chore: bump reva (#11957)

2026-04-25 17:25:21 +02:00 · 2026-01-23 11:49:55 +01:00
parent 6c954402cd
commit 57e063a9bd
40 changed files with 1741 additions and 450 deletions
--- a/changelog/unreleased/enhancement-bump-reva-bruteforce-protection.md
+++ b/changelog/unreleased/enhancement-bump-reva-bruteforce-protection.md
@@ -0,0 +1,5 @@
+Enhancement: Bump Reva
+
+This updates the ownCloud Reva dependency to include brute force protection for public links. The feature implements rate-limiting that blocks access to password-protected public shares after exceeding a configurable maximum number of failed authentication attempts within a time window.
+
+https://github.com/owncloud/reva/pull/460
--- a/go.mod
+++ b/go.mod
@@ -61,12 +61,12 @@ require (
 	github.com/nats-io/nats.go v1.48.0
 	github.com/olekukonko/tablewriter v1.1.0
 	github.com/onsi/ginkgo v1.16.5
-	github.com/onsi/ginkgo/v2 v2.27.4
-	github.com/onsi/gomega v1.38.3
+	github.com/onsi/ginkgo/v2 v2.27.5
+	github.com/onsi/gomega v1.39.0
 	github.com/open-policy-agent/opa v1.12.3
 	github.com/orcaman/concurrent-map v1.0.0
 	github.com/owncloud/libre-graph-api-go v1.0.5-0.20260116104114-10074a92be64
-	github.com/owncloud/reva/v2 v2.0.0-20260116122933-81e6e21256eb
+	github.com/owncloud/reva/v2 v2.0.0-20260123085534-22a1be2b211e
 	github.com/pkg/errors v0.9.1
 	github.com/pkg/xattr v0.4.12
 	github.com/prometheus/client_golang v1.23.2
@@ -96,14 +96,14 @@ require (
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.39.0
 	go.opentelemetry.io/otel/sdk v1.39.0
 	go.opentelemetry.io/otel/trace v1.39.0
-	golang.org/x/crypto v0.46.0
+	golang.org/x/crypto v0.47.0
 	golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b
 	golang.org/x/image v0.32.0
-	golang.org/x/net v0.47.0
+	golang.org/x/net v0.48.0
 	golang.org/x/oauth2 v0.34.0
 	golang.org/x/sync v0.19.0
 	golang.org/x/term v0.39.0
-	golang.org/x/text v0.32.0
+	golang.org/x/text v0.33.0
 	google.golang.org/genproto/googleapis/api v0.0.0-20251222181119-0a764e51fe1b
 	google.golang.org/grpc v1.78.0
 	google.golang.org/protobuf v1.36.11
@@ -292,7 +292,7 @@ require (
 	github.com/pjbgf/sha1cd v0.3.0 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/pquerna/cachecontrol v0.2.0 // indirect
-	github.com/prometheus/alertmanager v0.30.0 // indirect
+	github.com/prometheus/alertmanager v0.30.1 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v0.67.4 // indirect
 	github.com/prometheus/procfs v0.17.0 // indirect
@@ -304,7 +304,7 @@ require (
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/rwcarlsen/goexif v0.0.0-20190401172101-9e8deecbddbd // indirect
 	github.com/segmentio/asm v1.2.1 // indirect
-	github.com/segmentio/kafka-go v0.4.49 // indirect
+	github.com/segmentio/kafka-go v0.4.50 // indirect
 	github.com/segmentio/ksuid v1.0.4 // indirect
 	github.com/sercand/kuberesolver/v5 v5.1.1 // indirect
 	github.com/sergi/go-diff v1.4.0 // indirect
@@ -342,10 +342,10 @@ require (
 	go.uber.org/zap v1.27.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/mod v0.30.0 // indirect
+	golang.org/x/mod v0.31.0 // indirect
 	golang.org/x/sys v0.40.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
-	golang.org/x/tools v0.39.0 // indirect
+	golang.org/x/tools v0.40.0 // indirect
 	google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b // indirect
 	gopkg.in/cenkalti/backoff.v1 v1.1.0 // indirect
--- a/go.sum
+++ b/go.sum
@@ -727,12 +727,12 @@ github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+W
 github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
 github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
 github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
-github.com/onsi/ginkgo/v2 v2.27.4 h1:fcEcQW/A++6aZAZQNUmNjvA9PSOzefMJBerHJ4t8v8Y=
-github.com/onsi/ginkgo/v2 v2.27.4/go.mod h1:ArE1D/XhNXBXCBkKOLkbsb2c81dQHCRcF5zwn/ykDRo=
+github.com/onsi/ginkgo/v2 v2.27.5 h1:ZeVgZMx2PDMdJm/+w5fE/OyG6ILo1Y3e+QX4zSR0zTE=
+github.com/onsi/ginkgo/v2 v2.27.5/go.mod h1:ArE1D/XhNXBXCBkKOLkbsb2c81dQHCRcF5zwn/ykDRo=
 github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
 github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
-github.com/onsi/gomega v1.38.3 h1:eTX+W6dobAYfFeGC2PV6RwXRu/MyT+cQguijutvkpSM=
-github.com/onsi/gomega v1.38.3/go.mod h1:ZCU1pkQcXDO5Sl9/VVEGlDyp+zm0m1cmeG5TOzLgdh4=
+github.com/onsi/gomega v1.39.0 h1:y2ROC3hKFmQZJNFeGAMeHZKkjBL65mIZcvrLQBF9k6Q=
+github.com/onsi/gomega v1.39.0/go.mod h1:ZCU1pkQcXDO5Sl9/VVEGlDyp+zm0m1cmeG5TOzLgdh4=
 github.com/open-policy-agent/opa v1.12.3 h1:qe3m/w52baKC/HJtippw+hYBUKCzuBCPjB+D5P9knfc=
 github.com/open-policy-agent/opa v1.12.3/go.mod h1:RnDgm04GA1RjEXJvrsG9uNT/+FyBNmozcPvA2qz60M4=
 github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
@@ -742,8 +742,8 @@ github.com/orcaman/concurrent-map v1.0.0 h1:I/2A2XPCb4IuQWcQhBhSwGfiuybl/J0ev9HD
 github.com/orcaman/concurrent-map v1.0.0/go.mod h1:Lu3tH6HLW3feq74c2GC+jIMS/K2CFcDWnWD9XkenwhI=
 github.com/owncloud/libre-graph-api-go v1.0.5-0.20260116104114-10074a92be64 h1:z9djjzd+leAy6QZpi8dLy3OVjc/um+1XAGk1SJEvwE8=
 github.com/owncloud/libre-graph-api-go v1.0.5-0.20260116104114-10074a92be64/go.mod h1:z61VMGAJRtR1nbgXWiNoCkxUXP1B3Je9rMuJbnGd+Og=
-github.com/owncloud/reva/v2 v2.0.0-20260116122933-81e6e21256eb h1:G4YhVvtdJDEE0fhV0sWMUDpcpV5WqQNdfLw9xNMfkFI=
-github.com/owncloud/reva/v2 v2.0.0-20260116122933-81e6e21256eb/go.mod h1:nDBXQivlwd4Vf5UD/oDT0RakSXy0GJPI1LsyHMm5IpI=
+github.com/owncloud/reva/v2 v2.0.0-20260123085534-22a1be2b211e h1:SL7kqt9HyZpyeWjb0saiRm1COMPZhQ9w8lUoCHWgm2o=
+github.com/owncloud/reva/v2 v2.0.0-20260123085534-22a1be2b211e/go.mod h1:eHbT6pmVlcjdiBeVEYw7exlfJmemMzKBh4R+HFgx9Cc=
 github.com/oxtoacart/bpool v0.0.0-20190530202638-03653db5a59c h1:rp5dCmg/yLR3mgFuSOe4oEnDDmGLROTvMragMUXpTQw=
 github.com/oxtoacart/bpool v0.0.0-20190530202638-03653db5a59c/go.mod h1:X07ZCGwUbLaax7L0S3Tw4hpejzu63ZrrQiUe6W0hcy0=
 github.com/pablodz/inotifywaitgo v0.0.9 h1:njquRbBU7fuwIe5rEvtaniVBjwWzcpdUVptSgzFqZsw=
@@ -771,8 +771,8 @@ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRI
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pquerna/cachecontrol v0.2.0 h1:vBXSNuE5MYP9IJ5kjsdo8uq+w41jSPgvba2DEnkRx9k=
 github.com/pquerna/cachecontrol v0.2.0/go.mod h1:NrUG3Z7Rdu85UNR3vm7SOsl1nFIeSiQnrHV5K9mBcUI=
-github.com/prometheus/alertmanager v0.30.0 h1:E4dnxSFXK8V2Bb8iqudlisTmaIrF3hRJSWnliG08tBM=
-github.com/prometheus/alertmanager v0.30.0/go.mod h1:93PBumcTLr/gNtNtM0m7BcCffbvYP5bKuLBWiOnISaA=
+github.com/prometheus/alertmanager v0.30.1 h1:427prmCHuy1rMmV7fl/TVQFh5A/78XQ/Mp+TsswZNGM=
+github.com/prometheus/alertmanager v0.30.1/go.mod h1:93PBumcTLr/gNtNtM0m7BcCffbvYP5bKuLBWiOnISaA=
 github.com/prometheus/client_golang v0.8.0/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
@@ -835,8 +835,8 @@ github.com/rwcarlsen/goexif v0.0.0-20190401172101-9e8deecbddbd h1:CmH9+J6ZSsIjUK
 github.com/rwcarlsen/goexif v0.0.0-20190401172101-9e8deecbddbd/go.mod h1:hPqNNc0+uJM6H+SuU8sEs5K5IQeKccPqeSjfgcKGgPk=
 github.com/segmentio/asm v1.2.1 h1:DTNbBqs57ioxAD4PrArqftgypG4/qNpXoJx8TVXxPR0=
 github.com/segmentio/asm v1.2.1/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr5aAcs=
-github.com/segmentio/kafka-go v0.4.49 h1:GJiNX1d/g+kG6ljyJEoi9++PUMdXGAxb7JGPiDCuNmk=
-github.com/segmentio/kafka-go v0.4.49/go.mod h1:Y1gn60kzLEEaW28YshXyk2+VCUKbJ3Qr6DrnT3i4+9E=
+github.com/segmentio/kafka-go v0.4.50 h1:mcyC3tT5WeyWzrFbd6O374t+hmcu1NKt2Pu1L3QaXmc=
+github.com/segmentio/kafka-go v0.4.50/go.mod h1:Y1gn60kzLEEaW28YshXyk2+VCUKbJ3Qr6DrnT3i4+9E=
 github.com/segmentio/ksuid v1.0.4 h1:sBo2BdShXjmcugAMwjugoGUdUV0pcxY5mW4xKRn3v4c=
 github.com/segmentio/ksuid v1.0.4/go.mod h1:/XUiZBD3kVx5SmUOl55voK5yeAbBNNIed+2O73XgrPE=
 github.com/sercand/kuberesolver/v5 v5.1.1 h1:CYH+d67G0sGBj7q5wLK61yzqJJ8gLLC8aeprPTHb6yY=
@@ -1022,8 +1022,8 @@ golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
-golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU=
-golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0=
+golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8=
+golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -1065,8 +1065,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.30.0 h1:fDEXFVZ/fmCKProc/yAXXUijritrDzahmwwefnjoPFk=
-golang.org/x/mod v0.30.0/go.mod h1:lAsf5O2EvJeSFMiBxXDki7sCgAxEUcZHXoXMKT4GJKc=
+golang.org/x/mod v0.31.0 h1:HaW9xtz0+kOcWKwli0ZXy79Ix+UW/vOfmWI5QVd2tgI=
+golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1112,8 +1112,8 @@ golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
-golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
+golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=
+golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1234,8 +1234,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
-golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
-golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
+golang.org/x/text v0.33.0 h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE=
+golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -1290,8 +1290,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.39.0 h1:ik4ho21kwuQln40uelmciQPp9SipgNDdrafrYA4TmQQ=
-golang.org/x/tools v0.39.0/go.mod h1:JnefbkDPyD8UU2kI5fuf8ZX4/yUeh9W877ZeBONxUqQ=
+golang.org/x/tools v0.40.0 h1:yLkxfA+Qnul4cs9QA3KnlFu0lVmd8JJfoq+E41uSutA=
+golang.org/x/tools v0.40.0/go.mod h1:Ik/tzLRlbscWpqqMRjyWYDisX8bG13FrdXp3o4Sr9lc=
 golang.org/x/tools/godoc v0.1.0-deprecated h1:o+aZ1BOj6Hsx/GBdJO/s815sqftjSnrZZwyYTHODvtk=
 golang.org/x/tools/godoc v0.1.0-deprecated/go.mod h1:qM63CriJ961IHWmnWa9CjZnBndniPt4a3CK0PVB9bIg=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
--- a/vendor/github.com/onsi/ginkgo/v2/CHANGELOG.md
+++ b/vendor/github.com/onsi/ginkgo/v2/CHANGELOG.md
@@ -1,3 +1,8 @@
+## 2.27.5
+
+### Fixes
+Don't make a new formatter for each GinkgoT(); that's just silly and uses precious memory
+
 ## 2.27.4

 ### Fixes
--- a/vendor/github.com/onsi/ginkgo/v2/internal/testingtproxy/testing_t_proxy.go
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/testingtproxy/testing_t_proxy.go
@@ -27,6 +27,11 @@ type ginkgoWriterInterface interface {
 type ginkgoRecoverFunc func()
 type attachProgressReporterFunc func(func() string) func()

+var formatters = map[bool]formatter.Formatter{
+	true:  formatter.NewWithNoColorBool(true),
+	false: formatter.NewWithNoColorBool(false),
+}
+
 func New(writer ginkgoWriterInterface, fail failFunc, skip skipFunc, cleanup cleanupFunc, report reportFunc, addReportEntry addReportEntryFunc, ginkgoRecover ginkgoRecoverFunc, attachProgressReporter attachProgressReporterFunc, randomSeed int64, parallelProcess int, parallelTotal int, noColor bool, offset int) *ginkgoTestingTProxy {
 	return &ginkgoTestingTProxy{
 		fail:                   fail,
@@ -41,7 +46,7 @@ func New(writer ginkgoWriterInterface, fail failFunc, skip skipFunc, cleanup cle
 		randomSeed:             randomSeed,
 		parallelProcess:        parallelProcess,
 		parallelTotal:          parallelTotal,
-		f:                      formatter.NewWithNoColorBool(noColor),
+		f:                      formatters[noColor], //minimize allocations by reusing formatters
 	}
 }

--- a/vendor/github.com/onsi/ginkgo/v2/types/version.go
+++ b/vendor/github.com/onsi/ginkgo/v2/types/version.go
@@ -1,3 +1,3 @@
 package types

-const VERSION = "2.27.4"
+const VERSION = "2.27.5"
--- a/vendor/github.com/onsi/gomega/CHANGELOG.md
+++ b/vendor/github.com/onsi/gomega/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 1.39.0
+
+### Features
+
+Add `MatchErrorStrictly` which only passes if `errors.Is(actual, expected)` returns true.  `MatchError`, by contrast, will fallback to string comparison.
+
 ## 1.38.3

 ### Fixes
--- a/vendor/github.com/onsi/gomega/gomega_dsl.go
+++ b/vendor/github.com/onsi/gomega/gomega_dsl.go
@@ -22,7 +22,7 @@ import (
 	"github.com/onsi/gomega/types"
 )

-const GOMEGA_VERSION = "1.38.3"
+const GOMEGA_VERSION = "1.39.0"

 const nilGomegaPanic = `You are trying to make an assertion, but haven't registered Gomega's fail handler.
 If you're using Ginkgo then you probably forgot to put your assertion in an It().
--- a/vendor/github.com/onsi/gomega/matchers.go
+++ b/vendor/github.com/onsi/gomega/matchers.go
@@ -146,6 +146,24 @@ func MatchError(expected any, functionErrorDescription ...any) types.GomegaMatch
 	}
 }

+// MatchErrorStrictly succeeds iff actual is a non-nil error that matches the passed in
+// expected error according to errors.Is(actual, expected).
+//
+// This behavior differs from MatchError where
+//
+//	Expect(errors.New("some error")).To(MatchError(errors.New("some error")))
+//
+// succeeds, but errors.Is would return false so:
+//
+//	Expect(errors.New("some error")).To(MatchErrorStrictly(errors.New("some error")))
+//
+// fails.
+func MatchErrorStrictly(expected error) types.GomegaMatcher {
+	return &matchers.MatchErrorStrictlyMatcher{
+		Expected: expected,
+	}
+}
+
 // BeClosed succeeds if actual is a closed channel.
 // It is an error to pass a non-channel to BeClosed, it is also an error to pass nil
 //
--- a/vendor/github.com/onsi/gomega/matchers/match_error_strictly_matcher.go
+++ b/vendor/github.com/onsi/gomega/matchers/match_error_strictly_matcher.go
@@ -0,0 +1,39 @@
+package matchers
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/onsi/gomega/format"
+)
+
+type MatchErrorStrictlyMatcher struct {
+	Expected error
+}
+
+func (matcher *MatchErrorStrictlyMatcher) Match(actual any) (success bool, err error) {
+
+	if isNil(matcher.Expected) {
+		return false, fmt.Errorf("Expected error is nil, use \"ToNot(HaveOccurred())\" to explicitly check for nil errors")
+	}
+
+	if isNil(actual) {
+		return false, fmt.Errorf("Expected an error, got nil")
+	}
+
+	if !isError(actual) {
+		return false, fmt.Errorf("Expected an error.  Got:\n%s", format.Object(actual, 1))
+	}
+
+	actualErr := actual.(error)
+
+	return errors.Is(actualErr, matcher.Expected), nil
+}
+
+func (matcher *MatchErrorStrictlyMatcher) FailureMessage(actual any) (message string) {
+	return format.Message(actual, "to match error", matcher.Expected)
+}
+
+func (matcher *MatchErrorStrictlyMatcher) NegatedFailureMessage(actual any) (message string) {
+	return format.Message(actual, "not to match error", matcher.Expected)
+}
--- a/vendor/github.com/owncloud/reva/v2/internal/grpc/interceptors/metadata/metadata.go
+++ b/vendor/github.com/owncloud/reva/v2/internal/grpc/interceptors/metadata/metadata.go
@@ -0,0 +1,73 @@
+package metadata
+
+import (
+	"context"
+	"strings"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/metadata"
+)
+
+// NewUnary returns a server interceptor that will propagate GRPC metadata
+func NewUnary(autoPropPrefix string) grpc.UnaryServerInterceptor {
+	return func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) {
+		md, ok := metadata.FromIncomingContext(ctx)
+		if !ok {
+			md = metadata.MD{}
+		}
+
+		pairs := make([]string, 0, md.Len()*2)
+		for key, values := range md {
+			if strings.HasPrefix(key, autoPropPrefix) {
+				for _, value := range values {
+					pairs = append(pairs, key, value)
+				}
+			}
+		}
+
+		newctx := metadata.AppendToOutgoingContext(ctx, pairs...)
+		return handler(newctx, req)
+	}
+}
+
+// NewStream returns a server interceptor that will propagate GRPC metadata
+func NewStream(autoPropPrefix string) grpc.StreamServerInterceptor {
+	return func(srv interface{}, ss grpc.ServerStream, info *grpc.StreamServerInfo, handler grpc.StreamHandler) error {
+		ctx := ss.Context()
+
+		md, ok := metadata.FromIncomingContext(ctx)
+		if !ok {
+			md = metadata.MD{}
+		}
+
+		pairs := make([]string, 0, md.Len()*2)
+		for key, values := range md {
+			if strings.HasPrefix(key, autoPropPrefix) {
+				for _, value := range values {
+					pairs = append(pairs, key, value)
+				}
+			}
+		}
+
+		newctx := metadata.AppendToOutgoingContext(ctx, pairs...)
+
+		wrapped := newWrappedServerStream(newctx, ss)
+		return handler(srv, wrapped)
+	}
+}
+
+// newWrappedServerStream returns a wrapped server stream in order to customize
+// the GRPC server stream's context. It will use the one provided.
+func newWrappedServerStream(ctx context.Context, ss grpc.ServerStream) *wrappedServerStream {
+	return &wrappedServerStream{ServerStream: ss, newCtx: ctx}
+}
+
+type wrappedServerStream struct {
+	grpc.ServerStream
+	newCtx context.Context
+}
+
+// Context returns the context of the server stream
+func (ss *wrappedServerStream) Context() context.Context {
+	return ss.newCtx
+}
--- a/vendor/github.com/owncloud/reva/v2/internal/grpc/services/gateway/authprovider.go
+++ b/vendor/github.com/owncloud/reva/v2/internal/grpc/services/gateway/authprovider.go
@@ -65,6 +65,8 @@ func (s *svc) Authenticate(ctx context.Context, req *gateway.AuthenticateRequest
 		fallthrough
 	case res.Status.Code == rpc.Code_CODE_UNAUTHENTICATED:
 		fallthrough
+	case res.Status.Code == rpc.Code_CODE_RESOURCE_EXHAUSTED:
+		fallthrough
 	case res.Status.Code == rpc.Code_CODE_NOT_FOUND:
 		// normal failures, no need to log
 		return &gateway.AuthenticateResponse{
--- a/vendor/github.com/owncloud/reva/v2/internal/http/services/owncloud/ocdav/dav.go
+++ b/vendor/github.com/owncloud/reva/v2/internal/http/services/owncloud/ocdav/dav.go
@@ -330,6 +330,9 @@ func (h *DavHandler) Handler(s *svc) http.Handler {
 			case res.Status.Code == rpc.Code_CODE_NOT_FOUND:
 				w.WriteHeader(http.StatusNotFound)
 				return
+			case res.Status.Code == rpc.Code_CODE_RESOURCE_EXHAUSTED:
+				w.WriteHeader(http.StatusTooManyRequests)
+				return
 			case res.Status.Code != rpc.Code_CODE_OK:
 				w.WriteHeader(http.StatusInternalServerError)
 				return
--- a/vendor/github.com/owncloud/reva/v2/pkg/auth/manager/publicshares/bruteforceprotection.go
+++ b/vendor/github.com/owncloud/reva/v2/pkg/auth/manager/publicshares/bruteforceprotection.go
@@ -0,0 +1,329 @@
+package publicshares
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"math/rand"
+	"sync"
+	"time"
+
+	"github.com/owncloud/reva/v2/pkg/appctx"
+	"github.com/owncloud/reva/v2/pkg/rgrpc"
+	"github.com/rs/zerolog"
+	microstore "go-micro.dev/v4/store"
+	"google.golang.org/grpc/metadata"
+)
+
+const (
+	maxWriteRetries = 10
+)
+
+// attemptData contains the data we need to store for each failed attempt.
+// Right now, only the timestamp of the failed attempt is needed
+type attemptData struct {
+	ID        int   `json:"attemptId"`
+	Timestamp int64 `json:"timestamp"`
+}
+
+// BruteForceProtection implements a rate-limit-based protection for the
+// public shares.
+// Given a time duration (10 minutes, for example), a maximum of X failed
+// attempts are allowed. If that rate is reached, access to the public link
+// should be blocked until the rate decreases.
+// Note that the time the link should be blocked is undefined and will be
+// somewhere between 0 and the given duration
+type BruteForceProtection struct {
+	ID          int
+	mutex       *sync.Mutex
+	timeGap     time.Duration
+	maxAttempts int
+	store       microstore.Store
+}
+
+// NewBruteForceProtection creates a new instance of BruteForceProtection
+// If either the timeGap or maxAttempts are 0, the BruteForceProtection
+// won't register any failed attempt and it will act as if it is disabled.
+func NewBruteForceProtection(store microstore.Store, timeGap time.Duration, maxAttempts int) *BruteForceProtection {
+	return &BruteForceProtection{
+		ID:          rand.Int(),
+		mutex:       &sync.Mutex{},
+		timeGap:     timeGap,
+		maxAttempts: maxAttempts,
+		store:       store,
+	}
+}
+
+// AddAttemptAndCheckAllow register a new failed attempt for the provided public share
+// If the time gap or the max attempts are 0, the failed attempt won't be
+// registered.
+// The function returns a boolean whether there are more failed attempts
+// available (allowing access), and an error if something wrong happens.
+func (bfp *BruteForceProtection) AddAttemptAndCheckAllow(ctx context.Context, shareToken string) (bool, error) {
+	if bfp.timeGap <= 0 || bfp.maxAttempts <= 0 {
+		return true, nil
+	}
+
+	bfp.mutex.Lock()
+	defer bfp.mutex.Unlock()
+
+	attempt := &attemptData{
+		ID:        rand.Int(),
+		Timestamp: time.Now().Unix(),
+	}
+
+	log := appctx.GetLogger(ctx)
+	sublog := log.With().
+		Int("instanceID", bfp.ID).
+		Str("shareToken", shareToken).
+		Int("attemptID", attempt.ID).
+		Int64("attemptTimestamp", attempt.Timestamp).
+		Logger()
+
+	attemptCount, err := bfp.writeWithRetry(shareToken, attempt, sublog)
+	if err != nil {
+		sublog.Error().Err(err).Msg("Could not include the failed attempt for brute force protection")
+		return false, err
+	}
+
+	sublog.Debug().
+		Int("attemptCount", attemptCount).
+		Bool("stillAccessible", attemptCount <= bfp.maxAttempts).
+		Msg("Failed attempt registered for brute force protection")
+
+	return attemptCount <= bfp.maxAttempts, nil
+}
+
+// Verify will check if access to the share is available.
+// It will also update the stored information (expiring old data).
+// In case of errors, the verification will return false.
+func (bfp *BruteForceProtection) Verify(ctx context.Context, shareToken string) bool {
+	bfp.mutex.Lock()
+	defer bfp.mutex.Unlock()
+
+	log := appctx.GetLogger(ctx)
+	sublog := log.With().
+		Int("instanceID", bfp.ID).
+		Str("shareToken", shareToken).
+		Logger()
+
+	attemptList, err := bfp.readFromStore(shareToken)
+	if err != nil {
+		sublog.Error().Err(err).Msg("Could not read from the cache store")
+		return false
+	}
+
+	updatedList := bfp.cleanAttempts(attemptList)
+	if len(attemptList) != len(updatedList) {
+		sublog.Debug().Msg("Cleaning obsolete attempts")
+		if _, err := bfp.writeWithRetry(shareToken, nil, sublog); err != nil {
+			sublog.Error().Err(err).Msg("Failed to update the cache store")
+			return false
+		}
+	}
+
+	updatedListCount := len(updatedList)
+	sublog.Debug().
+		Int("attemptCount", updatedListCount).
+		Bool("stillAccessible", updatedListCount <= bfp.maxAttempts).
+		Msg("Verification for brute force protection done")
+
+	return updatedListCount <= bfp.maxAttempts
+}
+
+// Ensure the attempt is added in the right possition. Since multiple attempts
+// can happen very closely, the attempt at time 73 might have been registered
+// before the attempt at time 72
+func (bfp *BruteForceProtection) insertAttempt(attemptList []*attemptData, attempt *attemptData) []*attemptData {
+	if attempt == nil {
+		return attemptList
+	}
+
+	var i int
+	for i = 0; i < len(attemptList); i++ {
+		if attemptList[i].Timestamp > attempt.Timestamp {
+			break
+		}
+	}
+
+	return append(attemptList[:i], append([]*attemptData{attempt}, attemptList[i:]...)...)
+}
+
+// cleanAttempts will remove obsolete attempt data
+func (bfp *BruteForceProtection) cleanAttempts(attemptList []*attemptData) []*attemptData {
+	minTimestamp := time.Now().Add(-1 * bfp.timeGap).Unix()
+
+	var index int
+	for index = 0; index < len(attemptList); index++ {
+		if attemptList[index].Timestamp >= minTimestamp {
+			break
+		}
+	}
+
+	return attemptList[index:]
+}
+
+// areEqualLists checks that both lists have the same data
+func (bfp *BruteForceProtection) areEqualLists(a, b []*attemptData) bool {
+	if len(a) != len(b) {
+		return false
+	}
+
+	for i := 0; i < len(a); i++ { // already checked that the length of both lists are the same
+		if a[i].Timestamp != b[i].Timestamp {
+			return false
+		}
+	}
+	return true
+}
+
+// writeWithRetry will write the attempt data for the share. You can use a
+// nil attempt in order to just update and remove obsolete attempts.
+// This involves several steps:
+// 1. Read the current stored data.
+// 2. Update and insert the attempt in its right position (although unlikely,
+// replicas might have written a different attempt which happens later than
+// the attempt we're writing). Cleanup obsolete data also happens here.
+// 3. Write the data into the store.
+// 4. Re-read the written data to check it wasn't overwritten. This implies
+// checking and comparing the data written and read. If the check is wrong,
+// go back to step 2.
+//
+// This method includes retries (up to maxWriteRetries = 10) in case the check
+// fails.
+//
+// This method will return the number of the elements read for the check (at
+// step 4) and an error if any.
+func (bfp *BruteForceProtection) writeWithRetry(shareToken string, attempt *attemptData, logger zerolog.Logger) (int, error) {
+	// read the stored data
+	attemptList, err := bfp.readFromStore(shareToken)
+	if err != nil {
+		logger.Error().Err(err).Msg("Could not read from store before writing on it")
+		return 0, err
+	}
+
+	tries := 0
+	for tries = 0; tries < maxWriteRetries; tries++ {
+		updatedList := bfp.cleanAttempts(bfp.insertAttempt(attemptList, attempt))
+		if len(updatedList) == 0 {
+			// if all attempts expired, delete the info
+			// the new attempt shouldn't have expired, so this shouldn't happen
+			if derr := bfp.deleteFromStore(shareToken); derr != nil {
+				logger.Error().Err(err).Int("tryNo", tries).Msg("Error deleting from the cache store")
+				return 0, derr
+			}
+		} else {
+
+			// write the updated data into the store
+			if werr := bfp.writeToStore(shareToken, updatedList); werr != nil {
+				logger.Error().Err(err).Int("tryNo", tries).Msg("Error writing to the cache store")
+				return 0, werr
+			}
+		}
+
+		// re-read the data to ensure the data has been correctly updated
+		attemptList, err = bfp.readFromStore(shareToken)
+		if err != nil {
+			logger.Error().Err(err).Int("tryNo", tries).Msg("Error reading from the cache store")
+			return 0, err
+		}
+
+		// TODO: the areEqualLists might be too strict. We might just need
+		// to check that the data we want to add is present despite there
+		// could be additional data from other replicas
+		if bfp.areEqualLists(attemptList, updatedList) {
+			// if both lists are equal, the write was successful
+			break
+		}
+
+		logger.Info().Int("tryNo", tries).Msg("Attempt data seems to have been overwritten. Retrying")
+	}
+
+	if tries >= maxWriteRetries {
+		// couldn't write the data
+		return 0, errors.New("Could not ensure the data to be written in the store. Retries spent")
+	}
+	return len(attemptList), nil
+}
+
+// readFromStore will read the data from store and return a list with the failed
+// attempts. If there no failed attempts registered, an empty list will be returned.
+func (bfp *BruteForceProtection) readFromStore(shareToken string) ([]*attemptData, error) {
+	records, err := bfp.store.Read(shareToken)
+	if errors.Is(err, microstore.ErrNotFound) {
+		// if the key isn't found, use an empty list
+		return make([]*attemptData, 0), nil
+	} else if err != nil {
+		return nil, err
+	}
+
+	attemptList := make([]*attemptData, 0)
+	if jerr := json.Unmarshal(records[0].Value, &attemptList); jerr != nil {
+		return nil, jerr
+	}
+
+	return attemptList, nil
+}
+
+// writeToStore will write the attempt list into the store
+func (bfp *BruteForceProtection) writeToStore(shareToken string, attemptList []*attemptData) error {
+	marshalledList, merr := json.Marshal(attemptList)
+	if merr != nil {
+		return merr
+	}
+
+	newRecord := &microstore.Record{
+		Key:   shareToken,
+		Value: marshalledList,
+	}
+	if werr := bfp.store.Write(newRecord); werr != nil {
+		return werr
+	}
+	return nil
+}
+
+// deleteFromStore will delete the attempt list from the store. This should
+// only be called if the attempt list is empty.
+func (bfp *BruteForceProtection) deleteFromStore(shareToken string) error {
+	return bfp.store.Delete(shareToken)
+}
+
+// outgoingContextKey is the key that will be used to mark that the brute
+// force protection shouldn't consider the password for the share token
+// (context value) as a failed attempt even if the password is wrong.
+// The key is intended to auto-propagate across all the GRPC services.
+const outgoingContextKey = rgrpc.AutoPropPrefix + "bfp-skip"
+
+// MarkSkipAttemptContext will mark the share token so it will be skipped
+// for the brute force protection. This means that the password for the
+// share token won't be counted as a failed attempt even if the password
+// is wrong.
+// This "skip" will be valid within the returned context.
+// The context key used should auto-propagate across all the GRPC services,
+// assuming the metadata interceptors are in place (check
+// internal/grpc/interceptors/metadata/metadata.go)
+func MarkSkipAttemptContext(ctx context.Context, shareToken string) context.Context {
+	return metadata.AppendToOutgoingContext(ctx, outgoingContextKey, shareToken)
+}
+
+// CheckSkipAttempt will check whether we should skip the brute force
+// protection for the share token based on the context data.
+// If you want to skip the protection, the MarkSkipAttemptContext method
+// should have been called for the provided share token, and the returned
+// context needs to be used.
+// This method will return true if the context contains data marking the
+// share token as "to skip" (from the MarkSkipAttemptContext method). If there
+// is no such data, it will return false.
+func CheckSkipAttempt(ctx context.Context, shareToken string) bool {
+	possibleValues := metadata.ValueFromIncomingContext(ctx, outgoingContextKey)
+	if possibleValues == nil || len(possibleValues) < 1 {
+		return false
+	}
+
+	for _, value := range possibleValues {
+		if value == shareToken {
+			return true
+		}
+	}
+	return false
+}
--- a/vendor/github.com/owncloud/reva/v2/pkg/auth/manager/publicshares/publicshares.go
+++ b/vendor/github.com/owncloud/reva/v2/pkg/auth/manager/publicshares/publicshares.go
@@ -28,14 +28,16 @@ import (
 	rpcv1beta1 "github.com/cs3org/go-cs3apis/cs3/rpc/v1beta1"
 	link "github.com/cs3org/go-cs3apis/cs3/sharing/link/v1beta1"
 	types "github.com/cs3org/go-cs3apis/cs3/types/v1beta1"
+	"github.com/mitchellh/mapstructure"
 	"github.com/owncloud/reva/v2/pkg/auth"
 	"github.com/owncloud/reva/v2/pkg/auth/manager/registry"
 	"github.com/owncloud/reva/v2/pkg/auth/scope"
 	"github.com/owncloud/reva/v2/pkg/errtypes"
 	"github.com/owncloud/reva/v2/pkg/rgrpc/todo/pool"
+	"github.com/owncloud/reva/v2/pkg/store"
 	"github.com/owncloud/reva/v2/pkg/utils"
-	"github.com/mitchellh/mapstructure"
 	"github.com/pkg/errors"
+	microstore "go-micro.dev/v4/store"
 )

 func init() {
@@ -43,11 +45,20 @@ func init() {
 }

 type manager struct {
-	c *config
+	c   *config
+	bfp *BruteForceProtection
 }

 type config struct {
-	GatewayAddr string `mapstructure:"gateway_addr"`
+	GatewayAddr           string        `mapstructure:"gateway_addr"`
+	BruteForceTimeGap     time.Duration `mapstructure:"brute_force_time_gap"`
+	BruteForceMaxAttempts int           `mapstructure:"brute_force_max_attempts"`
+	StoreType             string        `mapstructure:"store_type"`
+	StoreNodes            []string      `mapstructure:"store_nodes"`
+	StoreDatabase         string        `mapstructure:"store_database"`
+	StoreTable            string        `mapstructure:"store_table"`
+	StoreUsername         string        `mapstructure:"store_username"`
+	StorePassword         string        `mapstructure:"store_password"`
 }

 func parseConfig(m map[string]interface{}) (*config, error) {
@@ -66,6 +77,15 @@ func New(m map[string]interface{}) (auth.Manager, error) {
 	if err != nil {
 		return nil, err
 	}
+
+	revaStore := store.Create(
+		store.Store(mgr.c.StoreType),
+		microstore.Nodes(mgr.c.StoreNodes...),
+		microstore.Database(mgr.c.StoreDatabase),
+		microstore.Table(mgr.c.StoreTable),
+		store.Authentication(mgr.c.StoreUsername, mgr.c.StorePassword),
+	)
+	mgr.bfp = NewBruteForceProtection(revaStore, mgr.c.BruteForceTimeGap, mgr.c.BruteForceMaxAttempts)
 	return mgr, nil
 }

@@ -79,6 +99,12 @@ func (m *manager) Configure(ml map[string]interface{}) error {
 }

 func (m *manager) Authenticate(ctx context.Context, token, secret string) (*user.User, map[string]*authpb.Scope, error) {
+	if !m.bfp.Verify(ctx, token) {
+		// brute force protection fail to verify the token even after
+		// cleaning the info
+		return nil, nil, errtypes.TooManyRequests("Too many failed requests")
+	}
+
 	gwConn, err := pool.GetGatewayServiceClient(m.c.GatewayAddr)
 	if err != nil {
 		return nil, nil, err
@@ -122,6 +148,15 @@ func (m *manager) Authenticate(ctx context.Context, token, secret string) (*user
 	case publicShareResponse.Status.Code == rpcv1beta1.Code_CODE_NOT_FOUND:
 		return nil, nil, errtypes.NotFound(publicShareResponse.Status.Message)
 	case publicShareResponse.Status.Code == rpcv1beta1.Code_CODE_PERMISSION_DENIED:
+		if secret != "" && secret != "|" && !CheckSkipAttempt(ctx, token) {
+			// FIXME: needs better detection. There are some scenarios where empty
+			// passwords reach this line with secret = "|", so we consider that
+			// particular string as an empty password for now.
+			allowed, _ := m.bfp.AddAttemptAndCheckAllow(ctx, token)
+			if !allowed {
+				return nil, nil, errtypes.TooManyRequests("Too many failed requests")
+			}
+		}
 		return nil, nil, errtypes.InvalidCredentials(publicShareResponse.Status.Message)
 	case publicShareResponse.Status.Code != rpcv1beta1.Code_CODE_OK:
 		return nil, nil, errtypes.InternalError(publicShareResponse.Status.Message)
--- a/vendor/github.com/owncloud/reva/v2/pkg/errtypes/errtypes.go
+++ b/vendor/github.com/owncloud/reva/v2/pkg/errtypes/errtypes.go
@@ -205,6 +205,14 @@ func (e TooEarly) Error() string { return "error: too early: " + string(e) }
 // IsTooEarly implements the IsTooEarly interface.
 func (e TooEarly) IsTooEarly() {}

+// TooManyRequests is the error to use when too many requests have been received in a given period of time
+type TooManyRequests string
+
+func (e TooManyRequests) Error() string { return "error: too many requests: " + string(e) }
+
+// IsTooManyRequests implements the IsTooManyRequests interface
+func (e TooManyRequests) IsTooManyRequests() {}
+
 // IsNotFound is the interface to implement
 // to specify that a resource is not found.
 type IsNotFound interface {
@@ -295,6 +303,12 @@ type IsTooEarly interface {
 	IsTooEarly()
 }

+// IsTooManyRequests is the interface to implement
+// to specify that too many requests have been received in a period of time
+type IsTooManyRequests interface {
+	IsTooManyRequests()
+}
+
 // NewErrtypeFromStatus maps a rpc status to an errtype
 func NewErrtypeFromStatus(status *rpc.Status) error {
 	switch status.Code {
@@ -365,6 +379,8 @@ func NewErrtypeFromHTTPStatusCode(code int, message string) error {
 		return PartialContent(message)
 	case http.StatusTooEarly:
 		return TooEarly(message)
+	case http.StatusTooManyRequests:
+		return TooManyRequests(message)
 	case StatusChecksumMismatch:
 		return ChecksumMismatch(message)
 	default:
@@ -401,6 +417,8 @@ func NewHTTPStatusCodeFromErrtype(err error) int {
 		return http.StatusPartialContent
 	case TooEarly:
 		return http.StatusTooEarly
+	case TooManyRequests:
+		return http.StatusTooManyRequests
 	case ChecksumMismatch:
 		return StatusChecksumMismatch
 	default:
--- a/vendor/github.com/owncloud/reva/v2/pkg/rgrpc/rgrpc.go
+++ b/vendor/github.com/owncloud/reva/v2/pkg/rgrpc/rgrpc.go
@@ -30,6 +30,7 @@ import (
 	"github.com/owncloud/reva/v2/internal/grpc/interceptors/appctx"
 	"github.com/owncloud/reva/v2/internal/grpc/interceptors/auth"
 	"github.com/owncloud/reva/v2/internal/grpc/interceptors/log"
+	"github.com/owncloud/reva/v2/internal/grpc/interceptors/metadata"
 	"github.com/owncloud/reva/v2/internal/grpc/interceptors/recovery"
 	"github.com/owncloud/reva/v2/internal/grpc/interceptors/token"
 	"github.com/owncloud/reva/v2/internal/grpc/interceptors/useragent"
@@ -46,6 +47,11 @@ import (
 	"google.golang.org/grpc/reflection"
 )

+const (
+	// Prefix used to auto-propagate GRPC metadata across reva services
+	AutoPropPrefix = "autoprop-"
+)
+
 // UnaryInterceptors is a map of registered unary grpc interceptors.
 var UnaryInterceptors = map[string]NewUnaryInterceptor{}

@@ -336,6 +342,7 @@ func (s *Server) getInterceptors(unprotected []string) ([]grpc.ServerOption, err
 		log.NewUnary(),
 		recovery.NewUnary(),
 		authUnary,
+		metadata.NewUnary(AutoPropPrefix),
 	}

 	for _, t := range unaryTriples {
@@ -378,6 +385,7 @@ func (s *Server) getInterceptors(unprotected []string) ([]grpc.ServerOption, err
 		log.NewStream(),
 		recovery.NewStream(),
 		authStream,
+		metadata.NewStream(AutoPropPrefix),
 	}

 	for _, t := range streamTriples {
--- a/vendor/github.com/owncloud/reva/v2/pkg/rgrpc/status/status.go
+++ b/vendor/github.com/owncloud/reva/v2/pkg/rgrpc/status/status.go
@@ -161,6 +161,15 @@ func NewLocked(ctx context.Context, msg string) *rpc.Status {
 	}
 }

+// NewTooManyRequests return a status Code_CODE_RESOURCE_EXHAUSTED
+func NewTooManyRequests(ctx context.Context, msg string) *rpc.Status {
+	return &rpc.Status{
+		Code:    rpc.Code_CODE_RESOURCE_EXHAUSTED,
+		Message: msg,
+		Trace:   getTrace(ctx),
+	}
+}
+
 // NewStatusFromErrType returns a status that corresponds to the given errtype
 func NewStatusFromErrType(ctx context.Context, msg string, err error) *rpc.Status {
 	switch e := err.(type) {
@@ -191,6 +200,8 @@ func NewStatusFromErrType(ctx context.Context, msg string, err error) *rpc.Statu
 		return NewUnimplemented(ctx, err, msg+":"+err.Error())
 	case errtypes.BadRequest:
 		return NewInvalid(ctx, msg+":"+err.Error())
+	case errtypes.TooManyRequests:
+		return NewTooManyRequests(ctx, msg+": "+err.Error())
 	}

 	// map GRPC status codes coming from the auth middleware
--- a/vendor/github.com/segmentio/kafka-go/protocol/describegroups/describegroups.go
+++ b/vendor/github.com/segmentio/kafka-go/protocol/describegroups/describegroups.go
@@ -10,8 +10,11 @@ func init() {

 // Detailed API definition: https://kafka.apache.org/protocol#The_Messages_DescribeGroups
 type Request struct {
-	Groups                      []string `kafka:"min=v0,max=v4"`
-	IncludeAuthorizedOperations bool     `kafka:"min=v3,max=v4"`
+	// We need at least one tagged field to indicate that this is a "flexible" message
+	// type.
+	_                           struct{} `kafka:"min=v5,max=v5,tag"`
+	Groups                      []string `kafka:"min=v0,max=v4|min=v5,max=v5,compact"`
+	IncludeAuthorizedOperations bool     `kafka:"min=v3,max=v5"`
 }

 func (r *Request) ApiKey() protocol.ApiKey { return protocol.DescribeGroups }
@@ -42,27 +45,36 @@ func (r *Request) Split(cluster protocol.Cluster) (
 }

 type Response struct {
-	ThrottleTimeMs int32           `kafka:"min=v1,max=v4"`
-	Groups         []ResponseGroup `kafka:"min=v0,max=v4"`
+	// We need at least one tagged field to indicate that this is a "flexible" message
+	// type.
+	_              struct{}        `kafka:"min=v5,max=v5,tag"`
+	ThrottleTimeMs int32           `kafka:"min=v1,max=v5"`
+	Groups         []ResponseGroup `kafka:"min=v0,max=v5"`
 }

 type ResponseGroup struct {
-	ErrorCode            int16                 `kafka:"min=v0,max=v4"`
-	GroupID              string                `kafka:"min=v0,max=v4"`
-	GroupState           string                `kafka:"min=v0,max=v4"`
-	ProtocolType         string                `kafka:"min=v0,max=v4"`
-	ProtocolData         string                `kafka:"min=v0,max=v4"`
-	Members              []ResponseGroupMember `kafka:"min=v0,max=v4"`
-	AuthorizedOperations int32                 `kafka:"min=v3,max=v4"`
+	// We need at least one tagged field to indicate that this is a "flexible" message
+	// type.
+	_                    struct{}              `kafka:"min=v5,max=v5,tag"`
+	ErrorCode            int16                 `kafka:"min=v0,max=v5"`
+	GroupID              string                `kafka:"min=v0,max=v4|min=v5,max=v5,compact"`
+	GroupState           string                `kafka:"min=v0,max=v4|min=v5,max=v5,compact"`
+	ProtocolType         string                `kafka:"min=v0,max=v4|min=v5,max=v5,compact"`
+	ProtocolData         string                `kafka:"min=v0,max=v4|min=v5,max=v5,compact"`
+	Members              []ResponseGroupMember `kafka:"min=v0,max=v4|min=v5,max=v5,compact"`
+	AuthorizedOperations int32                 `kafka:"min=v3,max=v5"`
 }

 type ResponseGroupMember struct {
-	MemberID         string `kafka:"min=v0,max=v4"`
-	GroupInstanceID  string `kafka:"min=v4,max=v4,nullable"`
-	ClientID         string `kafka:"min=v0,max=v4"`
-	ClientHost       string `kafka:"min=v0,max=v4"`
-	MemberMetadata   []byte `kafka:"min=v0,max=v4"`
-	MemberAssignment []byte `kafka:"min=v0,max=v4"`
+	// We need at least one tagged field to indicate that this is a "flexible" message
+	// type.
+	_                struct{} `kafka:"min=v5,max=v5,tag"`
+	MemberID         string   `kafka:"min=v0,max=v4|min=v5,max=v5,compact"`
+	GroupInstanceID  string   `kafka:"min=v4,max=v4,nullable|min=v5,max=v5,compact,nullable"`
+	ClientID         string   `kafka:"min=v0,max=v4|min=v5,max=v5,compact"`
+	ClientHost       string   `kafka:"min=v0,max=v4|min=v5,max=v5,compact"`
+	MemberMetadata   []byte   `kafka:"min=v0,max=v4|min=v5,max=v5,compact"`
+	MemberAssignment []byte   `kafka:"min=v0,max=v4|min=v5,max=v5,compact"`
 }

 func (r *Response) ApiKey() protocol.ApiKey { return protocol.DescribeGroups }
--- a/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305.go
+++ b/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305.go
@@ -38,6 +38,9 @@ type chacha20poly1305 struct {

 // New returns a ChaCha20-Poly1305 AEAD that uses the given 256-bit key.
 func New(key []byte) (cipher.AEAD, error) {
+	if fips140Enforced() {
+		return nil, errors.New("chacha20poly1305: use of ChaCha20Poly1305 is not allowed in FIPS 140-only mode")
+	}
 	if len(key) != KeySize {
 		return nil, errors.New("chacha20poly1305: bad key length")
 	}
--- a/vendor/golang.org/x/crypto/chacha20poly1305/fips140only_compat.go
+++ b/vendor/golang.org/x/crypto/chacha20poly1305/fips140only_compat.go
@@ -0,0 +1,9 @@
+// Copyright 2025 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build !go1.26
+
+package chacha20poly1305
+
+func fips140Enforced() bool { return false }
--- a/vendor/golang.org/x/crypto/chacha20poly1305/fips140only_go1.26.go
+++ b/vendor/golang.org/x/crypto/chacha20poly1305/fips140only_go1.26.go
@@ -0,0 +1,11 @@
+// Copyright 2025 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build go1.26
+
+package chacha20poly1305
+
+import "crypto/fips140"
+
+func fips140Enforced() bool { return fips140.Enforced() }
--- a/vendor/golang.org/x/crypto/chacha20poly1305/xchacha20poly1305.go
+++ b/vendor/golang.org/x/crypto/chacha20poly1305/xchacha20poly1305.go
@@ -22,6 +22,9 @@ type xchacha20poly1305 struct {
 // preferred when nonce uniqueness cannot be trivially ensured, or whenever
 // nonces are randomly generated.
 func NewX(key []byte) (cipher.AEAD, error) {
+	if fips140Enforced() {
+		return nil, errors.New("chacha20poly1305: use of ChaCha20Poly1305 is not allowed in FIPS 140-only mode")
+	}
 	if len(key) != KeySize {
 		return nil, errors.New("chacha20poly1305: bad key length")
 	}
--- a/vendor/golang.org/x/mod/module/module.go
+++ b/vendor/golang.org/x/mod/module/module.go
@@ -802,8 +802,8 @@ func MatchPrefixPatterns(globs, target string) bool {
 	for globs != "" {
 		// Extract next non-empty glob in comma-separated list.
 		var glob string
-		if i := strings.Index(globs, ","); i >= 0 {
-			glob, globs = globs[:i], globs[i+1:]
+		if before, after, ok := strings.Cut(globs, ","); ok {
+			glob, globs = before, after
 		} else {
 			glob, globs = globs, ""
 		}
--- a/vendor/golang.org/x/net/http2/transport.go
+++ b/vendor/golang.org/x/net/http2/transport.go
@@ -376,11 +376,24 @@ type ClientConn struct {
 	// completely unresponsive connection.
 	pendingResets int

+	// readBeforeStreamID is the smallest stream ID that has not been followed by
+	// a frame read from the peer. We use this to determine when a request may
+	// have been sent to a completely unresponsive connection:
+	// If the request ID is less than readBeforeStreamID, then we have had some
+	// indication of life on the connection since sending the request.
+	readBeforeStreamID uint32
+
 	// reqHeaderMu is a 1-element semaphore channel controlling access to sending new requests.
 	// Write to reqHeaderMu to lock it, read from it to unlock.
 	// Lock reqmu BEFORE mu or wmu.
 	reqHeaderMu chan struct{}

+	// internalStateHook reports state changes back to the net/http.ClientConn.
+	// Note that this is different from the user state hook registered by
+	// net/http.ClientConn.SetStateHook: The internal hook calls ClientConn,
+	// which calls the user hook.
+	internalStateHook func()
+
 	// wmu is held while writing.
 	// Acquire BEFORE mu when holding both, to avoid blocking mu on network writes.
 	// Only acquire both at the same time when changing peer settings.
@@ -710,7 +723,7 @@ func canRetryError(err error) bool {

 func (t *Transport) dialClientConn(ctx context.Context, addr string, singleUse bool) (*ClientConn, error) {
 	if t.transportTestHooks != nil {
-		return t.newClientConn(nil, singleUse)
+		return t.newClientConn(nil, singleUse, nil)
 	}
 	host, _, err := net.SplitHostPort(addr)
 	if err != nil {
@@ -720,7 +733,7 @@ func (t *Transport) dialClientConn(ctx context.Context, addr string, singleUse b
 	if err != nil {
 		return nil, err
 	}
-	return t.newClientConn(tconn, singleUse)
+	return t.newClientConn(tconn, singleUse, nil)
 }

 func (t *Transport) newTLSConfig(host string) *tls.Config {
@@ -772,10 +785,10 @@ func (t *Transport) expectContinueTimeout() time.Duration {
 }

 func (t *Transport) NewClientConn(c net.Conn) (*ClientConn, error) {
-	return t.newClientConn(c, t.disableKeepAlives())
+	return t.newClientConn(c, t.disableKeepAlives(), nil)
 }

-func (t *Transport) newClientConn(c net.Conn, singleUse bool) (*ClientConn, error) {
+func (t *Transport) newClientConn(c net.Conn, singleUse bool, internalStateHook func()) (*ClientConn, error) {
 	conf := configFromTransport(t)
 	cc := &ClientConn{
 		t:                           t,
@@ -797,6 +810,7 @@ func (t *Transport) newClientConn(c net.Conn, singleUse bool) (*ClientConn, erro
 		pings:                       make(map[[8]byte]chan struct{}),
 		reqHeaderMu:                 make(chan struct{}, 1),
 		lastActive:                  time.Now(),
+		internalStateHook:           internalStateHook,
 	}
 	if t.transportTestHooks != nil {
 		t.transportTestHooks.newclientconn(cc)
@@ -1037,10 +1051,7 @@ func (cc *ClientConn) idleStateLocked() (st clientConnIdleState) {
 		maxConcurrentOkay = cc.currentRequestCountLocked() < int(cc.maxConcurrentStreams)
 	}

-	st.canTakeNewRequest = cc.goAway == nil && !cc.closed && !cc.closing && maxConcurrentOkay &&
-		!cc.doNotReuse &&
-		int64(cc.nextStreamID)+2*int64(cc.pendingRequests) < math.MaxInt32 &&
-		!cc.tooIdleLocked()
+	st.canTakeNewRequest = maxConcurrentOkay && cc.isUsableLocked()

 	// If this connection has never been used for a request and is closed,
 	// then let it take a request (which will fail).
@@ -1056,6 +1067,31 @@ func (cc *ClientConn) idleStateLocked() (st clientConnIdleState) {
 	return
 }

+func (cc *ClientConn) isUsableLocked() bool {
+	return cc.goAway == nil &&
+		!cc.closed &&
+		!cc.closing &&
+		!cc.doNotReuse &&
+		int64(cc.nextStreamID)+2*int64(cc.pendingRequests) < math.MaxInt32 &&
+		!cc.tooIdleLocked()
+}
+
+// canReserveLocked reports whether a net/http.ClientConn can reserve a slot on this conn.
+//
+// This follows slightly different rules than clientConnIdleState.canTakeNewRequest.
+// We only permit reservations up to the conn's concurrency limit.
+// This differs from ClientConn.ReserveNewRequest, which permits reservations
+// past the limit when StrictMaxConcurrentStreams is set.
+func (cc *ClientConn) canReserveLocked() bool {
+	if cc.currentRequestCountLocked() >= int(cc.maxConcurrentStreams) {
+		return false
+	}
+	if !cc.isUsableLocked() {
+		return false
+	}
+	return true
+}
+
 // currentRequestCountLocked reports the number of concurrency slots currently in use,
 // including active streams, reserved slots, and reset streams waiting for acknowledgement.
 func (cc *ClientConn) currentRequestCountLocked() int {
@@ -1067,6 +1103,14 @@ func (cc *ClientConn) canTakeNewRequestLocked() bool {
 	return st.canTakeNewRequest
 }

+// availableLocked reports the number of concurrency slots available.
+func (cc *ClientConn) availableLocked() int {
+	if !cc.canTakeNewRequestLocked() {
+		return 0
+	}
+	return max(0, int(cc.maxConcurrentStreams)-cc.currentRequestCountLocked())
+}
+
 // tooIdleLocked reports whether this connection has been been sitting idle
 // for too much wall time.
 func (cc *ClientConn) tooIdleLocked() bool {
@@ -1091,6 +1135,7 @@ func (cc *ClientConn) closeConn() {
 	t := time.AfterFunc(250*time.Millisecond, cc.forceCloseConn)
 	defer t.Stop()
 	cc.tconn.Close()
+	cc.maybeCallStateHook()
 }

 // A tls.Conn.Close can hang for a long time if the peer is unresponsive.
@@ -1616,6 +1661,8 @@ func (cs *clientStream) cleanupWriteRequest(err error) {
 	}
 	bodyClosed := cs.reqBodyClosed
 	closeOnIdle := cc.singleUse || cc.doNotReuse || cc.t.disableKeepAlives() || cc.goAway != nil
+	// Have we read any frames from the connection since sending this request?
+	readSinceStream := cc.readBeforeStreamID > cs.ID
 	cc.mu.Unlock()
 	if mustCloseBody {
 		cs.reqBody.Close()
@@ -1647,8 +1694,10 @@ func (cs *clientStream) cleanupWriteRequest(err error) {
 				//
 				// This could be due to the server becoming unresponsive.
 				// To avoid sending too many requests on a dead connection,
-				// we let the request continue to consume a concurrency slot
-				// until we can confirm the server is still responding.
+				// if we haven't read any frames from the connection since
+				// sending this request, we let it continue to consume
+				// a concurrency slot until we can confirm the server is
+				// still responding.
 				// We do this by sending a PING frame along with the RST_STREAM
 				// (unless a ping is already in flight).
 				//
@@ -1659,7 +1708,7 @@ func (cs *clientStream) cleanupWriteRequest(err error) {
 				// because it's short lived and will probably be closed before
 				// we get the ping response.
 				ping := false
-				if !closeOnIdle {
+				if !closeOnIdle && !readSinceStream {
 					cc.mu.Lock()
 					// rstStreamPingsBlocked works around a gRPC behavior:
 					// see comment on the field for details.
@@ -1693,6 +1742,7 @@ func (cs *clientStream) cleanupWriteRequest(err error) {
 	}

 	close(cs.donec)
+	cc.maybeCallStateHook()
 }

 // awaitOpenSlotForStreamLocked waits until len(streams) < maxConcurrentStreams.
@@ -2745,6 +2795,7 @@ func (rl *clientConnReadLoop) streamByID(id uint32, headerOrData bool) *clientSt
 		// See comment on ClientConn.rstStreamPingsBlocked for details.
 		rl.cc.rstStreamPingsBlocked = false
 	}
+	rl.cc.readBeforeStreamID = rl.cc.nextStreamID
 	cs := rl.cc.streams[id]
 	if cs != nil && !cs.readAborted {
 		return cs
@@ -2795,6 +2846,7 @@ func (rl *clientConnReadLoop) processSettings(f *SettingsFrame) error {

 func (rl *clientConnReadLoop) processSettingsNoWrite(f *SettingsFrame) error {
 	cc := rl.cc
+	defer cc.maybeCallStateHook()
 	cc.mu.Lock()
 	defer cc.mu.Unlock()

@@ -2975,6 +3027,7 @@ func (cc *ClientConn) Ping(ctx context.Context) error {
 func (rl *clientConnReadLoop) processPing(f *PingFrame) error {
 	if f.IsAck() {
 		cc := rl.cc
+		defer cc.maybeCallStateHook()
 		cc.mu.Lock()
 		defer cc.mu.Unlock()
 		// If ack, notify listener if any
@@ -3198,9 +3251,13 @@ func registerHTTPSProtocol(t *http.Transport, rt noDialH2RoundTripper) (err erro
 }

 // noDialH2RoundTripper is a RoundTripper which only tries to complete the request
-// if there's already has a cached connection to the host.
+// if there's already a cached connection to the host.
 // (The field is exported so it can be accessed via reflect from net/http; tested
 // by TestNoDialH2RoundTripperType)
+//
+// A noDialH2RoundTripper is registered with http1.Transport.RegisterProtocol,
+// and the http1.Transport can use type assertions to call non-RoundTrip methods on it.
+// This lets us expose, for example, NewClientConn to net/http.
 type noDialH2RoundTripper struct{ *Transport }

 func (rt noDialH2RoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
@@ -3211,6 +3268,85 @@ func (rt noDialH2RoundTripper) RoundTrip(req *http.Request) (*http.Response, err
 	return res, err
 }

+func (rt noDialH2RoundTripper) NewClientConn(conn net.Conn, internalStateHook func()) (http.RoundTripper, error) {
+	tr := rt.Transport
+	cc, err := tr.newClientConn(conn, tr.disableKeepAlives(), internalStateHook)
+	if err != nil {
+		return nil, err
+	}
+
+	// RoundTrip should block when the conn is at its concurrency limit,
+	// not return an error. Setting strictMaxConcurrentStreams enables this.
+	cc.strictMaxConcurrentStreams = true
+
+	return netHTTPClientConn{cc}, nil
+}
+
+// netHTTPClientConn wraps ClientConn and implements the interface net/http expects from
+// the RoundTripper returned by NewClientConn.
+type netHTTPClientConn struct {
+	cc *ClientConn
+}
+
+func (cc netHTTPClientConn) RoundTrip(req *http.Request) (*http.Response, error) {
+	return cc.cc.RoundTrip(req)
+}
+
+func (cc netHTTPClientConn) Close() error {
+	return cc.cc.Close()
+}
+
+func (cc netHTTPClientConn) Err() error {
+	cc.cc.mu.Lock()
+	defer cc.cc.mu.Unlock()
+	if cc.cc.closed {
+		return errors.New("connection closed")
+	}
+	return nil
+}
+
+func (cc netHTTPClientConn) Reserve() error {
+	defer cc.cc.maybeCallStateHook()
+	cc.cc.mu.Lock()
+	defer cc.cc.mu.Unlock()
+	if !cc.cc.canReserveLocked() {
+		return errors.New("connection is unavailable")
+	}
+	cc.cc.streamsReserved++
+	return nil
+}
+
+func (cc netHTTPClientConn) Release() {
+	defer cc.cc.maybeCallStateHook()
+	cc.cc.mu.Lock()
+	defer cc.cc.mu.Unlock()
+	// We don't complain if streamsReserved is 0.
+	//
+	// This is consistent with RoundTrip: both Release and RoundTrip will
+	// consume a reservation iff one exists.
+	if cc.cc.streamsReserved > 0 {
+		cc.cc.streamsReserved--
+	}
+}
+
+func (cc netHTTPClientConn) Available() int {
+	cc.cc.mu.Lock()
+	defer cc.cc.mu.Unlock()
+	return cc.cc.availableLocked()
+}
+
+func (cc netHTTPClientConn) InFlight() int {
+	cc.cc.mu.Lock()
+	defer cc.cc.mu.Unlock()
+	return cc.cc.currentRequestCountLocked()
+}
+
+func (cc *ClientConn) maybeCallStateHook() {
+	if cc.internalStateHook != nil {
+		cc.internalStateHook()
+	}
+}
+
 func (t *Transport) idleConnTimeout() time.Duration {
 	// to keep things backwards compatible, we use non-zero values of
 	// IdleConnTimeout, followed by using the IdleConnTimeout on the underlying
--- a/vendor/golang.org/x/net/trace/events.go
+++ b/vendor/golang.org/x/net/trace/events.go
@@ -58,8 +58,8 @@ func RenderEvents(w http.ResponseWriter, req *http.Request, sensitive bool) {
 		Buckets: buckets,
 	}

-	data.Families = make([]string, 0, len(families))
 	famMu.RLock()
+	data.Families = make([]string, 0, len(families))
 	for name := range families {
 		data.Families = append(data.Families, name)
 	}
--- a/vendor/golang.org/x/tools/go/ast/astutil/imports.go
+++ b/vendor/golang.org/x/tools/go/ast/astutil/imports.go
@@ -9,6 +9,7 @@ import (
 	"fmt"
 	"go/ast"
 	"go/token"
+	"reflect"
 	"slices"
 	"strconv"
 	"strings"
@@ -149,7 +150,7 @@ func AddNamedImport(fset *token.FileSet, f *ast.File, name, path string) (added
 	if newImport.Name != nil {
 		newImport.Name.NamePos = pos
 	}
-	newImport.Path.ValuePos = pos
+	updateBasicLitPos(newImport.Path, pos)
 	newImport.EndPos = pos

 	// Clean up parens. impDecl contains at least one spec.
@@ -184,7 +185,7 @@ func AddNamedImport(fset *token.FileSet, f *ast.File, name, path string) (added
 		first.Lparen = first.Pos()
 		// Move the imports of the other import declaration to the first one.
 		for _, spec := range gen.Specs {
-			spec.(*ast.ImportSpec).Path.ValuePos = first.Pos()
+			updateBasicLitPos(spec.(*ast.ImportSpec).Path, first.Pos())
 			first.Specs = append(first.Specs, spec)
 		}
 		f.Decls = slices.Delete(f.Decls, i, i+1)
@@ -470,3 +471,17 @@ func Imports(fset *token.FileSet, f *ast.File) [][]*ast.ImportSpec {

 	return groups
 }
+
+// updateBasicLitPos updates lit.Pos,
+// ensuring that lit.End (if set) is displaced by the same amount.
+// (See https://go.dev/issue/76395.)
+func updateBasicLitPos(lit *ast.BasicLit, pos token.Pos) {
+	len := lit.End() - lit.Pos()
+	lit.ValuePos = pos
+	// TODO(adonovan): after go1.26, simplify to:
+	//   lit.ValueEnd = pos + len
+	v := reflect.ValueOf(lit).Elem().FieldByName("ValueEnd")
+	if v.IsValid() && v.Int() != 0 {
+		v.SetInt(int64(pos + len))
+	}
+}
--- a/vendor/golang.org/x/tools/go/packages/packages.go
+++ b/vendor/golang.org/x/tools/go/packages/packages.go
@@ -1027,11 +1027,15 @@ func (ld *loader) refine(response *DriverResponse) ([]*Package, error) {
 // Precondition: ld.Mode&(NeedSyntax|NeedTypes|NeedTypesInfo) != 0.
 func (ld *loader) loadPackage(lpkg *loaderPackage) {
 	if lpkg.PkgPath == "unsafe" {
-		// Fill in the blanks to avoid surprises.
+		// To avoid surprises, fill in the blanks consistent
+		// with other packages. (For example, some analyzers
+		// assert that each needed types.Info map is non-nil
+		// even when there is no syntax that would cause them
+		// to consult the map.)
 		lpkg.Types = types.Unsafe
 		lpkg.Fset = ld.Fset
 		lpkg.Syntax = []*ast.File{}
-		lpkg.TypesInfo = new(types.Info)
+		lpkg.TypesInfo = ld.newTypesInfo()
 		lpkg.TypesSizes = ld.sizes
 		return
 	}
@@ -1180,20 +1184,7 @@ func (ld *loader) loadPackage(lpkg *loaderPackage) {
 		return
 	}

-	// Populate TypesInfo only if needed, as it
-	// causes the type checker to work much harder.
-	if ld.Config.Mode&NeedTypesInfo != 0 {
-		lpkg.TypesInfo = &types.Info{
-			Types:        make(map[ast.Expr]types.TypeAndValue),
-			Defs:         make(map[*ast.Ident]types.Object),
-			Uses:         make(map[*ast.Ident]types.Object),
-			Implicits:    make(map[ast.Node]types.Object),
-			Instances:    make(map[*ast.Ident]types.Instance),
-			Scopes:       make(map[ast.Node]*types.Scope),
-			Selections:   make(map[*ast.SelectorExpr]*types.Selection),
-			FileVersions: make(map[*ast.File]string),
-		}
-	}
+	lpkg.TypesInfo = ld.newTypesInfo()
 	lpkg.TypesSizes = ld.sizes

 	importer := importerFunc(func(path string) (*types.Package, error) {
@@ -1307,6 +1298,24 @@ func (ld *loader) loadPackage(lpkg *loaderPackage) {
 	lpkg.IllTyped = illTyped
 }

+func (ld *loader) newTypesInfo() *types.Info {
+	// Populate TypesInfo only if needed, as it
+	// causes the type checker to work much harder.
+	if ld.Config.Mode&NeedTypesInfo == 0 {
+		return nil
+	}
+	return &types.Info{
+		Types:        make(map[ast.Expr]types.TypeAndValue),
+		Defs:         make(map[*ast.Ident]types.Object),
+		Uses:         make(map[*ast.Ident]types.Object),
+		Implicits:    make(map[ast.Node]types.Object),
+		Instances:    make(map[*ast.Ident]types.Instance),
+		Scopes:       make(map[ast.Node]*types.Scope),
+		Selections:   make(map[*ast.SelectorExpr]*types.Selection),
+		FileVersions: make(map[*ast.File]string),
+	}
+}
+
 // An importFunc is an implementation of the single-method
 // types.Importer interface based on a function value.
 type importerFunc func(path string) (*types.Package, error)
--- a/vendor/golang.org/x/tools/go/types/typeutil/callee.go
+++ b/vendor/golang.org/x/tools/go/types/typeutil/callee.go
@@ -12,6 +12,7 @@ import (

 // Callee returns the named target of a function call, if any:
 // a function, method, builtin, or variable.
+// It returns nil for a T(x) conversion.
 //
 // Functions and methods may potentially have type parameters.
 //
--- a/vendor/golang.org/x/tools/internal/event/core/export.go
+++ b/vendor/golang.org/x/tools/internal/event/core/export.go
@@ -8,7 +8,6 @@ import (
 	"context"
 	"sync/atomic"
 	"time"
-	"unsafe"

 	"golang.org/x/tools/internal/event/label"
 )
@@ -17,23 +16,21 @@ import (
 // It may return a modified context and event.
 type Exporter func(context.Context, Event, label.Map) context.Context

-var (
-	exporter unsafe.Pointer
-)
+var exporter atomic.Pointer[Exporter]

 // SetExporter sets the global exporter function that handles all events.
 // The exporter is called synchronously from the event call site, so it should
 // return quickly so as not to hold up user code.
 func SetExporter(e Exporter) {
-	p := unsafe.Pointer(&e)
 	if e == nil {
 		// &e is always valid, and so p is always valid, but for the early abort
 		// of ProcessEvent to be efficient it needs to make the nil check on the
 		// pointer without having to dereference it, so we make the nil function
 		// also a nil pointer
-		p = nil
+		exporter.Store(nil)
+	} else {
+		exporter.Store(&e)
 	}
-	atomic.StorePointer(&exporter, p)
 }

 // deliver is called to deliver an event to the supplied exporter.
@@ -48,7 +45,7 @@ func deliver(ctx context.Context, exporter Exporter, ev Event) context.Context {
 // Export is called to deliver an event to the global exporter if set.
 func Export(ctx context.Context, ev Event) context.Context {
 	// get the global exporter and abort early if there is not one
-	exporterPtr := (*Exporter)(atomic.LoadPointer(&exporter))
+	exporterPtr := exporter.Load()
 	if exporterPtr == nil {
 		return ctx
 	}
@@ -61,7 +58,7 @@ func Export(ctx context.Context, ev Event) context.Context {
 // It will fill in the time.
 func ExportPair(ctx context.Context, begin, end Event) (context.Context, func()) {
 	// get the global exporter and abort early if there is not one
-	exporterPtr := (*Exporter)(atomic.LoadPointer(&exporter))
+	exporterPtr := exporter.Load()
 	if exporterPtr == nil {
 		return ctx, func() {}
 	}
--- a/vendor/golang.org/x/tools/internal/event/label/label.go
+++ b/vendor/golang.org/x/tools/internal/event/label/label.go
@@ -7,7 +7,6 @@ package label
 import (
 	"fmt"
 	"io"
-	"reflect"
 	"slices"
 	"unsafe"
 )
@@ -103,11 +102,10 @@ type stringptr unsafe.Pointer
 // This method is for implementing new key types, label creation should
 // normally be done with the Of method of the key.
 func OfString(k Key, v string) Label {
-	hdr := (*reflect.StringHeader)(unsafe.Pointer(&v))
 	return Label{
 		key:     k,
-		packed:  uint64(hdr.Len),
-		untyped: stringptr(hdr.Data),
+		packed:  uint64(len(v)),
+		untyped: stringptr(unsafe.StringData(v)),
 	}
 }

@@ -116,11 +114,7 @@ func OfString(k Key, v string) Label {
 // This method is for implementing new key types, for type safety normal
 // access should be done with the From method of the key.
 func (t Label) UnpackString() string {
-	var v string
-	hdr := (*reflect.StringHeader)(unsafe.Pointer(&v))
-	hdr.Data = uintptr(t.untyped.(stringptr))
-	hdr.Len = int(t.packed)
-	return v
+	return unsafe.String((*byte)(t.untyped.(stringptr)), int(t.packed))
 }

 // Valid returns true if the Label is a valid one (it has a key).
--- a/vendor/golang.org/x/tools/internal/imports/sortimports.go
+++ b/vendor/golang.org/x/tools/internal/imports/sortimports.go
@@ -11,6 +11,7 @@ import (
 	"go/ast"
 	"go/token"
 	"log"
+	"reflect"
 	"slices"
 	"sort"
 	"strconv"
@@ -65,7 +66,7 @@ func sortImports(localPrefix string, tokFile *token.File, f *ast.File) {
 }

 // mergeImports merges all the import declarations into the first one.
-// Taken from golang.org/x/tools/ast/astutil.
+// Taken from golang.org/x/tools/go/ast/astutil.
 // This does not adjust line numbers properly
 func mergeImports(f *ast.File) {
 	if len(f.Decls) <= 1 {
@@ -89,7 +90,7 @@ func mergeImports(f *ast.File) {
 		first.Lparen = first.Pos()
 		// Move the imports of the other import declaration to the first one.
 		for _, spec := range gen.Specs {
-			spec.(*ast.ImportSpec).Path.ValuePos = first.Pos()
+			updateBasicLitPos(spec.(*ast.ImportSpec).Path, first.Pos())
 			first.Specs = append(first.Specs, spec)
 		}
 		f.Decls = slices.Delete(f.Decls, i, i+1)
@@ -98,7 +99,7 @@ func mergeImports(f *ast.File) {
 }

 // declImports reports whether gen contains an import of path.
-// Taken from golang.org/x/tools/ast/astutil.
+// Taken from golang.org/x/tools/go/ast/astutil.
 func declImports(gen *ast.GenDecl, path string) bool {
 	if gen.Tok != token.IMPORT {
 		return false
@@ -221,7 +222,7 @@ func sortSpecs(localPrefix string, tokFile *token.File, f *ast.File, specs []ast
 		if s.Name != nil {
 			s.Name.NamePos = pos[i].Start
 		}
-		s.Path.ValuePos = pos[i].Start
+		updateBasicLitPos(s.Path, pos[i].Start)
 		s.EndPos = pos[i].End
 		nextSpecPos := pos[i].End

@@ -296,3 +297,17 @@ type byCommentPos []*ast.CommentGroup
 func (x byCommentPos) Len() int           { return len(x) }
 func (x byCommentPos) Swap(i, j int)      { x[i], x[j] = x[j], x[i] }
 func (x byCommentPos) Less(i, j int) bool { return x[i].Pos() < x[j].Pos() }
+
+// updateBasicLitPos updates lit.Pos,
+// ensuring that lit.End (if set) is displaced by the same amount.
+// (See https://go.dev/issue/76395.)
+func updateBasicLitPos(lit *ast.BasicLit, pos token.Pos) {
+	len := lit.End() - lit.Pos()
+	lit.ValuePos = pos
+	// TODO(adonovan): after go1.26, simplify to:
+	//   lit.ValueEnd = pos + len
+	v := reflect.ValueOf(lit).Elem().FieldByName("ValueEnd")
+	if v.IsValid() && v.Int() != 0 {
+		v.SetInt(int64(pos + len))
+	}
+}
--- a/vendor/golang.org/x/tools/internal/modindex/lookup.go
+++ b/vendor/golang.org/x/tools/internal/modindex/lookup.go
@@ -8,6 +8,8 @@ import (
 	"slices"
 	"strconv"
 	"strings"
+
+	"golang.org/x/mod/module"
 )

 type Candidate struct {
@@ -104,11 +106,15 @@ func (ix *Index) Lookup(pkgName, name string, prefix bool) []Candidate {
 			if len(flds) < 2 {
 				continue // should never happen
 			}
+			impPath, err := module.UnescapePath(e.ImportPath)
+			if err != nil {
+				continue
+			}
 			px := Candidate{
 				PkgName:    pkgName,
 				Name:       flds[0],
 				Dir:        string(e.Dir),
-				ImportPath: e.ImportPath,
+				ImportPath: impPath,
 				Type:       asLexType(flds[1][0]),
 				Deprecated: len(flds[1]) > 1 && flds[1][1] == 'D',
 			}
--- a/vendor/golang.org/x/tools/internal/stdlib/deps.go
+++ b/vendor/golang.org/x/tools/internal/stdlib/deps.go
@@ -12,360 +12,364 @@ type pkginfo struct {
 }

 var deps = [...]pkginfo{
-	{"archive/tar", "\x03n\x03E<\x01\n\x01$\x01\x01\x02\x05\b\x02\x01\x02\x02\f"},
-	{"archive/zip", "\x02\x04d\a\x03\x12\x021<\x01+\x05\x01\x0f\x03\x02\x0e\x04"},
-	{"bufio", "\x03n\x84\x01D\x14"},
-	{"bytes", "q*Z\x03\fG\x02\x02"},
+	{"archive/tar", "\x03p\x03F=\x01\n\x01$\x01\x01\x02\x05\b\x02\x01\x02\x02\f"},
+	{"archive/zip", "\x02\x04f\a\x03\x13\x021=\x01+\x05\x01\x0f\x03\x02\x0e\x04"},
+	{"bufio", "\x03p\x86\x01D\x14"},
+	{"bytes", "s+[\x03\fG\x02\x02"},
 	{"cmp", ""},
-	{"compress/bzip2", "\x02\x02\xf1\x01A"},
-	{"compress/flate", "\x02o\x03\x81\x01\f\x033\x01\x03"},
-	{"compress/gzip", "\x02\x04d\a\x03\x14mT"},
-	{"compress/lzw", "\x02o\x03\x81\x01"},
-	{"compress/zlib", "\x02\x04d\a\x03\x12\x01n"},
-	{"container/heap", "\xb7\x02"},
+	{"compress/bzip2", "\x02\x02\xf5\x01A"},
+	{"compress/flate", "\x02q\x03\x83\x01\f\x033\x01\x03"},
+	{"compress/gzip", "\x02\x04f\a\x03\x15nT"},
+	{"compress/lzw", "\x02q\x03\x83\x01"},
+	{"compress/zlib", "\x02\x04f\a\x03\x13\x01o"},
+	{"container/heap", "\xbb\x02"},
 	{"container/list", ""},
 	{"container/ring", ""},
-	{"context", "q[o\x01\r"},
-	{"crypto", "\x86\x01oC"},
-	{"crypto/aes", "\x10\n\t\x95\x02"},
-	{"crypto/cipher", "\x03 \x01\x01\x1f\x11\x1c+Y"},
-	{"crypto/des", "\x10\x15\x1f-+\x9c\x01\x03"},
-	{"crypto/dsa", "D\x04)\x84\x01\r"},
-	{"crypto/ecdh", "\x03\v\f\x10\x04\x16\x04\r\x1c\x84\x01"},
-	{"crypto/ecdsa", "\x0e\x05\x03\x04\x01\x10\a\v\x06\x01\x04\f\x01\x1c\x84\x01\r\x05K\x01"},
-	{"crypto/ed25519", "\x0e\x1e\x11\a\n\a\x1c\x84\x01C"},
-	{"crypto/elliptic", "2?\x84\x01\r9"},
+	{"context", "s\\p\x01\r"},
+	{"crypto", "\x89\x01pC"},
+	{"crypto/aes", "\x10\n\t\x99\x02"},
+	{"crypto/cipher", "\x03 \x01\x01 \x12\x1c,Z"},
+	{"crypto/des", "\x10\x15 .,\x9d\x01\x03"},
+	{"crypto/dsa", "E\x04*\x86\x01\r"},
+	{"crypto/ecdh", "\x03\v\f\x10\x04\x17\x04\x0e\x1c\x86\x01"},
+	{"crypto/ecdsa", "\x0e\x05\x03\x04\x01\x10\b\v\x06\x01\x04\r\x01\x1c\x86\x01\r\x05K\x01"},
+	{"crypto/ed25519", "\x0e\x1e\x12\a\v\a\x1c\x86\x01C"},
+	{"crypto/elliptic", "3@\x86\x01\r9"},
 	{"crypto/fips140", "\"\x05"},
-	{"crypto/hkdf", "/\x14\x01-\x15"},
-	{"crypto/hmac", "\x1a\x16\x13\x01\x111"},
-	{"crypto/internal/boring", "\x0e\x02\ri"},
-	{"crypto/internal/boring/bbig", "\x1a\xe8\x01M"},
-	{"crypto/internal/boring/bcache", "\xbc\x02\x13"},
+	{"crypto/hkdf", "/\x15\x01.\x16"},
+	{"crypto/hmac", "\x1a\x16\x14\x01\x122"},
+	{"crypto/internal/boring", "\x0e\x02\rl"},
+	{"crypto/internal/boring/bbig", "\x1a\xec\x01M"},
+	{"crypto/internal/boring/bcache", "\xc0\x02\x13"},
 	{"crypto/internal/boring/sig", ""},
 	{"crypto/internal/constanttime", ""},
-	{"crypto/internal/cryptotest", "\x03\r\n\b%\x0e\x19\x06\x12\x12 \x04\x06\t\x18\x01\x11\x11\x1b\x01\a\x05\b\x03\x05\v"},
-	{"crypto/internal/entropy", "I"},
-	{"crypto/internal/entropy/v1.0.0", "B/\x93\x018\x13"},
-	{"crypto/internal/fips140", "A0\xbd\x01\v\x16"},
-	{"crypto/internal/fips140/aes", "\x03\x1f\x03\x02\x13\x05\x01\x01\x06*\x93\x014"},
-	{"crypto/internal/fips140/aes/gcm", "\"\x01\x02\x02\x02\x11\x05\x01\a*\x90\x01"},
-	{"crypto/internal/fips140/alias", "\xcf\x02"},
-	{"crypto/internal/fips140/bigmod", "'\x18\x01\a*\x93\x01"},
-	{"crypto/internal/fips140/check", "\"\x0e\x06\t\x02\xb4\x01Z"},
-	{"crypto/internal/fips140/check/checktest", "'\x87\x02!"},
-	{"crypto/internal/fips140/drbg", "\x03\x1e\x01\x01\x04\x13\x05\t\x01(\x84\x01\x0f7\x01"},
-	{"crypto/internal/fips140/ecdh", "\x03\x1f\x05\x02\t\r2\x84\x01\x0f7"},
-	{"crypto/internal/fips140/ecdsa", "\x03\x1f\x04\x01\x02\a\x02\x069\x15oF"},
-	{"crypto/internal/fips140/ed25519", "\x03\x1f\x05\x02\x04\v9\xc7\x01\x03"},
-	{"crypto/internal/fips140/edwards25519", "\x1e\t\a\x112\x93\x017"},
-	{"crypto/internal/fips140/edwards25519/field", "'\x13\x052\x93\x01"},
-	{"crypto/internal/fips140/hkdf", "\x03\x1f\x05\t\x06;\x15"},
-	{"crypto/internal/fips140/hmac", "\x03\x1f\x14\x01\x019\x15"},
-	{"crypto/internal/fips140/mlkem", "\x03\x1f\x05\x02\x0e\x03\x052\xca\x01"},
-	{"crypto/internal/fips140/nistec", "\x1e\t\f\f2\x93\x01*\r\x14"},
-	{"crypto/internal/fips140/nistec/fiat", "'\x137\x93\x01"},
-	{"crypto/internal/fips140/pbkdf2", "\x03\x1f\x05\t\x06;\x15"},
-	{"crypto/internal/fips140/rsa", "\x03\x1b\x04\x04\x01\x02\r\x01\x01\x027\x15oF"},
-	{"crypto/internal/fips140/sha256", "\x03\x1f\x1d\x01\a*\x15~"},
-	{"crypto/internal/fips140/sha3", "\x03\x1f\x18\x05\x011\x93\x01K"},
-	{"crypto/internal/fips140/sha512", "\x03\x1f\x1d\x01\a*\x15~"},
-	{"crypto/internal/fips140/ssh", "'_"},
-	{"crypto/internal/fips140/subtle", "\x1e\a\x1a\xc5\x01"},
-	{"crypto/internal/fips140/tls12", "\x03\x1f\x05\t\x06\x029\x15"},
-	{"crypto/internal/fips140/tls13", "\x03\x1f\x05\b\a\t2\x15"},
-	{"crypto/internal/fips140cache", "\xae\x02\r&"},
+	{"crypto/internal/cryptotest", "\x03\r\n\b&\x0f\x19\x06\x13\x12 \x04\x06\t\x19\x01\x11\x11\x1b\x01\a\x05\b\x03\x05\v"},
+	{"crypto/internal/entropy", "J"},
+	{"crypto/internal/entropy/v1.0.0", "C0\x95\x018\x13"},
+	{"crypto/internal/fips140", "B1\xbf\x01\v\x16"},
+	{"crypto/internal/fips140/aes", "\x03\x1f\x03\x02\x14\x05\x01\x01\x06+\x95\x014"},
+	{"crypto/internal/fips140/aes/gcm", "\"\x01\x02\x02\x02\x12\x05\x01\a+\x92\x01"},
+	{"crypto/internal/fips140/alias", "\xd3\x02"},
+	{"crypto/internal/fips140/bigmod", "'\x19\x01\a+\x95\x01"},
+	{"crypto/internal/fips140/check", "\"\x0e\a\t\x02\xb7\x01Z"},
+	{"crypto/internal/fips140/check/checktest", "'\x8b\x02!"},
+	{"crypto/internal/fips140/drbg", "\x03\x1e\x01\x01\x04\x14\x05\t\x01)\x86\x01\x0f7\x01"},
+	{"crypto/internal/fips140/ecdh", "\x03\x1f\x05\x02\n\r3\x86\x01\x0f7"},
+	{"crypto/internal/fips140/ecdsa", "\x03\x1f\x04\x01\x02\a\x03\x06:\x16pF"},
+	{"crypto/internal/fips140/ed25519", "\x03\x1f\x05\x02\x04\f:\xc9\x01\x03"},
+	{"crypto/internal/fips140/edwards25519", "\x1e\t\a\x123\x95\x017"},
+	{"crypto/internal/fips140/edwards25519/field", "'\x14\x053\x95\x01"},
+	{"crypto/internal/fips140/hkdf", "\x03\x1f\x05\t\a<\x16"},
+	{"crypto/internal/fips140/hmac", "\x03\x1f\x15\x01\x01:\x16"},
+	{"crypto/internal/fips140/mldsa", "\x03\x1b\x04\x05\x02\x0e\x01\x03\x053\x95\x017"},
+	{"crypto/internal/fips140/mlkem", "\x03\x1f\x05\x02\x0f\x03\x053\xcc\x01"},
+	{"crypto/internal/fips140/nistec", "\x1e\t\r\f3\x95\x01*\r\x14"},
+	{"crypto/internal/fips140/nistec/fiat", "'\x148\x95\x01"},
+	{"crypto/internal/fips140/pbkdf2", "\x03\x1f\x05\t\a<\x16"},
+	{"crypto/internal/fips140/rsa", "\x03\x1b\x04\x04\x01\x02\x0e\x01\x01\x028\x16pF"},
+	{"crypto/internal/fips140/sha256", "\x03\x1f\x1e\x01\a+\x16\x7f"},
+	{"crypto/internal/fips140/sha3", "\x03\x1f\x19\x05\x012\x95\x01K"},
+	{"crypto/internal/fips140/sha512", "\x03\x1f\x1e\x01\a+\x16\x7f"},
+	{"crypto/internal/fips140/ssh", "'b"},
+	{"crypto/internal/fips140/subtle", "\x1e\a\x1b\xc8\x01"},
+	{"crypto/internal/fips140/tls12", "\x03\x1f\x05\t\a\x02:\x16"},
+	{"crypto/internal/fips140/tls13", "\x03\x1f\x05\b\b\t3\x16"},
+	{"crypto/internal/fips140cache", "\xb2\x02\r&"},
 	{"crypto/internal/fips140deps", ""},
-	{"crypto/internal/fips140deps/byteorder", "\x9c\x01"},
-	{"crypto/internal/fips140deps/cpu", "\xb1\x01\a"},
-	{"crypto/internal/fips140deps/godebug", "\xb9\x01"},
-	{"crypto/internal/fips140deps/time", "\xc9\x02"},
-	{"crypto/internal/fips140hash", "7\x1c3\xc9\x01"},
-	{"crypto/internal/fips140only", ")\r\x01\x01N3<"},
+	{"crypto/internal/fips140deps/byteorder", "\x9f\x01"},
+	{"crypto/internal/fips140deps/cpu", "\xb4\x01\a"},
+	{"crypto/internal/fips140deps/godebug", "\xbc\x01"},
+	{"crypto/internal/fips140deps/time", "\xcd\x02"},
+	{"crypto/internal/fips140hash", "8\x1d4\xca\x01"},
+	{"crypto/internal/fips140only", ")\x0e\x01\x01P3="},
 	{"crypto/internal/fips140test", ""},
-	{"crypto/internal/hpke", "\x0e\x01\x01\x03\x056#+hM"},
-	{"crypto/internal/impl", "\xb9\x02"},
-	{"crypto/internal/randutil", "\xf5\x01\x12"},
-	{"crypto/internal/sysrand", "qo! \r\r\x01\x01\f\x06"},
-	{"crypto/internal/sysrand/internal/seccomp", "q"},
-	{"crypto/md5", "\x0e6-\x15\x16h"},
-	{"crypto/mlkem", "1"},
-	{"crypto/pbkdf2", "4\x0f\x01-\x15"},
-	{"crypto/rand", "\x1a\b\a\x1b\x04\x01(\x84\x01\rM"},
-	{"crypto/rc4", "%\x1f-\xc7\x01"},
-	{"crypto/rsa", "\x0e\f\x01\v\x0f\x0e\x01\x04\x06\a\x1c\x03\x123<\f\x01"},
-	{"crypto/sha1", "\x0e\f*\x03*\x15\x16\x15S"},
-	{"crypto/sha256", "\x0e\f\x1cP"},
-	{"crypto/sha3", "\x0e)O\xc9\x01"},
-	{"crypto/sha512", "\x0e\f\x1eN"},
-	{"crypto/subtle", "\x1e\x1c\x9c\x01X"},
-	{"crypto/tls", "\x03\b\x02\x01\x01\x01\x01\x02\x01\x01\x01\x02\x01\x01\t\x01\r\n\x01\n\x05\x03\x01\x01\x01\x01\x02\x01\x02\x01\x17\x02\x03\x12\x16\x15\b<\x16\x16\r\b\x01\x01\x01\x02\x01\r\x06\x02\x01\x0f"},
-	{"crypto/tls/internal/fips140tls", "\x17\xa5\x02"},
-	{"crypto/x509", "\x03\v\x01\x01\x01\x01\x01\x01\x01\x015\x05\x01\x01\x02\x05\x0e\x06\x02\x02\x03E\x039\x01\x02\b\x01\x01\x02\a\x10\x05\x01\x06\x02\x05\b\x02\x01\x02\x0e\x02\x01\x01\x02\x03\x01"},
-	{"crypto/x509/pkix", "g\x06\a\x8e\x01G"},
-	{"database/sql", "\x03\nN\x16\x03\x81\x01\v\a\"\x05\b\x02\x03\x01\r\x02\x02\x02"},
-	{"database/sql/driver", "\rd\x03\xb5\x01\x0f\x11"},
-	{"debug/buildinfo", "\x03[\x02\x01\x01\b\a\x03e\x1a\x02\x01+\x0f\x1f"},
-	{"debug/dwarf", "\x03g\a\x03\x81\x011\x11\x01\x01"},
-	{"debug/elf", "\x03\x06T\r\a\x03e\x1b\x01\f \x17\x01\x16"},
-	{"debug/gosym", "\x03g\n\xc3\x01\x01\x01\x02"},
-	{"debug/macho", "\x03\x06T\r\ne\x1c,\x17\x01"},
-	{"debug/pe", "\x03\x06T\r\a\x03e\x1c,\x17\x01\x16"},
-	{"debug/plan9obj", "j\a\x03e\x1c,"},
-	{"embed", "q*A\x19\x01S"},
+	{"crypto/internal/hpke", "\x03\v\x01\x01\x03\x055\x03\x04\x01\x01\x16\a\x03\x13\xcc\x01"},
+	{"crypto/internal/impl", "\xbd\x02"},
+	{"crypto/internal/randutil", "\xf9\x01\x12"},
+	{"crypto/internal/sysrand", "sq! \r\r\x01\x01\f\x06"},
+	{"crypto/internal/sysrand/internal/seccomp", "s"},
+	{"crypto/md5", "\x0e7.\x16\x16i"},
+	{"crypto/mlkem", "\x0e$"},
+	{"crypto/mlkem/mlkemtest", "2\x1b&"},
+	{"crypto/pbkdf2", "5\x0f\x01.\x16"},
+	{"crypto/rand", "\x1a\b\a\x1c\x04\x01)\x86\x01\rM"},
+	{"crypto/rc4", "% .\xc9\x01"},
+	{"crypto/rsa", "\x0e\f\x01\v\x10\x0e\x01\x04\a\a\x1c\x03\x133=\f\x01"},
+	{"crypto/sha1", "\x0e\f+\x03+\x16\x16\x15T"},
+	{"crypto/sha256", "\x0e\f\x1dR"},
+	{"crypto/sha3", "\x0e*Q\xca\x01"},
+	{"crypto/sha512", "\x0e\f\x1fP"},
+	{"crypto/subtle", "\x1e\x1d\x9f\x01X"},
+	{"crypto/tls", "\x03\b\x02\x01\x01\x01\x01\x02\x01\x01\x01\x02\x01\x01\t\x01\x0e\n\x01\n\x05\x04\x01\x01\x01\x01\x02\x01\x02\x01\x17\x02\x03\x13\x16\x15\b=\x16\x16\r\b\x01\x01\x01\x02\x01\r\x06\x02\x01\x0f"},
+	{"crypto/tls/internal/fips140tls", "\x17\xa9\x02"},
+	{"crypto/x509", "\x03\v\x01\x01\x01\x01\x01\x01\x01\x016\x06\x01\x01\x02\x05\x0e\x06\x02\x02\x03F\x03:\x01\x02\b\x01\x01\x02\a\x10\x05\x01\x06\a\b\x02\x01\x02\x0e\x02\x01\x01\x02\x03\x01"},
+	{"crypto/x509/pkix", "i\x06\a\x90\x01G"},
+	{"database/sql", "\x03\nP\x16\x03\x83\x01\v\a\"\x05\b\x02\x03\x01\r\x02\x02\x02"},
+	{"database/sql/driver", "\rf\x03\xb7\x01\x0f\x11"},
+	{"debug/buildinfo", "\x03]\x02\x01\x01\b\a\x03g\x1a\x02\x01+\x0f\x1f"},
+	{"debug/dwarf", "\x03i\a\x03\x83\x011\x11\x01\x01"},
+	{"debug/elf", "\x03\x06V\r\a\x03g\x1b\x01\f \x17\x01\x16"},
+	{"debug/gosym", "\x03i\n\xc5\x01\x01\x01\x02"},
+	{"debug/macho", "\x03\x06V\r\ng\x1c,\x17\x01"},
+	{"debug/pe", "\x03\x06V\r\a\x03g\x1c,\x17\x01\x16"},
+	{"debug/plan9obj", "l\a\x03g\x1c,"},
+	{"embed", "s+B\x19\x01S"},
 	{"embed/internal/embedtest", ""},
 	{"encoding", ""},
-	{"encoding/ascii85", "\xf5\x01C"},
-	{"encoding/asn1", "\x03n\x03e(\x01'\r\x02\x01\x10\x03\x01"},
-	{"encoding/base32", "\xf5\x01A\x02"},
-	{"encoding/base64", "\x9c\x01YA\x02"},
-	{"encoding/binary", "q\x84\x01\f(\r\x05"},
-	{"encoding/csv", "\x02\x01n\x03\x81\x01D\x12\x02"},
-	{"encoding/gob", "\x02c\x05\a\x03e\x1c\v\x01\x03\x1d\b\x12\x01\x0f\x02"},
-	{"encoding/hex", "q\x03\x81\x01A\x03"},
-	{"encoding/json", "\x03\x01a\x04\b\x03\x81\x01\f(\r\x02\x01\x02\x10\x01\x01\x02"},
-	{"encoding/pem", "\x03f\b\x84\x01A\x03"},
-	{"encoding/xml", "\x02\x01b\f\x03\x81\x014\x05\n\x01\x02\x10\x02"},
-	{"errors", "\xcc\x01\x83\x01"},
-	{"expvar", "nK@\b\v\x15\r\b\x02\x03\x01\x11"},
-	{"flag", "e\f\x03\x81\x01,\b\x05\b\x02\x01\x10"},
-	{"fmt", "qE&\x19\f \b\r\x02\x03\x12"},
-	{"go/ast", "\x03\x01p\x0e\x01r\x03)\b\r\x02\x01\x12\x02"},
-	{"go/build", "\x02\x01n\x03\x01\x02\x02\a\x02\x01\x17\x1f\x04\x02\b\x1b\x13\x01+\x01\x04\x01\a\b\x02\x01\x12\x02\x02"},
-	{"go/build/constraint", "q\xc7\x01\x01\x12\x02"},
-	{"go/constant", "t\x0f~\x01\x024\x01\x02\x12"},
-	{"go/doc", "\x04p\x01\x05\t=51\x10\x02\x01\x12\x02"},
-	{"go/doc/comment", "\x03q\xc2\x01\x01\x01\x01\x12\x02"},
-	{"go/format", "\x03q\x01\v\x01\x02rD"},
-	{"go/importer", "v\a\x01\x01\x04\x01q9"},
-	{"go/internal/gccgoimporter", "\x02\x01[\x13\x03\x04\v\x01o\x02,\x01\x05\x11\x01\f\b"},
-	{"go/internal/gcimporter", "\x02r\x0f\x010\x05\r/,\x15\x03\x02"},
-	{"go/internal/srcimporter", "t\x01\x01\n\x03\x01q,\x01\x05\x12\x02\x14"},
-	{"go/parser", "\x03n\x03\x01\x02\v\x01r\x01+\x06\x12"},
-	{"go/printer", "t\x01\x02\x03\tr\f \x15\x02\x01\x02\v\x05\x02"},
-	{"go/scanner", "\x03q\x0fr2\x10\x01\x13\x02"},
-	{"go/token", "\x04p\x84\x01>\x02\x03\x01\x0f\x02"},
-	{"go/types", "\x03\x01\x06g\x03\x01\x03\b\x03\x024\x062\x04\x03\t \x06\a\b\x01\x01\x01\x02\x01\x0f\x02\x02"},
-	{"go/version", "\xbe\x01{"},
-	{"hash", "\xf5\x01"},
-	{"hash/adler32", "q\x15\x16"},
-	{"hash/crc32", "q\x15\x16\x15\x8a\x01\x01\x13"},
-	{"hash/crc64", "q\x15\x16\x9f\x01"},
-	{"hash/fnv", "q\x15\x16h"},
-	{"hash/maphash", "\x86\x01\x11<|"},
-	{"html", "\xb9\x02\x02\x12"},
-	{"html/template", "\x03k\x06\x18-<\x01\n!\x05\x01\x02\x03\f\x01\x02\f\x01\x03\x02"},
-	{"image", "\x02o\x1ef\x0f4\x03\x01"},
+	{"encoding/ascii85", "\xf9\x01C"},
+	{"encoding/asn1", "\x03p\x03g(\x01'\r\x02\x01\x10\x03\x01"},
+	{"encoding/base32", "\xf9\x01A\x02"},
+	{"encoding/base64", "\x9f\x01ZA\x02"},
+	{"encoding/binary", "s\x86\x01\f(\r\x05"},
+	{"encoding/csv", "\x02\x01p\x03\x83\x01D\x12\x02"},
+	{"encoding/gob", "\x02e\x05\a\x03g\x1c\v\x01\x03\x1d\b\x12\x01\x0f\x02"},
+	{"encoding/hex", "s\x03\x83\x01A\x03"},
+	{"encoding/json", "\x03\x01c\x04\b\x03\x83\x01\f(\r\x02\x01\x02\x10\x01\x01\x02"},
+	{"encoding/pem", "\x03h\b\x86\x01A\x03"},
+	{"encoding/xml", "\x02\x01d\f\x03\x83\x014\x05\n\x01\x02\x10\x02"},
+	{"errors", "\xcf\x01\x84\x01"},
+	{"expvar", "pLA\b\v\x15\r\b\x02\x03\x01\x11"},
+	{"flag", "g\f\x03\x83\x01,\b\x05\b\x02\x01\x10"},
+	{"fmt", "sF'\x19\f \b\r\x02\x03\x12"},
+	{"go/ast", "\x03\x01r\x0f\x01s\x03)\b\r\x02\x01\x12\x02"},
+	{"go/build", "\x02\x01p\x03\x01\x02\x02\b\x02\x01\x17\x1f\x04\x02\b\x1c\x13\x01+\x01\x04\x01\a\b\x02\x01\x12\x02\x02"},
+	{"go/build/constraint", "s\xc9\x01\x01\x12\x02"},
+	{"go/constant", "v\x10\x7f\x01\x024\x01\x02\x12"},
+	{"go/doc", "\x04r\x01\x05\n=61\x10\x02\x01\x12\x02"},
+	{"go/doc/comment", "\x03s\xc4\x01\x01\x01\x01\x12\x02"},
+	{"go/format", "\x03s\x01\f\x01\x02sD"},
+	{"go/importer", "x\a\x01\x02\x04\x01r9"},
+	{"go/internal/gccgoimporter", "\x02\x01]\x13\x03\x04\f\x01p\x02,\x01\x05\x11\x01\f\b"},
+	{"go/internal/gcimporter", "\x02t\x10\x010\x05\r0,\x15\x03\x02"},
+	{"go/internal/scannerhooks", "\x86\x01"},
+	{"go/internal/srcimporter", "v\x01\x01\v\x03\x01r,\x01\x05\x12\x02\x14"},
+	{"go/parser", "\x03p\x03\x01\x02\b\x04\x01s\x01+\x06\x12"},
+	{"go/printer", "v\x01\x02\x03\ns\f \x15\x02\x01\x02\v\x05\x02"},
+	{"go/scanner", "\x03s\v\x05s2\x10\x01\x13\x02"},
+	{"go/token", "\x04r\x86\x01>\x02\x03\x01\x0f\x02"},
+	{"go/types", "\x03\x01\x06i\x03\x01\x03\t\x03\x024\x063\x04\x03\t \x06\a\b\x01\x01\x01\x02\x01\x0f\x02\x02"},
+	{"go/version", "\xc1\x01|"},
+	{"hash", "\xf9\x01"},
+	{"hash/adler32", "s\x16\x16"},
+	{"hash/crc32", "s\x16\x16\x15\x8b\x01\x01\x13"},
+	{"hash/crc64", "s\x16\x16\xa0\x01"},
+	{"hash/fnv", "s\x16\x16i"},
+	{"hash/maphash", "\x89\x01\x11<}"},
+	{"html", "\xbd\x02\x02\x12"},
+	{"html/template", "\x03m\x06\x19-=\x01\n!\x05\x01\x02\x03\f\x01\x02\f\x01\x03\x02"},
+	{"image", "\x02q\x1fg\x0f4\x03\x01"},
 	{"image/color", ""},
-	{"image/color/palette", "\x8f\x01"},
-	{"image/draw", "\x8e\x01\x01\x04"},
-	{"image/gif", "\x02\x01\x05i\x03\x1a\x01\x01\x01\vY"},
-	{"image/internal/imageutil", "\x8e\x01"},
-	{"image/jpeg", "\x02o\x1d\x01\x04b"},
-	{"image/png", "\x02\aa\n\x12\x02\x06\x01fC"},
-	{"index/suffixarray", "\x03g\a\x84\x01\f+\n\x01"},
-	{"internal/abi", "\xb8\x01\x97\x01"},
-	{"internal/asan", "\xcf\x02"},
-	{"internal/bisect", "\xae\x02\r\x01"},
-	{"internal/buildcfg", "tGf\x06\x02\x05\n\x01"},
-	{"internal/bytealg", "\xb1\x01\x9e\x01"},
+	{"image/color/palette", "\x92\x01"},
+	{"image/draw", "\x91\x01\x01\x04"},
+	{"image/gif", "\x02\x01\x05k\x03\x1b\x01\x01\x01\vZ\x0f"},
+	{"image/internal/imageutil", "\x91\x01"},
+	{"image/jpeg", "\x02q\x1e\x01\x04c"},
+	{"image/png", "\x02\ac\n\x13\x02\x06\x01gC"},
+	{"index/suffixarray", "\x03i\a\x86\x01\f+\n\x01"},
+	{"internal/abi", "\xbb\x01\x98\x01"},
+	{"internal/asan", "\xd3\x02"},
+	{"internal/bisect", "\xb2\x02\r\x01"},
+	{"internal/buildcfg", "vHg\x06\x02\x05\n\x01"},
+	{"internal/bytealg", "\xb4\x01\x9f\x01"},
 	{"internal/byteorder", ""},
 	{"internal/cfg", ""},
-	{"internal/cgrouptest", "tZS\x06\x0f\x02\x01\x04\x01"},
-	{"internal/chacha8rand", "\x9c\x01\x15\a\x97\x01"},
+	{"internal/cgrouptest", "v[T\x06\x0f\x02\x01\x04\x01"},
+	{"internal/chacha8rand", "\x9f\x01\x15\a\x98\x01"},
 	{"internal/copyright", ""},
 	{"internal/coverage", ""},
 	{"internal/coverage/calloc", ""},
-	{"internal/coverage/cfile", "n\x06\x16\x17\x01\x02\x01\x01\x01\x01\x01\x01\x01\"\x02&,\x06\a\n\x01\x03\r\x06"},
-	{"internal/coverage/cformat", "\x04p-\x04P\v6\x01\x02\r"},
-	{"internal/coverage/cmerge", "t-`"},
-	{"internal/coverage/decodecounter", "j\n-\v\x02G,\x17\x17"},
-	{"internal/coverage/decodemeta", "\x02h\n\x16\x17\v\x02G,"},
-	{"internal/coverage/encodecounter", "\x02h\n-\f\x01\x02E\v!\x15"},
-	{"internal/coverage/encodemeta", "\x02\x01g\n\x12\x04\x17\r\x02E,."},
-	{"internal/coverage/pods", "\x04p-\x80\x01\x06\x05\n\x02\x01"},
-	{"internal/coverage/rtcov", "\xcf\x02"},
-	{"internal/coverage/slicereader", "j\n\x81\x01Z"},
-	{"internal/coverage/slicewriter", "t\x81\x01"},
-	{"internal/coverage/stringtab", "t8\x04E"},
+	{"internal/coverage/cfile", "p\x06\x17\x17\x01\x02\x01\x01\x01\x01\x01\x01\x01\"\x02',\x06\a\n\x01\x03\r\x06"},
+	{"internal/coverage/cformat", "\x04r.\x04Q\v6\x01\x02\r"},
+	{"internal/coverage/cmerge", "v.a"},
+	{"internal/coverage/decodecounter", "l\n.\v\x02H,\x17\x17"},
+	{"internal/coverage/decodemeta", "\x02j\n\x17\x17\v\x02H,"},
+	{"internal/coverage/encodecounter", "\x02j\n.\f\x01\x02F\v!\x15"},
+	{"internal/coverage/encodemeta", "\x02\x01i\n\x13\x04\x17\r\x02F,."},
+	{"internal/coverage/pods", "\x04r.\x81\x01\x06\x05\n\x02\x01"},
+	{"internal/coverage/rtcov", "\xd3\x02"},
+	{"internal/coverage/slicereader", "l\n\x83\x01Z"},
+	{"internal/coverage/slicewriter", "v\x83\x01"},
+	{"internal/coverage/stringtab", "v9\x04F"},
 	{"internal/coverage/test", ""},
 	{"internal/coverage/uleb128", ""},
-	{"internal/cpu", "\xcf\x02"},
-	{"internal/dag", "\x04p\xc2\x01\x03"},
-	{"internal/diff", "\x03q\xc3\x01\x02"},
-	{"internal/exportdata", "\x02\x01n\x03\x02c\x1c,\x01\x05\x11\x01\x02"},
-	{"internal/filepathlite", "q*A\x1a@"},
-	{"internal/fmtsort", "\x04\xa5\x02\r"},
-	{"internal/fuzz", "\x03\nE\x18\x04\x03\x03\x01\v\x036<\f\x03\x1d\x01\x05\x02\x05\n\x01\x02\x01\x01\f\x04\x02"},
+	{"internal/cpu", "\xd3\x02"},
+	{"internal/dag", "\x04r\xc4\x01\x03"},
+	{"internal/diff", "\x03s\xc5\x01\x02"},
+	{"internal/exportdata", "\x02\x01p\x03\x02e\x1c,\x01\x05\x11\x01\x02"},
+	{"internal/filepathlite", "s+B\x1a@"},
+	{"internal/fmtsort", "\x04\xa9\x02\r"},
+	{"internal/fuzz", "\x03\nG\x18\x04\x03\x03\x01\f\x036=\f\x03\x1d\x01\x05\x02\x05\n\x01\x02\x01\x01\f\x04\x02"},
 	{"internal/goarch", ""},
-	{"internal/godebug", "\x99\x01!\x81\x01\x01\x13"},
+	{"internal/godebug", "\x9c\x01!\x82\x01\x01\x13"},
 	{"internal/godebugs", ""},
 	{"internal/goexperiment", ""},
 	{"internal/goos", ""},
-	{"internal/goroot", "\xa1\x02\x01\x05\x12\x02"},
+	{"internal/goroot", "\xa5\x02\x01\x05\x12\x02"},
 	{"internal/gover", "\x04"},
 	{"internal/goversion", ""},
-	{"internal/lazyregexp", "\xa1\x02\v\r\x02"},
-	{"internal/lazytemplate", "\xf5\x01,\x18\x02\f"},
-	{"internal/msan", "\xcf\x02"},
+	{"internal/lazyregexp", "\xa5\x02\v\r\x02"},
+	{"internal/lazytemplate", "\xf9\x01,\x18\x02\f"},
+	{"internal/msan", "\xd3\x02"},
 	{"internal/nettrace", ""},
-	{"internal/obscuretestdata", "i\x8c\x01,"},
-	{"internal/oserror", "q"},
-	{"internal/pkgbits", "\x03O\x18\a\x03\x04\vr\r\x1f\r\n\x01"},
+	{"internal/obscuretestdata", "k\x8e\x01,"},
+	{"internal/oserror", "s"},
+	{"internal/pkgbits", "\x03Q\x18\a\x03\x04\fs\r\x1f\r\n\x01"},
 	{"internal/platform", ""},
-	{"internal/poll", "qj\x05\x159\r\x01\x01\f\x06"},
-	{"internal/profile", "\x03\x04j\x03\x81\x017\n\x01\x01\x01\x10"},
+	{"internal/poll", "sl\x05\x159\r\x01\x01\f\x06"},
+	{"internal/profile", "\x03\x04l\x03\x83\x017\n\x01\x01\x01\x10"},
 	{"internal/profilerecord", ""},
-	{"internal/race", "\x97\x01\xb8\x01"},
-	{"internal/reflectlite", "\x97\x01!:<!"},
-	{"internal/runtime/atomic", "\xb8\x01\x97\x01"},
-	{"internal/runtime/cgroup", "\x9b\x01<\x04t"},
-	{"internal/runtime/exithook", "\xcd\x01\x82\x01"},
-	{"internal/runtime/gc", "\xb8\x01"},
-	{"internal/runtime/gc/internal/gen", "\n`\n\x17j\x04\v\x1d\b\x10\x02"},
-	{"internal/runtime/gc/scan", "\xb1\x01\a\x18\x06y"},
-	{"internal/runtime/maps", "\x97\x01\x01 \n\t\t\x02y"},
-	{"internal/runtime/math", "\xb8\x01"},
+	{"internal/race", "\x9a\x01\xb9\x01"},
+	{"internal/reflectlite", "\x9a\x01!;<!"},
+	{"internal/runtime/atomic", "\xbb\x01\x98\x01"},
+	{"internal/runtime/cgroup", "\x9e\x01=\x04t"},
+	{"internal/runtime/exithook", "\xd0\x01\x83\x01"},
+	{"internal/runtime/gc", "\xbb\x01"},
+	{"internal/runtime/gc/internal/gen", "\nb\n\x18k\x04\v\x1d\b\x10\x02"},
+	{"internal/runtime/gc/scan", "\xb4\x01\a\x18\ay"},
+	{"internal/runtime/maps", "\x9a\x01\x01 \n\t\t\x03y"},
+	{"internal/runtime/math", "\xbb\x01"},
+	{"internal/runtime/pprof/label", ""},
 	{"internal/runtime/startlinetest", ""},
-	{"internal/runtime/sys", "\xb8\x01\x04"},
-	{"internal/runtime/syscall/linux", "\xb8\x01\x97\x01"},
+	{"internal/runtime/sys", "\xbb\x01\x04"},
+	{"internal/runtime/syscall/linux", "\xbb\x01\x98\x01"},
 	{"internal/runtime/wasitest", ""},
-	{"internal/saferio", "\xf5\x01Z"},
-	{"internal/singleflight", "\xbb\x02"},
-	{"internal/strconv", "\x84\x02K"},
-	{"internal/stringslite", "\x9b\x01\xb4\x01"},
-	{"internal/sync", "\x97\x01!\x13q\x13"},
-	{"internal/synctest", "\x97\x01\xb8\x01"},
-	{"internal/syscall/execenv", "\xbd\x02"},
-	{"internal/syscall/unix", "\xae\x02\x0e\x01\x12"},
-	{"internal/sysinfo", "\x02\x01\xae\x01D,\x18\x02"},
+	{"internal/saferio", "\xf9\x01Z"},
+	{"internal/singleflight", "\xbf\x02"},
+	{"internal/strconv", "\x88\x02K"},
+	{"internal/stringslite", "\x9e\x01\xb5\x01"},
+	{"internal/sync", "\x9a\x01!\x13r\x13"},
+	{"internal/synctest", "\x9a\x01\xb9\x01"},
+	{"internal/syscall/execenv", "\xc1\x02"},
+	{"internal/syscall/unix", "\xb2\x02\x0e\x01\x12"},
+	{"internal/sysinfo", "\x02\x01\xb1\x01E,\x18\x02"},
 	{"internal/syslist", ""},
-	{"internal/testenv", "\x03\nd\x02\x01)\x1b\x0f/+\x01\x05\a\n\x01\x02\x02\x01\v"},
-	{"internal/testhash", "\x03\x83\x01o\x118\v"},
-	{"internal/testlog", "\xbb\x02\x01\x13"},
-	{"internal/testpty", "q\x03\xad\x01"},
-	{"internal/trace", "\x02\x01\x01\x06`\a\x03u\x03\x03\x06\x03\t5\x01\x01\x01\x10\x06"},
-	{"internal/trace/internal/testgen", "\x03g\ns\x03\x02\x03\x011\v\r\x10"},
-	{"internal/trace/internal/tracev1", "\x03\x01f\a\x03{\x06\f5\x01"},
-	{"internal/trace/raw", "\x02h\nx\x03\x06C\x01\x12"},
-	{"internal/trace/testtrace", "\x02\x01n\x03o\x04\x03\x05\x01\x05,\v\x02\b\x02\x01\x05"},
+	{"internal/testenv", "\x03\nf\x02\x01*\x1b\x0f0+\x01\x05\a\n\x01\x02\x02\x01\v"},
+	{"internal/testhash", "\x03\x86\x01p\x118\v"},
+	{"internal/testlog", "\xbf\x02\x01\x13"},
+	{"internal/testpty", "s\x03\xaf\x01"},
+	{"internal/trace", "\x02\x01\x01\x06b\a\x03w\x03\x03\x06\x03\t5\x01\x01\x01\x10\x06"},
+	{"internal/trace/internal/testgen", "\x03i\nu\x03\x02\x03\x011\v\r\x10"},
+	{"internal/trace/internal/tracev1", "\x03\x01h\a\x03}\x06\f5\x01"},
+	{"internal/trace/raw", "\x02j\nz\x03\x06C\x01\x12"},
+	{"internal/trace/testtrace", "\x02\x01p\x03q\x04\x03\x05\x01\x05,\v\x02\b\x02\x01\x05"},
 	{"internal/trace/tracev2", ""},
-	{"internal/trace/traceviewer", "\x02a\v\x06\x19<\x1e\a\a\x04\b\v\x15\x01\x05\a\n\x01\x02\x0e"},
+	{"internal/trace/traceviewer", "\x02c\v\x06\x1a<\x1f\a\a\x04\b\v\x15\x01\x05\a\n\x01\x02\x0e"},
 	{"internal/trace/traceviewer/format", ""},
-	{"internal/trace/version", "tx\t"},
-	{"internal/txtar", "\x03q\xad\x01\x18"},
-	{"internal/types/errors", "\xb8\x02"},
-	{"internal/unsafeheader", "\xcf\x02"},
-	{"internal/xcoff", "]\r\a\x03e\x1c,\x17\x01"},
-	{"internal/zstd", "j\a\x03\x81\x01\x0f"},
-	{"io", "q\xca\x01"},
-	{"io/fs", "q**01\x10\x13\x04"},
-	{"io/ioutil", "\xf5\x01\x01+\x15\x03"},
-	{"iter", "\xcb\x01c!"},
-	{"log", "t\x81\x01\x05'\r\r\x01\r"},
+	{"internal/trace/version", "vz\t"},
+	{"internal/txtar", "\x03s\xaf\x01\x18"},
+	{"internal/types/errors", "\xbc\x02"},
+	{"internal/unsafeheader", "\xd3\x02"},
+	{"internal/xcoff", "_\r\a\x03g\x1c,\x17\x01"},
+	{"internal/zstd", "l\a\x03\x83\x01\x0f"},
+	{"io", "s\xcc\x01"},
+	{"io/fs", "s+*11\x10\x13\x04"},
+	{"io/ioutil", "\xf9\x01\x01+\x15\x03"},
+	{"iter", "\xce\x01d!"},
+	{"log", "v\x83\x01\x05'\r\r\x01\r"},
 	{"log/internal", ""},
-	{"log/slog", "\x03\nX\t\x03\x03\x81\x01\x04\x01\x02\x02\x03(\x05\b\x02\x01\x02\x01\r\x02\x02\x02"},
+	{"log/slog", "\x03\nZ\t\x03\x03\x83\x01\x04\x01\x02\x02\x03(\x05\b\x02\x01\x02\x01\r\x02\x02\x02"},
 	{"log/slog/internal", ""},
-	{"log/slog/internal/benchmarks", "\rd\x03\x81\x01\x06\x03:\x11"},
-	{"log/slog/internal/buffer", "\xbb\x02"},
-	{"log/syslog", "q\x03\x85\x01\x12\x16\x18\x02\x0e"},
-	{"maps", "\xf8\x01W"},
-	{"math", "\xb1\x01SK"},
-	{"math/big", "\x03n\x03(\x15D\f\x03\x020\x02\x01\x02\x14"},
-	{"math/big/internal/asmgen", "\x03\x01p\x90\x012\x03"},
-	{"math/bits", "\xcf\x02"},
-	{"math/cmplx", "\x81\x02\x03"},
-	{"math/rand", "\xb9\x01H:\x01\x13"},
-	{"math/rand/v2", "q+\x03b\x03K"},
-	{"mime", "\x02\x01f\b\x03\x81\x01\v!\x15\x03\x02\x10\x02"},
-	{"mime/multipart", "\x02\x01K#\x03E<\v\x01\a\x02\x15\x02\x06\x0f\x02\x01\x16"},
-	{"mime/quotedprintable", "\x02\x01q\x81\x01"},
-	{"net", "\x04\td*\x1e\n\x05\x12\x01\x01\x04\x15\x01%\x06\r\b\x05\x01\x01\f\x06\a"},
-	{"net/http", "\x02\x01\x03\x01\x04\x02A\b\x13\x01\a\x03E<\x01\x03\a\x01\x03\x02\x02\x01\x02\x06\x02\x01\x01\n\x01\x01\x05\x01\x02\x05\b\x01\x01\x01\x02\x01\r\x02\x02\x02\b\x01\x01\x01"},
-	{"net/http/cgi", "\x02T\x1b\x03\x81\x01\x04\a\v\x01\x13\x01\x01\x01\x04\x01\x05\x02\b\x02\x01\x10\x0e"},
-	{"net/http/cookiejar", "\x04m\x03\x97\x01\x01\b\f\x16\x03\x02\x0e\x04"},
-	{"net/http/fcgi", "\x02\x01\n]\a\x03\x81\x01\x16\x01\x01\x14\x18\x02\x0e"},
-	{"net/http/httptest", "\x02\x01\nI\x02\x1b\x01\x81\x01\x04\x12\x01\n\t\x02\x17\x01\x02\x0e\x0e"},
-	{"net/http/httptrace", "\rImH\x14\n "},
-	{"net/http/httputil", "\x02\x01\nd\x03\x81\x01\x04\x0f\x03\x01\x05\x02\x01\v\x01\x19\x02\x0e\x0e"},
-	{"net/http/internal", "\x02\x01n\x03\x81\x01"},
-	{"net/http/internal/ascii", "\xb9\x02\x12"},
-	{"net/http/internal/httpcommon", "\rd\x03\x9d\x01\x0e\x01\x17\x01\x01\x02\x1c\x02"},
-	{"net/http/internal/testcert", "\xb9\x02"},
-	{"net/http/pprof", "\x02\x01\ng\x18-\x02\x0e,\x04\x13\x14\x01\r\x04\x03\x01\x02\x01\x10"},
+	{"log/slog/internal/benchmarks", "\rf\x03\x83\x01\x06\x03:\x11"},
+	{"log/slog/internal/buffer", "\xbf\x02"},
+	{"log/syslog", "s\x03\x87\x01\x12\x16\x18\x02\x0e"},
+	{"maps", "\xfc\x01W"},
+	{"math", "\xb4\x01TK"},
+	{"math/big", "\x03p\x03)\x15E\f\x03\x020\x02\x01\x02\x14"},
+	{"math/big/internal/asmgen", "\x03\x01r\x92\x012\x03"},
+	{"math/bits", "\xd3\x02"},
+	{"math/cmplx", "\x85\x02\x03"},
+	{"math/rand", "\xbc\x01I:\x01\x13"},
+	{"math/rand/v2", "s,\x03c\x03K"},
+	{"mime", "\x02\x01h\b\x03\x83\x01\v!\x15\x03\x02\x10\x02"},
+	{"mime/multipart", "\x02\x01M#\x03F=\v\x01\a\x02\x15\x02\x06\x0f\x02\x01\x16"},
+	{"mime/quotedprintable", "\x02\x01s\x83\x01"},
+	{"net", "\x04\tf+\x1e\n\x05\x13\x01\x01\x04\x15\x01%\x06\r\b\x05\x01\x01\f\x06\a"},
+	{"net/http", "\x02\x01\x03\x01\x04\x02C\b\x13\x01\a\x03F=\x01\x03\a\x01\x03\x02\x02\x01\x02\x06\x02\x01\x01\n\x01\x01\x05\x01\x02\x05\b\x01\x01\x01\x02\x01\r\x02\x02\x02\b\x01\x01\x01"},
+	{"net/http/cgi", "\x02V\x1b\x03\x83\x01\x04\a\v\x01\x13\x01\x01\x01\x04\x01\x05\x02\b\x02\x01\x10\x0e"},
+	{"net/http/cookiejar", "\x04o\x03\x99\x01\x01\b\a\x05\x16\x03\x02\x0e\x04"},
+	{"net/http/fcgi", "\x02\x01\n_\a\x03\x83\x01\x16\x01\x01\x14\x18\x02\x0e"},
+	{"net/http/httptest", "\x02\x01\nK\x02\x1b\x01\x83\x01\x04\x12\x01\n\t\x02\x17\x01\x02\x0e\x0e"},
+	{"net/http/httptrace", "\rKnI\x14\n "},
+	{"net/http/httputil", "\x02\x01\nf\x03\x83\x01\x04\x0f\x03\x01\x05\x02\x01\v\x01\x19\x02\x01\r\x0e"},
+	{"net/http/internal", "\x02\x01p\x03\x83\x01"},
+	{"net/http/internal/ascii", "\xbd\x02\x12"},
+	{"net/http/internal/httpcommon", "\rf\x03\x9f\x01\x0e\x01\x17\x01\x01\x02\x1c\x02"},
+	{"net/http/internal/testcert", "\xbd\x02"},
+	{"net/http/pprof", "\x02\x01\ni\x19-\x02\x0e-\x04\x13\x14\x01\r\x04\x03\x01\x02\x01\x10"},
 	{"net/internal/cgotest", ""},
-	{"net/internal/socktest", "t\xc7\x01\x02"},
-	{"net/mail", "\x02o\x03\x81\x01\x04\x0f\x03\x14\x1a\x02\x0e\x04"},
-	{"net/netip", "\x04m*\x01e\x034\x16"},
-	{"net/rpc", "\x02j\x05\x03\x0f\nh\x04\x12\x01\x1d\r\x03\x02"},
-	{"net/rpc/jsonrpc", "n\x03\x03\x81\x01\x16\x11\x1f"},
-	{"net/smtp", "\x192\v\x13\b\x03\x81\x01\x16\x14\x1a"},
-	{"net/textproto", "\x02\x01n\x03\x81\x01\f\n-\x01\x02\x14"},
-	{"net/url", "q\x03\xa7\x01\v\x10\x02\x01\x16"},
-	{"os", "q*\x01\x19\x03\x10\x13\x01\x03\x01\x05\x10\x018\b\x05\x01\x01\f\x06"},
-	{"os/exec", "\x03\ndH&\x01\x15\x01+\x06\a\n\x01\x04\f"},
-	{"os/exec/internal/fdtest", "\xbd\x02"},
-	{"os/signal", "\r\x94\x02\x15\x05\x02"},
-	{"os/user", "\x02\x01n\x03\x81\x01,\r\n\x01\x02"},
-	{"path", "q*\xb2\x01"},
-	{"path/filepath", "q*\x1aA+\r\b\x03\x04\x10"},
-	{"plugin", "q"},
-	{"reflect", "q&\x04\x1d\x13\b\x03\x05\x17\x06\t-\n\x03\x10\x02\x02"},
+	{"net/internal/socktest", "v\xc9\x01\x02"},
+	{"net/mail", "\x02q\x03\x83\x01\x04\x0f\x03\x14\x1a\x02\x0e\x04"},
+	{"net/netip", "\x04o+\x01f\x034\x16"},
+	{"net/rpc", "\x02l\x05\x03\x10\ni\x04\x12\x01\x1d\r\x03\x02"},
+	{"net/rpc/jsonrpc", "p\x03\x03\x83\x01\x16\x11\x1f"},
+	{"net/smtp", "\x193\f\x13\b\x03\x83\x01\x16\x14\x1a"},
+	{"net/textproto", "\x02\x01p\x03\x83\x01\f\n-\x01\x02\x14"},
+	{"net/url", "s\x03Fc\v\x10\x02\x01\x16"},
+	{"os", "s+\x01\x19\x03\x10\x14\x01\x03\x01\x05\x10\x018\b\x05\x01\x01\f\x06"},
+	{"os/exec", "\x03\nfI'\x01\x15\x01+\x06\a\n\x01\x04\f"},
+	{"os/exec/internal/fdtest", "\xc1\x02"},
+	{"os/signal", "\r\x98\x02\x15\x05\x02"},
+	{"os/user", "\x02\x01p\x03\x83\x01,\r\n\x01\x02"},
+	{"path", "s+\xb3\x01"},
+	{"path/filepath", "s+\x1aB+\r\b\x03\x04\x10"},
+	{"plugin", "s"},
+	{"reflect", "s'\x04\x1d\x13\b\x04\x05\x17\x06\t-\n\x03\x10\x02\x02"},
 	{"reflect/internal/example1", ""},
 	{"reflect/internal/example2", ""},
-	{"regexp", "\x03\xf2\x018\t\x02\x01\x02\x10\x02"},
-	{"regexp/syntax", "\xb6\x02\x01\x01\x01\x02\x10\x02"},
-	{"runtime", "\x97\x01\x04\x01\x03\f\x06\a\x02\x01\x01\x0e\x03\x01\x01\x01\x02\x01\x01\x02\x01\x04\x01\x10c"},
-	{"runtime/coverage", "\xa3\x01R"},
-	{"runtime/debug", "tTY\r\b\x02\x01\x10\x06"},
-	{"runtime/metrics", "\xba\x01G-!"},
-	{"runtime/pprof", "\x02\x01\x01\x03\x06]\a\x03#$\x0f+\f \r\b\x01\x01\x01\x02\x02\t\x03\x06"},
-	{"runtime/race", "\xb4\x02"},
+	{"regexp", "\x03\xf6\x018\t\x02\x01\x02\x10\x02"},
+	{"regexp/syntax", "\xba\x02\x01\x01\x01\x02\x10\x02"},
+	{"runtime", "\x9a\x01\x04\x01\x03\f\x06\a\x02\x01\x01\x0e\x03\x01\x01\x01\x02\x01\x01\x01\x02\x01\x04\x01\x10\x18K"},
+	{"runtime/coverage", "\xa6\x01S"},
+	{"runtime/debug", "vUZ\r\b\x02\x01\x10\x06"},
+	{"runtime/metrics", "\xbd\x01H-!"},
+	{"runtime/pprof", "\x02\x01\x01\x03\x06_\a\x03$$\x0f\v!\f \r\b\x01\x01\x01\x02\x02\t\x03\x06"},
+	{"runtime/race", "\xb8\x02"},
 	{"runtime/race/internal/amd64v1", ""},
-	{"runtime/trace", "\rd\x03x\t9\b\x05\x01\r\x06"},
-	{"slices", "\x04\xf4\x01\fK"},
-	{"sort", "\xcc\x0182"},
-	{"strconv", "q*@\x01q"},
-	{"strings", "q&\x04A\x19\x03\f7\x10\x02\x02"},
+	{"runtime/trace", "\rf\x03z\t9\b\x05\x01\r\x06"},
+	{"slices", "\x04\xf8\x01\fK"},
+	{"sort", "\xcf\x0192"},
+	{"strconv", "s+A\x01q"},
+	{"strings", "s'\x04B\x19\x03\f7\x10\x02\x02"},
 	{"structs", ""},
-	{"sync", "\xcb\x01\x12\x01P\x0e\x13"},
-	{"sync/atomic", "\xcf\x02"},
-	{"syscall", "q'\x03\x01\x1c\n\x03\x06\f\x04S\b\x05\x01\x13"},
-	{"testing", "\x03\nd\x02\x01W\x16\x14\f\x05\x1b\x06\x02\x05\x02\x05\x01\x02\x01\x02\x01\r\x02\x04"},
-	{"testing/fstest", "q\x03\x81\x01\x01\n&\x10\x03\b\b"},
-	{"testing/internal/testdeps", "\x02\v\xaa\x01.\x10,\x03\x05\x03\x06\a\x02\x0e"},
-	{"testing/iotest", "\x03n\x03\x81\x01\x04"},
-	{"testing/quick", "s\x01\x8d\x01\x05#\x10\x10"},
-	{"testing/slogtest", "\rd\x03\x87\x01.\x05\x10\v"},
-	{"testing/synctest", "\xde\x01`\x11"},
-	{"text/scanner", "\x03q\x81\x01,*\x02"},
-	{"text/tabwriter", "t\x81\x01X"},
-	{"text/template", "q\x03B?\x01\n \x01\x05\x01\x02\x05\v\x02\r\x03\x02"},
-	{"text/template/parse", "\x03q\xba\x01\n\x01\x12\x02"},
-	{"time", "q*\x1e#(*\r\x02\x12"},
-	{"time/tzdata", "q\xcc\x01\x12"},
+	{"sync", "\xce\x01\x13\x01P\x0e\x13"},
+	{"sync/atomic", "\xd3\x02"},
+	{"syscall", "s(\x03\x01\x1c\n\x03\x06\r\x04S\b\x05\x01\x13"},
+	{"testing", "\x03\nf\x02\x01X\x17\x14\f\x05\x1b\x06\x02\x05\x02\x05\x01\x02\x01\x02\x01\r\x02\x04"},
+	{"testing/fstest", "s\x03\x83\x01\x01\n&\x10\x03\b\b"},
+	{"testing/internal/testdeps", "\x02\v\xad\x01/\x10,\x03\x05\x03\x06\a\x02\x0e"},
+	{"testing/iotest", "\x03p\x03\x83\x01\x04"},
+	{"testing/quick", "u\x01\x8f\x01\x05#\x10\x10"},
+	{"testing/slogtest", "\rf\x03\x89\x01.\x05\x10\v"},
+	{"testing/synctest", "\xe2\x01`\x11"},
+	{"text/scanner", "\x03s\x83\x01,*\x02"},
+	{"text/tabwriter", "v\x83\x01X"},
+	{"text/template", "s\x03C@\x01\n \x01\x05\x01\x02\x05\v\x02\r\x03\x02"},
+	{"text/template/parse", "\x03s\xbc\x01\n\x01\x12\x02"},
+	{"time", "s+\x1e$(*\r\x02\x12"},
+	{"time/tzdata", "s\xce\x01\x12"},
 	{"unicode", ""},
 	{"unicode/utf16", ""},
 	{"unicode/utf8", ""},
-	{"unique", "\x97\x01!$\x01Q\r\x01\x13\x12"},
+	{"unique", "\x9a\x01!%\x01Q\r\x01\x13\x12"},
 	{"unsafe", ""},
-	{"vendor/golang.org/x/crypto/chacha20", "\x10Z\a\x93\x01*&"},
-	{"vendor/golang.org/x/crypto/chacha20poly1305", "\x10Z\a\xdf\x01\x04\x01\a"},
-	{"vendor/golang.org/x/crypto/cryptobyte", "g\n\x03\x8e\x01' \n"},
+	{"vendor/golang.org/x/crypto/chacha20", "\x10\\\a\x95\x01*&"},
+	{"vendor/golang.org/x/crypto/chacha20poly1305", "\x10\\\a\xe1\x01\x04\x01\a"},
+	{"vendor/golang.org/x/crypto/cryptobyte", "i\n\x03\x90\x01' \n"},
 	{"vendor/golang.org/x/crypto/cryptobyte/asn1", ""},
-	{"vendor/golang.org/x/crypto/internal/alias", "\xcf\x02"},
-	{"vendor/golang.org/x/crypto/internal/poly1305", "U\x15\x9a\x01"},
-	{"vendor/golang.org/x/net/dns/dnsmessage", "q"},
-	{"vendor/golang.org/x/net/http/httpguts", "\x8b\x02\x14\x1a\x14\r"},
-	{"vendor/golang.org/x/net/http/httpproxy", "q\x03\x97\x01\x10\x05\x01\x18\x14\r"},
-	{"vendor/golang.org/x/net/http2/hpack", "\x03n\x03\x81\x01F"},
-	{"vendor/golang.org/x/net/idna", "t\x8d\x018\x14\x10\x02\x01"},
-	{"vendor/golang.org/x/net/nettest", "\x03g\a\x03\x81\x01\x11\x05\x16\x01\f\n\x01\x02\x02\x01\v"},
-	{"vendor/golang.org/x/sys/cpu", "\xa1\x02\r\n\x01\x16"},
-	{"vendor/golang.org/x/text/secure/bidirule", "q\xdc\x01\x11\x01"},
-	{"vendor/golang.org/x/text/transform", "\x03n\x84\x01X"},
-	{"vendor/golang.org/x/text/unicode/bidi", "\x03\bi\x85\x01>\x16"},
-	{"vendor/golang.org/x/text/unicode/norm", "j\n\x81\x01F\x12\x11"},
-	{"weak", "\x97\x01\x97\x01!"},
+	{"vendor/golang.org/x/crypto/internal/alias", "\xd3\x02"},
+	{"vendor/golang.org/x/crypto/internal/poly1305", "W\x15\x9c\x01"},
+	{"vendor/golang.org/x/net/dns/dnsmessage", "s\xc7\x01"},
+	{"vendor/golang.org/x/net/http/httpguts", "\x8f\x02\x14\x1a\x14\r"},
+	{"vendor/golang.org/x/net/http/httpproxy", "s\x03\x99\x01\x10\x05\x01\x18\x14\r"},
+	{"vendor/golang.org/x/net/http2/hpack", "\x03p\x03\x83\x01F"},
+	{"vendor/golang.org/x/net/idna", "v\x8f\x018\x14\x10\x02\x01"},
+	{"vendor/golang.org/x/net/nettest", "\x03i\a\x03\x83\x01\x11\x05\x16\x01\f\n\x01\x02\x02\x01\v"},
+	{"vendor/golang.org/x/sys/cpu", "\xa5\x02\r\n\x01\x16"},
+	{"vendor/golang.org/x/text/secure/bidirule", "s\xde\x01\x11\x01"},
+	{"vendor/golang.org/x/text/transform", "\x03p\x86\x01X"},
+	{"vendor/golang.org/x/text/unicode/bidi", "\x03\bk\x87\x01>\x16"},
+	{"vendor/golang.org/x/text/unicode/norm", "l\n\x83\x01F\x12\x11"},
+	{"weak", "\x9a\x01\x98\x01!"},
 }

 // bootstrap is the list of bootstrap packages extracted from cmd/dist.
@@ -385,6 +389,7 @@ var bootstrap = map[string]bool{
 	"cmd/compile/internal/arm64":              true,
 	"cmd/compile/internal/base":               true,
 	"cmd/compile/internal/bitvec":             true,
+	"cmd/compile/internal/bloop":              true,
 	"cmd/compile/internal/compare":            true,
 	"cmd/compile/internal/coverage":           true,
 	"cmd/compile/internal/deadlocals":         true,
@@ -413,6 +418,7 @@ var bootstrap = map[string]bool{
 	"cmd/compile/internal/riscv64":            true,
 	"cmd/compile/internal/rttype":             true,
 	"cmd/compile/internal/s390x":              true,
+	"cmd/compile/internal/slice":              true,
 	"cmd/compile/internal/ssa":                true,
 	"cmd/compile/internal/ssagen":             true,
 	"cmd/compile/internal/staticdata":         true,
--- a/vendor/golang.org/x/tools/internal/stdlib/manifest.go
+++ b/vendor/golang.org/x/tools/internal/stdlib/manifest.go
--- a/vendor/golang.org/x/tools/internal/stdlib/stdlib.go
+++ b/vendor/golang.org/x/tools/internal/stdlib/stdlib.go
@@ -39,7 +39,7 @@ const (
 	Var                 // "EOF"
 	Const               // "Pi"
 	Field               // "Point.X"
-	Method              // "(*Buffer).Grow"
+	Method              // "(*Buffer).Grow" or "(Reader).Read"
 )

 func (kind Kind) String() string {
--- a/vendor/golang.org/x/tools/internal/typesinternal/classify_call.go
+++ b/vendor/golang.org/x/tools/internal/typesinternal/classify_call.go
@@ -8,7 +8,7 @@ import (
 	"fmt"
 	"go/ast"
 	"go/types"
-	_ "unsafe"
+	_ "unsafe" // for go:linkname hack
 )

 // CallKind describes the function position of an [*ast.CallExpr].
--- a/vendor/golang.org/x/tools/internal/typesinternal/types.go
+++ b/vendor/golang.org/x/tools/internal/typesinternal/types.go
@@ -23,7 +23,6 @@ import (
 	"go/token"
 	"go/types"
 	"reflect"
-	"unsafe"

 	"golang.org/x/tools/go/ast/inspector"
 	"golang.org/x/tools/internal/aliases"
@@ -40,8 +39,7 @@ func SetUsesCgo(conf *types.Config) bool {
 		}
 	}

-	addr := unsafe.Pointer(f.UnsafeAddr())
-	*(*bool)(addr) = true
+	*(*bool)(f.Addr().UnsafePointer()) = true

 	return true
 }
--- a/vendor/golang.org/x/tools/internal/versions/features.go
+++ b/vendor/golang.org/x/tools/internal/versions/features.go
@@ -9,6 +9,7 @@ package versions

 // named constants, to avoid misspelling
 const (
+	Go1_17 = "go1.17"
 	Go1_18 = "go1.18"
 	Go1_19 = "go1.19"
 	Go1_20 = "go1.20"
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -1179,7 +1179,7 @@ github.com/onsi/ginkgo/reporters/stenographer
 github.com/onsi/ginkgo/reporters/stenographer/support/go-colorable
 github.com/onsi/ginkgo/reporters/stenographer/support/go-isatty
 github.com/onsi/ginkgo/types
-# github.com/onsi/ginkgo/v2 v2.27.4
+# github.com/onsi/ginkgo/v2 v2.27.5
 ## explicit; go 1.23.0
 github.com/onsi/ginkgo/v2
 github.com/onsi/ginkgo/v2/config
@@ -1203,7 +1203,7 @@ github.com/onsi/ginkgo/v2/internal/reporters
 github.com/onsi/ginkgo/v2/internal/testingtproxy
 github.com/onsi/ginkgo/v2/reporters
 github.com/onsi/ginkgo/v2/types
-# github.com/onsi/gomega v1.38.3
+# github.com/onsi/gomega v1.39.0
 ## explicit; go 1.23.0
 github.com/onsi/gomega
 github.com/onsi/gomega/format
@@ -1313,7 +1313,7 @@ github.com/orcaman/concurrent-map
 # github.com/owncloud/libre-graph-api-go v1.0.5-0.20260116104114-10074a92be64
 ## explicit; go 1.18
 github.com/owncloud/libre-graph-api-go
-# github.com/owncloud/reva/v2 v2.0.0-20260116122933-81e6e21256eb
+# github.com/owncloud/reva/v2 v2.0.0-20260123085534-22a1be2b211e
 ## explicit; go 1.24.0
 github.com/owncloud/reva/v2/cmd/revad/internal/grace
 github.com/owncloud/reva/v2/cmd/revad/runtime
@@ -1322,6 +1322,7 @@ github.com/owncloud/reva/v2/internal/grpc/interceptors/auth
 github.com/owncloud/reva/v2/internal/grpc/interceptors/eventsmiddleware
 github.com/owncloud/reva/v2/internal/grpc/interceptors/loader
 github.com/owncloud/reva/v2/internal/grpc/interceptors/log
+github.com/owncloud/reva/v2/internal/grpc/interceptors/metadata
 github.com/owncloud/reva/v2/internal/grpc/interceptors/prometheus
 github.com/owncloud/reva/v2/internal/grpc/interceptors/readonly
 github.com/owncloud/reva/v2/internal/grpc/interceptors/recovery
@@ -1728,7 +1729,7 @@ github.com/pmezard/go-difflib/difflib
 ## explicit; go 1.16
 github.com/pquerna/cachecontrol
 github.com/pquerna/cachecontrol/cacheobject
-# github.com/prometheus/alertmanager v0.30.0
+# github.com/prometheus/alertmanager v0.30.1
 ## explicit; go 1.24.0
 github.com/prometheus/alertmanager/asset
 github.com/prometheus/alertmanager/featurecontrol
@@ -1816,7 +1817,7 @@ github.com/segmentio/asm/cpu/arm64
 github.com/segmentio/asm/cpu/cpuid
 github.com/segmentio/asm/cpu/x86
 github.com/segmentio/asm/internal/unsafebytes
-# github.com/segmentio/kafka-go v0.4.49
+# github.com/segmentio/kafka-go v0.4.50
 ## explicit; go 1.23
 github.com/segmentio/kafka-go
 github.com/segmentio/kafka-go/compress
@@ -2236,7 +2237,7 @@ go.yaml.in/yaml/v2
 # go.yaml.in/yaml/v3 v3.0.4
 ## explicit; go 1.16
 go.yaml.in/yaml/v3
-# golang.org/x/crypto v0.46.0
+# golang.org/x/crypto v0.47.0
 ## explicit; go 1.24.0
 golang.org/x/crypto/argon2
 golang.org/x/crypto/bcrypt
@@ -2288,12 +2289,12 @@ golang.org/x/image/vector
 golang.org/x/image/vp8
 golang.org/x/image/vp8l
 golang.org/x/image/webp
-# golang.org/x/mod v0.30.0
+# golang.org/x/mod v0.31.0
 ## explicit; go 1.24.0
 golang.org/x/mod/internal/lazyregexp
 golang.org/x/mod/module
 golang.org/x/mod/semver
-# golang.org/x/net v0.47.0
+# golang.org/x/net v0.48.0
 ## explicit; go 1.24.0
 golang.org/x/net/bpf
 golang.org/x/net/context
@@ -2340,7 +2341,7 @@ golang.org/x/sys/windows/svc/mgr
 # golang.org/x/term v0.39.0
 ## explicit; go 1.24.0
 golang.org/x/term
-# golang.org/x/text v0.32.0
+# golang.org/x/text v0.33.0
 ## explicit; go 1.24.0
 golang.org/x/text/cases
 golang.org/x/text/encoding
@@ -2368,7 +2369,7 @@ golang.org/x/text/width
 # golang.org/x/time v0.14.0
 ## explicit; go 1.24.0
 golang.org/x/time/rate
-# golang.org/x/tools v0.39.0
+# golang.org/x/tools v0.40.0
 ## explicit; go 1.24.0
 golang.org/x/tools/cover
 golang.org/x/tools/go/ast/astutil