20 files changed, 581 insertions, 85 deletions
diff --git a/.gitignore b/.gitignore
index 27ed8000f..839d2afff 100644
--- a/.gitignore
+++ b/.gitignore
@@ -153,6 +153,8 @@ data/configd-include.json
 
 # autogenerated vyos-commitd protobuf files
 python/vyos/proto/*pb2.py
+python/vyos/proto/*.desc
+python/vyos/proto/vyconf_proto.py
 
 # We do not use pip
 Pipfile
diff --git a/data/op-mode-standardized.json b/data/op-mode-standardized.json
index c2bfc3094..5d3f4a249 100644
--- a/data/op-mode-standardized.json
+++ b/data/op-mode-standardized.json
@@ -28,6 +28,7 @@
 "load-balancing_haproxy.py",
 "route.py",
 "storage.py",
+"stp.py",
 "system.py",
 "uptime.py",
 "version.py",
diff --git a/data/templates/rsyslog/rsyslog.conf.j2 b/data/templates/rsyslog/rsyslog.conf.j2
index a67e596fc..6ef2afcaf 100644
--- a/data/templates/rsyslog/rsyslog.conf.j2
+++ b/data/templates/rsyslog/rsyslog.conf.j2
@@ -1,16 +1,15 @@
 ### Autogenerated by system_syslog.py ###
 
 #### MODULES ####
-# Load input modules for local logging and kernel logging
+# Load input modules for local logging and journald
 
 # Old-style log file format with low-precision timestamps
 # A modern-style logfile format with high-precision timestamps and timezone info
 # RSYSLOG_FileFormat
 module(load="builtin:omfile" Template="RSYSLOG_TraditionalFileFormat")
-module(load="imuxsock")  # provides support for local system logging
-module(load="imklog")    # provides kernel logging support
+module(load="imuxsock")  # provides support for local system logging (collection from /dev/log unix socket)
 
-# Import logs from journald
+# Import logs from journald, which includes kernel log messages
 module(
     load="imjournal"
     StateFile="/var/spool/rsyslog/imjournal.state"  # Persistent state file to track the journal cursor
diff --git a/debian/control b/debian/control
index 4186dfb3b..c40b0fb04 100644
--- a/debian/control
+++ b/debian/control
@@ -41,8 +41,8 @@ Pre-Depends:
   libpam-runtime [amd64],
   libnss-tacplus [amd64],
   libpam-tacplus [amd64],
-  libpam-radius-auth (= 1.5.0-cl3u7) [amd64],
-  libnss-mapuser (= 1.1.0-cl3u3) [amd64],
+  vyos-libpam-radius-auth,
+  vyos-libnss-mapuser,
   tzdata (>= 2025b)
 Depends:
 ## Fundamentals
diff --git a/libvyosconfig b/libvyosconfig
-Subproject 74d884d7f383aa570fa00b7f3b222ea8b18bb45
+Subproject 58dbb42e827e3d326c6e0e9470334d4d5c7c396
diff --git a/op-mode-definitions/show-bridge.xml.in b/op-mode-definitions/show-bridge.xml.in
index 1212ab1f9..40fadac8b 100644
--- a/op-mode-definitions/show-bridge.xml.in
+++ b/op-mode-definitions/show-bridge.xml.in
@@ -7,6 +7,20 @@
           <help>Show bridging information</help>
         </properties>
         <children>
+          <node name="spanning-tree">
+            <properties>
+              <help>View Spanning Tree info for all bridges</help>
+            </properties>
+            <command>${vyos_op_scripts_dir}/stp.py show_stp</command>
+            <children>
+              <leafNode name="detail">
+                <properties>
+                  <help>Show detailed Spanning Tree info for all bridges</help>
+                </properties>
+                <command>${vyos_op_scripts_dir}/stp.py show_stp --detail</command>
+              </leafNode>
+            </children>
+          </node>
           <node name="vlan">
             <properties>
               <help>View the VLAN filter settings of the bridge</help>
@@ -44,6 +58,20 @@
         </properties>
         <command>bridge -c link show | grep "master $3"</command>
         <children>
+          <node name="spanning-tree">
+            <properties>
+              <help>View Spanning Tree info for specified bridges</help>
+            </properties>
+            <command>${vyos_op_scripts_dir}/stp.py show_stp --ifname=$3</command>
+            <children>
+              <leafNode name="detail">
+                <properties>
+                  <help>Show detailed Spanning Tree info for specified bridge</help>
+                </properties>
+                <command>${vyos_op_scripts_dir}/stp.py show_stp --ifname=$3 --detail</command>
+              </leafNode>
+            </children>
+          </node>
           <leafNode name="mdb">
             <properties>
               <help>Displays the multicast group database for the bridge</help>
diff --git a/python/setup.py b/python/setup.py
index 96dc211f7..571b956ee 100644
--- a/python/setup.py
+++ b/python/setup.py
@@ -7,6 +7,9 @@ from setuptools.command.build_py import build_py
 sys.path.append('./vyos')
 from defaults import directories
 
+def desc_out(f):
+    return os.path.splitext(f)[0] + '.desc'
+
 def packages(directory):
     return [
         _[0].replace('/','.')
@@ -37,9 +40,17 @@ class GenerateProto(build_py):
                     'protoc',
                     '--python_out=vyos/proto',
                     f'--proto_path={self.proto_path}/',
+                    f'--descriptor_set_out=vyos/proto/{desc_out(proto_file)}',
                     proto_file,
                 ]
             )
+        subprocess.check_call(
+            [
+                'vyos/proto/generate_dataclass.py',
+                'vyos/proto/vyconf.desc',
+                '--out-dir=vyos/proto',
+            ]
+        )
 
         build_py.run(self)
 
diff --git a/python/vyos/config.py b/python/vyos/config.py
index 1fab46761..546eeceab 100644
--- a/python/vyos/config.py
+++ b/python/vyos/config.py
@@ -149,6 +149,18 @@ class Config(object):
             return self._running_config
         return self._session_config
 
+    def get_bool_attr(self, attr) -> bool:
+        if not hasattr(self, attr):
+            return False
+        else:
+            tmp = getattr(self, attr)
+            if not isinstance(tmp, bool):
+                return False
+        return tmp
+
+    def set_bool_attr(self, attr, val):
+        setattr(self, attr, val)
+
     def _make_path(self, path):
         # Backwards-compatibility stuff: original implementation used string paths
         # libvyosconfig paths are lists, but since node names cannot contain whitespace,
diff --git a/python/vyos/configdep.py b/python/vyos/configdep.py
index cf7c9d543..747af8dbe 100644
--- a/python/vyos/configdep.py
+++ b/python/vyos/configdep.py
@@ -102,11 +102,16 @@ def run_config_mode_script(target: str, config: 'Config'):
     mod = load_as_module(name, path)
 
     config.set_level([])
+    dry_run = config.get_bool_attr('dry_run')
     try:
         c = mod.get_config(config)
         mod.verify(c)
-        mod.generate(c)
-        mod.apply(c)
+        if not dry_run:
+            mod.generate(c)
+            mod.apply(c)
+        else:
+            if hasattr(mod, 'call_dependents'):
+                mod.call_dependents()
     except (VyOSError, ConfigError) as e:
         raise ConfigError(str(e)) from e
 
diff --git a/python/vyos/configtree.py b/python/vyos/configtree.py
index dade852c7..ff40fbad0 100644
--- a/python/vyos/configtree.py
+++ b/python/vyos/configtree.py
@@ -523,35 +523,6 @@ def mask_inclusive(left, right, libpath=LIBPATH):
     return tree
 
 
-def show_commit_data(active_tree, proposed_tree, libpath=LIBPATH):
-    if not (
-        isinstance(active_tree, ConfigTree) and isinstance(proposed_tree, ConfigTree)
-    ):
-        raise TypeError('Arguments must be instances of ConfigTree')
-
-    __lib = cdll.LoadLibrary(libpath)
-    __show_commit_data = __lib.show_commit_data
-    __show_commit_data.argtypes = [c_void_p, c_void_p]
-    __show_commit_data.restype = c_char_p
-
-    res = __show_commit_data(active_tree._get_config(), proposed_tree._get_config())
-
-    return res.decode()
-
-
-def test_commit(active_tree, proposed_tree, libpath=LIBPATH):
-    if not (
-        isinstance(active_tree, ConfigTree) and isinstance(proposed_tree, ConfigTree)
-    ):
-        raise TypeError('Arguments must be instances of ConfigTree')
-
-    __lib = cdll.LoadLibrary(libpath)
-    __test_commit = __lib.test_commit
-    __test_commit.argtypes = [c_void_p, c_void_p]
-
-    __test_commit(active_tree._get_config(), proposed_tree._get_config())
-
-
 def reference_tree_to_json(from_dir, to_file, internal_cache='', libpath=LIBPATH):
     try:
         __lib = cdll.LoadLibrary(libpath)
diff --git a/python/vyos/kea.py b/python/vyos/kea.py
index c7947af3e..9fc5dde3d 100644
--- a/python/vyos/kea.py
+++ b/python/vyos/kea.py
@@ -483,10 +483,10 @@ def kea_get_domain_from_subnet_id(config, inet, subnet_id):
                     if option['name'] == 'domain-name':
                         return option['data']
 
-            # domain-name is not found in subnet, fallback to shared-network pool option
-            for option in network['option-data']:
-                if option['name'] == 'domain-name':
-                    return option['data']
+                # domain-name is not found in subnet, fallback to shared-network pool option
+                for option in network['option-data']:
+                    if option['name'] == 'domain-name':
+                        return option['data']
 
     return None
 
diff --git a/python/vyos/proto/generate_dataclass.py b/python/vyos/proto/generate_dataclass.py
new file mode 100755
index 000000000..c6296c568
--- /dev/null
+++ b/python/vyos/proto/generate_dataclass.py
@@ -0,0 +1,178 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2025 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+#
+import argparse
+import os
+
+from google.protobuf.descriptor_pb2 import FileDescriptorSet  # pylint: disable=no-name-in-module
+from google.protobuf.descriptor_pb2 import FieldDescriptorProto  # pylint: disable=no-name-in-module
+from humps import decamelize
+
+HEADER = """\
+from enum import IntEnum
+from dataclasses import dataclass
+from dataclasses import field
+"""
+
+
+def normalize(s: str) -> str:
+    """Decamelize and avoid syntactic collision"""
+    t = decamelize(s)
+    return t + '_' if t in ['from'] else t
+
+
+def generate_dataclass(descriptor_proto):
+    class_name = descriptor_proto.name
+    fields = []
+    for field_p in descriptor_proto.field:
+        field_name = field_p.name
+        field_type, field_default = get_type(field_p.type, field_p.type_name)
+        match field_p.label:
+            case FieldDescriptorProto.LABEL_REPEATED:
+                field_type = f'list[{field_type}] = field(default_factory=list)'
+            case FieldDescriptorProto.LABEL_OPTIONAL:
+                field_type = f'{field_type} = None'
+            case _:
+                field_type = f'{field_type} = {field_default}'
+
+        fields.append(f'    {field_name}: {field_type}')
+
+    code = f"""
+@dataclass
+class {class_name}:
+{chr(10).join(fields) if fields else '    pass'}
+"""
+
+    return code
+
+
+def generate_request(descriptor_proto):
+    class_name = descriptor_proto.name
+    fields = []
+    f_vars = []
+    for field_p in descriptor_proto.field:
+        field_name = field_p.name
+        field_type, field_default = get_type(field_p.type, field_p.type_name)
+        match field_p.label:
+            case FieldDescriptorProto.LABEL_REPEATED:
+                field_type = f'list[{field_type}] = []'
+            case FieldDescriptorProto.LABEL_OPTIONAL:
+                field_type = f'{field_type} = None'
+            case _:
+                field_type = f'{field_type} = {field_default}'
+
+        fields.append(f'{normalize(field_name)}: {field_type}')
+        f_vars.append(f'{normalize(field_name)}')
+
+    fields.insert(0, 'token: str = None')
+
+    code = f"""
+def set_request_{decamelize(class_name)}({', '.join(fields)}):
+    reqi = {class_name} ({', '.join(f_vars)})
+    req = Request({decamelize(class_name)}=reqi)
+    req_env = RequestEnvelope(token, req)
+    return req_env
+"""
+
+    return code
+
+
+def generate_nested_dataclass(descriptor_proto):
+    out = ''
+    for nested_p in descriptor_proto.nested_type:
+        out = out + generate_dataclass(nested_p)
+
+    return out
+
+
+def generate_nested_request(descriptor_proto):
+    out = ''
+    for nested_p in descriptor_proto.nested_type:
+        out = out + generate_request(nested_p)
+
+    return out
+
+
+def generate_enum_dataclass(descriptor_proto):
+    code = ''
+    for enum_p in descriptor_proto.enum_type:
+        enums = []
+        enum_name = enum_p.name
+        for enum_val in enum_p.value:
+            enums.append(f'    {enum_val.name} = {enum_val.number}')
+
+        code += f"""
+class {enum_name}(IntEnum):
+{chr(10).join(enums)}
+"""
+
+    return code
+
+
+def get_type(field_type, type_name):
+    res = 'Any', None
+    match field_type:
+        case FieldDescriptorProto.TYPE_STRING:
+            res = 'str', '""'
+        case FieldDescriptorProto.TYPE_INT32 | FieldDescriptorProto.TYPE_INT64:
+            res = 'int', 0
+        case FieldDescriptorProto.TYPE_FLOAT | FieldDescriptorProto.TYPE_DOUBLE:
+            res = 'float', 0.0
+        case FieldDescriptorProto.TYPE_BOOL:
+            res = 'bool', False
+        case FieldDescriptorProto.TYPE_MESSAGE | FieldDescriptorProto.TYPE_ENUM:
+            res = type_name.split('.')[-1], None
+        case _:
+            pass
+
+    return res
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser()
+    parser.add_argument('descriptor_file', help='protobuf .desc file')
+    parser.add_argument('--out-dir', help='directory to write generated file')
+    args = parser.parse_args()
+    desc_file = args.descriptor_file
+    out_dir = args.out_dir
+
+    with open(desc_file, 'rb') as f:
+        descriptor_set_data = f.read()
+
+    descriptor_set = FileDescriptorSet()
+    descriptor_set.ParseFromString(descriptor_set_data)
+
+    for file_proto in descriptor_set.file:
+        f = f'{file_proto.name.replace(".", "_")}.py'
+        f = os.path.join(out_dir, f)
+        dataclass_code = ''
+        nested_code = ''
+        enum_code = ''
+        request_code = ''
+        with open(f, 'w') as f:
+            enum_code += generate_enum_dataclass(file_proto)
+            for message_proto in file_proto.message_type:
+                dataclass_code += generate_dataclass(message_proto)
+                nested_code += generate_nested_dataclass(message_proto)
+                enum_code += generate_enum_dataclass(message_proto)
+                request_code += generate_nested_request(message_proto)
+
+            f.write(HEADER)
+            f.write(enum_code)
+            f.write(nested_code)
+            f.write(dataclass_code)
+            f.write(request_code)
diff --git a/python/vyos/proto/vyconf_client.py b/python/vyos/proto/vyconf_client.py
new file mode 100644
index 000000000..f34549309
--- /dev/null
+++ b/python/vyos/proto/vyconf_client.py
@@ -0,0 +1,87 @@
+# Copyright 2025 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+import socket
+from dataclasses import asdict
+
+from vyos.proto import vyconf_proto
+from vyos.proto import vyconf_pb2
+
+from google.protobuf.json_format import MessageToDict
+from google.protobuf.json_format import ParseDict
+
+socket_path = '/var/run/vyconfd.sock'
+
+
+def send_socket(msg: bytearray) -> bytes:
+    data = bytes()
+    client = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+    client.connect(socket_path)
+    client.sendall(msg)
+
+    data_length = client.recv(4)
+    if data_length:
+        length = int.from_bytes(data_length)
+        data = client.recv(length)
+
+    client.close()
+
+    return data
+
+
+def request_to_msg(req: vyconf_proto.RequestEnvelope) -> vyconf_pb2.RequestEnvelope:
+    # pylint: disable=no-member
+
+    msg = vyconf_pb2.RequestEnvelope()
+    msg = ParseDict(asdict(req), msg, ignore_unknown_fields=True)
+    return msg
+
+
+def msg_to_response(msg: vyconf_pb2.Response) -> vyconf_proto.Response:
+    # pylint: disable=no-member
+
+    d = MessageToDict(msg, preserving_proto_field_name=True)
+
+    response = vyconf_proto.Response(**d)
+    return response
+
+
+def write_request(req: vyconf_proto.RequestEnvelope) -> bytearray:
+    req_msg = request_to_msg(req)
+    encoded_data = req_msg.SerializeToString()
+    byte_size = req_msg.ByteSize()
+    length_bytes = byte_size.to_bytes(4)
+    arr = bytearray(length_bytes)
+    arr.extend(encoded_data)
+
+    return arr
+
+
+def read_response(msg: bytes) -> vyconf_proto.Response:
+    response_msg = vyconf_pb2.Response()  # pylint: disable=no-member
+    response_msg.ParseFromString(msg)
+    response = msg_to_response(response_msg)
+
+    return response
+
+
+def send_request(name, *args, **kwargs):
+    func = getattr(vyconf_proto, f'set_request_{name}')
+    request_env = func(*args, **kwargs)
+    msg = write_request(request_env)
+    response_msg = send_socket(msg)
+    response = read_response(response_msg)
+
+    return response
diff --git a/smoketest/scripts/cli/base_interfaces_test.py b/smoketest/scripts/cli/base_interfaces_test.py
index a9b758802..3e2653a2f 100644
--- a/smoketest/scripts/cli/base_interfaces_test.py
+++ b/smoketest/scripts/cli/base_interfaces_test.py
@@ -46,6 +46,8 @@ dhclient_process_name = 'dhclient'
 dhcp6c_base_dir = directories['dhcp6_client_dir']
 dhcp6c_process_name = 'dhcp6c'
 
+MSG_TESTCASE_UNSUPPORTED = 'unsupported on interface family'
+
 server_ca_root_cert_data = """
 MIIBcTCCARagAwIBAgIUDcAf1oIQV+6WRaW7NPcSnECQ/lUwCgYIKoZIzj0EAwIw
 HjEcMBoGA1UEAwwTVnlPUyBzZXJ2ZXIgcm9vdCBDQTAeFw0yMjAyMTcxOTQxMjBa
@@ -136,6 +138,7 @@ def is_mirrored_to(interface, mirror_if, qdisc):
     if mirror_if in tmp:
         ret_val = True
     return ret_val
+
 class BasicInterfaceTest:
     class TestCase(VyOSUnitTestSHIM.TestCase):
         _test_dhcp = False
@@ -219,7 +222,7 @@ class BasicInterfaceTest:
 
         def test_dhcp_disable_interface(self):
             if not self._test_dhcp:
-                self.skipTest('not supported')
+                self.skipTest(MSG_TESTCASE_UNSUPPORTED)
 
             # When interface is configured as admin down, it must be admin down
             # even when dhcpc starts on the given interface
@@ -242,7 +245,7 @@ class BasicInterfaceTest:
 
         def test_dhcp_client_options(self):
             if not self._test_dhcp or not self._test_vrf:
-                self.skipTest('not supported')
+                self.skipTest(MSG_TESTCASE_UNSUPPORTED)
 
             client_id = 'VyOS-router'
             distance = '100'
@@ -282,7 +285,7 @@ class BasicInterfaceTest:
 
         def test_dhcp_vrf(self):
             if not self._test_dhcp or not self._test_vrf:
-                self.skipTest('not supported')
+                self.skipTest(MSG_TESTCASE_UNSUPPORTED)
 
             cli_default_metric = default_value(self._base_path + [self._interfaces[0],
                                                'dhcp-options', 'default-route-distance'])
@@ -339,7 +342,7 @@ class BasicInterfaceTest:
 
         def test_dhcpv6_vrf(self):
             if not self._test_ipv6_dhcpc6 or not self._test_vrf:
-                self.skipTest('not supported')
+                self.skipTest(MSG_TESTCASE_UNSUPPORTED)
 
             vrf_name = 'purple6'
             self.cli_set(['vrf', 'name', vrf_name, 'table', '65001'])
@@ -391,7 +394,7 @@ class BasicInterfaceTest:
 
         def test_move_interface_between_vrf_instances(self):
             if not self._test_vrf:
-                self.skipTest('not supported')
+                self.skipTest(MSG_TESTCASE_UNSUPPORTED)
 
             vrf1_name = 'smoketest_mgmt1'
             vrf1_table = '5424'
@@ -436,7 +439,7 @@ class BasicInterfaceTest:
 
         def test_add_to_invalid_vrf(self):
             if not self._test_vrf:
-                self.skipTest('not supported')
+                self.skipTest(MSG_TESTCASE_UNSUPPORTED)
 
             # move interface into first VRF
             for interface in self._interfaces:
@@ -454,7 +457,7 @@ class BasicInterfaceTest:
 
         def test_span_mirror(self):
             if not self._mirror_interfaces:
-                self.skipTest('not supported')
+                self.skipTest(MSG_TESTCASE_UNSUPPORTED)
 
             # Check the two-way mirror rules of ingress and egress
             for mirror in self._mirror_interfaces:
@@ -563,7 +566,7 @@ class BasicInterfaceTest:
         def test_ipv6_link_local_address(self):
             # Common function for IPv6 link-local address assignemnts
             if not self._test_ipv6:
-                self.skipTest('not supported')
+                self.skipTest(MSG_TESTCASE_UNSUPPORTED)
 
             for interface in self._interfaces:
                 base = self._base_path + [interface]
@@ -594,7 +597,7 @@ class BasicInterfaceTest:
 
         def test_interface_mtu(self):
             if not self._test_mtu:
-                self.skipTest('not supported')
+                self.skipTest(MSG_TESTCASE_UNSUPPORTED)
 
             for intf in self._interfaces:
                 base = self._base_path + [intf]
@@ -614,7 +617,7 @@ class BasicInterfaceTest:
             # Testcase if MTU can be changed to 1200 on non IPv6
             # enabled interfaces
             if not self._test_mtu or not self._test_ipv6:
-                self.skipTest('not supported')
+                self.skipTest(MSG_TESTCASE_UNSUPPORTED)
 
             old_mtu = self._mtu
             self._mtu = '1200'
@@ -650,7 +653,7 @@ class BasicInterfaceTest:
             # which creates a wlan0 and wlan1 interface which will fail the
             # tearDown() test in the end that no interface is allowed to survive!
             if not self._test_vlan:
-                self.skipTest('not supported')
+                self.skipTest(MSG_TESTCASE_UNSUPPORTED)
 
             for interface in self._interfaces:
                 base = self._base_path + [interface]
@@ -695,7 +698,7 @@ class BasicInterfaceTest:
             # which creates a wlan0 and wlan1 interface which will fail the
             # tearDown() test in the end that no interface is allowed to survive!
             if not self._test_vlan or not self._test_mtu:
-                self.skipTest('not supported')
+                self.skipTest(MSG_TESTCASE_UNSUPPORTED)
 
             mtu_1500 = '1500'
             mtu_9000 = '9000'
@@ -741,7 +744,7 @@ class BasicInterfaceTest:
             # which creates a wlan0 and wlan1 interface which will fail the
             # tearDown() test in the end that no interface is allowed to survive!
             if not self._test_vlan:
-                self.skipTest('not supported')
+                self.skipTest(MSG_TESTCASE_UNSUPPORTED)
 
             for interface in self._interfaces:
                 base = self._base_path + [interface]
@@ -811,7 +814,7 @@ class BasicInterfaceTest:
         def test_vif_8021q_lower_up_down(self):
             # Testcase for https://vyos.dev/T3349
             if not self._test_vlan:
-                self.skipTest('not supported')
+                self.skipTest(MSG_TESTCASE_UNSUPPORTED)
 
             for interface in self._interfaces:
                 base = self._base_path + [interface]
@@ -851,7 +854,7 @@ class BasicInterfaceTest:
             # which creates a wlan0 and wlan1 interface which will fail the
             # tearDown() test in the end that no interface is allowed to survive!
             if not self._test_qinq:
-                self.skipTest('not supported')
+                self.skipTest(MSG_TESTCASE_UNSUPPORTED)
 
             for interface in self._interfaces:
                 base = self._base_path + [interface]
@@ -918,7 +921,7 @@ class BasicInterfaceTest:
             # which creates a wlan0 and wlan1 interface which will fail the
             # tearDown() test in the end that no interface is allowed to survive!
             if not self._test_qinq:
-                self.skipTest('not supported')
+                self.skipTest(MSG_TESTCASE_UNSUPPORTED)
 
             for interface in self._interfaces:
                 base = self._base_path + [interface]
@@ -956,7 +959,7 @@ class BasicInterfaceTest:
 
         def test_interface_ip_options(self):
             if not self._test_ip:
-                self.skipTest('not supported')
+                self.skipTest(MSG_TESTCASE_UNSUPPORTED)
 
             arp_tmo = '300'
             mss = '1420'
@@ -1058,7 +1061,7 @@ class BasicInterfaceTest:
 
         def test_interface_ipv6_options(self):
             if not self._test_ipv6:
-                self.skipTest('not supported')
+                self.skipTest(MSG_TESTCASE_UNSUPPORTED)
 
             mss = '1400'
             dad_transmits = '10'
@@ -1119,7 +1122,7 @@ class BasicInterfaceTest:
 
         def test_dhcpv6_client_options(self):
             if not self._test_ipv6_dhcpc6:
-                self.skipTest('not supported')
+                self.skipTest(MSG_TESTCASE_UNSUPPORTED)
 
             duid_base = 10
             for interface in self._interfaces:
@@ -1170,7 +1173,7 @@ class BasicInterfaceTest:
 
         def test_dhcpv6pd_auto_sla_id(self):
             if not self._test_ipv6_pd:
-                self.skipTest('not supported')
+                self.skipTest(MSG_TESTCASE_UNSUPPORTED)
 
             prefix_len = '56'
             sla_len = str(64 - int(prefix_len))
@@ -1231,7 +1234,7 @@ class BasicInterfaceTest:
 
         def test_dhcpv6pd_manual_sla_id(self):
             if not self._test_ipv6_pd:
-                self.skipTest('not supported')
+                self.skipTest(MSG_TESTCASE_UNSUPPORTED)
 
             prefix_len = '56'
             sla_len = str(64 - int(prefix_len))
@@ -1297,7 +1300,7 @@ class BasicInterfaceTest:
 
         def test_eapol(self):
             if not self._test_eapol:
-                self.skipTest('not supported')
+                self.skipTest(MSG_TESTCASE_UNSUPPORTED)
 
             cfg_dir = '/run/wpa_supplicant'
 
diff --git a/smoketest/scripts/cli/test_interfaces_loopback.py b/smoketest/scripts/cli/test_interfaces_loopback.py
index 0454dc658..f4b6038c5 100755
--- a/smoketest/scripts/cli/test_interfaces_loopback.py
+++ b/smoketest/scripts/cli/test_interfaces_loopback.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2020-2023 VyOS maintainers and contributors
+# Copyright (C) 2020-2025 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -17,6 +17,7 @@
 import unittest
 
 from base_interfaces_test import BasicInterfaceTest
+from base_interfaces_test import MSG_TESTCASE_UNSUPPORTED
 from netifaces import interfaces
 
 from vyos.utils.network import is_intf_addr_assigned
@@ -53,7 +54,7 @@ class LoopbackInterfaceTest(BasicInterfaceTest.TestCase):
             self.assertTrue(is_intf_addr_assigned('lo', addr))
 
     def test_interface_disable(self):
-        self.skipTest('not supported')
+        self.skipTest(MSG_TESTCASE_UNSUPPORTED)
 
 if __name__ == '__main__':
     unittest.main(verbosity=2)
diff --git a/smoketest/scripts/cli/test_interfaces_virtual-ethernet.py b/smoketest/scripts/cli/test_interfaces_virtual-ethernet.py
index c6a4613a7..b2af86139 100755
--- a/smoketest/scripts/cli/test_interfaces_virtual-ethernet.py
+++ b/smoketest/scripts/cli/test_interfaces_virtual-ethernet.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2023-2024 VyOS maintainers and contributors
+# Copyright (C) 2023-2025 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -34,9 +34,6 @@ class VEthInterfaceTest(BasicInterfaceTest.TestCase):
         # call base-classes classmethod
         super(VEthInterfaceTest, cls).setUpClass()
 
-    def test_vif_8021q_mtu_limits(self):
-        self.skipTest('not supported')
-
     # As we always need a pair of veth interfaces, we can not rely on the base
     # class check to determine if there is a dhcp6c or dhclient instance running.
     # This test will always fail as there is an instance running on the peer
diff --git a/smoketest/scripts/cli/test_interfaces_wireless.py b/smoketest/scripts/cli/test_interfaces_wireless.py
index b8b18f30f..1c69c1be5 100755
--- a/smoketest/scripts/cli/test_interfaces_wireless.py
+++ b/smoketest/scripts/cli/test_interfaces_wireless.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2020-2024 VyOS maintainers and contributors
+# Copyright (C) 2020-2025 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -64,13 +64,23 @@ class WirelessInterfaceTest(BasicInterfaceTest.TestCase):
         # call base-classes classmethod
         super(WirelessInterfaceTest, cls).setUpClass()
 
-        # T5245 - currently testcases are disabled
-        cls._test_ipv6 = False
-        cls._test_vlan = False
+        # If any wireless interface is based on mac80211_hwsim, disable all
+        # VLAN related testcases. See T5245, T7325
+        tmp = read_file('/proc/modules')
+        if 'mac80211_hwsim' in tmp:
+            cls._test_ipv6 = False
+            cls._test_vlan = False
+            cls._test_qinq = False
+
+        # Loading mac80211_hwsim module created two WIFI Interfaces in the
+        # background (wlan0 and wlan1), remove them to have a clean test start.
+        # This must happen AFTER the above check for unsupported drivers
+        for interface in cls._interfaces:
+            if interface_exists(interface):
+                call(f'sudo iw dev {interface} del')
 
         cls.cli_set(cls, wifi_cc_path + [country])
 
-
     def test_wireless_add_single_ip_address(self):
         # derived method to check if member interfaces are enslaved properly
         super().test_add_single_ip_address()
@@ -627,9 +637,4 @@ class WirelessInterfaceTest(BasicInterfaceTest.TestCase):
 
 if __name__ == '__main__':
     check_kmod('mac80211_hwsim')
-    # loading the module created two WIFI Interfaces in the background (wlan0 and wlan1)
-    # remove them to have a clean test start
-    for interface in ['wlan0', 'wlan1']:
-        if interface_exists(interface):
-            call(f'sudo iw dev {interface} del')
     unittest.main(verbosity=2)
diff --git a/src/conf_mode/service_dns_forwarding.py b/src/conf_mode/service_dns_forwarding.py
index e3bdbc9f8..5636d6f83 100755
--- a/src/conf_mode/service_dns_forwarding.py
+++ b/src/conf_mode/service_dns_forwarding.py
@@ -366,6 +366,13 @@ def apply(dns):
                     hc.add_name_server_tags_recursor(['dhcp-' + interface,
                                                       'dhcpv6-' + interface ])
 
+        # add dhcp interfaces
+        if 'dhcp' in dns:
+            for interface in dns['dhcp']:
+                if interface_exists(interface):
+                    hc.add_name_server_tags_recursor(['dhcp-' + interface,
+                                                      'dhcpv6-' + interface ])
+
         # hostsd will generate the forward-zones file
         # the list and keys() are required as get returns a dict, not list
         hc.delete_forward_zones(list(hc.get_forward_zones().keys()))
diff --git a/src/op_mode/stp.py b/src/op_mode/stp.py
new file mode 100755
index 000000000..fb57bd7ee
--- /dev/null
+++ b/src/op_mode/stp.py
@@ -0,0 +1,185 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2025 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import sys
+import typing
+import json
+from tabulate import tabulate
+
+import vyos.opmode
+from vyos.utils.process import cmd
+from vyos.utils.network import interface_exists
+
+def detailed_output(dataset, headers):
+    for data in dataset:
+        adjusted_rule = data + [""] * (len(headers) - len(data)) # account for different header length, like default-action
+        transformed_rule = [[header, adjusted_rule[i]] for i, header in enumerate(headers) if i < len(adjusted_rule)] # create key-pair list from headers and rules lists; wrap at 100 char
+
+        print(tabulate(transformed_rule, tablefmt="presto"))
+        print()
+
+def _get_bridge_vlan_data(iface):
+    allowed_vlans = []
+    native_vlan = None
+    vlanData = json.loads(cmd(f"bridge -j -d vlan show"))
+    for vlans in vlanData:
+        if vlans['ifname'] == iface:
+            for allowed in vlans['vlans']:
+                if "flags" in allowed and "PVID" in allowed["flags"]:
+                    native_vlan = allowed['vlan']
+                elif allowed.get('vlanEnd', None):
+                    allowed_vlans.append(f"{allowed['vlan']}-{allowed['vlanEnd']}")
+                else:
+                    allowed_vlans.append(str(allowed['vlan']))
+
+    if not allowed_vlans:
+        allowed_vlans = ["none"]
+    if not native_vlan:
+        native_vlan = "none"
+
+    return ",".join(allowed_vlans), native_vlan
+
+def _get_stp_data(ifname, brInfo, brStatus):
+    tmpInfo = {}
+
+    tmpInfo['bridge_name'] = brInfo.get('ifname')
+    tmpInfo['up_state'] = brInfo.get('operstate')
+    tmpInfo['priority'] = brInfo.get('linkinfo').get('info_data').get('priority')
+    tmpInfo['vlan_filtering'] = "Enabled" if brInfo.get('linkinfo').get('info_data').get('vlan_filtering') == 1 else "Disabled"
+    tmpInfo['vlan_protocol'] = brInfo.get('linkinfo').get('info_data').get('vlan_protocol')
+
+    # The version of VyOS I tested had am issue with the "ip -d link show type bridge"
+    # output. The root_id was always the local bridge, even though the underlying system
+    # understood when it wasn't. Could be an upstream Bug. I pull from the "/sys/class/net"
+    # structure instead. This can be changed later if the "ip link" behavior is corrected.
+
+    #tmpInfo['bridge_id'] = brInfo.get('linkinfo').get('info_data').get('bridge_id')
+    #tmpInfo['root_id'] = brInfo.get('linkinfo').get('info_data').get('root_id')
+
+    tmpInfo['bridge_id'] = cmd(f"cat /sys/class/net/{brInfo.get('ifname')}/bridge/bridge_id").split('.')
+    tmpInfo['root_id'] = cmd(f"cat /sys/class/net/{brInfo.get('ifname')}/bridge/root_id").split('.')
+
+    # The "/sys/class/net" structure stores the IDs without seperators like ':' or '.'
+    # This adds a ':' after every 2 characters to make it resemble a MAC Address
+    tmpInfo['bridge_id'][1] = ':'.join(tmpInfo['bridge_id'][1][i:i+2] for i in range(0, len(tmpInfo['bridge_id'][1]), 2))
+    tmpInfo['root_id'][1] = ':'.join(tmpInfo['root_id'][1][i:i+2] for i in range(0, len(tmpInfo['root_id'][1]), 2))
+
+    tmpInfo['stp_state'] = "Enabled" if brInfo.get('linkinfo', {}).get('info_data', {}).get('stp_state') == 1 else "Disabled"
+
+    # I don't call any of these values, but I created them to be called within raw output if desired
+
+    tmpInfo['mcast_snooping'] = "Enabled" if brInfo.get('linkinfo').get('info_data').get('mcast_snooping') == 1 else "Disabled"
+    tmpInfo['rxbytes'] = brInfo.get('stats64').get('rx').get('bytes')
+    tmpInfo['rxpackets'] = brInfo.get('stats64').get('rx').get('packets')
+    tmpInfo['rxerrors'] = brInfo.get('stats64').get('rx').get('errors')
+    tmpInfo['rxdropped'] = brInfo.get('stats64').get('rx').get('dropped')
+    tmpInfo['rxover_errors'] = brInfo.get('stats64').get('rx').get('over_errors')
+    tmpInfo['rxmulticast'] = brInfo.get('stats64').get('rx').get('multicast')
+    tmpInfo['txbytes'] = brInfo.get('stats64').get('tx').get('bytes')
+    tmpInfo['txpackets'] = brInfo.get('stats64').get('tx').get('packets')
+    tmpInfo['txerrors'] = brInfo.get('stats64').get('tx').get('errors')
+    tmpInfo['txdropped'] = brInfo.get('stats64').get('tx').get('dropped')
+    tmpInfo['txcarrier_errors'] = brInfo.get('stats64').get('tx').get('carrier_errors')
+    tmpInfo['txcollosions'] = brInfo.get('stats64').get('tx').get('collisions')
+
+    tmpStatus = []
+    for members in brStatus:
+        if members.get('master') == brInfo.get('ifname'):
+            allowed_vlans, native_vlan = _get_bridge_vlan_data(members['ifname'])
+            tmpStatus.append({'interface': members.get('ifname'),
+                                'state': members.get('state').capitalize(),
+                                'mtu': members.get('mtu'),
+                                'pathcost': members.get('cost'),
+                                'bpduguard': "Enabled" if members.get('guard') == True else "Disabled",
+                                'rootguard': "Enabled" if members.get('root_block') == True else "Disabled",
+                                'mac_learning': "Enabled" if members.get('learning') == True else "Disabled",
+                                'neigh_suppress': "Enabled" if members.get('neigh_suppress') == True else "Disabled",
+                                'vlan_tunnel': "Enabled" if members.get('vlan_tunnel') == True else "Disabled",
+                                'isolated': "Enabled" if members.get('isolated') == True else "Disabled",
+                                **({'allowed_vlans': allowed_vlans} if allowed_vlans else {}),
+                                **({'native_vlan': native_vlan} if native_vlan else {})})
+
+    tmpInfo['members'] = tmpStatus
+    return tmpInfo
+
+def show_stp(raw: bool, ifname: typing.Optional[str], detail: bool):
+    rawList = []
+    rawDict = {'stp': []}
+
+    if ifname:
+        if not interface_exists(ifname):
+            raise vyos.opmode.Error(f"{ifname} does not exist!")
+    else:
+        ifname = ""
+
+    bridgeInfo = json.loads(cmd(f"ip -j -d -s link show type bridge {ifname}"))
+
+    if not bridgeInfo:
+        raise vyos.opmode.Error(f"No Bridges configured!")
+
+    bridgeStatus = json.loads(cmd(f"bridge -j -s -d link show"))
+
+    for bridges in bridgeInfo:
+        output_list = []
+        amRoot = ""
+        bridgeDict = _get_stp_data(ifname, bridges, bridgeStatus)
+
+        if bridgeDict['bridge_id'][1] == bridgeDict['root_id'][1]:
+            amRoot = " (This bridge is the root)"
+
+        print('-' * 80)
+        print(f"Bridge interface {bridgeDict['bridge_name']} ({bridgeDict['up_state']}):\n")
+        print(f"Spanning Tree is {bridgeDict['stp_state']}")
+        print(f"Bridge ID {bridgeDict['bridge_id'][1]}, Priority {int(bridgeDict['bridge_id'][0], 16)}")
+        print(f"Root ID {bridgeDict['root_id'][1]}, Priority {int(bridgeDict['root_id'][0], 16)}{amRoot}")
+        print(f"VLANs {bridgeDict['vlan_filtering'].capitalize()}, Protocol {bridgeDict['vlan_protocol']}")
+        print()
+
+        for members in bridgeDict['members']:
+            output_list.append([members['interface'],
+                              members['state'],
+                              *([members['pathcost']] if detail else []),
+                              members['bpduguard'],
+                              members['rootguard'],
+                              members['mac_learning'],
+                              *([members['neigh_suppress']] if detail else []),
+                              *([members['vlan_tunnel']] if detail else []),
+                              *([members['isolated']] if detail else []),
+                              *([members['allowed_vlans']] if detail else []),
+                              *([members['native_vlan']] if detail else [])])
+
+        if raw:
+            rawList.append(bridgeDict)
+        elif detail:
+            headers = ['Interface', 'State', 'Pathcost', 'BPDU_Guard', 'Root_Guard', 'Learning', 'Neighbor_Suppression', 'Q-in-Q', 'Port_Isolation', 'Allowed VLANs', 'Native VLAN']
+            detailed_output(output_list, headers)
+        else:
+            headers = ['Interface', 'State', 'BPDU_Guard', 'Root_Guard', 'Learning']
+            print(tabulate(output_list, headers))
+            print()
+
+    if raw:
+        rawDict['stp'] = rawList
+        return rawDict
+
+if __name__ == '__main__':
+    try:
+        res = vyos.opmode.run(sys.modules[__name__])
+        if res:
+            print(res)
+    except (ValueError, vyos.opmode.Error) as e:
+        print(e)
+        sys.exit(1)
diff --git a/src/services/vyos-commitd b/src/services/vyos-commitd
index 8dbd39058..e7f2d82c7 100755
--- a/src/services/vyos-commitd
+++ b/src/services/vyos-commitd
@@ -72,8 +72,6 @@ class Session:
     # pylint: disable=too-many-instance-attributes
 
     session_id: str = ''
-    named_active: str = None
-    named_proposed: str = None
     dry_run: bool = False
     atomic: bool = False
     background: bool = False
@@ -235,8 +233,9 @@ def initialization(session: Session) -> Session:
     scripts_called = []
     setattr(config, 'scripts_called', scripts_called)
 
-    dry_run = False
-    setattr(config, 'dry_run', dry_run)
+    dry_run = session.dry_run
+    config.set_bool_attr('dry_run', dry_run)
+    logger.debug(f'commit dry_run is {dry_run}')
 
     session.config = config
 
@@ -249,11 +248,16 @@ def run_script(script_name: str, config: Config, args: list) -> tuple[bool, str]
     script = conf_mode_scripts[script_name]
     script.argv = args
     config.set_level([])
+    dry_run = config.get_bool_attr('dry_run')
     try:
         c = script.get_config(config)
         script.verify(c)
-        script.generate(c)
-        script.apply(c)
+        if not dry_run:
+            script.generate(c)
+            script.apply(c)
+        else:
+            if hasattr(script, 'call_dependents'):
+                script.call_dependents()
     except ConfigError as e:
         logger.error(e)
         return False, str(e)