Pull request 2302: upd-all

Squashed commit of the following: commit f920006277f39b74c803139af2a9039aa45effae Author: Ainar Garipov <A.Garipov@AdGuard.COM> Date: Fri Nov 8 16:14:41 2024 +0300 all: fix pre-commit; upd dnsproxy commit 391f79b244348c6075f5ba0fccfb8882791bf3f1 Author: Ainar Garipov <A.Garipov@AdGuard.COM> Date: Thu Nov 7 18:53:28 2024 +0300 scripts: imp install commit 35324db80b591831c32b7ea45930eefee82a6320 Author: Ainar Garipov <A.Garipov@AdGuard.COM> Date: Thu Nov 7 18:20:23 2024 +0300 all: imp docs, scripts commit d2724cfaefdb8659efbdb5bf181a28721a909f07 Author: Ainar Garipov <A.Garipov@AdGuard.COM> Date: Thu Nov 7 17:26:23 2024 +0300 all: upd go, deps, tools, scripts
2024-11-08 17:18:16 +03:00 · 2024-11-08 17:18:16 +03:00 · ac5a96fada
parent 6673bb175a
commit ac5a96fada
40 changed files with 834 additions and 916 deletions
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@ -1,7 +1,7 @@
 'name': 'build'
 'env':
-  'GO_VERSION': '1.23.2'
+  'GO_VERSION': '1.23.3'
  'NODE_VERSION': '16'
 'on':
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@ -1,7 +1,7 @@
 'name': 'lint'
 'env':
-  'GO_VERSION': '1.23.2'
+  'GO_VERSION': '1.23.3'
 'on':
  'push':
--- a/.gitignore
+++ b/.gitignore
@ -1,3 +1,8 @@
 # This comment is used to simplify checking local copies of the file.  Bump
 # this number every time a significant change is made to this file.
 #
 # AdGuard-Project-Version: 1
 # Please, DO NOT put your text editors' temporary files here.  The more are
 # added, the harder it gets to maintain and manage projects' gitignores.  Put
 # them into your global gitignore file instead.
@ -8,6 +13,7 @@
 # bottom to make sure they take effect.
 *.db
 *.log
 *.out
 *.snap
 *.test
 /agh-backup/
@ -21,6 +27,7 @@
 /launchpad_credentials
 /querylog.json*
 /snapcraft_login
 /test-reports/
 AdGuardHome
 AdGuardHome.exe
 AdGuardHome.yaml*
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -27,8 +27,13 @@ NOTE: Add new changes BELOW THIS COMMENT.
 ### Security
 - Go version has been updated to prevent the possibility of exploiting the Go
  vulnerabilities fixed in [1.23.3][go-1.23.3].
 - The release executables are now signed.
 [go-1.23.3]: https://groups.google.com/g/golang-announce/c/X5KodEJYuqI
 <!--
 NOTE: Add new changes ABOVE THIS COMMENT.
 -->
--- a/35
+++ b/35
@ -1,14 +1,14 @@
 # Keep the Makefile POSIX-compliant.  We currently allow hyphens in
 # target names, but that may change in the future.
 #
-# See https://pubs.opengroup.org/onlinepubs/9699919799/utilities/make.html.
+# See https://pubs.opengroup.org/onlinepubs/9799919799/utilities/make.html.
 .POSIX:
 # This comment is used to simplify checking local copies of the
 # Makefile.  Bump this number every time a significant change is made to
 # this Makefile.
 #
-# AdGuard-Project-Version: 6
+# AdGuard-Project-Version: 9
 # Don't name these macros "GO" etc., because GNU Make apparently makes
 # them exported environment variables with the literal value of
@ -22,13 +22,12 @@ VERBOSE.MACRO = $${VERBOSE:-0}
 CHANNEL = development
 CLIENT_DIR = client
 COMMIT = $$( git rev-parse --short HEAD )
 DEPLOY_SCRIPT_PATH = not/a/real/path
 DIST_DIR = dist
 GOAMD64 = v1
 GOPROXY = https://proxy.golang.org|direct
 GOTOOLCHAIN = go1.23.2
 GOTELEMETRY = off
 GOTOOLCHAIN = go1.23.3
 GPG_KEY = devteam@adguard.com
 GPG_KEY_PASSPHRASE = not-a-real-password
 NPM = npm
@ -36,6 +35,7 @@ NPM_FLAGS = --prefix $(CLIENT_DIR)
 NPM_INSTALL_FLAGS = $(NPM_FLAGS) --quiet --no-progress --ignore-engines\
 	--ignore-optional --ignore-platform --ignore-scripts
 RACE = 0
 REVISION = $${REVISION:-$$(git rev-parse --short HEAD)}
 SIGN = 1
 SIGNER_API_KEY = not-a-real-key
 VERSION = v0.0.0
@ -60,7 +60,6 @@ BUILD_RELEASE_DEPS_1 = go-deps
 ENV = env\
 	CHANNEL='$(CHANNEL)'\
 	COMMIT='$(COMMIT)'\
 	DEPLOY_SCRIPT_PATH='$(DEPLOY_SCRIPT_PATH)' \
 	DIST_DIR='$(DIST_DIR)'\
 	GO="$(GO.MACRO)"\
@ -70,17 +69,19 @@ ENV = env\
 	GOTOOLCHAIN='$(GOTOOLCHAIN)'\
 	GPG_KEY='$(GPG_KEY)'\
 	GPG_KEY_PASSPHRASE='$(GPG_KEY_PASSPHRASE)'\
 	NEXTAPI='$(NEXTAPI)'\
 	PATH="$${PWD}/bin:$$( "$(GO.MACRO)" env GOPATH )/bin:$${PATH}"\
 	RACE='$(RACE)'\
 	REVISION='$(REVISION)'\
 	SIGN='$(SIGN)'\
 	SIGNER_API_KEY='$(SIGNER_API_KEY)' \
 	NEXTAPI='$(NEXTAPI)'\
 	VERBOSE="$(VERBOSE.MACRO)"\
 	VERSION="$(VERSION)"\
 # Keep the line above blank.
 ENV_MISC = env\
 	PATH="$${PWD}/bin:$$("$(GO.MACRO)" env GOPATH)/bin:$${PATH}"\
 	VERBOSE="$(VERBOSE.MACRO)"\
 # Keep the line above blank.
@ -89,6 +90,8 @@ ENV_MISC = env\
 # full build.
 build: deps quick-build
 init: ; git config core.hooksPath ./scripts/hooks
 quick-build: js-build go-build
 deps: js-deps go-deps
@ -102,9 +105,6 @@ build-docker: ; $(ENV) "$(SHELL)" ./scripts/make/build-docker.sh
 build-release: $(BUILD_RELEASE_DEPS_$(FRONTEND_PREBUILT))
 	$(ENV) "$(SHELL)" ./scripts/make/build-release.sh
 clean: ; $(ENV) "$(SHELL)" ./scripts/make/clean.sh
 init:  ; git config core.hooksPath ./scripts/hooks
 js-build: ; $(NPM) $(NPM_FLAGS) run build-prod
 js-deps:  ; $(NPM) $(NPM_INSTALL_FLAGS) ci
 js-lint:  ; $(NPM) $(NPM_FLAGS) run lint
@ -127,17 +127,16 @@ go-check: go-tools go-lint go-test
 # A quick check to make sure that all operating systems relevant to the
 # development of the project can be typechecked and built successfully.
 go-os-check:
-	env GOOS='darwin'  "$(GO.MACRO)" vet ./internal/...
+	$(ENV) GOOS='darwin'  "$(GO.MACRO)" vet ./internal/...
-	env GOOS='freebsd' "$(GO.MACRO)" vet ./internal/...
+	$(ENV) GOOS='freebsd' "$(GO.MACRO)" vet ./internal/...
-	env GOOS='openbsd' "$(GO.MACRO)" vet ./internal/...
+	$(ENV) GOOS='openbsd' "$(GO.MACRO)" vet ./internal/...
-	env GOOS='linux'   "$(GO.MACRO)" vet ./internal/...
+	$(ENV) GOOS='linux'   "$(GO.MACRO)" vet ./internal/...
-	env GOOS='windows' "$(GO.MACRO)" vet ./internal/...
+	$(ENV) GOOS='windows' "$(GO.MACRO)" vet ./internal/...
 openapi-lint: ; cd ./openapi/ && $(YARN) test
 openapi-show: ; cd ./openapi/ && $(YARN) start
 txt-lint: ; $(ENV) "$(SHELL)" ./scripts/make/txt-lint.sh
 md-lint:  ; $(ENV_MISC) "$(SHELL)" ./scripts/make/md-lint.sh
 sh-lint:  ; $(ENV_MISC) "$(SHELL)" ./scripts/make/sh-lint.sh
 openapi-lint: ; cd ./openapi/ && $(YARN) test
 openapi-show: ; cd ./openapi/ && $(YARN) start
--- a/bamboo-specs/release.yaml
+++ b/bamboo-specs/release.yaml
@ -8,7 +8,7 @@
 'variables':
    'channel': 'edge'
    'dockerFrontend': 'adguard/home-js-builder:2.0'
-    'dockerGo': 'adguard/go-builder:1.23.2--1'
+    'dockerGo': 'adguard/go-builder:1.23.3--1'
 'stages':
  - 'Build frontend':
@ -142,13 +142,15 @@
                # Install Qemu, create builder.
                docker version -f '{{ .Server.Experimental }}'
                docker buildx rm buildx-builder || :
-                docker buildx create --name buildx-builder --driver docker-container\
+                docker buildx create \
-                                --use
+                    --name buildx-builder \
                    --driver docker-container \
                    --use
                docker buildx inspect --bootstrap
                # Login to DockerHub.
-                docker login -u="${bamboo.dockerHubUsername}"\
+                docker login -u="${bamboo.dockerHubUsername}" \
-                        -p="${bamboo.dockerHubPassword}"
+                    -p="${bamboo.dockerHubPassword}"
                # Boot the builder.
                docker buildx inspect --bootstrap
@ -157,14 +159,14 @@
                docker info
                # Prepare and push the build.
-                env\
+                env \
-                        CHANNEL="${bamboo.channel}"\
+                    CHANNEL="${bamboo.channel}" \
-                        COMMIT="${bamboo.repository.revision.number}"\
+                    REVISION="${bamboo.repository.revision.number}" \
-                        DIST_DIR='dist'\
+                    DIST_DIR='dist' \
-                        DOCKER_IMAGE_NAME='adguard/adguardhome'\
+                    DOCKER_IMAGE_NAME='adguard/adguardhome' \
-                        DOCKER_OUTPUT="type=image,name=adguard/adguardhome,push=true"\
+                    DOCKER_OUTPUT="type=image,name=adguard/adguardhome,push=true" \
-                        VERBOSE='1'\
+                    VERBOSE='1' \
-                        sh ./scripts/make/build-docker.sh
+                    sh ./scripts/make/build-docker.sh
            'environment':
                DOCKER_CLI_EXPERIMENTAL=enabled
    'final-tasks':
@ -276,7 +278,7 @@
        'variables':
            'channel': 'beta'
            'dockerFrontend': 'adguard/home-js-builder:2.0'
-            'dockerGo': 'adguard/go-builder:1.23.2--1'
+            'dockerGo': 'adguard/go-builder:1.23.3--1'
    # release-vX.Y.Z branches are the branches from which the actual final
    # release is built.
  - '^release-v[0-9]+\.[0-9]+\.[0-9]+':
@ -292,4 +294,4 @@
        'variables':
            'channel': 'release'
            'dockerFrontend': 'adguard/home-js-builder:2.0'
-            'dockerGo': 'adguard/go-builder:1.23.2--1'
+            'dockerGo': 'adguard/go-builder:1.23.3--1'
--- a/bamboo-specs/test.yaml
+++ b/bamboo-specs/test.yaml
@ -6,7 +6,7 @@
    'name': 'AdGuard Home - Build and run tests'
 'variables':
    'dockerFrontend': 'adguard/home-js-builder:2.0'
-    'dockerGo': 'adguard/go-builder:1.23.2--1'
+    'dockerGo': 'adguard/go-builder:1.23.3--1'
    'channel': 'development'
 'stages':
@ -196,5 +196,5 @@
        # may need to build a few of these.
        'variables':
            'dockerFrontend': 'adguard/home-js-builder:2.0'
-            'dockerGo': 'adguard/go-builder:1.23.2--1'
+            'dockerGo': 'adguard/go-builder:1.23.3--1'
            'channel': 'candidate'
--- a/go.mod
+++ b/go.mod
@ -1,11 +1,10 @@
 module github.com/AdguardTeam/AdGuardHome
-go 1.23.2
+go 1.23.3
 require (
-	// TODO(a.garipov):  Update when v0.73.3 is released.
+	github.com/AdguardTeam/dnsproxy v0.73.3
-	github.com/AdguardTeam/dnsproxy v0.73.3-0.20241004151328-c7c7b977a2a3
+	github.com/AdguardTeam/golibs v0.30.2
 	github.com/AdguardTeam/golibs v0.30.1
 	github.com/AdguardTeam/urlfilter v0.20.0
 	github.com/NYTimes/gziphandler v1.1.1
 	github.com/ameshkov/dnscrypt/v2 v2.3.0
@ -13,7 +12,7 @@ require (
 	github.com/c2h5oh/datasize v0.0.0-20231215233829-aa82cc1e6500
 	github.com/digineo/go-ipset/v2 v2.2.1
 	github.com/dimfeld/httptreemux/v5 v5.5.0
-	github.com/fsnotify/fsnotify v1.7.0
+	github.com/fsnotify/fsnotify v1.8.0
 	github.com/go-ping/ping v1.1.0
 	github.com/google/go-cmp v0.6.0
 	github.com/google/gopacket v1.1.19
@ -33,10 +32,10 @@ require (
 	github.com/stretchr/testify v1.9.0
 	github.com/ti-mo/netfilter v0.5.2
 	go.etcd.io/bbolt v1.3.11
-	golang.org/x/crypto v0.28.0
+	golang.org/x/crypto v0.29.0
 	golang.org/x/exp v0.0.0-20241009180824-f66d83c29e7c
 	golang.org/x/net v0.30.0
-	golang.org/x/sys v0.26.0
+	golang.org/x/sys v0.27.0
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1
 	gopkg.in/yaml.v3 v3.0.1
 	howett.net/plist v1.0.1
@ -49,9 +48,9 @@ require (
 	github.com/beefsack/go-rate v0.0.0-20220214233405-116f4ca011a0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
-	github.com/google/pprof v0.0.0-20241029010322-833c56d90c8e // indirect
+	github.com/google/pprof v0.0.0-20241101162523-b92577c0c142 // indirect
 	github.com/mdlayher/socket v0.5.1 // indirect
-	github.com/onsi/ginkgo/v2 v2.20.2 // indirect
+	github.com/onsi/ginkgo/v2 v2.21.0 // indirect
 	github.com/patrickmn/go-cache v2.1.0+incompatible // indirect
 	github.com/pierrec/lz4/v4 v4.1.21 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
@ -59,9 +58,9 @@ require (
 	github.com/quic-go/qpack v0.5.1 // indirect
 	github.com/u-root/uio v0.0.0-20240224005618-d2acac8f3701 // indirect
 	go.uber.org/mock v0.5.0 // indirect
-	golang.org/x/mod v0.21.0 // indirect
+	golang.org/x/mod v0.22.0 // indirect
-	golang.org/x/sync v0.8.0 // indirect
+	golang.org/x/sync v0.9.0 // indirect
-	golang.org/x/text v0.19.0 // indirect
+	golang.org/x/text v0.20.0 // indirect
 	golang.org/x/tools v0.26.0 // indirect
 	gonum.org/v1/gonum v0.15.1 // indirect
 )
--- a/go.sum
+++ b/go.sum
@ -1,7 +1,7 @@
-github.com/AdguardTeam/dnsproxy v0.73.3-0.20241004151328-c7c7b977a2a3 h1:IGXwBjdKDzUm007QzZyxSllMnkbdXe7K79x7JWcBW/E=
+github.com/AdguardTeam/dnsproxy v0.73.3 h1:aacr6Wu0ed94DDD+gSB6EwF8nvyq0+DAc7oFOgtgUpA=
-github.com/AdguardTeam/dnsproxy v0.73.3-0.20241004151328-c7c7b977a2a3/go.mod h1:356iHROxo+SOdBVifp1MXEh6qHyydtzGCcsQMfx+ZVs=
+github.com/AdguardTeam/dnsproxy v0.73.3/go.mod h1:18ssqhDgOCiVIwYmmVuXVM05wSwrzkO2yjKhVRWJX/g=
-github.com/AdguardTeam/golibs v0.30.1 h1:/yv7dq2h7WXw/jTDxkE3FP9zHerRT+i03PZRHJX4fPU=
+github.com/AdguardTeam/golibs v0.30.2 h1:urU/NAyIvQOeArBqDmKCDpaRkfTCJ26uSiSuDMKQfuY=
-github.com/AdguardTeam/golibs v0.30.1/go.mod h1:FkwcNQEJoGsgDGXcalrVa/4gWbE68KsmE2guXWtBQUE=
+github.com/AdguardTeam/golibs v0.30.2/go.mod h1:FkwcNQEJoGsgDGXcalrVa/4gWbE68KsmE2guXWtBQUE=
 github.com/AdguardTeam/urlfilter v0.20.0 h1:X32qiuVCVd8WDYCEsbdZKfXMzwdVqrdulamtUi4rmzs=
 github.com/AdguardTeam/urlfilter v0.20.0/go.mod h1:gjrywLTxfJh6JOkwi9SU+frhP7kVVEZ5exFGkR99qpk=
 github.com/NYTimes/gziphandler v1.1.1 h1:ZUDjpQae29j0ryrS0u/B8HZfJBtBQHjqw2rQ2cqUQ3I=
@ -27,8 +27,8 @@ github.com/digineo/go-ipset/v2 v2.2.1 h1:k6skY+0fMqeUjjeWO/m5OuWPSZUAn7AucHMnQ1M
 github.com/digineo/go-ipset/v2 v2.2.1/go.mod h1:wBsNzJlZlABHUITkesrggFnZQtgW5wkqw1uo8Qxe0VU=
 github.com/dimfeld/httptreemux/v5 v5.5.0 h1:p8jkiMrCuZ0CmhwYLcbNbl7DDo21fozhKHQ2PccwOFQ=
 github.com/dimfeld/httptreemux/v5 v5.5.0/go.mod h1:QeEylH57C0v3VO0tkKraVz9oD3Uu93CKPnTLbsidvSw=
-github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
+github.com/fsnotify/fsnotify v1.8.0 h1:dAwr6QBTBZIkG8roQaJjGof0pp0EeF+tNV7YBP3F/8M=
-github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
+github.com/fsnotify/fsnotify v1.8.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
 github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
 github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=
@ -44,8 +44,8 @@ github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/gopacket v1.1.19 h1:ves8RnFZPGiFnTS0uPQStjwru6uO6h+nlr9j6fL7kF8=
 github.com/google/gopacket v1.1.19/go.mod h1:iJ8V8n6KS+z2U1A8pUwu8bW5SyEMkXJB8Yo/Vo+TKTo=
-github.com/google/pprof v0.0.0-20241029010322-833c56d90c8e h1:v7R0PZoC2p1KWQmv1+GqCXQe59Ab1TkDF8Y9Lg2W6m4=
+github.com/google/pprof v0.0.0-20241101162523-b92577c0c142 h1:sAGdeJj0bnMgUNVeUpp6AYlVdCt3/GdI3pGRqsNSQLs=
-github.com/google/pprof v0.0.0-20241029010322-833c56d90c8e/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
+github.com/google/pprof v0.0.0-20241101162523-b92577c0c142/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
 github.com/google/renameio/v2 v2.0.0 h1:UifI23ZTGY8Tt29JbYFiuyIU3eX+RNFtUwefq9qAhxg=
 github.com/google/renameio/v2 v2.0.0/go.mod h1:BtmJXm5YlszgC+TD4HOEEUFgkJP3nLxehU6hfe7jRt4=
 github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
@ -82,10 +82,10 @@ github.com/miekg/dns v1.1.62 h1:cN8OuEF1/x5Rq6Np+h1epln8OiyPWV+lROx9LxcGgIQ=
 github.com/miekg/dns v1.1.62/go.mod h1:mvDlcItzm+br7MToIKqkglaGhlFMHJ9DTNNWONWXbNQ=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
-github.com/onsi/ginkgo/v2 v2.20.2 h1:7NVCeyIWROIAheY21RLS+3j2bb52W0W82tkberYytp4=
+github.com/onsi/ginkgo/v2 v2.21.0 h1:7rg/4f3rB88pb5obDgNZrNHrQ4e6WpjonchcpuBRnZM=
-github.com/onsi/ginkgo/v2 v2.20.2/go.mod h1:K9gyxPIlb+aIvnZ8bd9Ak+YP18w3APlR+5coaZoE2ag=
+github.com/onsi/ginkgo/v2 v2.21.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
-github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k=
+github.com/onsi/gomega v1.34.2 h1:pNCwDkzrsv7MS9kpaQvVb1aVLahQXyJ/Tv5oAZMI3i8=
-github.com/onsi/gomega v1.34.1/go.mod h1:kU1QgUvBDLXBJq618Xvm2LUX6rSAfRaFRTcdOeDLwwY=
+github.com/onsi/gomega v1.34.2/go.mod h1:v1xfxRgk0KIsG+QOdm7p8UosrOzPYRo60fd3B/1Dukc=
 github.com/patrickmn/go-cache v2.1.0+incompatible h1:HRMgzkcYKYpi3C8ajMPV8OFXaaRUnok+kx1WdO15EQc=
 github.com/patrickmn/go-cache v2.1.0+incompatible/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ=
 github.com/pierrec/lz4/v4 v4.1.21 h1:yOVMLb6qSIDP67pl/5F7RepeKYu/VmTyEXvuMI5d9mQ=
@ -128,14 +128,14 @@ go.uber.org/mock v0.5.0 h1:KAMbZvZPyBPWgD14IrIQ38QCyjwpvVVV6K/bHl1IwQU=
 go.uber.org/mock v0.5.0/go.mod h1:ge71pBPLYDk7QIi1LupWxdAykm7KIEFchiOqd6z7qMM=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.28.0 h1:GBDwsMXVQi34v5CCYUm2jkJvu4cbtru2U4TN2PSyQnw=
+golang.org/x/crypto v0.29.0 h1:L5SG1JTTXupVV3n6sUqMTeWbjAyfPwoda2DLX8J8FrQ=
-golang.org/x/crypto v0.28.0/go.mod h1:rmgy+3RHxRZMyY0jjAJShp2zgEdOqj2AO7U0pYmeQ7U=
+golang.org/x/crypto v0.29.0/go.mod h1:+F4F4N5hv6v38hfeYwTdx20oUvLLc+QfrE9Ax9HtgRg=
 golang.org/x/exp v0.0.0-20241009180824-f66d83c29e7c h1:7dEasQXItcW1xKJ2+gg5VOiBnqWrJc+rq0DPKyvvdbY=
 golang.org/x/exp v0.0.0-20241009180824-f66d83c29e7c/go.mod h1:NQtJDoLvd6faHhE7m4T/1IY708gDefGGjR/iUW8yQQ8=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
-golang.org/x/mod v0.21.0 h1:vvrHzRwRfVKSiLrG+d4FMl/Qi4ukBCE6kZlTUkDYRT0=
+golang.org/x/mod v0.22.0 h1:D4nJWe9zXqHOmWqj4VMOJhvzj7bEZg4wEYa759z1pH4=
-golang.org/x/mod v0.21.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
+golang.org/x/mod v0.22.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
@ -146,8 +146,8 @@ golang.org/x/net v0.30.0 h1:AcW1SDZMkb8IpzCdQUaIq2sP4sZ4zw+55h6ynffypl4=
 golang.org/x/net v0.30.0/go.mod h1:2wGyMJ5iFasEhkwi13ChkO/t1ECNC4X4eBKkVFyYFlU=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
+golang.org/x/sync v0.9.0 h1:fEo0HyrW1GIgZdpbhCRO0PkJajUS5H9IFUztCgEo2jQ=
-golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.9.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190322080309-f49334f85ddc/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@ -158,13 +158,13 @@ golang.org/x/sys v0.0.0-20210315160823-c6e025ad8005/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220209214540-3681064d5158/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.4.1-0.20230131160137-e7d7f63158de/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.26.0 h1:KHjCJyddX0LoSTb3J+vWpupP9p0oznkqVk/IfjymZbo=
+golang.org/x/sys v0.27.0 h1:wBqf8DvsY9Y/2P8gAfPDEYNuS30J4lPHJxXSb/nJZ+s=
-golang.org/x/sys v0.26.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.27.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.19.0 h1:kTxAhCbGbxhK0IwgSKiMO5awPoDQ0RpfiVYBfK860YM=
+golang.org/x/text v0.20.0 h1:gK/Kv2otX8gz+wn7Rmb3vT96ZwuoxnQlY+HlJVj7Qug=
-golang.org/x/text v0.19.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
+golang.org/x/text v0.20.0/go.mod h1:D4IsuqiFMhST5bX19pQ9ikHC2GsaKyk/oF+pn3ducp4=
 golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
 golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
--- a/internal/client/index.go
+++ b/internal/client/index.go
@ -2,6 +2,7 @@ package client
 import (
 	"fmt"
 	"maps"
 	"net"
 	"net/netip"
 	"slices"
@ -9,7 +10,6 @@ import (
 	"github.com/AdguardTeam/AdGuardHome/internal/aghalg"
 	"github.com/AdguardTeam/golibs/errors"
 	"golang.org/x/exp/maps"
 )
 // macKey contains MAC as byte array of 6, 8, or 20 bytes.
@ -330,12 +330,14 @@ func (ci *index) size() (n int) {
 // rangeByName is like [Index.Range] but sorts the persistent clients by name
 // before iterating ensuring a predictable order.
 func (ci *index) rangeByName(f func(c *Persistent) (cont bool)) {
-	cs := maps.Values(ci.uidToClient)
+	clients := slices.SortedStableFunc(
-	slices.SortFunc(cs, func(a, b *Persistent) (n int) {
+		maps.Values(ci.uidToClient),
-		return strings.Compare(a.Name, b.Name)
+		func(a, b *Persistent) (res int) {
-	})
+			return strings.Compare(a.Name, b.Name)
 		},
 	)
-	for _, c := range cs {
+	for _, c := range clients {
 		if !f(c) {
 			break
 		}
--- a/internal/stats/unit.go
+++ b/internal/stats/unit.go
@ -5,6 +5,7 @@ import (
 	"encoding/binary"
 	"encoding/gob"
 	"fmt"
 	"maps"
 	"slices"
 	"time"
@ -12,7 +13,6 @@ import (
 	"github.com/AdguardTeam/golibs/errors"
 	"github.com/AdguardTeam/golibs/logutil/slogutil"
 	"go.etcd.io/bbolt"
 	"golang.org/x/exp/maps"
 )
 const (
@ -234,18 +234,15 @@ func (a countPair) compareCount(b countPair) (res int) {
 	}
 }
-func convertMapToSlice(m map[string]uint64, max int) (s []countPair) {
+func convertMapToSlice(m map[string]uint64, maxVal int) (s []countPair) {
 	s = make([]countPair, 0, len(m))
 	for k, v := range m {
 		s = append(s, countPair{Name: k, Count: v})
 	}
 	slices.SortFunc(s, countPair.compareCount)
 	if max > len(s) {
 		max = len(s)
 	}
-	return s[:max]
+	return s[:min(maxVal, len(s))]
 }
 func convertSliceToMap(a []countPair) (m map[string]uint64) {
@ -611,9 +608,7 @@ func microsecondsToSeconds(n float64) (r float64) {
 func prepareTopUpstreamsAvgTime(
 	upstreamsAvgTime topAddrsFloat,
 ) (topUpstreamsAvgTime []topAddrsFloat) {
-	keys := maps.Keys(upstreamsAvgTime)
+	keys := slices.SortedStableFunc(maps.Keys(upstreamsAvgTime), func(a, b string) (res int) {
 	slices.SortFunc(keys, func(a, b string) (res int) {
 		switch x, y := upstreamsAvgTime[a], upstreamsAvgTime[b]; {
 		case x > y:
 			return -1
--- a/internal/tools/go.mod
+++ b/internal/tools/go.mod
@ -1,27 +1,28 @@
 module github.com/AdguardTeam/AdGuardHome/internal/tools
-go 1.23.2
+go 1.23.3
 require (
 	github.com/fzipp/gocyclo v0.6.0
 	github.com/golangci/misspell v0.6.0
 	github.com/gordonklaus/ineffassign v0.1.0
 	github.com/jstemmer/go-junit-report/v2 v2.1.0
 	github.com/kisielk/errcheck v1.8.0
 	github.com/kyoh86/looppointer v0.2.1
 	github.com/securego/gosec/v2 v2.21.4
 	github.com/uudashr/gocognit v1.1.3
 	golang.org/x/tools v0.26.0
 	golang.org/x/vuln v1.1.3
 	honnef.co/go/tools v0.5.1
 	mvdan.cc/gofumpt v0.7.0
 	mvdan.cc/sh/v3 v3.10.0
 	mvdan.cc/unparam v0.0.0-20240917084806-57a3b4290ba3
 )
 require (
 	cloud.google.com/go v0.116.0 // indirect
 	cloud.google.com/go/ai v0.8.2 // indirect
-	cloud.google.com/go/auth v0.9.9 // indirect
+	cloud.google.com/go/auth v0.10.1 // indirect
-	cloud.google.com/go/auth/oauth2adapt v0.2.4 // indirect
+	cloud.google.com/go/auth/oauth2adapt v0.2.5 // indirect
 	cloud.google.com/go/compute/metadata v0.5.2 // indirect
 	cloud.google.com/go/longrunning v0.6.2 // indirect
 	github.com/BurntSushi/toml v1.4.1-0.20240526193622-a339e1f7089c // indirect
@ -32,12 +33,13 @@ require (
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/google/generative-ai-go v0.18.0 // indirect
 	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/google/renameio/v2 v2.0.0 // indirect
 	github.com/google/s2a-go v0.1.8 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.4 // indirect
 	github.com/googleapis/gax-go/v2 v2.13.0 // indirect
 	github.com/gookit/color v1.5.4 // indirect
-	github.com/kyoh86/nolint v0.0.1 // indirect
+	github.com/rogpeppe/go-internal v1.13.1 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.56.0 // indirect
@ -53,13 +55,15 @@ require (
 	golang.org/x/oauth2 v0.23.0 // indirect
 	golang.org/x/sync v0.8.0 // indirect
 	golang.org/x/sys v0.26.0 // indirect
-	golang.org/x/telemetry v0.0.0-20241028140143-9c0d19e65ba0 // indirect
+	golang.org/x/telemetry v0.0.0-20241106142447-58a1122356f5 // indirect
 	golang.org/x/term v0.25.0 // indirect
 	golang.org/x/text v0.19.0 // indirect
 	golang.org/x/time v0.7.0 // indirect
-	google.golang.org/api v0.203.0 // indirect
+	google.golang.org/api v0.205.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20241021214115-324edc3d5d38 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20241104194629-dd2ea8efbc28 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20241021214115-324edc3d5d38 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20241104194629-dd2ea8efbc28 // indirect
 	google.golang.org/grpc v1.67.1 // indirect
 	google.golang.org/protobuf v1.35.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	mvdan.cc/editorconfig v0.3.0 // indirect
 )
--- a/internal/tools/go.sum
+++ b/internal/tools/go.sum
@ -3,10 +3,10 @@ cloud.google.com/go v0.116.0 h1:B3fRrSDkLRt5qSHWe40ERJvhvnQwdZiHu0bJOpldweE=
 cloud.google.com/go v0.116.0/go.mod h1:cEPSRWPzZEswwdr9BxE6ChEn01dWlTaF05LiC2Xs70U=
 cloud.google.com/go/ai v0.8.2 h1:LEaQwqBv+k2ybrcdTtCTc9OPZXoEdcQaGrfvDYS6Bnk=
 cloud.google.com/go/ai v0.8.2/go.mod h1:Wb3EUUGWwB6yHBaUf/+oxUq/6XbCaU1yh0GrwUS8lr4=
-cloud.google.com/go/auth v0.9.9 h1:BmtbpNQozo8ZwW2t7QJjnrQtdganSdmqeIBxHxNkEZQ=
+cloud.google.com/go/auth v0.10.1 h1:TnK46qldSfHWt2a0b/hciaiVJsmDXWy9FqyUan0uYiI=
-cloud.google.com/go/auth v0.9.9/go.mod h1:xxA5AqpDrvS+Gkmo9RqrGGRh6WSNKKOXhY3zNOr38tI=
+cloud.google.com/go/auth v0.10.1/go.mod h1:xxA5AqpDrvS+Gkmo9RqrGGRh6WSNKKOXhY3zNOr38tI=
-cloud.google.com/go/auth/oauth2adapt v0.2.4 h1:0GWE/FUsXhf6C+jAkWgYm7X9tK8cuEIfy19DBn6B6bY=
+cloud.google.com/go/auth/oauth2adapt v0.2.5 h1:2p29+dePqsCHPP1bqDJcKj4qxRyYCcbzKpFyKGt3MTk=
-cloud.google.com/go/auth/oauth2adapt v0.2.4/go.mod h1:jC/jOpwFP6JBxhB3P5Rr0a9HLMC/Pe3eaL4NmdvqPtc=
+cloud.google.com/go/auth/oauth2adapt v0.2.5/go.mod h1:AlmsELtlEBnaNTL7jCj8VQFLy6mbZv0s4Q7NGBeQ5E8=
 cloud.google.com/go/compute/metadata v0.5.2 h1:UxK4uu/Tn+I3p2dYWTfiX4wva7aYlKixAHn3fyqngqo=
 cloud.google.com/go/compute/metadata v0.5.2/go.mod h1:C66sj2AluDcIqakBq/M8lw8/ybHgOZqin2obFxa/E5k=
 cloud.google.com/go/longrunning v0.6.2 h1:xjDfh1pQcWPEvnfjZmwjKQEcHnpz6lHjfy7Fo0MK+hc=
@ -67,12 +67,15 @@ github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMyw
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/pprof v0.0.0-20240827171923-fa2c70bbbfe5 h1:5iH8iuqE5apketRbSFBy+X1V0o+l+8NF1avt4HWl7cA=
 github.com/google/pprof v0.0.0-20240827171923-fa2c70bbbfe5/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
 github.com/google/renameio v0.1.0 h1:GOZbcHa3HfsPKPlmyPyN2KEohoMXOhdMbHrvbpl2QaA=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/renameio/v2 v2.0.0 h1:UifI23ZTGY8Tt29JbYFiuyIU3eX+RNFtUwefq9qAhxg=
 github.com/google/renameio/v2 v2.0.0/go.mod h1:BtmJXm5YlszgC+TD4HOEEUFgkJP3nLxehU6hfe7jRt4=
 github.com/google/s2a-go v0.1.8 h1:zZDs9gcbt9ZPLV0ndSyQk6Kacx2g/X+SKYovpnz3SMM=
 github.com/google/s2a-go v0.1.8/go.mod h1:6iNWHTpQ+nfNRN5E00MSdfDwVesa8hhS32PhPO8deJA=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
@ -86,16 +89,14 @@ github.com/gookit/color v1.5.4 h1:FZmqs7XOyGgCAxmWyPslpiok1k05wmY3SJTytgvYFs0=
 github.com/gookit/color v1.5.4/go.mod h1:pZJOeOS8DM43rXbp4AZo1n9zCU2qjpcRko0b6/QJi9w=
 github.com/gordonklaus/ineffassign v0.1.0 h1:y2Gd/9I7MdY1oEIt+n+rowjBNDcLQq3RsH5hwJd0f9s=
 github.com/gordonklaus/ineffassign v0.1.0/go.mod h1:Qcp2HIAYhR7mNUVSIxZww3Guk4it82ghYcEXIAk+QT0=
 github.com/jstemmer/go-junit-report/v2 v2.1.0 h1:X3+hPYlSczH9IMIpSC9CQSZA0L+BipYafciZUWHEmsc=
 github.com/jstemmer/go-junit-report/v2 v2.1.0/go.mod h1:mgHVr7VUo5Tn8OLVr1cKnLuEy0M92wdRntM99h7RkgQ=
 github.com/kisielk/errcheck v1.8.0 h1:ZX/URYa7ilESY19ik/vBmCn6zdGQLxACwjAcWbHlYlg=
 github.com/kisielk/errcheck v1.8.0/go.mod h1:1kLL+jV4e+CFfueBmI1dSK2ADDyQnlrnrY/FqKluHJQ=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kyoh86/looppointer v0.2.1 h1:Jx9fnkBj/JrIryBLMTYNTj9rvc2SrPS98Dg0w7fxdJg=
 github.com/kyoh86/looppointer v0.2.1/go.mod h1:q358WcM8cMWU+5vzqukvaZtnJi1kw/MpRHQm3xvTrjw=
 github.com/kyoh86/nolint v0.0.1 h1:GjNxDEkVn2wAxKHtP7iNTrRxytRZ1wXxLV5j4XzGfRU=
 github.com/kyoh86/nolint v0.0.1/go.mod h1:1ZiZZ7qqrZ9dZegU96phwVcdQOMKIqRzFJL3ewq9gtI=
 github.com/onsi/ginkgo/v2 v2.20.2 h1:7NVCeyIWROIAheY21RLS+3j2bb52W0W82tkberYytp4=
 github.com/onsi/ginkgo/v2 v2.20.2/go.mod h1:K9gyxPIlb+aIvnZ8bd9Ak+YP18w3APlR+5coaZoE2ag=
 github.com/onsi/gomega v1.34.2 h1:pNCwDkzrsv7MS9kpaQvVb1aVLahQXyJ/Tv5oAZMI3i8=
@ -103,8 +104,8 @@ github.com/onsi/gomega v1.34.2/go.mod h1:v1xfxRgk0KIsG+QOdm7p8UosrOzPYRo60fd3B/1
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
+github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
-github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
+github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
 github.com/securego/gosec/v2 v2.21.4 h1:Le8MSj0PDmOnHJgUATjD96PaXRvCpKC+DGJvwyy0Mlk=
 github.com/securego/gosec/v2 v2.21.4/go.mod h1:Jtb/MwRQfRxCXyCm1rfM1BEiiiTfUOdyzzAhlr6lUTA=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
@ -121,7 +122,6 @@ github.com/uudashr/gocognit v1.1.3 h1:l+a111VcDbKfynh+airAy/DJQKaXh2m9vkoysMPSZy
 github.com/uudashr/gocognit v1.1.3/go.mod h1:aKH8/e8xbTRBwjbCkwZ8qt4l2EpKXl31KMHgSS+lZ2U=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
@ -148,7 +148,6 @@ golang.org/x/exp/typeparams v0.0.0-20241009180824-f66d83c29e7c/go.mod h1:AbB0pIl
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.21.0 h1:vvrHzRwRfVKSiLrG+d4FMl/Qi4ukBCE6kZlTUkDYRT0=
 golang.org/x/mod v0.21.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
@ -158,7 +157,6 @@ golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73r
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
 golang.org/x/net v0.30.0 h1:AcW1SDZMkb8IpzCdQUaIq2sP4sZ4zw+55h6ynffypl4=
@ -169,23 +167,23 @@ golang.org/x/oauth2 v0.23.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbht
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
 golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.26.0 h1:KHjCJyddX0LoSTb3J+vWpupP9p0oznkqVk/IfjymZbo=
 golang.org/x/sys v0.26.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/telemetry v0.0.0-20241028140143-9c0d19e65ba0 h1:od0RE4kmouF+x/o4zkTTSvBnGPZ2azGgCUmZdrbnEXM=
+golang.org/x/telemetry v0.0.0-20241106142447-58a1122356f5 h1:TCDqnvbBsFapViksHcHySl/sW4+rTGNIAoJJesHRuMM=
-golang.org/x/telemetry v0.0.0-20241028140143-9c0d19e65ba0/go.mod h1:8nZWdGp9pq73ZI//QJyckMQab3yq7hoWi7SI0UIusVI=
+golang.org/x/telemetry v0.0.0-20241106142447-58a1122356f5/go.mod h1:8nZWdGp9pq73ZI//QJyckMQab3yq7hoWi7SI0UIusVI=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.25.0 h1:WtHI/ltw4NvSUig5KARz9h521QvRC8RmF/cuYqifU24=
 golang.org/x/term v0.25.0/go.mod h1:RPyXicDX+6vLxogjjRxjgD2TKtmAO6NZBsBRfrOLu7M=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.19.0 h1:kTxAhCbGbxhK0IwgSKiMO5awPoDQ0RpfiVYBfK860YM=
@ -198,7 +196,6 @@ golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20201007032633-0806396f153e/go.mod h1:z6u4i615ZeAfBE4XtMziQW1fSVJXACjjbWkB/mvPzlU=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.26.0 h1:v/60pFQmzmT9ExmjDv2gGIfi3OqfKoEP6I5+umXlbnQ=
 golang.org/x/tools v0.26.0/go.mod h1:TPVVj70c7JJ3WCazhD8OdXcZg/og+b9+tH/KxylGwH0=
@ -208,17 +205,17 @@ golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/api v0.203.0 h1:SrEeuwU3S11Wlscsn+LA1kb/Y5xT8uggJSkIhD08NAU=
+google.golang.org/api v0.205.0 h1:LFaxkAIpDb/GsrWV20dMMo5MR0h8UARTbn24LmD+0Pg=
-google.golang.org/api v0.203.0/go.mod h1:BuOVyCSYEPwJb3npWvDnNmFI92f3GeRnHNkETneT3SI=
+google.golang.org/api v0.205.0/go.mod h1:NrK1EMqO8Xk6l6QwRAmrXXg2v6dzukhlOyvkYtnvUuc=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto/googleapis/api v0.0.0-20241021214115-324edc3d5d38 h1:2oV8dfuIkM1Ti7DwXc0BJfnwr9csz4TDXI9EmiI+Rbw=
+google.golang.org/genproto/googleapis/api v0.0.0-20241104194629-dd2ea8efbc28 h1:M0KvPgPmDZHPlbRbaNU1APr28TvwvvdUPlSv7PUvy8g=
-google.golang.org/genproto/googleapis/api v0.0.0-20241021214115-324edc3d5d38/go.mod h1:vuAjtvlwkDKF6L1GQ0SokiRLCGFfeBUXWr/aFFkHACc=
+google.golang.org/genproto/googleapis/api v0.0.0-20241104194629-dd2ea8efbc28/go.mod h1:dguCy7UOdZhTvLzDyt15+rOrawrpM4q7DD9dQ1P11P4=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241021214115-324edc3d5d38 h1:zciRKQ4kBpFgpfC5QQCVtnnNAcLIqweL7plyZRQHVpI=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20241104194629-dd2ea8efbc28 h1:XVhgTWWV3kGQlwJHR3upFWZeTsei6Oks1apkZSeonIE=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241021214115-324edc3d5d38/go.mod h1:GX3210XPVPUjJbTUbvwI8f2IpZDMZuPJWDzDuebbviI=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20241104194629-dd2ea8efbc28/go.mod h1:GX3210XPVPUjJbTUbvwI8f2IpZDMZuPJWDzDuebbviI=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
@ -246,7 +243,11 @@ honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.5.1 h1:4bH5o3b5ZULQ4UrBmP+63W9r7qIkqJClEA9ko5YKx+I=
 honnef.co/go/tools v0.5.1/go.mod h1:e9irvo83WDG9/irijV44wr3tbhcFeRnfpVlRqVwpzMs=
 mvdan.cc/editorconfig v0.3.0 h1:D1D2wLYEYGpawWT5SpM5pRivgEgXjtEXwC9MWhEY0gQ=
 mvdan.cc/editorconfig v0.3.0/go.mod h1:NcJHuDtNOTEJ6251indKiWuzK6+VcrMuLzGMLKBFupQ=
 mvdan.cc/gofumpt v0.7.0 h1:bg91ttqXmi9y2xawvkuMXyvAA/1ZGJqYAEGjXuP0JXU=
 mvdan.cc/gofumpt v0.7.0/go.mod h1:txVFJy/Sc/mvaycET54pV8SW8gWxTlUuGHVEcncmNUo=
 mvdan.cc/sh/v3 v3.10.0 h1:v9z7N1DLZ7owyLM/SXZQkBSXcwr2IGMm2LY2pmhVXj4=
 mvdan.cc/sh/v3 v3.10.0/go.mod h1:z/mSSVyLFGZzqb3ZIKojjyqIx/xbmz/UHdCSv9HmqXY=
 mvdan.cc/unparam v0.0.0-20240917084806-57a3b4290ba3 h1:YkmTN1n5U60NM02j7TCSWRlW3fqNiuXe/eVXf0dLFN8=
 mvdan.cc/unparam v0.0.0-20240917084806-57a3b4290ba3/go.mod h1:z5yboO1sP1Q9pcfvS597TpfbNXQjphDlkCJHzt13ybc=
--- a/internal/tools/tools.go
+++ b/internal/tools/tools.go
@ -10,8 +10,8 @@ import (
 	_ "github.com/fzipp/gocyclo/cmd/gocyclo"
 	_ "github.com/golangci/misspell/cmd/misspell"
 	_ "github.com/gordonklaus/ineffassign"
 	_ "github.com/jstemmer/go-junit-report/v2"
 	_ "github.com/kisielk/errcheck"
 	_ "github.com/kyoh86/looppointer"
 	_ "github.com/securego/gosec/v2/cmd/gosec"
 	_ "github.com/uudashr/gocognit/cmd/gocognit"
 	_ "golang.org/x/tools/go/analysis/passes/nilness/cmd/nilness"
@ -19,5 +19,6 @@ import (
 	_ "golang.org/x/vuln/cmd/govulncheck"
 	_ "honnef.co/go/tools/cmd/staticcheck"
 	_ "mvdan.cc/gofumpt"
 	_ "mvdan.cc/sh/v3/cmd/shfmt"
 	_ "mvdan.cc/unparam"
 )
--- a/internal/updater/check.go
+++ b/internal/updater/check.go
@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
 	"maps"
 	"net/http"
 	"slices"
 	"time"
@ -12,7 +13,6 @@ import (
 	"github.com/AdguardTeam/golibs/errors"
 	"github.com/AdguardTeam/golibs/ioutil"
 	"github.com/AdguardTeam/golibs/log"
 	"golang.org/x/exp/maps"
 )
 // TODO(a.garipov): Make configurable.
@ -120,8 +120,8 @@ func (u *Updater) downloadURL(versionObj map[string]string) (dlURL, key string,
 		return dlURL, key, true
 	}
-	keys := maps.Keys(versionObj)
+	keys := slices.Sorted(maps.Keys(versionObj))
-	slices.Sort(keys)
+
 	log.Error("updater: key %q not found; got keys %q", key, keys)
 	return "", key, false
--- a/scripts/README.md
+++ b/scripts/README.md
@ -32,10 +32,10 @@ Required environment:
 *  `CHANNEL`: release channel, see above.
 *  `COMMIT`: current Git revision.
 *  `DIST_DIR`: the directory where a release has previously been built.
 *  `REVISION`: current Git revision.
 *  `VERSION`: release version.
 Optional environment:
@ -105,18 +105,6 @@ and call `make` with `GOTOOLCHAIN=local`.
   ###  `clean.sh`: Cleanup
 Optional environment:
 *  `GO`: set an alternative name for the Go compiler.
 Required environment:
 *  `DIST_DIR`: the directory where a release has previously been built.
   ###  `go-bench.sh`: Run backend benchmarks
 Optional environment:
--- a/scripts/blocked-services/main.go
+++ b/scripts/blocked-services/main.go
@ -16,6 +16,7 @@ import (
 	"text/template"
 	"time"
 	"github.com/AdguardTeam/golibs/errors"
 	"github.com/AdguardTeam/golibs/logutil/slogutil"
 )
@ -30,14 +31,13 @@ func main() {
 	// Validate the URL.
 	_, err := url.Parse(urlStr)
-	check(err)
+	errors.Check(err)
 	c := &http.Client{
 		Timeout: 10 * time.Second,
 	}
-	resp, err := c.Get(urlStr)
+	resp := errors.Must(c.Get(urlStr))
 	check(err)
 	defer slogutil.CloseAndLog(ctx, l, resp.Body, slog.LevelError)
 	if resp.StatusCode != http.StatusOK {
@ -46,7 +46,7 @@ func main() {
 	hlSvcs := &hlServices{}
 	err = json.NewDecoder(resp.Body).Decode(hlSvcs)
-	check(err)
+	errors.Check(err)
 	// Sort all services and rules to make the output more predictable.
 	slices.SortStableFunc(hlSvcs.BlockedServices, func(a, b *hlServicesService) (res int) {
@ -59,20 +59,20 @@ func main() {
 	// Use another set of delimiters to prevent them interfering with the Go
 	// code.
 	tmpl, err := template.New("main").Delims("<%", "%>").Funcs(template.FuncMap{
-		"isnotlast": func(idx, sliceLen int) (ok bool) { return idx != sliceLen-1 },
+		"isnotlast": func(idx, sliceLen int) (ok bool) {
 			return idx != sliceLen-1
 		},
 	}).Parse(tmplStr)
-	check(err)
+	errors.Check(err)
-	f, err := os.OpenFile(
+	f := errors.Must(os.OpenFile(
 		"./internal/filtering/servicelist.go",
 		os.O_CREATE|os.O_TRUNC|os.O_WRONLY,
 		0o644,
-	)
+	))
 	check(err)
 	defer slogutil.CloseAndLog(ctx, l, f, slog.LevelError)
-	err = tmpl.Execute(f, hlSvcs)
+	errors.Check(tmpl.Execute(f, hlSvcs))
 	check(err)
 }
 // tmplStr is the template for the Go source file with the services.
@ -100,13 +100,6 @@ var blockedServices = []blockedService{<% $l := len .BlockedServices %>
 }<% if isnotlast $i $l %>, <% end %><% end %>}
 `
 // check is a simple error-checking helper for scripts.
 func check(err error) {
 	if err != nil {
 		panic(err)
 	}
 }
 // hlServices is the JSON structure for the Hostlists Registry blocked service
 // index.
 type hlServices struct {
--- a/scripts/hooks/pre-commit
+++ b/scripts/hooks/pre-commit
@ -2,81 +2,78 @@
 set -e -f -u
-# This comment is used to simplify checking local copies of the script.
+# This comment is used to simplify checking local copies of the script.  Bump
-# Bump this number every time a significant change is made to this
+# this number every time a significant change is made to this script.
 # script.
 #
-# AdGuard-Project-Version: 3
+# AdGuard-Project-Version: 5
 # TODO(a.garipov): Add pre-merge-commit.
-# Only show interactive prompts if there a terminal is attached to
+# Only show interactive prompts if there a terminal is attached to stdout.
-# stdout.  While this technically doesn't guarantee that reading from
+# While this technically doesn't guarantee that reading from /dev/tty works,
-# /dev/tty works, this should work reasonably well on all of our
+# this should work reasonably well on all of our supported development systems
-# supported development systems and in most terminal emulators.
+# and in most terminal emulators.
 is_tty='0'
-if [ -t '1' ]
+if [ -t '1' ]; then
 then
 	is_tty='1'
 fi
 readonly is_tty
-# prompt is a helper that prompts the user for interactive input if that
+# prompt is a helper that prompts the user for interactive input if that can be
-# can be done.  If there is no terminal attached, it sleeps for two
+# done.  If there is no terminal attached, it sleeps for two seconds, giving the
-# seconds, giving the programmer some time to react, and returns with
+# programmer some time to react, and returns with a zero exit code.
 # a zero exit code.
 prompt() {
-	if [ "$is_tty" -eq '0' ]
+	if [ "$is_tty" -eq '0' ]; then
 	then
 		sleep 2
 		return 0
 	fi
-	while true
+	while true; do
 	do
 		printf 'commit anyway? y/[n]: '
-		read -r ans < /dev/tty
+		read -r ans </dev/tty
-		case "$ans"
+		case "$ans" in
-		in
+		'y' | 'Y')
 		('y'|'Y')
 			break
 			;;
-		(''|'n'|'N')
+		'' | 'n' | 'N')
 			exit 1
 			;;
-		(*)
+		*)
 			continue
 			;;
 		esac
 	done
 }
-# Warn the programmer about unstaged changes and untracked files, but do
+# Warn the programmer about unstaged changes and untracked files, but do not
-# not fail the commit, because those changes might be temporary or for
+# fail the commit, because those changes might be temporary or for a different
-# a different branch.
+# branch.
 #
 # shellcheck disable=SC2016
 awk_prog='substr($2, 2, 1) != "." { print $9; } $1 == "?" { print $2; }'
 readonly awk_prog
-unstaged="$( git status --porcelain=2 | awk "$awk_prog" )"
+unstaged="$(git status --porcelain=2 | awk "$awk_prog")"
 readonly unstaged
-if [ "$unstaged" != '' ]
+if [ "$unstaged" != '' ]; then
 then
 	printf 'WARNING: you have unstaged changes:\n\n%s\n\n' "$unstaged"
 	prompt
 fi
-# Warn the programmer about temporary todos, but do not fail the commit,
+# Warn the programmer about temporary todos and skel FIXMEs, but do not fail the
-# because the commit could be in a temporary branch.
+# commit, because the commit could be in a temporary branch.
-temp_todos="$( git grep -e 'TODO.*!!' -- ':!scripts/hooks/pre-commit' || : )"
+temp_todos="$(
 	git grep -e 'FIXME' -e 'TODO.*!!' -- \
 		':!./scripts/hooks/pre-commit' \
 		':!./client' \
 		|| :
 )"
 readonly temp_todos
-if [ "$temp_todos" != '' ]
+if [ "$temp_todos" != '' ]; then
 then
 	printf 'WARNING: you have temporary todos:\n\n%s\n\n' "$temp_todos"
 	prompt
 fi
@ -84,32 +81,22 @@ fi
 verbose="${VERBOSE:-0}"
 readonly verbose
-if [ "$( git diff --cached --name-only -- 'client/*.js' || true )" != '' ]
+if [ "$(git diff --cached --name-only -- '*.md' || :)" != '' ]; then
 then
 	make VERBOSE="$verbose" js-lint js-test
 fi
 if [ "$( git diff --cached --name-only -- '*.go' '*.mod' 'Makefile' || true )" != '' ]
 then
 	make VERBOSE="$verbose" go-os-check go-lint go-test
 fi
 if [ "$( git diff --cached --name-only -- '*.md' || true )" != '' ]
 then
 	make VERBOSE="$verbose" md-lint
 fi
-if [ "$( git diff --cached --name-only -- '*.sh' || true )" != '' ]
+if [ "$(git diff --cached --name-only -- '*.sh' || :)" != '' ]; then
 then
 	make VERBOSE="$verbose" sh-lint
 fi
-if [ "$( git diff --cached --name-only -- '*.md' '*.txt' '*.yaml' '*.yml' || true )" != '' ]
+if [ "$(git diff --cached --name-only -- '*.md' '*.txt' '*.yaml' '*.yml' || :)" != '' ]; then
 then
 	make VERBOSE="$verbose" txt-lint
 fi
-if [ "$( git diff --cached --name-only -- './openapi/openapi.yaml' || true )" != '' ]
+if [ "$(git diff --cached --name-only -- '*.go' '*.mod' 'Makefile' || :)" != '' ]; then
-then
+	make VERBOSE="$verbose" go-os-check go-lint go-test
 fi
 if [ "$(git diff --cached --name-only -- './openapi/openapi.yaml' || :)" != '' ]; then
 	make VERBOSE="$verbose" openapi-lint
 fi
--- a/scripts/install.sh
+++ b/scripts/install.sh
@ -9,8 +9,7 @@ set -e -f -u
 # Function log is an echo wrapper that writes to stderr if the caller
 # requested verbosity level greater than 0.  Otherwise, it does nothing.
 log() {
-	if [ "$verbose" -gt '0' ]
+	if [ "$verbose" -gt '0' ]; then
 	then
 		echo "$1" 1>&2
 	fi
 }
@ -27,7 +26,7 @@ error_exit() {
 #
 # TODO(e.burkov): Document each option.
 usage() {
-	echo 'install.sh: usage: [-c channel] [-C cpu_type] [-h] [-O os] [-o output_dir]'\
+	echo 'install.sh: usage: [-c channel] [-C cpu_type] [-h] [-O os] [-o output_dir]' \
 		'[-r|-R] [-u|-U] [-v|-V]' 1>&2
 	exit 2
@ -38,8 +37,7 @@ usage() {
 #
 # TODO(e.burkov):  Use everywhere the sudo_cmd isn't quoted.
 maybe_sudo() {
-	if [ "$use_sudo" -eq 0 ]
+	if [ "$use_sudo" -eq 0 ]; then
 	then
 		"$@"
 	else
 		"$sudo_cmd" "$@"
@ -64,8 +62,8 @@ is_little_endian() {
 	# explicitly implementation-defined in POSIX.  Use hexdump instead of od,
 	# because OpenWrt and its derivatives have the former but not the latter.
 	is_little_endian_result="$(
-		printf 'I'\
+		printf 'I' \
-			| hexdump -o\
+			| hexdump -o \
 			| awk '{ print substr($2, 6, 1); exit; }'
 	)"
 	readonly is_little_endian_result
@ -84,15 +82,14 @@ check_required() {
 	required_unix="tar"
 	readonly required_darwin required_unix
-	case "$os"
+	case "$os" in
-	in
+	'freebsd' | 'linux' | 'openbsd')
 	('freebsd'|'linux'|'openbsd')
 		required="$required_unix"
 		;;
-	('darwin')
+	'darwin')
 		required="$required_darwin"
 		;;
-	(*)
+	*)
 		# Generally shouldn't happen, since the OS has already been validated.
 		error_exit "unsupported operating system: '$os'"
 		;;
@ -100,11 +97,9 @@ check_required() {
 	readonly required
 	# Don't use quotes to get word splitting.
-	for cmd in $required
+	for cmd in $required; do
 	do
 		log "checking $cmd"
-		if ! is_command "$cmd"
+		if ! is_command "$cmd"; then
 		then
 			log "the full list of required software: [$required]"
 			error_exit "$cmd is required to install AdGuard Home via this script"
@ -114,57 +109,53 @@ check_required() {
 # Function check_out_dir requires the output directory to be set and exist.
 check_out_dir() {
-	if [ "$out_dir" = '' ]
+	if [ "$out_dir" = '' ]; then
 	then
 		error_exit 'output directory should be presented'
 	fi
-	if ! [ -d "$out_dir" ]
+	if ! [ -d "$out_dir" ]; then
 	then
 		log "$out_dir directory will be created"
 	fi
 }
 # Function parse_opts parses the options list and validates it's combinations.
 parse_opts() {
-	while getopts "C:c:hO:o:rRuUvV" opt "$@"
+	while getopts "C:c:hO:o:rRuUvV" opt "$@"; do
-	do
+		case "$opt" in
-		case "$opt"
+		C)
 		in
 		(C)
 			cpu="$OPTARG"
 			;;
-		(c)
+		c)
 			channel="$OPTARG"
 			;;
-		(h)
+		h)
 			usage
 			;;
-		(O)
+		O)
 			os="$OPTARG"
 			;;
-		(o)
+		o)
 			out_dir="$OPTARG"
 			;;
-		(R)
+		R)
 			reinstall='0'
 			;;
-		(U)
+		U)
 			uninstall='0'
 			;;
-		(r)
+		r)
 			reinstall='1'
 			;;
-		(u)
+		u)
 			uninstall='1'
 			;;
-		(V)
+		V)
 			verbose='0'
 			;;
-		(v)
+		v)
 			verbose='1'
 			;;
-		(*)
+		*)
 			log "bad option $OPTARG"
 			usage
@ -172,8 +163,7 @@ parse_opts() {
 		esac
 	done
-	if [ "$uninstall" -eq '1' ] && [ "$reinstall" -eq '1' ]
+	if [ "$uninstall" -eq '1' ] && [ "$reinstall" -eq '1' ]; then
 	then
 		error_exit 'the -r and -u options are mutually exclusive'
 	fi
 }
@ -181,14 +171,12 @@ parse_opts() {
 # Function set_channel sets the channel if needed and validates the value.
 set_channel() {
 	# Validate.
-	case "$channel"
+	case "$channel" in
-	in
+	'development' | 'edge' | 'beta' | 'release')
 	('development'|'edge'|'beta'|'release')
 		# All is well, go on.
 		;;
-	(*)
+	*)
-		error_exit \
+		error_exit "invalid channel '$channel'
 "invalid channel '$channel'
 supported values are 'development', 'edge', 'beta', and 'release'"
 		;;
 	esac
@ -200,36 +188,33 @@ supported values are 'development', 'edge', 'beta', and 'release'"
 # Function set_os sets the os if needed and validates the value.
 set_os() {
 	# Set if needed.
-	if [ "$os" = '' ]
+	if [ "$os" = '' ]; then
-	then
+		os="$(uname -s)"
-		os="$( uname -s )"
+		case "$os" in
-		case "$os"
+		'Darwin')
 		in
 		('Darwin')
 			os='darwin'
 			;;
-		('FreeBSD')
+		'FreeBSD')
 			os='freebsd'
 			;;
-		('Linux')
+		'Linux')
 			os='linux'
 			;;
-		('OpenBSD')
+		'OpenBSD')
 			os='openbsd'
 			;;
-		(*)
+		*)
 			error_exit "unsupported operating system: '$os'"
 			;;
 		esac
 	fi
 	# Validate.
-	case "$os"
+	case "$os" in
-	in
+	'darwin' | 'freebsd' | 'linux' | 'openbsd')
 	('darwin'|'freebsd'|'linux'|'openbsd')
 		# All right, go on.
 		;;
-	(*)
+	*)
 		error_exit "unsupported operating system: '$os'"
 		;;
 	esac
@ -241,52 +226,49 @@ set_os() {
 # Function set_cpu sets the cpu if needed and validates the value.
 set_cpu() {
 	# Set if needed.
-	if [ "$cpu" = '' ]
+	if [ "$cpu" = '' ]; then
-	then
+		cpu="$(uname -m)"
-		cpu="$( uname -m )"
+		case "$cpu" in
-		case "$cpu"
+		'x86_64' | 'x86-64' | 'x64' | 'amd64')
 		in
 		('x86_64'|'x86-64'|'x64'|'amd64')
 			cpu='amd64'
 			;;
-		('i386'|'i486'|'i686'|'i786'|'x86')
+		'i386' | 'i486' | 'i686' | 'i786' | 'x86')
 			cpu='386'
 			;;
-		('armv5l')
+		'armv5l')
 			cpu='armv5'
 			;;
-		('armv6l')
+		'armv6l')
 			cpu='armv6'
 			;;
-		('armv7l' | 'armv8l')
+		'armv7l' | 'armv8l')
 			cpu='armv7'
 			;;
-		('aarch64'|'arm64')
+		'aarch64' | 'arm64')
 			cpu='arm64'
 			;;
-		('mips'|'mips64')
+		'mips' | 'mips64')
-			if is_little_endian
+			if is_little_endian; then
 			then
 				cpu="${cpu}le"
 			fi
 			cpu="${cpu}_softfloat"
 			;;
-		(*)
+		*)
 			error_exit "unsupported cpu type: $cpu"
 			;;
 		esac
 	fi
 	# Validate.
-	case "$cpu"
+	case "$cpu" in
-	in
+	'amd64' | '386' | 'armv5' | 'armv6' | 'armv7' | 'arm64')
 	('amd64'|'386'|'armv5'|'armv6'|'armv7'|'arm64')
 		# All right, go on.
 		;;
-	('mips64le_softfloat'|'mips64_softfloat'|'mipsle_softfloat'|'mips_softfloat')
+	'mips64le_softfloat' | 'mips64_softfloat' | 'mipsle_softfloat' | 'mips_softfloat')
 		# That's right too.
 		;;
-	(*)
+	*)
 		error_exit "unsupported cpu type: $cpu"
 		;;
 	esac
@ -301,8 +283,7 @@ set_cpu() {
 #
 # See https://github.com/AdguardTeam/AdGuardHome/issues/2443.
 fix_darwin() {
-	if [ "$os" != 'darwin' ]
+	if [ "$os" != 'darwin' ]; then
 	then
 		return 0
 	fi
@ -317,16 +298,14 @@ fix_darwin() {
 # Function fix_freebsd performs some fixes to make it work on FreeBSD.
 fix_freebsd() {
-	if ! [ "$os" = 'freebsd' ]
+	if ! [ "$os" = 'freebsd' ]; then
 	then
 		return 0
 	fi
 	rcd='/usr/local/etc/rc.d'
 	readonly rcd
-	if ! [ -d "$rcd" ]
+	if ! [ -d "$rcd" ]; then
 	then
 		mkdir "$rcd"
 	fi
 }
@ -335,8 +314,7 @@ fix_freebsd() {
 # The second argument is optional and is the output file.
 download_curl() {
 	curl_output="${2:-}"
-	if [ "$curl_output" = '' ]
+	if [ "$curl_output" = '' ]; then
 	then
 		curl -L -S -s "$1"
 	else
 		curl -L -S -o "$curl_output" -s "$1"
@ -355,8 +333,7 @@ download_wget() {
 # URL.  The second argument is optional and is the output file.
 download_fetch() {
 	fetch_output="${2:-}"
-	if [ "$fetch_output" = '' ]
+	if [ "$fetch_output" = '' ]; then
 	then
 		fetch -o '-' "$1"
 	else
 		fetch -o "$fetch_output" "$1"
@ -366,15 +343,12 @@ download_fetch() {
 # Function set_download_func sets the appropriate function for downloading
 # files.
 set_download_func() {
-	if is_command 'curl'
+	if is_command 'curl'; then
 	then
 		# Go on and use the default, download_curl.
 		return 0
-	elif is_command 'wget'
+	elif is_command 'wget'; then
 	then
 		download_func='download_wget'
-	elif is_command 'fetch'
+	elif is_command 'fetch'; then
 	then
 		download_func='download_fetch'
 	else
 		error_exit "either curl or wget is required to install AdGuard Home via this script"
@ -384,15 +358,14 @@ set_download_func() {
 # Function set_sudo_cmd sets the appropriate command to run a command under
 # superuser privileges.
 set_sudo_cmd() {
-	case "$os"
+	case "$os" in
-	in
+	'openbsd')
 	('openbsd')
 		sudo_cmd='doas'
 		;;
-	('darwin'|'freebsd'|'linux')
+	'darwin' | 'freebsd' | 'linux')
 		# Go on and use the default, sudo.
 		;;
-	(*)
+	*)
 		error_exit "unsupported operating system: '$os'"
 		;;
 	esac
@ -418,22 +391,20 @@ configure() {
 # Function is_root checks for root privileges to be granted.
 is_root() {
-	if [ "$( id -u )" -eq '0' ]
+	user_id="$(id -u)"
-	then
+	if [ "$user_id" -eq '0' ]; then
 		log 'script is executed with root privileges'
 		return 0
 	fi
-	if is_command "$sudo_cmd"
+	if is_command "$sudo_cmd"; then
 	then
 		log 'note that AdGuard Home requires root privileges to install using this script'
 		return 1
 	fi
-	error_exit \
+	error_exit 'root privileges are required to install AdGuard Home using this script
 'root privileges are required to install AdGuard Home using this script
 please, restart it with root privileges'
 }
@ -443,25 +414,21 @@ please, restart it with root privileges'
 #
 # TODO(e.burkov): Try to avoid restarting.
 rerun_with_root() {
-	script_url=\
+	script_url='https://raw.githubusercontent.com/AdguardTeam/AdGuardHome/master/scripts/install.sh'
 'https://raw.githubusercontent.com/AdguardTeam/AdGuardHome/master/scripts/install.sh'
 	readonly script_url
 	r='-R'
-	if [ "$reinstall" -eq '1' ]
+	if [ "$reinstall" -eq '1' ]; then
 	then
 		r='-r'
 	fi
 	u='-U'
-	if [ "$uninstall" -eq '1' ]
+	if [ "$uninstall" -eq '1' ]; then
 	then
 		u='-u'
 	fi
 	v='-V'
-	if [ "$verbose" -eq '1' ]
+	if [ "$verbose" -eq '1' ]; then
 	then
 		v='-v'
 	fi
@ -473,7 +440,7 @@ rerun_with_root() {
 	# producing any output, the latter prints an exit command for the following
 	# shell to execute to prevent it from getting an empty input and exiting
 	# with a zero code in that case.
-	{ "$download_func" "$script_url" || echo 'exit 1'; }\
+	{ "$download_func" "$script_url" || echo 'exit 1'; } \
 		| $sudo_cmd sh -s -- -c "$channel" -C "$cpu" -O "$os" -o "$out_dir" "$r" "$u" "$v"
 	# Exit the script.  Since if the code of the previous pipeline is non-zero,
@ -484,10 +451,9 @@ rerun_with_root() {
 # Function download downloads the file from the URL and saves it to the
 # specified filepath.
 download() {
-	log "downloading package from $url -> $pkg_name"
+	log "downloading package from $url to $pkg_name"
-	if ! "$download_func" "$url" "$pkg_name"
+	if ! "$download_func" "$url" "$pkg_name"; then
 	then
 		error_exit "cannot download the package from $url into $pkg_name"
 	fi
@ -497,25 +463,29 @@ download() {
 # Function unpack unpacks the passed archive depending on it's extension.
 unpack() {
 	log "unpacking package from $pkg_name into $out_dir"
-	if ! mkdir -m 0700 -p "$out_dir"
+
-	then
+	# shellcheck disable=SC2174
 	if ! mkdir -m 0700 -p "$out_dir"; then
 		error_exit "cannot create directory $out_dir"
 	fi
-	case "$pkg_ext"
+	case "$pkg_ext" in
-	in
+	'zip')
 	('zip')
 		unzip "$pkg_name" -d "$out_dir"
 		;;
-	('tar.gz')
+	'tar.gz')
 		tar -C "$out_dir" -f "$pkg_name" -x -z
 		;;
-	(*)
+	*)
 		error_exit "unexpected package extension: '$pkg_ext'"
 		;;
 	esac
-	log "successfully unpacked, contents: $( echo; ls -l -A "$agh_dir" )"
+	unpacked_contents="$(
 		echo
 		ls -l -A "$agh_dir"
 	)"
 	log "successfully unpacked, contents: $unpacked_contents"
 	rm "$pkg_name"
 }
@ -523,34 +493,29 @@ unpack() {
 # Function handle_existing detects the existing AGH installation and takes care
 # of removing it if needed.
 handle_existing() {
-	if ! [ -d "$agh_dir" ]
+	if ! [ -d "$agh_dir" ]; then
 	then
 		log 'no need to uninstall'
-		if [ "$uninstall" -eq '1' ]
+		if [ "$uninstall" -eq '1' ]; then
 		then
 			exit 0
 		fi
 		return 0
 	fi
-	if [ "$( ls -1 -A "$agh_dir" )" != '' ]
+	existing_adguard_home="$(ls -1 -A "$agh_dir")"
-	then
+	if [ "$existing_adguard_home" != '' ]; then
 		log 'the existing AdGuard Home installation is detected'
-		if [ "$reinstall" -ne '1' ] && [ "$uninstall" -ne '1' ]
+		if [ "$reinstall" -ne '1' ] && [ "$uninstall" -ne '1' ]; then
 		then
 			error_exit \
-"to reinstall/uninstall the AdGuard Home using this script specify one of the '-r' or '-u' flags"
+				"to reinstall/uninstall the AdGuard Home using this script specify one of the '-r' or '-u' flags"
 		fi
 		# TODO(e.burkov):  Remove the stop once v0.107.1 released.
-		if ( cd "$agh_dir" && ! ./AdGuardHome -s stop || ! ./AdGuardHome -s uninstall )
+		if (cd "$agh_dir" && ! ./AdGuardHome -s stop || ! ./AdGuardHome -s uninstall); then
-		then
+			# It doesn't terminate the script since it is possible that AGH just
-			# It doesn't terminate the script since it is possible
+			# not installed as service but appearing in the directory.
 			# that AGH just not installed as service but appearing
 			# in the directory.
 			log "cannot uninstall AdGuard Home from $agh_dir"
 		fi
@ -559,8 +524,7 @@ handle_existing() {
 		log 'AdGuard Home was successfully uninstalled'
 	fi
-	if [ "$uninstall" -eq '1' ]
+	if [ "$uninstall" -eq '1' ]; then
 	then
 		exit 0
 	fi
 }
@ -569,13 +533,11 @@ handle_existing() {
 install_service() {
 	# Installing the service as root is required at least on FreeBSD.
 	use_sudo='0'
-	if [ "$os" = 'freebsd' ]
+	if [ "$os" = 'freebsd' ]; then
 	then
 		use_sudo='1'
 	fi
-	if ( cd "$agh_dir" && maybe_sudo ./AdGuardHome -s install )
+	if (cd "$agh_dir" && maybe_sudo ./AdGuardHome -s install); then
 	then
 		return 0
 	fi
@ -583,13 +545,11 @@ install_service() {
 	rm -r "$agh_dir"
-	# Some devices detected to have armv7 CPU face the compatibility
+	# Some devices detected to have armv7 CPU face the compatibility issues with
-	# issues with actual armv7 builds.  We should try to install the
+	# actual armv7 builds.  We should try to install the armv5 binary instead.
 	# armv5 binary instead.
 	#
 	# See https://github.com/AdguardTeam/AdGuardHome/issues/2542.
-	if [ "$cpu" = 'armv7' ]
+	if [ "$cpu" = 'armv7' ]; then
 	then
 		cpu='armv5'
 		reinstall='1'
@ -601,8 +561,6 @@ install_service() {
 	error_exit 'cannot install AdGuardHome as a service'
 }
 # Entrypoint
 # Set default values of configuration variables.
@ -624,8 +582,7 @@ echo 'starting AdGuard Home installation script'
 configure
 check_required
-if ! is_root
+if ! is_root; then
 then
 	rerun_with_root
 fi
 # Needs rights.
@ -638,7 +595,7 @@ unpack
 install_service
-echo "\
+printf '%s\n' \
-AdGuard Home is now installed and running
+	'AdGuard Home is now installed and running' \
-you can control the service status with the following commands:
+	'you can control the service status with the following commands:' \
-$sudo_cmd ${agh_dir}/AdGuardHome -s start|stop|restart|status|install|uninstall"
+	"$sudo_cmd ${agh_dir}/AdGuardHome -s start|stop|restart|status|install|uninstall"
--- a/scripts/make/build-docker.sh
+++ b/scripts/make/build-docker.sh
@ -15,7 +15,7 @@ set -e -f -u
 # Require these to be set.  The channel value is validated later.
 channel="${CHANNEL:?please set CHANNEL}"
-commit="${COMMIT:?please set COMMIT}"
+commit="${REVISION:?please set REVISION}"
 dist_dir="${DIST_DIR:?please set DIST_DIR}"
 readonly channel commit dist_dir
--- a/scripts/make/clean.sh
+++ b/scripts/make/clean.sh
@ -1,29 +0,0 @@
 #!/bin/sh
 verbose="${VERBOSE:-0}"
 readonly verbose
 if [ "$verbose" -gt '0' ]
 then
 	set -x
 fi
 set -e -f -u
 dist_dir="${DIST_DIR:?please set DIST_DIR}"
 sudo_cmd="${SUDO:-}"
 readonly dist_dir sudo_cmd
 $sudo_cmd rm -f\
 	./AdGuardHome\
 	./AdGuardHome.exe\
 	./coverage.txt\
 	;
 $sudo_cmd rm -f -r\
 	./bin/\
 	./build/static/\
 	./client/node_modules/\
 	./data/\
 	"./${dist_dir}/"\
 	;
--- a/scripts/make/go-bench.sh
+++ b/scripts/make/go-bench.sh
@ -7,13 +7,11 @@ readonly verbose
 #   0 = Don't print anything except for errors.
 #   1 = Print commands, but not nested commands.
 #   2 = Print everything.
-if [ "$verbose" -gt '1' ]
+if [ "$verbose" -gt '1' ]; then
 then
 	set -x
 	v_flags='-v=1'
 	x_flags='-x=1'
-elif [ "$verbose" -gt '0' ]
+elif [ "$verbose" -gt '0' ]; then
 then
 	set -x
 	v_flags='-v=1'
 	x_flags='-x=0'
@ -26,8 +24,7 @@ readonly v_flags x_flags
 set -e -f -u
-if [ "${RACE:-1}" -eq '0' ]
+if [ "${RACE:-1}" -eq '0' ]; then
 then
 	race_flags='--race=0'
 else
 	race_flags='--race=1'
@ -36,20 +33,20 @@ readonly race_flags
 go="${GO:-go}"
-count_flags='--count=1'
+count_flags='--count=2'
 shuffle_flags='--shuffle=on'
 timeout_flags="${TIMEOUT_FLAGS:---timeout=30s}"
 readonly go count_flags shuffle_flags timeout_flags
-"$go" test\
+"$go" test \
-	"$count_flags"\
+	"$count_flags" \
-	"$shuffle_flags"\
+	"$shuffle_flags" \
-	"$race_flags"\
+	"$race_flags" \
-	"$timeout_flags"\
+	"$timeout_flags" \
-	"$x_flags"\
+	"$x_flags" \
-	"$v_flags"\
+	"$v_flags" \
-	--bench='.'\
+	--bench='.' \
-	--benchmem\
+	--benchmem \
-	--benchtime=1s\
+	--benchtime='1s' \
-	--run='^$'\
+	--run='^$' \
 	./...
--- a/scripts/make/go-build.sh
+++ b/scripts/make/go-build.sh
@ -9,7 +9,7 @@
 # This comment is used to simplify checking local copies of the script.  Bump
 # this number every time a significant change is made to this script.
 #
-# AdGuard-Project-Version: 1
+# AdGuard-Project-Version: 2
 # The default verbosity level is 0.  Show every command that is run and every
 # package that is processed if the caller requested verbosity level greater than
@ -18,14 +18,12 @@
 verbose="${VERBOSE:-0}"
 readonly verbose
-if [ "$verbose" -gt '1' ]
+if [ "$verbose" -gt '1' ]; then
 then
 	env
 	set -x
 	v_flags='-v=1'
 	x_flags='-x=1'
-elif [ "$verbose" -gt '0' ]
+elif [ "$verbose" -gt '0' ]; then
 then
 	set -x
 	v_flags='-v=1'
 	x_flags='-x=0'
@ -49,13 +47,12 @@ readonly go
 channel="${CHANNEL:?please set CHANNEL}"
 readonly channel
-case "$channel"
+case "$channel" in
-in
+'development' | 'edge' | 'beta' | 'release' | 'candidate')
 ('development'|'edge'|'beta'|'release'|'candidate')
 	# All is well, go on.
 	;;
-(*)
+*)
-	echo "invalid channel '$channel', supported values are\
+	echo "invalid channel '$channel', supported values are \
 		'development', 'edge', 'beta', 'release', and 'candidate'" 1>&2
 	exit 1
 	;;
@ -64,14 +61,13 @@ esac
 # Check VERSION against the default value from the Makefile.  If it is that, use
 # the version calculation script.
 version="${VERSION:-}"
-if [ "$version" = 'v0.0.0' ] || [ "$version" = '' ]
+if [ "$version" = 'v0.0.0' ] || [ "$version" = '' ]; then
-then
+	version="$(sh ./scripts/make/version.sh)"
 	version="$( sh ./scripts/make/version.sh )"
 fi
 readonly version
 # Set date and time of the latest commit unless already set.
-committime="${SOURCE_DATE_EPOCH:-$( git log -1 --pretty=%ct )}"
+committime="${SOURCE_DATE_EPOCH:-$(git log -1 --pretty=%ct)}"
 readonly committime
 # Set the linker flags accordingly: set the release channel and the current
@ -84,11 +80,9 @@ ldflags="-s -w"
 ldflags="${ldflags} -X ${version_pkg}.version=${version}"
 ldflags="${ldflags} -X ${version_pkg}.channel=${channel}"
 ldflags="${ldflags} -X ${version_pkg}.committime=${committime}"
-if [ "${GOARM:-}" != '' ]
+if [ "${GOARM:-}" != '' ]; then
 then
 	ldflags="${ldflags} -X ${version_pkg}.goarm=${GOARM}"
-elif [ "${GOMIPS:-}" != '' ]
+elif [ "${GOMIPS:-}" != '' ]; then
 then
 	ldflags="${ldflags} -X ${version_pkg}.gomips=${GOMIPS}"
 fi
 readonly ldflags
@ -99,9 +93,8 @@ readonly parallelism
 # Use GOFLAGS for -p, because -p=0 simply disables the build instead of leaving
 # the default value.
-if [ "${parallelism}" != '' ]
+if [ "${parallelism}" != '' ]; then
-then
+	GOFLAGS="${GOFLAGS:-} -p=${parallelism}"
        GOFLAGS="${GOFLAGS:-} -p=${parallelism}"
 fi
 readonly GOFLAGS
 export GOFLAGS
@ -115,8 +108,7 @@ readonly o_flags
 # Allow users to enable the race detector.  Unfortunately, that means that cgo
 # must be enabled.
-if [ "${RACE:-0}" -eq '0' ]
+if [ "${RACE:-0}" -eq '0' ]; then
 then
 	CGO_ENABLED='0'
 	race_flags='--race=0'
 else
@ -130,24 +122,23 @@ GO111MODULE='on'
 export GO111MODULE
 # Build the new binary if requested.
-if [ "${NEXTAPI:-0}" -eq '0' ]
+if [ "${NEXTAPI:-0}" -eq '0' ]; then
 then
 	tags_flags='--tags='
 else
 	tags_flags='--tags=next'
 fi
 readonly tags_flags
-if [ "$verbose" -gt '0' ]
+if [ "$verbose" -gt '0' ]; then
 then
 	"$go" env
 fi
-"$go" build\
+"$go" build \
-	--ldflags="$ldflags"\
+	--ldflags="$ldflags" \
-	"$race_flags"\
+	"$race_flags" \
-	"$tags_flags"\
+	"$tags_flags" \
-	--trimpath\
+	--trimpath \
-	"$o_flags"\
+	"$o_flags" \
-	"$v_flags"\
+	"$v_flags" \
-	"$x_flags"
+	"$x_flags" \
 	;
--- a/scripts/make/go-deps.sh
+++ b/scripts/make/go-deps.sh
@ -3,18 +3,16 @@
 # This comment is used to simplify checking local copies of the script.  Bump
 # this number every time a significant change is made to this script.
 #
-# AdGuard-Project-Version: 1
+# AdGuard-Project-Version: 2
 verbose="${VERBOSE:-0}"
 readonly verbose
-if [ "$verbose" -gt '1' ]
+if [ "$verbose" -gt '1' ]; then
 then
 	env
 	set -x
 	x_flags='-x=1'
-elif [ "$verbose" -gt '0' ]
+elif [ "$verbose" -gt '0' ]; then
 then
 	set -x
 	x_flags='-x=0'
 else
--- a/scripts/make/go-fuzz.sh
+++ b/scripts/make/go-fuzz.sh
@ -7,13 +7,11 @@ readonly verbose
 #   0 = Don't print anything except for errors.
 #   1 = Print commands, but not nested commands.
 #   2 = Print everything.
-if [ "$verbose" -gt '1' ]
+if [ "$verbose" -gt '1' ]; then
 then
 	set -x
 	v_flags='-v=1'
 	x_flags='-x=1'
-elif [ "$verbose" -gt '0' ]
+elif [ "$verbose" -gt '0' ]; then
 then
 	set -x
 	v_flags='-v=1'
 	x_flags='-x=0'
@ -26,8 +24,7 @@ readonly v_flags x_flags
 set -e -f -u
-if [ "${RACE:-1}" -eq '0' ]
+if [ "${RACE:-1}" -eq '0' ]; then
 then
 	race_flags='--race=0'
 else
 	race_flags='--race=1'
@ -36,7 +33,7 @@ readonly race_flags
 go="${GO:-go}"
-count_flags='--count=1'
+count_flags='--count=2'
 shuffle_flags='--shuffle=on'
 timeout_flags="${TIMEOUT_FLAGS:---timeout=30s}"
 fuzztime_flags="${FUZZTIME_FLAGS:---fuzztime=20s}"
@ -44,15 +41,15 @@ fuzztime_flags="${FUZZTIME_FLAGS:---fuzztime=20s}"
 readonly go count_flags shuffle_flags timeout_flags fuzztime_flags
 # TODO(a.garipov): File an issue about using --fuzz with multiple packages.
-"$go" test\
+"$go" test \
-	"$count_flags"\
+	"$count_flags" \
-	"$shuffle_flags"\
+	"$shuffle_flags" \
-	"$race_flags"\
+	"$race_flags" \
-	"$timeout_flags"\
+	"$timeout_flags" \
-	"$x_flags"\
+	"$x_flags" \
-	"$v_flags"\
+	"$v_flags" \
-	"$fuzztime_flags"\
+	"$fuzztime_flags" \
-	--fuzz='.'\
+	--fuzz='.' \
-	--run='^$'\
+	--run='^$' \
-	./internal/filtering/rulelist/\
+	./internal/filtering/rulelist/ \
 	;
--- a/scripts/make/go-lint.sh
+++ b/scripts/make/go-lint.sh
@ -3,19 +3,17 @@
 # This comment is used to simplify checking local copies of the script.  Bump
 # this number every time a significant change is made to this script.
 #
-# AdGuard-Project-Version: 8
+# AdGuard-Project-Version: 13
 verbose="${VERBOSE:-0}"
 readonly verbose
-if [ "$verbose" -gt '0' ]
+if [ "$verbose" -gt '0' ]; then
 then
 	set -x
 fi
 # Set $EXIT_ON_ERROR to zero to see all errors.
-if [ "${EXIT_ON_ERROR:-1}" -eq '0' ]
+if [ "${EXIT_ON_ERROR:-1}" -eq '0' ]; then
 then
 	set +e
 else
 	set -e
@ -23,23 +21,26 @@ fi
 set -f -u
 # Source the common helpers, including not_found and run_linter.
 . ./scripts/make/helper.sh
 # Simple analyzers
 # blocklist_imports is a simple check against unwanted packages.  The following
 # packages are banned:
 #
 #   *  Package errors is replaced by our own package in the
-#      github.com/AdguardTeam/golibs module.
+#   github.com/AdguardTeam/golibs module.
 #
-#   *  Packages golang.org/x/exp/slices and golang.org/x/net/context have been
+#   *  Packages log and github.com/AdguardTeam/golibs/log are replaced by
-#      moved into stdlib.
+#      stdlib's new package log/slog and AdGuard's new utilities package
 #      github.com/AdguardTeam/golibs/logutil/slogutil.
 #
 #   *  Package github.com/prometheus/client_golang/prometheus/promauto is not
 #      recommended, as it encourages reliance on global state.
 #
 #   *  Packages golang.org/x/exp/maps, golang.org/x/exp/slices, and
 #      golang.org/x/net/context have been moved into stdlib.
 #
 #   *  Package io/ioutil is soft-deprecated.
 #
@ -54,48 +55,60 @@ set -f -u
 #
 #   *  Package unsafe is… unsafe.
 #
-# If your project needs more exceptions, add and document them.  Currently,
+# Currently, the only standard exception are files generated from protobuf
-# there are only two standard exceptions:
+# schemas, which use package reflect.  If your project needs more exceptions,
 # add and document them.
 #
-#   *  Files generated from protobuf schemas, which use package reflect.
+# NOTE:  Flag -H for grep is non-POSIX but all of Busybox, GNU, macOS, and
 # OpenBSD support it.
 #
-#   *  Windows-specific code caused by golang.org/x/sys/windows API design.
+# NOTE:  Exclude the permission_windows.go, because it requires unsafe for the
 # OS APIs.
 #
 # TODO(a.garipov): Add golibs/log.
 #
 # TODO(a.garipov): Add deprecated package golang.org/x/exp/maps once all
 # projects switch to Go 1.23.
 blocklist_imports() {
-	git grep\
+	find . \
-		-e '[[:space:]]"errors"$'\
+		-type 'f' \
-		-e '[[:space:]]"golang.org/x/exp/slices"$'\
+		-name '*.go' \
-		-e '[[:space:]]"golang.org/x/net/context"$'\
+		'!' '(' \
-		-e '[[:space:]]"io/ioutil"$'\
+		-name '*.pb.go' \
-		-e '[[:space:]]"log"$'\
+		-o -path './internal/aghos/permission_windows.go' \
-		-e '[[:space:]]"reflect"$'\
+		')' \
-		-e '[[:space:]]"sort"$'\
+		-exec \
-		-e '[[:space:]]"unsafe"$'\
+		'grep' \
-		-n\
+		'-H' \
-		-- '*.go'\
+		'-e' '[[:space:]]"errors"$' \
-		':!*.pb.go'\
+		'-e' '[[:space:]]"github.com/prometheus/client_golang/prometheus/promauto"$' \
-		':!./internal/aghos/permission_windows.go'\
+		'-e' '[[:space:]]"golang.org/x/exp/maps"$' \
-		| sed -e 's/^\([^[:space:]]\+\)\(.*\)$/\1 blocked import:\2/'\
+		'-e' '[[:space:]]"golang.org/x/exp/slices"$' \
-		|| exit 0
+		'-e' '[[:space:]]"golang.org/x/net/context"$' \
 		'-e' '[[:space:]]"io/ioutil"$' \
 		'-e' '[[:space:]]"log"$' \
 		'-e' '[[:space:]]"reflect"$' \
 		'-e' '[[:space:]]"sort"$' \
 		'-e' '[[:space:]]"unsafe"$' \
 		'-n' \
 		'{}' \
 		';'
 }
 # method_const is a simple check against the usage of some raw strings and
 # numbers where one should use named constants.
 method_const() {
-	git grep -F\
+	find . \
-		-e '"DELETE"'\
+		-type 'f' \
-		-e '"GET"'\
+		-name '*.go' \
-		-e '"PATCH"'\
+		-exec \
-		-e '"POST"'\
+		'grep' \
-		-e '"PUT"'\
+		'-H' \
-		-n\
+		'-e' '"DELETE"' \
-		-- '*.go'\
+		'-e' '"GET"' \
-		| sed -e 's/^\([^[:space:]]\+\)\(.*\)$/\1 http method literal:\2/'\
+		'-e' '"PATCH"' \
-		|| exit 0
+		'-e' '"POST"' \
 		'-e' '"PUT"' \
 		'-n' \
 		'{}' \
 		';'
 }
 # underscores is a simple check against Go filenames with underscores.  Add new
@ -103,35 +116,34 @@ method_const() {
 # use of filenames like client_manager.go.
 underscores() {
 	underscore_files="$(
-		git ls-files '*_*.go'\
+		find . \
-			| grep -F\
+			-type 'f' \
-			-e '_bsd.go'\
+			-name '*_*.go' \
-			-e '_darwin.go'\
+			'!' '(' -name '*_bsd.go' \
-			-e '_freebsd.go'\
+			-o -name '*_darwin.go' \
-			-e '_generate.go'\
+			-o -name '*_freebsd.go' \
-			-e '_linux.go'\
+			-o -name '*_generate.go' \
-			-e '_next.go'\
+			-o -name '*_linux.go' \
-			-e '_openbsd.go'\
+			-o -name '*_next.go' \
-			-e '_others.go'\
+			-o -name '*_openbsd.go' \
-			-e '_test.go'\
+			-o -name '*_others.go' \
-			-e '_unix.go'\
+			-o -name '*_test.go' \
-			-e '_windows.go'\
+			-o -name '*_unix.go' \
-			-v\
+			-o -name '*_windows.go' \
-			| sed -e 's/./\t\0/'
+			')' \
 			-exec 'printf' '\t%s\n' '{}' ';'
 	)"
 	readonly underscore_files
-	if [ "$underscore_files" != '' ]
+	if [ "$underscore_files" != '' ]; then
-	then
+		printf \
-		echo 'found file names with underscores:'
+			'found file names with underscores:\n%s\n' \
-		echo "$underscore_files"
+			"$underscore_files"
 	fi
 }
 # TODO(a.garipov): Add an analyzer to look for `fallthrough`, `goto`, and `new`?
 # Checks
 run_linter -e blocklist_imports
@ -142,8 +154,6 @@ run_linter -e underscores
 run_linter -e gofumpt --extra -e -l .
 # TODO(a.garipov): golint is deprecated, find a suitable replacement.
 run_linter "${GO:-go}" vet ./...
 run_linter govulncheck ./...
@ -151,129 +161,138 @@ run_linter govulncheck ./...
 run_linter gocyclo --over 10 .
 # TODO(a.garipov): Enable 10 for all.
-run_linter gocognit --over='20'\
+run_linter gocognit --over='20' \
-	./internal/querylog/\
+	./internal/querylog/ \
 	;
-run_linter gocognit --over='19'\
+run_linter gocognit --over='19' \
-	./internal/home/\
+	./internal/home/ \
 	;
-run_linter gocognit --over='18'\
+run_linter gocognit --over='18' \
-	./internal/aghtls/\
+	./internal/aghtls/ \
 	;
-run_linter gocognit --over='15'\
+run_linter gocognit --over='15' \
-	./internal/aghos/\
+	./internal/aghos/ \
-	./internal/filtering/\
+	./internal/filtering/ \
 	;
-run_linter gocognit --over='14'\
+run_linter gocognit --over='14' \
-	./internal/dhcpd\
+	./internal/dhcpd \
 	;
-run_linter gocognit --over='13'\
+run_linter gocognit --over='13' \
-	./internal/aghnet/\
+	./internal/aghnet/ \
 	;
-run_linter gocognit --over='12'\
+run_linter gocognit --over='12' \
-	./internal/filtering/rewrite/\
+	./internal/filtering/rewrite/ \
 	;
-run_linter gocognit --over='11'\
+run_linter gocognit --over='11' \
-	./internal/updater/\
+	./internal/updater/ \
 	;
-run_linter gocognit --over='10'\
+run_linter gocognit --over='10' \
-	./internal/aghalg/\
+	./internal/aghalg/ \
-	./internal/aghhttp/\
+	./internal/aghhttp/ \
-	./internal/aghrenameio/\
+	./internal/aghrenameio/ \
-	./internal/aghtest/\
+	./internal/aghtest/ \
-	./internal/arpdb/\
+	./internal/arpdb/ \
-	./internal/client/\
+	./internal/client/ \
-	./internal/configmigrate/\
+	./internal/configmigrate/ \
-	./internal/dhcpsvc\
+	./internal/dhcpsvc \
-	./internal/dnsforward/\
+	./internal/dnsforward/ \
-	./internal/filtering/hashprefix/\
+	./internal/filtering/hashprefix/ \
-	./internal/filtering/rulelist/\
+	./internal/filtering/rulelist/ \
-	./internal/filtering/safesearch/\
+	./internal/filtering/safesearch/ \
-	./internal/ipset\
+	./internal/ipset \
-	./internal/next/\
+	./internal/next/ \
-	./internal/rdns/\
+	./internal/rdns/ \
-	./internal/schedule/\
+	./internal/schedule/ \
-	./internal/stats/\
+	./internal/stats/ \
-	./internal/tools/\
+	./internal/tools/ \
-	./internal/version/\
+	./internal/version/ \
-	./internal/whois/\
+	./internal/whois/ \
-	./scripts/\
+	./scripts/ \
 	;
 run_linter ineffassign ./...
 run_linter unparam ./...
-git ls-files -- 'Makefile' '*.conf' '*.go' '*.mod' '*.sh' '*.yaml' '*.yml'\
+find . \
-	| xargs misspell --error\
+	-type 'f' \
-	| sed -e 's/^/misspell: /'
+	'(' \
 	-name 'Makefile' \
 	-o -name '*.conf' \
 	-o -name '*.go' \
 	-o -name '*.mod' \
 	-o -name '*.sh' \
 	-o -name '*.yaml' \
 	-o -name '*.yml' \
 	')' \
 	-exec 'misspell' '--error' '{}' '+'
 run_linter nilness ./...
 # TODO(a.garipov): Enable for all.
 run_linter fieldalignment \
-	./internal/aghalg/\
+	./internal/aghalg/ \
-	./internal/aghhttp/\
+	./internal/aghhttp/ \
-	./internal/aghos/\
+	./internal/aghos/ \
-	./internal/aghrenameio/\
+	./internal/aghrenameio/ \
-	./internal/aghtest/\
+	./internal/aghtest/ \
-	./internal/aghtls/\
+	./internal/aghtls/ \
-	./internal/arpdb/\
+	./internal/arpdb/ \
-	./internal/client/\
+	./internal/client/ \
-	./internal/configmigrate/\
+	./internal/configmigrate/ \
-	./internal/dhcpsvc/\
+	./internal/dhcpsvc/ \
-	./internal/filtering/hashprefix/\
+	./internal/filtering/hashprefix/ \
-	./internal/filtering/rewrite/\
+	./internal/filtering/rewrite/ \
-	./internal/filtering/rulelist/\
+	./internal/filtering/rulelist/ \
-	./internal/filtering/safesearch/\
+	./internal/filtering/safesearch/ \
-	./internal/ipset/\
+	./internal/ipset/ \
-	./internal/next/...\
+	./internal/next/... \
-	./internal/querylog/\
+	./internal/querylog/ \
-	./internal/rdns/\
+	./internal/rdns/ \
-	./internal/schedule/\
+	./internal/schedule/ \
-	./internal/stats/\
+	./internal/stats/ \
-	./internal/updater/\
+	./internal/updater/ \
-	./internal/version/\
+	./internal/version/ \
-	./internal/whois/\
+	./internal/whois/ \
 	;
 run_linter -e shadow --strict ./...
 # TODO(a.garipov): Enable for all.
 # TODO(e.burkov):  Re-enable G115.
-run_linter gosec --exclude G115 --quiet\
+run_linter gosec --exclude G115 --quiet \
-	./internal/aghalg/\
+	./internal/aghalg/ \
-	./internal/aghhttp/\
+	./internal/aghhttp/ \
-	./internal/aghnet/\
+	./internal/aghnet/ \
-	./internal/aghos/\
+	./internal/aghos/ \
-	./internal/aghrenameio/\
+	./internal/aghrenameio/ \
-	./internal/aghtest/\
+	./internal/aghtest/ \
-	./internal/arpdb/\
+	./internal/arpdb/ \
-	./internal/client/\
+	./internal/client/ \
-	./internal/configmigrate/\
+	./internal/configmigrate/ \
-	./internal/dhcpd/\
+	./internal/dhcpd/ \
-	./internal/dhcpsvc/\
+	./internal/dhcpsvc/ \
-	./internal/dnsforward/\
+	./internal/dnsforward/ \
-	./internal/filtering/hashprefix/\
+	./internal/filtering/hashprefix/ \
-	./internal/filtering/rewrite/\
+	./internal/filtering/rewrite/ \
-	./internal/filtering/rulelist/\
+	./internal/filtering/rulelist/ \
-	./internal/filtering/safesearch/\
+	./internal/filtering/safesearch/ \
-	./internal/ipset/\
+	./internal/ipset/ \
-	./internal/next/\
+	./internal/next/ \
-	./internal/rdns/\
+	./internal/rdns/ \
-	./internal/schedule/\
+	./internal/schedule/ \
-	./internal/stats/\
+	./internal/stats/ \
-	./internal/tools/\
+	./internal/tools/ \
-	./internal/version/\
+	./internal/version/ \
-	./internal/whois/\
+	./internal/whois/ \
 	;
 run_linter errcheck ./...
@ -287,4 +306,4 @@ windows: GOOS=windows
 '
 readonly staticcheck_matrix
-echo "$staticcheck_matrix" | run_linter staticcheck --matrix ./...
+printf '%s' "$staticcheck_matrix" | run_linter staticcheck --matrix ./...
--- a/scripts/make/go-test.sh
+++ b/scripts/make/go-test.sh
@ -3,7 +3,7 @@
 # This comment is used to simplify checking local copies of the script.  Bump
 # this number every time a significant change is made to this script.
 #
-# AdGuard-Project-Version: 1
+# AdGuard-Project-Version: 6
 verbose="${VERBOSE:-0}"
 readonly verbose
@ -12,13 +12,11 @@ readonly verbose
 #   0 = Don't print anything except for errors.
 #   1 = Print commands, but not nested commands.
 #   2 = Print everything.
-if [ "$verbose" -gt '1' ]
+if [ "$verbose" -gt '1' ]; then
 then
 	set -x
 	v_flags='-v=1'
 	x_flags='-x=1'
-elif [ "$verbose" -gt '0' ]
+elif [ "$verbose" -gt '0' ]; then
 then
 	set -x
 	v_flags='-v=1'
 	x_flags='-x=0'
@ -31,29 +29,54 @@ readonly v_flags x_flags
 set -e -f -u
-if [ "${RACE:-1}" -eq '0' ]
+if [ "${RACE:-1}" -eq '0' ]; then
 then
 	race_flags='--race=0'
 else
 	race_flags='--race=1'
 fi
 readonly race_flags
 count_flags='--count=2'
 cover_flags='--coverprofile=./cover.out'
 go="${GO:-go}"
 readonly go
 count_flags='--count=1'
 cover_flags='--coverprofile=./coverage.txt'
 shuffle_flags='--shuffle=on'
 timeout_flags="${TIMEOUT_FLAGS:---timeout=90s}"
-readonly count_flags cover_flags shuffle_flags timeout_flags
+readonly count_flags cover_flags go shuffle_flags timeout_flags
-"$go" test\
+go_test() {
-	"$count_flags"\
+	"$go" test \
-	"$cover_flags"\
+		"$count_flags" \
-	"$race_flags"\
+		"$cover_flags" \
-	"$shuffle_flags"\
+		"$race_flags" \
-	"$timeout_flags"\
+		"$shuffle_flags" \
-	"$v_flags"\
+		"$timeout_flags" \
-	"$x_flags"\
+		"$v_flags" \
-	./...
+		"$x_flags" \
 		./...
 }
 test_reports_dir="${TEST_REPORTS_DIR:-}"
 readonly test_reports_dir
 if [ "$test_reports_dir" = '' ]; then
 	go_test
 	exit "$?"
 fi
 mkdir -p "$test_reports_dir"
 # NOTE:  The pipe ignoring the exit code here is intentional, as go-junit-report
 # will set the exit code to be saved.
 go_test 2>&1 \
 	| tee "${test_reports_dir}/test-output.txt"
 # Don't fail on errors in exporting, because TEST_REPORTS_DIR is generally only
 # not empty in CI, and so the exit code must be preserved to exit with it later.
 set +e
 go-junit-report \
 	--in "${test_reports_dir}/test-output.txt" \
 	--set-exit-code \
 	>"${test_reports_dir}/test-report.xml"
 printf '%s\n' "$?" \
 	>"${test_reports_dir}/test-exit-code.txt"
--- a/scripts/make/go-tools.sh
+++ b/scripts/make/go-tools.sh
@ -3,18 +3,16 @@
 # This comment is used to simplify checking local copies of the script.  Bump
 # this number every time a significant change is made to this script.
 #
-# AdGuard-Project-Version: 4
+# AdGuard-Project-Version: 6
 verbose="${VERBOSE:-0}"
 readonly verbose
-if [ "$verbose" -gt '1' ]
+if [ "$verbose" -gt '1' ]; then
 then
 	set -x
 	v_flags='-v=1'
 	x_flags='-x=1'
-elif [ "$verbose" -gt '0' ]
+elif [ "$verbose" -gt '0' ]; then
 then
 	set -x
 	v_flags='-v=1'
 	x_flags='-x=0'
@ -33,45 +31,49 @@ readonly go
 # Remove only the actual binaries in the bin/ directory, as developers may add
 # their own scripts there.  Most commonly, a script named “go” for tools that
 # call the go binary and need a particular version.
-rm -f\
+rm -f \
-	bin/errcheck\
+	bin/errcheck \
-	bin/fieldalignment\
+	bin/fieldalignment \
-	bin/gocognit\
+	bin/go-junit-report \
-	bin/gocyclo\
+	bin/gocognit \
-	bin/gofumpt\
+	bin/gocyclo \
-	bin/gosec\
+	bin/gofumpt \
-	bin/govulncheck\
+	bin/gosec \
-	bin/ineffassign\
+	bin/govulncheck \
-	bin/misspell\
+	bin/ineffassign \
-	bin/nilness\
+	bin/misspell \
-	bin/shadow\
+	bin/nilness \
-	bin/staticcheck\
+	bin/shadow \
-	bin/unparam\
+	bin/shfmt \
 	bin/staticcheck \
 	bin/unparam \
 	;
 # Reset GOARCH and GOOS to make sure we install the tools for the native
 # architecture even when we're cross-compiling the main binary, and also to
 # prevent the "cannot install cross-compiled binaries when GOBIN is set" error.
-env\
+env \
-	GOARCH=""\
+	GOARCH="" \
-	GOBIN="${PWD}/bin"\
+	GOBIN="${PWD}/bin" \
-	GOOS=""\
+	GOOS="" \
-	GOWORK='off'\
+	GOWORK='off' \
-	"$go" install\
+	"$go" install \
-	--modfile=./internal/tools/go.mod\
+	--modfile=./internal/tools/go.mod \
-	"$v_flags"\
+	"$v_flags" \
-	"$x_flags"\
+	"$x_flags" \
-	github.com/fzipp/gocyclo/cmd/gocyclo\
+	github.com/fzipp/gocyclo/cmd/gocyclo \
-	github.com/golangci/misspell/cmd/misspell\
+	github.com/golangci/misspell/cmd/misspell \
-	github.com/gordonklaus/ineffassign\
+	github.com/gordonklaus/ineffassign \
-	github.com/kisielk/errcheck\
+	github.com/jstemmer/go-junit-report/v2 \
-	github.com/securego/gosec/v2/cmd/gosec\
+	github.com/kisielk/errcheck \
-	github.com/uudashr/gocognit/cmd/gocognit\
+	github.com/securego/gosec/v2/cmd/gosec \
-	golang.org/x/tools/go/analysis/passes/fieldalignment/cmd/fieldalignment\
+	github.com/uudashr/gocognit/cmd/gocognit \
-	golang.org/x/tools/go/analysis/passes/nilness/cmd/nilness\
+	golang.org/x/tools/go/analysis/passes/fieldalignment/cmd/fieldalignment \
-	golang.org/x/tools/go/analysis/passes/shadow/cmd/shadow\
+	golang.org/x/tools/go/analysis/passes/nilness/cmd/nilness \
-	golang.org/x/vuln/cmd/govulncheck\
+	golang.org/x/tools/go/analysis/passes/shadow/cmd/shadow \
-	honnef.co/go/tools/cmd/staticcheck\
+	golang.org/x/vuln/cmd/govulncheck \
-	mvdan.cc/gofumpt\
+	honnef.co/go/tools/cmd/staticcheck \
-	mvdan.cc/unparam\
+	mvdan.cc/gofumpt \
 	mvdan.cc/sh/v3/cmd/shfmt \
 	mvdan.cc/unparam \
 	;
--- a/scripts/make/go-upd-tools.sh
+++ b/scripts/make/go-upd-tools.sh
@ -3,18 +3,16 @@
 # This comment is used to simplify checking local copies of the script.  Bump
 # this number every time a significant change is made to this script.
 #
-# AdGuard-Project-Version: 2
+# AdGuard-Project-Version: 3
 verbose="${VERBOSE:-0}"
 readonly verbose
-if [ "$verbose" -gt '1' ]
+if [ "$verbose" -gt '1' ]; then
 then
 	env
 	set -x
 	x_flags='-x=1'
-elif [ "$verbose" -gt '0' ]
+elif [ "$verbose" -gt '0' ]; then
 then
 	set -x
 	x_flags='-x=0'
 else
--- a/scripts/make/helper.sh
+++ b/scripts/make/helper.sh
@ -8,9 +8,7 @@
 # This comment is used to simplify checking local copies of the script.  Bump
 # this number every time a remarkable change is made to this script.
 #
-# AdGuard-Project-Version: 3
+# AdGuard-Project-Version: 4
 # Deferred helpers
@ -23,8 +21,7 @@ make sure you have installed the linter binaries using:
 readonly not_found_msg
 not_found() {
-	if [ "$?" -eq '127' ]
+	if [ "$?" -eq '127' ]; then
 	then
 		# Code 127 is the exit status a shell uses when a command or a file is
 		# not found, according to the Bash Hackers wiki.
 		#
@ -34,8 +31,6 @@ not_found() {
 }
 trap not_found EXIT
 # Helpers
 # run_linter runs the given linter with two additions:
@ -47,8 +42,7 @@ trap not_found EXIT
 run_linter() (
 	set +e
-	if [ "${VERBOSE:-0}" -lt '2' ]
+	if [ "${VERBOSE:-0}" -lt '2' ]; then
 	then
 		set +x
 	fi
@ -56,8 +50,7 @@ run_linter() (
 	shift
 	exit_on_output='0'
-	if [ "$cmd" = '-e' ]
+	if [ "$cmd" = '-e' ]; then
 	then
 		exit_on_output='1'
 		cmd="${1:?run_linter: provide a command}"
 		shift
@ -65,17 +58,15 @@ run_linter() (
 	readonly cmd
-	output="$( "$cmd" "$@" )"
+	output="$("$cmd" "$@")"
 	exitcode="$?"
 	readonly output
-	if [ "$output" != '' ]
+	if [ "$output" != '' ]; then
 	then
 		echo "$output" | sed -e "s/^/${cmd}: /"
-		if [ "$exitcode" -eq '0' ] && [ "$exit_on_output" -eq '1' ]
+		if [ "$exitcode" -eq '0' ] && [ "$exit_on_output" -eq '1' ]; then
 		then
 			exitcode='1'
 		fi
 	fi
--- a/scripts/make/md-lint.sh
+++ b/scripts/make/md-lint.sh
@ -3,21 +3,18 @@
 # This comment is used to simplify checking local copies of the script.  Bump
 # this number every time a remarkable change is made to this script.
 #
-# AdGuard-Project-Version: 2
+# AdGuard-Project-Version: 3
 verbose="${VERBOSE:-0}"
 readonly verbose
 set -e -f -u
-if [ "$verbose" -gt '0' ]
+if [ "$verbose" -gt '0' ]; then
 then
 	set -x
 fi
 # NOTE: Adjust for your project.
 # markdownlint\
 # 	./README.md\
 # 	;
 # TODO(e.burkov):  Lint markdown documents within this project.
 # markdownlint \
 # 	./README.md \
 # 	;
--- a/scripts/make/sh-lint.sh
+++ b/scripts/make/sh-lint.sh
@ -3,7 +3,7 @@
 # This comment is used to simplify checking local copies of the script.  Bump
 # this number every time a remarkable change is made to this script.
 #
-# AdGuard-Project-Version: 2
+# AdGuard-Project-Version: 3
 verbose="${VERBOSE:-0}"
 readonly verbose
@ -11,16 +11,25 @@ readonly verbose
 # Don't use -f, because we use globs in this script.
 set -e -u
-if [ "$verbose" -gt '0' ]
+if [ "$verbose" -gt '0' ]; then
 then
 	set -x
 fi
-# NOTE: Adjust for your project.
+# Source the common helpers, including not_found and run_linter.
-#
+. ./scripts/make/helper.sh
-# TODO(e.burkov):  Add build-docker.sh, build-release.sh and install.sh.
+
-shellcheck -e 'SC2250' -f 'gcc' -o 'all' -x --\
+run_linter -e shfmt --binary-next-line -d -p -s \
-	./scripts/hooks/*\
+	./scripts/hooks/* \
-	./scripts/snap/*\
+	./scripts/install.sh \
-	./scripts/make/*\
+	./scripts/make/*.sh \
 	./scripts/snap/*.sh \
 	./snap/local/*.sh \
 	;
 shellcheck -e 'SC2250' -e 'SC2310' -f 'gcc' -o 'all' -x -- \
 	./scripts/hooks/* \
 	./scripts/install.sh \
 	./scripts/make/*.sh \
 	./scripts/snap/*.sh \
 	./snap/local/*.sh \
 	;
--- a/scripts/make/txt-lint.sh
+++ b/scripts/make/txt-lint.sh
@ -3,19 +3,17 @@
 # This comment is used to simplify checking local copies of the script.  Bump
 # this number every time a remarkable change is made to this script.
 #
-# AdGuard-Project-Version: 5
+# AdGuard-Project-Version: 8
 verbose="${VERBOSE:-0}"
 readonly verbose
-if [ "$verbose" -gt '0' ]
+if [ "$verbose" -gt '0' ]; then
 then
 	set -x
 fi
 # Set $EXIT_ON_ERROR to zero to see all errors.
-if [ "${EXIT_ON_ERROR:-1}" -eq '0' ]
+if [ "${EXIT_ON_ERROR:-1}" -eq '0' ]; then
 then
 	set +e
 else
 	set -e
@ -32,19 +30,30 @@ set -f -u
 # trailing_newlines is a simple check that makes sure that all plain-text files
 # have a trailing newlines to make sure that all tools work correctly with them.
 trailing_newlines() (
-	nl="$( printf "\n" )"
+	nl="$(printf '\n')"
 	readonly nl
-	# NOTE: Adjust for your project.
+	find . \
-	git ls-files\
+		-type 'f' \
-		':!*.png'\
+		'!' '(' \
-		':!*.tar.gz'\
+		-name '*.db' \
-		':!*.zip'\
+		-o -name '*.exe' \
-		| while read -r f
+		-o -name '*.out' \
-		do
+		-o -name '*.png' \
-			final_byte="$( tail -c -1 "$f" )"
+		-o -name '*.svg' \
-			if [ "$final_byte" != "$nl" ]
+		-o -name '*.tar.gz' \
-			then
+		-o -name '*.test' \
 		-o -name '*.zip' \
 		-o -name 'AdGuardHome' \
 		-o -name 'adguard-home' \
 		-o -path '*/node_modules/*' \
 		-o -path './.git/*' \
 		-o -path './bin/*' \
 		-o -path './build/*' \
 		')' \
 		| while read -r f; do
 			final_byte="$(tail -c -1 "$f")"
 			if [ "$final_byte" != "$nl" ]; then
 				printf '%s: must have a trailing newline\n' "$f"
 			fi
 		done
@ -53,19 +62,26 @@ trailing_newlines() (
 # trailing_whitespace is a simple check that makes sure that there are no
 # trailing whitespace in plain-text files.
 trailing_whitespace() {
-	# NOTE: Adjust for your project.
+	find . \
-	git ls-files\
+		-type 'f' \
-		':!*.bmp'\
+		'!' '(' \
-		':!*.jpg'\
+		-name '*.db' \
-		':!*.mmdb'\
+		-o -name '*.exe' \
-		':!*.png'\
+		-o -name '*.out' \
-		':!*.svg'\
+		-o -name '*.png' \
-		':!*.tar.gz'\
+		-o -name '*.svg' \
-		':!*.webp'\
+		-o -name '*.tar.gz' \
-		':!*.zip'\
+		-o -name '*.test' \
-		| while read -r f
+		-o -name '*.zip' \
-		do
+		-o -name 'AdGuardHome' \
-			grep -e '[[:space:]]$' -n -- "$f"\
+		-o -name 'adguard-home' \
 		-o -path '*/node_modules/*' \
 		-o -path './.git/*' \
 		-o -path './bin/*' \
 		-o -path './build/*' \
 		')' \
 		| while read -r f; do
 			grep -e '[[:space:]]$' -n -- "$f" \
 				| sed -e "s:^:${f}\::" -e 's/ \+$/>>>&<<</'
 		done
 }
@ -74,7 +90,18 @@ run_linter -e trailing_newlines
 run_linter -e trailing_whitespace
-git ls-files -- '*.conf' '*.md' '*.txt' '*.yaml' '*.yml'\
+find . \
-	'client/src/__locales/en.json'\
+	-type 'f' \
-	| xargs misspell --error\
+	'!' '(' \
-	| sed -e 's/^/misspell: /'
+	-path '*/node_modules/*' \
 	-o -path './data/filters/*' \
 	')' \
 	'(' \
 	-name 'Makefile' \
 	-o -name '*.conf' \
 	-o -name '*.md' \
 	-o -name '*.txt' \
 	-o -name '*.yaml' \
 	-o -name '*.yml' \
 	')' \
 	-exec 'misspell' '--error' '{}' '+'
--- a/scripts/make/version.sh
+++ b/scripts/make/version.sh
@ -25,8 +25,7 @@
 verbose="${VERBOSE:-0}"
 readonly verbose
-if [ "$verbose" -gt '0' ]
+if [ "$verbose" -gt '0' ]; then
 then
 	set -x
 fi
@ -62,20 +61,20 @@ get_last_minor_zero() {
 	# second field (",2").  The sort is also numeric and reverse ("nr").
 	#
 	# Finally, get the top (that is, most recent) version.
-	git tag\
+	git tag \
-		| grep -e 'v[0-9]\+\.[0-9]\+\.0$'\
+		| grep -e 'v[0-9]\+\.[0-9]\+\.0$' \
-		| sort -k 1.2,1nr -k 2,2nr -t '.'\
+		| sort -k 1.2,1nr -k 2,2nr -t '.' \
-		| head -n 1
+		| head -n 1 \
 		;
 }
 channel="${CHANNEL:?please set CHANNEL}"
 readonly channel
-case "$channel"
+case "$channel" in
-in
+'development')
 ('development')
 	# commit_number is the number of current commit within the branch.
-	commit_number="$( git rev-list --count master..HEAD )"
+	commit_number="$(git rev-list --count master..HEAD)"
 	readonly commit_number
 	# The development builds are described with a combination of unset semantic
@ -83,21 +82,21 @@ in
 	#
 	#   v0.0.0-dev.5-a1b2c3d4
 	#
-	version="v0.0.0-dev.${commit_number}+$( git rev-parse --short HEAD )"
+	version="v0.0.0-dev.${commit_number}+$(git rev-parse --short HEAD)"
 	;;
-('edge')
+'edge')
 	# last_minor_zero is the last new minor release.
-	last_minor_zero="$( get_last_minor_zero )"
+	last_minor_zero="$(get_last_minor_zero)"
 	readonly last_minor_zero
 	# num_commits_since_minor is the number of commits since the last new
 	# minor release.  If the current commit is the new minor release,
 	# num_commits_since_minor is zero.
-	num_commits_since_minor="$( git rev-list --count "${last_minor_zero}..HEAD" )"
+	num_commits_since_minor="$(git rev-list --count "${last_minor_zero}..HEAD")"
 	readonly num_commits_since_minor
 	# next_minor is the next minor release version.
-	next_minor="$( echo "$last_minor_zero" | awk -F '.' "$bump_minor" )"
+	next_minor="$(echo "$last_minor_zero" | awk -F '.' "$bump_minor")"
 	readonly next_minor
 	# Make this commit a prerelease version for the next minor release.  For
@ -106,21 +105,20 @@ in
 	#
 	#   v0.124.0-a.5+a1b2c3d4
 	#
-	version="${next_minor}-a.${num_commits_since_minor}+$( git rev-parse --short HEAD )"
+	version="${next_minor}-a.${num_commits_since_minor}+$(git rev-parse --short HEAD)"
 	;;
-('beta'|'release')
+'beta' | 'release')
 	# current_desc is the description of the current git commit.  If the
 	# current commit is tagged, git describe will show the tag.
-	current_desc="$( git describe )"
+	current_desc="$(git describe)"
 	readonly current_desc
 	# last_tag is the most recent git tag.
-	last_tag="$( git describe --abbrev=0 )"
+	last_tag="$(git describe --abbrev=0)"
 	readonly last_tag
 	# Require an actual tag for the beta and final releases.
-	if [ "$current_desc" != "$last_tag" ]
+	if [ "$current_desc" != "$last_tag" ]; then
 	then
 		echo 'need a tag' 1>&2
 		exit 1
@ -128,41 +126,39 @@ in
 	version="$last_tag"
 	;;
-('candidate')
+'candidate')
 	# This pseudo-channel is used to set a proper versions into release
 	# candidate builds.
 	# last_tag is expected to be the latest release tag.
-	last_tag="$( git describe --abbrev=0 )"
+	last_tag="$(git describe --abbrev=0)"
 	readonly last_tag
 	# current_branch is the name of the branch currently checked out.
-	current_branch="$( git rev-parse --abbrev-ref HEAD )"
+	current_branch="$(git rev-parse --abbrev-ref HEAD)"
 	readonly current_branch
 	# The branch should be named like:
 	#
 	#   rc-v12.34.56
 	#
-	if ! echo "$current_branch" | grep -E -e '^rc-v[0-9]+\.[0-9]+\.[0-9]+$' -q
+	if ! echo "$current_branch" | grep -E -e '^rc-v[0-9]+\.[0-9]+\.[0-9]+$' -q; then
 	then
 		echo "invalid release candidate branch name '$current_branch'" 1>&2
 		exit 1
 	fi
-	version="${current_branch#rc-}-rc.$( git rev-list --count "$last_tag"..HEAD )"
+	version="${current_branch#rc-}-rc.$(git rev-list --count "$last_tag"..HEAD)"
 	;;
-(*)
+*)
-	echo "invalid channel '$channel', supported values are\
+	echo "invalid channel '$channel', supported values are \
 		'development', 'edge', 'beta', 'release' and 'candidate'" 1>&2
 	exit 1
 	;;
 esac
 # Finally, make sure that we don't output invalid versions.
-if ! echo "$version" | grep -E -e '^v[0-9]+\.[0-9]+\.[0-9]+(-(a|b|dev|rc)\.[0-9]+)?(\+[[:xdigit:]]+)?$' -q
+if ! echo "$version" | grep -E -e '^v[0-9]+\.[0-9]+\.[0-9]+(-(a|b|dev|rc)\.[0-9]+)?(\+[[:xdigit:]]+)?$' -q; then
 then
 	echo "generated an invalid version '$version'" 1>&2
 	exit 1
--- a/scripts/snap/build.sh
+++ b/scripts/snap/build.sh
@ -2,8 +2,7 @@
 verbose="${VERBOSE:-0}"
-if [ "$verbose" -gt '0' ]
+if [ "$verbose" -gt '0' ]; then
 then
 	set -x
 fi
@ -14,29 +13,27 @@ set -e -f -u
 #
 # TODO(a.garipov): Add to helpers.sh and use more actively in scripts.
 log() {
-	if [ "$verbose" -gt '0' ]
+	if [ "$verbose" -gt '0' ]; then
 	then
 		# Don't use quotes to get word splitting.
 		echo "$1" 1>&2
 	fi
 }
-version="$( ./AdGuardHome_amd64 --version | cut -d ' ' -f 4 )"
+version="$(./AdGuardHome_amd64 --version | cut -d ' ' -f 4)"
-if [ "$version" = '' ]
+if [ "$version" = '' ]; then
 then
 	log 'empty version from ./AdGuardHome_amd64'
 	exit 1
 fi
 readonly version
 log "version '$version'"
-for arch in\
+for arch in \
-	'i386'\
+	'amd64' \
-	'amd64'\
+	'arm64' \
-	'armhf'\
+	'armhf' \
-	'arm64'
+	'i386'; do
 do
 	build_output="./AdGuardHome_${arch}"
 	snap_output="./AdGuardHome_${arch}.snap"
 	snap_dir="${snap_output}.dir"
@ -48,25 +45,22 @@ do
 	cp -r './snap/gui' "${snap_dir}/meta/"
 	# Create a snap.yaml file, setting the values.
-	sed\
+	sed \
-		-e 's/%VERSION%/'"$version"'/'\
+		-e 's/%VERSION%/'"$version"'/' \
-		-e 's/%ARCH%/'"$arch"'/'\
+		-e 's/%ARCH%/'"$arch"'/' \
-		./snap/snap.tmpl.yaml\
+		./snap/snap.tmpl.yaml \
-		> "${snap_dir}/meta/snap.yaml"
+		>"${snap_dir}/meta/snap.yaml"
 	# TODO(a.garipov): The snapcraft tool will *always* write everything,
 	# including errors, to stdout.  And there doesn't seem to be a way to change
 	# that.  So, save the combined output, but only show it when snapcraft
 	# actually fails.
 	set +e
-	snapcraft_output="$(
+	snapcraft_output="$(snapcraft pack "$snap_dir" --output "$snap_output" 2>&1)"
 		snapcraft pack "$snap_dir" --output "$snap_output" 2>&1
 	)"
 	snapcraft_exit_code="$?"
 	set -e
-	if [ "$snapcraft_exit_code" -ne '0' ]
+	if [ "$snapcraft_exit_code" -ne '0' ]; then
 	then
 		log "$snapcraft_output"
 		exit "$snapcraft_exit_code"
 	fi
--- a/scripts/snap/download.sh
+++ b/scripts/snap/download.sh
@ -2,8 +2,7 @@
 verbose="${VERBOSE:-0}"
-if [ "$verbose" -gt '0' ]
+if [ "$verbose" -gt '0' ]; then
 then
 	set -x
 fi
@ -12,18 +11,17 @@ set -e -f -u
 channel="${CHANNEL:?please set CHANNEL}"
 readonly channel
-printf '%s %s\n'\
+printf '%s %s\n' \
-	'386'   'i386'\
+	'386' 'i386' \
-	'amd64' 'amd64'\
+	'amd64' 'amd64' \
-	'armv7' 'armhf'\
+	'armv7' 'armhf' \
 	'arm64' 'arm64' \
-| while read -r arch snap_arch
+	| while read -r arch snap_arch; do
-do
+		release_url="https://static.adtidy.org/adguardhome/${channel}/AdGuardHome_linux_${arch}.tar.gz"
-	release_url="https://static.adtidy.org/adguardhome/${channel}/AdGuardHome_linux_${arch}.tar.gz"
+		output="./AdGuardHome_linux_${arch}.tar.gz"
 	output="./AdGuardHome_linux_${arch}.tar.gz"
-	curl -o "$output" -v "$release_url"
+		curl -o "$output" -v "$release_url"
-	tar -f "$output" -v -x -z
+		tar -f "$output" -v -x -z
-	cp ./AdGuardHome/AdGuardHome "./AdGuardHome_${snap_arch}"
+		cp ./AdGuardHome/AdGuardHome "./AdGuardHome_${snap_arch}"
-	rm -f -r "$output" ./AdGuardHome
+		rm -f -r "$output" ./AdGuardHome
-done
+	done
--- a/scripts/snap/upload.sh
+++ b/scripts/snap/upload.sh
@ -2,8 +2,7 @@
 verbose="${VERBOSE:-0}"
-if [ "$verbose" -gt '0' ]
+if [ "$verbose" -gt '0' ]; then
 then
 	set -x
 fi
@ -12,8 +11,7 @@ set -e -f -u
 # Function log is an echo wrapper that writes to stderr if the caller requested
 # verbosity level greater than 0.  Otherwise, it does nothing.
 log() {
-	if [ "$verbose" -gt '0' ]
+	if [ "$verbose" -gt '0' ]; then
 	then
 		# Don't use quotes to get word splitting.
 		echo "$1" 1>&2
 	fi
@ -21,8 +19,7 @@ log() {
 # Do not set a new lowercase variable, because the snapcraft tool expects the
 # uppercase form.
-if [ "${SNAPCRAFT_STORE_CREDENTIALS:-}" = '' ]
+if [ "${SNAPCRAFT_STORE_CREDENTIALS:-}" = '' ]; then
 then
 	log 'please set SNAPCRAFT_STORE_CREDENTIALS'
 	exit 1
@ -40,12 +37,11 @@ default_timeout='90s'
 kill_timeout='120s'
 readonly default_timeout kill_timeout
-for arch in\
+for arch in \
-	'i386'\
+	'amd64' \
-	'amd64'\
+	'arm64' \
-	'armhf'\
+	'armhf' \
-	'arm64'
+	'i386'; do
 do
 	snap_file="./AdGuardHome_${arch}.snap"
 	# Catch the exit code and the combined output to later inspect it.
@ -53,30 +49,28 @@ do
 	snapcraft_output="$(
 		# Use timeout(1) to force snapcraft to quit after a certain time.  There
 		# seems to be no environment variable or flag to force this behavior.
-		timeout\
+		timeout \
-			--preserve-status\
+			--preserve-status \
-			-k "$kill_timeout"\
+			-k "$kill_timeout" \
-			-v "$default_timeout"\
+			-v "$default_timeout" \
-			"$snapcraft_cmd" upload\
+			"$snapcraft_cmd" upload \
-			--release="${snapcraft_channel}"\
+			--release="${snapcraft_channel}" \
-			--quiet\
+			--quiet \
-			"${snap_file}"\
+			"${snap_file}" \
 			2>&1
 	)"
 	snapcraft_exit_code="$?"
 	set -e
-	if [ "$snapcraft_exit_code" -eq '0' ]
+	if [ "$snapcraft_exit_code" -eq '0' ]; then
 	then
 		log "successful upload: ${snapcraft_output}"
 		continue
 	fi
 	# Skip the ones that were failed by a duplicate upload error.
-	case "$snapcraft_output"
+	case "$snapcraft_output" in
-	in
+	*'A file with this exact same content has already been uploaded'* | \
 	(*'A file with this exact same content has already been uploaded'*|\
 		*'Error checking upload uniqueness'*)
 		log "warning: duplicate upload, skipping"
@ -84,7 +78,7 @@ do
 		continue
 		;;
-	(*)
+	*)
 		echo "unexpected snapcraft upload error: ${snapcraft_output}"
 		return "$snapcraft_exit_code"
--- a/scripts/translations/main.go
+++ b/scripts/translations/main.go
@ -10,6 +10,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"log/slog"
 	"maps"
 	"net/url"
 	"os"
 	"os/exec"
@ -21,7 +22,6 @@ import (
 	"github.com/AdguardTeam/AdGuardHome/internal/aghos"
 	"github.com/AdguardTeam/golibs/errors"
 	"github.com/AdguardTeam/golibs/logutil/slogutil"
 	"golang.org/x/exp/maps"
 )
 const (
@ -76,40 +76,30 @@ func main() {
 		usage("")
 	}
-	conf, err := readTwoskyConfig()
+	conf := errors.Must(readTwoskyConfig())
 	check(err)
 	var cli *twoskyClient
 	switch os.Args[1] {
 	case "summary":
-		err = summary(conf.Languages)
+		errors.Check(summary(conf.Languages))
 	case "download":
-		cli, err = conf.toClient()
+		cli = errors.Must(conf.toClient())
 		check(err)
-		err = cli.download(ctx, l)
+		errors.Check(cli.download(ctx, l))
 	case "unused":
-		err = unused(ctx, l, conf.LocalizableFiles[0])
+		err := unused(ctx, l, conf.LocalizableFiles[0])
 		errors.Check(err)
 	case "upload":
-		cli, err = conf.toClient()
+		cli = errors.Must(conf.toClient())
 		check(err)
-		err = cli.upload()
+		errors.Check(cli.upload())
 	case "auto-add":
-		err = autoAdd(conf.LocalizableFiles[0])
+		err := autoAdd(conf.LocalizableFiles[0])
 		errors.Check(err)
 	default:
 		usage("unknown command")
 	}
 	check(err)
 }
 // check is a simple error-checking helper for scripts.
 func check(err error) {
 	if err != nil {
 		panic(err)
 	}
 }
 // usage prints usage.  If addStr is not empty print addStr and exit with code
@ -163,15 +153,11 @@ func readTwoskyConfig() (t *twoskyConfig, err error) {
 	var tsc []twoskyConfig
 	err = json.Unmarshal(b, &tsc)
 	if err != nil {
-		err = fmt.Errorf("unmarshalling %q: %w", twoskyConfFile, err)
+		return nil, fmt.Errorf("unmarshalling %q: %w", twoskyConfFile, err)
 		return nil, err
 	}
 	if len(tsc) == 0 {
-		err = fmt.Errorf("%q is empty", twoskyConfFile)
+		return nil, fmt.Errorf("%q is empty", twoskyConfFile)
 		return nil, err
 	}
 	conf := tsc[0]
@ -224,7 +210,8 @@ func (t *twoskyConfig) toClient() (cli *twoskyClient, err error) {
 		baseLang = langCode(uLangStr)
 	}
-	langs := maps.Keys(t.Languages)
+	langs := slices.Sorted(maps.Keys(t.Languages))
 	dlLangStr := os.Getenv("DOWNLOAD_LANGUAGES")
 	if dlLangStr == "blocker" {
 		langs = blockerLangCodes
@ -295,8 +282,7 @@ func summary(langs languages) (err error) {
 	size := float64(len(baseLoc))
-	keys := maps.Keys(langs)
+	keys := slices.Sorted(maps.Keys(langs))
 	slices.Sort(keys)
 	for _, lang := range keys {
 		name := filepath.Join(localesDir, string(lang)+".json")
@ -399,10 +385,7 @@ func findUnused(fileNames []string, loc locales) (err error) {
 		}
 	}
-	keys := maps.Keys(loc)
+	for _, v := range slices.Sorted(maps.Keys(loc)) {
 	slices.Sort(keys)
 	for _, v := range keys {
 		fmt.Println(v)
 	}
--- a/scripts/vetted-filters/main.go
+++ b/scripts/vetted-filters/main.go
@ -13,6 +13,7 @@ import (
 	"os"
 	"time"
 	"github.com/AdguardTeam/golibs/errors"
 	"github.com/AdguardTeam/golibs/logutil/slogutil"
 	"github.com/google/renameio/v2/maybe"
 )
@ -22,20 +23,19 @@ func main() {
 	l := slogutil.New(nil)
 	urlStr := "https://adguardteam.github.io/HostlistsRegistry/assets/filters.json"
-	if v, ok := os.LookupEnv("URL"); ok {
+	if s := os.Getenv("URL"); s != "" {
-		urlStr = v
+		urlStr = s
 	}
 	// Validate the URL.
 	_, err := url.Parse(urlStr)
-	check(err)
+	errors.Check(err)
 	c := &http.Client{
 		Timeout: 10 * time.Second,
 	}
-	resp, err := c.Get(urlStr)
+	resp := errors.Must(c.Get(urlStr))
 	check(err)
 	defer slogutil.CloseAndLog(ctx, l, resp.Body, slog.LevelError)
 	if resp.StatusCode != http.StatusOK {
@ -44,7 +44,7 @@ func main() {
 	hlFlt := &hlFilters{}
 	err = json.NewDecoder(resp.Body).Decode(hlFlt)
-	check(err)
+	errors.Check(err)
 	aghFlt := &aghFilters{
 		Categories: map[string]*aghFiltersCategory{
@ -93,11 +93,10 @@ func main() {
 	enc := json.NewEncoder(buf)
 	enc.SetIndent("", "    ")
-	err = enc.Encode(aghFlt)
+	errors.Check(enc.Encode(aghFlt))
 	check(err)
 	err = maybe.WriteFile("client/src/helpers/filters/filters.ts", buf.Bytes(), 0o644)
-	check(err)
+	errors.Check(err)
 }
 // jsHeader is the header for the generated JavaScript file.  It informs the
@ -109,13 +108,6 @@ const jsHeader = `// Code generated by go run ./scripts/vetted-filters/main.go;
 export default `
 // check is a simple error-checking helper for scripts.
 func check(err error) {
 	if err != nil {
 		panic(err)
 	}
 }
 // hlFilters is the JSON structure for the Hostlists Registry rule list index.
 type hlFilters struct {
 	Filters []*hlFiltersFilter `json:"filters"`
--- a/snap/local/adguard-home-web.sh
+++ b/snap/local/adguard-home-web.sh
@ -1,24 +1,25 @@
 #!/bin/sh
 # shellcheck disable=SC2154
 conf_file="${SNAP_DATA}/AdGuardHome.yaml"
 readonly conf_file
-if ! [ -f "$conf_file" ]
+if ! [ -f "$conf_file" ]; then
-then
+	xdg-open 'http://localhost:3000'
  xdg-open 'http://localhost:3000'
-  exit
+	exit
 fi
 # Get the admin interface port from the configuration.
 #
 # shellcheck disable=SC2016
 awk_prog='/^[^[:space:]]/ { is_http = /^http:/ };/^[[:space:]]+address:/ { if (is_http) print $2 }'
 readonly awk_prog
-bind_port="$( awk "$awk_prog" "$conf_file" | awk -F ':' '{print $NF}' )"
+bind_port="$(awk "$awk_prog" "$conf_file" | awk -F ':' '{print $NF}')"
 readonly bind_port
-if [ "$bind_port" = '' ]
+if [ "$bind_port" = '' ]; then
 then
 	xdg-open 'http://localhost:3000'
 else
 	xdg-open "http://localhost:${bind_port}"