services.postgresql = mkIf localDB {
+    services.postgresql = lib.mkIf localDB {
       enable = true;
       ensureUsers = [ {
         name = cfg.database.username;
@@ -136,7 +133,7 @@ in
     # The postgresql module doesn't currently support concepts like
     # objects owners and extensions; for now we tack on what's needed
     # here.
-    systemd.services.postfixadmin-postgres = let pgsql = config.services.postgresql; in mkIf localDB {
+    systemd.services.postfixadmin-postgres = let pgsql = config.services.postgresql; in lib.mkIf localDB {
       after = [ "postgresql.service" ];
       bindsTo = [ "postgresql.service" ];
       wantedBy = [ "multi-user.target" ];
@@ -172,12 +169,12 @@ in
       };
     };
 
-    users.users.${user} = mkIf localDB {
+    users.users.${user} = lib.mkIf localDB {
       group = user;
       isSystemUser = true;
       createHome = false;
     };
-    users.groups.${user} = mkIf localDB {};
+    users.groups.${user} = lib.mkIf localDB {};
 
     services.phpfpm.pools.postfixadmin = {
       user = user;
@@ -186,7 +183,7 @@ in
         error_log = 'stderr'
         log_errors = on
       '';
-      settings = mapAttrs (name: mkDefault) {
+      settings = lib.mapAttrs (name: lib.mkDefault) {
         "listen.owner" = "nginx";
         "listen.group" = "nginx";
         "listen.mode" = "0660";
diff --git a/nixos/modules/services/mail/postsrsd.nix b/nixos/modules/services/mail/postsrsd.nix
index 92f01dd4101e..f94d3942b5e3 100644
--- a/nixos/modules/services/mail/postsrsd.nix
+++ b/nixos/modules/services/mail/postsrsd.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   cfg = config.services.postsrsd;
@@ -14,67 +11,67 @@ in {
 
     services.postsrsd = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Whether to enable the postsrsd SRS server for Postfix.";
       };
 
-      secretsFile = mkOption {
-        type = types.path;
+      secretsFile = lib.mkOption {
+        type = lib.types.path;
         default = "/var/lib/postsrsd/postsrsd.secret";
         description = "Secret keys used for signing and verification";
       };
 
-      domain = mkOption {
-        type = types.str;
+      domain = lib.mkOption {
+        type = lib.types.str;
         description = "Domain name for rewrite";
       };
 
-      separator = mkOption {
-        type = types.enum ["-" "=" "+"];
+      separator = lib.mkOption {
+        type = lib.types.enum ["-" "=" "+"];
         default = "=";
         description = "First separator character in generated addresses";
       };
 
-      # bindAddress = mkOption { # uncomment once 1.5 is released
-      #   type = types.str;
+      # bindAddress = lib.mkOption { # uncomment once 1.5 is released
+      #   type = lib.types.str;
       #   default = "127.0.0.1";
       #   description = "Socket listen address";
       # };
 
-      forwardPort = mkOption {
-        type = types.int;
+      forwardPort = lib.mkOption {
+        type = lib.types.int;
         default = 10001;
         description = "Port for the forward SRS lookup";
       };
 
-      reversePort = mkOption {
-        type = types.int;
+      reversePort = lib.mkOption {
+        type = lib.types.int;
         default = 10002;
         description = "Port for the reverse SRS lookup";
       };
 
-      timeout = mkOption {
-        type = types.int;
+      timeout = lib.mkOption {
+        type = lib.types.int;
         default = 1800;
         description = "Timeout for idle client connections in seconds";
       };
 
-      excludeDomains = mkOption {
-        type = types.listOf types.str;
+      excludeDomains = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [];
         description = "Origin domains to exclude from rewriting in addition to primary domain";
       };
 
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = "postsrsd";
         description = "User for the daemon";
       };
 
-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
         default = "postsrsd";
         description = "Group for the daemon";
       };
@@ -86,18 +83,18 @@ in {
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
-    services.postsrsd.domain = mkDefault config.networking.hostName;
+    services.postsrsd.domain = lib.mkDefault config.networking.hostName;
 
-    users.users = optionalAttrs (cfg.user == "postsrsd") {
+    users.users = lib.optionalAttrs (cfg.user == "postsrsd") {
       postsrsd = {
         group = cfg.group;
         uid = config.ids.uids.postsrsd;
       };
     };
 
-    users.groups = optionalAttrs (cfg.group == "postsrsd") {
+    users.groups = lib.optionalAttrs (cfg.group == "postsrsd") {
       postsrsd.gid = config.ids.gids.postsrsd;
     };
 
@@ -110,7 +107,7 @@ in {
       path = [ pkgs.coreutils ];
 
       serviceConfig = {
-        ExecStart = ''${pkgs.postsrsd}/sbin/postsrsd "-s${cfg.secretsFile}" "-d${cfg.domain}" -a${cfg.separator} -f${toString cfg.forwardPort} -r${toString cfg.reversePort} -t${toString cfg.timeout} "-X${concatStringsSep "," cfg.excludeDomains}"'';
+        ExecStart = ''${pkgs.postsrsd}/sbin/postsrsd "-s${cfg.secretsFile}" "-d${cfg.domain}" -a${cfg.separator} -f${toString cfg.forwardPort} -r${toString cfg.reversePort} -t${toString cfg.timeout} "-X${lib.concatStringsSep "," cfg.excludeDomains}"'';
         User = cfg.user;
         Group = cfg.group;
         PermissionsStartOnly = true;
diff --git a/nixos/modules/services/mail/roundcube.nix b/nixos/modules/services/mail/roundcube.nix
index 2914877bdccd..1a9a3bdf26b9 100644
--- a/nixos/modules/services/mail/roundcube.nix
+++ b/nixos/modules/services/mail/roundcube.nix
@@ -1,7 +1,4 @@
 { lib, config, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.roundcube;
   fpm = config.services.phpfpm.pools.roundcube;
@@ -11,8 +8,8 @@ let
 in
 {
   options.services.roundcube = {
-    enable = mkOption {
-      type = types.bool;
+    enable = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''
         Whether to enable roundcube.
@@ -23,27 +20,27 @@ in
       '';
     };
 
-    hostName = mkOption {
-      type = types.str;
+    hostName = lib.mkOption {
+      type = lib.types.str;
       example = "webmail.example.com";
       description = "Hostname to use for the nginx vhost";
     };
 
-    package = mkPackageOption pkgs "roundcube" {
+    package = lib.mkPackageOption pkgs "roundcube" {
       example = "roundcube.withPlugins (plugins: [ plugins.persistent_login ])";
     };
 
     database = {
-      username = mkOption {
-        type = types.str;
+      username = lib.mkOption {
+        type = lib.types.str;
         default = "roundcube";
         description = ''
           Username for the postgresql connection.
           If `database.host` is set to `localhost`, a unix user and group of the same name will be created as well.
         '';
       };
-      host = mkOption {
-        type = types.str;
+      host = lib.mkOption {
+        type = lib.types.str;
         default = "localhost";
         description = ''
           Host of the postgresql server. If this is not set to
@@ -52,13 +49,13 @@ in
           permissions.
         '';
       };
-      password = mkOption {
-        type = types.str;
+      password = lib.mkOption {
+        type = lib.types.str;
         description = "Password for the postgresql connection. Do not use: the password will be stored world readable in the store; use `passwordFile` instead.";
         default = "";
       };
-      passwordFile = mkOption {
-        type = types.str;
+      passwordFile = lib.mkOption {
+        type = lib.types.str;
         description = ''
           Password file for the postgresql connection.
           Must be formatted according to PostgreSQL .pgpass standard (see https://www.postgresql.org/docs/current/libpq-pgpass.html)
@@ -66,32 +63,32 @@ in
           Ignored if `database.host` is set to `localhost`, as peer authentication will be used.
         '';
       };
-      dbname = mkOption {
-        type = types.str;
+      dbname = lib.mkOption {
+        type = lib.types.str;
         default = "roundcube";
         description = "Name of the postgresql database";
       };
     };
 
-    plugins = mkOption {
-      type = types.listOf types.str;
+    plugins = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
       default = [];
       description = ''
         List of roundcube plugins to enable. Currently, only those directly shipped with Roundcube are supported.
       '';
     };
 
-    dicts = mkOption {
-      type = types.listOf types.package;
+    dicts = lib.mkOption {
+      type = lib.types.listOf lib.types.package;
       default = [];
-      example = literalExpression "with pkgs.aspellDicts; [ en fr de ]";
+      example = lib.literalExpression "with pkgs.aspellDicts; [ en fr de ]";
       description = ''
         List of aspell dictionaries for spell checking. If empty, spell checking is disabled.
       '';
     };
 
-    maxAttachmentSize = mkOption {
-      type = types.int;
+    maxAttachmentSize = lib.mkOption {
+      type = lib.types.int;
       default = 18;
       apply = configuredMaxAttachmentSize: "${toString (configuredMaxAttachmentSize * 1.37)}M";
       description = ''
@@ -112,16 +109,16 @@ in
       description = "Configure nginx as a reverse proxy for roundcube.";
     };
 
-    extraConfig = mkOption {
-      type = types.lines;
+    extraConfig = lib.mkOption {
+      type = lib.types.lines;
       default = "";
       description = "Extra configuration for roundcube webmail instance";
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     # backward compatibility: if password is set but not passwordFile, make one.
-    services.roundcube.database.passwordFile = mkIf (!localDB && cfg.database.password != "") (mkDefault ("${pkgs.writeText "roundcube-password" cfg.database.password}"));
+    services.roundcube.database.passwordFile = lib.mkIf (!localDB && cfg.database.password != "") (lib.mkDefault ("${pkgs.writeText "roundcube-password" cfg.database.password}"));
     warnings = lib.optional (!localDB && cfg.database.password != "") "services.roundcube.database.password is deprecated and insecure; use services.roundcube.database.passwordFile instead";
 
     environment.etc."roundcube/config.inc.php".text = ''
@@ -139,7 +136,7 @@ in
       $config['db_dsnw'] = 'pgsql://${cfg.database.username}${lib.optionalString (!localDB) ":' . $password . '"}@${if localDB then "unix(/run/postgresql)" else cfg.database.host}/${cfg.database.dbname}';
       $config['log_driver'] = 'syslog';
       $config['max_message_size'] =  '${cfg.maxAttachmentSize}';
-      $config['plugins'] = [${concatMapStringsSep "," (p: "'${p}'") cfg.plugins}];
+      $config['plugins'] = [${lib.concatMapStringsSep "," (p: "'${p}'") cfg.plugins}];
       $config['des_key'] = file_get_contents('/var/lib/roundcube/des_key');
       $config['mime_types'] = '${pkgs.nginx}/conf/mime.types';
       # Roundcube uses PHP-FPM which has `PrivateTmp = true;`
@@ -156,8 +153,8 @@ in
       enable = true;
       virtualHosts = {
         ${cfg.hostName} = {
-          forceSSL = mkDefault true;
-          enableACME = mkDefault true;
+          forceSSL = lib.mkDefault true;
+          enableACME = lib.mkDefault true;
           root = cfg.package;
           locations."/" = {
             index = "index.php";
@@ -201,7 +198,7 @@ in
       }
     ];
 
-    services.postgresql = mkIf localDB {
+    services.postgresql = lib.mkIf localDB {
       enable = true;
       ensureDatabases = [ cfg.database.dbname ];
       ensureUsers = [ {
@@ -210,12 +207,12 @@ in
       } ];
     };
 
-    users.users.${user} = mkIf localDB {
+    users.users.${user} = lib.mkIf localDB {
       group = user;
       isSystemUser = true;
       createHome = false;
     };
-    users.groups.${user} = mkIf localDB {};
+    users.groups.${user} = lib.mkIf localDB {};
 
     services.phpfpm.pools.roundcube = {
       user = if localDB then user else "nginx";
@@ -225,7 +222,7 @@ in
         post_max_size = ${cfg.maxAttachmentSize}
         upload_max_filesize = ${cfg.maxAttachmentSize}
       '';
-      settings = mapAttrs (name: mkDefault) {
+      settings = lib.mapAttrs (name: lib.mkDefault) {
         "listen.owner" = "nginx";
         "listen.group" = "nginx";
         "listen.mode" = "0660";
@@ -247,8 +244,8 @@ in
       config.environment.etc."roundcube/config.inc.php".source
     ];
 
-    systemd.services.roundcube-setup = mkMerge [
-      (mkIf (cfg.database.host == "localhost") {
+    systemd.services.roundcube-setup = lib.mkMerge [
+      (lib.mkIf (cfg.database.host == "localhost") {
         requires = [ "postgresql.service" ];
         after = [ "postgresql.service" ];
       })
diff --git a/nixos/modules/services/mail/spamassassin.nix b/nixos/modules/services/mail/spamassassin.nix
index e51cc0239a82..fbe4cc82adb9 100644
--- a/nixos/modules/services/mail/spamassassin.nix
+++ b/nixos/modules/services/mail/spamassassin.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.spamassassin;
   spamassassin-local-cf = pkgs.writeText "local.cf" cfg.config;
@@ -12,16 +9,16 @@ in
   options = {
 
     services.spamassassin = {
-      enable = mkEnableOption "the SpamAssassin daemon";
+      enable = lib.mkEnableOption "the SpamAssassin daemon";
 
-      debug = mkOption {
-        type = types.bool;
+      debug = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Whether to run the SpamAssassin daemon in debug mode";
       };
 
-      config = mkOption {
-        type = types.lines;
+      config = lib.mkOption {
+        type = lib.types.lines;
         description = ''
           The SpamAssassin local.cf config
 
@@ -55,8 +52,8 @@ in
         default = "";
       };
 
-      initPreConf = mkOption {
-        type = with types; either str path;
+      initPreConf = lib.mkOption {
+        type = with lib.types; either str path;
         description = "The SpamAssassin init.pre config.";
         apply = val: if builtins.isPath val then val else pkgs.writeText "init.pre" val;
         default =
@@ -111,7 +108,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     environment.etc."mail/spamassassin/init.pre".source = cfg.initPreConf;
     environment.etc."mail/spamassassin/local.cf".source = spamassassin-local-cf;
 
@@ -185,7 +182,7 @@ in
       serviceConfig = {
         User = "spamd";
         Group = "spamd";
-        ExecStart = "+${pkgs.spamassassin}/bin/spamd ${optionalString cfg.debug "-D"} --username=spamd --groupname=spamd --virtual-config-dir=%S/spamassassin/user-%u --allow-tell --pidfile=/run/spamd.pid";
+        ExecStart = "+${pkgs.spamassassin}/bin/spamd ${lib.optionalString cfg.debug "-D"} --username=spamd --groupname=spamd --virtual-config-dir=%S/spamassassin/user-%u --allow-tell --pidfile=/run/spamd.pid";
         ExecReload = "+${pkgs.coreutils}/bin/kill -HUP $MAINPID";
         StateDirectory = "spamassassin";
       };
diff --git a/nixos/modules/services/mail/stalwart-mail.nix b/nixos/modules/services/mail/stalwart-mail.nix
index 1025788f0d84..fe433f9a2662 100644
--- a/nixos/modules/services/mail/stalwart-mail.nix
+++ b/nixos/modules/services/mail/stalwart-mail.nix
@@ -1,29 +1,26 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.stalwart-mail;
   configFormat = pkgs.formats.toml { };
   configFile = configFormat.generate "stalwart-mail.toml" cfg.settings;
   dataDir = "/var/lib/stalwart-mail";
-  useLegacyStorage = versionOlder config.system.stateVersion "24.11";
+  useLegacyStorage = lib.versionOlder config.system.stateVersion "24.11";
 
   parsePorts = listeners: let
     parseAddresses = listeners: lib.flatten(lib.mapAttrsToList (name: value: value.bind) listeners);
-    splitAddress = addr: strings.splitString ":" addr;
-    extractPort = addr: strings.toInt(builtins.foldl' (a: b: b) "" (splitAddress addr));
+    splitAddress = addr: lib.splitString ":" addr;
+    extractPort = addr: lib.toInt(builtins.foldl' (a: b: b) "" (splitAddress addr));
   in
     builtins.map(address: extractPort address) (parseAddresses listeners);
 
 in {
   options.services.stalwart-mail = {
-    enable = mkEnableOption "the Stalwart all-in-one email server";
+    enable = lib.mkEnableOption "the Stalwart all-in-one email server";
 
-    package = mkPackageOption pkgs "stalwart-mail" { };
+    package = lib.mkPackageOption pkgs "stalwart-mail" { };
 
-    openFirewall = mkOption {
-      type = types.bool;
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''
         Whether to open TCP firewall ports, which are specified in
@@ -31,7 +28,7 @@ in {
       '';
     };
 
-    settings = mkOption {
+    settings = lib.mkOption {
       inherit (configFormat) type;
       default = { };
       description = ''
@@ -43,36 +40,36 @@ in {
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     # Default config: all local
     services.stalwart-mail.settings = {
       tracer.stdout = {
-        type = mkDefault "stdout";
-        level = mkDefault "info";
-        ansi = mkDefault false;  # no colour markers to journald
-        enable = mkDefault true;
+        type = lib.mkDefault "stdout";
+        level = lib.mkDefault "info";
+        ansi = lib.mkDefault false;  # no colour markers to journald
+        enable = lib.mkDefault true;
       };
       store = if useLegacyStorage then {
         # structured data in SQLite, blobs on filesystem
-        db.type = mkDefault "sqlite";
-        db.path = mkDefault "${dataDir}/data/index.sqlite3";
-        fs.type = mkDefault "fs";
-        fs.path = mkDefault "${dataDir}/data/blobs";
+        db.type = lib.mkDefault "sqlite";
+        db.path = lib.mkDefault "${dataDir}/data/index.sqlite3";
+        fs.type = lib.mkDefault "fs";
+        fs.path = lib.mkDefault "${dataDir}/data/blobs";
       } else {
         # everything in RocksDB
-        db.type = mkDefault "rocksdb";
-        db.path = mkDefault "${dataDir}/db";
-        db.compression = mkDefault "lz4";
+        db.type = lib.mkDefault "rocksdb";
+        db.path = lib.mkDefault "${dataDir}/db";
+        db.compression = lib.mkDefault "lz4";
       };
-      storage.data = mkDefault "db";
-      storage.fts = mkDefault "db";
-      storage.lookup = mkDefault "db";
-      storage.blob = mkDefault (if useLegacyStorage then "fs" else "db");
-      directory.internal.type = mkDefault "internal";
-      directory.internal.store = mkDefault "db";
-      storage.directory = mkDefault "internal";
-      resolver.type = mkDefault "system";
+      storage.data = lib.mkDefault "db";
+      storage.fts = lib.mkDefault "db";
+      storage.lookup = lib.mkDefault "db";
+      storage.blob = lib.mkDefault (if useLegacyStorage then "fs" else "db");
+      directory.internal.type = lib.mkDefault "internal";
+      directory.internal.store = lib.mkDefault "db";
+      storage.directory = lib.mkDefault "internal";
+      resolver.type = lib.mkDefault "system";
       resolver.public-suffix = lib.mkDefault [
         "file://${pkgs.publicsuffix-list}/share/publicsuffix/public_suffix_list.dat"
       ];
@@ -155,13 +152,13 @@ in {
     # Make admin commands available in the shell
     environment.systemPackages = [ cfg.package ];
 
-    networking.firewall = mkIf (cfg.openFirewall
+    networking.firewall = lib.mkIf (cfg.openFirewall
       && (builtins.hasAttr "listener" cfg.settings.server)) {
       allowedTCPPorts = parsePorts cfg.settings.server.listener;
     };
   };
 
   meta = {
-    maintainers = with maintainers; [ happysalada pacien onny ];
+    maintainers = with lib.maintainers; [ happysalada pacien onny ];
   };
 }
diff --git a/nixos/modules/services/mail/zeyple.nix b/nixos/modules/services/mail/zeyple.nix
index 6f6a1799bc0a..2f9164f700fe 100644
--- a/nixos/modules/services/mail/zeyple.nix
+++ b/nixos/modules/services/mail/zeyple.nix
@@ -1,6 +1,4 @@
 { config, pkgs, lib, ... }:
-
-with lib;
 let
   cfg = config.services.zeyple;
   ini = pkgs.formats.ini { };
@@ -16,10 +14,10 @@ let
   '';
 in {
   options.services.zeyple = {
-    enable = mkEnableOption "Zeyple, an utility program to automatically encrypt outgoing emails with GPG";
+    enable = lib.mkEnableOption "Zeyple, an utility program to automatically encrypt outgoing emails with GPG";
 
-    user = mkOption {
-      type = types.str;
+    user = lib.mkOption {
+      type = lib.types.str;
       default = "zeyple";
       description = ''
         User to run Zeyple as.
@@ -32,8 +30,8 @@ in {
       '';
     };
 
-    group = mkOption {
-      type = types.str;
+    group = lib.mkOption {
+      type = lib.types.str;
       default = "zeyple";
       description = ''
         Group to use to run Zeyple.
@@ -46,7 +44,7 @@ in {
       '';
     };
 
-    settings = mkOption {
+    settings = lib.mkOption {
       type = ini.type;
       default = { };
       description = ''
@@ -56,21 +54,21 @@ in {
       '';
     };
 
-    keys = mkOption {
-      type = with types; listOf path;
+    keys = lib.mkOption {
+      type = with lib.types; listOf path;
       description = "List of public key files that will be imported by gpg.";
     };
 
-    rotateLogs = mkOption {
-      type = types.bool;
+    rotateLogs = lib.mkOption {
+      type = lib.types.bool;
       default = true;
       description = "Whether to enable rotation of log files.";
     };
   };
 
-  config = mkIf cfg.enable {
-    users.groups = optionalAttrs (cfg.group == "zeyple") { "${cfg.group}" = { }; };
-    users.users = optionalAttrs (cfg.user == "zeyple") {
+  config = lib.mkIf cfg.enable {
+    users.groups = lib.optionalAttrs (cfg.group == "zeyple") { "${cfg.group}" = { }; };
+    users.users = lib.optionalAttrs (cfg.user == "zeyple") {
       "${cfg.user}" = {
         isSystemUser = true;
         group = cfg.group;
@@ -78,14 +76,14 @@ in {
     };
 
     services.zeyple.settings = {
-      zeyple = mapAttrs (name: mkDefault) {
+      zeyple = lib.mapAttrs (name: lib.mkDefault) {
         log_file = "/var/log/zeyple/zeyple.log";
         force_encrypt = true;
       };
 
-      gpg = mapAttrs (name: mkDefault) { home = "${gpgHome}"; };
+      gpg = lib.mapAttrs (name: lib.mkDefault) { home = "${gpgHome}"; };
 
-      relay = mapAttrs (name: mkDefault) {
+      relay = lib.mapAttrs (name: lib.mkDefault) {
         host = "localhost";
         port = 10026;
       };
@@ -98,7 +96,7 @@ in {
       mode = "0600";
     };
 
-    services.logrotate = mkIf cfg.rotateLogs {
+    services.logrotate = lib.mkIf cfg.rotateLogs {
       enable = true;
       settings.zeyple = {
         files = cfg.settings.zeyple.log_file;
diff --git a/nixos/modules/services/matrix/appservice-discord.nix b/nixos/modules/services/matrix/appservice-discord.nix
index 7f3a1ed3e20a..cbe265d35944 100644
--- a/nixos/modules/services/matrix/appservice-discord.nix
+++ b/nixos/modules/services/matrix/appservice-discord.nix
@@ -1,7 +1,4 @@
 { config, options, pkgs, lib, ... }:
-
-with lib;
-
 let
   dataDir = "/var/lib/matrix-appservice-discord";
   registrationFile = "${dataDir}/discord-registration.yaml";
@@ -13,14 +10,14 @@ let
 in {
   options = {
     services.matrix-appservice-discord = {
-      enable = mkEnableOption "a bridge between Matrix and Discord";
+      enable = lib.mkEnableOption "a bridge between Matrix and Discord";
 
-      package = mkPackageOption pkgs "matrix-appservice-discord" { };
+      package = lib.mkPackageOption pkgs "matrix-appservice-discord" { };
 
-      settings = mkOption rec {
-        # TODO: switch to types.config.json as prescribed by RFC42 once it's implemented
-        type = types.attrs;
-        apply = recursiveUpdate default;
+      settings = lib.mkOption rec {
+        # TODO: switch to lib.types.config.json as prescribed by RFC42 once it's implemented
+        type = lib.types.attrs;
+        apply = lib.recursiveUpdate default;
         default = {
           database = {
             filename = "${dataDir}/discord.db";
@@ -33,7 +30,7 @@ in {
             botToken = "";
           };
         };
-        example = literalExpression ''
+        example = lib.literalExpression ''
           {
             bridge = {
               domain = "public-domain.tld";
@@ -55,8 +52,8 @@ in {
         '';
       };
 
-      environmentFile = mkOption {
-        type = types.nullOr types.path;
+      environmentFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
         default = null;
         description = ''
           File containing environment variables to be passed to the matrix-appservice-discord service,
@@ -66,36 +63,36 @@ in {
         '';
       };
 
-      url = mkOption {
-        type = types.str;
+      url = lib.mkOption {
+        type = lib.types.str;
         default = "http://localhost:${toString cfg.port}";
-        defaultText = literalExpression ''"http://localhost:''${toString config.${opt.port}}"'';
+        defaultText = lib.literalExpression ''"http://localhost:''${toString config.${opt.port}}"'';
         description = ''
           The URL where the application service is listening for HS requests.
         '';
       };
 
-      port = mkOption {
-        type = types.port;
+      port = lib.mkOption {
+        type = lib.types.port;
         default = 9005; # from https://github.com/Half-Shot/matrix-appservice-discord/blob/master/package.json#L11
         description = ''
           Port number on which the bridge should listen for internal communication with the Matrix homeserver.
         '';
       };
 
-      localpart = mkOption {
-        type = with types; nullOr str;
+      localpart = lib.mkOption {
+        type = with lib.types; nullOr str;
         default = null;
         description = ''
           The user_id localpart to assign to the AS.
         '';
       };
 
-      serviceDependencies = mkOption {
-        type = with types; listOf str;
-        default = optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit;
-        defaultText = literalExpression ''
-          optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit
+      serviceDependencies = lib.mkOption {
+        type = with lib.types; listOf str;
+        default = lib.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit;
+        defaultText = lib.literalExpression ''
+          lib.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit
         '';
         description = ''
           List of Systemd services to require and wait for when starting the application service,
@@ -105,7 +102,7 @@ in {
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.matrix-appservice-discord = {
       description = "A bridge between Matrix and Discord.";
 
@@ -117,8 +114,8 @@ in {
         if [ ! -f '${registrationFile}' ]; then
           ${cfg.package}/bin/matrix-appservice-discord \
             --generate-registration \
-            --url=${escapeShellArg cfg.url} \
-            ${optionalString (cfg.localpart != null) "--localpart=${escapeShellArg cfg.localpart}"} \
+            --url=${lib.escapeShellArg cfg.url} \
+            ${lib.optionalString (cfg.localpart != null) "--localpart=${lib.escapeShellArg cfg.localpart}"} \
             --config='${settingsFile}' \
             --file='${registrationFile}'
         fi
@@ -151,5 +148,5 @@ in {
     };
   };
 
-  meta.maintainers = with maintainers; [ pacien ];
+  meta.maintainers = with lib.maintainers; [ pacien ];
 }
diff --git a/nixos/modules/services/matrix/appservice-irc.nix b/nixos/modules/services/matrix/appservice-irc.nix
index f4539a90f2e6..55a04059abe4 100644
--- a/nixos/modules/services/matrix/appservice-irc.nix
+++ b/nixos/modules/services/matrix/appservice-irc.nix
@@ -1,7 +1,4 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   cfg = config.services.matrix-appservice-irc;
 
@@ -25,29 +22,29 @@ let
   '';
   registrationFile = "/var/lib/matrix-appservice-irc/registration.yml";
 in {
-  options.services.matrix-appservice-irc = with types; {
-    enable = mkEnableOption "the Matrix/IRC bridge";
+  options.services.matrix-appservice-irc = with lib.types; {
+    enable = lib.mkEnableOption "the Matrix/IRC bridge";
 
-    port = mkOption {
+    port = lib.mkOption {
       type = port;
       description = "The port to listen on";
       default = 8009;
     };
 
-    needBindingCap = mkOption {
+    needBindingCap = lib.mkOption {
       type = bool;
       description = "Whether the daemon needs to bind to ports below 1024 (e.g. for the ident service)";
       default = false;
     };
 
-    passwordEncryptionKeyLength = mkOption {
+    passwordEncryptionKeyLength = lib.mkOption {
       type = ints.unsigned;
       description = "Length of the key to encrypt IRC passwords with";
       default = 4096;
       example = 8192;
     };
 
-    registrationUrl = mkOption {
+    registrationUrl = lib.mkOption {
       type = str;
       description = ''
         The URL where the application service is listening for homeserver requests,
@@ -56,13 +53,13 @@ in {
       example = "http://localhost:8009";
     };
 
-    localpart = mkOption {
+    localpart = lib.mkOption {
       type = str;
       description = "The user_id localpart to assign to the appservice";
       default = "appservice-irc";
     };
 
-    settings = mkOption {
+    settings = lib.mkOption {
       description = ''
         Configuration for the appservice, see
         <https://github.com/matrix-org/matrix-appservice-irc/blob/${pkgs.matrix-appservice-irc.version}/config.sample.yaml>
@@ -73,19 +70,19 @@ in {
         freeformType = jsonType;
 
         options = {
-          homeserver = mkOption {
+          homeserver = lib.mkOption {
             description = "Homeserver configuration";
             default = {};
             type = submodule {
               freeformType = jsonType;
 
               options = {
-                url = mkOption {
+                url = lib.mkOption {
                   type = str;
                   description = "The URL to the home server for client-server API calls";
                 };
 
-                domain = mkOption {
+                domain = lib.mkOption {
                   type = str;
                   description = ''
                     The 'domain' part for user IDs on this home server. Usually
@@ -96,21 +93,21 @@ in {
             };
           };
 
-          database = mkOption {
+          database = lib.mkOption {
             default = {};
             description = "Configuration for the database";
             type = submodule {
               freeformType = jsonType;
 
               options = {
-                engine = mkOption {
+                engine = lib.mkOption {
                   type = str;
                   description = "Which database engine to use";
                   default = "nedb";
                   example = "postgres";
                 };
 
-                connectionString = mkOption {
+                connectionString = lib.mkOption {
                   type = str;
                   description = "The database connection string";
                   default = "nedb://var/lib/matrix-appservice-irc/data";
@@ -120,14 +117,14 @@ in {
             };
           };
 
-          ircService = mkOption {
+          ircService = lib.mkOption {
             default = {};
             description = "IRC bridge configuration";
             type = submodule {
               freeformType = jsonType;
 
               options = {
-                passwordEncryptionKeyPath = mkOption {
+                passwordEncryptionKeyPath = lib.mkOption {
                   type = str;
                   description = ''
                     Location of the key with which IRC passwords are encrypted
@@ -136,7 +133,7 @@ in {
                   default = "/var/lib/matrix-appservice-irc/passkey.pem";
                 };
 
-                servers = mkOption {
+                servers = lib.mkOption {
                   type = submodule { freeformType = jsonType; };
                   description = "IRC servers to connect to";
                 };
@@ -147,7 +144,7 @@ in {
       };
     };
   };
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.matrix-appservice-irc = {
       description = "Matrix-IRC bridge";
       before = [ "matrix-synapse.service" ]; # So the registration can be used by Synapse
@@ -206,7 +203,7 @@ in {
         User = "matrix-appservice-irc";
         Group = "matrix-appservice-irc";
 
-        CapabilityBoundingSet = [ "CAP_CHOWN" ] ++ optional (cfg.needBindingCap) "CAP_NET_BIND_SERVICE";
+        CapabilityBoundingSet = [ "CAP_CHOWN" ] ++ lib.optional (cfg.needBindingCap) "CAP_NET_BIND_SERVICE";
         AmbientCapabilities = CapabilityBoundingSet;
         NoNewPrivileges = true;
 
diff --git a/nixos/modules/services/matrix/conduit.nix b/nixos/modules/services/matrix/conduit.nix
index b1d9b0424295..c484f67327d8 100644
--- a/nixos/modules/services/matrix/conduit.nix
+++ b/nixos/modules/services/matrix/conduit.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.matrix-conduit;
 
@@ -9,67 +6,67 @@ let
   configFile = format.generate "conduit.toml" cfg.settings;
 in
   {
-    meta.maintainers = with maintainers; [ pstn ];
+    meta.maintainers = with lib.maintainers; [ pstn ];
     options.services.matrix-conduit = {
-      enable = mkEnableOption "matrix-conduit";
+      enable = lib.mkEnableOption "matrix-conduit";
 
-      extraEnvironment = mkOption {
-        type = types.attrsOf types.str;
+      extraEnvironment = lib.mkOption {
+        type = lib.types.attrsOf lib.types.str;
         description = "Extra Environment variables to pass to the conduit server.";
         default = {};
         example = { RUST_BACKTRACE="yes"; };
       };
 
-      package = mkPackageOption pkgs "matrix-conduit" { };
+      package = lib.mkPackageOption pkgs "matrix-conduit" { };
 
-      settings = mkOption {
-        type = types.submodule {
+      settings = lib.mkOption {
+        type = lib.types.submodule {
           freeformType = format.type;
           options = {
-            global.server_name = mkOption {
-              type = types.str;
+            global.server_name = lib.mkOption {
+              type = lib.types.str;
               example = "example.com";
               description = "The server_name is the name of this server. It is used as a suffix for user # and room ids.";
             };
-            global.port = mkOption {
-              type = types.port;
+            global.port = lib.mkOption {
+              type = lib.types.port;
               default = 6167;
               description = "The port Conduit will be running on. You need to set up a reverse proxy in your web server (e.g. apache or nginx), so all requests to /_matrix on port 443 and 8448 will be forwarded to the Conduit instance running on this port";
             };
-            global.max_request_size = mkOption {
-              type = types.ints.positive;
+            global.max_request_size = lib.mkOption {
+              type = lib.types.ints.positive;
               default = 20000000;
               description = "Max request size in bytes. Don't forget to also change it in the proxy.";
             };
-            global.allow_registration = mkOption {
-              type = types.bool;
+            global.allow_registration = lib.mkOption {
+              type = lib.types.bool;
               default = false;
               description = "Whether new users can register on this server.";
             };
-            global.allow_encryption = mkOption {
-              type = types.bool;
+            global.allow_encryption = lib.mkOption {
+              type = lib.types.bool;
               default = true;
               description = "Whether new encrypted rooms can be created. Note: existing rooms will continue to work.";
             };
-            global.allow_federation = mkOption {
-              type = types.bool;
+            global.allow_federation = lib.mkOption {
+              type = lib.types.bool;
               default = true;
               description = ''
                 Whether this server federates with other servers.
               '';
             };
-            global.trusted_servers = mkOption {
-              type = types.listOf types.str;
+            global.trusted_servers = lib.mkOption {
+              type = lib.types.listOf lib.types.str;
               default = [ "matrix.org" ];
               description = "Servers trusted with signing server keys.";
             };
-            global.address = mkOption {
-              type = types.str;
+            global.address = lib.mkOption {
+              type = lib.types.str;
               default = "::1";
               description = "Address to listen on for connections by the reverse proxy/tls terminator.";
             };
-            global.database_path = mkOption {
-              type = types.str;
+            global.database_path = lib.mkOption {
+              type = lib.types.str;
               default = "/var/lib/matrix-conduit/";
               readOnly = true;
               description = ''
@@ -78,8 +75,8 @@ in
                 and is set to be read only.
               '';
             };
-            global.database_backend = mkOption {
-              type = types.enum [ "sqlite" "rocksdb" ];
+            global.database_backend = lib.mkOption {
+              type = lib.types.enum [ "sqlite" "rocksdb" ];
               default = "sqlite";
               example = "rocksdb";
               description = ''
@@ -87,8 +84,8 @@ in
                 instance will require manual migration of data.
               '';
             };
-            global.allow_check_for_updates = mkOption {
-              type = types.bool;
+            global.allow_check_for_updates = lib.mkOption {
+              type = lib.types.bool;
               default = false;
               description = ''
                 Whether to allow Conduit to automatically contact
@@ -109,7 +106,7 @@ in
       };
     };
 
-    config = mkIf cfg.enable {
+    config = lib.mkIf cfg.enable {
       systemd.services.conduit = {
         description = "Conduit Matrix Server";
         documentation = [ "https://gitlab.com/famedly/conduit/" ];
diff --git a/nixos/modules/services/matrix/mautrix-facebook.nix b/nixos/modules/services/matrix/mautrix-facebook.nix
index 4d5217ee4367..0e81b390732a 100644
--- a/nixos/modules/services/matrix/mautrix-facebook.nix
+++ b/nixos/modules/services/matrix/mautrix-facebook.nix
@@ -1,26 +1,23 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   cfg = config.services.mautrix-facebook;
   settingsFormat = pkgs.formats.json {};
   settingsFile = settingsFormat.generate "mautrix-facebook-config.json" cfg.settings;
 
-  puppetRegex = concatStringsSep
+  puppetRegex = lib.concatStringsSep
     ".*"
     (map
-      escapeRegex
-      (splitString
+      lib.escapeRegex
+      (lib.splitString
         "{userid}"
         cfg.settings.bridge.username_template));
 in {
   options = {
     services.mautrix-facebook = {
-      enable = mkEnableOption "Mautrix-Facebook, a Matrix-Facebook hybrid puppeting/relaybot bridge";
+      enable = lib.mkEnableOption "Mautrix-Facebook, a Matrix-Facebook hybrid puppeting/relaybot bridge";
 
-      settings = mkOption rec {
-        apply = recursiveUpdate default;
+      settings = lib.mkOption rec {
+        apply = lib.recursiveUpdate default;
         type = settingsFormat.type;
         default = {
           homeserver = {
@@ -70,7 +67,7 @@ in {
             };
           };
         };
-        example = literalExpression ''
+        example = lib.literalExpression ''
           {
             homeserver = {
               address = "http://localhost:8008";
@@ -93,8 +90,8 @@ in {
         '';
       };
 
-      environmentFile = mkOption {
-        type = types.nullOr types.path;
+      environmentFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
         default = null;
         description = ''
           File containing environment variables to be passed to the mautrix-facebook service.
@@ -103,16 +100,16 @@ in {
         '';
       };
 
-      configurePostgresql = mkOption {
-        type = types.bool;
+      configurePostgresql = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = ''
           Enable PostgreSQL and create a user and database for mautrix-facebook. The default `settings` reference this database, if you disable this option you must provide a database URL.
         '';
       };
 
-      registrationData = mkOption {
-        type = types.attrs;
+      registrationData = lib.mkOption {
+        type = lib.types.attrs;
         default = {};
         description = ''
           Output data for appservice registration. Simply make any desired changes and serialize to JSON. Note that this data contains secrets so think twice before putting it into the nix store.
@@ -123,7 +120,7 @@ in {
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     users.groups.mautrix-facebook = {};
 
     users.users.mautrix-facebook = {
@@ -131,7 +128,7 @@ in {
       isSystemUser = true;
     };
 
-    services.postgresql = mkIf cfg.configurePostgresql {
+    services.postgresql = lib.mkIf cfg.configurePostgresql {
       ensureDatabases = ["mautrix-facebook"];
       ensureUsers = [{
         name = "mautrix-facebook";
@@ -143,8 +140,8 @@ in {
       wantedBy = [ "multi-user.target" ];
       wants = [
         "network-online.target"
-      ] ++ optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit
-        ++ optional cfg.configurePostgresql "postgresql.service";
+      ] ++ lib.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit
+        ++ lib.optional cfg.configurePostgresql "postgresql.service";
       after = wants;
 
       serviceConfig = {
@@ -176,11 +173,11 @@ in {
           users = [
             {
               exclusive = true;
-              regex = escapeRegex "@${cfg.settings.appservice.bot_username}:${cfg.settings.homeserver.domain}";
+              regex = lib.escapeRegex "@${cfg.settings.appservice.bot_username}:${cfg.settings.homeserver.domain}";
             }
             {
               exclusive = true;
-              regex = "@${puppetRegex}:${escapeRegex cfg.settings.homeserver.domain}";
+              regex = "@${puppetRegex}:${lib.escapeRegex cfg.settings.homeserver.domain}";
             }
           ];
           aliases = [];
@@ -196,5 +193,5 @@ in {
     };
   };
 
-  meta.maintainers = with maintainers; [ kevincox ];
+  meta.maintainers = with lib.maintainers; [ kevincox ];
 }
diff --git a/nixos/modules/services/matrix/mautrix-telegram.nix b/nixos/modules/services/matrix/mautrix-telegram.nix
index a1ffaf9debe5..16a4046e1d3a 100644
--- a/nixos/modules/services/matrix/mautrix-telegram.nix
+++ b/nixos/modules/services/matrix/mautrix-telegram.nix
@@ -1,7 +1,4 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   dataDir = "/var/lib/mautrix-telegram";
   registrationFile = "${dataDir}/telegram-registration.yaml";
@@ -13,10 +10,10 @@ let
 in {
   options = {
     services.mautrix-telegram = {
-      enable = mkEnableOption "Mautrix-Telegram, a Matrix-Telegram hybrid puppeting/relaybot bridge";
+      enable = lib.mkEnableOption "Mautrix-Telegram, a Matrix-Telegram hybrid puppeting/relaybot bridge";
 
-      settings = mkOption rec {
-        apply = recursiveUpdate default;
+      settings = lib.mkOption rec {
+        apply = lib.recursiveUpdate default;
         inherit (settingsFormat) type;
         default = {
           homeserver = {
@@ -64,7 +61,7 @@ in {
             };
           };
         };
-        example = literalExpression ''
+        example = lib.literalExpression ''
           {
             homeserver = {
               address = "http://localhost:8008";
@@ -95,8 +92,8 @@ in {
         '';
       };
 
-      environmentFile = mkOption {
-        type = types.nullOr types.path;
+      environmentFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
         default = null;
         description = ''
           File containing environment variables to be passed to the mautrix-telegram service,
@@ -120,11 +117,11 @@ in {
         '';
       };
 
-      serviceDependencies = mkOption {
-        type = with types; listOf str;
-        default = optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit;
-        defaultText = literalExpression ''
-          optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit
+      serviceDependencies = lib.mkOption {
+        type = with lib.types; listOf str;
+        default = lib.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit;
+        defaultText = lib.literalExpression ''
+          lib.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit
         '';
         description = ''
           List of Systemd services to require and wait for when starting the application service.
@@ -133,7 +130,7 @@ in {
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.mautrix-telegram = {
       description = "Mautrix-Telegram, a Matrix-Telegram hybrid puppeting/relaybot bridge.";
 
@@ -192,5 +189,5 @@ in {
     };
   };
 
-  meta.maintainers = with maintainers; [ pacien vskilet ];
+  meta.maintainers = with lib.maintainers; [ pacien vskilet ];
 }
diff --git a/nixos/modules/services/matrix/mjolnir.nix b/nixos/modules/services/matrix/mjolnir.nix
index d01c058e7396..e00dece33cab 100644
--- a/nixos/modules/services/matrix/mjolnir.nix
+++ b/nixos/modules/services/matrix/mjolnir.nix
@@ -1,6 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
 let
   cfg = config.services.mjolnir;
 
@@ -25,8 +23,8 @@ let
   };
 
   moduleConfigFile = pkgs.writeText "module-config.yaml" (
-    generators.toYAML { } (filterAttrs (_: v: v != null)
-      (fold recursiveUpdate { } [ yamlConfig cfg.settings ])));
+    lib.generators.toYAML { } (lib.filterAttrs (_: v: v != null)
+      (lib.fold lib.recursiveUpdate { } [ yamlConfig cfg.settings ])));
 
   # these config files will be merged one after the other to build the final config
   configFiles = [
@@ -38,8 +36,8 @@ let
   # replace all secret strings using replace-secret
   generateConfig = pkgs.writeShellScript "mjolnir-generate-config" (
     let
-      yqEvalStr = concatImapStringsSep " * " (pos: _: "select(fileIndex == ${toString (pos - 1)})") configFiles;
-      yqEvalArgs = concatStringsSep " " configFiles;
+      yqEvalStr = lib.concatImapStringsSep " * " (pos: _: "select(fileIndex == ${toString (pos - 1)})") configFiles;
+      yqEvalArgs = lib.concatStringsSep " " configFiles;
     in
     ''
       set -euo pipefail
@@ -54,10 +52,10 @@ let
       # e.g. "eval-all 'select(fileIndex == 0) * select(fileIndex == 1)' filea.yaml fileb.yaml" will merge filea.yaml with fileb.yaml
       ${pkgs.yq-go}/bin/yq eval-all -P '${yqEvalStr}' ${yqEvalArgs} > ${cfg.dataPath}/config/default.yaml
 
-      ${optionalString (cfg.accessTokenFile != null) ''
+      ${lib.optionalString (cfg.accessTokenFile != null) ''
         ${pkgs.replace-secret}/bin/replace-secret '@ACCESS_TOKEN@' '${cfg.accessTokenFile}' ${cfg.dataPath}/config/default.yaml
       ''}
-      ${optionalString (cfg.pantalaimon.passwordFile != null) ''
+      ${lib.optionalString (cfg.pantalaimon.passwordFile != null) ''
         ${pkgs.replace-secret}/bin/replace-secret '@PANTALAIMON_PASSWORD@' '${cfg.pantalaimon.passwordFile}' ${cfg.dataPath}/config/default.yaml
       ''}
     ''
@@ -65,10 +63,10 @@ let
 in
 {
   options.services.mjolnir = {
-    enable = mkEnableOption "Mjolnir, a moderation tool for Matrix";
+    enable = lib.mkEnableOption "Mjolnir, a moderation tool for Matrix";
 
-    homeserverUrl = mkOption {
-      type = types.str;
+    homeserverUrl = lib.mkOption {
+      type = lib.types.str;
       default = "https://matrix.org";
       description = ''
         Where the homeserver is located (client-server URL).
@@ -78,43 +76,43 @@ in
       '';
     };
 
-    accessTokenFile = mkOption {
-      type = with types; nullOr path;
+    accessTokenFile = lib.mkOption {
+      type = with lib.types; nullOr path;
       default = null;
       description = ''
         File containing the matrix access token for the `mjolnir` user.
       '';
     };
 
-    pantalaimon = mkOption {
+    pantalaimon = lib.mkOption {
       description = ''
         `pantalaimon` options (enables E2E Encryption support).
 
         This will create a `pantalaimon` instance with the name "mjolnir".
       '';
       default = { };
-      type = types.submodule {
+      type = lib.types.submodule {
         options = {
-          enable = mkEnableOption ''
+          enable = lib.mkEnableOption ''
             ignoring the accessToken. If true, accessToken is ignored and the username/password below will be
             used instead. The access token of the bot will be stored in the dataPath
           '';
 
-          username = mkOption {
-            type = types.str;
+          username = lib.mkOption {
+            type = lib.types.str;
             description = "The username to login with.";
           };
 
-          passwordFile = mkOption {
-            type = with types; nullOr path;
+          passwordFile = lib.mkOption {
+            type = with lib.types; nullOr path;
             default = null;
             description = ''
               File containing the matrix password for the `mjolnir` user.
             '';
           };
 
-          options = mkOption {
-            type = types.submodule (import ./pantalaimon-options.nix);
+          options = lib.mkOption {
+            type = lib.types.submodule (import ./pantalaimon-options.nix);
             default = { };
             description = ''
               passthrough additional options to the `pantalaimon` service.
@@ -124,16 +122,16 @@ in
       };
     };
 
-    dataPath = mkOption {
-      type = types.path;
+    dataPath = lib.mkOption {
+      type = lib.types.path;
       default = "/var/lib/mjolnir";
       description = ''
         The directory the bot should store various bits of information in.
       '';
     };
 
-    managementRoom = mkOption {
-      type = types.str;
+    managementRoom = lib.mkOption {
+      type = lib.types.str;
       default = "#moderators:example.org";
       description = ''
         The room ID where people can use the bot. The bot has no access controls, so
@@ -143,10 +141,10 @@ in
       '';
     };
 
-    protectedRooms = mkOption {
-      type = types.listOf types.str;
+    protectedRooms = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
       default = [ ];
-      example = literalExpression ''
+      example = lib.literalExpression ''
         [
           "https://matrix.to/#/#yourroom:example.org"
           "https://matrix.to/#/#anotherroom:example.org"
@@ -157,10 +155,10 @@ in
       '';
     };
 
-    settings = mkOption {
+    settings = lib.mkOption {
       default = { };
       type = (pkgs.formats.yaml { }).type;
-      example = literalExpression ''
+      example = lib.literalExpression ''
         {
           autojoinOnlyIfManager = true;
           automaticallyRedactForReasons = [ "spam" "advertising" ];
@@ -172,7 +170,7 @@ in
     };
   };
 
-  config = mkIf config.services.mjolnir.enable {
+  config = lib.mkIf config.services.mjolnir.enable {
     assertions = [
       {
         assertion = !(cfg.pantalaimon.enable && cfg.pantalaimon.passwordFile == null);
@@ -188,15 +186,15 @@ in
       }
     ];
 
-    services.pantalaimon-headless.instances."mjolnir" = mkIf cfg.pantalaimon.enable
+    services.pantalaimon-headless.instances."mjolnir" = lib.mkIf cfg.pantalaimon.enable
       {
         homeserver = cfg.homeserverUrl;
       } // cfg.pantalaimon.options;
 
     systemd.services.mjolnir = {
       description = "mjolnir - a moderation tool for Matrix";
-      wants = [ "network-online.target" ] ++ optionals (cfg.pantalaimon.enable) [ "pantalaimon-mjolnir.service" ];
-      after = [ "network-online.target" ] ++ optionals (cfg.pantalaimon.enable) [ "pantalaimon-mjolnir.service" ];
+      wants = [ "network-online.target" ] ++ lib.optionals (cfg.pantalaimon.enable) [ "pantalaimon-mjolnir.service" ];
+      after = [ "network-online.target" ] ++ lib.optionals (cfg.pantalaimon.enable) [ "pantalaimon-mjolnir.service" ];
       wantedBy = [ "multi-user.target" ];
 
       serviceConfig = {
@@ -216,10 +214,10 @@ in
         /* TODO: wait for #102397 to be resolved. Then load secrets from $CREDENTIALS_DIRECTORY+"/NAME"
         DynamicUser = true;
         LoadCredential = [] ++
-          optionals (cfg.accessTokenFile != null) [
+          lib.optionals (cfg.accessTokenFile != null) [
             "access_token:${cfg.accessTokenFile}"
           ] ++
-          optionals (cfg.pantalaimon.passwordFile != null) [
+          lib.optionals (cfg.pantalaimon.passwordFile != null) [
             "pantalaimon_password:${cfg.pantalaimon.passwordFile}"
           ];
         */
@@ -237,6 +235,6 @@ in
 
   meta = {
     doc = ./mjolnir.md;
-    maintainers = with maintainers; [ jojosch ];
+    maintainers = with lib.maintainers; [ jojosch ];
   };
 }
diff --git a/nixos/modules/services/matrix/mx-puppet-discord.nix b/nixos/modules/services/matrix/mx-puppet-discord.nix
index 2b3a46193177..c6af1e3ff022 100644
--- a/nixos/modules/services/matrix/mx-puppet-discord.nix
+++ b/nixos/modules/services/matrix/mx-puppet-discord.nix
@@ -1,7 +1,4 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   dataDir = "/var/lib/mx-puppet-discord";
   registrationFile = "${dataDir}/discord-registration.yaml";
@@ -12,13 +9,13 @@ let
 in {
   options = {
     services.mx-puppet-discord = {
-      enable = mkEnableOption ''
+      enable = lib.mkEnableOption ''
         mx-puppet-discord is a discord puppeting bridge for matrix.
         It handles bridging private and group DMs, as well as Guilds (servers)
       '';
 
-      settings = mkOption rec {
-        apply = recursiveUpdate default;
+      settings = lib.mkOption rec {
+        apply = lib.recursiveUpdate default;
         inherit (settingsFormat) type;
         default = {
           bridge.port = 8434;
@@ -45,7 +42,7 @@ in {
             lineDateFormat = "MMM-D HH:mm:ss.SSS";
           };
         };
-        example = literalExpression ''
+        example = lib.literalExpression ''
           {
             bridge = {
               bindAddress = "localhost";
@@ -64,11 +61,11 @@ in {
           sample.config.yaml](https://github.com/matrix-discord/mx-puppet-discord/blob/master/sample.config.yaml).
         '';
       };
-      serviceDependencies = mkOption {
-        type = with types; listOf str;
-        default = optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit;
-        defaultText = literalExpression ''
-          optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit
+      serviceDependencies = lib.mkOption {
+        type = with lib.types; listOf str;
+        default = lib.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit;
+        defaultText = lib.literalExpression ''
+          lib.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit
         '';
         description = ''
           List of Systemd services to require and wait for when starting the application service.
@@ -77,7 +74,7 @@ in {
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.mx-puppet-discord = {
       description = "Matrix to Discord puppeting bridge";
 
@@ -118,5 +115,5 @@ in {
     };
   };
 
-  meta.maintainers = with maintainers; [ govanify ];
+  meta.maintainers = with lib.maintainers; [ govanify ];
 }
diff --git a/nixos/modules/services/matrix/pantalaimon-options.nix b/nixos/modules/services/matrix/pantalaimon-options.nix
index 4243513788b5..b3a663f59931 100644
--- a/nixos/modules/services/matrix/pantalaimon-options.nix
+++ b/nixos/modules/services/matrix/pantalaimon-options.nix
@@ -1,26 +1,24 @@
 { config, lib, name, ... }:
-
-with lib;
 {
   options = {
-    dataPath = mkOption {
-      type = types.path;
+    dataPath = lib.mkOption {
+      type = lib.types.path;
       default = "/var/lib/pantalaimon-${name}";
       description = ''
         The directory where `pantalaimon` should store its state such as the database file.
       '';
     };
 
-    logLevel = mkOption {
-      type = types.enum [ "info" "warning" "error" "debug" ];
+    logLevel = lib.mkOption {
+      type = lib.types.enum [ "info" "warning" "error" "debug" ];
       default = "warning";
       description = ''
         Set the log level of the daemon.
       '';
     };
 
-    homeserver = mkOption {
-      type = types.str;
+    homeserver = lib.mkOption {
+      type = lib.types.str;
       example = "https://matrix.org";
       description = ''
         The URI of the homeserver that the `pantalaimon` proxy should
@@ -29,8 +27,8 @@ with lib;
       '';
     };
 
-    ssl = mkOption {
-      type = types.bool;
+    ssl = lib.mkOption {
+      type = lib.types.bool;
       default = true;
       description = ''
         Whether or not SSL verification should be enabled for outgoing
@@ -38,8 +36,8 @@ with lib;
       '';
     };
 
-    listenAddress = mkOption {
-      type = types.str;
+    listenAddress = lib.mkOption {
+      type = lib.types.str;
       default = "localhost";
       description = ''
         The address where the daemon will listen to client connections
@@ -47,18 +45,18 @@ with lib;
       '';
     };
 
-    listenPort = mkOption {
-      type = types.port;
+    listenPort = lib.mkOption {
+      type = lib.types.port;
       default = 8009;
       description = ''
         The port where the daemon will listen to client connections for
         this homeserver. Note that the listen address/port combination
-        needs to be unique between different homeservers.
+        needs to be lib.unique between different homeservers.
       '';
     };
 
-    extraSettings = mkOption {
-      type = types.attrs;
+    extraSettings = lib.mkOption {
+      type = lib.types.attrs;
       default = { };
       description = ''
         Extra configuration options. See
diff --git a/nixos/modules/services/matrix/pantalaimon.nix b/nixos/modules/services/matrix/pantalaimon.nix
index 6f3fefdb3430..28fcdcee973f 100644
--- a/nixos/modules/services/matrix/pantalaimon.nix
+++ b/nixos/modules/services/matrix/pantalaimon.nix
@@ -1,6 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
 let
   cfg = config.services.pantalaimon-headless;
 
@@ -12,7 +10,7 @@ let
       Notifications = false;
     };
 
-    ${name} = (recursiveUpdate
+    ${name} = (lib.recursiveUpdate
       {
         Homeserver = instanceConfig.homeserver;
         ListenAddress = instanceConfig.listenAddress;
@@ -28,7 +26,7 @@ let
   };
 
   mkPantalaimonService = name: instanceConfig:
-    nameValuePair "pantalaimon-${name}" {
+    lib.nameValuePair "pantalaimon-${name}" {
       description = "pantalaimon instance ${name} - E2EE aware proxy daemon for matrix clients";
       wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
@@ -48,9 +46,9 @@ let
     };
 in
 {
-  options.services.pantalaimon-headless.instances = mkOption {
+  options.services.pantalaimon-headless.instances = lib.mkOption {
     default = { };
-    type = types.attrsOf (types.submodule (import ./pantalaimon-options.nix));
+    type = lib.types.attrsOf (lib.types.submodule (import ./pantalaimon-options.nix));
     description = ''
       Declarative instance config.
 
@@ -59,12 +57,12 @@ in
     '';
   };
 
-  config = mkIf (config.services.pantalaimon-headless.instances != { })
+  config = lib.mkIf (config.services.pantalaimon-headless.instances != { })
     {
-      systemd.services = mapAttrs' mkPantalaimonService config.services.pantalaimon-headless.instances;
+      systemd.services = lib.mapAttrs' mkPantalaimonService config.services.pantalaimon-headless.instances;
     };
 
   meta = {
-    maintainers = with maintainers; [ jojosch ];
+    maintainers = with lib.maintainers; [ jojosch ];
   };
 }
diff --git a/nixos/modules/services/misc/airsonic.nix b/nixos/modules/services/misc/airsonic.nix
index d980069608e7..3231fce35dab 100644
--- a/nixos/modules/services/misc/airsonic.nix
+++ b/nixos/modules/services/misc/airsonic.nix
@@ -1,7 +1,4 @@
 { config, lib, options, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.airsonic;
   opt = options.services.airsonic;
@@ -9,16 +6,16 @@ in {
   options = {
 
     services.airsonic = {
-      enable = mkEnableOption "Airsonic, the Free and Open Source media streaming server (fork of Subsonic and Libresonic)";
+      enable = lib.mkEnableOption "Airsonic, the Free and Open Source media streaming server (fork of Subsonic and Libresonic)";
 
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = "airsonic";
         description = "User account under which airsonic runs.";
       };
 
-      home = mkOption {
-        type = types.path;
+      home = lib.mkOption {
+        type = lib.types.path;
         default = "/var/lib/airsonic";
         description = ''
           The directory where Airsonic will create files.
@@ -26,16 +23,16 @@ in {
         '';
       };
 
-      virtualHost = mkOption {
-        type = types.nullOr types.str;
+      virtualHost = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         description = ''
           Name of the nginx virtualhost to use and setup. If null, do not setup any virtualhost.
         '';
       };
 
-      listenAddress = mkOption {
-        type = types.str;
+      listenAddress = lib.mkOption {
+        type = lib.types.str;
         default = "127.0.0.1";
         description = ''
           The host name or IP address on which to bind Airsonic.
@@ -47,8 +44,8 @@ in {
         '';
       };
 
-      port = mkOption {
-        type = types.port;
+      port = lib.mkOption {
+        type = lib.types.port;
         default = 4040;
         description = ''
           The port on which Airsonic will listen for
@@ -56,8 +53,8 @@ in {
         '';
       };
 
-      contextPath = mkOption {
-        type = types.path;
+      contextPath = lib.mkOption {
+        type = lib.types.path;
         default = "/";
         description = ''
           The context path, i.e., the last part of the Airsonic
@@ -65,8 +62,8 @@ in {
         '';
       };
 
-      maxMemory = mkOption {
-        type = types.int;
+      maxMemory = lib.mkOption {
+        type = lib.types.int;
         default = 100;
         description = ''
           The memory limit (max Java heap size) in megabytes.
@@ -74,10 +71,10 @@ in {
         '';
       };
 
-      transcoders = mkOption {
-        type = types.listOf types.path;
+      transcoders = lib.mkOption {
+        type = lib.types.listOf lib.types.path;
         default = [ "${pkgs.ffmpeg.bin}/bin/ffmpeg" ];
-        defaultText = literalExpression ''[ "''${pkgs.ffmpeg.bin}/bin/ffmpeg" ]'';
+        defaultText = lib.literalExpression ''[ "''${pkgs.ffmpeg.bin}/bin/ffmpeg" ]'';
         description = ''
           List of paths to transcoder executables that should be accessible
           from Airsonic. Symlinks will be created to each executable inside
@@ -85,7 +82,7 @@ in {
         '';
       };
 
-      jre = mkPackageOption pkgs "jre8" {
+      jre = lib.mkPackageOption pkgs "jre8" {
         extraDescription = ''
           ::: {.note}
           Airsonic only supports Java 8, airsonic-advanced requires at least
@@ -94,14 +91,14 @@ in {
         '';
       };
 
-      war = mkOption {
-        type = types.path;
+      war = lib.mkOption {
+        type = lib.types.path;
         default = "${pkgs.airsonic}/webapps/airsonic.war";
-        defaultText = literalExpression ''"''${pkgs.airsonic}/webapps/airsonic.war"'';
+        defaultText = lib.literalExpression ''"''${pkgs.airsonic}/webapps/airsonic.war"'';
         description = "Airsonic war file to use.";
       };
 
-      jvmOptions = mkOption {
+      jvmOptions = lib.mkOption {
         description = ''
           Extra command line options for the JVM running AirSonic.
           Useful for sending jukebox output to non-default alsa
@@ -109,7 +106,7 @@ in {
         '';
         default = [
         ];
-        type = types.listOf types.str;
+        type = lib.types.listOf lib.types.str;
         example = [
           "-Djavax.sound.sampled.Clip='#CODEC [plughw:1,0]'"
           "-Djavax.sound.sampled.Port='#Port CODEC [hw:1]'"
@@ -121,7 +118,7 @@ in {
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.airsonic = {
       description = "Airsonic Media Server";
       after = [ "network.target" ];
@@ -143,7 +140,7 @@ in {
           -Dserver.port=${toString cfg.port} \
           -Dserver.context-path=${cfg.contextPath} \
           -Djava.awt.headless=true \
-          ${optionalString (cfg.virtualHost != null)
+          ${lib.optionalString (cfg.virtualHost != null)
             "-Dserver.use-forward-headers=true"} \
           ${toString cfg.jvmOptions} \
           -verbose:gc \
@@ -155,7 +152,7 @@ in {
       };
     };
 
-    services.nginx = mkIf (cfg.virtualHost != null) {
+    services.nginx = lib.mkIf (cfg.virtualHost != null) {
       enable = true;
       recommendedProxySettings = true;
       virtualHosts.${cfg.virtualHost} = {
diff --git a/nixos/modules/services/misc/amazon-ssm-agent.nix b/nixos/modules/services/misc/amazon-ssm-agent.nix
index 0da10621d0a0..89acbf09fea8 100644
--- a/nixos/modules/services/misc/amazon-ssm-agent.nix
+++ b/nixos/modules/services/misc/amazon-ssm-agent.nix
@@ -1,6 +1,4 @@
 { config, pkgs, lib, ... }:
-
-with lib;
 let
   cfg = config.services.amazon-ssm-agent;
 
@@ -22,16 +20,16 @@ let
   };
 in {
   imports = [
-    (mkRenamedOptionModule [ "services" "ssm-agent" "enable" ] [ "services" "amazon-ssm-agent" "enable" ])
-    (mkRenamedOptionModule [ "services" "ssm-agent" "package" ] [ "services" "amazon-ssm-agent" "package" ])
+    (lib.mkRenamedOptionModule [ "services" "ssm-agent" "enable" ] [ "services" "amazon-ssm-agent" "enable" ])
+    (lib.mkRenamedOptionModule [ "services" "ssm-agent" "package" ] [ "services" "amazon-ssm-agent" "package" ])
   ];
 
   options.services.amazon-ssm-agent = {
-    enable = mkEnableOption "Amazon SSM agent";
-    package = mkPackageOption pkgs "amazon-ssm-agent" {};
+    enable = lib.mkEnableOption "Amazon SSM agent";
+    package = lib.mkPackageOption pkgs "amazon-ssm-agent" {};
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     # See https://github.com/aws/amazon-ssm-agent/blob/mainline/packaging/linux/amazon-ssm-agent.service
     systemd.services.amazon-ssm-agent = {
       inherit (cfg.package.meta) description;
diff --git a/nixos/modules/services/misc/ankisyncd.nix b/nixos/modules/services/misc/ankisyncd.nix
index b999b02534e7..dd05b49538eb 100644
--- a/nixos/modules/services/misc/ankisyncd.nix
+++ b/nixos/modules/services/misc/ankisyncd.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.ankisyncd;
 
@@ -22,37 +19,37 @@ let
 in
   {
     options.services.ankisyncd = {
-      enable = mkEnableOption "ankisyncd, a standalone unofficial anky sync server";
+      enable = lib.mkEnableOption "ankisyncd, a standalone unofficial anky sync server";
 
-      package = mkPackageOption pkgs "ankisyncd" { };
+      package = lib.mkPackageOption pkgs "ankisyncd" { };
 
-      host = mkOption {
-        type = types.str;
+      host = lib.mkOption {
+        type = lib.types.str;
         default = "localhost";
         description = "ankisyncd host";
       };
 
-      port = mkOption {
-        type = types.port;
+      port = lib.mkOption {
+        type = lib.types.port;
         default = 27701;
         description = "ankisyncd port";
       };
 
-      openFirewall = mkOption {
+      openFirewall = lib.mkOption {
         default = false;
-        type = types.bool;
+        type = lib.types.bool;
         description = "Whether to open the firewall for the specified port.";
       };
     };
 
-    config = mkIf cfg.enable {
+    config = lib.mkIf cfg.enable {
       warnings = [
         ''
         `services.ankisyncd` has been replaced by `services.anki-sync-server` and will be removed after
         24.05 because anki-sync-server(-rs and python) are not maintained.
         ''
       ];
-      networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ];
+      networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ cfg.port ];
 
       systemd.services.ankisyncd = {
         description = "ankisyncd - Anki sync server";
diff --git a/nixos/modules/services/misc/apache-kafka.nix b/nixos/modules/services/misc/apache-kafka.nix
index d1a3d92f2e22..0ed20961c57b 100644
--- a/nixos/modules/services/misc/apache-kafka.nix
+++ b/nixos/modules/services/misc/apache-kafka.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.apache-kafka;
 
@@ -17,24 +14,24 @@ let
 
   mkPropertyString = let
     render = {
-      bool = boolToString;
+      bool = lib.boolToString;
       int = toString;
-      list = concatMapStringsSep "," mkPropertyString;
-      string = id;
+      list = lib.concatMapStringsSep "," mkPropertyString;
+      string = lib.id;
     };
   in
     v: render.${builtins.typeOf v} v;
 
-  stringlySettings = mapAttrs (_: mkPropertyString)
-    (filterAttrs (_: v:  v != null) cfg.settings);
+  stringlySettings = lib.mapAttrs (_: mkPropertyString)
+    (lib.filterAttrs (_: v:  v != null) cfg.settings);
 
   generator = (pkgs.formats.javaProperties {}).generate;
 in {
 
   options.services.apache-kafka = {
-    enable = mkEnableOption "Apache Kafka event streaming broker";
+    enable = lib.mkEnableOption "Apache Kafka event streaming broker";
 
-    settings = mkOption {
+    settings = lib.mkOption {
       description = ''
         [Kafka broker configuration](https://kafka.apache.org/documentation.html#brokerconfigs)
         {file}`server.properties`.
@@ -44,81 +41,81 @@ in {
         but instead as quoted strings (ie. `settings."broker.id"`, NOT
         `settings.broker.id`).
      '';
-      type = types.submodule {
-        freeformType = with types; let
+      type = lib.types.submodule {
+        freeformType = with lib.types; let
           primitive = oneOf [bool int str];
         in lazyAttrsOf (nullOr (either primitive (listOf primitive)));
 
         options = {
-          "broker.id" = mkOption {
+          "broker.id" = lib.mkOption {
             description = "Broker ID. -1 or null to auto-allocate in zookeeper mode.";
             default = null;
-            type = with types; nullOr int;
+            type = with lib.types; nullOr int;
           };
 
-          "log.dirs" = mkOption {
+          "log.dirs" = lib.mkOption {
             description = "Log file directories.";
             # Deliberaly leave out old default and use the rewrite opportunity
             # to have users choose a safer value -- /tmp might be volatile and is a
             # slightly scary default choice.
             # default = [ "/tmp/apache-kafka" ];
-            type = with types; listOf path;
+            type = with lib.types; listOf path;
           };
 
-          "listeners" = mkOption {
+          "listeners" = lib.mkOption {
             description = ''
               Kafka Listener List.
               See [listeners](https://kafka.apache.org/documentation/#brokerconfigs_listeners).
             '';
-            type = types.listOf types.str;
+            type = lib.types.listOf lib.types.str;
             default = [ "PLAINTEXT://localhost:9092" ];
           };
         };
       };
     };
 
-    clusterId = mkOption {
+    clusterId = lib.mkOption {
       description = ''
         KRaft mode ClusterId used for formatting log directories. Can be generated with `kafka-storage.sh random-uuid`
       '';
-      type = with types; nullOr str;
+      type = with lib.types; nullOr str;
       default = null;
     };
 
-    configFiles.serverProperties = mkOption {
+    configFiles.serverProperties = lib.mkOption {
       description = ''
         Kafka server.properties configuration file path.
         Defaults to the rendered `settings`.
       '';
-      type = types.path;
+      type = lib.types.path;
     };
 
-    configFiles.log4jProperties = mkOption {
+    configFiles.log4jProperties = lib.mkOption {
       description = "Kafka log4j property configuration file path";
-      type = types.path;
+      type = lib.types.path;
       default = pkgs.writeText "log4j.properties" cfg.log4jProperties;
       defaultText = ''pkgs.writeText "log4j.properties" cfg.log4jProperties'';
     };
 
-    formatLogDirs = mkOption {
+    formatLogDirs = lib.mkOption {
       description = ''
         Whether to format log dirs in KRaft mode if all log dirs are
         unformatted, ie. they contain no meta.properties.
       '';
-      type = types.bool;
+      type = lib.types.bool;
       default = false;
     };
 
-    formatLogDirsIgnoreFormatted = mkOption {
+    formatLogDirsIgnoreFormatted = lib.mkOption {
       description = ''
         Whether to ignore already formatted log dirs when formatting log dirs,
         instead of failing. Useful when replacing or adding disks.
       '';
-      type = types.bool;
+      type = lib.types.bool;
       default = false;
     };
 
-    log4jProperties = mkOption {
+    log4jProperties = lib.mkOption {
       description = "Kafka log4j property configuration.";
       default = ''
         log4j.rootLogger=INFO, stdout
@@ -127,13 +124,13 @@ in {
         log4j.appender.stdout.layout=org.apache.log4j.PatternLayout
         log4j.appender.stdout.layout.ConversionPattern=[%d] %p %m (%c)%n
       '';
-      type = types.lines;
+      type = lib.types.lines;
     };
 
-    jvmOptions = mkOption {
+    jvmOptions = lib.mkOption {
       description = "Extra command line options for the JVM running Kafka.";
       default = [];
-      type = types.listOf types.str;
+      type = lib.types.listOf lib.types.str;
       example = [
         "-Djava.net.preferIPv4Stack=true"
         "-Dcom.sun.management.jmxremote"
@@ -141,38 +138,38 @@ in {
       ];
     };
 
-    package = mkPackageOption pkgs "apacheKafka" { };
+    package = lib.mkPackageOption pkgs "apacheKafka" { };
 
-    jre = mkOption {
+    jre = lib.mkOption {
       description = "The JRE with which to run Kafka";
       default = cfg.package.passthru.jre;
-      defaultText = literalExpression "pkgs.apacheKafka.passthru.jre";
-      type = types.package;
+      defaultText = lib.literalExpression "pkgs.apacheKafka.passthru.jre";
+      type = lib.types.package;
     };
   };
 
   imports = [
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "apache-kafka" "brokerId" ]
       [ "services" "apache-kafka" "settings" ''broker.id'' ])
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "apache-kafka" "logDirs" ]
       [ "services" "apache-kafka" "settings" ''log.dirs'' ])
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "apache-kafka" "zookeeper" ]
       [ "services" "apache-kafka" "settings" ''zookeeper.connect'' ])
 
-    (mkRemovedOptionModule [ "services" "apache-kafka" "port" ]
+    (lib.mkRemovedOptionModule [ "services" "apache-kafka" "port" ]
       "Please see services.apache-kafka.settings.listeners and its documentation instead")
-    (mkRemovedOptionModule [ "services" "apache-kafka" "hostname" ]
+    (lib.mkRemovedOptionModule [ "services" "apache-kafka" "hostname" ]
       "Please see services.apache-kafka.settings.listeners and its documentation instead")
-    (mkRemovedOptionModule [ "services" "apache-kafka" "extraProperties" ]
+    (lib.mkRemovedOptionModule [ "services" "apache-kafka" "extraProperties" ]
       "Please see services.apache-kafka.settings and its documentation instead")
-    (mkRemovedOptionModule [ "services" "apache-kafka" "serverProperties" ]
+    (lib.mkRemovedOptionModule [ "services" "apache-kafka" "serverProperties" ]
       "Please see services.apache-kafka.settings and its documentation instead")
   ];
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     services.apache-kafka.configFiles.serverProperties = generator "server.properties" stringlySettings;
 
     users.users.apache-kafka = {
@@ -188,11 +185,11 @@ in {
       description = "Apache Kafka Daemon";
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
-      preStart = mkIf cfg.formatLogDirs
+      preStart = lib.mkIf cfg.formatLogDirs
         (if cfg.formatLogDirsIgnoreFormatted then ''
           ${cfg.package}/bin/kafka-storage.sh format -t "${cfg.clusterId}" -c ${cfg.configFiles.serverProperties} --ignore-formatted
         '' else ''
-          if ${concatMapStringsSep " && " (l: ''[ ! -f "${l}/meta.properties" ]'') cfg.settings."log.dirs"}; then
+          if ${lib.concatMapStringsSep " && " (l: ''[ ! -f "${l}/meta.properties" ]'') cfg.settings."log.dirs"}; then
             ${cfg.package}/bin/kafka-storage.sh format -t "${cfg.clusterId}" -c ${cfg.configFiles.serverProperties}
           fi
         '');
diff --git a/nixos/modules/services/misc/autofs.nix b/nixos/modules/services/misc/autofs.nix
index d94fae3edebf..6c3ab8e57df9 100644
--- a/nixos/modules/services/misc/autofs.nix
+++ b/nixos/modules/services/misc/autofs.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   cfg = config.services.autofs;
@@ -18,8 +15,8 @@ in
 
     services.autofs = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Mount filesystems on demand. Unmount them automatically.
@@ -27,9 +24,9 @@ in
         '';
       };
 
-      autoMaster = mkOption {
-        type = types.str;
-        example = literalExpression ''
+      autoMaster = lib.mkOption {
+        type = lib.types.str;
+        example = lib.literalExpression ''
           let
             mapConf = pkgs.writeText "auto" '''
              kernel    -ro,soft,intr       ftp.kernel.org:/pub/linux
@@ -51,14 +48,14 @@ in
         '';
       };
 
-      timeout = mkOption {
-        type = types.int;
+      timeout = lib.mkOption {
+        type = lib.types.int;
         default = 600;
         description = "Set the global minimum timeout, in seconds, until directories are unmounted";
       };
 
-      debug = mkOption {
-        type = types.bool;
+      debug = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Pass -d and -7 to automount and write log to the system journal.
@@ -72,7 +69,7 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     boot.kernelModules = [ "autofs" ];
 
@@ -90,7 +87,7 @@ in
         serviceConfig = {
           Type = "forking";
           PIDFile = "/run/autofs.pid";
-          ExecStart = "${pkgs.autofs5}/bin/automount ${optionalString cfg.debug "-d"} -p /run/autofs.pid -t ${builtins.toString cfg.timeout} ${autoMaster}";
+          ExecStart = "${pkgs.autofs5}/bin/automount ${lib.optionalString cfg.debug "-d"} -p /run/autofs.pid -t ${builtins.toString cfg.timeout} ${autoMaster}";
           ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
         };
       };
diff --git a/nixos/modules/services/misc/bazarr.nix b/nixos/modules/services/misc/bazarr.nix
index 99343a146a7a..e81b5d2b736e 100644
--- a/nixos/modules/services/misc/bazarr.nix
+++ b/nixos/modules/services/misc/bazarr.nix
@@ -1,42 +1,39 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   cfg = config.services.bazarr;
 in
 {
   options = {
     services.bazarr = {
-      enable = mkEnableOption "bazarr, a subtitle manager for Sonarr and Radarr";
+      enable = lib.mkEnableOption "bazarr, a subtitle manager for Sonarr and Radarr";
 
-      openFirewall = mkOption {
-        type = types.bool;
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Open ports in the firewall for the bazarr web interface.";
       };
 
-      listenPort = mkOption {
-        type = types.port;
+      listenPort = lib.mkOption {
+        type = lib.types.port;
         default = 6767;
         description = "Port on which the bazarr web interface should listen";
       };
 
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = "bazarr";
         description = "User account under which bazarr runs.";
       };
 
-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
         default = "bazarr";
         description = "Group under which bazarr runs.";
       };
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.bazarr = {
       description = "bazarr";
       after = [ "network.target" ];
@@ -58,11 +55,11 @@ in
       };
     };
 
-    networking.firewall = mkIf cfg.openFirewall {
+    networking.firewall = lib.mkIf cfg.openFirewall {
       allowedTCPPorts = [ cfg.listenPort ];
     };
 
-    users.users = mkIf (cfg.user == "bazarr") {
+    users.users = lib.mkIf (cfg.user == "bazarr") {
       bazarr = {
         isSystemUser = true;
         group = cfg.group;
@@ -70,7 +67,7 @@ in
       };
     };
 
-    users.groups = mkIf (cfg.group == "bazarr") {
+    users.groups = lib.mkIf (cfg.group == "bazarr") {
       bazarr = {};
     };
   };
diff --git a/nixos/modules/services/misc/bcg.nix b/nixos/modules/services/misc/bcg.nix
index 63c441833d95..98193fcafb3e 100644
--- a/nixos/modules/services/misc/bcg.nix
+++ b/nixos/modules/services/misc/bcg.nix
@@ -4,13 +4,10 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.bcg;
   configFile = (pkgs.formats.yaml {}).generate "bcg.conf.yaml" (
-    filterAttrsRecursive (n: v: v != null) {
+    lib.filterAttrsRecursive (n: v: v != null) {
       inherit (cfg) device name mqtt;
       retain_node_messages = cfg.retainNodeMessages;
       qos_node_messages = cfg.qosNodeMessages;
@@ -25,10 +22,10 @@ in
 {
   options = {
     services.bcg = {
-      enable = mkEnableOption "BigClown gateway";
-      package = mkPackageOption pkgs [ "python3Packages" "bcg" ] { };
-      environmentFiles = mkOption {
-        type = types.listOf types.path;
+      enable = lib.mkEnableOption "BigClown gateway";
+      package = lib.mkPackageOption pkgs [ "python3Packages" "bcg" ] { };
+      environmentFiles = lib.mkOption {
+        type = lib.types.listOf lib.types.path;
         default = [];
         example = [ "/run/keys/bcg.env" ];
         description = ''
@@ -38,17 +35,17 @@ in
           This is useful to avoid putting secrets into the nix store.
         '';
       };
-      verbose = mkOption {
-        type = types.enum ["CRITICAL" "ERROR" "WARNING" "INFO" "DEBUG"];
+      verbose = lib.mkOption {
+        type = lib.types.enum ["CRITICAL" "ERROR" "WARNING" "INFO" "DEBUG"];
         default = "WARNING";
         description = "Verbosity level.";
       };
-      device = mkOption {
-        type = types.str;
+      device = lib.mkOption {
+        type = lib.types.str;
         description = "Device name to configure gateway to use.";
       };
-      name = mkOption {
-        type = with types; nullOr str;
+      name = lib.mkOption {
+        type = with lib.types; nullOr str;
         default = null;
         description = ''
           Name for the device.
@@ -61,86 +58,86 @@ in
         '';
       };
       mqtt = {
-        host = mkOption {
-          type = types.str;
+        host = lib.mkOption {
+          type = lib.types.str;
           default = "127.0.0.1";
           description = "Host where MQTT server is running.";
         };
-        port = mkOption {
-          type = types.port;
+        port = lib.mkOption {
+          type = lib.types.port;
           default = 1883;
           description = "Port of MQTT server.";
         };
-        username = mkOption {
-          type = with types; nullOr str;
+        username = lib.mkOption {
+          type = with lib.types; nullOr str;
           default = null;
           description = "MQTT server access username.";
         };
-        password = mkOption {
-          type = with types; nullOr str;
+        password = lib.mkOption {
+          type = with lib.types; nullOr str;
           default = null;
           description = "MQTT server access password.";
         };
-        cafile = mkOption {
-          type = with types; nullOr str;
+        cafile = lib.mkOption {
+          type = with lib.types; nullOr str;
           default = null;
           description = "Certificate Authority file for MQTT server access.";
         };
-        certfile = mkOption {
-          type = with types; nullOr str;
+        certfile = lib.mkOption {
+          type = with lib.types; nullOr str;
           default = null;
           description = "Certificate file for MQTT server access.";
         };
-        keyfile = mkOption {
-          type = with types; nullOr str;
+        keyfile = lib.mkOption {
+          type = with lib.types; nullOr str;
           default = null;
           description = "Key file for MQTT server access.";
         };
       };
-      retainNodeMessages = mkOption {
-        type = types.bool;
+      retainNodeMessages = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Specify that node messages should be retaied in MQTT broker.";
       };
-      qosNodeMessages = mkOption {
-        type = types.int;
+      qosNodeMessages = lib.mkOption {
+        type = lib.types.int;
         default = 1;
         description = "Set the guarantee of MQTT message delivery.";
       };
-      baseTopicPrefix = mkOption {
-        type = types.str;
+      baseTopicPrefix = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = "Topic prefix added to all MQTT messages.";
       };
-      automaticRemoveKitFromNames = mkOption {
-        type = types.bool;
+      automaticRemoveKitFromNames = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = "Automatically remove kits.";
       };
-      automaticRenameKitNodes = mkOption {
-        type = types.bool;
+      automaticRenameKitNodes = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = "Automatically rename kit's nodes.";
       };
-      automaticRenameGenericNodes = mkOption {
-        type = types.bool;
+      automaticRenameGenericNodes = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = "Automatically rename generic nodes.";
       };
-      automaticRenameNodes = mkOption {
-        type = types.bool;
+      automaticRenameNodes = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = "Automatically rename all nodes.";
       };
-      rename = mkOption {
-        type = with types; attrsOf str;
+      rename = lib.mkOption {
+        type = with lib.types; attrsOf str;
         default = {};
         description = "Rename nodes to different name.";
       };
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     environment.systemPackages = with pkgs; [
       python3Packages.bcg
       python3Packages.bch
@@ -156,7 +153,7 @@ in
       wantedBy = [ "multi-user.target" ];
       wants = [ "network-online.target" ] ++ lib.optional config.services.mosquitto.enable "mosquitto.service";
       after = [ "network-online.target" ];
-      preStart = mkIf envConfig ''
+      preStart = lib.mkIf envConfig ''
         umask 077
         ${pkgs.envsubst}/bin/envsubst -i "${configFile}" -o "${finalConfig}"
         '';
diff --git a/nixos/modules/services/misc/beanstalkd.nix b/nixos/modules/services/misc/beanstalkd.nix
index b8f163cbfadf..5f7e4be34daa 100644
--- a/nixos/modules/services/misc/beanstalkd.nix
+++ b/nixos/modules/services/misc/beanstalkd.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.beanstalkd;
   pkg = pkgs.beanstalkd;
@@ -12,25 +9,25 @@ in
 
   options = {
     services.beanstalkd = {
-      enable = mkEnableOption "the Beanstalk work queue";
+      enable = lib.mkEnableOption "the Beanstalk work queue";
 
       listen = {
-        port = mkOption {
-          type = types.port;
+        port = lib.mkOption {
+          type = lib.types.port;
           description = "TCP port that will be used to accept client connections.";
           default = 11300;
         };
 
-        address = mkOption {
-          type = types.str;
+        address = lib.mkOption {
+          type = lib.types.str;
           description = "IP address to listen on.";
           default = "127.0.0.1";
           example = "0.0.0.0";
         };
       };
 
-      openFirewall = mkOption {
-        type = types.bool;
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Whether to open ports in the firewall for the server.";
       };
@@ -39,9 +36,9 @@ in
 
   # implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
-    networking.firewall = mkIf cfg.openFirewall {
+    networking.firewall = lib.mkIf cfg.openFirewall {
       allowedTCPPorts = [ cfg.listen.port ];
     };
 
diff --git a/nixos/modules/services/misc/bees.nix b/nixos/modules/services/misc/bees.nix
index a0fd3cd43d62..170f92253c63 100644
--- a/nixos/modules/services/misc/bees.nix
+++ b/nixos/modules/services/misc/bees.nix
@@ -1,15 +1,12 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   cfg = config.services.beesd;
 
   logLevels = { emerg = 0; alert = 1; crit = 2; err = 3; warning = 4; notice = 5; info = 6; debug = 7; };
 
-  fsOptions = with types; {
-    options.spec = mkOption {
+  fsOptions = with lib.types; {
+    options.spec = lib.mkOption {
       type = str;
       description = ''
         Description of how to identify the filesystem to be duplicated by this
@@ -25,8 +22,8 @@ let
       '';
       example = "LABEL=MyBulkDataDrive";
     };
-    options.hashTableSizeMB = mkOption {
-      type = types.addCheck types.int (n: mod n 16 == 0);
+    options.hashTableSizeMB = lib.mkOption {
+      type = lib.types.addCheck lib.types.int (n: mod n 16 == 0);
       default = 1024; # 1GB; default from upstream beesd script
       description = ''
         Hash table size in MB; must be a multiple of 16.
@@ -40,13 +37,13 @@ let
         will recognize only aligned duplicate blocks of 16KB.
       '';
     };
-    options.verbosity = mkOption {
-      type = types.enum (attrNames logLevels ++ attrValues logLevels);
-      apply = v: if isString v then logLevels.${v} else v;
+    options.verbosity = lib.mkOption {
+      type = lib.types.enum (lib.attrNames logLevels ++ lib.attrValues logLevels);
+      apply = v: if lib.isString v then logLevels.${v} else v;
       default = "info";
       description = "Log verbosity (syslog keyword/level).";
     };
-    options.workDir = mkOption {
+    options.workDir = lib.mkOption {
       type = str;
       default = ".beeshome";
       description = ''
@@ -54,13 +51,13 @@ let
         the hash table will be stored.
       '';
     };
-    options.extraOptions = mkOption {
+    options.extraOptions = lib.mkOption {
       type = listOf str;
       default = [ ];
       description = ''
         Extra command-line options passed to the daemon. See upstream bees documentation.
       '';
-      example = literalExpression ''
+      example = lib.literalExpression ''
         [ "--thread-count" "4" ]
       '';
     };
@@ -70,11 +67,11 @@ in
 {
 
   options.services.beesd = {
-    filesystems = mkOption {
-      type = with types; attrsOf (submodule fsOptions);
+    filesystems = lib.mkOption {
+      type = with lib.types; attrsOf (submodule fsOptions);
       description = "BTRFS filesystems to run block-level deduplication on.";
       default = { };
-      example = literalExpression ''
+      example = lib.literalExpression ''
         {
           root = {
             spec = "LABEL=root";
@@ -87,8 +84,8 @@ in
     };
   };
   config = {
-    systemd.services = mapAttrs'
-      (name: fs: nameValuePair "beesd@${name}" {
+    systemd.services = lib.mapAttrs'
+      (name: fs: lib.nameValuePair "beesd@${name}" {
         description = "Block-level BTRFS deduplication for %i";
         after = [ "sysinit.target" ];
 
@@ -100,11 +97,11 @@ in
               "idxSizeMB=${toString fs.hashTableSizeMB}"
               "workDir=${fs.workDir}"
             ];
-            configOptsStr = escapeShellArgs configOpts;
+            configOptsStr = lib.escapeShellArgs configOpts;
           in
           {
             # Values from https://github.com/Zygo/bees/blob/v0.6.5/scripts/beesd@.service.in
-            ExecStart = "${pkgs.bees}/bin/bees-service-wrapper run ${configOptsStr} -- --no-timestamps ${escapeShellArgs fs.extraOptions}";
+            ExecStart = "${pkgs.bees}/bin/bees-service-wrapper run ${configOptsStr} -- --no-timestamps ${lib.escapeShellArgs fs.extraOptions}";
             ExecStopPost = "${pkgs.bees}/bin/bees-service-wrapper cleanup ${configOptsStr}";
             CPUAccounting = true;
             CPUSchedulingPolicy = "batch";
diff --git a/nixos/modules/services/misc/bepasty.nix b/nixos/modules/services/misc/bepasty.nix
index fad4827c6650..76e85a91317c 100644
--- a/nixos/modules/services/misc/bepasty.nix
+++ b/nixos/modules/services/misc/bepasty.nix
@@ -1,6 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
 let
   gunicorn = pkgs.python3Packages.gunicorn;
   bepasty = pkgs.bepasty;
@@ -13,20 +11,20 @@ let
 in
 {
   options.services.bepasty = {
-    enable = mkEnableOption "bepasty, a binary pastebin server";
+    enable = lib.mkEnableOption "bepasty, a binary pastebin server";
 
-    servers = mkOption {
+    servers = lib.mkOption {
       default = {};
       description = ''
         configure a number of bepasty servers which will be started with
         gunicorn.
         '';
-      type = with types ; attrsOf (submodule ({ config, ... } : {
+      type = with lib.types ; attrsOf (submodule ({ config, ... } : {
 
         options = {
 
-          bind = mkOption {
-            type = types.str;
+          bind = lib.mkOption {
+            type = lib.types.str;
             description = ''
               Bind address to be used for this server.
               '';
@@ -34,16 +32,16 @@ in
             default = "127.0.0.1:8000";
           };
 
-          dataDir = mkOption {
-            type = types.str;
+          dataDir = lib.mkOption {
+            type = lib.types.str;
             description = ''
               Path to the directory where the pastes will be saved to
               '';
             default = default_home+"/data";
           };
 
-          defaultPermissions = mkOption {
-            type = types.str;
+          defaultPermissions = lib.mkOption {
+            type = lib.types.str;
             description = ''
               default permissions for all unauthenticated accesses.
               '';
@@ -51,8 +49,8 @@ in
             default = "read";
           };
 
-          extraConfig = mkOption {
-            type = types.lines;
+          extraConfig = lib.mkOption {
+            type = lib.types.lines;
             description = ''
               Extra configuration for bepasty server to be appended on the
               configuration.
@@ -68,8 +66,8 @@ in
               '';
           };
 
-          secretKey = mkOption {
-            type = types.str;
+          secretKey = lib.mkOption {
+            type = lib.types.str;
             description = ''
               server secret for safe session cookies, must be set.
 
@@ -81,8 +79,8 @@ in
             default = "";
           };
 
-          secretKeyFile = mkOption {
-            type = types.nullOr types.str;
+          secretKeyFile = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
             default = null;
             description = ''
               A file that contains the server secret for safe session cookies, must be set.
@@ -94,8 +92,8 @@ in
               '';
           };
 
-          workDir = mkOption {
-            type = types.str;
+          workDir = lib.mkOption {
+            type = lib.types.str;
             description = ''
               Path to the working directory (used for config and pidfile).
               Defaults to the users home directory.
@@ -105,7 +103,7 @@ in
 
         };
         config = {
-          secretKeyFile = mkDefault (
+          secretKeyFile = lib.mkDefault (
             if config.secretKey != ""
             then toString (pkgs.writeTextFile {
               name = "bepasty-secret-key";
@@ -118,13 +116,13 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     environment.systemPackages = [ bepasty ];
 
     # creates gunicorn systemd service for each configured server
-    systemd.services = mapAttrs' (name: server:
-      nameValuePair ("bepasty-server-${name}-gunicorn")
+    systemd.services = lib.mapAttrs' (name: server:
+      lib.nameValuePair ("bepasty-server-${name}-gunicorn")
         ({
           description = "Bepasty Server ${name}";
           wantedBy = [ "multi-user.target" ];
diff --git a/nixos/modules/services/misc/calibre-server.nix b/nixos/modules/services/misc/calibre-server.nix
index 8e2ce2909239..5fa3c11a48aa 100644
--- a/nixos/modules/services/misc/calibre-server.nix
+++ b/nixos/modules/services/misc/calibre-server.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   cfg = config.services.calibre-server;
@@ -9,21 +6,21 @@ let
   documentationLink = "https://manual.calibre-ebook.com";
   generatedDocumentationLink = documentationLink + "/generated/en/calibre-server.html";
 
-  execFlags = (concatStringsSep " "
-    (mapAttrsToList (k: v: "${k} ${toString v}") (filterAttrs (name: value: value != null) {
+  execFlags = (lib.concatStringsSep " "
+    (lib.mapAttrsToList (k: v: "${k} ${toString v}") (lib.filterAttrs (name: value: value != null) {
       "--listen-on" = cfg.host;
       "--port" = cfg.port;
       "--auth-mode" = cfg.auth.mode;
       "--userdb" = cfg.auth.userDb;
-    }) ++ [(optionalString (cfg.auth.enable == true) "--enable-auth")])
+    }) ++ [(lib.optionalString (cfg.auth.enable == true) "--enable-auth")])
   );
 in
 
 {
   imports = [
-    (mkChangedOptionModule [ "services" "calibre-server" "libraryDir" ] [ "services" "calibre-server" "libraries" ]
+    (lib.mkChangedOptionModule [ "services" "calibre-server" "libraryDir" ] [ "services" "calibre-server" "libraries" ]
       (config:
-        let libraryDir = getAttrFromPath [ "services" "calibre-server" "libraryDir" ] config;
+        let libraryDir = lib.getAttrFromPath [ "services" "calibre-server" "libraryDir" ] config;
         in [ libraryDir ]
       )
     )
@@ -32,11 +29,11 @@ in
   options = {
     services.calibre-server = {
 
-      enable = mkEnableOption "calibre-server (e-book software)";
+      enable = lib.mkEnableOption "calibre-server (e-book software)";
       package = lib.mkPackageOption pkgs "calibre" { };
 
-      libraries = mkOption {
-        type = types.listOf types.path;
+      libraries = lib.mkOption {
+        type = lib.types.listOf lib.types.path;
         default = [ "/var/lib/calibre-server" ];
         description = ''
           Make sure each library path is initialized before service startup.
@@ -45,20 +42,20 @@ in
         '';
       };
 
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = "calibre-server";
         description = "The user under which calibre-server runs.";
       };
 
-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
         default = "calibre-server";
         description = "The group under which calibre-server runs.";
       };
 
-      host = mkOption {
-        type = types.str;
+      host = lib.mkOption {
+        type = lib.types.str;
         default = "0.0.0.0";
         example = "::1";
         description = ''
@@ -67,9 +64,9 @@ in
         '';
       };
 
-      port = mkOption {
+      port = lib.mkOption {
         default = 8080;
-        type = types.port;
+        type = lib.types.port;
         description = ''
           The port on which to listen for connections.
           See the [calibre-server documentation](${generatedDocumentationLink}#cmdoption-calibre-server-port) for details.
@@ -77,8 +74,8 @@ in
       };
 
       auth = {
-        enable = mkOption {
-          type = types.bool;
+        enable = lib.mkOption {
+          type = lib.types.bool;
           default = false;
           description = ''
             Password based authentication to access the server.
@@ -86,8 +83,8 @@ in
           '';
         };
 
-        mode = mkOption {
-          type = types.enum [ "auto" "basic" "digest" ];
+        mode = lib.mkOption {
+          type = lib.types.enum [ "auto" "basic" "digest" ];
           default = "auto";
           description = ''
             Choose the type of authentication used.
@@ -96,9 +93,9 @@ in
           '';
         };
 
-        userDb = mkOption {
+        userDb = lib.mkOption {
           default = null;
-          type = types.nullOr types.path;
+          type = lib.types.nullOr lib.types.path;
           description = ''
             Choose users database file to use for authentication.
             Make sure users database file is initialized before service startup.
@@ -109,7 +106,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     systemd.services.calibre-server = {
       description = "Calibre Server";
@@ -125,7 +122,7 @@ in
 
     environment.systemPackages = [ pkgs.calibre ];
 
-    users.users = optionalAttrs (cfg.user == "calibre-server") {
+    users.users = lib.optionalAttrs (cfg.user == "calibre-server") {
       calibre-server = {
         home = "/var/lib/calibre-server";
         createHome = true;
@@ -134,7 +131,7 @@ in
       };
     };
 
-    users.groups = optionalAttrs (cfg.group == "calibre-server") {
+    users.groups = lib.optionalAttrs (cfg.group == "calibre-server") {
       calibre-server = {
         gid = config.ids.gids.calibre-server;
       };
diff --git a/nixos/modules/services/misc/canto-daemon.nix b/nixos/modules/services/misc/canto-daemon.nix
index db51a263aab5..c5a702b79e44 100644
--- a/nixos/modules/services/misc/canto-daemon.nix
+++ b/nixos/modules/services/misc/canto-daemon.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
 cfg = config.services.canto-daemon;
@@ -13,8 +10,8 @@ in {
   options = {
 
     services.canto-daemon = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Whether to enable the canto RSS daemon.";
       };
@@ -24,7 +21,7 @@ in {
 
 ##### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     systemd.user.services.canto-daemon = {
       description = "Canto RSS Daemon";
diff --git a/nixos/modules/services/misc/cfdyndns.nix b/nixos/modules/services/misc/cfdyndns.nix
index 506e5f7613c0..a34e5d6d3913 100644
--- a/nixos/modules/services/misc/cfdyndns.nix
+++ b/nixos/modules/services/misc/cfdyndns.nix
@@ -1,50 +1,47 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   cfg = config.services.cfdyndns;
 in
 {
   imports = [
-    (mkRemovedOptionModule
+    (lib.mkRemovedOptionModule
       [ "services" "cfdyndns" "apikey" ]
       "Use services.cfdyndns.apikeyFile instead.")
   ];
 
   options = {
     services.cfdyndns = {
-      enable = mkEnableOption "Cloudflare Dynamic DNS Client";
+      enable = lib.mkEnableOption "Cloudflare Dynamic DNS Client";
 
-      email = mkOption {
-        type = types.str;
+      email = lib.mkOption {
+        type = lib.types.str;
         description = ''
           The email address to use to authenticate to CloudFlare.
         '';
       };
 
-      apiTokenFile = mkOption {
+      apiTokenFile = lib.mkOption {
         default = null;
-        type = types.nullOr types.str;
+        type = lib.types.nullOr lib.types.str;
         description = ''
           The path to a file containing the API Token
           used to authenticate with CloudFlare.
         '';
       };
 
-      apikeyFile = mkOption {
+      apikeyFile = lib.mkOption {
         default = null;
-        type = types.nullOr types.str;
+        type = lib.types.nullOr lib.types.str;
         description = ''
           The path to a file containing the API Key
           used to authenticate with CloudFlare.
         '';
       };
 
-      records = mkOption {
+      records = lib.mkOption {
         default = [];
         example = [ "host.tld" ];
-        type = types.listOf types.str;
+        type = lib.types.listOf lib.types.str;
         description = ''
           The records to update in CloudFlare.
         '';
@@ -52,7 +49,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.cfdyndns = {
       description = "CloudFlare Dynamic DNS Client";
       after = [ "network.target" ];
@@ -64,14 +61,14 @@ in
         DynamicUser = true;
       };
       environment = {
-        CLOUDFLARE_RECORDS="${concatStringsSep "," cfg.records}";
+        CLOUDFLARE_RECORDS="${lib.concatStringsSep "," cfg.records}";
       };
       script = ''
-        ${optionalString (cfg.apikeyFile != null) ''
-          export CLOUDFLARE_APIKEY="$(cat ${escapeShellArg cfg.apikeyFile})"
+        ${lib.optionalString (cfg.apikeyFile != null) ''
+          export CLOUDFLARE_APIKEY="$(cat ${lib.escapeShellArg cfg.apikeyFile})"
           export CLOUDFLARE_EMAIL="${cfg.email}"
         ''}
-        ${optionalString (cfg.apiTokenFile != null) ''
+        ${lib.optionalString (cfg.apiTokenFile != null) ''
           export CLOUDFLARE_APITOKEN=$(${pkgs.systemd}/bin/systemd-creds cat CLOUDFLARE_APITOKEN_FILE)
         ''}
         ${pkgs.cfdyndns}/bin/cfdyndns
diff --git a/nixos/modules/services/misc/cgminer.nix b/nixos/modules/services/misc/cgminer.nix
index dd857124b226..6aa6bc63c99c 100644
--- a/nixos/modules/services/misc/cgminer.nix
+++ b/nixos/modules/services/misc/cgminer.nix
@@ -1,25 +1,22 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.cgminer;
 
   convType = with builtins;
-    v: if isBool v then boolToString v else toString v;
+    v: if lib.isBool v then lib.boolToString v else toString v;
   mergedHwConfig =
-    mapAttrsToList (n: v: ''"${n}": "${(concatStringsSep "," (map convType v))}"'')
-      (foldAttrs (n: a: [n] ++ a) [] cfg.hardware);
+    lib.mapAttrsToList (n: v: ''"${n}": "${(lib.concatStringsSep "," (map convType v))}"'')
+      (lib.foldAttrs (n: a: [n] ++ a) [] cfg.hardware);
   mergedConfig = with builtins;
-    mapAttrsToList (n: v: ''"${n}":  ${if isBool v then convType v else ''"${convType v}"''}'')
+    lib.mapAttrsToList (n: v: ''"${n}":  ${if lib.isBool v then convType v else ''"${convType v}"''}'')
       cfg.config;
 
   cgminerConfig = pkgs.writeText "cgminer.conf" ''
   {
-  ${concatStringsSep ",\n" mergedHwConfig},
-  ${concatStringsSep ",\n" mergedConfig},
+  ${lib.concatStringsSep ",\n" mergedHwConfig},
+  ${lib.concatStringsSep ",\n" mergedConfig},
   "pools": [
-  ${concatStringsSep ",\n"
+  ${lib.concatStringsSep ",\n"
     (map (v: ''{"url": "${v.url}", "user": "${v.user}", "pass": "${v.pass}"}'')
           cfg.pools)}]
   }
@@ -31,19 +28,19 @@ in
 
     services.cgminer = {
 
-      enable = mkEnableOption "cgminer, an ASIC/FPGA/GPU miner for bitcoin and litecoin";
+      enable = lib.mkEnableOption "cgminer, an ASIC/FPGA/GPU miner for bitcoin and litecoin";
 
-      package = mkPackageOption pkgs "cgminer" { };
+      package = lib.mkPackageOption pkgs "cgminer" { };
 
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = "cgminer";
         description = "User account under which cgminer runs";
       };
 
-      pools = mkOption {
+      pools = lib.mkOption {
         default = [];  # Run benchmark
-        type = types.listOf (types.attrsOf types.str);
+        type = lib.types.listOf (lib.types.attrsOf lib.types.str);
         description = "List of pools where to mine";
         example = [{
           url = "http://p2pool.org:9332";
@@ -52,9 +49,9 @@ in
         }];
       };
 
-      hardware = mkOption {
+      hardware = lib.mkOption {
         default = []; # Run without options
-        type = types.listOf (types.attrsOf (types.either types.str types.int));
+        type = lib.types.listOf (lib.types.attrsOf (lib.types.either lib.types.str lib.types.int));
         description= "List of config options for every GPU";
         example = [
         {
@@ -79,9 +76,9 @@ in
         }];
       };
 
-      config = mkOption {
+      config = lib.mkOption {
         default = {};
-        type = types.attrsOf (types.either types.bool types.int);
+        type = lib.types.attrsOf (lib.types.either lib.types.bool lib.types.int);
         description = "Additional config";
         example = {
           auto-fan = true;
@@ -101,16 +98,16 @@ in
 
   ###### implementation
 
-  config = mkIf config.services.cgminer.enable {
+  config = lib.mkIf config.services.cgminer.enable {
 
-    users.users = optionalAttrs (cfg.user == "cgminer") {
+    users.users = lib.optionalAttrs (cfg.user == "cgminer") {
       cgminer = {
         isSystemUser = true;
         group = "cgminer";
         description = "Cgminer user";
       };
     };
-    users.groups = optionalAttrs (cfg.user == "cgminer") {
+    users.groups = lib.optionalAttrs (cfg.user == "cgminer") {
       cgminer = {};
     };
 
diff --git a/nixos/modules/services/misc/clipcat.nix b/nixos/modules/services/misc/clipcat.nix
index fa608e73c7d6..4a46adc0758a 100644
--- a/nixos/modules/services/misc/clipcat.nix
+++ b/nixos/modules/services/misc/clipcat.nix
@@ -1,18 +1,15 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.clipcat;
 in {
 
   options.services.clipcat= {
-    enable = mkEnableOption "Clipcat clipboard daemon";
+    enable = lib.mkEnableOption "Clipcat clipboard daemon";
 
-    package = mkPackageOption pkgs "clipcat" { };
+    package = lib.mkPackageOption pkgs "clipcat" { };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.user.services.clipcat = {
       enable      = true;
       description = "clipcat daemon";
diff --git a/nixos/modules/services/misc/clipmenu.nix b/nixos/modules/services/misc/clipmenu.nix
index 71d36f9ef130..559917b7a2bf 100644
--- a/nixos/modules/services/misc/clipmenu.nix
+++ b/nixos/modules/services/misc/clipmenu.nix
@@ -1,18 +1,15 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.clipmenu;
 in {
 
   options.services.clipmenu = {
-    enable = mkEnableOption "clipmenu, the clipboard management daemon";
+    enable = lib.mkEnableOption "clipmenu, the clipboard management daemon";
 
-    package = mkPackageOption pkgs "clipmenu" { };
+    package = lib.mkPackageOption pkgs "clipmenu" { };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.user.services.clipmenu = {
       enable      = true;
       description = "Clipboard management daemon";
diff --git a/nixos/modules/services/misc/confd.nix b/nixos/modules/services/misc/confd.nix
index 836a1119a577..7744cee32049 100644
--- a/nixos/modules/services/misc/confd.nix
+++ b/nixos/modules/services/misc/confd.nix
@@ -1,7 +1,4 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   cfg = config.services.confd;
 
@@ -9,62 +6,62 @@ let
     backend = "${cfg.backend}"
     confdir = "${cfg.confDir}"
     interval = ${toString cfg.interval}
-    nodes = [ ${concatMapStringsSep "," (s: ''"${s}"'') cfg.nodes}, ]
+    nodes = [ ${lib.concatMapStringsSep "," (s: ''"${s}"'') cfg.nodes}, ]
     prefix = "${cfg.prefix}"
     log-level = "${cfg.logLevel}"
-    watch = ${boolToString cfg.watch}
+    watch = ${lib.boolToString cfg.watch}
   '';
 
 in {
   options.services.confd = {
-    enable = mkEnableOption "confd, a service to manage local application configuration files using templates and data from etcd/consul/redis/zookeeper";
+    enable = lib.mkEnableOption "confd, a service to manage local application configuration files using templates and data from etcd/consul/redis/zookeeper";
 
-    backend = mkOption {
+    backend = lib.mkOption {
       description = "Confd config storage backend to use.";
       default = "etcd";
-      type = types.enum ["etcd" "consul" "redis" "zookeeper"];
+      type = lib.types.enum ["etcd" "consul" "redis" "zookeeper"];
     };
 
-    interval = mkOption {
+    interval = lib.mkOption {
       description = "Confd check interval.";
       default = 10;
-      type = types.int;
+      type = lib.types.int;
     };
 
-    nodes = mkOption {
+    nodes = lib.mkOption {
       description = "Confd list of nodes to connect to.";
       default = [ "http://127.0.0.1:2379" ];
-      type = types.listOf types.str;
+      type = lib.types.listOf lib.types.str;
     };
 
-    watch = mkOption {
+    watch = lib.mkOption {
       description = "Confd, whether to watch etcd config for changes.";
       default = true;
-      type = types.bool;
+      type = lib.types.bool;
     };
 
-    prefix = mkOption {
+    prefix = lib.mkOption {
       description = "The string to prefix to keys.";
       default = "/";
-      type = types.path;
+      type = lib.types.path;
     };
 
-    logLevel = mkOption {
+    logLevel = lib.mkOption {
       description = "Confd log level.";
       default = "info";
-      type = types.enum ["info" "debug"];
+      type = lib.types.enum ["info" "debug"];
     };
 
-    confDir = mkOption {
+    confDir = lib.mkOption {
       description = "The path to the confd configs.";
       default = "/etc/confd";
-      type = types.path;
+      type = lib.types.path;
     };
 
-    package = mkPackageOption pkgs "confd" { };
+    package = lib.mkPackageOption pkgs "confd" { };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.confd = {
       description = "Confd Service.";
       wantedBy = [ "multi-user.target" ];
@@ -80,6 +77,6 @@ in {
 
     environment.systemPackages = [ cfg.package ];
 
-    services.etcd.enable = mkIf (cfg.backend == "etcd") (mkDefault true);
+    services.etcd.enable = lib.mkIf (cfg.backend == "etcd") (lib.mkDefault true);
   };
 }
diff --git a/nixos/modules/services/misc/cpuminer-cryptonight.nix b/nixos/modules/services/misc/cpuminer-cryptonight.nix
index 907b9d90da29..c61c0d7c34bd 100644
--- a/nixos/modules/services/misc/cpuminer-cryptonight.nix
+++ b/nixos/modules/services/misc/cpuminer-cryptonight.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.cpuminer-cryptonight;
 
@@ -20,28 +17,28 @@ in
   options = {
 
     services.cpuminer-cryptonight = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to enable the cpuminer cryptonight miner.
         '';
       };
-      url = mkOption {
-        type = types.str;
+      url = lib.mkOption {
+        type = lib.types.str;
         description = "URL of mining server";
       };
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         description = "Username for mining server";
       };
-      pass = mkOption {
-        type = types.str;
+      pass = lib.mkOption {
+        type = lib.types.str;
         default = "x";
         description = "Password for mining server";
       };
-      threads = mkOption {
-        type = types.int;
+      threads = lib.mkOption {
+        type = lib.types.int;
         default = 0;
         description = "Number of miner threads, defaults to available processors";
       };
@@ -49,7 +46,7 @@ in
 
   };
 
-  config = mkIf config.services.cpuminer-cryptonight.enable {
+  config = lib.mkIf config.services.cpuminer-cryptonight.enable {
 
     systemd.services.cpuminer-cryptonight = {
       description = "Cryptonight cpuminer";
diff --git a/nixos/modules/services/misc/devmon.nix b/nixos/modules/services/misc/devmon.nix
index e4a3348646b1..13e2ab7f31c2 100644
--- a/nixos/modules/services/misc/devmon.nix
+++ b/nixos/modules/services/misc/devmon.nix
@@ -1,18 +1,15 @@
 { pkgs, config, lib, ... }:
-
-with lib;
-
 let
   cfg = config.services.devmon;
 
 in {
   options = {
     services.devmon = {
-      enable = mkEnableOption "devmon, an automatic device mounting daemon";
+      enable = lib.mkEnableOption "devmon, an automatic device mounting daemon";
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.user.services.devmon = {
       description = "devmon automatic device mounting daemon";
       wantedBy = [ "default.target" ];
diff --git a/nixos/modules/services/misc/devpi-server.nix b/nixos/modules/services/misc/devpi-server.nix
index 92c0c6206c8b..ad72a8ced69a 100644
--- a/nixos/modules/services/misc/devpi-server.nix
+++ b/nixos/modules/services/misc/devpi-server.nix
@@ -4,7 +4,6 @@
   config,
   ...
 }:
-with lib;
 let
   cfg = config.services.devpi-server;
 
@@ -17,17 +16,17 @@ let
 in
 {
   options.services.devpi-server = {
-    enable = mkEnableOption "Devpi Server";
+    enable = lib.mkEnableOption "Devpi Server";
 
-    package = mkPackageOption pkgs "devpi-server" { };
+    package = lib.mkPackageOption pkgs "devpi-server" { };
 
-    primaryUrl = mkOption {
-      type = types.str;
+    primaryUrl = lib.mkOption {
+      type = lib.types.str;
       description = "Url for the primary node. Required option for replica nodes.";
     };
 
-    replica = mkOption {
-      type = types.bool;
+    replica = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''
         Run node as a replica.
@@ -35,8 +34,8 @@ in
       '';
     };
 
-    secretFile = mkOption {
-      type = types.nullOr types.path;
+    secretFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
       default = null;
       description = ''
         Path to a shared secret file used for synchronization,
@@ -44,24 +43,24 @@ in
       '';
     };
 
-    host = mkOption {
-      type = types.str;
+    host = lib.mkOption {
+      type = lib.types.str;
       default = "localhost";
       description = ''
         domain/ip address to listen on
       '';
     };
 
-    port = mkOption {
-      type = types.port;
+    port = lib.mkOption {
+      type = lib.types.port;
       default = 3141;
       description = "The port on which Devpi Server will listen.";
     };
 
-    openFirewall = mkEnableOption "opening the default ports in the firewall for Devpi Server";
+    openFirewall = lib.mkEnableOption "opening the default ports in the firewall for Devpi Server";
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     systemd.services.devpi-server = {
       enable = true;
@@ -74,7 +73,7 @@ in
       # have 0600 permissions.
       preStart =
         ''
-          ${optionalString (!isNull cfg.secretFile)
+          ${lib.optionalString (!isNull cfg.secretFile)
             "install -Dm 0600 \${CREDENTIALS_DIRECTORY}/devpi-secret ${runtimeDir}/${secretsFileName}"
           }
 
@@ -83,7 +82,7 @@ in
             exit 0
           fi
           ${cfg.package}/bin/devpi-init --serverdir ${serverDir} ''
-        + strings.optionalString cfg.replica "--role=replica --master-url=${cfg.primaryUrl}";
+        + lib.optionalString cfg.replica "--role=replica --master-url=${cfg.primaryUrl}";
 
       serviceConfig = {
         LoadCredential = lib.mkIf (! isNull cfg.secretFile) [
@@ -112,7 +111,7 @@ in
                   [ "--role=master" ]
               );
           in
-          "${cfg.package}/bin/devpi-server ${concatStringsSep " " args}";
+          "${cfg.package}/bin/devpi-server ${lib.concatStringsSep " " args}";
         DynamicUser = true;
         StateDirectory = stateDirName;
         RuntimeDirectory = stateDirName;
@@ -123,10 +122,10 @@ in
       };
     };
 
-    networking.firewall = mkIf cfg.openFirewall {
+    networking.firewall = lib.mkIf cfg.openFirewall {
       allowedTCPPorts = [ cfg.port ];
     };
 
-    meta.maintainers = [ cafkafk ];
+    meta.maintainers = [ lib.maintainers.cafkafk ];
   };
 }
diff --git a/nixos/modules/services/misc/dictd.nix b/nixos/modules/services/misc/dictd.nix
index 6660d5e977ff..b11a87f28905 100644
--- a/nixos/modules/services/misc/dictd.nix
+++ b/nixos/modules/services/misc/dictd.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.dictd;
 in
@@ -14,19 +11,19 @@ in
 
     services.dictd = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to enable the DICT.org dictionary server.
         '';
       };
 
-      DBs = mkOption {
-        type = types.listOf types.package;
+      DBs = lib.mkOption {
+        type = lib.types.listOf lib.types.package;
         default = with pkgs.dictdDBs; [ wiktionary wordnet ];
-        defaultText = literalExpression "with pkgs.dictdDBs; [ wiktionary wordnet ]";
-        example = literalExpression "[ pkgs.dictdDBs.nld2eng ]";
+        defaultText = lib.literalExpression "with pkgs.dictdDBs; [ wiktionary wordnet ]";
+        example = lib.literalExpression "[ pkgs.dictdDBs.nld2eng ]";
         description = "List of databases to make available.";
       };
 
@@ -40,7 +37,7 @@ in
   config = let dictdb = pkgs.dictDBCollector { dictlist = map (x: {
                name = x.name;
                filename = x; } ) cfg.DBs; };
-  in mkIf cfg.enable {
+  in lib.mkIf cfg.enable {
 
     # get the command line client on system path to make some use of the service
     environment.systemPackages = [ pkgs.dict ];
diff --git a/nixos/modules/services/misc/disnix.nix b/nixos/modules/services/misc/disnix.nix
index 80e749204993..619fbcf92308 100644
--- a/nixos/modules/services/misc/disnix.nix
+++ b/nixos/modules/services/misc/disnix.nix
@@ -1,8 +1,5 @@
 # Disnix server
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   cfg = config.services.disnix;
@@ -17,22 +14,22 @@ in
 
     services.disnix = {
 
-      enable = mkEnableOption "Disnix";
+      enable = lib.mkEnableOption "Disnix";
 
-      enableMultiUser = mkOption {
-        type = types.bool;
+      enableMultiUser = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = "Whether to support multi-user mode by enabling the Disnix D-Bus service";
       };
 
-      useWebServiceInterface = mkEnableOption "the DisnixWebService interface running on Apache Tomcat";
+      useWebServiceInterface = lib.mkEnableOption "the DisnixWebService interface running on Apache Tomcat";
 
-      package = mkPackageOption pkgs "disnix" {};
+      package = lib.mkPackageOption pkgs "disnix" {};
 
-      enableProfilePath = mkEnableOption "exposing the Disnix profiles in the system's PATH";
+      enableProfilePath = lib.mkEnableOption "exposing the Disnix profiles in the system's PATH";
 
-      profiles = mkOption {
-        type = types.listOf types.str;
+      profiles = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [ "default" ];
         description = "Names of the Disnix profiles to expose in the system's PATH";
       };
@@ -42,10 +39,10 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     dysnomia.enable = true;
 
-    environment.systemPackages = [ pkgs.disnix ] ++ optional cfg.useWebServiceInterface pkgs.DisnixWebService;
+    environment.systemPackages = [ pkgs.disnix ] ++ lib.optional cfg.useWebServiceInterface pkgs.DisnixWebService;
     environment.variables.PATH = lib.optionals cfg.enableProfilePath (map (profileName: "/nix/var/nix/profiles/disnix/${profileName}/bin" ) cfg.profiles);
     environment.variables.DISNIX_REMOTE_CLIENT = lib.optionalString (cfg.enableMultiUser) "disnix-client";
 
@@ -54,26 +51,26 @@ in
 
     services.tomcat.enable = cfg.useWebServiceInterface;
     services.tomcat.extraGroups = [ "disnix" ];
-    services.tomcat.javaOpts = "${optionalString cfg.useWebServiceInterface "-Djava.library.path=${pkgs.libmatthew_java}/lib/jni"} ";
-    services.tomcat.sharedLibs = optional cfg.useWebServiceInterface "${pkgs.DisnixWebService}/share/java/DisnixConnection.jar"
-      ++ optional cfg.useWebServiceInterface "${pkgs.dbus_java}/share/java/dbus.jar";
-    services.tomcat.webapps = optional cfg.useWebServiceInterface pkgs.DisnixWebService;
+    services.tomcat.javaOpts = "${lib.optionalString cfg.useWebServiceInterface "-Djava.library.path=${pkgs.libmatthew_java}/lib/jni"} ";
+    services.tomcat.sharedLibs = lib.optional cfg.useWebServiceInterface "${pkgs.DisnixWebService}/share/java/DisnixConnection.jar"
+      ++ lib.optional cfg.useWebServiceInterface "${pkgs.dbus_java}/share/java/dbus.jar";
+    services.tomcat.webapps = lib.optional cfg.useWebServiceInterface pkgs.DisnixWebService;
 
     users.groups.disnix.gid = config.ids.gids.disnix;
 
     systemd.services = {
-      disnix = mkIf cfg.enableMultiUser {
+      disnix = lib.mkIf cfg.enableMultiUser {
         description = "Disnix server";
         wants = [ "dysnomia.target" ];
         wantedBy = [ "multi-user.target" ];
         after = [ "dbus.service" ]
-          ++ optional config.services.httpd.enable "httpd.service"
-          ++ optional config.services.mysql.enable "mysql.service"
-          ++ optional config.services.postgresql.enable "postgresql.service"
-          ++ optional config.services.tomcat.enable "tomcat.service"
-          ++ optional config.services.svnserve.enable "svnserve.service"
-          ++ optional config.services.mongodb.enable "mongodb.service"
-          ++ optional config.services.influxdb.enable "influxdb.service";
+          ++ lib.optional config.services.httpd.enable "httpd.service"
+          ++ lib.optional config.services.mysql.enable "mysql.service"
+          ++ lib.optional config.services.postgresql.enable "postgresql.service"
+          ++ lib.optional config.services.tomcat.enable "tomcat.service"
+          ++ lib.optional config.services.svnserve.enable "svnserve.service"
+          ++ lib.optional config.services.mongodb.enable "mongodb.service"
+          ++ lib.optional config.services.influxdb.enable "influxdb.service";
 
         restartIfChanged = false;
 
@@ -82,8 +79,8 @@ in
         environment = {
           HOME = "/root";
         }
-        // (optionalAttrs (config.environment.variables ? DYSNOMIA_CONTAINERS_PATH) { inherit (config.environment.variables) DYSNOMIA_CONTAINERS_PATH; })
-        // (optionalAttrs (config.environment.variables ? DYSNOMIA_MODULES_PATH) { inherit (config.environment.variables) DYSNOMIA_MODULES_PATH; });
+        // (lib.optionalAttrs (config.environment.variables ? DYSNOMIA_CONTAINERS_PATH) { inherit (config.environment.variables) DYSNOMIA_CONTAINERS_PATH; })
+        // (lib.optionalAttrs (config.environment.variables ? DYSNOMIA_MODULES_PATH) { inherit (config.environment.variables) DYSNOMIA_MODULES_PATH; });
 
         serviceConfig.ExecStart = "${cfg.package}/bin/disnix-service";
       };
diff --git a/nixos/modules/services/misc/docker-registry.nix b/nixos/modules/services/misc/docker-registry.nix
index 93bf71ea3ecc..99d5e3e1804a 100644
--- a/nixos/modules/services/misc/docker-registry.nix
+++ b/nixos/modules/services/misc/docker-registry.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.dockerRegistry;
 
@@ -15,7 +12,7 @@ let
     storage = {
       cache.blobdescriptor = blobCache;
       delete.enabled = cfg.enableDelete;
-    } // (optionalAttrs (cfg.storagePath != null) { filesystem.rootdirectory = cfg.storagePath; });
+    } // (lib.optionalAttrs (cfg.storagePath != null) { filesystem.rootdirectory = cfg.storagePath; });
     http = {
       addr = "${cfg.listenAddress}:${builtins.toString cfg.port}";
       headers.X-Content-Type-Options = ["nosniff"];
@@ -27,7 +24,7 @@ let
     };
   };
 
-  registryConfig.redis = mkIf cfg.enableRedisCache {
+  registryConfig.redis = lib.mkIf cfg.enableRedisCache {
     addr = "${cfg.redisUrl}";
     password = "${cfg.redisPassword}";
     db = 0;
@@ -44,32 +41,32 @@ let
   configFile = cfg.configFile;
 in {
   options.services.dockerRegistry = {
-    enable = mkEnableOption "Docker Registry";
+    enable = lib.mkEnableOption "Docker Registry";
 
-    package = mkPackageOption pkgs "docker-distribution" {
+    package = lib.mkPackageOption pkgs "docker-distribution" {
       example = "gitlab-container-registry";
     };
 
-    listenAddress = mkOption {
+    listenAddress = lib.mkOption {
       description = "Docker registry host or ip to bind to.";
       default = "127.0.0.1";
-      type = types.str;
+      type = lib.types.str;
     };
 
-    port = mkOption {
+    port = lib.mkOption {
       description = "Docker registry port to bind to.";
       default = 5000;
-      type = types.port;
+      type = lib.types.port;
     };
 
-    openFirewall = mkOption {
-      type = types.bool;
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = "Opens the port used by the firewall.";
     };
 
-    storagePath = mkOption {
-      type = types.nullOr types.path;
+    storagePath = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
       default = "/var/lib/docker-registry";
       description = ''
         Docker registry storage path for the filesystem storage backend. Set to
@@ -77,50 +74,50 @@ in {
       '';
     };
 
-    enableDelete = mkOption {
-      type = types.bool;
+    enableDelete = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = "Enable delete for manifests and blobs.";
     };
 
-    enableRedisCache = mkEnableOption "redis as blob cache";
+    enableRedisCache = lib.mkEnableOption "redis as blob cache";
 
-    redisUrl = mkOption {
-      type = types.str;
+    redisUrl = lib.mkOption {
+      type = lib.types.str;
       default = "localhost:6379";
       description = "Set redis host and port.";
     };
 
-    redisPassword = mkOption {
-      type = types.str;
+    redisPassword = lib.mkOption {
+      type = lib.types.str;
       default = "";
       description = "Set redis password.";
     };
 
-    extraConfig = mkOption {
+    extraConfig = lib.mkOption {
       description = ''
         Docker extra registry configuration via environment variables.
       '';
       default = {};
-      type = types.attrs;
+      type = lib.types.attrs;
     };
 
     configFile = lib.mkOption {
-      default = pkgs.writeText "docker-registry-config.yml" (builtins.toJSON (recursiveUpdate registryConfig cfg.extraConfig));
-      defaultText = literalExpression ''pkgs.writeText "docker-registry-config.yml" "# my custom docker-registry-config.yml ..."'';
+      default = pkgs.writeText "docker-registry-config.yml" (builtins.toJSON (lib.recursiveUpdate registryConfig cfg.extraConfig));
+      defaultText = lib.literalExpression ''pkgs.writeText "docker-registry-config.yml" "# my custom docker-registry-config.yml ..."'';
       description = ''
        Path to CNCF distribution config file.
 
        Setting this option will override any configuration applied by the extraConfig option.
       '';
-      type =  types.path;
+      type =  lib.types.path;
     };
 
-    enableGarbageCollect = mkEnableOption "garbage collect";
+    enableGarbageCollect = lib.mkEnableOption "garbage collect";
 
-    garbageCollectDates = mkOption {
+    garbageCollectDates = lib.mkOption {
       default = "daily";
-      type = types.str;
+      type = lib.types.str;
       description = ''
         Specification (in the format described by
         {manpage}`systemd.time(7)`) of the time at
@@ -129,7 +126,7 @@ in {
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.docker-registry = {
       description = "Docker Container Registry";
       wantedBy = [ "multi-user.target" ];
@@ -141,7 +138,7 @@ in {
       serviceConfig = {
         User = "docker-registry";
         WorkingDirectory = cfg.storagePath;
-        AmbientCapabilities = mkIf (cfg.port < 1024) "cap_net_bind_service";
+        AmbientCapabilities = lib.mkIf (cfg.port < 1024) "cap_net_bind_service";
       };
     };
 
@@ -158,11 +155,11 @@ in {
         /run/current-system/systemd/bin/systemctl restart docker-registry.service
       '';
 
-      startAt = optional cfg.enableGarbageCollect cfg.garbageCollectDates;
+      startAt = lib.optional cfg.enableGarbageCollect cfg.garbageCollectDates;
     };
 
     users.users.docker-registry =
-      (optionalAttrs (cfg.storagePath != null) {
+      (lib.optionalAttrs (cfg.storagePath != null) {
         createHome = true;
         home = cfg.storagePath;
       }) // {
@@ -171,7 +168,7 @@ in {
       };
     users.groups.docker-registry = {};
 
-    networking.firewall = mkIf cfg.openFirewall {
+    networking.firewall = lib.mkIf cfg.openFirewall {
       allowedTCPPorts = [ cfg.port ];
     };
   };
diff --git a/nixos/modules/services/misc/domoticz.nix b/nixos/modules/services/misc/domoticz.nix
index 52443f49f7b3..13e56f2faea5 100644
--- a/nixos/modules/services/misc/domoticz.nix
+++ b/nixos/modules/services/misc/domoticz.nix
@@ -1,7 +1,4 @@
 { lib, pkgs, config, ... }:
-
-with lib;
-
 let
 
   cfg = config.services.domoticz;
@@ -12,16 +9,16 @@ in {
   options = {
 
     services.domoticz = {
-      enable = mkEnableOption pkgDesc;
+      enable = lib.mkEnableOption pkgDesc;
 
-      bind = mkOption {
-        type = types.str;
+      bind = lib.mkOption {
+        type = lib.types.str;
         default = "0.0.0.0";
         description = "IP address to bind to.";
       };
 
-      port = mkOption {
-        type = types.port;
+      port = lib.mkOption {
+        type = lib.types.port;
         default = 8080;
         description = "Port to bind to for HTTP, set to 0 to disable HTTP.";
       };
@@ -30,7 +27,7 @@ in {
 
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     systemd.services."domoticz" = {
       description = pkgDesc;
diff --git a/nixos/modules/services/misc/duckling.nix b/nixos/modules/services/misc/duckling.nix
index 77d2a92380b0..ed0b7b37d8c8 100644
--- a/nixos/modules/services/misc/duckling.nix
+++ b/nixos/modules/services/misc/duckling.nix
@@ -1,16 +1,13 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.duckling;
 in {
   options = {
     services.duckling = {
-      enable = mkEnableOption "duckling";
+      enable = lib.mkEnableOption "duckling";
 
-      port = mkOption {
-        type = types.port;
+      port = lib.mkOption {
+        type = lib.types.port;
         default = 8080;
         description = ''
           Port on which duckling will run.
@@ -19,7 +16,7 @@ in {
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.duckling = {
       description = "Duckling server service";
       wantedBy    = [ "multi-user.target" ];
diff --git a/nixos/modules/services/misc/dwm-status.nix b/nixos/modules/services/misc/dwm-status.nix
index 081451f2ace9..927561270a79 100644
--- a/nixos/modules/services/misc/dwm-status.nix
+++ b/nixos/modules/services/misc/dwm-status.nix
@@ -1,11 +1,8 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.dwm-status;
 
-  order = concatMapStringsSep "," (feature: ''"${feature}"'') cfg.order;
+  order = lib.concatMapStringsSep "," (feature: ''"${feature}"'') cfg.order;
 
   configFile = pkgs.writeText "dwm-status.toml" ''
     order = [${order}]
@@ -22,21 +19,21 @@ in
 
     services.dwm-status = {
 
-      enable = mkEnableOption "dwm-status user service";
+      enable = lib.mkEnableOption "dwm-status user service";
 
-      package = mkPackageOption pkgs "dwm-status" {
+      package = lib.mkPackageOption pkgs "dwm-status" {
         example = "dwm-status.override { enableAlsaUtils = false; }";
       };
 
-      order = mkOption {
-        type = types.listOf (types.enum [ "audio" "backlight" "battery" "cpu_load" "network" "time" ]);
+      order = lib.mkOption {
+        type = lib.types.listOf (lib.types.enum [ "audio" "backlight" "battery" "cpu_load" "network" "time" ]);
         description = ''
           List of enabled features in order.
         '';
       };
 
-      extraConfig = mkOption {
-        type = types.lines;
+      extraConfig = lib.mkOption {
+        type = lib.types.lines;
         default = "";
         description = ''
           Extra config in TOML format.
@@ -50,9 +47,9 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
-    services.upower.enable = elem "battery" cfg.order;
+    services.upower.enable = lib.elem "battery" cfg.order;
 
     systemd.user.services.dwm-status = {
       description = "Highly performant and configurable DWM status service";
diff --git a/nixos/modules/services/misc/dysnomia.nix b/nixos/modules/services/misc/dysnomia.nix
index 8150b7876221..9f421d7ec375 100644
--- a/nixos/modules/services/misc/dysnomia.nix
+++ b/nixos/modules/services/misc/dysnomia.nix
@@ -1,16 +1,13 @@
 {pkgs, lib, config, ...}:
-
-with lib;
-
 let
   cfg = config.dysnomia;
 
   printProperties = properties:
-    concatMapStrings (propertyName:
+    lib.concatMapStrings (propertyName:
       let
         property = properties.${propertyName};
       in
-      if isList property then "${propertyName}=(${lib.concatMapStrings (elem: "\"${toString elem}\" ") (properties.${propertyName})})\n"
+      if lib.isList property then "${propertyName}=(${lib.concatMapStrings (elem: "\"${toString elem}\" ") (properties.${propertyName})})\n"
       else "${propertyName}=\"${toString property}\"\n"
     ) (builtins.attrNames properties);
 
@@ -29,7 +26,7 @@ let
       mkdir -p $out
       cd $out
 
-      ${concatMapStrings (containerName:
+      ${lib.concatMapStrings (containerName:
         let
           containerProperties = cfg.containers.${containerName};
         in
@@ -47,7 +44,7 @@ let
     ''
       mkdir ${containerName}
 
-      ${concatMapStrings (componentName:
+      ${lib.concatMapStrings (componentName:
         let
           component = cfg.components.${containerName}.${componentName};
         in
@@ -61,7 +58,7 @@ let
       mkdir -p $out
       cd $out
 
-      ${concatMapStrings (containerName:
+      ${lib.concatMapStrings (containerName:
         linkMutableComponents { inherit containerName; }
       ) (builtins.attrNames cfg.components)}
     '';
@@ -84,68 +81,68 @@ in
   options = {
     dysnomia = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Whether to enable Dysnomia";
       };
 
-      enableAuthentication = mkOption {
-        type = types.bool;
+      enableAuthentication = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Whether to publish privacy-sensitive authentication credentials";
       };
 
-      package = mkOption {
-        type = types.path;
+      package = lib.mkOption {
+        type = lib.types.path;
         description = "The Dysnomia package";
       };
 
-      properties = mkOption {
+      properties = lib.mkOption {
         description = "An attribute set in which each attribute represents a machine property. Optionally, these values can be shell substitutions.";
         default = {};
-        type = types.attrs;
+        type = lib.types.attrs;
       };
 
-      containers = mkOption {
+      containers = lib.mkOption {
         description = "An attribute set in which each key represents a container and each value an attribute set providing its configuration properties";
         default = {};
-        type = types.attrsOf types.attrs;
+        type = lib.types.attrsOf lib.types.attrs;
       };
 
-      components = mkOption {
+      components = lib.mkOption {
         description = "An attribute set in which each key represents a container and each value an attribute set in which each key represents a component and each value a derivation constructing its initial state";
         default = {};
-        type = types.attrsOf types.attrs;
+        type = lib.types.attrsOf lib.types.attrs;
       };
 
-      extraContainerProperties = mkOption {
+      extraContainerProperties = lib.mkOption {
         description = "An attribute set providing additional container settings in addition to the default properties";
         default = {};
-        type = types.attrs;
+        type = lib.types.attrs;
       };
 
-      extraContainerPaths = mkOption {
+      extraContainerPaths = lib.mkOption {
         description = "A list of paths containing additional container configurations that are added to the search folders";
         default = [];
-        type = types.listOf types.path;
+        type = lib.types.listOf lib.types.path;
       };
 
-      extraModulePaths = mkOption {
+      extraModulePaths = lib.mkOption {
         description = "A list of paths containing additional modules that are added to the search folders";
         default = [];
-        type = types.listOf types.path;
+        type = lib.types.listOf lib.types.path;
       };
 
-      enableLegacyModules = mkOption {
-        type = types.bool;
+      enableLegacyModules = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = "Whether to enable Dysnomia legacy process and wrapper modules";
       };
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     environment.etc = {
       "dysnomia/containers" = {
@@ -199,16 +196,16 @@ in
         "sysvinit-script"
         "nixos-configuration"
       ]
-      ++ optional (dysnomiaFlags.enableApacheWebApplication) "apache-webapplication"
-      ++ optional (dysnomiaFlags.enableAxis2WebService) "axis2-webservice"
-      ++ optional (dysnomiaFlags.enableDockerContainer) "docker-container"
-      ++ optional (dysnomiaFlags.enableEjabberdDump) "ejabberd-dump"
-      ++ optional (dysnomiaFlags.enableInfluxDatabase) "influx-database"
-      ++ optional (dysnomiaFlags.enableMySQLDatabase) "mysql-database"
-      ++ optional (dysnomiaFlags.enablePostgreSQLDatabase) "postgresql-database"
-      ++ optional (dysnomiaFlags.enableTomcatWebApplication) "tomcat-webapplication"
-      ++ optional (dysnomiaFlags.enableMongoDatabase) "mongo-database"
-      ++ optional (dysnomiaFlags.enableSubversionRepository) "subversion-repository";
+      ++ lib.optional (dysnomiaFlags.enableApacheWebApplication) "apache-webapplication"
+      ++ lib.optional (dysnomiaFlags.enableAxis2WebService) "axis2-webservice"
+      ++ lib.optional (dysnomiaFlags.enableDockerContainer) "docker-container"
+      ++ lib.optional (dysnomiaFlags.enableEjabberdDump) "ejabberd-dump"
+      ++ lib.optional (dysnomiaFlags.enableInfluxDatabase) "influx-database"
+      ++ lib.optional (dysnomiaFlags.enableMySQLDatabase) "mysql-database"
+      ++ lib.optional (dysnomiaFlags.enablePostgreSQLDatabase) "postgresql-database"
+      ++ lib.optional (dysnomiaFlags.enableTomcatWebApplication) "tomcat-webapplication"
+      ++ lib.optional (dysnomiaFlags.enableMongoDatabase) "mongo-database"
+      ++ lib.optional (dysnomiaFlags.enableSubversionRepository) "subversion-repository";
     };
 
     dysnomia.containers = lib.recursiveUpdate ({
diff --git a/nixos/modules/services/misc/errbot.nix b/nixos/modules/services/misc/errbot.nix
index b447ba5d438d..1c7135e774e8 100644
--- a/nixos/modules/services/misc/errbot.nix
+++ b/nixos/modules/services/misc/errbot.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.errbot;
   pluginEnv = plugins: pkgs.buildEnv {
@@ -17,7 +14,7 @@ let
     BOT_LOG_LEVEL = logging.${instanceCfg.logLevel}
     BOT_LOG_FILE = False
 
-    BOT_ADMINS = (${concatMapStringsSep "," (name: "'${name}'") instanceCfg.admins})
+    BOT_ADMINS = (${lib.concatMapStringsSep "," (name: "'${name}'") instanceCfg.admins})
 
     BOT_IDENTITY = ${builtins.toJSON instanceCfg.identity}
 
@@ -25,48 +22,48 @@ let
   '';
 in {
   options = {
-    services.errbot.instances = mkOption {
+    services.errbot.instances = lib.mkOption {
       default = {};
       description = "Errbot instance configs";
-      type = types.attrsOf (types.submodule {
+      type = lib.types.attrsOf (lib.types.submodule {
         options = {
-          dataDir = mkOption {
-            type = types.nullOr types.path;
+          dataDir = lib.mkOption {
+            type = lib.types.nullOr lib.types.path;
             default = null;
             description = "Data directory for errbot instance.";
           };
 
-          plugins = mkOption {
-            type = types.listOf types.package;
+          plugins = lib.mkOption {
+            type = lib.types.listOf lib.types.package;
             default = [];
             description = "List of errbot plugin derivations.";
           };
 
-          logLevel = mkOption {
-            type = types.str;
+          logLevel = lib.mkOption {
+            type = lib.types.str;
             default = "INFO";
             description = "Errbot log level";
           };
 
-          admins = mkOption {
-            type = types.listOf types.str;
+          admins = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
             default = [];
             description = "List of identifiers of errbot admins.";
           };
 
-          backend = mkOption {
-            type = types.str;
+          backend = lib.mkOption {
+            type = lib.types.str;
             default = "XMPP";
             description = "Errbot backend name.";
           };
 
-          identity = mkOption {
-            type = types.attrs;
+          identity = lib.mkOption {
+            type = lib.types.attrs;
             description = "Errbot identity configuration";
           };
 
-          extraConfig = mkOption {
-            type = types.lines;
+          extraConfig = lib.mkOption {
+            type = lib.types.lines;
             default = "";
             description = "String to be appended to the config verbatim";
           };
@@ -75,14 +72,14 @@ in {
     };
   };
 
-  config = mkIf (cfg.instances != {}) {
+  config = lib.mkIf (cfg.instances != {}) {
     users.users.errbot = {
       group = "errbot";
       isSystemUser = true;
     };
     users.groups.errbot = {};
 
-    systemd.services = mapAttrs' (name: instanceCfg: nameValuePair "errbot-${name}" (
+    systemd.services = lib.mapAttrs' (name: instanceCfg: lib.nameValuePair "errbot-${name}" (
     let
       dataDir = if instanceCfg.dataDir != null then instanceCfg.dataDir else
         "/var/lib/errbot/${name}";
diff --git a/nixos/modules/services/misc/etebase-server.nix b/nixos/modules/services/misc/etebase-server.nix
index 9b2ba34cc30b..ba45a1703ac2 100644
--- a/nixos/modules/services/misc/etebase-server.nix
+++ b/nixos/modules/services/misc/etebase-server.nix
@@ -1,7 +1,4 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   cfg = config.services.etebase-server;
 
@@ -13,24 +10,24 @@ let
 in
 {
   imports = [
-    (mkRemovedOptionModule
+    (lib.mkRemovedOptionModule
       [ "services" "etebase-server" "customIni" ]
       "Set the option `services.etebase-server.settings' instead.")
-    (mkRemovedOptionModule
+    (lib.mkRemovedOptionModule
       [ "services" "etebase-server" "database" ]
       "Set the option `services.etebase-server.settings.database' instead.")
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "etebase-server" "secretFile" ]
       [ "services" "etebase-server" "settings" "secret_file" ])
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "etebase-server" "host" ]
       [ "services" "etebase-server" "settings" "allowed_hosts" "allowed_host1" ])
   ];
 
   options = {
     services.etebase-server = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         example = true;
         description = ''
@@ -43,77 +40,77 @@ in
         '';
       };
 
-      package = mkOption {
-        type = types.package;
+      package = lib.mkOption {
+        type = lib.types.package;
         default = pkgs.etebase-server;
-        defaultText = literalExpression "pkgs.python3.pkgs.etebase-server";
+        defaultText = lib.literalExpression "pkgs.python3.pkgs.etebase-server";
         description = "etebase-server package to use.";
       };
 
-      dataDir = mkOption {
-        type = types.str;
+      dataDir = lib.mkOption {
+        type = lib.types.str;
         default = "/var/lib/etebase-server";
         description = "Directory to store the Etebase server data.";
       };
 
-      port = mkOption {
-        type = with types; nullOr port;
+      port = lib.mkOption {
+        type = with lib.types; nullOr port;
         default = 8001;
         description = "Port to listen on.";
       };
 
-      openFirewall = mkOption {
-        type = types.bool;
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to open ports in the firewall for the server.
         '';
       };
 
-      unixSocket = mkOption {
-        type = with types; nullOr str;
+      unixSocket = lib.mkOption {
+        type = with lib.types; nullOr str;
         default = null;
         description = "The path to the socket to bind to.";
         example = "/run/etebase-server/etebase-server.sock";
       };
 
-      settings = mkOption {
+      settings = lib.mkOption {
         type = lib.types.submodule {
           freeformType = iniFmt.type;
 
           options = {
             global = {
-              debug = mkOption {
-                type = types.bool;
+              debug = lib.mkOption {
+                type = lib.types.bool;
                 default = false;
                 description = ''
                   Whether to set django's DEBUG flag.
                 '';
               };
-              secret_file = mkOption {
-                type = with types; nullOr str;
+              secret_file = lib.mkOption {
+                type = with lib.types; nullOr str;
                 default = null;
                 description = ''
                   The path to a file containing the secret
                   used as django's SECRET_KEY.
                 '';
               };
-              static_root = mkOption {
-                type = types.str;
+              static_root = lib.mkOption {
+                type = lib.types.str;
                 default = "${cfg.dataDir}/static";
-                defaultText = literalExpression ''"''${config.services.etebase-server.dataDir}/static"'';
+                defaultText = lib.literalExpression ''"''${config.services.etebase-server.dataDir}/static"'';
                 description = "The directory for static files.";
               };
-              media_root = mkOption {
-                type = types.str;
+              media_root = lib.mkOption {
+                type = lib.types.str;
                 default = "${cfg.dataDir}/media";
-                defaultText = literalExpression ''"''${config.services.etebase-server.dataDir}/media"'';
+                defaultText = lib.literalExpression ''"''${config.services.etebase-server.dataDir}/media"'';
                 description = "The media directory.";
               };
             };
             allowed_hosts = {
-              allowed_host1 = mkOption {
-                type = types.str;
+              allowed_host1 = lib.mkOption {
+                type = lib.types.str;
                 default = "0.0.0.0";
                 example = "localhost";
                 description = ''
@@ -122,15 +119,15 @@ in
               };
             };
             database = {
-              engine = mkOption {
-                type = types.enum [ "django.db.backends.sqlite3" "django.db.backends.postgresql" ];
+              engine = lib.mkOption {
+                type = lib.types.enum [ "django.db.backends.sqlite3" "django.db.backends.postgresql" ];
                 default = "django.db.backends.sqlite3";
                 description = "The database engine to use.";
               };
-              name = mkOption {
-                type = types.str;
+              name = lib.mkOption {
+                type = lib.types.str;
                 default = "${cfg.dataDir}/db.sqlite3";
-                defaultText = literalExpression ''"''${config.services.etebase-server.dataDir}/db.sqlite3"'';
+                defaultText = lib.literalExpression ''"''${config.services.etebase-server.dataDir}/db.sqlite3"'';
                 description = "The database name.";
               };
             };
@@ -154,15 +151,15 @@ in
         };
       };
 
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = defaultUser;
         description = "User under which Etebase server runs.";
       };
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     environment.systemPackages = with pkgs; [
       (runCommand "etebase-server" {
@@ -170,7 +167,7 @@ in
       } ''
         makeWrapper ${cfg.package}/bin/etebase-server \
           $out/bin/etebase-server \
-          --chdir ${escapeShellArg cfg.dataDir} \
+          --chdir ${lib.escapeShellArg cfg.dataDir} \
           --prefix ETEBASE_EASY_CONFIG_PATH : "${configIni}"
       '')
     ];
@@ -217,7 +214,7 @@ in
         '';
     };
 
-    users = optionalAttrs (cfg.user == defaultUser) {
+    users = lib.optionalAttrs (cfg.user == defaultUser) {
       users.${defaultUser} = {
         isSystemUser = true;
         group = defaultUser;
@@ -227,7 +224,7 @@ in
       groups.${defaultUser} = {};
     };
 
-    networking.firewall = mkIf cfg.openFirewall {
+    networking.firewall = lib.mkIf cfg.openFirewall {
       allowedTCPPorts = [ cfg.port ];
     };
   };
diff --git a/nixos/modules/services/misc/etesync-dav.nix b/nixos/modules/services/misc/etesync-dav.nix
index ea659c61bd5a..2cccc51d1fbf 100644
--- a/nixos/modules/services/misc/etesync-dav.nix
+++ b/nixos/modules/services/misc/etesync-dav.nix
@@ -1,40 +1,37 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.etesync-dav;
 in
   {
     options.services.etesync-dav = {
-      enable = mkEnableOption "etesync-dav, end-to-end encrypted sync for contacts, calendars and tasks";
+      enable = lib.mkEnableOption "etesync-dav, end-to-end encrypted sync for contacts, calendars and tasks";
 
-      host = mkOption {
-        type = types.str;
+      host = lib.mkOption {
+        type = lib.types.str;
         default = "localhost";
         description = "The server host address.";
       };
 
-      port = mkOption {
-        type = types.port;
+      port = lib.mkOption {
+        type = lib.types.port;
         default = 37358;
         description = "The server host port.";
       };
 
-      apiUrl = mkOption {
-        type = types.str;
+      apiUrl = lib.mkOption {
+        type = lib.types.str;
         default = "https://api.etesync.com/";
         description = "The url to the etesync API.";
       };
 
-      openFirewall = mkOption {
+      openFirewall = lib.mkOption {
         default = false;
-        type = types.bool;
+        type = lib.types.bool;
         description = "Whether to open the firewall for the specified port.";
       };
 
-      sslCertificate = mkOption {
-        type = types.nullOr types.path;
+      sslCertificate = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
         default = null;
         example = "/var/etesync.crt";
         description = ''
@@ -43,8 +40,8 @@ in
         '';
       };
 
-      sslCertificateKey = mkOption {
-        type = types.nullOr types.path;
+      sslCertificateKey = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
         default = null;
         example = "/var/etesync.key";
         description = ''
@@ -54,8 +51,8 @@ in
       };
     };
 
-    config = mkIf cfg.enable {
-      networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ];
+    config = lib.mkIf cfg.enable {
+      networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ cfg.port ];
 
       systemd.services.etesync-dav = {
         description = "etesync-dav - A CalDAV and CardDAV adapter for EteSync";
@@ -75,12 +72,12 @@ in
           DynamicUser = true;
           StateDirectory = "etesync-dav";
           ExecStart = "${pkgs.etesync-dav}/bin/etesync-dav";
-          ExecStartPre = mkIf (cfg.sslCertificate != null || cfg.sslCertificateKey != null) (
+          ExecStartPre = lib.mkIf (cfg.sslCertificate != null || cfg.sslCertificateKey != null) (
             pkgs.writers.writeBash "etesync-dav-copy-keys" ''
-              ${optionalString (cfg.sslCertificate != null) ''
+              ${lib.optionalString (cfg.sslCertificate != null) ''
                 cp ${toString cfg.sslCertificate} $STATE_DIRECTORY/etesync.crt
               ''}
-              ${optionalString (cfg.sslCertificateKey != null) ''
+              ${lib.optionalString (cfg.sslCertificateKey != null) ''
                 cp ${toString cfg.sslCertificateKey} $STATE_DIRECTORY/etesync.key
               ''}
             ''
diff --git a/nixos/modules/services/misc/evdevremapkeys.nix b/nixos/modules/services/misc/evdevremapkeys.nix
index e559dd89dc9f..754bce9f03d2 100644
--- a/nixos/modules/services/misc/evdevremapkeys.nix
+++ b/nixos/modules/services/misc/evdevremapkeys.nix
@@ -1,6 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
 let
   format = pkgs.formats.yaml { };
   cfg = config.services.evdevremapkeys;
@@ -8,9 +6,9 @@ let
 in
 {
   options.services.evdevremapkeys = {
-    enable = mkEnableOption ''evdevremapkeys, a daemon to remap events on linux input devices'';
+    enable = lib.mkEnableOption ''evdevremapkeys, a daemon to remap events on linux input devices'';
 
-    settings = mkOption {
+    settings = lib.mkOption {
       type = format.type;
       default = { };
       description = ''
@@ -19,7 +17,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     boot.kernelModules = [ "uinput" ];
     services.udev.extraRules = ''
       KERNEL=="uinput", MODE="0660", GROUP="input"
diff --git a/nixos/modules/services/misc/felix.nix b/nixos/modules/services/misc/felix.nix
index 0283de128afe..3def12e3adef 100644
--- a/nixos/modules/services/misc/felix.nix
+++ b/nixos/modules/services/misc/felix.nix
@@ -1,8 +1,5 @@
 # Felix server
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   cfg = config.services.felix;
@@ -17,23 +14,23 @@ in
 
     services.felix = {
 
-      enable = mkEnableOption "the Apache Felix OSGi service";
+      enable = lib.mkEnableOption "the Apache Felix OSGi service";
 
-      bundles = mkOption {
-        type = types.listOf types.package;
+      bundles = lib.mkOption {
+        type = lib.types.listOf lib.types.package;
         default = [ pkgs.felix_remoteshell ];
-        defaultText = literalExpression "[ pkgs.felix_remoteshell ]";
+        defaultText = lib.literalExpression "[ pkgs.felix_remoteshell ]";
         description = "List of bundles that should be activated on startup";
       };
 
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = "osgi";
         description = "User account under which Apache Felix runs.";
       };
 
-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
         default = "osgi";
         description = "Group account under which Apache Felix runs.";
       };
@@ -45,7 +42,7 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     users.groups.osgi.gid = config.ids.gids.osgi;
 
     users.users.osgi =
diff --git a/nixos/modules/services/misc/freeswitch.nix b/nixos/modules/services/misc/freeswitch.nix
index e90d9838fcb7..eace38229ca5 100644
--- a/nixos/modules/services/misc/freeswitch.nix
+++ b/nixos/modules/services/misc/freeswitch.nix
@@ -1,5 +1,4 @@
 { config, lib, pkgs, ...}:
-with lib;
 let
   cfg = config.services.freeswitch;
   pkg = cfg.package;
@@ -7,7 +6,7 @@ let
     mkdir -p $out
     cp -rT ${cfg.configTemplate} $out
     chmod -R +w $out
-    ${concatStringsSep "\n" (mapAttrsToList (fileName: filePath: ''
+    ${lib.concatStringsSep "\n" (lib.mapAttrsToList (fileName: filePath: ''
       mkdir -p $out/$(dirname ${fileName})
       cp ${filePath} $out/${fileName}
     '') cfg.configDir)}
@@ -18,10 +17,10 @@ let
 in {
   options = {
     services.freeswitch = {
-      enable = mkEnableOption "FreeSWITCH";
-      enableReload = mkOption {
+      enable = lib.mkEnableOption "FreeSWITCH";
+      enableReload = lib.mkOption {
         default = false;
-        type = types.bool;
+        type = lib.types.bool;
         description = ''
           Issue the `reloadxml` command to FreeSWITCH when configuration directory changes (instead of restart).
           See [FreeSWITCH documentation](https://freeswitch.org/confluence/display/FREESWITCH/Reloading) for more info.
@@ -29,21 +28,21 @@ in {
           See also `systemd.services.*.restartIfChanged`.
         '';
       };
-      configTemplate = mkOption {
-        type = types.path;
+      configTemplate = lib.mkOption {
+        type = lib.types.path;
         default = "${config.services.freeswitch.package}/share/freeswitch/conf/vanilla";
-        defaultText = literalExpression ''"''${config.services.freeswitch.package}/share/freeswitch/conf/vanilla"'';
-        example = literalExpression ''"''${config.services.freeswitch.package}/share/freeswitch/conf/minimal"'';
+        defaultText = lib.literalExpression ''"''${config.services.freeswitch.package}/share/freeswitch/conf/vanilla"'';
+        example = lib.literalExpression ''"''${config.services.freeswitch.package}/share/freeswitch/conf/minimal"'';
         description = ''
           Configuration template to use.
           See available templates in [FreeSWITCH repository](https://github.com/signalwire/freeswitch/tree/master/conf).
           You can also set your own configuration directory.
         '';
       };
-      configDir = mkOption {
-        type = with types; attrsOf path;
+      configDir = lib.mkOption {
+        type = with lib.types; attrsOf path;
         default = { };
-        example = literalExpression ''
+        example = lib.literalExpression ''
           {
             "freeswitch.xml" = ./freeswitch.xml;
             "dialplan/default.xml" = pkgs.writeText "dialplan-default.xml" '''
@@ -58,14 +57,14 @@ in {
           Also check available templates in [FreeSWITCH repository](https://github.com/signalwire/freeswitch/tree/master/conf).
         '';
       };
-      package = mkPackageOption pkgs "freeswitch" { };
+      package = lib.mkPackageOption pkgs "freeswitch" { };
     };
   };
-  config = mkIf cfg.enable {
-    environment.etc.freeswitch = mkIf cfg.enableReload {
+  config = lib.mkIf cfg.enable {
+    environment.etc.freeswitch = lib.mkIf cfg.enableReload {
       source = configDirectory;
     };
-    systemd.services.freeswitch-config-reload = mkIf cfg.enableReload {
+    systemd.services.freeswitch-config-reload = lib.mkIf cfg.enableReload {
       before = [ "freeswitch.service" ];
       wantedBy = [ "multi-user.target" ];
       restartTriggers = [ configDirectory ];
diff --git a/nixos/modules/services/misc/fstrim.nix b/nixos/modules/services/misc/fstrim.nix
index 10dced2c4e64..8ead4a645f7c 100644
--- a/nixos/modules/services/misc/fstrim.nix
+++ b/nixos/modules/services/misc/fstrim.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   cfg = config.services.fstrim;
@@ -11,10 +8,10 @@ in {
   options = {
 
     services.fstrim = {
-      enable = mkEnableOption "periodic SSD TRIM of mounted partitions in background";
+      enable = lib.mkEnableOption "periodic SSD TRIM of mounted partitions in background";
 
-      interval = mkOption {
-        type = types.str;
+      interval = lib.mkOption {
+        type = lib.types.str;
         default = "weekly";
         description = ''
           How often we run fstrim. For most desktop and server systems
@@ -28,7 +25,7 @@ in {
 
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     systemd.packages = [ pkgs.util-linux ];
 
diff --git a/nixos/modules/services/misc/gitweb.nix b/nixos/modules/services/misc/gitweb.nix
index 8f4869ce5d55..fb31deb8538a 100644
--- a/nixos/modules/services/misc/gitweb.nix
+++ b/nixos/modules/services/misc/gitweb.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.gitweb;
 
@@ -10,18 +7,18 @@ in
 
   options.services.gitweb = {
 
-    projectroot = mkOption {
+    projectroot = lib.mkOption {
       default = "/srv/git";
-      type = types.path;
+      type = lib.types.path;
       description = ''
         Path to git projects (bare repositories) that should be served by
         gitweb. Must not end with a slash.
       '';
     };
 
-    extraConfig = mkOption {
+    extraConfig = lib.mkOption {
       default = "";
-      type = types.lines;
+      type = lib.types.lines;
       description = ''
         Verbatim configuration text appended to the generated gitweb.conf file.
       '';
@@ -32,23 +29,23 @@ in
       '';
     };
 
-    gitwebTheme = mkOption {
+    gitwebTheme = lib.mkOption {
       default = false;
-      type = types.bool;
+      type = lib.types.bool;
       description = ''
         Use an alternative theme for gitweb, strongly inspired by GitHub.
       '';
     };
 
-    gitwebConfigFile = mkOption {
+    gitwebConfigFile = lib.mkOption {
       default = pkgs.writeText "gitweb.conf" ''
         # path to git projects (<project>.git)
         $projectroot = "${cfg.projectroot}";
         $highlight_bin = "${pkgs.highlight}/bin/highlight";
         ${cfg.extraConfig}
       '';
-      defaultText = literalMD "generated config file";
-      type = types.path;
+      defaultText = lib.literalMD "generated config file";
+      type = lib.types.path;
       readOnly = true;
       internal = true;
     };
diff --git a/nixos/modules/services/misc/gollum.nix b/nixos/modules/services/misc/gollum.nix
index fb9b9e19813f..ccfa63d3823d 100644
--- a/nixos/modules/services/misc/gollum.nix
+++ b/nixos/modules/services/misc/gollum.nix
@@ -4,16 +4,13 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.gollum;
 in
 
 {
   imports = [
-    (mkRemovedOptionModule
+    (lib.mkRemovedOptionModule
       [
         "services"
         "gollum"
@@ -24,35 +21,35 @@ in
   ];
 
   options.services.gollum = {
-    enable = mkEnableOption "Gollum, a git-powered wiki service";
+    enable = lib.mkEnableOption "Gollum, a git-powered wiki service";
 
-    address = mkOption {
-      type = types.str;
+    address = lib.mkOption {
+      type = lib.types.str;
       default = "0.0.0.0";
       description = "IP address on which the web server will listen.";
     };
 
-    port = mkOption {
-      type = types.port;
+    port = lib.mkOption {
+      type = lib.types.port;
       default = 4567;
       description = "Port on which the web server will run.";
     };
 
-    extraConfig = mkOption {
-      type = types.lines;
+    extraConfig = lib.mkOption {
+      type = lib.types.lines;
       default = "";
       description = "Content of the configuration file";
     };
 
-    math = mkOption {
-      type = types.bool;
+    math = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = "Enable support for math rendering using KaTeX";
     };
 
-    allowUploads = mkOption {
-      type = types.nullOr (
-        types.enum [
+    allowUploads = lib.mkOption {
+      type = lib.types.nullOr (
+        lib.types.enum [
           "dir"
           "page"
         ]
@@ -61,9 +58,9 @@ in
       description = "Enable uploads of external files";
     };
 
-    user-icons = mkOption {
-      type = types.nullOr (
-        types.enum [
+    user-icons = lib.mkOption {
+      type = lib.types.nullOr (
+        lib.types.enum [
           "gravatar"
           "identicon"
         ]
@@ -72,61 +69,61 @@ in
       description = "Enable specific user icons for history view";
     };
 
-    emoji = mkOption {
-      type = types.bool;
+    emoji = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = "Parse and interpret emoji tags";
     };
 
-    h1-title = mkOption {
-      type = types.bool;
+    h1-title = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = "Use the first h1 as page title";
     };
 
-    no-edit = mkOption {
-      type = types.bool;
+    no-edit = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = "Disable editing pages";
     };
 
-    local-time = mkOption {
-      type = types.bool;
+    local-time = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = "Use the browser's local timezone instead of the server's for displaying dates.";
     };
 
-    branch = mkOption {
-      type = types.str;
+    branch = lib.mkOption {
+      type = lib.types.str;
       default = "master";
       example = "develop";
       description = "Git branch to serve";
     };
 
-    stateDir = mkOption {
-      type = types.path;
+    stateDir = lib.mkOption {
+      type = lib.types.path;
       default = "/var/lib/gollum";
       description = "Specifies the path of the repository directory. If it does not exist, Gollum will create it on startup.";
     };
 
-    package = mkPackageOption pkgs "gollum" { };
+    package = lib.mkPackageOption pkgs "gollum" { };
 
-    user = mkOption {
-      type = types.str;
+    user = lib.mkOption {
+      type = lib.types.str;
       default = "gollum";
       description = "Specifies the owner of the wiki directory";
     };
 
-    group = mkOption {
-      type = types.str;
+    group = lib.mkOption {
+      type = lib.types.str;
       default = "gollum";
       description = "Specifies the owner group of the wiki directory";
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
-    users.users.gollum = mkIf (cfg.user == "gollum") {
+    users.users.gollum = lib.mkIf (cfg.user == "gollum") {
       group = cfg.group;
       description = "Gollum user";
       createHome = false;
@@ -158,13 +155,13 @@ in
             --host ${cfg.address} \
             --config ${pkgs.writeText "gollum-config.rb" cfg.extraConfig} \
             --ref ${cfg.branch} \
-            ${optionalString cfg.math "--math"} \
-            ${optionalString cfg.emoji "--emoji"} \
-            ${optionalString cfg.h1-title "--h1-title"} \
-            ${optionalString cfg.no-edit "--no-edit"} \
-            ${optionalString cfg.local-time "--local-time"} \
-            ${optionalString (cfg.allowUploads != null) "--allow-uploads ${cfg.allowUploads}"} \
-            ${optionalString (cfg.user-icons != null) "--user-icons ${cfg.user-icons}"} \
+            ${lib.optionalString cfg.math "--math"} \
+            ${lib.optionalString cfg.emoji "--emoji"} \
+            ${lib.optionalString cfg.h1-title "--h1-title"} \
+            ${lib.optionalString cfg.no-edit "--no-edit"} \
+            ${lib.optionalString cfg.local-time "--local-time"} \
+            ${lib.optionalString (cfg.allowUploads != null) "--allow-uploads ${cfg.allowUploads}"} \
+            ${lib.optionalString (cfg.user-icons != null) "--user-icons ${cfg.user-icons}"} \
             ${cfg.stateDir}
         '';
       };
diff --git a/nixos/modules/services/misc/gpsd.nix b/nixos/modules/services/misc/gpsd.nix
index 6f7aec0784a0..76aa151f204a 100644
--- a/nixos/modules/services/misc/gpsd.nix
+++ b/nixos/modules/services/misc/gpsd.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, utils, ... }:
-
-with lib;
-
 let
 
   uid = config.ids.uids.gpsd;
@@ -21,16 +18,16 @@ in {
 
     services.gpsd = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to enable `gpsd`, a GPS service daemon.
         '';
       };
 
-      devices = mkOption {
-        type = types.listOf types.str;
+      devices = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [ "/dev/ttyUSB0" ];
         description = ''
           List of devices that `gpsd` should subscribe to.
@@ -43,8 +40,8 @@ in {
         '';
       };
 
-      readonly = mkOption {
-        type = types.bool;
+      readonly = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = ''
           Whether to enable the broken-device-safety, otherwise
@@ -60,40 +57,40 @@ in {
         '';
       };
 
-      nowait = mkOption {
-        type = types.bool;
+      nowait = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           don't wait for client connects to poll GPS
         '';
       };
 
-      port = mkOption {
-        type = types.port;
+      port = lib.mkOption {
+        type = lib.types.port;
         default = 2947;
         description = ''
           The port where to listen for TCP connections.
         '';
       };
 
-      debugLevel = mkOption {
-        type = types.int;
+      debugLevel = lib.mkOption {
+        type = lib.types.int;
         default = 0;
         description = ''
           The debugging level.
         '';
       };
 
-      listenany = mkOption {
-        type = types.bool;
+      listenany = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Listen on all addresses rather than just loopback.
         '';
       };
 
-      extraArgs = mkOption {
-        type = types.listOf types.str;
+      extraArgs = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [ ];
         example = [ "-r" "-s" "19200" ];
         description = ''
@@ -108,7 +105,7 @@ in {
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     users.users.gpsd = {
       inherit uid;
@@ -131,9 +128,9 @@ in {
         in ''
           ${pkgs.gpsd}/sbin/gpsd -D "${toString cfg.debugLevel}"  \
             -S "${toString cfg.port}"                             \
-            ${optionalString cfg.readonly "-b"}                   \
-            ${optionalString cfg.nowait "-n"}                     \
-            ${optionalString cfg.listenany "-G"}                  \
+            ${lib.optionalString cfg.readonly "-b"}                   \
+            ${lib.optionalString cfg.nowait "-n"}                     \
+            ${lib.optionalString cfg.listenany "-G"}                  \
             ${extraArgs}                                          \
             ${devices}
         '';
diff --git a/nixos/modules/services/misc/greenclip.nix b/nixos/modules/services/misc/greenclip.nix
index d92cd1854877..ce44ad4f6663 100644
--- a/nixos/modules/services/misc/greenclip.nix
+++ b/nixos/modules/services/misc/greenclip.nix
@@ -1,18 +1,15 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.greenclip;
 in {
 
   options.services.greenclip = {
-    enable = mkEnableOption "Greenclip, a clipboard manager";
+    enable = lib.mkEnableOption "Greenclip, a clipboard manager";
 
-    package = mkPackageOption pkgs [ "haskellPackages" "greenclip" ] { };
+    package = lib.mkPackageOption pkgs [ "haskellPackages" "greenclip" ] { };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.user.services.greenclip = {
       enable      = true;
       description = "greenclip daemon";
diff --git a/nixos/modules/services/misc/headphones.nix b/nixos/modules/services/misc/headphones.nix
index 31bd61cb4c20..b56322b0cbcc 100644
--- a/nixos/modules/services/misc/headphones.nix
+++ b/nixos/modules/services/misc/headphones.nix
@@ -1,7 +1,4 @@
 { config, lib, options, pkgs, ... }:
-
-with lib;
-
 let
 
   name = "headphones";
@@ -17,39 +14,39 @@ in
 
   options = {
     services.headphones = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Whether to enable the headphones server.";
       };
-      dataDir = mkOption {
-        type = types.path;
+      dataDir = lib.mkOption {
+        type = lib.types.path;
         default = "/var/lib/${name}";
         description = "Path where to store data files.";
       };
-      configFile = mkOption {
-        type = types.path;
+      configFile = lib.mkOption {
+        type = lib.types.path;
         default = "${cfg.dataDir}/config.ini";
-        defaultText = literalExpression ''"''${config.${opt.dataDir}}/config.ini"'';
+        defaultText = lib.literalExpression ''"''${config.${opt.dataDir}}/config.ini"'';
         description = "Path to config file.";
       };
-      host = mkOption {
-        type = types.str;
+      host = lib.mkOption {
+        type = lib.types.str;
         default = "localhost";
         description = "Host to listen on.";
       };
-      port = mkOption {
-        type = types.ints.u16;
+      port = lib.mkOption {
+        type = lib.types.ints.u16;
         default = 8181;
         description = "Port to bind to.";
       };
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = name;
         description = "User to run the service as";
       };
-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
         default = name;
         description = "Group to run the service as";
       };
@@ -59,9 +56,9 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
-    users.users = optionalAttrs (cfg.user == name) {
+    users.users = lib.optionalAttrs (cfg.user == name) {
       ${name} = {
         uid = config.ids.uids.headphones;
         group = cfg.group;
@@ -71,7 +68,7 @@ in
       };
     };
 
-    users.groups = optionalAttrs (cfg.group == name) {
+    users.groups = lib.optionalAttrs (cfg.group == name) {
       ${name}.gid = config.ids.gids.headphones;
     };
 
diff --git a/nixos/modules/services/misc/heisenbridge.nix b/nixos/modules/services/misc/heisenbridge.nix
index 54c298f1b560..d8c5ec80e892 100644
--- a/nixos/modules/services/misc/heisenbridge.nix
+++ b/nixos/modules/services/misc/heisenbridge.nix
@@ -1,7 +1,4 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   cfg = config.services.heisenbridge;
 
@@ -23,18 +20,18 @@ let
 in
 {
   options.services.heisenbridge = {
-    enable = mkEnableOption "the Matrix to IRC bridge";
+    enable = lib.mkEnableOption "the Matrix to IRC bridge";
 
-    package = mkPackageOption pkgs "heisenbridge" { };
+    package = lib.mkPackageOption pkgs "heisenbridge" { };
 
-    homeserver = mkOption {
-      type = types.str;
+    homeserver = lib.mkOption {
+      type = lib.types.str;
       description = "The URL to the home server for client-server API calls";
       example = "http://localhost:8008";
     };
 
-    registrationUrl = mkOption {
-      type = types.str;
+    registrationUrl = lib.mkOption {
+      type = lib.types.str;
       description = ''
         The URL where the application service is listening for HS requests, from the Matrix HS perspective.#
         The default value assumes the bridge runs on the same host as the home server, in the same network.
@@ -44,27 +41,27 @@ in
       defaultText = "http://$${cfg.address}:$${toString cfg.port}";
     };
 
-    address = mkOption {
-      type = types.str;
+    address = lib.mkOption {
+      type = lib.types.str;
       description = "Address to listen on. IPv6 does not seem to be supported.";
       default = "127.0.0.1";
       example = "0.0.0.0";
     };
 
-    port = mkOption {
-      type = types.port;
+    port = lib.mkOption {
+      type = lib.types.port;
       description = "The port to listen on";
       default = 9898;
     };
 
-    debug = mkOption {
-      type = types.bool;
+    debug = lib.mkOption {
+      type = lib.types.bool;
       description = "More verbose logging. Recommended during initial setup.";
       default = false;
     };
 
-    owner = mkOption {
-      type = types.nullOr types.str;
+    owner = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
       description = ''
         Set owner MXID otherwise first talking local user will claim the bridge
       '';
@@ -72,10 +69,10 @@ in
       example = "@admin:example.org";
     };
 
-    namespaces = mkOption {
+    namespaces = lib.mkOption {
       description = "Configure the 'namespaces' section of the registration.yml for the bridge and the server";
       # TODO link to Matrix documentation of the format
-      type = types.submodule {
+      type = lib.types.submodule {
         freeformType = jsonType;
       };
 
@@ -91,21 +88,21 @@ in
       };
     };
 
-    identd.enable = mkEnableOption "identd service support";
-    identd.port = mkOption {
-      type = types.port;
+    identd.enable = lib.mkEnableOption "identd service support";
+    identd.port = lib.mkOption {
+      type = lib.types.port;
       description = "identd listen port";
       default = 113;
     };
 
-    extraArgs = mkOption {
-      type = types.listOf types.str;
+    extraArgs = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
       description = "Heisenbridge is configured over the command line. Append extra arguments here";
       default = [ ];
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.heisenbridge = {
       description = "Matrix<->IRC bridge";
       before = [ "matrix-synapse.service" ]; # So the registration file can be used by Synapse
@@ -191,7 +188,7 @@ in
         RemoveIPC = true;
         UMask = "0077";
 
-        CapabilityBoundingSet = [ "CAP_CHOWN" ] ++ optional (cfg.port < 1024 || (cfg.identd.enable && cfg.identd.port < 1024)) "CAP_NET_BIND_SERVICE";
+        CapabilityBoundingSet = [ "CAP_CHOWN" ] ++ lib.optional (cfg.port < 1024 || (cfg.identd.enable && cfg.identd.port < 1024)) "CAP_NET_BIND_SERVICE";
         AmbientCapabilities = CapabilityBoundingSet;
         NoNewPrivileges = true;
         LockPersonality = true;
diff --git a/nixos/modules/services/misc/ihaskell.nix b/nixos/modules/services/misc/ihaskell.nix
index 186ff7345ab3..b2ea3e70dede 100644
--- a/nixos/modules/services/misc/ihaskell.nix
+++ b/nixos/modules/services/misc/ihaskell.nix
@@ -1,7 +1,4 @@
 { pkgs, lib, config, ... }:
-
-with lib;
-
 let
 
   cfg = config.services.ihaskell;
@@ -14,17 +11,17 @@ in
 {
   options = {
     services.ihaskell = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Autostart an IHaskell notebook service.";
       };
 
-      extraPackages = mkOption {
-        type = types.functionTo (types.listOf types.package);
+      extraPackages = lib.mkOption {
+        type = lib.types.functionTo (lib.types.listOf lib.types.package);
         default = haskellPackages: [];
-        defaultText = literalExpression "haskellPackages: []";
-        example = literalExpression ''
+        defaultText = lib.literalExpression "haskellPackages: []";
+        example = lib.literalExpression ''
           haskellPackages: [
             haskellPackages.wreq
             haskellPackages.lens
@@ -39,7 +36,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     users.users.ihaskell = {
       group = config.users.groups.ihaskell.name;
diff --git a/nixos/modules/services/misc/input-remapper.nix b/nixos/modules/services/misc/input-remapper.nix
index 94c2ece52f98..cf335dacb4ff 100644
--- a/nixos/modules/services/misc/input-remapper.nix
+++ b/nixos/modules/services/misc/input-remapper.nix
@@ -1,25 +1,22 @@
 { pkgs, lib, config, ... }:
-
-with lib;
-
 let cfg = config.services.input-remapper; in
 {
   options = {
     services.input-remapper = {
-      enable = mkEnableOption "input-remapper, an easy to use tool to change the mapping of your input device buttons";
-      package = mkPackageOption pkgs "input-remapper" { };
-      enableUdevRules = mkEnableOption "udev rules added by input-remapper to handle hotplugged devices. Currently disabled by default due to https://github.com/sezanzeb/input-remapper/issues/140";
-      serviceWantedBy = mkOption {
+      enable = lib.mkEnableOption "input-remapper, an easy to use tool to change the mapping of your input device buttons";
+      package = lib.mkPackageOption pkgs "input-remapper" { };
+      enableUdevRules = lib.mkEnableOption "udev rules added by input-remapper to handle hotplugged devices. Currently disabled by default due to https://github.com/sezanzeb/input-remapper/issues/140";
+      serviceWantedBy = lib.mkOption {
         default = [ "graphical.target" ];
         example = [ "multi-user.target" ];
-        type = types.listOf types.str;
+        type = lib.types.listOf lib.types.str;
         description = "Specifies the WantedBy setting for the input-remapper service.";
       };
     };
   };
 
-  config = mkIf cfg.enable {
-    services.udev.packages = mkIf cfg.enableUdevRules [ cfg.package ];
+  config = lib.mkIf cfg.enable {
+    services.udev.packages = lib.mkIf cfg.enableUdevRules [ cfg.package ];
     services.dbus.packages = [ cfg.package ];
     systemd.packages = [ cfg.package ];
     environment.systemPackages = [ cfg.package ];
diff --git a/nixos/modules/services/misc/irkerd.nix b/nixos/modules/services/misc/irkerd.nix
index 993d77ba424c..28966c4ae226 100644
--- a/nixos/modules/services/misc/irkerd.nix
+++ b/nixos/modules/services/misc/irkerd.nix
@@ -1,29 +1,26 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.irkerd;
   ports = [ 6659 ];
 in
 {
   options.services.irkerd = {
-    enable = mkOption {
+    enable = lib.mkOption {
       description = "Whether to enable irker, an IRC notification daemon.";
       default = false;
-      type = types.bool;
+      type = lib.types.bool;
     };
 
-    openPorts = mkOption {
+    openPorts = lib.mkOption {
       description = "Open ports in the firewall for irkerd";
       default = false;
-      type = types.bool;
+      type = lib.types.bool;
     };
 
-    listenAddress = mkOption {
+    listenAddress = lib.mkOption {
       default = "localhost";
       example = "0.0.0.0";
-      type = types.str;
+      type = lib.types.str;
       description = ''
         Specifies the bind address on which the irker daemon listens.
         The default is localhost.
@@ -33,14 +30,14 @@ in
       '';
     };
 
-    nick = mkOption {
+    nick = lib.mkOption {
       default = "irker";
-      type = types.str;
+      type = lib.types.str;
       description = "Nick to use for irker";
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.irkerd = {
       description = "Internet Relay Chat (IRC) notification daemon";
       documentation = [ "man:irkerd(8)" "man:irkerhook(1)" "man:irk(1)" ];
@@ -61,7 +58,7 @@ in
     };
     users.groups.irkerd = {};
 
-    networking.firewall.allowedTCPPorts = mkIf cfg.openPorts ports;
-    networking.firewall.allowedUDPPorts = mkIf cfg.openPorts ports;
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openPorts ports;
+    networking.firewall.allowedUDPPorts = lib.mkIf cfg.openPorts ports;
   };
 }
diff --git a/nixos/modules/services/misc/jackett.nix b/nixos/modules/services/misc/jackett.nix
index a843f400b031..cbac537a58b5 100644
--- a/nixos/modules/services/misc/jackett.nix
+++ b/nixos/modules/services/misc/jackett.nix
@@ -1,7 +1,4 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   cfg = config.services.jackett;
 
@@ -9,45 +6,45 @@ in
 {
   options = {
     services.jackett = {
-      enable = mkEnableOption "Jackett, API support for your favorite torrent trackers";
+      enable = lib.mkEnableOption "Jackett, API support for your favorite torrent trackers";
 
-      port = mkOption {
+      port = lib.mkOption {
         default = 9117;
-        type = types.port;
+        type = lib.types.port;
         description = ''
           Port serving the web interface
         '';
       };
 
-      dataDir = mkOption {
-        type = types.str;
+      dataDir = lib.mkOption {
+        type = lib.types.str;
         default = "/var/lib/jackett/.config/Jackett";
         description = "The directory where Jackett stores its data files.";
       };
 
-      openFirewall = mkOption {
-        type = types.bool;
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Open ports in the firewall for the Jackett web interface.";
       };
 
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = "jackett";
         description = "User account under which Jackett runs.";
       };
 
-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
         default = "jackett";
         description = "Group under which Jackett runs.";
       };
 
-      package = mkPackageOption pkgs "jackett" { };
+      package = lib.mkPackageOption pkgs "jackett" { };
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.tmpfiles.rules = [
       "d '${cfg.dataDir}' 0700 ${cfg.user} ${cfg.group} - -"
     ];
@@ -66,11 +63,11 @@ in
       };
     };
 
-    networking.firewall = mkIf cfg.openFirewall {
+    networking.firewall = lib.mkIf cfg.openFirewall {
       allowedTCPPorts = [ cfg.port ];
     };
 
-    users.users = mkIf (cfg.user == "jackett") {
+    users.users = lib.mkIf (cfg.user == "jackett") {
       jackett = {
         group = cfg.group;
         home = cfg.dataDir;
@@ -78,7 +75,7 @@ in
       };
     };
 
-    users.groups = mkIf (cfg.group == "jackett") {
+    users.groups = lib.mkIf (cfg.group == "jackett") {
       jackett.gid = config.ids.gids.jackett;
     };
   };
diff --git a/nixos/modules/services/misc/jellyseerr.nix b/nixos/modules/services/misc/jellyseerr.nix
index 9aab517e0493..e09de7aec50b 100644
--- a/nixos/modules/services/misc/jellyseerr.nix
+++ b/nixos/modules/services/misc/jellyseerr.nix
@@ -1,30 +1,28 @@
 { config, pkgs, lib, ... }:
-
-with lib;
 let
   cfg = config.services.jellyseerr;
 in
 {
-  meta.maintainers = [ maintainers.camillemndn ];
+  meta.maintainers = [ lib.maintainers.camillemndn ];
 
   options.services.jellyseerr = {
-    enable = mkEnableOption ''Jellyseerr, a requests manager for Jellyfin'';
-    package = mkPackageOption pkgs "jellyseerr" { };
+    enable = lib.mkEnableOption ''Jellyseerr, a requests manager for Jellyfin'';
+    package = lib.mkPackageOption pkgs "jellyseerr" { };
 
-    openFirewall = mkOption {
-      type = types.bool;
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''Open port in the firewall for the Jellyseerr web interface.'';
     };
 
-    port = mkOption {
-      type = types.port;
+    port = lib.mkOption {
+      type = lib.types.port;
       default = 5055;
       description = ''The port which the Jellyseerr web UI should listen to.'';
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.jellyseerr = {
       description = "Jellyseerr, a requests manager for Jellyfin";
       after = [ "network.target" ];
@@ -56,7 +54,7 @@ in
       };
     };
 
-    networking.firewall = mkIf cfg.openFirewall {
+    networking.firewall = lib.mkIf cfg.openFirewall {
       allowedTCPPorts = [ cfg.port ];
     };
   };
diff --git a/nixos/modules/services/misc/klipper.nix b/nixos/modules/services/misc/klipper.nix
index 5e20b32bc8fd..f0972f8caff4 100644
--- a/nixos/modules/services/misc/klipper.nix
+++ b/nixos/modules/services/misc/klipper.nix
@@ -1,25 +1,24 @@
 { config, lib, pkgs, ... }:
-with lib;
 let
   cfg = config.services.klipper;
   format = pkgs.formats.ini {
     # https://github.com/NixOS/nixpkgs/pull/121613#issuecomment-885241996
     listToValue = l:
-      if builtins.length l == 1 then generators.mkValueStringDefault { } (head l)
-      else lib.concatMapStrings (s: "\n  ${generators.mkValueStringDefault {} s}") l;
-    mkKeyValue = generators.mkKeyValueDefault { } ":";
+      if builtins.length l == 1 then lib.generators.mkValueStringDefault { } (lib.head l)
+      else lib.concatMapStrings (s: "\n  ${lib.generators.mkValueStringDefault {} s}") l;
+    mkKeyValue = lib.generators.mkKeyValueDefault { } ":";
   };
 in
 {
   ##### interface
   options = {
     services.klipper = {
-      enable = mkEnableOption "Klipper, the 3D printer firmware";
+      enable = lib.mkEnableOption "Klipper, the 3D printer firmware";
 
-      package = mkPackageOption pkgs "klipper" { };
+      package = lib.mkPackageOption pkgs "klipper" { };
 
-      logFile = mkOption {
-        type = types.nullOr types.path;
+      logFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
         default = null;
         example = "/var/lib/klipper/klipper.log";
         description = ''
@@ -28,20 +27,20 @@ in
         '';
       };
 
-      inputTTY = mkOption {
-        type = types.path;
+      inputTTY = lib.mkOption {
+        type = lib.types.path;
         default = "/run/klipper/tty";
         description = "Path of the virtual printer symlink to create.";
       };
 
-      apiSocket = mkOption {
-        type = types.nullOr types.path;
+      apiSocket = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
         default = "/run/klipper/api";
         description = "Path of the API socket to create.";
       };
 
-      mutableConfig = mkOption {
-        type = types.bool;
+      mutableConfig = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         example = true;
         description = ''
@@ -50,28 +49,28 @@ in
         '';
       };
 
-      mutableConfigFolder = mkOption {
-        type = types.path;
+      mutableConfigFolder = lib.mkOption {
+        type = lib.types.path;
         default = "/var/lib/klipper";
         description = "Path to mutable Klipper config file.";
       };
 
-      configFile = mkOption {
-        type = types.nullOr types.path;
+      configFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
         default = null;
         description = ''
           Path to default Klipper config.
         '';
       };
 
-      octoprintIntegration = mkOption {
-        type = types.bool;
+      octoprintIntegration = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Allows Octoprint to control Klipper.";
       };
 
-      user = mkOption {
-        type = types.nullOr types.str;
+      user = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         description = ''
           User account under which Klipper runs.
@@ -80,8 +79,8 @@ in
         '';
       };
 
-      group = mkOption {
-        type = types.nullOr types.str;
+      group = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         description = ''
           Group account under which Klipper runs.
@@ -90,8 +89,8 @@ in
         '';
       };
 
-      settings = mkOption {
-        type = types.nullOr format.type;
+      settings = lib.mkOption {
+        type = lib.types.nullOr format.type;
         default = null;
         description = ''
           Configuration for Klipper. See the [documentation](https://www.klipper3d.org/Overview.html#configuration-and-tuning-guides)
@@ -99,24 +98,24 @@ in
         '';
       };
 
-      firmwares = mkOption {
+      firmwares = lib.mkOption {
         description = "Firmwares klipper should manage";
         default = { };
-        type = with types; attrsOf
+        type = with lib.types; attrsOf
           (submodule {
             options = {
-              enable = mkEnableOption ''
+              enable = lib.mkEnableOption ''
                 building of firmware for manual flashing
               '';
-              enableKlipperFlash = mkEnableOption ''
+              enableKlipperFlash = lib.mkEnableOption ''
                 flashings scripts for firmware. This will add `klipper-flash-$mcu` scripts to your environment which can be called to flash the firmware.
                 Please check the configs at [klipper](https://github.com/Klipper3d/klipper/tree/master/config) whether your board supports flashing via `make flash`
               '';
-              serial = mkOption {
-                type = types.nullOr path;
+              serial = lib.mkOption {
+                type = lib.types.nullOr path;
                 description = "Path to serial port this printer is connected to. Leave `null` to derive it from `service.klipper.settings`.";
               };
-              configFile = mkOption {
+              configFile = lib.mkOption {
                 type = path;
                 description = "Path to firmware config which is generated using `klipper-genconf`";
               };
@@ -127,7 +126,7 @@ in
   };
 
   ##### implementation
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     assertions = [
       {
         assertion = cfg.octoprintIntegration -> config.services.octoprint.enable;
@@ -138,7 +137,7 @@ in
         message = "Option services.klipper.group is not set when services.klipper.user is specified.";
       }
       {
-        assertion = cfg.settings != null -> foldl (a: b: a && b) true (mapAttrsToList (mcu: _: mcu != null -> (hasAttrByPath [ "${mcu}" "serial" ] cfg.settings)) cfg.firmwares);
+        assertion = cfg.settings != null -> lib.foldl (a: b: a && b) true (lib.mapAttrsToList (mcu: _: mcu != null -> (lib.hasAttrByPath [ "${mcu}" "serial" ] cfg.settings)) cfg.firmwares);
         message = "Option services.klipper.settings.$mcu.serial must be set when settings.klipper.firmware.$mcu is specified";
       }
       {
@@ -147,11 +146,11 @@ in
       }
     ];
 
-    environment.etc = mkIf (!cfg.mutableConfig) {
+    environment.etc = lib.mkIf (!cfg.mutableConfig) {
       "klipper.cfg".source = if cfg.settings != null then format.generate "klipper.cfg" cfg.settings else cfg.configFile;
     };
 
-    services.klipper = mkIf cfg.octoprintIntegration {
+    services.klipper = lib.mkIf cfg.octoprintIntegration {
       user = config.services.octoprint.user;
       group = config.services.octoprint.group;
     };
@@ -159,8 +158,8 @@ in
     systemd.services.klipper =
       let
         klippyArgs = "--input-tty=${cfg.inputTTY}"
-          + optionalString (cfg.apiSocket != null) " --api-server=${cfg.apiSocket}"
-          + optionalString (cfg.logFile != null) " --logfile=${cfg.logFile}"
+          + lib.optionalString (cfg.apiSocket != null) " --api-server=${cfg.apiSocket}"
+          + lib.optionalString (cfg.logFile != null) " --logfile=${cfg.logFile}"
         ;
         printerConfigPath =
           if cfg.mutableConfig
@@ -211,7 +210,7 @@ in
       with pkgs;
       let
         default = a: b: if a != null then a else b;
-        firmwares = filterAttrs (n: v: v != null) (mapAttrs
+        firmwares = lib.filterAttrs (n: v: v != null) (lib.mapAttrs
           (mcu: { enable, enableKlipperFlash, configFile, serial }:
             if enable then
               pkgs.klipper-firmware.override
@@ -220,18 +219,18 @@ in
                   firmwareConfig = configFile;
                 } else null)
           cfg.firmwares);
-        firmwareFlasher = mapAttrsToList
+        firmwareFlasher = lib.mapAttrsToList
           (mcu: firmware: pkgs.klipper-flash.override {
             mcu = lib.strings.sanitizeDerivationName mcu;
             klipper-firmware = firmware;
             flashDevice = default cfg.firmwares."${mcu}".serial cfg.settings."${mcu}".serial;
             firmwareConfig = cfg.firmwares."${mcu}".configFile;
           })
-          (filterAttrs (mcu: firmware: cfg.firmwares."${mcu}".enableKlipperFlash) firmwares);
+          (lib.filterAttrs (mcu: firmware: cfg.firmwares."${mcu}".enableKlipperFlash) firmwares);
       in
-      [ klipper-genconf ] ++ firmwareFlasher ++ attrValues firmwares;
+      [ klipper-genconf ] ++ firmwareFlasher ++ lib.attrValues firmwares;
   };
   meta.maintainers = [
-    maintainers.cab404
+    lib.maintainers.cab404
   ];
 }
diff --git a/nixos/modules/services/misc/languagetool.nix b/nixos/modules/services/misc/languagetool.nix
index 2a7e68c9053a..c2921ea0f047 100644
--- a/nixos/modules/services/misc/languagetool.nix
+++ b/nixos/modules/services/misc/languagetool.nix
@@ -1,19 +1,16 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.languagetool;
   settingsFormat = pkgs.formats.javaProperties { };
 in
 {
   options.services.languagetool = {
-    enable = mkEnableOption "the LanguageTool server, a multilingual spelling, style, and grammar checker that helps correct or paraphrase texts";
+    enable = lib.mkEnableOption "the LanguageTool server, a multilingual spelling, style, and grammar checker that helps correct or paraphrase texts";
 
-    package = mkPackageOption pkgs "languagetool" { };
+    package = lib.mkPackageOption pkgs "languagetool" { };
 
-    port = mkOption {
-      type = types.port;
+    port = lib.mkOption {
+      type = lib.types.port;
       default = 8081;
       example = 8081;
       description = ''
@@ -21,10 +18,10 @@ in
       '';
     };
 
-    public = mkEnableOption "access from anywhere (rather than just localhost)";
+    public = lib.mkEnableOption "access from anywhere (rather than just localhost)";
 
-    allowOrigin = mkOption {
-      type = types.nullOr types.str;
+    allowOrigin = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
       default = null;
       example = "https://my-website.org";
       description = ''
@@ -34,12 +31,12 @@ in
       '';
     };
 
-    settings = mkOption {
-      type = types.submodule {
+    settings = lib.mkOption {
+      type = lib.types.submodule {
         freeformType = settingsFormat.type;
 
-        options.cacheSize = mkOption {
-          type = types.ints.unsigned;
+        options.cacheSize = lib.mkOption {
+          type = lib.types.ints.unsigned;
           default = 1000;
           apply = toString;
           description = "Number of sentences cached.";
@@ -53,22 +50,22 @@ in
       '';
     };
 
-    jrePackage = mkPackageOption pkgs "jre" { };
+    jrePackage = lib.mkPackageOption pkgs "jre" { };
 
-    jvmOptions = mkOption {
+    jvmOptions = lib.mkOption {
       description = ''
         Extra command line options for the JVM running languagetool.
         More information can be found here: https://docs.oracle.com/en/java/javase/19/docs/specs/man/java.html#standard-options-for-java
       '';
       default = [ ];
-      type = types.listOf types.str;
+      type = lib.types.listOf lib.types.str;
       example = [
         "-Xmx512m"
       ];
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     systemd.services.languagetool = {
       description = "LanguageTool HTTP server";
@@ -89,8 +86,8 @@ in
             ${toString cfg.jvmOptions} \
             org.languagetool.server.HTTPServer \
               --port ${toString cfg.port} \
-              ${optionalString cfg.public "--public"} \
-              ${optionalString (cfg.allowOrigin != null) "--allow-origin ${cfg.allowOrigin}"} \
+              ${lib.optionalString cfg.public "--public"} \
+              ${lib.optionalString (cfg.allowOrigin != null) "--allow-origin ${cfg.allowOrigin}"} \
               "--config" ${settingsFormat.generate "languagetool.conf" cfg.settings}
         '';
       };
diff --git a/nixos/modules/services/misc/leaps.nix b/nixos/modules/services/misc/leaps.nix
index c6f5a1252332..10d332fb74ad 100644
--- a/nixos/modules/services/misc/leaps.nix
+++ b/nixos/modules/services/misc/leaps.nix
@@ -1,7 +1,4 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   cfg = config.services.leaps;
   stateDir = "/var/lib/leaps/";
@@ -9,27 +6,27 @@ in
 {
   options = {
     services.leaps = {
-      enable = mkEnableOption "leaps, a pair programming service";
-      port = mkOption {
-        type = types.port;
+      enable = lib.mkEnableOption "leaps, a pair programming service";
+      port = lib.mkOption {
+        type = lib.types.port;
         default = 8080;
         description = "A port where leaps listens for incoming http requests";
       };
-      address = mkOption {
+      address = lib.mkOption {
         default = "";
-        type = types.str;
+        type = lib.types.str;
         example = "127.0.0.1";
         description = "Hostname or IP-address to listen to. By default it will listen on all interfaces.";
       };
-      path = mkOption {
+      path = lib.mkOption {
         default = "/";
-        type = types.path;
+        type = lib.types.path;
         description = "Subdirectory used for reverse proxy setups";
       };
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     users = {
       users.leaps = {
         uid             = config.ids.uids.leaps;
diff --git a/nixos/modules/services/misc/lidarr.nix b/nixos/modules/services/misc/lidarr.nix
index 5f7b5c293a25..fd94f6536b22 100644
--- a/nixos/modules/services/misc/lidarr.nix
+++ b/nixos/modules/services/misc/lidarr.nix
@@ -1,41 +1,38 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   cfg = config.services.lidarr;
 in
 {
   options = {
     services.lidarr = {
-      enable = mkEnableOption "Lidarr, a Usenet/BitTorrent music downloader";
+      enable = lib.mkEnableOption "Lidarr, a Usenet/BitTorrent music downloader";
 
-      dataDir = mkOption {
-        type = types.str;
+      dataDir = lib.mkOption {
+        type = lib.types.str;
         default = "/var/lib/lidarr/.config/Lidarr";
         description = "The directory where Lidarr stores its data files.";
       };
 
-      package = mkPackageOption pkgs "lidarr" { };
+      package = lib.mkPackageOption pkgs "lidarr" { };
 
-      openFirewall = mkOption {
-        type = types.bool;
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Open ports in the firewall for Lidarr
         '';
       };
 
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = "lidarr";
         description = ''
           User account under which Lidarr runs.
         '';
       };
 
-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
         default = "lidarr";
         description = ''
           Group under which Lidarr runs.
@@ -44,7 +41,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.tmpfiles.settings."10-lidarr".${cfg.dataDir}.d = {
       inherit (cfg) user group;
       mode = "0700";
@@ -64,11 +61,11 @@ in
       };
     };
 
-    networking.firewall = mkIf cfg.openFirewall {
+    networking.firewall = lib.mkIf cfg.openFirewall {
       allowedTCPPorts = [ 8686 ];
     };
 
-    users.users = mkIf (cfg.user == "lidarr") {
+    users.users = lib.mkIf (cfg.user == "lidarr") {
       lidarr = {
         group = cfg.group;
         home = "/var/lib/lidarr";
@@ -76,7 +73,7 @@ in
       };
     };
 
-    users.groups = mkIf (cfg.group == "lidarr") {
+    users.groups = lib.mkIf (cfg.group == "lidarr") {
       lidarr = {
         gid = config.ids.gids.lidarr;
       };
diff --git a/nixos/modules/services/misc/lifecycled.nix b/nixos/modules/services/misc/lifecycled.nix
index 8b80af392492..c58b4f7525f5 100644
--- a/nixos/modules/services/misc/lifecycled.nix
+++ b/nixos/modules/services/misc/lifecycled.nix
@@ -1,6 +1,4 @@
 { config, pkgs, lib, ... }:
-
-with lib;
 let
   cfg = config.services.lifecycled;
 
@@ -21,17 +19,17 @@ let
   '';
 in
 {
-  meta.maintainers = with maintainers; [ cole-h grahamc ];
+  meta.maintainers = with lib.maintainers; [ cole-h grahamc ];
 
   options = {
     services.lifecycled = {
-      enable = mkEnableOption "lifecycled, a daemon for responding to AWS AutoScaling Lifecycle Hooks";
+      enable = lib.mkEnableOption "lifecycled, a daemon for responding to AWS AutoScaling Lifecycle Hooks";
 
       queueCleaner = {
-        enable = mkEnableOption "lifecycled-queue-cleaner";
+        enable = lib.mkEnableOption "lifecycled-queue-cleaner";
 
-        frequency = mkOption {
-          type = types.str;
+        frequency = lib.mkOption {
+          type = lib.types.str;
           default = "hourly";
           description = ''
             How often to trigger the queue cleaner.
@@ -43,8 +41,8 @@ in
           '';
         };
 
-        parallel = mkOption {
-          type = types.ints.unsigned;
+        parallel = lib.mkOption {
+          type = lib.types.ints.unsigned;
           default = 20;
           description = ''
             The number of parallel deletes to run.
@@ -52,63 +50,63 @@ in
         };
       };
 
-      instanceId = mkOption {
-        type = types.nullOr types.str;
+      instanceId = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         description = ''
           The instance ID to listen for events for.
         '';
       };
 
-      snsTopic = mkOption {
-        type = types.nullOr types.str;
+      snsTopic = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         description = ''
           The SNS topic that receives events.
         '';
       };
 
-      noSpot = mkOption {
-        type = types.bool;
+      noSpot = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Disable the spot termination listener.
         '';
       };
 
-      handler = mkOption {
-        type = types.path;
+      handler = lib.mkOption {
+        type = lib.types.path;
         description = ''
           The script to invoke to handle events.
         '';
       };
 
-      json = mkOption {
-        type = types.bool;
+      json = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Enable JSON logging.
         '';
       };
 
-      cloudwatchGroup = mkOption {
-        type = types.nullOr types.str;
+      cloudwatchGroup = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         description = ''
           Write logs to a specific Cloudwatch Logs group.
         '';
       };
 
-      cloudwatchStream = mkOption {
-        type = types.nullOr types.str;
+      cloudwatchStream = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         description = ''
           Write logs to a specific Cloudwatch Logs stream. Defaults to the instance ID.
         '';
       };
 
-      debug = mkOption {
-        type = types.bool;
+      debug = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Enable debugging information.
@@ -117,8 +115,8 @@ in
 
       # XXX: Can be removed if / when
       # https://github.com/buildkite/lifecycled/pull/91 is merged.
-      awsRegion = mkOption {
-        type = types.nullOr types.str;
+      awsRegion = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         description = ''
           The region used for accessing AWS services.
@@ -129,8 +127,8 @@ in
 
   ### Implementation ###
 
-  config = mkMerge [
-    (mkIf cfg.enable {
+  config = lib.mkMerge [
+    (lib.mkIf cfg.enable {
       environment.etc."lifecycled".source = configFile;
 
       systemd.packages = [ pkgs.lifecycled ];
@@ -140,10 +138,10 @@ in
       };
     })
 
-    (mkIf cfg.queueCleaner.enable {
+    (lib.mkIf cfg.queueCleaner.enable {
       systemd.services.lifecycled-queue-cleaner = {
         description = "Lifecycle Daemon Queue Cleaner";
-        environment = optionalAttrs (cfg.awsRegion != null) { AWS_REGION = cfg.awsRegion; };
+        environment = lib.optionalAttrs (cfg.awsRegion != null) { AWS_REGION = cfg.awsRegion; };
         serviceConfig = {
           Type = "oneshot";
           ExecStart = "${pkgs.lifecycled}/bin/lifecycled-queue-cleaner -parallel ${toString cfg.queueCleaner.parallel}";
diff --git a/nixos/modules/services/misc/logkeys.nix b/nixos/modules/services/misc/logkeys.nix
index 0fb4fa6cf8de..428ce626b715 100644
--- a/nixos/modules/services/misc/logkeys.nix
+++ b/nixos/modules/services/misc/logkeys.nix
@@ -1,22 +1,19 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.logkeys;
 in {
   options.services.logkeys = {
-    enable = mkEnableOption "logkeys, a keylogger service";
+    enable = lib.mkEnableOption "logkeys, a keylogger service";
 
-    device = mkOption {
+    device = lib.mkOption {
       description = "Use the given device as keyboard input event device instead of /dev/input/eventX default.";
       default = null;
-      type = types.nullOr types.str;
+      type = lib.types.nullOr lib.types.str;
       example = "/dev/input/event15";
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.logkeys = {
       description = "LogKeys Keylogger Daemon";
       wantedBy = [ "multi-user.target" ];
diff --git a/nixos/modules/services/misc/mame.nix b/nixos/modules/services/misc/mame.nix
index 38b4dd290ed5..054a7803b9c4 100644
--- a/nixos/modules/services/misc/mame.nix
+++ b/nixos/modules/services/misc/mame.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.mame;
   mame = "mame${lib.optionalString pkgs.stdenv.is64bit "64"}";
@@ -9,29 +6,29 @@ in
 {
   options = {
     services.mame = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to setup TUN/TAP Ethernet interface for MAME emulator.
         '';
       };
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         description = ''
           User from which you run MAME binary.
         '';
       };
-      hostAddr = mkOption {
-        type = types.str;
+      hostAddr = lib.mkOption {
+        type = lib.types.str;
         description = ''
           IP address of the host system. Usually an address of the main network
           adapter or the adapter through which you get an internet connection.
         '';
         example = "192.168.31.156";
       };
-      emuAddr = mkOption {
-        type = types.str;
+      emuAddr = lib.mkOption {
+        type = lib.types.str;
         description = ''
           IP address of the guest system. The same you set inside guest OS under
           MAME. Should be on the same subnet as {option}`services.mame.hostAddr`.
@@ -41,7 +38,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     environment.systemPackages = [ pkgs.mame ];
 
     security.wrappers."${mame}" = {
diff --git a/nixos/modules/services/misc/mbpfan.nix b/nixos/modules/services/misc/mbpfan.nix
index 1d9b7ae87ca0..3061f68bb6e2 100644
--- a/nixos/modules/services/misc/mbpfan.nix
+++ b/nixos/modules/services/misc/mbpfan.nix
@@ -1,55 +1,53 @@
 { config, lib, pkgs, ... }:
-with lib;
-
 let
   cfg = config.services.mbpfan;
-  verbose = optionalString cfg.verbose "v";
+  verbose = lib.optionalString cfg.verbose "v";
   format = pkgs.formats.ini {};
   cfgfile = format.generate "mbpfan.ini" cfg.settings;
 
 in {
   options.services.mbpfan = {
-    enable = mkEnableOption "mbpfan, fan controller daemon for Apple Macs and MacBooks";
-    package = mkPackageOption pkgs "mbpfan" {};
+    enable = lib.mkEnableOption "mbpfan, fan controller daemon for Apple Macs and MacBooks";
+    package = lib.mkPackageOption pkgs "mbpfan" {};
 
-    verbose = mkOption {
-      type = types.bool;
+    verbose = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = "If true, sets the log level to verbose.";
     };
 
-    aggressive = mkOption {
-      type = types.bool;
+    aggressive = lib.mkOption {
+      type = lib.types.bool;
       default = true;
       description = "If true, favors higher default fan speeds.";
     };
 
-    settings = mkOption {
+    settings = lib.mkOption {
       default = {};
       description = "INI configuration for Mbpfan.";
-      type = types.submodule {
+      type = lib.types.submodule {
         freeformType = format.type;
 
-        options.general.low_temp = mkOption {
-          type = types.int;
+        options.general.low_temp = lib.mkOption {
+          type = lib.types.int;
           default = (if cfg.aggressive then 55 else 63);
-          defaultText = literalExpression "55";
+          defaultText = lib.literalExpression "55";
           description = "If temperature is below this, fans will run at minimum speed.";
         };
-        options.general.high_temp = mkOption {
-          type = types.int;
+        options.general.high_temp = lib.mkOption {
+          type = lib.types.int;
           default = (if cfg.aggressive then 58 else 66);
-          defaultText = literalExpression "58";
+          defaultText = lib.literalExpression "58";
           description = "If temperature is above this, fan speed will gradually increase.";
         };
-        options.general.max_temp = mkOption {
-          type = types.int;
+        options.general.max_temp = lib.mkOption {
+          type = lib.types.int;
           default = (if cfg.aggressive then 78 else 86);
-          defaultText = literalExpression "78";
+          defaultText = lib.literalExpression "78";
           description = "If temperature is above this, fans will run at maximum speed.";
         };
-        options.general.polling_interval = mkOption {
-          type = types.int;
+        options.general.polling_interval = lib.mkOption {
+          type = lib.types.int;
           default = 1;
           description = "The polling interval.";
         };
@@ -58,15 +56,15 @@ in {
   };
 
   imports = [
-    (mkRenamedOptionModule [ "services" "mbpfan" "pollingInterval" ] [ "services" "mbpfan" "settings" "general" "polling_interval" ])
-    (mkRenamedOptionModule [ "services" "mbpfan" "maxTemp" ] [ "services" "mbpfan" "settings" "general" "max_temp" ])
-    (mkRenamedOptionModule [ "services" "mbpfan" "lowTemp" ] [ "services" "mbpfan" "settings" "general" "low_temp" ])
-    (mkRenamedOptionModule [ "services" "mbpfan" "highTemp" ] [ "services" "mbpfan" "settings" "general" "high_temp" ])
-    (mkRenamedOptionModule [ "services" "mbpfan" "minFanSpeed" ] [ "services" "mbpfan" "settings" "general" "min_fan1_speed" ])
-    (mkRenamedOptionModule [ "services" "mbpfan" "maxFanSpeed" ] [ "services" "mbpfan" "settings" "general" "max_fan1_speed" ])
+    (lib.mkRenamedOptionModule [ "services" "mbpfan" "pollingInterval" ] [ "services" "mbpfan" "settings" "general" "polling_interval" ])
+    (lib.mkRenamedOptionModule [ "services" "mbpfan" "maxTemp" ] [ "services" "mbpfan" "settings" "general" "max_temp" ])
+    (lib.mkRenamedOptionModule [ "services" "mbpfan" "lowTemp" ] [ "services" "mbpfan" "settings" "general" "low_temp" ])
+    (lib.mkRenamedOptionModule [ "services" "mbpfan" "highTemp" ] [ "services" "mbpfan" "settings" "general" "high_temp" ])
+    (lib.mkRenamedOptionModule [ "services" "mbpfan" "minFanSpeed" ] [ "services" "mbpfan" "settings" "general" "min_fan1_speed" ])
+    (lib.mkRenamedOptionModule [ "services" "mbpfan" "maxFanSpeed" ] [ "services" "mbpfan" "settings" "general" "max_fan1_speed" ])
   ];
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     boot.kernelModules = [ "coretemp" "applesmc" ];
     environment.systemPackages = [ cfg.package ];
     environment.etc."mbpfan.conf".source = cfgfile;
diff --git a/nixos/modules/services/misc/moonraker.nix b/nixos/modules/services/misc/moonraker.nix
index 1461f1048b03..b9ddace19e91 100644
--- a/nixos/modules/services/misc/moonraker.nix
+++ b/nixos/modules/services/misc/moonraker.nix
@@ -1,5 +1,4 @@
 { config, lib, options, pkgs, ... }:
-with lib;
 let
   cfg = config.services.moonraker;
   pkg = cfg.package;
@@ -7,37 +6,37 @@ let
   format = pkgs.formats.ini {
     # https://github.com/NixOS/nixpkgs/pull/121613#issuecomment-885241996
     listToValue = l:
-      if builtins.length l == 1 then generators.mkValueStringDefault {} (head l)
-      else lib.concatMapStrings (s: "\n  ${generators.mkValueStringDefault {} s}") l;
-    mkKeyValue = generators.mkKeyValueDefault {} ":";
+      if builtins.length l == 1 then lib.generators.mkValueStringDefault {} (lib.head l)
+      else lib.concatMapStrings (s: "\n  ${lib.generators.mkValueStringDefault {} s}") l;
+    mkKeyValue = lib.generators.mkKeyValueDefault {} ":";
   };
 
   unifiedConfigDir = cfg.stateDir + "/config";
 in {
   options = {
     services.moonraker = {
-      enable = mkEnableOption "Moonraker, an API web server for Klipper";
+      enable = lib.mkEnableOption "Moonraker, an API web server for Klipper";
 
-      package = mkPackageOption pkgs "moonraker" {
+      package = lib.mkPackageOption pkgs "moonraker" {
         nullable = true;
         example = "moonraker.override { useGpiod = true; }";
       };
 
-      klipperSocket = mkOption {
-        type = types.path;
+      klipperSocket = lib.mkOption {
+        type = lib.types.path;
         default = config.services.klipper.apiSocket;
-        defaultText = literalExpression "config.services.klipper.apiSocket";
+        defaultText = lib.literalExpression "config.services.klipper.apiSocket";
         description = "Path to Klipper's API socket.";
       };
 
-      stateDir = mkOption {
-        type = types.path;
+      stateDir = lib.mkOption {
+        type = lib.types.path;
         default = "/var/lib/moonraker";
         description = "The directory containing the Moonraker databases.";
       };
 
-      configDir = mkOption {
-        type = types.nullOr types.path;
+      configDir = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
         default = null;
         description = ''
           Deprecated directory containing client-writable configuration files.
@@ -46,32 +45,32 @@ in {
         '';
       };
 
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = "moonraker";
         description = "User account under which Moonraker runs.";
       };
 
-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
         default = "moonraker";
         description = "Group account under which Moonraker runs.";
       };
 
-      address = mkOption {
-        type = types.str;
+      address = lib.mkOption {
+        type = lib.types.str;
         default = "127.0.0.1";
         example = "0.0.0.0";
         description = "The IP or host to listen on.";
       };
 
-      port = mkOption {
-        type = types.ints.unsigned;
+      port = lib.mkOption {
+        type = lib.types.ints.unsigned;
         default = 7125;
         description = "The port to listen on.";
       };
 
-      settings = mkOption {
+      settings = lib.mkOption {
         type = format.type;
         default = { };
         example = {
@@ -86,8 +85,8 @@ in {
         '';
       };
 
-      allowSystemControl = mkOption {
-        type = types.bool;
+      allowSystemControl = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to allow Moonraker to perform system-level operations.
@@ -101,12 +100,12 @@ in {
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     warnings = []
-      ++ (optional (head (cfg.settings.update_manager.enable_system_updates or [false])) ''
+      ++ (lib.optional (lib.head (cfg.settings.update_manager.enable_system_updates or [false])) ''
         Enabling system updates is not supported on NixOS and will lead to non-removable warnings in some clients.
       '')
-      ++ (optional (cfg.configDir != null) ''
+      ++ (lib.optional (cfg.configDir != null) ''
         services.moonraker.configDir has been deprecated upstream and will be removed.
 
         Action: ${
@@ -123,14 +122,14 @@ in {
       }
     ];
 
-    users.users = optionalAttrs (cfg.user == "moonraker") {
+    users.users = lib.optionalAttrs (cfg.user == "moonraker") {
       moonraker = {
         group = cfg.group;
         uid = config.ids.uids.moonraker;
       };
     };
 
-    users.groups = optionalAttrs (cfg.group == "moonraker") {
+    users.groups = lib.optionalAttrs (cfg.group == "moonraker") {
       moonraker.gid = config.ids.gids.moonraker;
     };
 
@@ -149,7 +148,7 @@ in {
           config_path = cfg.configDir;
         };
       });
-      fullConfig = recursiveUpdate cfg.settings forcedConfig;
+      fullConfig = lib.recursiveUpdate cfg.settings forcedConfig;
     in format.generate "moonraker.cfg" fullConfig;
 
     systemd.tmpfiles.rules = [
@@ -160,7 +159,7 @@ in {
       description = "Moonraker, an API web server for Klipper";
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ]
-        ++ optional config.services.klipper.enable "klipper.service";
+        ++ lib.optional config.services.klipper.enable "klipper.service";
 
       # Moonraker really wants its own config to be writable...
       script = ''
@@ -211,7 +210,7 @@ in {
     '';
   };
 
-  meta.maintainers = with maintainers; [
+  meta.maintainers = with lib.maintainers; [
     cab404
     vtuan10
     zhaofengli
diff --git a/nixos/modules/services/misc/n8n.nix b/nixos/modules/services/misc/n8n.nix
index 231470b9937a..623c9a3be8a9 100644
--- a/nixos/modules/services/misc/n8n.nix
+++ b/nixos/modules/services/misc/n8n.nix
@@ -1,7 +1,4 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   cfg = config.services.n8n;
   format = pkgs.formats.json {};
@@ -9,15 +6,15 @@ let
 in
 {
   options.services.n8n = {
-    enable = mkEnableOption "n8n server";
+    enable = lib.mkEnableOption "n8n server";
 
-    openFirewall = mkOption {
-      type = types.bool;
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = "Open ports in the firewall for the n8n web interface.";
     };
 
-    settings = mkOption {
+    settings = lib.mkOption {
       type = format.type;
       default = {};
       description = ''
@@ -26,8 +23,8 @@ in
       '';
     };
 
-    webhookUrl = mkOption {
-      type = types.str;
+    webhookUrl = lib.mkOption {
+      type = lib.types.str;
       default = "";
       description = ''
         WEBHOOK_URL for n8n, in case we're running behind a reverse proxy.
@@ -37,7 +34,7 @@ in
 
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     services.n8n.settings = {
       # We use this to open the firewall, so we need to know about the default at eval time
       port = lib.mkDefault 5678;
@@ -85,7 +82,7 @@ in
       };
     };
 
-    networking.firewall = mkIf cfg.openFirewall {
+    networking.firewall = lib.mkIf cfg.openFirewall {
       allowedTCPPorts = [ cfg.settings.port ];
     };
   };
diff --git a/nixos/modules/services/misc/nix-ssh-serve.nix b/nixos/modules/services/misc/nix-ssh-serve.nix
index f60736c688d9..b0ccf495c7eb 100644
--- a/nixos/modules/services/misc/nix-ssh-serve.nix
+++ b/nixos/modules/services/misc/nix-ssh-serve.nix
@@ -1,6 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
 let cfg = config.nix.sshServe;
     command =
       if cfg.protocol == "ssh"
@@ -11,27 +9,27 @@ in {
 
     nix.sshServe = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Whether to enable serving the Nix store as a remote store via SSH.";
       };
 
-      write = mkOption {
-        type = types.bool;
+      write = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Whether to enable writing to the Nix store as a remote store via SSH. Note: the sshServe user is named nix-ssh and is not a trusted-user. nix-ssh should be added to the {option}`nix.settings.trusted-users` option in most use cases, such as allowing remote building of derivations.";
       };
 
-      keys = mkOption {
-        type = types.listOf types.str;
+      keys = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [];
         example = [ "ssh-dss AAAAB3NzaC1k... alice@example.org" ];
         description = "A list of SSH public keys allowed to access the binary cache via SSH.";
       };
 
-      protocol = mkOption {
-        type = types.enum [ "ssh" "ssh-ng" ];
+      protocol = lib.mkOption {
+        type = lib.types.enum [ "ssh" "ssh-ng" ];
         default = "ssh";
         description = "The specific Nix-over-SSH protocol to use.";
       };
@@ -40,7 +38,7 @@ in {
 
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     users.users.nix-ssh = {
       description = "Nix SSH store user";
diff --git a/nixos/modules/services/misc/novacomd.nix b/nixos/modules/services/misc/novacomd.nix
index 7cfc68d2b673..52423ff0668f 100644
--- a/nixos/modules/services/misc/novacomd.nix
+++ b/nixos/modules/services/misc/novacomd.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   cfg = config.services.novacomd;
@@ -10,11 +7,11 @@ in {
 
   options = {
     services.novacomd = {
-      enable = mkEnableOption "Novacom service for connecting to WebOS devices";
+      enable = lib.mkEnableOption "Novacom service for connecting to WebOS devices";
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     environment.systemPackages = [ pkgs.webos.novacom ];
 
     systemd.services.novacomd = {
@@ -27,5 +24,5 @@ in {
     };
   };
 
-  meta.maintainers = with maintainers; [ dtzWill ];
+  meta.maintainers = with lib.maintainers; [ dtzWill ];
 }
diff --git a/nixos/modules/services/misc/ntfy-sh.nix b/nixos/modules/services/misc/ntfy-sh.nix
index ae6ab9571d0f..db857a3f1472 100644
--- a/nixos/modules/services/misc/ntfy-sh.nix
+++ b/nixos/modules/services/misc/ntfy-sh.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.ntfy-sh;
 
@@ -10,28 +7,28 @@ in
 
 {
   options.services.ntfy-sh = {
-    enable = mkEnableOption "[ntfy-sh](https://ntfy.sh), a push notification service";
+    enable = lib.mkEnableOption "[ntfy-sh](https://ntfy.sh), a push notification service";
 
-    package = mkPackageOption pkgs "ntfy-sh" { };
+    package = lib.mkPackageOption pkgs "ntfy-sh" { };
 
-    user = mkOption {
+    user = lib.mkOption {
       default = "ntfy-sh";
-      type = types.str;
+      type = lib.types.str;
       description = "User the ntfy-sh server runs under.";
     };
 
-    group = mkOption {
+    group = lib.mkOption {
       default = "ntfy-sh";
-      type = types.str;
+      type = lib.types.str;
       description = "Primary group of ntfy-sh user.";
     };
 
-    settings = mkOption {
-      type = types.submodule {
+    settings = lib.mkOption {
+      type = lib.types.submodule {
         freeformType = settingsFormat.type;
         options = {
-          base-url = mkOption {
-            type = types.str;
+          base-url = lib.mkOption {
+            type = lib.types.str;
             example = "https://ntfy.example";
             description = ''
               Public facing base URL of the service
@@ -49,7 +46,7 @@ in
 
       default = { };
 
-      example = literalExpression ''
+      example = lib.literalExpression ''
         {
           listen-http = ":8080";
         }
@@ -65,7 +62,7 @@ in
     let
       configuration = settingsFormat.generate "server.yml" cfg.settings;
     in
-    mkIf cfg.enable {
+    lib.mkIf cfg.enable {
       # to configure access control via the cli
       environment = {
         etc."ntfy/server.yml".source = configuration;
@@ -73,10 +70,10 @@ in
       };
 
       services.ntfy-sh.settings = {
-        auth-file = mkDefault "/var/lib/ntfy-sh/user.db";
-        listen-http = mkDefault "127.0.0.1:2586";
-        attachment-cache-dir = mkDefault "/var/lib/ntfy-sh/attachments";
-        cache-file = mkDefault "/var/lib/ntfy-sh/cache-file.db";
+        auth-file = lib.mkDefault "/var/lib/ntfy-sh/user.db";
+        listen-http = lib.mkDefault "127.0.0.1:2586";
+        attachment-cache-dir = lib.mkDefault "/var/lib/ntfy-sh/attachments";
+        cache-file = lib.mkDefault "/var/lib/ntfy-sh/cache-file.db";
       };
 
       systemd.services.ntfy-sh = {
@@ -110,11 +107,11 @@ in
         };
       };
 
-      users.groups = optionalAttrs (cfg.group == "ntfy-sh") {
+      users.groups = lib.optionalAttrs (cfg.group == "ntfy-sh") {
         ntfy-sh = { };
       };
 
-      users.users = optionalAttrs (cfg.user == "ntfy-sh") {
+      users.users = lib.optionalAttrs (cfg.user == "ntfy-sh") {
         ntfy-sh = {
           isSystemUser = true;
           group = cfg.group;
diff --git a/nixos/modules/services/misc/nzbget.nix b/nixos/modules/services/misc/nzbget.nix
index c961fe9b2877..a2726d455009 100644
--- a/nixos/modules/services/misc/nzbget.nix
+++ b/nixos/modules/services/misc/nzbget.nix
@@ -1,46 +1,43 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   cfg = config.services.nzbget;
   pkg = pkgs.nzbget;
   stateDir = "/var/lib/nzbget";
   configFile = "${stateDir}/nzbget.conf";
-  configOpts = concatStringsSep " " (mapAttrsToList (name: value: "-o ${name}=${escapeShellArg (toStr value)}") cfg.settings);
+  configOpts = lib.concatStringsSep " " (lib.mapAttrsToList (name: value: "-o ${name}=${lib.escapeShellArg (toStr value)}") cfg.settings);
   toStr = v:
     if v == true then "yes"
     else if v == false then "no"
-    else if isInt v then toString v
+    else if lib.isInt v then toString v
     else v;
 in
 {
   imports = [
-    (mkRemovedOptionModule [ "services" "misc" "nzbget" "configFile" ] "The configuration of nzbget is now managed by users through the web interface.")
-    (mkRemovedOptionModule [ "services" "misc" "nzbget" "dataDir" ] "The data directory for nzbget is now /var/lib/nzbget.")
-    (mkRemovedOptionModule [ "services" "misc" "nzbget" "openFirewall" ] "The port used by nzbget is managed through the web interface so you should adjust your firewall rules accordingly.")
+    (lib.mkRemovedOptionModule [ "services" "misc" "nzbget" "configFile" ] "The configuration of nzbget is now managed by users through the web interface.")
+    (lib.mkRemovedOptionModule [ "services" "misc" "nzbget" "dataDir" ] "The data directory for nzbget is now /var/lib/nzbget.")
+    (lib.mkRemovedOptionModule [ "services" "misc" "nzbget" "openFirewall" ] "The port used by nzbget is managed through the web interface so you should adjust your firewall rules accordingly.")
   ];
 
   # interface
 
   options = {
     services.nzbget = {
-      enable = mkEnableOption "NZBGet, for downloading files from news servers";
+      enable = lib.mkEnableOption "NZBGet, for downloading files from news servers";
 
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = "nzbget";
         description = "User account under which NZBGet runs";
       };
 
-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
         default = "nzbget";
         description = "Group under which NZBGet runs";
       };
 
-      settings = mkOption {
-        type = with types; attrsOf (oneOf [ bool int str ]);
+      settings = lib.mkOption {
+        type = with lib.types; attrsOf (oneOf [ bool int str ]);
         default = {};
         description = ''
           NZBGet configuration, passed via command line using switch -o. Refer to
@@ -56,7 +53,7 @@ in
 
   # implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     services.nzbget.settings = {
       # allows nzbget to run as a "simple" service
       OutputMode = "loggable";
@@ -100,7 +97,7 @@ in
       };
     };
 
-    users.users = mkIf (cfg.user == "nzbget") {
+    users.users = lib.mkIf (cfg.user == "nzbget") {
       nzbget = {
         home = stateDir;
         group = cfg.group;
@@ -108,7 +105,7 @@ in
       };
     };
 
-    users.groups = mkIf (cfg.group == "nzbget") {
+    users.groups = lib.mkIf (cfg.group == "nzbget") {
       nzbget = {
         gid = config.ids.gids.nzbget;
       };
diff --git a/nixos/modules/services/misc/nzbhydra2.nix b/nixos/modules/services/misc/nzbhydra2.nix
index 8246ea52f978..c71e8a92b727 100644
--- a/nixos/modules/services/misc/nzbhydra2.nix
+++ b/nixos/modules/services/misc/nzbhydra2.nix
@@ -1,31 +1,28 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let cfg = config.services.nzbhydra2;
 
 in {
   options = {
     services.nzbhydra2 = {
-      enable = mkEnableOption "NZBHydra2, Usenet meta search";
+      enable = lib.mkEnableOption "NZBHydra2, Usenet meta search";
 
-      dataDir = mkOption {
-        type = types.str;
+      dataDir = lib.mkOption {
+        type = lib.types.str;
         default = "/var/lib/nzbhydra2";
         description = "The directory where NZBHydra2 stores its data files.";
       };
 
-      openFirewall = mkOption {
-        type = types.bool;
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Open ports in the firewall for the NZBHydra2 web interface.";
       };
 
-      package = mkPackageOption pkgs "nzbhydra2" { };
+      package = lib.mkPackageOption pkgs "nzbhydra2" { };
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.tmpfiles.rules =
       [ "d '${cfg.dataDir}' 0700 nzbhydra2 nzbhydra2 - -" ];
 
@@ -60,7 +57,7 @@ in {
       };
     };
 
-    networking.firewall = mkIf cfg.openFirewall { allowedTCPPorts = [ 5076 ]; };
+    networking.firewall = lib.mkIf cfg.openFirewall { allowedTCPPorts = [ 5076 ]; };
 
     users.users.nzbhydra2 = {
       group = "nzbhydra2";
diff --git a/nixos/modules/services/misc/octoprint.nix b/nixos/modules/services/misc/octoprint.nix
index 6290a6a7a537..42b2926a7a1e 100644
--- a/nixos/modules/services/misc/octoprint.nix
+++ b/nixos/modules/services/misc/octoprint.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   cfg = config.services.octoprint;
@@ -13,7 +10,7 @@ let
     webcam.ffmpeg = "${pkgs.ffmpeg.bin}/bin/ffmpeg";
   };
 
-  fullConfig = recursiveUpdate cfg.extraConfig baseConfig;
+  fullConfig = lib.recursiveUpdate cfg.extraConfig baseConfig;
 
   cfgUpdate = pkgs.writeText "octoprint-config.yaml" (builtins.toJSON fullConfig);
 
@@ -29,58 +26,58 @@ in
 
     services.octoprint = {
 
-      enable = mkEnableOption "OctoPrint, web interface for 3D printers";
+      enable = lib.mkEnableOption "OctoPrint, web interface for 3D printers";
 
-      host = mkOption {
-        type = types.str;
+      host = lib.mkOption {
+        type = lib.types.str;
         default = "0.0.0.0";
         description = ''
           Host to bind OctoPrint to.
         '';
       };
 
-      port = mkOption {
-        type = types.port;
+      port = lib.mkOption {
+        type = lib.types.port;
         default = 5000;
         description = ''
           Port to bind OctoPrint to.
         '';
       };
 
-      openFirewall = mkOption {
-        type = types.bool;
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Open ports in the firewall for OctoPrint.";
       };
 
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = "octoprint";
         description = "User for the daemon.";
       };
 
-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
         default = "octoprint";
         description = "Group for the daemon.";
       };
 
-      stateDir = mkOption {
-        type = types.path;
+      stateDir = lib.mkOption {
+        type = lib.types.path;
         default = "/var/lib/octoprint";
         description = "State directory of the daemon.";
       };
 
-      plugins = mkOption {
-        type = types.functionTo (types.listOf types.package);
+      plugins = lib.mkOption {
+        type = lib.types.functionTo (lib.types.listOf lib.types.package);
         default = plugins: [ ];
-        defaultText = literalExpression "plugins: []";
-        example = literalExpression "plugins: with plugins; [ themeify stlviewer ]";
+        defaultText = lib.literalExpression "plugins: []";
+        example = lib.literalExpression "plugins: with plugins; [ themeify stlviewer ]";
         description = "Additional plugins to be used. Available plugins are passed through the plugins input.";
       };
 
-      extraConfig = mkOption {
-        type = types.attrs;
+      extraConfig = lib.mkOption {
+        type = lib.types.attrs;
         default = { };
         description = "Extra options which are added to OctoPrint's YAML configuration file.";
       };
@@ -91,16 +88,16 @@ in
 
   ##### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
-    users.users = optionalAttrs (cfg.user == "octoprint") {
+    users.users = lib.optionalAttrs (cfg.user == "octoprint") {
       octoprint = {
         group = cfg.group;
         uid = config.ids.uids.octoprint;
       };
     };
 
-    users.groups = optionalAttrs (cfg.group == "octoprint") {
+    users.groups = lib.optionalAttrs (cfg.group == "octoprint") {
       octoprint.gid = config.ids.gids.octoprint;
     };
 
@@ -137,6 +134,6 @@ in
       };
     };
 
-    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ];
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ cfg.port ];
   };
 }
diff --git a/nixos/modules/services/misc/ombi.nix b/nixos/modules/services/misc/ombi.nix
index 9b2e3cf84e5d..51f3c3e468a5 100644
--- a/nixos/modules/services/misc/ombi.nix
+++ b/nixos/modules/services/misc/ombi.nix
@@ -1,13 +1,10 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let cfg = config.services.ombi;
 
 in {
   options = {
     services.ombi = {
-      enable = mkEnableOption ''
+      enable = lib.mkEnableOption ''
         Ombi, a web application that automatically gives your shared Plex or
         Emby users the ability to request content by themselves!
 
@@ -15,39 +12,39 @@ in {
         on how to set up a reverse proxy
       '';
 
-      dataDir = mkOption {
-        type = types.str;
+      dataDir = lib.mkOption {
+        type = lib.types.str;
         default = "/var/lib/ombi";
         description = "The directory where Ombi stores its data files.";
       };
 
-      port = mkOption {
-        type = types.port;
+      port = lib.mkOption {
+        type = lib.types.port;
         default = 5000;
         description = "The port for the Ombi web interface.";
       };
 
-      openFirewall = mkOption {
-        type = types.bool;
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Open ports in the firewall for the Ombi web interface.";
       };
 
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = "ombi";
         description = "User account under which Ombi runs.";
       };
 
-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
         default = "ombi";
         description = "Group under which Ombi runs.";
       };
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.tmpfiles.rules = [
       "d '${cfg.dataDir}' 0700 ${cfg.user} ${cfg.group} - -"
     ];
@@ -66,11 +63,11 @@ in {
       };
     };
 
-    networking.firewall = mkIf cfg.openFirewall {
+    networking.firewall = lib.mkIf cfg.openFirewall {
       allowedTCPPorts = [ cfg.port ];
     };
 
-    users.users = mkIf (cfg.user == "ombi") {
+    users.users = lib.mkIf (cfg.user == "ombi") {
       ombi = {
         isSystemUser = true;
         group = cfg.group;
@@ -78,6 +75,6 @@ in {
       };
     };
 
-    users.groups = mkIf (cfg.group == "ombi") { ombi = { }; };
+    users.groups = lib.mkIf (cfg.group == "ombi") { ombi = { }; };
   };
 }
diff --git a/nixos/modules/services/misc/osrm.nix b/nixos/modules/services/misc/osrm.nix
index a93337dc75e3..8feccbbfa726 100644
--- a/nixos/modules/services/misc/osrm.nix
+++ b/nixos/modules/services/misc/osrm.nix
@@ -1,59 +1,56 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.osrm;
 in
 
 {
   options.services.osrm = {
-    enable = mkOption {
-      type = types.bool;
+    enable = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = "Enable the OSRM service.";
     };
 
-    address = mkOption {
-      type = types.str;
+    address = lib.mkOption {
+      type = lib.types.str;
       default = "0.0.0.0";
       description = "IP address on which the web server will listen.";
     };
 
-    port = mkOption {
-      type = types.port;
+    port = lib.mkOption {
+      type = lib.types.port;
       default = 5000;
       description = "Port on which the web server will run.";
     };
 
-    threads = mkOption {
-      type = types.int;
+    threads = lib.mkOption {
+      type = lib.types.int;
       default = 4;
       description = "Number of threads to use.";
     };
 
-    algorithm = mkOption {
-      type = types.enum [ "CH" "CoreCH" "MLD" ];
+    algorithm = lib.mkOption {
+      type = lib.types.enum [ "CH" "CoreCH" "MLD" ];
       default = "MLD";
       description = "Algorithm to use for the data. Must be one of CH, CoreCH, MLD";
     };
 
-    extraFlags = mkOption {
-      type = types.listOf types.str;
+    extraFlags = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
       default = [];
       example = [ "--max-table-size 1000" "--max-matching-size 1000" ];
       description = "Extra command line arguments passed to osrm-routed";
     };
 
-    dataFile = mkOption {
-      type = types.path;
+    dataFile = lib.mkOption {
+      type = lib.types.path;
       example = "/var/lib/osrm/berlin-latest.osrm";
       description = "Data file location";
     };
 
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     users.users.osrm = {
       group = config.users.users.osrm.name;
diff --git a/nixos/modules/services/misc/owncast.nix b/nixos/modules/services/misc/owncast.nix
index 94f0f4e998c4..debbd90d42a7 100644
--- a/nixos/modules/services/misc/owncast.nix
+++ b/nixos/modules/services/misc/owncast.nix
@@ -1,57 +1,56 @@
 { lib, pkgs, config, ... }:
-with lib;
 let cfg = config.services.owncast;
 in {
 
   options.services.owncast = {
 
-    enable = mkEnableOption "owncast, a video live streaming solution";
+    enable = lib.mkEnableOption "owncast, a video live streaming solution";
 
-    dataDir = mkOption {
-      type = types.str;
+    dataDir = lib.mkOption {
+      type = lib.types.str;
       default = "/var/lib/owncast";
       description = ''
         The directory where owncast stores its data files. If left as the default value this directory will automatically be created before the owncast server starts, otherwise the sysadmin is responsible for ensuring the directory exists with appropriate ownership and permissions.
       '';
     };
 
-    openFirewall = mkOption {
-      type = types.bool;
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''
         Open the appropriate ports in the firewall for owncast.
       '';
     };
 
-    user = mkOption {
-      type = types.str;
+    user = lib.mkOption {
+      type = lib.types.str;
       default = "owncast";
       description = "User account under which owncast runs.";
     };
 
-    group = mkOption {
-      type = types.str;
+    group = lib.mkOption {
+      type = lib.types.str;
       default = "owncast";
       description = "Group under which owncast runs.";
     };
 
-    listen = mkOption {
-      type = types.str;
+    listen = lib.mkOption {
+      type = lib.types.str;
       default = "127.0.0.1";
       example = "0.0.0.0";
       description = "The IP address to bind the owncast web server to.";
     };
 
-    port = mkOption {
-      type = types.port;
+    port = lib.mkOption {
+      type = lib.types.port;
       default = 8080;
       description = ''
         TCP port where owncast web-gui listens.
       '';
     };
 
-    rtmp-port = mkOption {
-      type = types.port;
+    rtmp-port = lib.mkOption {
+      type = lib.types.port;
       default = 1935;
       description = ''
         TCP port where owncast rtmp service listens.
@@ -60,13 +59,13 @@ in {
 
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     systemd.services.owncast = {
       description = "A self-hosted live video and web chat server";
       wantedBy = [ "multi-user.target" ];
 
-      serviceConfig = mkMerge [
+      serviceConfig = lib.mkMerge [
         {
           User = cfg.user;
           Group = cfg.group;
@@ -74,13 +73,13 @@ in {
           ExecStart = "${pkgs.owncast}/bin/owncast -webserverport ${toString cfg.port} -rtmpport ${toString cfg.rtmp-port} -webserverip ${cfg.listen}";
           Restart = "on-failure";
         }
-        (mkIf (cfg.dataDir == "/var/lib/owncast") {
+        (lib.mkIf (cfg.dataDir == "/var/lib/owncast") {
           StateDirectory = "owncast";
         })
       ];
     };
 
-    users.users = mkIf (cfg.user == "owncast") {
+    users.users = lib.mkIf (cfg.user == "owncast") {
       owncast = {
         isSystemUser = true;
         group = cfg.group;
@@ -88,10 +87,10 @@ in {
       };
     };
 
-    users.groups = mkIf (cfg.group == "owncast") { owncast = { }; };
+    users.groups = lib.mkIf (cfg.group == "owncast") { owncast = { }; };
 
     networking.firewall =
-      mkIf cfg.openFirewall { allowedTCPPorts = [ cfg.rtmp-port ] ++ optional (cfg.listen != "127.0.0.1") cfg.port; };
+      lib.mkIf cfg.openFirewall { allowedTCPPorts = [ cfg.rtmp-port ] ++ lib.optional (cfg.listen != "127.0.0.1") cfg.port; };
 
   };
   meta = { maintainers = with lib.maintainers; [ MayNiklas ]; };
diff --git a/nixos/modules/services/networking/dnscrypt-wrapper.nix b/nixos/modules/services/networking/dnscrypt-wrapper.nix
index fb07d893b88e..2a9ae3cfbaad 100644
--- a/nixos/modules/services/networking/dnscrypt-wrapper.nix
+++ b/nixos/modules/services/networking/dnscrypt-wrapper.nix
@@ -1,6 +1,4 @@
 { config, lib, pkgs, ... }:
-with lib;
-
 let
   cfg     = config.services.dnscrypt-wrapper;
   dataDir = "/var/lib/dnscrypt-wrapper";
@@ -40,7 +38,7 @@ let
     cd ${dataDir}
 
     # generate provider keypair (first run only)
-    ${optionalString (cfg.providerKey.public == null || cfg.providerKey.secret == null) ''
+    ${lib.optionalString (cfg.providerKey.public == null || cfg.providerKey.secret == null) ''
       if [ ! -f ${publicKey} ] || [ ! -f ${secretKey} ]; then
         dnscrypt-wrapper --gen-provider-keypair
       fi
@@ -96,12 +94,12 @@ let
         sha256 = "0c4mq741q4rpmdn09agwmxap32kf0vgfz7pkhcdc5h54chc3g3xy";
       };
 
-      configureFlags = optional stdenv.isLinux "--with-systemd";
+      configureFlags = lib.optional stdenv.isLinux "--with-systemd";
 
       nativeBuildInputs = [ autoreconfHook pkg-config ];
 
       # <ldns/ldns.h> depends on <openssl/ssl.h>
-      buildInputs = [ libsodium openssl.dev ldns ] ++ optional stdenv.isLinux systemd;
+      buildInputs = [ libsodium openssl.dev ldns ] ++ lib.optional stdenv.isLinux systemd;
 
       postInstall = ''
         # Previous versions required libtool files to load plugins; they are
@@ -112,9 +110,9 @@ let
       meta = {
         description = "A tool for securing communications between a client and a DNS resolver";
         homepage = "https://github.com/dyne/dnscrypt-proxy";
-        license = licenses.isc;
-        maintainers = with maintainers; [ rnhmjoj ];
-        platforms = platforms.linux;
+        license = lib.licenses.isc;
+        maintainers = with lib.maintainers; [ rnhmjoj ];
+        platforms = lib.platforms.linux;
       };
     }) { };
 
@@ -124,28 +122,28 @@ in {
   ###### interface
 
   options.services.dnscrypt-wrapper = {
-    enable = mkEnableOption "DNSCrypt wrapper";
+    enable = lib.mkEnableOption "DNSCrypt wrapper";
 
-    address = mkOption {
-      type = types.str;
+    address = lib.mkOption {
+      type = lib.types.str;
       default = "127.0.0.1";
       description = ''
         The DNSCrypt wrapper will bind to this IP address.
       '';
     };
 
-    port = mkOption {
-      type = types.port;
+    port = lib.mkOption {
+      type = lib.types.port;
       default = 5353;
       description = ''
         The DNSCrypt wrapper will listen for DNS queries on this port.
       '';
     };
 
-    providerName = mkOption {
-      type = types.str;
+    providerName = lib.mkOption {
+      type = lib.types.str;
       default = "2.dnscrypt-cert.${config.networking.hostName}";
-      defaultText = literalExpression ''"2.dnscrypt-cert.''${config.networking.hostName}"'';
+      defaultText = lib.literalExpression ''"2.dnscrypt-cert.''${config.networking.hostName}"'';
       example = "2.dnscrypt-cert.myresolver";
       description = ''
         The name that will be given to this DNSCrypt resolver.
@@ -153,8 +151,8 @@ in {
       '';
     };
 
-    providerKey.public = mkOption {
-      type = types.nullOr types.path;
+    providerKey.public = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
       default = null;
       example = "/etc/secrets/public.key";
       description = ''
@@ -163,8 +161,8 @@ in {
       '';
     };
 
-    providerKey.secret = mkOption {
-      type = types.nullOr types.path;
+    providerKey.secret = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
       default = null;
       example = "/etc/secrets/secret.key";
       description = ''
@@ -173,24 +171,24 @@ in {
       '';
     };
 
-    upstream.address = mkOption {
-      type = types.str;
+    upstream.address = lib.mkOption {
+      type = lib.types.str;
       default = "127.0.0.1";
       description = ''
         The IP address of the upstream DNS server DNSCrypt will "wrap".
       '';
     };
 
-    upstream.port = mkOption {
-      type = types.port;
+    upstream.port = lib.mkOption {
+      type = lib.types.port;
       default = 53;
       description = ''
         The port of the upstream DNS server DNSCrypt will "wrap".
       '';
     };
 
-    keys.expiration = mkOption {
-      type = types.int;
+    keys.expiration = lib.mkOption {
+      type = lib.types.int;
       default = 30;
       description = ''
         The duration (in days) of the time-limited secret key.
@@ -198,8 +196,8 @@ in {
       '';
     };
 
-    keys.checkInterval = mkOption {
-      type = types.int;
+    keys.checkInterval = lib.mkOption {
+      type = lib.types.int;
       default = 1440;
       description = ''
         The time interval (in minutes) between key expiration checks.
@@ -211,7 +209,7 @@ in {
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     users.users.dnscrypt-wrapper = {
       description = "dnscrypt-wrapper daemon user";
diff --git a/nixos/modules/services/networking/kea.nix b/nixos/modules/services/networking/kea.nix
index 11add600b66f..8a145c37a61f 100644
--- a/nixos/modules/services/networking/kea.nix
+++ b/nixos/modules/services/networking/kea.nix
@@ -3,9 +3,6 @@
 , pkgs
 , ...
 }:
-
-with lib;
-
 let
   cfg = config.services.kea;
 
@@ -32,17 +29,17 @@ let
   package = pkgs.kea;
 in
 {
-  options.services.kea = with types; {
-    ctrl-agent = mkOption {
+  options.services.kea = with lib.types; {
+    ctrl-agent = lib.mkOption {
       description = ''
         Kea Control Agent configuration
       '';
       default = {};
       type = submodule {
         options = {
-          enable = mkEnableOption "Kea Control Agent";
+          enable = lib.mkEnableOption "Kea Control Agent";
 
-          extraArgs = mkOption {
+          extraArgs = lib.mkOption {
             type = listOf str;
             default = [];
             description = ''
@@ -50,7 +47,7 @@ in
             '';
           };
 
-          configFile = mkOption {
+          configFile = lib.mkOption {
             type = nullOr path;
             default = null;
             description = ''
@@ -61,7 +58,7 @@ in
             '';
           };
 
-          settings = mkOption {
+          settings = lib.mkOption {
             type = format.type;
             default = null;
             description = ''
@@ -72,16 +69,16 @@ in
       };
     };
 
-    dhcp4 = mkOption {
+    dhcp4 = lib.mkOption {
       description = ''
         DHCP4 Server configuration
       '';
       default = {};
       type = submodule {
         options = {
-          enable = mkEnableOption "Kea DHCP4 server";
+          enable = lib.mkEnableOption "Kea DHCP4 server";
 
-          extraArgs = mkOption {
+          extraArgs = lib.mkOption {
             type = listOf str;
             default = [];
             description = ''
@@ -89,7 +86,7 @@ in
             '';
           };
 
-          configFile = mkOption {
+          configFile = lib.mkOption {
             type = nullOr path;
             default = null;
             description = ''
@@ -100,7 +97,7 @@ in
             '';
           };
 
-          settings = mkOption {
+          settings = lib.mkOption {
             type = format.type;
             default = null;
             example = {
@@ -132,16 +129,16 @@ in
       };
     };
 
-    dhcp6 = mkOption {
+    dhcp6 = lib.mkOption {
       description = ''
         DHCP6 Server configuration
       '';
       default = {};
       type = submodule {
         options = {
-          enable = mkEnableOption "Kea DHCP6 server";
+          enable = lib.mkEnableOption "Kea DHCP6 server";
 
-          extraArgs = mkOption {
+          extraArgs = lib.mkOption {
             type = listOf str;
             default = [];
             description = ''
@@ -149,7 +146,7 @@ in
             '';
           };
 
-          configFile = mkOption {
+          configFile = lib.mkOption {
             type = nullOr path;
             default = null;
             description = ''
@@ -160,7 +157,7 @@ in
             '';
           };
 
-          settings = mkOption {
+          settings = lib.mkOption {
             type = format.type;
             default = null;
             example = {
@@ -193,16 +190,16 @@ in
       };
     };
 
-    dhcp-ddns = mkOption {
+    dhcp-ddns = lib.mkOption {
       description = ''
         Kea DHCP-DDNS configuration
       '';
       default = {};
       type = submodule {
         options = {
-          enable = mkEnableOption "Kea DDNS server";
+          enable = lib.mkEnableOption "Kea DDNS server";
 
-          extraArgs = mkOption {
+          extraArgs = lib.mkOption {
             type = listOf str;
             default = [];
             description = ''
@@ -210,7 +207,7 @@ in
             '';
           };
 
-          configFile = mkOption {
+          configFile = lib.mkOption {
             type = nullOr path;
             default = null;
             description = ''
@@ -221,7 +218,7 @@ in
             '';
           };
 
-          settings = mkOption {
+          settings = lib.mkOption {
             type = format.type;
             default = null;
             example = {
@@ -258,14 +255,14 @@ in
       StateDirectory = "kea";
       UMask = "0077";
     };
-  in mkIf (cfg.ctrl-agent.enable || cfg.dhcp4.enable || cfg.dhcp6.enable || cfg.dhcp-ddns.enable) (mkMerge [
+  in lib.mkIf (cfg.ctrl-agent.enable || cfg.dhcp4.enable || cfg.dhcp6.enable || cfg.dhcp-ddns.enable) (lib.mkMerge [
   {
     environment.systemPackages = [ package ];
   }
 
-  (mkIf cfg.ctrl-agent.enable {
+  (lib.mkIf cfg.ctrl-agent.enable {
     assertions = [{
-        assertion = xor (cfg.ctrl-agent.settings == null) (cfg.ctrl-agent.configFile == null);
+        assertion = lib.xor (cfg.ctrl-agent.settings == null) (cfg.ctrl-agent.configFile == null);
         message = "Either services.kea.ctrl-agent.settings or services.kea.ctrl-agent.configFile must be set to a non-null value.";
     }];
 
@@ -308,9 +305,9 @@ in
     };
   })
 
-  (mkIf cfg.dhcp4.enable {
+  (lib.mkIf cfg.dhcp4.enable {
     assertions = [{
-        assertion = xor (cfg.dhcp4.settings == null) (cfg.dhcp4.configFile == null);
+        assertion = lib.xor (cfg.dhcp4.settings == null) (cfg.dhcp4.configFile == null);
         message = "Either services.kea.dhcp4.settings or services.kea.dhcp4.configFile must be set to a non-null value.";
     }];
 
@@ -358,9 +355,9 @@ in
     };
   })
 
-  (mkIf cfg.dhcp6.enable {
+  (lib.mkIf cfg.dhcp6.enable {
     assertions = [{
-        assertion = xor (cfg.dhcp6.settings == null) (cfg.dhcp6.configFile == null);
+        assertion = lib.xor (cfg.dhcp6.settings == null) (cfg.dhcp6.configFile == null);
         message = "Either services.kea.dhcp6.settings or services.kea.dhcp6.configFile must be set to a non-null value.";
     }];
 
@@ -406,9 +403,9 @@ in
     };
   })
 
-  (mkIf cfg.dhcp-ddns.enable {
+  (lib.mkIf cfg.dhcp-ddns.enable {
     assertions = [{
-        assertion = xor (cfg.dhcp-ddns.settings == null) (cfg.dhcp-ddns.configFile == null);
+        assertion = lib.xor (cfg.dhcp-ddns.settings == null) (cfg.dhcp-ddns.configFile == null);
         message = "Either services.kea.dhcp-ddns.settings or services.kea.dhcp-ddns.configFile must be set to a non-null value.";
     }];
 
@@ -453,7 +450,7 @@ in
 
   ]);
 
-  meta.maintainers = with maintainers; [ hexa ];
+  meta.maintainers = with lib.maintainers; [ hexa ];
   # uses attributes of the linked package
   meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/services/networking/kresd.nix b/nixos/modules/services/networking/kresd.nix
index d295e40f3922..892f863aacfe 100644
--- a/nixos/modules/services/networking/kresd.nix
+++ b/nixos/modules/services/networking/kresd.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.kresd;
 
@@ -12,11 +9,11 @@ let
     al_v4 = builtins.match "([0-9.]+):([0-9]+)($)" addr;
     al_v6 = builtins.match "\\[(.+)]:([0-9]+)(%.*|$)" addr;
     al_portOnly = builtins.match "(^)([0-9]+)" addr;
-    al = findFirst (a: a != null)
+    al = lib.findFirst (a: a != null)
       (throw "services.kresd.*: incorrect address specification '${addr}'")
       [ al_v4 al_v6 al_portOnly ];
-    port = elemAt al 1;
-    addrSpec = if al_portOnly == null then "'${head al}${elemAt al 2}'" else "{'::', '0.0.0.0'}";
+    port = lib.elemAt al 1;
+    addrSpec = if al_portOnly == null then "'${lib.head al}${lib.elemAt al 2}'" else "{'::', '0.0.0.0'}";
     in # freebind is set for compatibility with earlier kresd services;
        # it could be configurable, for example.
       ''
@@ -25,30 +22,30 @@ let
 
   configFile = pkgs.writeText "kresd.conf" (
     ""
-    + concatMapStrings (mkListen "dns") cfg.listenPlain
-    + concatMapStrings (mkListen "tls") cfg.listenTLS
-    + concatMapStrings (mkListen "doh2") cfg.listenDoH
+    + lib.concatMapStrings (mkListen "dns") cfg.listenPlain
+    + lib.concatMapStrings (mkListen "tls") cfg.listenTLS
+    + lib.concatMapStrings (mkListen "doh2") cfg.listenDoH
     + cfg.extraConfig
   );
 in {
-  meta.maintainers = [ maintainers.vcunat /* upstream developer */ ];
+  meta.maintainers = [ lib.maintainers.vcunat /* upstream developer */ ];
 
   imports = [
-    (mkChangedOptionModule [ "services" "kresd" "interfaces" ] [ "services" "kresd" "listenPlain" ]
+    (lib.mkChangedOptionModule [ "services" "kresd" "interfaces" ] [ "services" "kresd" "listenPlain" ]
       (config:
-        let value = getAttrFromPath [ "services" "kresd" "interfaces" ] config;
+        let value = lib.getAttrFromPath [ "services" "kresd" "interfaces" ] config;
         in map
-          (iface: if elem ":" (stringToCharacters iface) then "[${iface}]:53" else "${iface}:53") # Syntax depends on being IPv6 or IPv4.
+          (iface: if lib.elem ":" (lib.stringToCharacters iface) then "[${iface}]:53" else "${iface}:53") # Syntax depends on being IPv6 or IPv4.
           value
       )
     )
-    (mkRemovedOptionModule [ "services" "kresd" "cacheDir" ] "Please use (bind-)mounting instead.")
+    (lib.mkRemovedOptionModule [ "services" "kresd" "cacheDir" ] "Please use (bind-)mounting instead.")
   ];
 
   ###### interface
   options.services.kresd = {
-    enable = mkOption {
-      type = types.bool;
+    enable = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''
         Whether to enable knot-resolver domain name server.
@@ -57,18 +54,18 @@ in {
         and give commands interactively to kresd@1.service.
       '';
     };
-    package = mkPackageOption pkgs "knot-resolver" {
+    package = lib.mkPackageOption pkgs "knot-resolver" {
       example = "knot-resolver.override { extraFeatures = true; }";
     };
-    extraConfig = mkOption {
-      type = types.lines;
+    extraConfig = lib.mkOption {
+      type = lib.types.lines;
       default = "";
       description = ''
         Extra lines to be added verbatim to the generated configuration file.
       '';
     };
-    listenPlain = mkOption {
-      type = with types; listOf str;
+    listenPlain = lib.mkOption {
+      type = with lib.types; listOf str;
       default = [ "[::1]:53" "127.0.0.1:53" ];
       example = [ "53" ];
       description = ''
@@ -76,8 +73,8 @@ in {
         For detailed syntax see ListenStream in {manpage}`systemd.socket(5)`.
       '';
     };
-    listenTLS = mkOption {
-      type = with types; listOf str;
+    listenTLS = lib.mkOption {
+      type = with lib.types; listOf str;
       default = [];
       example = [ "198.51.100.1:853" "[2001:db8::1]:853" "853" ];
       description = ''
@@ -85,8 +82,8 @@ in {
         For detailed syntax see ListenStream in {manpage}`systemd.socket(5)`.
       '';
     };
-    listenDoH = mkOption {
-      type = with types; listOf str;
+    listenDoH = lib.mkOption {
+      type = with lib.types; listOf str;
       default = [];
       example = [ "198.51.100.1:443" "[2001:db8::1]:443" "443" ];
       description = ''
@@ -94,8 +91,8 @@ in {
         For detailed syntax see ListenStream in {manpage}`systemd.socket(5)`.
       '';
     };
-    instances = mkOption {
-      type = types.ints.unsigned;
+    instances = lib.mkOption {
+      type = lib.types.ints.unsigned;
       default = 1;
       description = ''
         The number of instances to start.  They will be called kresd@{1,2,...}.service.
@@ -107,10 +104,10 @@ in {
   };
 
   ###### implementation
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     environment.etc."knot-resolver/kresd.conf".source = configFile; # not required
 
-    networking.resolvconf.useLocalResolver = mkDefault true;
+    networking.resolvconf.useLocalResolver = lib.mkDefault true;
 
     users.users.knot-resolver =
       { isSystemUser = true;
@@ -124,7 +121,7 @@ in {
     systemd.targets.kresd = { # configure units started by default
       wantedBy = [ "multi-user.target" ];
       wants = [ "kres-cache-gc.service" ]
-        ++ map (i: "kresd@${toString i}.service") (range 1 cfg.instances);
+        ++ map (i: "kresd@${toString i}.service") (lib.range 1 cfg.instances);
     };
     systemd.services."kresd@".serviceConfig = {
       ExecStart = "${cfg.package}/bin/kresd --noninteractive "
diff --git a/nixos/modules/services/networking/libreswan.nix b/nixos/modules/services/networking/libreswan.nix
index ae71acf089f4..a66ff3065224 100644
--- a/nixos/modules/services/networking/libreswan.nix
+++ b/nixos/modules/services/networking/libreswan.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   cfg = config.services.libreswan;
@@ -11,14 +8,14 @@ let
 
   trim = chars: str:
   let
-    nonchars = filter (x : !(elem x.value chars))
-               (imap0 (i: v: {ind = i; value = v;}) (stringToCharacters str));
+    nonchars = lib.filter (x : !(lib.elem x.value chars))
+               (lib.imap0 (i: v: {ind = i; value = v;}) (lib.stringToCharacters str));
   in
     lib.optionalString (nonchars != [ ])
-      (substring (head nonchars).ind (add 1 (sub (last nonchars).ind (head nonchars).ind)) str);
-  indent = str: concatStrings (concatMap (s: ["  " (trim [" " "\t"] s) "\n"]) (splitString "\n" str));
+      (lib.substring (lib.head nonchars).ind (lib.add 1 (lib.sub (lib.last nonchars).ind (lib.head nonchars).ind)) str);
+  indent = str: lib.concatStrings (lib.concatMap (s: ["  " (trim [" " "\t"] s) "\n"]) (lib.splitString "\n" str));
   configText = indent (toString cfg.configSetup);
-  connectionText = concatStrings (mapAttrsToList (n: v:
+  connectionText = lib.concatStrings (lib.mapAttrsToList (n: v:
     ''
       conn ${n}
       ${indent v}
@@ -32,7 +29,7 @@ let
       ${connectionText}
     '';
 
-  policyFiles = mapAttrs' (name: text:
+  policyFiles = lib.mapAttrs' (name: text:
     { name = "ipsec.d/policies/${name}";
       value.source = pkgs.writeText "ipsec-policy-${name}" text;
     }) cfg.policies;
@@ -47,10 +44,10 @@ in
 
     services.libreswan = {
 
-      enable = mkEnableOption "Libreswan IPsec service";
+      enable = lib.mkEnableOption "Libreswan IPsec service";
 
-      configSetup = mkOption {
-        type = types.lines;
+      configSetup = lib.mkOption {
+        type = lib.types.lines;
         default = ''
             protostack=netkey
             virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v4:100.64.0.0/10,%v6:fd00::/8,%v6:fe80::/10
@@ -63,10 +60,10 @@ in
         description = "Options to go in the 'config setup' section of the Libreswan IPsec configuration";
       };
 
-      connections = mkOption {
-        type = types.attrsOf types.lines;
+      connections = lib.mkOption {
+        type = lib.types.attrsOf lib.types.lines;
         default = {};
-        example = literalExpression ''
+        example = lib.literalExpression ''
           { myconnection = '''
               auto=add
               left=%defaultroute
@@ -82,10 +79,10 @@ in
         description = "A set of connections to define for the Libreswan IPsec service";
       };
 
-      policies = mkOption {
-        type = types.attrsOf types.lines;
+      policies = lib.mkOption {
+        type = lib.types.attrsOf lib.types.lines;
         default = {};
-        example = literalExpression ''
+        example = lib.literalExpression ''
           { private-or-clear = '''
               # Attempt opportunistic IPsec for the entire Internet
               0.0.0.0/0
@@ -102,8 +99,8 @@ in
         '';
       };
 
-      disableRedirects = mkOption {
-        type = types.bool;
+      disableRedirects = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = ''
           Whether to disable send and accept redirects for all network interfaces.
@@ -119,7 +116,7 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     # Install package, systemd units, etc.
     environment.systemPackages = [ pkgs.libreswan pkgs.iproute2 ];
@@ -136,7 +133,7 @@ in
     systemd.services.ipsec = {
       description = "Internet Key Exchange (IKE) Protocol Daemon for IPsec";
       wantedBy = [ "multi-user.target" ];
-      restartTriggers = [ configFile ] ++ mapAttrsToList (n: v: v.source) policyFiles;
+      restartTriggers = [ configFile ] ++ lib.mapAttrsToList (n: v: v.source) policyFiles;
       path = with pkgs; [
         libreswan
         iproute2
@@ -145,7 +142,7 @@ in
         iptables
         nettools
       ];
-      preStart = optionalString cfg.disableRedirects ''
+      preStart = lib.optionalString cfg.disableRedirects ''
         # Disable send/receive redirects
         echo 0 | tee /proc/sys/net/ipv4/conf/*/send_redirects
         echo 0 | tee /proc/sys/net/ipv{4,6}/conf/*/accept_redirects
diff --git a/nixos/modules/services/system/userborn.nix b/nixos/modules/services/system/userborn.nix
new file mode 100644
index 000000000000..d73bd2646c80
--- /dev/null
+++ b/nixos/modules/services/system/userborn.nix
@@ -0,0 +1,183 @@
+{
+  utils,
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+
+  cfg = config.services.userborn;
+  userCfg = config.users;
+
+  userbornConfig = {
+    groups = lib.mapAttrsToList (username: opts: {
+      inherit (opts) name gid members;
+    }) config.users.groups;
+
+    users = lib.mapAttrsToList (username: opts: {
+      inherit (opts)
+        name
+        uid
+        group
+        description
+        home
+        password
+        hashedPassword
+        hashedPasswordFile
+        initialPassword
+        initialHashedPassword
+        ;
+      isNormal = opts.isNormalUser;
+      shell = utils.toShellPath opts.shell;
+    }) config.users.users;
+  };
+
+  userbornConfigJson = pkgs.writeText "userborn.json" (builtins.toJSON userbornConfig);
+
+  immutableEtc = config.system.etc.overlay.enable && !config.system.etc.overlay.mutable;
+  # The filenames created by userborn.
+  passwordFiles = [
+    "group"
+    "passwd"
+    "shadow"
+  ];
+
+in
+{
+
+  options.services.userborn = {
+
+    enable = lib.mkEnableOption "userborn";
+
+    package = lib.mkPackageOption pkgs "userborn" { };
+
+    passwordFilesLocation = lib.mkOption {
+      type = lib.types.str;
+      default = if immutableEtc then "/var/lib/nixos" else "/etc";
+      defaultText = lib.literalExpression ''if immutableEtc then "/var/lib/nixos" else "/etc"'';
+      description = ''
+        The location of the original password files.
+
+        If this is not `/etc`, the files are symlinked from this location to `/etc`.
+
+        The primary motivation for this is an immutable `/etc`, where we cannot
+        write the files directly to `/etc`.
+
+        However this an also serve other use cases, e.g. when `/etc` is on a `tmpfs`.
+      '';
+    };
+
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    assertions = [
+      {
+        assertion = !(config.systemd.sysusers.enable && cfg.enable);
+        message = "You cannot use systemd-sysusers and Userborn at the same time";
+      }
+      {
+        assertion = config.system.activationScripts.users == "";
+        message = "system.activationScripts.users has to be empty to use userborn";
+      }
+      {
+        assertion = immutableEtc -> (cfg.passwordFilesLocation != "/etc");
+        message = "When `system.etc.overlay.mutable = false`, `services.userborn.passwordFilesLocation` cannot be set to `/etc`";
+      }
+    ];
+
+    system.activationScripts.users = lib.mkForce "";
+    system.activationScripts.hashes = lib.mkForce "";
+
+    systemd = {
+
+      # Create home directories, do not create /var/empty even if that's a user's
+      # home.
+      tmpfiles.settings.home-directories = lib.mapAttrs' (
+        username: opts:
+        lib.nameValuePair opts.home {
+          d = {
+            mode = opts.homeMode;
+            user = username;
+            inherit (opts) group;
+          };
+        }
+      ) (lib.filterAttrs (_username: opts: opts.home != "/var/empty") userCfg.users);
+
+      services.userborn = {
+        wantedBy = [ "sysinit.target" ];
+        requiredBy = [ "sysinit-reactivation.target" ];
+        after = [
+          "systemd-remount-fs.service"
+          "systemd-tmpfiles-setup-dev-early.service"
+        ];
+        before = [
+          "systemd-tmpfiles-setup-dev.service"
+          "sysinit.target"
+          "shutdown.target"
+          "sysinit-reactivation.target"
+        ];
+        conflicts = [ "shutdown.target" ];
+        restartTriggers = [
+          userbornConfigJson
+          cfg.passwordFilesLocation
+        ];
+        # This way we don't have to re-declare all the dependencies to other
+        # services again.
+        aliases = [ "systemd-sysusers.service" ];
+
+        unitConfig = {
+          Description = "Manage Users and Groups";
+          DefaultDependencies = false;
+        };
+
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+          TimeoutSec = "90s";
+
+          ExecStart = "${lib.getExe cfg.package} ${userbornConfigJson} ${cfg.passwordFilesLocation}";
+
+          ExecStartPre = lib.mkMerge [
+            (lib.mkIf (!config.system.etc.overlay.mutable) [
+              "${pkgs.coreutils}/bin/mkdir -p ${cfg.passwordFilesLocation}"
+            ])
+
+            # Make the source files writable before executing userborn.
+            (lib.mkIf (!userCfg.mutableUsers) (
+              lib.map (file: "-${pkgs.util-linux}/bin/umount ${cfg.passwordFilesLocation}/${file}") passwordFiles
+            ))
+          ];
+
+          # Make the source files read-only after userborn has finished.
+          ExecStartPost = lib.mkIf (!userCfg.mutableUsers) (
+            lib.map (
+              file:
+              "${pkgs.util-linux}/bin/mount --bind -o ro ${cfg.passwordFilesLocation}/${file} ${cfg.passwordFilesLocation}/${file}"
+            ) passwordFiles
+          );
+        };
+      };
+    };
+
+    # Statically create the symlinks to passwordFilesLocation when they're not
+    # inside /etc because we will not be able to do it at runtime in case of an
+    # immutable /etc!
+    environment.etc = lib.mkIf (cfg.passwordFilesLocation != "/etc") (
+      lib.listToAttrs (
+        lib.map (
+          file:
+          lib.nameValuePair file {
+            source = "${cfg.passwordFilesLocation}/${file}";
+            mode = "direct-symlink";
+          }
+        ) passwordFiles
+      )
+    );
+  };
+
+  meta.maintainers = with lib.maintainers; [ nikstur ];
+
+}
diff --git a/nixos/modules/system/boot/systemd/journald.nix b/nixos/modules/system/boot/systemd/journald.nix
index 180a5cf6c396..1eb958a3c2cd 100644
--- a/nixos/modules/system/boot/systemd/journald.nix
+++ b/nixos/modules/system/boot/systemd/journald.nix
@@ -1,24 +1,21 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.journald;
 in {
   imports = [
-    (mkRenamedOptionModule [ "services" "journald" "enableHttpGateway" ] [ "services" "journald" "gateway" "enable" ])
+    (lib.mkRenamedOptionModule [ "services" "journald" "enableHttpGateway" ] [ "services" "journald" "gateway" "enable" ])
   ];
 
   options = {
-    services.journald.console = mkOption {
+    services.journald.console = lib.mkOption {
       default = "";
-      type = types.str;
+      type = lib.types.str;
       description = "If non-empty, write log messages to the specified TTY device.";
     };
 
-    services.journald.rateLimitInterval = mkOption {
+    services.journald.rateLimitInterval = lib.mkOption {
       default = "30s";
-      type = types.str;
+      type = lib.types.str;
       description = ''
         Configures the rate limiting interval that is applied to all
         messages generated on the system. This rate limiting is applied
@@ -32,18 +29,18 @@ in {
       '';
     };
 
-    services.journald.storage = mkOption {
+    services.journald.storage = lib.mkOption {
       default = "persistent";
-      type = types.enum [ "persistent" "volatile" "auto" "none" ];
+      type = lib.types.enum [ "persistent" "volatile" "auto" "none" ];
       description = ''
         Controls where to store journal data. See
         {manpage}`journald.conf(5)` for further information.
       '';
     };
 
-    services.journald.rateLimitBurst = mkOption {
+    services.journald.rateLimitBurst = lib.mkOption {
       default = 10000;
-      type = types.int;
+      type = lib.types.int;
       description = ''
         Configures the rate limiting burst limit (number of messages per
         interval) that is applied to all messages generated on the system.
@@ -67,9 +64,9 @@ in {
       '';
     };
 
-    services.journald.extraConfig = mkOption {
+    services.journald.extraConfig = lib.mkOption {
       default = "";
-      type = types.lines;
+      type = lib.types.lines;
       example = "Storage=volatile";
       description = ''
         Extra config options for systemd-journald. See {manpage}`journald.conf(5)`
@@ -77,10 +74,10 @@ in {
       '';
     };
 
-    services.journald.forwardToSyslog = mkOption {
+    services.journald.forwardToSyslog = lib.mkOption {
       default = config.services.rsyslogd.enable || config.services.syslog-ng.enable;
-      defaultText = literalExpression "services.rsyslogd.enable || services.syslog-ng.enable";
-      type = types.bool;
+      defaultText = lib.literalExpression "services.rsyslogd.enable || services.syslog-ng.enable";
+      type = lib.types.bool;
       description = ''
         Whether to forward log messages to syslog.
       '';
@@ -97,7 +94,7 @@ in {
       "systemd-journal-flush.service"
       "systemd-journal-catalog-update.service"
       "systemd-journald-sync@.service"
-      ] ++ (optional (!config.boot.isContainer) "systemd-journald-audit.socket") ++ [
+      ] ++ (lib.optional (!config.boot.isContainer) "systemd-journald-audit.socket") ++ [
       "systemd-journald-dev-log.socket"
       "syslog.socket"
       ];
@@ -108,11 +105,11 @@ in {
         Storage=${cfg.storage}
         RateLimitInterval=${cfg.rateLimitInterval}
         RateLimitBurst=${toString cfg.rateLimitBurst}
-        ${optionalString (cfg.console != "") ''
+        ${lib.optionalString (cfg.console != "") ''
           ForwardToConsole=yes
           TTYPath=${cfg.console}
         ''}
-        ${optionalString (cfg.forwardToSyslog) ''
+        ${lib.optionalString (cfg.forwardToSyslog) ''
           ForwardToSyslog=yes
         ''}
         ${cfg.extraConfig}
diff --git a/nixos/modules/system/boot/systemd/logind.nix b/nixos/modules/system/boot/systemd/logind.nix
index ed5369c09ccb..c7a0a375f6ff 100644
--- a/nixos/modules/system/boot/systemd/logind.nix
+++ b/nixos/modules/system/boot/systemd/logind.nix
@@ -1,20 +1,17 @@
 { config, lib, pkgs, utils, ... }:
-
-with lib;
-
 let
   cfg = config.services.logind;
 
-  logindHandlerType = types.enum [
+  logindHandlerType = lib.types.enum [
     "ignore" "poweroff" "reboot" "halt" "kexec" "suspend"
     "hibernate" "hybrid-sleep" "suspend-then-hibernate" "lock"
   ];
 in
 {
   options.services.logind = {
-    extraConfig = mkOption {
+    extraConfig = lib.mkOption {
       default = "";
-      type = types.lines;
+      type = lib.types.lines;
       example = "IdleAction=lock";
       description = ''
         Extra config options for systemd-logind.
@@ -23,9 +20,9 @@ in
       '';
     };
 
-    killUserProcesses = mkOption {
+    killUserProcesses = lib.mkOption {
       default = false;
-      type = types.bool;
+      type = lib.types.bool;
       description = ''
         Specifies whether the processes of a user should be killed
         when the user logs out.  If true, the scope unit corresponding
@@ -39,7 +36,7 @@ in
       '';
     };
 
-    powerKey = mkOption {
+    powerKey = lib.mkOption {
       default = "poweroff";
       example = "ignore";
       type = logindHandlerType;
@@ -49,7 +46,7 @@ in
       '';
     };
 
-    powerKeyLongPress = mkOption {
+    powerKeyLongPress = lib.mkOption {
       default = "ignore";
       example = "reboot";
       type = logindHandlerType;
@@ -59,7 +56,7 @@ in
       '';
     };
 
-    rebootKey = mkOption {
+    rebootKey = lib.mkOption {
       default = "reboot";
       example = "ignore";
       type = logindHandlerType;
@@ -69,7 +66,7 @@ in
       '';
     };
 
-    rebootKeyLongPress = mkOption {
+    rebootKeyLongPress = lib.mkOption {
       default = "poweroff";
       example = "ignore";
       type = logindHandlerType;
@@ -79,7 +76,7 @@ in
       '';
     };
 
-    suspendKey = mkOption {
+    suspendKey = lib.mkOption {
       default = "suspend";
       example = "ignore";
       type = logindHandlerType;
@@ -89,7 +86,7 @@ in
       '';
     };
 
-    suspendKeyLongPress = mkOption {
+    suspendKeyLongPress = lib.mkOption {
       default = "hibernate";
       example = "ignore";
       type = logindHandlerType;
@@ -99,7 +96,7 @@ in
       '';
     };
 
-    hibernateKey = mkOption {
+    hibernateKey = lib.mkOption {
       default = "hibernate";
       example = "ignore";
       type = logindHandlerType;
@@ -109,7 +106,7 @@ in
       '';
     };
 
-    hibernateKeyLongPress = mkOption {
+    hibernateKeyLongPress = lib.mkOption {
       default = "ignore";
       example = "suspend";
       type = logindHandlerType;
@@ -119,7 +116,7 @@ in
       '';
     };
 
-    lidSwitch = mkOption {
+    lidSwitch = lib.mkOption {
       default = "suspend";
       example = "ignore";
       type = logindHandlerType;
@@ -129,9 +126,9 @@ in
       '';
     };
 
-    lidSwitchExternalPower = mkOption {
+    lidSwitchExternalPower = lib.mkOption {
       default = cfg.lidSwitch;
-      defaultText = literalExpression "services.logind.lidSwitch";
+      defaultText = lib.literalExpression "services.logind.lidSwitch";
       example = "ignore";
       type = logindHandlerType;
 
@@ -142,7 +139,7 @@ in
       '';
     };
 
-    lidSwitchDocked = mkOption {
+    lidSwitchDocked = lib.mkOption {
       default = "ignore";
       example = "suspend";
       type = logindHandlerType;
@@ -159,11 +156,11 @@ in
       "systemd-logind.service"
       "autovt@.service"
       "systemd-user-sessions.service"
-    ] ++ optionals config.systemd.package.withImportd [
+    ] ++ lib.optionals config.systemd.package.withImportd [
       "dbus-org.freedesktop.import1.service"
-    ] ++ optionals config.systemd.package.withMachined [
+    ] ++ lib.optionals config.systemd.package.withMachined [
       "dbus-org.freedesktop.machine1.service"
-    ] ++ optionals config.systemd.package.withPortabled [
+    ] ++ lib.optionals config.systemd.package.withPortabled [
       "dbus-org.freedesktop.portable1.service"
     ] ++ [
       "dbus-org.freedesktop.login1.service"
diff --git a/nixos/modules/system/etc/etc-activation.nix b/nixos/modules/system/etc/etc-activation.nix
index ed9f50941771..9b43d76e8746 100644
--- a/nixos/modules/system/etc/etc-activation.nix
+++ b/nixos/modules/system/etc/etc-activation.nix
@@ -19,8 +19,8 @@
           message = "`system.etc.overlay.enable` requires `boot.initrd.systemd.enable`";
         }
         {
-          assertion = (!config.system.etc.overlay.mutable) -> config.systemd.sysusers.enable;
-          message = "`system.etc.overlay.mutable = false` requires `systemd.sysusers.enable`";
+          assertion = (!config.system.etc.overlay.mutable) -> (config.systemd.sysusers.enable || config.services.userborn.enable);
+          message = "`!system.etc.overlay.mutable` requires `systemd.sysusers.enable` or `services.userborn.enable`";
         }
         {
           assertion = lib.versionAtLeast config.boot.kernelPackages.kernel.version "6.6";
diff --git a/nixos/modules/system/etc/etc.nix b/nixos/modules/system/etc/etc.nix
index ae186467ee6b..594b9aab61b7 100644
--- a/nixos/modules/system/etc/etc.nix
+++ b/nixos/modules/system/etc/etc.nix
@@ -1,12 +1,8 @@
 # Management of static files in /etc.
-
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
-  etc' = filter (f: f.enable) (attrValues config.environment.etc);
+  etc' = lib.filter (f: f.enable) (lib.attrValues config.environment.etc);
 
   etc = pkgs.runCommandLocal "etc" {
     # This is needed for the systemd module
@@ -51,7 +47,7 @@ let
     }
 
     mkdir -p "$out/etc"
-    ${concatMapStringsSep "\n" (etcEntry: escapeShellArgs [
+    ${lib.concatMapStringsSep "\n" (etcEntry: lib.escapeShellArgs [
       "makeEtcEntry"
       # Force local source paths to be added to the store
       "${etcEntry.source}"
@@ -62,7 +58,7 @@ let
     ]) etc'}
   '';
 
-  etcHardlinks = filter (f: f.mode != "symlink" && f.mode != "direct-symlink") etc';
+  etcHardlinks = lib.filter (f: f.mode != "symlink" && f.mode != "direct-symlink") etc';
 
 in
 
@@ -75,8 +71,8 @@ in
   options = {
 
     system.etc.overlay = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Mount `/etc` as an overlayfs instead of generating it via a perl script.
@@ -86,8 +82,8 @@ in
         '';
       };
 
-      mutable = mkOption {
-        type = types.bool;
+      mutable = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = ''
           Whether to mount `/etc` mutably (i.e. read-write) or immutably (i.e. read-only).
@@ -98,9 +94,9 @@ in
       };
     };
 
-    environment.etc = mkOption {
+    environment.etc = lib.mkOption {
       default = {};
-      example = literalExpression ''
+      example = lib.literalExpression ''
         { example-configuration-file =
             { source = "/nix/store/.../etc/dir/file.conf.example";
               mode = "0440";
@@ -112,12 +108,12 @@ in
         Set of files that have to be linked in {file}`/etc`.
       '';
 
-      type = with types; attrsOf (submodule (
+      type = with lib.types; attrsOf (submodule (
         { name, config, options, ... }:
         { options = {
 
-            enable = mkOption {
-              type = types.bool;
+            enable = lib.mkOption {
+              type = lib.types.bool;
               default = true;
               description = ''
                 Whether this /etc file should be generated.  This
@@ -125,8 +121,8 @@ in
               '';
             };
 
-            target = mkOption {
-              type = types.str;
+            target = lib.mkOption {
+              type = lib.types.str;
               description = ''
                 Name of symlink (relative to
                 {file}`/etc`).  Defaults to the attribute
@@ -134,19 +130,19 @@ in
               '';
             };
 
-            text = mkOption {
+            text = lib.mkOption {
               default = null;
-              type = types.nullOr types.lines;
+              type = lib.types.nullOr lib.types.lines;
               description = "Text of the file.";
             };
 
-            source = mkOption {
-              type = types.path;
+            source = lib.mkOption {
+              type = lib.types.path;
               description = "Path of the source file.";
             };
 
-            mode = mkOption {
-              type = types.str;
+            mode = lib.mkOption {
+              type = lib.types.str;
               default = "symlink";
               example = "0600";
               description = ''
@@ -156,27 +152,27 @@ in
               '';
             };
 
-            uid = mkOption {
+            uid = lib.mkOption {
               default = 0;
-              type = types.int;
+              type = lib.types.int;
               description = ''
                 UID of created file. Only takes effect when the file is
                 copied (that is, the mode is not 'symlink').
                 '';
             };
 
-            gid = mkOption {
+            gid = lib.mkOption {
               default = 0;
-              type = types.int;
+              type = lib.types.int;
               description = ''
                 GID of created file. Only takes effect when the file is
                 copied (that is, the mode is not 'symlink').
               '';
             };
 
-            user = mkOption {
+            user = lib.mkOption {
               default = "+${toString config.uid}";
-              type = types.str;
+              type = lib.types.str;
               description = ''
                 User name of created file.
                 Only takes effect when the file is copied (that is, the mode is not 'symlink').
@@ -184,9 +180,9 @@ in
               '';
             };
 
-            group = mkOption {
+            group = lib.mkOption {
               default = "+${toString config.gid}";
-              type = types.str;
+              type = lib.types.str;
               description = ''
                 Group name of created file.
                 Only takes effect when the file is copied (that is, the mode is not 'symlink').
@@ -197,10 +193,10 @@ in
           };
 
           config = {
-            target = mkDefault name;
-            source = mkIf (config.text != null) (
+            target = lib.mkDefault name;
+            source = lib.mkIf (config.text != null) (
               let name' = "etc-" + lib.replaceStrings ["/"] ["-"] name;
-              in mkDerivedConfig options.text (pkgs.writeText name')
+              in lib.mkDerivedConfig options.text (pkgs.writeText name')
             );
           };
 
@@ -299,7 +295,7 @@ in
       }
 
       mkdir -p "$out"
-      ${concatMapStringsSep "\n" (etcEntry: escapeShellArgs [
+      ${lib.concatMapStringsSep "\n" (etcEntry: lib.escapeShellArgs [
         "makeEtcEntry"
         # Force local source paths to be added to the store
         "${etcEntry.source}"
diff --git a/nixos/modules/tasks/auto-upgrade.nix b/nixos/modules/tasks/auto-upgrade.nix
index f5747dda55f4..32a52041e57a 100644
--- a/nixos/modules/tasks/auto-upgrade.nix
+++ b/nixos/modules/tasks/auto-upgrade.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let cfg = config.system.autoUpgrade;
 
 in {
@@ -10,8 +7,8 @@ in {
 
     system.autoUpgrade = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to periodically upgrade NixOS to the latest
@@ -21,8 +18,8 @@ in {
         '';
       };
 
-      operation = mkOption {
-        type = types.enum ["switch" "boot"];
+      operation = lib.mkOption {
+        type = lib.types.enum ["switch" "boot"];
         default = "switch";
         example = "boot";
         description = ''
@@ -32,8 +29,8 @@ in {
         '';
       };
 
-      flake = mkOption {
-        type = types.nullOr types.str;
+      flake = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         example = "github:kloenk/nix";
         description = ''
@@ -42,8 +39,8 @@ in {
         '';
       };
 
-      channel = mkOption {
-        type = types.nullOr types.str;
+      channel = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         example = "https://nixos.org/channels/nixos-14.12-small";
         description = ''
@@ -54,8 +51,8 @@ in {
         '';
       };
 
-      flags = mkOption {
-        type = types.listOf types.str;
+      flags = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [ ];
         example = [
           "-I"
@@ -73,8 +70,8 @@ in {
         '';
       };
 
-      dates = mkOption {
-        type = types.str;
+      dates = lib.mkOption {
+        type = lib.types.str;
         default = "04:40";
         example = "daily";
         description = ''
@@ -86,9 +83,9 @@ in {
         '';
       };
 
-      allowReboot = mkOption {
+      allowReboot = lib.mkOption {
         default = false;
-        type = types.bool;
+        type = lib.types.bool;
         description = ''
           Reboot the system into the new generation instead of a switch
           if the new generation uses a different kernel, kernel modules
@@ -97,9 +94,9 @@ in {
         '';
       };
 
-      randomizedDelaySec = mkOption {
+      randomizedDelaySec = lib.mkOption {
         default = "0";
-        type = types.str;
+        type = lib.types.str;
         example = "45min";
         description = ''
           Add a randomized delay before each automatic upgrade.
@@ -109,9 +106,9 @@ in {
         '';
       };
 
-      fixedRandomDelay = mkOption {
+      fixedRandomDelay = lib.mkOption {
         default = false;
-        type = types.bool;
+        type = lib.types.bool;
         example = true;
         description = ''
           Make the randomized delay consistent between runs.
@@ -120,7 +117,7 @@ in {
         '';
       };
 
-      rebootWindow = mkOption {
+      rebootWindow = lib.mkOption {
         description = ''
           Define a lower and upper time value (in HH:MM format) which
           constitute a time window during which reboots are allowed after an upgrade.
@@ -129,26 +126,26 @@ in {
         '';
         default = null;
         example = { lower = "01:00"; upper = "05:00"; };
-        type = with types; nullOr (submodule {
+        type = with lib.types; nullOr (submodule {
           options = {
-            lower = mkOption {
+            lower = lib.mkOption {
               description = "Lower limit of the reboot window";
-              type = types.strMatching "[[:digit:]]{2}:[[:digit:]]{2}";
+              type = lib.types.strMatching "[[:digit:]]{2}:[[:digit:]]{2}";
               example = "01:00";
             };
 
-            upper = mkOption {
+            upper = lib.mkOption {
               description = "Upper limit of the reboot window";
-              type = types.strMatching "[[:digit:]]{2}:[[:digit:]]{2}";
+              type = lib.types.strMatching "[[:digit:]]{2}:[[:digit:]]{2}";
               example = "05:00";
             };
           };
         });
       };
 
-      persistent = mkOption {
+      persistent = lib.mkOption {
         default = true;
-        type = types.bool;
+        type = lib.types.bool;
         example = false;
         description = ''
           Takes a boolean argument. If true, the time when the service
@@ -176,7 +173,7 @@ in {
     }];
 
     system.autoUpgrade.flags = (if cfg.flake == null then
-        [ "--no-build-output" ] ++ optionals (cfg.channel != null) [
+        [ "--no-build-output" ] ++ lib.optionals (cfg.channel != null) [
           "-I"
           "nixpkgs=${cfg.channel}/nixexprs.tar.xz"
         ]
@@ -211,13 +208,13 @@ in {
         date     = "${pkgs.coreutils}/bin/date";
         readlink = "${pkgs.coreutils}/bin/readlink";
         shutdown = "${config.systemd.package}/bin/shutdown";
-        upgradeFlag = optional (cfg.channel == null) "--upgrade";
+        upgradeFlag = lib.optional (cfg.channel == null) "--upgrade";
       in if cfg.allowReboot then ''
         ${nixos-rebuild} boot ${toString (cfg.flags ++ upgradeFlag)}
         booted="$(${readlink} /run/booted-system/{initrd,kernel,kernel-modules})"
         built="$(${readlink} /nix/var/nix/profiles/system/{initrd,kernel,kernel-modules})"
 
-        ${optionalString (cfg.rebootWindow != null) ''
+        ${lib.optionalString (cfg.rebootWindow != null) ''
           current_time="$(${date} +%H:%M)"
 
           lower="${cfg.rebootWindow.lower}"
@@ -244,7 +241,7 @@ in {
 
         if [ "''${booted}" = "''${built}" ]; then
           ${nixos-rebuild} ${cfg.operation} ${toString cfg.flags}
-        ${optionalString (cfg.rebootWindow != null) ''
+        ${lib.optionalString (cfg.rebootWindow != null) ''
           elif [ "''${do_reboot}" != true ]; then
             echo "Outside of configured reboot window, skipping."
         ''}
@@ -271,4 +268,3 @@ in {
   };
 
 }
-
diff --git a/nixos/modules/tasks/filesystems.nix b/nixos/modules/tasks/filesystems.nix
index cd0ba98ef968..5c95cd3d451e 100644
--- a/nixos/modules/tasks/filesystems.nix
+++ b/nixos/modules/tasks/filesystems.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, utils, ... }:
+{ config, lib, pkgs, utils, ... }@moduleArgs:
 
 with lib;
 with utils;
@@ -136,10 +136,21 @@ let
 
     };
 
-    config.options = mkMerge [
+    config.options = let
+      inInitrd = utils.fsNeededForBoot config;
+    in mkMerge [
       (mkIf config.autoResize [ "x-systemd.growfs" ])
       (mkIf config.autoFormat [ "x-systemd.makefs" ])
       (mkIf (utils.fsNeededForBoot config) [ "x-initrd.mount" ])
+      (mkIf
+        # With scripted stage 1, depends is implemented by sorting 'config.system.build.fileSystems'
+        (lib.length config.depends > 0 && (inInitrd -> moduleArgs.config.boot.initrd.systemd.enable))
+        (
+          map (
+            x: "x-systemd.requires-mounts-for=${optionalString inInitrd "/sysroot"}${x}"
+          ) config.depends
+        )
+      )
     ];
 
   };
diff --git a/nixos/modules/tasks/filesystems/overlayfs.nix b/nixos/modules/tasks/filesystems/overlayfs.nix
index 2d876c92a1fd..3f1f0bc15b63 100644
--- a/nixos/modules/tasks/filesystems/overlayfs.nix
+++ b/nixos/modules/tasks/filesystems/overlayfs.nix
@@ -82,6 +82,10 @@ let
     config = lib.mkIf (config.overlay.lowerdir != null) {
       fsType = "overlay";
       device = lib.mkDefault "overlay";
+      depends = map (x: "${x}") (config.overlay.lowerdir ++ lib.optionals (config.overlay.upperdir != null) [
+        config.overlay.upperdir
+        config.overlay.workdir
+      ]);
 
       options =
         let
@@ -96,7 +100,7 @@ let
         ] ++ lib.optionals (config.overlay.upperdir != null) [
           "upperdir=${upperdir}"
           "workdir=${workdir}"
-        ] ++ (map (s: "x-systemd.requires-mounts-for=${s}") lowerdir);
+        ];
     };
 
   };
@@ -123,18 +127,29 @@ in
 
       boot.initrd.availableKernelModules = lib.mkIf (initrdFileSystems != { }) [ "overlay" ];
 
-      assertions = lib.concatLists (lib.mapAttrsToList
-        (_name: fs: [
-          {
-            assertion = (fs.overlay.upperdir == null) == (fs.overlay.workdir == null);
-            message = "You cannot define a `lowerdir` without a `workdir` and vice versa for mount point: ${fs.mountPoint}";
-          }
-          {
-            assertion = (fs.overlay.lowerdir != null && fs.overlay.upperdir == null) -> (lib.length fs.overlay.lowerdir) >= 2;
-            message = "A read-only overlay (without an `upperdir`) requires at least 2 `lowerdir`s: ${fs.mountPoint}";
-          }
-        ])
-        config.fileSystems);
+      assertions =
+        lib.concatLists (
+          lib.mapAttrsToList (_name: fs: [
+            {
+              assertion = (fs.overlay.upperdir == null) == (fs.overlay.workdir == null);
+              message = "You cannot define a `lowerdir` without a `workdir` and vice versa for mount point: ${fs.mountPoint}";
+            }
+            {
+              assertion =
+                (fs.overlay.lowerdir != null && fs.overlay.upperdir == null)
+                -> (lib.length fs.overlay.lowerdir) >= 2;
+              message = "A read-only overlay (without an `upperdir`) requires at least 2 `lowerdir`s: ${fs.mountPoint}";
+            }
+          ]) overlayFileSystems
+        )
+        ++ lib.mapAttrsToList (_: fs: {
+          assertion = fs.overlay.upperdir == null -> config.boot.initrd.systemd.enable;
+          message = ''
+            Stage 1 overlay file system ${fs.mountPoint} has no upperdir,
+            which is not supported with scripted initrd. Please enable
+            'boot.initrd.systemd.enable'.
+          '';
+        }) initrdFileSystems;
 
       boot.initrd.systemd.services = lib.mkMerge (lib.mapAttrsToList preMountService initrdFileSystems);
       systemd.services = lib.mkMerge (lib.mapAttrsToList preMountService userspaceFileSystems);
diff --git a/nixos/modules/virtualisation/azure-agent.nix b/nixos/modules/virtualisation/azure-agent.nix
index 5b3b7080ea68..8903bf0985a2 100644
--- a/nixos/modules/virtualisation/azure-agent.nix
+++ b/nixos/modules/virtualisation/azure-agent.nix
@@ -11,7 +11,6 @@ let
   '';
 
 in
-
 {
 
   ###### interface
@@ -35,13 +34,9 @@ in
 
   config = lib.mkIf cfg.enable {
     assertions = [{
-      assertion = pkgs.stdenv.hostPlatform.isx86;
-      message = "Azure not currently supported on ${pkgs.stdenv.hostPlatform.system}";
-    }
-      {
-        assertion = config.networking.networkmanager.enable == false;
-        message = "Windows Azure Linux Agent is not compatible with NetworkManager";
-      }];
+      assertion = config.networking.networkmanager.enable == false;
+      message = "Windows Azure Linux Agent is not compatible with NetworkManager";
+    }];
 
     boot.initrd.kernelModules = [ "ata_piix" ];
     networking.firewall.allowedUDPPorts = [ 68 ];
diff --git a/nixos/modules/virtualisation/azure-common.nix b/nixos/modules/virtualisation/azure-common.nix
index cd1ffdb6cbcc..d8d835dd303d 100644
--- a/nixos/modules/virtualisation/azure-common.nix
+++ b/nixos/modules/virtualisation/azure-common.nix
@@ -1,67 +1,85 @@
-{ lib, pkgs, ... }:
+{ config, lib, pkgs, ... }:
 
 with lib;
+let
+  cfg = config.virtualisation.azure;
+  mlxDrivers = [ "mlx4_en" "mlx4_core" "mlx5_core" ];
+in
 {
-  imports = [ ../profiles/headless.nix ];
-
-  require = [ ./azure-agent.nix ];
-  virtualisation.azure.agent.enable = true;
-
-  boot.kernelParams = [ "console=ttyS0" "earlyprintk=ttyS0" "rootdelay=300" "panic=1" "boot.panic_on_fail" ];
-  boot.initrd.kernelModules = [ "hv_vmbus" "hv_netvsc" "hv_utils" "hv_storvsc" ];
-
-  # Generate a GRUB menu.
-  boot.loader.grub.device = "/dev/sda";
-  boot.loader.timeout = 0;
-
-  boot.growPartition = true;
-
-  # Don't put old configurations in the GRUB menu.  The user has no
-  # way to select them anyway.
-  boot.loader.grub.configurationLimit = 0;
-
-  fileSystems."/" = {
-    device = "/dev/disk/by-label/nixos";
-    fsType = "ext4";
-    autoResize = true;
+  options.virtualisation.azure = {
+    acceleratedNetworking = mkOption {
+      default = false;
+      description = "Whether the machine's network interface has enabled accelerated networking.";
+    };
   };
 
-  # Allow root logins only using the SSH key that the user specified
-  # at instance creation time, ping client connections to avoid timeouts
-  services.openssh.enable = true;
-  services.openssh.settings.PermitRootLogin = "prohibit-password";
-  services.openssh.settings.ClientAliveInterval = 180;
+  imports = [
+    ../profiles/headless.nix
+    ./azure-agent.nix
+  ];
 
-  # Force getting the hostname from Azure
-  networking.hostName = mkDefault "";
+  config = {
+    virtualisation.azure.agent.enable = true;
 
-  # Always include cryptsetup so that NixOps can use it.
-  # sg_scan is needed to finalize disk removal on older kernels
-  environment.systemPackages = [ pkgs.cryptsetup pkgs.sg3_utils ];
+    boot.kernelParams = [ "console=ttyS0" "earlyprintk=ttyS0" "rootdelay=300" "panic=1" "boot.panic_on_fail" ];
+    boot.initrd.kernelModules = [ "hv_vmbus" "hv_netvsc" "hv_utils" "hv_storvsc" ];
+    boot.initrd.availableKernelModules = lib.optionals cfg.acceleratedNetworking mlxDrivers;
 
-  networking.usePredictableInterfaceNames = false;
+    # Accelerated networking
+    systemd.network.networks."99-azure-unmanaged-devices.network" = lib.mkIf cfg.acceleratedNetworking {
+      matchConfig.Driver = mlxDrivers;
+      linkConfig.Unmanaged = "yes";
+    };
+    networking.networkmanager.unmanaged = lib.mkIf cfg.acceleratedNetworking
+      (builtins.map (drv: "driver:${drv}") mlxDrivers);
 
-  services.udev.extraRules = ''
-    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:0", ATTR{removable}=="0", SYMLINK+="disk/by-lun/0",
-    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:1", ATTR{removable}=="0", SYMLINK+="disk/by-lun/1",
-    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:2", ATTR{removable}=="0", SYMLINK+="disk/by-lun/2"
-    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:3", ATTR{removable}=="0", SYMLINK+="disk/by-lun/3"
+    # Generate a GRUB menu.
+    boot.loader.grub.device = "/dev/sda";
 
-    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:4", ATTR{removable}=="0", SYMLINK+="disk/by-lun/4"
-    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:5", ATTR{removable}=="0", SYMLINK+="disk/by-lun/5"
-    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:6", ATTR{removable}=="0", SYMLINK+="disk/by-lun/6"
-    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:7", ATTR{removable}=="0", SYMLINK+="disk/by-lun/7"
+    boot.growPartition = true;
 
-    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:8", ATTR{removable}=="0", SYMLINK+="disk/by-lun/8"
-    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:9", ATTR{removable}=="0", SYMLINK+="disk/by-lun/9"
-    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:10", ATTR{removable}=="0", SYMLINK+="disk/by-lun/10"
-    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:11", ATTR{removable}=="0", SYMLINK+="disk/by-lun/11"
+    fileSystems."/" = {
+      device = "/dev/disk/by-label/nixos";
+      fsType = "ext4";
+      autoResize = true;
+    };
 
-    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:12", ATTR{removable}=="0", SYMLINK+="disk/by-lun/12"
-    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:13", ATTR{removable}=="0", SYMLINK+="disk/by-lun/13"
-    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:14", ATTR{removable}=="0", SYMLINK+="disk/by-lun/14"
-    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:15", ATTR{removable}=="0", SYMLINK+="disk/by-lun/15"
+    # Allow root logins only using the SSH key that the user specified
+    # at instance creation time, ping client connections to avoid timeouts
+    services.openssh.enable = true;
+    services.openssh.settings.PermitRootLogin = "prohibit-password";
+    services.openssh.settings.ClientAliveInterval = 180;
 
-  '';
+    # Force getting the hostname from Azure
+    networking.hostName = mkDefault "";
 
+    # Always include cryptsetup so that NixOps can use it.
+    # sg_scan is needed to finalize disk removal on older kernels
+    environment.systemPackages = [ pkgs.cryptsetup pkgs.sg3_utils ];
+
+    networking.usePredictableInterfaceNames = false;
+
+    services.udev.extraRules = ''
+      ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:0", ATTR{removable}=="0", SYMLINK+="disk/by-lun/0",
+      ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:1", ATTR{removable}=="0", SYMLINK+="disk/by-lun/1",
+      ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:2", ATTR{removable}=="0", SYMLINK+="disk/by-lun/2"
+      ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:3", ATTR{removable}=="0", SYMLINK+="disk/by-lun/3"
+
+      ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:4", ATTR{removable}=="0", SYMLINK+="disk/by-lun/4"
+      ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:5", ATTR{removable}=="0", SYMLINK+="disk/by-lun/5"
+      ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:6", ATTR{removable}=="0", SYMLINK+="disk/by-lun/6"
+      ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:7", ATTR{removable}=="0", SYMLINK+="disk/by-lun/7"
+
+      ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:8", ATTR{removable}=="0", SYMLINK+="disk/by-lun/8"
+      ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:9", ATTR{removable}=="0", SYMLINK+="disk/by-lun/9"
+      ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:10", ATTR{removable}=="0", SYMLINK+="disk/by-lun/10"
+      ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:11", ATTR{removable}=="0", SYMLINK+="disk/by-lun/11"
+
+      ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:12", ATTR{removable}=="0", SYMLINK+="disk/by-lun/12"
+      ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:13", ATTR{removable}=="0", SYMLINK+="disk/by-lun/13"
+      ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:14", ATTR{removable}=="0", SYMLINK+="disk/by-lun/14"
+      ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:15", ATTR{removable}=="0", SYMLINK+="disk/by-lun/15"
+
+    '';
+  };
 }
diff --git a/nixos/modules/virtualisation/azure-image.nix b/nixos/modules/virtualisation/azure-image.nix
index 98678346a8fd..ecb57483cce9 100644
--- a/nixos/modules/virtualisation/azure-image.nix
+++ b/nixos/modules/virtualisation/azure-image.nix
@@ -7,8 +7,8 @@ in
 {
   imports = [ ./azure-common.nix ];
 
-  options = {
-    virtualisation.azureImage.diskSize = mkOption {
+  options.virtualisation.azureImage = {
+    diskSize = mkOption {
       type = with types; either (enum [ "auto" ]) int;
       default = "auto";
       example = 2048;
@@ -16,14 +16,34 @@ in
         Size of disk image. Unit is MB.
       '';
     };
-    virtualisation.azureImage.contents = mkOption {
+
+    bootSize = mkOption {
+      type = types.int;
+      default = 256;
+      description = ''
+        ESP partition size. Unit is MB.
+        Only effective when vmGeneration is `v2`.
+      '';
+    };
+
+    contents = mkOption {
       type = with types; listOf attrs;
       default = [ ];
       description = ''
         Extra contents to add to the image.
       '';
     };
+
+    vmGeneration = mkOption {
+      type = with types; enum [ "v1" "v2" ];
+      default = "v1";
+      description = ''
+        VM Generation to use.
+        For v2, secure boot needs to be turned off during creation.
+      '';
+    };
   };
+
   config = {
     system.build.azureImage = import ../../lib/make-disk-image.nix {
       name = "azure-image";
@@ -33,9 +53,12 @@ in
       '';
       configFile = ./azure-config-user.nix;
       format = "raw";
+
+      bootSize = "${toString cfg.bootSize}M";
+      partitionTableType = if cfg.vmGeneration == "v2" then "efi" else "legacy";
+
       inherit (cfg) diskSize contents;
       inherit config lib pkgs;
     };
-
   };
 }
diff --git a/nixos/modules/virtualisation/vmware-image.nix b/nixos/modules/virtualisation/vmware-image.nix
index 4a9064c9b8a3..47b7c212bcd1 100644
--- a/nixos/modules/virtualisation/vmware-image.nix
+++ b/nixos/modules/virtualisation/vmware-image.nix
@@ -1,7 +1,4 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   boolToStr = value: if value then "on" else "off";
   cfg = config.vmware;
@@ -17,35 +14,35 @@ let
 in {
   options = {
     vmware = {
-      baseImageSize = mkOption {
-        type = with types; either (enum [ "auto" ]) int;
+      baseImageSize = lib.mkOption {
+        type = with lib.types; either (enum [ "auto" ]) int;
         default = "auto";
         example = 2048;
         description = ''
           The size of the VMWare base image in MiB.
         '';
       };
-      vmDerivationName = mkOption {
-        type = types.str;
+      vmDerivationName = lib.mkOption {
+        type = lib.types.str;
         default = "nixos-vmware-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}";
         description = ''
           The name of the derivation for the VMWare appliance.
         '';
       };
-      vmFileName = mkOption {
-        type = types.str;
+      vmFileName = lib.mkOption {
+        type = lib.types.str;
         default = "nixos-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}.vmdk";
         description = ''
           The file name of the VMWare appliance.
         '';
       };
-      vmSubformat = mkOption {
-        type = types.enum subformats;
+      vmSubformat = lib.mkOption {
+        type = lib.types.enum subformats;
         default = "monolithicSparse";
         description = "Specifies which VMDK subformat to use.";
       };
-      vmCompat6 = mkOption {
-        type = types.bool;
+      vmCompat6 = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         example = true;
         description = "Create a VMDK version 6 image (instead of version 4).";
diff --git a/nixos/modules/virtualisation/xe-guest-utilities.nix b/nixos/modules/virtualisation/xe-guest-utilities.nix
index 25ccbaebc077..9bc68c0a3d7d 100644
--- a/nixos/modules/virtualisation/xe-guest-utilities.nix
+++ b/nixos/modules/virtualisation/xe-guest-utilities.nix
@@ -1,14 +1,13 @@
 { config, lib, pkgs, ... }:
-with lib;
 let
   cfg = config.services.xe-guest-utilities;
 in {
   options = {
     services.xe-guest-utilities = {
-      enable = mkEnableOption "the Xen guest utilities daemon";
+      enable = lib.mkEnableOption "the Xen guest utilities daemon";
     };
   };
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     services.udev.packages = [ pkgs.xe-guest-utilities ];
     systemd.tmpfiles.rules = [ "d /run/xenstored 0755 - - -" ];
 
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 155232b378b4..72e76651371c 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1060,6 +1060,11 @@ in {
   uptime-kuma = handleTest ./uptime-kuma.nix {};
   urn-timer = handleTest ./urn-timer.nix {};
   usbguard = handleTest ./usbguard.nix {};
+  userborn = runTest ./userborn.nix;
+  userborn-mutable-users = runTest ./userborn-mutable-users.nix;
+  userborn-immutable-users = runTest ./userborn-immutable-users.nix;
+  userborn-mutable-etc = runTest ./userborn-mutable-etc.nix;
+  userborn-immutable-etc = runTest ./userborn-immutable-etc.nix;
   user-activation-scripts = handleTest ./user-activation-scripts.nix {};
   user-expiry = runTest ./user-expiry.nix;
   user-home-mode = handleTest ./user-home-mode.nix {};
diff --git a/nixos/tests/audiobookshelf.nix b/nixos/tests/audiobookshelf.nix
index 64bd415160ee..ccd830eb28da 100644
--- a/nixos/tests/audiobookshelf.nix
+++ b/nixos/tests/audiobookshelf.nix
@@ -1,10 +1,7 @@
 import ./make-test-python.nix ({ lib, ... }:
-
-with lib;
-
 {
   name = "audiobookshelf";
-  meta.maintainers = with maintainers; [ wietsedv ];
+  meta.maintainers = with lib.maintainers; [ wietsedv ];
 
   nodes.machine =
     { pkgs, ... }:
diff --git a/nixos/tests/filesystems-overlayfs.nix b/nixos/tests/filesystems-overlayfs.nix
index d7cbf640abe4..faac9078a520 100644
--- a/nixos/tests/filesystems-overlayfs.nix
+++ b/nixos/tests/filesystems-overlayfs.nix
@@ -26,7 +26,6 @@ in
 
   nodes.machine = { config, pkgs, ... }: {
     boot.initrd.systemd.enable = true;
-    boot.initrd.availableKernelModules = [ "overlay" ];
 
     virtualisation.fileSystems = {
       "/initrd-overlay" = {
diff --git a/nixos/tests/userborn-immutable-etc.nix b/nixos/tests/userborn-immutable-etc.nix
new file mode 100644
index 000000000000..e95fba23063b
--- /dev/null
+++ b/nixos/tests/userborn-immutable-etc.nix
@@ -0,0 +1,70 @@
+{ lib, ... }:
+
+let
+  normaloHashedPassword = "$y$j9T$IEWqhKtWg.r.8fVkSEF56.$iKNxdMC6hOAQRp6eBtYvBk4c7BGpONXeZMqc8I/LM46";
+
+  common = {
+    services.userborn.enable = true;
+    boot.initrd.systemd.enable = true;
+    system.etc.overlay = {
+      enable = true;
+      mutable = false;
+    };
+  };
+in
+
+{
+
+  name = "userborn-immutable-etc";
+
+  meta.maintainers = with lib.maintainers; [ nikstur ];
+
+  nodes.machine =
+    { config, ... }:
+    {
+      imports = [ common ];
+
+      users = {
+        users = {
+          normalo = {
+            isNormalUser = true;
+            hashedPassword = normaloHashedPassword;
+          };
+        };
+      };
+
+      specialisation.new-generation = {
+        inheritParentConfig = false;
+        configuration = {
+          nixpkgs = {
+            inherit (config.nixpkgs) hostPlatform;
+          };
+          imports = [ common ];
+
+          users.users = {
+            new-normalo = {
+              isNormalUser = true;
+            };
+          };
+        };
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("userborn.service")
+
+    with subtest("normalo user is created"):
+      assert "${normaloHashedPassword}" in machine.succeed("getent shadow normalo"), "normalo user password is not correct"
+
+
+    machine.succeed("/run/current-system/specialisation/new-generation/bin/switch-to-configuration switch")
+
+
+    with subtest("normalo user is disabled"):
+      print(machine.succeed("getent shadow normalo"))
+      assert "!*" in machine.succeed("getent shadow normalo"), "normalo user is not disabled"
+
+    with subtest("new-normalo user is created after switching to new generation"):
+      print(machine.succeed("getent passwd new-normalo"))
+  '';
+}
diff --git a/nixos/tests/userborn-immutable-users.nix b/nixos/tests/userborn-immutable-users.nix
new file mode 100644
index 000000000000..887d2d312eb7
--- /dev/null
+++ b/nixos/tests/userborn-immutable-users.nix
@@ -0,0 +1,75 @@
+{ lib, ... }:
+
+let
+  normaloHashedPassword = "$y$j9T$IEWqhKtWg.r.8fVkSEF56.$iKNxdMC6hOAQRp6eBtYvBk4c7BGpONXeZMqc8I/LM46";
+
+  common = {
+    services.userborn.enable = true;
+    users.mutableUsers = false;
+  };
+in
+
+{
+
+  name = "userborn-immutable-users";
+
+  meta.maintainers = with lib.maintainers; [ nikstur ];
+
+  nodes.machine =
+    { config, ... }:
+    {
+      imports = [ common ];
+
+      users = {
+        users = {
+          normalo = {
+            isNormalUser = true;
+            hashedPassword = normaloHashedPassword;
+          };
+        };
+      };
+
+      specialisation.new-generation = {
+        inheritParentConfig = false;
+        configuration = {
+          nixpkgs = {
+            inherit (config.nixpkgs) hostPlatform;
+          };
+          imports = [ common ];
+
+          users.users = {
+            new-normalo = {
+              isNormalUser = true;
+            };
+          };
+        };
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("userborn.service")
+
+    with subtest("normalo user is created"):
+      assert "${normaloHashedPassword}" in machine.succeed("getent shadow normalo"), "normalo user password is not correct"
+
+    with subtest("Fail to add new user manually"):
+      machine.fail("useradd manual-normalo")
+
+    with subtest("Fail to add delete user manually"):
+      machine.fail("userdel normalo")
+
+
+    machine.succeed("/run/current-system/specialisation/new-generation/bin/switch-to-configuration switch")
+
+
+    with subtest("normalo user is disabled"):
+      print(machine.succeed("getent shadow normalo"))
+      assert "!*" in machine.succeed("getent shadow normalo"), "normalo user is not disabled"
+
+    with subtest("new-normalo user is created after switching to new generation"):
+      print(machine.succeed("getent passwd new-normalo"))
+
+    with subtest("Still fail to add new user manually"):
+      machine.fail("useradd again-normalo")
+  '';
+}
diff --git a/nixos/tests/userborn-mutable-etc.nix b/nixos/tests/userborn-mutable-etc.nix
new file mode 100644
index 000000000000..6199b84ce71d
--- /dev/null
+++ b/nixos/tests/userborn-mutable-etc.nix
@@ -0,0 +1,70 @@
+{ lib, ... }:
+
+let
+  normaloHashedPassword = "$y$j9T$IEWqhKtWg.r.8fVkSEF56.$iKNxdMC6hOAQRp6eBtYvBk4c7BGpONXeZMqc8I/LM46";
+
+  common = {
+    services.userborn.enable = true;
+    boot.initrd.systemd.enable = true;
+    system.etc.overlay = {
+      enable = true;
+      mutable = true;
+    };
+  };
+in
+
+{
+
+  name = "userborn-mutable-etc";
+
+  meta.maintainers = with lib.maintainers; [ nikstur ];
+
+  nodes.machine =
+    { config, ... }:
+    {
+      imports = [ common ];
+
+      users = {
+        users = {
+          normalo = {
+            isNormalUser = true;
+            hashedPassword = normaloHashedPassword;
+          };
+        };
+      };
+
+      specialisation.new-generation = {
+        inheritParentConfig = false;
+        configuration = {
+          nixpkgs = {
+            inherit (config.nixpkgs) hostPlatform;
+          };
+          imports = [ common ];
+
+          users.users = {
+            new-normalo = {
+              isNormalUser = true;
+            };
+          };
+        };
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("userborn.service")
+
+    with subtest("normalo user is created"):
+      assert "${normaloHashedPassword}" in machine.succeed("getent shadow normalo"), "normalo user password is not correct"
+
+
+    machine.succeed("/run/current-system/specialisation/new-generation/bin/switch-to-configuration switch")
+
+
+    with subtest("normalo user is disabled"):
+      print(machine.succeed("getent shadow normalo"))
+      assert "!*" in machine.succeed("getent shadow normalo"), "normalo user is not disabled"
+
+    with subtest("new-normalo user is created after switching to new generation"):
+      print(machine.succeed("getent passwd new-normalo"))
+  '';
+}
diff --git a/nixos/tests/userborn-mutable-users.nix b/nixos/tests/userborn-mutable-users.nix
new file mode 100644
index 000000000000..e2b9c3df4953
--- /dev/null
+++ b/nixos/tests/userborn-mutable-users.nix
@@ -0,0 +1,76 @@
+{ lib, ... }:
+
+let
+  normaloHashedPassword = "$y$j9T$IEWqhKtWg.r.8fVkSEF56.$iKNxdMC6hOAQRp6eBtYvBk4c7BGpONXeZMqc8I/LM46";
+
+  common = {
+    services.userborn.enable = true;
+    users.mutableUsers = true;
+  };
+in
+
+{
+
+  name = "userborn-mutable-users";
+
+  meta.maintainers = with lib.maintainers; [ nikstur ];
+
+  nodes.machine =
+    { config, ... }:
+    {
+      imports = [ common ];
+
+      users = {
+        mutableUsers = true;
+        users = {
+          normalo = {
+            isNormalUser = true;
+            hashedPassword = normaloHashedPassword;
+          };
+        };
+      };
+
+      specialisation.new-generation = {
+        inheritParentConfig = false;
+        configuration = {
+          nixpkgs = {
+            inherit (config.nixpkgs) hostPlatform;
+          };
+          imports = [ common ];
+
+          users.users = {
+            new-normalo = {
+              isNormalUser = true;
+            };
+          };
+        };
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("userborn.service")
+
+    with subtest("normalo user is created"):
+      assert 1000 == int(machine.succeed("id --user normalo")), "normalo user doesn't have UID 1000"
+      assert "${normaloHashedPassword}" in machine.succeed("getent shadow normalo"), "normalo user password is not correct"
+
+    with subtest("Add new user manually"):
+      machine.succeed("useradd manual-normalo")
+      assert 1001 == int(machine.succeed("id --user manual-normalo")), "manual-normalo user doesn't have UID 1001"
+
+    with subtest("Delete manual--normalo user manually"):
+      machine.succeed("userdel manual-normalo")
+
+
+    machine.succeed("/run/current-system/specialisation/new-generation/bin/switch-to-configuration switch")
+
+
+    with subtest("normalo user is disabled"):
+      print(machine.succeed("getent shadow normalo"))
+      assert "!*" in machine.succeed("getent shadow normalo"), "normalo user is not disabled"
+
+    with subtest("new-normalo user is created after switching to new generation"):
+      print(machine.succeed("getent passwd new-normalo"))
+      assert 1001 == int(machine.succeed("id --user new-normalo")), "new-normalo user doesn't have UID 1001"
+  '';
+}
diff --git a/nixos/tests/userborn.nix b/nixos/tests/userborn.nix
new file mode 100644
index 000000000000..c89880a14a5c
--- /dev/null
+++ b/nixos/tests/userborn.nix
@@ -0,0 +1,127 @@
+{ lib, ... }:
+
+let
+  # All passwords are "test"
+  rootHashedPasswordFile = "$y$j9T$6ueoTO5y7vvFsGvpQJEEa.$vubxgBiMnkTCtRtPD3hNiZHa7Nm1WsJeE9QomYqSRXB";
+  updatedRootHashedPassword = "$y$j9T$pBCO9N1FRF1rSl6V15n9n/$1JmRLEYPO7TRCx43cvLO19u59WA/oqTEhmSR4wrhzr.";
+
+  normaloPassword = "test";
+  updatedNormaloHashedPassword = "$y$j9T$IEWqhKtWg.r.8fVkSEF56.$iKNxdMC6hOAQRp6eBtYvBk4c7BGpONXeZMqc8I/LM46";
+
+  sysuserInitialHashedPassword = "$y$j9T$Kb6jGrk41hudTZpNjazf11$iw7fZXrewC6JxRaGPz7/gPXDZ.Z1VWsupvy81Hi1XiD";
+  updatedSysuserInitialHashedPassword = "$y$j9T$kUBVhgOdSjymSfwfRVja70$eqCwWzVsz0fI0Uc6JsdD2CYMCpfJcErqnIqva2JCi1D";
+
+  newNormaloHashedPassword = "$y$j9T$UFBMWbGjjVola0YE9YCcV/$jRSi5S6lzkcifbuqjMcyXLTwgOGm9BTQk/G/jYaxroC";
+in
+
+{
+
+  name = "userborn";
+
+  meta.maintainers = with lib.maintainers; [ nikstur ];
+
+  nodes.machine = {
+    services.userborn.enable = true;
+
+    # Read this password file at runtime from outside the Nix store.
+    environment.etc."rootpw.secret".text = rootHashedPasswordFile;
+
+    users = {
+      users = {
+        root = {
+          # Override the empty root password set by the test instrumentation.
+          hashedPasswordFile = lib.mkForce "/etc/rootpw.secret";
+        };
+        normalo = {
+          isNormalUser = true;
+          password = normaloPassword;
+        };
+        sysuser = {
+          isSystemUser = true;
+          group = "sysusers";
+          initialHashedPassword = sysuserInitialHashedPassword;
+        };
+      };
+      groups = {
+        sysusers = { };
+      };
+    };
+
+    specialisation.new-generation.configuration = {
+      users = {
+        users = {
+          root = {
+            # Forcing this to null simulates removing the config value in a new
+            # generation.
+            hashedPasswordFile = lib.mkOverride 9 null;
+            hashedPassword = updatedRootHashedPassword;
+          };
+          normalo = {
+            hashedPassword = updatedNormaloHashedPassword;
+          };
+          sysuser = {
+            initialHashedPassword = lib.mkForce updatedSysuserInitialHashedPassword;
+          };
+          new-normalo = {
+            isNormalUser = true;
+            hashedPassword = newNormaloHashedPassword;
+          };
+        };
+        groups = {
+          new-group = { };
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("userborn.service")
+
+    with subtest("Correct mode on the password files"):
+      assert machine.succeed("stat -c '%a' /etc/passwd") == "644\n"
+      assert machine.succeed("stat -c '%a' /etc/group") == "644\n"
+      assert machine.succeed("stat -c '%a' /etc/shadow") == "0\n"
+
+    with subtest("root user has correct password"):
+      print(machine.succeed("getent passwd root"))
+      assert "${rootHashedPasswordFile}" in machine.succeed("getent shadow root"), "root user password is not correct"
+
+    with subtest("normalo user is created"):
+      print(machine.succeed("getent passwd normalo"))
+      assert 1000 <= int(machine.succeed("id --user normalo")), "normalo user doesn't have a normal UID"
+      assert machine.succeed("stat -c '%U' /home/normalo") == "normalo\n"
+
+    with subtest("system user is created with correct password"):
+      print(machine.succeed("getent passwd sysuser"))
+      assert 1000 > int(machine.succeed("id --user sysuser")), "sysuser user doesn't have a system UID"
+      assert "${sysuserInitialHashedPassword}" in machine.succeed("getent shadow sysuser"), "system user password is not correct"
+
+    with subtest("sysusers group is created"):
+      print(machine.succeed("getent group sysusers"))
+
+
+    machine.succeed("/run/current-system/specialisation/new-generation/bin/switch-to-configuration switch")
+
+
+    with subtest("root user password is updated"):
+      print(machine.succeed("getent passwd root"))
+      assert "${updatedRootHashedPassword}" in machine.succeed("getent shadow root"), "root user password is not updated"
+
+    with subtest("normalo user password is updated"):
+      print(machine.succeed("getent passwd normalo"))
+      assert "${updatedNormaloHashedPassword}" in machine.succeed("getent shadow normalo"), "normalo user password is not updated"
+
+    with subtest("system user password is NOT updated"):
+      print(machine.succeed("getent passwd sysuser"))
+      assert "${sysuserInitialHashedPassword}" in machine.succeed("getent shadow sysuser"), "sysuser user password is not updated"
+
+    with subtest("new-normalo user is created after switching to new generation"):
+      print(machine.succeed("getent passwd new-normalo"))
+      assert 1000 <= int(machine.succeed("id --user new-normalo")), "new-normalo user doesn't have a normal UID"
+      assert machine.succeed("stat -c '%U' /home/new-normalo") == "new-normalo\n"
+      assert "${newNormaloHashedPassword}" in machine.succeed("getent shadow new-normalo"), "new-normalo user password is not correct"
+
+    with subtest("new-group group is created after switching to new generation"):
+      print(machine.succeed("getent group new-group"))
+  '';
+}
diff --git a/pkgs/applications/audio/tauon/default.nix b/pkgs/applications/audio/tauon/default.nix
index b134aa4b43d1..b7e954abc4df 100644
--- a/pkgs/applications/audio/tauon/default.nix
+++ b/pkgs/applications/audio/tauon/default.nix
@@ -19,21 +19,22 @@
   mpg123,
   opusfile,
   pango,
+  pipewire,
   wavpack,
   ffmpeg,
   pulseaudio,
-  withDiscordRPC ? false,
+  withDiscordRPC ? true,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tauon";
-  version = "7.8.0";
+  version = "7.8.2";
 
   src = fetchFromGitHub {
     owner = "Taiko2k";
-    repo = "TauonMusicBox";
+    repo = "Tauon";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-8UnUcEvG206tPwyD+WqxcJgDvQlYvTJ6v+sm0u30Z3k=";
+    hash = "sha256-fVp3RWRNIBSeALbYNRIYjyWNH9An+YnS7neQt0x33yI=";
   };
 
   postUnpack = ''
@@ -54,15 +55,16 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail 'libopenmpt.so' '${lib.getLib libopenmpt}/lib/libopenmpt.so'
 
     substituteInPlace t_modules/t_phazor.py \
-      --replace-fail 'lib/libphazor.so' '../../lib/libphazor.so'
+      --replace-fail 'lib/libphazor' '../../lib/libphazor'
 
-    substituteInPlace compile-phazor.sh --replace-fail 'gcc' '${stdenv.cc.targetPrefix}cc'
+    substituteInPlace compile-phazor*.sh --replace-fail 'gcc' '${stdenv.cc.targetPrefix}cc'
 
     substituteInPlace extra/tauonmb.desktop --replace-fail 'Exec=/opt/tauon-music-box/tauonmb.sh' 'Exec=${placeholder "out"}/bin/tauon'
   '';
 
   postBuild = ''
     bash ./compile-phazor.sh
+    bash ./compile-phazor-pipewire.sh
   '';
 
   nativeBuildInputs = [
@@ -84,6 +86,7 @@ stdenv.mkDerivation (finalAttrs: {
     mpg123
     opusfile
     pango
+    pipewire
     wavpack
   ];
 
@@ -92,7 +95,7 @@ stdenv.mkDerivation (finalAttrs: {
     [
       beautifulsoup4
       dbus-python
-      isounidecode
+      unidecode
       jxlpy
       musicbrainzngs
       mutagen
diff --git a/pkgs/applications/blockchains/btcpayserver/default.nix b/pkgs/applications/blockchains/btcpayserver/default.nix
index 15d033573601..3d97da4895cb 100644
--- a/pkgs/applications/blockchains/btcpayserver/default.nix
+++ b/pkgs/applications/blockchains/btcpayserver/default.nix
@@ -6,13 +6,13 @@
 
 buildDotnetModule rec {
   pname = "btcpayserver";
-  version = "1.13.1";
+  version = "1.13.5";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-p0GNwwbhsgChlSlPVD/RHhzWF/1URdYp/iYQmJxORU8=";
+    sha256 = "sha256-xga/v+4keZSgayPzitchzV4IRdui1IBPYB/uNVVMIaM=";
   };
 
   projectFile = "BTCPayServer/BTCPayServer.csproj";
diff --git a/pkgs/applications/blockchains/btcpayserver/deps.nix b/pkgs/applications/blockchains/btcpayserver/deps.nix
index 2ae9af5a0887..f61f2e02a649 100644
--- a/pkgs/applications/blockchains/btcpayserver/deps.nix
+++ b/pkgs/applications/blockchains/btcpayserver/deps.nix
@@ -2,375 +2,382 @@
 # Please dont edit it manually, your changes might get overwritten!
 
 { fetchNuGet }: [
-  (fetchNuGet { pname = "AngleSharp"; version = "0.17.1"; sha256 = "038idg33ydy72362qplsd7y8ldifi9zg02dhjli6wy4p47hyqcph"; })
-  (fetchNuGet { pname = "AngleSharp.Css"; version = "0.17.0"; sha256 = "0q5vfj4l24kz1djigl0fva0dv64j2f90x3g1db59vbiz8vvfjz5i"; })
-  (fetchNuGet { pname = "AWSSDK.Core"; version = "3.3.104.14"; sha256 = "157694kb63z1szbsv861515fvjv7amrjrfmgbm3idpyw31afk650"; })
-  (fetchNuGet { pname = "AWSSDK.S3"; version = "3.3.110.10"; sha256 = "1lf1hfbx792dpa1hxgn0a0jrrvldd16hgbxx229dk2qcz5qlnc38"; })
-  (fetchNuGet { pname = "BIP78.Sender"; version = "0.2.2"; sha256 = "12pm2s35c0qzc06099q2z1pxwq94rq85n74yz8fs8gwvm2ksgp4p"; })
-  (fetchNuGet { pname = "BTCPayServer.Hwi"; version = "2.0.2"; sha256 = "0lh3n1qncqs4kbrmx65xs271f0d9c7irrs9qnsa9q51cbbqbljh9"; })
-  (fetchNuGet { pname = "BTCPayServer.Lightning.All"; version = "1.6.0"; sha256 = "0xcqf7jz5rsi6nawcjfdbbdjlnqbx8xfzw8sn3a9ks8xjqv37krn"; })
-  (fetchNuGet { pname = "BTCPayServer.Lightning.Charge"; version = "1.5.1"; sha256 = "1sb6qhm15d6qqyx9v5g7csvp8phhs6k2py5wmfmbpnjydaydf76g"; })
-  (fetchNuGet { pname = "BTCPayServer.Lightning.CLightning"; version = "1.6.0"; sha256 = "1bsmic9i1p2ya5hv1mscv46fxh6ibczfj1srylzwcpgs0mypy5y3"; })
-  (fetchNuGet { pname = "BTCPayServer.Lightning.Common"; version = "1.3.21"; sha256 = "042xwfsxd30zgwiz0w14ynb755w5sldkplxgw1fkw68lrz66x5s4"; })
-  (fetchNuGet { pname = "BTCPayServer.Lightning.Common"; version = "1.5.1"; sha256 = "1jy5k0nd2b10p3gyv8qm3nb31chkpcssrb9sjw2dqbac757nv154"; })
-  (fetchNuGet { pname = "BTCPayServer.Lightning.Eclair"; version = "1.5.2"; sha256 = "1wmj66my2cg9dbz4bf8vrkxpkpl4wfqaxxzqxgs830vdk8h7pp50"; })
-  (fetchNuGet { pname = "BTCPayServer.Lightning.LNBank"; version = "1.5.2"; sha256 = "0g2jv712lb3arlpf6j8p0ccq62gz1bjipb9ndzhdk7mwhaznkrwl"; })
-  (fetchNuGet { pname = "BTCPayServer.Lightning.LND"; version = "1.5.4"; sha256 = "0jqxy60msq9rl04lmqyiz9f02mjywypfh3apr9vcbyv2q47maxnd"; })
-  (fetchNuGet { pname = "BTCPayServer.Lightning.LNDhub"; version = "1.5.2"; sha256 = "09i663w6i93675bxrq5x6l26kr60mafwfr6ny92xrppj8rmd2lzx"; })
-  (fetchNuGet { pname = "BTCPayServer.NETCore.Plugins"; version = "1.4.4"; sha256 = "0rk0prmb0539ji5fd33cqy3yvw51i5i8m5hb43admr5z8960dd6l"; })
-  (fetchNuGet { pname = "BTCPayServer.NETCore.Plugins.Mvc"; version = "1.4.4"; sha256 = "1kmmj5m7s41wc1akpqw1b1j7pp4c0vn6sqxb487980ibpj6hyisl"; })
-  (fetchNuGet { pname = "BTCPayServer.NTag424"; version = "1.0.22"; sha256 = "1gy81kqd745p2sak7yj5phn25k8blwwjzi39s5ikpwyqg3b0arsw"; })
-  (fetchNuGet { pname = "CsvHelper"; version = "15.0.5"; sha256 = "01y8bhsnxghn3flz0pr11vj6wjrpmia8rpdrsp7kjfc1zmhqlgma"; })
-  (fetchNuGet { pname = "Dapper"; version = "2.1.28"; sha256 = "15vpa9k11rr1mh5vb6hdchy8hqa03lqs83w19s3kxzh1089yl9m8"; })
-  (fetchNuGet { pname = "DigitalRuby.ExchangeSharp"; version = "1.0.4"; sha256 = "1hkdls4wjrxq6df1zq9saa6hn5hynalq3gxb486w59j7i9f3g7d8"; })
-  (fetchNuGet { pname = "Fido2"; version = "2.0.2"; sha256 = "1wqlk48apm7h637da7sav0r1a8yz2yy2gxhifpvydjqk1n3qybz4"; })
-  (fetchNuGet { pname = "Fido2.AspNet"; version = "2.0.2"; sha256 = "0x2k1wyd0p7cy4ir15m2bxiggckl98znc65b4vq75ckjyd6dm1a1"; })
-  (fetchNuGet { pname = "Fido2.Models"; version = "2.0.2"; sha256 = "1vk4h9sv2dhdr0jvh2a7yk6v9rhxk9y8hxz4mkal8vd9psajz5cg"; })
-  (fetchNuGet { pname = "Google.Api.Gax"; version = "2.5.0"; sha256 = "0q6pi53px998i3gdndla8v0zqdpyi9gnsy9mdcfpkrg09vfbdsl9"; })
-  (fetchNuGet { pname = "Google.Api.Gax.Rest"; version = "2.5.0"; sha256 = "1zkjl5zh6qwdz4qmnxnk5877pas638i2qi25znilhqqf3mrkp0rp"; })
-  (fetchNuGet { pname = "Google.Apis"; version = "1.35.1"; sha256 = "1022l8m7v9f3rkjc9l11mkzwsbmqx9sk5f4aym035vn9hdr16d49"; })
-  (fetchNuGet { pname = "Google.Apis"; version = "1.38.0"; sha256 = "01j3d1lv106cqw9n0lwgclrxghy852fsibv6av4xr03ivrkm8g40"; })
-  (fetchNuGet { pname = "Google.Apis.Auth"; version = "1.35.1"; sha256 = "1qdnd1nq9bfgyljmiww91pfi0iz1n29rz2dlizhxcijqya2ldha3"; })
-  (fetchNuGet { pname = "Google.Apis.Auth"; version = "1.38.0"; sha256 = "0x3bdwiyqjxw5df99bfasmsv09kb47wzisag938631cijl0g277y"; })
-  (fetchNuGet { pname = "Google.Apis.Core"; version = "1.35.1"; sha256 = "01dfw2kxknlc5pm7x1q88lv9j979509lkkgvlffjry5bawsxsja4"; })
-  (fetchNuGet { pname = "Google.Apis.Core"; version = "1.38.0"; sha256 = "012gslhnx65vqfyzjnqx4bqk9kb8bwbx966q2f9fdgrfcn26gj9j"; })
-  (fetchNuGet { pname = "Google.Apis.Storage.v1"; version = "1.38.0.1470"; sha256 = "0mfrz7fmpfbjvp4zfpjasmnfbgxgxrrjkf8xgp9p6h9g8qh2f2h2"; })
-  (fetchNuGet { pname = "Google.Cloud.Storage.V1"; version = "2.3.0"; sha256 = "01jhrd6m6md8m28chzg2dkdfd4yris79j1xi7r1ydm1cfjhmlj64"; })
-  (fetchNuGet { pname = "HtmlSanitizer"; version = "8.0.838"; sha256 = "1k05ld36872lzbhlby9m1vf9y7chlijbflbk2pzcni57b9rp2qrg"; })
-  (fetchNuGet { pname = "Humanizer.Core"; version = "2.14.1"; sha256 = "1ai7hgr0qwd7xlqfd92immddyi41j3ag91h3594yzfsgsy6yhyqi"; })
-  (fetchNuGet { pname = "libsodium"; version = "1.0.18"; sha256 = "15qzl5k31yaaapqlijr336lh4lzz1qqxlimgxy8fdyig8jdmgszn"; })
-  (fetchNuGet { pname = "LNURL"; version = "0.0.34"; sha256 = "1sbkqsln7wq5fsbw63wdha8kqwxgd95j0iblv4kxa1shyg3c5d9x"; })
-  (fetchNuGet { pname = "MailKit"; version = "3.3.0"; sha256 = "18l0jkrc4d553kiw4vdjzzpafpvsgjs1n19kjbi8isnhzidmsl4j"; })
-  (fetchNuGet { pname = "Microsoft.AspNet.SignalR.Client"; version = "2.4.3"; sha256 = "1whxcmxydcxjkw84sqk5idd406v3ia0xj2m4ia4b6wqbvkdqn7rf"; })
-  (fetchNuGet { pname = "Microsoft.AspNet.WebApi.Client"; version = "5.2.9"; sha256 = "1sy1q36bm9fz3gi780w4jgysw3dwaz2f3a5gcn6jxw1gkmdasb08"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.Connections.Abstractions"; version = "8.0.0"; sha256 = "0whzyzmsk5lylvdz30kchiwkpc495n837hn41165idj8b2f0p4c9"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.Cryptography.Internal"; version = "8.0.1"; sha256 = "1gc2y4v1cvayy2fai02gsv1z6fr58kxb5jnmbjqxnd0zf49m88j7"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.Cryptography.KeyDerivation"; version = "8.0.1"; sha256 = "0fnvim0rmiw9jm8xvajb5b9w4wawp95szy2dfh2aw1n8jgzs207x"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.Http.Connections.Client"; version = "8.0.0"; sha256 = "1bkkwayfg78cbgj1bqklz60hm1h19rzh1r439b4jhd5b56m2krqv"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.Http.Connections.Common"; version = "8.0.0"; sha256 = "1r0lqw6pq2m3636ym1qmh3n12qi2x80fjanpq831mjdmyl2p5agb"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.Identity.EntityFrameworkCore"; version = "8.0.1"; sha256 = "08pnswpz17pfr923p9iv6imgzb8yfhsi4g31lxrhzglagahv4hiy"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.JsonPatch"; version = "8.0.1"; sha256 = "1jgkjna579pw5fx1pjbz0dc2lil9i3djf9c8lkb4vxrzrwmrdw31"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.Mvc.NewtonsoftJson"; version = "8.0.1"; sha256 = "05pfp1kq24aqc56dbx2i2s71rbypc1czidhd6nvah0r3pn91rfny"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.Mvc.Razor.Extensions"; version = "6.0.0"; sha256 = "1l26il73lrr48afwksd05qlaa9h7v14kydrvfcz2iczdh2r7id2f"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation"; version = "8.0.1"; sha256 = "0lqybwazpnivi7nq59yphizsq33wpz52s0n9iipvdg9lhhjns8xf"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.Razor.Language"; version = "6.0.0"; sha256 = "0lssd2j44m0ybwmm1yphyncnh4jy5pg404767rzi8m5y06hdsiiz"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.SignalR.Client"; version = "8.0.0"; sha256 = "0mziqda492663w6k2v28v9fzwpzis2g81vck3d17rnzc872pkmnp"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.SignalR.Client.Core"; version = "8.0.0"; sha256 = "11273dhmdmrpkcc6hv448nvnr8lq9c3wj4bh55nijir7w0l70m7k"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.SignalR.Common"; version = "8.0.0"; sha256 = "0k4zlb3p57208zmmndlw2j1q160wawc93ixlbfwkqihnm1hcig6y"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.SignalR.Protocols.Json"; version = "8.0.0"; sha256 = "1va843rls7iffygjw9xijs15shd4jprhaa3b8ixgym52n2k12pxl"; })
-  (fetchNuGet { pname = "Microsoft.Bcl.AsyncInterfaces"; version = "6.0.0"; sha256 = "15gqy2m14fdlvy1g59207h5kisznm355kbw010gy19vh47z8gpz3"; })
-  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Analyzers"; version = "3.3.2"; sha256 = "162vb5894zxps0cf5n9gc08an7gwybzz87allx3lsszvllr9ldx4"; })
-  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Analyzers"; version = "3.3.3"; sha256 = "09m4cpry8ivm9ga1abrxmvw16sslxhy2k5sl14zckhqb1j164im6"; })
-  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Analyzers"; version = "3.3.4"; sha256 = "0wd6v57p53ahz5z9zg4iyzmy3src7rlsncyqpcag02jjj1yx6g58"; })
-  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Common"; version = "4.0.0"; sha256 = "1rwnz5zy7ia9312n2qzzar95x9p7iiw57cql7ssdwv255xl1ix29"; })
-  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Common"; version = "4.5.0"; sha256 = "0hjzca7v3qq4wqzi9chgxzycbaysnjgj28ps20695x61sia6i3da"; })
-  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Common"; version = "4.8.0"; sha256 = "0gmbxn91h4r23fhzpl1dh56cpva4sg2h659kdbdazayrajfj50fw"; })
-  (fetchNuGet { pname = "Microsoft.CodeAnalysis.CSharp"; version = "4.0.0"; sha256 = "1mzxjy7xp8r9x25xyspq89ngsz0hmkbp0l0h3v1jv2rcrw63wqb4"; })
-  (fetchNuGet { pname = "Microsoft.CodeAnalysis.CSharp"; version = "4.5.0"; sha256 = "1l6v0ii5lapmfnfpjwi3j5bwlx8v9nvyani5pwvqzdfqsd5m7mp5"; })
-  (fetchNuGet { pname = "Microsoft.CodeAnalysis.CSharp"; version = "4.8.0"; sha256 = "0idaksbib90zgi8xlycmdzk77dlxichspp23wpnfrzfxkdfafqrj"; })
-  (fetchNuGet { pname = "Microsoft.CodeAnalysis.CSharp.Workspaces"; version = "4.5.0"; sha256 = "0skg5a8i4fq6cndxcjwciai808p0zpqz9kbvck94mcywfzassv1a"; })
-  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Razor"; version = "6.0.0"; sha256 = "183jyvimyacynn6gc9b5r7l2d8q5gfbzkdl6hqfywsskxyjwqpwg"; })
-  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Workspaces.Common"; version = "4.5.0"; sha256 = "1wjwsrnn5frahqciwaxsgalv80fs6xhqy6kcqy7hcsh7jrfc1kjq"; })
-  (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.5.0"; sha256 = "01i28nvzccxbqmiz217fxs6hnjwmd5fafs37rd49a6qp53y6623l"; })
-  (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.7.0"; sha256 = "0gd67zlw554j098kabg887b5a6pq9kzavpa3jjy5w53ccjzjfy8j"; })
-  (fetchNuGet { pname = "Microsoft.Data.Sqlite.Core"; version = "8.0.1"; sha256 = "1ippysjxq97vz4kd0jxiqbcamgd9xxb6n23ias5d4c7gbiwayz0z"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore"; version = "8.0.1"; sha256 = "1k1c63vkzr020q0pb6xxf29xlgxldnzhlqpmpq9fig85y73s84ds"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Abstractions"; version = "8.0.0"; sha256 = "019r991228nxv1fibsxg5z81rr7ydgy77c9v7yvlx35kfppxq4s3"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Abstractions"; version = "8.0.1"; sha256 = "1p8c2xfz8kgzswh9kq38mmy8qxfynnkywj9vwx15azbi8wcmh24x"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Analyzers"; version = "8.0.1"; sha256 = "0l0fi9kiinj021sfk85qds1rdzavpkl24sjyzfyb8q8jmj5l2i0n"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Design"; version = "8.0.1"; sha256 = "1y21lmbnq271q7q1vsq1z5gnz4fy89zca8qzm6bg2qfv8bgqqrny"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Relational"; version = "8.0.0"; sha256 = "0ngsxk717si11g4a01ah2np8gp8b3k09y23229anr9jrhykr1bw1"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Relational"; version = "8.0.1"; sha256 = "12zmg196mpd0wacwyrckv6l5rl76dzmvr588i437xiwp0iyjcsh9"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Sqlite"; version = "8.0.1"; sha256 = "1igwxjmzgzkzyhmg5jbis6hynnzf5vfzl00h053si89h5m6vvhmb"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Sqlite.Core"; version = "8.0.1"; sha256 = "0zg7whf02jlpcs72ngiydwd2xwwlvz3nja0xnyxv4k4w56qs8qcj"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Caching.Abstractions"; version = "2.2.0"; sha256 = "0hhxc5dp52faha1bdqw0k426zicsv6x1kfqi30m9agr0b2hixj52"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Caching.Abstractions"; version = "8.0.0"; sha256 = "04m6ywsf9731z24nfd14z0ah8xl06619ba7mkdb4vg8h5jpllsn4"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Caching.Memory"; version = "8.0.0"; sha256 = "0bv8ihd5i2gwr97qljwf56h8mdwspmlw0zs64qyk608fb3ciwi25"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Configuration"; version = "3.1.5"; sha256 = "1i7zm8ghgxwp655anyfm910qm7rcpvrz48fxjyzw9w63hj4sv6bk"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Configuration"; version = "6.0.0"; sha256 = "1zdyai2rzngmsp3706d12qrdk315c1s3ja218fzb3nc3wd1vz0s8"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Abstractions"; version = "3.1.5"; sha256 = "03jwqjrfyx11ax19bq84c28qzaiyj4whrx7vayy4hr7sv0p28h8k"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Abstractions"; version = "6.0.0"; sha256 = "0w6wwxv12nbc3sghvr68847wc9skkdgsicrz3fx4chgng1i3xy0j"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Abstractions"; version = "8.0.0"; sha256 = "1jlpa4ggl1gr5fs7fdcw04li3y3iy05w3klr9lrrlc7v8w76kq71"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Binder"; version = "3.1.5"; sha256 = "0310pvrwbbqak7k4s32syryqxlkwli8w8bwlpnqmz42svh2302wv"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Binder"; version = "8.0.0"; sha256 = "1m0gawiz8f5hc3li9vd5psddlygwgkiw13d7div87kmkf4idza8r"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.EnvironmentVariables"; version = "6.0.0"; sha256 = "19w2vxliz1xangbach3hkx72x2pxqhc9n9c3kc3l8mhicl8w6vdl"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.FileExtensions"; version = "6.0.0"; sha256 = "02nna984iwnyyz4jjh9vs405nlj0yk1g5vz4v2x30z2c89mx5f9w"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Ini"; version = "6.0.0"; sha256 = "18qg1f7yvgvrgsq40cgc1yvpb9av84ma80k3grhvwn1cyam2img6"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.DependencyInjection"; version = "8.0.0"; sha256 = "0i7qziz0iqmbk8zzln7kx9vd0lbx1x3va0yi3j1bgkjir13h78ps"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.DependencyInjection.Abstractions"; version = "3.1.5"; sha256 = "1wkf8ajh4pj6g3wwd18g3hjc3lqqny8052rl373ddcardxrs2gvn"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.DependencyInjection.Abstractions"; version = "8.0.0"; sha256 = "1zw0bpp5742jzx03wvqc8csnvsbgdqi0ls9jfc5i2vd3cl8b74pg"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.DependencyModel"; version = "8.0.0"; sha256 = "02jnx23hm1vid3yd9pw4gghzn6qkgdl5xfc5r0zrcxdax70rsh5a"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Diagnostics.Abstractions"; version = "8.0.0"; sha256 = "15m4j6w9n8h0mj7hlfzb83hd3wn7aq1s7fxbicm16slsjfwzj82i"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Features"; version = "8.0.0"; sha256 = "0v8xp320jki9vsrm1gd4k3bhafa3q9c3bf3wc5z59bnx56d06cly"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.FileProviders.Abstractions"; version = "6.0.0"; sha256 = "1fbqmfapxdz77drcv1ndyj2ybvd2rv4c9i9pgiykcpl4fa6dc65q"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.FileProviders.Abstractions"; version = "8.0.0"; sha256 = "1idq65fxwcn882c06yci7nscy9i0rgw6mqjrl7362prvvsd9f15r"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.FileProviders.Physical"; version = "6.0.0"; sha256 = "1ikc3kf325xig6njbi2aj5kmww4xlaq9lsrpc8v764fsm4x10474"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.FileSystemGlobbing"; version = "6.0.0"; sha256 = "09gyyv4fwy9ys84z3aq4lm9y09b7bd1d4l4gfdinmg0z9678f1a4"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Hosting.Abstractions"; version = "8.0.0"; sha256 = "00d5dwmzw76iy8z40ly01hy9gly49a7rpf7k7m99vrid1kxp346h"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Identity.Core"; version = "8.0.1"; sha256 = "0gf68x3zxbn3gxzdjmbfcqhm58ybxvpanl4pq8vs5g492qw7h24b"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Identity.Stores"; version = "8.0.1"; sha256 = "19c0by2r85jqz6pj8mnr047aasasr7fbzi3ih04gchj8la69ka5h"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Logging"; version = "8.0.0"; sha256 = "0nppj34nmq25gnrg0wh1q22y4wdqbih4ax493f226azv8mkp9s1i"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Logging.Abstractions"; version = "1.0.0"; sha256 = "1sh9bidmhy32gkz6fkli79mxv06546ybrzppfw5v2aq0bda1ghka"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Logging.Abstractions"; version = "3.1.5"; sha256 = "0lr22hlf52csrna9ly2lbz3y1agfgdlg7rvsqjg7ik488dhkmhji"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Logging.Abstractions"; version = "6.0.0"; sha256 = "0b75fmins171zi6bfdcq1kcvyrirs8n91mknjnxy4c3ygi1rrnj0"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Logging.Abstractions"; version = "7.0.1"; sha256 = "0xv3sqc1lbx5j4yy6g2w3kakzvrpwqs2ihax6lqasj5sz5map6fk"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Logging.Abstractions"; version = "8.0.0"; sha256 = "1klcqhg3hk55hb6vmjiq2wgqidsl81aldw0li2z98lrwx26msrr6"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "3.1.5"; sha256 = "0rhqyqa7vhlmz2g0250zhypaayvckx4dv89micdg521cpvr5arpr"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "8.0.0"; sha256 = "0p50qn6zhinzyhq9sy5svnmqqwhw2jajs2pbjh9sah504wjvhscz"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "8.0.1"; sha256 = "01jsya858i861x6d7qbl3wlr0gp2y7x2m4q6f1r743w360z8zgpn"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Options.ConfigurationExtensions"; version = "3.1.5"; sha256 = "10w78fj2jpmghvprz6b046xcr68zzp6x550a7m1iivn0h7a3l7pi"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.PlatformAbstractions"; version = "1.1.0"; sha256 = "0r4j8v2vvp3kalvb11ny9cvpls3nrvqj0c81rxbkh99ynd2dbscp"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "2.2.0"; sha256 = "0znah6arbcqari49ymigg3wiy2hgdifz8zsq8vdc3ynnf45r7h0c"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "3.1.5"; sha256 = "0n2pk1sy8ikd29282sx4ps9r1wnhzgg4nwmkka9ypjizd8lkkk2m"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "6.0.0"; sha256 = "1kjiw6s4yfz9gm7mx3wkhp06ghnbs95icj9hi505shz9rjrg42q2"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "8.0.0"; sha256 = "0aldaz5aapngchgdr7dax9jw5wy7k7hmjgjpfgfv1wfif27jlkqm"; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.JsonWebTokens"; version = "6.6.0"; sha256 = "06z5a1jpqpdd1pix85is7kkpn4v0l4an909skji2p8gm09p5sfyv"; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Logging"; version = "6.6.0"; sha256 = "1mpkx544cbxws1a22zwxbp3lqqamcc3x915l23spsxqvgr02jjrq"; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Tokens"; version = "6.6.0"; sha256 = "0h5vbsd5x9cf7nqyrwn7d7y1axhf1zz0jr9prvi4xpxawa3kajyj"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.0.1"; sha256 = "01al6cfxp68dscl15z7rxfw9zvhm64dncsw09a1vmdkacsa2v6lr"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.1.0"; sha256 = "08vh1r12g6ykjygq5d3vq09zylgb84l63k49jc4v8faw9g93iqqm"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "2.1.2"; sha256 = "1507hnpr9my3z4w1r6xk5n0s1j3y6a2c2cnynj76za7cphxi1141"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.0.1"; sha256 = "0ppdkwy6s9p7x9jix3v4402wb171cdiibq7js7i13nxpdky7074p"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.1.0"; sha256 = "193xwf33fbm0ni3idxzbr5fdq3i2dlfgihsac9jj7whj0gd902nh"; })
-  (fetchNuGet { pname = "Microsoft.Win32.Primitives"; version = "4.3.0"; sha256 = "0j0c1wj4ndj21zsgivsc24whiya605603kxrbiw6wkfdync464wq"; })
-  (fetchNuGet { pname = "Microsoft.Win32.SystemEvents"; version = "7.0.0"; sha256 = "1bh77misznh19m1swqm3dsbji499b8xh9gk6w74sgbkarf6ni8lb"; })
-  (fetchNuGet { pname = "MimeKit"; version = "3.3.0"; sha256 = "0rslxmwlv6w2fssv0mz2v6qi6zg1v0lmly6hvh258xqdfxrhn0y8"; })
-  (fetchNuGet { pname = "Mono.TextTemplating"; version = "2.2.1"; sha256 = "1ih6399x4bxzchw7pq5195imir9viy2r1w702vy87vrarxyjqdp1"; })
-  (fetchNuGet { pname = "MySqlConnector"; version = "2.3.1"; sha256 = "12j62zmn2ma3xymp0iyiq64g7a9mpcfshg4zkk2wcmvfggga5wml"; })
-  (fetchNuGet { pname = "NBitcoin"; version = "5.0.40"; sha256 = "1rqzn84yaww4afagwg8jg1l5qdkvqyjdfcyd5widddqwxabbsjvh"; })
-  (fetchNuGet { pname = "NBitcoin"; version = "6.0.8"; sha256 = "1f90zyrd35fzx0vgvd83jhd6hczd4037h2k198xiyxj04l4m3wm5"; })
-  (fetchNuGet { pname = "NBitcoin"; version = "7.0.1"; sha256 = "05kqpjyp3ckb2183g9vfsdv362y5xg5j21p36zls0x3b0jgrwxw7"; })
-  (fetchNuGet { pname = "NBitcoin"; version = "7.0.31"; sha256 = "07i20b6q2fmzrcibypcs2ys72ifnl9jbkjxaadxm6ml60gfds9mk"; })
-  (fetchNuGet { pname = "NBitcoin"; version = "7.0.34"; sha256 = "0hw69gcmkxyz6y06c10hjmjm3avrpzc0lhn2n0k5fspnsh4bnrkz"; })
-  (fetchNuGet { pname = "NBitcoin.Altcoins"; version = "3.0.23"; sha256 = "0nr8yryixhip7ffqlr584j8pfvjwggng23m0h0mad3liv3hxhb7k"; })
-  (fetchNuGet { pname = "NBitpayClient"; version = "1.0.0.39"; sha256 = "1sgwradg7jnb4n3chwqfkximj1qhgl3r23p0sifmaa0kql2hlira"; })
-  (fetchNuGet { pname = "NBXplorer.Client"; version = "4.3.0"; sha256 = "067v8438mys96r5c50xm5ifbnj1d9j58zj53zfw9xilylgr0wa69"; })
-  (fetchNuGet { pname = "NdefLibrary"; version = "4.1.0"; sha256 = "1zqdia6jzhk6pr3d0szacc8knir035hk9qar7vnq1pv0yawn21z6"; })
-  (fetchNuGet { pname = "NETStandard.Library"; version = "1.6.1"; sha256 = "1z70wvsx2d847a2cjfii7b83pjfs34q05gb037fdjikv5kbagml8"; })
-  (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.1"; sha256 = "0fijg0w6iwap8gvzyjnndds0q4b8anwxxvik7y8vgq97dram4srb"; })
-  (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.3"; sha256 = "0xrwysmrn4midrjal8g2hr1bbg38iyisl0svamb11arqws4w2bw7"; })
-  (fetchNuGet { pname = "Newtonsoft.Json.Bson"; version = "1.0.1"; sha256 = "1r1hvj5gjl466bya2bfl5aaj8rbwyf5x1msg710wf3k2llbci1xa"; })
-  (fetchNuGet { pname = "Newtonsoft.Json.Bson"; version = "1.0.2"; sha256 = "0c27bhy9x3c2n26inq32kmp6drpm71n6mqnmcr19wrlcaihglj35"; })
-  (fetchNuGet { pname = "NicolasDorier.CommandLine"; version = "2.0.0"; sha256 = "0gywvl0gqs3crlzwgwzcqf0qsrbhk3dxjycpimxqvs1ihg4dhb1f"; })
-  (fetchNuGet { pname = "NicolasDorier.CommandLine.Configuration"; version = "2.0.0"; sha256 = "1cng096r3kb85lf5wjill4yhxx8nv9v0d6ksbn1i1vvdawwl6fkw"; })
-  (fetchNuGet { pname = "NicolasDorier.RateLimits"; version = "1.2.3"; sha256 = "197cqb0yxd2hfxyikxw53m4lmxh87l9sqrr8xihg1j0knvwzgyyp"; })
-  (fetchNuGet { pname = "NicolasDorier.StandardConfiguration"; version = "2.0.1"; sha256 = "1jiinqj1y8vv78p766asml4bd0k5gwrpl9ksi176h0z7wsj6ilrx"; })
-  (fetchNuGet { pname = "NLog"; version = "5.1.3"; sha256 = "0r09pd9cax95gn5bxskfhmalfd5qi3xx5j14znvryd1vn2vy6fln"; })
-  (fetchNuGet { pname = "Npgsql"; version = "8.0.0"; sha256 = "1x3jlin44frkhd7d50q0vmy0gapxqhmd4jv1nvsnkndp3xjsaynd"; })
-  (fetchNuGet { pname = "Npgsql.EntityFrameworkCore.PostgreSQL"; version = "8.0.0"; sha256 = "0gakaj66imb5248w7sircam4b69y5di6xkrd62flqb5szlai3vg5"; })
-  (fetchNuGet { pname = "NSec.Cryptography"; version = "20.2.0"; sha256 = "19slji51v8s8i4836nqqg7qb3i3p4ahqahz0fbb3gwpp67pn6izx"; })
-  (fetchNuGet { pname = "PeterO.Cbor"; version = "4.1.3"; sha256 = "0882i3bhhx2yag2m4lbdsgngjwaj9ff4v0ab9zb839i4r77aq1yn"; })
-  (fetchNuGet { pname = "PeterO.Numbers"; version = "1.6.0"; sha256 = "04kfdkfr600h69g67g6izbn57bxqjamvaadyw3p9gjsc0wrivi98"; })
-  (fetchNuGet { pname = "PeterO.URIUtility"; version = "1.0.0"; sha256 = "04ihfbk2lf0smznwfb62h57qknls5jyxirdz72g5wn9h1dcgkdac"; })
-  (fetchNuGet { pname = "Pomelo.EntityFrameworkCore.MySql"; version = "8.0.0-beta.2"; sha256 = "0f93gqzs6xr9lb6my8lmwkfvbb7lcgjq04715wk2k37mbb0smirv"; })
-  (fetchNuGet { pname = "Portable.BouncyCastle"; version = "1.9.0"; sha256 = "0kphjwz4hk2nki3b4f9z096xzd520nrpvi3cjib8fkjk6zhwrr8q"; })
-  (fetchNuGet { pname = "QRCoder"; version = "1.4.3"; sha256 = "1hmlqbdyq5n9bsmns5h0dwcxpd2jvqr9a2y6dyc9kbjmc8j1dpla"; })
-  (fetchNuGet { pname = "runtime.any.System.Collections"; version = "4.0.11"; sha256 = "1x44bm1cgv28zmrp095wf9mn8a6a0ivnzp9v14dcbhx06igxzgg0"; })
-  (fetchNuGet { pname = "runtime.any.System.Collections"; version = "4.3.0"; sha256 = "0bv5qgm6vr47ynxqbnkc7i797fdi8gbjjxii173syrx14nmrkwg0"; })
-  (fetchNuGet { pname = "runtime.any.System.Diagnostics.Tools"; version = "4.3.0"; sha256 = "1wl76vk12zhdh66vmagni66h5xbhgqq7zkdpgw21jhxhvlbcl8pk"; })
-  (fetchNuGet { pname = "runtime.any.System.Diagnostics.Tracing"; version = "4.1.0"; sha256 = "041im8hmp1zdgrx6jzyrdch6kshvbddmkar7r2mlm1ksb5c5kwpq"; })
-  (fetchNuGet { pname = "runtime.any.System.Diagnostics.Tracing"; version = "4.3.0"; sha256 = "00j6nv2xgmd3bi347k00m7wr542wjlig53rmj28pmw7ddcn97jbn"; })
-  (fetchNuGet { pname = "runtime.any.System.Globalization"; version = "4.0.11"; sha256 = "0240rp66pi5bw1xklmh421hj7arwcdmjmgfkiq1cbc6nrm8ah286"; })
-  (fetchNuGet { pname = "runtime.any.System.Globalization"; version = "4.3.0"; sha256 = "1daqf33hssad94lamzg01y49xwndy2q97i2lrb7mgn28656qia1x"; })
-  (fetchNuGet { pname = "runtime.any.System.Globalization.Calendars"; version = "4.3.0"; sha256 = "1ghhhk5psqxcg6w88sxkqrc35bxcz27zbqm2y5p5298pv3v7g201"; })
-  (fetchNuGet { pname = "runtime.any.System.IO"; version = "4.1.0"; sha256 = "0kasfkjiml2kk8prnyn1990nhsahnjggvqwszqjdsfwfl43vpcb5"; })
-  (fetchNuGet { pname = "runtime.any.System.IO"; version = "4.3.0"; sha256 = "0l8xz8zn46w4d10bcn3l4yyn4vhb3lrj2zw8llvz7jk14k4zps5x"; })
-  (fetchNuGet { pname = "runtime.any.System.Reflection"; version = "4.1.0"; sha256 = "06kcs059d5czyakx75rvlwa2mr86156w18fs7chd03f7084l7mq6"; })
-  (fetchNuGet { pname = "runtime.any.System.Reflection"; version = "4.3.0"; sha256 = "02c9h3y35pylc0zfq3wcsvc5nqci95nrkq0mszifc0sjx7xrzkly"; })
-  (fetchNuGet { pname = "runtime.any.System.Reflection.Extensions"; version = "4.3.0"; sha256 = "0zyri97dfc5vyaz9ba65hjj1zbcrzaffhsdlpxc9bh09wy22fq33"; })
-  (fetchNuGet { pname = "runtime.any.System.Reflection.Primitives"; version = "4.0.1"; sha256 = "1zxrpvixr5fqzkxpnin6g6gjq6xajy1snghz99ds2dwbhm276rhz"; })
-  (fetchNuGet { pname = "runtime.any.System.Reflection.Primitives"; version = "4.3.0"; sha256 = "0x1mm8c6iy8rlxm8w9vqw7gb7s1ljadrn049fmf70cyh42vdfhrf"; })
-  (fetchNuGet { pname = "runtime.any.System.Resources.ResourceManager"; version = "4.0.1"; sha256 = "1jmgs7hynb2rff48623wnyb37558bbh1q28k9c249j5r5sgsr5kr"; })
-  (fetchNuGet { pname = "runtime.any.System.Resources.ResourceManager"; version = "4.3.0"; sha256 = "03kickal0iiby82wa5flar18kyv82s9s6d4xhk5h4bi5kfcyfjzl"; })
-  (fetchNuGet { pname = "runtime.any.System.Runtime"; version = "4.1.0"; sha256 = "0mjr2bi7wvnkphfjqgkyf8vfyvy15a829jz6mivl6jmksh2bx40m"; })
-  (fetchNuGet { pname = "runtime.any.System.Runtime"; version = "4.3.0"; sha256 = "1cqh1sv3h5j7ixyb7axxbdkqx6cxy00p4np4j91kpm492rf4s25b"; })
-  (fetchNuGet { pname = "runtime.any.System.Runtime.Handles"; version = "4.0.1"; sha256 = "1kswgqhy34qvc49i981fk711s7knd6z13bp0rin8ms6axkh98nas"; })
-  (fetchNuGet { pname = "runtime.any.System.Runtime.Handles"; version = "4.3.0"; sha256 = "0bh5bi25nk9w9xi8z23ws45q5yia6k7dg3i4axhfqlnj145l011x"; })
-  (fetchNuGet { pname = "runtime.any.System.Runtime.InteropServices"; version = "4.1.0"; sha256 = "0gm8if0hcmp1qys1wmx4970k2x62pqvldgljsyzbjhiy5644vl8z"; })
-  (fetchNuGet { pname = "runtime.any.System.Runtime.InteropServices"; version = "4.3.0"; sha256 = "0c3g3g3jmhlhw4klrc86ka9fjbl7i59ds1fadsb2l8nqf8z3kb19"; })
-  (fetchNuGet { pname = "runtime.any.System.Text.Encoding"; version = "4.0.11"; sha256 = "0m4vgmzi1ky8xlj0r7xcyazxln3j9dlialnk6d2gmgrfnzf8f9m7"; })
-  (fetchNuGet { pname = "runtime.any.System.Text.Encoding"; version = "4.3.0"; sha256 = "0aqqi1v4wx51h51mk956y783wzags13wa7mgqyclacmsmpv02ps3"; })
-  (fetchNuGet { pname = "runtime.any.System.Text.Encoding.Extensions"; version = "4.3.0"; sha256 = "0lqhgqi0i8194ryqq6v2gqx0fb86db2gqknbm0aq31wb378j7ip8"; })
-  (fetchNuGet { pname = "runtime.any.System.Threading.Tasks"; version = "4.0.11"; sha256 = "1qzdp09qs8br5qxzlm1lgbjn4n57fk8vr1lzrmli2ysdg6x1xzvk"; })
-  (fetchNuGet { pname = "runtime.any.System.Threading.Tasks"; version = "4.3.0"; sha256 = "03mnvkhskbzxddz4hm113zsch1jyzh2cs450dk3rgfjp8crlw1va"; })
-  (fetchNuGet { pname = "runtime.any.System.Threading.Timer"; version = "4.3.0"; sha256 = "0aw4phrhwqz9m61r79vyfl5la64bjxj8l34qnrcwb28v49fg2086"; })
-  (fetchNuGet { pname = "runtime.debian.8-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "16rnxzpk5dpbbl1x354yrlsbvwylrq456xzpsha1n9y3glnhyx9d"; })
-  (fetchNuGet { pname = "runtime.fedora.23-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0hkg03sgm2wyq8nqk6dbm9jh5vcq57ry42lkqdmfklrw89lsmr59"; })
-  (fetchNuGet { pname = "runtime.fedora.24-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0c2p354hjx58xhhz7wv6div8xpi90sc6ibdm40qin21bvi7ymcaa"; })
-  (fetchNuGet { pname = "runtime.native.System"; version = "4.0.0"; sha256 = "1ppk69xk59ggacj9n7g6fyxvzmk1g5p4fkijm0d7xqfkig98qrkf"; })
-  (fetchNuGet { pname = "runtime.native.System"; version = "4.3.0"; sha256 = "15hgf6zaq9b8br2wi1i3x0zvmk410nlmsmva9p0bbg73v6hml5k4"; })
-  (fetchNuGet { pname = "runtime.native.System.IO.Compression"; version = "4.3.0"; sha256 = "1vvivbqsk6y4hzcid27pqpm5bsi6sc50hvqwbcx8aap5ifrxfs8d"; })
-  (fetchNuGet { pname = "runtime.native.System.Net.Http"; version = "4.3.0"; sha256 = "1n6rgz5132lcibbch1qlf0g9jk60r0kqv087hxc0lisy50zpm7kk"; })
-  (fetchNuGet { pname = "runtime.native.System.Net.Security"; version = "4.3.0"; sha256 = "0dnqjhw445ay3chpia9p6vy4w2j6s9vy3hxszqvdanpvvyaxijr3"; })
-  (fetchNuGet { pname = "runtime.native.System.Security.Cryptography"; version = "4.0.0"; sha256 = "0k57aa2c3b10wl3hfqbgrl7xq7g8hh3a3ir44b31dn5p61iiw3z9"; })
-  (fetchNuGet { pname = "runtime.native.System.Security.Cryptography.Apple"; version = "4.3.0"; sha256 = "1b61p6gw1m02cc1ry996fl49liiwky6181dzr873g9ds92zl326q"; })
-  (fetchNuGet { pname = "runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "18pzfdlwsg2nb1jjjjzyb5qlgy6xjxzmhnfaijq5s2jw3cm3ab97"; })
-  (fetchNuGet { pname = "runtime.opensuse.13.2-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0qyynf9nz5i7pc26cwhgi8j62ps27sqmf78ijcfgzab50z9g8ay3"; })
-  (fetchNuGet { pname = "runtime.opensuse.42.1-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "1klrs545awhayryma6l7g2pvnp9xy4z0r1i40r80zb45q3i9nbyf"; })
-  (fetchNuGet { pname = "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.Apple"; version = "4.3.0"; sha256 = "10yc8jdrwgcl44b4g93f1ds76b176bajd3zqi2faf5rvh1vy9smi"; })
-  (fetchNuGet { pname = "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0zcxjv5pckplvkg0r6mw3asggm7aqzbdjimhvsasb0cgm59x09l3"; })
-  (fetchNuGet { pname = "runtime.rhel.7-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0vhynn79ih7hw7cwjazn87rm9z9fj0rvxgzlab36jybgcpcgphsn"; })
-  (fetchNuGet { pname = "runtime.ubuntu.14.04-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "160p68l2c7cqmyqjwxydcvgw7lvl1cr0znkw8fp24d1by9mqc8p3"; })
-  (fetchNuGet { pname = "runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "15zrc8fgd8zx28hdghcj5f5i34wf3l6bq5177075m2bc2j34jrqy"; })
-  (fetchNuGet { pname = "runtime.ubuntu.16.10-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "1p4dgxax6p7rlgj4q73k73rslcnz4wdcv8q2flg1s8ygwcm58ld5"; })
-  (fetchNuGet { pname = "runtime.unix.Microsoft.Win32.Primitives"; version = "4.3.0"; sha256 = "0y61k9zbxhdi0glg154v30kkq7f8646nif8lnnxbvkjpakggd5id"; })
-  (fetchNuGet { pname = "runtime.unix.System.Console"; version = "4.3.0"; sha256 = "1pfpkvc6x2if8zbdzg9rnc5fx51yllprl8zkm5npni2k50lisy80"; })
-  (fetchNuGet { pname = "runtime.unix.System.Diagnostics.Debug"; version = "4.0.11"; sha256 = "05ndbai4vpqrry0ghbfgqc8xblmplwjgndxmdn1zklqimczwjg2d"; })
-  (fetchNuGet { pname = "runtime.unix.System.Diagnostics.Debug"; version = "4.3.0"; sha256 = "1lps7fbnw34bnh3lm31gs5c0g0dh7548wfmb8zz62v0zqz71msj5"; })
-  (fetchNuGet { pname = "runtime.unix.System.IO.FileSystem"; version = "4.3.0"; sha256 = "14nbkhvs7sji5r1saj2x8daz82rnf9kx28d3v2qss34qbr32dzix"; })
-  (fetchNuGet { pname = "runtime.unix.System.Net.Primitives"; version = "4.3.0"; sha256 = "0bdnglg59pzx9394sy4ic66kmxhqp8q8bvmykdxcbs5mm0ipwwm4"; })
-  (fetchNuGet { pname = "runtime.unix.System.Net.Sockets"; version = "4.3.0"; sha256 = "03npdxzy8gfv035bv1b9rz7c7hv0rxl5904wjz51if491mw0xy12"; })
-  (fetchNuGet { pname = "runtime.unix.System.Private.Uri"; version = "4.0.1"; sha256 = "0ic5dgc45jkhcr1g9xmmzjm7ffiw4cymm0fprczlx4fnww4783nm"; })
-  (fetchNuGet { pname = "runtime.unix.System.Private.Uri"; version = "4.3.0"; sha256 = "1jx02q6kiwlvfksq1q9qr17fj78y5v6mwsszav4qcz9z25d5g6vk"; })
-  (fetchNuGet { pname = "runtime.unix.System.Runtime.Extensions"; version = "4.1.0"; sha256 = "0x1cwd7cvifzmn5x1wafvj75zdxlk3mxy860igh3x1wx0s8167y4"; })
-  (fetchNuGet { pname = "runtime.unix.System.Runtime.Extensions"; version = "4.3.0"; sha256 = "0pnxxmm8whx38dp6yvwgmh22smknxmqs5n513fc7m4wxvs1bvi4p"; })
-  (fetchNuGet { pname = "Serilog"; version = "3.1.1"; sha256 = "0ck51ndmaqflsri7yyw5792z42wsp91038rx2i6vg7z4r35vfvig"; })
-  (fetchNuGet { pname = "Serilog.AspNetCore"; version = "8.0.0"; sha256 = "0g1scn1a5paiydxk1nnrwzzqny2vabc3hniy6jwjqycag6ch2pni"; })
-  (fetchNuGet { pname = "Serilog.Extensions.Hosting"; version = "8.0.0"; sha256 = "10cgp4nsrzkld5yxnvkfkwd0wkc1m8m7p5z42w4sqd8f188n8i9q"; })
-  (fetchNuGet { pname = "Serilog.Extensions.Logging"; version = "8.0.0"; sha256 = "087ab94sfhkj6h6x3cwwf66g456704faxnfyc4pi6shxk45b318s"; })
-  (fetchNuGet { pname = "Serilog.Formatting.Compact"; version = "2.0.0"; sha256 = "0y7vg2qji02riq7r0kgybarhkngw6gh3xw89w7c2hcmjawd96x3k"; })
-  (fetchNuGet { pname = "Serilog.Settings.Configuration"; version = "8.0.0"; sha256 = "0245gvndwbj4nbp8q09vp7w4i9iddxr0vzda2c3ja5afz1zgs395"; })
-  (fetchNuGet { pname = "Serilog.Sinks.Console"; version = "5.0.0"; sha256 = "0qk5b9vfgzx00a1c2rnih2p3jlcc88vdi9ar5cpwv1jb09x6brah"; })
-  (fetchNuGet { pname = "Serilog.Sinks.Debug"; version = "2.0.0"; sha256 = "1i7j870l47gan3gpnnlzkccn5lbm7518cnkp25a3g5gp9l0dbwpw"; })
-  (fetchNuGet { pname = "Serilog.Sinks.File"; version = "5.0.1-dev-00968"; sha256 = "03p0pyydks9dpzisp9ryjgf54rlh1ym8wpy1nv5692smffbfyyl1"; })
-  (fetchNuGet { pname = "SocketIOClient"; version = "3.0.8"; sha256 = "1k3csni1zyy55rdzcyivppqmyxvrmm31bqm6gffc25v959jp73wv"; })
-  (fetchNuGet { pname = "SQLitePCLRaw.bundle_e_sqlite3"; version = "2.1.6"; sha256 = "0pzgdfl707pd9fz108xaff22w7c2y27yaix6wfp36phqkdnzz43m"; })
-  (fetchNuGet { pname = "SQLitePCLRaw.core"; version = "2.1.6"; sha256 = "1w8zsgz2w2q0a9cw9cl1rzrpv48a04nhyq67ywan6xlgknds65a7"; })
-  (fetchNuGet { pname = "SQLitePCLRaw.lib.e_sqlite3"; version = "2.1.6"; sha256 = "0g959z7r3h43nwzm7z3jiib1xvyx146lxyv0x6fl8ll5wivpjyxq"; })
-  (fetchNuGet { pname = "SQLitePCLRaw.provider.e_sqlite3"; version = "2.1.6"; sha256 = "1vs1c7yhi0mdqrd35ji289cxkhg7dxdnn6wgjjbngvqxkdhkyxyc"; })
-  (fetchNuGet { pname = "SSH.NET"; version = "2023.0.0"; sha256 = "16pjwb4ns8vq561x7ib9vbpmxqvvh9ibl8af2s7v4a5wxc21y832"; })
-  (fetchNuGet { pname = "SshNet.Security.Cryptography"; version = "1.3.0"; sha256 = "1y9r9c2dn81l1l4nn976fwf0by83qbvb0sp1hw7m19pqz7pmaflh"; })
-  (fetchNuGet { pname = "System.AppContext"; version = "4.3.0"; sha256 = "1649qvy3dar900z3g817h17nl8jp4ka5vcfmsr05kh0fshn7j3ya"; })
-  (fetchNuGet { pname = "System.Buffers"; version = "4.3.0"; sha256 = "0fgns20ispwrfqll4q1zc1waqcmylb3zc50ys9x8zlwxh9pmd9jy"; })
-  (fetchNuGet { pname = "System.Buffers"; version = "4.5.1"; sha256 = "04kb1mdrlcixj9zh1xdi5as0k0qi8byr5mi3p3jcxx72qz93s2y3"; })
-  (fetchNuGet { pname = "System.CodeDom"; version = "4.4.0"; sha256 = "1zgbafm5p380r50ap5iddp11kzhr9khrf2pnai6k593wjar74p1g"; })
-  (fetchNuGet { pname = "System.Collections"; version = "4.0.11"; sha256 = "1ga40f5lrwldiyw6vy67d0sg7jd7ww6kgwbksm19wrvq9hr0bsm6"; })
-  (fetchNuGet { pname = "System.Collections"; version = "4.3.0"; sha256 = "19r4y64dqyrq6k4706dnyhhw7fs24kpp3awak7whzss39dakpxk9"; })
-  (fetchNuGet { pname = "System.Collections.Concurrent"; version = "4.0.12"; sha256 = "07y08kvrzpak873pmyxs129g1ch8l27zmg51pcyj2jvq03n0r0fc"; })
-  (fetchNuGet { pname = "System.Collections.Concurrent"; version = "4.3.0"; sha256 = "0wi10md9aq33jrkh2c24wr2n9hrpyamsdhsxdcnf43b7y86kkii8"; })
-  (fetchNuGet { pname = "System.Collections.Immutable"; version = "5.0.0"; sha256 = "1kvcllagxz2q92g81zkz81djkn2lid25ayjfgjalncyc68i15p0r"; })
-  (fetchNuGet { pname = "System.Collections.Immutable"; version = "6.0.0"; sha256 = "1js98kmjn47ivcvkjqdmyipzknb9xbndssczm8gq224pbaj1p88c"; })
-  (fetchNuGet { pname = "System.Collections.Immutable"; version = "7.0.0"; sha256 = "1n9122cy6v3qhsisc9lzwa1m1j62b8pi2678nsmnlyvfpk0zdagm"; })
-  (fetchNuGet { pname = "System.Collections.Immutable"; version = "8.0.0"; sha256 = "0z53a42zjd59zdkszcm7pvij4ri5xbb8jly9hzaad9khlf69bcqp"; })
-  (fetchNuGet { pname = "System.Composition"; version = "6.0.0"; sha256 = "1p7hysns39cc24af6dwd4m48bqjsrr3clvi4aws152mh2fgyg50z"; })
-  (fetchNuGet { pname = "System.Composition.AttributedModel"; version = "6.0.0"; sha256 = "1mqrblb0l65hw39d0hnspqcv85didpn4wbiwhfgj4784wzqx2w6k"; })
-  (fetchNuGet { pname = "System.Composition.Convention"; version = "6.0.0"; sha256 = "02km3yb94p1c4s7liyhkmda0g71zm1rc8ijsfmy4bnlkq15xjw3b"; })
-  (fetchNuGet { pname = "System.Composition.Hosting"; version = "6.0.0"; sha256 = "0big5nk8c44rxp6cfykhk7rxvn2cgwa99w6c3v2a36adc3lj36ky"; })
-  (fetchNuGet { pname = "System.Composition.Runtime"; version = "6.0.0"; sha256 = "0vq5ik63yii1784gsa2f2kx9w6xllmm8b8rk0arid1jqdj1nyrlw"; })
-  (fetchNuGet { pname = "System.Composition.TypedParts"; version = "6.0.0"; sha256 = "0y9pq3y60nyrpfy51f576a0qjjdh61mcv8vnik32pm4bz56h9q72"; })
-  (fetchNuGet { pname = "System.Configuration.ConfigurationManager"; version = "7.0.0"; sha256 = "149d9kmakzkbw69cip1ny0wjlgcvnhrr7vz5pavpsip36k2mw02a"; })
-  (fetchNuGet { pname = "System.Console"; version = "4.3.0"; sha256 = "1flr7a9x920mr5cjsqmsy9wgnv3lvd0h1g521pdr1lkb2qycy7ay"; })
-  (fetchNuGet { pname = "System.Diagnostics.Debug"; version = "4.0.11"; sha256 = "0gmjghrqmlgzxivd2xl50ncbglb7ljzb66rlx8ws6dv8jm0d5siz"; })
-  (fetchNuGet { pname = "System.Diagnostics.Debug"; version = "4.3.0"; sha256 = "00yjlf19wjydyr6cfviaph3vsjzg3d5nvnya26i2fvfg53sknh3y"; })
-  (fetchNuGet { pname = "System.Diagnostics.DiagnosticSource"; version = "4.3.0"; sha256 = "0z6m3pbiy0qw6rn3n209rrzf9x1k4002zh90vwcrsym09ipm2liq"; })
-  (fetchNuGet { pname = "System.Diagnostics.DiagnosticSource"; version = "8.0.0"; sha256 = "0nzra1i0mljvmnj1qqqg37xs7bl71fnpl68nwmdajchh65l878zr"; })
-  (fetchNuGet { pname = "System.Diagnostics.EventLog"; version = "7.0.0"; sha256 = "16p8z975dnzmncfifa9gw9n3k9ycpr2qvz7lglpghsvx0fava8k9"; })
-  (fetchNuGet { pname = "System.Diagnostics.Tools"; version = "4.3.0"; sha256 = "0in3pic3s2ddyibi8cvgl102zmvp9r9mchh82ns9f0ms4basylw1"; })
-  (fetchNuGet { pname = "System.Diagnostics.Tracing"; version = "4.1.0"; sha256 = "1d2r76v1x610x61ahfpigda89gd13qydz6vbwzhpqlyvq8jj6394"; })
-  (fetchNuGet { pname = "System.Diagnostics.Tracing"; version = "4.3.0"; sha256 = "1m3bx6c2s958qligl67q7grkwfz3w53hpy7nc97mh6f7j5k168c4"; })
-  (fetchNuGet { pname = "System.Drawing.Common"; version = "7.0.0"; sha256 = "0jwyv5zjxzr4bm4vhmz394gsxqa02q6pxdqd2hwy1f116f0l30dp"; })
-  (fetchNuGet { pname = "System.Formats.Asn1"; version = "6.0.0"; sha256 = "1vvr7hs4qzjqb37r0w1mxq7xql2b17la63jwvmgv65s1hj00g8r9"; })
-  (fetchNuGet { pname = "System.Globalization"; version = "4.0.11"; sha256 = "070c5jbas2v7smm660zaf1gh0489xanjqymkvafcs4f8cdrs1d5d"; })
-  (fetchNuGet { pname = "System.Globalization"; version = "4.3.0"; sha256 = "1cp68vv683n6ic2zqh2s1fn4c2sd87g5hpp6l4d4nj4536jz98ki"; })
-  (fetchNuGet { pname = "System.Globalization.Calendars"; version = "4.3.0"; sha256 = "1xwl230bkakzzkrggy1l1lxmm3xlhk4bq2pkv790j5lm8g887lxq"; })
-  (fetchNuGet { pname = "System.Globalization.Extensions"; version = "4.3.0"; sha256 = "02a5zfxavhv3jd437bsncbhd2fp1zv4gxzakp1an9l6kdq1mcqls"; })
-  (fetchNuGet { pname = "System.IdentityModel.Tokens.Jwt"; version = "6.6.0"; sha256 = "17i6a43g1fksq9xy77dgsz54klz71pz062pb58lqx8h06p1818h1"; })
-  (fetchNuGet { pname = "System.Interactive.Async"; version = "3.1.1"; sha256 = "03iq20gq0n2b2sdzs5jhxf46nzkfgvzip6q5248vka2rcvn1yanh"; })
-  (fetchNuGet { pname = "System.IO"; version = "4.1.0"; sha256 = "1g0yb8p11vfd0kbkyzlfsbsp5z44lwsvyc0h3dpw6vqnbi035ajp"; })
-  (fetchNuGet { pname = "System.IO"; version = "4.3.0"; sha256 = "05l9qdrzhm4s5dixmx68kxwif4l99ll5gqmh7rqgw554fx0agv5f"; })
-  (fetchNuGet { pname = "System.IO.Compression"; version = "4.3.0"; sha256 = "084zc82yi6yllgda0zkgl2ys48sypiswbiwrv7irb3r0ai1fp4vz"; })
-  (fetchNuGet { pname = "System.IO.Compression.ZipFile"; version = "4.3.0"; sha256 = "1yxy5pq4dnsm9hlkg9ysh5f6bf3fahqqb6p8668ndy5c0lk7w2ar"; })
-  (fetchNuGet { pname = "System.IO.FileSystem"; version = "4.3.0"; sha256 = "0z2dfrbra9i6y16mm9v1v6k47f0fm617vlb7s5iybjjsz6g1ilmw"; })
-  (fetchNuGet { pname = "System.IO.FileSystem.Primitives"; version = "4.3.0"; sha256 = "0j6ndgglcf4brg2lz4wzsh1av1gh8xrzdsn9f0yznskhqn1xzj9c"; })
-  (fetchNuGet { pname = "System.IO.Pipelines"; version = "6.0.3"; sha256 = "1jgdazpmwc21dd9naq3l9n5s8a1jnbwlvgkf1pnm0aji6jd4xqdz"; })
-  (fetchNuGet { pname = "System.IO.Pipelines"; version = "8.0.0"; sha256 = "00f36lqz1wf3x51kwk23gznkjjrf5nmqic9n7073nhrgrvb43nid"; })
-  (fetchNuGet { pname = "System.Linq"; version = "4.1.0"; sha256 = "1ppg83svb39hj4hpp5k7kcryzrf3sfnm08vxd5sm2drrijsla2k5"; })
-  (fetchNuGet { pname = "System.Linq"; version = "4.3.0"; sha256 = "1w0gmba695rbr80l1k2h4mrwzbzsyfl2z4klmpbsvsg5pm4a56s7"; })
-  (fetchNuGet { pname = "System.Linq.Expressions"; version = "4.3.0"; sha256 = "0ky2nrcvh70rqq88m9a5yqabsl4fyd17bpr63iy2mbivjs2nyypv"; })
-  (fetchNuGet { pname = "System.Memory"; version = "4.5.1"; sha256 = "0f07d7hny38lq9w69wx4lxkn4wszrqf9m9js6fh9is645csm167c"; })
-  (fetchNuGet { pname = "System.Memory"; version = "4.5.3"; sha256 = "0naqahm3wljxb5a911d37mwjqjdxv9l0b49p5dmfyijvni2ppy8a"; })
-  (fetchNuGet { pname = "System.Memory"; version = "4.5.4"; sha256 = "14gbbs22mcxwggn0fcfs1b062521azb9fbb7c113x0mq6dzq9h6y"; })
-  (fetchNuGet { pname = "System.Net.Http"; version = "4.3.0"; sha256 = "1i4gc757xqrzflbk7kc5ksn20kwwfjhw9w7pgdkn19y3cgnl302j"; })
-  (fetchNuGet { pname = "System.Net.NameResolution"; version = "4.3.0"; sha256 = "15r75pwc0rm3vvwsn8rvm2krf929mjfwliv0mpicjnii24470rkq"; })
-  (fetchNuGet { pname = "System.Net.Primitives"; version = "4.3.0"; sha256 = "0c87k50rmdgmxx7df2khd9qj7q35j9rzdmm2572cc55dygmdk3ii"; })
-  (fetchNuGet { pname = "System.Net.Security"; version = "4.3.0"; sha256 = "1aa5igz31ivk6kpgsrwck3jccab7wd88wr52lddmgypmbh9mmf87"; })
-  (fetchNuGet { pname = "System.Net.Sockets"; version = "4.3.0"; sha256 = "1ssa65k6chcgi6mfmzrznvqaxk8jp0gvl77xhf1hbzakjnpxspla"; })
-  (fetchNuGet { pname = "System.Net.WebHeaderCollection"; version = "4.3.0"; sha256 = "0ms3ddjv1wn8sqa5qchm245f3vzzif6l6fx5k92klqpn7zf4z562"; })
-  (fetchNuGet { pname = "System.Net.WebSockets"; version = "4.3.0"; sha256 = "1gfj800078kggcgl0xyl00a6y5k4wwh2k2qm69rjy22wbmq7fy4p"; })
-  (fetchNuGet { pname = "System.Net.WebSockets.Client"; version = "4.3.2"; sha256 = "103y8lfsfa5xd1sqmq9sml4qyp4rij2i3fnnw119h119hb04l0rk"; })
-  (fetchNuGet { pname = "System.ObjectModel"; version = "4.3.0"; sha256 = "191p63zy5rpqx7dnrb3h7prvgixmk168fhvvkkvhlazncf8r3nc2"; })
-  (fetchNuGet { pname = "System.Private.Uri"; version = "4.0.1"; sha256 = "0k57qhawjysm4cpbfpc49kl4av7lji310kjcamkl23bwgij5ld9j"; })
-  (fetchNuGet { pname = "System.Private.Uri"; version = "4.3.0"; sha256 = "04r1lkdnsznin0fj4ya1zikxiqr0h6r6a1ww2dsm60gqhdrf0mvx"; })
-  (fetchNuGet { pname = "System.Reflection"; version = "4.1.0"; sha256 = "1js89429pfw79mxvbzp8p3q93il6rdff332hddhzi5wqglc4gml9"; })
-  (fetchNuGet { pname = "System.Reflection"; version = "4.3.0"; sha256 = "0xl55k0mw8cd8ra6dxzh974nxif58s3k1rjv1vbd7gjbjr39j11m"; })
-  (fetchNuGet { pname = "System.Reflection.Emit"; version = "4.3.0"; sha256 = "11f8y3qfysfcrscjpjym9msk7lsfxkk4fmz9qq95kn3jd0769f74"; })
-  (fetchNuGet { pname = "System.Reflection.Emit.ILGeneration"; version = "4.3.0"; sha256 = "0w1n67glpv8241vnpz1kl14sy7zlnw414aqwj4hcx5nd86f6994q"; })
-  (fetchNuGet { pname = "System.Reflection.Emit.Lightweight"; version = "4.3.0"; sha256 = "0ql7lcakycrvzgi9kxz1b3lljd990az1x6c4jsiwcacrvimpib5c"; })
-  (fetchNuGet { pname = "System.Reflection.Extensions"; version = "4.3.0"; sha256 = "02bly8bdc98gs22lqsfx9xicblszr2yan7v2mmw3g7hy6miq5hwq"; })
-  (fetchNuGet { pname = "System.Reflection.Metadata"; version = "5.0.0"; sha256 = "17qsl5nanlqk9iz0l5wijdn6ka632fs1m1fvx18dfgswm258r3ss"; })
-  (fetchNuGet { pname = "System.Reflection.Metadata"; version = "6.0.1"; sha256 = "0fjqifk4qz9lw5gcadpfalpplyr0z2b3p9x7h0ll481a9sqvppc9"; })
-  (fetchNuGet { pname = "System.Reflection.Metadata"; version = "7.0.0"; sha256 = "1wilasn2qmj870h2bhw348lspamm7pbinpb4m89icg113510l00v"; })
-  (fetchNuGet { pname = "System.Reflection.Primitives"; version = "4.0.1"; sha256 = "1bangaabhsl4k9fg8khn83wm6yial8ik1sza7401621jc6jrym28"; })
-  (fetchNuGet { pname = "System.Reflection.Primitives"; version = "4.3.0"; sha256 = "04xqa33bld78yv5r93a8n76shvc8wwcdgr1qvvjh959g3rc31276"; })
-  (fetchNuGet { pname = "System.Reflection.TypeExtensions"; version = "4.3.0"; sha256 = "0y2ssg08d817p0vdag98vn238gyrrynjdj4181hdg780sif3ykp1"; })
-  (fetchNuGet { pname = "System.Resources.ResourceManager"; version = "4.0.1"; sha256 = "0b4i7mncaf8cnai85jv3wnw6hps140cxz8vylv2bik6wyzgvz7bi"; })
-  (fetchNuGet { pname = "System.Resources.ResourceManager"; version = "4.3.0"; sha256 = "0sjqlzsryb0mg4y4xzf35xi523s4is4hz9q4qgdvlvgivl7qxn49"; })
-  (fetchNuGet { pname = "System.Runtime"; version = "4.1.0"; sha256 = "02hdkgk13rvsd6r9yafbwzss8kr55wnj8d5c7xjnp8gqrwc8sn0m"; })
-  (fetchNuGet { pname = "System.Runtime"; version = "4.3.0"; sha256 = "066ixvgbf2c929kgknshcxqj6539ax7b9m570cp8n179cpfkapz7"; })
-  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "4.5.1"; sha256 = "1xcrjx5fwg284qdnxyi2d0lzdm5q4frlpkp0nf6vvkx1kdz2prrf"; })
-  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "4.7.0"; sha256 = "16r6sn4czfjk8qhnz7bnqlyiaaszr0ihinb7mq9zzr1wba257r54"; })
-  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "5.0.0"; sha256 = "02k25ivn50dmqx5jn8hawwmz24yf0454fjd823qk6lygj9513q4x"; })
-  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "6.0.0"; sha256 = "0qm741kh4rh57wky16sq4m0v05fxmkjjr87krycf5vp9f0zbahbc"; })
-  (fetchNuGet { pname = "System.Runtime.Extensions"; version = "4.1.0"; sha256 = "0rw4rm4vsm3h3szxp9iijc3ksyviwsv6f63dng3vhqyg4vjdkc2z"; })
-  (fetchNuGet { pname = "System.Runtime.Extensions"; version = "4.3.0"; sha256 = "1ykp3dnhwvm48nap8q23893hagf665k0kn3cbgsqpwzbijdcgc60"; })
-  (fetchNuGet { pname = "System.Runtime.Handles"; version = "4.0.1"; sha256 = "1g0zrdi5508v49pfm3iii2hn6nm00bgvfpjq1zxknfjrxxa20r4g"; })
-  (fetchNuGet { pname = "System.Runtime.Handles"; version = "4.3.0"; sha256 = "0sw2gfj2xr7sw9qjn0j3l9yw07x73lcs97p8xfc9w1x9h5g5m7i8"; })
-  (fetchNuGet { pname = "System.Runtime.InteropServices"; version = "4.1.0"; sha256 = "01kxqppx3dr3b6b286xafqilv4s2n0gqvfgzfd4z943ga9i81is1"; })
-  (fetchNuGet { pname = "System.Runtime.InteropServices"; version = "4.3.0"; sha256 = "00hywrn4g7hva1b2qri2s6rabzwgxnbpw9zfxmz28z09cpwwgh7j"; })
-  (fetchNuGet { pname = "System.Runtime.InteropServices.RuntimeInformation"; version = "4.3.0"; sha256 = "0q18r1sh4vn7bvqgd6dmqlw5v28flbpj349mkdish2vjyvmnb2ii"; })
-  (fetchNuGet { pname = "System.Runtime.Numerics"; version = "4.3.0"; sha256 = "19rav39sr5dky7afygh309qamqqmi9kcwvz3i0c5700v0c5cg61z"; })
-  (fetchNuGet { pname = "System.Security.Claims"; version = "4.3.0"; sha256 = "0jvfn7j22l3mm28qjy3rcw287y9h65ha4m940waaxah07jnbzrhn"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Algorithms"; version = "4.3.0"; sha256 = "03sq183pfl5kp7gkvq77myv7kbpdnq3y0xj7vi4q1kaw54sny0ml"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Cng"; version = "4.3.0"; sha256 = "1k468aswafdgf56ab6yrn7649kfqx2wm9aslywjam1hdmk5yypmv"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Cng"; version = "4.7.0"; sha256 = "00797sqbba8lys486ifxblz9j52m29kidclvmqpk531820k55x9j"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Csp"; version = "4.3.0"; sha256 = "1x5wcrddf2s3hb8j78cry7yalca4lb5vfnkrysagbn6r9x6xvrx1"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Encoding"; version = "4.3.0"; sha256 = "1jr6w70igqn07k5zs1ph6xja97hxnb3mqbspdrff6cvssgrixs32"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0givpvvj8yc7gv4lhb6s1prq6p2c4147204a0wib89inqzd87gqc"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Pkcs"; version = "6.0.0"; sha256 = "1q80znpwkv5wrzgx0qnzxqaa5k1s72fnk3g1yng62l7y14d8ki64"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Primitives"; version = "4.3.0"; sha256 = "0pyzncsv48zwly3lw4f2dayqswcfvdwq2nz0dgwmi7fj3pn64wby"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.ProtectedData"; version = "7.0.0"; sha256 = "15s9s6hsj9bz0nzw41mxbqdjgjd71w2djqbv0aj413gfi9amybk9"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.X509Certificates"; version = "4.3.0"; sha256 = "0valjcz5wksbvijylxijjxb1mp38mdhv03r533vnx1q3ikzdav9h"; })
-  (fetchNuGet { pname = "System.Security.Permissions"; version = "7.0.0"; sha256 = "0wkm6bj4abknzj41ygkziifx8mzhj4bix92wjvj6lihaw1gniq8c"; })
-  (fetchNuGet { pname = "System.Security.Principal"; version = "4.3.0"; sha256 = "12cm2zws06z4lfc4dn31iqv7072zyi4m910d4r6wm8yx85arsfxf"; })
-  (fetchNuGet { pname = "System.Security.Principal.Windows"; version = "4.3.0"; sha256 = "00a0a7c40i3v4cb20s2cmh9csb5jv2l0frvnlzyfxh848xalpdwr"; })
-  (fetchNuGet { pname = "System.Text.Encoding"; version = "4.0.11"; sha256 = "1dyqv0hijg265dwxg6l7aiv74102d6xjiwplh2ar1ly6xfaa4iiw"; })
-  (fetchNuGet { pname = "System.Text.Encoding"; version = "4.3.0"; sha256 = "1f04lkir4iladpp51sdgmis9dj4y8v08cka0mbmsy0frc9a4gjqr"; })
-  (fetchNuGet { pname = "System.Text.Encoding.CodePages"; version = "4.5.1"; sha256 = "1z21qyfs6sg76rp68qdx0c9iy57naan89pg7p6i3qpj8kyzn921w"; })
-  (fetchNuGet { pname = "System.Text.Encoding.CodePages"; version = "6.0.0"; sha256 = "0gm2kiz2ndm9xyzxgi0jhazgwslcs427waxgfa30m7yqll1kcrww"; })
-  (fetchNuGet { pname = "System.Text.Encoding.Extensions"; version = "4.3.0"; sha256 = "11q1y8hh5hrp5a3kw25cb6l00v5l5dvirkz8jr3sq00h1xgcgrxy"; })
-  (fetchNuGet { pname = "System.Text.Encodings.Web"; version = "7.0.0"; sha256 = "1151hbyrcf8kyg1jz8k9awpbic98lwz9x129rg7zk1wrs6vjlpxl"; })
-  (fetchNuGet { pname = "System.Text.Encodings.Web"; version = "8.0.0"; sha256 = "1wbypkx0m8dgpsaqgyywz4z760xblnwalb241d5qv9kx8m128i11"; })
-  (fetchNuGet { pname = "System.Text.Json"; version = "7.0.2"; sha256 = "1i6yinxvbwdk5g5z9y8l4a5hj2gw3h9ijlz2f1c1ngyprnwz2ivf"; })
-  (fetchNuGet { pname = "System.Text.Json"; version = "8.0.0"; sha256 = "134savxw0sq7s448jnzw17bxcijsi1v38mirpbb6zfxmqlf04msw"; })
-  (fetchNuGet { pname = "System.Text.RegularExpressions"; version = "4.3.0"; sha256 = "1bgq51k7fwld0njylfn7qc5fmwrk2137gdq7djqdsw347paa9c2l"; })
-  (fetchNuGet { pname = "System.Threading"; version = "4.0.11"; sha256 = "19x946h926bzvbsgj28csn46gak2crv2skpwsx80hbgazmkgb1ls"; })
-  (fetchNuGet { pname = "System.Threading"; version = "4.3.0"; sha256 = "0rw9wfamvhayp5zh3j7p1yfmx9b5khbf4q50d8k5rk993rskfd34"; })
-  (fetchNuGet { pname = "System.Threading.Channels"; version = "6.0.0"; sha256 = "1qbyi7yymqc56frqy7awvcqc1m7x3xrpx87a37dgb3mbrjg9hlcj"; })
-  (fetchNuGet { pname = "System.Threading.Channels"; version = "8.0.0"; sha256 = "060ab3gxgmffzlfcj08hpmkyfkhyiky9brw35klbl32pnfhdi53k"; })
-  (fetchNuGet { pname = "System.Threading.Tasks"; version = "4.0.11"; sha256 = "0nr1r41rak82qfa5m0lhk9mp0k93bvfd7bbd9sdzwx9mb36g28p5"; })
-  (fetchNuGet { pname = "System.Threading.Tasks"; version = "4.3.0"; sha256 = "134z3v9abw3a6jsw17xl3f6hqjpak5l682k2vz39spj4kmydg6k7"; })
-  (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.3.0"; sha256 = "1xxcx2xh8jin360yjwm4x4cf5y3a2bwpn2ygkfkwkicz7zk50s2z"; })
-  (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.5.4"; sha256 = "0y6ncasgfcgnjrhynaf0lwpkpkmv4a07sswwkwbwb5h7riisj153"; })
-  (fetchNuGet { pname = "System.Threading.ThreadPool"; version = "4.3.0"; sha256 = "027s1f4sbx0y1xqw2irqn6x161lzj8qwvnh2gn78ciiczdv10vf1"; })
-  (fetchNuGet { pname = "System.Threading.Timer"; version = "4.3.0"; sha256 = "1nx773nsx6z5whv8kaa1wjh037id2f1cxhb69pvgv12hd2b6qs56"; })
-  (fetchNuGet { pname = "System.Windows.Extensions"; version = "7.0.0"; sha256 = "11r9f0v7qp365bdpq5ax023yra4qvygljz18dlqs650d44iay669"; })
-  (fetchNuGet { pname = "System.Xml.ReaderWriter"; version = "4.3.0"; sha256 = "0c47yllxifzmh8gq6rq6l36zzvw4kjvlszkqa9wq3fr59n0hl3s1"; })
-  (fetchNuGet { pname = "System.Xml.XDocument"; version = "4.3.0"; sha256 = "08h8fm4l77n0nd4i4fk2386y809bfbwqb7ih9d7564ifcxr5ssxd"; })
-  (fetchNuGet { pname = "TwentyTwenty.Storage"; version = "2.12.1"; sha256 = "0m41dxzc3hh0f4j1k4q915pvcq6zr0hv1pj6b3sayrn8vjhk64qb"; })
-  (fetchNuGet { pname = "TwentyTwenty.Storage.Amazon"; version = "2.12.1"; sha256 = "03nrkvhki35w1rqx94s97rwxl0qwqlczyiimhrkc72vjppn5p6ph"; })
-  (fetchNuGet { pname = "TwentyTwenty.Storage.Azure"; version = "2.12.1"; sha256 = "10q7gpr8kmgzmxrzj3paqlnw4d8li8scwpxkzs11ildscfp6hvlv"; })
-  (fetchNuGet { pname = "TwentyTwenty.Storage.Google"; version = "2.12.1"; sha256 = "0d8s7p9brp03h9dpv3wxnqg0xsm7d9p4k6dpxpb9jak535khxzhp"; })
-  (fetchNuGet { pname = "TwentyTwenty.Storage.Local"; version = "2.12.1"; sha256 = "1zmjqwd1v3z78ab4vdmaadh94465k1qgpv7ylv8x3sdx4z78yjm8"; })
-  (fetchNuGet { pname = "WindowsAzure.Storage"; version = "9.3.3"; sha256 = "14b0b0nj85yvyn0h8ghr3kj6di2nkbzjxc2q98f1wcr0151xvdfx"; })
-  (fetchNuGet { pname = "YamlDotNet"; version = "8.0.0"; sha256 = "09hr1jimmfhcpk97p963y94h2k5p7wzcj4mpwqpdnwzbyrp2flpm"; })
+  (fetchNuGet { pname = "AngleSharp"; version = "0.17.1"; hash = "sha256-8DLs4SGXeG4ilbAJ8H6KLjaK/GmaXizMEMc3P8ZrEQ0="; })
+  (fetchNuGet { pname = "AngleSharp.Css"; version = "0.17.0"; hash = "sha256-sXzp9kY/rp3KauGNDpITkpjdgNoO0BdlC38SQYl0u2A="; })
+  (fetchNuGet { pname = "AWSSDK.Core"; version = "3.3.104.14"; hash = "sha256-oJjpVBjc3xZHXa+6LHNVZ8vtSijBoK3X1+EPsyZJ5pQ="; })
+  (fetchNuGet { pname = "AWSSDK.S3"; version = "3.3.110.10"; hash = "sha256-aDBLcfkMi9mSEL2vB01oje6cJVDAvg6Duk2k05eDwdE="; })
+  (fetchNuGet { pname = "BIP78.Sender"; version = "0.2.2"; hash = "sha256-l9ynp6ibP6Qd+p4cWxDOJGHeb/gCpwQMYB8DVoYW9Yo="; })
+  (fetchNuGet { pname = "BTCPayServer.Hwi"; version = "2.0.2"; hash = "sha256-CUq68FosFJyUtjjpnONhqQEXjtC9mF7zmkRjZnGwA1I="; })
+  (fetchNuGet { pname = "BTCPayServer.Lightning.All"; version = "1.6.0"; hash = "sha256-Ns8zNpYd6ZnUsBrx7zrqC1sq21rNScaVNVHn8uVxmHU="; })
+  (fetchNuGet { pname = "BTCPayServer.Lightning.Charge"; version = "1.5.1"; hash = "sha256-zxzXvGpe2ruqq7z4K6bREF50t2bnlZ26x9i0EirEZuk="; })
+  (fetchNuGet { pname = "BTCPayServer.Lightning.CLightning"; version = "1.6.0"; hash = "sha256-wxd/fQX6XcY/9VkH6T5b0cDuDNlM17BhUV7cEBOLVa8="; })
+  (fetchNuGet { pname = "BTCPayServer.Lightning.Common"; version = "1.3.21"; hash = "sha256-RJduzM8UGT5d4K/TOxvVhZdylvUkcPAjfx+M1rXjXRA="; })
+  (fetchNuGet { pname = "BTCPayServer.Lightning.Common"; version = "1.5.1"; hash = "sha256-pIRtTzlMLdwElzqtrDW7E7Iwlh0Vo+3fuCAs0SyYxcs="; })
+  (fetchNuGet { pname = "BTCPayServer.Lightning.Eclair"; version = "1.5.2"; hash = "sha256-oNx7IJptg4H06/j3rrDjhN55+8wbuUX+aukx4asxsvI="; })
+  (fetchNuGet { pname = "BTCPayServer.Lightning.LNBank"; version = "1.5.2"; hash = "sha256-lOdpv4K8ntngbzatG+UK/wmDGQMXSeMuzWosKsLZUjw="; })
+  (fetchNuGet { pname = "BTCPayServer.Lightning.LND"; version = "1.5.4"; hash = "sha256-zXZVD8Fi+8V2ylcN6K7nXlYBXPrR40oJoDlhXYHxHUs="; })
+  (fetchNuGet { pname = "BTCPayServer.Lightning.LNDhub"; version = "1.5.2"; hash = "sha256-/VPRakby3txF8tZkx52qwORpBDW94NxXOWakaPgwJiY="; })
+  (fetchNuGet { pname = "BTCPayServer.NETCore.Plugins"; version = "1.4.4"; hash = "sha256-1LQGTEK/5NrUIAuWimKJofDth8dsjOZKlGkUsGq+YGY="; })
+  (fetchNuGet { pname = "BTCPayServer.NETCore.Plugins.Mvc"; version = "1.4.4"; hash = "sha256-VEcPjbwrApQOIqtjbewGjNx7ZFiB4ztVYDwQfWqRtc4="; })
+  (fetchNuGet { pname = "BTCPayServer.NTag424"; version = "1.0.23"; hash = "sha256-KbROPk6QSOpitvPXWrsco0lCdlZr9ZMY6Fjd4/dUYtU="; })
+  (fetchNuGet { pname = "CsvHelper"; version = "32.0.3"; hash = "sha256-XbRxWNgxYe3sUZQZr5d9DxLAOl10cBCZ7JGm4xujuMQ="; })
+  (fetchNuGet { pname = "Dapper"; version = "2.1.35"; hash = "sha256-zeroySx7lO1yLtbhKhFQ87diWXOq9gPnv3qFcmNcs9M="; })
+  (fetchNuGet { pname = "DigitalRuby.ExchangeSharp"; version = "1.0.4"; hash = "sha256-qJ03XIpHpsINIqu/gamyHhYLjVI64R9cM7hnyYmmbcI="; })
+  (fetchNuGet { pname = "Fido2"; version = "2.0.2"; hash = "sha256-5C+Phw0Ty+b3dRH2J7wX3yMVMthKH9XOMPDUqxCZFPM="; })
+  (fetchNuGet { pname = "Fido2.AspNet"; version = "2.0.2"; hash = "sha256-QYXaTPNysnLwJqsYZj9KdLL3Yl+ilpAj8exc0DwPU3Q="; })
+  (fetchNuGet { pname = "Fido2.Models"; version = "2.0.2"; hash = "sha256-j5Uvlb6pbUTVrOR3iHyaHea0zfRHCbglyA02sXWCZO4="; })
+  (fetchNuGet { pname = "Google.Api.Gax"; version = "2.5.0"; hash = "sha256-ieq23E7g5XkdazV5bV+K/jb8wUaKNtveiCilfkeJ12A="; })
+  (fetchNuGet { pname = "Google.Api.Gax.Rest"; version = "2.5.0"; hash = "sha256-N4M7cx0OY0ij/UVELCIaRqt7DirTdlsx+Y1jA3+hcv4="; })
+  (fetchNuGet { pname = "Google.Apis"; version = "1.35.1"; hash = "sha256-iTQTcoPJ7jJA9Yq4MnXquC7N/6wh0MTkzMOlfSqiQoA="; })
+  (fetchNuGet { pname = "Google.Apis"; version = "1.38.0"; hash = "sha256-gDxUZ95xgNzJVmavqJ0oyMPXM2WPU2ATx8yAsGloQwY="; })
+  (fetchNuGet { pname = "Google.Apis.Auth"; version = "1.35.1"; hash = "sha256-Q8FGhfJYRtbhj7SJn5Ow4UcQ3Q2J81gl9c+thG1otuE="; })
+  (fetchNuGet { pname = "Google.Apis.Auth"; version = "1.38.0"; hash = "sha256-/hzxAJWRhWHQSE/p+PkhayawddXKrZRcK7xL7CNva3Q="; })
+  (fetchNuGet { pname = "Google.Apis.Core"; version = "1.35.1"; hash = "sha256-REndNVer+Cydo/vNSRMo6SSZNkUIh37qLYza2afgrgU="; })
+  (fetchNuGet { pname = "Google.Apis.Core"; version = "1.38.0"; hash = "sha256-MslnhGUuv+aSE9iY1BdfaM008SIdW/m9w7uYbiHVTwQ="; })
+  (fetchNuGet { pname = "Google.Apis.Storage.v1"; version = "1.38.0.1470"; hash = "sha256-AgonIEYvQXPTfR25KXPur7/lbNVKXvfJ3XK5W9352VU="; })
+  (fetchNuGet { pname = "Google.Cloud.Storage.V1"; version = "2.3.0"; hash = "sha256-xEhaoXQs1OZDPrEHmY6O2ZPm2mzifciQqKhVU03LUAY="; })
+  (fetchNuGet { pname = "HtmlSanitizer"; version = "8.0.838"; hash = "sha256-L2Nxc1qnRMv+FXNRt2SkkB2f3A41+UXh+lQcZEajBcw="; })
+  (fetchNuGet { pname = "Humanizer.Core"; version = "2.14.1"; hash = "sha256-EXvojddPu+9JKgOG9NSQgUTfWq1RpOYw7adxDPKDJ6o="; })
+  (fetchNuGet { pname = "libsodium"; version = "1.0.18"; hash = "sha256-9utXm0Qv+uaQ769G2jEO/1MCqRkjy0jxVUr5MGahH5c="; })
+  (fetchNuGet { pname = "LNURL"; version = "0.0.34"; hash = "sha256-PbXCxvNQB9Un2XRFIEtqr3M8kYKND8OXdgXzY6nGc+k="; })
+  (fetchNuGet { pname = "MailKit"; version = "3.3.0"; hash = "sha256-klBdW/zQ6ojikjMFG7R8el+n7v+ybcLjHKU0wvKUgKI="; })
+  (fetchNuGet { pname = "Microsoft.AspNet.SignalR.Client"; version = "2.4.3"; hash = "sha256-Lh+L29wLc7OIiqQK2YGKYxtAWotlYk0Qn7Kz5ntlHfI="; })
+  (fetchNuGet { pname = "Microsoft.AspNet.WebApi.Client"; version = "5.2.9"; hash = "sha256-CCytWp0v8C6NZa+o4cRXvA2u/ZOEA3TiG9+luszAwes="; })
+  (fetchNuGet { pname = "Microsoft.AspNet.WebApi.Client"; version = "6.0.0"; hash = "sha256-lNL5C4W7/p8homWooO/3ZKDZQ2M0FUTDixJwqWBPVbo="; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.Connections.Abstractions"; version = "8.0.0"; hash = "sha256-iZELnFhItlhMCMTCM5AtibA7eYRsgvHbpp6Wqev3H3I="; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.Cryptography.Internal"; version = "8.0.7"; hash = "sha256-10N8W6/uHUkWfp8sZKbI/AOE0UjJUnUY20CSOo4G2ro="; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.Cryptography.KeyDerivation"; version = "8.0.7"; hash = "sha256-AhGoDSx+dA6vBDGu652KmOkp+iD+/Ntdms52C2BV+Mc="; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.Http.Connections.Client"; version = "8.0.0"; hash = "sha256-G+cpqimrNCjJSoPkAH9OAYYKgfl04hXkWwyd57zic64="; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.Http.Connections.Common"; version = "8.0.0"; hash = "sha256-66lyBfW1yRoGwtcq6QDqImIR7IAVh+rNMKMKfA3HFOQ="; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.Identity.EntityFrameworkCore"; version = "8.0.7"; hash = "sha256-AlQ4h8t8W8g3e8l20/pzpGrDaBnmKF7wlJZev1fb7a0="; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.JsonPatch"; version = "8.0.7"; hash = "sha256-LP/OZQs56HKBp26Ok1XeL9BRmHL05y+dnuTCK1BzF3Y="; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.Mvc.NewtonsoftJson"; version = "8.0.7"; hash = "sha256-oOb2m53qLEvX1diNvXoagEGI/uIt0HiSGbSqYRioJD0="; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.Mvc.Razor.Extensions"; version = "6.0.0"; hash = "sha256-TrR4soDtsyg+czs3P0nYByalKC6g6cmdQiRnOg6NRtA="; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation"; version = "8.0.6"; hash = "sha256-s+MyQom7sv4sABfxjbHnuAcrF2uUAgJfizZVUqb0Qqo="; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.Razor.Language"; version = "6.0.0"; hash = "sha256-P0bdoAG+VBR/PuYQQN4tXhJomfXw+lArXx5UQqRoWlM="; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.SignalR.Client"; version = "8.0.0"; hash = "sha256-19Z5xUHs23xCG5PtgJ7Q8V/+XdpIbDENH8aIRFTD8Vc="; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.SignalR.Client.Core"; version = "8.0.0"; hash = "sha256-81RwKOAnRxltKXARyQdLmKJst0WEbGgYmzfXVmEbR4Q="; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.SignalR.Common"; version = "8.0.0"; hash = "sha256-3rzIYKgWRjy5W7THkRhXHJiAgxScNlvrR0Cccsein0w="; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.SignalR.Protocols.Json"; version = "8.0.0"; hash = "sha256-tF8RprCiVP96RGsoBfOVpEFdgpaxJy6fdy4eTfMgSO0="; })
+  (fetchNuGet { pname = "Microsoft.Bcl.AsyncInterfaces"; version = "6.0.0"; hash = "sha256-49+H/iFwp+AfCICvWcqo9us4CzxApPKC37Q5Eqrw+JU="; })
+  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Analyzers"; version = "3.3.2"; hash = "sha256-pDeaMqX7a01Hp1Qd9P/y/B2rEGAv2eIY0Ld/klBZW5g="; })
+  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Analyzers"; version = "3.3.3"; hash = "sha256-pkZiggwLw8k+CVSXKTzsVGsT+K49LxXUS3VH5PNlpCY="; })
+  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Analyzers"; version = "3.3.4"; hash = "sha256-qDzTfZBSCvAUu9gzq2k+LOvh6/eRvJ9++VCNck/ZpnE="; })
+  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Common"; version = "4.0.0"; hash = "sha256-SfQYaC9FbN60PhSzU3iM56ZeUlb/Y2FFGEnF43/5luc="; })
+  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Common"; version = "4.10.0"; hash = "sha256-gtGxb7gPSOWVN2SS5CaHtZO+i6hvBbiXyA2AZ8dOKzY="; })
+  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Common"; version = "4.5.0"; hash = "sha256-qo1oVNTB9JIMEPoiIZ+02qvF/O8PshQ/5gTjsY9iX0I="; })
+  (fetchNuGet { pname = "Microsoft.CodeAnalysis.CSharp"; version = "4.0.0"; hash = "sha256-ZGE+DM8siy3DHhBQcNesEHz9bEL4at+L6Cmj24+X/dc="; })
+  (fetchNuGet { pname = "Microsoft.CodeAnalysis.CSharp"; version = "4.10.0"; hash = "sha256-HjKeyCBJ+tylS3EaF18Z99Qj2F0eJQvUZo/pYrBcfLI="; })
+  (fetchNuGet { pname = "Microsoft.CodeAnalysis.CSharp"; version = "4.5.0"; hash = "sha256-5dZTS9PYtY83vyVa5bdNG3XKV5EjcnmddfUqWmIE29A="; })
+  (fetchNuGet { pname = "Microsoft.CodeAnalysis.CSharp.Workspaces"; version = "4.5.0"; hash = "sha256-Kmyt1Xfcs0rSZHvN9PH94CKAooqMS9abZQY7EpEqb2o="; })
+  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Razor"; version = "6.0.0"; hash = "sha256-j1/Mpe9Ta+4dhoa2+Zd7BaMm6MllJfaMtZ4pX+P2cqA="; })
+  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Workspaces.Common"; version = "4.5.0"; hash = "sha256-WM7AXJYHagaPx2waj2E32gG0qXq6Kx4Zhiq7Ym3WXPI="; })
+  (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.5.0"; hash = "sha256-dAhj/CgXG5VIy2dop1xplUsLje7uBPFjxasz9rdFIgY="; })
+  (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.7.0"; hash = "sha256-Enknv2RsFF68lEPdrf5M+BpV1kHoLTVRApKUwuk/pj0="; })
+  (fetchNuGet { pname = "Microsoft.Data.Sqlite.Core"; version = "8.0.5"; hash = "sha256-PH+ZS45SGfWSFcYZA+V3m0k1r3kxaDzD3DutVVRyqfQ="; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore"; version = "8.0.6"; hash = "sha256-T9Pz6bCGULBEYjzdUBd1KXSAnw1c4VljSkwgbTE2MmE="; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore"; version = "8.0.7"; hash = "sha256-frnGwFjqiq2Ja451sYmH8ZbTtDtSPGyGurzStkDkIpk="; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Abstractions"; version = "8.0.4"; hash = "sha256-ywVWOje6duVcJ8gSSC5HER2UO0mAzfg6VMtqloRmQfc="; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Abstractions"; version = "8.0.6"; hash = "sha256-RdcIA9WUJnHyAFdlpBPs5qUusKMUH9uLFGusKBWDCX8="; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Abstractions"; version = "8.0.7"; hash = "sha256-MuddWH+nSOJQzHmYeo6NBZDCFIhKXmkkmrJKYP1Gw9A="; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Analyzers"; version = "8.0.6"; hash = "sha256-aTWfaOL0MfWYBbR+1Q1g+sxzmcjA4Q/OBFnVZDQqKJ8="; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Analyzers"; version = "8.0.7"; hash = "sha256-iWgYqv1/162ldAjwmZ9piCMlzcuyzfPki8+ZU7DMdYU="; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Design"; version = "8.0.6"; hash = "sha256-svQdeAv19bCM/RQwWFA6wFssrXecqazqs5ctbdZCBgQ="; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Relational"; version = "8.0.0"; hash = "sha256-ga+Qp4dZpmxVEmIIn8AcC92HrhVQBaDICyHqE87s+lk="; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Relational"; version = "8.0.4"; hash = "sha256-TRP/Ior708EQjD03GGxKom2eLOxcUYN1MoFqzk3lYp8="; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Relational"; version = "8.0.5"; hash = "sha256-peIG9ZgXvvEB2wJ2QFxC3u+H8LnZ9xL/HIegw4R00Do="; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Relational"; version = "8.0.6"; hash = "sha256-l2fkzSq3Tb15Uq7a879Bihat+Y7rijDwsrs/MDiApdw="; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Relational"; version = "8.0.7"; hash = "sha256-cTIllPWauAbpiMFw5FdacpF6ZJr+ehf+eFG8RrA5Wjg="; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Sqlite"; version = "8.0.5"; hash = "sha256-lED2YXKz6PzYAC5iIXW957N74KUuYtJ9cKvoPFiebpk="; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Sqlite.Core"; version = "8.0.5"; hash = "sha256-+6AvDE+Fj0Oc7EfA4SXwFUdkOSvvX6jC5HPtbUhYQwE="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Caching.Abstractions"; version = "2.2.0"; hash = "sha256-osgeoVggP5UqGBG7GbrZmsVvBJmA47aCgsqJclthHUI="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Caching.Abstractions"; version = "8.0.0"; hash = "sha256-xGpKrywQvU1Wm/WolYIxgHYEFfgkNGeJ+GGc5DT3phI="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Caching.Memory"; version = "8.0.0"; hash = "sha256-RUQe2VgOATM9JkZ/wGm9mreKoCmOS4pPyvyJWBqMaC8="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Configuration"; version = "3.1.5"; hash = "sha256-c5mtiYTD8MS/l90h8vO+LJ+KQUjVeatKMZf3Bx+q/8Q="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Configuration"; version = "6.0.0"; hash = "sha256-SIO/Q+OD2bG+Q0EoOXRgJYzZMhahGXDG1fXZn0VUvv0="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Abstractions"; version = "3.1.5"; hash = "sha256-E0EkLtj6ZEi8V/v0DDmRPqqPkWAE4ZVCVyF077LEXA4="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Abstractions"; version = "6.0.0"; hash = "sha256-Evg+Ynj2QUa6Gz+zqF+bUyfGD0HI5A2fHmxZEXbn3HA="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Abstractions"; version = "8.0.0"; hash = "sha256-4eBpDkf7MJozTZnOwQvwcfgRKQGcNXe0K/kF+h5Rl8o="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Binder"; version = "3.1.5"; hash = "sha256-mwswBNxakF+xvZQvxFGkfNKOffZaDE3mmQqvxfO+IAw="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Binder"; version = "8.0.0"; hash = "sha256-GanfInGzzoN2bKeNwON8/Hnamr6l7RTpYLA49CNXD9Q="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.EnvironmentVariables"; version = "6.0.0"; hash = "sha256-tG3DEWURVkQHm4MlmxjE/YouTp9wQKbWs6qHH2nfgqc="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.FileExtensions"; version = "6.0.0"; hash = "sha256-PLnSa0JMfDC62OTv8sL0QFJbANE7QSnJ997ySFBS1go="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Ini"; version = "6.0.0"; hash = "sha256-5tUoqvIsWL5hfmMCpCpBW6V1tw/sMUCwfnm/7Y8LD6M="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.DependencyInjection"; version = "8.0.0"; hash = "sha256-+qIDR8hRzreCHNEDtUcPfVHQdurzWPo/mqviCH78+EQ="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.DependencyInjection.Abstractions"; version = "3.1.5"; hash = "sha256-dj+hc29ZsdbGGTSLApC3GNPBJBwPhcb5eEZeAqVCbvI="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.DependencyInjection.Abstractions"; version = "8.0.0"; hash = "sha256-75KzEGWjbRELczJpCiJub+ltNUMMbz5A/1KQU+5dgP8="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.DependencyModel"; version = "8.0.0"; hash = "sha256-qkCdwemqdZY/yIW5Xmh7Exv74XuE39T8aHGHCofoVgo="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Diagnostics.Abstractions"; version = "8.0.0"; hash = "sha256-USD5uZOaahMqi6u7owNWx/LR4EDrOwqPrAAim7iRpJY="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Features"; version = "8.0.0"; hash = "sha256-njIDmindrlR+YXy4NVjCQzkF15ikvVCz3ilOCcS4HW0="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.FileProviders.Abstractions"; version = "6.0.0"; hash = "sha256-uBjWjHKEXjZ9fDfFxMjOou3lhfTNhs1yO+e3fpWreLk="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.FileProviders.Abstractions"; version = "8.0.0"; hash = "sha256-uQSXmt47X2HGoVniavjLICbPtD2ReQOYQMgy3l0xuMU="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.FileProviders.Physical"; version = "6.0.0"; hash = "sha256-5BAQOqnaEXM2YjdrmrCinXBeZ5FKxCWtebEXMdwcbMY="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.FileSystemGlobbing"; version = "6.0.0"; hash = "sha256-RAWHjkkfvGpjc49Q0kJbZyXgU6UEq/EJ0j557sj2/iU="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Hosting.Abstractions"; version = "8.0.0"; hash = "sha256-0JBx+wwt5p1SPfO4m49KxNOXPAzAU0A+8tEc/itvpQE="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Identity.Core"; version = "8.0.7"; hash = "sha256-zPHu/A8MX/FNt7nVJO2gpzIXa1Yw23GHqLfI0IO/B+k="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Identity.Stores"; version = "8.0.7"; hash = "sha256-E6rTtrvhV9bgAMks5RHMCbT1e26ttsWDNJWyGnECSNo="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Logging"; version = "8.0.0"; hash = "sha256-Meh0Z0X7KyOEG4l0RWBcuHHihcABcvCyfUXgasmQ91o="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Logging.Abstractions"; version = "1.0.0"; hash = "sha256-asIXVFsAK7ELd/f+vLwhxYDdazqRTmf+fGJ4WFtcCeo="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Logging.Abstractions"; version = "3.1.5"; hash = "sha256-UcI6YUOIzHiexHrn82h77qngx19UeJqUzZqJ4igUIlM="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Logging.Abstractions"; version = "6.0.0"; hash = "sha256-QNqcQ3x+MOK7lXbWkCzSOWa/2QyYNbdM/OEEbWN15Sw="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Logging.Abstractions"; version = "7.0.1"; hash = "sha256-05mravm6SK0wNV3BKDTmN+8/1RxcPOM9kaUvGhjWY3c="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Logging.Abstractions"; version = "8.0.0"; hash = "sha256-Jmddjeg8U5S+iBTwRlVAVLeIHxc4yrrNgqVMOB7EjM4="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "3.1.5"; hash = "sha256-+WZV8r4siPIaizWh3UifbHulrocfFAGe+JXCfRT2GGY="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "8.0.0"; hash = "sha256-n2m4JSegQKUTlOsKLZUUHHKMq926eJ0w9N9G+I3FoFw="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "8.0.2"; hash = "sha256-AjcldddddtN/9aH9pg7ClEZycWtFHLi9IPe1GGhNQys="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Options.ConfigurationExtensions"; version = "3.1.5"; hash = "sha256-8R461IHA7hhDPQqU0s39H5nMuiFgmZ/vhq9eKaRDh4M="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.PlatformAbstractions"; version = "1.1.0"; hash = "sha256-l+nVRLM+JThXzwExIPHOdmh6N0vehrA2VXPcvcVGkmQ="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "2.2.0"; hash = "sha256-DMCTC3HW+sHaRlh/9F1sDwof+XgvVp9IzAqzlZWByn4="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "3.1.5"; hash = "sha256-Vcw5KWo/yuuTmrNyS9770PKQk76ka4FEEm1G5HWYV1g="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "6.0.0"; hash = "sha256-AgvysszpQ11AiTBJFkvSy8JnwIWTj15Pfek7T7ThUc4="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "8.0.0"; hash = "sha256-FU8qj3DR8bDdc1c+WeGZx/PCZeqqndweZM9epcpXjSo="; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.JsonWebTokens"; version = "6.6.0"; hash = "sha256-2ztdbgL1oSuinDqBZBWhYBN75zw6FtTjDa1dfGVQ5Rs="; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Logging"; version = "6.6.0"; hash = "sha256-OEspQH4bd331ELSE1AdjVWFMx12dfyFU0LwvRkjp89Y="; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Tokens"; version = "6.6.0"; hash = "sha256-0ks1h+Kq307izjdlCf4PDnYV/GnH8uyxPY6lXppeu0A="; })
+  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.0.1"; hash = "sha256-mZotlGZqtrqDSoBrZhsxFe6fuOv5/BIo0w2Z2x0zVAU="; })
+  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.1.0"; hash = "sha256-FeM40ktcObQJk4nMYShB61H/E8B7tIKfl9ObJ0IOcCM="; })
+  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "2.1.2"; hash = "sha256-gYQQO7zsqG+OtN4ywYQyfsiggS2zmxw4+cPXlK+FB5Q="; })
+  (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.0.1"; hash = "sha256-lxxw/Gy32xHi0fLgFWNj4YTFBSBkjx5l6ucmbTyf7V4="; })
+  (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.1.0"; hash = "sha256-0AqQ2gMS8iNlYkrD+BxtIg7cXMnr9xZHtKAuN4bjfaQ="; })
+  (fetchNuGet { pname = "Microsoft.Win32.Primitives"; version = "4.3.0"; hash = "sha256-mBNDmPXNTW54XLnPAUwBRvkIORFM7/j0D0I2SyQPDEg="; })
+  (fetchNuGet { pname = "Microsoft.Win32.SystemEvents"; version = "7.0.0"; hash = "sha256-i6JojctqrqfJ4Wa+BDtaKZEol26jYq5DTQHar2M9B64="; })
+  (fetchNuGet { pname = "MimeKit"; version = "3.3.0"; hash = "sha256-yAMLc3cNd1QE3NB4WinY4X0TsdniV7C1doKbTXntVGc="; })
+  (fetchNuGet { pname = "Mono.TextTemplating"; version = "2.2.1"; hash = "sha256-4TYsfc8q74P8FuDwkIWPO+VYY0mh4Hs4ZL8v0lMaBsY="; })
+  (fetchNuGet { pname = "MySqlConnector"; version = "2.3.1"; hash = "sha256-tPKi3ntuV8bFnJ88qB27NanziMHRR3Cr70NVYesXRoo="; })
+  (fetchNuGet { pname = "NBitcoin"; version = "5.0.40"; hash = "sha256-cEu9luoct9YiL80z16THezZcaHgSPf6UU4Rz5QmyH+c="; })
+  (fetchNuGet { pname = "NBitcoin"; version = "6.0.8"; hash = "sha256-pfJRCSVAdh87SmEKeAYg7TNoGpQDtf026N+V0bL/ILk="; })
+  (fetchNuGet { pname = "NBitcoin"; version = "7.0.1"; hash = "sha256-h3eenwRrdKDpN+MGIcvrxQszdtNupzdQEGuycb28eBY="; })
+  (fetchNuGet { pname = "NBitcoin"; version = "7.0.31"; hash = "sha256-sybd3AOGVlN7U6rLuWSi1kVxtBeaXb8iy786gc0CIh4="; })
+  (fetchNuGet { pname = "NBitcoin"; version = "7.0.37"; hash = "sha256-RclQZgot+Y8PZi9JEX7tgUJinkIBXs1Qgf4vGR2y4rc="; })
+  (fetchNuGet { pname = "NBitcoin.Altcoins"; version = "3.0.24"; hash = "sha256-MGxIuYtWPgSYj5JCMmZfP7u04ki/UpeN1+//gU6RsdI="; })
+  (fetchNuGet { pname = "NBitpayClient"; version = "1.0.0.39"; hash = "sha256-KkcKBcUTKFVd1OAOkQd9EAdZY58Oc8iGJcvK85rK/Ok="; })
+  (fetchNuGet { pname = "NBXplorer.Client"; version = "4.3.1"; hash = "sha256-hrgJwOoM0kD/90eUsqEK+nZLKCCItV+dQE/Gf1Gh4jc="; })
+  (fetchNuGet { pname = "NdefLibrary"; version = "4.1.0"; hash = "sha256-5gdhufJg34DtPlnhNGEZIEc7EWPqa9BGvmbCL42KDf8="; })
+  (fetchNuGet { pname = "NETStandard.Library"; version = "1.6.1"; hash = "sha256-iNan1ix7RtncGWC9AjAZ2sk70DoxOsmEOgQ10fXm4Pw="; })
+  (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.1"; hash = "sha256-K2tSVW4n4beRPzPu3rlVaBEMdGvWSv/3Q1fxaDh4Mjo="; })
+  (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.3"; hash = "sha256-hy/BieY4qxBWVVsDqqOPaLy1QobiIapkbrESm6v2PHc="; })
+  (fetchNuGet { pname = "Newtonsoft.Json.Bson"; version = "1.0.1"; hash = "sha256-qofIFqViDsdBOE/X0IvzfGUklSrULaH8MoZQ+YrcMOQ="; })
+  (fetchNuGet { pname = "Newtonsoft.Json.Bson"; version = "1.0.2"; hash = "sha256-ZUj6YFSMZp5CZtXiamw49eZmbp1iYBuNsIKNnjxcRzA="; })
+  (fetchNuGet { pname = "NicolasDorier.CommandLine"; version = "2.0.0"; hash = "sha256-LizYyIMx6I17jZd52duYcGWNgcPs88c/zWxo/ADd3D8="; })
+  (fetchNuGet { pname = "NicolasDorier.CommandLine.Configuration"; version = "2.0.0"; hash = "sha256-fDpDOVdt7xCDXXqaBnbaFvUOPaE0Sl4cLWjNkU0Cz7I="; })
+  (fetchNuGet { pname = "NicolasDorier.RateLimits"; version = "1.2.3"; hash = "sha256-1/v3+bYTyPBg7ChnrBM9CPZKSR2F9xl9d1C07sHC7KQ="; })
+  (fetchNuGet { pname = "NicolasDorier.StandardConfiguration"; version = "2.0.1"; hash = "sha256-PdNopObnA2hOiHomejN/ZYK2CK1aGXMuOnsjHyS2Mco="; })
+  (fetchNuGet { pname = "NLog"; version = "5.1.3"; hash = "sha256-ljrjt7A7NJ+3/STI0vuIuDRHVYVu6r6KfSV1xVK7CWQ="; })
+  (fetchNuGet { pname = "Npgsql"; version = "8.0.3"; hash = "sha256-weBGo/IXKI5ufixBCuWG7OqDSyIqvGV07oxrG0XnQIQ="; })
+  (fetchNuGet { pname = "Npgsql.EntityFrameworkCore.PostgreSQL"; version = "8.0.4"; hash = "sha256-T5yuMlQc/eUJtTjHygRqtEO4wKc9YQSVYDKU7ZS8WIU="; })
+  (fetchNuGet { pname = "NSec.Cryptography"; version = "20.2.0"; hash = "sha256-/Udj7zH38jfWcuBDhaEid8Sx8HkYWzMQiUijHUqUVKc="; })
+  (fetchNuGet { pname = "PeterO.Cbor"; version = "4.1.3"; hash = "sha256-1geszskkpoHWT0uBTZxLUnH57NNtUVLFU150CNeIAiE="; })
+  (fetchNuGet { pname = "PeterO.Numbers"; version = "1.6.0"; hash = "sha256-KMUdMwdMy5fu4L4ptauSuK9T7PrRvGNeMhAAk91sbhI="; })
+  (fetchNuGet { pname = "PeterO.URIUtility"; version = "1.0.0"; hash = "sha256-TLX5WAswWV6eOL/l2L0smtqJT4HCLMftrxo4KuZyMBI="; })
+  (fetchNuGet { pname = "Pomelo.EntityFrameworkCore.MySql"; version = "8.0.0-beta.2"; hash = "sha256-O8eqwVr1jCkmL+EQgOVj9Ky13eSVIl/Noil3oz9+Izk="; })
+  (fetchNuGet { pname = "Portable.BouncyCastle"; version = "1.9.0"; hash = "sha256-GOXM4TdTTodWlGzEfbMForTfTQI/ObJGnFZMSD6X8E4="; })
+  (fetchNuGet { pname = "QRCoder"; version = "1.4.3"; hash = "sha256-it4WJGJVrpmYb8YLlTLeUrTbGW8AFm2rXskW7NvCtMI="; })
+  (fetchNuGet { pname = "runtime.any.System.Collections"; version = "4.0.11"; hash = "sha256-4L3fXzSgw8UaCTvdb3cEyihka3K8JHBz/Ujsx0JdhPQ="; })
+  (fetchNuGet { pname = "runtime.any.System.Collections"; version = "4.3.0"; hash = "sha256-4PGZqyWhZ6/HCTF2KddDsbmTTjxs2oW79YfkberDZS8="; })
+  (fetchNuGet { pname = "runtime.any.System.Diagnostics.Tools"; version = "4.3.0"; hash = "sha256-8yLKFt2wQxkEf7fNfzB+cPUCjYn2qbqNgQ1+EeY2h/I="; })
+  (fetchNuGet { pname = "runtime.any.System.Diagnostics.Tracing"; version = "4.1.0"; hash = "sha256-+PJZWFl6hkqryCerWVtbG+ppIGvZf2l6fu2HWyGqMRA="; })
+  (fetchNuGet { pname = "runtime.any.System.Diagnostics.Tracing"; version = "4.3.0"; hash = "sha256-dsmTLGvt8HqRkDWP8iKVXJCS+akAzENGXKPV18W2RgI="; })
+  (fetchNuGet { pname = "runtime.any.System.Globalization"; version = "4.0.11"; hash = "sha256-BgmoUM3WsMUCjtO9KmtjPKsjYRAEVjp74KvEa8zNgAg="; })
+  (fetchNuGet { pname = "runtime.any.System.Globalization"; version = "4.3.0"; hash = "sha256-PaiITTFI2FfPylTEk7DwzfKeiA/g/aooSU1pDcdwWLU="; })
+  (fetchNuGet { pname = "runtime.any.System.Globalization.Calendars"; version = "4.3.0"; hash = "sha256-AYh39tgXJVFu8aLi9Y/4rK8yWMaza4S4eaxjfcuEEL4="; })
+  (fetchNuGet { pname = "runtime.any.System.IO"; version = "4.1.0"; hash = "sha256-ZbG7B6GOO90k/prj/Z60UGloQUrBepsvmlPQGuV0Wk0="; })
+  (fetchNuGet { pname = "runtime.any.System.IO"; version = "4.3.0"; hash = "sha256-vej7ySRhyvM3pYh/ITMdC25ivSd0WLZAaIQbYj/6HVE="; })
+  (fetchNuGet { pname = "runtime.any.System.Reflection"; version = "4.1.0"; hash = "sha256-BtdDCQLHDdAgO9qhwE0JBuUqFKc7l9On8p+VlgrQbBo="; })
+  (fetchNuGet { pname = "runtime.any.System.Reflection"; version = "4.3.0"; hash = "sha256-ns6f++lSA+bi1xXgmW1JkWFb2NaMD+w+YNTfMvyAiQk="; })
+  (fetchNuGet { pname = "runtime.any.System.Reflection.Extensions"; version = "4.3.0"; hash = "sha256-Y2AnhOcJwJVYv7Rp6Jz6ma0fpITFqJW+8rsw106K2X8="; })
+  (fetchNuGet { pname = "runtime.any.System.Reflection.Primitives"; version = "4.0.1"; hash = "sha256-H2ZzRIWLN6FbSh8+q4OXqhssn3nGRnv7/NiV3OO+uf8="; })
+  (fetchNuGet { pname = "runtime.any.System.Reflection.Primitives"; version = "4.3.0"; hash = "sha256-LkPXtiDQM3BcdYkAm5uSNOiz3uF4J45qpxn5aBiqNXQ="; })
+  (fetchNuGet { pname = "runtime.any.System.Resources.ResourceManager"; version = "4.0.1"; hash = "sha256-eZasny65yEQESxMJHOBaqJQzlrd8CIOIc1ks6+HRr8o="; })
+  (fetchNuGet { pname = "runtime.any.System.Resources.ResourceManager"; version = "4.3.0"; hash = "sha256-9EvnmZslLgLLhJ00o5MWaPuJQlbUFcUF8itGQNVkcQ4="; })
+  (fetchNuGet { pname = "runtime.any.System.Runtime"; version = "4.1.0"; hash = "sha256-FZC+BNSzSkN3rObLJJAqwW/vNnJ+PiwdvNNufuISWVY="; })
+  (fetchNuGet { pname = "runtime.any.System.Runtime"; version = "4.3.0"; hash = "sha256-qwhNXBaJ1DtDkuRacgHwnZmOZ1u9q7N8j0cWOLYOELM="; })
+  (fetchNuGet { pname = "runtime.any.System.Runtime.Handles"; version = "4.0.1"; hash = "sha256-WlmU4OzK6IpszOCuEb5pdh4dwpkuoBQTYRuT4SF+XM8="; })
+  (fetchNuGet { pname = "runtime.any.System.Runtime.Handles"; version = "4.3.0"; hash = "sha256-PQRACwnSUuxgVySO1840KvqCC9F8iI9iTzxNW0RcBS4="; })
+  (fetchNuGet { pname = "runtime.any.System.Runtime.InteropServices"; version = "4.1.0"; hash = "sha256-H9FNiCk+Qrm+15K+Rje+wnQxwUmkVx60x+FWBoGLqD4="; })
+  (fetchNuGet { pname = "runtime.any.System.Runtime.InteropServices"; version = "4.3.0"; hash = "sha256-Kaw5PnLYIiqWbsoF3VKJhy7pkpoGsUwn4ZDCKscbbzA="; })
+  (fetchNuGet { pname = "runtime.any.System.Text.Encoding"; version = "4.0.11"; hash = "sha256-pyaH3Lcuv/pEM9NSFWlLcljav/Ksnwwk7cjPEH99m1Q="; })
+  (fetchNuGet { pname = "runtime.any.System.Text.Encoding"; version = "4.3.0"; hash = "sha256-Q18B9q26MkWZx68exUfQT30+0PGmpFlDgaF0TnaIGCs="; })
+  (fetchNuGet { pname = "runtime.any.System.Text.Encoding.Extensions"; version = "4.3.0"; hash = "sha256-6MYj0RmLh4EVqMtO/MRqBi0HOn5iG4x9JimgCCJ+EFM="; })
+  (fetchNuGet { pname = "runtime.any.System.Threading.Tasks"; version = "4.0.11"; hash = "sha256-c/8eunlNexFpzZ+GvNF0p1hi5Xo0VPo7LnkhjRO47eM="; })
+  (fetchNuGet { pname = "runtime.any.System.Threading.Tasks"; version = "4.3.0"; hash = "sha256-agdOM0NXupfHbKAQzQT8XgbI9B8hVEh+a/2vqeHctg4="; })
+  (fetchNuGet { pname = "runtime.any.System.Threading.Timer"; version = "4.3.0"; hash = "sha256-BgHxXCIbicVZtpgMimSXixhFC3V+p5ODqeljDjO8hCs="; })
+  (fetchNuGet { pname = "runtime.debian.8-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-LXUPLX3DJxsU1Pd3UwjO1PO9NM2elNEDXeu2Mu/vNps="; })
+  (fetchNuGet { pname = "runtime.fedora.23-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-qeSqaUI80+lqw5MK4vMpmO0CZaqrmYktwp6L+vQAb0I="; })
+  (fetchNuGet { pname = "runtime.fedora.24-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-SrHqT9wrCBsxILWtaJgGKd6Odmxm8/Mh7Kh0CUkZVzA="; })
+  (fetchNuGet { pname = "runtime.native.System"; version = "4.0.0"; hash = "sha256-bmaM0ovT4X4aqDJOR255Yda/u3fmHZskU++lMnsy894="; })
+  (fetchNuGet { pname = "runtime.native.System"; version = "4.3.0"; hash = "sha256-ZBZaodnjvLXATWpXXakFgcy6P+gjhshFXmglrL5xD5Y="; })
+  (fetchNuGet { pname = "runtime.native.System.IO.Compression"; version = "4.3.0"; hash = "sha256-DWnXs4vlKoU6WxxvCArTJupV6sX3iBbZh8SbqfHace8="; })
+  (fetchNuGet { pname = "runtime.native.System.Net.Http"; version = "4.3.0"; hash = "sha256-c556PyheRwpYhweBjSfIwEyZHnAUB8jWioyKEcp/2dg="; })
+  (fetchNuGet { pname = "runtime.native.System.Net.Security"; version = "4.3.0"; hash = "sha256-I8vYld/7WtU2/rrD4XfSRgpO/DY3qXghG14VQjiU2DY="; })
+  (fetchNuGet { pname = "runtime.native.System.Security.Cryptography"; version = "4.0.0"; hash = "sha256-6Q8eYzC32BbGIiTHoQaE6B3cD81vYQcH5SCswYRSp0w="; })
+  (fetchNuGet { pname = "runtime.native.System.Security.Cryptography.Apple"; version = "4.3.0"; hash = "sha256-2IhBv0i6pTcOyr8FFIyfPEaaCHUmJZ8DYwLUwJ+5waw="; })
+  (fetchNuGet { pname = "runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-Jy01KhtcCl2wjMpZWH+X3fhHcVn+SyllWFY8zWlz/6I="; })
+  (fetchNuGet { pname = "runtime.opensuse.13.2-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-wyv00gdlqf8ckxEdV7E+Ql9hJIoPcmYEuyeWb5Oz3mM="; })
+  (fetchNuGet { pname = "runtime.opensuse.42.1-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-zi+b4sCFrA9QBiSGDD7xPV27r3iHGlV99gpyVUjRmc4="; })
+  (fetchNuGet { pname = "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.Apple"; version = "4.3.0"; hash = "sha256-serkd4A7F6eciPiPJtUyJyxzdAtupEcWIZQ9nptEzIM="; })
+  (fetchNuGet { pname = "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-gybQU6mPgaWV3rBG2dbH6tT3tBq8mgze3PROdsuWnX0="; })
+  (fetchNuGet { pname = "runtime.rhel.7-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-VsP72GVveWnGUvS/vjOQLv1U80H2K8nZ4fDAmI61Hm4="; })
+  (fetchNuGet { pname = "runtime.ubuntu.14.04-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-4yKGa/IrNCKuQ3zaDzILdNPD32bNdy6xr5gdJigyF5g="; })
+  (fetchNuGet { pname = "runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-HmdJhhRsiVoOOCcUvAwdjpMRiyuSwdcgEv2j9hxi+Zc="; })
+  (fetchNuGet { pname = "runtime.ubuntu.16.10-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-pVFUKuPPIx0edQKjzRon3zKq8zhzHEzko/lc01V/jdw="; })
+  (fetchNuGet { pname = "runtime.unix.Microsoft.Win32.Primitives"; version = "4.3.0"; hash = "sha256-LZb23lRXzr26tRS5aA0xyB08JxiblPDoA7HBvn6awXg="; })
+  (fetchNuGet { pname = "runtime.unix.System.Console"; version = "4.3.0"; hash = "sha256-AHkdKShTRHttqfMjmi+lPpTuCrM5vd/WRy6Kbtie190="; })
+  (fetchNuGet { pname = "runtime.unix.System.Diagnostics.Debug"; version = "4.0.11"; hash = "sha256-TTzJP6sR0/mDbbU3+ySnt9LVEcPPLfiAzxnfTaJazRY="; })
+  (fetchNuGet { pname = "runtime.unix.System.Diagnostics.Debug"; version = "4.3.0"; hash = "sha256-ReoazscfbGH+R6s6jkg5sIEHWNEvjEoHtIsMbpc7+tI="; })
+  (fetchNuGet { pname = "runtime.unix.System.IO.FileSystem"; version = "4.3.0"; hash = "sha256-Pf4mRl6YDK2x2KMh0WdyNgv0VUNdSKVDLlHqozecy5I="; })
+  (fetchNuGet { pname = "runtime.unix.System.Net.Primitives"; version = "4.3.0"; hash = "sha256-pHJ+I6i16MV6m77uhTC6GPY6jWGReE3SSP3fVB59ti0="; })
+  (fetchNuGet { pname = "runtime.unix.System.Net.Sockets"; version = "4.3.0"; hash = "sha256-IvgOeA2JuBjKl5yAVGjPYMPDzs9phb3KANs95H9v1w4="; })
+  (fetchNuGet { pname = "runtime.unix.System.Private.Uri"; version = "4.0.1"; hash = "sha256-1Q50COfWkU4/y9eBWj0jPDp3qvy19vRCZnDKQthrhUU="; })
+  (fetchNuGet { pname = "runtime.unix.System.Private.Uri"; version = "4.3.0"; hash = "sha256-c5tXWhE/fYbJVl9rXs0uHh3pTsg44YD1dJvyOA0WoMs="; })
+  (fetchNuGet { pname = "runtime.unix.System.Runtime.Extensions"; version = "4.1.0"; hash = "sha256-xB8TkAadhz7gi8Ag3+uYtLdfjtxO8dCLrd/FzU7jLHQ="; })
+  (fetchNuGet { pname = "runtime.unix.System.Runtime.Extensions"; version = "4.3.0"; hash = "sha256-l8S9gt6dk3qYG6HYonHtdlYtBKyPb29uQ6NDjmrt3V4="; })
+  (fetchNuGet { pname = "Serilog"; version = "3.1.1"; hash = "sha256-L263y8jkn7dNFD2jAUK6mgvyRTqFe39i1tRhVZsNZTI="; })
+  (fetchNuGet { pname = "Serilog.AspNetCore"; version = "8.0.0"; hash = "sha256-0V4BmXmKeSy5ND5aONhSW3iL/+fZ2jB781HdooJlOjw="; })
+  (fetchNuGet { pname = "Serilog.Extensions.Hosting"; version = "8.0.0"; hash = "sha256-OEVkEQoONawJF+SXeyqqgU0OGp9ubtt9aXT+rC25j4E="; })
+  (fetchNuGet { pname = "Serilog.Extensions.Logging"; version = "8.0.0"; hash = "sha256-GoWxCpkdahMvYd7ZrhwBxxTyjHGcs9ENNHJCp0la6iA="; })
+  (fetchNuGet { pname = "Serilog.Formatting.Compact"; version = "2.0.0"; hash = "sha256-c3STGleyMijY4QnxPuAz/NkJs1r+TZAPjlmAKLF4+3g="; })
+  (fetchNuGet { pname = "Serilog.Settings.Configuration"; version = "8.0.0"; hash = "sha256-JQ39fvhOFSUHE6r9DXJvLaZI+Lk7AYzuskQu3ux+hQg="; })
+  (fetchNuGet { pname = "Serilog.Sinks.Console"; version = "5.0.0"; hash = "sha256-UOVlegJLhs0vK1ml2DZCjFE5roDRZsGCAqD/53ZaZWI="; })
+  (fetchNuGet { pname = "Serilog.Sinks.Debug"; version = "2.0.0"; hash = "sha256-/PLVAE33lTdUEXdahkI5ddFiGZufWnvfsOodQsFB8sQ="; })
+  (fetchNuGet { pname = "Serilog.Sinks.File"; version = "5.0.1-dev-00968"; hash = "sha256-gXrvlnNVi2TKtsFfjqoPkGZS3JM+p6vjvy3p2by/4A4="; })
+  (fetchNuGet { pname = "SocketIOClient"; version = "3.0.8"; hash = "sha256-m49zZSppF8Gce6biFUateXdf8b07evZbLsX7H6LVbMw="; })
+  (fetchNuGet { pname = "SQLitePCLRaw.bundle_e_sqlite3"; version = "2.1.6"; hash = "sha256-dZD/bZsYXjOu46ZH5Y/wgh0uhHOqIxC+S+0ecKhr718="; })
+  (fetchNuGet { pname = "SQLitePCLRaw.core"; version = "2.1.6"; hash = "sha256-RxWjm52PdmMV98dgDy0BCpF988+BssRZUgALLv7TH/E="; })
+  (fetchNuGet { pname = "SQLitePCLRaw.lib.e_sqlite3"; version = "2.1.6"; hash = "sha256-uHt5d+SFUkSd6WD7Tg0J3e8eVoxy/FM/t4PAkc9PJT0="; })
+  (fetchNuGet { pname = "SQLitePCLRaw.provider.e_sqlite3"; version = "2.1.6"; hash = "sha256-zHc/YZsd72eXlI8ba1tv58HZWUIiyjJaxq2CCP1hQe8="; })
+  (fetchNuGet { pname = "SSH.NET"; version = "2023.0.0"; hash = "sha256-YiAfBOu8KLKPFk4humKCe+Ne79ppxdODKXgjbcni8po="; })
+  (fetchNuGet { pname = "SshNet.Security.Cryptography"; version = "1.3.0"; hash = "sha256-kDpV7/n4plAPh+FqsPbCA/kFHHfmJGsJDTQg2wRLOfk="; })
+  (fetchNuGet { pname = "System.AppContext"; version = "4.3.0"; hash = "sha256-yg95LNQOwFlA1tWxXdQkVyJqT4AnoDc+ACmrNvzGiZg="; })
+  (fetchNuGet { pname = "System.Buffers"; version = "4.3.0"; hash = "sha256-XqZWb4Kd04960h4U9seivjKseGA/YEIpdplfHYHQ9jk="; })
+  (fetchNuGet { pname = "System.Buffers"; version = "4.5.1"; hash = "sha256-wws90sfi9M7kuCPWkv1CEYMJtCqx9QB/kj0ymlsNaxI="; })
+  (fetchNuGet { pname = "System.CodeDom"; version = "4.4.0"; hash = "sha256-L1xyspJ8pDJNVPYKl+FMGf4Zwm0tlqtAyQCNW6pT6/0="; })
+  (fetchNuGet { pname = "System.Collections"; version = "4.0.11"; hash = "sha256-puoFMkx4Z55C1XPxNw3np8nzNGjH+G24j43yTIsDRL0="; })
+  (fetchNuGet { pname = "System.Collections"; version = "4.3.0"; hash = "sha256-afY7VUtD6w/5mYqrce8kQrvDIfS2GXDINDh73IjxJKc="; })
+  (fetchNuGet { pname = "System.Collections.Concurrent"; version = "4.0.12"; hash = "sha256-zIEM7AB4SyE9u6G8+o+gCLLwkgi6+3rHQVPdn/dEwB8="; })
+  (fetchNuGet { pname = "System.Collections.Concurrent"; version = "4.3.0"; hash = "sha256-KMY5DfJnDeIsa13DpqvyN8NkReZEMAFnlmNglVoFIXI="; })
+  (fetchNuGet { pname = "System.Collections.Immutable"; version = "5.0.0"; hash = "sha256-GdwSIjLMM0uVfE56VUSLVNgpW0B//oCeSFj8/hSlbM8="; })
+  (fetchNuGet { pname = "System.Collections.Immutable"; version = "6.0.0"; hash = "sha256-DKEbpFqXCIEfqp9p3ezqadn5b/S1YTk32/EQK+tEScs="; })
+  (fetchNuGet { pname = "System.Collections.Immutable"; version = "8.0.0"; hash = "sha256-F7OVjKNwpqbUh8lTidbqJWYi476nsq9n+6k0+QVRo3w="; })
+  (fetchNuGet { pname = "System.Composition"; version = "6.0.0"; hash = "sha256-H5TnnxOwihI0VyRuykbOWuKFSCWNN+MUEYyloa328Nw="; })
+  (fetchNuGet { pname = "System.Composition.AttributedModel"; version = "6.0.0"; hash = "sha256-03DR8ecEHSKfgzwuTuxtsRW0Gb7aQtDS4LAYChZdGdc="; })
+  (fetchNuGet { pname = "System.Composition.Convention"; version = "6.0.0"; hash = "sha256-a3DZS8CT2kV8dVpGxHKoP5wHVKsT+kiPJixckpYfdQo="; })
+  (fetchNuGet { pname = "System.Composition.Hosting"; version = "6.0.0"; hash = "sha256-fpoh6WBNmaHEHszwlBR/TNjd85lwesfM7ZkQhqYtLy4="; })
+  (fetchNuGet { pname = "System.Composition.Runtime"; version = "6.0.0"; hash = "sha256-nGZvg2xYhhazAjOjhWqltBue+hROKP0IOiFGP8yMBW8="; })
+  (fetchNuGet { pname = "System.Composition.TypedParts"; version = "6.0.0"; hash = "sha256-4uAETfmL1CvGjHajzWowsEmJgTKnuFC8u9lbYPzAN3k="; })
+  (fetchNuGet { pname = "System.Configuration.ConfigurationManager"; version = "7.0.0"; hash = "sha256-SgBexTTjRn23uuXvkzO0mz0qOfA23MiS4Wv+qepMLZE="; })
+  (fetchNuGet { pname = "System.Console"; version = "4.3.0"; hash = "sha256-Xh3PPBZr0pDbDaK8AEHbdGz7ePK6Yi1ZyRWI1JM6mbo="; })
+  (fetchNuGet { pname = "System.Diagnostics.Debug"; version = "4.0.11"; hash = "sha256-P+rSQJVoN6M56jQbs76kZ9G3mAWFdtF27P/RijN8sj4="; })
+  (fetchNuGet { pname = "System.Diagnostics.Debug"; version = "4.3.0"; hash = "sha256-fkA79SjPbSeiEcrbbUsb70u9B7wqbsdM9s1LnoKj0gM="; })
+  (fetchNuGet { pname = "System.Diagnostics.DiagnosticSource"; version = "4.3.0"; hash = "sha256-OFJRb0ygep0Z3yDBLwAgM/Tkfs4JCDtsNhwDH9cd1Xw="; })
+  (fetchNuGet { pname = "System.Diagnostics.DiagnosticSource"; version = "8.0.0"; hash = "sha256-+aODaDEQMqla5RYZeq0Lh66j+xkPYxykrVvSCmJQ+Vs="; })
+  (fetchNuGet { pname = "System.Diagnostics.EventLog"; version = "7.0.0"; hash = "sha256-aSK1lQN9a/guffT8jUW+zKc5bOIvKRcds/XbVk766Jo="; })
+  (fetchNuGet { pname = "System.Diagnostics.Tools"; version = "4.3.0"; hash = "sha256-gVOv1SK6Ape0FQhCVlNOd9cvQKBvMxRX9K0JPVi8w0Y="; })
+  (fetchNuGet { pname = "System.Diagnostics.Tracing"; version = "4.1.0"; hash = "sha256-JA0jJcLbU3zh52ub3zweob2EVHvxOqiC6SCYHrY5WbQ="; })
+  (fetchNuGet { pname = "System.Diagnostics.Tracing"; version = "4.3.0"; hash = "sha256-hCETZpHHGVhPYvb4C0fh4zs+8zv4GPoixagkLZjpa9Q="; })
+  (fetchNuGet { pname = "System.Drawing.Common"; version = "7.0.0"; hash = "sha256-t4FBgTMhuOA5FA23fg0WQOGuH0njV7hJXST/Ln/Znks="; })
+  (fetchNuGet { pname = "System.Formats.Asn1"; version = "6.0.0"; hash = "sha256-KaMHgIRBF7Nf3VwOo+gJS1DcD+41cJDPWFh+TDQ8ee8="; })
+  (fetchNuGet { pname = "System.Globalization"; version = "4.0.11"; hash = "sha256-rbSgc2PIEc2c2rN6LK3qCREAX3DqA2Nq1WcLrZYsDBw="; })
+  (fetchNuGet { pname = "System.Globalization"; version = "4.3.0"; hash = "sha256-caL0pRmFSEsaoeZeWN5BTQtGrAtaQPwFi8YOZPZG5rI="; })
+  (fetchNuGet { pname = "System.Globalization.Calendars"; version = "4.3.0"; hash = "sha256-uNOD0EOVFgnS2fMKvMiEtI9aOw00+Pfy/H+qucAQlPc="; })
+  (fetchNuGet { pname = "System.Globalization.Extensions"; version = "4.3.0"; hash = "sha256-mmJWA27T0GRVuFP9/sj+4TrR4GJWrzNIk2PDrbr7RQk="; })
+  (fetchNuGet { pname = "System.IdentityModel.Tokens.Jwt"; version = "6.6.0"; hash = "sha256-AaKAwjUAoo4pKusKA/4N59NJytevneN7wnq68AZRJp4="; })
+  (fetchNuGet { pname = "System.Interactive.Async"; version = "3.1.1"; hash = "sha256-0Cof7GZZqLkREQWbG/9+bn5riOtQFv2bFktYgB8QOA4="; })
+  (fetchNuGet { pname = "System.IO"; version = "4.1.0"; hash = "sha256-V6oyQFwWb8NvGxAwvzWnhPxy9dKOfj/XBM3tEC5aHrw="; })
+  (fetchNuGet { pname = "System.IO"; version = "4.3.0"; hash = "sha256-ruynQHekFP5wPrDiVyhNiRIXeZ/I9NpjK5pU+HPDiRY="; })
+  (fetchNuGet { pname = "System.IO.Compression"; version = "4.3.0"; hash = "sha256-f5PrQlQgj5Xj2ZnHxXW8XiOivaBvfqDao9Sb6AVinyA="; })
+  (fetchNuGet { pname = "System.IO.Compression.ZipFile"; version = "4.3.0"; hash = "sha256-WQl+JgWs+GaRMeiahTFUbrhlXIHapzcpTFXbRvAtvvs="; })
+  (fetchNuGet { pname = "System.IO.FileSystem"; version = "4.3.0"; hash = "sha256-vNIYnvlayuVj0WfRfYKpDrhDptlhp1pN8CYmlVd2TXw="; })
+  (fetchNuGet { pname = "System.IO.FileSystem.Primitives"; version = "4.3.0"; hash = "sha256-LMnfg8Vwavs9cMnq9nNH8IWtAtSfk0/Fy4s4Rt9r1kg="; })
+  (fetchNuGet { pname = "System.IO.Pipelines"; version = "6.0.3"; hash = "sha256-v+FOmjRRKlDtDW6+TfmyMiiki010YGVTa0EwXu9X7ck="; })
+  (fetchNuGet { pname = "System.IO.Pipelines"; version = "8.0.0"; hash = "sha256-LdpB1s4vQzsOODaxiKstLks57X9DTD5D6cPx8DE1wwE="; })
+  (fetchNuGet { pname = "System.Linq"; version = "4.1.0"; hash = "sha256-ZQpFtYw5N1F1aX0jUK3Tw+XvM5tnlnshkTCNtfVA794="; })
+  (fetchNuGet { pname = "System.Linq"; version = "4.3.0"; hash = "sha256-R5uiSL3l6a3XrXSSL6jz+q/PcyVQzEAByiuXZNSqD/A="; })
+  (fetchNuGet { pname = "System.Linq.Expressions"; version = "4.3.0"; hash = "sha256-+3pvhZY7rip8HCbfdULzjlC9FPZFpYoQxhkcuFm2wk8="; })
+  (fetchNuGet { pname = "System.Memory"; version = "4.5.1"; hash = "sha256-7JhQNSvE6JigM1qmmhzOX3NiZ6ek82R4whQNb+FpBzg="; })
+  (fetchNuGet { pname = "System.Memory"; version = "4.5.3"; hash = "sha256-Cvl7RbRbRu9qKzeRBWjavUkseT2jhZBUWV1SPipUWFk="; })
+  (fetchNuGet { pname = "System.Memory"; version = "4.5.4"; hash = "sha256-3sCEfzO4gj5CYGctl9ZXQRRhwAraMQfse7yzKoRe65E="; })
+  (fetchNuGet { pname = "System.Memory"; version = "4.5.5"; hash = "sha256-EPQ9o1Kin7KzGI5O3U3PUQAZTItSbk9h/i4rViN3WiI="; })
+  (fetchNuGet { pname = "System.Net.Http"; version = "4.3.0"; hash = "sha256-UoBB7WPDp2Bne/fwxKF0nE8grJ6FzTMXdT/jfsphj8Q="; })
+  (fetchNuGet { pname = "System.Net.NameResolution"; version = "4.3.0"; hash = "sha256-eGZwCBExWsnirWBHyp2sSSSXp6g7I6v53qNmwPgtJ5c="; })
+  (fetchNuGet { pname = "System.Net.Primitives"; version = "4.3.0"; hash = "sha256-MY7Z6vOtFMbEKaLW9nOSZeAjcWpwCtdO7/W1mkGZBzE="; })
+  (fetchNuGet { pname = "System.Net.Security"; version = "4.3.0"; hash = "sha256-B7laE1z1+ldbo6JkjlDjZynG5JiMZ/3uNHPHMP6LRak="; })
+  (fetchNuGet { pname = "System.Net.Sockets"; version = "4.3.0"; hash = "sha256-il7dr5VT/QWDg/0cuh+4Es2u8LY//+qqiY9BZmYxSus="; })
+  (fetchNuGet { pname = "System.Net.WebHeaderCollection"; version = "4.3.0"; hash = "sha256-wpRP3D/2YjpFmqU7Q42L/+/hChEVMlwU1sjysGVrQ1c="; })
+  (fetchNuGet { pname = "System.Net.WebSockets"; version = "4.3.0"; hash = "sha256-l3h3cF1cCC9zMhWLKSDnZBZvFADUd0Afe2+iAwBA0r0="; })
+  (fetchNuGet { pname = "System.Net.WebSockets.Client"; version = "4.3.2"; hash = "sha256-MwNKwIIpBJhC4Na6EYWMmVyPCa064Yp1aL0opx1FfoA="; })
+  (fetchNuGet { pname = "System.ObjectModel"; version = "4.3.0"; hash = "sha256-gtmRkWP2Kwr3nHtDh0yYtce38z1wrGzb6fjm4v8wN6Q="; })
+  (fetchNuGet { pname = "System.Private.Uri"; version = "4.0.1"; hash = "sha256-MjVaZHx8DUFnVUxOEEaU9GxF6EyEXbcuI1V7yRXEp0w="; })
+  (fetchNuGet { pname = "System.Private.Uri"; version = "4.3.0"; hash = "sha256-fVfgcoP4AVN1E5wHZbKBIOPYZ/xBeSIdsNF+bdukIRM="; })
+  (fetchNuGet { pname = "System.Reflection"; version = "4.1.0"; hash = "sha256-idZHGH2Yl/hha1CM4VzLhsaR8Ljo/rV7TYe7mwRJSMs="; })
+  (fetchNuGet { pname = "System.Reflection"; version = "4.3.0"; hash = "sha256-NQSZRpZLvtPWDlvmMIdGxcVuyUnw92ZURo0hXsEshXY="; })
+  (fetchNuGet { pname = "System.Reflection.Emit"; version = "4.3.0"; hash = "sha256-5LhkDmhy2FkSxulXR+bsTtMzdU3VyyuZzsxp7/DwyIU="; })
+  (fetchNuGet { pname = "System.Reflection.Emit.ILGeneration"; version = "4.3.0"; hash = "sha256-mKRknEHNls4gkRwrEgi39B+vSaAz/Gt3IALtS98xNnA="; })
+  (fetchNuGet { pname = "System.Reflection.Emit.Lightweight"; version = "4.3.0"; hash = "sha256-rKx4a9yZKcajloSZHr4CKTVJ6Vjh95ni+zszPxWjh2I="; })
+  (fetchNuGet { pname = "System.Reflection.Extensions"; version = "4.3.0"; hash = "sha256-mMOCYzUenjd4rWIfq7zIX9PFYk/daUyF0A8l1hbydAk="; })
+  (fetchNuGet { pname = "System.Reflection.Metadata"; version = "5.0.0"; hash = "sha256-Wo+MiqhcP9dQ6NuFGrQTw6hpbJORFwp+TBNTq2yhGp8="; })
+  (fetchNuGet { pname = "System.Reflection.Metadata"; version = "6.0.1"; hash = "sha256-id27sU4qIEIpgKenO5b4IHt6L1XuNsVe4TR9TKaLWDo="; })
+  (fetchNuGet { pname = "System.Reflection.Metadata"; version = "8.0.0"; hash = "sha256-dQGC30JauIDWNWXMrSNOJncVa1umR1sijazYwUDdSIE="; })
+  (fetchNuGet { pname = "System.Reflection.Primitives"; version = "4.0.1"; hash = "sha256-SFSfpWEyCBMAOerrMCOiKnpT+UAWTvRcmoRquJR6Vq0="; })
+  (fetchNuGet { pname = "System.Reflection.Primitives"; version = "4.3.0"; hash = "sha256-5ogwWB4vlQTl3jjk1xjniG2ozbFIjZTL9ug0usZQuBM="; })
+  (fetchNuGet { pname = "System.Reflection.TypeExtensions"; version = "4.3.0"; hash = "sha256-4U4/XNQAnddgQIHIJq3P2T80hN0oPdU2uCeghsDTWng="; })
+  (fetchNuGet { pname = "System.Resources.ResourceManager"; version = "4.0.1"; hash = "sha256-cZ2/3/fczLjEpn6j3xkgQV9ouOVjy4Kisgw5xWw9kSw="; })
+  (fetchNuGet { pname = "System.Resources.ResourceManager"; version = "4.3.0"; hash = "sha256-idiOD93xbbrbwwSnD4mORA9RYi/D/U48eRUsn/WnWGo="; })
+  (fetchNuGet { pname = "System.Runtime"; version = "4.1.0"; hash = "sha256-FViNGM/4oWtlP6w0JC0vJU+k9efLKZ+yaXrnEeabDQo="; })
+  (fetchNuGet { pname = "System.Runtime"; version = "4.3.0"; hash = "sha256-51813WXpBIsuA6fUtE5XaRQjcWdQ2/lmEokJt97u0Rg="; })
+  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "4.5.1"; hash = "sha256-Lucrfpuhz72Ns+DOS7MjuNT2KWgi+m4bJkg87kqXmfU="; })
+  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "4.7.0"; hash = "sha256-pORThFo85P8TrmfZCCPIXysVPcV2nW8hRlO6z4jVJps="; })
+  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "5.0.0"; hash = "sha256-neARSpLPUzPxEKhJRwoBzhPxK+cKIitLx7WBYncsYgo="; })
+  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "6.0.0"; hash = "sha256-bEG1PnDp7uKYz/OgLOWs3RWwQSVYm+AnPwVmAmcgp2I="; })
+  (fetchNuGet { pname = "System.Runtime.Extensions"; version = "4.1.0"; hash = "sha256-X7DZ5CbPY7jHs20YZ7bmcXs9B5Mxptu/HnBUvUnNhGc="; })
+  (fetchNuGet { pname = "System.Runtime.Extensions"; version = "4.3.0"; hash = "sha256-wLDHmozr84v1W2zYCWYxxj0FR0JDYHSVRaRuDm0bd/o="; })
+  (fetchNuGet { pname = "System.Runtime.Handles"; version = "4.0.1"; hash = "sha256-j2QgVO9ZOjv7D1het98CoFpjoYgxjupuIhuBUmLLH7w="; })
+  (fetchNuGet { pname = "System.Runtime.Handles"; version = "4.3.0"; hash = "sha256-KJ5aXoGpB56Y6+iepBkdpx/AfaJDAitx4vrkLqR7gms="; })
+  (fetchNuGet { pname = "System.Runtime.InteropServices"; version = "4.1.0"; hash = "sha256-QceAYlJvkPRJc/+5jR+wQpNNI3aqGySWWSO30e/FfQY="; })
+  (fetchNuGet { pname = "System.Runtime.InteropServices"; version = "4.3.0"; hash = "sha256-8sDH+WUJfCR+7e4nfpftj/+lstEiZixWUBueR2zmHgI="; })
+  (fetchNuGet { pname = "System.Runtime.InteropServices.RuntimeInformation"; version = "4.3.0"; hash = "sha256-MYpl6/ZyC6hjmzWRIe+iDoldOMW1mfbwXsduAnXIKGA="; })
+  (fetchNuGet { pname = "System.Runtime.Numerics"; version = "4.3.0"; hash = "sha256-P5jHCgMbgFMYiONvzmaKFeOqcAIDPu/U8bOVrNPYKqc="; })
+  (fetchNuGet { pname = "System.Security.Claims"; version = "4.3.0"; hash = "sha256-Fua/rDwAqq4UByRVomAxMPmDBGd5eImRqHVQIeSxbks="; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Algorithms"; version = "4.3.0"; hash = "sha256-tAJvNSlczYBJ3Ed24Ae27a55tq/n4D3fubNQdwcKWA8="; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Cng"; version = "4.3.0"; hash = "sha256-u17vy6wNhqok91SrVLno2M1EzLHZm6VMca85xbVChsw="; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Cng"; version = "4.7.0"; hash = "sha256-MvVSJhAojDIvrpuyFmcSVRSZPl3dRYOI9hSptbA+6QA="; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Csp"; version = "4.3.0"; hash = "sha256-oefdTU/Z2PWU9nlat8uiRDGq/PGZoSPRgkML11pmvPQ="; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Encoding"; version = "4.3.0"; hash = "sha256-Yuge89N6M+NcblcvXMeyHZ6kZDfwBv3LPMDiF8HhJss="; })
+  (fetchNuGet { pname = "System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-DL+D2sc2JrQiB4oAcUggTFyD8w3aLEjJfod5JPe+Oz4="; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Pkcs"; version = "6.0.0"; hash = "sha256-xMSJGgn+UGGe9eGNaZ04OsyiFO7fYtDfz7zsya/9AOE="; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Primitives"; version = "4.3.0"; hash = "sha256-fnFi7B3SnVj5a+BbgXnbjnGNvWrCEU6Hp/wjsjWz318="; })
+  (fetchNuGet { pname = "System.Security.Cryptography.ProtectedData"; version = "7.0.0"; hash = "sha256-aS5fVYrujUCkAnth2QQPp8knG169BsK/BX8lqaHRSZc="; })
+  (fetchNuGet { pname = "System.Security.Cryptography.X509Certificates"; version = "4.3.0"; hash = "sha256-MG3V/owDh273GCUPsGGraNwaVpcydupl3EtPXj6TVG0="; })
+  (fetchNuGet { pname = "System.Security.Permissions"; version = "7.0.0"; hash = "sha256-DOFoX+AKRmrkllykHheR8FfUXYx/Ph+I/HYuReQydXI="; })
+  (fetchNuGet { pname = "System.Security.Principal"; version = "4.3.0"; hash = "sha256-rjudVUHdo8pNJg2EVEn0XxxwNo5h2EaYo+QboPkXlYk="; })
+  (fetchNuGet { pname = "System.Security.Principal.Windows"; version = "4.3.0"; hash = "sha256-mbdLVUcEwe78p3ZnB6jYsizNEqxMaCAWI3tEQNhRQAE="; })
+  (fetchNuGet { pname = "System.Text.Encoding"; version = "4.0.11"; hash = "sha256-PEailOvG05CVgPTyKLtpAgRydlSHmtd5K0Y8GSHY2Lc="; })
+  (fetchNuGet { pname = "System.Text.Encoding"; version = "4.3.0"; hash = "sha256-GctHVGLZAa/rqkBNhsBGnsiWdKyv6VDubYpGkuOkBLg="; })
+  (fetchNuGet { pname = "System.Text.Encoding.CodePages"; version = "4.5.1"; hash = "sha256-PIhkv59IXjyiuefdhKxS9hQfEwO9YWRuNudpo53HQfw="; })
+  (fetchNuGet { pname = "System.Text.Encoding.CodePages"; version = "6.0.0"; hash = "sha256-nGc2A6XYnwqGcq8rfgTRjGr+voISxNe/76k2K36coj4="; })
+  (fetchNuGet { pname = "System.Text.Encoding.Extensions"; version = "4.3.0"; hash = "sha256-vufHXg8QAKxHlujPHHcrtGwAqFmsCD6HKjfDAiHyAYc="; })
+  (fetchNuGet { pname = "System.Text.Encodings.Web"; version = "7.0.0"; hash = "sha256-tF8qt9GZh/nPy0mEnj6nKLG4Lldpoi/D8xM5lv2CoYQ="; })
+  (fetchNuGet { pname = "System.Text.Encodings.Web"; version = "8.0.0"; hash = "sha256-IUQkQkV9po1LC0QsqrilqwNzPvnc+4eVvq+hCvq8fvE="; })
+  (fetchNuGet { pname = "System.Text.Json"; version = "7.0.2"; hash = "sha256-bkfxuc3XPxtYcOJTGRMc/AkJiyIU+fTLK7PxtbuN3sQ="; })
+  (fetchNuGet { pname = "System.Text.Json"; version = "8.0.0"; hash = "sha256-XFcCHMW1u2/WujlWNHaIWkbW1wn8W4kI0QdrwPtWmow="; })
+  (fetchNuGet { pname = "System.Text.RegularExpressions"; version = "4.3.0"; hash = "sha256-VLCk1D1kcN2wbAe3d0YQM/PqCsPHOuqlBY1yd2Yo+K0="; })
+  (fetchNuGet { pname = "System.Threading"; version = "4.0.11"; hash = "sha256-mob1Zv3qLQhQ1/xOLXZmYqpniNUMCfn02n8ZkaAhqac="; })
+  (fetchNuGet { pname = "System.Threading"; version = "4.3.0"; hash = "sha256-ZDQ3dR4pzVwmaqBg4hacZaVenQ/3yAF/uV7BXZXjiWc="; })
+  (fetchNuGet { pname = "System.Threading.Channels"; version = "6.0.0"; hash = "sha256-klGYnsyrjvXaGeqgfnMf/dTAMNtcHY+zM4Xh6v2JfuE="; })
+  (fetchNuGet { pname = "System.Threading.Channels"; version = "8.0.0"; hash = "sha256-c5TYoLNXDLroLIPnlfyMHk7nZ70QAckc/c7V199YChg="; })
+  (fetchNuGet { pname = "System.Threading.Tasks"; version = "4.0.11"; hash = "sha256-5SLxzFg1df6bTm2t09xeI01wa5qQglqUwwJNlQPJIVs="; })
+  (fetchNuGet { pname = "System.Threading.Tasks"; version = "4.3.0"; hash = "sha256-Z5rXfJ1EXp3G32IKZGiZ6koMjRu0n8C1NGrwpdIen4w="; })
+  (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.3.0"; hash = "sha256-X2hQ5j+fxcmnm88Le/kSavjiGOmkcumBGTZKBLvorPc="; })
+  (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.5.4"; hash = "sha256-owSpY8wHlsUXn5xrfYAiu847L6fAKethlvYx97Ri1ng="; })
+  (fetchNuGet { pname = "System.Threading.ThreadPool"; version = "4.3.0"; hash = "sha256-wW0QdvssRoaOfQLazTGSnwYTurE4R8FxDx70pYkL+gg="; })
+  (fetchNuGet { pname = "System.Threading.Timer"; version = "4.3.0"; hash = "sha256-pmhslmhQhP32TWbBzoITLZ4BoORBqYk25OWbru04p9s="; })
+  (fetchNuGet { pname = "System.Windows.Extensions"; version = "7.0.0"; hash = "sha256-yRivIiENFKMxbSh8SZ/fmKjshwBdFXzbKmZcfDZwKYc="; })
+  (fetchNuGet { pname = "System.Xml.ReaderWriter"; version = "4.3.0"; hash = "sha256-QQ8KgU0lu4F5Unh+TbechO//zaAGZ4MfgvW72Cn1hzA="; })
+  (fetchNuGet { pname = "System.Xml.XDocument"; version = "4.3.0"; hash = "sha256-rWtdcmcuElNOSzCehflyKwHkDRpiOhJJs8CeQ0l1CCI="; })
+  (fetchNuGet { pname = "TwentyTwenty.Storage"; version = "2.12.1"; hash = "sha256-CxMzodzIZq/0WEbesCHI32C2bwkJkxkkcQDCwX5vgVQ="; })
+  (fetchNuGet { pname = "TwentyTwenty.Storage.Amazon"; version = "2.12.1"; hash = "sha256-8Jpb7L1yi8NmhjVG/xnFHAPaeT5Jk9RxDryMOOGe2Q4="; })
+  (fetchNuGet { pname = "TwentyTwenty.Storage.Azure"; version = "2.12.1"; hash = "sha256-m25ormO60RiC/rNfzjSKFDXCLcXqDvlzr//VifJ9B4M="; })
+  (fetchNuGet { pname = "TwentyTwenty.Storage.Google"; version = "2.12.1"; hash = "sha256-F/4OZxllKpnW7beZSW5qp+oOHradj31bggPcvNI9GjU="; })
+  (fetchNuGet { pname = "TwentyTwenty.Storage.Local"; version = "2.12.1"; hash = "sha256-qEqPzie96dHRpv7s+3CYxRCSYFOqtk2WQuePHRrHsv4="; })
+  (fetchNuGet { pname = "WindowsAzure.Storage"; version = "9.3.3"; hash = "sha256-3bXdQwkgMx4cSliwLv+aVsRm5BwZPgSB9dsXJC1YYJE="; })
+  (fetchNuGet { pname = "YamlDotNet"; version = "8.0.0"; hash = "sha256-9VInbvbrc9su5rcSyT4/t0wBSfLDpHvSvAy6WqMMGSY="; })
 ]
diff --git a/pkgs/applications/blockchains/nbxplorer/default.nix b/pkgs/applications/blockchains/nbxplorer/default.nix
index 5f8c0110402e..170316494a8a 100644
--- a/pkgs/applications/blockchains/nbxplorer/default.nix
+++ b/pkgs/applications/blockchains/nbxplorer/default.nix
@@ -6,13 +6,13 @@
 
 buildDotnetModule rec {
   pname = "nbxplorer";
-  version = "2.5.2";
+  version = "2.5.6";
 
   src = fetchFromGitHub {
     owner = "dgarage";
     repo = "NBXplorer";
     rev = "v${version}";
-    sha256 = "sha256-zfL+VoDfICUtw02KeRghaq3XPOa/YnSh8orhqmo3Auo=";
+    sha256 = "sha256-GPquY5kfn08TUCum/INdHPasx8BWK2mf+PQlSgTl4iw=";
   };
 
   projectFile = "NBXplorer/NBXplorer.csproj";
diff --git a/pkgs/applications/blockchains/nbxplorer/deps.nix b/pkgs/applications/blockchains/nbxplorer/deps.nix
index cdf73d5de09a..441a54528783 100644
--- a/pkgs/applications/blockchains/nbxplorer/deps.nix
+++ b/pkgs/applications/blockchains/nbxplorer/deps.nix
@@ -2,221 +2,219 @@
 # Please dont edit it manually, your changes might get overwritten!
 
 { fetchNuGet }: [
-  (fetchNuGet { pname = "Dapper"; version = "2.1.28"; sha256 = "15vpa9k11rr1mh5vb6hdchy8hqa03lqs83w19s3kxzh1089yl9m8"; })
-  (fetchNuGet { pname = "DBTrie"; version = "1.0.39"; sha256 = "0kbvl3kf73hrh1w2n3d2wshlxpqsv1pwydhwv2wxigmvs70fn1xp"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.JsonPatch"; version = "8.0.1"; sha256 = "1jgkjna579pw5fx1pjbz0dc2lil9i3djf9c8lkb4vxrzrwmrdw31"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.Mvc.NewtonsoftJson"; version = "8.0.1"; sha256 = "05pfp1kq24aqc56dbx2i2s71rbypc1czidhd6nvah0r3pn91rfny"; })
-  (fetchNuGet { pname = "Microsoft.Azure.Amqp"; version = "2.4.9"; sha256 = "15kvklhfl17713kwin8p71lcxq2jx87bk1d8gsl597z3w6l4cqma"; })
-  (fetchNuGet { pname = "Microsoft.Azure.ServiceBus"; version = "4.2.1"; sha256 = "0akxqds078p7djd5g95i9dh4wrlfarabkq2ybn614cqdgl4z0is5"; })
-  (fetchNuGet { pname = "Microsoft.Azure.Services.AppAuthentication"; version = "1.0.3"; sha256 = "0as64agcsilwgbvwx7iw3abdxyp9cbfpczbagjz49mqmmgnqp899"; })
-  (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.3.0"; sha256 = "0gw297dgkh0al1zxvgvncqs0j15lsna9l1wpqas4rflmys440xvb"; })
-  (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.7.0"; sha256 = "0gd67zlw554j098kabg887b5a6pq9kzavpa3jjy5w53ccjzjfy8j"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Configuration"; version = "6.0.0"; sha256 = "1zdyai2rzngmsp3706d12qrdk315c1s3ja218fzb3nc3wd1vz0s8"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Abstractions"; version = "6.0.0"; sha256 = "0w6wwxv12nbc3sghvr68847wc9skkdgsicrz3fx4chgng1i3xy0j"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.EnvironmentVariables"; version = "6.0.0"; sha256 = "19w2vxliz1xangbach3hkx72x2pxqhc9n9c3kc3l8mhicl8w6vdl"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.FileExtensions"; version = "6.0.0"; sha256 = "02nna984iwnyyz4jjh9vs405nlj0yk1g5vz4v2x30z2c89mx5f9w"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Ini"; version = "6.0.0"; sha256 = "18qg1f7yvgvrgsq40cgc1yvpb9av84ma80k3grhvwn1cyam2img6"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.DependencyInjection.Abstractions"; version = "8.0.0"; sha256 = "1zw0bpp5742jzx03wvqc8csnvsbgdqi0ls9jfc5i2vd3cl8b74pg"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.FileProviders.Abstractions"; version = "6.0.0"; sha256 = "1fbqmfapxdz77drcv1ndyj2ybvd2rv4c9i9pgiykcpl4fa6dc65q"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.FileProviders.Physical"; version = "6.0.0"; sha256 = "1ikc3kf325xig6njbi2aj5kmww4xlaq9lsrpc8v764fsm4x10474"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.FileSystemGlobbing"; version = "6.0.0"; sha256 = "09gyyv4fwy9ys84z3aq4lm9y09b7bd1d4l4gfdinmg0z9678f1a4"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Logging.Abstractions"; version = "1.0.0"; sha256 = "1sh9bidmhy32gkz6fkli79mxv06546ybrzppfw5v2aq0bda1ghka"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Logging.Abstractions"; version = "6.0.0"; sha256 = "0b75fmins171zi6bfdcq1kcvyrirs8n91mknjnxy4c3ygi1rrnj0"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Logging.Abstractions"; version = "8.0.0"; sha256 = "1klcqhg3hk55hb6vmjiq2wgqidsl81aldw0li2z98lrwx26msrr6"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "6.0.0"; sha256 = "1kjiw6s4yfz9gm7mx3wkhp06ghnbs95icj9hi505shz9rjrg42q2"; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Clients.ActiveDirectory"; version = "3.14.2"; sha256 = "0g9a2z1qjxd71lqqghp0a542xk9jkvz951bbnnnw43is4hlnqncq"; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.JsonWebTokens"; version = "5.4.0"; sha256 = "0a5fn0p10dmkwa7vvbq28xw78aq33xm7c82l7vhla95n0lr178n8"; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Logging"; version = "5.4.0"; sha256 = "1idlpyg3q3syam6aflfbnsa7iql685mjralr1cnfpryf00lm59v0"; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Tokens"; version = "5.4.0"; sha256 = "0gpdh5rs0p97zm41pphha8n3ccd50b1iszikj3917f111khpw8l0"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.0.1"; sha256 = "01al6cfxp68dscl15z7rxfw9zvhm64dncsw09a1vmdkacsa2v6lr"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.0.2"; sha256 = "17rrj0awknxx6rpdxr7yijdxqdmbbpdlcf2nsadjbd4d2gw7dck0"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.1.0"; sha256 = "08vh1r12g6ykjygq5d3vq09zylgb84l63k49jc4v8faw9g93iqqm"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.0.1"; sha256 = "0ppdkwy6s9p7x9jix3v4402wb171cdiibq7js7i13nxpdky7074p"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.1.0"; sha256 = "193xwf33fbm0ni3idxzbr5fdq3i2dlfgihsac9jj7whj0gd902nh"; })
-  (fetchNuGet { pname = "Microsoft.Win32.Primitives"; version = "4.0.1"; sha256 = "1n8ap0cmljbqskxpf8fjzn7kh1vvlndsa75k01qig26mbw97k2q7"; })
-  (fetchNuGet { pname = "Microsoft.Win32.Primitives"; version = "4.3.0"; sha256 = "0j0c1wj4ndj21zsgivsc24whiya605603kxrbiw6wkfdync464wq"; })
-  (fetchNuGet { pname = "Microsoft.Win32.Registry"; version = "4.3.0"; sha256 = "1gxyzxam8163vk1kb6xzxjj4iwspjsz9zhgn1w9rjzciphaz0ig7"; })
-  (fetchNuGet { pname = "NBitcoin"; version = "7.0.34"; sha256 = "0hw69gcmkxyz6y06c10hjmjm3avrpzc0lhn2n0k5fspnsh4bnrkz"; })
-  (fetchNuGet { pname = "NBitcoin.Altcoins"; version = "3.0.23"; sha256 = "0nr8yryixhip7ffqlr584j8pfvjwggng23m0h0mad3liv3hxhb7k"; })
-  (fetchNuGet { pname = "NETStandard.Library"; version = "1.6.1"; sha256 = "1z70wvsx2d847a2cjfii7b83pjfs34q05gb037fdjikv5kbagml8"; })
-  (fetchNuGet { pname = "Newtonsoft.Json"; version = "10.0.3"; sha256 = "06vy67bkshclpz69kps4vgzc9h2cgg41c8vlqmdbwclfky7c4haq"; })
-  (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.1"; sha256 = "0fijg0w6iwap8gvzyjnndds0q4b8anwxxvik7y8vgq97dram4srb"; })
-  (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.3"; sha256 = "0xrwysmrn4midrjal8g2hr1bbg38iyisl0svamb11arqws4w2bw7"; })
-  (fetchNuGet { pname = "Newtonsoft.Json.Bson"; version = "1.0.2"; sha256 = "0c27bhy9x3c2n26inq32kmp6drpm71n6mqnmcr19wrlcaihglj35"; })
-  (fetchNuGet { pname = "NicolasDorier.CommandLine"; version = "2.0.0"; sha256 = "0gywvl0gqs3crlzwgwzcqf0qsrbhk3dxjycpimxqvs1ihg4dhb1f"; })
-  (fetchNuGet { pname = "NicolasDorier.CommandLine.Configuration"; version = "2.0.0"; sha256 = "1cng096r3kb85lf5wjill4yhxx8nv9v0d6ksbn1i1vvdawwl6fkw"; })
-  (fetchNuGet { pname = "NicolasDorier.StandardConfiguration"; version = "2.0.0"; sha256 = "0058dx34ja2idw468bmw7l3w21wr2am6yx57sqp7llhjl5ayy0wv"; })
-  (fetchNuGet { pname = "Npgsql"; version = "8.0.2"; sha256 = "0w1hm3bjh1vfnkzflp1x8bd4d723mpr4y6gb6ga79v5kkf09cmm2"; })
-  (fetchNuGet { pname = "RabbitMQ.Client"; version = "5.1.2"; sha256 = "195nxmnva1z2p0ahvn0kswv4d39f5bdy2sl3cxcvfziamc21xrmd"; })
-  (fetchNuGet { pname = "runtime.any.System.Collections"; version = "4.3.0"; sha256 = "0bv5qgm6vr47ynxqbnkc7i797fdi8gbjjxii173syrx14nmrkwg0"; })
-  (fetchNuGet { pname = "runtime.any.System.Diagnostics.Tools"; version = "4.3.0"; sha256 = "1wl76vk12zhdh66vmagni66h5xbhgqq7zkdpgw21jhxhvlbcl8pk"; })
-  (fetchNuGet { pname = "runtime.any.System.Diagnostics.Tracing"; version = "4.3.0"; sha256 = "00j6nv2xgmd3bi347k00m7wr542wjlig53rmj28pmw7ddcn97jbn"; })
-  (fetchNuGet { pname = "runtime.any.System.Globalization"; version = "4.3.0"; sha256 = "1daqf33hssad94lamzg01y49xwndy2q97i2lrb7mgn28656qia1x"; })
-  (fetchNuGet { pname = "runtime.any.System.Globalization.Calendars"; version = "4.3.0"; sha256 = "1ghhhk5psqxcg6w88sxkqrc35bxcz27zbqm2y5p5298pv3v7g201"; })
-  (fetchNuGet { pname = "runtime.any.System.IO"; version = "4.3.0"; sha256 = "0l8xz8zn46w4d10bcn3l4yyn4vhb3lrj2zw8llvz7jk14k4zps5x"; })
-  (fetchNuGet { pname = "runtime.any.System.Reflection"; version = "4.3.0"; sha256 = "02c9h3y35pylc0zfq3wcsvc5nqci95nrkq0mszifc0sjx7xrzkly"; })
-  (fetchNuGet { pname = "runtime.any.System.Reflection.Extensions"; version = "4.3.0"; sha256 = "0zyri97dfc5vyaz9ba65hjj1zbcrzaffhsdlpxc9bh09wy22fq33"; })
-  (fetchNuGet { pname = "runtime.any.System.Reflection.Primitives"; version = "4.3.0"; sha256 = "0x1mm8c6iy8rlxm8w9vqw7gb7s1ljadrn049fmf70cyh42vdfhrf"; })
-  (fetchNuGet { pname = "runtime.any.System.Resources.ResourceManager"; version = "4.3.0"; sha256 = "03kickal0iiby82wa5flar18kyv82s9s6d4xhk5h4bi5kfcyfjzl"; })
-  (fetchNuGet { pname = "runtime.any.System.Runtime"; version = "4.3.0"; sha256 = "1cqh1sv3h5j7ixyb7axxbdkqx6cxy00p4np4j91kpm492rf4s25b"; })
-  (fetchNuGet { pname = "runtime.any.System.Runtime.Handles"; version = "4.3.0"; sha256 = "0bh5bi25nk9w9xi8z23ws45q5yia6k7dg3i4axhfqlnj145l011x"; })
-  (fetchNuGet { pname = "runtime.any.System.Runtime.InteropServices"; version = "4.3.0"; sha256 = "0c3g3g3jmhlhw4klrc86ka9fjbl7i59ds1fadsb2l8nqf8z3kb19"; })
-  (fetchNuGet { pname = "runtime.any.System.Text.Encoding"; version = "4.3.0"; sha256 = "0aqqi1v4wx51h51mk956y783wzags13wa7mgqyclacmsmpv02ps3"; })
-  (fetchNuGet { pname = "runtime.any.System.Text.Encoding.Extensions"; version = "4.3.0"; sha256 = "0lqhgqi0i8194ryqq6v2gqx0fb86db2gqknbm0aq31wb378j7ip8"; })
-  (fetchNuGet { pname = "runtime.any.System.Threading.Tasks"; version = "4.3.0"; sha256 = "03mnvkhskbzxddz4hm113zsch1jyzh2cs450dk3rgfjp8crlw1va"; })
-  (fetchNuGet { pname = "runtime.any.System.Threading.Timer"; version = "4.3.0"; sha256 = "0aw4phrhwqz9m61r79vyfl5la64bjxj8l34qnrcwb28v49fg2086"; })
-  (fetchNuGet { pname = "runtime.debian.8-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "16rnxzpk5dpbbl1x354yrlsbvwylrq456xzpsha1n9y3glnhyx9d"; })
-  (fetchNuGet { pname = "runtime.fedora.23-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0hkg03sgm2wyq8nqk6dbm9jh5vcq57ry42lkqdmfklrw89lsmr59"; })
-  (fetchNuGet { pname = "runtime.fedora.24-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0c2p354hjx58xhhz7wv6div8xpi90sc6ibdm40qin21bvi7ymcaa"; })
-  (fetchNuGet { pname = "runtime.native.System"; version = "4.0.0"; sha256 = "1ppk69xk59ggacj9n7g6fyxvzmk1g5p4fkijm0d7xqfkig98qrkf"; })
-  (fetchNuGet { pname = "runtime.native.System"; version = "4.3.0"; sha256 = "15hgf6zaq9b8br2wi1i3x0zvmk410nlmsmva9p0bbg73v6hml5k4"; })
-  (fetchNuGet { pname = "runtime.native.System.IO.Compression"; version = "4.3.0"; sha256 = "1vvivbqsk6y4hzcid27pqpm5bsi6sc50hvqwbcx8aap5ifrxfs8d"; })
-  (fetchNuGet { pname = "runtime.native.System.Net.Http"; version = "4.0.1"; sha256 = "1hgv2bmbaskx77v8glh7waxws973jn4ah35zysnkxmf0196sfxg6"; })
-  (fetchNuGet { pname = "runtime.native.System.Net.Http"; version = "4.3.0"; sha256 = "1n6rgz5132lcibbch1qlf0g9jk60r0kqv087hxc0lisy50zpm7kk"; })
-  (fetchNuGet { pname = "runtime.native.System.Net.Security"; version = "4.3.0"; sha256 = "0dnqjhw445ay3chpia9p6vy4w2j6s9vy3hxszqvdanpvvyaxijr3"; })
-  (fetchNuGet { pname = "runtime.native.System.Security.Cryptography"; version = "4.0.0"; sha256 = "0k57aa2c3b10wl3hfqbgrl7xq7g8hh3a3ir44b31dn5p61iiw3z9"; })
-  (fetchNuGet { pname = "runtime.native.System.Security.Cryptography.Apple"; version = "4.3.0"; sha256 = "1b61p6gw1m02cc1ry996fl49liiwky6181dzr873g9ds92zl326q"; })
-  (fetchNuGet { pname = "runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "18pzfdlwsg2nb1jjjjzyb5qlgy6xjxzmhnfaijq5s2jw3cm3ab97"; })
-  (fetchNuGet { pname = "runtime.opensuse.13.2-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0qyynf9nz5i7pc26cwhgi8j62ps27sqmf78ijcfgzab50z9g8ay3"; })
-  (fetchNuGet { pname = "runtime.opensuse.42.1-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "1klrs545awhayryma6l7g2pvnp9xy4z0r1i40r80zb45q3i9nbyf"; })
-  (fetchNuGet { pname = "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.Apple"; version = "4.3.0"; sha256 = "10yc8jdrwgcl44b4g93f1ds76b176bajd3zqi2faf5rvh1vy9smi"; })
-  (fetchNuGet { pname = "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0zcxjv5pckplvkg0r6mw3asggm7aqzbdjimhvsasb0cgm59x09l3"; })
-  (fetchNuGet { pname = "runtime.rhel.7-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0vhynn79ih7hw7cwjazn87rm9z9fj0rvxgzlab36jybgcpcgphsn"; })
-  (fetchNuGet { pname = "runtime.ubuntu.14.04-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "160p68l2c7cqmyqjwxydcvgw7lvl1cr0znkw8fp24d1by9mqc8p3"; })
-  (fetchNuGet { pname = "runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "15zrc8fgd8zx28hdghcj5f5i34wf3l6bq5177075m2bc2j34jrqy"; })
-  (fetchNuGet { pname = "runtime.ubuntu.16.10-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "1p4dgxax6p7rlgj4q73k73rslcnz4wdcv8q2flg1s8ygwcm58ld5"; })
-  (fetchNuGet { pname = "runtime.unix.Microsoft.Win32.Primitives"; version = "4.3.0"; sha256 = "0y61k9zbxhdi0glg154v30kkq7f8646nif8lnnxbvkjpakggd5id"; })
-  (fetchNuGet { pname = "runtime.unix.System.Console"; version = "4.3.0"; sha256 = "1pfpkvc6x2if8zbdzg9rnc5fx51yllprl8zkm5npni2k50lisy80"; })
-  (fetchNuGet { pname = "runtime.unix.System.Diagnostics.Debug"; version = "4.3.0"; sha256 = "1lps7fbnw34bnh3lm31gs5c0g0dh7548wfmb8zz62v0zqz71msj5"; })
-  (fetchNuGet { pname = "runtime.unix.System.IO.FileSystem"; version = "4.3.0"; sha256 = "14nbkhvs7sji5r1saj2x8daz82rnf9kx28d3v2qss34qbr32dzix"; })
-  (fetchNuGet { pname = "runtime.unix.System.Net.Primitives"; version = "4.3.0"; sha256 = "0bdnglg59pzx9394sy4ic66kmxhqp8q8bvmykdxcbs5mm0ipwwm4"; })
-  (fetchNuGet { pname = "runtime.unix.System.Net.Sockets"; version = "4.3.0"; sha256 = "03npdxzy8gfv035bv1b9rz7c7hv0rxl5904wjz51if491mw0xy12"; })
-  (fetchNuGet { pname = "runtime.unix.System.Private.Uri"; version = "4.3.0"; sha256 = "1jx02q6kiwlvfksq1q9qr17fj78y5v6mwsszav4qcz9z25d5g6vk"; })
-  (fetchNuGet { pname = "runtime.unix.System.Runtime.Extensions"; version = "4.3.0"; sha256 = "0pnxxmm8whx38dp6yvwgmh22smknxmqs5n513fc7m4wxvs1bvi4p"; })
-  (fetchNuGet { pname = "System.AppContext"; version = "4.3.0"; sha256 = "1649qvy3dar900z3g817h17nl8jp4ka5vcfmsr05kh0fshn7j3ya"; })
-  (fetchNuGet { pname = "System.Buffers"; version = "4.3.0"; sha256 = "0fgns20ispwrfqll4q1zc1waqcmylb3zc50ys9x8zlwxh9pmd9jy"; })
-  (fetchNuGet { pname = "System.Collections"; version = "4.0.11"; sha256 = "1ga40f5lrwldiyw6vy67d0sg7jd7ww6kgwbksm19wrvq9hr0bsm6"; })
-  (fetchNuGet { pname = "System.Collections"; version = "4.3.0"; sha256 = "19r4y64dqyrq6k4706dnyhhw7fs24kpp3awak7whzss39dakpxk9"; })
-  (fetchNuGet { pname = "System.Collections.Concurrent"; version = "4.0.12"; sha256 = "07y08kvrzpak873pmyxs129g1ch8l27zmg51pcyj2jvq03n0r0fc"; })
-  (fetchNuGet { pname = "System.Collections.Concurrent"; version = "4.3.0"; sha256 = "0wi10md9aq33jrkh2c24wr2n9hrpyamsdhsxdcnf43b7y86kkii8"; })
-  (fetchNuGet { pname = "System.Collections.NonGeneric"; version = "4.3.0"; sha256 = "07q3k0hf3mrcjzwj8fwk6gv3n51cb513w4mgkfxzm3i37sc9kz7k"; })
-  (fetchNuGet { pname = "System.Collections.Specialized"; version = "4.3.0"; sha256 = "1sdwkma4f6j85m3dpb53v9vcgd0zyc9jb33f8g63byvijcj39n20"; })
-  (fetchNuGet { pname = "System.ComponentModel"; version = "4.3.0"; sha256 = "0986b10ww3nshy30x9sjyzm0jx339dkjxjj3401r3q0f6fx2wkcb"; })
-  (fetchNuGet { pname = "System.ComponentModel.Primitives"; version = "4.3.0"; sha256 = "1svfmcmgs0w0z9xdw2f2ps05rdxmkxxhf0l17xk9l1l8xfahkqr0"; })
-  (fetchNuGet { pname = "System.ComponentModel.TypeConverter"; version = "4.3.0"; sha256 = "17ng0p7v3nbrg3kycz10aqrrlw4lz9hzhws09pfh8gkwicyy481x"; })
-  (fetchNuGet { pname = "System.Console"; version = "4.3.0"; sha256 = "1flr7a9x920mr5cjsqmsy9wgnv3lvd0h1g521pdr1lkb2qycy7ay"; })
-  (fetchNuGet { pname = "System.Diagnostics.Debug"; version = "4.0.11"; sha256 = "0gmjghrqmlgzxivd2xl50ncbglb7ljzb66rlx8ws6dv8jm0d5siz"; })
-  (fetchNuGet { pname = "System.Diagnostics.Debug"; version = "4.3.0"; sha256 = "00yjlf19wjydyr6cfviaph3vsjzg3d5nvnya26i2fvfg53sknh3y"; })
-  (fetchNuGet { pname = "System.Diagnostics.DiagnosticSource"; version = "4.5.1"; sha256 = "1j8dgilsgd0n7y87wq1cdlnwck96wijhbyhdp4d01l1gzm3074c1"; })
-  (fetchNuGet { pname = "System.Diagnostics.Process"; version = "4.3.0"; sha256 = "0g4prsbkygq8m21naqmcp70f24a1ksyix3dihb1r1f71lpi3cfj7"; })
-  (fetchNuGet { pname = "System.Diagnostics.Tools"; version = "4.3.0"; sha256 = "0in3pic3s2ddyibi8cvgl102zmvp9r9mchh82ns9f0ms4basylw1"; })
-  (fetchNuGet { pname = "System.Diagnostics.Tracing"; version = "4.1.0"; sha256 = "1d2r76v1x610x61ahfpigda89gd13qydz6vbwzhpqlyvq8jj6394"; })
-  (fetchNuGet { pname = "System.Diagnostics.Tracing"; version = "4.3.0"; sha256 = "1m3bx6c2s958qligl67q7grkwfz3w53hpy7nc97mh6f7j5k168c4"; })
-  (fetchNuGet { pname = "System.Dynamic.Runtime"; version = "4.3.0"; sha256 = "1d951hrvrpndk7insiag80qxjbf2y0y39y8h5hnq9612ws661glk"; })
-  (fetchNuGet { pname = "System.Globalization"; version = "4.0.11"; sha256 = "070c5jbas2v7smm660zaf1gh0489xanjqymkvafcs4f8cdrs1d5d"; })
-  (fetchNuGet { pname = "System.Globalization"; version = "4.3.0"; sha256 = "1cp68vv683n6ic2zqh2s1fn4c2sd87g5hpp6l4d4nj4536jz98ki"; })
-  (fetchNuGet { pname = "System.Globalization.Calendars"; version = "4.0.1"; sha256 = "0bv0alrm2ck2zk3rz25lfyk9h42f3ywq77mx1syl6vvyncnpg4qh"; })
-  (fetchNuGet { pname = "System.Globalization.Calendars"; version = "4.3.0"; sha256 = "1xwl230bkakzzkrggy1l1lxmm3xlhk4bq2pkv790j5lm8g887lxq"; })
-  (fetchNuGet { pname = "System.Globalization.Extensions"; version = "4.3.0"; sha256 = "02a5zfxavhv3jd437bsncbhd2fp1zv4gxzakp1an9l6kdq1mcqls"; })
-  (fetchNuGet { pname = "System.IdentityModel.Tokens.Jwt"; version = "5.4.0"; sha256 = "05f91fjn054bwphmbbg7c38ipl4i81v73j232jgcq6y16dx6ifyc"; })
-  (fetchNuGet { pname = "System.IO"; version = "4.1.0"; sha256 = "1g0yb8p11vfd0kbkyzlfsbsp5z44lwsvyc0h3dpw6vqnbi035ajp"; })
-  (fetchNuGet { pname = "System.IO"; version = "4.3.0"; sha256 = "05l9qdrzhm4s5dixmx68kxwif4l99ll5gqmh7rqgw554fx0agv5f"; })
-  (fetchNuGet { pname = "System.IO.Compression"; version = "4.3.0"; sha256 = "084zc82yi6yllgda0zkgl2ys48sypiswbiwrv7irb3r0ai1fp4vz"; })
-  (fetchNuGet { pname = "System.IO.Compression.ZipFile"; version = "4.3.0"; sha256 = "1yxy5pq4dnsm9hlkg9ysh5f6bf3fahqqb6p8668ndy5c0lk7w2ar"; })
-  (fetchNuGet { pname = "System.IO.FileSystem"; version = "4.0.1"; sha256 = "0kgfpw6w4djqra3w5crrg8xivbanh1w9dh3qapb28q060wb9flp1"; })
-  (fetchNuGet { pname = "System.IO.FileSystem"; version = "4.3.0"; sha256 = "0z2dfrbra9i6y16mm9v1v6k47f0fm617vlb7s5iybjjsz6g1ilmw"; })
-  (fetchNuGet { pname = "System.IO.FileSystem.Primitives"; version = "4.0.1"; sha256 = "1s0mniajj3lvbyf7vfb5shp4ink5yibsx945k6lvxa96r8la1612"; })
-  (fetchNuGet { pname = "System.IO.FileSystem.Primitives"; version = "4.3.0"; sha256 = "0j6ndgglcf4brg2lz4wzsh1av1gh8xrzdsn9f0yznskhqn1xzj9c"; })
-  (fetchNuGet { pname = "System.Linq"; version = "4.1.0"; sha256 = "1ppg83svb39hj4hpp5k7kcryzrf3sfnm08vxd5sm2drrijsla2k5"; })
-  (fetchNuGet { pname = "System.Linq"; version = "4.3.0"; sha256 = "1w0gmba695rbr80l1k2h4mrwzbzsyfl2z4klmpbsvsg5pm4a56s7"; })
-  (fetchNuGet { pname = "System.Linq.Expressions"; version = "4.3.0"; sha256 = "0ky2nrcvh70rqq88m9a5yqabsl4fyd17bpr63iy2mbivjs2nyypv"; })
-  (fetchNuGet { pname = "System.Net.Http"; version = "4.3.0"; sha256 = "1i4gc757xqrzflbk7kc5ksn20kwwfjhw9w7pgdkn19y3cgnl302j"; })
-  (fetchNuGet { pname = "System.Net.NameResolution"; version = "4.3.0"; sha256 = "15r75pwc0rm3vvwsn8rvm2krf929mjfwliv0mpicjnii24470rkq"; })
-  (fetchNuGet { pname = "System.Net.Primitives"; version = "4.0.11"; sha256 = "10xzzaynkzkakp7jai1ik3r805zrqjxiz7vcagchyxs2v26a516r"; })
-  (fetchNuGet { pname = "System.Net.Primitives"; version = "4.3.0"; sha256 = "0c87k50rmdgmxx7df2khd9qj7q35j9rzdmm2572cc55dygmdk3ii"; })
-  (fetchNuGet { pname = "System.Net.Security"; version = "4.3.0"; sha256 = "1aa5igz31ivk6kpgsrwck3jccab7wd88wr52lddmgypmbh9mmf87"; })
-  (fetchNuGet { pname = "System.Net.Sockets"; version = "4.3.0"; sha256 = "1ssa65k6chcgi6mfmzrznvqaxk8jp0gvl77xhf1hbzakjnpxspla"; })
-  (fetchNuGet { pname = "System.Net.WebHeaderCollection"; version = "4.0.1"; sha256 = "10bxpxj80c4z00z3ksrfswspq9qqsw8jwxcbzvymzycb97m9b55q"; })
-  (fetchNuGet { pname = "System.Net.WebHeaderCollection"; version = "4.3.0"; sha256 = "0ms3ddjv1wn8sqa5qchm245f3vzzif6l6fx5k92klqpn7zf4z562"; })
-  (fetchNuGet { pname = "System.Net.WebSockets"; version = "4.0.0"; sha256 = "04jdhq9dp43x1m6hddn06sq74skc50i1yk6hip0224pj6fwxa4k2"; })
-  (fetchNuGet { pname = "System.Net.WebSockets"; version = "4.3.0"; sha256 = "1gfj800078kggcgl0xyl00a6y5k4wwh2k2qm69rjy22wbmq7fy4p"; })
-  (fetchNuGet { pname = "System.Net.WebSockets.Client"; version = "4.0.2"; sha256 = "0p8m9h94h9za8281hngpi6awka6v26s1gkk0npmxzqq4ilas6b4s"; })
-  (fetchNuGet { pname = "System.Net.WebSockets.Client"; version = "4.3.2"; sha256 = "103y8lfsfa5xd1sqmq9sml4qyp4rij2i3fnnw119h119hb04l0rk"; })
-  (fetchNuGet { pname = "System.ObjectModel"; version = "4.3.0"; sha256 = "191p63zy5rpqx7dnrb3h7prvgixmk168fhvvkkvhlazncf8r3nc2"; })
-  (fetchNuGet { pname = "System.Private.DataContractSerialization"; version = "4.1.1"; sha256 = "1xk9wvgzipssp1393nsg4n16zbr5481k03nkdlj954hzq5jkx89r"; })
-  (fetchNuGet { pname = "System.Private.DataContractSerialization"; version = "4.3.0"; sha256 = "06fjipqvjp559rrm825x6pll8gimdj9x1n3larigh5hsm584gndw"; })
-  (fetchNuGet { pname = "System.Private.Uri"; version = "4.3.0"; sha256 = "04r1lkdnsznin0fj4ya1zikxiqr0h6r6a1ww2dsm60gqhdrf0mvx"; })
-  (fetchNuGet { pname = "System.Reflection"; version = "4.1.0"; sha256 = "1js89429pfw79mxvbzp8p3q93il6rdff332hddhzi5wqglc4gml9"; })
-  (fetchNuGet { pname = "System.Reflection"; version = "4.3.0"; sha256 = "0xl55k0mw8cd8ra6dxzh974nxif58s3k1rjv1vbd7gjbjr39j11m"; })
-  (fetchNuGet { pname = "System.Reflection.Emit"; version = "4.0.1"; sha256 = "0ydqcsvh6smi41gyaakglnv252625hf29f7kywy2c70nhii2ylqp"; })
-  (fetchNuGet { pname = "System.Reflection.Emit"; version = "4.3.0"; sha256 = "11f8y3qfysfcrscjpjym9msk7lsfxkk4fmz9qq95kn3jd0769f74"; })
-  (fetchNuGet { pname = "System.Reflection.Emit.ILGeneration"; version = "4.0.1"; sha256 = "1pcd2ig6bg144y10w7yxgc9d22r7c7ww7qn1frdfwgxr24j9wvv0"; })
-  (fetchNuGet { pname = "System.Reflection.Emit.ILGeneration"; version = "4.3.0"; sha256 = "0w1n67glpv8241vnpz1kl14sy7zlnw414aqwj4hcx5nd86f6994q"; })
-  (fetchNuGet { pname = "System.Reflection.Emit.Lightweight"; version = "4.0.1"; sha256 = "1s4b043zdbx9k39lfhvsk68msv1nxbidhkq6nbm27q7sf8xcsnxr"; })
-  (fetchNuGet { pname = "System.Reflection.Emit.Lightweight"; version = "4.3.0"; sha256 = "0ql7lcakycrvzgi9kxz1b3lljd990az1x6c4jsiwcacrvimpib5c"; })
-  (fetchNuGet { pname = "System.Reflection.Extensions"; version = "4.0.1"; sha256 = "0m7wqwq0zqq9gbpiqvgk3sr92cbrw7cp3xn53xvw7zj6rz6fdirn"; })
-  (fetchNuGet { pname = "System.Reflection.Extensions"; version = "4.3.0"; sha256 = "02bly8bdc98gs22lqsfx9xicblszr2yan7v2mmw3g7hy6miq5hwq"; })
-  (fetchNuGet { pname = "System.Reflection.Primitives"; version = "4.0.1"; sha256 = "1bangaabhsl4k9fg8khn83wm6yial8ik1sza7401621jc6jrym28"; })
-  (fetchNuGet { pname = "System.Reflection.Primitives"; version = "4.3.0"; sha256 = "04xqa33bld78yv5r93a8n76shvc8wwcdgr1qvvjh959g3rc31276"; })
-  (fetchNuGet { pname = "System.Reflection.TypeExtensions"; version = "4.1.0"; sha256 = "1bjli8a7sc7jlxqgcagl9nh8axzfl11f4ld3rjqsyxc516iijij7"; })
-  (fetchNuGet { pname = "System.Reflection.TypeExtensions"; version = "4.3.0"; sha256 = "0y2ssg08d817p0vdag98vn238gyrrynjdj4181hdg780sif3ykp1"; })
-  (fetchNuGet { pname = "System.Resources.ResourceManager"; version = "4.0.1"; sha256 = "0b4i7mncaf8cnai85jv3wnw6hps140cxz8vylv2bik6wyzgvz7bi"; })
-  (fetchNuGet { pname = "System.Resources.ResourceManager"; version = "4.3.0"; sha256 = "0sjqlzsryb0mg4y4xzf35xi523s4is4hz9q4qgdvlvgivl7qxn49"; })
-  (fetchNuGet { pname = "System.Runtime"; version = "4.1.0"; sha256 = "02hdkgk13rvsd6r9yafbwzss8kr55wnj8d5c7xjnp8gqrwc8sn0m"; })
-  (fetchNuGet { pname = "System.Runtime"; version = "4.3.0"; sha256 = "066ixvgbf2c929kgknshcxqj6539ax7b9m570cp8n179cpfkapz7"; })
-  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "6.0.0"; sha256 = "0qm741kh4rh57wky16sq4m0v05fxmkjjr87krycf5vp9f0zbahbc"; })
-  (fetchNuGet { pname = "System.Runtime.Extensions"; version = "4.1.0"; sha256 = "0rw4rm4vsm3h3szxp9iijc3ksyviwsv6f63dng3vhqyg4vjdkc2z"; })
-  (fetchNuGet { pname = "System.Runtime.Extensions"; version = "4.3.0"; sha256 = "1ykp3dnhwvm48nap8q23893hagf665k0kn3cbgsqpwzbijdcgc60"; })
-  (fetchNuGet { pname = "System.Runtime.Handles"; version = "4.0.1"; sha256 = "1g0zrdi5508v49pfm3iii2hn6nm00bgvfpjq1zxknfjrxxa20r4g"; })
-  (fetchNuGet { pname = "System.Runtime.Handles"; version = "4.3.0"; sha256 = "0sw2gfj2xr7sw9qjn0j3l9yw07x73lcs97p8xfc9w1x9h5g5m7i8"; })
-  (fetchNuGet { pname = "System.Runtime.InteropServices"; version = "4.1.0"; sha256 = "01kxqppx3dr3b6b286xafqilv4s2n0gqvfgzfd4z943ga9i81is1"; })
-  (fetchNuGet { pname = "System.Runtime.InteropServices"; version = "4.3.0"; sha256 = "00hywrn4g7hva1b2qri2s6rabzwgxnbpw9zfxmz28z09cpwwgh7j"; })
-  (fetchNuGet { pname = "System.Runtime.InteropServices.RuntimeInformation"; version = "4.3.0"; sha256 = "0q18r1sh4vn7bvqgd6dmqlw5v28flbpj349mkdish2vjyvmnb2ii"; })
-  (fetchNuGet { pname = "System.Runtime.Numerics"; version = "4.0.1"; sha256 = "1y308zfvy0l5nrn46mqqr4wb4z1xk758pkk8svbz8b5ij7jnv4nn"; })
-  (fetchNuGet { pname = "System.Runtime.Numerics"; version = "4.3.0"; sha256 = "19rav39sr5dky7afygh309qamqqmi9kcwvz3i0c5700v0c5cg61z"; })
-  (fetchNuGet { pname = "System.Runtime.Serialization.Formatters"; version = "4.3.0"; sha256 = "114j35n8gcvn3sqv9ar36r1jjq0y1yws9r0yk8i6wm4aq7n9rs0m"; })
-  (fetchNuGet { pname = "System.Runtime.Serialization.Json"; version = "4.0.2"; sha256 = "08ypbzs0sb302ga04ds5b2wxa2gg0q50zpa0nvc87ipjhs0v66dn"; })
-  (fetchNuGet { pname = "System.Runtime.Serialization.Primitives"; version = "4.1.1"; sha256 = "042rfjixknlr6r10vx2pgf56yming8lkjikamg3g4v29ikk78h7k"; })
-  (fetchNuGet { pname = "System.Runtime.Serialization.Primitives"; version = "4.3.0"; sha256 = "01vv2p8h4hsz217xxs0rixvb7f2xzbh6wv1gzbfykcbfrza6dvnf"; })
-  (fetchNuGet { pname = "System.Runtime.Serialization.Xml"; version = "4.3.0"; sha256 = "1b2cxl2h7s8cydbhbmxhvvq071n9ck61g08npg4gyw7nvg37rfni"; })
-  (fetchNuGet { pname = "System.Security.Claims"; version = "4.3.0"; sha256 = "0jvfn7j22l3mm28qjy3rcw287y9h65ha4m940waaxah07jnbzrhn"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Algorithms"; version = "4.2.0"; sha256 = "148s9g5dgm33ri7dnh19s4lgnlxbpwvrw2jnzllq2kijj4i4vs85"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Algorithms"; version = "4.3.0"; sha256 = "03sq183pfl5kp7gkvq77myv7kbpdnq3y0xj7vi4q1kaw54sny0ml"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Cng"; version = "4.2.0"; sha256 = "118jijz446kix20blxip0f0q8mhsh9bz118mwc2ch1p6g7facpzc"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Cng"; version = "4.3.0"; sha256 = "1k468aswafdgf56ab6yrn7649kfqx2wm9aslywjam1hdmk5yypmv"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Csp"; version = "4.0.0"; sha256 = "1cwv8lqj8r15q81d2pz2jwzzbaji0l28xfrpw29kdpsaypm92z2q"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Csp"; version = "4.3.0"; sha256 = "1x5wcrddf2s3hb8j78cry7yalca4lb5vfnkrysagbn6r9x6xvrx1"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Encoding"; version = "4.0.0"; sha256 = "0a8y1a5wkmpawc787gfmnrnbzdgxmx1a14ax43jf3rj9gxmy3vk4"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Encoding"; version = "4.3.0"; sha256 = "1jr6w70igqn07k5zs1ph6xja97hxnb3mqbspdrff6cvssgrixs32"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.OpenSsl"; version = "4.0.0"; sha256 = "16sx3cig3d0ilvzl8xxgffmxbiqx87zdi8fc73i3i7zjih1a7f4q"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0givpvvj8yc7gv4lhb6s1prq6p2c4147204a0wib89inqzd87gqc"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Primitives"; version = "4.0.0"; sha256 = "0i7cfnwph9a10bm26m538h5xcr8b36jscp9sy1zhgifksxz4yixh"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Primitives"; version = "4.3.0"; sha256 = "0pyzncsv48zwly3lw4f2dayqswcfvdwq2nz0dgwmi7fj3pn64wby"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.X509Certificates"; version = "4.1.0"; sha256 = "0clg1bv55mfv5dq00m19cp634zx6inm31kf8ppbq1jgyjf2185dh"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.X509Certificates"; version = "4.3.0"; sha256 = "0valjcz5wksbvijylxijjxb1mp38mdhv03r533vnx1q3ikzdav9h"; })
-  (fetchNuGet { pname = "System.Security.Principal"; version = "4.3.0"; sha256 = "12cm2zws06z4lfc4dn31iqv7072zyi4m910d4r6wm8yx85arsfxf"; })
-  (fetchNuGet { pname = "System.Security.Principal.Windows"; version = "4.3.0"; sha256 = "00a0a7c40i3v4cb20s2cmh9csb5jv2l0frvnlzyfxh848xalpdwr"; })
-  (fetchNuGet { pname = "System.Text.Encoding"; version = "4.0.11"; sha256 = "1dyqv0hijg265dwxg6l7aiv74102d6xjiwplh2ar1ly6xfaa4iiw"; })
-  (fetchNuGet { pname = "System.Text.Encoding"; version = "4.3.0"; sha256 = "1f04lkir4iladpp51sdgmis9dj4y8v08cka0mbmsy0frc9a4gjqr"; })
-  (fetchNuGet { pname = "System.Text.Encoding.Extensions"; version = "4.0.11"; sha256 = "08nsfrpiwsg9x5ml4xyl3zyvjfdi4mvbqf93kjdh11j4fwkznizs"; })
-  (fetchNuGet { pname = "System.Text.Encoding.Extensions"; version = "4.3.0"; sha256 = "11q1y8hh5hrp5a3kw25cb6l00v5l5dvirkz8jr3sq00h1xgcgrxy"; })
-  (fetchNuGet { pname = "System.Text.RegularExpressions"; version = "4.1.0"; sha256 = "1mw7vfkkyd04yn2fbhm38msk7dz2xwvib14ygjsb8dq2lcvr18y7"; })
-  (fetchNuGet { pname = "System.Text.RegularExpressions"; version = "4.3.0"; sha256 = "1bgq51k7fwld0njylfn7qc5fmwrk2137gdq7djqdsw347paa9c2l"; })
-  (fetchNuGet { pname = "System.Threading"; version = "4.0.11"; sha256 = "19x946h926bzvbsgj28csn46gak2crv2skpwsx80hbgazmkgb1ls"; })
-  (fetchNuGet { pname = "System.Threading"; version = "4.3.0"; sha256 = "0rw9wfamvhayp5zh3j7p1yfmx9b5khbf4q50d8k5rk993rskfd34"; })
-  (fetchNuGet { pname = "System.Threading.Channels"; version = "4.7.1"; sha256 = "038fyrriypwzsj5fwgnkw79hm5ya0x63r724yizgahbxf512chr2"; })
-  (fetchNuGet { pname = "System.Threading.Tasks"; version = "4.0.11"; sha256 = "0nr1r41rak82qfa5m0lhk9mp0k93bvfd7bbd9sdzwx9mb36g28p5"; })
-  (fetchNuGet { pname = "System.Threading.Tasks"; version = "4.3.0"; sha256 = "134z3v9abw3a6jsw17xl3f6hqjpak5l682k2vz39spj4kmydg6k7"; })
-  (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.0.0"; sha256 = "1cb51z062mvc2i8blpzmpn9d9mm4y307xrwi65di8ri18cz5r1zr"; })
-  (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.3.0"; sha256 = "1xxcx2xh8jin360yjwm4x4cf5y3a2bwpn2ygkfkwkicz7zk50s2z"; })
-  (fetchNuGet { pname = "System.Threading.Thread"; version = "4.3.0"; sha256 = "0y2xiwdfcph7znm2ysxanrhbqqss6a3shi1z3c779pj2s523mjx4"; })
-  (fetchNuGet { pname = "System.Threading.ThreadPool"; version = "4.3.0"; sha256 = "027s1f4sbx0y1xqw2irqn6x161lzj8qwvnh2gn78ciiczdv10vf1"; })
-  (fetchNuGet { pname = "System.Threading.Timer"; version = "4.3.0"; sha256 = "1nx773nsx6z5whv8kaa1wjh037id2f1cxhb69pvgv12hd2b6qs56"; })
-  (fetchNuGet { pname = "System.Xml.ReaderWriter"; version = "4.0.11"; sha256 = "0c6ky1jk5ada9m94wcadih98l6k1fvf6vi7vhn1msjixaha419l5"; })
-  (fetchNuGet { pname = "System.Xml.ReaderWriter"; version = "4.3.0"; sha256 = "0c47yllxifzmh8gq6rq6l36zzvw4kjvlszkqa9wq3fr59n0hl3s1"; })
-  (fetchNuGet { pname = "System.Xml.XDocument"; version = "4.3.0"; sha256 = "08h8fm4l77n0nd4i4fk2386y809bfbwqb7ih9d7564ifcxr5ssxd"; })
-  (fetchNuGet { pname = "System.Xml.XmlDocument"; version = "4.0.1"; sha256 = "0ihsnkvyc76r4dcky7v3ansnbyqjzkbyyia0ir5zvqirzan0bnl1"; })
-  (fetchNuGet { pname = "System.Xml.XmlDocument"; version = "4.3.0"; sha256 = "0bmz1l06dihx52jxjr22dyv5mxv6pj4852lx68grjm7bivhrbfwi"; })
-  (fetchNuGet { pname = "System.Xml.XmlSerializer"; version = "4.0.11"; sha256 = "01nzc3gdslw90qfykq4qzr2mdnqxjl4sj0wp3fixiwdmlmvpib5z"; })
-  (fetchNuGet { pname = "System.Xml.XmlSerializer"; version = "4.3.0"; sha256 = "07pa4sx196vxkgl3csvdmw94nydlsm9ir38xxcs84qjn8cycd912"; })
+  (fetchNuGet { pname = "Dapper"; version = "2.1.35"; hash = "sha256-zeroySx7lO1yLtbhKhFQ87diWXOq9gPnv3qFcmNcs9M="; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.JsonPatch"; version = "8.0.5"; hash = "sha256-i5VzC7peTKTiwjoqzlUFysyu7oUxBtf3bG/BZ6QYs/A="; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.Mvc.NewtonsoftJson"; version = "8.0.5"; hash = "sha256-8GX1oDCmWiX3t/gwpn2fVl3Pw3DdXgWru5refK8w+aw="; })
+  (fetchNuGet { pname = "Microsoft.Azure.Amqp"; version = "2.4.9"; hash = "sha256-qmJGqOHjn1SofqiFuQ7qUuDOaDgX2cjnCOcE6iCde5Y="; })
+  (fetchNuGet { pname = "Microsoft.Azure.ServiceBus"; version = "4.2.1"; hash = "sha256-RUfwCX0NMxKMXV7guVRWjmZOYEuxpFeabOeiA3TDfSo="; })
+  (fetchNuGet { pname = "Microsoft.Azure.Services.AppAuthentication"; version = "1.0.3"; hash = "sha256-KaGL7asV10S+fGp9dt1i6frelho8ns73epxGzZ4iRis="; })
+  (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.3.0"; hash = "sha256-a3dAiPaVuky0wpcHmpTVtAQJNGZ2v91/oArA+dpJgj8="; })
+  (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.7.0"; hash = "sha256-Enknv2RsFF68lEPdrf5M+BpV1kHoLTVRApKUwuk/pj0="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Configuration"; version = "6.0.0"; hash = "sha256-SIO/Q+OD2bG+Q0EoOXRgJYzZMhahGXDG1fXZn0VUvv0="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Abstractions"; version = "6.0.0"; hash = "sha256-Evg+Ynj2QUa6Gz+zqF+bUyfGD0HI5A2fHmxZEXbn3HA="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.EnvironmentVariables"; version = "6.0.0"; hash = "sha256-tG3DEWURVkQHm4MlmxjE/YouTp9wQKbWs6qHH2nfgqc="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.FileExtensions"; version = "6.0.0"; hash = "sha256-PLnSa0JMfDC62OTv8sL0QFJbANE7QSnJ997ySFBS1go="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Ini"; version = "6.0.0"; hash = "sha256-5tUoqvIsWL5hfmMCpCpBW6V1tw/sMUCwfnm/7Y8LD6M="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.DependencyInjection.Abstractions"; version = "8.0.0"; hash = "sha256-75KzEGWjbRELczJpCiJub+ltNUMMbz5A/1KQU+5dgP8="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.FileProviders.Abstractions"; version = "6.0.0"; hash = "sha256-uBjWjHKEXjZ9fDfFxMjOou3lhfTNhs1yO+e3fpWreLk="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.FileProviders.Physical"; version = "6.0.0"; hash = "sha256-5BAQOqnaEXM2YjdrmrCinXBeZ5FKxCWtebEXMdwcbMY="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.FileSystemGlobbing"; version = "6.0.0"; hash = "sha256-RAWHjkkfvGpjc49Q0kJbZyXgU6UEq/EJ0j557sj2/iU="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Logging.Abstractions"; version = "1.0.0"; hash = "sha256-asIXVFsAK7ELd/f+vLwhxYDdazqRTmf+fGJ4WFtcCeo="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Logging.Abstractions"; version = "6.0.0"; hash = "sha256-QNqcQ3x+MOK7lXbWkCzSOWa/2QyYNbdM/OEEbWN15Sw="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Logging.Abstractions"; version = "8.0.0"; hash = "sha256-Jmddjeg8U5S+iBTwRlVAVLeIHxc4yrrNgqVMOB7EjM4="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "6.0.0"; hash = "sha256-AgvysszpQ11AiTBJFkvSy8JnwIWTj15Pfek7T7ThUc4="; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Clients.ActiveDirectory"; version = "3.14.2"; hash = "sha256-mFlsKSQ6DsKttWuFkv6eMs0uSFHgwocxDad1icMXKj0="; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.JsonWebTokens"; version = "5.4.0"; hash = "sha256-yKITMgW2JEXhPlQgdmofAyt0eEcCr72P4rM2EC6wrig="; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Logging"; version = "5.4.0"; hash = "sha256-YKdSKQDO5+ssC5mqLGtBhuJ4lLbLUadMVV4PPJ6/tMU="; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Tokens"; version = "5.4.0"; hash = "sha256-gCJ+4QwhuBPSkDN+HcMCpTE2LFIQ3htI/SddoHOB7T4="; })
+  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.0.1"; hash = "sha256-mZotlGZqtrqDSoBrZhsxFe6fuOv5/BIo0w2Z2x0zVAU="; })
+  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.0.2"; hash = "sha256-YLJ2+BONtCWb0lY4Rttdqzbcm4z+5N5uNr3byRWQOZ8="; })
+  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.1.0"; hash = "sha256-FeM40ktcObQJk4nMYShB61H/E8B7tIKfl9ObJ0IOcCM="; })
+  (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.0.1"; hash = "sha256-lxxw/Gy32xHi0fLgFWNj4YTFBSBkjx5l6ucmbTyf7V4="; })
+  (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.1.0"; hash = "sha256-0AqQ2gMS8iNlYkrD+BxtIg7cXMnr9xZHtKAuN4bjfaQ="; })
+  (fetchNuGet { pname = "Microsoft.Win32.Primitives"; version = "4.0.1"; hash = "sha256-B4t5El/ViBdxALMcpZulewc4j/3SIXf71HhJWhm4Ctk="; })
+  (fetchNuGet { pname = "Microsoft.Win32.Primitives"; version = "4.3.0"; hash = "sha256-mBNDmPXNTW54XLnPAUwBRvkIORFM7/j0D0I2SyQPDEg="; })
+  (fetchNuGet { pname = "Microsoft.Win32.Registry"; version = "4.3.0"; hash = "sha256-50XwFbyRfZkTD/bBn76WV/NIpOy/mzXD3MMEVFX/vr8="; })
+  (fetchNuGet { pname = "NBitcoin"; version = "7.0.37"; hash = "sha256-RclQZgot+Y8PZi9JEX7tgUJinkIBXs1Qgf4vGR2y4rc="; })
+  (fetchNuGet { pname = "NBitcoin.Altcoins"; version = "3.0.24"; hash = "sha256-MGxIuYtWPgSYj5JCMmZfP7u04ki/UpeN1+//gU6RsdI="; })
+  (fetchNuGet { pname = "NETStandard.Library"; version = "1.6.1"; hash = "sha256-iNan1ix7RtncGWC9AjAZ2sk70DoxOsmEOgQ10fXm4Pw="; })
+  (fetchNuGet { pname = "Newtonsoft.Json"; version = "10.0.3"; hash = "sha256-WEHCjp+OMr5axXQjFsh7TMDE/ttE35nMv5RBPdcxfhs="; })
+  (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.1"; hash = "sha256-K2tSVW4n4beRPzPu3rlVaBEMdGvWSv/3Q1fxaDh4Mjo="; })
+  (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.3"; hash = "sha256-hy/BieY4qxBWVVsDqqOPaLy1QobiIapkbrESm6v2PHc="; })
+  (fetchNuGet { pname = "Newtonsoft.Json.Bson"; version = "1.0.2"; hash = "sha256-ZUj6YFSMZp5CZtXiamw49eZmbp1iYBuNsIKNnjxcRzA="; })
+  (fetchNuGet { pname = "NicolasDorier.CommandLine"; version = "2.0.0"; hash = "sha256-LizYyIMx6I17jZd52duYcGWNgcPs88c/zWxo/ADd3D8="; })
+  (fetchNuGet { pname = "NicolasDorier.CommandLine.Configuration"; version = "2.0.0"; hash = "sha256-fDpDOVdt7xCDXXqaBnbaFvUOPaE0Sl4cLWjNkU0Cz7I="; })
+  (fetchNuGet { pname = "NicolasDorier.StandardConfiguration"; version = "2.0.0"; hash = "sha256-mwPvVaESUnou1qd0b6oSmQfBBz28LmQIb1EoSUZvqAA="; })
+  (fetchNuGet { pname = "Npgsql"; version = "8.0.3"; hash = "sha256-weBGo/IXKI5ufixBCuWG7OqDSyIqvGV07oxrG0XnQIQ="; })
+  (fetchNuGet { pname = "RabbitMQ.Client"; version = "5.1.2"; hash = "sha256-reYeBKsqfrdZZ4Nq4dsqLo1GNtcT2A0VuOIHtW3ttqQ="; })
+  (fetchNuGet { pname = "runtime.any.System.Collections"; version = "4.3.0"; hash = "sha256-4PGZqyWhZ6/HCTF2KddDsbmTTjxs2oW79YfkberDZS8="; })
+  (fetchNuGet { pname = "runtime.any.System.Diagnostics.Tools"; version = "4.3.0"; hash = "sha256-8yLKFt2wQxkEf7fNfzB+cPUCjYn2qbqNgQ1+EeY2h/I="; })
+  (fetchNuGet { pname = "runtime.any.System.Diagnostics.Tracing"; version = "4.3.0"; hash = "sha256-dsmTLGvt8HqRkDWP8iKVXJCS+akAzENGXKPV18W2RgI="; })
+  (fetchNuGet { pname = "runtime.any.System.Globalization"; version = "4.3.0"; hash = "sha256-PaiITTFI2FfPylTEk7DwzfKeiA/g/aooSU1pDcdwWLU="; })
+  (fetchNuGet { pname = "runtime.any.System.Globalization.Calendars"; version = "4.3.0"; hash = "sha256-AYh39tgXJVFu8aLi9Y/4rK8yWMaza4S4eaxjfcuEEL4="; })
+  (fetchNuGet { pname = "runtime.any.System.IO"; version = "4.3.0"; hash = "sha256-vej7ySRhyvM3pYh/ITMdC25ivSd0WLZAaIQbYj/6HVE="; })
+  (fetchNuGet { pname = "runtime.any.System.Reflection"; version = "4.3.0"; hash = "sha256-ns6f++lSA+bi1xXgmW1JkWFb2NaMD+w+YNTfMvyAiQk="; })
+  (fetchNuGet { pname = "runtime.any.System.Reflection.Extensions"; version = "4.3.0"; hash = "sha256-Y2AnhOcJwJVYv7Rp6Jz6ma0fpITFqJW+8rsw106K2X8="; })
+  (fetchNuGet { pname = "runtime.any.System.Reflection.Primitives"; version = "4.3.0"; hash = "sha256-LkPXtiDQM3BcdYkAm5uSNOiz3uF4J45qpxn5aBiqNXQ="; })
+  (fetchNuGet { pname = "runtime.any.System.Resources.ResourceManager"; version = "4.3.0"; hash = "sha256-9EvnmZslLgLLhJ00o5MWaPuJQlbUFcUF8itGQNVkcQ4="; })
+  (fetchNuGet { pname = "runtime.any.System.Runtime"; version = "4.3.0"; hash = "sha256-qwhNXBaJ1DtDkuRacgHwnZmOZ1u9q7N8j0cWOLYOELM="; })
+  (fetchNuGet { pname = "runtime.any.System.Runtime.Handles"; version = "4.3.0"; hash = "sha256-PQRACwnSUuxgVySO1840KvqCC9F8iI9iTzxNW0RcBS4="; })
+  (fetchNuGet { pname = "runtime.any.System.Runtime.InteropServices"; version = "4.3.0"; hash = "sha256-Kaw5PnLYIiqWbsoF3VKJhy7pkpoGsUwn4ZDCKscbbzA="; })
+  (fetchNuGet { pname = "runtime.any.System.Text.Encoding"; version = "4.3.0"; hash = "sha256-Q18B9q26MkWZx68exUfQT30+0PGmpFlDgaF0TnaIGCs="; })
+  (fetchNuGet { pname = "runtime.any.System.Text.Encoding.Extensions"; version = "4.3.0"; hash = "sha256-6MYj0RmLh4EVqMtO/MRqBi0HOn5iG4x9JimgCCJ+EFM="; })
+  (fetchNuGet { pname = "runtime.any.System.Threading.Tasks"; version = "4.3.0"; hash = "sha256-agdOM0NXupfHbKAQzQT8XgbI9B8hVEh+a/2vqeHctg4="; })
+  (fetchNuGet { pname = "runtime.any.System.Threading.Timer"; version = "4.3.0"; hash = "sha256-BgHxXCIbicVZtpgMimSXixhFC3V+p5ODqeljDjO8hCs="; })
+  (fetchNuGet { pname = "runtime.debian.8-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-LXUPLX3DJxsU1Pd3UwjO1PO9NM2elNEDXeu2Mu/vNps="; })
+  (fetchNuGet { pname = "runtime.fedora.23-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-qeSqaUI80+lqw5MK4vMpmO0CZaqrmYktwp6L+vQAb0I="; })
+  (fetchNuGet { pname = "runtime.fedora.24-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-SrHqT9wrCBsxILWtaJgGKd6Odmxm8/Mh7Kh0CUkZVzA="; })
+  (fetchNuGet { pname = "runtime.native.System"; version = "4.0.0"; hash = "sha256-bmaM0ovT4X4aqDJOR255Yda/u3fmHZskU++lMnsy894="; })
+  (fetchNuGet { pname = "runtime.native.System"; version = "4.3.0"; hash = "sha256-ZBZaodnjvLXATWpXXakFgcy6P+gjhshFXmglrL5xD5Y="; })
+  (fetchNuGet { pname = "runtime.native.System.IO.Compression"; version = "4.3.0"; hash = "sha256-DWnXs4vlKoU6WxxvCArTJupV6sX3iBbZh8SbqfHace8="; })
+  (fetchNuGet { pname = "runtime.native.System.Net.Http"; version = "4.0.1"; hash = "sha256-5nWnTQrA1T6t9r8MqIiV4yTNu+IH0of2OX1qteoS+8E="; })
+  (fetchNuGet { pname = "runtime.native.System.Net.Http"; version = "4.3.0"; hash = "sha256-c556PyheRwpYhweBjSfIwEyZHnAUB8jWioyKEcp/2dg="; })
+  (fetchNuGet { pname = "runtime.native.System.Net.Security"; version = "4.3.0"; hash = "sha256-I8vYld/7WtU2/rrD4XfSRgpO/DY3qXghG14VQjiU2DY="; })
+  (fetchNuGet { pname = "runtime.native.System.Security.Cryptography"; version = "4.0.0"; hash = "sha256-6Q8eYzC32BbGIiTHoQaE6B3cD81vYQcH5SCswYRSp0w="; })
+  (fetchNuGet { pname = "runtime.native.System.Security.Cryptography.Apple"; version = "4.3.0"; hash = "sha256-2IhBv0i6pTcOyr8FFIyfPEaaCHUmJZ8DYwLUwJ+5waw="; })
+  (fetchNuGet { pname = "runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-Jy01KhtcCl2wjMpZWH+X3fhHcVn+SyllWFY8zWlz/6I="; })
+  (fetchNuGet { pname = "runtime.opensuse.13.2-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-wyv00gdlqf8ckxEdV7E+Ql9hJIoPcmYEuyeWb5Oz3mM="; })
+  (fetchNuGet { pname = "runtime.opensuse.42.1-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-zi+b4sCFrA9QBiSGDD7xPV27r3iHGlV99gpyVUjRmc4="; })
+  (fetchNuGet { pname = "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.Apple"; version = "4.3.0"; hash = "sha256-serkd4A7F6eciPiPJtUyJyxzdAtupEcWIZQ9nptEzIM="; })
+  (fetchNuGet { pname = "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-gybQU6mPgaWV3rBG2dbH6tT3tBq8mgze3PROdsuWnX0="; })
+  (fetchNuGet { pname = "runtime.rhel.7-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-VsP72GVveWnGUvS/vjOQLv1U80H2K8nZ4fDAmI61Hm4="; })
+  (fetchNuGet { pname = "runtime.ubuntu.14.04-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-4yKGa/IrNCKuQ3zaDzILdNPD32bNdy6xr5gdJigyF5g="; })
+  (fetchNuGet { pname = "runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-HmdJhhRsiVoOOCcUvAwdjpMRiyuSwdcgEv2j9hxi+Zc="; })
+  (fetchNuGet { pname = "runtime.ubuntu.16.10-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-pVFUKuPPIx0edQKjzRon3zKq8zhzHEzko/lc01V/jdw="; })
+  (fetchNuGet { pname = "runtime.unix.Microsoft.Win32.Primitives"; version = "4.3.0"; hash = "sha256-LZb23lRXzr26tRS5aA0xyB08JxiblPDoA7HBvn6awXg="; })
+  (fetchNuGet { pname = "runtime.unix.System.Console"; version = "4.3.0"; hash = "sha256-AHkdKShTRHttqfMjmi+lPpTuCrM5vd/WRy6Kbtie190="; })
+  (fetchNuGet { pname = "runtime.unix.System.Diagnostics.Debug"; version = "4.3.0"; hash = "sha256-ReoazscfbGH+R6s6jkg5sIEHWNEvjEoHtIsMbpc7+tI="; })
+  (fetchNuGet { pname = "runtime.unix.System.IO.FileSystem"; version = "4.3.0"; hash = "sha256-Pf4mRl6YDK2x2KMh0WdyNgv0VUNdSKVDLlHqozecy5I="; })
+  (fetchNuGet { pname = "runtime.unix.System.Net.Primitives"; version = "4.3.0"; hash = "sha256-pHJ+I6i16MV6m77uhTC6GPY6jWGReE3SSP3fVB59ti0="; })
+  (fetchNuGet { pname = "runtime.unix.System.Net.Sockets"; version = "4.3.0"; hash = "sha256-IvgOeA2JuBjKl5yAVGjPYMPDzs9phb3KANs95H9v1w4="; })
+  (fetchNuGet { pname = "runtime.unix.System.Private.Uri"; version = "4.3.0"; hash = "sha256-c5tXWhE/fYbJVl9rXs0uHh3pTsg44YD1dJvyOA0WoMs="; })
+  (fetchNuGet { pname = "runtime.unix.System.Runtime.Extensions"; version = "4.3.0"; hash = "sha256-l8S9gt6dk3qYG6HYonHtdlYtBKyPb29uQ6NDjmrt3V4="; })
+  (fetchNuGet { pname = "System.AppContext"; version = "4.3.0"; hash = "sha256-yg95LNQOwFlA1tWxXdQkVyJqT4AnoDc+ACmrNvzGiZg="; })
+  (fetchNuGet { pname = "System.Buffers"; version = "4.3.0"; hash = "sha256-XqZWb4Kd04960h4U9seivjKseGA/YEIpdplfHYHQ9jk="; })
+  (fetchNuGet { pname = "System.Collections"; version = "4.0.11"; hash = "sha256-puoFMkx4Z55C1XPxNw3np8nzNGjH+G24j43yTIsDRL0="; })
+  (fetchNuGet { pname = "System.Collections"; version = "4.3.0"; hash = "sha256-afY7VUtD6w/5mYqrce8kQrvDIfS2GXDINDh73IjxJKc="; })
+  (fetchNuGet { pname = "System.Collections.Concurrent"; version = "4.0.12"; hash = "sha256-zIEM7AB4SyE9u6G8+o+gCLLwkgi6+3rHQVPdn/dEwB8="; })
+  (fetchNuGet { pname = "System.Collections.Concurrent"; version = "4.3.0"; hash = "sha256-KMY5DfJnDeIsa13DpqvyN8NkReZEMAFnlmNglVoFIXI="; })
+  (fetchNuGet { pname = "System.Collections.NonGeneric"; version = "4.3.0"; hash = "sha256-8/yZmD4jjvq7m68SPkJZLBQ79jOTOyT5lyzX4SCYAx8="; })
+  (fetchNuGet { pname = "System.Collections.Specialized"; version = "4.3.0"; hash = "sha256-QNg0JJNx+zXMQ26MJRPzH7THdtqjrNtGLUgaR1SdvOk="; })
+  (fetchNuGet { pname = "System.ComponentModel"; version = "4.3.0"; hash = "sha256-i00uujMO4JEDIEPKLmdLY3QJ6vdSpw6Gh9oOzkFYBiU="; })
+  (fetchNuGet { pname = "System.ComponentModel.Primitives"; version = "4.3.0"; hash = "sha256-IOMJleuIBppmP4ECB3uftbdcgL7CCd56+oAD/Sqrbus="; })
+  (fetchNuGet { pname = "System.ComponentModel.TypeConverter"; version = "4.3.0"; hash = "sha256-PSDiPYt8PgTdTUBz+GH6lHCaM1YgfObneHnZsc8Fz54="; })
+  (fetchNuGet { pname = "System.Console"; version = "4.3.0"; hash = "sha256-Xh3PPBZr0pDbDaK8AEHbdGz7ePK6Yi1ZyRWI1JM6mbo="; })
+  (fetchNuGet { pname = "System.Diagnostics.Debug"; version = "4.0.11"; hash = "sha256-P+rSQJVoN6M56jQbs76kZ9G3mAWFdtF27P/RijN8sj4="; })
+  (fetchNuGet { pname = "System.Diagnostics.Debug"; version = "4.3.0"; hash = "sha256-fkA79SjPbSeiEcrbbUsb70u9B7wqbsdM9s1LnoKj0gM="; })
+  (fetchNuGet { pname = "System.Diagnostics.DiagnosticSource"; version = "4.5.1"; hash = "sha256-gZEDRv0v0AAauQ36BWXkJk3GLW0sYH6QPxa0p2l8Dck="; })
+  (fetchNuGet { pname = "System.Diagnostics.Process"; version = "4.3.0"; hash = "sha256-Rzo24qXhuJDDgrGNHr2eQRHhwLmsYmWDqAg/P5fOlzw="; })
+  (fetchNuGet { pname = "System.Diagnostics.Tools"; version = "4.3.0"; hash = "sha256-gVOv1SK6Ape0FQhCVlNOd9cvQKBvMxRX9K0JPVi8w0Y="; })
+  (fetchNuGet { pname = "System.Diagnostics.Tracing"; version = "4.1.0"; hash = "sha256-JA0jJcLbU3zh52ub3zweob2EVHvxOqiC6SCYHrY5WbQ="; })
+  (fetchNuGet { pname = "System.Diagnostics.Tracing"; version = "4.3.0"; hash = "sha256-hCETZpHHGVhPYvb4C0fh4zs+8zv4GPoixagkLZjpa9Q="; })
+  (fetchNuGet { pname = "System.Dynamic.Runtime"; version = "4.3.0"; hash = "sha256-k75gjOYimIQtLBD5NDzwwi3ZMUBPRW3jmc3evDMMJbU="; })
+  (fetchNuGet { pname = "System.Globalization"; version = "4.0.11"; hash = "sha256-rbSgc2PIEc2c2rN6LK3qCREAX3DqA2Nq1WcLrZYsDBw="; })
+  (fetchNuGet { pname = "System.Globalization"; version = "4.3.0"; hash = "sha256-caL0pRmFSEsaoeZeWN5BTQtGrAtaQPwFi8YOZPZG5rI="; })
+  (fetchNuGet { pname = "System.Globalization.Calendars"; version = "4.0.1"; hash = "sha256-EJN3LbN+b0O9Dr2eg7kfThCYpne0iJ/H/GIyUTNVYC8="; })
+  (fetchNuGet { pname = "System.Globalization.Calendars"; version = "4.3.0"; hash = "sha256-uNOD0EOVFgnS2fMKvMiEtI9aOw00+Pfy/H+qucAQlPc="; })
+  (fetchNuGet { pname = "System.Globalization.Extensions"; version = "4.3.0"; hash = "sha256-mmJWA27T0GRVuFP9/sj+4TrR4GJWrzNIk2PDrbr7RQk="; })
+  (fetchNuGet { pname = "System.IdentityModel.Tokens.Jwt"; version = "5.4.0"; hash = "sha256-zLtoejPBG8yeFEPIcXZAkdAb0WDnrVXh5YsUYKULyRU="; })
+  (fetchNuGet { pname = "System.IO"; version = "4.1.0"; hash = "sha256-V6oyQFwWb8NvGxAwvzWnhPxy9dKOfj/XBM3tEC5aHrw="; })
+  (fetchNuGet { pname = "System.IO"; version = "4.3.0"; hash = "sha256-ruynQHekFP5wPrDiVyhNiRIXeZ/I9NpjK5pU+HPDiRY="; })
+  (fetchNuGet { pname = "System.IO.Compression"; version = "4.3.0"; hash = "sha256-f5PrQlQgj5Xj2ZnHxXW8XiOivaBvfqDao9Sb6AVinyA="; })
+  (fetchNuGet { pname = "System.IO.Compression.ZipFile"; version = "4.3.0"; hash = "sha256-WQl+JgWs+GaRMeiahTFUbrhlXIHapzcpTFXbRvAtvvs="; })
+  (fetchNuGet { pname = "System.IO.FileSystem"; version = "4.0.1"; hash = "sha256-4VKXFgcGYCTWVXjAlniAVq0dO3o5s8KHylg2wg2/7k0="; })
+  (fetchNuGet { pname = "System.IO.FileSystem"; version = "4.3.0"; hash = "sha256-vNIYnvlayuVj0WfRfYKpDrhDptlhp1pN8CYmlVd2TXw="; })
+  (fetchNuGet { pname = "System.IO.FileSystem.Primitives"; version = "4.0.1"; hash = "sha256-IpigKMomqb6pmYWkrlf0ZdpILtRluX2cX5sOKVW0Feg="; })
+  (fetchNuGet { pname = "System.IO.FileSystem.Primitives"; version = "4.3.0"; hash = "sha256-LMnfg8Vwavs9cMnq9nNH8IWtAtSfk0/Fy4s4Rt9r1kg="; })
+  (fetchNuGet { pname = "System.Linq"; version = "4.1.0"; hash = "sha256-ZQpFtYw5N1F1aX0jUK3Tw+XvM5tnlnshkTCNtfVA794="; })
+  (fetchNuGet { pname = "System.Linq"; version = "4.3.0"; hash = "sha256-R5uiSL3l6a3XrXSSL6jz+q/PcyVQzEAByiuXZNSqD/A="; })
+  (fetchNuGet { pname = "System.Linq.Expressions"; version = "4.3.0"; hash = "sha256-+3pvhZY7rip8HCbfdULzjlC9FPZFpYoQxhkcuFm2wk8="; })
+  (fetchNuGet { pname = "System.Net.Http"; version = "4.3.0"; hash = "sha256-UoBB7WPDp2Bne/fwxKF0nE8grJ6FzTMXdT/jfsphj8Q="; })
+  (fetchNuGet { pname = "System.Net.NameResolution"; version = "4.3.0"; hash = "sha256-eGZwCBExWsnirWBHyp2sSSSXp6g7I6v53qNmwPgtJ5c="; })
+  (fetchNuGet { pname = "System.Net.Primitives"; version = "4.0.11"; hash = "sha256-2YSijNhCdw/ZU2yfH7vE+ReA8pgxRCXPnWr+ab36v4M="; })
+  (fetchNuGet { pname = "System.Net.Primitives"; version = "4.3.0"; hash = "sha256-MY7Z6vOtFMbEKaLW9nOSZeAjcWpwCtdO7/W1mkGZBzE="; })
+  (fetchNuGet { pname = "System.Net.Security"; version = "4.3.0"; hash = "sha256-B7laE1z1+ldbo6JkjlDjZynG5JiMZ/3uNHPHMP6LRak="; })
+  (fetchNuGet { pname = "System.Net.Sockets"; version = "4.3.0"; hash = "sha256-il7dr5VT/QWDg/0cuh+4Es2u8LY//+qqiY9BZmYxSus="; })
+  (fetchNuGet { pname = "System.Net.WebHeaderCollection"; version = "4.0.1"; hash = "sha256-uJSV6kmL+V/9/ot1LhHXGCd8Ndcu6zk+AJ8wgGS/fYE="; })
+  (fetchNuGet { pname = "System.Net.WebHeaderCollection"; version = "4.3.0"; hash = "sha256-wpRP3D/2YjpFmqU7Q42L/+/hChEVMlwU1sjysGVrQ1c="; })
+  (fetchNuGet { pname = "System.Net.WebSockets"; version = "4.0.0"; hash = "sha256-YhLVuTPyEiHAjdBMHyIobGpysDbAtgZNDX2Q2xKGTRI="; })
+  (fetchNuGet { pname = "System.Net.WebSockets"; version = "4.3.0"; hash = "sha256-l3h3cF1cCC9zMhWLKSDnZBZvFADUd0Afe2+iAwBA0r0="; })
+  (fetchNuGet { pname = "System.Net.WebSockets.Client"; version = "4.0.2"; hash = "sha256-miyjFY0E49/rtWDOF7QR26jJlYn3WRiQQOonSBJMFV0="; })
+  (fetchNuGet { pname = "System.Net.WebSockets.Client"; version = "4.3.2"; hash = "sha256-MwNKwIIpBJhC4Na6EYWMmVyPCa064Yp1aL0opx1FfoA="; })
+  (fetchNuGet { pname = "System.ObjectModel"; version = "4.3.0"; hash = "sha256-gtmRkWP2Kwr3nHtDh0yYtce38z1wrGzb6fjm4v8wN6Q="; })
+  (fetchNuGet { pname = "System.Private.DataContractSerialization"; version = "4.1.1"; hash = "sha256-OaE+ZcEfkpIkbdMOMAMiJa9vgiVP25FGuFrf+N/mafY="; })
+  (fetchNuGet { pname = "System.Private.DataContractSerialization"; version = "4.3.0"; hash = "sha256-vNlHUKkaFvhiVnTY0JNsNT5E6TW9CFRzTqVcufGN0hk="; })
+  (fetchNuGet { pname = "System.Private.Uri"; version = "4.3.0"; hash = "sha256-fVfgcoP4AVN1E5wHZbKBIOPYZ/xBeSIdsNF+bdukIRM="; })
+  (fetchNuGet { pname = "System.Reflection"; version = "4.1.0"; hash = "sha256-idZHGH2Yl/hha1CM4VzLhsaR8Ljo/rV7TYe7mwRJSMs="; })
+  (fetchNuGet { pname = "System.Reflection"; version = "4.3.0"; hash = "sha256-NQSZRpZLvtPWDlvmMIdGxcVuyUnw92ZURo0hXsEshXY="; })
+  (fetchNuGet { pname = "System.Reflection.Emit"; version = "4.0.1"; hash = "sha256-F1MvYoQWHCY89/O4JBwswogitqVvKuVfILFqA7dmuHk="; })
+  (fetchNuGet { pname = "System.Reflection.Emit"; version = "4.3.0"; hash = "sha256-5LhkDmhy2FkSxulXR+bsTtMzdU3VyyuZzsxp7/DwyIU="; })
+  (fetchNuGet { pname = "System.Reflection.Emit.ILGeneration"; version = "4.0.1"; hash = "sha256-YG+eJBG5P+5adsHiw/lhJwvREnvdHw6CJyS8ZV4Ujd0="; })
+  (fetchNuGet { pname = "System.Reflection.Emit.ILGeneration"; version = "4.3.0"; hash = "sha256-mKRknEHNls4gkRwrEgi39B+vSaAz/Gt3IALtS98xNnA="; })
+  (fetchNuGet { pname = "System.Reflection.Emit.Lightweight"; version = "4.0.1"; hash = "sha256-uVvNOnL64CPqsgZP2OLqNmxdkZl6Q0fTmKmv9gcBi+g="; })
+  (fetchNuGet { pname = "System.Reflection.Emit.Lightweight"; version = "4.3.0"; hash = "sha256-rKx4a9yZKcajloSZHr4CKTVJ6Vjh95ni+zszPxWjh2I="; })
+  (fetchNuGet { pname = "System.Reflection.Extensions"; version = "4.0.1"; hash = "sha256-NsfmzM9G/sN3H8X2cdnheTGRsh7zbRzvegnjDzDH/FQ="; })
+  (fetchNuGet { pname = "System.Reflection.Extensions"; version = "4.3.0"; hash = "sha256-mMOCYzUenjd4rWIfq7zIX9PFYk/daUyF0A8l1hbydAk="; })
+  (fetchNuGet { pname = "System.Reflection.Primitives"; version = "4.0.1"; hash = "sha256-SFSfpWEyCBMAOerrMCOiKnpT+UAWTvRcmoRquJR6Vq0="; })
+  (fetchNuGet { pname = "System.Reflection.Primitives"; version = "4.3.0"; hash = "sha256-5ogwWB4vlQTl3jjk1xjniG2ozbFIjZTL9ug0usZQuBM="; })
+  (fetchNuGet { pname = "System.Reflection.TypeExtensions"; version = "4.1.0"; hash = "sha256-R0YZowmFda+xzKNR4kKg7neFoE30KfZwp/IwfRSKVK4="; })
+  (fetchNuGet { pname = "System.Reflection.TypeExtensions"; version = "4.3.0"; hash = "sha256-4U4/XNQAnddgQIHIJq3P2T80hN0oPdU2uCeghsDTWng="; })
+  (fetchNuGet { pname = "System.Resources.ResourceManager"; version = "4.0.1"; hash = "sha256-cZ2/3/fczLjEpn6j3xkgQV9ouOVjy4Kisgw5xWw9kSw="; })
+  (fetchNuGet { pname = "System.Resources.ResourceManager"; version = "4.3.0"; hash = "sha256-idiOD93xbbrbwwSnD4mORA9RYi/D/U48eRUsn/WnWGo="; })
+  (fetchNuGet { pname = "System.Runtime"; version = "4.1.0"; hash = "sha256-FViNGM/4oWtlP6w0JC0vJU+k9efLKZ+yaXrnEeabDQo="; })
+  (fetchNuGet { pname = "System.Runtime"; version = "4.3.0"; hash = "sha256-51813WXpBIsuA6fUtE5XaRQjcWdQ2/lmEokJt97u0Rg="; })
+  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "6.0.0"; hash = "sha256-bEG1PnDp7uKYz/OgLOWs3RWwQSVYm+AnPwVmAmcgp2I="; })
+  (fetchNuGet { pname = "System.Runtime.Extensions"; version = "4.1.0"; hash = "sha256-X7DZ5CbPY7jHs20YZ7bmcXs9B5Mxptu/HnBUvUnNhGc="; })
+  (fetchNuGet { pname = "System.Runtime.Extensions"; version = "4.3.0"; hash = "sha256-wLDHmozr84v1W2zYCWYxxj0FR0JDYHSVRaRuDm0bd/o="; })
+  (fetchNuGet { pname = "System.Runtime.Handles"; version = "4.0.1"; hash = "sha256-j2QgVO9ZOjv7D1het98CoFpjoYgxjupuIhuBUmLLH7w="; })
+  (fetchNuGet { pname = "System.Runtime.Handles"; version = "4.3.0"; hash = "sha256-KJ5aXoGpB56Y6+iepBkdpx/AfaJDAitx4vrkLqR7gms="; })
+  (fetchNuGet { pname = "System.Runtime.InteropServices"; version = "4.1.0"; hash = "sha256-QceAYlJvkPRJc/+5jR+wQpNNI3aqGySWWSO30e/FfQY="; })
+  (fetchNuGet { pname = "System.Runtime.InteropServices"; version = "4.3.0"; hash = "sha256-8sDH+WUJfCR+7e4nfpftj/+lstEiZixWUBueR2zmHgI="; })
+  (fetchNuGet { pname = "System.Runtime.InteropServices.RuntimeInformation"; version = "4.3.0"; hash = "sha256-MYpl6/ZyC6hjmzWRIe+iDoldOMW1mfbwXsduAnXIKGA="; })
+  (fetchNuGet { pname = "System.Runtime.Numerics"; version = "4.0.1"; hash = "sha256-1pJt5ZGxLPTX1mjOi8qZPXyyOMkYV0NstoUCv91HYPg="; })
+  (fetchNuGet { pname = "System.Runtime.Numerics"; version = "4.3.0"; hash = "sha256-P5jHCgMbgFMYiONvzmaKFeOqcAIDPu/U8bOVrNPYKqc="; })
+  (fetchNuGet { pname = "System.Runtime.Serialization.Formatters"; version = "4.3.0"; hash = "sha256-Feic7MGKVG4imh7kpLkPHmApQzYjq7SxHnazh2wZkoQ="; })
+  (fetchNuGet { pname = "System.Runtime.Serialization.Json"; version = "4.0.2"; hash = "sha256-thmzgYbyxoPYtkDdDwoG7wnVuVhFNwLUE2AsDfRf1yM="; })
+  (fetchNuGet { pname = "System.Runtime.Serialization.Primitives"; version = "4.1.1"; hash = "sha256-80B05oxJbPLGq2pGOSl6NlZvintX9A1CNpna2aN0WRA="; })
+  (fetchNuGet { pname = "System.Runtime.Serialization.Primitives"; version = "4.3.0"; hash = "sha256-zu5m1M9usend+i9sbuD6Xbizdo8Z6N5PEF9DAtEVewc="; })
+  (fetchNuGet { pname = "System.Runtime.Serialization.Xml"; version = "4.3.0"; hash = "sha256-0bp8xtv2cP/IuxaBF8xkyYYD8N6w1wVX8wzpAwXtTKw="; })
+  (fetchNuGet { pname = "System.Security.Claims"; version = "4.3.0"; hash = "sha256-Fua/rDwAqq4UByRVomAxMPmDBGd5eImRqHVQIeSxbks="; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Algorithms"; version = "4.2.0"; hash = "sha256-BelNIpEyToEp/VYKnje/q1P7KNEpQNtOzGPU18pLGpE="; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Algorithms"; version = "4.3.0"; hash = "sha256-tAJvNSlczYBJ3Ed24Ae27a55tq/n4D3fubNQdwcKWA8="; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Cng"; version = "4.2.0"; hash = "sha256-7F+m3HnmBsgE4xWF8FeCGlaEgQM3drqA6HEaQr6MEoU="; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Cng"; version = "4.3.0"; hash = "sha256-u17vy6wNhqok91SrVLno2M1EzLHZm6VMca85xbVChsw="; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Csp"; version = "4.0.0"; hash = "sha256-WHyR6vVK3zaT4De7jgQFUar1P5fiX9ECwiVkJDFFm7M="; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Csp"; version = "4.3.0"; hash = "sha256-oefdTU/Z2PWU9nlat8uiRDGq/PGZoSPRgkML11pmvPQ="; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Encoding"; version = "4.0.0"; hash = "sha256-ZO7ha39J5uHkIF2RoEKv/bW/bLbVvYMO4+rWyYsKHik="; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Encoding"; version = "4.3.0"; hash = "sha256-Yuge89N6M+NcblcvXMeyHZ6kZDfwBv3LPMDiF8HhJss="; })
+  (fetchNuGet { pname = "System.Security.Cryptography.OpenSsl"; version = "4.0.0"; hash = "sha256-mLijAozynzjiOMyh2P5BHcfVq3Ovd0T/phG08SIbXZs="; })
+  (fetchNuGet { pname = "System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-DL+D2sc2JrQiB4oAcUggTFyD8w3aLEjJfod5JPe+Oz4="; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Primitives"; version = "4.0.0"; hash = "sha256-sEdPftfTxQd/8DpdpqUZC2XWC0SjVCPqAkEleLl17EQ="; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Primitives"; version = "4.3.0"; hash = "sha256-fnFi7B3SnVj5a+BbgXnbjnGNvWrCEU6Hp/wjsjWz318="; })
+  (fetchNuGet { pname = "System.Security.Cryptography.X509Certificates"; version = "4.1.0"; hash = "sha256-sBUUhJP+yYDXvcjNMKqNpn8yzGUpVABwK9vVUvYKjzI="; })
+  (fetchNuGet { pname = "System.Security.Cryptography.X509Certificates"; version = "4.3.0"; hash = "sha256-MG3V/owDh273GCUPsGGraNwaVpcydupl3EtPXj6TVG0="; })
+  (fetchNuGet { pname = "System.Security.Principal"; version = "4.3.0"; hash = "sha256-rjudVUHdo8pNJg2EVEn0XxxwNo5h2EaYo+QboPkXlYk="; })
+  (fetchNuGet { pname = "System.Security.Principal.Windows"; version = "4.3.0"; hash = "sha256-mbdLVUcEwe78p3ZnB6jYsizNEqxMaCAWI3tEQNhRQAE="; })
+  (fetchNuGet { pname = "System.Text.Encoding"; version = "4.0.11"; hash = "sha256-PEailOvG05CVgPTyKLtpAgRydlSHmtd5K0Y8GSHY2Lc="; })
+  (fetchNuGet { pname = "System.Text.Encoding"; version = "4.3.0"; hash = "sha256-GctHVGLZAa/rqkBNhsBGnsiWdKyv6VDubYpGkuOkBLg="; })
+  (fetchNuGet { pname = "System.Text.Encoding.Extensions"; version = "4.0.11"; hash = "sha256-+kf7J3dEhgCbnCM5vHYlsTm5/R/Ud0Jr6elpHm922iI="; })
+  (fetchNuGet { pname = "System.Text.Encoding.Extensions"; version = "4.3.0"; hash = "sha256-vufHXg8QAKxHlujPHHcrtGwAqFmsCD6HKjfDAiHyAYc="; })
+  (fetchNuGet { pname = "System.Text.RegularExpressions"; version = "4.1.0"; hash = "sha256-x6OQN6MCN7S0fJ6EFTfv4rczdUWjwuWE9QQ0P6fbh9c="; })
+  (fetchNuGet { pname = "System.Text.RegularExpressions"; version = "4.3.0"; hash = "sha256-VLCk1D1kcN2wbAe3d0YQM/PqCsPHOuqlBY1yd2Yo+K0="; })
+  (fetchNuGet { pname = "System.Threading"; version = "4.0.11"; hash = "sha256-mob1Zv3qLQhQ1/xOLXZmYqpniNUMCfn02n8ZkaAhqac="; })
+  (fetchNuGet { pname = "System.Threading"; version = "4.3.0"; hash = "sha256-ZDQ3dR4pzVwmaqBg4hacZaVenQ/3yAF/uV7BXZXjiWc="; })
+  (fetchNuGet { pname = "System.Threading.Tasks"; version = "4.0.11"; hash = "sha256-5SLxzFg1df6bTm2t09xeI01wa5qQglqUwwJNlQPJIVs="; })
+  (fetchNuGet { pname = "System.Threading.Tasks"; version = "4.3.0"; hash = "sha256-Z5rXfJ1EXp3G32IKZGiZ6koMjRu0n8C1NGrwpdIen4w="; })
+  (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.0.0"; hash = "sha256-+YdcPkMhZhRbMZHnfsDwpNbUkr31X7pQFGxXYcAPZbE="; })
+  (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.3.0"; hash = "sha256-X2hQ5j+fxcmnm88Le/kSavjiGOmkcumBGTZKBLvorPc="; })
+  (fetchNuGet { pname = "System.Threading.Thread"; version = "4.3.0"; hash = "sha256-pMs6RNFC3nQOGz9EqIcyWmO8YLaqay+q/Qde5hqPXXg="; })
+  (fetchNuGet { pname = "System.Threading.ThreadPool"; version = "4.3.0"; hash = "sha256-wW0QdvssRoaOfQLazTGSnwYTurE4R8FxDx70pYkL+gg="; })
+  (fetchNuGet { pname = "System.Threading.Timer"; version = "4.3.0"; hash = "sha256-pmhslmhQhP32TWbBzoITLZ4BoORBqYk25OWbru04p9s="; })
+  (fetchNuGet { pname = "System.Xml.ReaderWriter"; version = "4.0.11"; hash = "sha256-haZAFFQ9Sl2DhfvEbdx2YRqKEoxNMU5STaqpMmXw0zA="; })
+  (fetchNuGet { pname = "System.Xml.ReaderWriter"; version = "4.3.0"; hash = "sha256-QQ8KgU0lu4F5Unh+TbechO//zaAGZ4MfgvW72Cn1hzA="; })
+  (fetchNuGet { pname = "System.Xml.XDocument"; version = "4.3.0"; hash = "sha256-rWtdcmcuElNOSzCehflyKwHkDRpiOhJJs8CeQ0l1CCI="; })
+  (fetchNuGet { pname = "System.Xml.XmlDocument"; version = "4.0.1"; hash = "sha256-gdoFrPo54v1LjkBF79f8EvtltVVjHz9ZI9kc5ve0GkY="; })
+  (fetchNuGet { pname = "System.Xml.XmlDocument"; version = "4.3.0"; hash = "sha256-kbuV4Y7rVJkfMp2Kgoi8Zvdatm9CZNmlKB3GZgANvy4="; })
+  (fetchNuGet { pname = "System.Xml.XmlSerializer"; version = "4.0.11"; hash = "sha256-v6x4d6W18dijG5cDqQmVHdtWRf6Y4OkdBolT3d5g3wY="; })
+  (fetchNuGet { pname = "System.Xml.XmlSerializer"; version = "4.3.0"; hash = "sha256-IqTGPENWYoI06x2NHFPVtHlLEq9tazbom32bFLom6h4="; })
 ]
diff --git a/pkgs/applications/blockchains/optimism/default.nix b/pkgs/applications/blockchains/optimism/default.nix
index 14c763e27c23..945ef865f964 100644
--- a/pkgs/applications/blockchains/optimism/default.nix
+++ b/pkgs/applications/blockchains/optimism/default.nix
@@ -6,19 +6,19 @@
 
 buildGoModule rec {
   pname = "optimism";
-  version = "1.9.0";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "ethereum-optimism";
     repo = "optimism";
     rev = "op-node/v${version}";
-    hash = "sha256-TIxA+Dyxdwm3Q8U6xh7x7hBPNXmH+vVDK2lAaRFKSN0=";
+    hash = "sha256-PlwpN8P1t0NNIU+Ys50dIXmfUQFIY9e1tLABiVK0JQo=";
     fetchSubmodules = true;
   };
 
   subPackages = [ "op-node/cmd" "op-proposer/cmd" "op-batcher/cmd" ];
 
-  vendorHash = "sha256-xoflPeUeFlbMBUSas+dmBOCFOOvrBHEvYWEk7QkNW14=";
+  vendorHash = "sha256-n1uJ/dkEjjsTdmL7TeHU4PKnBhiRrqCNtcGxK70Q0c4=";
 
   buildInputs = [
     libpcap
diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index 8e06f7a07d1b..68c5b6799f6d 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -9,16 +9,16 @@ let
     inherit tiling_wm;
   };
   stableVersion = {
-    version = "2024.1.1.13"; # "Android Studio Koala | 2024.1.1 Patch 2"
-    sha256Hash = "sha256-h8kOL/vULA1eCmVxP62T9I5oATTS40Qs2YAI4riRadY=";
+    version = "2024.1.2.12"; # "Android Studio Koala Feature Drop | 2024.1.2"
+    sha256Hash = "sha256-dFFogg6YmpCF/4QtR85UFAfbCd97irIHcPbqieQabpI=";
   };
   betaVersion = {
     version = "2024.1.2.11"; # "Android Studio Koala Feature Drop | 2024.1.2 RC 1"
     sha256Hash = "sha256-Qn5NNW2Rt6f9QiEUamIumme45uUVeTiMJ/9niAC6ilM=";
   };
   latestVersion = {
-    version = "2024.2.1.3"; # "Android Studio Ladybug | 2024.2.1 Canary 7"
-    sha256Hash = "sha256-HECowgJ7b6PjYHb+lRuFLzl9wWwWfFWNI0cSijwG7LA=";
+    version = "2024.2.1.4"; # "Android Studio Ladybug | 2024.2.1 Canary 8"
+    sha256Hash = "sha256-H2NN6/ywQCMunX1mk0gbgEoY75gHV+fpru+mZNe9fpk=";
   };
 in {
   # Attributes are named by their corresponding release channels
diff --git a/pkgs/applications/file-managers/nnn/default.nix b/pkgs/applications/file-managers/nnn/default.nix
index fe1cf6778027..6ad01c156338 100644
--- a/pkgs/applications/file-managers/nnn/default.nix
+++ b/pkgs/applications/file-managers/nnn/default.nix
@@ -26,13 +26,13 @@ assert withEmojis -> (!withIcons && !withNerdIcons);
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nnn";
-  version = "4.9";
+  version = "5.0";
 
   src = fetchFromGitHub {
     owner = "jarun";
     repo = "nnn";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-g19uI36HyzTF2YUQKFP4DE2ZBsArGryVHhX79Y0XzhU=";
+    hash = "sha256-HShHSjqD0zeE1/St1Y2dUeHfac6HQnPFfjmFvSuEXUA=";
   };
 
   patches = [
diff --git a/pkgs/applications/graphics/cloudcompare/default.nix b/pkgs/applications/graphics/cloudcompare/default.nix
index 37543db1babd..738ce255a4cf 100644
--- a/pkgs/applications/graphics/cloudcompare/default.nix
+++ b/pkgs/applications/graphics/cloudcompare/default.nix
@@ -12,7 +12,6 @@
 , gmp
 , laszip
 , mpfr
-, pdal
 , pcl
 , qtbase
 , qtsvg
@@ -49,7 +48,6 @@ mkDerivation rec {
     gmp
     laszip
     mpfr
-    pdal
     pcl
     qtbase
     qtsvg
@@ -72,7 +70,7 @@ mkDerivation rec {
     "-DPLUGIN_IO_QCSV_MATRIX=ON"
     "-DPLUGIN_IO_QE57=ON"
     "-DPLUGIN_IO_QFBX=OFF" # Autodesk FBX SDK is gratis+proprietary; not packaged in nixpkgs
-    "-DPLUGIN_IO_QPDAL=ON" # required for .las/.laz support
+    "-DPLUGIN_IO_QLAS=ON" # required for .las/.laz support
     "-DPLUGIN_IO_QPHOTOSCAN=ON"
     "-DPLUGIN_IO_QRDB=OFF" # Riegl rdblib is proprietary; not packaged in nixpkgs
 
diff --git a/pkgs/applications/misc/exercism/default.nix b/pkgs/applications/misc/exercism/default.nix
index bcd611573aed..f61de362ac7a 100644
--- a/pkgs/applications/misc/exercism/default.nix
+++ b/pkgs/applications/misc/exercism/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "exercism";
-  version = "3.4.1";
+  version = "3.5.1";
 
   src = fetchFromGitHub {
     owner = "exercism";
     repo  = "cli";
     rev   = "refs/tags/v${version}";
-    hash  = "sha256-ohqfwK0RWSY7/GsUa/VTAD5pcuzQIkx8z3n5rKEb7hY=";
+    hash  = "sha256-AqGSwHQdY/m6aJYbjJdt+IYr5n1Jf7LW4paCOxjptjA=";
   };
 
   vendorHash = "sha256-xY3C3emqtPIKyxIN9aEkrLXhTxWNmo0EJXNZVtbtIvs=";
diff --git a/pkgs/applications/misc/tickrs/default.nix b/pkgs/applications/misc/tickrs/default.nix
index 29587be9bcde..f2cc437ab9b6 100644
--- a/pkgs/applications/misc/tickrs/default.nix
+++ b/pkgs/applications/misc/tickrs/default.nix
@@ -41,7 +41,7 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/tarkah/tickrs";
     changelog = "https://github.com/tarkah/tickrs/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
-    maintainers = with maintainers; [ mredaelli ];
+    maintainers = with maintainers; [ ];
     mainProgram = "tickrs";
   };
 }
diff --git a/pkgs/applications/networking/browsers/microsoft-edge/default.nix b/pkgs/applications/networking/browsers/microsoft-edge/default.nix
index 0f596386ace9..6f899c924ff2 100644
--- a/pkgs/applications/networking/browsers/microsoft-edge/default.nix
+++ b/pkgs/applications/networking/browsers/microsoft-edge/default.nix
@@ -1,20 +1,20 @@
 {
   beta = import ./browser.nix {
     channel = "beta";
-    version = "128.0.2739.5";
+    version = "128.0.2739.42";
     revision = "1";
-    hash = "sha256-y+587iVWgPk2a1P/F2iwSW1NEnAJaigL6rlVmqaIDJk=";
+    hash = "sha256-VcBn2WL4rdAeEa62XT/dhC2OFLsV0Q/Sp6hqgmc/e0Y=";
   };
   dev = import ./browser.nix {
     channel = "dev";
-    version = "128.0.2739.5";
+    version = "129.0.2779.0";
     revision = "1";
-    hash = "sha256-zY3iGbeYlOoArNNdF1qNwdtp25P0uWJmVMEK7kJIiqQ=";
+    hash = "sha256-hlamsHTpBMGwOICga0k874q8+xuaZFMofFLG/EvB0NU=";
   };
   stable = import ./browser.nix {
     channel = "stable";
-    version = "127.0.2651.86";
+    version = "128.0.2739.42";
     revision = "1";
-    hash = "sha256-1Dh+OoTrghn9ArvEnBZCkLnUf0m0qnkEtCoWjA8QId4=";
+    hash = "sha256-AwdZX2Ens2+rhHLYV0efYsXYBTs2a57HyGz2k+IDMeQ=";
   };
 }
diff --git a/pkgs/applications/networking/cluster/kubefirst/default.nix b/pkgs/applications/networking/cluster/kubefirst/default.nix
index 19c416d5e69b..d9ccd5d5148f 100644
--- a/pkgs/applications/networking/cluster/kubefirst/default.nix
+++ b/pkgs/applications/networking/cluster/kubefirst/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "kubefirst";
-  version = "2.4.17";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "kubefirst";
     repo = "kubefirst";
     rev = "refs/tags/v${version}";
-    hash = "sha256-wYPrQkoz1rivfnhku3Njj8e/rJc2GuT1HOPyNSada+o=";
+    hash = "sha256-1VadsiZZii6gI8vdTNfwmbBPuHcgPh4kWZ2jf/EkFKU=";
   };
 
-  vendorHash = "sha256-ymqBSNzgK79IYSZ+WR+0yi01008jIPaRJ7vnnxMDycY=";
+  vendorHash = "sha256-tOCVDp9oClfeBsyZ6gv6HoGPjZByoxxAceV/wxQeBSA=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/applications/networking/cluster/sonobuoy/default.nix b/pkgs/applications/networking/cluster/sonobuoy/default.nix
index a62efd6833fb..e86d9c920c3a 100644
--- a/pkgs/applications/networking/cluster/sonobuoy/default.nix
+++ b/pkgs/applications/networking/cluster/sonobuoy/default.nix
@@ -2,11 +2,11 @@
 
 # SHA of ${version} for the tool's help output. Unfortunately this is needed in build flags.
 # The update script can update this automatically, the comment is used to find the line.
-let rev = "6f9e27f1795f10475c9f6f5decdff692e1e228da"; # update-commit-sha
+let rev = "cc22d58f4c8b5a155bd1778cd3702eca5ad43e05"; # update-commit-sha
 in
 buildGoModule rec {
   pname = "sonobuoy";
-  version = "0.57.1"; # Do not forget to update `rev` above
+  version = "0.57.2"; # Do not forget to update `rev` above
 
   ldflags =
     let t = "github.com/vmware-tanzu/sonobuoy";
@@ -21,10 +21,10 @@ buildGoModule rec {
     owner = "vmware-tanzu";
     repo = "sonobuoy";
     rev = "v${version}";
-    hash = "sha256-e9C5ZwKqT3Fiko2HqrIpONVvjhT8KBBO7rQc3BJhl+A=";
+    hash = "sha256-QRHCAnZwz90ZVaZUbg7Jv1VlobbcY5mbFQbMQJfHsfU=";
   };
 
-  vendorHash = "sha256-HE53eIEyhOI9ksEx1EKmv/txaTa7KDrNUMEVRMi4Wuo=";
+  vendorHash = "sha256-QUKdCsbxobusyaPWLMJujPgmWIT3mBajgy98BUAgPyk=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/applications/networking/feedreaders/newsboat/default.nix b/pkgs/applications/networking/feedreaders/newsboat/default.nix
index 5d0249249478..43f3c565d244 100644
--- a/pkgs/applications/networking/feedreaders/newsboat/default.nix
+++ b/pkgs/applications/networking/feedreaders/newsboat/default.nix
@@ -66,5 +66,6 @@ rustPlatform.buildRustPackage rec {
     maintainers = with lib.maintainers; [ dotlambda nicknovitski ];
     license     = lib.licenses.mit;
     platforms   = lib.platforms.unix;
+    mainProgram = "newsboat";
   };
 }
diff --git a/pkgs/applications/networking/iroh/default.nix b/pkgs/applications/networking/iroh/default.nix
index c976b7f82628..1ba9611bf94a 100644
--- a/pkgs/applications/networking/iroh/default.nix
+++ b/pkgs/applications/networking/iroh/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "iroh";
-  version = "0.21.0";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "n0-computer";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-g/x5lVVrm1NrJbqmhza/wryEwuXHh1tDBf+x6vL+2n0=";
+    hash = "sha256-kXKA0gDmxruoHLTB9zJ36ydqqwaeyQm/Icqgv6API0k=";
   };
 
-  cargoHash = "sha256-Sp2yMF/M3SuNB1DDQ79Lau5IxtSM1NPLJi9TnHWqnuc=";
+  cargoHash = "sha256-XUokfLMXIYfiN4A2/aYYhq0N7H2vsZL1uvKg498M3yA=";
 
   buildInputs = lib.optionals stdenv.isDarwin (
     with darwin.apple_sdk.frameworks; [
diff --git a/pkgs/applications/networking/sync/onedrive/default.nix b/pkgs/applications/networking/sync/onedrive/default.nix
deleted file mode 100644
index d7dd30b106c8..000000000000
--- a/pkgs/applications/networking/sync/onedrive/default.nix
+++ /dev/null
@@ -1,57 +0,0 @@
-{ stdenv
-, lib
-, fetchFromGitHub
-, autoreconfHook
-, ldc
-, installShellFiles
-, pkg-config
-, curl
-, sqlite
-, libnotify
-, withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd
-, systemd
-}:
-
-stdenv.mkDerivation rec {
-  pname = "onedrive";
-  version = "2.4.25";
-
-  src = fetchFromGitHub {
-    owner = "abraunegg";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-M6EOJiykmAKWIuAXdm9ebTSX1eVoO+1axgzxlAmuI8U=";
-  };
-
-  nativeBuildInputs = [ autoreconfHook ldc installShellFiles pkg-config ];
-
-  buildInputs = [
-    curl
-    sqlite
-    libnotify
-  ] ++ lib.optional withSystemd systemd;
-
-  configureFlags = [
-    "--enable-notifications"
-  ] ++ lib.optionals withSystemd [
-    "--with-systemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
-    "--with-systemduserunitdir=${placeholder "out"}/lib/systemd/user"
-  ];
-
-  # we could also pass --enable-completions to configure but we would then have to
-  # figure out the paths manually and pass those along.
-  postInstall = ''
-    installShellCompletion --bash --name ${pname}  contrib/completions/complete.bash
-    installShellCompletion --zsh  --name _${pname} contrib/completions/complete.zsh
-    installShellCompletion --fish --name ${pname}  contrib/completions/complete.fish
-  '';
-
-  meta = with lib; {
-    description = "Complete tool to interact with OneDrive on Linux";
-    mainProgram = "onedrive";
-    homepage = "https://github.com/abraunegg/onedrive";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ srgom peterhoeg bertof ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/applications/science/chemistry/nwchem/default.nix b/pkgs/applications/science/chemistry/nwchem/default.nix
index af63e2a77568..44ce15229017 100644
--- a/pkgs/applications/science/chemistry/nwchem/default.nix
+++ b/pkgs/applications/science/chemistry/nwchem/default.nix
@@ -32,7 +32,7 @@ let
   };
 
   dftd3Src = fetchurl {
-    url = "https://www.chemiebn.uni-bonn.de/pctc/mulliken-center/software/dft-d3/dftd3.tgz";
+    url = "https://www.chemie.uni-bonn.de/grimme/software/dft-d3/dftd3.tgz";
     hash = "sha256-2Xz5dY9hqoH9hUJUSPv0pujOB8EukjZzmDGjrzKID1k=";
   };
 
@@ -45,20 +45,20 @@ let
   plumedSrc = fetchFromGitHub {
     owner = "edoapra";
     repo = "plumed2";
-    rev = "e7c908da50bde1c6399c9f0e445d6ea3330ddd9b";
-    hash = "sha256-CNlb6MTEkD977hj3xonYqZH1/WlQ1EdVD7cvL//heRM=";
+    rev = "88f06db71173e7893713a582e5ada7193e8ae1c9";
+    hash = "sha256-p5XNxHcE/QkJ5WdQH/xPp2EyrqCNjA/w/e1R2fkwYts=";
   };
 
 in
 stdenv.mkDerivation rec {
   pname = "nwchem";
-  version = "7.2.2";
+  version = "7.2.3";
 
   src = fetchFromGitHub {
     owner = "nwchemgit";
     repo = "nwchem";
     rev = "v${version}-release";
-    hash = "sha256-BcYRqPaPR24OTRY0MJgBxi46HvUG4uFaY0unZmu5b9k=";
+    hash = "sha256-2qc4kLb/WmUJuJGonIyS7pgCfyt8yXdcpDAKU0RMY58=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/electronics/nvc/default.nix b/pkgs/applications/science/electronics/nvc/default.nix
index c05527234f70..f0d49ac11f02 100644
--- a/pkgs/applications/science/electronics/nvc/default.nix
+++ b/pkgs/applications/science/electronics/nvc/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nvc";
-  version = "1.13.2";
+  version = "1.13.3";
 
   src = fetchFromGitHub {
     owner = "nickg";
     repo = "nvc";
     rev = "r${version}";
-    hash = "sha256-ir4/zwGaIGMUP8kVqoXV1Kn2A8yJYVQHJpb1sVfhOSI=";
+    hash = "sha256-u+EmZ+h+TVBHEmrELgU4s1C+Z8Cfp3gN9BnQruwCsYU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/math/cplex/default.nix b/pkgs/applications/science/math/cplex/default.nix
index ddc950b30664..e80444b70b27 100644
--- a/pkgs/applications/science/math/cplex/default.nix
+++ b/pkgs/applications/science/math/cplex/default.nix
@@ -9,14 +9,14 @@
 
 stdenv.mkDerivation rec {
   pname = "cplex";
-  version = "128";
+  version = "22.11";
 
   src =
     if releasePath == null then
       throw ''
         This nix expression requires that the cplex installer is already
         downloaded to your machine. Get it from IBM:
-        https://developer.ibm.com/docloud/blog/2017/12/20/cplex-optimization-studio-12-8-now-available/
+        https://www.ibm.com/support/pages/downloading-ibm-ilog-cplex-optimization-studio-2211
 
         Set `cplex.releasePath = /path/to/download;` in your
         ~/.config/nixpkgs/config.nix for `nix-*` commands, or
@@ -36,7 +36,8 @@ stdenv.mkDerivation rec {
   '';
 
   buildPhase = ''
-    sh $name -i silent -DLICENSE_ACCEPTED=TRUE -DUSER_INSTALL_DIR=$out
+     export JAVA_TOOL_OPTIONS=-Djdk.util.zip.disableZip64ExtraFieldValidation=true
+     sh $name LAX_VM ${openjdk}/bin/java -i silent -DLICENSE_ACCEPTED=TRUE -DUSER_INSTALL_DIR=$out
   '';
 
   installPhase = ''
diff --git a/pkgs/applications/virtualization/lima/bin.nix b/pkgs/applications/virtualization/lima/bin.nix
index ba26d9e6041d..7549f0c1528b 100644
--- a/pkgs/applications/virtualization/lima/bin.nix
+++ b/pkgs/applications/virtualization/lima/bin.nix
@@ -57,10 +57,17 @@ stdenvNoCC.mkDerivation {
     chmod +x $out/bin/limactl
     wrapProgram $out/bin/limactl \
       --prefix PATH : ${lib.makeBinPath [ qemu ]}
-    installShellCompletion --cmd limactl \
-      --bash <($out/bin/limactl completion bash) \
-      --fish <($out/bin/limactl completion fish) \
-      --zsh <($out/bin/limactl completion zsh)
+
+    # the shell completion only works with a patched $out/bin/limactl and so
+    # needs to run after the autoPatchelfHook is executed in postFixup.
+    doShellCompletion() {
+      installShellCompletion --cmd limactl \
+        --bash <($out/bin/limactl completion bash) \
+        --fish <($out/bin/limactl completion fish) \
+        --zsh <($out/bin/limactl completion zsh)
+    }
+    postFixupHooks+=(doShellCompletion)
+
     runHook postInstall
   '';
 
diff --git a/pkgs/applications/virtualization/virtualbox/default.nix b/pkgs/applications/virtualization/virtualbox/default.nix
index 9173e9474052..3f27170311cd 100644
--- a/pkgs/applications/virtualization/virtualbox/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/default.nix
@@ -32,8 +32,8 @@ let
   virtualboxVersion = "7.0.20";
   virtualboxSha256 = "5cf5979bef66ebab3fcd495796b215a940e8a07c469d4bc56d064de44222dd02";
 
-  kvmPatchVersion = "20240617";
-  kvmPatchHash = "sha256-bOcM9xA1SXB1uTwljpw2vevVeSdHa3omCRon/8DoAUk=";
+  kvmPatchVersion = "20240828";
+  kvmPatchHash = "sha256-g0esJbB1IGyLGZMLFJIY8ZYdHWuiM5IZtLMHZvCY6bs=";
 
   # The KVM build is not compatible to VirtualBox's kernel modules. So don't export
   # modsrc at all.
diff --git a/pkgs/build-support/node/build-npm-package/hooks/default.nix b/pkgs/build-support/node/build-npm-package/hooks/default.nix
index 36f0319e3d23..7a4fed30f5d5 100644
--- a/pkgs/build-support/node/build-npm-package/hooks/default.nix
+++ b/pkgs/build-support/node/build-npm-package/hooks/default.nix
@@ -7,6 +7,8 @@
 , prefetch-npm-deps
 , diffutils
 , installShellFiles
+, nodejsInstallManuals
+, nodejsInstallExecutables
 }:
 
 {
@@ -39,9 +41,10 @@
       propagatedBuildInputs = [
         installShellFiles
         makeWrapper
+        nodejsInstallManuals
+        nodejsInstallExecutables
       ];
       substitutions = {
-        hostNode = "${nodejs}/bin/node";
         jq = "${jq}/bin/jq";
       };
     } ./npm-install-hook.sh;
diff --git a/pkgs/build-support/node/build-npm-package/hooks/npm-install-hook.sh b/pkgs/build-support/node/build-npm-package/hooks/npm-install-hook.sh
index 750ed421789f..d495caf2d048 100644
--- a/pkgs/build-support/node/build-npm-package/hooks/npm-install-hook.sh
+++ b/pkgs/build-support/node/build-npm-package/hooks/npm-install-hook.sh
@@ -14,31 +14,9 @@ npmInstallHook() {
         cp "${npmWorkspace-.}/$file" "$dest"
     done < <(@jq@ --raw-output '.[0].files | map(.path | select(. | startswith("node_modules/") | not)) | join("\n")' <<< "$(npm_config_cache="$HOME/.npm" npm pack --json --dry-run --loglevel=warn --no-foreground-scripts ${npmWorkspace+--workspace=$npmWorkspace} $npmPackFlags "${npmPackFlagsArray[@]}" $npmFlags "${npmFlagsArray[@]}")")
 
-    # Based on code from Python's buildPythonPackage wrap.sh script, for
-    # supporting both the case when makeWrapperArgs is an array and a
-    # IFS-separated string.
-    #
-    # TODO: remove the string branch when __structuredAttrs are used.
-    if [[ "${makeWrapperArgs+defined}" == "defined" && "$(declare -p makeWrapperArgs)" =~ ^'declare -a makeWrapperArgs=' ]]; then
-        local -a user_args=("${makeWrapperArgs[@]}")
-    else
-        local -a user_args="(${makeWrapperArgs:-})"
-    fi
-    while IFS=" " read -ra bin; do
-        mkdir -p "$out/bin"
-        makeWrapper @hostNode@ "$out/bin/${bin[0]}" --add-flags "$packageOut/${bin[1]}" "${user_args[@]}"
-    done < <(@jq@ --raw-output '(.bin | type) as $typ | if $typ == "string" then
-        .name + " " + .bin
-        elif $typ == "object" then .bin | to_entries | map(.key + " " + .value) | join("\n")
-        elif $typ == "null" then empty
-        else "invalid type " + $typ | halt_error end' "${npmWorkspace-.}/package.json")
+    nodejsInstallExecutables "${npmWorkspace-.}/package.json"
 
-    while IFS= read -r man; do
-        installManPage "$packageOut/$man"
-    done < <(@jq@ --raw-output '(.man | type) as $typ | if $typ == "string" then .man
-        elif $typ == "list" then .man | join("\n")
-        elif $typ == "null" then empty
-        else "invalid type " + $typ | halt_error end' "${npmWorkspace-.}/package.json")
+    nodejsInstallManuals "${npmWorkspace-.}/package.json"
 
     local -r nodeModulesPath="$packageOut/node_modules"
 
diff --git a/pkgs/build-support/singularity-tools/default.nix b/pkgs/build-support/singularity-tools/default.nix
index 249c3c8c85f1..2a6716962879 100644
--- a/pkgs/build-support/singularity-tools/default.nix
+++ b/pkgs/build-support/singularity-tools/default.nix
@@ -5,8 +5,9 @@
   runCommand,
   vmTools,
   writeClosure,
-  writers,
+  writeDirectReferencesToFile,
   writeScript,
+  writeStringReferencesToFile,
   # Native build inputs
   buildPackages,
   e2fsprogs,
@@ -69,10 +70,16 @@ lib.makeExtensible (final: {
         set -e
         ${runAsRoot}
       '';
-      runScriptFile = writers.writeBash "run-script.sh" ''
+      runScriptFile = writeScript "run-script.sh" ''
+        #!/bin/sh
         set -e
         ${runScript}
       '';
+      runScriptReferences =
+        if builtins ? getContext then
+          lib.splitString "\n" (writeStringReferencesToFile runScriptFile.text).text
+        else
+          [ (writeDirectReferencesToFile runScriptFile) ];
       result = vmTools.runInLinuxVM (
         runCommand "${projectName}-image-${name}.sif"
           {
@@ -82,13 +89,7 @@ lib.makeExtensible (final: {
               util-linux
             ];
             strictDeps = true;
-            layerClosure = writeClosure (
-              [
-                bashInteractive
-                runScriptFile
-              ]
-              ++ contents
-            );
+            layerClosure = writeClosure ([ bashInteractive ] ++ runScriptReferences ++ contents);
             preVM = vmTools.createEmptyImage {
               size = diskSize;
               fullName = "${projectName}-run-disk";
@@ -134,12 +135,14 @@ lib.makeExtensible (final: {
               done
             done
 
-            # Create runScript and link shell
+            # Link /bin/sh
             if [ ! -e bin/sh ]; then
               ln -s ${lib.getExe bashInteractive} bin/sh
             fi
             mkdir -p .singularity.d
-            ln -s ${runScriptFile} .singularity.d/runscript
+
+            # Create runscript
+            cp "${runScriptFile}" .singularity.d/runscript
 
             # Fill out .singularity.d
             mkdir -p .singularity.d/env
diff --git a/pkgs/by-name/am/amdvlk/package.nix b/pkgs/by-name/am/amdvlk/package.nix
index 2b67caeb7fd2..8adf2b030d52 100644
--- a/pkgs/by-name/am/amdvlk/package.nix
+++ b/pkgs/by-name/am/amdvlk/package.nix
@@ -27,13 +27,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "amdvlk";
-  version = "2024.Q3.1";
+  version = "2024.Q3.2";
 
   src = fetchRepoProject {
     name = "amdvlk-src";
     manifest = "https://github.com/GPUOpen-Drivers/AMDVLK.git";
     rev = "refs/tags/v-${finalAttrs.version}";
-    sha256 = "IZYv9ZfpIllYUhJ3f7AOFmSl7OfWWY8doaG8pe3GE+4=";
+    sha256 = "1Svdr93ShjhaWJUTLn5y1kBM4hHey1dUVDiHqFIKgrU=";
   };
 
   buildInputs =
diff --git a/pkgs/by-name/an/anytype/package.nix b/pkgs/by-name/an/anytype/package.nix
index ea4619b2ba4e..619ca4adefd5 100644
--- a/pkgs/by-name/an/anytype/package.nix
+++ b/pkgs/by-name/an/anytype/package.nix
@@ -2,11 +2,11 @@
 
 let
   pname = "anytype";
-  version = "0.42.4";
+  version = "0.42.5";
   name = "Anytype-${version}";
   src = fetchurl {
     url = "https://github.com/anyproto/anytype-ts/releases/download/v${version}/${name}.AppImage";
-    hash = "sha256-SFLjjr+L7eTqaZ2teug7mzXhIU+eVebBqrE4q5aasLk=";
+    hash = "sha256-43g/CdmmQTSxk7OTZMPIiWIYJjCG2zJNM9kaAq1jOqE=";
   };
   appimageContents = appimageTools.extractType2 { inherit pname version src; };
 in appimageTools.wrapType2 {
diff --git a/pkgs/by-name/ba/badger/package.nix b/pkgs/by-name/ba/badger/package.nix
index 4c41b8f88496..1188c115dafd 100644
--- a/pkgs/by-name/ba/badger/package.nix
+++ b/pkgs/by-name/ba/badger/package.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "badger";
-  version = "4.2.0";
+  version = "4.3.0";
 
   src = fetchFromGitHub {
     owner = "dgraph-io";
     repo = "badger";
     rev = "v${version}";
-    hash = "sha256-+b+VTGUGmqixB51f1U2QK+XfVra4zXybW19n/CeeoAQ=";
+    hash = "sha256-Kzhua1nF9Y0j6Ez35ucKdYMRR46yEwM0pJ8P6A7pUrw=";
   };
 
-  vendorHash = "sha256-YiSmxtRt8HtYcvPL9ZKMjb2ch/MZBjZp5pIIBdqQ7Nw=";
+  vendorHash = "sha256-A9rMLWjCpM9VrXmWXNo/mZbGCBKrakxbjthVOl2aDa4=";
 
   subPackages = [ "badger" ];
 
diff --git a/pkgs/by-name/co/consul/package.nix b/pkgs/by-name/co/consul/package.nix
index 74f1ccbad672..824d0128f9a1 100644
--- a/pkgs/by-name/co/consul/package.nix
+++ b/pkgs/by-name/co/consul/package.nix
@@ -8,7 +8,7 @@
 
 buildGoModule rec {
   pname = "consul";
-  version = "1.19.1";
+  version = "1.19.2";
 
   # Note: Currently only release tags are supported, because they have the Consul UI
   # vendored. See
@@ -22,7 +22,7 @@ buildGoModule rec {
     owner = "hashicorp";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-UMKXI16QQHV9I+kH62KRbZCEcQLXkBwB6o/lqtCZa78=";
+    hash = "sha256-BDEKnwX4OZ9eRvcZ3StpJTJM4P0/VvQGEQyaPg0AJhM=";
   };
 
   # This corresponds to paths with package main - normally unneeded but consul
@@ -32,7 +32,7 @@ buildGoModule rec {
     "connect/certgen"
   ];
 
-  vendorHash = "sha256-l1+KVygh0TuvN45UmU/bXksjHBTZZ6jt54nZtR9f+II=";
+  vendorHash = "sha256-n37MNBWMQnX6nMV7FvWF8acO5W4Y3GHzZj2rkulZruY=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/do/docfd/package.nix b/pkgs/by-name/do/docfd/package.nix
index 3636296b8de4..18b80cf7142b 100644
--- a/pkgs/by-name/do/docfd/package.nix
+++ b/pkgs/by-name/do/docfd/package.nix
@@ -42,7 +42,6 @@ buildDunePackage' rec {
     cmdliner
     containers-data
     digestif
-    domainslib
     eio_main
     lwd
     nottui
diff --git a/pkgs/by-name/fi/files-cli/package.nix b/pkgs/by-name/fi/files-cli/package.nix
index b787a99fa67a..82aaa4af8a44 100644
--- a/pkgs/by-name/fi/files-cli/package.nix
+++ b/pkgs/by-name/fi/files-cli/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "files-cli";
-  version = "2.13.122";
+  version = "2.13.128";
 
   src = fetchFromGitHub {
     repo = "files-cli";
     owner = "files-com";
     rev = "v${version}";
-    hash = "sha256-5F1ETivnflf27nseSTQ4xv1LkJKKC3oa+Ao20jUW1BQ=";
+    hash = "sha256-oQ+mESm7/VkfX+8Yf3l7x7VSfUK2flndSthlhNpvjh0=";
   };
 
-  vendorHash = "sha256-4uFUo47m1jdKIhPgDE5R4Hb+HQslsDu16QNb4IDTwMg=";
+  vendorHash = "sha256-h0dADEkiVNBudIh64Waqf9LtLa+I6dwAkmtYjuspEBs=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/fo/forgejo/lts.nix b/pkgs/by-name/fo/forgejo/lts.nix
index 4030b6158718..7693d27f5502 100644
--- a/pkgs/by-name/fo/forgejo/lts.nix
+++ b/pkgs/by-name/fo/forgejo/lts.nix
@@ -1,6 +1,6 @@
 import ./generic.nix {
-  version = "7.0.7";
-  hash = "sha256-Xk5ElAfTjbz77Jv5VMbSW7q8qJ5vhNd3daNilNzDsY4=";
+  version = "7.0.8";
+  hash = "sha256-m6yToQQFM+4g8xhs572O4n4r06xeS3DozYHtAKwMjUg=";
   npmDepsHash = "sha256-OqtYRjftwGxgW1JgMxyWd+9DndpEkd3LdQHSECc40yU=";
   vendorHash = "sha256-hfbNyCQMQzDzJxFc2MPAR4+v/qNcnORiQNbwbbIA4Nw=";
   lts = true;
diff --git a/pkgs/by-name/fo/forgejo/package.nix b/pkgs/by-name/fo/forgejo/package.nix
index f06c4eaf739a..8beb4a67c764 100644
--- a/pkgs/by-name/fo/forgejo/package.nix
+++ b/pkgs/by-name/fo/forgejo/package.nix
@@ -1,8 +1,8 @@
 import ./generic.nix {
-  version = "8.0.1";
-  hash = "sha256-0D2ntZVK4k5AwAMg4XnLyabnxAoHx9JjBoFAdkfrdAY=";
+  version = "8.0.2";
+  hash = "sha256-rjwZjwt0F9AhXgQ8CzOfsZ3acyBvzsDc/2LHRWieDzg=";
   npmDepsHash = "sha256-6AMaZadgcTvOBsIXJjZQB6Q1rkdn+R82pclXdVvtdWY=";
-  vendorHash = "sha256-tNb0tCf+gjUmUqrjkzt7Wqqz21hW9WRh8CEdX8rv8Do=";
+  vendorHash = "sha256-4l4kscwesW/cR8mZjE3G9HcVm0d1ukxbtBY6RXYRi8k=";
   lts = false;
   nixUpdateExtraArgs = [
     "--override-filename"
diff --git a/pkgs/by-name/gi/gitlab-timelogs/package.nix b/pkgs/by-name/gi/gitlab-timelogs/package.nix
new file mode 100644
index 000000000000..4a7778ab95bc
--- /dev/null
+++ b/pkgs/by-name/gi/gitlab-timelogs/package.nix
@@ -0,0 +1,48 @@
+{
+  darwin,
+  fetchCrate,
+  iconv,
+  lib,
+  openssl,
+  pkg-config,
+  rustPlatform,
+  stdenv,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "gitlab-timelogs";
+  version = "0.3.0";
+
+  src = fetchCrate {
+    inherit pname version;
+    hash = "sha256-n+Jvm4RqHkXIeQcY55iOEBgwvbr77vLMhqxXgdau5MQ=";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs =
+    [ openssl ]
+    ++ lib.optionals stdenv.isDarwin [
+      darwin.apple_sdk.frameworks.SystemConfiguration
+      iconv
+    ];
+
+  cargoHash = "sha256-REE7DWY0l4TTDTwWFWVr3Zk/oLQlOjrbFEWSFUlBEig=";
+
+  meta = {
+    description = " CLI utility to support you with your time logs in GitLab";
+    mainProgram = "gitlab-timelogs";
+    longDescription = ''
+      CLI utility to support you with your time logs in GitLab.
+
+      gitlab-timelogs is not associated with the official GitLab project!
+    '';
+    homepage = "https://github.com/phip1611/gitlab-timelogs";
+    changelog = "https://github.com/phip1611/gitlab-timelogs/blob/v${version}/CHANGELOG.md";
+    license = with lib.licenses; [ mit ];
+    maintainers = with lib.maintainers; [
+      blitz
+      phip1611
+    ];
+  };
+}
diff --git a/pkgs/by-name/ha/hatch/package.nix b/pkgs/by-name/ha/hatch/package.nix
index 141fb9a51ec6..5ae22d698f21 100644
--- a/pkgs/by-name/ha/hatch/package.nix
+++ b/pkgs/by-name/ha/hatch/package.nix
@@ -96,6 +96,9 @@ python3Packages.buildPythonApplication rec {
       "test_uv_env"
       "test_pyenv"
       "test_pypirc"
+      # Relies on FHS
+      # Could not read ELF interpreter from any of the following paths: /bin/sh, /usr/bin/env, /bin/dash, /bin/ls
+      "test_new_selected_python"
     ]
     ++ lib.optionals stdenv.isDarwin [
       # https://github.com/NixOS/nixpkgs/issues/209358
diff --git a/pkgs/by-name/hu/hugo/package.nix b/pkgs/by-name/hu/hugo/package.nix
index d59977744103..58e970715b33 100644
--- a/pkgs/by-name/hu/hugo/package.nix
+++ b/pkgs/by-name/hu/hugo/package.nix
@@ -1,6 +1,6 @@
 { stdenv
 , lib
-, buildGoModule
+, buildGo123Module
 , fetchFromGitHub
 , installShellFiles
 , buildPackages
@@ -8,18 +8,18 @@
 , hugo
 }:
 
-buildGoModule rec {
+buildGo123Module rec {
   pname = "hugo";
-  version = "0.132.1";
+  version = "0.133.1";
 
   src = fetchFromGitHub {
     owner = "gohugoio";
     repo = "hugo";
     rev = "refs/tags/v${version}";
-    hash = "sha256-PhjoFhiFPnhKUb/A6wP4T0GIz4XCQCobEniAvJRZqJg=";
+    hash = "sha256-vTUhUSaUvj3gBoiYOJwmxScCpl2Z6/xRWvyV3ivPBTo=";
   };
 
-  vendorHash = "sha256-7HdMbbMjYd+SZ4mJVqLOwAnJBnQs3WDCSaIXtIdpXBk=";
+  vendorHash = "sha256-+1wNCavx9pVWlFeP3NF/OAMgTVfIqAQdCkq4fW9RZxc=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/im/imhex/package.nix b/pkgs/by-name/im/imhex/package.nix
index a1b55f16899d..55283031e79d 100644
--- a/pkgs/by-name/im/imhex/package.nix
+++ b/pkgs/by-name/im/imhex/package.nix
@@ -25,15 +25,15 @@
 }:
 
 let
-  version = "1.35.3";
-  patterns_version = "1.35.3";
+  version = "1.35.4";
+  patterns_version = "1.35.4";
 
   patterns_src = fetchFromGitHub {
     name = "ImHex-Patterns-source-${patterns_version}";
     owner = "WerWolv";
     repo = "ImHex-Patterns";
     rev = "ImHex-v${patterns_version}";
-    hash = "sha256-h86qoFMSP9ehsXJXOccUK9Mfqe+DVObfSRT4TCtK0rY=";
+    hash = "sha256-7ch2KXkbkdRAvo3HyErWcth3kG4bzYvp9I5GZSsb/BQ=";
   };
 
 in
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
     owner = "WerWolv";
     repo = "ImHex";
     rev = "refs/tags/v${version}";
-    hash = "sha256-8vhOOHfg4D9B9yYgnGZBpcjAjuL4M4oHHax9ad5PJtA=";
+    hash = "sha256-6QpmFkSMQpGlEzo7BHZn20c+q8CTDUB4yO87wMU5JT4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ju/just/package.nix b/pkgs/by-name/ju/just/package.nix
index 08c1c248c382..3dfcd639f5d1 100644
--- a/pkgs/by-name/ju/just/package.nix
+++ b/pkgs/by-name/ju/just/package.nix
@@ -12,17 +12,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "just";
-  version = "1.34.0";
+  version = "1.35.0";
   outputs = [ "out" "man" "doc" ];
 
   src = fetchFromGitHub {
     owner = "casey";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-fAzBAiF7eVl5tieSH0m3Wa9UWthVjX7e5tAex5peRQw=";
+    hash = "sha256-/5UzieioBzltFhzUoPOm6B4QKHFEquXCKo/2SPHkp2M=";
   };
 
-  cargoHash = "sha256-v3z0Md66fzT0JQfVfISPqhJAunYHl8UmpYL1ASVWxVU=";
+  cargoHash = "sha256-X3noVDRnnrR6xuOBfoH4JPdcPLOBHbGQb6opNvzK/TE=";
 
   nativeBuildInputs = [ installShellFiles mdbook ];
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];
diff --git a/pkgs/by-name/la/lazysql/package.nix b/pkgs/by-name/la/lazysql/package.nix
index 74f29f92d8ca..dd9199847248 100644
--- a/pkgs/by-name/la/lazysql/package.nix
+++ b/pkgs/by-name/la/lazysql/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "lazysql";
-  version = "0.2.4";
+  version = "0.2.5";
 
   src = fetchFromGitHub {
     owner = "jorgerojas26";
     repo = "lazysql";
     rev = "v${version}";
-    hash = "sha256-Pzx9wjuPv7k0q+ads/uKrRTEAZbktf4ciyD7KZjYGwQ=";
+    hash = "sha256-QzvaQMSr0PjeAGJr5ThAQ/U0dRMa17E5hiPnc2ViUNo=";
   };
 
-  vendorHash = "sha256-hYkSdFmzljhjsh2stXWGDLHwB4NXeKQyjiN2DqG0GRg=";
+  vendorHash = "sha256-celee8uyoirX+vtAww2iQJtRwJEHyfHL2mZA2muSRiQ=";
 
   buildInputs = lib.optionals stdenv.isLinux [ xorg.libX11 ] ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Cocoa ];
 
diff --git a/pkgs/by-name/li/lime3ds/package.nix b/pkgs/by-name/li/lime3ds/package.nix
index 671b34b146dc..62c70f5b69f6 100644
--- a/pkgs/by-name/li/lime3ds/package.nix
+++ b/pkgs/by-name/li/lime3ds/package.nix
@@ -40,19 +40,13 @@
 , useDiscordRichPresence ? false , rapidjson
 }: let
   inherit (lib) optional optionals cmakeBool optionalString getLib makeLibraryPath;
-
-  compat-list = fetchurl {
-    name = "lime3ds-compat-list";
-    url = "https://raw.githubusercontent.com/Lime3DS/compatibility-list/fa9d49d22e698df2f238e53f2b34acda08b947f6/compatibility_list.json";
-    hash = "sha256-dNZuU8uFXJ5gw/rmtF6bAjtrvVBXP8aUNXVdBY1dT34=";
-  };
 in stdenv.mkDerivation (finalAttrs: {
   pname = "lime3ds";
-  version = "2116";
+  version = "2117.1";
 
   src = fetchzip {
     url = "https://github.com/Lime3DS/Lime3DS/releases/download/${finalAttrs.version}/lime3ds-unified-source-${finalAttrs.version}.tar.xz";
-    hash = "sha256-ff4An+ZdxlY4H90Yep4lpKROOMEkDijb3dVFIgSPvWQ=";
+    hash = "sha256-v6AHzbuk5n55nTDO0UndtmdhovfY4kngC5TJaNIV5S4=";
   };
 
   nativeBuildInputs = [
@@ -104,10 +98,6 @@ in stdenv.mkDerivation (finalAttrs: {
     mkdir externals/dynarmic/src/dynarmic/ir/var
     ln -s ../opt externals/dynarmic/src/dynarmic/ir/var/empty
 
-    # Prep compatibilitylist
-    rm ./dist/compatibility_list/compatibility_list.json
-    ln -s ${compat-list} ./dist/compatibility_list/compatibility_list.json
-
     # We already know the submodules are present
     substituteInPlace CMakeLists.txt \
       --replace-fail "check_submodules_present()" ""
@@ -140,8 +130,6 @@ in stdenv.mkDerivation (finalAttrs: {
     (cmakeBool "DISABLE_SYSTEM_LODEPNG" true)
     (cmakeBool "DISABLE_SYSTEM_VMA" true)
     (cmakeBool "DISABLE_SYSTEM_XBYAK" true)
-    (cmakeBool "CITRA_ENABLE_COMPATIBILITY_REPORTING" true)
-    (cmakeBool "ENABLE_COMPATIBILITY_LIST_DOWNLOAD" false)
     (cmakeBool "ENABLE_SDL2_FRONTEND" enableSdl2Frontend)
     (cmakeBool "ENABLE_CUBEB" enableCubeb)
     (cmakeBool "USE_DISCORD_PRESENCE" useDiscordRichPresence)
diff --git a/pkgs/by-name/ll/llama-cpp/package.nix b/pkgs/by-name/ll/llama-cpp/package.nix
index 06656848d47b..454f4b704399 100644
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@@ -69,13 +69,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "llama-cpp";
-  version = "3620";
+  version = "3645";
 
   src = fetchFromGitHub {
     owner = "ggerganov";
     repo = "llama.cpp";
     rev = "refs/tags/b${finalAttrs.version}";
-    hash = "sha256-jZyMDNEppMxS+qinqJMU0VfjowzYrvCp5Mn0ub9x6NE=";
+    hash = "sha256-Vev4X9wXyTksHop4q9ysym0zEaMBt51CIOqIf5jymK0=";
     leaveDotGit = true;
     postFetch = ''
       git -C "$out" rev-parse --short HEAD > $out/COMMIT
diff --git a/pkgs/by-name/mi/micro/package.nix b/pkgs/by-name/mi/micro/package.nix
index 04755a16aaf9..e7c25d77bc40 100644
--- a/pkgs/by-name/mi/micro/package.nix
+++ b/pkgs/by-name/mi/micro/package.nix
@@ -93,6 +93,7 @@ let
 
     meta = {
       homepage = "https://micro-editor.github.io";
+      changelog = "https://github.com/zyedidia/micro/releases/";
       description = "Modern and intuitive terminal-based text editor";
       longDescription = ''
         micro is a terminal-based text editor that aims to be easy to use and
@@ -106,7 +107,10 @@ let
       '';
       license = lib.licenses.mit;
       mainProgram = "micro";
-      maintainers = with lib.maintainers; [ AndersonTorres ];
+      maintainers = with lib.maintainers; [
+        AndersonTorres
+        pbsds
+      ];
     };
   };
 in
diff --git a/pkgs/by-name/ni/nix-update/package.nix b/pkgs/by-name/ni/nix-update/package.nix
index db47d4b5abd6..ecd378884767 100644
--- a/pkgs/by-name/ni/nix-update/package.nix
+++ b/pkgs/by-name/ni/nix-update/package.nix
@@ -3,7 +3,6 @@
 , fetchFromGitHub
 , nix
 , nix-prefetch-git
-, nixpkgs-fmt
 , nixpkgs-review
 }:
 
@@ -24,7 +23,7 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   makeWrapperArgs = [
-    "--prefix" "PATH" ":" (lib.makeBinPath [ nix nix-prefetch-git nixpkgs-fmt nixpkgs-review ])
+    "--prefix" "PATH" ":" (lib.makeBinPath [ nix nix-prefetch-git nixpkgs-review ])
   ];
 
   checkPhase = ''
@@ -36,7 +35,7 @@ python3.pkgs.buildPythonApplication rec {
     inherit (src.meta) homepage;
     changelog = "https://github.com/Mic92/nix-update/releases/tag/${version}";
     license = licenses.mit;
-    maintainers = with maintainers; [ figsoda mic92 zowoq ];
+    maintainers = with maintainers; [ figsoda mic92 ];
     mainProgram = "nix-update";
     platforms = platforms.all;
   };
diff --git a/pkgs/by-name/no/nodejsInstallExecutables/hook.sh b/pkgs/by-name/no/nodejsInstallExecutables/hook.sh
new file mode 100644
index 000000000000..ab2a8e372da4
--- /dev/null
+++ b/pkgs/by-name/no/nodejsInstallExecutables/hook.sh
@@ -0,0 +1,27 @@
+# shellcheck shell=bash
+
+nodejsInstallExecutables() {
+    local -r packageJson="${1-./package.json}"
+
+    local -r packageOut="$out/lib/node_modules/$(@jq@ --raw-output '.name' package.json)"
+
+    # Based on code from Python's buildPythonPackage wrap.sh script, for
+    # supporting both the case when makeWrapperArgs is an array and a
+    # IFS-separated string.
+    #
+    # TODO: remove the string branch when __structuredAttrs are used.
+    if [[ "${makeWrapperArgs+defined}" == "defined" && "$(declare -p makeWrapperArgs)" =~ ^'declare -a makeWrapperArgs=' ]]; then
+        local -a user_args=("${makeWrapperArgs[@]}")
+    else
+        local -a user_args="(${makeWrapperArgs:-})"
+    fi
+
+    while IFS=" " read -ra bin; do
+        mkdir -p "$out/bin"
+        makeWrapper @hostNode@ "$out/bin/${bin[0]}" --add-flags "$packageOut/${bin[1]}" "${user_args[@]}"
+    done < <(@jq@ --raw-output '(.bin | type) as $typ | if $typ == "string" then
+        .name + " " + .bin
+        elif $typ == "object" then .bin | to_entries | map(.key + " " + .value) | join("\n")
+        elif $typ == "null" then empty
+        else "invalid type " + $typ | halt_error end' "$packageJson")
+}
diff --git a/pkgs/by-name/no/nodejsInstallExecutables/package.nix b/pkgs/by-name/no/nodejsInstallExecutables/package.nix
new file mode 100644
index 000000000000..8403cf8881d6
--- /dev/null
+++ b/pkgs/by-name/no/nodejsInstallExecutables/package.nix
@@ -0,0 +1,19 @@
+{
+  makeSetupHook,
+  installShellFiles,
+  makeWrapper,
+  nodejs,
+  jq,
+}:
+
+makeSetupHook {
+  name = "nodejs-install-executables";
+  propagatedBuildInputs = [
+    installShellFiles
+    makeWrapper
+  ];
+  substitutions = {
+    hostNode = "${nodejs}/bin/node";
+    jq = "${jq}/bin/jq";
+  };
+} ./hook.sh
diff --git a/pkgs/by-name/no/nodejsInstallManuals/hook.sh b/pkgs/by-name/no/nodejsInstallManuals/hook.sh
new file mode 100644
index 000000000000..f0ff209c6226
--- /dev/null
+++ b/pkgs/by-name/no/nodejsInstallManuals/hook.sh
@@ -0,0 +1,14 @@
+# shellcheck shell=bash
+
+nodejsInstallManuals() {
+    local -r packageJson="${1-./package.json}"
+
+    local -r packageOut="$out/lib/node_modules/$(@jq@ --raw-output '.name' package.json)"
+
+    while IFS= read -r man; do
+        installManPage "$packageOut/$man"
+    done < <(@jq@ --raw-output '(.man | type) as $typ | if $typ == "string" then .man
+        elif $typ == "list" then .man | join("\n")
+        elif $typ == "null" then empty
+        else "invalid type " + $typ | halt_error end' "$packageJson")
+}
diff --git a/pkgs/by-name/no/nodejsInstallManuals/package.nix b/pkgs/by-name/no/nodejsInstallManuals/package.nix
new file mode 100644
index 000000000000..9f74cf8538da
--- /dev/null
+++ b/pkgs/by-name/no/nodejsInstallManuals/package.nix
@@ -0,0 +1,13 @@
+{
+  makeSetupHook,
+  installShellFiles,
+  jq,
+}:
+
+makeSetupHook {
+  name = "nodejs-install-manuals";
+  propagatedBuildInputs = [ installShellFiles ];
+  substitutions = {
+    jq = "${jq}/bin/jq";
+  };
+} ./hook.sh
diff --git a/pkgs/by-name/on/onedrive/package.nix b/pkgs/by-name/on/onedrive/package.nix
new file mode 100644
index 000000000000..db108ec5057c
--- /dev/null
+++ b/pkgs/by-name/on/onedrive/package.nix
@@ -0,0 +1,81 @@
+{
+  lib,
+  autoreconfHook,
+  curl,
+  fetchFromGitHub,
+  installShellFiles,
+  ldc,
+  libnotify,
+  pkg-config,
+  sqlite,
+  stdenv,
+  systemd,
+  testers,
+  # Boolean flags
+  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "onedrive";
+  version = "2.5.0-rc3";
+
+  src = fetchFromGitHub {
+    owner = "abraunegg";
+    repo = "onedrive";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-UOtCRCHTBpPScFB/OcGalGFjVUslULBO3KIED+0Hs+M=";
+  };
+
+  outputs = [
+    "out"
+    "doc"
+    "man"
+  ];
+
+  nativeBuildInputs = [
+    autoreconfHook
+    installShellFiles
+    ldc
+    pkg-config
+  ];
+
+  buildInputs = [
+    curl
+    libnotify
+    sqlite
+  ] ++ lib.optionals withSystemd [ systemd ];
+
+  configureFlags = [
+    (lib.enableFeature true "notifications")
+    (lib.withFeatureAs withSystemd "systemdsystemunitdir" "${placeholder "out"}/lib/systemd/system")
+    (lib.withFeatureAs withSystemd "systemduserunitdir" "${placeholder "out"}/lib/systemd/user")
+  ];
+
+  # we could also pass --enable-completions to configure but we would then have to
+  # figure out the paths manually and pass those along.
+  postInstall = ''
+    installShellCompletion --bash --name onedrive contrib/completions/complete.bash
+    installShellCompletion --fish --name onedrive contrib/completions/complete.fish
+    installShellCompletion --zsh --name _onedrive contrib/completions/complete.zsh
+  '';
+
+  passthru = {
+    tests.version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+      version = "v${finalAttrs.version}";
+    };
+  };
+
+  meta = {
+    homepage = "https://github.com/abraunegg/onedrive";
+    description = "Complete tool to interact with OneDrive on Linux";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "onedrive";
+    maintainers = with lib.maintainers; [
+      AndersonTorres
+      peterhoeg
+      bertof
+    ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/pr/pretix/package.nix b/pkgs/by-name/pr/pretix/package.nix
index ebcab4bda0cc..2c6e7ccc16db 100644
--- a/pkgs/by-name/pr/pretix/package.nix
+++ b/pkgs/by-name/pr/pretix/package.nix
@@ -90,6 +90,7 @@ python.pkgs.buildPythonApplication rec {
   ];
 
   pythonRelaxDeps = [
+    "django-phonenumber-field"
     "importlib-metadata"
     "kombu"
     "markdown"
@@ -102,8 +103,6 @@ python.pkgs.buildPythonApplication rec {
   ];
 
   pythonRemoveDeps = [
-    "phonenumberslite" # we provide phonenumbers instead
-    "psycopg2-binary" # we provide psycopg2 instead
     "vat-moss-forked" # we provide a patched vat-moss package
   ];
 
@@ -175,11 +174,11 @@ python.pkgs.buildPythonApplication rec {
     paypalrestsdk
     paypal-checkout-serversdk
     pyjwt
-    phonenumbers
+    phonenumberslite
     pillow
     pretix-plugin-build
     protobuf
-    psycopg2
+    psycopg2-binary
     pycountry
     pycparser
     pycryptodome
diff --git a/pkgs/by-name/qb/qbittorrent-enhanced/package.nix b/pkgs/by-name/qb/qbittorrent-enhanced/package.nix
index a86b62968423..261b729d4922 100644
--- a/pkgs/by-name/qb/qbittorrent-enhanced/package.nix
+++ b/pkgs/by-name/qb/qbittorrent-enhanced/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qbittorrent-enhanced";
-  version = "4.6.5.10";
+  version = "4.6.6.10";
 
   src = fetchFromGitHub {
     owner = "c0re100";
     repo = "qBittorrent-Enhanced-Edition";
     rev = "release-${version}";
-    hash = "sha256-Yy0DUTz1lWkseh9x1xnHJCI89BKqi/D7zUn/S+qC+kM=";
+    hash = "sha256-mmM/1eU8FTWAciq2rh7fRa96fOkovMk4ScoehnqHdIQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ra/radicale/package.nix b/pkgs/by-name/ra/radicale/package.nix
index 719d49ab3a0e..1946ffab2fac 100644
--- a/pkgs/by-name/ra/radicale/package.nix
+++ b/pkgs/by-name/ra/radicale/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "radicale";
-  version = "3.2.2";
+  version = "3.2.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Kozea";
     repo = "Radicale";
-    rev = "v${version}-version";
-    hash = "sha256-ZdcV2t2F2UgjGC+aTfynP2DbPRgzOIADDebY64nj3NA=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-1IlnXVetQQuKBt6+QVKNeMM6qBQAiUhqc+4x3xOnSdE=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/re/renode-unstable/package.nix b/pkgs/by-name/re/renode-unstable/package.nix
index 42eaecec89b1..f5ed94e77400 100644
--- a/pkgs/by-name/re/renode-unstable/package.nix
+++ b/pkgs/by-name/re/renode-unstable/package.nix
@@ -5,11 +5,11 @@
 
 renode.overrideAttrs (finalAttrs: _: {
   pname = "renode-unstable";
-  version = "1.15.2+20240823gitc4eea992a";
+  version = "1.15.2+20240829gitfedcdbdaf";
 
   src = fetchurl {
     url = "https://builds.renode.io/renode-${finalAttrs.version}.linux-dotnet.tar.gz";
-    hash = "sha256-y5y3jvTn3QPVODqX1IX4qq9LjRoxdTYJ68kURRfGCX8=";
+    hash = "sha256-pZ8+wxu7357jXGhFFgG9RQ0Jy8a3CfKpe3x31VbsgfQ=";
   };
 
   passthru.updateScript =
diff --git a/pkgs/by-name/re/renode/package.nix b/pkgs/by-name/re/renode/package.nix
index 2a3cd46c2723..08e2ec3a84f4 100644
--- a/pkgs/by-name/re/renode/package.nix
+++ b/pkgs/by-name/re/renode/package.nix
@@ -39,11 +39,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "renode";
-  version = "1.15.1";
+  version = "1.15.2";
 
   src = fetchurl {
     url = "https://github.com/renode/renode/releases/download/v${finalAttrs.version}/renode-${finalAttrs.version}.linux-dotnet.tar.gz";
-    hash = "sha256-NrbdkHxZ5g4dhmkhOIWTSxuY3GA1h1FM5JkWVPuQjjc=";
+    hash = "sha256-4W6/s2XYKj4q31VLz5MohaMdv4rLTaQHCx6AoWxHTvo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ri/ripunzip/package.nix b/pkgs/by-name/ri/ripunzip/package.nix
index 43ec13dcda17..41d0594ebd5f 100644
--- a/pkgs/by-name/ri/ripunzip/package.nix
+++ b/pkgs/by-name/ri/ripunzip/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ripunzip";
-  version = "1.2.2";
+  version = "1.2.3";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "ripunzip";
     rev = "v${version}";
-    hash = "sha256-qDY81SxTVfGBCZU2jxuOswyTqzN7Mk3q7Ns6+ShRUnU=";
+    hash = "sha256-9aBAksX4h8DlHTl95xd2QvFi3ZV/6i69b68OFa4B1Ew=";
   };
 
-  cargoHash = "sha256-8AKmIzMrxpQBDrW8C/OFZYvFn+u4yvWbMXSsCC0NX+Y=";
+  cargoHash = "sha256-QyVhEHm1W4kb5b4dngBui3lT7vKBGDS5ZObMWua96KM=";
 
   buildInputs = [ openssl ]
     ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ Security SystemConfiguration ]);
diff --git a/pkgs/by-name/ru/rustlings/package.nix b/pkgs/by-name/ru/rustlings/package.nix
index 1d2e83b9739f..25407298d2e9 100644
--- a/pkgs/by-name/ru/rustlings/package.nix
+++ b/pkgs/by-name/ru/rustlings/package.nix
@@ -10,7 +10,7 @@
 }:
 let
   pname = "rustlings";
-  version = "6.2.0";
+  version = "6.3.0";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -18,10 +18,10 @@ rustPlatform.buildRustPackage {
     owner = "rust-lang";
     repo = "rustlings";
     rev = "v${version}";
-    hash = "sha256-BVmiMIIx8YEO57FO0ZpsCQcim68mn7NHpAOO86dZqlI=";
+    hash = "sha256-te7DYgbEtWWSSvO28ajkJucRb3c9L8La1wfGW0WSxW0=";
   };
 
-  cargoHash = "sha256-ZupwPw/bfeN+s7IWXbY21K/ODXSaYef+IDDpBVCi3Ek=";
+  cargoHash = "sha256-Vq4Os4CKkEz4HggIZhlbIo9Cu+BVJPdybL1CNvz5wEQ=";
 
   # Disabled test that does not work well in an isolated environment
   checkFlags = [
diff --git a/pkgs/by-name/sc/sc/package.nix b/pkgs/by-name/sc/sc/package.nix
new file mode 100644
index 000000000000..a1b9a59dec5b
--- /dev/null
+++ b/pkgs/by-name/sc/sc/package.nix
@@ -0,0 +1,47 @@
+{
+  stdenv,
+  fetchFromGitHub,
+  ncurses,
+  bison,
+  lib,
+}:
+stdenv.mkDerivation {
+  pname = "sc";
+  version = "2024-08-15";
+
+  src = fetchFromGitHub {
+    repo = "sc";
+    owner = "n-t-roff";
+    rev = "e029bc0fb5fa29da1fd23b04fa2a97039a96d2ba";
+    hash = "sha256-JQY+ixHL+TpP4YRpgB9GP4jO5+PBMS/v5Ad3Ux0+yuQ=";
+  };
+
+  buildInputs = [ ncurses ];
+
+  nativeBuildInputs = [ bison ];
+
+  installFlags = [ "prefix=$(out)" ];
+
+  # Non-standard configure script
+  configurePhase = "./configure";
+
+  outputs = [
+    "out"
+    "man"
+  ];
+
+  meta = {
+    description = "Curses-based spreadsheet calculator.";
+
+    longDescription = ''
+      This is a fork of the old sc-7.16 application with attention paid to
+      reduced compiler warnings, bugfixes, and functionality improvements
+      (e.g. mouse suport, configurability via .scrc).
+      See CHANGES-git or README.md for a full list of changes.
+    '';
+
+    homepage = "https://github.com/n-t-roff/sc";
+    license = lib.licenses.unlicense;
+    maintainers = [ lib.maintainers.claes ];
+  };
+}
diff --git a/pkgs/by-name/sq/sqlite_orm/package.nix b/pkgs/by-name/sq/sqlite_orm/package.nix
index 82e11c6015b7..34a76f4095fc 100644
--- a/pkgs/by-name/sq/sqlite_orm/package.nix
+++ b/pkgs/by-name/sq/sqlite_orm/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "sqlite_orm";
-  version = "1.8.2";
+  version = "1.9";
 
   src = fetchFromGitHub {
     owner = "fnc12";
     repo = "sqlite_orm";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-KqphGFcnR1Y11KqL7sxODSv7lEvcURdF6kLd3cg84kc=";
+    hash = "sha256-jgRCYOtCyXj2E5J3iYBffX2AyBwvhune+i4Pb2eCBrA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/st/stalwart-mail/package.nix b/pkgs/by-name/st/stalwart-mail/package.nix
index 6c697a494d34..045143f15b79 100644
--- a/pkgs/by-name/st/stalwart-mail/package.nix
+++ b/pkgs/by-name/st/stalwart-mail/package.nix
@@ -25,7 +25,7 @@ let
   # See upstream issue for rocksdb 9.X support
   # https://github.com/stalwartlabs/mail-server/issues/407
   rocksdb = rocksdb_8_11;
-  version = "0.9.2";
+  version = "0.9.3";
 in
 rustPlatform.buildRustPackage {
   pname = "stalwart-mail";
@@ -35,11 +35,11 @@ rustPlatform.buildRustPackage {
     owner = "stalwartlabs";
     repo = "mail-server";
     rev = "refs/tags/v${version}";
-    hash = "sha256-8O+0yOdaHnc2vDLCPK7PIuR6IBeOmH9RNDo0uaw7EeU=";
+    hash = "sha256-XjHm9jBpBQcf1qaZJLDSSrPK9Nqi3olG0pMXHdNUjbg=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-ofF9eTXLVyFfrTnAj6rMYV3dMY613tjhKgoLs303CEA=";
+  cargoHash = "sha256-sFYvEKZVTS5v37CpIl/KjoOY0iWCHLgIJFUdht5SjJY=";
 
   patches = [
     # Remove "PermissionsStartOnly" from systemd service files,
@@ -61,14 +61,19 @@ rustPlatform.buildRustPackage {
     bzip2
     openssl
     sqlite
-    foundationdb
     zstd
+  ] ++ lib.optionals stdenv.isLinux [
+    foundationdb
   ] ++ lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.CoreFoundation
     darwin.apple_sdk.frameworks.Security
     darwin.apple_sdk.frameworks.SystemConfiguration
   ];
 
+  # skip defaults on darwin because foundationdb is not available
+  buildNoDefaultFeatures = stdenv.isDarwin;
+  buildFeatures = lib.optional (stdenv.isDarwin) [ "sqlite" "postgres" "mysql" "rocks" "elastic" "s3" "redis" ];
+
   env = {
     OPENSSL_NO_VENDOR = true;
     ZSTD_SYS_USE_PKG_CONFIG = true;
diff --git a/pkgs/by-name/su/surrealdb/package.nix b/pkgs/by-name/su/surrealdb/package.nix
index 31623b5f16ef..5f4ec81470ec 100644
--- a/pkgs/by-name/su/surrealdb/package.nix
+++ b/pkgs/by-name/su/surrealdb/package.nix
@@ -25,8 +25,8 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-KtR+qU2Xys4NkEARZBbO8mTPa7EI9JplWvXdtuLt2vE=";
   };
 
-  patches = [
-      ./time.patch  # TODO: remove when https://github.com/surrealdb/surrealdb/pull/4565 merged
+  cargoPatches = [
+    ./time.patch # TODO: remove when https://github.com/surrealdb/surrealdb/pull/4565 merged
   ];
 
   cargoHash = "sha256-5qIIPdE6HYov5EIR4do+pMeZ1Lo3at39aKOP9scfMy8=";
diff --git a/pkgs/by-name/sv/svix-server/Cargo.lock b/pkgs/by-name/sv/svix-server/Cargo.lock
index 10779d70aec4..4363c3ef350f 100644
--- a/pkgs/by-name/sv/svix-server/Cargo.lock
+++ b/pkgs/by-name/sv/svix-server/Cargo.lock
@@ -399,6 +399,17 @@ dependencies = [
  "reactor-trait",
 ]
 
+[[package]]
+name = "async-socks5"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77f634add2445eb2c1f785642a67ca1073fedd71e73dc3ca69435ef9b9bdedc7"
+dependencies = [
+ "async-trait",
+ "thiserror",
+ "tokio",
+]
+
 [[package]]
 name = "async-stream"
 version = "0.3.5"
@@ -2122,6 +2133,21 @@ dependencies = [
  "tower-service",
 ]
 
+[[package]]
+name = "hyper-socks2"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc38166fc2732d450e9372388d269eb38ff0b75a3cfb4c542e65b2f6893629c4"
+dependencies = [
+ "async-socks5",
+ "futures",
+ "http 0.2.12",
+ "hyper 0.14.28",
+ "hyper-tls 0.5.0",
+ "thiserror",
+ "tokio",
+]
+
 [[package]]
 name = "hyper-timeout"
 version = "0.4.1"
@@ -2134,6 +2160,19 @@ dependencies = [
  "tokio-io-timeout",
 ]
 
+[[package]]
+name = "hyper-tls"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6183ddfa99b85da61a140bea0efc93fdf56ceaa041b37d553518030827f9905"
+dependencies = [
+ "bytes",
+ "hyper 0.14.28",
+ "native-tls",
+ "tokio",
+ "tokio-native-tls",
+]
+
 [[package]]
 name = "hyper-tls"
 version = "0.6.0"
@@ -3676,7 +3715,7 @@ dependencies = [
  "http-body 1.0.1",
  "http-body-util",
  "hyper 1.4.1",
- "hyper-tls",
+ "hyper-tls 0.6.0",
  "hyper-util",
  "ipnet",
  "js-sys",
@@ -4753,7 +4792,7 @@ dependencies = [
  "http-body-util",
  "hyper 1.4.1",
  "hyper-rustls 0.26.0",
- "hyper-tls",
+ "hyper-tls 0.6.0",
  "hyper-util",
  "serde",
  "serde_derive",
@@ -4791,7 +4830,7 @@ dependencies = [
 
 [[package]]
 name = "svix-server"
-version = "1.28.0"
+version = "1.30.0"
 dependencies = [
  "aide",
  "anyhow",
@@ -4818,6 +4857,7 @@ dependencies = [
  "http 0.2.12",
  "hyper 0.14.28",
  "hyper-openssl",
+ "hyper-socks2",
  "indexmap 1.9.3",
  "ipnet",
  "jsonschema",
diff --git a/pkgs/by-name/sv/svix-server/package.nix b/pkgs/by-name/sv/svix-server/package.nix
index 22ba5720f0a9..16eaf01be24d 100644
--- a/pkgs/by-name/sv/svix-server/package.nix
+++ b/pkgs/by-name/sv/svix-server/package.nix
@@ -3,13 +3,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "svix-server";
-  version = "1.28.0";
+  version = "1.30.0";
 
   src = fetchFromGitHub {
     owner = "svix";
     repo = "svix-webhooks";
     rev = "v${version}";
-    hash = "sha256-6GKb3tSO4yr2tMH7V5oOPSsWK4OLX0/Zqd2N+ZrIvls=";
+    hash = "sha256-W5oLN0rMG2c8h05sIEOf4h95SQrFrs/7vLpsHH91sIA=";
   };
 
   sourceRoot = "${src.name}/server";
diff --git a/pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix b/pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix
index 4fcb7b08d14c..007a951265e4 100644
--- a/pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix
+++ b/pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix
@@ -1,23 +1,23 @@
 {
-  version = "1.14.0";
+  version = "1.15.0";
 
   x86_64-linux = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.14.0/linux/amd64/sysdig-cli-scanner";
-    hash = "sha256-EkwfoK/F2bl83J2cCjfC3s9ESpk5yrnv3+sFO94nzvw=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.15.0/linux/amd64/sysdig-cli-scanner";
+    hash = "sha256-Mwpn8UWyR9gqLXq+buy9GaPUA0i6EOh6ymY4Ezv/vbs=";
   };
 
   aarch64-linux = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.14.0/linux/arm64/sysdig-cli-scanner";
-    hash = "sha256-EkhhiV+x7Iv1nYp0+/+mpnVDVT1GpqW3Yh3VPOkM61g=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.15.0/linux/arm64/sysdig-cli-scanner";
+    hash = "sha256-UeztxyqRtbnF2eRprjMOEO5gAG95sUfrS6ZScvRx/Ag=";
   };
 
   x86_64-darwin = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.14.0/darwin/amd64/sysdig-cli-scanner";
-    hash = "sha256-VQCvAOTEgdso32XMGqPflYzX3t5GhrzxAjZzft0wuFs=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.15.0/darwin/amd64/sysdig-cli-scanner";
+    hash = "sha256-FjKfEtxwTPpMgepu3P0VeefSbhzAWUgb+8UFyQSjVPI=";
   };
 
   aarch64-darwin = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.14.0/darwin/arm64/sysdig-cli-scanner";
-    hash = "sha256-BELMtP3VRS+xb15LXCx5F/5XwtJn3DF6R5aluq1WHPc=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.15.0/darwin/arm64/sysdig-cli-scanner";
+    hash = "sha256-neI+oSbFqIibupKMe2IR3SMMPtiQ7SQlRaxJld6qh6g=";
   };
 }
diff --git a/pkgs/by-name/us/userborn/package.nix b/pkgs/by-name/us/userborn/package.nix
new file mode 100644
index 000000000000..5b0f14eb396f
--- /dev/null
+++ b/pkgs/by-name/us/userborn/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  makeBinaryWrapper,
+  mkpasswd,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "userborn";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "nikstur";
+    repo = "userborn";
+    rev = version;
+    hash = "sha256-aptFDrL9RPPTu4wp2ee3LVaEruRdCWtLGIKdOgsR+/s=";
+  };
+
+  sourceRoot = "${src.name}/rust/userborn";
+
+  cargoHash = "sha256-m39AC26E0Pxu1E/ap2kSwr5uznJNgExf5QUrZ+zTNX0=";
+
+  nativeBuildInputs = [ makeBinaryWrapper ];
+
+  buildInputs = [ mkpasswd ];
+
+  nativeCheckInputs = [ mkpasswd ];
+
+  postInstall = ''
+    wrapProgram $out/bin/userborn --prefix PATH : ${lib.makeBinPath [ mkpasswd ]}
+  '';
+
+  stripAllList = [ "bin" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/nikstur/userborn";
+    description = "Declaratively bear (manage) Linux users and groups";
+    license = licenses.mit;
+    maintainers = with lib.maintainers; [ nikstur ];
+    mainProgram = "userborn";
+  };
+}
diff --git a/pkgs/by-name/uv/uv/Cargo.lock b/pkgs/by-name/uv/uv/Cargo.lock
index 12b4b0f77e29..f247509778bc 100644
--- a/pkgs/by-name/uv/uv/Cargo.lock
+++ b/pkgs/by-name/uv/uv/Cargo.lock
@@ -43,21 +43,6 @@ dependencies = [
  "memchr",
 ]
 
-[[package]]
-name = "alloc-no-stdlib"
-version = "2.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc7bb162ec39d46ab1ca8c77bf72e890535becd1751bb45f64c597edb4c8c6b3"
-
-[[package]]
-name = "alloc-stdlib"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94fb8275041c72129eb51b7d0322c29b8387a0386127718b096429201a5d6ece"
-dependencies = [
- "alloc-no-stdlib",
-]
-
 [[package]]
 name = "android-tzdata"
 version = "0.1.1"
@@ -211,7 +196,6 @@ version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fec134f64e2bc57411226dfc4e52dec859ddfc7e711fc5e07b612584f000e4aa"
 dependencies = [
- "brotli",
  "bzip2",
  "flate2",
  "futures-core",
@@ -461,27 +445,6 @@ version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "510a90332002c1af3317ef6b712f0dab697f30bbe809b86965eac2923c0bca8e"
 
-[[package]]
-name = "brotli"
-version = "6.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "74f7971dbd9326d58187408ab83117d8ac1bb9c17b085fdacd1cf2f598719b6b"
-dependencies = [
- "alloc-no-stdlib",
- "alloc-stdlib",
- "brotli-decompressor",
-]
-
-[[package]]
-name = "brotli-decompressor"
-version = "4.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a45bd2e4095a8b518033b128020dd4a55aab1c0a381ba4404a472630f4bc362"
-dependencies = [
- "alloc-no-stdlib",
- "alloc-stdlib",
-]
-
 [[package]]
 name = "bstr"
 version = "1.10.0"
@@ -4529,7 +4492,7 @@ checksum = "81dfa00651efa65069b0b6b651f4aaa31ba9e3c3ce0137aaad053604ee7e0314"
 
 [[package]]
 name = "uv"
-version = "0.3.5"
+version = "0.4.0"
 dependencies = [
  "anstream",
  "anyhow",
@@ -4780,7 +4743,6 @@ dependencies = [
  "uv-auth",
  "uv-cache",
  "uv-normalize",
- "uv-workspace",
 ]
 
 [[package]]
@@ -5080,7 +5042,7 @@ dependencies = [
  "uv-state",
  "uv-warnings",
  "which",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
  "winsafe 0.0.22",
 ]
 
@@ -5284,7 +5246,7 @@ dependencies = [
 
 [[package]]
 name = "uv-version"
-version = "0.3.5"
+version = "0.4.0"
 
 [[package]]
 name = "uv-virtualenv"
diff --git a/pkgs/by-name/uv/uv/package.nix b/pkgs/by-name/uv/uv/package.nix
index e15660f5b3a4..977cb057fe3b 100644
--- a/pkgs/by-name/uv/uv/package.nix
+++ b/pkgs/by-name/uv/uv/package.nix
@@ -16,14 +16,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "uv";
-  version = "0.3.5";
+  version = "0.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     rev = "refs/tags/${version}";
-    hash = "sha256-D/BCxA7GOEu26xDkMmchXAMFB1pDewYSiOrNj2oSTyE=";
+    hash = "sha256-JEGcX4dT/cVLb07n2Y0nai17jW0tXpV18qaYVnoEpew=";
   };
 
   cargoDeps = rustPlatform.importCargoLock {
diff --git a/pkgs/by-name/wl/wlx-overlay-s/package.nix b/pkgs/by-name/wl/wlx-overlay-s/package.nix
index 411d83799b99..fb9404b3c8a4 100644
--- a/pkgs/by-name/wl/wlx-overlay-s/package.nix
+++ b/pkgs/by-name/wl/wlx-overlay-s/package.nix
@@ -4,6 +4,8 @@
   fetchFromGitHub,
   fontconfig,
   lib,
+  libGL,
+  libuuid,
   libX11,
   libXext,
   libXrandr,
@@ -19,6 +21,7 @@
   shaderc,
   stdenv,
   testers,
+  vulkan-loader,
   wayland,
   wlx-overlay-s,
 }:
@@ -76,7 +79,11 @@ rustPlatform.buildRustPackage rec {
   postInstall = ''
     patchelf $out/bin/wlx-overlay-s \
       --add-needed ${lib.getLib wayland}/lib/libwayland-client.so.0 \
-      --add-needed ${lib.getLib libxkbcommon}/lib/libxkbcommon.so.0
+      --add-needed ${lib.getLib libxkbcommon}/lib/libxkbcommon.so.0 \
+      --add-needed ${lib.getLib libGL}/lib/libEGL.so.1 \
+      --add-needed ${lib.getLib libGL}/lib/libGL.so.1 \
+      --add-needed ${lib.getLib vulkan-loader}/lib/libvulkan.so.1 \
+      --add-needed ${lib.getLib libuuid}/lib/libuuid.so.1
   '';
 
   passthru = {
diff --git a/pkgs/by-name/ws/wstunnel/package.nix b/pkgs/by-name/ws/wstunnel/package.nix
index 9e918039c14a..46b9723e9559 100644
--- a/pkgs/by-name/ws/wstunnel/package.nix
+++ b/pkgs/by-name/ws/wstunnel/package.nix
@@ -8,7 +8,7 @@
 }:
 
 let
-  version = "10.0.1";
+  version = "10.1.0";
 in
 
 rustPlatform.buildRustPackage {
@@ -19,10 +19,10 @@ rustPlatform.buildRustPackage {
     owner = "erebe";
     repo = "wstunnel";
     rev = "v${version}";
-    hash = "sha256-lahuuVc+fbuWMXaWvt8C6j26Mo/1o5PkBfVH+lemdv4=";
+    hash = "sha256-nOks9OMA0z7e1nYnKxkSmEj5GXP00385E+jr67lzS5c=";
   };
 
-  cargoHash = "sha256-gNx01LHIcAbedO2X/OwwnQWd9d0Qc6ahe84IRUyptcY=";
+  cargoHash = "sha256-QJ5Fb1M5CLDd2bZPy2p9zqh2A9KIoHp7PA1fxX2RDjI=";
 
   nativeBuildInputs = [ versionCheckHook ];
 
diff --git a/pkgs/by-name/ya/yamlscript/package.nix b/pkgs/by-name/ya/yamlscript/package.nix
index e9e221b946e7..14c9bbb5326d 100644
--- a/pkgs/by-name/ya/yamlscript/package.nix
+++ b/pkgs/by-name/ya/yamlscript/package.nix
@@ -2,11 +2,11 @@
 
 buildGraalvmNativeImage rec {
   pname = "yamlscript";
-  version = "0.1.72";
+  version = "0.1.73";
 
   src = fetchurl {
     url = "https://github.com/yaml/yamlscript/releases/download/${version}/yamlscript.cli-${version}-standalone.jar";
-    hash = "sha256-Qp2/Bifh+KXUjpcW/Lct6nGBv50TUEOGTjVPkXGbD54=";
+    hash = "sha256-FXw476RXIFnjnK8cz/Kxni4dZ58LJvevcxiotDO7+bQ=";
   };
 
   executable = "ys";
diff --git a/pkgs/by-name/yt/ytdownloader/package.nix b/pkgs/by-name/yt/ytdownloader/package.nix
index 01351c615d23..190c8e9f96f1 100644
--- a/pkgs/by-name/yt/ytdownloader/package.nix
+++ b/pkgs/by-name/yt/ytdownloader/package.nix
@@ -12,16 +12,16 @@
 
 buildNpmPackage rec {
   pname = "ytDownloader";
-  version = "3.18.0";
+  version = "3.18.2";
 
   src = fetchFromGitHub {
     owner = "aandrew-me";
     repo = "ytDownloader";
     rev = "refs/tags/v${version}";
-    hash = "sha256-/3VlBxT06/jnBwk07zoUs1yb9MUB9U+oJtXBGoKH6Dg=";
+    hash = "sha256-j6FeRqAeqXLofvI5R7nOwfg6wd17Xk85vryktGfnxyI=";
   };
 
-  npmDepsHash = "sha256-dAd9O3iOELBRRzQV/+DSQXHS5PLjDZvsF2D1vwT9dw8=";
+  npmDepsHash = "sha256-LUlpyzHJDpjytZmMjjn899NKwvb80a0DXdMhVT2aRTY=";
 
   nativeBuildInputs = [
     copyDesktopItems
diff --git a/pkgs/data/misc/v2ray-domain-list-community/default.nix b/pkgs/data/misc/v2ray-domain-list-community/default.nix
index 92fecc9ca031..a38e6cf45b39 100644
--- a/pkgs/data/misc/v2ray-domain-list-community/default.nix
+++ b/pkgs/data/misc/v2ray-domain-list-community/default.nix
@@ -3,12 +3,12 @@
 let
   generator = pkgsBuildBuild.buildGoModule rec {
     pname = "v2ray-domain-list-community";
-    version = "20240823035651";
+    version = "20240829063032";
     src = fetchFromGitHub {
       owner = "v2fly";
       repo = "domain-list-community";
       rev = version;
-      hash = "sha256-2tUs3+CXpBJ1/PHxXwIjv6srOEN2f+1G+ST3/vuOXLQ=";
+      hash = "sha256-gON0oAObjo3eFU50tPg318RNCrYevu5J68nl/gPlEkI=";
     };
     vendorHash = "sha256-NLh14rXRci4hgDkBJVJDIDvobndB7KYRKAX7UjyqSsg=";
     meta = with lib; {
diff --git a/pkgs/development/compilers/circt/default.nix b/pkgs/development/compilers/circt/default.nix
index e8be6989a771..0d70a64a2173 100644
--- a/pkgs/development/compilers/circt/default.nix
+++ b/pkgs/development/compilers/circt/default.nix
@@ -18,12 +18,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "circt";
-  version = "1.81.1";
+  version = "1.84.0";
   src = fetchFromGitHub {
     owner = "llvm";
     repo = "circt";
     rev = "firtool-${version}";
-    hash = "sha256-MDmCsDXc4ohqz+btqbWhhq0PoTNqE6MfVpzrjIoS4rU=";
+    hash = "sha256-9GOn0wnFQ9JidLf5qpz2xG0lf+cCqKMvZnAy4JDCFu4=";
     fetchSubmodules = true;
   };
 
@@ -89,7 +89,7 @@ stdenv.mkDerivation rec {
     description = "Circuit IR compilers and tools";
     homepage = "https://circt.org/";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ sharzy pineapplehunter ];
+    maintainers = with lib.maintainers; [ sharzy pineapplehunter sequencer ];
     platforms = lib.platforms.all;
   };
 }
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index 828f729a735a..02d385d063a2 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -135,7 +135,7 @@ let
   in passthruFun rec {
     inherit self sourceVersion packageOverrides;
     implementation = "cpython";
-    libPrefix = "python${pythonVersion}";
+    libPrefix = "python${pythonVersion}${lib.optionalString (!enableGIL) "t"}";
     executable = libPrefix;
     pythonVersion = with sourceVersion; "${major}.${minor}";
     sitePackages = "lib/${libPrefix}/site-packages";
diff --git a/pkgs/development/interpreters/python/meta-package.nix b/pkgs/development/interpreters/python/meta-package.nix
new file mode 100644
index 000000000000..2e25dff85fe0
--- /dev/null
+++ b/pkgs/development/interpreters/python/meta-package.nix
@@ -0,0 +1,58 @@
+{
+  buildPythonPackage,
+  lib,
+  hatchling,
+}:
+{
+  pname,
+  version,
+  dependencies ? [ ],
+  optional-dependencies ? { },
+  passthru ? { },
+  meta ? { },
+}:
+
+# Create a "fake" meta package to satisfy a dependency on a package, but don't actually build it.
+# This is useful for packages that have a split binary/source dichotomy like psycopg2/psycopg2-binary,
+# where we want to use the former, but some projects declare a dependency on the latter.
+
+buildPythonPackage {
+  inherit
+    pname
+    version
+    dependencies
+    optional-dependencies
+    meta
+    passthru
+    ;
+
+  pyproject = true;
+
+  # Make a minimal pyproject.toml that can be built
+  unpackPhase = ''
+    cat > pyproject.toml << EOF
+    [project]
+    name = "${pname}"
+    version = "${version}"
+    dependencies = ${builtins.toJSON (map lib.getName dependencies)}
+
+    [project.optional-dependencies]
+    ${lib.optionalString (optional-dependencies != { }) (
+      (lib.concatStringsSep "\n" (
+        lib.mapAttrsToList (
+          group: deps: group + " = " + builtins.toJSON (map lib.getName deps)
+        ) optional-dependencies
+      ))
+    )}
+
+    [tool.hatch.build.targets.wheel]
+    bypass-selection = true
+
+    [build-system]
+    requires = ["hatchling"]
+    build-backend = "hatchling.build"
+    EOF
+  '';
+
+  build-system = [ hatchling ];
+}
diff --git a/pkgs/development/interpreters/python/python-packages-base.nix b/pkgs/development/interpreters/python/python-packages-base.nix
index a807b6e6e33c..edd0937098b6 100644
--- a/pkgs/development/interpreters/python/python-packages-base.nix
+++ b/pkgs/development/interpreters/python/python-packages-base.nix
@@ -61,6 +61,8 @@ let
 
   removePythonPrefix = lib.removePrefix namePrefix;
 
+  mkPythonMetaPackage = callPackage ./meta-package.nix { };
+
   # Convert derivation to a Python module.
   toPythonModule = drv:
     drv.overrideAttrs( oldAttrs: {
@@ -97,6 +99,7 @@ in {
   inherit buildPythonPackage buildPythonApplication;
   inherit hasPythonModule requiredPythonModules makePythonPath disabled disabledIf;
   inherit toPythonModule toPythonApplication;
+  inherit mkPythonMetaPackage;
 
   python = toPythonModule python;
 
diff --git a/pkgs/development/libraries/libxsmm/default.nix b/pkgs/development/libraries/libxsmm/default.nix
index 178e524fd1b7..eeb9dcf71b4a 100644
--- a/pkgs/development/libraries/libxsmm/default.nix
+++ b/pkgs/development/libraries/libxsmm/default.nix
@@ -6,16 +6,20 @@
 
 stdenv.mkDerivation rec {
   pname = "libxsmm";
-  version = "1.16.3";
+  version = "1.17";
 
   src = fetchFromGitHub {
-    owner = "hfp";
+    owner = "libxsmm";
     repo = "libxsmm";
     rev = version;
-    sha256 = "sha256-PpMiD/PeQ0pe5hqFG6VFHWpR8y3wnO2z1dJfHHeItlQ=";
+    sha256 = "sha256-s/NEFU4IwQPLyPLwMmrrpMDd73q22Sk2BNid/kedawY=";
   };
 
+  # Fixes /build references in the rpath
+  patches = [ ./rpath.patch ];
+
   outputs = [ "out" "dev" "doc" ];
+
   nativeBuildInputs = [
     gfortran
     python3
@@ -39,7 +43,7 @@ stdenv.mkDerivation rec {
     mkdir -p $dev/lib/pkgconfig
     mv $out/lib/*.pc $dev/lib/pkgconfig
 
-    moveToOutput "share/libxsmm" "$doc"
+    moveToOutput "share/libxsmm" ''${!outputDoc}
   '';
 
   prePatch = ''
diff --git a/pkgs/development/libraries/libxsmm/rpath.patch b/pkgs/development/libraries/libxsmm/rpath.patch
new file mode 100644
index 000000000000..bd3feca413b7
--- /dev/null
+++ b/pkgs/development/libraries/libxsmm/rpath.patch
@@ -0,0 +1,13 @@
+diff --git a/Makefile.inc b/Makefile.inc
+index 424d7b2e4..87934fee0 100644
+--- a/Makefile.inc
++++ b/Makefile.inc
+@@ -918,7 +918,7 @@ ifneq (Darwin,$(UNAME))
+   XLNKVERBOSE := --verbose
+   linkopt = $(if $1,$(XLNKOPT)$(if $2,$1=$(call quote,$2),$1))
+   abslibrpath = $(strip $(if $(findstring .$(ILIBEXT),$1)$(wildcard $1/), \
+-    $(call linkopt,--rpath,$(call qxdir,$(call qapath,$1)))))
++    $(call linkopt,--rpath,$(PREFIX)/lib)))
+   XGROUP_BEGIN := $(call linkopt,--start-group)
+   XGROUP_END := $(call linkopt,--end-group)
+   ifneq (0,$(ASNEEDED))
diff --git a/pkgs/development/libraries/olm/default.nix b/pkgs/development/libraries/olm/default.nix
index 3fda0206ace5..f0a6c47d4ca7 100644
--- a/pkgs/development/libraries/olm/default.nix
+++ b/pkgs/development/libraries/olm/default.nix
@@ -34,11 +34,11 @@ stdenv.mkDerivation rec {
       disclaims that its implementations are not cryptographically secure
       and should not be used when cryptographic security is required.
 
-      It is not known that the issues can be exploited over the network in
-      practical conditions. Upstream has stated that the library should
-      not be used going forwards, and there are no plans to move to a
-      another cryptography implementation or otherwise further maintain
-      the library at all.
+      It is not known if the issues can be exploited over the network in
+      practical conditions. Upstream does not believe such an attack is
+      feasible, but has stated that the library should not be used going
+      forward, and there are no plans to move to a another cryptography
+      implementation or otherwise further maintain the library at all.
 
       You should make an informed decision about whether to override this
       security warning, especially if you critically rely on end‐to‐end
@@ -66,9 +66,9 @@ stdenv.mkDerivation rec {
       * The blog post disclosing the details of the known vulnerabilities:
         <https://soatok.blog/2024/08/14/security-issues-in-matrixs-olm-library/>
 
-      * The announcement in This Week in Matrix from the Matrix.org
-        project lead:
-        <https://matrix.org/blog/2024/08/16/this-week-in-matrix-2024-08-16/#dept-of-encryption-closed-lock-with-key>
+      * The statement about the deprecation and vulnerabilities from the
+        Matrix.org Foundation:
+        <https://matrix.org/blog/2024/08/libolm-deprecation/>
 
       * A (likely incomplete) aggregation of client tracking issue links:
         <https://github.com/NixOS/nixpkgs/pull/334638#issuecomment-2289025802>
diff --git a/pkgs/development/libraries/quarto/default.nix b/pkgs/development/libraries/quarto/default.nix
index 1cf1d80b4ff0..11350128b4aa 100644
--- a/pkgs/development/libraries/quarto/default.nix
+++ b/pkgs/development/libraries/quarto/default.nix
@@ -19,10 +19,10 @@
 
 stdenv.mkDerivation (final: {
   pname = "quarto";
-  version = "1.5.56";
+  version = "1.5.57";
   src = fetchurl {
     url = "https://github.com/quarto-dev/quarto-cli/releases/download/v${final.version}/quarto-${final.version}-linux-amd64.tar.gz";
-    sha256 = "sha256-sq7/Jfwo//yMiK0JSN99HMnXswNP4vPElZIRmSb+R8g=";
+    sha256 = "sha256-ZBjv/Z98il8EMZe88fMKSi1YjeOZ8jEh7OxYDKUTMpY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/science/math/dbcsr/default.nix b/pkgs/development/libraries/science/math/dbcsr/default.nix
index a99f673700c4..34f9c4db39cc 100644
--- a/pkgs/development/libraries/science/math/dbcsr/default.nix
+++ b/pkgs/development/libraries/science/math/dbcsr/default.nix
@@ -50,10 +50,6 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ mpi ];
 
-  preConfigure = ''
-    export PKG_CONFIG_PATH=${libxsmm}/lib
-  '';
-
   cmakeFlags = [
     "-DUSE_OPENMP=ON"
     "-DUSE_SMM=libxsmm"
diff --git a/pkgs/development/ocaml-modules/backoff/default.nix b/pkgs/development/ocaml-modules/backoff/default.nix
new file mode 100644
index 000000000000..5f8f7a12d79b
--- /dev/null
+++ b/pkgs/development/ocaml-modules/backoff/default.nix
@@ -0,0 +1,24 @@
+{ lib, buildDunePackage, fetchurl, alcotest}:
+
+buildDunePackage rec {
+  pname = "backoff";
+  version = "0.1.0";
+
+  src = fetchurl {
+    url = "https://github.com/ocaml-multicore/backoff/releases/download/${version}/backoff-${version}.tbz";
+    hash = "sha256-EaSseCKekNE03gaNiqh5Y11r8TF9XulR9AZboPWMIwA=";
+  };
+
+  doCheck = true;
+
+  checkInputs = [ alcotest ];
+
+  meta = {
+    description = "Exponential backoff mechanism for OCaml";
+    homepage = "https://github.com/ocaml-multicore/backoff";
+    license = lib.licenses.isc;
+    maintainers = [ lib.maintainers.vbgl ];
+  };
+
+  minimalOCamlVersion = "4.13";
+}
diff --git a/pkgs/development/ocaml-modules/domainslib/default.nix b/pkgs/development/ocaml-modules/domainslib/default.nix
index 096ba5434996..e912cfeb57af 100644
--- a/pkgs/development/ocaml-modules/domainslib/default.nix
+++ b/pkgs/development/ocaml-modules/domainslib/default.nix
@@ -29,5 +29,6 @@ buildDunePackage rec {
     description = "Nested-parallel programming";
     license = lib.licenses.isc;
     maintainers = [ lib.maintainers.vbgl ];
+    broken = true; # Not compatible with saturn > 0.4.0
   };
 }
diff --git a/pkgs/development/ocaml-modules/multicore-bench/default.nix b/pkgs/development/ocaml-modules/multicore-bench/default.nix
new file mode 100644
index 000000000000..5e1d2275e5b6
--- /dev/null
+++ b/pkgs/development/ocaml-modules/multicore-bench/default.nix
@@ -0,0 +1,22 @@
+{ lib, buildDunePackage, fetchurl
+, domain-local-await, mtime, multicore-magic, yojson
+}:
+
+buildDunePackage rec {
+  pname = "multicore-bench";
+  version = "0.1.4";
+
+  src = fetchurl {
+    url = "https://github.com/ocaml-multicore/multicore-bench/releases/download/${version}/multicore-bench-${version}.tbz";
+    hash = "sha256-iCx5QvhYo/e53cW23Sza2as4aez4HeESVvLPF1DW85A=";
+  };
+
+  propagatedBuildInputs = [ domain-local-await mtime multicore-magic yojson ];
+
+  meta = {
+    description = "Framework for writing multicore benchmark executables to run on current-bench";
+    homepage = "https://github.com/ocaml-multicore/multicore-bench";
+    license = lib.licenses.isc;
+    maintainers = [ lib.maintainers.vbgl ];
+  };
+}
diff --git a/pkgs/development/ocaml-modules/multicore-magic/default.nix b/pkgs/development/ocaml-modules/multicore-magic/default.nix
new file mode 100644
index 000000000000..3082eece19cf
--- /dev/null
+++ b/pkgs/development/ocaml-modules/multicore-magic/default.nix
@@ -0,0 +1,24 @@
+{ lib, buildDunePackage, fetchurl
+, alcotest, domain_shims
+}:
+
+buildDunePackage rec {
+  pname = "multicore-magic";
+  version = "2.3.0";
+
+  src = fetchurl {
+    url = "https://github.com/ocaml-multicore/multicore-magic/releases/download/${version}/multicore-magic-${version}.tbz";
+    hash = "sha256-r50UqLOd2DoTz0CEXHpJMHX0fty+mGiAKTdtykgnzu4=";
+  };
+
+  doCheck = true;
+
+  checkInputs = [ alcotest domain_shims ];
+
+  meta = {
+    description = "Low-level multicore utilities for OCaml";
+    license = lib.licenses.isc;
+    homepage = "https://github.com/ocaml-multicore/multicore-magic";
+    maintainers = [ lib.maintainers.vbgl ];
+  };
+}
diff --git a/pkgs/development/ocaml-modules/saturn/default.nix b/pkgs/development/ocaml-modules/saturn/default.nix
index 582f0e7f5aea..d5b8d0478f2a 100644
--- a/pkgs/development/ocaml-modules/saturn/default.nix
+++ b/pkgs/development/ocaml-modules/saturn/default.nix
@@ -1,6 +1,8 @@
 { lib, buildDunePackage, ocaml
 , saturn_lockfree
+, domain_shims
 , dscheck
+, multicore-bench
 , qcheck, qcheck-alcotest, qcheck-stm
 }:
 
@@ -12,7 +14,14 @@ buildDunePackage rec {
   propagatedBuildInputs = [ saturn_lockfree ];
 
   doCheck = lib.versionAtLeast ocaml.version "5.0";
-  checkInputs = [ dscheck qcheck qcheck-alcotest qcheck-stm ];
+  checkInputs = [
+    domain_shims
+    dscheck
+    multicore-bench
+    qcheck
+    qcheck-alcotest
+    qcheck-stm
+  ];
 
   meta = saturn_lockfree.meta // {
     description = "Parallelism-safe data structures for multicore OCaml";
diff --git a/pkgs/development/ocaml-modules/saturn/lockfree.nix b/pkgs/development/ocaml-modules/saturn/lockfree.nix
index 42858626e58d..07b8dc785cff 100644
--- a/pkgs/development/ocaml-modules/saturn/lockfree.nix
+++ b/pkgs/development/ocaml-modules/saturn/lockfree.nix
@@ -1,19 +1,19 @@
 { lib, fetchurl, buildDunePackage
-, domain_shims
+, backoff, multicore-magic
 }:
 
 buildDunePackage rec {
   pname = "saturn_lockfree";
-  version = "0.4.0";
+  version = "0.5.0";
 
-  minimalOCamlVersion = "4.12";
+  minimalOCamlVersion = "4.13";
 
   src = fetchurl {
     url = "https://github.com/ocaml-multicore/saturn/releases/download/${version}/saturn-${version}.tbz";
-    hash = "sha256-fHvslaJwVbQaqDVA/MHGqHybetYbxRGlMrhgXqM3iPs=";
+    hash = "sha256-ZmmxwIe5PiPYTTdvOHbOjRbv2b/bb9y0IekByfREPjk=";
   };
 
-  propagatedBuildInputs = [ domain_shims ];
+  propagatedBuildInputs = [ backoff multicore-magic ];
 
   meta = {
     description = "Lock-free data structures for multicore OCaml";
diff --git a/pkgs/development/python-modules/aeidon/default.nix b/pkgs/development/python-modules/aeidon/default.nix
index 744ece58293f..7438d3a74fe6 100644
--- a/pkgs/development/python-modules/aeidon/default.nix
+++ b/pkgs/development/python-modules/aeidon/default.nix
@@ -1,10 +1,8 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
-  gettext,
-  flake8,
-  isocodes,
+  fetchFromGitHub,
+  setuptools,
   pytestCheckHook,
   charset-normalizer,
 }:
@@ -12,35 +10,27 @@
 buildPythonPackage rec {
   pname = "aeidon";
   version = "1.15";
+  pyproject = true;
 
-  src = fetchPypi {
-    pname = "aeidon";
-    inherit version;
-    sha256 = "sha256-qGpGraRZFVaW1Jys24qvfPo5WDg7Q/fhvm44JH8ulVw=";
+  src = fetchFromGitHub {
+    owner = "otsaloma";
+    repo = "gaupol";
+    rev = "refs/tags/${version}";
+    hash = "sha256-lhNyeieeiBBm3rNDEU0BuWKeM6XYlOtv1voW8tR8cUM=";
   };
 
-  nativeBuildInputs = [
-    gettext
-    flake8
-  ];
-
-  dependencies = [ isocodes ];
-
-  installPhase = ''
-    runHook preInstall
-    python setup.py --without-gaupol install --prefix=$out
-    runHook postInstall
+  postPatch = ''
+    mv setup.py setup_gaupol.py
+    substituteInPlace setup-aeidon.py \
+      --replace "from setup import" "from setup_gaupol import"
+    mv setup-aeidon.py setup.py
   '';
 
-  nativeCheckInputs = [
-    pytestCheckHook
-    charset-normalizer
-  ];
+  build-system = [ setuptools ];
 
-  # Aeidon is looking in the wrong subdirectory for data
-  preCheck = ''
-    cp -r data aeidon/
-  '';
+  dependencies = [ charset-normalizer ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
 
   pytestFlagsArray = [ "aeidon/test" ];
 
@@ -52,9 +42,10 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "aeidon" ];
 
   meta = with lib; {
+    changelog = "https://github.com/otsaloma/gaupol/releases/tag/${version}";
     description = "Reading, writing and manipulationg text-based subtitle files";
     homepage = "https://github.com/otsaloma/gaupol";
-    license = licenses.gpl3Only;
+    license = licenses.gpl3Plus;
     maintainers = with maintainers; [ erictapen ];
   };
 
diff --git a/pkgs/development/python-modules/affine/default.nix b/pkgs/development/python-modules/affine/default.nix
index c86ad95b71d6..50ad44f34cc1 100644
--- a/pkgs/development/python-modules/affine/default.nix
+++ b/pkgs/development/python-modules/affine/default.nix
@@ -29,6 +29,6 @@ buildPythonPackage rec {
     description = "Matrices describing affine transformation of the plane";
     license = licenses.bsd3;
     homepage = "https://github.com/rasterio/affine";
-    maintainers = with maintainers; [ mredaelli ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/aioesphomeapi/default.nix b/pkgs/development/python-modules/aioesphomeapi/default.nix
index a3797f510728..074a1025c458 100644
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "aioesphomeapi";
-  version = "25.2.1";
+  version = "25.3.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     owner = "esphome";
     repo = "aioesphomeapi";
     rev = "refs/tags/v${version}";
-    hash = "sha256-pQ8RR8e9NVQNBKaQMI60WYANI0rSK5L/H+5e2Tu7zUU=";
+    hash = "sha256-3srw745rEDS8G4270kHPGjOr4Tnbrt5EMO/B/cb03Vs=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/atlassian-python-api/default.nix b/pkgs/development/python-modules/atlassian-python-api/default.nix
index 6a481aed589d..5d1a30895382 100644
--- a/pkgs/development/python-modules/atlassian-python-api/default.nix
+++ b/pkgs/development/python-modules/atlassian-python-api/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "atlassian-python-api";
-  version = "3.41.14";
+  version = "3.41.15";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "atlassian-api";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-cXVHGEOvEuSH19mub9u6kjK3epetN3IeXlHxwiBzTPY=";
+    hash = "sha256-DnsDulCbkilfD51r8x/L3RJXTDclAi4gYNktfuQC0w8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/bthome-ble/default.nix b/pkgs/development/python-modules/bthome-ble/default.nix
index 5e038521dff2..8f48d2c0364d 100644
--- a/pkgs/development/python-modules/bthome-ble/default.nix
+++ b/pkgs/development/python-modules/bthome-ble/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "bthome-ble";
-  version = "3.10.0";
+  version = "3.11.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = "bthome-ble";
     rev = "refs/tags/v${version}";
-    hash = "sha256-oGhj1LsglD5d0i5ltpRZ1GvxsntTEoX6NzdrkHpml7E=";
+    hash = "sha256-TlZyNGfHNKN+6tCKepLS+fbgfq3a1uzeCXl25khl6d8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/cartopy/default.nix b/pkgs/development/python-modules/cartopy/default.nix
index 06437870fae5..dbd7659ab81e 100644
--- a/pkgs/development/python-modules/cartopy/default.nix
+++ b/pkgs/development/python-modules/cartopy/default.nix
@@ -104,6 +104,6 @@ buildPythonPackage rec {
     mainProgram = "feature_download";
     license = licenses.lgpl3Plus;
     homepage = "https://scitools.org.uk/cartopy/docs/latest/";
-    maintainers = with maintainers; [ mredaelli ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/craft-platforms/default.nix b/pkgs/development/python-modules/craft-platforms/default.nix
index 3cd303990859..f183449961d3 100644
--- a/pkgs/development/python-modules/craft-platforms/default.nix
+++ b/pkgs/development/python-modules/craft-platforms/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "craft-platforms";
-  version = "0.1.1";
+  version = "0.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "canonical";
     repo = "craft-platforms";
     rev = "refs/tags/${version}";
-    hash = "sha256-KzskmSw7NsH1CAYjPf2281Ob71Jd6AhWxtp5tR3IqyU=";
+    hash = "sha256-chCPuncy+//Y5iohTh0d8qRNaEno6Sqze2Zoas3uwPQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/django-payments/default.nix b/pkgs/development/python-modules/django-payments/default.nix
index 935808b32c79..62e4484e4553 100644
--- a/pkgs/development/python-modules/django-payments/default.nix
+++ b/pkgs/development/python-modules/django-payments/default.nix
@@ -13,12 +13,13 @@
   setuptools-scm,
   sphinx-rtd-theme,
   stripe,
+  suds-community,
   xmltodict,
 }:
 
 buildPythonPackage rec {
   pname = "django-payments";
-  version = "2.0.0";
+  version = "3.0.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -27,14 +28,9 @@ buildPythonPackage rec {
     owner = "jazzband";
     repo = "django-payments";
     rev = "refs/tags/v${version}";
-    hash = "sha256-6WPV08CV+rko/tRnsT5GyTGYaJbiIKTvpisfRwizBIo=";
+    hash = "sha256-/XsqtExnNtUGqI40XvvcO/nGq56gbC/mPdtHv1QQyGo=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace-fail "django-phonenumber-field[phonenumberslite]" "django-phonenumber-field"
-  '';
-
   build-system = [
     setuptools
     setuptools-scm
@@ -44,26 +40,16 @@ buildPythonPackage rec {
     django
     django-phonenumber-field
     requests
-  ] ++ django-phonenumber-field.optional-dependencies.phonenumbers;
+  ] ++ django-phonenumber-field.optional-dependencies.phonenumberslite;
 
   # require internet connection
   doCheck = false;
 
   pythonImportsCheck = [ "payments" ];
 
-  passthru.optional-dependencies = {
-    all = [
-      braintree # suds-community
-      mercadopago
-      cryptography
-      xmltodict
-      stripe
-    ];
+  optional-dependencies = {
     braintree = [ braintree ];
-    cybersource = [
-      # suds-community
-    ];
-    docs = [ sphinx-rtd-theme ];
+    cybersource = [ suds-community ];
     mercadopago = [ mercadopago ];
     sagepay = [ cryptography ];
     sofort = [ xmltodict ];
@@ -73,7 +59,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Universal payment handling for Django";
     homepage = "https://github.com/jazzband/django-payments/";
-    changelog = "https://github.com/jazzband/django-payments/releases/tag/v${version}";
+    changelog = "https://github.com/jazzband/django-payments/blob/${src.rev}/CHANGELOG.rst";
     license = licenses.bsd3;
     maintainers = with maintainers; [ derdennisop ];
   };
diff --git a/pkgs/development/python-modules/django-phonenumber-field/default.nix b/pkgs/development/python-modules/django-phonenumber-field/default.nix
index e58bb4e81cff..39cd78b2f495 100644
--- a/pkgs/development/python-modules/django-phonenumber-field/default.nix
+++ b/pkgs/development/python-modules/django-phonenumber-field/default.nix
@@ -4,8 +4,9 @@
   buildPythonPackage,
   django,
   djangorestframework,
-  fetchPypi,
+  fetchFromGitHub,
   phonenumbers,
+  phonenumberslite,
   python,
   pythonOlder,
   setuptools-scm,
@@ -13,19 +14,25 @@
 
 buildPythonPackage rec {
   pname = "django-phonenumber-field";
-  version = "7.3.0";
-  format = "pyproject";
+  version = "8.0.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-+c2z3ghfmcJJMoKTo7k9Tl+kQMDI47mesND1R0hil5c=";
+  src = fetchFromGitHub {
+    owner = "stefanfoulis";
+    repo = "django-phonenumber-field";
+    rev = "refs/tags/${version}";
+    hash = "sha256-l+BAh7QYGN0AgDHICvlQnBYAcpEn8acu+JBmoo85kF0=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  build-system = [ setuptools-scm ];
 
-  propagatedBuildInputs = [ django ] ++ passthru.optional-dependencies.phonenumbers;
+  # Upstream doesn't put phonenumbers in dependencies but the package doesn't
+  # make sense without either of the two optional dependencies. Since, in
+  # Nixpkgs, phonenumberslite depends on phonenumbers, add the latter
+  # unconditionally.
+  dependencies = [ django ] ++ optional-dependencies.phonenumbers;
 
   nativeCheckInputs = [
     babel
@@ -38,8 +45,9 @@ buildPythonPackage rec {
     ${python.interpreter} -m django test --settings tests.settings
   '';
 
-  passthru.optional-dependencies = {
+  optional-dependencies = {
     phonenumbers = [ phonenumbers ];
+    phonenumberslite = [ phonenumberslite ];
   };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/flask-security/default.nix b/pkgs/development/python-modules/flask-security/default.nix
index e202a68ab480..8cfc0f5996b9 100644
--- a/pkgs/development/python-modules/flask-security/default.nix
+++ b/pkgs/development/python-modules/flask-security/default.nix
@@ -22,7 +22,7 @@
 
   # extras: mfa
   cryptography,
-  phonenumbers,
+  phonenumberslite,
   webauthn,
   qrcode,
 
@@ -63,11 +63,6 @@ buildPythonPackage rec {
     hash = "sha256-RGRwgrDFe+0v8NYyajMikdoi1DQf1I+B5y8KJyF+cZs=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail phonenumberslite phonenumbers
-  '';
-
   build-system = [ flit-core ];
 
   # flask-login>=0.6.2 not satisfied by version 0.7.0.dev0
@@ -103,7 +98,7 @@ buildPythonPackage rec {
     ];
     mfa = [
       cryptography
-      phonenumbers
+      phonenumberslite
       webauthn
       qrcode
     ];
diff --git a/pkgs/development/python-modules/gentools/default.nix b/pkgs/development/python-modules/gentools/default.nix
index 8ecaecbee472..d2bb35462ead 100644
--- a/pkgs/development/python-modules/gentools/default.nix
+++ b/pkgs/development/python-modules/gentools/default.nix
@@ -35,6 +35,6 @@ buildPythonPackage rec {
     homepage = "https://gentools.readthedocs.io/";
     changelog = "https://github.com/ariebovenberg/gentools/blob/v${version}/CHANGELOG.rst";
     license = licenses.mit;
-    maintainers = with maintainers; [ mredaelli ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/gvm-tools/default.nix b/pkgs/development/python-modules/gvm-tools/default.nix
index 860c7254b100..73184dcad346 100644
--- a/pkgs/development/python-modules/gvm-tools/default.nix
+++ b/pkgs/development/python-modules/gvm-tools/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "gvm-tools";
-  version = "24.7.0";
+  version = "24.8.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "greenbone";
     repo = "gvm-tools";
     rev = "refs/tags/v${version}";
-    hash = "sha256-m4wEAx2WyVIMi+xucqUCPr2PLxLo00haObjf+0swUdA=";
+    hash = "sha256-MwLwJyxKu4O0cEabBjcdhqtqW3uwgbyVlezZysUDYa4=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/hiyapyco/default.nix b/pkgs/development/python-modules/hiyapyco/default.nix
index 24c1c400565d..1e2b45a7dc60 100644
--- a/pkgs/development/python-modules/hiyapyco/default.nix
+++ b/pkgs/development/python-modules/hiyapyco/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "hiyapyco";
-  version = "0.6.0";
+  version = "0.6.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "zerwes";
     repo = pname;
     rev = "refs/tags/release-${version}";
-    hash = "sha256-F+OPoFEUTHWSo5Pc46Wwt4j/x7w0BjhJhpLEdNPr7H0=";
+    hash = "sha256-KB/KFrR7IScIWyYbsU+4BbV0+SCeeWxYDD8lbxosRLc=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/lib4sbom/default.nix b/pkgs/development/python-modules/lib4sbom/default.nix
index 3dc8f0c4c236..dbf4d5a5025f 100644
--- a/pkgs/development/python-modules/lib4sbom/default.nix
+++ b/pkgs/development/python-modules/lib4sbom/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "lib4sbom";
-  version = "0.7.3";
+  version = "0.7.4";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "anthonyharrison";
     repo = "lib4sbom";
     rev = "refs/tags/v${version}";
-    hash = "sha256-RuIvhlLnWf/ayU6tjpHYKvBFqU8ojPwJK/pDIdLrD2s=";
+    hash = "sha256-Uqv6E9qMJRsfYICVAiZEQGlG/0w8aECuh8wMa85FnlE=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/libpysal/default.nix b/pkgs/development/python-modules/libpysal/default.nix
index bc6120a1c693..c81bab3c1512 100644
--- a/pkgs/development/python-modules/libpysal/default.nix
+++ b/pkgs/development/python-modules/libpysal/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "libpysal";
-  version = "4.12.0";
+  version = "4.12.1";
   pyproject = true;
   disabled = pythonOlder "3.10";
 
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "pysal";
     repo = "libpysal";
     rev = "refs/tags/v${version}";
-    hash = "sha256-m7jcTi51ngAXXWYJGkjMVA3KwAxL2aJysdjiS1pWEIQ=";
+    hash = "sha256-snhCEKeGKKj/bTDYi6ZVv5F4b/2rz/JHIFG2IoINQ+Q=";
   };
 
   build-system = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/lmcloud/default.nix b/pkgs/development/python-modules/lmcloud/default.nix
index cfb193bcdfe1..adf2cbfd0cfc 100644
--- a/pkgs/development/python-modules/lmcloud/default.nix
+++ b/pkgs/development/python-modules/lmcloud/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "lmcloud";
-  version = "1.1.13";
+  version = "1.2.1";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -20,8 +20,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "zweckj";
     repo = "lmcloud";
-    rev = "refs/tags/v.${version}";
-    hash = "sha256-byZtmyZcvr39hKzamGjSunMeVE2C19QtwF4u78k+YOY=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-dkYfcXU6RbnGcJpKdsNw05PgxGNdsZ1wNzq8uDvS0rU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/model-bakery/default.nix b/pkgs/development/python-modules/model-bakery/default.nix
index 0b6c3f49443c..464b2920a799 100644
--- a/pkgs/development/python-modules/model-bakery/default.nix
+++ b/pkgs/development/python-modules/model-bakery/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "model-bakery";
-  version = "1.19.4";
+  version = "1.19.5";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "model-bakers";
     repo = "model_bakery";
     rev = "refs/tags/${version}";
-    hash = "sha256-Jok5fQ8z9/v6n482yYA06ugC+4SSMuV7fmt1cdv3/dg=";
+    hash = "sha256-hOXE3mddGmRRgO9qAlj3bnmco8QTg2rD0sgui3J9pp8=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/neo4j/default.nix b/pkgs/development/python-modules/neo4j/default.nix
index 03635a8017bf..498e644a05e5 100644
--- a/pkgs/development/python-modules/neo4j/default.nix
+++ b/pkgs/development/python-modules/neo4j/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "neo4j";
-  version = "5.23.1";
+  version = "5.24.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -22,13 +22,14 @@ buildPythonPackage rec {
     owner = "neo4j";
     repo = "neo4j-python-driver";
     rev = "refs/tags/${version}";
-    hash = "sha256-0kxeBwdhiDRCA4mkvr/wU07mr4bdvegO8sqghrH7dYg=";
+    hash = "sha256-bkLz+4eOS+c1qUC2PbPNcn19sJqUqONSgKhAe1Ga1U8=";
   };
 
   postPatch = ''
     # The dynamic versioning adds a postfix (.dev0) to the version
     substituteInPlace pyproject.toml \
-      --replace-fail '"tomlkit ~= 0.11.6"' '"tomlkit >= 0.11.6"' \
+      --replace-fail "setuptools ==" "setuptools >=" \
+      --replace-fail "tomlkit ==" "tomlkit >=" \
       --replace-fail 'dynamic = ["version", "readme"]' 'dynamic = ["readme"]' \
       --replace-fail '#readme = "README.rst"' 'version = "${version}"'
   '';
diff --git a/pkgs/development/python-modules/phonenumberslite/default.nix b/pkgs/development/python-modules/phonenumberslite/default.nix
new file mode 100644
index 000000000000..c2e80c478607
--- /dev/null
+++ b/pkgs/development/python-modules/phonenumberslite/default.nix
@@ -0,0 +1,14 @@
+{
+  mkPythonMetaPackage,
+  phonenumbers,
+}:
+
+mkPythonMetaPackage {
+  pname = "phonenumberslite";
+  inherit (phonenumbers) version;
+  dependencies = [ phonenumbers ];
+  optional-dependencies = phonenumbers.optional-dependencies or { };
+  meta = {
+    inherit (phonenumbers.meta) changelog description homepage;
+  };
+}
diff --git a/pkgs/development/python-modules/playwrightcapture/default.nix b/pkgs/development/python-modules/playwrightcapture/default.nix
index 33e95475b887..4ca77cb5cabe 100644
--- a/pkgs/development/python-modules/playwrightcapture/default.nix
+++ b/pkgs/development/python-modules/playwrightcapture/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "playwrightcapture";
-  version = "1.25.13";
+  version = "1.25.14";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     owner = "Lookyloo";
     repo = "PlaywrightCapture";
     rev = "refs/tags/v${version}";
-    hash = "sha256-O482RKJejgg3eJe4M9U0ExuDFwFz9Fbpxvrn6re58h8=";
+    hash = "sha256-1MTU/teBs2HisW0L0o5RyAAi8wlkrVFwc/K70O4YfKg=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/powerline/default.nix b/pkgs/development/python-modules/powerline/default.nix
index 6578c6f43559..6e1f724a35dd 100644
--- a/pkgs/development/python-modules/powerline/default.nix
+++ b/pkgs/development/python-modules/powerline/default.nix
@@ -14,7 +14,7 @@
 # TODO: bzr support is missing because nixpkgs switched to `breezy`
 
 buildPythonPackage rec {
-  version = "2.8.3";
+  version = "2.8.4";
   pname = "powerline";
   format = "setuptools";
 
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-UIx9/IZg6Wv596wHzQb0CO6zwmQXUaFEPKBojo2LXmA=";
+    hash = "sha256-snJrfUvP11lBIy6F0WtqJt9fiYm5jxMwm9u3u5XFO84=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/psycopg2-binary/default.nix b/pkgs/development/python-modules/psycopg2-binary/default.nix
new file mode 100644
index 000000000000..f0691a2c601b
--- /dev/null
+++ b/pkgs/development/python-modules/psycopg2-binary/default.nix
@@ -0,0 +1,13 @@
+{
+  mkPythonMetaPackage,
+  psycopg2,
+}:
+mkPythonMetaPackage {
+  pname = "psycopg2-binary";
+  inherit (psycopg2) version;
+  dependencies = [ psycopg2 ];
+  optional-dependencies = psycopg2.optional-dependencies or { };
+  meta = {
+    inherit (psycopg2.meta) description homepage;
+  };
+}
diff --git a/pkgs/development/python-modules/pydaikin/default.nix b/pkgs/development/python-modules/pydaikin/default.nix
index 945be522b76f..a11d99332351 100644
--- a/pkgs/development/python-modules/pydaikin/default.nix
+++ b/pkgs/development/python-modules/pydaikin/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "pydaikin";
-  version = "2.13.4";
+  version = "2.13.6";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "fredrike";
     repo = "pydaikin";
     rev = "refs/tags/v${version}";
-    hash = "sha256-zttn1AlKeLtDBxoJd15uYfi1V8FYIwbADm864jnpSQs=";
+    hash = "sha256-b1dvPrtvYJuTZNUase4GgXFGq69QKJZoxUr2iuYShxk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyepsg/default.nix b/pkgs/development/python-modules/pyepsg/default.nix
index f7b7a3e11a6a..47cf101d674b 100644
--- a/pkgs/development/python-modules/pyepsg/default.nix
+++ b/pkgs/development/python-modules/pyepsg/default.nix
@@ -23,6 +23,6 @@ buildPythonPackage rec {
     description = "Simple Python interface to epsg.io";
     license = licenses.lgpl3;
     homepage = "https://pyepsg.readthedocs.io/en/latest/";
-    maintainers = with maintainers; [ mredaelli ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/pyfuse3/default.nix b/pkgs/development/python-modules/pyfuse3/default.nix
index 971551608979..27cc23a31774 100644
--- a/pkgs/development/python-modules/pyfuse3/default.nix
+++ b/pkgs/development/python-modules/pyfuse3/default.nix
@@ -16,33 +16,33 @@
 
 buildPythonPackage rec {
   pname = "pyfuse3";
-  version = "3.3.0";
+  version = "3.4.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
-  format = "pyproject";
-
   src = fetchFromGitHub {
     owner = "libfuse";
     repo = "pyfuse3";
     rev = "refs/tags/${version}";
-    hash = "sha256-GLGuTFdTA16XnXKSBD7ET963a8xH9EG/JfPNu6/3DOg=";
+    hash = "sha256-J4xHiaV8GCtUQ9GJS8YRXpMsuzuwbtnzspvuIonHT24=";
   };
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace "'pkg-config'" "'$(command -v $PKG_CONFIG)'"
+      --replace-fail "'pkg-config'" "'$(command -v $PKG_CONFIG)'"
   '';
 
-  nativeBuildInputs = [
+  build-system = [
     cython
-    pkg-config
     setuptools
   ];
 
+  nativeBuildInputs = [ pkg-config ];
+
   buildInputs = [ fuse3 ];
 
-  propagatedBuildInputs = [ trio ];
+  dependencies = [ trio ];
 
   preBuild = ''
     ${python.pythonOnBuildForHost.interpreter} setup.py build_cython
diff --git a/pkgs/development/python-modules/python-gvm/default.nix b/pkgs/development/python-modules/python-gvm/default.nix
index 223f43fbd5ff..763999be86ad 100644
--- a/pkgs/development/python-modules/python-gvm/default.nix
+++ b/pkgs/development/python-modules/python-gvm/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "python-gvm";
-  version = "24.7.0";
+  version = "24.8.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "greenbone";
     repo = "python-gvm";
     rev = "refs/tags/v${version}";
-    hash = "sha256-WsZxISvPw4uvRKv5CYpcLunAxvoCvVWTSp+m2QTEe0g=";
+    hash = "sha256-JyImC75Le6S2kQXSU/Ze4TNaitJSJ8LD9j/ny+xjoGA=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/safety/default.nix b/pkgs/development/python-modules/safety/default.nix
index db1e2ed0d590..8bef717dabf5 100644
--- a/pkgs/development/python-modules/safety/default.nix
+++ b/pkgs/development/python-modules/safety/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "safety";
-  version = "3.2.6";
+  version = "3.2.7";
 
   disabled = pythonOlder "3.7";
 
@@ -36,7 +36,7 @@ buildPythonPackage rec {
     owner = "pyupio";
     repo = "safety";
     rev = "refs/tags/${version}";
-    hash = "sha256-pC9ruEGT3v5C5EpxIN+uZX+6sVYG4+MpXU0gt9yb+IE=";
+    hash = "sha256-JWbiw9qgfDo0UMAcqIhk1Y5tW0aSaZtbVdpdaY2z+3w=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/snuggs/default.nix b/pkgs/development/python-modules/snuggs/default.nix
index 914166113170..b742c8d6985a 100644
--- a/pkgs/development/python-modules/snuggs/default.nix
+++ b/pkgs/development/python-modules/snuggs/default.nix
@@ -47,6 +47,6 @@ buildPythonPackage rec {
     description = "S-expressions for Numpy";
     license = licenses.mit;
     homepage = "https://github.com/mapbox/snuggs";
-    maintainers = with maintainers; [ mredaelli ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/sqlmap/default.nix b/pkgs/development/python-modules/sqlmap/default.nix
index 239ac5a0149a..2a1a3f42593a 100644
--- a/pkgs/development/python-modules/sqlmap/default.nix
+++ b/pkgs/development/python-modules/sqlmap/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "sqlmap";
-  version = "1.8.7.post1";
+  version = "1.8.8";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-rycF/D6knpOHlmTZBVysq9DMqCadwv1eq8vkuhpZ2hQ=";
+    hash = "sha256-TtJF6IHQdpx9OZ6wACmON1HQXhvvi67QZU/gI+zsy2Q=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/std-uritemplate/default.nix b/pkgs/development/python-modules/std-uritemplate/default.nix
index 12e58966b017..b6c195ebf9d4 100644
--- a/pkgs/development/python-modules/std-uritemplate/default.nix
+++ b/pkgs/development/python-modules/std-uritemplate/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "std-uritemplate";
-  version = "1.0.5";
+  version = "1.0.6";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "std_uritemplate";
     inherit version;
-    hash = "sha256-bqMecvlqsrVNk8d03iF1zlNQqDP798AkuzcYo6U59gU=";
+    hash = "sha256-m+1iEgSp27R/ieqVjJfEY9FfKLzLyAGquMmw11cZ7GI=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/stravalib/default.nix b/pkgs/development/python-modules/stravalib/default.nix
index 935f40d00004..f35593ecd95b 100644
--- a/pkgs/development/python-modules/stravalib/default.nix
+++ b/pkgs/development/python-modules/stravalib/default.nix
@@ -15,24 +15,24 @@
 
 buildPythonPackage rec {
   pname = "stravalib";
-  version = "1.6";
+  version = "2.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
+  disabled = pythonOlder "3.10";
 
   src = fetchFromGitHub {
     owner = "stravalib";
     repo = "stravalib";
     rev = "refs/tags/v${version}";
-    hash = "sha256-U+QlSrijvT77/m+yjhFxbcVTQe51J+PR4Kc8N+qG+wI=";
+    hash = "sha256-uF29fK+ZSSO688zKYYiSEygBUJZ6NBcvdgGgz3I1I6Q=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
     setuptools-scm
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     arrow
     pint
     pydantic
@@ -52,6 +52,5 @@ buildPythonPackage rec {
     changelog = "https://github.com/stravalib/stravalib/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ sikmir ];
-    broken = lib.versionAtLeast pydantic.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/suds-community/default.nix b/pkgs/development/python-modules/suds-community/default.nix
new file mode 100644
index 000000000000..e3a9d8a12987
--- /dev/null
+++ b/pkgs/development/python-modules/suds-community/default.nix
@@ -0,0 +1,14 @@
+{
+  mkPythonMetaPackage,
+  suds,
+}:
+
+mkPythonMetaPackage {
+  pname = "suds-community";
+  inherit (suds) version;
+  dependencies = [ suds ];
+  optional-dependencies = suds.optional-dependencies or { };
+  meta = {
+    inherit (suds.meta) changelog description homepage;
+  };
+}
diff --git a/pkgs/development/python-modules/suds/default.nix b/pkgs/development/python-modules/suds/default.nix
index 054f0b0cb434..35dc2eeaa5bc 100644
--- a/pkgs/development/python-modules/suds/default.nix
+++ b/pkgs/development/python-modules/suds/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   pytestCheckHook,
   setuptools,
   six,
@@ -9,16 +9,20 @@
 
 buildPythonPackage rec {
   pname = "suds";
-  version = "1.1.2";
+  version = "1.2.0";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-HVz6dBFxk7JEpCM/JGxIPZ9BGYtEjF8UqLrRHE9knys=";
+  src = fetchFromGitHub {
+    owner = "suds-community";
+    repo = "suds";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-YdL+zDelRspQ6VMqa45vK1DDS3HjFvKE1P02USVBrEo=";
   };
 
   build-system = [ setuptools ];
 
+  env.SUDS_PACKAGE = "suds";
+
   nativeCheckInputs = [
     pytestCheckHook
     six
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 2cc852ee4010..aa55057c63ea 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1221";
+  version = "3.0.1222";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-wrz0Q/sNy6FBEcIu/eD7yV2HGOgV9sdzw+Q2Pxkh9eI=";
+    hash = "sha256-984uvizJ6gz4+y2fABp3IUBrJw/Z9HMbLo7zOfuf1Ik=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/xiaomi-ble/default.nix b/pkgs/development/python-modules/xiaomi-ble/default.nix
index 3268f737c602..542096715a88 100644
--- a/pkgs/development/python-modules/xiaomi-ble/default.nix
+++ b/pkgs/development/python-modules/xiaomi-ble/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "xiaomi-ble";
-  version = "0.31.0";
+  version = "0.31.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = "xiaomi-ble";
     rev = "refs/tags/v${version}";
-    hash = "sha256-JmJfLRszP0uKsQ6HjTUbh9YeEGa06qBuJwbmu1lzZCw=";
+    hash = "sha256-ggI0beyE3gfgs5hyh7Rn9YDDkIvqqd0hA/XCy55/r2E=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index 06a08979f493..05aa7f736bd3 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.2.238";
+  version = "3.2.239";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     rev = "refs/tags/${version}";
-    hash = "sha256-L5HGX7cT5pxd4dFjrppSg70XyqCDg1EXodsBRWFZ9o8=";
+    hash = "sha256-Y746ZwkLS6S682mnMSq30tQgFiZJduEkh3ZeOTf8V1E=";
   };
 
   patches = [ ./flake8-compat-5.x.patch ];
diff --git a/pkgs/development/tools/check-jsonschema/default.nix b/pkgs/development/tools/check-jsonschema/default.nix
index fa2d4920a26b..25125b41b6b5 100644
--- a/pkgs/development/tools/check-jsonschema/default.nix
+++ b/pkgs/development/tools/check-jsonschema/default.nix
@@ -4,7 +4,7 @@ with python3.pkgs;
 
 buildPythonApplication rec {
   pname = "check-jsonschema";
-  version = "0.28.5";
+  version = "0.29.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -13,7 +13,7 @@ buildPythonApplication rec {
     owner = "python-jsonschema";
     repo = "check-jsonschema";
     rev = "refs/tags/${version}";
-    hash = "sha256-O2w9P/5og0cI7Ol+d5YVwLuvCjiskrRLL3V/jsYB4k4=";
+    hash = "sha256-Z/v/a0zENH8K1NHCZViLBbc8gma5rTMBm8hatHhu878=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/gauge/plugins/default.nix b/pkgs/development/tools/gauge/plugins/default.nix
index 92ee2fca77d0..b68d48ba4767 100644
--- a/pkgs/development/tools/gauge/plugins/default.nix
+++ b/pkgs/development/tools/gauge/plugins/default.nix
@@ -3,6 +3,7 @@ lib.makeScope pkgs.newScope (final: let
   inherit (final) callPackage;
 in {
   makeGaugePlugin = callPackage ./make-gauge-plugin.nix { };
+  testGaugePlugins = callPackage ./test-gauge-plugins.nix { };
   dotnet = callPackage ./dotnet { };
   html-report = callPackage ./html-report { };
   java = callPackage ./java { };
diff --git a/pkgs/development/tools/gauge/plugins/java/data.json b/pkgs/development/tools/gauge/plugins/java/data.json
index 96c993e6f306..f5a9e09edfdc 100644
--- a/pkgs/development/tools/gauge/plugins/java/data.json
+++ b/pkgs/development/tools/gauge/plugins/java/data.json
@@ -1,19 +1,19 @@
 {
-  "version": "0.10.3",
+  "version": "0.11.0",
   "aarch64-darwin": {
-    "url": "https://github.com/getgauge/gauge-java/releases/download/v0.10.3/gauge-java-0.10.3-darwin.arm64.zip",
-    "hash": "sha256-Hs9ZNupj0s7YRjRZibphr7m5YjOj3MTgx/hqAbWyY6I="
+    "url": "https://github.com/getgauge/gauge-java/releases/download/v0.11.0/gauge-java-0.11.0-darwin.arm64.zip",
+    "hash": "sha256-o7viYih6oghPipGmpsdGZXxtML4++Ux7Qul8pRzkdUc="
   },
   "x86_64-darwin": {
-    "url": "https://github.com/getgauge/gauge-java/releases/download/v0.10.3/gauge-java-0.10.3-darwin.x86_64.zip",
-    "hash": "sha256-Hj/Lkwsx/RvyMiJO8dI6vFpIvvyhOA2Un5deC1syYY4="
+    "url": "https://github.com/getgauge/gauge-java/releases/download/v0.11.0/gauge-java-0.11.0-darwin.x86_64.zip",
+    "hash": "sha256-wTXVuyXU9mfVxAc/l0mgvKt3c/jinffILBUhe/tikgs="
   },
   "aarch64-linux": {
-    "url": "https://github.com/getgauge/gauge-java/releases/download/v0.10.3/gauge-java-0.10.3-linux.arm64.zip",
-    "hash": "sha256-XJqP2eew+aI1jFaDzsJhfML8Ft+adFJrHURF8F391Pc="
+    "url": "https://github.com/getgauge/gauge-java/releases/download/v0.11.0/gauge-java-0.11.0-linux.arm64.zip",
+    "hash": "sha256-CsEzoNseWllbNtN5mOYVCPvTPlm60fd7eSXuTpxbRx8="
   },
   "x86_64-linux": {
-    "url": "https://github.com/getgauge/gauge-java/releases/download/v0.10.3/gauge-java-0.10.3-linux.x86_64.zip",
-    "hash": "sha256-sMyWhAGo6oa7MsqK8xApdrwhZo8NkSTIRbsCu5LW3ls="
+    "url": "https://github.com/getgauge/gauge-java/releases/download/v0.11.0/gauge-java-0.11.0-linux.x86_64.zip",
+    "hash": "sha256-zig+Wq6uyBl8fKfjcpKCRFtHBZ/xFeDaUrUqvx1ails="
   }
 }
diff --git a/pkgs/development/tools/gauge/plugins/make-gauge-plugin.nix b/pkgs/development/tools/gauge/plugins/make-gauge-plugin.nix
index 81fbff823802..acf902e1b79d 100644
--- a/pkgs/development/tools/gauge/plugins/make-gauge-plugin.nix
+++ b/pkgs/development/tools/gauge/plugins/make-gauge-plugin.nix
@@ -3,6 +3,7 @@
 , lib
 , writeScript
 , autoPatchelfHook
+, testGaugePlugins
 }:
 
 { pname
@@ -34,64 +35,67 @@ stdenvNoCC.mkDerivation (finalAttrs: (lib.recursiveUpdate {
     stripRoot = false;
   };
 
-  nativeBuildInputs = [ autoPatchelfHook ];
+  nativeBuildInputs = lib.optional stdenvNoCC.hostPlatform.isLinux autoPatchelfHook;
 
   installPhase = ''
     mkdir -p "$out/share/gauge-plugins/${pname}/${finalAttrs.version}"
     cp -r . "$out/share/gauge-plugins/${pname}/${finalAttrs.version}"
   '';
 
-  passthru.updateScript = writeScript "update-${finalAttrs.pname}" ''
-    #!/usr/bin/env nix-shell
-    #!nix-shell -i bash -p curl nix-prefetch yq-go
+  passthru = {
+    tests.loadPlugin = testGaugePlugins { plugins = [ finalAttrs.finalPackage ]; };
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p curl nix-prefetch yq-go
 
-    set -e
+      set -e
 
-    dirname="pkgs/development/tools/gauge/plugins/${pname}"
+      dirname="pkgs/development/tools/gauge/plugins/${pname}"
 
-    currentVersion=$(nix eval --raw -f default.nix gaugePlugins.${pname}.version)
+      currentVersion=$(nix eval --raw -f default.nix gaugePlugins.${pname}.version)
 
-    latestTag=$(curl -s ''${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} https://api.github.com/repos/${repo}/releases/latest | yq ".tag_name")
-    latestVersion="$(expr $latestTag : 'v\(.*\)')"
+      latestTag=$(curl -s ''${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} https://api.github.com/repos/${repo}/releases/latest | yq ".tag_name")
+      latestVersion="$(expr $latestTag : 'v\(.*\)')"
 
-    tempfile=$(mktemp)
+      tempfile=$(mktemp)
 
-    if [[ "$FORCE_UPDATE" != "true" && "$currentVersion" == "$latestVersion" ]]; then
-        echo "gauge-${pname} is up-to-date: ''${currentVersion}"
-        exit 0
-    fi
+      if [[ "$FORCE_UPDATE" != "true" && "$currentVersion" == "$latestVersion" ]]; then
+          echo "gauge-${pname} is up-to-date: ''${currentVersion}"
+          exit 0
+      fi
 
-    yq -iPoj "{ \"version\": \"$latestVersion\" }" "$tempfile"
+      yq -iPoj "{ \"version\": \"$latestVersion\" }" "$tempfile"
 
-    updateSystem() {
-        system=$1
-        url=$2
+      updateSystem() {
+          system=$1
+          url=$2
 
-        echo "Fetching hash for $system"
-        hash=$(nix-prefetch-url --type sha256 $url --unpack)
-        sriHash="$(nix hash to-sri --type sha256 $hash)"
+          echo "Fetching hash for $system"
+          hash=$(nix-prefetch-url --type sha256 $url --unpack)
+          sriHash="$(nix hash to-sri --type sha256 $hash)"
 
-        yq -iPoj '. + { "$system": { "url": "$url", "hash": "$sriHash" } }' "$tempfile"
-    }
+          yq -iPoj ". + { \"$system\": { \"url\": \"$url\", \"hash\": \"$sriHash\" } }" "$tempfile"
+      }
 
-    updateSingle() {
-        url=$1
+      updateSingle() {
+          url=$1
 
-        echo "Fetching hash"
-        hash=$(nix-prefetch-url --type sha256 $url --unpack)
-        sriHash="$(nix hash to-sri --type sha256 $hash)"
+          echo "Fetching hash"
+          hash=$(nix-prefetch-url --type sha256 $url --unpack)
+          sriHash="$(nix hash to-sri --type sha256 $hash)"
 
-        yq -iPoj '. + { "url": "$url", "hash": "$sriHash" }' "$tempfile"
-    }
+          yq -iPoj ". + { \"url\": \"$url\", \"hash\": \"$sriHash\" }" "$tempfile"
+      }
 
-    baseUrl="https://github.com/${repo}/releases/download/$latestTag/${releasePrefix}$latestVersion"
+      baseUrl="https://github.com/${repo}/releases/download/$latestTag/${releasePrefix}$latestVersion"
 
-    ${if isCrossArch then
-        "updateSingle \${baseUrl}.zip"
-      else
-        lib.concatStringsSep "\n" (map (platform: ''updateSystem "${platform}" "''${baseUrl}-${systemMap.${platform}}.zip"'') meta.platforms)
-    }
+      ${if isCrossArch then
+          "updateSingle \${baseUrl}.zip"
+        else
+          lib.concatStringsSep "\n" (map (platform: ''updateSystem "${platform}" "''${baseUrl}-${systemMap.${platform}}.zip"'') meta.platforms)
+      }
 
-    mv "$tempfile" "$dirname/data.json"
-  '';
+      mv "$tempfile" "$dirname/data.json"
+    '';
+  };
 } otherArgs))
diff --git a/pkgs/development/tools/gauge/plugins/ruby/data.json b/pkgs/development/tools/gauge/plugins/ruby/data.json
index b7f827cfc569..95316f6b7ca0 100644
--- a/pkgs/development/tools/gauge/plugins/ruby/data.json
+++ b/pkgs/development/tools/gauge/plugins/ruby/data.json
@@ -1,19 +1,19 @@
 {
-  "version": "0.8.0",
+  "version": "0.9.2",
   "aarch64-darwin": {
-    "url": "https://github.com/getgauge/gauge-ruby/releases/download/v0.8.0/gauge-ruby-0.8.0-darwin.arm64.zip",
-    "hash": "sha256-HQ7reuC7dQUMbhEzUBiEelPmFBsFJBHe42lmFufkZJY="
+    "url": "https://github.com/getgauge/gauge-ruby/releases/download/v0.9.2/gauge-ruby-0.9.2-darwin.arm64.zip",
+    "hash": "sha256-QPwqgQ+Qd+eHbw445GstcPqEODoKcvvt+YJxsJqxtPc="
   },
   "x86_64-darwin": {
-    "url": "https://github.com/getgauge/gauge-ruby/releases/download/v0.8.0/gauge-ruby-0.8.0-darwin.x86_64.zip",
-    "hash": "sha256-poxT9wYgs21GRx/eVvD7jA1T0VBDEHgH0Zv941pZcKA="
+    "url": "https://github.com/getgauge/gauge-ruby/releases/download/v0.9.2/gauge-ruby-0.9.2-darwin.x86_64.zip",
+    "hash": "sha256-AWe5S8QXkps6eV1+1GZbHY/S+kY/QQoiG/gbddZHZdk="
   },
   "aarch64-linux": {
-    "url": "https://github.com/getgauge/gauge-ruby/releases/download/v0.8.0/gauge-ruby-0.8.0-linux.arm64.zip",
-    "hash": "sha256-SAEHPaWScux6C05jQBfDuLBN2J22Df9eKVM46kWawiU="
+    "url": "https://github.com/getgauge/gauge-ruby/releases/download/v0.9.2/gauge-ruby-0.9.2-linux.arm64.zip",
+    "hash": "sha256-7d6FETLrd7OePiWWRu+5OMKKH9t9H+ZnQCqqYTsuRrk="
   },
   "x86_64-linux": {
-    "url": "https://github.com/getgauge/gauge-ruby/releases/download/v0.8.0/gauge-ruby-0.8.0-linux.x86_64.zip",
-    "hash": "sha256-aXLDK/7phdsX0CmIuxfK39mdrjGo2IpwYBL7uolP5Mk="
+    "url": "https://github.com/getgauge/gauge-ruby/releases/download/v0.9.2/gauge-ruby-0.9.2-linux.x86_64.zip",
+    "hash": "sha256-iPHQ5Tx3iCb/e3RoF5P2grCbNBFuagezQrABK7snFvw="
   }
 }
diff --git a/pkgs/development/tools/gauge/plugins/screenshot/data.json b/pkgs/development/tools/gauge/plugins/screenshot/data.json
index c836d5a84a95..bc2c83ad6425 100644
--- a/pkgs/development/tools/gauge/plugins/screenshot/data.json
+++ b/pkgs/development/tools/gauge/plugins/screenshot/data.json
@@ -1,19 +1,19 @@
 {
-  "version": "0.2.0",
+  "version": "0.3.0",
   "x86_64-darwin": {
-    "url": "https://github.com/getgauge/gauge_screenshot/releases/download/v0.2.0/screenshot-0.2.0-darwin.x86_64.zip",
-    "hash": "sha256-7bFuInEYAQ+fN12HTazQNfqpz5DAkYNCjUJbaj0DYb4="
+    "url": "https://github.com/getgauge/gauge_screenshot/releases/download/v0.3.0/screenshot-0.3.0-darwin.x86_64.zip",
+    "hash": "sha256-2PL0WrIpfDCK5+aKH1rtNVBTiIPYHU4f81UZpv9M2sQ="
   },
   "aarch64-darwin": {
-    "url": "https://github.com/getgauge/gauge_screenshot/releases/download/v0.2.0/screenshot-0.2.0-darwin.arm64.zip",
-    "hash": "sha256-Ly6iHBc2PfeFkKkZIkyD2JD5+EpFNL4SDjzG1oMpKfA="
+    "url": "https://github.com/getgauge/gauge_screenshot/releases/download/v0.3.0/screenshot-0.3.0-darwin.arm64.zip",
+    "hash": "sha256-QfpylVGxE/qKiN57ni4aJsh8Dfg/VIN9vfd1nHX2QO0="
   },
   "aarch64-linux": {
-    "url": "https://github.com/getgauge/gauge_screenshot/releases/download/v0.2.0/screenshot-0.2.0-linux.arm64.zip",
-    "hash": "sha256-Pzfnhs4H0MmeBIhrZElFmvC+PuabLNU/pftVdIu4+LI="
+    "url": "https://github.com/getgauge/gauge_screenshot/releases/download/v0.3.0/screenshot-0.3.0-linux.arm64.zip",
+    "hash": "sha256-HfO2KjK1xSp6xw9F38JjkrUs7JfxkrdltRr6j5/5Cw8="
   },
   "x86_64-linux": {
-    "url": "https://github.com/getgauge/gauge_screenshot/releases/download/v0.2.0/screenshot-0.2.0-linux.x86_64.zip",
-    "hash": "sha256-Wpuq3aSgbIhd4WuJx4SMv+NbEZMVIpAOUMdKV2xxd7c="
+    "url": "https://github.com/getgauge/gauge_screenshot/releases/download/v0.3.0/screenshot-0.3.0-linux.x86_64.zip",
+    "hash": "sha256-2EEUI2jBmEC2JfeJizFqNzINZtYy/y1c+B70hE1hCQk="
   }
 }
diff --git a/pkgs/development/tools/gauge/plugins/test-gauge-plugins.nix b/pkgs/development/tools/gauge/plugins/test-gauge-plugins.nix
new file mode 100644
index 000000000000..3648e87f7b91
--- /dev/null
+++ b/pkgs/development/tools/gauge/plugins/test-gauge-plugins.nix
@@ -0,0 +1,35 @@
+{
+  runCommand,
+  gauge,
+  lib,
+}:
+
+/**
+  Creates a gauge install with all given plugins and makes sure every plugin is loaded.
+*/
+{ plugins }:
+
+let
+  gaugeWithPlugins = gauge.withPlugins (_: plugins);
+in
+
+runCommand "gauge-test" { nativeBuildInputs = [ gaugeWithPlugins ]; } ''
+  mkdir $out
+  echo $(gauge install || true) > $out/output.txt
+
+  function checkPlugin() {
+    plugin="$1"
+    version="$2"
+
+    echo Checking for plugin $plugin version $version
+    if ! grep "$plugin ($version)" $out/output.txt
+    then
+      echo "Couldn't find plugin $plugin version $version"
+      exit 1
+    fi
+  }
+
+  ${lib.concatMapStringsSep "\n" (
+    p: "checkPlugin '${lib.removePrefix "gauge-plugin-" p.pname}' '${p.version}'"
+  ) plugins}
+''
diff --git a/pkgs/development/tools/gauge/wrapper.nix b/pkgs/development/tools/gauge/wrapper.nix
index 67b1a8ddc52b..8f4ceca25e9e 100644
--- a/pkgs/development/tools/gauge/wrapper.nix
+++ b/pkgs/development/tools/gauge/wrapper.nix
@@ -6,6 +6,7 @@
 , xorg
 , gaugePlugins
 , plugins ? []
+, runCommand
 }:
 
 stdenvNoCC.mkDerivation {
@@ -53,6 +54,8 @@ stdenvNoCC.mkDerivation {
         requiredPlugins = with manifest; [ Language ] ++ Plugins;
         manifestPlugins = plugins: map (name: plugins.${name} or (throw "Gauge plugin ${name} is not available!")) requiredPlugins;
       in gauge.withPlugins manifestPlugins;
+    # Builds gauge with all plugins and checks for successful installation
+    tests.allPlugins = gaugePlugins.testGaugePlugins { plugins = lib.filter lib.isDerivation (lib.attrValues gaugePlugins); };
   };
 
   inherit (gauge-unwrapped) meta;
diff --git a/pkgs/development/tools/hcloud/default.nix b/pkgs/development/tools/hcloud/default.nix
index 66dfe5e70e83..d2d74ab52edf 100644
--- a/pkgs/development/tools/hcloud/default.nix
+++ b/pkgs/development/tools/hcloud/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "hcloud";
-  version = "1.46.0";
+  version = "1.47.0";
 
   src = fetchFromGitHub {
     owner = "hetznercloud";
     repo = "cli";
     rev = "refs/tags/v${version}";
-    hash = "sha256-xW0M4ppbW6yD5+JpJZnDVf2mPiBzNFotP1IPTbnJoC4=";
+    hash = "sha256-bIrkX/udxkHA+DWQ1t7QkHOmEhqacdtVR9wBWaS820M=";
   };
 
-  vendorHash = "sha256-XocfpUmq/w/gqhCaT4Y33uQaggx3Bm16QuG/bGdxmg4=";
+  vendorHash = "sha256-fNcyIP6q54A+TlsN0xliQGONx7H20KNY+d0NxOUSxQc=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/development/tools/language-servers/neocmakelsp/default.nix b/pkgs/development/tools/language-servers/neocmakelsp/default.nix
index f58a1595f4a5..42968130d1a4 100644
--- a/pkgs/development/tools/language-servers/neocmakelsp/default.nix
+++ b/pkgs/development/tools/language-servers/neocmakelsp/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "neocmakelsp";
-  version = "0.8.1";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "Decodetalkers";
     repo = "neocmakelsp";
     rev = "v${version}";
-    hash = "sha256-SDSqYfnHI6nFJrLUDApYR1nfGdcPdPihrb54gNIRkLU=";
+    hash = "sha256-t9cFECz4olFQ3VOuZzqHRMuvC8df1qaF7etb9ThJiok=";
   };
 
-  cargoHash = "sha256-Rlu2m+pbaU+EunQ7pthYPSRZo1yVF/+L114WxCv3l9c=";
+  cargoHash = "sha256-m+eO2y6TNRYc9Nau5ma9qcZcj7xUdxjo34eBmuXANkU=";
 
   meta = with lib; {
     description = "CMake lsp based on tower-lsp and treesitter";
diff --git a/pkgs/development/tools/misc/kool/default.nix b/pkgs/development/tools/misc/kool/default.nix
index dd5a79f17ee4..7c96ee3ee242 100644
--- a/pkgs/development/tools/misc/kool/default.nix
+++ b/pkgs/development/tools/misc/kool/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "kool";
-  version = "3.2.0";
+  version = "3.3.0";
 
   src = fetchFromGitHub {
     owner = "kool-dev";
     repo = "kool";
     rev = version;
-    hash = "sha256-oMPzDU5MNIgxg7E2lgvgXEfO4W+VrFlLThOC9OEqhWo=";
+    hash = "sha256-AbE0MT55LQgDY/WZRs+kCfreLYtSyzmXkYIQmJC4Hbo=";
   };
 
-  vendorHash = "sha256-PmS96KVhe9TDmtYBx2hROLCbGMQ0OY3MN405dUmxPzk=";
+  vendorHash = "sha256-wzTsd2ITwnPFc85bXoZLLb9wKvHYOgnb1FGiFXLkkiE=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/development/tools/nest-cli/default.nix b/pkgs/development/tools/nest-cli/default.nix
index 2e036238cc65..9c5f8a12df5b 100644
--- a/pkgs/development/tools/nest-cli/default.nix
+++ b/pkgs/development/tools/nest-cli/default.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "nest-cli";
-  version = "10.4.4";
+  version = "10.4.5";
 
   src = fetchFromGitHub {
     owner = "nestjs";
     repo = pname;
     rev = version;
-    hash = "sha256-m08QZBBIWl/JB3Z7aOiNE4kagL0wFn4JJhCFCtjkpdo=";
+    hash = "sha256-F/Oi7ra+UE4YKXHZalH5qFk4coaGfHRpWaxamYunRuw=";
   };
 
-  npmDepsHash = "sha256-PbUleMm6J/5R64ZceZ5G4CsU+P3etdlV7rdT5VvUSFQ=";
+  npmDepsHash = "sha256-6yh8TKfq3fuq4QcnA4uM49/G0Kp1sccRyTcV5s9dVck=";
 
   env = {
     npm_config_build_from_source = true;
diff --git a/pkgs/development/tools/pscale/default.nix b/pkgs/development/tools/pscale/default.nix
index 3a4ed97102d5..4075b1ad9d3c 100644
--- a/pkgs/development/tools/pscale/default.nix
+++ b/pkgs/development/tools/pscale/default.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "pscale";
-  version = "0.207.0";
+  version = "0.208.0";
 
   src = fetchFromGitHub {
     owner = "planetscale";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-T01Vo8W21Gu2e7W87LFM/7NGsqHgWt+L4mXmPAEyB70=";
+    sha256 = "sha256-q7rVTazlUmCOCv6W92uAg9/Jgkdxnl2eSxU3NSBsFZQ=";
   };
 
   vendorHash = "sha256-5Uul5c8Lwu6SJ7DlLU8+k2Pxa3V/DhqdvK5xY2g6S40=";
@@ -35,6 +35,8 @@ buildGoModule rec {
       --zsh <($out/bin/pscale completion zsh)
   '';
 
+  __darwinAllowLocalNetworking = true;
+
   passthru.tests.version = testers.testVersion {
     package = pscale;
   };
diff --git a/pkgs/development/tools/rust/cargo-clone/default.nix b/pkgs/development/tools/rust/cargo-clone/default.nix
index e937f7185a5f..c5e065eb2eaa 100644
--- a/pkgs/development/tools/rust/cargo-clone/default.nix
+++ b/pkgs/development/tools/rust/cargo-clone/default.nix
@@ -39,6 +39,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/janlikar/cargo-clone";
     changelog = "https://github.com/janlikar/cargo-clone/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ asl20 mit ];
-    maintainers = with maintainers; [ figsoda matthiasbeyer ];
+    maintainers = with maintainers; [ figsoda matthiasbeyer janlikar ];
   };
 }
diff --git a/pkgs/development/tools/rust/cargo-mobile2/default.nix b/pkgs/development/tools/rust/cargo-mobile2/default.nix
index adcd4f54d267..b8180bb4348e 100644
--- a/pkgs/development/tools/rust/cargo-mobile2/default.nix
+++ b/pkgs/development/tools/rust/cargo-mobile2/default.nix
@@ -12,7 +12,7 @@
 let
   inherit (darwin.apple_sdk.frameworks) CoreServices;
   pname = "cargo-mobile2";
-  version = "0.14.0";
+  version = "0.15.1";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -20,14 +20,14 @@ rustPlatform.buildRustPackage {
     owner = "tauri-apps";
     repo = pname;
     rev = "cargo-mobile2-v${version}";
-    hash = "sha256-niUovhdM3eXDKiQTISttxCJ+vcPxqTOdkcHR0oP0A2w=";
+    hash = "sha256-kWoVjEZsHvuVfsl/SsVm/XJ4Y/U/gjcprY4xISE5xs8=";
   };
 
   # Manually specify the sourceRoot since this crate depends on other crates in the workspace. Relevant info at
   # https://discourse.nixos.org/t/difficulty-using-buildrustpackage-with-a-src-containing-multiple-cargo-workspaces/10202
   # sourceRoot = "${src.name}/tooling/cli";
 
-  cargoHash = "sha256-oIPMBy6oG4PYxi7iSDNelsFK8ChGfyYNpA5p3GgaD9w=";
+  cargoHash = "sha256-zfu5cRTJY5yZOOa41PribmcbEVcxbRJfosj4+tU/OsU=";
 
   preBuild = ''
     mkdir -p $out/share/
diff --git a/pkgs/development/tools/rust/rust-analyzer/default.nix b/pkgs/development/tools/rust/rust-analyzer/default.nix
index 783554ec89cf..122e5d747787 100644
--- a/pkgs/development/tools/rust/rust-analyzer/default.nix
+++ b/pkgs/development/tools/rust/rust-analyzer/default.nix
@@ -13,14 +13,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rust-analyzer-unwrapped";
-  version = "2024-08-19";
-  cargoHash = "sha256-+zwjyTzcfUu5V6+j9r+tu7pcf40OzQ4mlE8VlZielVI=";
+  version = "2024-08-27";
+  cargoHash = "sha256-zYKBNByyHjLbShhmoVTvqWe30EKVf3XBKzktZzGjifo=";
 
   src = fetchFromGitHub {
     owner = "rust-lang";
     repo = "rust-analyzer";
     rev = version;
-    hash = "sha256-x/RXN/ougJ1IEoBKrY0UijB530OfOfICK4KPa3Kj9Bk=";
+    hash = "sha256-tRaJTAfFpV2y+kqf8ZzX74waPpkZ0r2EB4WIKLQAsrw=";
   };
 
   cargoBuildFlags = [ "--bin" "rust-analyzer" "--bin" "rust-analyzer-proc-macro-srv" ];
diff --git a/pkgs/development/tools/taplo/default.nix b/pkgs/development/tools/taplo/default.nix
index 6041f913b48b..77774a0d9a72 100644
--- a/pkgs/development/tools/taplo/default.nix
+++ b/pkgs/development/tools/taplo/default.nix
@@ -4,21 +4,21 @@
 , pkg-config
 , openssl
 , stdenv
-, Security
+, darwin
 , withLsp ? true
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "taplo";
-  version = "0.9.0";
+  version = "0.9.3";
 
   src = fetchCrate {
     inherit version;
     pname = "taplo-cli";
-    hash = "sha256-vvb00a6rppx9kKx+pzObT/hW/IsG6RyYFEDp9M5gvqc=";
+    hash = "sha256-dNGQbaIfFmgXh2AOcaE74BTz7/jaiBgU7Y1pkg1rV7U=";
   };
 
-  cargoHash = "sha256-oT7U9htu7J22MqLZb+YXohlB1CVGxHGQvHJu18PeLf8=";
+  cargoHash = "sha256-iucjewjRCunKxKCqeZwf7bdEo7+aN9hfWPwUAJhaSq0=";
 
   nativeBuildInputs = [
     pkg-config
@@ -27,7 +27,8 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [
     openssl
   ] ++ lib.optionals stdenv.isDarwin [
-    Security
+    darwin.apple_sdk.frameworks.Security
+    darwin.apple_sdk.frameworks.SystemConfiguration
   ];
 
   buildFeatures = lib.optional withLsp "lsp";
diff --git a/pkgs/development/tools/wasm-bindgen-cli/default.nix b/pkgs/development/tools/wasm-bindgen-cli/default.nix
index 6fce69be410a..3b0a6c1b53eb 100644
--- a/pkgs/development/tools/wasm-bindgen-cli/default.nix
+++ b/pkgs/development/tools/wasm-bindgen-cli/default.nix
@@ -8,9 +8,9 @@
 , stdenv
 , curl
 , Security
-, version ? "0.2.92"
-, hash ? "sha256-1VwY8vQy7soKEgbki4LD+v259751kKxSxmo/gqE6yV0="
-, cargoHash ? "sha256-aACJ+lYNEU8FFBs158G1/JG8sc6Rq080PeKCMnwdpH0="
+, version ? "0.2.93"
+, hash ? "sha256-DDdu5mM3gneraM85pAepBXWn3TMofarVR4NbjMdz3r0="
+, cargoHash ? "sha256-birrg+XABBHHKJxfTKAMSlmTVYLmnmqMDfRnmG6g/YQ="
 }:
 
 rustPlatform.buildRustPackage rec {
diff --git a/pkgs/kde/gear/konsole/default.nix b/pkgs/kde/gear/konsole/default.nix
index 8cd29b8a4f91..65a94bb19096 100644
--- a/pkgs/kde/gear/konsole/default.nix
+++ b/pkgs/kde/gear/konsole/default.nix
@@ -7,4 +7,6 @@ mkKdeDerivation {
   pname = "konsole";
 
   extraBuildInputs = [qt5compat qtmultimedia];
+
+  meta.mainProgram = "konsole";
 }
diff --git a/pkgs/misc/drivers/sc-controller/default.nix b/pkgs/misc/drivers/sc-controller/default.nix
index 2215c5d1d29e..e58e71a93f55 100644
--- a/pkgs/misc/drivers/sc-controller/default.nix
+++ b/pkgs/misc/drivers/sc-controller/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonApplication rec {
   pname = "sc-controller";
-  version = "0.4.8.17";
+  version = "0.4.8.18";
 
   src = fetchFromGitHub {
     owner  = "C0rn3j";
     repo   = pname;
-    rev    = "v${version}";
-    sha256 = "sha256-arBdPrFtdllWMn1KuZ+PlENiJ0oRPVbgVjbef+pv+IE=";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-xSxAzvyBXfU7IzTWOXPPDBX4bTvbZ7RHUTtz3zwi7a8=";
   };
 
   nativeBuildInputs = [ wrapGAppsHook3 gobject-introspection ];
diff --git a/pkgs/os-specific/linux/android-udev-rules/default.nix b/pkgs/os-specific/linux/android-udev-rules/default.nix
index 6c890b075f17..b0a4c378ecd6 100644
--- a/pkgs/os-specific/linux/android-udev-rules/default.nix
+++ b/pkgs/os-specific/linux/android-udev-rules/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "android-udev-rules";
-  version = "20240625";
+  version = "20240829";
 
   src = fetchFromGitHub {
     owner = "M0Rf30";
     repo = "android-udev-rules";
     rev = version;
-    hash = "sha256-SlUZElep8ZBkYl+5VPDESZ5sKwIQ+xa0+pB4WmJkNt8=";
+    hash = "sha256-QrWEvNcPKSEJghQc0tqb/L71IqeMUmuJLyA0NtzacyY=";
   };
 
   installPhase = ''
diff --git a/pkgs/os-specific/linux/compsize/default.nix b/pkgs/os-specific/linux/compsize/default.nix
index 441108b0e54f..a1175df20629 100644
--- a/pkgs/os-specific/linux/compsize/default.nix
+++ b/pkgs/os-specific/linux/compsize/default.nix
@@ -1,5 +1,17 @@
-{ lib, stdenv, fetchFromGitHub, btrfs-progs }:
+{ lib, stdenv, fetchFromGitHub, fetchurl, btrfs-progs }:
 
+let
+  # https://github.com/kilobyte/compsize/issues/52
+  btrfs-progs' = btrfs-progs.overrideAttrs (old: rec {
+    pname = "btrfs-progs";
+    version = "6.10";
+    src = fetchurl {
+      url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
+      hash = "sha256-M4KoTj/P4f/eoHphqz9OhmZdOPo18fNFSNXfhnQj4N8=";
+    };
+  });
+
+in
 stdenv.mkDerivation rec {
   pname = "compsize";
   version = "1.5";
@@ -11,7 +23,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-OX41ChtHX36lVRL7O2gH21Dfw6GPPEClD+yafR/PFm8=";
   };
 
-  buildInputs = [ btrfs-progs ];
+  buildInputs = [ btrfs-progs' ];
 
   installFlags = [
     "PREFIX=${placeholder "out"}"
diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index 74e603623412..a6067439a8f3 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -230,6 +230,7 @@ kernel.overrideAttrs (finalAttrs: previousAttrs: {
   passthru = previousAttrs.passthru or { } // basicArgs // {
     features = kernelFeatures;
     inherit commonStructuredConfig structuredExtraConfig extraMakeFlags isZen isHardened isLibre;
+    isVanilla = !(isHardened || isLibre || isZen);
     isXen = lib.warn "The isXen attribute is deprecated. All Nixpkgs kernels that support it now have Xen enabled." true;
 
     # Adds dependencies needed to edit the config:
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 6c9d2da1e9db..246ab4f2d728 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -5,16 +5,16 @@ let
   variants = {
     # ./update-zen.py zen
     zen = {
-      version = "6.10.5"; #zen
+      version = "6.10.7"; #zen
       suffix = "zen1"; #zen
-      sha256 = "08ibz7560xsmlnrm8j13hxf8hjjcxfmnjdrwffqc81g9g6rvpqra"; #zen
+      sha256 = "1km3b7nad429hw7d8ff14zj1cg0fhh65ycrrwk4iaxj6rvafzsz1"; #zen
       isLqx = false;
     };
     # ./update-zen.py lqx
     lqx = {
-      version = "6.10.5"; #lqx
+      version = "6.10.6"; #lqx
       suffix = "lqx1"; #lqx
-      sha256 = "09rscj20j94qkmvk0hlpjm6v1n1ndnkv2vl035gsp5lwggws2jqm"; #lqx
+      sha256 = "0b1pqsssnxc69yhx2wai5xnj6cb9713z33m8xal25jjgx9z4v8kv"; #lqx
       isLqx = true;
     };
   };
diff --git a/pkgs/os-specific/linux/zfs/2_1.nix b/pkgs/os-specific/linux/zfs/2_1.nix
index 97173a5154a5..d950f5cac15d 100644
--- a/pkgs/os-specific/linux/zfs/2_1.nix
+++ b/pkgs/os-specific/linux/zfs/2_1.nix
@@ -1,7 +1,6 @@
 { callPackage
 , kernel ? null
 , stdenv
-, linuxKernel
 , lib
 , nixosTests
 , ...
@@ -15,9 +14,7 @@ callPackage ./generic.nix args {
   # this attribute is the correct one for this package.
   kernelModuleAttribute = "zfs_2_1";
   # check the release notes for compatible kernels
-  kernelCompatible = kernel.kernelOlder "6.8";
-
-  latestCompatibleLinuxPackages = linuxKernel.packages.linux_6_6;
+  kernelCompatible = kernel: kernel.kernelOlder "6.8";
 
   # This is a fixed version to the 2.1.x series, move only
   # if the 2.1.x series moves.
diff --git a/pkgs/os-specific/linux/zfs/2_2.nix b/pkgs/os-specific/linux/zfs/2_2.nix
index 9e3fde0780f0..469b1cca0968 100644
--- a/pkgs/os-specific/linux/zfs/2_2.nix
+++ b/pkgs/os-specific/linux/zfs/2_2.nix
@@ -2,7 +2,6 @@
 , kernel ? null
 , stdenv
 , lib
-, linuxKernel
 , nixosTests
 , ...
 } @ args:
@@ -15,9 +14,7 @@ callPackage ./generic.nix args {
   # this attribute is the correct one for this package.
   kernelModuleAttribute = "zfs_2_2";
   # check the release notes for compatible kernels
-  kernelCompatible = kernel.kernelOlder "6.10";
-
-  latestCompatibleLinuxPackages = linuxKernel.packages.linux_6_6;
+  kernelCompatible = kernel: kernel.kernelOlder "6.10";
 
   # this package should point to the latest release.
   version = "2.2.5";
diff --git a/pkgs/os-specific/linux/zfs/generic.nix b/pkgs/os-specific/linux/zfs/generic.nix
index 3adcb97f6a69..b6e0a6d9882e 100644
--- a/pkgs/os-specific/linux/zfs/generic.nix
+++ b/pkgs/os-specific/linux/zfs/generic.nix
@@ -2,6 +2,7 @@ let
   genericBuild =
   { pkgs, lib, stdenv, fetchFromGitHub
   , autoreconfHook269, util-linux, nukeReferences, coreutils
+  , linuxKernel
   , perl
   , configFile ? "all"
 
@@ -27,8 +28,6 @@ let
   , kernelModuleAttribute
   , extraPatches ? []
   , rev ? "zfs-${version}"
-  , isUnstable ? false
-  , latestCompatibleLinuxPackages
   , kernelCompatible ? null
   , maintainers ? (with lib.maintainers; [ amarshall ])
   , tests
@@ -199,7 +198,13 @@ let
     outputs = [ "out" ] ++ optionals buildUser [ "dev" ];
 
     passthru = {
-      inherit enableMail latestCompatibleLinuxPackages kernelModuleAttribute;
+      inherit enableMail kernelModuleAttribute;
+      latestCompatibleLinuxPackages = lib.pipe linuxKernel.packages [
+        builtins.attrValues
+        (builtins.filter (kPkgs: (builtins.tryEval kPkgs).success && kPkgs ? kernel && kPkgs.kernel.passthru.isVanilla && kernelCompatible kPkgs.kernel))
+        (builtins.sort (a: b: (lib.versionOlder a.kernel.version b.kernel.version)))
+        lib.last
+      ];
       # The corresponding userspace tools to this instantiation
       # of the ZFS package set.
       userspaceTools = genericBuild (outerArgs // {
@@ -236,7 +241,7 @@ let
       mainProgram = "zfs";
       # If your Linux kernel version is not yet supported by zfs, try zfs_unstable.
       # On NixOS set the option `boot.zfs.package = pkgs.zfs_unstable`.
-      broken = buildKernel && (kernelCompatible != null) && !kernelCompatible;
+      broken = buildKernel && (kernelCompatible != null) && !(kernelCompatible kernel);
     };
   };
 in
diff --git a/pkgs/os-specific/linux/zfs/unstable.nix b/pkgs/os-specific/linux/zfs/unstable.nix
index 50e1cc1459e9..8ca88c71303c 100644
--- a/pkgs/os-specific/linux/zfs/unstable.nix
+++ b/pkgs/os-specific/linux/zfs/unstable.nix
@@ -1,7 +1,6 @@
 { callPackage
 , kernel ? null
 , stdenv
-, linuxKernel
 , nixosTests
 , fetchpatch
 , ...
@@ -15,9 +14,7 @@ callPackage ./generic.nix args {
   # this attribute is the correct one for this package.
   kernelModuleAttribute = "zfs_unstable";
   # check the release notes for compatible kernels
-  kernelCompatible = kernel.kernelOlder "6.11";
-
-  latestCompatibleLinuxPackages = linuxKernel.packages.linux_6_10;
+  kernelCompatible = kernel: kernel.kernelOlder "6.11";
 
   # this package should point to a version / git revision compatible with the latest kernel release
   # IMPORTANT: Always use a tagged release candidate or commits from the
@@ -26,7 +23,6 @@ callPackage ./generic.nix args {
   version = "2.2.5";
   # rev = "";
 
-  isUnstable = true;
   tests = [
     nixosTests.zfs.unstable
   ];
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/default.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/default.nix
index 5af0caced5ef..f716973d14b9 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/default.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/default.nix
@@ -14,6 +14,8 @@
 
   decluttering-card = callPackage ./decluttering-card { };
 
+  hourly-weather = callPackage ./hourly-weather { };
+
   lg-webos-remote-control = callPackage ./lg-webos-remote-control { };
 
   light-entity-card = callPackage ./light-entity-card { };
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/hourly-weather/default.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/hourly-weather/default.nix
new file mode 100644
index 000000000000..11ec3d02ad85
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/hourly-weather/default.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+}:
+
+buildNpmPackage rec {
+  pname = "hourly-weather";
+  version = "6.1.0";
+
+  src = fetchFromGitHub {
+    owner = "decompil3d";
+    repo = "lovelace-hourly-weather";
+    rev = version;
+    hash = "sha256-IvwWeksEnq44PhCpUXVufYb8w5XEX9Dk0LMLLeM7Dps=";
+  };
+
+  npmDepsHash = "sha256-4uQfaYMg533xZobAl6+/9+FsHAFBm03wrF01nDa53Qg=";
+
+  env.CYPRESS_INSTALL_BINARY = "0";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir $out
+    cp dist/hourly-weather.js $out
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Hourly weather card for Home Assistant. Visualize upcoming weather conditions as a colored horizontal bar";
+    homepage = "https://github.com/decompil3d/lovelace-hourly-weather";
+    license = licenses.mit;
+    maintainers = with maintainers; [ matthiasbeyer ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/servers/ldap/389/default.nix b/pkgs/servers/ldap/389/default.nix
index 0658b7a36fed..e8cfaa1f1ca6 100644
--- a/pkgs/servers/ldap/389/default.nix
+++ b/pkgs/servers/ldap/389/default.nix
@@ -31,45 +31,26 @@
 , withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd, systemd
 , zlib
 , rsync
-, fetchpatch
 , withCockpit ? true
 , withAsan ? false
 }:
 
 stdenv.mkDerivation rec {
   pname = "389-ds-base";
-  version = "2.4.5";
+  version = "2.4.6";
 
   src = fetchFromGitHub {
     owner = "389ds";
     repo = pname;
     rev = "${pname}-${version}";
-    hash = "sha256-12JCd2R00L0T5EPUNO/Aw2HRID+z2krNQ09RSX9Qkj8=";
+    hash = "sha256-+FTCzEyQY71TCkj8HMnSkrnQtxjHxOmtYhfZEAYOLis=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "fix-32bit.patch";
-      url = "https://github.com/389ds/389-ds-base/commit/1fe029c495cc9f069c989cfbb09d449a078c56e2.patch";
-      hash = "sha256-b0HSaDjuEUKERIXKg8np+lZDdZNmrCTAXybJzF+0hq0=";
-    })
-    (fetchpatch {
-      name = "CVE-2024-2199.patch";
-      url = "https://git.rockylinux.org/staging/rpms/389-ds-base/-/raw/dae373bd6b4e7d6f35a096e6f27be1c3bf1e48ac/SOURCES/0004-CVE-2024-2199.patch";
-      hash = "sha256-grANphTafCoa9NQy+FowwPhGQnvuCbfGnSpQ1Wp69Vg=";
-    })
-    (fetchpatch {
-      name = "CVE-2024-3657.patch";
-      url = "https://git.rockylinux.org/staging/rpms/389-ds-base/-/raw/dae373bd6b4e7d6f35a096e6f27be1c3bf1e48ac/SOURCES/0005-CVE-2024-3657.patch";
-      hash = "sha256-CuiCXQp3PMiYERzFk7oH3T91yQ1dP/gtLNWF0eqGAQ4=";
-    })
-  ];
-
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     sourceRoot = "${src.name}/src";
     name = "${pname}-${version}";
-    hash = "sha256-fE3bJROwti9Ru0jhCiWhXcuQdxXTqzN9yOd2nlhKABI=";
+    hash = "sha256-2Ng268tfbMRU3Uyo5ljSS/HxPnw1abvGjcczo25HyVk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/mattermost/default.nix b/pkgs/servers/mattermost/default.nix
index 666e812a691b..fd66967da051 100644
--- a/pkgs/servers/mattermost/default.nix
+++ b/pkgs/servers/mattermost/default.nix
@@ -12,13 +12,13 @@ buildGoModule rec {
   # See https://docs.mattermost.com/upgrade/extended-support-release.html
   # When a new ESR version is available (e.g. 8.1.x -> 9.5.x), update
   # the version regex in passthru.updateScript as well.
-  version = "9.5.8";
+  version = "9.5.9";
 
   src = fetchFromGitHub {
     owner = "mattermost";
     repo = "mattermost";
     rev = "v${version}";
-    hash = "sha256-WK3O1t2mMqftH8EB12g1/xzQnnmJxSsBjaGrRk0Hypw=";
+    hash = "sha256-mGTLn1aV6pB/ubqtYYF1zNRAaLj5IsdQTLhf1LzcNho=";
   };
 
   # Needed because buildGoModule does not support go workspaces yet.
@@ -34,7 +34,7 @@ buildGoModule rec {
 
   webapp = fetchurl {
     url = "https://releases.mattermost.com/${version}/mattermost-${version}-linux-amd64.tar.gz";
-    hash = "sha256-gUp/Y0hI3oZkyTnEvyNXtHtPx77MC5zz+Z4b0FdrsqM=";
+    hash = "sha256-TgaRDIxGBoow1//99bGpp91HNYgdWRnoS09EDAFcHDs=";
   };
 
   # Makes nix-update-script pick up the fetchurl for the webapp.
diff --git a/pkgs/servers/monitoring/grafana-image-renderer/default.nix b/pkgs/servers/monitoring/grafana-image-renderer/default.nix
index df9e37dc43e4..9015c2a7ca59 100644
--- a/pkgs/servers/monitoring/grafana-image-renderer/default.nix
+++ b/pkgs/servers/monitoring/grafana-image-renderer/default.nix
@@ -7,13 +7,13 @@
 
 mkYarnPackage rec {
   pname = "grafana-image-renderer";
-  version = "3.11.1";
+  version = "3.11.3";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "grafana-image-renderer";
     rev = "v${version}";
-    hash = "sha256-ORXzMXw8pgOtb9zyntkAeT5O4CYGCB1wJ4ipZlB2T84=";
+    hash = "sha256-a++aQt2y7+Nrvjka9XV7j8YwmppWFnUffFO4XEiZVvo=";
   };
 
   offlineCache = fetchYarnDeps {
diff --git a/pkgs/servers/web-apps/matomo/default.nix b/pkgs/servers/web-apps/matomo/default.nix
index 529deabd48bc..989d96df645c 100644
--- a/pkgs/servers/web-apps/matomo/default.nix
+++ b/pkgs/servers/web-apps/matomo/default.nix
@@ -7,8 +7,8 @@ let
       hash = "sha256-cGnsxfpvt7FyhxFcA2/gWWe7CyanVGZVKtCDES3XLdI=";
     };
     matomo_5 = {
-      version = "5.0.2";
-      hash = "sha256-rLAShJLtzd3HB1Je+P+i8GKWdeklyC2sTnmPR07Md+8=";
+      version = "5.1.1";
+      hash = "sha256-xi6R9O/pOxBgga6+wwqziwDKK7Q1Ispldvxg+0mpdeQ=";
     };
     matomo-beta = {
       version = "5.0.0";
diff --git a/pkgs/shells/powershell/default.nix b/pkgs/shells/powershell/default.nix
index 2dd075d4aab9..c6d123701589 100644
--- a/pkgs/shells/powershell/default.nix
+++ b/pkgs/shells/powershell/default.nix
@@ -29,7 +29,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "powershell";
-  version = "7.4.4";
+  version = "7.4.5";
 
   src = passthru.sources.${stdenv.hostPlatform.system}
     or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
@@ -84,19 +84,19 @@ stdenv.mkDerivation rec {
     sources = {
       aarch64-darwin = fetchurl {
         url = "https://github.com/PowerShell/PowerShell/releases/download/v${version}/powershell-${version}-osx-arm64.tar.gz";
-        hash = "sha256-guRxvkxaUjVj1XxmIlM4Rm9DKxRujd0EjLmzVXBgPZw=";
+        hash = "sha256-pN0wv/jV1luaLO1NF4QRwXI8FzcBev8VCkiMcSs3r1I=";
       };
       aarch64-linux = fetchurl {
         url = "https://github.com/PowerShell/PowerShell/releases/download/v${version}/powershell-${version}-linux-arm64.tar.gz";
-        hash = "sha256-NNjn0S3xY0GfymYC5UZCHBqrz2yPi7RALdTgOxpMRDc=";
+        hash = "sha256-8JaGSezUfVUAzLdmxP9No04NeCVMzpCYx/QtDlSEtRM=";
       };
       x86_64-darwin = fetchurl {
         url = "https://github.com/PowerShell/PowerShell/releases/download/v${version}/powershell-${version}-osx-x64.tar.gz";
-        hash = "sha256-4vlRwZFjGfBZtdJs4Jek+Kwhwecf4W8x/UmX/yaiviQ=";
+        hash = "sha256-1DE6D4AZBwKz9UIPpLy3a9hlgsF4QoGf2+eYO5SANYA=";
       };
       x86_64-linux = fetchurl {
         url = "https://github.com/PowerShell/PowerShell/releases/download/v${version}/powershell-${version}-linux-x64.tar.gz";
-        hash = "sha256-SUNSAMQ/5v+D8+YvmQm0Bi7YF6MdBpf7V2EepPrKYzs=";
+        hash = "sha256-wjUJzE0Ixiuf9uom9XnuTFD5eKo0JpM0qF7aL+w29Fs=";
       };
     };
     tests.version = testers.testVersion {
diff --git a/pkgs/tools/games/ukmm/Cargo.lock b/pkgs/tools/games/ukmm/Cargo.lock
index fd02a661c5d0..4a1d6c5cbaf8 100644
--- a/pkgs/tools/games/ukmm/Cargo.lock
+++ b/pkgs/tools/games/ukmm/Cargo.lock
@@ -150,6 +150,15 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "ansi_term"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d52a9bb7ec0cf484c551830a7ce27bd20d67eac647e1befb56b0be4ee39a55d2"
+dependencies = [
+ "winapi",
+]
+
 [[package]]
 name = "anstream"
 version = "0.6.15"
@@ -467,6 +476,17 @@ version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
 
+[[package]]
+name = "atty"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
+dependencies = [
+ "hermit-abi 0.1.19",
+ "libc",
+ "winapi",
+]
+
 [[package]]
 name = "auto-enum"
 version = "0.1.2"
@@ -507,6 +527,42 @@ dependencies = [
  "arrayvec",
 ]
 
+[[package]]
+name = "aws-lc-rs"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ae74d9bd0a7530e8afd1770739ad34b36838829d6ad61818f9230f683f5ad77"
+dependencies = [
+ "aws-lc-sys",
+ "mirai-annotations",
+ "paste",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-lc-sys"
+version = "0.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f0e249228c6ad2d240c2dc94b714d711629d52bad946075d8e9b2f5391f0703"
+dependencies = [
+ "bindgen",
+ "cc",
+ "cmake",
+ "dunce",
+ "fs_extra",
+ "libc",
+ "paste",
+]
+
+[[package]]
+name = "base64"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b25d992356d2eb0ed82172f5248873db5560c4721f564b13cb5193bda5e668e"
+dependencies = [
+ "byteorder",
+]
+
 [[package]]
 name = "base64"
 version = "0.21.7"
@@ -528,6 +584,29 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "bindgen"
+version = "0.69.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a00dc851838a2120612785d195287475a3ac45514741da670b735818822129a0"
+dependencies = [
+ "bitflags 2.6.0",
+ "cexpr",
+ "clang-sys",
+ "itertools 0.12.1",
+ "lazy_static",
+ "lazycell",
+ "log",
+ "prettyplease",
+ "proc-macro2 1.0.86",
+ "quote 1.0.36",
+ "regex",
+ "rustc-hash 1.1.0",
+ "shlex",
+ "syn 2.0.72",
+ "which 4.4.2",
+]
+
 [[package]]
 name = "binrw"
 version = "0.13.3"
@@ -535,7 +614,18 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "173901312e9850391d4d7c1318c4e099fdc037d61870fca427429830efdb4e5f"
 dependencies = [
  "array-init",
- "binrw_derive",
+ "binrw_derive 0.13.3",
+ "bytemuck",
+]
+
+[[package]]
+name = "binrw"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f36b7cb3ab9ff6a2858650d8dc360e783a5d14dc29594db48c56a3c233cc265"
+dependencies = [
+ "array-init",
+ "binrw_derive 0.14.0",
  "bytemuck",
 ]
 
@@ -552,6 +642,19 @@ dependencies = [
  "syn 1.0.109",
 ]
 
+[[package]]
+name = "binrw_derive"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20ea7a8c5c8eeffffac6d54d172444e15beffac6f817fac714460a9a9aa88da3"
+dependencies = [
+ "either",
+ "owo-colors",
+ "proc-macro2 1.0.86",
+ "quote 1.0.36",
+ "syn 1.0.109",
+]
+
 [[package]]
 name = "bit-set"
 version = "0.5.3"
@@ -674,7 +777,7 @@ dependencies = [
  "include-flate",
  "once_cell",
  "regex",
- "roead",
+ "roead 0.25.3",
  "serde_json",
  "twox-hash",
 ]
@@ -821,6 +924,15 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c"
 
+[[package]]
+name = "cexpr"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
+dependencies = [
+ "nom",
+]
+
 [[package]]
 name = "cfg-expr"
 version = "0.15.8"
@@ -879,6 +991,32 @@ dependencies = [
  "windows-targets 0.52.6",
 ]
 
+[[package]]
+name = "clang-sys"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b023947811758c97c59bf9d1c188fd619ad4718dcaa767947df1cadb14f39f4"
+dependencies = [
+ "glob",
+ "libc",
+ "libloading",
+]
+
+[[package]]
+name = "clap"
+version = "2.34.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0610544180c38b88101fecf2dd634b174a62eef6946f84dfc6a7127512b381c"
+dependencies = [
+ "ansi_term",
+ "atty",
+ "bitflags 1.3.2",
+ "strsim 0.8.0",
+ "textwrap",
+ "unicode-width",
+ "vec_map",
+]
+
 [[package]]
 name = "clipboard-win"
 version = "5.4.0"
@@ -1238,7 +1376,7 @@ dependencies = [
  "ident_case",
  "proc-macro2 1.0.86",
  "quote 1.0.36",
- "strsim",
+ "strsim 0.11.1",
  "syn 2.0.72",
 ]
 
@@ -1261,11 +1399,12 @@ checksum = "7762d17f1241643615821a8455a0b2c3e803784b058693d990b11f2dce25a0ca"
 
 [[package]]
 name = "dashmap"
-version = "5.5.3"
+version = "6.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "978747c1d849a7d2ee5e8adc0159961c48fb7e5db2f06af6723b80123bb53856"
+checksum = "804c8821570c3f8b70230c2ba75ffa5c0f9a4189b9a432b6656c536712acae28"
 dependencies = [
  "cfg-if 1.0.0",
+ "crossbeam-utils",
  "hashbrown 0.14.5",
  "lock_api",
  "once_cell",
@@ -1384,6 +1523,12 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "75b325c5dbd37f80359721ad39aca5a29fb04c89279657cffdda8736d0c0b9d2"
 
+[[package]]
+name = "dunce"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
+
 [[package]]
 name = "duplicate"
 version = "1.0.0"
@@ -1981,6 +2126,12 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "fs_extra"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
+
 [[package]]
 name = "futures-channel"
 version = "0.3.30"
@@ -2230,6 +2381,15 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
+[[package]]
+name = "hermit-abi"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "hermit-abi"
 version = "0.4.0"
@@ -2253,12 +2413,16 @@ dependencies = [
 
 [[package]]
 name = "http_req"
-version = "0.11.1"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0122ab6637149482eb66b57288ac597bc7eb9859cbaa79dee62fa19a350df3d2"
+checksum = "92208b0986f414edaca8ede2c6962c979309346a9e8e19d07d0a7879aae1549e"
 dependencies = [
- "native-tls",
+ "rustls",
+ "rustls-pemfile",
+ "rustls-pki-types",
  "unicase",
+ "webpki",
+ "webpki-roots",
 ]
 
 [[package]]
@@ -2565,6 +2729,12 @@ version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
 
+[[package]]
+name = "lazycell"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
+
 [[package]]
 name = "lebe"
 version = "0.5.2"
@@ -2987,6 +3157,12 @@ dependencies = [
  "simd-adler32",
 ]
 
+[[package]]
+name = "mirai-annotations"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9be0862c1b3f26a88803c4a49de6889c10e608b3ee9344e6ef5b45fb37ad3d1"
+
 [[package]]
 name = "mmap-rs"
 version = "0.6.1"
@@ -3035,18 +3211,20 @@ dependencies = [
 
 [[package]]
 name = "msyt"
-version = "1.4.0"
-source = "git+https://github.com/NiceneNerd/msyt?rev=v1.4.0#d1acc2e84c8c79af508deb46075204576a46bbb2"
+version = "1.2.1"
+source = "git+https://github.com/NiceneNerd/msyt?rev=12e4d95fb6480f445284f37706db7bfa8351dc06#12e4d95fb6480f445284f37706db7bfa8351dc06"
 dependencies = [
  "anyhow",
- "base64 0.22.1",
+ "base64 0.10.1",
  "byteordered",
+ "clap",
  "glob",
- "indexmap 2.2.6",
+ "indexmap 1.9.3",
  "msbt",
+ "rayon",
  "serde",
  "serde_derive",
- "serde_yaml",
+ "serde_yaml 0.8.26",
 ]
 
 [[package]]
@@ -3058,23 +3236,6 @@ dependencies = [
  "getrandom",
 ]
 
-[[package]]
-name = "native-tls"
-version = "0.2.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8614eb2c83d59d1c8cc974dd3f920198647674a0a035e1af1fa58707e317466"
-dependencies = [
- "libc",
- "log",
- "openssl",
- "openssl-probe",
- "openssl-sys",
- "schannel",
- "security-framework",
- "security-framework-sys",
- "tempfile",
-]
-
 [[package]]
 name = "ndk"
 version = "0.8.0"
@@ -3417,50 +3578,6 @@ dependencies = [
  "pathdiff",
 ]
 
-[[package]]
-name = "openssl"
-version = "0.10.64"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95a0481286a310808298130d22dd1fef0fa571e05a8f44ec801801e84b216b1f"
-dependencies = [
- "bitflags 2.6.0",
- "cfg-if 1.0.0",
- "foreign-types 0.3.2",
- "libc",
- "once_cell",
- "openssl-macros",
- "openssl-sys",
-]
-
-[[package]]
-name = "openssl-macros"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
-dependencies = [
- "proc-macro2 1.0.86",
- "quote 1.0.36",
- "syn 2.0.72",
-]
-
-[[package]]
-name = "openssl-probe"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
-
-[[package]]
-name = "openssl-sys"
-version = "0.9.102"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c597637d56fbc83893a35eb0dd04b2b8e7a50c91e64e9493e398b5df4fb45fa2"
-dependencies = [
- "cc",
- "libc",
- "pkg-config",
- "vcpkg",
-]
-
 [[package]]
 name = "orbclient"
 version = "0.3.47"
@@ -3687,7 +3804,7 @@ checksum = "a3ed00ed3fbf728b5816498ecd316d1716eecaced9c0c8d2c5a6740ca214985b"
 dependencies = [
  "cfg-if 1.0.0",
  "concurrent-queue",
- "hermit-abi",
+ "hermit-abi 0.4.0",
  "pin-project-lite",
  "rustix",
  "tracing",
@@ -3712,6 +3829,16 @@ version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
 
+[[package]]
+name = "prettyplease"
+version = "0.2.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f12335488a2f3b0a83b14edad48dca9879ce89b2edd10e80237e4e852dd645e"
+dependencies = [
+ "proc-macro2 1.0.86",
+ "syn 2.0.72",
+]
+
 [[package]]
 name = "proc-macro-crate"
 version = "1.3.1"
@@ -4152,21 +4279,46 @@ name = "roead"
 version = "0.25.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4727c05997dc74a6fc4fb56acdc76aeb3bcbc409242f4b5a6bebd409b6dc3860"
+dependencies = [
+ "almost",
+ "binrw 0.13.3",
+ "cxx",
+ "cxx-build",
+ "indexmap 2.2.6",
+ "join_str",
+ "num-integer",
+ "num-traits",
+ "once_cell",
+ "parking_lot",
+ "rustc-hash 1.1.0",
+ "serde",
+ "serde_json",
+ "smartstring",
+ "thiserror",
+]
+
+[[package]]
+name = "roead"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "caa4e7e992638f39b4ecbde6f11e02dfbcf81dae42954ee5fba32111dd9e39ce"
 dependencies = [
  "almost",
  "base64 0.22.1",
- "binrw",
+ "binrw 0.14.0",
  "cxx",
  "cxx-build",
  "indexmap 2.2.6",
  "join_str",
  "lexical",
+ "lexical-core",
  "num-integer",
  "num-traits",
- "once_cell",
  "parking_lot",
- "rustc-hash",
+ "rustc-hash 2.0.0",
+ "rustc_version",
  "ryml",
+ "scc",
  "serde",
  "serde_json",
  "smartstring",
@@ -4199,15 +4351,14 @@ checksum = "6c20b6793b5c2fa6553b250154b78d6d0db37e72700ae35fad9387a46f487c97"
 
 [[package]]
 name = "rstb"
-version = "0.9.0"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe0870ba0dd7f71f00e32079a9a41c16c0007649d3af650782fe2768dd414ee7"
+checksum = "4dd1ba79c81f67f9ef9edd6c455e07278cd4c3a70bbf86d6e5bd5f3cde6ddfab"
 dependencies = [
  "crc",
  "include-flate",
- "once_cell",
  "phf",
- "roead",
+ "roead 0.25.3",
  "serde",
  "serde_json",
  "thiserror",
@@ -4219,6 +4370,12 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
 
+[[package]]
+name = "rustc-hash"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "583034fd73374156e66797ed8e5b0d5690409c9226b22d87cb7f19821c05d152"
+
 [[package]]
 name = "rustc_version"
 version = "0.4.0"
@@ -4247,6 +4404,7 @@ version = "0.23.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c58f8c84392efc0a126acce10fa59ff7b3d2ac06ab451a33f2741989b806b044"
 dependencies = [
+ "aws-lc-rs",
  "log",
  "once_cell",
  "ring",
@@ -4256,6 +4414,16 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "rustls-pemfile"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "196fe16b00e106300d3e45ecfcb764fa292a535d7326a29a5875c579c7417425"
+dependencies = [
+ "base64 0.22.1",
+ "rustls-pki-types",
+]
+
 [[package]]
 name = "rustls-pki-types"
 version = "1.7.0"
@@ -4268,6 +4436,7 @@ version = "0.102.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8e6b52d4fda176fd835fdc55a835d4a89b8499cad995885a21149d5ad62f852e"
 dependencies = [
+ "aws-lc-rs",
  "ring",
  "rustls-pki-types",
  "untrusted",
@@ -4308,12 +4477,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "19d36299972b96b8ae7e8f04ecbf75fb41a27bf3781af00abcf57609774cb911"
 
 [[package]]
-name = "schannel"
-version = "0.1.23"
+name = "scc"
+version = "2.1.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fbc91545643bcf3a0bbb6569265615222618bdf33ce4ffbbd13c4bbd4c093534"
+checksum = "aeb7ac86243095b70a7920639507b71d51a63390d1ba26c4f60a552fbb914a37"
 dependencies = [
- "windows-sys 0.52.0",
+ "sdd",
 ]
 
 [[package]]
@@ -4335,27 +4504,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a3cf7c11c38cb994f3d40e8a8cde3bbd1f72a435e4c49e85d6553d8312306152"
 
 [[package]]
-name = "security-framework"
-version = "2.11.1"
+name = "sdd"
+version = "3.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
-dependencies = [
- "bitflags 2.6.0",
- "core-foundation",
- "core-foundation-sys",
- "libc",
- "security-framework-sys",
-]
-
-[[package]]
-name = "security-framework-sys"
-version = "2.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75da29fe9b9b08fe9d6b22b5b4bcbc75d8db3aa31e639aa56bb62e9d46bfceaf"
-dependencies = [
- "core-foundation-sys",
- "libc",
-]
+checksum = "0495e4577c672de8254beb68d01a9b62d0e8a13c099edecdbedccce3223cd29f"
 
 [[package]]
 name = "semver"
@@ -4444,6 +4596,18 @@ dependencies = [
  "syn 2.0.72",
 ]
 
+[[package]]
+name = "serde_yaml"
+version = "0.8.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "578a7433b776b56a35785ed5ce9a7e777ac0598aac5a6dd1b4b18a307c7fc71b"
+dependencies = [
+ "indexmap 1.9.3",
+ "ryu",
+ "serde",
+ "yaml-rust",
+]
+
 [[package]]
 name = "serde_yaml"
 version = "0.9.34+deprecated"
@@ -4517,6 +4681,12 @@ dependencies = [
  "digest",
 ]
 
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
 [[package]]
 name = "signal-hook-registry"
 version = "1.4.2"
@@ -4704,6 +4874,12 @@ dependencies = [
  "float-cmp",
 ]
 
+[[package]]
+name = "strsim"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ea5119cdb4c55b55d432abb513a0429384878c15dde60cc77b1c99de1a95a6a"
+
 [[package]]
 name = "strsim"
 version = "0.11.1"
@@ -4840,6 +5016,15 @@ dependencies = [
  "winapi-util",
 ]
 
+[[package]]
+name = "textwrap"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d326610f408c7a4eb6f51c37c330e496b08506c9457c9d34287ecc38809fb060"
+dependencies = [
+ "unicode-width",
+]
+
 [[package]]
 name = "thiserror"
 version = "1.0.63"
@@ -5131,7 +5316,7 @@ dependencies = [
 
 [[package]]
 name = "uk-content"
-version = "0.13.0"
+version = "0.15.0"
 dependencies = [
  "anyhow",
  "indexmap 2.2.6",
@@ -5141,9 +5326,9 @@ dependencies = [
  "lexical-core",
  "lighter",
  "msyt",
- "roead",
+ "roead 1.0.0",
  "rstb",
- "rustc-hash",
+ "rustc-hash 2.0.0",
  "serde",
  "serde_json",
  "smartstring",
@@ -5163,7 +5348,7 @@ dependencies = [
 
 [[package]]
 name = "uk-manager"
-version = "0.13.0"
+version = "0.15.0"
 dependencies = [
  "anyhow",
  "anyhow_ext",
@@ -5180,14 +5365,14 @@ dependencies = [
  "path-slash",
  "rayon",
  "remove_dir_all",
- "roead",
+ "roead 1.0.0",
  "rstb",
- "rustc-hash",
+ "rustc-hash 2.0.0",
  "sanitise-file-name",
  "serde",
  "serde_json",
  "serde_with",
- "serde_yaml",
+ "serde_yaml 0.9.34+deprecated",
  "sevenz-rust",
  "smartstring",
  "split-iter",
@@ -5201,7 +5386,7 @@ dependencies = [
 
 [[package]]
 name = "uk-mod"
-version = "0.13.0"
+version = "0.15.0"
 dependencies = [
  "anyhow",
  "anyhow_ext",
@@ -5223,13 +5408,13 @@ dependencies = [
  "path-slash",
  "piz",
  "rayon",
- "roead",
+ "roead 1.0.0",
  "rstb",
  "sanitise-file-name",
  "serde",
  "serde_json",
  "serde_with",
- "serde_yaml",
+ "serde_yaml 0.9.34+deprecated",
  "smartstring",
  "tempfile",
  "typetag",
@@ -5242,7 +5427,7 @@ dependencies = [
 
 [[package]]
 name = "uk-reader"
-version = "0.13.0"
+version = "0.15.0"
 dependencies = [
  "anyhow",
  "anyhow_ext",
@@ -5254,7 +5439,7 @@ dependencies = [
  "minicbor-ser",
  "moka",
  "parking_lot",
- "roead",
+ "roead 1.0.0",
  "serde",
  "serde_json",
  "smartstring",
@@ -5267,7 +5452,7 @@ dependencies = [
 
 [[package]]
 name = "uk-ui"
-version = "0.13.0"
+version = "0.15.0"
 dependencies = [
  "catppuccin-egui",
  "color-hex",
@@ -5278,23 +5463,19 @@ dependencies = [
  "egui_extras",
  "font-loader",
  "hex",
- "once_cell",
  "rfd",
- "rustc-hash",
+ "rustc-hash 2.0.0",
  "serde",
  "syntect",
 ]
 
 [[package]]
 name = "uk-util"
-version = "0.13.0"
-dependencies = [
- "once_cell",
-]
+version = "0.15.0"
 
 [[package]]
 name = "ukmm"
-version = "0.13.0"
+version = "0.15.0"
 dependencies = [
  "anyhow",
  "anyhow_ext",
@@ -5315,17 +5496,18 @@ dependencies = [
  "lenient_semver",
  "log",
  "mimalloc",
- "once_cell",
  "open",
  "parking_lot",
  "rayon",
  "remove_dir_all",
  "rfd",
  "roxmltree 0.20.0",
- "rustc-hash",
+ "rustc-hash 2.0.0",
+ "rustls",
  "serde",
  "serde_json",
- "serde_yaml",
+ "serde_yaml 0.9.34+deprecated",
+ "shlex",
  "smartstring",
  "ssilide",
  "uk-content",
@@ -5334,6 +5516,7 @@ dependencies = [
  "uk-reader",
  "uk-ui",
  "uk-util",
+ "which 6.0.3",
  "winreg",
  "winres",
  "xflags",
@@ -5505,10 +5688,10 @@ dependencies = [
 ]
 
 [[package]]
-name = "vcpkg"
-version = "0.2.15"
+name = "vec_map"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191"
 
 [[package]]
 name = "version-compare"
@@ -5776,6 +5959,16 @@ dependencies = [
  "web-sys",
 ]
 
+[[package]]
+name = "webpki"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed63aea5ce73d0ff405984102c42de94fc55a6b75765d621c65262469b3c9b53"
+dependencies = [
+ "ring",
+ "untrusted",
+]
+
 [[package]]
 name = "webpki-roots"
 version = "0.26.3"
@@ -5791,6 +5984,30 @@ version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "53a85b86a771b1c87058196170769dd264f66c0782acf1ae6cc51bfd64b39082"
 
+[[package]]
+name = "which"
+version = "4.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87ba24419a2078cd2b0f2ede2691b6c66d8e47836da3b6db8265ebad47afbfc7"
+dependencies = [
+ "either",
+ "home",
+ "once_cell",
+ "rustix",
+]
+
+[[package]]
+name = "which"
+version = "6.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4ee928febd44d98f2f459a4a79bd4d928591333a494a10a868418ac1b39cf1f"
+dependencies = [
+ "either",
+ "home",
+ "rustix",
+ "winsafe",
+]
+
 [[package]]
 name = "widestring"
 version = "1.1.0"
@@ -6179,6 +6396,12 @@ dependencies = [
  "toml 0.5.11",
 ]
 
+[[package]]
+name = "winsafe"
+version = "0.0.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d135d17ab770252ad95e9a872d365cf3090e3be864a34ab46f48555993efc904"
+
 [[package]]
 name = "x11-dl"
 version = "2.21.0"
@@ -6388,6 +6611,20 @@ name = "zeroize"
 version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ced3678a2879b30306d323f4542626697a464a97c0a07c9aebf7ebca65cd4dde"
+dependencies = [
+ "zeroize_derive",
+]
+
+[[package]]
+name = "zeroize_derive"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce36e65b0d2999d2aafac989fb249189a141aee1f53c612c1f37d72631959f69"
+dependencies = [
+ "proc-macro2 1.0.86",
+ "quote 1.0.36",
+ "syn 2.0.72",
+]
 
 [[package]]
 name = "zip"
diff --git a/pkgs/tools/games/ukmm/default.nix b/pkgs/tools/games/ukmm/default.nix
index feab9651b771..98709602dcde 100644
--- a/pkgs/tools/games/ukmm/default.nix
+++ b/pkgs/tools/games/ukmm/default.nix
@@ -13,13 +13,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ukmm";
-  version = "0.13.0";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "NiceneNerd";
     repo = "ukmm";
     rev = "refs/tags/v${version}";
-    hash = "sha256-IhVpsDdFpeE27GY+2iZyAmXjS6F8S4ME09SneQCSuZg=";
+    hash = "sha256-NZN+T2N+N+oxrjBRvVbRWbB2KY5im9SN7gPHzfvovl8=";
   };
 
   cargoLock = {
@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage rec {
       "egui-aesthetix-0.2.4" = "sha256-6Nt+nx1pAkuehXINRLp8xgiXmq1PzWgtu/hVbcDm5iA=";
       "junction-0.2.0" = "sha256-6+pPp5wG1NoIj16Z+OvO4Pvy0jnQibn/A9cTaHAEVq4=";
       "msbt-0.1.1" = "sha256-PtBs60xgYrwS7yPnRzXpExwYUD3azIaqObRnnJEL5dE=";
-      "msyt-1.4.0" = "sha256-Ovp0QVzMR4sT/qKArLJYFG1Olp4SytI1QDE9ixhTIS0=";
+      "msyt-1.2.1" = "sha256-aw5whCoQBhO0u9Fx2rTO1sRuPdGnAAlmPWv5q8CbQcI=";
     };
   };
 
diff --git a/pkgs/tools/misc/handlr/default.nix b/pkgs/tools/misc/handlr/default.nix
index e2aa411f6c44..b2245eafe534 100644
--- a/pkgs/tools/misc/handlr/default.nix
+++ b/pkgs/tools/misc/handlr/default.nix
@@ -31,7 +31,7 @@ rustPlatform.buildRustPackage rec {
     description = "Alternative to xdg-open to manage default applications with ease";
     homepage = "https://github.com/chmln/handlr";
     license = licenses.mit;
-    maintainers = with maintainers; [ mredaelli artturin ];
+    maintainers = with maintainers; [ artturin ];
     mainProgram = "handlr";
   };
 }
diff --git a/pkgs/tools/misc/snapper/default.nix b/pkgs/tools/misc/snapper/default.nix
index d80bf5312a9c..41184f33ae41 100644
--- a/pkgs/tools/misc/snapper/default.nix
+++ b/pkgs/tools/misc/snapper/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "snapper";
-  version = "0.11.1";
+  version = "0.11.2";
 
   src = fetchFromGitHub {
     owner = "openSUSE";
     repo = "snapper";
     rev = "v${version}";
-    sha256 = "sha256-gD5GsD36KNqoJHFHjNkAUq5M7UZS9Fi176OXgGfqjQ8=";
+    sha256 = "sha256-U948AmyQ6c5+FCrDijOVLc/p2wwbq5IWwS66x+O960Y=";
   };
 
   strictDeps = true;
diff --git a/pkgs/tools/networking/cfspeedtest/default.nix b/pkgs/tools/networking/cfspeedtest/default.nix
index b8417182dc7f..61bdad229863 100644
--- a/pkgs/tools/networking/cfspeedtest/default.nix
+++ b/pkgs/tools/networking/cfspeedtest/default.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cfspeedtest";
-  version = "1.2.5";
+  version = "1.2.6";
 
   src = fetchFromGitHub {
     owner = "code-inflation";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-rJTECX6JgIoOFpUWK4jYF6duGfhFn6SCNsHzotq5Fhg=";
+    hash = "sha256-K/rotb4rgYKOF1Gvgb8uPfHCAyYqwcvyU26ZlKGxHcs=";
   };
 
-  cargoHash = "sha256-XVXHVkwkVYaETN4NAcZkoSQJJK3FxuD4uk7hll47pLM=";
+  cargoHash = "sha256-clIMlnLXL4ciD1H0LNSLH/ooKIfoZy9D/RDvoSHfG+I=";
 
   meta = with lib; {
     description = "Unofficial CLI for speed.cloudflare.com";
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 1cf50ac79c43..d4b01dd7de31 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -149,6 +149,8 @@ stdenv.mkDerivation (finalAttrs: {
       "--without-ca-path"
     ] ++ lib.optionals (!gnutlsSupport && !opensslSupport && !wolfsslSupport && !rustlsSupport) [
       "--without-ssl"
+    ] ++ lib.optionals (rustlsSupport && !stdenv.isDarwin) [
+      "--with-ca-bundle=/etc/ssl/certs/ca-certificates.crt"
     ] ++ lib.optionals (gnutlsSupport && !stdenv.isDarwin) [
       "--with-ca-path=/etc/ssl/certs"
     ];
diff --git a/pkgs/tools/networking/ddns-go/default.nix b/pkgs/tools/networking/ddns-go/default.nix
index 02d4954e4ca2..3d696e952037 100644
--- a/pkgs/tools/networking/ddns-go/default.nix
+++ b/pkgs/tools/networking/ddns-go/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "ddns-go";
-  version = "6.6.9";
+  version = "6.7.0";
 
   src = fetchFromGitHub {
     owner = "jeessy2";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-bhZFc5E4ejeZK64bTwB32KjGaVYz21mP/HAl2Mv/jAA=";
+    hash = "sha256-8NiJgvZ6Z1QGHX3LeNtipQDbntppE1WO2HbinlgKiNE=";
   };
 
   vendorHash = "sha256-XAAJ3XuT0OqUAhkkRRftbxYsiPg7OfRnpnWtoUytJ2o=";
diff --git a/pkgs/tools/networking/grpc_cli/default.nix b/pkgs/tools/networking/grpc_cli/default.nix
index 6074d6cc9561..24e22436b20d 100644
--- a/pkgs/tools/networking/grpc_cli/default.nix
+++ b/pkgs/tools/networking/grpc_cli/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "grpc_cli";
-  version = "1.66.0";
+  version = "1.66.1";
   src = fetchFromGitHub {
     owner = "grpc";
     repo = "grpc";
     rev = "v${version}";
-    hash = "sha256-KQKAkjLib0HAJEti8wrDOwtTzFV5Tir72P5RxwTmhNI=";
+    hash = "sha256-CmQUUbIYPWRS7q7OX+TmkTvoqtJAUEwhL/lev8JdB8U=";
     fetchSubmodules = true;
   };
   nativeBuildInputs = [ automake cmake autoconf ];
diff --git a/pkgs/tools/security/metasploit/Gemfile b/pkgs/tools/security/metasploit/Gemfile
index d5dc101a286b..5cb6092615da 100644
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.4.23"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.4.24"
diff --git a/pkgs/tools/security/metasploit/Gemfile.lock b/pkgs/tools/security/metasploit/Gemfile.lock
index fc3c90867107..6eddefe9becd 100644
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@@ -1,9 +1,9 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: 01b22e64d29b9a8e457691b1973dd0cdf49bfbe0
-  ref: refs/tags/6.4.23
+  revision: 1d1fe1ccc7a339d4800cf20b8301d1ff1f56cd9b
+  ref: refs/tags/6.4.24
   specs:
-    metasploit-framework (6.4.23)
+    metasploit-framework (6.4.24)
       aarch64
       abbrev
       actionpack (~> 7.0.0)
diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix
index e4e381834afb..a8a01e639cc1 100644
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@@ -15,13 +15,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "metasploit-framework";
-  version = "6.4.23";
+  version = "6.4.24";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     rev = "refs/tags/${version}";
-    hash = "sha256-MeM1+GT09/G9hX10686afaVB51jBPKey3ZTgJVocj+0=";
+    hash = "sha256-320yeezX3GV8sNi84JbU8qeKcj+uuiaqXQkYYh1jmh0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/metasploit/gemset.nix b/pkgs/tools/security/metasploit/gemset.nix
index fb5c5ef0ef44..26b9050c60cb 100644
--- a/pkgs/tools/security/metasploit/gemset.nix
+++ b/pkgs/tools/security/metasploit/gemset.nix
@@ -724,12 +724,12 @@
     platforms = [];
     source = {
       fetchSubmodules = false;
-      rev = "01b22e64d29b9a8e457691b1973dd0cdf49bfbe0";
-      sha256 = "1vcg3id2bq4lvnrafg61b3kl39bxkb7fnx3xhnyz3xzlckw3bqri";
+      rev = "1d1fe1ccc7a339d4800cf20b8301d1ff1f56cd9b";
+      sha256 = "07csccfn4609bnm2dfmf7xr8m9zjsjbf1g6qn1y6bp6pxiwk4vfz";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.4.23";
+    version = "6.4.24";
   };
   metasploit-model = {
     groups = ["default"];
diff --git a/pkgs/tools/security/rustscan/default.nix b/pkgs/tools/security/rustscan/default.nix
index 588a05ec7eb0..fc3ab5b2e013 100644
--- a/pkgs/tools/security/rustscan/default.nix
+++ b/pkgs/tools/security/rustscan/default.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rustscan";
-  version = "2.2.3";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "RustScan";
     repo = "RustScan";
     rev = "refs/tags/${version}";
-    hash = "sha256-GOoyq2GgVGNUxxy0KQeRvkISb3FJqwWK5XpmoBAw/tk=";
+    hash = "sha256-6heC/bHo4IqKNvPjch7AiyWTCZDCv4MZHC7DTEX3U5c=";
   };
 
-  cargoHash = "sha256-K9NFm++jBsrn7U+rZkTOWhrUuL4CA0NR7SlSyhSIwSc=";
+  cargoHash = "sha256-Fr+m4BeYvUOoSkewwdUgpmdNchweeLK7v/tKLEzFOBs=";
 
   postPatch = ''
     substituteInPlace src/scripts/mod.rs \
@@ -39,6 +39,8 @@ rustPlatform.buildRustPackage rec {
     # These tests require network access
     "--skip=parse_correct_host_addresses"
     "--skip=parse_hosts_file_and_incorrect_hosts"
+    "--skip=resolver_args_google_dns"
+    "--skip=resolver_default_cloudflare"
   ];
 
   meta = with lib; {
diff --git a/pkgs/tools/security/trufflehog/default.nix b/pkgs/tools/security/trufflehog/default.nix
index 663c3c262b9b..d45a45a880a6 100644
--- a/pkgs/tools/security/trufflehog/default.nix
+++ b/pkgs/tools/security/trufflehog/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "trufflehog";
-  version = "3.81.9";
+  version = "3.81.10";
 
   src = fetchFromGitHub {
     owner = "trufflesecurity";
     repo = "trufflehog";
     rev = "refs/tags/v${version}";
-    hash = "sha256-6/lCkao8I4WXIgzGSL72YZGvFp80C5hkycXXR/kSxYw=";
+    hash = "sha256-U2HKrOk6+QO3QhDTDXpx3eWIsikfkuFTOQWcqbtj1qE=";
   };
 
-  vendorHash = "sha256-S61Np15QlUc58iAokmB4CW/g7laBNwclLJzl9FAk72g=";
+  vendorHash = "sha256-9AY0Dzn29GbWveb5HGWpKHkW9LCglPUzlX9wyQmj+FM=";
 
   proxyVendor = true;
 
diff --git a/pkgs/tools/system/tuptime/default.nix b/pkgs/tools/system/tuptime/default.nix
index d92f65f78ae2..12027e463ad9 100644
--- a/pkgs/tools/system/tuptime/default.nix
+++ b/pkgs/tools/system/tuptime/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tuptime";
-  version = "5.2.3";
+  version = "5.2.4";
 
   src = fetchFromGitHub {
     owner = "rfmoz";
     repo = "tuptime";
     rev = version;
-    sha256 = "sha256-kR+Pi7/nsRzmmvibp95wjj8/B/Q6FCDSn2A7vJ3sM94=";
+    sha256 = "sha256-pYGtgv9hPBG/URD2nOWg6qJYYLtlqLW+t5mCLpzKlEc=";
   };
 
   nativeBuildInputs = [ makeWrapper installShellFiles ];
diff --git a/pkgs/tools/text/hcledit/default.nix b/pkgs/tools/text/hcledit/default.nix
index 9c48e5c6729e..882561b98387 100644
--- a/pkgs/tools/text/hcledit/default.nix
+++ b/pkgs/tools/text/hcledit/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "hcledit";
-  version = "0.2.13";
+  version = "0.2.14";
 
   src = fetchFromGitHub {
     owner = "minamijoyo";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-AKNvbvRfy5QpbR1WLBlf4YcbTdX9rTGS/bovDWQXYZo=";
+    hash = "sha256-7Yay4a55AIzhJHkUh3lCNjklPOZm9VwrmAAyLIW6XJ0=";
   };
 
   vendorHash = "sha256-G6jmdosQHBA+n7MgVAlzdSTqPYb5d+k4b4EzAI384FQ=";
diff --git a/pkgs/tools/virtualization/udocker/default.nix b/pkgs/tools/virtualization/udocker/default.nix
index 21fc0d1f838f..8f0afedfd9cb 100644
--- a/pkgs/tools/virtualization/udocker/default.nix
+++ b/pkgs/tools/virtualization/udocker/default.nix
@@ -8,13 +8,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "udocker";
-  version = "1.3.16";
+  version = "1.3.17";
 
   src = fetchFromGitHub {
     owner = "indigo-dc";
     repo = "udocker";
     rev = "refs/tags/${version}";
-    hash = "sha256-PUbNFvKaF41egGMypdkmVFCt1bWmTCWR5iQNOt/L4+Y=";
+    hash = "sha256-P49fkLvdCm/Eco+nD3SGM04PRQatBzq9CHlayueQetk=";
   };
 
   # crun patchelf proot runc fakechroot
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 1e5bf39be48d..886f5a7dc38e 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1467,7 +1467,7 @@ mapAliases ({
 
   tabula = throw "tabula has been removed from nixpkgs, as it was broken"; # Added 2024-07-15
   tangogps = foxtrotgps; # Added 2020-01-26
-  taskwarrior = lib.warn "taskwarrior was replaced by taskwarrior3, which requires manual transition from taskwarrior 2.6, read upstram's docs: https://taskwarrior.org/docs/upgrade-3/" taskwarrior2;
+  taskwarrior = lib.warn "taskwarrior was replaced by taskwarrior3, which requires manual transition from taskwarrior 2.6, read upstream's docs: https://taskwarrior.org/docs/upgrade-3/" taskwarrior2;
   taplo-cli = taplo; # Added 2022-07-30
   taplo-lsp = taplo; # Added 2022-07-30
   taro = taproot-assets; # Added 2023-07-04
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ae72008ada57..9e0b945222e9 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -19021,9 +19021,7 @@ with pkgs;
 
   szyszka = callPackage ../tools/misc/szyszka { };
 
-  taplo = callPackage ../development/tools/taplo {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  taplo = callPackage ../development/tools/taplo { };
 
   taoup = callPackage ../tools/misc/taoup { };
 
@@ -22883,8 +22881,6 @@ with pkgs;
 
   oneDNN_2 = callPackage ../development/libraries/oneDNN/2.nix { };
 
-  onedrive = callPackage ../applications/networking/sync/onedrive { };
-
   oneko = callPackage ../applications/misc/oneko { };
 
   oniguruma = callPackage ../development/libraries/oniguruma { };
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 8fb8986dd9b0..c487541fa2e8 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -64,6 +64,8 @@ let
 
     b0 = callPackage ../development/ocaml-modules/b0 { };
 
+    backoff = callPackage ../development/ocaml-modules/backoff { };
+
     bap = janeStreet_0_15.bap;
 
     base64 = callPackage ../development/ocaml-modules/base64 { };
@@ -1199,6 +1201,10 @@ let
 
     mtime =  callPackage ../development/ocaml-modules/mtime { };
 
+    multicore-bench =  callPackage ../development/ocaml-modules/multicore-bench { };
+
+    multicore-magic =  callPackage ../development/ocaml-modules/multicore-magic { };
+
     multipart-form-data =  callPackage ../development/ocaml-modules/multipart-form-data { };
 
     mustache =  callPackage ../development/ocaml-modules/mustache { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 5ca278ddb429..4332f6d5adcc 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -10111,6 +10111,8 @@ self: super: with self; {
 
   phonenumbers = callPackage ../development/python-modules/phonenumbers { };
 
+  phonenumberslite = callPackage ../development/python-modules/phonenumberslite { };
+
   photutils = callPackage ../development/python-modules/photutils { };
 
   pkgutil-resolve-name = callPackage ../development/python-modules/pkgutil-resolve-name { };
@@ -10952,6 +10954,8 @@ self: super: with self; {
 
   psycopg2cffi = callPackage ../development/python-modules/psycopg2cffi { };
 
+  psycopg2-binary = callPackage ../development/python-modules/psycopg2-binary { };
+
   psygnal = callPackage ../development/python-modules/psygnal { };
 
   ptable = callPackage ../development/python-modules/ptable { };
@@ -15280,6 +15284,8 @@ self: super: with self; {
 
   suds = callPackage ../development/python-modules/suds { };
 
+  suds-community = callPackage ../development/python-modules/suds-community { };
+
   sumo = callPackage ../development/python-modules/sumo { };
 
   sumtypes = callPackage ../development/python-modules/sumtypes { };