diff --git a/go.mod b/go.mod
index 0d73a540c8..4e33dd56fd 100644
--- a/go.mod
+++ b/go.mod
@@ -64,19 +64,19 @@ replace github.com/alibabacloud-go/cr-20160607 => github.com/vdemeester/cr-20160
 require (
 	cel.dev/expr v0.25.1 // indirect
 	cloud.google.com/go v0.123.0 // indirect
-	cloud.google.com/go/auth v0.18.2 // indirect
+	cloud.google.com/go/auth v0.20.0 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
 	cloud.google.com/go/firestore v1.21.0 // indirect
-	cloud.google.com/go/iam v1.5.3 // indirect
-	cloud.google.com/go/longrunning v0.8.0 // indirect
+	cloud.google.com/go/iam v1.7.0 // indirect
+	cloud.google.com/go/longrunning v0.9.0 // indirect
 	cloud.google.com/go/monitoring v1.24.3 // indirect
 	cloud.google.com/go/storage v1.61.3 // indirect
 	filippo.io/edwards25519 v1.2.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.1 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/containers/azcontainerregistry v0.2.3 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
 	github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 // indirect
@@ -88,22 +88,22 @@ require (
 	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
 	github.com/aws/aws-sdk-go v1.55.8 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.41.5 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.32.12 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.19.12 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.41.7 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.32.17 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.16 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.23 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ecr v1.55.3 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.38.10 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 // indirect
-	github.com/aws/aws-sdk-go-v2/service/signin v1.0.8 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.30.13 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.41.9 // indirect
-	github.com/aws/smithy-go v1.24.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.9 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.23 // indirect
+	github.com/aws/aws-sdk-go-v2/service/signin v1.0.11 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.30.17 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.21 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.42.1 // indirect
+	github.com/aws/smithy-go v1.25.1 // indirect
 	github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.12.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/blendle/zapdriver v1.3.1 // indirect
@@ -139,26 +139,27 @@ require (
 	github.com/go-errors/errors v1.4.2 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-openapi/analysis v0.24.3 // indirect
+	github.com/go-openapi/analysis v0.25.0 // indirect
 	github.com/go-openapi/errors v0.22.7 // indirect
-	github.com/go-openapi/jsonpointer v0.22.5 // indirect
+	github.com/go-openapi/jsonpointer v0.23.1 // indirect
 	github.com/go-openapi/jsonreference v0.21.5 // indirect
 	github.com/go-openapi/loads v0.23.3 // indirect
-	github.com/go-openapi/runtime v0.29.3 // indirect
+	github.com/go-openapi/runtime v0.31.0 // indirect
+	github.com/go-openapi/runtime/server-middleware v0.30.0 // indirect
 	github.com/go-openapi/spec v0.22.4 // indirect
-	github.com/go-openapi/strfmt v0.26.1 // indirect
-	github.com/go-openapi/swag v0.25.5 // indirect
-	github.com/go-openapi/swag/cmdutils v0.25.5 // indirect
-	github.com/go-openapi/swag/conv v0.25.5 // indirect
-	github.com/go-openapi/swag/fileutils v0.25.5 // indirect
-	github.com/go-openapi/swag/jsonname v0.25.5 // indirect
-	github.com/go-openapi/swag/jsonutils v0.25.5 // indirect
-	github.com/go-openapi/swag/loading v0.25.5 // indirect
-	github.com/go-openapi/swag/mangling v0.25.5 // indirect
-	github.com/go-openapi/swag/netutils v0.25.5 // indirect
-	github.com/go-openapi/swag/stringutils v0.25.5 // indirect
-	github.com/go-openapi/swag/typeutils v0.25.5 // indirect
-	github.com/go-openapi/swag/yamlutils v0.25.5 // indirect
+	github.com/go-openapi/strfmt v0.26.2 // indirect
+	github.com/go-openapi/swag v0.26.0 // indirect
+	github.com/go-openapi/swag/cmdutils v0.26.0 // indirect
+	github.com/go-openapi/swag/conv v0.26.0 // indirect
+	github.com/go-openapi/swag/fileutils v0.26.0 // indirect
+	github.com/go-openapi/swag/jsonname v0.26.0 // indirect
+	github.com/go-openapi/swag/jsonutils v0.26.0 // indirect
+	github.com/go-openapi/swag/loading v0.26.0 // indirect
+	github.com/go-openapi/swag/mangling v0.26.0 // indirect
+	github.com/go-openapi/swag/netutils v0.26.0 // indirect
+	github.com/go-openapi/swag/stringutils v0.26.0 // indirect
+	github.com/go-openapi/swag/typeutils v0.26.0 // indirect
+	github.com/go-openapi/swag/yamlutils v0.26.0 // indirect
 	github.com/go-openapi/validate v0.25.2 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/golang-jwt/jwt/v5 v5.3.0 // indirect
@@ -176,8 +177,8 @@ require (
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/google/wire v0.6.0 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.14 // indirect
-	github.com/googleapis/gax-go/v2 v2.19.0 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.15 // indirect
+	github.com/googleapis/gax-go/v2 v2.22.0 // indirect
 	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
 	github.com/grafeas/grafeas v0.2.3 // indirect
 	github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
@@ -245,7 +246,7 @@ require (
 	github.com/sigstore/rekor v1.5.0 // indirect
 	github.com/sigstore/rekor-tiles/v2 v2.0.1 // indirect
 	github.com/sigstore/sigstore-go v1.1.4 // indirect
-	github.com/sigstore/timestamp-authority/v2 v2.0.6 // indirect
+	github.com/sigstore/timestamp-authority/v2 v2.1.0 // indirect
 	github.com/sirupsen/logrus v1.9.4 // indirect
 	github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
 	github.com/spf13/afero v1.15.0 // indirect
@@ -271,7 +272,7 @@ require (
 	go.mongodb.org/mongo-driver v1.17.7 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/detectors/gcp v1.42.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0 // indirect
@@ -286,7 +287,7 @@ require (
 	go.opentelemetry.io/otel/trace v1.43.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
 	go.starlark.net v0.0.0-20230525235612-a134d8f9ddca // indirect
-	go.step.sm/crypto v0.77.2 // indirect
+	go.step.sm/crypto v0.81.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	gocloud.dev v0.43.0 // indirect
@@ -301,8 +302,8 @@ require (
 	golang.org/x/time v0.15.0 // indirect
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
 	gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
-	google.golang.org/api v0.272.0 // indirect
-	google.golang.org/genproto v0.0.0-20260316180232-0b37fe3546d5 // indirect
+	google.golang.org/api v0.277.0 // indirect
+	google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
diff --git a/go.sum b/go.sum
index d4fd155ec1..943fb3a959 100644
--- a/go.sum
+++ b/go.sum
@@ -5,22 +5,22 @@ cel.dev/expr v0.25.1/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.123.0 h1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE=
 cloud.google.com/go v0.123.0/go.mod h1:xBoMV08QcqUGuPW65Qfm1o9Y4zKZBpGS+7bImXLTAZU=
-cloud.google.com/go/auth v0.18.2 h1:+Nbt5Ev0xEqxlNjd6c+yYUeosQ5TtEUaNcN/3FozlaM=
-cloud.google.com/go/auth v0.18.2/go.mod h1:xD+oY7gcahcu7G2SG2DsBerfFxgPAJz17zz2joOFF3M=
+cloud.google.com/go/auth v0.20.0 h1:kXTssoVb4azsVDoUiF8KvxAqrsQcQtB53DcSgta74CA=
+cloud.google.com/go/auth v0.20.0/go.mod h1:942/yi/itH1SsmpyrbnTMDgGfdy2BUqIKyd0cyYLc5Q=
 cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
 cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
 cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
 cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
 cloud.google.com/go/firestore v1.21.0 h1:BhopUsx7kh6NFx77ccRsHhrtkbJUmDAxNY3uapWdjcM=
 cloud.google.com/go/firestore v1.21.0/go.mod h1:1xH6HNcnkf/gGyR8udd6pFO4Z7GWJSwLKQMx/u6UrP4=
-cloud.google.com/go/iam v1.5.3 h1:+vMINPiDF2ognBJ97ABAYYwRgsaqxPbQDlMnbHMjolc=
-cloud.google.com/go/iam v1.5.3/go.mod h1:MR3v9oLkZCTlaqljW6Eb2d3HGDGK5/bDv93jhfISFvU=
-cloud.google.com/go/kms v1.26.0 h1:cK9mN2cf+9V63D3H1f6koxTatWy39aTI/hCjz1I+adU=
-cloud.google.com/go/kms v1.26.0/go.mod h1:pHKOdFJm63hxBsiPkYtowZPltu9dW0MWvBa6IA4HM58=
+cloud.google.com/go/iam v1.7.0 h1:JD3zh0C6LHl16aCn5Akff0+GELdp1+4hmh6ndoFLl8U=
+cloud.google.com/go/iam v1.7.0/go.mod h1:tetWZW1PD/m6vcuY2Zj/aU0eCHNPuxedbnbRTyKXvdY=
+cloud.google.com/go/kms v1.31.0 h1:LS8N92OxFDgOLg5NCo3OmbvjtQAIVT5gUHVLKIDHaFE=
+cloud.google.com/go/kms v1.31.0/go.mod h1:YIyXZym11R5uovJJt4oN5eUL3oPmirF3yKeIh6QAf4U=
 cloud.google.com/go/logging v1.13.2 h1:qqlHCBvieJT9Cdq4QqYx1KPadCQ2noD4FK02eNqHAjA=
 cloud.google.com/go/logging v1.13.2/go.mod h1:zaybliM3yun1J8mU2dVQ1/qDzjbOqEijZCn6hSBtKak=
-cloud.google.com/go/longrunning v0.8.0 h1:LiKK77J3bx5gDLi4SMViHixjD2ohlkwBi+mKA7EhfW8=
-cloud.google.com/go/longrunning v0.8.0/go.mod h1:UmErU2Onzi+fKDg2gR7dusz11Pe26aknR4kHmJJqIfk=
+cloud.google.com/go/longrunning v0.9.0 h1:0EzbDEGsAvOZNbqXopgniY0w0a1phvu5IdUFq8grmqY=
+cloud.google.com/go/longrunning v0.9.0/go.mod h1:pkTz846W7bF4o2SzdWJ40Hu0Re+UoNT6Q5t+igIcb8E=
 cloud.google.com/go/monitoring v1.24.3 h1:dde+gMNc0UhPZD1Azu6at2e79bfdztVDS5lvhOdsgaE=
 cloud.google.com/go/monitoring v1.24.3/go.mod h1:nYP6W0tm3N9H/bOw8am7t62YTzZY+zUeQ+Bi6+2eonI=
 cloud.google.com/go/pubsub v1.50.1 h1:fzbXpPyJnSGvWXF1jabhQeXyxdbCIkXTpjXHy7xviBM=
@@ -46,16 +46,16 @@ github.com/AdamKorcz/go-fuzz-headers-1 v0.0.0-20230919221257-8b5d3ce2d11d/go.mod
 github.com/AlecAivazis/survey/v2 v2.3.7 h1:6I/u8FvytdGsgonrYsVn2t8t4QiRnh6QSTqkkhIiSjQ=
 github.com/AlecAivazis/survey/v2 v2.3.7/go.mod h1:xUTIdE4KCOIjsBAE1JYsUPoCqYdZ1reCfTwbto0Fduo=
 github.com/Azure/azure-sdk-for-go v68.0.0+incompatible h1:fcYLmCpyNYRnvJbPerq7U0hS+6+I79yEDJBqVNcqUzU=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 h1:fou+2+WFTib47nS+nz/ozhEBnvU96bKHy6LjRsY4E28=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0/go.mod h1:t76Ruy8AHvUAC8GfMWJMa0ElSbuIcO03NLpynfbgsPA=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.1 h1:jHb/wfvRikGdxMXYV3QG/SzUOPYN9KEUUuC0Yd0/vC0=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.1/go.mod h1:pzBXCYn05zvYIrwLgtK8Ap8QcjRg+0i76tMQdWN6wOk=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 h1:Hk5QBxZQC1jb2Fwj6mpzme37xbCDdNTxU7O9eb5+LB4=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1/go.mod h1:IYus9qsFobWIc2YVwe/WPjcnyCkPKtnHAqUYeebc8z0=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2 h1:yz1bePFlP5Vws5+8ez6T3HWXPmwOK7Yvq8QxDBD3SKY=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2/go.mod h1:Pa9ZNPuoNu/GztvBSKk9J1cDJW6vk/n0zLtV4mgd8N8=
 github.com/Azure/azure-sdk-for-go/sdk/containers/azcontainerregistry v0.2.3 h1:ldKsKtEIblsgsr6mPwrd9yRntoX6uLz/K89wsldwx/k=
 github.com/Azure/azure-sdk-for-go/sdk/containers/azcontainerregistry v0.2.3/go.mod h1:MAm7bk0oDLmD8yIkvfbxPW04fxzphPyL+7GzwHxOp6Y=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 h1:9iefClla7iYpfYWdzPCRDozdmndjTm8DXdpCzPajMgA=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2/go.mod h1:XtLgD3ZD34DAaVIIAyG3objl5DynM3CQ/vMcbBNJZGI=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 h1:fhqpLE3UEXi9lPaBRpQ6XuRW0nU7hgg4zlmZZa+a9q4=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0/go.mod h1:7dCRMLwisfRH3dBupKeNCioWYUZ4SS09Z14H+7i8ZoY=
 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 h1:E4MgwLBGeVB5f2MdcIVD3ELVAWpr+WD6MUe1i+tM/PA=
 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0/go.mod h1:Y2b/1clN4zsAoUd/pgNAQHjLDnTis/6ROkUfyob6psM=
 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 h1:nCYfgcSyHZXJI8J0IWE5MsCGlb2xp9fJiXyxWgmOFg4=
@@ -96,40 +96,40 @@ github.com/autarch/testify v1.2.2 h1:9Q9V6zqhP7R6dv+zRUddv6kXKLo6ecQhnFRFWM71i1c
 github.com/autarch/testify v1.2.2/go.mod h1:oDbHKfFv2/D5UtVrxkk90OKcb6P4/AqF1Pcf6ZbvDQo=
 github.com/aws/aws-sdk-go v1.55.8 h1:JRmEUbU52aJQZ2AjX4q4Wu7t4uZjOu71uyNmaWlUkJQ=
 github.com/aws/aws-sdk-go v1.55.8/go.mod h1:ZkViS9AqA6otK+JBBNH2++sx1sgxrPKcSzPPvQkUtXk=
-github.com/aws/aws-sdk-go-v2 v1.41.5 h1:dj5kopbwUsVUVFgO4Fi5BIT3t4WyqIDjGKCangnV/yY=
-github.com/aws/aws-sdk-go-v2 v1.41.5/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o=
-github.com/aws/aws-sdk-go-v2/config v1.32.12 h1:O3csC7HUGn2895eNrLytOJQdoL2xyJy0iYXhoZ1OmP0=
-github.com/aws/aws-sdk-go-v2/config v1.32.12/go.mod h1:96zTvoOFR4FURjI+/5wY1vc1ABceROO4lWgWJuxgy0g=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.12 h1:oqtA6v+y5fZg//tcTWahyN9PEn5eDU/Wpvc2+kJ4aY8=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.12/go.mod h1:U3R1RtSHx6NB0DvEQFGyf/0sbrpJrluENHdPy1j/3TE=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 h1:zOgq3uezl5nznfoK3ODuqbhVg1JzAGDUhXOsU0IDCAo=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20/go.mod h1:z/MVwUARehy6GAg/yQ1GO2IMl0k++cu1ohP9zo887wE=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 h1:Rgg6wvjjtX8bNHcvi9OnXWwcE0a2vGpbwmtICOsvcf4=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21/go.mod h1:A/kJFst/nm//cyqonihbdpQZwiUhhzpqTsdbhDdRF9c=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 h1:PEgGVtPoB6NTpPrBgqSE5hE/o47Ij9qk/SEZFbUOe9A=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21/go.mod h1:p+hz+PRAYlY3zcpJhPwXlLC4C+kqn70WIHwnzAfs6ps=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 h1:qYQ4pzQ2Oz6WpQ8T3HvGHnZydA72MnLuFK9tJwmrbHw=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6/go.mod h1:O3h0IK87yXci+kg6flUKzJnWeziQUKciKrLjcatSNcY=
+github.com/aws/aws-sdk-go-v2 v1.41.7 h1:DWpAJt66FmnnaRIOT/8ASTucrvuDPZASqhhLey6tLY8=
+github.com/aws/aws-sdk-go-v2 v1.41.7/go.mod h1:4LAfZOPHNVNQEckOACQx60Y8pSRjIkNZQz1w92xpMJc=
+github.com/aws/aws-sdk-go-v2/config v1.32.17 h1:FpL4/758/diKwqbytU0prpuiu60fgXKUWCpDJtApclU=
+github.com/aws/aws-sdk-go-v2/config v1.32.17/go.mod h1:OXqUMzgXytfoF9JaKkhrOYsyh72t9G+MJH8mMRaexOE=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.16 h1:r3RJBuU7X9ibt8RHbMjWE6y60QbKBiII6wSrXnapxSU=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.16/go.mod h1:6cx7zqDENJDbBIIWX6P8s0h6hqHC8Avbjh9Dseo27ug=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.23 h1:UuSfcORqNSz/ey3VPRS8TcVH2Ikf0/sC+Hdj400QI6U=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.23/go.mod h1:+G/OSGiOFnSOkYloKj/9M35s74LgVAdJBSD5lsFfqKg=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23 h1:GpT/TrnBYuE5gan2cZbTtvP+JlHsutdmlV2YfEyNde0=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23/go.mod h1:xYWD6BS9ywC5bS3sz9Xh04whO/hzK2plt2Zkyrp4JuA=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23 h1:bpd8vxhlQi2r1hiueOw02f/duEPTMK59Q4QMAoTTtTo=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23/go.mod h1:15DfR2nw+CRHIk0tqNyifu3G1YdAOy68RftkhMDDwYk=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24 h1:OQqn11BtaYv1WLUowvcA30MpzIu8Ti4pcLPIIyoKZrA=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24/go.mod h1:X5ZJyfwVrWA96GzPmUCWFQaEARPR7gCrpq2E92PJwAE=
 github.com/aws/aws-sdk-go-v2/service/ecr v1.55.3 h1:RtGctYMmkTerGClvdY6bHXdtly4FeYw9wz/NPz62LF8=
 github.com/aws/aws-sdk-go-v2/service/ecr v1.55.3/go.mod h1:vBfBu24Ka3/5UZtepbTV0gnc9VPLT8ok+0oDDaYAzn4=
 github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.38.10 h1:1A/sI3LNMi3fhRI5TFLMwwo7ALAALSFVCSGvFlr1Iys=
 github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.38.10/go.mod h1:Diyyyz0b43X13pdi1mVMqlTwDjOmRbJMvDsqnduUYWM=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 h1:5EniKhLZe4xzL7a+fU3C2tfUN4nWIqlLesfrjkuPFTY=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7/go.mod h1:x0nZssQ3qZSnIcePWLvcoFisRXJzcTVvYpAAdYX8+GI=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 h1:c31//R3xgIJMSC8S6hEVq+38DcvUlgFY0FM6mSI5oto=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21/go.mod h1:r6+pf23ouCB718FUxaqzZdbpYFyDtehyZcmP5KL9FkA=
-github.com/aws/aws-sdk-go-v2/service/kms v1.50.3 h1:s/zDSG/a/Su9aX+v0Ld9cimUCdkr5FWPmBV8owaEbZY=
-github.com/aws/aws-sdk-go-v2/service/kms v1.50.3/go.mod h1:/iSgiUor15ZuxFGQSTf3lA2FmKxFsQoc2tADOarQBSw=
-github.com/aws/aws-sdk-go-v2/service/signin v1.0.8 h1:0GFOLzEbOyZABS3PhYfBIx2rNBACYcKty+XGkTgw1ow=
-github.com/aws/aws-sdk-go-v2/service/signin v1.0.8/go.mod h1:LXypKvk85AROkKhOG6/YEcHFPoX+prKTowKnVdcaIxE=
-github.com/aws/aws-sdk-go-v2/service/sso v1.30.13 h1:kiIDLZ005EcKomYYITtfsjn7dtOwHDOFy7IbPXKek2o=
-github.com/aws/aws-sdk-go-v2/service/sso v1.30.13/go.mod h1:2h/xGEowcW/g38g06g3KpRWDlT+OTfxxI0o1KqayAB8=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17 h1:jzKAXIlhZhJbnYwHbvUQZEB8KfgAEuG0dc08Bkda7NU=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17/go.mod h1:Al9fFsXjv4KfbzQHGe6V4NZSZQXecFcvaIF4e70FoRA=
-github.com/aws/aws-sdk-go-v2/service/sts v1.41.9 h1:Cng+OOwCHmFljXIxpEVXAGMnBia8MSU6Ch5i9PgBkcU=
-github.com/aws/aws-sdk-go-v2/service/sts v1.41.9/go.mod h1:LrlIndBDdjA/EeXeyNBle+gyCwTlizzW5ycgWnvIxkk=
-github.com/aws/smithy-go v1.24.2 h1:FzA3bu/nt/vDvmnkg+R8Xl46gmzEDam6mZ1hzmwXFng=
-github.com/aws/smithy-go v1.24.2/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.9 h1:FLudkZLt5ci0ozzgkVo8BJGwvqNaZbTWb3UcucAateA=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.9/go.mod h1:w7wZ/s9qK7c8g4al+UyoF1Sp/Z45UwMGcqIzLWVQHWk=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.23 h1:pbrxO/kuIwgEsOPLkaHu0O+m4fNgLU8B3vxQ+72jTPw=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.23/go.mod h1:/CMNUqoj46HpS3MNRDEDIwcgEnrtZlKRaHNaHxIFpNA=
+github.com/aws/aws-sdk-go-v2/service/kms v1.51.1 h1:zuSf4olLKZW8cF/W9Y5wvGT+/0raY/3kVp49KsGs0QY=
+github.com/aws/aws-sdk-go-v2/service/kms v1.51.1/go.mod h1:Y0+uxvxz6ib4KktRdK0V4X45Vcs/JyYoz8H71pO8xeI=
+github.com/aws/aws-sdk-go-v2/service/signin v1.0.11 h1:TdJ+HdzOBhU8+iVAOGUTU63VXopcumCOF1paFulHWZc=
+github.com/aws/aws-sdk-go-v2/service/signin v1.0.11/go.mod h1:R82ZRExE/nheo0N+T8zHPcLRTcH8MGsnR3BiVGX0TwI=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.17 h1:7byT8HUWrgoRp6sXjxtZwgOKfhss5fW6SkLBtqzgRoE=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.17/go.mod h1:xNWknVi4Ezm1vg1QsB/5EWpAJURq22uqd38U8qKvOJc=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.21 h1:+1Kl1zx6bWi4X7cKi3VYh29h8BvsCoHQEQ6ST9X8w7w=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.21/go.mod h1:4vIRDq+CJB2xFAXZ+YgGUTiEft7oAQlhIs71xcSeuVg=
+github.com/aws/aws-sdk-go-v2/service/sts v1.42.1 h1:F/M5Y9I3nwr2IEpshZgh1GeHpOItExNM9L1euNuh/fk=
+github.com/aws/aws-sdk-go-v2/service/sts v1.42.1/go.mod h1:mTNxImtovCOEEuD65mKW7DCsL+2gjEH+RPEAexAzAio=
+github.com/aws/smithy-go v1.25.1 h1:J8ERsGSU7d+aCmdQur5Txg6bVoYelvQJgtZehD12GkI=
+github.com/aws/smithy-go v1.25.1/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
 github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.12.0 h1:JFWXO6QPihCknDdnL6VaQE57km4ZKheHIGd9YiOGcTo=
 github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.12.0/go.mod h1:046/oLyFlYdAghYQE2yHXi/E//VM5Cf3/dFmA+3CZ0c=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
@@ -252,52 +252,54 @@ github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
-github.com/go-openapi/analysis v0.24.3 h1:a1hrvMr8X0Xt69KP5uVTu5jH62DscmDifrLzNglAayk=
-github.com/go-openapi/analysis v0.24.3/go.mod h1:Nc+dWJ/FxZbhSow5Yh3ozg5CLJioB+XXT6MdLvJUsUw=
+github.com/go-openapi/analysis v0.25.0 h1:EnjAq1yO8wEO9HbPmY8vLPEIkdZuuFhCAKBPvCB7bCs=
+github.com/go-openapi/analysis v0.25.0/go.mod h1:5WFTRE43WLkPG9r9OtlMfqkkvUTYLVVCIxLlEpyF8kE=
 github.com/go-openapi/errors v0.22.7 h1:JLFBGC0Apwdzw3484MmBqspjPbwa2SHvpDm0u5aGhUA=
 github.com/go-openapi/errors v0.22.7/go.mod h1://QW6SD9OsWtH6gHllUCddOXDL0tk0ZGNYHwsw4sW3w=
-github.com/go-openapi/jsonpointer v0.22.5 h1:8on/0Yp4uTb9f4XvTrM2+1CPrV05QPZXu+rvu2o9jcA=
-github.com/go-openapi/jsonpointer v0.22.5/go.mod h1:gyUR3sCvGSWchA2sUBJGluYMbe1zazrYWIkWPjjMUY0=
+github.com/go-openapi/jsonpointer v0.23.1 h1:1HBACs7XIwR2RcmItfdSFlALhGbe6S92p0ry4d1GWg4=
+github.com/go-openapi/jsonpointer v0.23.1/go.mod h1:iWRmZTrGn7XwYhtPt/fvdSFj1OfNBngqRT2UG3BxSqY=
 github.com/go-openapi/jsonreference v0.21.5 h1:6uCGVXU/aNF13AQNggxfysJ+5ZcU4nEAe+pJyVWRdiE=
 github.com/go-openapi/jsonreference v0.21.5/go.mod h1:u25Bw85sX4E2jzFodh1FOKMTZLcfifd1Q+iKKOUxExw=
 github.com/go-openapi/loads v0.23.3 h1:g5Xap1JfwKkUnZdn+S0L3SzBDpcTIYzZ5Qaag0YDkKQ=
 github.com/go-openapi/loads v0.23.3/go.mod h1:NOH07zLajXo8y55hom0omlHWDVVvCwBM/S+csCK8LqA=
-github.com/go-openapi/runtime v0.29.3 h1:h5twGaEqxtQg40ePiYm9vFFH1q06Czd7Ot6ufdK0w/Y=
-github.com/go-openapi/runtime v0.29.3/go.mod h1:8A1W0/L5eyNJvKciqZtvIVQvYO66NlB7INMSZ9bw/oI=
+github.com/go-openapi/runtime v0.31.0 h1:vhmlo1LMjGXYTlYB0eFm0tTVuAidDHtmrL1nAABzUCg=
+github.com/go-openapi/runtime v0.31.0/go.mod h1:fZnoje1YWt7IrH/fHBOS1h9+VzeS1d0cHj8TTkZOaRc=
+github.com/go-openapi/runtime/server-middleware v0.30.0 h1:8rPoJ/xv7JL8BsovaqboKETlpWBArVh8n+0L/GyePog=
+github.com/go-openapi/runtime/server-middleware v0.30.0/go.mod h1:OYNT/TxNvB/VK5oe4htM2jDTwlEXuejVJmu0DVZfAMs=
 github.com/go-openapi/spec v0.22.4 h1:4pxGjipMKu0FzFiu/DPwN3CTBRlVM2yLf/YTWorYfDQ=
 github.com/go-openapi/spec v0.22.4/go.mod h1:WQ6Ai0VPWMZgMT4XySjlRIE6GP1bGQOtEThn3gcWLtQ=
-github.com/go-openapi/strfmt v0.26.1 h1:7zGCHji7zSYDC2tCXIusoxYQz/48jAf2q+sF6wXTG+c=
-github.com/go-openapi/strfmt v0.26.1/go.mod h1:Zslk5VZPOISLwmWTMBIS7oiVFem1o1EI6zULY8Uer7Y=
-github.com/go-openapi/swag v0.25.5 h1:pNkwbUEeGwMtcgxDr+2GBPAk4kT+kJ+AaB+TMKAg+TU=
-github.com/go-openapi/swag v0.25.5/go.mod h1:B3RT6l8q7X803JRxa2e59tHOiZlX1t8viplOcs9CwTA=
-github.com/go-openapi/swag/cmdutils v0.25.5 h1:yh5hHrpgsw4NwM9KAEtaDTXILYzdXh/I8Whhx9hKj7c=
-github.com/go-openapi/swag/cmdutils v0.25.5/go.mod h1:pdae/AFo6WxLl5L0rq87eRzVPm/XRHM3MoYgRMvG4A0=
-github.com/go-openapi/swag/conv v0.25.5 h1:wAXBYEXJjoKwE5+vc9YHhpQOFj2JYBMF2DUi+tGu97g=
-github.com/go-openapi/swag/conv v0.25.5/go.mod h1:CuJ1eWvh1c4ORKx7unQnFGyvBbNlRKbnRyAvDvzWA4k=
-github.com/go-openapi/swag/fileutils v0.25.5 h1:B6JTdOcs2c0dBIs9HnkyTW+5gC+8NIhVBUwERkFhMWk=
-github.com/go-openapi/swag/fileutils v0.25.5/go.mod h1:V3cT9UdMQIaH4WiTrUc9EPtVA4txS0TOmRURmhGF4kc=
-github.com/go-openapi/swag/jsonname v0.25.5 h1:8p150i44rv/Drip4vWI3kGi9+4W9TdI3US3uUYSFhSo=
-github.com/go-openapi/swag/jsonname v0.25.5/go.mod h1:jNqqikyiAK56uS7n8sLkdaNY/uq6+D2m2LANat09pKU=
-github.com/go-openapi/swag/jsonutils v0.25.5 h1:XUZF8awQr75MXeC+/iaw5usY/iM7nXPDwdG3Jbl9vYo=
-github.com/go-openapi/swag/jsonutils v0.25.5/go.mod h1:48FXUaz8YsDAA9s5AnaUvAmry1UcLcNVWUjY42XkrN4=
-github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.5 h1:SX6sE4FrGb4sEnnxbFL/25yZBb5Hcg1inLeErd86Y1U=
-github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.5/go.mod h1:/2KvOTrKWjVA5Xli3DZWdMCZDzz3uV/T7bXwrKWPquo=
-github.com/go-openapi/swag/loading v0.25.5 h1:odQ/umlIZ1ZVRteI6ckSrvP6e2w9UTF5qgNdemJHjuU=
-github.com/go-openapi/swag/loading v0.25.5/go.mod h1:I8A8RaaQ4DApxhPSWLNYWh9NvmX2YKMoB9nwvv6oW6g=
-github.com/go-openapi/swag/mangling v0.25.5 h1:hyrnvbQRS7vKePQPHHDso+k6CGn5ZBs5232UqWZmJZw=
-github.com/go-openapi/swag/mangling v0.25.5/go.mod h1:6hadXM/o312N/h98RwByLg088U61TPGiltQn71Iw0NY=
-github.com/go-openapi/swag/netutils v0.25.5 h1:LZq2Xc2QI8+7838elRAaPCeqJnHODfSyOa7ZGfxDKlU=
-github.com/go-openapi/swag/netutils v0.25.5/go.mod h1:lHbtmj4m57APG/8H7ZcMMSWzNqIQcu0RFiXrPUara14=
-github.com/go-openapi/swag/stringutils v0.25.5 h1:NVkoDOA8YBgtAR/zvCx5rhJKtZF3IzXcDdwOsYzrB6M=
-github.com/go-openapi/swag/stringutils v0.25.5/go.mod h1:PKK8EZdu4QJq8iezt17HM8RXnLAzY7gW0O1KKarrZII=
-github.com/go-openapi/swag/typeutils v0.25.5 h1:EFJ+PCga2HfHGdo8s8VJXEVbeXRCYwzzr9u4rJk7L7E=
-github.com/go-openapi/swag/typeutils v0.25.5/go.mod h1:itmFmScAYE1bSD8C4rS0W+0InZUBrB2xSPbWt6DLGuc=
-github.com/go-openapi/swag/yamlutils v0.25.5 h1:kASCIS+oIeoc55j28T4o8KwlV2S4ZLPT6G0iq2SSbVQ=
-github.com/go-openapi/swag/yamlutils v0.25.5/go.mod h1:Gek1/SjjfbYvM+Iq4QGwa/2lEXde9n2j4a3wI3pNuOQ=
-github.com/go-openapi/testify/enable/yaml/v2 v2.4.1 h1:NZOrZmIb6PTv5LTFxr5/mKV/FjbUzGE7E6gLz7vFoOQ=
-github.com/go-openapi/testify/enable/yaml/v2 v2.4.1/go.mod h1:r7dwsujEHawapMsxA69i+XMGZrQ5tRauhLAjV/sxg3Q=
-github.com/go-openapi/testify/v2 v2.4.1 h1:zB34HDKj4tHwyUQHrUkpV0Q0iXQ6dUCOQtIqn8hE6Iw=
-github.com/go-openapi/testify/v2 v2.4.1/go.mod h1:HCPmvFFnheKK2BuwSA0TbbdxJ3I16pjwMkYkP4Ywn54=
+github.com/go-openapi/strfmt v0.26.2 h1:ysjheCh4i1rmFEo2LanhELDNucNzfWTZhUDKgWWPaFM=
+github.com/go-openapi/strfmt v0.26.2/go.mod h1:fXh1e449cyUn2NYuz+wb3wARBUdMl7qPEZwX00nqivY=
+github.com/go-openapi/swag v0.26.0 h1:GVDXCmfvhfu1BxiHo8/FA+BbKmhecHnG3varjON5/RI=
+github.com/go-openapi/swag v0.26.0/go.mod h1:82g3193sZJRbocs7bNCqGfIgq8pkuwVwCfhKIRlEQF0=
+github.com/go-openapi/swag/cmdutils v0.26.0 h1:iowihOcvq7y4egO8cOq0dmfohz6wfeQ63U1EnuhO2TU=
+github.com/go-openapi/swag/cmdutils v0.26.0/go.mod h1:Sm1MVFMkF6guJJ+pQqHnQA3N0j9qALV3NxzDSv6bETM=
+github.com/go-openapi/swag/conv v0.26.0 h1:5yGGsPYI1ZCva93U0AoKi/iZrNhaJEjr324YVsiD89I=
+github.com/go-openapi/swag/conv v0.26.0/go.mod h1:tpAmIL7X58VPnHHiSO4uE3jBeRamGsFsfdDeDtb5ECE=
+github.com/go-openapi/swag/fileutils v0.26.0 h1:WJoPRvsA7QRiiWluowkLJa9jaYR7FCuxmDvnCgaRRxU=
+github.com/go-openapi/swag/fileutils v0.26.0/go.mod h1:0WDJ7lp67eNjPMO50wAWYlKvhOb6CQ37rzR7wrgI8Tc=
+github.com/go-openapi/swag/jsonname v0.26.0 h1:gV1NFX9M8avo0YSpmWogqfQISigCmpaiNci8cGECU5w=
+github.com/go-openapi/swag/jsonname v0.26.0/go.mod h1:urBBR8bZNoDYGr653ynhIx+gTeIz0ARZxHkAPktJK2M=
+github.com/go-openapi/swag/jsonutils v0.26.0 h1:FawFML2iAXsPqmERscuMPIHmFsoP1tOqWkxBaKNMsnA=
+github.com/go-openapi/swag/jsonutils v0.26.0/go.mod h1:2VmA0CJlyFqgawOaPI9psnjFDqzyivIqLYN34t9p91E=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.26.0 h1:apqeINu/ICHouqiRZbyFvuDge5jCmmLTqGQ9V95EaOM=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.26.0/go.mod h1:AyM6QT8uz5IdKxk5akv0y6u4QvcL9GWERt0Jx/F/R8Y=
+github.com/go-openapi/swag/loading v0.26.0 h1:Apg6zaKhCJurpJer0DCxq99qwmhFddBhaMX7kilDcko=
+github.com/go-openapi/swag/loading v0.26.0/go.mod h1:dBxQ/6V2uBaAQdevN18VELE6xSpJWZxLX4txe12JwDg=
+github.com/go-openapi/swag/mangling v0.26.0 h1:Du2YC4YLA/Y5m/YKQd7AnY5qq0wRKSFZTTt8ktFaXcQ=
+github.com/go-openapi/swag/mangling v0.26.0/go.mod h1:jifS7W9vbg+pw63bT+GI53otluMQL3CeemuyCHKwVx0=
+github.com/go-openapi/swag/netutils v0.26.0 h1:CmZp+ZT7HrmFwrC3GdGsXBq2+42T1bjKBapcqVpIs3c=
+github.com/go-openapi/swag/netutils v0.26.0/go.mod h1:5iK+Ok3ZohWWex1C50BFTPexi03UaPwjW4Oj8kgrpwo=
+github.com/go-openapi/swag/stringutils v0.26.0 h1:qZQngLxs5s7SLijc3N2ZO+fUq2o8LjuWAASSrJuh+xg=
+github.com/go-openapi/swag/stringutils v0.26.0/go.mod h1:sWn5uY+QIIspwPhvgnqJsH8xqFT2ZbYcvbcFanRyhFE=
+github.com/go-openapi/swag/typeutils v0.26.0 h1:2kdEwdiNWy+JJdOvu5MA2IIg2SylWAFuuyQIKYybfq4=
+github.com/go-openapi/swag/typeutils v0.26.0/go.mod h1:oovDuIUvTrEHVMqWilQzKzV4YlSKgyZmFh7AlfABNVE=
+github.com/go-openapi/swag/yamlutils v0.26.0 h1:H7O8l/8NJJQ/oiReEN+oMpnGMyt8G0hl460nRZxhLMQ=
+github.com/go-openapi/swag/yamlutils v0.26.0/go.mod h1:1evKEGAtP37Pkwcc7EWMF0hedX0/x3Rkvei2wtG/TbU=
+github.com/go-openapi/testify/enable/yaml/v2 v2.5.0 h1:3hZD1fwydvCx/cc1R2uYNQirHqf2s6lqpKV3FcNTURA=
+github.com/go-openapi/testify/enable/yaml/v2 v2.5.0/go.mod h1:TvDZKBH7ZbMaF3EqH2AwTvNQCmzyZq8K1agRjf1B+Nk=
+github.com/go-openapi/testify/v2 v2.5.0 h1:UOCr63aAsMIDydZbZGqo5Ev01D4eydItRbekDuZMJLw=
+github.com/go-openapi/testify/v2 v2.5.0/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw=
 github.com/go-openapi/validate v0.25.2 h1:12NsfLAwGegqbGWr2CnvT65X/Q2USJipmJ9b7xDJZz0=
 github.com/go-openapi/validate v0.25.2/go.mod h1:Pgl1LpPPGFnZ+ys4/hTlDiRYQdI1ocKypgE+8Q8BLfY=
 github.com/go-rod/rod v0.116.2 h1:A5t2Ky2A+5eD/ZJQr1EfsQSe5rms5Xof/qj296e+ZqA=
@@ -387,10 +389,10 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/wire v0.6.0 h1:HBkoIh4BdSxoyo9PveV8giw7ZsaBOvzWKfcg/6MrVwI=
 github.com/google/wire v0.6.0/go.mod h1:F4QhpQ9EDIdJ1Mbop/NZBRB+5yrR6qg3BnctaoUk6NA=
-github.com/googleapis/enterprise-certificate-proxy v0.3.14 h1:yh8ncqsbUY4shRD5dA6RlzjJaT4hi3kII+zYw8wmLb8=
-github.com/googleapis/enterprise-certificate-proxy v0.3.14/go.mod h1:vqVt9yG9480NtzREnTlmGSBmFrA+bzb0yl0TxoBQXOg=
-github.com/googleapis/gax-go/v2 v2.19.0 h1:fYQaUOiGwll0cGj7jmHT/0nPlcrZDFPrZRhTsoCr8hE=
-github.com/googleapis/gax-go/v2 v2.19.0/go.mod h1:w2ROXVdfGEVFXzmlciUU4EdjHgWvB5h2n6x/8XSTTJA=
+github.com/googleapis/enterprise-certificate-proxy v0.3.15 h1:xolVQTEXusUcAA5UgtyRLjelpFFHWlPQ4XfWGc7MBas=
+github.com/googleapis/enterprise-certificate-proxy v0.3.15/go.mod h1:vqVt9yG9480NtzREnTlmGSBmFrA+bzb0yl0TxoBQXOg=
+github.com/googleapis/gax-go/v2 v2.22.0 h1:PjIWBpgGIVKGoCXuiCoP64altEJCj3/Ei+kSU5vlZD4=
+github.com/googleapis/gax-go/v2 v2.22.0/go.mod h1:irWBbALSr0Sk3qlqb9SyJ1h68WjgeFuiOzI4Rqw5+aY=
 github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
 github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4=
 github.com/gorilla/sessions v1.2.1/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM=
@@ -666,16 +668,16 @@ github.com/sigstore/sigstore v1.10.8 h1:1Mgkxvkw4AXMfIP1DOjc6kw0GkUgA8pGVpveN/Ef
 github.com/sigstore/sigstore v1.10.8/go.mod h1:f9+B/4iaYimvUkySyb2mvc73n3RLqNn24grHZM/ET8M=
 github.com/sigstore/sigstore-go v1.1.4 h1:wTTsgCHOfqiEzVyBYA6mDczGtBkN7cM8mPpjJj5QvMg=
 github.com/sigstore/sigstore-go v1.1.4/go.mod h1:2U/mQOT9cjjxrtIUeKDVhL+sHBKsnWddn8URlswdBsg=
-github.com/sigstore/sigstore/pkg/signature/kms/aws v1.10.5 h1:aqHRubTITULckG9JAcq2FEhtKkT/RRE8oErfuV3smSI=
-github.com/sigstore/sigstore/pkg/signature/kms/aws v1.10.5/go.mod h1:h9eK9QyPqpFskF/ewFkRLtwh4/Q3FLc2/DXbym4IHN8=
-github.com/sigstore/sigstore/pkg/signature/kms/azure v1.10.5 h1:+9C6CUkv+J4iT67Lx+H1EGBfAdoAHqXumHadeIj9jA4=
-github.com/sigstore/sigstore/pkg/signature/kms/azure v1.10.5/go.mod h1:myZsg7wRiy/vf102g5uUAitYhtXCwepmAGxgHG1VHuE=
-github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.10.5 h1:BpQx6AhjwIN9LmlO4ypkcMcHiWiepgZQGSw5U69frHU=
-github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.10.5/go.mod h1:ejMD/17lMJ4HykQRPdj5NNr+OQYIEZto8HjDKghVMOA=
-github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.10.5 h1:OFwQZgWkB/6J6W5sy3SkXE4pJnhNRnE2cJd8ySXmHpo=
-github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.10.5/go.mod h1:Ee/enmyxi/RFLVlajbnjgH2wOWQwlJ0wY8qZrk43hEw=
-github.com/sigstore/timestamp-authority/v2 v2.0.6 h1:1Vh7/SdmLsVLG6Br6/bisd1SnlicfDm0MJYiA+D7Ppw=
-github.com/sigstore/timestamp-authority/v2 v2.0.6/go.mod h1:Nk5ucGBDyH0tXAIMZ0prf6xn8qfTnbJhSq+CDabYcfc=
+github.com/sigstore/sigstore/pkg/signature/kms/aws v1.10.6 h1:5OgLJUqWaw6+I0BM4W1eUEzCWzZT/hu1lXkw0oGyays=
+github.com/sigstore/sigstore/pkg/signature/kms/aws v1.10.6/go.mod h1:h9eK9QyPqpFskF/ewFkRLtwh4/Q3FLc2/DXbym4IHN8=
+github.com/sigstore/sigstore/pkg/signature/kms/azure v1.10.6 h1:U0OBU3vyU4wFPdQG65UelVmYKGEoP511JUBKwLdLOUc=
+github.com/sigstore/sigstore/pkg/signature/kms/azure v1.10.6/go.mod h1:myZsg7wRiy/vf102g5uUAitYhtXCwepmAGxgHG1VHuE=
+github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.10.6 h1:C4rrjnIWR7i9GoIpI2x9irNkUqVqAst2f3xIGMugDP8=
+github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.10.6/go.mod h1:ejMD/17lMJ4HykQRPdj5NNr+OQYIEZto8HjDKghVMOA=
+github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.10.6 h1:otSDRygk1TdzEiUBFyaGygT+qdwSnM9RT1i6BQMHmEY=
+github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.10.6/go.mod h1:Ee/enmyxi/RFLVlajbnjgH2wOWQwlJ0wY8qZrk43hEw=
+github.com/sigstore/timestamp-authority/v2 v2.1.0 h1:hXoyug4t6FblDeb7gX/AMxqJFwKZegmxVoBdHE4UbHM=
+github.com/sigstore/timestamp-authority/v2 v2.1.0/go.mod h1:QOEsMbG/XXJlstwDbSLmbBQsSXNKuKya0z0gq6i3kbY=
 github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
 github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
 github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
@@ -742,10 +744,12 @@ github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
 github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
 github.com/tink-crypto/tink-go-awskms/v2 v2.1.0 h1:N9UxlsOzu5mttdjhxkDLbzwtEecuXmlxZVo/ds7JKJI=
 github.com/tink-crypto/tink-go-awskms/v2 v2.1.0/go.mod h1:PxSp9GlOkKL9rlybW804uspnHuO9nbD98V/fDX4uSis=
+github.com/tink-crypto/tink-go-awskms/v3 v3.0.0 h1:XSohRhCkXAVI0iaCnWB/GS05TEmpnKurQmzaY1jzt3Y=
+github.com/tink-crypto/tink-go-awskms/v3 v3.0.0/go.mod h1:+7MXsShLzVbSQ6dI0Pe4JuZM52jD1jQ1itAygd/MDsA=
 github.com/tink-crypto/tink-go-gcpkms/v2 v2.2.0 h1:3B9i6XBXNTRspfkTC0asN5W0K6GhOSgcujNiECNRNb0=
 github.com/tink-crypto/tink-go-gcpkms/v2 v2.2.0/go.mod h1:jY5YN2BqD/KSCHM9SqZPIpJNG/u3zwfLXHgws4x2IRw=
-github.com/tink-crypto/tink-go-hcvault/v2 v2.4.0 h1:j+S+WKBQ5ya26A5EM/uXoVe+a2IaPQN8KgBJZ22cJ+4=
-github.com/tink-crypto/tink-go-hcvault/v2 v2.4.0/go.mod h1:OCKJIujnTzDq7f+73NhVs99oA2c1TR6nsOpuasYM6Yo=
+github.com/tink-crypto/tink-go-hcvault/v2 v2.5.0 h1:eXuNqgrcYelxU1MVikOJDP3wTS5lvihM4ntoAbAMfvs=
+github.com/tink-crypto/tink-go-hcvault/v2 v2.5.0/go.mod h1:3RhcxAqek6xUlRFmJifvU4CYLZN60KMQdIKqpZAZJG0=
 github.com/tink-crypto/tink-go/v2 v2.6.0 h1:+KHNBHhWH33Vn+igZWcsgdEPUxKwBMEe0QC60t388v4=
 github.com/tink-crypto/tink-go/v2 v2.6.0/go.mod h1:2WbBA6pfNsAfBwDCggboaHeB2X29wkU8XHtGwh2YIk8=
 github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 h1:e/5i7d4oYZ+C1wj2THlRK+oAhjeS/TRQwMfkIuet3w0=
@@ -790,8 +794,8 @@ go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
 go.opentelemetry.io/contrib/detectors/gcp v1.42.0 h1:kpt2PEJuOuqYkPcktfJqWWDjTEd/FNgrxcniL7kQrXQ=
 go.opentelemetry.io/contrib/detectors/gcp v1.42.0/go.mod h1:W9zQ439utxymRrXsUOzZbFX4JhLxXU4+ZnCt8GG7yA8=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 h1:YH4g8lQroajqUwWbq/tr2QX1JFmEXaDLgG+ew9bLMWo=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0/go.mod h1:fvPi2qXDqFs8M4B4fmJhE92TyQs9Ydjlg3RvfUp+NbQ=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 h1:yI1/OhfEPy7J9eoa6Sj051C7n5dvpj0QX8g4sRchg04=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0/go.mod h1:NoUCKYWK+3ecatC4HjkRktREheMeEtrXoQxrqYFeHSc=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 h1:OyrsyzuttWTSur2qN/Lm0m2a8yqyIjUVBZcxFPuXq2o=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0/go.mod h1:C2NGBr+kAB4bk3xtMXfZ94gqFDtg/GkI7e9zqGh5Beg=
 go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
@@ -824,8 +828,8 @@ go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpu
 go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk=
 go.starlark.net v0.0.0-20230525235612-a134d8f9ddca h1:VdD38733bfYv5tUZwEIskMM93VanwNIi5bIKnDrJdEY=
 go.starlark.net v0.0.0-20230525235612-a134d8f9ddca/go.mod h1:jxU+3+j+71eXOW14274+SmmuW82qJzl6iZSeqEtTGds=
-go.step.sm/crypto v0.77.2 h1:qFjjei+RHc5kP5R7NW9OUWT7SqWIuAOvOkXqg4fNWj8=
-go.step.sm/crypto v0.77.2/go.mod h1:W0YJb9onM5l78qgkXIJ2Up6grnwW8EtpCKIza/NCg0o=
+go.step.sm/crypto v0.81.0 h1:e+ouzpNt3Xm4dp7HGXhgYB5y4iFik3vh3phHKWmvugU=
+go.step.sm/crypto v0.81.0/go.mod h1:fsTizqQeASjTXnbv9O00XtRlIuXRkCdoRiJNyXGQujc=
 go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
@@ -981,15 +985,15 @@ gomodules.xyz/jsonpatch/v2 v2.5.0 h1:JELs8RLM12qJGXU4u/TO3V25KW8GreMKl9pdkk14RM0
 gomodules.xyz/jsonpatch/v2 v2.5.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/api v0.272.0 h1:eLUQZGnAS3OHn31URRf9sAmRk3w2JjMx37d2k8AjJmA=
-google.golang.org/api v0.272.0/go.mod h1:wKjowi5LNJc5qarNvDCvNQBn3rVK8nSy6jg2SwRwzIA=
+google.golang.org/api v0.277.0 h1:HJfyJUiNeBBUMai7ez8u14wkp/gH/I4wpGbbO9o+cSk=
+google.golang.org/api v0.277.0/go.mod h1:B9TqLBwJqVjp1mtt7WeoQwWRwvu/400y5lETOql+giQ=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20260316180232-0b37fe3546d5 h1:JNfk58HZ8lfmXbYK2vx/UvsqIL59TzByCxPIX4TDmsE=
-google.golang.org/genproto v0.0.0-20260316180232-0b37fe3546d5/go.mod h1:x5julN69+ED4PcFk/XWayw35O0lf/nGa4aNgODCmNmw=
+google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 h1:XzmzkmB14QhVhgnawEVsOn6OFsnpyxNPRY9QV01dNB0=
+google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:L43LFes82YgSonw6iTXTxXUX1OlULt4AQtkik4ULL/I=
 google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 h1:VPWxll4HlMw1Vs/qXtN7BvhZqsS9cdAittCNvVENElA=
 google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:7QBABkRtR8z+TEnmXTqIqwJLlzrZKVfAUm7tY3yGv0M=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa h1:mZHHdPZl0dbGHCflZgAq/Q468DWVFcU2whhB2KAo8fk=
diff --git a/vendor/cloud.google.com/go/auth/CHANGES.md b/vendor/cloud.google.com/go/auth/CHANGES.md
index 846231f64a..2c1f6ff8fa 100644
--- a/vendor/cloud.google.com/go/auth/CHANGES.md
+++ b/vendor/cloud.google.com/go/auth/CHANGES.md
@@ -1,5 +1,13 @@
 # Changes
 
+## [0.20.0](https://github.com/googleapis/google-cloud-go/releases/tag/auth%2Fv0.20.0) (2026-04-06)
+
+## [0.19.0](https://github.com/googleapis/google-cloud-go/releases/tag/auth%2Fv0.19.0) (2026-03-23)
+
+### Features
+
+* add OpenTelemetry gRPC and HTTP wrappers for T4 tracing (#14133) ([d38abf9](https://github.com/googleapis/google-cloud-go/commit/d38abf988d4017b4832434abae9a90874bec5ce9))
+
 ## [0.18.2](https://github.com/googleapis/google-cloud-go/releases/tag/auth%2Fv0.18.2) (2026-02-13)
 
 ### Bug Fixes
diff --git a/vendor/cloud.google.com/go/auth/grpctransport/grpctransport.go b/vendor/cloud.google.com/go/auth/grpctransport/grpctransport.go
index 9b4b1f06e8..f77f6423c4 100644
--- a/vendor/cloud.google.com/go/auth/grpctransport/grpctransport.go
+++ b/vendor/cloud.google.com/go/auth/grpctransport/grpctransport.go
@@ -22,19 +22,27 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
+	"net"
 	"net/http"
 	"os"
+	"strconv"
+	"strings"
 
 	"cloud.google.com/go/auth"
 	"cloud.google.com/go/auth/credentials"
 	"cloud.google.com/go/auth/internal"
 	"cloud.google.com/go/auth/internal/transport"
 	"cloud.google.com/go/auth/internal/transport/headers"
+	"github.com/googleapis/gax-go/v2"
+	"github.com/googleapis/gax-go/v2/callctx"
 	"github.com/googleapis/gax-go/v2/internallog"
 	"go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc"
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/trace"
 	"google.golang.org/grpc"
 	grpccreds "google.golang.org/grpc/credentials"
 	grpcinsecure "google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/stats"
 )
 
 const (
@@ -47,6 +55,30 @@ const (
 	quotaProjectHeaderKey = "X-goog-user-project"
 )
 
+// codeToStr is a reversal of the `strToCode` map in
+// https://github.com/grpc/grpc-go/blob/master/codes/codes.go
+// The gRPC specification has exactly 17 status codes, defined
+// as a contiguous block of integers from 0 to 16.
+var codeToStr = [...]string{
+	"OK",                  // codes.OK = 0
+	"CANCELED",            // codes.Canceled = 1
+	"UNKNOWN",             // codes.Unknown = 2
+	"INVALID_ARGUMENT",    // codes.InvalidArgument = 3
+	"DEADLINE_EXCEEDED",   // codes.DeadlineExceeded = 4
+	"NOT_FOUND",           // codes.NotFound = 5
+	"ALREADY_EXISTS",      // codes.AlreadyExists = 6
+	"PERMISSION_DENIED",   // codes.PermissionDenied = 7
+	"RESOURCE_EXHAUSTED",  // codes.ResourceExhausted = 8
+	"FAILED_PRECONDITION", // codes.FailedPrecondition = 9
+	"ABORTED",             // codes.Aborted = 10
+	"OUT_OF_RANGE",        // codes.OutOfRange = 11
+	"UNIMPLEMENTED",       // codes.Unimplemented = 12
+	"INTERNAL",            // codes.Internal = 13
+	"UNAVAILABLE",         // codes.Unavailable = 14
+	"DATA_LOSS",           // codes.DataLoss = 15
+	"UNAUTHENTICATED",     // codes.Unauthenticated = 16
+}
+
 var (
 	// Set at init time by dial_socketopt.go. If nil, socketopt is not supported.
 	timeoutDialerOption grpc.DialOption
@@ -198,7 +230,7 @@ type InternalOptions struct {
 	// service.
 	DefaultScopes []string
 	// SkipValidation bypasses validation on Options. It should only be used
-	// internally for clients that needs more control over their transport.
+	// internally for clients that need more control over their transport.
 	SkipValidation bool
 	// TelemetryAttributes specifies a map of telemetry attributes to be added
 	// to all OpenTelemetry signals, such as tracing and metrics, for purposes
@@ -338,7 +370,7 @@ func dial(ctx context.Context, secure bool, opts *Options) (*grpc.ClientConn, er
 	// Add tracing, but before the other options, so that clients can override the
 	// gRPC stats handler.
 	// This assumes that gRPC options are processed in order, left to right.
-	grpcOpts = addOpenTelemetryStatsHandler(grpcOpts, opts)
+	grpcOpts = addOpenTelemetryStatsHandler(grpcOpts, opts, transportCreds.Endpoint)
 	grpcOpts = append(grpcOpts, opts.GRPCDialOpts...)
 
 	return grpc.DialContext(ctx, transportCreds.Endpoint, grpcOpts...)
@@ -426,9 +458,218 @@ func (c *grpcCredentialsProvider) RequireTransportSecurity() bool {
 	return c.secure
 }
 
-func addOpenTelemetryStatsHandler(dialOpts []grpc.DialOption, opts *Options) []grpc.DialOption {
+func addOpenTelemetryStatsHandler(dialOpts []grpc.DialOption, opts *Options, endpoint string) []grpc.DialOption {
 	if opts.DisableTelemetry {
 		return dialOpts
 	}
-	return append(dialOpts, grpc.WithStatsHandler(otelgrpc.NewClientHandler()))
+	if gax.IsFeatureEnabled("METRICS") {
+		host, port := extractHostPort(endpoint)
+		dialOpts = append(dialOpts, grpc.WithChainUnaryInterceptor(openTelemetryUnaryClientInterceptor(host, port)))
+	}
+	if !gax.IsFeatureEnabled("TRACING") && !gax.IsFeatureEnabled("LOGGING") {
+		return append(dialOpts, grpc.WithStatsHandler(otelgrpc.NewClientHandler()))
+	}
+	var staticAttrs []attribute.KeyValue
+	var scopedLogger *slog.Logger
+
+	if gax.IsFeatureEnabled("LOGGING") && opts.Logger != nil {
+		scopedLogger = opts.Logger
+	}
+
+	if opts.InternalOptions != nil {
+		staticAttrs = transport.StaticTelemetryAttributes(opts.InternalOptions.TelemetryAttributes)
+		if scopedLogger != nil {
+			var staticLogAttrs []any
+			for _, attr := range staticAttrs {
+				staticLogAttrs = append(staticLogAttrs, slog.String(string(attr.Key), attr.Value.AsString()))
+			}
+			scopedLogger = scopedLogger.With(staticLogAttrs...)
+		}
+	}
+	var otelOpts []otelgrpc.Option
+	if gax.IsFeatureEnabled("TRACING") {
+		otelOpts = append(otelOpts, otelgrpc.WithSpanAttributes(staticAttrs...))
+	}
+	return append(dialOpts, grpc.WithStatsHandler(&otelHandler{
+		Handler: otelgrpc.NewClientHandler(otelOpts...),
+		logger:  scopedLogger,
+	}))
+}
+
+// Extract the host and port from a target address
+func extractHostPort(target string) (string, int) {
+	if idx := strings.Index(target, "://"); idx != -1 {
+		target = target[idx+3:]
+		// Ensure any leading authorities (like 8.8.8.8 in dns://8.8.8.8/foo) are stripped
+		if slashIdx := strings.Index(target, "/"); slashIdx != -1 {
+			target = target[slashIdx+1:]
+		}
+	}
+	host, portStr, err := net.SplitHostPort(target)
+	if err != nil {
+		return target, 0
+	}
+	port, err := strconv.Atoi(portStr)
+	if err != nil {
+		return host, 0
+	}
+	return host, port
+}
+
+// openTelemetryUnaryClientInterceptor returns an interceptor that populates
+// TransportTelemetryData with the server peer address.
+func openTelemetryUnaryClientInterceptor(host string, port int) grpc.UnaryClientInterceptor {
+	return func(ctx context.Context, method string, req, reply any, cc *grpc.ClientConn, invoker grpc.UnaryInvoker, opts ...grpc.CallOption) error {
+		transportData := gax.ExtractTransportTelemetry(ctx)
+		if transportData != nil {
+			if host != "" {
+				transportData.SetServerAddress(host)
+			}
+			if port != 0 {
+				transportData.SetServerPort(port)
+			}
+		}
+
+		err := invoker(ctx, method, req, reply, cc, opts...)
+
+		return err
+	}
+}
+
+// otelHandler is a wrapper around the OpenTelemetry gRPC client handler that
+// adds custom Google Cloud-specific attributes to spans and metrics.
+type otelHandler struct {
+	stats.Handler
+	logger *slog.Logger
+}
+
+// TagRPC intercepts the RPC start to extract dynamic attributes like resource
+// name and retry count from the outgoing context metadata and attach them to
+// the current span.
+func (h *otelHandler) TagRPC(ctx context.Context, info *stats.RPCTagInfo) context.Context {
+	ctx = h.Handler.TagRPC(ctx, info)
+
+	var span trace.Span
+	if gax.IsFeatureEnabled("TRACING") {
+		if s := trace.SpanFromContext(ctx); s != nil && s.IsRecording() {
+			span = s
+		}
+	}
+
+	if span == nil {
+		return ctx
+	}
+	var attrs []attribute.KeyValue
+	if resName, ok := callctx.TelemetryFromContext(ctx, "resource_name"); ok {
+		attrs = append(attrs, attribute.String("gcp.resource.destination.id", resName))
+	}
+	if resendCountStr, ok := callctx.TelemetryFromContext(ctx, "resend_count"); ok {
+		if count, err := strconv.Atoi(resendCountStr); err == nil {
+			attrs = append(attrs, attribute.Int("gcp.grpc.resend_count", count))
+		}
+	}
+	if len(attrs) > 0 {
+		span.SetAttributes(attrs...)
+	}
+	return ctx
+}
+
+// HandleRPC intercepts the RPC completion to capture and format error-related
+// attributes ensuring they conform to Google Cloud observability standards.
+func (h *otelHandler) HandleRPC(ctx context.Context, s stats.RPCStats) {
+	end, ok := s.(*stats.End)
+	if !ok {
+		h.Handler.HandleRPC(ctx, s)
+		return
+	}
+
+	var span trace.Span
+	if gax.IsFeatureEnabled("TRACING") {
+		if s := trace.SpanFromContext(ctx); s != nil && s.IsRecording() {
+			span = s
+		}
+	}
+
+	var logger *slog.Logger
+	if gax.IsFeatureEnabled("LOGGING") {
+		if l := h.logger; l != nil && l.Enabled(ctx, slog.LevelDebug) {
+			logger = l
+		}
+	}
+
+	if span == nil && logger == nil {
+		h.Handler.HandleRPC(ctx, s)
+		return
+	}
+
+	if end.Error != nil {
+		h.handleRPCError(ctx, span, logger, end)
+	} else {
+		h.handleRPCSuccess(span)
+	}
+	h.Handler.HandleRPC(ctx, s)
+}
+
+func (h *otelHandler) handleRPCError(ctx context.Context, span trace.Span, logger *slog.Logger, end *stats.End) {
+	info := gax.ExtractTelemetryErrorInfo(ctx, end.Error)
+
+	if logger != nil {
+		logActionableError(ctx, logger, info)
+	}
+
+	if span != nil {
+		attrs := []attribute.KeyValue{
+			attribute.String("error.type", info.ErrorType),
+			attribute.String("status.message", info.StatusMessage),
+			attribute.String("rpc.response.status_code", info.StatusCode),
+			attribute.String("exception.type", fmt.Sprintf("%T", end.Error)),
+		}
+		span.SetAttributes(attrs...)
+	}
+}
+
+func (h *otelHandler) handleRPCSuccess(span trace.Span) {
+	if span != nil {
+		attrs := []attribute.KeyValue{
+			attribute.String("rpc.response.status_code", "OK"),
+		}
+		span.SetAttributes(attrs...)
+	}
+}
+
+func logActionableError(ctx context.Context, logger *slog.Logger, info gax.TelemetryErrorInfo) {
+	baseLogAttrs := []slog.Attr{
+		slog.String("rpc.system.name", "grpc"),
+		slog.String("rpc.response.status_code", info.StatusCode),
+	}
+
+	if resendCountStr, ok := callctx.TelemetryFromContext(ctx, "resend_count"); ok {
+		if count, e := strconv.Atoi(resendCountStr); e == nil {
+			baseLogAttrs = append(baseLogAttrs, slog.Int64("gcp.grpc.resend_count", int64(count)))
+		}
+	}
+
+	msg := info.StatusMessage
+	if msg == "" {
+		msg = "API call failed"
+	}
+
+	if rpcMethod, ok := callctx.TelemetryFromContext(ctx, "rpc_method"); ok {
+		baseLogAttrs = append(baseLogAttrs, slog.String("rpc.method", rpcMethod))
+	}
+
+	if resName, ok := callctx.TelemetryFromContext(ctx, "resource_name"); ok {
+		baseLogAttrs = append(baseLogAttrs, slog.String("gcp.resource.destination.id", resName))
+	}
+
+	if info.Domain != "" {
+		baseLogAttrs = append(baseLogAttrs, slog.String("gcp.errors.domain", info.Domain))
+	}
+	for k, v := range info.Metadata {
+		baseLogAttrs = append(baseLogAttrs, slog.String("gcp.errors.metadata."+k, v))
+	}
+
+	baseLogAttrs = append(baseLogAttrs, slog.String("error.type", info.ErrorType))
+
+	logger.LogAttrs(ctx, slog.LevelDebug, msg, baseLogAttrs...)
 }
diff --git a/vendor/cloud.google.com/go/auth/httptransport/transport.go b/vendor/cloud.google.com/go/auth/httptransport/transport.go
index 3feb997c76..87b3fef218 100644
--- a/vendor/cloud.google.com/go/auth/httptransport/transport.go
+++ b/vendor/cloud.google.com/go/auth/httptransport/transport.go
@@ -15,11 +15,17 @@
 package httptransport
 
 import (
+	"bytes"
 	"context"
 	"crypto/tls"
+	"fmt"
+	"io"
+	"log/slog"
 	"net"
 	"net/http"
 	"os"
+	"strconv"
+	"sync"
 	"time"
 
 	"cloud.google.com/go/auth"
@@ -28,12 +34,18 @@ import (
 	"cloud.google.com/go/auth/internal/transport"
 	"cloud.google.com/go/auth/internal/transport/cert"
 	"cloud.google.com/go/auth/internal/transport/headers"
+	"github.com/googleapis/gax-go/v2"
+	"github.com/googleapis/gax-go/v2/callctx"
 	"go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/trace"
 	"golang.org/x/net/http2"
+	"google.golang.org/api/googleapi"
 )
 
 const (
 	quotaProjectHeaderKey = "X-goog-user-project"
+	maxErrorReadBytes     = int64(8192) // 8KB
 )
 
 func newTransport(base http.RoundTripper, opts *Options) (http.RoundTripper, error) {
@@ -173,7 +185,308 @@ func addOpenTelemetryTransport(trans http.RoundTripper, opts *Options) http.Roun
 	if opts.DisableTelemetry {
 		return trans
 	}
-	return otelhttp.NewTransport(trans)
+
+	var traceAttrs []attribute.KeyValue
+	var scopedLogger *slog.Logger
+
+	if gax.IsFeatureEnabled("LOGGING") && opts.Logger != nil {
+		scopedLogger = opts.Logger
+	}
+
+	if opts.InternalOptions != nil {
+		attrs := transport.StaticTelemetryAttributes(opts.InternalOptions.TelemetryAttributes)
+		if gax.IsFeatureEnabled("TRACING") {
+			traceAttrs = attrs
+		}
+		if scopedLogger != nil {
+			var logAttrs []any
+			for _, attr := range attrs {
+				logAttrs = append(logAttrs, slog.String(string(attr.Key), attr.Value.AsString()))
+			}
+			scopedLogger = scopedLogger.With(logAttrs...)
+		}
+	}
+
+	if gax.IsFeatureEnabled("METRICS") || gax.IsFeatureEnabled("TRACING") || gax.IsFeatureEnabled("LOGGING") {
+		trans = &otelAttributeTransport{
+			base:   trans,
+			logger: scopedLogger,
+		}
+	}
+
+	if !gax.IsFeatureEnabled("TRACING") && !gax.IsFeatureEnabled("LOGGING") {
+		return otelhttp.NewTransport(trans)
+	}
+
+	var otelOpts []otelhttp.Option
+	if len(traceAttrs) > 0 {
+		otelOpts = append(otelOpts, otelhttp.WithSpanOptions(trace.WithAttributes(traceAttrs...)))
+	}
+	return otelhttp.NewTransport(trans, otelOpts...)
+}
+
+// otelAttributeTransport is a wrapper around an http.RoundTripper that adds
+// custom Google Cloud-specific attributes to OpenTelemetry spans.
+type otelAttributeTransport struct {
+	base   http.RoundTripper
+	logger *slog.Logger
+}
+
+// RoundTrip intercepts the HTTP request and response to enrich the active
+// OpenTelemetry span with static and dynamic attributes, as well as detailed
+// error information.
+func (t *otelAttributeTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	var span trace.Span
+	if gax.IsFeatureEnabled("TRACING") {
+		if s := trace.SpanFromContext(req.Context()); s != nil && s.IsRecording() {
+			span = s
+		}
+	}
+
+	if span != nil {
+		var attrs []attribute.KeyValue
+		attrs = append(attrs, attribute.String("rpc.system.name", "http"))
+		if resName, ok := callctx.TelemetryFromContext(req.Context(), "resource_name"); ok {
+			attrs = append(attrs, attribute.String("gcp.resource.destination.id", resName))
+		}
+		if resendCountStr, ok := callctx.TelemetryFromContext(req.Context(), "resend_count"); ok {
+			if count, err := strconv.Atoi(resendCountStr); err == nil {
+				attrs = append(attrs, attribute.Int("http.request.resend_count", count))
+			}
+		}
+		if urlTemplate, ok := callctx.TelemetryFromContext(req.Context(), "url_template"); ok {
+			attrs = append(attrs, attribute.String("url.template", urlTemplate))
+			span.SetName(fmt.Sprintf("%s %s", req.Method, urlTemplate))
+		}
+		span.SetAttributes(attrs...)
+	}
+
+	var data *gax.TransportTelemetryData
+	if gax.IsFeatureEnabled("METRICS") {
+		data = gax.ExtractTransportTelemetry(req.Context())
+		if data != nil && req.URL != nil {
+			host := req.URL.Hostname()
+			if host != "" {
+				data.SetServerAddress(host)
+			}
+			portStr := req.URL.Port()
+			if portStr == "" {
+				if req.URL.Scheme == "https" {
+					portStr = "443"
+				} else if req.URL.Scheme == "http" {
+					portStr = "80"
+				}
+			}
+			if port, pErr := strconv.Atoi(portStr); pErr == nil {
+				data.SetServerPort(port)
+			}
+		}
+	}
+
+	resp, err := t.base.RoundTrip(req)
+
+	var logger *slog.Logger
+	if gax.IsFeatureEnabled("LOGGING") {
+		if l := t.logger; l != nil && l.Enabled(req.Context(), slog.LevelDebug) {
+			logger = l
+		}
+	}
+
+	if span == nil && logger == nil {
+		return resp, err
+	}
+
+	if err != nil {
+		t.logAndSpanError(req, resp, err, err, span, logger)
+	} else if resp.StatusCode >= 400 {
+		if resp.Body != nil && resp.Body != http.NoBody && (resp.ContentLength < 0 || resp.ContentLength <= maxErrorReadBytes) {
+			resp.Body = &errorTrackingBody{
+				ReadCloser: resp.Body,
+				req:        req,
+				resp:       resp,
+				span:       span,
+				logger:     logger,
+				t:          t,
+			}
+		} else {
+			t.logAndSpanError(req, resp, &googleapi.Error{
+				Code:    resp.StatusCode,
+				Message: resp.Status,
+			}, nil, span, logger)
+		}
+	} else {
+		if span != nil {
+			span.SetAttributes(attribute.Int("http.response.status_code", resp.StatusCode))
+		}
+	}
+
+	return resp, err
+}
+
+func (t *otelAttributeTransport) logAndSpanError(req *http.Request, resp *http.Response, errToParse error, netErr error, span trace.Span, logger *slog.Logger) {
+	var httpStatusCode int
+	if resp != nil {
+		httpStatusCode = resp.StatusCode
+	}
+
+	info := gax.ExtractTelemetryErrorInfo(req.Context(), errToParse)
+
+	if netErr == nil && resp != nil && resp.StatusCode >= 400 {
+		if info.ErrorType == "*googleapi.Error" {
+			info.ErrorType = strconv.Itoa(resp.StatusCode)
+		}
+	}
+
+	if logger != nil {
+		logAttrs := []slog.Attr{
+			slog.String("rpc.system.name", "http"),
+		}
+		if httpStatusCode > 0 {
+			logAttrs = append(logAttrs, slog.Int64("http.response.status_code", int64(httpStatusCode)))
+		}
+
+		ctx := req.Context()
+		if resendCountStr, ok := callctx.TelemetryFromContext(ctx, "resend_count"); ok {
+			if count, e := strconv.Atoi(resendCountStr); e == nil {
+				logAttrs = append(logAttrs, slog.Int64("http.request.resend_count", int64(count)))
+			}
+		}
+		if urlTemplate, ok := callctx.TelemetryFromContext(ctx, "url_template"); ok {
+			logAttrs = append(logAttrs, slog.String("url.template", urlTemplate))
+		}
+		logAttrs = append(logAttrs, slog.String("http.request.method", req.Method))
+
+		msg := info.StatusMessage
+		if msg == "" {
+			msg = "API call failed"
+		}
+
+		if rpcMethod, ok := callctx.TelemetryFromContext(ctx, "rpc_method"); ok {
+			logAttrs = append(logAttrs, slog.String("rpc.method", rpcMethod))
+		}
+
+		if resName, ok := callctx.TelemetryFromContext(ctx, "resource_name"); ok {
+			logAttrs = append(logAttrs, slog.String("gcp.resource.destination.id", resName))
+		}
+
+		if info.Domain != "" {
+			logAttrs = append(logAttrs, slog.String("gcp.errors.domain", info.Domain))
+		}
+		for k, v := range info.Metadata {
+			logAttrs = append(logAttrs, slog.String("gcp.errors.metadata."+k, v))
+		}
+
+		logAttrs = append(logAttrs, slog.String("error.type", info.ErrorType))
+		if info.StatusCode != "" {
+			logAttrs = append(logAttrs, slog.String("rpc.response.status_code", info.StatusCode))
+		}
+
+		logger.LogAttrs(ctx, slog.LevelDebug, msg, logAttrs...)
+	}
+
+	if span != nil {
+		if netErr != nil {
+			span.SetAttributes(
+				attribute.String("error.type", info.ErrorType),
+				attribute.String("status.message", info.StatusMessage),
+				attribute.String("exception.type", fmt.Sprintf("%T", netErr)),
+			)
+		} else {
+			span.SetAttributes(
+				attribute.Int("http.response.status_code", httpStatusCode),
+				attribute.String("error.type", info.ErrorType),
+				attribute.String("status.message", info.StatusMessage),
+			)
+		}
+	}
+}
+
+type errorTrackingBody struct {
+	io.ReadCloser
+	req    *http.Request
+	resp   *http.Response
+	span   trace.Span
+	logger *slog.Logger
+	t      *otelAttributeTransport
+
+	mu       sync.Mutex
+	buf      bytes.Buffer
+	recorded bool
+}
+
+func (b *errorTrackingBody) Read(p []byte) (n int, err error) {
+	n, err = b.ReadCloser.Read(p)
+
+	b.mu.Lock()
+	shouldRecord := false
+	if !b.recorded {
+		if n > 0 {
+			remaining := maxErrorReadBytes - int64(b.buf.Len())
+			if remaining > 0 {
+				if int64(n) > remaining {
+					b.buf.Write(p[:remaining])
+				} else {
+					b.buf.Write(p[:n])
+				}
+			}
+		}
+
+		if err == io.EOF || int64(b.buf.Len()) >= maxErrorReadBytes {
+			shouldRecord = true
+			b.recorded = true
+		}
+	}
+	b.mu.Unlock()
+
+	if shouldRecord {
+		b.recordError()
+	}
+
+	return n, err
+}
+
+func (b *errorTrackingBody) Close() error {
+	b.mu.Lock()
+	shouldRecord := !b.recorded
+	b.recorded = true
+	b.mu.Unlock()
+
+	// We can close the network stream immediately.
+	err := b.ReadCloser.Close()
+
+	// Do heavy in-memory telemetry parsing without holding the lock
+	if shouldRecord {
+		b.recordError() // If this panics here, the socket is already released
+	}
+
+	return err
+}
+
+func (b *errorTrackingBody) recordError() {
+	errToParse := &googleapi.Error{
+		Code:    b.resp.StatusCode,
+		Message: b.resp.Status,
+	}
+
+	if b.buf.Len() > 0 {
+		clone := *b.resp
+		clone.Body = io.NopCloser(bytes.NewReader(b.buf.Bytes()))
+		if errResp := googleapi.CheckResponse(&clone); errResp != nil {
+			if gErr, ok := errResp.(*googleapi.Error); ok {
+				if gErr.Message == "" {
+					gErr.Message = b.resp.Status
+				}
+				errToParse = gErr
+			} else {
+				errToParse = &googleapi.Error{
+					Code:    b.resp.StatusCode,
+					Message: errResp.Error(),
+				}
+			}
+		}
+	}
+
+	b.t.logAndSpanError(b.req, b.resp, errToParse, nil, b.span, b.logger)
 }
 
 type authTransport struct {
diff --git a/vendor/cloud.google.com/go/auth/internal/transport/transport.go b/vendor/cloud.google.com/go/auth/internal/transport/transport.go
index 5c8721efa9..fb0a8a1e07 100644
--- a/vendor/cloud.google.com/go/auth/internal/transport/transport.go
+++ b/vendor/cloud.google.com/go/auth/internal/transport/transport.go
@@ -24,8 +24,38 @@ import (
 	"time"
 
 	"cloud.google.com/go/auth/credentials"
+	"go.opentelemetry.io/otel/attribute"
 )
 
+// knownKeys provides keys for reading telemetry attributes from Context.
+// It provides an implicit contract with generated client library code
+// using the same keys. The keys in this collection should not be removed
+// or modified. New keys may be added, but they will need to be explicitly
+// used in code referencing this collection in order to appear in telemetry.
+var knownKeys = []string{
+	"gcp.client.service",
+	"gcp.client.version",
+	"gcp.client.repo",
+	"gcp.client.artifact",
+	"gcp.client.language",
+	"url.domain",
+}
+
+// StaticTelemetryAttributes selectively converts known keys from a map of
+// strings to Open Telemetry attributes.
+func StaticTelemetryAttributes(m map[string]string) []attribute.KeyValue {
+	var staticAttrs []attribute.KeyValue
+	if m == nil {
+		return staticAttrs
+	}
+	for _, k := range knownKeys {
+		if v, ok := m[k]; ok {
+			staticAttrs = append(staticAttrs, attribute.String(k, v))
+		}
+	}
+	return staticAttrs
+}
+
 // CloneDetectOptions clones a user set detect option into some new memory that
 // we can internally manipulate before sending onto the detect package.
 func CloneDetectOptions(oldDo *credentials.DetectOptions) *credentials.DetectOptions {
diff --git a/vendor/cloud.google.com/go/auth/internal/version.go b/vendor/cloud.google.com/go/auth/internal/version.go
index b73008694f..d627069b57 100644
--- a/vendor/cloud.google.com/go/auth/internal/version.go
+++ b/vendor/cloud.google.com/go/auth/internal/version.go
@@ -4,7 +4,7 @@
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
-//      http://www.apache.org/licenses/LICENSE-2.0
+//     https://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
@@ -17,4 +17,4 @@
 package internal
 
 // Version is the current tagged release of the library.
-const Version = "0.18.2"
+const Version = "0.20.0"
diff --git a/vendor/cloud.google.com/go/iam/.repo-metadata.json b/vendor/cloud.google.com/go/iam/.repo-metadata.json
new file mode 100644
index 0000000000..bdabea916f
--- /dev/null
+++ b/vendor/cloud.google.com/go/iam/.repo-metadata.json
@@ -0,0 +1,10 @@
+{
+    "api_shortname": "iam",
+    "client_documentation": "https://cloud.google.com/go/docs/reference/cloud.google.com/go/iam/latest",
+    "client_library_type": "manual",
+    "description": "Cloud IAM",
+    "distribution_name": "cloud.google.com/go/iam",
+    "language": "go",
+    "library_type": "CORE",
+    "release_level": "stable"
+}
\ No newline at end of file
diff --git a/vendor/cloud.google.com/go/iam/CHANGES.md b/vendor/cloud.google.com/go/iam/CHANGES.md
index a91f9186b7..69b2eaf676 100644
--- a/vendor/cloud.google.com/go/iam/CHANGES.md
+++ b/vendor/cloud.google.com/go/iam/CHANGES.md
@@ -1,6 +1,14 @@
 # Changes
 
 
+## [1.7.0](https://github.com/googleapis/google-cloud-go/releases/tag/iam%2Fv1.7.0) (2026-04-02)
+
+## [1.6.0](https://github.com/googleapis/google-cloud-go/releases/tag/iam%2Fv1.6.0) (2026-03-26)
+
+### Features
+
+* update image to us-central1-docker.pkg.dev/cloud-sdk-librarian-prod/images-prod/librarian-go@sha256:f9f9065a893591ad505df3384f409e9d404132d8c83b5d4bcbb8ae1650553b3b ([9a2be95](https://github.com/googleapis/google-cloud-go/commit/9a2be95cffe44aa7e6d68c08fff6d85a3a13a9b7))
+
 ## [1.5.3](https://github.com/googleapis/google-cloud-go/compare/iam/v1.5.2...iam/v1.5.3) (2025-10-08)
 
 
diff --git a/vendor/cloud.google.com/go/iam/README.md b/vendor/cloud.google.com/go/iam/README.md
index 0072cc9e29..5f525c5941 100644
--- a/vendor/cloud.google.com/go/iam/README.md
+++ b/vendor/cloud.google.com/go/iam/README.md
@@ -1,8 +1,8 @@
-# IAM API
+# Identity and Access Management (IAM) API
 
 [![Go Reference](https://pkg.go.dev/badge/cloud.google.com/go/iam.svg)](https://pkg.go.dev/cloud.google.com/go/iam)
 
-Go Client Library for IAM API.
+Go Client Library for Identity and Access Management (IAM) API.
 
 ## Install
 
@@ -19,6 +19,21 @@ However, a `v1+` module may have breaking changes in two scenarios:
 * Packages with `alpha` or `beta` in the import path
 * The GoDoc has an explicit stability disclaimer (for example, for an experimental feature).
 
+### Which package to use?
+
+Generated client library surfaces can be found in packages whose import path
+ends in `.../apivXXX`. The `XXX` could be something like `1` or `2` in the case
+of a stable service backend or may be like `1beta2` or `2beta` in the case of a
+more experimental service backend. Because of this fact, a given module can have
+multiple clients for different service backends. In these cases it is generally
+recommended to use clients with stable service backends, with import suffixes like
+`apiv1`, unless you need to use features that are only present in a beta backend
+or there is not yet a stable backend available.
+
+## Google Cloud Samples
+
+To browse ready to use code samples check [Google Cloud Samples](https://cloud.google.com/docs/samples?l=go).
+
 ## Go Version Support
 
 See the [Go Versions Supported](https://github.com/googleapis/google-cloud-go#go-versions-supported)
diff --git a/vendor/cloud.google.com/go/iam/apiv1/iampb/iam_policy.pb.go b/vendor/cloud.google.com/go/iam/apiv1/iampb/iam_policy.pb.go
index 51a944cfa4..e6dc60ff19 100644
--- a/vendor/cloud.google.com/go/iam/apiv1/iampb/iam_policy.pb.go
+++ b/vendor/cloud.google.com/go/iam/apiv1/iampb/iam_policy.pb.go
@@ -14,19 +14,21 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.35.2
+// 	protoc-gen-go v1.36.11
 // 	protoc        v4.25.7
 // source: google/iam/v1/iam_policy.proto
 
 package iampb
 
 import (
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+
 	_ "google.golang.org/genproto/googleapis/api/annotations"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	fieldmaskpb "google.golang.org/protobuf/types/known/fieldmaskpb"
-	reflect "reflect"
-	sync "sync"
 )
 
 const (
@@ -38,10 +40,7 @@ const (
 
 // Request message for `SetIamPolicy` method.
 type SetIamPolicyRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// REQUIRED: The resource for which the policy is being specified.
 	// See the operation documentation for the appropriate value for this field.
 	Resource string `protobuf:"bytes,1,opt,name=resource,proto3" json:"resource,omitempty"`
@@ -55,7 +54,9 @@ type SetIamPolicyRequest struct {
 	// following default mask is used:
 	//
 	// `paths: "bindings, etag"`
-	UpdateMask *fieldmaskpb.FieldMask `protobuf:"bytes,3,opt,name=update_mask,json=updateMask,proto3" json:"update_mask,omitempty"`
+	UpdateMask    *fieldmaskpb.FieldMask `protobuf:"bytes,3,opt,name=update_mask,json=updateMask,proto3" json:"update_mask,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *SetIamPolicyRequest) Reset() {
@@ -111,16 +112,15 @@ func (x *SetIamPolicyRequest) GetUpdateMask() *fieldmaskpb.FieldMask {
 
 // Request message for `GetIamPolicy` method.
 type GetIamPolicyRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// REQUIRED: The resource for which the policy is being requested.
 	// See the operation documentation for the appropriate value for this field.
 	Resource string `protobuf:"bytes,1,opt,name=resource,proto3" json:"resource,omitempty"`
 	// OPTIONAL: A `GetPolicyOptions` object for specifying options to
 	// `GetIamPolicy`.
-	Options *GetPolicyOptions `protobuf:"bytes,2,opt,name=options,proto3" json:"options,omitempty"`
+	Options       *GetPolicyOptions `protobuf:"bytes,2,opt,name=options,proto3" json:"options,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *GetIamPolicyRequest) Reset() {
@@ -169,10 +169,7 @@ func (x *GetIamPolicyRequest) GetOptions() *GetPolicyOptions {
 
 // Request message for `TestIamPermissions` method.
 type TestIamPermissionsRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// REQUIRED: The resource for which the policy detail is being requested.
 	// See the operation documentation for the appropriate value for this field.
 	Resource string `protobuf:"bytes,1,opt,name=resource,proto3" json:"resource,omitempty"`
@@ -180,7 +177,9 @@ type TestIamPermissionsRequest struct {
 	// wildcards (such as '*' or 'storage.*') are not allowed. For more
 	// information see
 	// [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).
-	Permissions []string `protobuf:"bytes,2,rep,name=permissions,proto3" json:"permissions,omitempty"`
+	Permissions   []string `protobuf:"bytes,2,rep,name=permissions,proto3" json:"permissions,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *TestIamPermissionsRequest) Reset() {
@@ -229,13 +228,12 @@ func (x *TestIamPermissionsRequest) GetPermissions() []string {
 
 // Response message for `TestIamPermissions` method.
 type TestIamPermissionsResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// A subset of `TestPermissionsRequest.permissions` that the caller is
 	// allowed.
-	Permissions []string `protobuf:"bytes,1,rep,name=permissions,proto3" json:"permissions,omitempty"`
+	Permissions   []string `protobuf:"bytes,1,rep,name=permissions,proto3" json:"permissions,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *TestIamPermissionsResponse) Reset() {
@@ -277,98 +275,39 @@ func (x *TestIamPermissionsResponse) GetPermissions() []string {
 
 var File_google_iam_v1_iam_policy_proto protoreflect.FileDescriptor
 
-var file_google_iam_v1_iam_policy_proto_rawDesc = []byte{
-	0x0a, 0x1e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x69, 0x61, 0x6d, 0x2f, 0x76, 0x31, 0x2f,
-	0x69, 0x61, 0x6d, 0x5f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x12, 0x0d, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x69, 0x61, 0x6d, 0x2e, 0x76, 0x31, 0x1a,
-	0x1c, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x61, 0x6e, 0x6e, 0x6f,
-	0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x17, 0x67,
-	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x61,
-	0x70, 0x69, 0x2f, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x5f, 0x62, 0x65, 0x68, 0x61, 0x76, 0x69, 0x6f,
-	0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x19, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f,
-	0x61, 0x70, 0x69, 0x2f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x1a, 0x1b, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x69, 0x61, 0x6d, 0x2f, 0x76,
-	0x31, 0x2f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a,
-	0x1a, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x69, 0x61, 0x6d, 0x2f, 0x76, 0x31, 0x2f, 0x70,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x20, 0x67, 0x6f, 0x6f,
-	0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x66, 0x69, 0x65,
-	0x6c, 0x64, 0x5f, 0x6d, 0x61, 0x73, 0x6b, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xad, 0x01,
-	0x0a, 0x13, 0x53, 0x65, 0x74, 0x49, 0x61, 0x6d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x25, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x09, 0xe0, 0x41, 0x02, 0xfa, 0x41, 0x03, 0x0a,
-	0x01, 0x2a, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x32, 0x0a, 0x06,
-	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x67,
-	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x69, 0x61, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x42, 0x03, 0xe0, 0x41, 0x02, 0x52, 0x06, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
-	0x12, 0x3b, 0x0a, 0x0b, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x6d, 0x61, 0x73, 0x6b, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x4d, 0x61, 0x73,
-	0x6b, 0x52, 0x0a, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4d, 0x61, 0x73, 0x6b, 0x22, 0x77, 0x0a,
-	0x13, 0x47, 0x65, 0x74, 0x49, 0x61, 0x6d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x12, 0x25, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x09, 0xe0, 0x41, 0x02, 0xfa, 0x41, 0x03, 0x0a, 0x01,
-	0x2a, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x39, 0x0a, 0x07, 0x6f,
-	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x67,
-	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x69, 0x61, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74,
-	0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f,
-	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x22, 0x69, 0x0a, 0x19, 0x54, 0x65, 0x73, 0x74, 0x49, 0x61,
-	0x6d, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x12, 0x25, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x09, 0xe0, 0x41, 0x02, 0xfa, 0x41, 0x03, 0x0a, 0x01, 0x2a,
-	0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x25, 0x0a, 0x0b, 0x70, 0x65,
-	0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x42,
-	0x03, 0xe0, 0x41, 0x02, 0x52, 0x0b, 0x70, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e,
-	0x73, 0x22, 0x3e, 0x0a, 0x1a, 0x54, 0x65, 0x73, 0x74, 0x49, 0x61, 0x6d, 0x50, 0x65, 0x72, 0x6d,
-	0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
-	0x20, 0x0a, 0x0b, 0x70, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x01,
-	0x20, 0x03, 0x28, 0x09, 0x52, 0x0b, 0x70, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e,
-	0x73, 0x32, 0xb4, 0x03, 0x0a, 0x09, 0x49, 0x41, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12,
-	0x74, 0x0a, 0x0c, 0x53, 0x65, 0x74, 0x49, 0x61, 0x6d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12,
-	0x22, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x69, 0x61, 0x6d, 0x2e, 0x76, 0x31, 0x2e,
-	0x53, 0x65, 0x74, 0x49, 0x61, 0x6d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x1a, 0x15, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x69, 0x61, 0x6d,
-	0x2e, 0x76, 0x31, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x22, 0x29, 0x82, 0xd3, 0xe4, 0x93,
-	0x02, 0x23, 0x3a, 0x01, 0x2a, 0x22, 0x1e, 0x2f, 0x76, 0x31, 0x2f, 0x7b, 0x72, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x3d, 0x2a, 0x2a, 0x7d, 0x3a, 0x73, 0x65, 0x74, 0x49, 0x61, 0x6d, 0x50,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12, 0x74, 0x0a, 0x0c, 0x47, 0x65, 0x74, 0x49, 0x61, 0x6d, 0x50,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12, 0x22, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x69,
-	0x61, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x49, 0x61, 0x6d, 0x50, 0x6f, 0x6c, 0x69,
-	0x63, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x15, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
-	0x6c, 0x65, 0x2e, 0x69, 0x61, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
-	0x22, 0x29, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x23, 0x3a, 0x01, 0x2a, 0x22, 0x1e, 0x2f, 0x76, 0x31,
-	0x2f, 0x7b, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x3d, 0x2a, 0x2a, 0x7d, 0x3a, 0x67,
-	0x65, 0x74, 0x49, 0x61, 0x6d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12, 0x9a, 0x01, 0x0a, 0x12,
-	0x54, 0x65, 0x73, 0x74, 0x49, 0x61, 0x6d, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f,
-	0x6e, 0x73, 0x12, 0x28, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x69, 0x61, 0x6d, 0x2e,
-	0x76, 0x31, 0x2e, 0x54, 0x65, 0x73, 0x74, 0x49, 0x61, 0x6d, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73,
-	0x73, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x29, 0x2e, 0x67,
-	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x69, 0x61, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x65, 0x73,
-	0x74, 0x49, 0x61, 0x6d, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x2f, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x29, 0x3a,
-	0x01, 0x2a, 0x22, 0x24, 0x2f, 0x76, 0x31, 0x2f, 0x7b, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x3d, 0x2a, 0x2a, 0x7d, 0x3a, 0x74, 0x65, 0x73, 0x74, 0x49, 0x61, 0x6d, 0x50, 0x65, 0x72,
-	0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x1a, 0x1e, 0xca, 0x41, 0x1b, 0x69, 0x61, 0x6d,
-	0x2d, 0x6d, 0x65, 0x74, 0x61, 0x2d, 0x61, 0x70, 0x69, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
-	0x61, 0x70, 0x69, 0x73, 0x2e, 0x63, 0x6f, 0x6d, 0x42, 0x7c, 0x0a, 0x11, 0x63, 0x6f, 0x6d, 0x2e,
-	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x69, 0x61, 0x6d, 0x2e, 0x76, 0x31, 0x42, 0x0e, 0x49,
-	0x61, 0x6d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a,
-	0x29, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63, 0x6f,
-	0x6d, 0x2f, 0x67, 0x6f, 0x2f, 0x69, 0x61, 0x6d, 0x2f, 0x61, 0x70, 0x69, 0x76, 0x31, 0x2f, 0x69,
-	0x61, 0x6d, 0x70, 0x62, 0x3b, 0x69, 0x61, 0x6d, 0x70, 0x62, 0xaa, 0x02, 0x13, 0x47, 0x6f, 0x6f,
-	0x67, 0x6c, 0x65, 0x2e, 0x43, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x49, 0x61, 0x6d, 0x2e, 0x56, 0x31,
-	0xca, 0x02, 0x13, 0x47, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x5c, 0x43, 0x6c, 0x6f, 0x75, 0x64, 0x5c,
-	0x49, 0x61, 0x6d, 0x5c, 0x56, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
+const file_google_iam_v1_iam_policy_proto_rawDesc = "" +
+	"\n" +
+	"\x1egoogle/iam/v1/iam_policy.proto\x12\rgoogle.iam.v1\x1a\x1cgoogle/api/annotations.proto\x1a\x17google/api/client.proto\x1a\x1fgoogle/api/field_behavior.proto\x1a\x19google/api/resource.proto\x1a\x1bgoogle/iam/v1/options.proto\x1a\x1agoogle/iam/v1/policy.proto\x1a google/protobuf/field_mask.proto\"\xad\x01\n" +
+	"\x13SetIamPolicyRequest\x12%\n" +
+	"\bresource\x18\x01 \x01(\tB\t\xe0A\x02\xfaA\x03\n" +
+	"\x01*R\bresource\x122\n" +
+	"\x06policy\x18\x02 \x01(\v2\x15.google.iam.v1.PolicyB\x03\xe0A\x02R\x06policy\x12;\n" +
+	"\vupdate_mask\x18\x03 \x01(\v2\x1a.google.protobuf.FieldMaskR\n" +
+	"updateMask\"w\n" +
+	"\x13GetIamPolicyRequest\x12%\n" +
+	"\bresource\x18\x01 \x01(\tB\t\xe0A\x02\xfaA\x03\n" +
+	"\x01*R\bresource\x129\n" +
+	"\aoptions\x18\x02 \x01(\v2\x1f.google.iam.v1.GetPolicyOptionsR\aoptions\"i\n" +
+	"\x19TestIamPermissionsRequest\x12%\n" +
+	"\bresource\x18\x01 \x01(\tB\t\xe0A\x02\xfaA\x03\n" +
+	"\x01*R\bresource\x12%\n" +
+	"\vpermissions\x18\x02 \x03(\tB\x03\xe0A\x02R\vpermissions\">\n" +
+	"\x1aTestIamPermissionsResponse\x12 \n" +
+	"\vpermissions\x18\x01 \x03(\tR\vpermissions2\xb4\x03\n" +
+	"\tIAMPolicy\x12t\n" +
+	"\fSetIamPolicy\x12\".google.iam.v1.SetIamPolicyRequest\x1a\x15.google.iam.v1.Policy\")\x82\xd3\xe4\x93\x02#:\x01*\"\x1e/v1/{resource=**}:setIamPolicy\x12t\n" +
+	"\fGetIamPolicy\x12\".google.iam.v1.GetIamPolicyRequest\x1a\x15.google.iam.v1.Policy\")\x82\xd3\xe4\x93\x02#:\x01*\"\x1e/v1/{resource=**}:getIamPolicy\x12\x9a\x01\n" +
+	"\x12TestIamPermissions\x12(.google.iam.v1.TestIamPermissionsRequest\x1a).google.iam.v1.TestIamPermissionsResponse\"/\x82\xd3\xe4\x93\x02):\x01*\"$/v1/{resource=**}:testIamPermissions\x1a\x1e\xcaA\x1biam-meta-api.googleapis.comB|\n" +
+	"\x11com.google.iam.v1B\x0eIamPolicyProtoP\x01Z)cloud.google.com/go/iam/apiv1/iampb;iampb\xaa\x02\x13Google.Cloud.Iam.V1\xca\x02\x13Google\\Cloud\\Iam\\V1b\x06proto3"
 
 var (
 	file_google_iam_v1_iam_policy_proto_rawDescOnce sync.Once
-	file_google_iam_v1_iam_policy_proto_rawDescData = file_google_iam_v1_iam_policy_proto_rawDesc
+	file_google_iam_v1_iam_policy_proto_rawDescData []byte
 )
 
 func file_google_iam_v1_iam_policy_proto_rawDescGZIP() []byte {
 	file_google_iam_v1_iam_policy_proto_rawDescOnce.Do(func() {
-		file_google_iam_v1_iam_policy_proto_rawDescData = protoimpl.X.CompressGZIP(file_google_iam_v1_iam_policy_proto_rawDescData)
+		file_google_iam_v1_iam_policy_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_google_iam_v1_iam_policy_proto_rawDesc), len(file_google_iam_v1_iam_policy_proto_rawDesc)))
 	})
 	return file_google_iam_v1_iam_policy_proto_rawDescData
 }
@@ -411,7 +350,7 @@ func file_google_iam_v1_iam_policy_proto_init() {
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_google_iam_v1_iam_policy_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_google_iam_v1_iam_policy_proto_rawDesc), len(file_google_iam_v1_iam_policy_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   4,
 			NumExtensions: 0,
@@ -422,7 +361,6 @@ func file_google_iam_v1_iam_policy_proto_init() {
 		MessageInfos:      file_google_iam_v1_iam_policy_proto_msgTypes,
 	}.Build()
 	File_google_iam_v1_iam_policy_proto = out.File
-	file_google_iam_v1_iam_policy_proto_rawDesc = nil
 	file_google_iam_v1_iam_policy_proto_goTypes = nil
 	file_google_iam_v1_iam_policy_proto_depIdxs = nil
 }
diff --git a/vendor/cloud.google.com/go/iam/apiv1/iampb/iam_policy_grpc.pb.go b/vendor/cloud.google.com/go/iam/apiv1/iampb/iam_policy_grpc.pb.go
index d2d5afeae6..064cb92713 100644
--- a/vendor/cloud.google.com/go/iam/apiv1/iampb/iam_policy_grpc.pb.go
+++ b/vendor/cloud.google.com/go/iam/apiv1/iampb/iam_policy_grpc.pb.go
@@ -22,6 +22,7 @@ package iampb
 
 import (
 	context "context"
+
 	grpc "google.golang.org/grpc"
 	codes "google.golang.org/grpc/codes"
 	status "google.golang.org/grpc/status"
diff --git a/vendor/cloud.google.com/go/iam/apiv1/iampb/options.pb.go b/vendor/cloud.google.com/go/iam/apiv1/iampb/options.pb.go
index 9c7e7b831a..dcd7697048 100644
--- a/vendor/cloud.google.com/go/iam/apiv1/iampb/options.pb.go
+++ b/vendor/cloud.google.com/go/iam/apiv1/iampb/options.pb.go
@@ -14,17 +14,19 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.35.2
+// 	protoc-gen-go v1.36.11
 // 	protoc        v4.25.7
 // source: google/iam/v1/options.proto
 
 package iampb
 
 import (
-	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
-	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
+
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 )
 
 const (
@@ -36,10 +38,7 @@ const (
 
 // Encapsulates settings provided to GetIamPolicy.
 type GetPolicyOptions struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// Optional. The maximum policy version that will be used to format the
 	// policy.
 	//
@@ -59,6 +58,8 @@ type GetPolicyOptions struct {
 	// [IAM
 	// documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
 	RequestedPolicyVersion int32 `protobuf:"varint,1,opt,name=requested_policy_version,json=requestedPolicyVersion,proto3" json:"requested_policy_version,omitempty"`
+	unknownFields          protoimpl.UnknownFields
+	sizeCache              protoimpl.SizeCache
 }
 
 func (x *GetPolicyOptions) Reset() {
@@ -100,34 +101,21 @@ func (x *GetPolicyOptions) GetRequestedPolicyVersion() int32 {
 
 var File_google_iam_v1_options_proto protoreflect.FileDescriptor
 
-var file_google_iam_v1_options_proto_rawDesc = []byte{
-	0x0a, 0x1b, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x69, 0x61, 0x6d, 0x2f, 0x76, 0x31, 0x2f,
-	0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0d, 0x67,
-	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x69, 0x61, 0x6d, 0x2e, 0x76, 0x31, 0x22, 0x4c, 0x0a, 0x10,
-	0x47, 0x65, 0x74, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73,
-	0x12, 0x38, 0x0a, 0x18, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x65, 0x64, 0x5f, 0x70, 0x6f,
-	0x6c, 0x69, 0x63, 0x79, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x05, 0x52, 0x16, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x65, 0x64, 0x50, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x42, 0x7d, 0x0a, 0x11, 0x63, 0x6f,
-	0x6d, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x69, 0x61, 0x6d, 0x2e, 0x76, 0x31, 0x42,
-	0x0c, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a,
-	0x29, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63, 0x6f,
-	0x6d, 0x2f, 0x67, 0x6f, 0x2f, 0x69, 0x61, 0x6d, 0x2f, 0x61, 0x70, 0x69, 0x76, 0x31, 0x2f, 0x69,
-	0x61, 0x6d, 0x70, 0x62, 0x3b, 0x69, 0x61, 0x6d, 0x70, 0x62, 0xf8, 0x01, 0x01, 0xaa, 0x02, 0x13,
-	0x47, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x43, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x49, 0x61, 0x6d,
-	0x2e, 0x56, 0x31, 0xca, 0x02, 0x13, 0x47, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x5c, 0x43, 0x6c, 0x6f,
-	0x75, 0x64, 0x5c, 0x49, 0x61, 0x6d, 0x5c, 0x56, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x33,
-}
+const file_google_iam_v1_options_proto_rawDesc = "" +
+	"\n" +
+	"\x1bgoogle/iam/v1/options.proto\x12\rgoogle.iam.v1\"L\n" +
+	"\x10GetPolicyOptions\x128\n" +
+	"\x18requested_policy_version\x18\x01 \x01(\x05R\x16requestedPolicyVersionB}\n" +
+	"\x11com.google.iam.v1B\fOptionsProtoP\x01Z)cloud.google.com/go/iam/apiv1/iampb;iampb\xf8\x01\x01\xaa\x02\x13Google.Cloud.Iam.V1\xca\x02\x13Google\\Cloud\\Iam\\V1b\x06proto3"
 
 var (
 	file_google_iam_v1_options_proto_rawDescOnce sync.Once
-	file_google_iam_v1_options_proto_rawDescData = file_google_iam_v1_options_proto_rawDesc
+	file_google_iam_v1_options_proto_rawDescData []byte
 )
 
 func file_google_iam_v1_options_proto_rawDescGZIP() []byte {
 	file_google_iam_v1_options_proto_rawDescOnce.Do(func() {
-		file_google_iam_v1_options_proto_rawDescData = protoimpl.X.CompressGZIP(file_google_iam_v1_options_proto_rawDescData)
+		file_google_iam_v1_options_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_google_iam_v1_options_proto_rawDesc), len(file_google_iam_v1_options_proto_rawDesc)))
 	})
 	return file_google_iam_v1_options_proto_rawDescData
 }
@@ -153,7 +141,7 @@ func file_google_iam_v1_options_proto_init() {
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_google_iam_v1_options_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_google_iam_v1_options_proto_rawDesc), len(file_google_iam_v1_options_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   1,
 			NumExtensions: 0,
@@ -164,7 +152,6 @@ func file_google_iam_v1_options_proto_init() {
 		MessageInfos:      file_google_iam_v1_options_proto_msgTypes,
 	}.Build()
 	File_google_iam_v1_options_proto = out.File
-	file_google_iam_v1_options_proto_rawDesc = nil
 	file_google_iam_v1_options_proto_goTypes = nil
 	file_google_iam_v1_options_proto_depIdxs = nil
 }
diff --git a/vendor/cloud.google.com/go/iam/apiv1/iampb/policy.pb.go b/vendor/cloud.google.com/go/iam/apiv1/iampb/policy.pb.go
index 2efacbb063..5c5dec2ff7 100644
--- a/vendor/cloud.google.com/go/iam/apiv1/iampb/policy.pb.go
+++ b/vendor/cloud.google.com/go/iam/apiv1/iampb/policy.pb.go
@@ -14,18 +14,20 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.35.2
+// 	protoc-gen-go v1.36.11
 // 	protoc        v4.25.7
 // source: google/iam/v1/policy.proto
 
 package iampb
 
 import (
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+
 	expr "google.golang.org/genproto/googleapis/type/expr"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	reflect "reflect"
-	sync "sync"
 )
 
 const (
@@ -276,10 +278,7 @@ func (AuditConfigDelta_Action) EnumDescriptor() ([]byte, []int) {
 // For a description of IAM and its features, see the
 // [IAM documentation](https://cloud.google.com/iam/docs/).
 type Policy struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// Specifies the format of the policy.
 	//
 	// Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
@@ -331,7 +330,9 @@ type Policy struct {
 	// whenever you call `setIamPolicy`. If you omit this field, then IAM allows
 	// you to overwrite a version `3` policy with a version `1` policy, and all of
 	// the conditions in the version `3` policy are lost.
-	Etag []byte `protobuf:"bytes,3,opt,name=etag,proto3" json:"etag,omitempty"`
+	Etag          []byte `protobuf:"bytes,3,opt,name=etag,proto3" json:"etag,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Policy) Reset() {
@@ -394,10 +395,7 @@ func (x *Policy) GetEtag() []byte {
 
 // Associates `members`, or principals, with a `role`.
 type Binding struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// Role that is assigned to the list of `members`, or principals.
 	// For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
 	Role string `protobuf:"bytes,1,opt,name=role,proto3" json:"role,omitempty"`
@@ -454,7 +452,9 @@ type Binding struct {
 	// To learn which resources support conditions in their IAM policies, see the
 	// [IAM
 	// documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
-	Condition *expr.Expr `protobuf:"bytes,3,opt,name=condition,proto3" json:"condition,omitempty"`
+	Condition     *expr.Expr `protobuf:"bytes,3,opt,name=condition,proto3" json:"condition,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Binding) Reset() {
@@ -560,16 +560,15 @@ func (x *Binding) GetCondition() *expr.Expr {
 // logging. It also exempts `jose@example.com` from DATA_READ logging, and
 // `aliya@example.com` from DATA_WRITE logging.
 type AuditConfig struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// Specifies a service that will be enabled for audit logging.
 	// For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.
 	// `allServices` is a special value that covers all services.
 	Service string `protobuf:"bytes,1,opt,name=service,proto3" json:"service,omitempty"`
 	// The configuration for logging of each type of permission.
 	AuditLogConfigs []*AuditLogConfig `protobuf:"bytes,3,rep,name=audit_log_configs,json=auditLogConfigs,proto3" json:"audit_log_configs,omitempty"`
+	unknownFields   protoimpl.UnknownFields
+	sizeCache       protoimpl.SizeCache
 }
 
 func (x *AuditConfig) Reset() {
@@ -636,10 +635,7 @@ func (x *AuditConfig) GetAuditLogConfigs() []*AuditLogConfig {
 // This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting
 // jose@example.com from DATA_READ logging.
 type AuditLogConfig struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// The log type that this config enables.
 	LogType AuditLogConfig_LogType `protobuf:"varint,1,opt,name=log_type,json=logType,proto3,enum=google.iam.v1.AuditLogConfig_LogType" json:"log_type,omitempty"`
 	// Specifies the identities that do not cause logging for this type of
@@ -647,6 +643,8 @@ type AuditLogConfig struct {
 	// Follows the same format of
 	// [Binding.members][google.iam.v1.Binding.members].
 	ExemptedMembers []string `protobuf:"bytes,2,rep,name=exempted_members,json=exemptedMembers,proto3" json:"exempted_members,omitempty"`
+	unknownFields   protoimpl.UnknownFields
+	sizeCache       protoimpl.SizeCache
 }
 
 func (x *AuditLogConfig) Reset() {
@@ -695,14 +693,13 @@ func (x *AuditLogConfig) GetExemptedMembers() []string {
 
 // The difference delta between two policies.
 type PolicyDelta struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// The delta for Bindings between two policies.
 	BindingDeltas []*BindingDelta `protobuf:"bytes,1,rep,name=binding_deltas,json=bindingDeltas,proto3" json:"binding_deltas,omitempty"`
 	// The delta for AuditConfigs between two policies.
 	AuditConfigDeltas []*AuditConfigDelta `protobuf:"bytes,2,rep,name=audit_config_deltas,json=auditConfigDeltas,proto3" json:"audit_config_deltas,omitempty"`
+	unknownFields     protoimpl.UnknownFields
+	sizeCache         protoimpl.SizeCache
 }
 
 func (x *PolicyDelta) Reset() {
@@ -752,10 +749,7 @@ func (x *PolicyDelta) GetAuditConfigDeltas() []*AuditConfigDelta {
 // One delta entry for Binding. Each individual change (only one member in each
 // entry) to a binding will be a separate entry.
 type BindingDelta struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// The action that was performed on a Binding.
 	// Required
 	Action BindingDelta_Action `protobuf:"varint,1,opt,name=action,proto3,enum=google.iam.v1.BindingDelta_Action" json:"action,omitempty"`
@@ -768,7 +762,9 @@ type BindingDelta struct {
 	// Required
 	Member string `protobuf:"bytes,3,opt,name=member,proto3" json:"member,omitempty"`
 	// The condition that is associated with this binding.
-	Condition *expr.Expr `protobuf:"bytes,4,opt,name=condition,proto3" json:"condition,omitempty"`
+	Condition     *expr.Expr `protobuf:"bytes,4,opt,name=condition,proto3" json:"condition,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *BindingDelta) Reset() {
@@ -832,10 +828,7 @@ func (x *BindingDelta) GetCondition() *expr.Expr {
 // One delta entry for AuditConfig. Each individual change (only one
 // exempted_member in each entry) to a AuditConfig will be a separate entry.
 type AuditConfigDelta struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// The action that was performed on an audit configuration in a policy.
 	// Required
 	Action AuditConfigDelta_Action `protobuf:"varint,1,opt,name=action,proto3,enum=google.iam.v1.AuditConfigDelta_Action" json:"action,omitempty"`
@@ -851,7 +844,9 @@ type AuditConfigDelta struct {
 	// Specifies the log_type that was be enabled. ADMIN_ACTIVITY is always
 	// enabled, and cannot be configured.
 	// Required
-	LogType string `protobuf:"bytes,4,opt,name=log_type,json=logType,proto3" json:"log_type,omitempty"`
+	LogType       string `protobuf:"bytes,4,opt,name=log_type,json=logType,proto3" json:"log_type,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *AuditConfigDelta) Reset() {
@@ -914,107 +909,64 @@ func (x *AuditConfigDelta) GetLogType() string {
 
 var File_google_iam_v1_policy_proto protoreflect.FileDescriptor
 
-var file_google_iam_v1_policy_proto_rawDesc = []byte{
-	0x0a, 0x1a, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x69, 0x61, 0x6d, 0x2f, 0x76, 0x31, 0x2f,
-	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0d, 0x67, 0x6f,
-	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x69, 0x61, 0x6d, 0x2e, 0x76, 0x31, 0x1a, 0x16, 0x67, 0x6f, 0x6f,
-	0x67, 0x6c, 0x65, 0x2f, 0x74, 0x79, 0x70, 0x65, 0x2f, 0x65, 0x78, 0x70, 0x72, 0x2e, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x22, 0xab, 0x01, 0x0a, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12, 0x18,
-	0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x05, 0x52,
-	0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x32, 0x0a, 0x08, 0x62, 0x69, 0x6e, 0x64,
-	0x69, 0x6e, 0x67, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x67, 0x6f, 0x6f,
-	0x67, 0x6c, 0x65, 0x2e, 0x69, 0x61, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x42, 0x69, 0x6e, 0x64, 0x69,
-	0x6e, 0x67, 0x52, 0x08, 0x62, 0x69, 0x6e, 0x64, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x3f, 0x0a, 0x0d,
-	0x61, 0x75, 0x64, 0x69, 0x74, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x73, 0x18, 0x06, 0x20,
-	0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x69, 0x61, 0x6d,
-	0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x64, 0x69, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52,
-	0x0c, 0x61, 0x75, 0x64, 0x69, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x73, 0x12, 0x12, 0x0a,
-	0x04, 0x65, 0x74, 0x61, 0x67, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x65, 0x74, 0x61,
-	0x67, 0x22, 0x68, 0x0a, 0x07, 0x42, 0x69, 0x6e, 0x64, 0x69, 0x6e, 0x67, 0x12, 0x12, 0x0a, 0x04,
-	0x72, 0x6f, 0x6c, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x72, 0x6f, 0x6c, 0x65,
-	0x12, 0x18, 0x0a, 0x07, 0x6d, 0x65, 0x6d, 0x62, 0x65, 0x72, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28,
-	0x09, 0x52, 0x07, 0x6d, 0x65, 0x6d, 0x62, 0x65, 0x72, 0x73, 0x12, 0x2f, 0x0a, 0x09, 0x63, 0x6f,
-	0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x11, 0x2e,
-	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x74, 0x79, 0x70, 0x65, 0x2e, 0x45, 0x78, 0x70, 0x72,
-	0x52, 0x09, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x72, 0x0a, 0x0b, 0x41,
-	0x75, 0x64, 0x69, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x18, 0x0a, 0x07, 0x73, 0x65,
-	0x72, 0x76, 0x69, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x73, 0x65, 0x72,
-	0x76, 0x69, 0x63, 0x65, 0x12, 0x49, 0x0a, 0x11, 0x61, 0x75, 0x64, 0x69, 0x74, 0x5f, 0x6c, 0x6f,
-	0x67, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32,
-	0x1d, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x69, 0x61, 0x6d, 0x2e, 0x76, 0x31, 0x2e,
-	0x41, 0x75, 0x64, 0x69, 0x74, 0x4c, 0x6f, 0x67, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0f,
-	0x61, 0x75, 0x64, 0x69, 0x74, 0x4c, 0x6f, 0x67, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x73, 0x22,
-	0xd1, 0x01, 0x0a, 0x0e, 0x41, 0x75, 0x64, 0x69, 0x74, 0x4c, 0x6f, 0x67, 0x43, 0x6f, 0x6e, 0x66,
-	0x69, 0x67, 0x12, 0x40, 0x0a, 0x08, 0x6c, 0x6f, 0x67, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x0e, 0x32, 0x25, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x69, 0x61,
-	0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x64, 0x69, 0x74, 0x4c, 0x6f, 0x67, 0x43, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x2e, 0x4c, 0x6f, 0x67, 0x54, 0x79, 0x70, 0x65, 0x52, 0x07, 0x6c, 0x6f, 0x67,
-	0x54, 0x79, 0x70, 0x65, 0x12, 0x29, 0x0a, 0x10, 0x65, 0x78, 0x65, 0x6d, 0x70, 0x74, 0x65, 0x64,
-	0x5f, 0x6d, 0x65, 0x6d, 0x62, 0x65, 0x72, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0f,
-	0x65, 0x78, 0x65, 0x6d, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x6d, 0x62, 0x65, 0x72, 0x73, 0x22,
-	0x52, 0x0a, 0x07, 0x4c, 0x6f, 0x67, 0x54, 0x79, 0x70, 0x65, 0x12, 0x18, 0x0a, 0x14, 0x4c, 0x4f,
-	0x47, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49,
-	0x45, 0x44, 0x10, 0x00, 0x12, 0x0e, 0x0a, 0x0a, 0x41, 0x44, 0x4d, 0x49, 0x4e, 0x5f, 0x52, 0x45,
-	0x41, 0x44, 0x10, 0x01, 0x12, 0x0e, 0x0a, 0x0a, 0x44, 0x41, 0x54, 0x41, 0x5f, 0x57, 0x52, 0x49,
-	0x54, 0x45, 0x10, 0x02, 0x12, 0x0d, 0x0a, 0x09, 0x44, 0x41, 0x54, 0x41, 0x5f, 0x52, 0x45, 0x41,
-	0x44, 0x10, 0x03, 0x22, 0xa2, 0x01, 0x0a, 0x0b, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x44, 0x65,
-	0x6c, 0x74, 0x61, 0x12, 0x42, 0x0a, 0x0e, 0x62, 0x69, 0x6e, 0x64, 0x69, 0x6e, 0x67, 0x5f, 0x64,
-	0x65, 0x6c, 0x74, 0x61, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x67, 0x6f,
-	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x69, 0x61, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x42, 0x69, 0x6e, 0x64,
-	0x69, 0x6e, 0x67, 0x44, 0x65, 0x6c, 0x74, 0x61, 0x52, 0x0d, 0x62, 0x69, 0x6e, 0x64, 0x69, 0x6e,
-	0x67, 0x44, 0x65, 0x6c, 0x74, 0x61, 0x73, 0x12, 0x4f, 0x0a, 0x13, 0x61, 0x75, 0x64, 0x69, 0x74,
-	0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x5f, 0x64, 0x65, 0x6c, 0x74, 0x61, 0x73, 0x18, 0x02,
-	0x20, 0x03, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x69, 0x61,
-	0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x64, 0x69, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x44, 0x65, 0x6c, 0x74, 0x61, 0x52, 0x11, 0x61, 0x75, 0x64, 0x69, 0x74, 0x43, 0x6f, 0x6e, 0x66,
-	0x69, 0x67, 0x44, 0x65, 0x6c, 0x74, 0x61, 0x73, 0x22, 0xde, 0x01, 0x0a, 0x0c, 0x42, 0x69, 0x6e,
-	0x64, 0x69, 0x6e, 0x67, 0x44, 0x65, 0x6c, 0x74, 0x61, 0x12, 0x3a, 0x0a, 0x06, 0x61, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x22, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
-	0x6c, 0x65, 0x2e, 0x69, 0x61, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x42, 0x69, 0x6e, 0x64, 0x69, 0x6e,
-	0x67, 0x44, 0x65, 0x6c, 0x74, 0x61, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x72, 0x6f, 0x6c, 0x65, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x04, 0x72, 0x6f, 0x6c, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x6d, 0x65, 0x6d,
-	0x62, 0x65, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x6d, 0x65, 0x6d, 0x62, 0x65,
-	0x72, 0x12, 0x2f, 0x0a, 0x09, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x04,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x74, 0x79,
-	0x70, 0x65, 0x2e, 0x45, 0x78, 0x70, 0x72, 0x52, 0x09, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69,
-	0x6f, 0x6e, 0x22, 0x35, 0x0a, 0x06, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x16, 0x0a, 0x12,
-	0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49,
-	0x45, 0x44, 0x10, 0x00, 0x12, 0x07, 0x0a, 0x03, 0x41, 0x44, 0x44, 0x10, 0x01, 0x12, 0x0a, 0x0a,
-	0x06, 0x52, 0x45, 0x4d, 0x4f, 0x56, 0x45, 0x10, 0x02, 0x22, 0xe7, 0x01, 0x0a, 0x10, 0x41, 0x75,
-	0x64, 0x69, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x44, 0x65, 0x6c, 0x74, 0x61, 0x12, 0x3e,
-	0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x26,
-	0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x69, 0x61, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x41,
-	0x75, 0x64, 0x69, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x44, 0x65, 0x6c, 0x74, 0x61, 0x2e,
-	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x18,
-	0x0a, 0x07, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x07, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x27, 0x0a, 0x0f, 0x65, 0x78, 0x65, 0x6d,
-	0x70, 0x74, 0x65, 0x64, 0x5f, 0x6d, 0x65, 0x6d, 0x62, 0x65, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x0e, 0x65, 0x78, 0x65, 0x6d, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x6d, 0x62, 0x65,
-	0x72, 0x12, 0x19, 0x0a, 0x08, 0x6c, 0x6f, 0x67, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x04, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x07, 0x6c, 0x6f, 0x67, 0x54, 0x79, 0x70, 0x65, 0x22, 0x35, 0x0a, 0x06,
-	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x16, 0x0a, 0x12, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e,
-	0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x07,
-	0x0a, 0x03, 0x41, 0x44, 0x44, 0x10, 0x01, 0x12, 0x0a, 0x0a, 0x06, 0x52, 0x45, 0x4d, 0x4f, 0x56,
-	0x45, 0x10, 0x02, 0x42, 0x7c, 0x0a, 0x11, 0x63, 0x6f, 0x6d, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
-	0x65, 0x2e, 0x69, 0x61, 0x6d, 0x2e, 0x76, 0x31, 0x42, 0x0b, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
-	0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x29, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x67,
-	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x6f, 0x2f, 0x69, 0x61, 0x6d,
-	0x2f, 0x61, 0x70, 0x69, 0x76, 0x31, 0x2f, 0x69, 0x61, 0x6d, 0x70, 0x62, 0x3b, 0x69, 0x61, 0x6d,
-	0x70, 0x62, 0xf8, 0x01, 0x01, 0xaa, 0x02, 0x13, 0x47, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x43,
-	0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x49, 0x61, 0x6d, 0x2e, 0x56, 0x31, 0xca, 0x02, 0x13, 0x47, 0x6f,
-	0x6f, 0x67, 0x6c, 0x65, 0x5c, 0x43, 0x6c, 0x6f, 0x75, 0x64, 0x5c, 0x49, 0x61, 0x6d, 0x5c, 0x56,
-	0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
+const file_google_iam_v1_policy_proto_rawDesc = "" +
+	"\n" +
+	"\x1agoogle/iam/v1/policy.proto\x12\rgoogle.iam.v1\x1a\x16google/type/expr.proto\"\xab\x01\n" +
+	"\x06Policy\x12\x18\n" +
+	"\aversion\x18\x01 \x01(\x05R\aversion\x122\n" +
+	"\bbindings\x18\x04 \x03(\v2\x16.google.iam.v1.BindingR\bbindings\x12?\n" +
+	"\raudit_configs\x18\x06 \x03(\v2\x1a.google.iam.v1.AuditConfigR\fauditConfigs\x12\x12\n" +
+	"\x04etag\x18\x03 \x01(\fR\x04etag\"h\n" +
+	"\aBinding\x12\x12\n" +
+	"\x04role\x18\x01 \x01(\tR\x04role\x12\x18\n" +
+	"\amembers\x18\x02 \x03(\tR\amembers\x12/\n" +
+	"\tcondition\x18\x03 \x01(\v2\x11.google.type.ExprR\tcondition\"r\n" +
+	"\vAuditConfig\x12\x18\n" +
+	"\aservice\x18\x01 \x01(\tR\aservice\x12I\n" +
+	"\x11audit_log_configs\x18\x03 \x03(\v2\x1d.google.iam.v1.AuditLogConfigR\x0fauditLogConfigs\"\xd1\x01\n" +
+	"\x0eAuditLogConfig\x12@\n" +
+	"\blog_type\x18\x01 \x01(\x0e2%.google.iam.v1.AuditLogConfig.LogTypeR\alogType\x12)\n" +
+	"\x10exempted_members\x18\x02 \x03(\tR\x0fexemptedMembers\"R\n" +
+	"\aLogType\x12\x18\n" +
+	"\x14LOG_TYPE_UNSPECIFIED\x10\x00\x12\x0e\n" +
+	"\n" +
+	"ADMIN_READ\x10\x01\x12\x0e\n" +
+	"\n" +
+	"DATA_WRITE\x10\x02\x12\r\n" +
+	"\tDATA_READ\x10\x03\"\xa2\x01\n" +
+	"\vPolicyDelta\x12B\n" +
+	"\x0ebinding_deltas\x18\x01 \x03(\v2\x1b.google.iam.v1.BindingDeltaR\rbindingDeltas\x12O\n" +
+	"\x13audit_config_deltas\x18\x02 \x03(\v2\x1f.google.iam.v1.AuditConfigDeltaR\x11auditConfigDeltas\"\xde\x01\n" +
+	"\fBindingDelta\x12:\n" +
+	"\x06action\x18\x01 \x01(\x0e2\".google.iam.v1.BindingDelta.ActionR\x06action\x12\x12\n" +
+	"\x04role\x18\x02 \x01(\tR\x04role\x12\x16\n" +
+	"\x06member\x18\x03 \x01(\tR\x06member\x12/\n" +
+	"\tcondition\x18\x04 \x01(\v2\x11.google.type.ExprR\tcondition\"5\n" +
+	"\x06Action\x12\x16\n" +
+	"\x12ACTION_UNSPECIFIED\x10\x00\x12\a\n" +
+	"\x03ADD\x10\x01\x12\n" +
+	"\n" +
+	"\x06REMOVE\x10\x02\"\xe7\x01\n" +
+	"\x10AuditConfigDelta\x12>\n" +
+	"\x06action\x18\x01 \x01(\x0e2&.google.iam.v1.AuditConfigDelta.ActionR\x06action\x12\x18\n" +
+	"\aservice\x18\x02 \x01(\tR\aservice\x12'\n" +
+	"\x0fexempted_member\x18\x03 \x01(\tR\x0eexemptedMember\x12\x19\n" +
+	"\blog_type\x18\x04 \x01(\tR\alogType\"5\n" +
+	"\x06Action\x12\x16\n" +
+	"\x12ACTION_UNSPECIFIED\x10\x00\x12\a\n" +
+	"\x03ADD\x10\x01\x12\n" +
+	"\n" +
+	"\x06REMOVE\x10\x02B|\n" +
+	"\x11com.google.iam.v1B\vPolicyProtoP\x01Z)cloud.google.com/go/iam/apiv1/iampb;iampb\xf8\x01\x01\xaa\x02\x13Google.Cloud.Iam.V1\xca\x02\x13Google\\Cloud\\Iam\\V1b\x06proto3"
 
 var (
 	file_google_iam_v1_policy_proto_rawDescOnce sync.Once
-	file_google_iam_v1_policy_proto_rawDescData = file_google_iam_v1_policy_proto_rawDesc
+	file_google_iam_v1_policy_proto_rawDescData []byte
 )
 
 func file_google_iam_v1_policy_proto_rawDescGZIP() []byte {
 	file_google_iam_v1_policy_proto_rawDescOnce.Do(func() {
-		file_google_iam_v1_policy_proto_rawDescData = protoimpl.X.CompressGZIP(file_google_iam_v1_policy_proto_rawDescData)
+		file_google_iam_v1_policy_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_google_iam_v1_policy_proto_rawDesc), len(file_google_iam_v1_policy_proto_rawDesc)))
 	})
 	return file_google_iam_v1_policy_proto_rawDescData
 }
@@ -1061,7 +1013,7 @@ func file_google_iam_v1_policy_proto_init() {
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_google_iam_v1_policy_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_google_iam_v1_policy_proto_rawDesc), len(file_google_iam_v1_policy_proto_rawDesc)),
 			NumEnums:      3,
 			NumMessages:   7,
 			NumExtensions: 0,
@@ -1073,7 +1025,6 @@ func file_google_iam_v1_policy_proto_init() {
 		MessageInfos:      file_google_iam_v1_policy_proto_msgTypes,
 	}.Build()
 	File_google_iam_v1_policy_proto = out.File
-	file_google_iam_v1_policy_proto_rawDesc = nil
 	file_google_iam_v1_policy_proto_goTypes = nil
 	file_google_iam_v1_policy_proto_depIdxs = nil
 }
diff --git a/vendor/cloud.google.com/go/iam/apiv1/iampb/resource_policy_member.pb.go b/vendor/cloud.google.com/go/iam/apiv1/iampb/resource_policy_member.pb.go
index c2b0f7a5bb..ef86d278b5 100644
--- a/vendor/cloud.google.com/go/iam/apiv1/iampb/resource_policy_member.pb.go
+++ b/vendor/cloud.google.com/go/iam/apiv1/iampb/resource_policy_member.pb.go
@@ -14,18 +14,20 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.35.2
+// 	protoc-gen-go v1.36.11
 // 	protoc        v4.25.7
 // source: google/iam/v1/resource_policy_member.proto
 
 package iampb
 
 import (
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+
 	_ "google.golang.org/genproto/googleapis/api/annotations"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	reflect "reflect"
-	sync "sync"
 )
 
 const (
@@ -38,10 +40,7 @@ const (
 // Output-only policy member strings of a Google Cloud resource's built-in
 // identity.
 type ResourcePolicyMember struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// IAM policy binding member referring to a Google Cloud resource by
 	// user-assigned name (https://google.aip.dev/122). If a resource is deleted
 	// and recreated with the same name, the binding will be applicable to the new
@@ -58,6 +57,8 @@ type ResourcePolicyMember struct {
 	// Example:
 	// `principal://parametermanager.googleapis.com/projects/12345/uid/locations/us-central1-a/parameters/a918fed5`
 	IamPolicyUidPrincipal string `protobuf:"bytes,2,opt,name=iam_policy_uid_principal,json=iamPolicyUidPrincipal,proto3" json:"iam_policy_uid_principal,omitempty"`
+	unknownFields         protoimpl.UnknownFields
+	sizeCache             protoimpl.SizeCache
 }
 
 func (x *ResourcePolicyMember) Reset() {
@@ -106,42 +107,22 @@ func (x *ResourcePolicyMember) GetIamPolicyUidPrincipal() string {
 
 var File_google_iam_v1_resource_policy_member_proto protoreflect.FileDescriptor
 
-var file_google_iam_v1_resource_policy_member_proto_rawDesc = []byte{
-	0x0a, 0x2a, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x69, 0x61, 0x6d, 0x2f, 0x76, 0x31, 0x2f,
-	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5f,
-	0x6d, 0x65, 0x6d, 0x62, 0x65, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0d, 0x67, 0x6f,
-	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x69, 0x61, 0x6d, 0x2e, 0x76, 0x31, 0x1a, 0x1f, 0x67, 0x6f, 0x6f,
-	0x67, 0x6c, 0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x5f, 0x62, 0x65,
-	0x68, 0x61, 0x76, 0x69, 0x6f, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x94, 0x01, 0x0a,
-	0x14, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x4d,
-	0x65, 0x6d, 0x62, 0x65, 0x72, 0x12, 0x3e, 0x0a, 0x19, 0x69, 0x61, 0x6d, 0x5f, 0x70, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x70, 0x72, 0x69, 0x6e, 0x63, 0x69, 0x70,
-	0x61, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x03, 0xe0, 0x41, 0x03, 0x52, 0x16, 0x69,
-	0x61, 0x6d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x4e, 0x61, 0x6d, 0x65, 0x50, 0x72, 0x69, 0x6e,
-	0x63, 0x69, 0x70, 0x61, 0x6c, 0x12, 0x3c, 0x0a, 0x18, 0x69, 0x61, 0x6d, 0x5f, 0x70, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x5f, 0x75, 0x69, 0x64, 0x5f, 0x70, 0x72, 0x69, 0x6e, 0x63, 0x69, 0x70, 0x61,
-	0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x03, 0xe0, 0x41, 0x03, 0x52, 0x15, 0x69, 0x61,
-	0x6d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x55, 0x69, 0x64, 0x50, 0x72, 0x69, 0x6e, 0x63, 0x69,
-	0x70, 0x61, 0x6c, 0x42, 0x87, 0x01, 0x0a, 0x11, 0x63, 0x6f, 0x6d, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
-	0x6c, 0x65, 0x2e, 0x69, 0x61, 0x6d, 0x2e, 0x76, 0x31, 0x42, 0x19, 0x52, 0x65, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x4d, 0x65, 0x6d, 0x62, 0x65, 0x72, 0x50,
-	0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x29, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x67, 0x6f,
-	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x6f, 0x2f, 0x69, 0x61, 0x6d, 0x2f,
-	0x61, 0x70, 0x69, 0x76, 0x31, 0x2f, 0x69, 0x61, 0x6d, 0x70, 0x62, 0x3b, 0x69, 0x61, 0x6d, 0x70,
-	0x62, 0xaa, 0x02, 0x13, 0x47, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x43, 0x6c, 0x6f, 0x75, 0x64,
-	0x2e, 0x49, 0x61, 0x6d, 0x2e, 0x56, 0x31, 0xca, 0x02, 0x13, 0x47, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
-	0x5c, 0x43, 0x6c, 0x6f, 0x75, 0x64, 0x5c, 0x49, 0x61, 0x6d, 0x5c, 0x56, 0x31, 0x62, 0x06, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
+const file_google_iam_v1_resource_policy_member_proto_rawDesc = "" +
+	"\n" +
+	"*google/iam/v1/resource_policy_member.proto\x12\rgoogle.iam.v1\x1a\x1fgoogle/api/field_behavior.proto\"\x94\x01\n" +
+	"\x14ResourcePolicyMember\x12>\n" +
+	"\x19iam_policy_name_principal\x18\x01 \x01(\tB\x03\xe0A\x03R\x16iamPolicyNamePrincipal\x12<\n" +
+	"\x18iam_policy_uid_principal\x18\x02 \x01(\tB\x03\xe0A\x03R\x15iamPolicyUidPrincipalB\x87\x01\n" +
+	"\x11com.google.iam.v1B\x19ResourcePolicyMemberProtoP\x01Z)cloud.google.com/go/iam/apiv1/iampb;iampb\xaa\x02\x13Google.Cloud.Iam.V1\xca\x02\x13Google\\Cloud\\Iam\\V1b\x06proto3"
 
 var (
 	file_google_iam_v1_resource_policy_member_proto_rawDescOnce sync.Once
-	file_google_iam_v1_resource_policy_member_proto_rawDescData = file_google_iam_v1_resource_policy_member_proto_rawDesc
+	file_google_iam_v1_resource_policy_member_proto_rawDescData []byte
 )
 
 func file_google_iam_v1_resource_policy_member_proto_rawDescGZIP() []byte {
 	file_google_iam_v1_resource_policy_member_proto_rawDescOnce.Do(func() {
-		file_google_iam_v1_resource_policy_member_proto_rawDescData = protoimpl.X.CompressGZIP(file_google_iam_v1_resource_policy_member_proto_rawDescData)
+		file_google_iam_v1_resource_policy_member_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_google_iam_v1_resource_policy_member_proto_rawDesc), len(file_google_iam_v1_resource_policy_member_proto_rawDesc)))
 	})
 	return file_google_iam_v1_resource_policy_member_proto_rawDescData
 }
@@ -167,7 +148,7 @@ func file_google_iam_v1_resource_policy_member_proto_init() {
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_google_iam_v1_resource_policy_member_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_google_iam_v1_resource_policy_member_proto_rawDesc), len(file_google_iam_v1_resource_policy_member_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   1,
 			NumExtensions: 0,
@@ -178,7 +159,6 @@ func file_google_iam_v1_resource_policy_member_proto_init() {
 		MessageInfos:      file_google_iam_v1_resource_policy_member_proto_msgTypes,
 	}.Build()
 	File_google_iam_v1_resource_policy_member_proto = out.File
-	file_google_iam_v1_resource_policy_member_proto_rawDesc = nil
 	file_google_iam_v1_resource_policy_member_proto_goTypes = nil
 	file_google_iam_v1_resource_policy_member_proto_depIdxs = nil
 }
diff --git a/vendor/cloud.google.com/go/longrunning/autogen/longrunningpb/operations.pb.go b/vendor/cloud.google.com/go/longrunning/autogen/longrunningpb/operations.pb.go
index cc84c0f14c..3efdc7cfe2 100644
--- a/vendor/cloud.google.com/go/longrunning/autogen/longrunningpb/operations.pb.go
+++ b/vendor/cloud.google.com/go/longrunning/autogen/longrunningpb/operations.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.35.2
+// 	protoc-gen-go v1.36.11
 // 	protoc        v4.25.7
 // source: google/longrunning/operations.proto
 
@@ -23,6 +23,7 @@ package longrunningpb
 import (
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 
 	_ "google.golang.org/genproto/googleapis/api/annotations"
 	status "google.golang.org/genproto/googleapis/rpc/status"
@@ -44,10 +45,7 @@ const (
 // This resource represents a long-running operation that is the result of a
 // network API call.
 type Operation struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// The server-assigned name, which is only unique within the same service that
 	// originally returns it. If you use the default HTTP mapping, the
 	// `name` should be a resource name ending with `operations/{unique_id}`.
@@ -66,11 +64,13 @@ type Operation struct {
 	// If `done` == `true`, exactly one of `error` or `response` can be set.
 	// Some services might not provide the result.
 	//
-	// Types that are assignable to Result:
+	// Types that are valid to be assigned to Result:
 	//
 	//	*Operation_Error
 	//	*Operation_Response
-	Result isOperation_Result `protobuf_oneof:"result"`
+	Result        isOperation_Result `protobuf_oneof:"result"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Operation) Reset() {
@@ -124,23 +124,27 @@ func (x *Operation) GetDone() bool {
 	return false
 }
 
-func (m *Operation) GetResult() isOperation_Result {
-	if m != nil {
-		return m.Result
+func (x *Operation) GetResult() isOperation_Result {
+	if x != nil {
+		return x.Result
 	}
 	return nil
 }
 
 func (x *Operation) GetError() *status.Status {
-	if x, ok := x.GetResult().(*Operation_Error); ok {
-		return x.Error
+	if x != nil {
+		if x, ok := x.Result.(*Operation_Error); ok {
+			return x.Error
+		}
 	}
 	return nil
 }
 
 func (x *Operation) GetResponse() *anypb.Any {
-	if x, ok := x.GetResult().(*Operation_Response); ok {
-		return x.Response
+	if x != nil {
+		if x, ok := x.Result.(*Operation_Response); ok {
+			return x.Response
+		}
 	}
 	return nil
 }
@@ -173,12 +177,11 @@ func (*Operation_Response) isOperation_Result() {}
 // The request message for
 // [Operations.GetOperation][google.longrunning.Operations.GetOperation].
 type GetOperationRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// The name of the operation resource.
-	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Name          string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *GetOperationRequest) Reset() {
@@ -221,10 +224,7 @@ func (x *GetOperationRequest) GetName() string {
 // The request message for
 // [Operations.ListOperations][google.longrunning.Operations.ListOperations].
 type ListOperationsRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// The name of the operation's parent resource.
 	Name string `protobuf:"bytes,4,opt,name=name,proto3" json:"name,omitempty"`
 	// The standard list filter.
@@ -244,6 +244,8 @@ type ListOperationsRequest struct {
 	// `UNIMPLEMENTED` error if set unless explicitly documented otherwise in
 	// service or product specific documentation.
 	ReturnPartialSuccess bool `protobuf:"varint,5,opt,name=return_partial_success,json=returnPartialSuccess,proto3" json:"return_partial_success,omitempty"`
+	unknownFields        protoimpl.UnknownFields
+	sizeCache            protoimpl.SizeCache
 }
 
 func (x *ListOperationsRequest) Reset() {
@@ -314,10 +316,7 @@ func (x *ListOperationsRequest) GetReturnPartialSuccess() bool {
 // The response message for
 // [Operations.ListOperations][google.longrunning.Operations.ListOperations].
 type ListOperationsResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// A list of operations that matches the specified filter in the request.
 	Operations []*Operation `protobuf:"bytes,1,rep,name=operations,proto3" json:"operations,omitempty"`
 	// The standard List next-page token.
@@ -326,7 +325,9 @@ type ListOperationsResponse struct {
 	// `ListOperationsRequest.return_partial_success` and reads across
 	// collections e.g. when attempting to list all resources across all supported
 	// locations.
-	Unreachable []string `protobuf:"bytes,3,rep,name=unreachable,proto3" json:"unreachable,omitempty"`
+	Unreachable   []string `protobuf:"bytes,3,rep,name=unreachable,proto3" json:"unreachable,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *ListOperationsResponse) Reset() {
@@ -383,12 +384,11 @@ func (x *ListOperationsResponse) GetUnreachable() []string {
 // The request message for
 // [Operations.CancelOperation][google.longrunning.Operations.CancelOperation].
 type CancelOperationRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// The name of the operation resource to be cancelled.
-	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Name          string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *CancelOperationRequest) Reset() {
@@ -431,12 +431,11 @@ func (x *CancelOperationRequest) GetName() string {
 // The request message for
 // [Operations.DeleteOperation][google.longrunning.Operations.DeleteOperation].
 type DeleteOperationRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// The name of the operation resource to be deleted.
-	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Name          string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *DeleteOperationRequest) Reset() {
@@ -479,16 +478,15 @@ func (x *DeleteOperationRequest) GetName() string {
 // The request message for
 // [Operations.WaitOperation][google.longrunning.Operations.WaitOperation].
 type WaitOperationRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// The name of the operation resource to wait on.
 	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
 	// The maximum duration to wait before timing out. If left blank, the wait
 	// will be at most the time permitted by the underlying HTTP/RPC protocol.
 	// If RPC context deadline is also specified, the shorter one will be used.
-	Timeout *durationpb.Duration `protobuf:"bytes,2,opt,name=timeout,proto3" json:"timeout,omitempty"`
+	Timeout       *durationpb.Duration `protobuf:"bytes,2,opt,name=timeout,proto3" json:"timeout,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *WaitOperationRequest) Reset() {
@@ -546,10 +544,7 @@ func (x *WaitOperationRequest) GetTimeout() *durationpb.Duration {
 //	  };
 //	}
 type OperationInfo struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// Required. The message name of the primary return type for this
 	// long-running operation.
 	// This type will be used to deserialize the LRO's response.
@@ -566,7 +561,9 @@ type OperationInfo struct {
 	// message name must be used (e.g. `google.protobuf.Struct`).
 	//
 	// Note: Altering this value constitutes a breaking change.
-	MetadataType string `protobuf:"bytes,2,opt,name=metadata_type,json=metadataType,proto3" json:"metadata_type,omitempty"`
+	MetadataType  string `protobuf:"bytes,2,opt,name=metadata_type,json=metadataType,proto3" json:"metadata_type,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *OperationInfo) Reset() {
@@ -639,151 +636,59 @@ var (
 
 var File_google_longrunning_operations_proto protoreflect.FileDescriptor
 
-var file_google_longrunning_operations_proto_rawDesc = []byte{
-	0x0a, 0x23, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x6c, 0x6f, 0x6e, 0x67, 0x72, 0x75, 0x6e,
-	0x6e, 0x69, 0x6e, 0x67, 0x2f, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x12, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6c, 0x6f,
-	0x6e, 0x67, 0x72, 0x75, 0x6e, 0x6e, 0x69, 0x6e, 0x67, 0x1a, 0x1c, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
-	0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x17, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f,
-	0x61, 0x70, 0x69, 0x2f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x66, 0x69, 0x65,
-	0x6c, 0x64, 0x5f, 0x62, 0x65, 0x68, 0x61, 0x76, 0x69, 0x6f, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x1a, 0x19, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
-	0x75, 0x66, 0x2f, 0x61, 0x6e, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x20, 0x67, 0x6f,
-	0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x64, 0x65,
-	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1e,
-	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f,
-	0x64, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1b,
-	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f,
-	0x65, 0x6d, 0x70, 0x74, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x17, 0x67, 0x6f, 0x6f,
-	0x67, 0x6c, 0x65, 0x2f, 0x72, 0x70, 0x63, 0x2f, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x2e, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x22, 0xcf, 0x01, 0x0a, 0x09, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69,
-	0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x30, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
-	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x52, 0x08,
-	0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x12, 0x0a, 0x04, 0x64, 0x6f, 0x6e, 0x65,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x04, 0x64, 0x6f, 0x6e, 0x65, 0x12, 0x2a, 0x0a, 0x05,
-	0x65, 0x72, 0x72, 0x6f, 0x72, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x67, 0x6f,
-	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x72, 0x70, 0x63, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x48,
-	0x00, 0x52, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x12, 0x32, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f,
-	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79,
-	0x48, 0x00, 0x52, 0x08, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x08, 0x0a, 0x06,
-	0x72, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x22, 0x29, 0x0a, 0x13, 0x47, 0x65, 0x74, 0x4f, 0x70, 0x65,
-	0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x12, 0x0a,
-	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d,
-	0x65, 0x22, 0xb5, 0x01, 0x0a, 0x15, 0x4c, 0x69, 0x73, 0x74, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74,
-	0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x6e,
-	0x61, 0x6d, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12,
-	0x16, 0x0a, 0x06, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x06, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x12, 0x1b, 0x0a, 0x09, 0x70, 0x61, 0x67, 0x65, 0x5f,
-	0x73, 0x69, 0x7a, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52, 0x08, 0x70, 0x61, 0x67, 0x65,
-	0x53, 0x69, 0x7a, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x70, 0x61, 0x67, 0x65, 0x5f, 0x74, 0x6f, 0x6b,
-	0x65, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x70, 0x61, 0x67, 0x65, 0x54, 0x6f,
-	0x6b, 0x65, 0x6e, 0x12, 0x34, 0x0a, 0x16, 0x72, 0x65, 0x74, 0x75, 0x72, 0x6e, 0x5f, 0x70, 0x61,
-	0x72, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x18, 0x05, 0x20,
-	0x01, 0x28, 0x08, 0x52, 0x14, 0x72, 0x65, 0x74, 0x75, 0x72, 0x6e, 0x50, 0x61, 0x72, 0x74, 0x69,
-	0x61, 0x6c, 0x53, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x22, 0xa6, 0x01, 0x0a, 0x16, 0x4c, 0x69,
-	0x73, 0x74, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3d, 0x0a, 0x0a, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f,
-	0x6e, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
-	0x65, 0x2e, 0x6c, 0x6f, 0x6e, 0x67, 0x72, 0x75, 0x6e, 0x6e, 0x69, 0x6e, 0x67, 0x2e, 0x4f, 0x70,
-	0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0a, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69,
-	0x6f, 0x6e, 0x73, 0x12, 0x26, 0x0a, 0x0f, 0x6e, 0x65, 0x78, 0x74, 0x5f, 0x70, 0x61, 0x67, 0x65,
-	0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x6e, 0x65,
-	0x78, 0x74, 0x50, 0x61, 0x67, 0x65, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x25, 0x0a, 0x0b, 0x75,
-	0x6e, 0x72, 0x65, 0x61, 0x63, 0x68, 0x61, 0x62, 0x6c, 0x65, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09,
-	0x42, 0x03, 0xe0, 0x41, 0x06, 0x52, 0x0b, 0x75, 0x6e, 0x72, 0x65, 0x61, 0x63, 0x68, 0x61, 0x62,
-	0x6c, 0x65, 0x22, 0x2c, 0x0a, 0x16, 0x43, 0x61, 0x6e, 0x63, 0x65, 0x6c, 0x4f, 0x70, 0x65, 0x72,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x12, 0x0a, 0x04,
-	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65,
-	0x22, 0x2c, 0x0a, 0x16, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74,
-	0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61,
-	0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x22, 0x5f,
-	0x0a, 0x14, 0x57, 0x61, 0x69, 0x74, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x33, 0x0a, 0x07, 0x74, 0x69,
-	0x6d, 0x65, 0x6f, 0x75, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f,
-	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x75,
-	0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x07, 0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x22,
-	0x59, 0x0a, 0x0d, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x6e, 0x66, 0x6f,
-	0x12, 0x23, 0x0a, 0x0d, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x5f, 0x74, 0x79, 0x70,
-	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x54, 0x79, 0x70, 0x65, 0x12, 0x23, 0x0a, 0x0d, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x61, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x6d, 0x65,
-	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x54, 0x79, 0x70, 0x65, 0x32, 0xaa, 0x05, 0x0a, 0x0a, 0x4f,
-	0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x94, 0x01, 0x0a, 0x0e, 0x4c, 0x69,
-	0x73, 0x74, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x29, 0x2e, 0x67,
-	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6c, 0x6f, 0x6e, 0x67, 0x72, 0x75, 0x6e, 0x6e, 0x69, 0x6e,
-	0x67, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
-	0x2e, 0x6c, 0x6f, 0x6e, 0x67, 0x72, 0x75, 0x6e, 0x6e, 0x69, 0x6e, 0x67, 0x2e, 0x4c, 0x69, 0x73,
-	0x74, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x22, 0x2b, 0xda, 0x41, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x2c, 0x66, 0x69, 0x6c,
-	0x74, 0x65, 0x72, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x17, 0x12, 0x15, 0x2f, 0x76, 0x31, 0x2f, 0x7b,
-	0x6e, 0x61, 0x6d, 0x65, 0x3d, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x7d,
-	0x12, 0x7f, 0x0a, 0x0c, 0x47, 0x65, 0x74, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x12, 0x27, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6c, 0x6f, 0x6e, 0x67, 0x72, 0x75,
-	0x6e, 0x6e, 0x69, 0x6e, 0x67, 0x2e, 0x47, 0x65, 0x74, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69,
-	0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
-	0x6c, 0x65, 0x2e, 0x6c, 0x6f, 0x6e, 0x67, 0x72, 0x75, 0x6e, 0x6e, 0x69, 0x6e, 0x67, 0x2e, 0x4f,
-	0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x27, 0xda, 0x41, 0x04, 0x6e, 0x61, 0x6d,
-	0x65, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x1a, 0x12, 0x18, 0x2f, 0x76, 0x31, 0x2f, 0x7b, 0x6e, 0x61,
-	0x6d, 0x65, 0x3d, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2f, 0x2a, 0x2a,
-	0x7d, 0x12, 0x7e, 0x0a, 0x0f, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4f, 0x70, 0x65, 0x72, 0x61,
-	0x74, 0x69, 0x6f, 0x6e, 0x12, 0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6c, 0x6f,
-	0x6e, 0x67, 0x72, 0x75, 0x6e, 0x6e, 0x69, 0x6e, 0x67, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65,
-	0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
-	0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0x27, 0xda, 0x41, 0x04, 0x6e, 0x61, 0x6d,
-	0x65, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x1a, 0x2a, 0x18, 0x2f, 0x76, 0x31, 0x2f, 0x7b, 0x6e, 0x61,
-	0x6d, 0x65, 0x3d, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2f, 0x2a, 0x2a,
-	0x7d, 0x12, 0x88, 0x01, 0x0a, 0x0f, 0x43, 0x61, 0x6e, 0x63, 0x65, 0x6c, 0x4f, 0x70, 0x65, 0x72,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6c,
-	0x6f, 0x6e, 0x67, 0x72, 0x75, 0x6e, 0x6e, 0x69, 0x6e, 0x67, 0x2e, 0x43, 0x61, 0x6e, 0x63, 0x65,
-	0x6c, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0x31, 0xda, 0x41, 0x04, 0x6e, 0x61,
-	0x6d, 0x65, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x24, 0x3a, 0x01, 0x2a, 0x22, 0x1f, 0x2f, 0x76, 0x31,
-	0x2f, 0x7b, 0x6e, 0x61, 0x6d, 0x65, 0x3d, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x73, 0x2f, 0x2a, 0x2a, 0x7d, 0x3a, 0x63, 0x61, 0x6e, 0x63, 0x65, 0x6c, 0x12, 0x5a, 0x0a, 0x0d,
-	0x57, 0x61, 0x69, 0x74, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x28, 0x2e,
-	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6c, 0x6f, 0x6e, 0x67, 0x72, 0x75, 0x6e, 0x6e, 0x69,
-	0x6e, 0x67, 0x2e, 0x57, 0x61, 0x69, 0x74, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
-	0x2e, 0x6c, 0x6f, 0x6e, 0x67, 0x72, 0x75, 0x6e, 0x6e, 0x69, 0x6e, 0x67, 0x2e, 0x4f, 0x70, 0x65,
-	0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x00, 0x1a, 0x1d, 0xca, 0x41, 0x1a, 0x6c, 0x6f, 0x6e,
-	0x67, 0x72, 0x75, 0x6e, 0x6e, 0x69, 0x6e, 0x67, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x61,
-	0x70, 0x69, 0x73, 0x2e, 0x63, 0x6f, 0x6d, 0x3a, 0x69, 0x0a, 0x0e, 0x6f, 0x70, 0x65, 0x72, 0x61,
-	0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x6e, 0x66, 0x6f, 0x12, 0x1e, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
-	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4d, 0x65, 0x74, 0x68,
-	0x6f, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x99, 0x08, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x21, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6c, 0x6f, 0x6e, 0x67, 0x72, 0x75,
-	0x6e, 0x6e, 0x69, 0x6e, 0x67, 0x2e, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x49,
-	0x6e, 0x66, 0x6f, 0x52, 0x0d, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x6e,
-	0x66, 0x6f, 0x42, 0xa2, 0x01, 0x0a, 0x16, 0x63, 0x6f, 0x6d, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
-	0x65, 0x2e, 0x6c, 0x6f, 0x6e, 0x67, 0x72, 0x75, 0x6e, 0x6e, 0x69, 0x6e, 0x67, 0x42, 0x0f, 0x4f,
-	0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01,
-	0x5a, 0x43, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63,
-	0x6f, 0x6d, 0x2f, 0x67, 0x6f, 0x2f, 0x6c, 0x6f, 0x6e, 0x67, 0x72, 0x75, 0x6e, 0x6e, 0x69, 0x6e,
-	0x67, 0x2f, 0x61, 0x75, 0x74, 0x6f, 0x67, 0x65, 0x6e, 0x2f, 0x6c, 0x6f, 0x6e, 0x67, 0x72, 0x75,
-	0x6e, 0x6e, 0x69, 0x6e, 0x67, 0x70, 0x62, 0x3b, 0x6c, 0x6f, 0x6e, 0x67, 0x72, 0x75, 0x6e, 0x6e,
-	0x69, 0x6e, 0x67, 0x70, 0x62, 0xa2, 0x02, 0x05, 0x47, 0x4c, 0x52, 0x55, 0x4e, 0xaa, 0x02, 0x12,
-	0x47, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x4c, 0x6f, 0x6e, 0x67, 0x52, 0x75, 0x6e, 0x6e, 0x69,
-	0x6e, 0x67, 0xca, 0x02, 0x12, 0x47, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x5c, 0x4c, 0x6f, 0x6e, 0x67,
-	0x52, 0x75, 0x6e, 0x6e, 0x69, 0x6e, 0x67, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
+const file_google_longrunning_operations_proto_rawDesc = "" +
+	"\n" +
+	"#google/longrunning/operations.proto\x12\x12google.longrunning\x1a\x1cgoogle/api/annotations.proto\x1a\x17google/api/client.proto\x1a\x1fgoogle/api/field_behavior.proto\x1a\x19google/protobuf/any.proto\x1a google/protobuf/descriptor.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1bgoogle/protobuf/empty.proto\x1a\x17google/rpc/status.proto\"\xcf\x01\n" +
+	"\tOperation\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\x120\n" +
+	"\bmetadata\x18\x02 \x01(\v2\x14.google.protobuf.AnyR\bmetadata\x12\x12\n" +
+	"\x04done\x18\x03 \x01(\bR\x04done\x12*\n" +
+	"\x05error\x18\x04 \x01(\v2\x12.google.rpc.StatusH\x00R\x05error\x122\n" +
+	"\bresponse\x18\x05 \x01(\v2\x14.google.protobuf.AnyH\x00R\bresponseB\b\n" +
+	"\x06result\")\n" +
+	"\x13GetOperationRequest\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\"\xb5\x01\n" +
+	"\x15ListOperationsRequest\x12\x12\n" +
+	"\x04name\x18\x04 \x01(\tR\x04name\x12\x16\n" +
+	"\x06filter\x18\x01 \x01(\tR\x06filter\x12\x1b\n" +
+	"\tpage_size\x18\x02 \x01(\x05R\bpageSize\x12\x1d\n" +
+	"\n" +
+	"page_token\x18\x03 \x01(\tR\tpageToken\x124\n" +
+	"\x16return_partial_success\x18\x05 \x01(\bR\x14returnPartialSuccess\"\xa6\x01\n" +
+	"\x16ListOperationsResponse\x12=\n" +
+	"\n" +
+	"operations\x18\x01 \x03(\v2\x1d.google.longrunning.OperationR\n" +
+	"operations\x12&\n" +
+	"\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken\x12%\n" +
+	"\vunreachable\x18\x03 \x03(\tB\x03\xe0A\x06R\vunreachable\",\n" +
+	"\x16CancelOperationRequest\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\",\n" +
+	"\x16DeleteOperationRequest\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\"_\n" +
+	"\x14WaitOperationRequest\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\x123\n" +
+	"\atimeout\x18\x02 \x01(\v2\x19.google.protobuf.DurationR\atimeout\"Y\n" +
+	"\rOperationInfo\x12#\n" +
+	"\rresponse_type\x18\x01 \x01(\tR\fresponseType\x12#\n" +
+	"\rmetadata_type\x18\x02 \x01(\tR\fmetadataType2\xaa\x05\n" +
+	"\n" +
+	"Operations\x12\x94\x01\n" +
+	"\x0eListOperations\x12).google.longrunning.ListOperationsRequest\x1a*.google.longrunning.ListOperationsResponse\"+\xdaA\vname,filter\x82\xd3\xe4\x93\x02\x17\x12\x15/v1/{name=operations}\x12\x7f\n" +
+	"\fGetOperation\x12'.google.longrunning.GetOperationRequest\x1a\x1d.google.longrunning.Operation\"'\xdaA\x04name\x82\xd3\xe4\x93\x02\x1a\x12\x18/v1/{name=operations/**}\x12~\n" +
+	"\x0fDeleteOperation\x12*.google.longrunning.DeleteOperationRequest\x1a\x16.google.protobuf.Empty\"'\xdaA\x04name\x82\xd3\xe4\x93\x02\x1a*\x18/v1/{name=operations/**}\x12\x88\x01\n" +
+	"\x0fCancelOperation\x12*.google.longrunning.CancelOperationRequest\x1a\x16.google.protobuf.Empty\"1\xdaA\x04name\x82\xd3\xe4\x93\x02$:\x01*\"\x1f/v1/{name=operations/**}:cancel\x12Z\n" +
+	"\rWaitOperation\x12(.google.longrunning.WaitOperationRequest\x1a\x1d.google.longrunning.Operation\"\x00\x1a\x1d\xcaA\x1alongrunning.googleapis.com:i\n" +
+	"\x0eoperation_info\x12\x1e.google.protobuf.MethodOptions\x18\x99\b \x01(\v2!.google.longrunning.OperationInfoR\roperationInfoB\xa2\x01\n" +
+	"\x16com.google.longrunningB\x0fOperationsProtoP\x01ZCcloud.google.com/go/longrunning/autogen/longrunningpb;longrunningpb\xa2\x02\x05GLRUN\xaa\x02\x12Google.LongRunning\xca\x02\x12Google\\LongRunningb\x06proto3"
 
 var (
 	file_google_longrunning_operations_proto_rawDescOnce sync.Once
-	file_google_longrunning_operations_proto_rawDescData = file_google_longrunning_operations_proto_rawDesc
+	file_google_longrunning_operations_proto_rawDescData []byte
 )
 
 func file_google_longrunning_operations_proto_rawDescGZIP() []byte {
 	file_google_longrunning_operations_proto_rawDescOnce.Do(func() {
-		file_google_longrunning_operations_proto_rawDescData = protoimpl.X.CompressGZIP(file_google_longrunning_operations_proto_rawDescData)
+		file_google_longrunning_operations_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_google_longrunning_operations_proto_rawDesc), len(file_google_longrunning_operations_proto_rawDesc)))
 	})
 	return file_google_longrunning_operations_proto_rawDescData
 }
@@ -842,7 +747,7 @@ func file_google_longrunning_operations_proto_init() {
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_google_longrunning_operations_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_google_longrunning_operations_proto_rawDesc), len(file_google_longrunning_operations_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   8,
 			NumExtensions: 1,
@@ -854,7 +759,6 @@ func file_google_longrunning_operations_proto_init() {
 		ExtensionInfos:    file_google_longrunning_operations_proto_extTypes,
 	}.Build()
 	File_google_longrunning_operations_proto = out.File
-	file_google_longrunning_operations_proto_rawDesc = nil
 	file_google_longrunning_operations_proto_goTypes = nil
 	file_google_longrunning_operations_proto_depIdxs = nil
 }
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/CHANGELOG.md b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/CHANGELOG.md
index fa477145fa..d730a3bc35 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/CHANGELOG.md
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/CHANGELOG.md
@@ -1,5 +1,18 @@
 # Release History
 
+## 1.21.1 (2026-04-16)
+
+### Bugs Fixed
+
+* Fixed an issue in `ResponseError.Error()` where the request URL path was being logged unescaped.
+* Redact query parameters when logging errors.
+* For `runtime.JoinPaths`, don't add a slash between root and paths when `paths` starts with `?` (query string).
+
+### Other Changes
+
+* Upgraded to Go 1.25.0.
+* Upgraded dependencies.
+
 ## 1.21.0 (2026-01-12)
 
 ### Features Added
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/exported/response_error.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/exported/response_error.go
index ef0635bb22..8246b6a5b8 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/exported/response_error.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/exported/response_error.go
@@ -131,7 +131,7 @@ func (e *ResponseError) Error() string {
 	msg := &bytes.Buffer{}
 	if e.RawResponse != nil {
 		if e.RawResponse.Request != nil {
-			fmt.Fprintf(msg, "%s %s://%s%s\n", e.RawResponse.Request.Method, e.RawResponse.Request.URL.Scheme, e.RawResponse.Request.URL.Host, e.RawResponse.Request.URL.Path)
+			fmt.Fprintf(msg, "%s %s://%s%s\n", e.RawResponse.Request.Method, e.RawResponse.Request.URL.Scheme, e.RawResponse.Request.URL.Host, e.RawResponse.Request.URL.EscapedPath())
 		} else {
 			fmt.Fprintln(msg, "Request information not available")
 		}
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/shared/constants.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/shared/constants.go
index 213202e336..8ad391dd26 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/shared/constants.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/shared/constants.go
@@ -37,5 +37,5 @@ const (
 	Module = "azcore"
 
 	// Version is the semantic version (see http://semver.org) of this module.
-	Version = "v1.21.0"
+	Version = "v1.21.1"
 )
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_http_trace.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_http_trace.go
index ddf9ede01e..7017d5e106 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_http_trace.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_http_trace.go
@@ -5,10 +5,8 @@ package runtime
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"net/http"
-	"net/url"
 	"strings"
 
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/exported"
@@ -73,14 +71,7 @@ func (h *httpTracePolicy) Do(req *policy.Request) (resp *http.Response, err erro
 					span.SetAttributes(tracing.Attribute{Key: attrAZServiceReqID, Value: reqID})
 				}
 			} else if err != nil {
-				var urlErr *url.Error
-				if errors.As(err, &urlErr) {
-					// calling *url.Error.Error() will include the unsanitized URL
-					// which we don't want. in addition, we already have the HTTP verb
-					// and sanitized URL in the trace so we aren't losing any info
-					err = urlErr.Err
-				}
-				span.SetStatus(tracing.SpanStatusError, err.Error())
+				span.SetStatus(tracing.SpanStatusError, getSanitizedURLString(err.Error(), req.Raw().URL, h.allowedQP))
 			}
 			span.End()
 		}()
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_logging.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_logging.go
index dd59fbc99b..d9e6481de8 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_logging.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_logging.go
@@ -158,6 +158,27 @@ func getSanitizedURL(u url.URL, allowedQueryParams map[string]struct{}) string {
 	return u.String()
 }
 
+// getSanitizedURLString returns s with the query params of u redacted.
+// if s doesn't contain u, then s is returned unchanged.
+func getSanitizedURLString(s string, u *url.URL, allowedQueryParams map[string]struct{}) string {
+	if u.RawQuery == "" {
+		// the URL doesn't have any query params, so nothing to redact
+		return s
+	}
+
+	urlIndex := strings.Index(strings.ToLower(s), strings.ToLower(u.String()))
+	if urlIndex < 0 {
+		// the URL isn't in the string, so nothing to redact
+		return s
+	}
+
+	// replace the unsanitized URL in the error message with the sanitized version
+	sanitizedURL := getSanitizedURL(*u, allowedQueryParams)
+	s = s[:urlIndex] + sanitizedURL + s[urlIndex+len(u.String()):]
+
+	return s
+}
+
 // writeRequestWithResponse appends a formatted HTTP request into a Buffer. If request and/or err are
 // not nil, then these are also written into the Buffer.
 func (p *logPolicy) writeRequestWithResponse(b *bytes.Buffer, req *policy.Request, resp *http.Response, err error) {
@@ -171,7 +192,7 @@ func (p *logPolicy) writeRequestWithResponse(b *bytes.Buffer, req *policy.Reques
 	}
 	if err != nil {
 		fmt.Fprintln(b, "   --------------------------------------------------------------------------------")
-		fmt.Fprint(b, "   ERROR:\n"+err.Error()+"\n")
+		fmt.Fprint(b, "   ERROR:\n"+getSanitizedURLString(err.Error(), req.Raw().URL, p.allowedQP)+"\n")
 	}
 }
 
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/request.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/request.go
index df7826b763..20d86496d2 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/request.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/request.go
@@ -90,12 +90,16 @@ func JoinPaths(root string, paths ...string) string {
 	}
 
 	if qps != "" {
-		p = p + "?" + qps
+		if strings.Contains(p, "?") {
+			p = p + "&" + qps
+		} else {
+			p = p + "?" + qps
+		}
 	}
 
 	if strings.HasSuffix(root, "/") && strings.HasPrefix(p, "/") {
 		root = root[:len(root)-1]
-	} else if !strings.HasSuffix(root, "/") && !strings.HasPrefix(p, "/") {
+	} else if !strings.HasSuffix(root, "/") && !strings.HasPrefix(p, "/") && !strings.HasPrefix(p, "?") {
 		p = "/" + p
 	}
 	return root + p
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/diag/diag.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/diag/diag.go
index 245af7d2be..c6ce89e1d4 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/diag/diag.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/diag/diag.go
@@ -1,6 +1,3 @@
-//go:build go1.18
-// +build go1.18
-
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
@@ -42,7 +39,7 @@ func StackTrace(skipFrames, totalFrames int) string {
 		sb.WriteString("()\n\t")
 		sb.WriteString(frame.File)
 		sb.WriteRune(':')
-		sb.WriteString(fmt.Sprintf("%d\n", frame.Line))
+		fmt.Fprintf(&sb, "%d\n", frame.Line)
 		if !more {
 			break
 		}
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/diag/doc.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/diag/doc.go
index 66bf13e5f0..198a7ba75e 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/diag/doc.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/diag/doc.go
@@ -1,6 +1,3 @@
-//go:build go1.18
-// +build go1.18
-
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/errorinfo/doc.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/errorinfo/doc.go
index 8c6eacb618..545f36625a 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/errorinfo/doc.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/errorinfo/doc.go
@@ -1,6 +1,3 @@
-//go:build go1.18
-// +build go1.18
-
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/errorinfo/errorinfo.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/errorinfo/errorinfo.go
index 779657b23b..d6e570f91d 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/errorinfo/errorinfo.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/errorinfo/errorinfo.go
@@ -1,6 +1,3 @@
-//go:build go1.18
-// +build go1.18
-
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/exported/exported.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/exported/exported.go
index 9948f604b3..16bb492767 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/exported/exported.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/exported/exported.go
@@ -1,6 +1,3 @@
-//go:build go1.18
-// +build go1.18
-
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
@@ -10,6 +7,7 @@ import (
 	"errors"
 	"io"
 	"net/http"
+	"slices"
 )
 
 // HasStatusCode returns true if the Response's status code is one of the specified values.
@@ -18,12 +16,7 @@ func HasStatusCode(resp *http.Response, statusCodes ...int) bool {
 	if resp == nil {
 		return false
 	}
-	for _, sc := range statusCodes {
-		if resp.StatusCode == sc {
-			return true
-		}
-	}
-	return false
+	return slices.Contains(statusCodes, resp.StatusCode)
 }
 
 // PayloadOptions contains the optional values for the Payload func.
@@ -57,7 +50,7 @@ func Payload(resp *http.Response, opts *PayloadOptions) ([]byte, error) {
 	}
 
 	bytesBody, err := io.ReadAll(resp.Body)
-	resp.Body.Close()
+	_ = resp.Body.Close()
 	if err != nil {
 		return nil, err
 	}
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/log/doc.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/log/doc.go
index d7876d297a..452fbf06ea 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/log/doc.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/log/doc.go
@@ -1,6 +1,3 @@
-//go:build go1.18
-// +build go1.18
-
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/log/log.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/log/log.go
index 76dadf7d35..4bba1cfda6 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/log/log.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/log/log.go
@@ -1,6 +1,3 @@
-//go:build go1.18
-// +build go1.18
-
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/poller/util.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/poller/util.go
index db8269627d..718b235121 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/poller/util.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/poller/util.go
@@ -1,6 +1,3 @@
-//go:build go1.18
-// +build go1.18
-
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/temporal/resource.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/temporal/resource.go
index 02aa1fb3bc..153f4cc623 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/temporal/resource.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/temporal/resource.go
@@ -1,6 +1,3 @@
-//go:build go1.18
-// +build go1.18
-
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
@@ -93,7 +90,7 @@ func (er *Resource[TResource, TState]) Get(state TState) (TResource, error) {
 			}
 			// Getting here means that this thread/goroutine will wait for the updated resource
 		} else if er.shouldRefresh(resource, state) {
-			if !(er.acquiring || backoff(now, er.lastAttempt)) {
+			if !er.acquiring && !backoff(now, er.lastAttempt) {
 				// If another thread/goroutine is not acquiring/renewing the resource, and none has attempted
 				// to do so within the last 30 seconds, this thread/goroutine will do it
 				er.acquiring, acquire = true, true
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/uuid/doc.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/uuid/doc.go
index a3824bee8b..296a1096b7 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/uuid/doc.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/uuid/doc.go
@@ -1,6 +1,3 @@
-//go:build go1.18
-// +build go1.18
-
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/uuid/uuid.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/uuid/uuid.go
index 278ac9cd1c..072fa21ca4 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/uuid/uuid.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/uuid/uuid.go
@@ -1,6 +1,3 @@
-//go:build go1.18
-// +build go1.18
-
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/aws/go_module_metadata.go b/vendor/github.com/aws/aws-sdk-go-v2/aws/go_module_metadata.go
index 57bfbfb694..e589f61561 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/aws/go_module_metadata.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/aws/go_module_metadata.go
@@ -3,4 +3,4 @@
 package aws
 
 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.41.5"
+const goModuleVersion = "1.41.7"
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/config/CHANGELOG.md b/vendor/github.com/aws/aws-sdk-go-v2/config/CHANGELOG.md
index 0c2a7d9f0d..6f932e910a 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/config/CHANGELOG.md
+++ b/vendor/github.com/aws/aws-sdk-go-v2/config/CHANGELOG.md
@@ -1,3 +1,25 @@
+# v1.32.17 (2026-04-29)
+
+* **Dependency Update**: Update to smithy-go v1.25.1.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.32.16 (2026-04-17)
+
+* **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.32.15 (2026-04-16)
+
+* No change notes available for this release.
+
+# v1.32.14 (2026-04-02)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.32.13 (2026-03-26)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
 # v1.32.12 (2026-03-13)
 
 * **Bug Fix**: Replace usages of the old ioutil/ package throughout the SDK.
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/config/go_module_metadata.go b/vendor/github.com/aws/aws-sdk-go-v2/config/go_module_metadata.go
index 202b9574b3..fdbfa78e45 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/config/go_module_metadata.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/config/go_module_metadata.go
@@ -3,4 +3,4 @@
 package config
 
 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.32.12"
+const goModuleVersion = "1.32.17"
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/ini/errors.go b/vendor/github.com/aws/aws-sdk-go-v2/config/internal/ini/errors.go
similarity index 100%
rename from vendor/github.com/aws/aws-sdk-go-v2/internal/ini/errors.go
rename to vendor/github.com/aws/aws-sdk-go-v2/config/internal/ini/errors.go
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/ini/ini.go b/vendor/github.com/aws/aws-sdk-go-v2/config/internal/ini/ini.go
similarity index 100%
rename from vendor/github.com/aws/aws-sdk-go-v2/internal/ini/ini.go
rename to vendor/github.com/aws/aws-sdk-go-v2/config/internal/ini/ini.go
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/ini/parse.go b/vendor/github.com/aws/aws-sdk-go-v2/config/internal/ini/parse.go
similarity index 100%
rename from vendor/github.com/aws/aws-sdk-go-v2/internal/ini/parse.go
rename to vendor/github.com/aws/aws-sdk-go-v2/config/internal/ini/parse.go
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/ini/sections.go b/vendor/github.com/aws/aws-sdk-go-v2/config/internal/ini/sections.go
similarity index 100%
rename from vendor/github.com/aws/aws-sdk-go-v2/internal/ini/sections.go
rename to vendor/github.com/aws/aws-sdk-go-v2/config/internal/ini/sections.go
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/ini/strings.go b/vendor/github.com/aws/aws-sdk-go-v2/config/internal/ini/strings.go
similarity index 100%
rename from vendor/github.com/aws/aws-sdk-go-v2/internal/ini/strings.go
rename to vendor/github.com/aws/aws-sdk-go-v2/config/internal/ini/strings.go
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/ini/token.go b/vendor/github.com/aws/aws-sdk-go-v2/config/internal/ini/token.go
similarity index 100%
rename from vendor/github.com/aws/aws-sdk-go-v2/internal/ini/token.go
rename to vendor/github.com/aws/aws-sdk-go-v2/config/internal/ini/token.go
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/ini/tokenize.go b/vendor/github.com/aws/aws-sdk-go-v2/config/internal/ini/tokenize.go
similarity index 100%
rename from vendor/github.com/aws/aws-sdk-go-v2/internal/ini/tokenize.go
rename to vendor/github.com/aws/aws-sdk-go-v2/config/internal/ini/tokenize.go
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/ini/value.go b/vendor/github.com/aws/aws-sdk-go-v2/config/internal/ini/value.go
similarity index 100%
rename from vendor/github.com/aws/aws-sdk-go-v2/internal/ini/value.go
rename to vendor/github.com/aws/aws-sdk-go-v2/config/internal/ini/value.go
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/config/shared_config.go b/vendor/github.com/aws/aws-sdk-go-v2/config/shared_config.go
index 44c616fd57..5b251f54f5 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/config/shared_config.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/config/shared_config.go
@@ -12,8 +12,8 @@ import (
 	"time"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/config/internal/ini"
 	"github.com/aws/aws-sdk-go-v2/feature/ec2/imds"
-	"github.com/aws/aws-sdk-go-v2/internal/ini"
 	"github.com/aws/aws-sdk-go-v2/internal/shareddefaults"
 	"github.com/aws/smithy-go/logging"
 	smithyrequestcompression "github.com/aws/smithy-go/private/requestcompression"
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/credentials/CHANGELOG.md b/vendor/github.com/aws/aws-sdk-go-v2/credentials/CHANGELOG.md
index a5705a1946..0b215e6b83 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/credentials/CHANGELOG.md
+++ b/vendor/github.com/aws/aws-sdk-go-v2/credentials/CHANGELOG.md
@@ -1,3 +1,21 @@
+# v1.19.16 (2026-04-29)
+
+* **Dependency Update**: Update to smithy-go v1.25.1.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.19.15 (2026-04-17)
+
+* **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.19.14 (2026-04-02)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.19.13 (2026-03-26)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
 # v1.19.12 (2026-03-13)
 
 * **Bug Fix**: Replace usages of the old ioutil/ package throughout the SDK.
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/credentials/go_module_metadata.go b/vendor/github.com/aws/aws-sdk-go-v2/credentials/go_module_metadata.go
index 97ad19cb73..5abad90cd9 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/credentials/go_module_metadata.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/credentials/go_module_metadata.go
@@ -3,4 +3,4 @@
 package credentials
 
 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.19.12"
+const goModuleVersion = "1.19.16"
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/CHANGELOG.md b/vendor/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/CHANGELOG.md
index a2be438e9e..e17294549f 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/CHANGELOG.md
+++ b/vendor/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/CHANGELOG.md
@@ -1,3 +1,17 @@
+# v1.18.23 (2026-04-29)
+
+* **Dependency Update**: Update to smithy-go v1.25.1.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.18.22 (2026-04-17)
+
+* **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.18.21 (2026-03-26)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
 # v1.18.20 (2026-03-13)
 
 * **Bug Fix**: Replace usages of the old ioutil/ package throughout the SDK.
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/go_module_metadata.go b/vendor/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/go_module_metadata.go
index 1ce3f98b74..7f59387edc 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/go_module_metadata.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/go_module_metadata.go
@@ -3,4 +3,4 @@
 package imds
 
 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.18.20"
+const goModuleVersion = "1.18.23"
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/configsources/CHANGELOG.md b/vendor/github.com/aws/aws-sdk-go-v2/internal/configsources/CHANGELOG.md
index 1def5e2d9f..0990a4143a 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/internal/configsources/CHANGELOG.md
+++ b/vendor/github.com/aws/aws-sdk-go-v2/internal/configsources/CHANGELOG.md
@@ -1,3 +1,13 @@
+# v1.4.23 (2026-04-29)
+
+* **Dependency Update**: Update to smithy-go v1.25.1.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.4.22 (2026-04-17)
+
+* **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
+* **Dependency Update**: Updated to the latest SDK module versions
+
 # v1.4.21 (2026-03-26)
 
 * **Dependency Update**: Updated to the latest SDK module versions
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/configsources/go_module_metadata.go b/vendor/github.com/aws/aws-sdk-go-v2/internal/configsources/go_module_metadata.go
index 548da96016..05a8d3e7bc 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/internal/configsources/go_module_metadata.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/internal/configsources/go_module_metadata.go
@@ -3,4 +3,4 @@
 package configsources
 
 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.4.21"
+const goModuleVersion = "1.4.23"
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2/CHANGELOG.md b/vendor/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2/CHANGELOG.md
index a2a1c183ff..49577e3e94 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2/CHANGELOG.md
+++ b/vendor/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2/CHANGELOG.md
@@ -1,3 +1,13 @@
+# v2.7.23 (2026-04-29)
+
+* **Dependency Update**: Update to smithy-go v1.25.1.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v2.7.22 (2026-04-17)
+
+* **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
+* **Dependency Update**: Updated to the latest SDK module versions
+
 # v2.7.21 (2026-03-26)
 
 * **Dependency Update**: Updated to the latest SDK module versions
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2/go_module_metadata.go b/vendor/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2/go_module_metadata.go
index 03a0b8c038..1e92900a1e 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2/go_module_metadata.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2/go_module_metadata.go
@@ -3,4 +3,4 @@
 package endpoints
 
 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "2.7.21"
+const goModuleVersion = "2.7.23"
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/ini/CHANGELOG.md b/vendor/github.com/aws/aws-sdk-go-v2/internal/ini/CHANGELOG.md
deleted file mode 100644
index fdf434a5eb..0000000000
--- a/vendor/github.com/aws/aws-sdk-go-v2/internal/ini/CHANGELOG.md
+++ /dev/null
@@ -1,296 +0,0 @@
-# v1.8.6 (2026-03-13)
-
-* **Bug Fix**: Replace usages of the old ioutil/ package throughout the SDK.
-
-# v1.8.5 (2026-03-03)
-
-* **Bug Fix**: Modernize non codegen files with go fix
-* **Dependency Update**: Bump minimum Go version to 1.24
-
-# v1.8.4 (2025-10-16)
-
-* **Dependency Update**: Bump minimum Go version to 1.23.
-
-# v1.8.3 (2025-02-18)
-
-* **Bug Fix**: Bump go version to 1.22
-
-# v1.8.2 (2025-01-24)
-
-* **Bug Fix**: Refactor filepath.Walk to filepath.WalkDir
-
-# v1.8.1 (2024-08-15)
-
-* **Dependency Update**: Bump minimum Go version to 1.21.
-
-# v1.8.0 (2024-02-13)
-
-* **Feature**: Bump minimum Go version to 1.20 per our language support policy.
-
-# v1.7.3 (2024-01-22)
-
-* **Bug Fix**: Remove invalid escaping of shared config values. All values in the shared config file will now be interpreted literally, save for fully-quoted strings which are unwrapped for legacy reasons.
-
-# v1.7.2 (2023-12-08)
-
-* **Bug Fix**: Correct loading of [services *] sections into shared config.
-
-# v1.7.1 (2023-11-16)
-
-* **Bug Fix**: Fix recognition of trailing comments in shared config properties. # or ; separators that aren't preceded by whitespace at the end of a property value should be considered part of it.
-
-# v1.7.0 (2023-11-13)
-
-* **Feature**: Replace the legacy config parser with a modern, less-strict implementation. Parsing failures within a section will now simply ignore the invalid line rather than silently drop the entire section.
-
-# v1.6.0 (2023-11-09.2)
-
-* **Feature**: BREAKFIX: In order to support subproperty parsing, invalid property definitions must not be ignored
-
-# v1.5.2 (2023-11-09)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.5.1 (2023-11-07)
-
-* **Bug Fix**: Fix subproperty performance regression
-
-# v1.5.0 (2023-11-01)
-
-* **Feature**: Adds support for configured endpoints via environment variables and the AWS shared configuration file.
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.4.0 (2023-10-31)
-
-* **Feature**: **BREAKING CHANGE**: Bump minimum go version to 1.19 per the revised [go version support policy](https://aws.amazon.com/blogs/developer/aws-sdk-for-go-aligns-with-go-release-policy-on-supported-runtimes/).
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.45 (2023-10-12)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.44 (2023-10-06)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.43 (2023-09-22)
-
-* **Bug Fix**: Fixed a bug where merging `max_attempts` or `duration_seconds` fields across shared config files with invalid values would silently default them to 0.
-* **Bug Fix**: Move type assertion of config values out of the parsing stage, which resolves an issue where the contents of a profile would silently be dropped with certain numeric formats.
-
-# v1.3.42 (2023-08-21)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.41 (2023-08-18)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.40 (2023-08-17)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.39 (2023-08-07)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.38 (2023-07-31)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.37 (2023-07-28)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.36 (2023-07-13)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.35 (2023-06-13)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.34 (2023-04-24)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.33 (2023-04-07)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.32 (2023-03-21)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.31 (2023-03-10)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.30 (2023-02-20)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.29 (2023-02-03)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.28 (2022-12-15)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.27 (2022-12-02)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.26 (2022-10-24)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.25 (2022-10-21)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.24 (2022-09-20)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.23 (2022-09-14)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.22 (2022-09-02)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.21 (2022-08-31)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.20 (2022-08-29)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.19 (2022-08-11)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.18 (2022-08-09)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.17 (2022-08-08)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.16 (2022-08-01)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.15 (2022-07-05)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.14 (2022-06-29)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.13 (2022-06-07)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.12 (2022-05-17)
-
-* **Bug Fix**: Removes the fuzz testing files from the module, as they are invalid and not used.
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.11 (2022-04-25)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.10 (2022-03-30)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.9 (2022-03-24)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.8 (2022-03-23)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.7 (2022-03-08)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.6 (2022-02-24)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.5 (2022-01-28)
-
-* **Bug Fix**: Fixes the SDK's handling of `duration_sections` in the shared credentials file or specified in multiple shared config and shared credentials files under the same profile. [#1568](https://github.com/aws/aws-sdk-go-v2/pull/1568). Thanks to [Amir Szekely](https://github.com/kichik) for help reproduce this bug.
-
-# v1.3.4 (2022-01-14)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.3 (2022-01-07)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.2 (2021-12-02)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.1 (2021-11-19)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.3.0 (2021-11-06)
-
-* **Feature**: The SDK now supports configuration of FIPS and DualStack endpoints using environment variables, shared configuration, or programmatically.
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.2.5 (2021-10-21)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.2.4 (2021-10-11)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.2.3 (2021-09-17)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.2.2 (2021-08-27)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.2.1 (2021-08-19)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.2.0 (2021-08-04)
-
-* **Feature**: adds error handling for defered close calls
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.1.1 (2021-07-15)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.1.0 (2021-07-01)
-
-* **Feature**: Support for `:`, `=`, `[`, `]` being present in expression values.
-
-# v1.0.1 (2021-06-25)
-
-* **Dependency Update**: Updated to the latest SDK module versions
-
-# v1.0.0 (2021-05-20)
-
-* **Release**: The `github.com/aws/aws-sdk-go-v2/internal/ini` package is now a Go Module.
-* **Dependency Update**: Updated to the latest SDK module versions
-
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/CHANGELOG.md b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/CHANGELOG.md
new file mode 100644
index 0000000000..e1e3c23a74
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/CHANGELOG.md
@@ -0,0 +1,460 @@
+# v1.4.24 (2026-04-29)
+
+* **Dependency Update**: Update to smithy-go v1.25.1.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.4.23 (2026-04-17)
+
+* **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.4.22 (2026-03-26)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.4.21 (2026-03-13)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.4.20 (2026-03-05)
+
+* **Bug Fix**: Read the correct auth property for SigV4A signing names.
+
+# v1.4.19 (2026-03-03)
+
+* **Bug Fix**: Modernize non codegen files with go fix
+* **Dependency Update**: Bump minimum Go version to 1.24
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.4.18 (2026-02-23)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.4.17 (2026-01-09)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.4.16 (2025-12-08)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.4.15 (2025-12-02)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+* **Dependency Update**: Upgrade to smithy-go v1.24.0. Notably this version of the library reduces the allocation footprint of the middleware system. We observe a ~10% reduction in allocations per SDK call with this change.
+
+# v1.4.14 (2025-11-19.2)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.4.13 (2025-11-04)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+* **Dependency Update**: Upgrade to smithy-go v1.23.2 which should convey some passive reduction of overall allocations, especially when not using the metrics system.
+
+# v1.4.12 (2025-10-30)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.4.11 (2025-10-23)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.4.10 (2025-10-16)
+
+* **Dependency Update**: Bump minimum Go version to 1.23.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.4.9 (2025-09-26)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.4.8 (2025-09-23)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.4.7 (2025-09-08)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.4.6 (2025-08-29)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.4.5 (2025-08-27)
+
+* **Dependency Update**: Update to smithy-go v1.23.0.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.4.4 (2025-08-21)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.4.3 (2025-08-11)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.4.2 (2025-08-04)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.4.1 (2025-07-30)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.4.0 (2025-07-28)
+
+* **Feature**: Add support for HTTP interceptors.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.37 (2025-07-19)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.36 (2025-06-17)
+
+* **Dependency Update**: Update to smithy-go v1.22.4.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.35 (2025-06-10)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.34 (2025-02-27)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.33 (2025-02-18)
+
+* **Bug Fix**: Bump go version to 1.22
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.32 (2025-02-05)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.31 (2025-01-31)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.30 (2025-01-30)
+
+* **Bug Fix**: Do not sign Transfer-Encoding header in Sigv4[a]. Fixes a signer mismatch issue with S3 Accelerate.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.29 (2025-01-24)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+* **Dependency Update**: Upgrade to smithy-go v1.22.2.
+
+# v1.3.28 (2025-01-15)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.27 (2025-01-09)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.26 (2024-12-19)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.25 (2024-12-02)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.24 (2024-11-18)
+
+* **Dependency Update**: Update to smithy-go v1.22.1.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.23 (2024-11-06)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.22 (2024-10-28)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.21 (2024-10-08)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.20 (2024-10-07)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.19 (2024-10-04)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.18 (2024-09-20)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.17 (2024-09-03)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.16 (2024-08-15)
+
+* **Dependency Update**: Bump minimum Go version to 1.21.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.15 (2024-07-10.2)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.14 (2024-07-10)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.13 (2024-06-28)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.12 (2024-06-19)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.11 (2024-06-18)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.10 (2024-06-17)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.9 (2024-06-07)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.8 (2024-06-03)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.7 (2024-05-16)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.6 (2024-05-15)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.5 (2024-03-29)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.4 (2024-03-18)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.3 (2024-03-07)
+
+* **Bug Fix**: Remove dependency on go-cmp.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.2 (2024-02-23)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.1 (2024-02-21)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.3.0 (2024-02-13)
+
+* **Feature**: Bump minimum Go version to 1.20 per our language support policy.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.2.10 (2024-01-04)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.2.9 (2023-12-07)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.2.8 (2023-12-01)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.2.7 (2023-11-30)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.2.6 (2023-11-29)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.2.5 (2023-11-28.2)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.2.4 (2023-11-20)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.2.3 (2023-11-15)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.2.2 (2023-11-09)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.2.1 (2023-11-01)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.2.0 (2023-10-31)
+
+* **Feature**: **BREAKING CHANGE**: Bump minimum go version to 1.19 per the revised [go version support policy](https://aws.amazon.com/blogs/developer/aws-sdk-for-go-aligns-with-go-release-policy-on-supported-runtimes/).
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.1.6 (2023-10-12)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.1.5 (2023-10-06)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.1.4 (2023-08-21)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.1.3 (2023-08-18)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.1.2 (2023-08-17)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.1.1 (2023-08-07)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.1.0 (2023-07-31)
+
+* **Feature**: Adds support for smithy-modeled endpoint resolution. A new rules-based endpoint resolution will be added to the SDK which will supercede and deprecate existing endpoint resolution. Specifically, EndpointResolver will be deprecated while BaseEndpoint and EndpointResolverV2 will take its place. For more information, please see the Endpoints section in our Developer Guide.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.0.28 (2023-07-28)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.0.27 (2023-07-13)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.0.26 (2023-06-13)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.0.25 (2023-04-24)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.0.24 (2023-04-07)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.0.23 (2023-03-21)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.0.22 (2023-03-10)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.0.21 (2023-02-20)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.0.20 (2023-02-14)
+
+* No change notes available for this release.
+
+# v1.0.19 (2023-02-03)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.0.18 (2022-12-15)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.0.17 (2022-12-02)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.0.16 (2022-10-24)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.0.15 (2022-10-21)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.0.14 (2022-09-20)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.0.13 (2022-09-14)
+
+* **Bug Fix**: Fixes an issues where an error from an underlying SigV4 credential provider would not be surfaced from the SigV4a credential provider. Contribution by [sakthipriyan-aqfer](https://github.com/sakthipriyan-aqfer).
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.0.12 (2022-09-02)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.0.11 (2022-08-31)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.0.10 (2022-08-29)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.0.9 (2022-08-11)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.0.8 (2022-08-09)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.0.7 (2022-08-08)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.0.6 (2022-08-01)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.0.5 (2022-07-05)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.0.4 (2022-06-29)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.0.3 (2022-06-07)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.0.2 (2022-05-17)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.0.1 (2022-04-25)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.0.0 (2022-04-07)
+
+* **Release**: New internal v4a signing module location.
+
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/ini/LICENSE.txt b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/LICENSE.txt
similarity index 100%
rename from vendor/github.com/aws/aws-sdk-go-v2/internal/ini/LICENSE.txt
rename to vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/LICENSE.txt
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/credentials.go b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/credentials.go
new file mode 100644
index 0000000000..3ae3a019e6
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/credentials.go
@@ -0,0 +1,141 @@
+package v4a
+
+import (
+	"context"
+	"crypto/ecdsa"
+	"fmt"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/internal/sdk"
+)
+
+// Credentials is Context, ECDSA, and Optional Session Token that can be used
+// to sign requests using SigV4a
+type Credentials struct {
+	Context      string
+	PrivateKey   *ecdsa.PrivateKey
+	SessionToken string
+
+	// Time the credentials will expire.
+	CanExpire bool
+	Expires   time.Time
+}
+
+// Expired returns if the credentials have expired.
+func (v Credentials) Expired() bool {
+	if v.CanExpire {
+		return !v.Expires.After(sdk.NowTime())
+	}
+
+	return false
+}
+
+// HasKeys returns if the credentials keys are set.
+func (v Credentials) HasKeys() bool {
+	return len(v.Context) > 0 && v.PrivateKey != nil
+}
+
+// SymmetricCredentialAdaptor wraps a SigV4 AccessKey/SecretKey provider and adapts the credentials
+// to a ECDSA PrivateKey for signing with SiV4a
+type SymmetricCredentialAdaptor struct {
+	SymmetricProvider aws.CredentialsProvider
+
+	asymmetric atomic.Value
+	m          sync.Mutex
+}
+
+// Retrieve retrieves symmetric credentials from the underlying provider.
+func (s *SymmetricCredentialAdaptor) Retrieve(ctx context.Context) (aws.Credentials, error) {
+	symCreds, err := s.retrieveFromSymmetricProvider(ctx)
+	if err != nil {
+		return aws.Credentials{}, err
+	}
+
+	if asymCreds := s.getCreds(); asymCreds == nil {
+		return symCreds, nil
+	}
+
+	s.m.Lock()
+	defer s.m.Unlock()
+
+	asymCreds := s.getCreds()
+	if asymCreds == nil {
+		return symCreds, nil
+	}
+
+	// if the context does not match the access key id clear it
+	if asymCreds.Context != symCreds.AccessKeyID {
+		s.asymmetric.Store((*Credentials)(nil))
+	}
+
+	return symCreds, nil
+}
+
+// RetrievePrivateKey returns credentials suitable for SigV4a signing
+func (s *SymmetricCredentialAdaptor) RetrievePrivateKey(ctx context.Context) (Credentials, error) {
+	if asymCreds := s.getCreds(); asymCreds != nil {
+		return *asymCreds, nil
+	}
+
+	s.m.Lock()
+	defer s.m.Unlock()
+
+	if asymCreds := s.getCreds(); asymCreds != nil {
+		return *asymCreds, nil
+	}
+
+	symmetricCreds, err := s.retrieveFromSymmetricProvider(ctx)
+	if err != nil {
+		return Credentials{}, fmt.Errorf("failed to retrieve symmetric credentials: %v", err)
+	}
+
+	privateKey, err := deriveKeyFromAccessKeyPair(symmetricCreds.AccessKeyID, symmetricCreds.SecretAccessKey)
+	if err != nil {
+		return Credentials{}, fmt.Errorf("failed to derive assymetric key from credentials")
+	}
+
+	creds := Credentials{
+		Context:      symmetricCreds.AccessKeyID,
+		PrivateKey:   privateKey,
+		SessionToken: symmetricCreds.SessionToken,
+		CanExpire:    symmetricCreds.CanExpire,
+		Expires:      symmetricCreds.Expires,
+	}
+
+	s.asymmetric.Store(&creds)
+
+	return creds, nil
+}
+
+func (s *SymmetricCredentialAdaptor) getCreds() *Credentials {
+	v := s.asymmetric.Load()
+
+	if v == nil {
+		return nil
+	}
+
+	c := v.(*Credentials)
+	if c != nil && c.HasKeys() && !c.Expired() {
+		return c
+	}
+
+	return nil
+}
+
+func (s *SymmetricCredentialAdaptor) retrieveFromSymmetricProvider(ctx context.Context) (aws.Credentials, error) {
+	credentials, err := s.SymmetricProvider.Retrieve(ctx)
+	if err != nil {
+		return aws.Credentials{}, err
+	}
+
+	return credentials, nil
+}
+
+// CredentialsProvider is the interface for a provider to retrieve credentials
+// to sign requests with.
+type CredentialsProvider interface {
+	RetrievePrivateKey(context.Context) (Credentials, error)
+}
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/error.go b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/error.go
new file mode 100644
index 0000000000..380d174271
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/error.go
@@ -0,0 +1,17 @@
+package v4a
+
+import "fmt"
+
+// SigningError indicates an error condition occurred while performing SigV4a signing
+type SigningError struct {
+	Err error
+}
+
+func (e *SigningError) Error() string {
+	return fmt.Sprintf("failed to sign request: %v", e.Err)
+}
+
+// Unwrap returns the underlying error cause
+func (e *SigningError) Unwrap() error {
+	return e.Err
+}
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/ini/go_module_metadata.go b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/go_module_metadata.go
similarity index 74%
rename from vendor/github.com/aws/aws-sdk-go-v2/internal/ini/go_module_metadata.go
rename to vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/go_module_metadata.go
index 1dc2e12aa8..455cb74e1a 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/internal/ini/go_module_metadata.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/go_module_metadata.go
@@ -1,6 +1,6 @@
 // Code generated by internal/repotools/cmd/updatemodulemeta DO NOT EDIT.
 
-package ini
+package v4a
 
 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.8.6"
+const goModuleVersion = "1.4.24"
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/internal/crypto/compare.go b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/internal/crypto/compare.go
new file mode 100644
index 0000000000..1d0f25f8c2
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/internal/crypto/compare.go
@@ -0,0 +1,30 @@
+package crypto
+
+import "fmt"
+
+// ConstantTimeByteCompare is a constant-time byte comparison of x and y. This function performs an absolute comparison
+// if the two byte slices assuming they represent a big-endian number.
+//
+//		 error if len(x) != len(y)
+//	  -1 if x <  y
+//	   0 if x == y
+//	  +1 if x >  y
+func ConstantTimeByteCompare(x, y []byte) (int, error) {
+	if len(x) != len(y) {
+		return 0, fmt.Errorf("slice lengths do not match")
+	}
+
+	xLarger, yLarger := 0, 0
+
+	for i := 0; i < len(x); i++ {
+		xByte, yByte := int(x[i]), int(y[i])
+
+		x := ((yByte - xByte) >> 8) & 1
+		y := ((xByte - yByte) >> 8) & 1
+
+		xLarger |= x &^ yLarger
+		yLarger |= y &^ xLarger
+	}
+
+	return xLarger - yLarger, nil
+}
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/internal/crypto/ecc.go b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/internal/crypto/ecc.go
new file mode 100644
index 0000000000..758c73fcb3
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/internal/crypto/ecc.go
@@ -0,0 +1,113 @@
+package crypto
+
+import (
+	"bytes"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/hmac"
+	"encoding/asn1"
+	"encoding/binary"
+	"fmt"
+	"hash"
+	"math"
+	"math/big"
+)
+
+type ecdsaSignature struct {
+	R, S *big.Int
+}
+
+// ECDSAKey takes the given elliptic curve, and private key (d) byte slice
+// and returns the private ECDSA key.
+func ECDSAKey(curve elliptic.Curve, d []byte) *ecdsa.PrivateKey {
+	return ECDSAKeyFromPoint(curve, (&big.Int{}).SetBytes(d))
+}
+
+// ECDSAKeyFromPoint takes the given elliptic curve and point and returns the
+// private and public keypair
+func ECDSAKeyFromPoint(curve elliptic.Curve, d *big.Int) *ecdsa.PrivateKey {
+	pX, pY := curve.ScalarBaseMult(d.Bytes())
+
+	privKey := &ecdsa.PrivateKey{
+		PublicKey: ecdsa.PublicKey{
+			Curve: curve,
+			X:     pX,
+			Y:     pY,
+		},
+		D: d,
+	}
+
+	return privKey
+}
+
+// ECDSAPublicKey takes the provide curve and (x, y) coordinates and returns
+// *ecdsa.PublicKey. Returns an error if the given points are not on the curve.
+func ECDSAPublicKey(curve elliptic.Curve, x, y []byte) (*ecdsa.PublicKey, error) {
+	xPoint := (&big.Int{}).SetBytes(x)
+	yPoint := (&big.Int{}).SetBytes(y)
+
+	if !curve.IsOnCurve(xPoint, yPoint) {
+		return nil, fmt.Errorf("point(%v, %v) is not on the given curve", xPoint.String(), yPoint.String())
+	}
+
+	return &ecdsa.PublicKey{
+		Curve: curve,
+		X:     xPoint,
+		Y:     yPoint,
+	}, nil
+}
+
+// VerifySignature takes the provided public key, hash, and asn1 encoded signature and returns
+// whether the given signature is valid.
+func VerifySignature(key *ecdsa.PublicKey, hash []byte, signature []byte) (bool, error) {
+	var ecdsaSignature ecdsaSignature
+
+	_, err := asn1.Unmarshal(signature, &ecdsaSignature)
+	if err != nil {
+		return false, err
+	}
+
+	return ecdsa.Verify(key, hash, ecdsaSignature.R, ecdsaSignature.S), nil
+}
+
+// HMACKeyDerivation provides an implementation of a NIST-800-108 of a KDF (Key Derivation Function) in Counter Mode.
+// For the purposes of this implantation HMAC is used as the PRF (Pseudorandom function), where the value of
+// `r` is defined as a 4 byte counter.
+func HMACKeyDerivation(hash func() hash.Hash, bitLen int, key []byte, label, context []byte) ([]byte, error) {
+	// verify that we won't overflow the counter
+	n := int64(math.Ceil((float64(bitLen) / 8) / float64(hash().Size())))
+	if n > 0x7FFFFFFF {
+		return nil, fmt.Errorf("unable to derive key of size %d using 32-bit counter", bitLen)
+	}
+
+	// verify the requested bit length is not larger then the length encoding size
+	if int64(bitLen) > 0x7FFFFFFF {
+		return nil, fmt.Errorf("bitLen is greater than 32-bits")
+	}
+
+	fixedInput := bytes.NewBuffer(nil)
+	fixedInput.Write(label)
+	fixedInput.WriteByte(0x00)
+	fixedInput.Write(context)
+	if err := binary.Write(fixedInput, binary.BigEndian, int32(bitLen)); err != nil {
+		return nil, fmt.Errorf("failed to write bit length to fixed input string: %v", err)
+	}
+
+	var output []byte
+
+	h := hmac.New(hash, key)
+
+	for i := int64(1); i <= n; i++ {
+		h.Reset()
+		if err := binary.Write(h, binary.BigEndian, int32(i)); err != nil {
+			return nil, err
+		}
+		_, err := h.Write(fixedInput.Bytes())
+		if err != nil {
+			return nil, err
+		}
+		output = append(output, h.Sum(nil)...)
+	}
+
+	return output[:bitLen/8], nil
+}
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/internal/v4/const.go b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/internal/v4/const.go
new file mode 100644
index 0000000000..89a76e2eaa
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/internal/v4/const.go
@@ -0,0 +1,36 @@
+package v4
+
+const (
+	// EmptyStringSHA256 is the hex encoded sha256 value of an empty string
+	EmptyStringSHA256 = `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
+
+	// UnsignedPayload indicates that the request payload body is unsigned
+	UnsignedPayload = "UNSIGNED-PAYLOAD"
+
+	// AmzAlgorithmKey indicates the signing algorithm
+	AmzAlgorithmKey = "X-Amz-Algorithm"
+
+	// AmzSecurityTokenKey indicates the security token to be used with temporary credentials
+	AmzSecurityTokenKey = "X-Amz-Security-Token"
+
+	// AmzDateKey is the UTC timestamp for the request in the format YYYYMMDD'T'HHMMSS'Z'
+	AmzDateKey = "X-Amz-Date"
+
+	// AmzCredentialKey is the access key ID and credential scope
+	AmzCredentialKey = "X-Amz-Credential"
+
+	// AmzSignedHeadersKey is the set of headers signed for the request
+	AmzSignedHeadersKey = "X-Amz-SignedHeaders"
+
+	// AmzSignatureKey is the query parameter to store the SigV4 signature
+	AmzSignatureKey = "X-Amz-Signature"
+
+	// TimeFormat is the time format to be used in the X-Amz-Date header or query parameter
+	TimeFormat = "20060102T150405Z"
+
+	// ShortTimeFormat is the shorten time format used in the credential scope
+	ShortTimeFormat = "20060102"
+
+	// ContentSHAKey is the SHA256 of request body
+	ContentSHAKey = "X-Amz-Content-Sha256"
+)
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/internal/v4/header_rules.go b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/internal/v4/header_rules.go
new file mode 100644
index 0000000000..a15177e8f3
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/internal/v4/header_rules.go
@@ -0,0 +1,82 @@
+package v4
+
+import (
+	sdkstrings "github.com/aws/aws-sdk-go-v2/internal/strings"
+)
+
+// Rules houses a set of Rule needed for validation of a
+// string value
+type Rules []Rule
+
+// Rule interface allows for more flexible rules and just simply
+// checks whether or not a value adheres to that Rule
+type Rule interface {
+	IsValid(value string) bool
+}
+
+// IsValid will iterate through all rules and see if any rules
+// apply to the value and supports nested rules
+func (r Rules) IsValid(value string) bool {
+	for _, rule := range r {
+		if rule.IsValid(value) {
+			return true
+		}
+	}
+	return false
+}
+
+// MapRule generic Rule for maps
+type MapRule map[string]struct{}
+
+// IsValid for the map Rule satisfies whether it exists in the map
+func (m MapRule) IsValid(value string) bool {
+	_, ok := m[value]
+	return ok
+}
+
+// AllowList is a generic Rule for whitelisting
+type AllowList struct {
+	Rule
+}
+
+// IsValid for AllowList checks if the value is within the AllowList
+func (w AllowList) IsValid(value string) bool {
+	return w.Rule.IsValid(value)
+}
+
+// DenyList is a generic Rule for blacklisting
+type DenyList struct {
+	Rule
+}
+
+// IsValid for AllowList checks if the value is within the AllowList
+func (b DenyList) IsValid(value string) bool {
+	return !b.Rule.IsValid(value)
+}
+
+// Patterns is a list of strings to match against
+type Patterns []string
+
+// IsValid for Patterns checks each pattern and returns if a match has
+// been found
+func (p Patterns) IsValid(value string) bool {
+	for _, pattern := range p {
+		if sdkstrings.HasPrefixFold(value, pattern) {
+			return true
+		}
+	}
+	return false
+}
+
+// InclusiveRules rules allow for rules to depend on one another
+type InclusiveRules []Rule
+
+// IsValid will return true if all rules are true
+func (r InclusiveRules) IsValid(value string) bool {
+	for _, rule := range r {
+		if !rule.IsValid(value) {
+			return false
+		}
+	}
+	return true
+}
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/internal/v4/headers.go b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/internal/v4/headers.go
new file mode 100644
index 0000000000..688f834742
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/internal/v4/headers.go
@@ -0,0 +1,68 @@
+package v4
+
+// IgnoredHeaders is a list of headers that are ignored during signing
+var IgnoredHeaders = Rules{
+	DenyList{
+		MapRule{
+			"Authorization":     struct{}{},
+			"User-Agent":        struct{}{},
+			"X-Amzn-Trace-Id":   struct{}{},
+			"Transfer-Encoding": struct{}{},
+		},
+	},
+}
+
+// RequiredSignedHeaders is a whitelist for Build canonical headers.
+var RequiredSignedHeaders = Rules{
+	AllowList{
+		MapRule{
+			"Cache-Control":                         struct{}{},
+			"Content-Disposition":                   struct{}{},
+			"Content-Encoding":                      struct{}{},
+			"Content-Language":                      struct{}{},
+			"Content-Md5":                           struct{}{},
+			"Content-Type":                          struct{}{},
+			"Expires":                               struct{}{},
+			"If-Match":                              struct{}{},
+			"If-Modified-Since":                     struct{}{},
+			"If-None-Match":                         struct{}{},
+			"If-Unmodified-Since":                   struct{}{},
+			"Range":                                 struct{}{},
+			"X-Amz-Acl":                             struct{}{},
+			"X-Amz-Copy-Source":                     struct{}{},
+			"X-Amz-Copy-Source-If-Match":            struct{}{},
+			"X-Amz-Copy-Source-If-Modified-Since":   struct{}{},
+			"X-Amz-Copy-Source-If-None-Match":       struct{}{},
+			"X-Amz-Copy-Source-If-Unmodified-Since": struct{}{},
+			"X-Amz-Copy-Source-Range":               struct{}{},
+			"X-Amz-Copy-Source-Server-Side-Encryption-Customer-Algorithm": struct{}{},
+			"X-Amz-Copy-Source-Server-Side-Encryption-Customer-Key":       struct{}{},
+			"X-Amz-Copy-Source-Server-Side-Encryption-Customer-Key-Md5":   struct{}{},
+			"X-Amz-Grant-Full-control":                                    struct{}{},
+			"X-Amz-Grant-Read":                                            struct{}{},
+			"X-Amz-Grant-Read-Acp":                                        struct{}{},
+			"X-Amz-Grant-Write":                                           struct{}{},
+			"X-Amz-Grant-Write-Acp":                                       struct{}{},
+			"X-Amz-Metadata-Directive":                                    struct{}{},
+			"X-Amz-Mfa":                                                   struct{}{},
+			"X-Amz-Request-Payer":                                         struct{}{},
+			"X-Amz-Server-Side-Encryption":                                struct{}{},
+			"X-Amz-Server-Side-Encryption-Aws-Kms-Key-Id":                 struct{}{},
+			"X-Amz-Server-Side-Encryption-Customer-Algorithm":             struct{}{},
+			"X-Amz-Server-Side-Encryption-Customer-Key":                   struct{}{},
+			"X-Amz-Server-Side-Encryption-Customer-Key-Md5":               struct{}{},
+			"X-Amz-Storage-Class":                                         struct{}{},
+			"X-Amz-Website-Redirect-Location":                             struct{}{},
+			"X-Amz-Content-Sha256":                                        struct{}{},
+			"X-Amz-Tagging":                                               struct{}{},
+		},
+	},
+	Patterns{"X-Amz-Meta-"},
+}
+
+// AllowedQueryHoisting is a whitelist for Build query headers. The boolean value
+// represents whether or not it is a pattern.
+var AllowedQueryHoisting = InclusiveRules{
+	DenyList{RequiredSignedHeaders},
+	Patterns{"X-Amz-"},
+}
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/internal/v4/hmac.go b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/internal/v4/hmac.go
new file mode 100644
index 0000000000..e7fa7a1b1e
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/internal/v4/hmac.go
@@ -0,0 +1,13 @@
+package v4
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+)
+
+// HMACSHA256 computes a HMAC-SHA256 of data given the provided key.
+func HMACSHA256(key []byte, data []byte) []byte {
+	hash := hmac.New(sha256.New, key)
+	hash.Write(data)
+	return hash.Sum(nil)
+}
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/internal/v4/host.go b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/internal/v4/host.go
new file mode 100644
index 0000000000..bf93659a43
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/internal/v4/host.go
@@ -0,0 +1,75 @@
+package v4
+
+import (
+	"net/http"
+	"strings"
+)
+
+// SanitizeHostForHeader removes default port from host and updates request.Host
+func SanitizeHostForHeader(r *http.Request) {
+	host := getHost(r)
+	port := portOnly(host)
+	if port != "" && isDefaultPort(r.URL.Scheme, port) {
+		r.Host = stripPort(host)
+	}
+}
+
+// Returns host from request
+func getHost(r *http.Request) string {
+	if r.Host != "" {
+		return r.Host
+	}
+
+	return r.URL.Host
+}
+
+// Hostname returns u.Host, without any port number.
+//
+// If Host is an IPv6 literal with a port number, Hostname returns the
+// IPv6 literal without the square brackets. IPv6 literals may include
+// a zone identifier.
+//
+// Copied from the Go 1.8 standard library (net/url)
+func stripPort(hostport string) string {
+	colon := strings.IndexByte(hostport, ':')
+	if colon == -1 {
+		return hostport
+	}
+	if i := strings.IndexByte(hostport, ']'); i != -1 {
+		return strings.TrimPrefix(hostport[:i], "[")
+	}
+	return hostport[:colon]
+}
+
+// Port returns the port part of u.Host, without the leading colon.
+// If u.Host doesn't contain a port, Port returns an empty string.
+//
+// Copied from the Go 1.8 standard library (net/url)
+func portOnly(hostport string) string {
+	colon := strings.IndexByte(hostport, ':')
+	if colon == -1 {
+		return ""
+	}
+	if i := strings.Index(hostport, "]:"); i != -1 {
+		return hostport[i+len("]:"):]
+	}
+	if strings.Contains(hostport, "]") {
+		return ""
+	}
+	return hostport[colon+len(":"):]
+}
+
+// Returns true if the specified URI is using the standard port
+// (i.e. port 80 for HTTP URIs or 443 for HTTPS URIs)
+func isDefaultPort(scheme, port string) bool {
+	if port == "" {
+		return true
+	}
+
+	lowerCaseScheme := strings.ToLower(scheme)
+	if (lowerCaseScheme == "http" && port == "80") || (lowerCaseScheme == "https" && port == "443") {
+		return true
+	}
+
+	return false
+}
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/internal/v4/time.go b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/internal/v4/time.go
new file mode 100644
index 0000000000..1de06a765d
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/internal/v4/time.go
@@ -0,0 +1,36 @@
+package v4
+
+import "time"
+
+// SigningTime provides a wrapper around a time.Time which provides cached values for SigV4 signing.
+type SigningTime struct {
+	time.Time
+	timeFormat      string
+	shortTimeFormat string
+}
+
+// NewSigningTime creates a new SigningTime given a time.Time
+func NewSigningTime(t time.Time) SigningTime {
+	return SigningTime{
+		Time: t,
+	}
+}
+
+// TimeFormat provides a time formatted in the X-Amz-Date format.
+func (m *SigningTime) TimeFormat() string {
+	return m.format(&m.timeFormat, TimeFormat)
+}
+
+// ShortTimeFormat provides a time formatted of 20060102.
+func (m *SigningTime) ShortTimeFormat() string {
+	return m.format(&m.shortTimeFormat, ShortTimeFormat)
+}
+
+func (m *SigningTime) format(target *string, format string) string {
+	if len(*target) > 0 {
+		return *target
+	}
+	v := m.Time.Format(format)
+	*target = v
+	return v
+}
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/internal/v4/util.go b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/internal/v4/util.go
new file mode 100644
index 0000000000..741019b5f9
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/internal/v4/util.go
@@ -0,0 +1,64 @@
+package v4
+
+import (
+	"net/url"
+	"strings"
+)
+
+const doubleSpace = "  "
+
+// StripExcessSpaces will rewrite the passed in slice's string values to not
+// contain muliple side-by-side spaces.
+func StripExcessSpaces(str string) string {
+	var j, k, l, m, spaces int
+	// Trim trailing spaces
+	for j = len(str) - 1; j >= 0 && str[j] == ' '; j-- {
+	}
+
+	// Trim leading spaces
+	for k = 0; k < j && str[k] == ' '; k++ {
+	}
+	str = str[k : j+1]
+
+	// Strip multiple spaces.
+	j = strings.Index(str, doubleSpace)
+	if j < 0 {
+		return str
+	}
+
+	buf := []byte(str)
+	for k, m, l = j, j, len(buf); k < l; k++ {
+		if buf[k] == ' ' {
+			if spaces == 0 {
+				// First space.
+				buf[m] = buf[k]
+				m++
+			}
+			spaces++
+		} else {
+			// End of multiple spaces.
+			spaces = 0
+			buf[m] = buf[k]
+			m++
+		}
+	}
+
+	return string(buf[:m])
+}
+
+// GetURIPath returns the escaped URI component from the provided URL
+func GetURIPath(u *url.URL) string {
+	var uri string
+
+	if len(u.Opaque) > 0 {
+		uri = "/" + strings.Join(strings.Split(u.Opaque, "/")[3:], "/")
+	} else {
+		uri = u.EscapedPath()
+	}
+
+	if len(uri) == 0 {
+		uri = "/"
+	}
+
+	return uri
+}
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/middleware.go b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/middleware.go
new file mode 100644
index 0000000000..64b8b4e330
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/middleware.go
@@ -0,0 +1,118 @@
+package v4a
+
+import (
+	"context"
+	"fmt"
+	awsmiddleware "github.com/aws/aws-sdk-go-v2/aws/middleware"
+	v4 "github.com/aws/aws-sdk-go-v2/aws/signer/v4"
+	internalauth "github.com/aws/aws-sdk-go-v2/internal/auth"
+	"github.com/aws/smithy-go/middleware"
+	smithyhttp "github.com/aws/smithy-go/transport/http"
+	"net/http"
+	"time"
+)
+
+// HTTPSigner is SigV4a HTTP signer implementation
+type HTTPSigner interface {
+	SignHTTP(ctx context.Context, credentials Credentials, r *http.Request, payloadHash string, service string, regionSet []string, signingTime time.Time, optfns ...func(*SignerOptions)) error
+}
+
+// SignHTTPRequestMiddlewareOptions is the middleware options for constructing a SignHTTPRequestMiddleware.
+type SignHTTPRequestMiddlewareOptions struct {
+	Credentials CredentialsProvider
+	Signer      HTTPSigner
+	LogSigning  bool
+}
+
+// SignHTTPRequestMiddleware is a middleware for signing an HTTP request using SigV4a.
+type SignHTTPRequestMiddleware struct {
+	credentials CredentialsProvider
+	signer      HTTPSigner
+	logSigning  bool
+}
+
+// NewSignHTTPRequestMiddleware constructs a SignHTTPRequestMiddleware using the given SignHTTPRequestMiddlewareOptions.
+func NewSignHTTPRequestMiddleware(options SignHTTPRequestMiddlewareOptions) *SignHTTPRequestMiddleware {
+	return &SignHTTPRequestMiddleware{
+		credentials: options.Credentials,
+		signer:      options.Signer,
+		logSigning:  options.LogSigning,
+	}
+}
+
+// ID the middleware identifier.
+func (s *SignHTTPRequestMiddleware) ID() string {
+	return "Signing"
+}
+
+// HandleFinalize signs an HTTP request using SigV4a.
+func (s *SignHTTPRequestMiddleware) HandleFinalize(
+	ctx context.Context, in middleware.FinalizeInput, next middleware.FinalizeHandler,
+) (
+	out middleware.FinalizeOutput, metadata middleware.Metadata, err error,
+) {
+	if !hasCredentialProvider(s.credentials) {
+		return next.HandleFinalize(ctx, in)
+	}
+
+	req, ok := in.Request.(*smithyhttp.Request)
+	if !ok {
+		return out, metadata, fmt.Errorf("unexpected request middleware type %T", in.Request)
+	}
+
+	signingName, signingRegion := awsmiddleware.GetSigningName(ctx), awsmiddleware.GetSigningRegion(ctx)
+	payloadHash := v4.GetPayloadHash(ctx)
+	if len(payloadHash) == 0 {
+		return out, metadata, &SigningError{Err: fmt.Errorf("computed payload hash missing from context")}
+	}
+
+	credentials, err := s.credentials.RetrievePrivateKey(ctx)
+	if err != nil {
+		return out, metadata, &SigningError{Err: fmt.Errorf("failed to retrieve credentials: %w", err)}
+	}
+
+	signerOptions := []func(o *SignerOptions){
+		func(o *SignerOptions) {
+			o.Logger = middleware.GetLogger(ctx)
+			o.LogSigning = s.logSigning
+		},
+	}
+
+	// existing DisableURIPathEscaping is equivalent in purpose
+	// to authentication scheme property DisableDoubleEncoding
+	disableDoubleEncoding, overridden := internalauth.GetDisableDoubleEncoding(ctx)
+	if overridden {
+		signerOptions = append(signerOptions, func(o *SignerOptions) {
+			o.DisableURIPathEscaping = disableDoubleEncoding
+		})
+	}
+
+	err = s.signer.SignHTTP(ctx, credentials, req.Request, payloadHash, signingName, []string{signingRegion}, time.Now().UTC(), signerOptions...)
+	if err != nil {
+		return out, metadata, &SigningError{Err: fmt.Errorf("failed to sign http request, %w", err)}
+	}
+
+	return next.HandleFinalize(ctx, in)
+}
+
+func hasCredentialProvider(p CredentialsProvider) bool {
+	if p == nil {
+		return false
+	}
+
+	return true
+}
+
+// RegisterSigningMiddleware registers the SigV4a signing middleware to the stack. If a signing middleware is already
+// present, this provided middleware will be swapped. Otherwise the middleware will be added at the tail of the
+// finalize step.
+func RegisterSigningMiddleware(stack *middleware.Stack, signingMiddleware *SignHTTPRequestMiddleware) (err error) {
+	const signedID = "Signing"
+	_, present := stack.Finalize.Get(signedID)
+	if present {
+		_, err = stack.Finalize.Swap(signedID, signingMiddleware)
+	} else {
+		err = stack.Finalize.Add(signingMiddleware, middleware.After)
+	}
+	return err
+}
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/presign_middleware.go b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/presign_middleware.go
new file mode 100644
index 0000000000..951fc415d5
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/presign_middleware.go
@@ -0,0 +1,117 @@
+package v4a
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"time"
+
+	awsmiddleware "github.com/aws/aws-sdk-go-v2/aws/middleware"
+	v4 "github.com/aws/aws-sdk-go-v2/aws/signer/v4"
+	"github.com/aws/aws-sdk-go-v2/internal/sdk"
+	"github.com/aws/smithy-go/middleware"
+	smithyHTTP "github.com/aws/smithy-go/transport/http"
+)
+
+// HTTPPresigner is an interface to a SigV4a signer that can sign create a
+// presigned URL for a HTTP requests.
+type HTTPPresigner interface {
+	PresignHTTP(
+		ctx context.Context, credentials Credentials, r *http.Request,
+		payloadHash string, service string, regionSet []string, signingTime time.Time,
+		optFns ...func(*SignerOptions),
+	) (url string, signedHeader http.Header, err error)
+}
+
+// PresignHTTPRequestMiddlewareOptions is the options for the PresignHTTPRequestMiddleware middleware.
+type PresignHTTPRequestMiddlewareOptions struct {
+	CredentialsProvider CredentialsProvider
+	Presigner           HTTPPresigner
+	LogSigning          bool
+}
+
+// PresignHTTPRequestMiddleware provides the Finalize middleware for creating a
+// presigned URL for an HTTP request.
+//
+// Will short circuit the middleware stack and not forward onto the next
+// Finalize handler.
+type PresignHTTPRequestMiddleware struct {
+	credentialsProvider CredentialsProvider
+	presigner           HTTPPresigner
+	logSigning          bool
+}
+
+// NewPresignHTTPRequestMiddleware returns a new PresignHTTPRequestMiddleware
+// initialized with the presigner.
+func NewPresignHTTPRequestMiddleware(options PresignHTTPRequestMiddlewareOptions) *PresignHTTPRequestMiddleware {
+	return &PresignHTTPRequestMiddleware{
+		credentialsProvider: options.CredentialsProvider,
+		presigner:           options.Presigner,
+		logSigning:          options.LogSigning,
+	}
+}
+
+// ID provides the middleware ID.
+func (*PresignHTTPRequestMiddleware) ID() string { return "PresignHTTPRequest" }
+
+// HandleFinalize will take the provided input and create a presigned url for
+// the http request using the SigV4 presign authentication scheme.
+func (s *PresignHTTPRequestMiddleware) HandleFinalize(
+	ctx context.Context, in middleware.FinalizeInput, next middleware.FinalizeHandler,
+) (
+	out middleware.FinalizeOutput, metadata middleware.Metadata, err error,
+) {
+	req, ok := in.Request.(*smithyHTTP.Request)
+	if !ok {
+		return out, metadata, &SigningError{
+			Err: fmt.Errorf("unexpected request middleware type %T", in.Request),
+		}
+	}
+
+	httpReq := req.Build(ctx)
+	if !hasCredentialProvider(s.credentialsProvider) {
+		out.Result = &v4.PresignedHTTPRequest{
+			URL:          httpReq.URL.String(),
+			Method:       httpReq.Method,
+			SignedHeader: http.Header{},
+		}
+
+		return out, metadata, nil
+	}
+
+	signingName := awsmiddleware.GetSigningName(ctx)
+	signingRegion := awsmiddleware.GetSigningRegion(ctx)
+	payloadHash := v4.GetPayloadHash(ctx)
+	if len(payloadHash) == 0 {
+		return out, metadata, &SigningError{
+			Err: fmt.Errorf("computed payload hash missing from context"),
+		}
+	}
+
+	credentials, err := s.credentialsProvider.RetrievePrivateKey(ctx)
+	if err != nil {
+		return out, metadata, &SigningError{
+			Err: fmt.Errorf("failed to retrieve credentials: %w", err),
+		}
+	}
+
+	u, h, err := s.presigner.PresignHTTP(ctx, credentials,
+		httpReq, payloadHash, signingName, []string{signingRegion}, sdk.NowTime(),
+		func(o *SignerOptions) {
+			o.Logger = middleware.GetLogger(ctx)
+			o.LogSigning = s.logSigning
+		})
+	if err != nil {
+		return out, metadata, &SigningError{
+			Err: fmt.Errorf("failed to sign http request, %w", err),
+		}
+	}
+
+	out.Result = &v4.PresignedHTTPRequest{
+		URL:          u,
+		Method:       httpReq.Method,
+		SignedHeader: h,
+	}
+
+	return out, metadata, nil
+}
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/smithy.go b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/smithy.go
new file mode 100644
index 0000000000..c3b689bace
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/smithy.go
@@ -0,0 +1,92 @@
+package v4a
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	internalcontext "github.com/aws/aws-sdk-go-v2/internal/context"
+
+	v4 "github.com/aws/aws-sdk-go-v2/aws/signer/v4"
+	"github.com/aws/aws-sdk-go-v2/internal/sdk"
+	"github.com/aws/smithy-go"
+	"github.com/aws/smithy-go/auth"
+	"github.com/aws/smithy-go/logging"
+	smithyhttp "github.com/aws/smithy-go/transport/http"
+)
+
+// CredentialsAdapter adapts v4a.Credentials to smithy auth.Identity.
+type CredentialsAdapter struct {
+	Credentials Credentials
+}
+
+var _ auth.Identity = (*CredentialsAdapter)(nil)
+
+// Expiration returns the time of expiration for the credentials.
+func (v *CredentialsAdapter) Expiration() time.Time {
+	return v.Credentials.Expires
+}
+
+// CredentialsProviderAdapter adapts v4a.CredentialsProvider to
+// auth.IdentityResolver.
+type CredentialsProviderAdapter struct {
+	Provider CredentialsProvider
+}
+
+var _ (auth.IdentityResolver) = (*CredentialsProviderAdapter)(nil)
+
+// GetIdentity retrieves v4a credentials using the underlying provider.
+func (v *CredentialsProviderAdapter) GetIdentity(ctx context.Context, _ smithy.Properties) (
+	auth.Identity, error,
+) {
+	creds, err := v.Provider.RetrievePrivateKey(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("get credentials: %w", err)
+	}
+
+	return &CredentialsAdapter{Credentials: creds}, nil
+}
+
+// SignerAdapter adapts v4a.HTTPSigner to smithy http.Signer.
+type SignerAdapter struct {
+	Signer     HTTPSigner
+	Logger     logging.Logger
+	LogSigning bool
+}
+
+var _ (smithyhttp.Signer) = (*SignerAdapter)(nil)
+
+// SignRequest signs the request with the provided identity.
+func (v *SignerAdapter) SignRequest(ctx context.Context, r *smithyhttp.Request, identity auth.Identity, props smithy.Properties) error {
+	ca, ok := identity.(*CredentialsAdapter)
+	if !ok {
+		return fmt.Errorf("unexpected identity type: %T", identity)
+	}
+
+	name, ok := smithyhttp.GetSigV4ASigningName(&props)
+	if !ok {
+		return fmt.Errorf("sigv4a signing name is required")
+	}
+
+	regions, ok := smithyhttp.GetSigV4ASigningRegions(&props)
+	if !ok {
+		return fmt.Errorf("sigv4a signing region is required")
+	}
+
+	hash := v4.GetPayloadHash(ctx)
+	signingTime := sdk.NowTime()
+	if skew := internalcontext.GetAttemptSkewContext(ctx); skew != 0 {
+		signingTime.Add(skew)
+	}
+	err := v.Signer.SignHTTP(ctx, ca.Credentials, r.Request, hash, name, regions, signingTime, func(o *SignerOptions) {
+		o.DisableURIPathEscaping, _ = smithyhttp.GetDisableDoubleEncoding(&props)
+
+		o.Logger = v.Logger
+		o.LogSigning = v.LogSigning
+	})
+	if err != nil {
+		return fmt.Errorf("sign http: %w", err)
+	}
+
+	return nil
+}
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/v4a.go b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/v4a.go
new file mode 100644
index 0000000000..f226bcdced
--- /dev/null
+++ b/vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/v4a.go
@@ -0,0 +1,520 @@
+package v4a
+
+import (
+	"bytes"
+	"context"
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"hash"
+	"math/big"
+	"net/http"
+	"net/textproto"
+	"net/url"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+
+	signerCrypto "github.com/aws/aws-sdk-go-v2/internal/v4a/internal/crypto"
+	v4Internal "github.com/aws/aws-sdk-go-v2/internal/v4a/internal/v4"
+	"github.com/aws/smithy-go/encoding/httpbinding"
+	"github.com/aws/smithy-go/logging"
+)
+
+const (
+	// AmzRegionSetKey represents the region set header used for sigv4a
+	AmzRegionSetKey     = "X-Amz-Region-Set"
+	amzAlgorithmKey     = v4Internal.AmzAlgorithmKey
+	amzSecurityTokenKey = v4Internal.AmzSecurityTokenKey
+	amzDateKey          = v4Internal.AmzDateKey
+	amzCredentialKey    = v4Internal.AmzCredentialKey
+	amzSignedHeadersKey = v4Internal.AmzSignedHeadersKey
+	authorizationHeader = "Authorization"
+
+	signingAlgorithm = "AWS4-ECDSA-P256-SHA256"
+
+	timeFormat      = "20060102T150405Z"
+	shortTimeFormat = "20060102"
+
+	// EmptyStringSHA256 is a hex encoded SHA-256 hash of an empty string
+	EmptyStringSHA256 = v4Internal.EmptyStringSHA256
+
+	// Version of signing v4a
+	Version = "SigV4A"
+)
+
+var (
+	p256          elliptic.Curve
+	nMinusTwoP256 *big.Int
+
+	one = new(big.Int).SetInt64(1)
+)
+
+func init() {
+	// Ensure the elliptic curve parameters are initialized on package import rather then on first usage
+	p256 = elliptic.P256()
+
+	nMinusTwoP256 = new(big.Int).SetBytes(p256.Params().N.Bytes())
+	nMinusTwoP256 = nMinusTwoP256.Sub(nMinusTwoP256, new(big.Int).SetInt64(2))
+}
+
+// SignerOptions is the SigV4a signing options for constructing a Signer.
+type SignerOptions struct {
+	Logger     logging.Logger
+	LogSigning bool
+
+	// Disables the Signer's moving HTTP header key/value pairs from the HTTP
+	// request header to the request's query string. This is most commonly used
+	// with pre-signed requests preventing headers from being added to the
+	// request's query string.
+	DisableHeaderHoisting bool
+
+	// Disables the automatic escaping of the URI path of the request for the
+	// siganture's canonical string's path. For services that do not need additional
+	// escaping then use this to disable the signer escaping the path.
+	//
+	// S3 is an example of a service that does not need additional escaping.
+	//
+	// http://docs.aws.amazon.com/general/latest/gr/sigv4-create-canonical-request.html
+	DisableURIPathEscaping bool
+}
+
+// Signer is a SigV4a HTTP signing implementation
+type Signer struct {
+	options SignerOptions
+}
+
+// NewSigner constructs a SigV4a Signer.
+func NewSigner(optFns ...func(*SignerOptions)) *Signer {
+	options := SignerOptions{}
+
+	for _, fn := range optFns {
+		fn(&options)
+	}
+
+	return &Signer{options: options}
+}
+
+// deriveKeyFromAccessKeyPair derives a NIST P-256 PrivateKey from the given
+// IAM AccessKey and SecretKey pair.
+//
+// Based on FIPS.186-4 Appendix B.4.2
+func deriveKeyFromAccessKeyPair(accessKey, secretKey string) (*ecdsa.PrivateKey, error) {
+	params := p256.Params()
+	bitLen := params.BitSize // Testing random candidates does not require an additional 64 bits
+	counter := 0x01
+
+	buffer := make([]byte, 1+len(accessKey)) // 1 byte counter + len(accessKey)
+	kdfContext := bytes.NewBuffer(buffer)
+
+	inputKey := append([]byte("AWS4A"), []byte(secretKey)...)
+
+	d := new(big.Int)
+	for {
+		kdfContext.Reset()
+		kdfContext.WriteString(accessKey)
+		kdfContext.WriteByte(byte(counter))
+
+		key, err := signerCrypto.HMACKeyDerivation(sha256.New, bitLen, inputKey, []byte(signingAlgorithm), kdfContext.Bytes())
+		if err != nil {
+			return nil, err
+		}
+
+		// Check key first before calling SetBytes if key key is in fact a valid candidate.
+		// This ensures the byte slice is the correct length (32-bytes) to compare in constant-time
+		cmp, err := signerCrypto.ConstantTimeByteCompare(key, nMinusTwoP256.Bytes())
+		if err != nil {
+			return nil, err
+		}
+		if cmp == -1 {
+			d.SetBytes(key)
+			break
+		}
+
+		counter++
+		if counter > 0xFF {
+			return nil, fmt.Errorf("exhausted single byte external counter")
+		}
+	}
+	d = d.Add(d, one)
+
+	priv := new(ecdsa.PrivateKey)
+	priv.PublicKey.Curve = p256
+	priv.D = d
+	priv.PublicKey.X, priv.PublicKey.Y = p256.ScalarBaseMult(d.Bytes())
+
+	return priv, nil
+}
+
+type httpSigner struct {
+	Request     *http.Request
+	ServiceName string
+	RegionSet   []string
+	Time        time.Time
+	Credentials Credentials
+	IsPreSign   bool
+
+	Logger logging.Logger
+	Debug  bool
+
+	// PayloadHash is the hex encoded SHA-256 hash of the request payload
+	// If len(PayloadHash) == 0 the signer will attempt to send the request
+	// as an unsigned payload. Note: Unsigned payloads only work for a subset of services.
+	PayloadHash string
+
+	DisableHeaderHoisting  bool
+	DisableURIPathEscaping bool
+}
+
+// SignHTTP takes the provided http.Request, payload hash, service, regionSet, and time and signs using SigV4a.
+// The passed in request will be modified in place.
+func (s *Signer) SignHTTP(ctx context.Context, credentials Credentials, r *http.Request, payloadHash string, service string, regionSet []string, signingTime time.Time, optFns ...func(*SignerOptions)) error {
+	options := s.options
+	for _, fn := range optFns {
+		fn(&options)
+	}
+
+	signer := &httpSigner{
+		Request:                r,
+		PayloadHash:            payloadHash,
+		ServiceName:            service,
+		RegionSet:              regionSet,
+		Credentials:            credentials,
+		Time:                   signingTime.UTC(),
+		DisableHeaderHoisting:  options.DisableHeaderHoisting,
+		DisableURIPathEscaping: options.DisableURIPathEscaping,
+	}
+
+	signedRequest, err := signer.Build()
+	if err != nil {
+		return err
+	}
+
+	logHTTPSigningInfo(ctx, options, signedRequest)
+
+	return nil
+}
+
+// PresignHTTP takes the provided http.Request, payload hash, service, regionSet, and time and presigns using SigV4a
+// Returns the presigned URL along with the headers that were signed with the request.
+//
+// PresignHTTP will not set the expires time of the presigned request
+// automatically. To specify the expire duration for a request add the
+// "X-Amz-Expires" query parameter on the request with the value as the
+// duration in seconds the presigned URL should be considered valid for. This
+// parameter is not used by all AWS services, and is most notable used by
+// Amazon S3 APIs.
+func (s *Signer) PresignHTTP(ctx context.Context, credentials Credentials, r *http.Request, payloadHash string, service string, regionSet []string, signingTime time.Time, optFns ...func(*SignerOptions)) (signedURI string, signedHeaders http.Header, err error) {
+	options := s.options
+	for _, fn := range optFns {
+		fn(&options)
+	}
+
+	signer := &httpSigner{
+		Request:                r,
+		PayloadHash:            payloadHash,
+		ServiceName:            service,
+		RegionSet:              regionSet,
+		Credentials:            credentials,
+		Time:                   signingTime.UTC(),
+		IsPreSign:              true,
+		DisableHeaderHoisting:  options.DisableHeaderHoisting,
+		DisableURIPathEscaping: options.DisableURIPathEscaping,
+	}
+
+	signedRequest, err := signer.Build()
+	if err != nil {
+		return "", nil, err
+	}
+
+	logHTTPSigningInfo(ctx, options, signedRequest)
+
+	signedHeaders = make(http.Header)
+
+	// For the signed headers we canonicalize the header keys in the returned map.
+	// This avoids situations where can standard library double headers like host header. For example the standard
+	// library will set the Host header, even if it is present in lower-case form.
+	for k, v := range signedRequest.SignedHeaders {
+		key := textproto.CanonicalMIMEHeaderKey(k)
+		signedHeaders[key] = append(signedHeaders[key], v...)
+	}
+
+	return signedRequest.Request.URL.String(), signedHeaders, nil
+}
+
+func (s *httpSigner) setRequiredSigningFields(headers http.Header, query url.Values) {
+	amzDate := s.Time.Format(timeFormat)
+
+	if s.IsPreSign {
+		query.Set(AmzRegionSetKey, strings.Join(s.RegionSet, ","))
+		query.Set(amzDateKey, amzDate)
+		query.Set(amzAlgorithmKey, signingAlgorithm)
+		if len(s.Credentials.SessionToken) > 0 {
+			query.Set(amzSecurityTokenKey, s.Credentials.SessionToken)
+		}
+		return
+	}
+
+	headers.Set(AmzRegionSetKey, strings.Join(s.RegionSet, ","))
+	headers.Set(amzDateKey, amzDate)
+	if len(s.Credentials.SessionToken) > 0 {
+		headers.Set(amzSecurityTokenKey, s.Credentials.SessionToken)
+	}
+}
+
+func (s *httpSigner) Build() (signedRequest, error) {
+	req := s.Request
+
+	query := req.URL.Query()
+	headers := req.Header
+
+	s.setRequiredSigningFields(headers, query)
+
+	// Sort Each Query Key's Values
+	for key := range query {
+		sort.Strings(query[key])
+	}
+
+	v4Internal.SanitizeHostForHeader(req)
+
+	credentialScope := s.buildCredentialScope()
+	credentialStr := s.Credentials.Context + "/" + credentialScope
+	if s.IsPreSign {
+		query.Set(amzCredentialKey, credentialStr)
+	}
+
+	unsignedHeaders := headers
+	if s.IsPreSign && !s.DisableHeaderHoisting {
+		urlValues := url.Values{}
+		urlValues, unsignedHeaders = buildQuery(v4Internal.AllowedQueryHoisting, unsignedHeaders)
+		for k := range urlValues {
+			query[k] = urlValues[k]
+		}
+	}
+
+	host := req.URL.Host
+	if len(req.Host) > 0 {
+		host = req.Host
+	}
+
+	signedHeaders, signedHeadersStr, canonicalHeaderStr := s.buildCanonicalHeaders(host, v4Internal.IgnoredHeaders, unsignedHeaders, s.Request.ContentLength)
+
+	if s.IsPreSign {
+		query.Set(amzSignedHeadersKey, signedHeadersStr)
+	}
+
+	rawQuery := strings.Replace(query.Encode(), "+", "%20", -1)
+
+	canonicalURI := v4Internal.GetURIPath(req.URL)
+	if !s.DisableURIPathEscaping {
+		canonicalURI = httpbinding.EscapePath(canonicalURI, false)
+	}
+
+	canonicalString := s.buildCanonicalString(
+		req.Method,
+		canonicalURI,
+		rawQuery,
+		signedHeadersStr,
+		canonicalHeaderStr,
+	)
+
+	strToSign := s.buildStringToSign(credentialScope, canonicalString)
+	signingSignature, err := s.buildSignature(strToSign)
+	if err != nil {
+		return signedRequest{}, err
+	}
+
+	if s.IsPreSign {
+		rawQuery += "&X-Amz-Signature=" + signingSignature
+	} else {
+		headers[authorizationHeader] = append(headers[authorizationHeader][:0], buildAuthorizationHeader(credentialStr, signedHeadersStr, signingSignature))
+	}
+
+	req.URL.RawQuery = rawQuery
+
+	return signedRequest{
+		Request:         req,
+		SignedHeaders:   signedHeaders,
+		CanonicalString: canonicalString,
+		StringToSign:    strToSign,
+		PreSigned:       s.IsPreSign,
+	}, nil
+}
+
+func buildAuthorizationHeader(credentialStr, signedHeadersStr, signingSignature string) string {
+	const credential = "Credential="
+	const signedHeaders = "SignedHeaders="
+	const signature = "Signature="
+	const commaSpace = ", "
+
+	var parts strings.Builder
+	parts.Grow(len(signingAlgorithm) + 1 +
+		len(credential) + len(credentialStr) + len(commaSpace) +
+		len(signedHeaders) + len(signedHeadersStr) + len(commaSpace) +
+		len(signature) + len(signingSignature),
+	)
+	parts.WriteString(signingAlgorithm)
+	parts.WriteRune(' ')
+	parts.WriteString(credential)
+	parts.WriteString(credentialStr)
+	parts.WriteString(commaSpace)
+	parts.WriteString(signedHeaders)
+	parts.WriteString(signedHeadersStr)
+	parts.WriteString(commaSpace)
+	parts.WriteString(signature)
+	parts.WriteString(signingSignature)
+	return parts.String()
+}
+
+func (s *httpSigner) buildCredentialScope() string {
+	return strings.Join([]string{
+		s.Time.Format(shortTimeFormat),
+		s.ServiceName,
+		"aws4_request",
+	}, "/")
+
+}
+
+func buildQuery(r v4Internal.Rule, header http.Header) (url.Values, http.Header) {
+	query := url.Values{}
+	unsignedHeaders := http.Header{}
+	for k, h := range header {
+		if r.IsValid(k) {
+			query[k] = h
+		} else {
+			unsignedHeaders[k] = h
+		}
+	}
+
+	return query, unsignedHeaders
+}
+
+func (s *httpSigner) buildCanonicalHeaders(host string, rule v4Internal.Rule, header http.Header, length int64) (signed http.Header, signedHeaders, canonicalHeadersStr string) {
+	signed = make(http.Header)
+
+	var headers []string
+	const hostHeader = "host"
+	headers = append(headers, hostHeader)
+	signed[hostHeader] = append(signed[hostHeader], host)
+
+	if length > 0 {
+		const contentLengthHeader = "content-length"
+		headers = append(headers, contentLengthHeader)
+		signed[contentLengthHeader] = append(signed[contentLengthHeader], strconv.FormatInt(length, 10))
+	}
+
+	for k, v := range header {
+		if !rule.IsValid(k) {
+			continue // ignored header
+		}
+
+		lowerCaseKey := strings.ToLower(k)
+		if _, ok := signed[lowerCaseKey]; ok {
+			// include additional values
+			signed[lowerCaseKey] = append(signed[lowerCaseKey], v...)
+			continue
+		}
+
+		headers = append(headers, lowerCaseKey)
+		signed[lowerCaseKey] = v
+	}
+	sort.Strings(headers)
+
+	signedHeaders = strings.Join(headers, ";")
+
+	var canonicalHeaders strings.Builder
+	n := len(headers)
+	const colon = ':'
+	for i := range n {
+		if headers[i] == hostHeader {
+			canonicalHeaders.WriteString(hostHeader)
+			canonicalHeaders.WriteRune(colon)
+			canonicalHeaders.WriteString(v4Internal.StripExcessSpaces(host))
+		} else {
+			canonicalHeaders.WriteString(headers[i])
+			canonicalHeaders.WriteRune(colon)
+			// Trim out leading, trailing, and dedup inner spaces from signed header values.
+			values := signed[headers[i]]
+			for j, v := range values {
+				cleanedValue := strings.TrimSpace(v4Internal.StripExcessSpaces(v))
+				canonicalHeaders.WriteString(cleanedValue)
+				if j < len(values)-1 {
+					canonicalHeaders.WriteRune(',')
+				}
+			}
+		}
+		canonicalHeaders.WriteRune('\n')
+	}
+	canonicalHeadersStr = canonicalHeaders.String()
+
+	return signed, signedHeaders, canonicalHeadersStr
+}
+
+func (s *httpSigner) buildCanonicalString(method, uri, query, signedHeaders, canonicalHeaders string) string {
+	return strings.Join([]string{
+		method,
+		uri,
+		query,
+		canonicalHeaders,
+		signedHeaders,
+		s.PayloadHash,
+	}, "\n")
+}
+
+func (s *httpSigner) buildStringToSign(credentialScope, canonicalRequestString string) string {
+	return strings.Join([]string{
+		signingAlgorithm,
+		s.Time.Format(timeFormat),
+		credentialScope,
+		hex.EncodeToString(makeHash(sha256.New(), []byte(canonicalRequestString))),
+	}, "\n")
+}
+
+func makeHash(hash hash.Hash, b []byte) []byte {
+	hash.Reset()
+	hash.Write(b)
+	return hash.Sum(nil)
+}
+
+func (s *httpSigner) buildSignature(strToSign string) (string, error) {
+	sig, err := s.Credentials.PrivateKey.Sign(rand.Reader, makeHash(sha256.New(), []byte(strToSign)), crypto.SHA256)
+	if err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(sig), nil
+}
+
+const logSignInfoMsg = `Request Signature:
+---[ CANONICAL STRING  ]-----------------------------
+%s
+---[ STRING TO SIGN ]--------------------------------
+%s%s
+-----------------------------------------------------`
+const logSignedURLMsg = `
+---[ SIGNED URL ]------------------------------------
+%s`
+
+func logHTTPSigningInfo(ctx context.Context, options SignerOptions, r signedRequest) {
+	if !options.LogSigning {
+		return
+	}
+	signedURLMsg := ""
+	if r.PreSigned {
+		signedURLMsg = fmt.Sprintf(logSignedURLMsg, r.Request.URL.String())
+	}
+	logger := logging.WithContext(ctx, options.Logger)
+	logger.Logf(logging.Debug, logSignInfoMsg, r.CanonicalString, r.StringToSign, signedURLMsg)
+}
+
+type signedRequest struct {
+	Request         *http.Request
+	SignedHeaders   http.Header
+	CanonicalString string
+	StringToSign    string
+	PreSigned       bool
+}
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding/CHANGELOG.md b/vendor/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding/CHANGELOG.md
index 497d372304..cf6c5e0911 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding/CHANGELOG.md
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding/CHANGELOG.md
@@ -1,3 +1,11 @@
+# v1.13.9 (2026-04-29)
+
+* **Dependency Update**: Update to smithy-go v1.25.1.
+
+# v1.13.8 (2026-04-17)
+
+* **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
+
 # v1.13.7 (2026-03-13)
 
 * **Bug Fix**: Replace usages of the old ioutil/ package throughout the SDK.
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding/go_module_metadata.go b/vendor/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding/go_module_metadata.go
index 5679a2b2b1..e145070706 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding/go_module_metadata.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding/go_module_metadata.go
@@ -3,4 +3,4 @@
 package acceptencoding
 
 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.13.7"
+const goModuleVersion = "1.13.9"
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url/CHANGELOG.md b/vendor/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url/CHANGELOG.md
index 7c5e13816e..96adad5261 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url/CHANGELOG.md
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url/CHANGELOG.md
@@ -1,3 +1,13 @@
+# v1.13.23 (2026-04-29)
+
+* **Dependency Update**: Update to smithy-go v1.25.1.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.13.22 (2026-04-17)
+
+* **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
+* **Dependency Update**: Updated to the latest SDK module versions
+
 # v1.13.21 (2026-03-26)
 
 * **Dependency Update**: Updated to the latest SDK module versions
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url/go_module_metadata.go b/vendor/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url/go_module_metadata.go
index 456855e885..5737e9c0c1 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url/go_module_metadata.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url/go_module_metadata.go
@@ -3,4 +3,4 @@
 package presignedurl
 
 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.13.21"
+const goModuleVersion = "1.13.23"
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/CHANGELOG.md b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/CHANGELOG.md
index 6625fa25ef..253e035967 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/CHANGELOG.md
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/CHANGELOG.md
@@ -1,3 +1,18 @@
+# v1.0.11 (2026-04-29)
+
+* **Dependency Update**: Update to smithy-go v1.25.1.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.0.10 (2026-04-17)
+
+* **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.0.9 (2026-03-26)
+
+* **Bug Fix**: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
+* **Dependency Update**: Updated to the latest SDK module versions
+
 # v1.0.8 (2026-03-13)
 
 * **Dependency Update**: Updated to the latest SDK module versions
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_client.go b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_client.go
index d2db11d2aa..2c0413c16e 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_client.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_client.go
@@ -15,9 +15,7 @@ import (
 	internalauth "github.com/aws/aws-sdk-go-v2/internal/auth"
 	internalauthsmithy "github.com/aws/aws-sdk-go-v2/internal/auth/smithy"
 	internalConfig "github.com/aws/aws-sdk-go-v2/internal/configsources"
-	internalmiddleware "github.com/aws/aws-sdk-go-v2/internal/middleware"
 	smithy "github.com/aws/smithy-go"
-	smithyauth "github.com/aws/smithy-go/auth"
 	smithydocument "github.com/aws/smithy-go/document"
 	"github.com/aws/smithy-go/logging"
 	"github.com/aws/smithy-go/metrics"
@@ -711,10 +709,11 @@ func addIsPaginatorUserAgent(o *Options) {
 	})
 }
 
-func addRetry(stack *middleware.Stack, o Options) error {
+func addRetry(stack *middleware.Stack, o Options, c *Client) error {
 	attempt := retry.NewAttemptMiddleware(o.Retryer, smithyhttp.RequestCloner, func(m *retry.Attempt) {
 		m.LogAttempts = o.ClientLogMode.IsRetries()
 		m.OperationMeter = o.MeterProvider.Meter("github.com/aws/aws-sdk-go-v2/service/signin")
+		m.ClientSkew = c.timeOffset
 	})
 	if err := stack.Finalize.Insert(attempt, "ResolveAuthScheme", middleware.Before); err != nil {
 		return err
@@ -755,25 +754,6 @@ func resolveUseFIPSEndpoint(cfg aws.Config, o *Options) error {
 	return nil
 }
 
-func resolveAccountID(identity smithyauth.Identity, mode aws.AccountIDEndpointMode) *string {
-	if mode == aws.AccountIDEndpointModeDisabled {
-		return nil
-	}
-
-	if ca, ok := identity.(*internalauthsmithy.CredentialsAdapter); ok && ca.Credentials.AccountID != "" {
-		return aws.String(ca.Credentials.AccountID)
-	}
-
-	return nil
-}
-
-func addTimeOffsetBuild(stack *middleware.Stack, c *Client) error {
-	mw := internalmiddleware.AddTimeOffsetMiddleware{Offset: c.timeOffset}
-	if err := stack.Build.Add(&mw, middleware.After); err != nil {
-		return err
-	}
-	return stack.Deserialize.Insert(&mw, "RecordResponseTiming", middleware.Before)
-}
 func initializeTimeOffsetResolver(c *Client) {
 	c.timeOffset = new(atomic.Int64)
 }
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_CreateOAuth2Token.go b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_CreateOAuth2Token.go
index 54ba42422d..dec8656f86 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_CreateOAuth2Token.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_CreateOAuth2Token.go
@@ -134,7 +134,7 @@ func (c *Client) addOperationCreateOAuth2TokenMiddlewares(stack *middleware.Stac
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -158,9 +158,6 @@ func (c *Client) addOperationCreateOAuth2TokenMiddlewares(stack *middleware.Stac
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
-	if err = addTimeOffsetBuild(stack, c); err != nil {
-		return err
-	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/go_module_metadata.go b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/go_module_metadata.go
index fe22d5a366..eba7ad7774 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/signin/go_module_metadata.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/signin/go_module_metadata.go
@@ -3,4 +3,4 @@
 package signin
 
 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.0.8"
+const goModuleVersion = "1.0.11"
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sso/CHANGELOG.md b/vendor/github.com/aws/aws-sdk-go-v2/service/sso/CHANGELOG.md
index 6c9be38802..26c80a2c23 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/sso/CHANGELOG.md
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sso/CHANGELOG.md
@@ -1,3 +1,22 @@
+# v1.30.17 (2026-04-29)
+
+* **Dependency Update**: Update to smithy-go v1.25.1.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.30.16 (2026-04-17)
+
+* **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.30.15 (2026-04-02)
+
+* No change notes available for this release.
+
+# v1.30.14 (2026-03-26)
+
+* **Bug Fix**: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
+* **Dependency Update**: Updated to the latest SDK module versions
+
 # v1.30.13 (2026-03-13)
 
 * **Dependency Update**: Updated to the latest SDK module versions
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_client.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_client.go
index 8e5a2e77f8..ca5364792a 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_client.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_client.go
@@ -15,9 +15,7 @@ import (
 	internalauth "github.com/aws/aws-sdk-go-v2/internal/auth"
 	internalauthsmithy "github.com/aws/aws-sdk-go-v2/internal/auth/smithy"
 	internalConfig "github.com/aws/aws-sdk-go-v2/internal/configsources"
-	internalmiddleware "github.com/aws/aws-sdk-go-v2/internal/middleware"
 	smithy "github.com/aws/smithy-go"
-	smithyauth "github.com/aws/smithy-go/auth"
 	smithydocument "github.com/aws/smithy-go/document"
 	"github.com/aws/smithy-go/logging"
 	"github.com/aws/smithy-go/metrics"
@@ -711,10 +709,11 @@ func addIsPaginatorUserAgent(o *Options) {
 	})
 }
 
-func addRetry(stack *middleware.Stack, o Options) error {
+func addRetry(stack *middleware.Stack, o Options, c *Client) error {
 	attempt := retry.NewAttemptMiddleware(o.Retryer, smithyhttp.RequestCloner, func(m *retry.Attempt) {
 		m.LogAttempts = o.ClientLogMode.IsRetries()
 		m.OperationMeter = o.MeterProvider.Meter("github.com/aws/aws-sdk-go-v2/service/sso")
+		m.ClientSkew = c.timeOffset
 	})
 	if err := stack.Finalize.Insert(attempt, "ResolveAuthScheme", middleware.Before); err != nil {
 		return err
@@ -755,25 +754,6 @@ func resolveUseFIPSEndpoint(cfg aws.Config, o *Options) error {
 	return nil
 }
 
-func resolveAccountID(identity smithyauth.Identity, mode aws.AccountIDEndpointMode) *string {
-	if mode == aws.AccountIDEndpointModeDisabled {
-		return nil
-	}
-
-	if ca, ok := identity.(*internalauthsmithy.CredentialsAdapter); ok && ca.Credentials.AccountID != "" {
-		return aws.String(ca.Credentials.AccountID)
-	}
-
-	return nil
-}
-
-func addTimeOffsetBuild(stack *middleware.Stack, c *Client) error {
-	mw := internalmiddleware.AddTimeOffsetMiddleware{Offset: c.timeOffset}
-	if err := stack.Build.Add(&mw, middleware.After); err != nil {
-		return err
-	}
-	return stack.Deserialize.Insert(&mw, "RecordResponseTiming", middleware.Before)
-}
 func initializeTimeOffsetResolver(c *Client) {
 	c.timeOffset = new(atomic.Int64)
 }
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_GetRoleCredentials.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_GetRoleCredentials.go
index c0b961fcf1..5482b7a032 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_GetRoleCredentials.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_GetRoleCredentials.go
@@ -93,7 +93,7 @@ func (c *Client) addOperationGetRoleCredentialsMiddlewares(stack *middleware.Sta
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -117,9 +117,6 @@ func (c *Client) addOperationGetRoleCredentialsMiddlewares(stack *middleware.Sta
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
-	if err = addTimeOffsetBuild(stack, c); err != nil {
-		return err
-	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_ListAccountRoles.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_ListAccountRoles.go
index f5ca09ac7d..8759d52576 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_ListAccountRoles.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_ListAccountRoles.go
@@ -98,7 +98,7 @@ func (c *Client) addOperationListAccountRolesMiddlewares(stack *middleware.Stack
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -122,9 +122,6 @@ func (c *Client) addOperationListAccountRolesMiddlewares(stack *middleware.Stack
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
-	if err = addTimeOffsetBuild(stack, c); err != nil {
-		return err
-	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_ListAccounts.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_ListAccounts.go
index 54511d34a6..fea5b43912 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_ListAccounts.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_ListAccounts.go
@@ -97,7 +97,7 @@ func (c *Client) addOperationListAccountsMiddlewares(stack *middleware.Stack, op
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -121,9 +121,6 @@ func (c *Client) addOperationListAccountsMiddlewares(stack *middleware.Stack, op
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
-	if err = addTimeOffsetBuild(stack, c); err != nil {
-		return err
-	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_Logout.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_Logout.go
index a21116e96c..84aef7ce5f 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_Logout.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_Logout.go
@@ -92,7 +92,7 @@ func (c *Client) addOperationLogoutMiddlewares(stack *middleware.Stack, options
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -116,9 +116,6 @@ func (c *Client) addOperationLogoutMiddlewares(stack *middleware.Stack, options
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
-	if err = addTimeOffsetBuild(stack, c); err != nil {
-		return err
-	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sso/go_module_metadata.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sso/go_module_metadata.go
index fde08b7d08..9d12dd55bc 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/sso/go_module_metadata.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sso/go_module_metadata.go
@@ -3,4 +3,4 @@
 package sso
 
 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.30.13"
+const goModuleVersion = "1.30.17"
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sso/internal/endpoints/endpoints.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sso/internal/endpoints/endpoints.go
index 9f550c3f1b..871275a6bf 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/sso/internal/endpoints/endpoints.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sso/internal/endpoints/endpoints.go
@@ -482,6 +482,11 @@ var defaultPartitions = endpoints.Partitions{
 		},
 		RegionRegex:    partitionRegexp.AwsEusc,
 		IsRegionalized: true,
+		Endpoints: endpoints.Endpoints{
+			endpoints.EndpointKey{
+				Region: "eusc-de-east-1",
+			}: endpoints.Endpoint{},
+		},
 	},
 	{
 		ID: "aws-iso",
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/CHANGELOG.md b/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/CHANGELOG.md
index 40da3df26f..e645209405 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/CHANGELOG.md
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/CHANGELOG.md
@@ -1,3 +1,22 @@
+# v1.35.21 (2026-04-29)
+
+* **Dependency Update**: Update to smithy-go v1.25.1.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.35.20 (2026-04-17)
+
+* **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.35.19 (2026-04-02)
+
+* No change notes available for this release.
+
+# v1.35.18 (2026-03-26)
+
+* **Bug Fix**: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
+* **Dependency Update**: Updated to the latest SDK module versions
+
 # v1.35.17 (2026-03-13)
 
 * **Dependency Update**: Updated to the latest SDK module versions
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_client.go b/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_client.go
index 8e8508fa34..2c0958ade2 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_client.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_client.go
@@ -15,9 +15,7 @@ import (
 	internalauth "github.com/aws/aws-sdk-go-v2/internal/auth"
 	internalauthsmithy "github.com/aws/aws-sdk-go-v2/internal/auth/smithy"
 	internalConfig "github.com/aws/aws-sdk-go-v2/internal/configsources"
-	internalmiddleware "github.com/aws/aws-sdk-go-v2/internal/middleware"
 	smithy "github.com/aws/smithy-go"
-	smithyauth "github.com/aws/smithy-go/auth"
 	smithydocument "github.com/aws/smithy-go/document"
 	"github.com/aws/smithy-go/logging"
 	"github.com/aws/smithy-go/metrics"
@@ -711,10 +709,11 @@ func addIsPaginatorUserAgent(o *Options) {
 	})
 }
 
-func addRetry(stack *middleware.Stack, o Options) error {
+func addRetry(stack *middleware.Stack, o Options, c *Client) error {
 	attempt := retry.NewAttemptMiddleware(o.Retryer, smithyhttp.RequestCloner, func(m *retry.Attempt) {
 		m.LogAttempts = o.ClientLogMode.IsRetries()
 		m.OperationMeter = o.MeterProvider.Meter("github.com/aws/aws-sdk-go-v2/service/ssooidc")
+		m.ClientSkew = c.timeOffset
 	})
 	if err := stack.Finalize.Insert(attempt, "ResolveAuthScheme", middleware.Before); err != nil {
 		return err
@@ -755,25 +754,6 @@ func resolveUseFIPSEndpoint(cfg aws.Config, o *Options) error {
 	return nil
 }
 
-func resolveAccountID(identity smithyauth.Identity, mode aws.AccountIDEndpointMode) *string {
-	if mode == aws.AccountIDEndpointModeDisabled {
-		return nil
-	}
-
-	if ca, ok := identity.(*internalauthsmithy.CredentialsAdapter); ok && ca.Credentials.AccountID != "" {
-		return aws.String(ca.Credentials.AccountID)
-	}
-
-	return nil
-}
-
-func addTimeOffsetBuild(stack *middleware.Stack, c *Client) error {
-	mw := internalmiddleware.AddTimeOffsetMiddleware{Offset: c.timeOffset}
-	if err := stack.Build.Add(&mw, middleware.After); err != nil {
-		return err
-	}
-	return stack.Deserialize.Insert(&mw, "RecordResponseTiming", middleware.Before)
-}
 func initializeTimeOffsetResolver(c *Client) {
 	c.timeOffset = new(atomic.Int64)
 }
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_CreateToken.go b/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_CreateToken.go
index 3f622dbcb9..cd739d53f5 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_CreateToken.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_CreateToken.go
@@ -163,7 +163,7 @@ func (c *Client) addOperationCreateTokenMiddlewares(stack *middleware.Stack, opt
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -187,9 +187,6 @@ func (c *Client) addOperationCreateTokenMiddlewares(stack *middleware.Stack, opt
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
-	if err = addTimeOffsetBuild(stack, c); err != nil {
-		return err
-	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_CreateTokenWithIAM.go b/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_CreateTokenWithIAM.go
index 24cb2fac8d..a02f62a286 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_CreateTokenWithIAM.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_CreateTokenWithIAM.go
@@ -210,7 +210,7 @@ func (c *Client) addOperationCreateTokenWithIAMMiddlewares(stack *middleware.Sta
 	if err = addComputePayloadSHA256(stack); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -234,9 +234,6 @@ func (c *Client) addOperationCreateTokenWithIAMMiddlewares(stack *middleware.Sta
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
-	if err = addTimeOffsetBuild(stack, c); err != nil {
-		return err
-	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_RegisterClient.go b/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_RegisterClient.go
index 14472ee3be..f32e86be9c 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_RegisterClient.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_RegisterClient.go
@@ -134,7 +134,7 @@ func (c *Client) addOperationRegisterClientMiddlewares(stack *middleware.Stack,
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -158,9 +158,6 @@ func (c *Client) addOperationRegisterClientMiddlewares(stack *middleware.Stack,
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
-	if err = addTimeOffsetBuild(stack, c); err != nil {
-		return err
-	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_StartDeviceAuthorization.go b/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_StartDeviceAuthorization.go
index 92a6854a77..a35750b227 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_StartDeviceAuthorization.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_StartDeviceAuthorization.go
@@ -116,7 +116,7 @@ func (c *Client) addOperationStartDeviceAuthorizationMiddlewares(stack *middlewa
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -140,9 +140,6 @@ func (c *Client) addOperationStartDeviceAuthorizationMiddlewares(stack *middlewa
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
-	if err = addTimeOffsetBuild(stack, c); err != nil {
-		return err
-	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/go_module_metadata.go b/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/go_module_metadata.go
index a8373e5b55..af00268dfc 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/go_module_metadata.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/go_module_metadata.go
@@ -3,4 +3,4 @@
 package ssooidc
 
 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.35.17"
+const goModuleVersion = "1.35.21"
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/internal/endpoints/endpoints.go b/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/internal/endpoints/endpoints.go
index b7c58e2f24..4ab58f60bd 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/internal/endpoints/endpoints.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/internal/endpoints/endpoints.go
@@ -482,6 +482,11 @@ var defaultPartitions = endpoints.Partitions{
 		},
 		RegionRegex:    partitionRegexp.AwsEusc,
 		IsRegionalized: true,
+		Endpoints: endpoints.Endpoints{
+			endpoints.EndpointKey{
+				Region: "eusc-de-east-1",
+			}: endpoints.Endpoint{},
+		},
 	},
 	{
 		ID: "aws-iso",
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/CHANGELOG.md b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/CHANGELOG.md
index 32f04b84c4..199f7a79ce 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/CHANGELOG.md
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/CHANGELOG.md
@@ -1,3 +1,19 @@
+# v1.42.1 (2026-04-29)
+
+* **Dependency Update**: Update to smithy-go v1.25.1.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.42.0 (2026-04-17)
+
+* **Feature**: The STS client now supports configuring SigV4a through the auth scheme preference setting. SigV4a uses asymmetric cryptography, enabling customers using long-term IAM credentials to continue making STS API calls even when a region is isolated from the partition leader.
+* **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.41.10 (2026-03-26)
+
+* **Bug Fix**: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
+* **Dependency Update**: Updated to the latest SDK module versions
+
 # v1.41.9 (2026-03-13)
 
 * **Dependency Update**: Updated to the latest SDK module versions
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_client.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_client.go
index 70228d0dfa..958c83c1a8 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_client.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_client.go
@@ -16,11 +16,10 @@ import (
 	internalauth "github.com/aws/aws-sdk-go-v2/internal/auth"
 	internalauthsmithy "github.com/aws/aws-sdk-go-v2/internal/auth/smithy"
 	internalConfig "github.com/aws/aws-sdk-go-v2/internal/configsources"
-	internalmiddleware "github.com/aws/aws-sdk-go-v2/internal/middleware"
+	"github.com/aws/aws-sdk-go-v2/internal/v4a"
 	acceptencodingcust "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding"
 	presignedurlcust "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url"
 	smithy "github.com/aws/smithy-go"
-	smithyauth "github.com/aws/smithy-go/auth"
 	smithydocument "github.com/aws/smithy-go/document"
 	"github.com/aws/smithy-go/logging"
 	"github.com/aws/smithy-go/metrics"
@@ -209,6 +208,8 @@ func New(options Options, optFns ...func(*Options)) *Client {
 
 	resolveEndpointResolverV2(&options)
 
+	resolveHTTPSignerV4a(&options)
+
 	resolveTracerProvider(&options)
 
 	resolveMeterProvider(&options)
@@ -383,6 +384,11 @@ func resolveAuthSchemes(options *Options) {
 				Logger:     options.Logger,
 				LogSigning: options.ClientLogMode.IsSigning(),
 			}),
+			internalauth.NewHTTPAuthScheme("aws.auth#sigv4a", &v4a.SignerAdapter{
+				Signer:     options.httpSignerV4a,
+				Logger:     options.Logger,
+				LogSigning: options.ClientLogMode.IsSigning(),
+			}),
 		}
 	}
 }
@@ -715,10 +721,11 @@ func addIsPaginatorUserAgent(o *Options) {
 	})
 }
 
-func addRetry(stack *middleware.Stack, o Options) error {
+func addRetry(stack *middleware.Stack, o Options, c *Client) error {
 	attempt := retry.NewAttemptMiddleware(o.Retryer, smithyhttp.RequestCloner, func(m *retry.Attempt) {
 		m.LogAttempts = o.ClientLogMode.IsRetries()
 		m.OperationMeter = o.MeterProvider.Meter("github.com/aws/aws-sdk-go-v2/service/sts")
+		m.ClientSkew = c.timeOffset
 	})
 	if err := stack.Finalize.Insert(attempt, "ResolveAuthScheme", middleware.Before); err != nil {
 		return err
@@ -759,25 +766,26 @@ func resolveUseFIPSEndpoint(cfg aws.Config, o *Options) error {
 	return nil
 }
 
-func resolveAccountID(identity smithyauth.Identity, mode aws.AccountIDEndpointMode) *string {
-	if mode == aws.AccountIDEndpointModeDisabled {
-		return nil
-	}
+type httpSignerV4a interface {
+	SignHTTP(ctx context.Context, credentials v4a.Credentials, r *http.Request, payloadHash,
+		service string, regionSet []string, signingTime time.Time,
+		optFns ...func(*v4a.SignerOptions)) error
+}
 
-	if ca, ok := identity.(*internalauthsmithy.CredentialsAdapter); ok && ca.Credentials.AccountID != "" {
-		return aws.String(ca.Credentials.AccountID)
+func resolveHTTPSignerV4a(o *Options) {
+	if o.httpSignerV4a != nil {
+		return
 	}
-
-	return nil
+	o.httpSignerV4a = newDefaultV4aSigner(*o)
 }
 
-func addTimeOffsetBuild(stack *middleware.Stack, c *Client) error {
-	mw := internalmiddleware.AddTimeOffsetMiddleware{Offset: c.timeOffset}
-	if err := stack.Build.Add(&mw, middleware.After); err != nil {
-		return err
-	}
-	return stack.Deserialize.Insert(&mw, "RecordResponseTiming", middleware.Before)
+func newDefaultV4aSigner(o Options) *v4a.Signer {
+	return v4a.NewSigner(func(so *v4a.SignerOptions) {
+		so.Logger = o.Logger
+		so.LogSigning = o.ClientLogMode.IsSigning()
+	})
 }
+
 func initializeTimeOffsetResolver(c *Client) {
 	c.timeOffset = new(atomic.Int64)
 }
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRole.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRole.go
index 0ddd3623ae..83aa65a5a2 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRole.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRole.go
@@ -448,7 +448,7 @@ func (c *Client) addOperationAssumeRoleMiddlewares(stack *middleware.Stack, opti
 	if err = addComputePayloadSHA256(stack); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -472,9 +472,6 @@ func (c *Client) addOperationAssumeRoleMiddlewares(stack *middleware.Stack, opti
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
-	if err = addTimeOffsetBuild(stack, c); err != nil {
-		return err
-	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRoleWithSAML.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRoleWithSAML.go
index 15f1dd91d2..520e6e1c61 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRoleWithSAML.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRoleWithSAML.go
@@ -383,7 +383,7 @@ func (c *Client) addOperationAssumeRoleWithSAMLMiddlewares(stack *middleware.Sta
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -407,9 +407,6 @@ func (c *Client) addOperationAssumeRoleWithSAMLMiddlewares(stack *middleware.Sta
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
-	if err = addTimeOffsetBuild(stack, c); err != nil {
-		return err
-	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRoleWithWebIdentity.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRoleWithWebIdentity.go
index 7006eb3b7f..8a164be5be 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRoleWithWebIdentity.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRoleWithWebIdentity.go
@@ -400,7 +400,7 @@ func (c *Client) addOperationAssumeRoleWithWebIdentityMiddlewares(stack *middlew
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -424,9 +424,6 @@ func (c *Client) addOperationAssumeRoleWithWebIdentityMiddlewares(stack *middlew
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
-	if err = addTimeOffsetBuild(stack, c); err != nil {
-		return err
-	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRoot.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRoot.go
index 009c405583..b52a372dba 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRoot.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRoot.go
@@ -157,7 +157,7 @@ func (c *Client) addOperationAssumeRootMiddlewares(stack *middleware.Stack, opti
 	if err = addComputePayloadSHA256(stack); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -181,9 +181,6 @@ func (c *Client) addOperationAssumeRootMiddlewares(stack *middleware.Stack, opti
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
-	if err = addTimeOffsetBuild(stack, c); err != nil {
-		return err
-	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_DecodeAuthorizationMessage.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_DecodeAuthorizationMessage.go
index b00b0c4096..eaeab8a683 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_DecodeAuthorizationMessage.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_DecodeAuthorizationMessage.go
@@ -117,7 +117,7 @@ func (c *Client) addOperationDecodeAuthorizationMessageMiddlewares(stack *middle
 	if err = addComputePayloadSHA256(stack); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -141,9 +141,6 @@ func (c *Client) addOperationDecodeAuthorizationMessageMiddlewares(stack *middle
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
-	if err = addTimeOffsetBuild(stack, c); err != nil {
-		return err
-	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetAccessKeyInfo.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetAccessKeyInfo.go
index 887bb081f3..2f7adb2f53 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetAccessKeyInfo.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetAccessKeyInfo.go
@@ -108,7 +108,7 @@ func (c *Client) addOperationGetAccessKeyInfoMiddlewares(stack *middleware.Stack
 	if err = addComputePayloadSHA256(stack); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -132,9 +132,6 @@ func (c *Client) addOperationGetAccessKeyInfoMiddlewares(stack *middleware.Stack
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
-	if err = addTimeOffsetBuild(stack, c); err != nil {
-		return err
-	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetCallerIdentity.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetCallerIdentity.go
index 2c8d886701..f2d4fbc240 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetCallerIdentity.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetCallerIdentity.go
@@ -99,7 +99,7 @@ func (c *Client) addOperationGetCallerIdentityMiddlewares(stack *middleware.Stac
 	if err = addComputePayloadSHA256(stack); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -123,9 +123,6 @@ func (c *Client) addOperationGetCallerIdentityMiddlewares(stack *middleware.Stac
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
-	if err = addTimeOffsetBuild(stack, c); err != nil {
-		return err
-	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetDelegatedAccessToken.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetDelegatedAccessToken.go
index 092ec13e3a..78d688acc7 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetDelegatedAccessToken.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetDelegatedAccessToken.go
@@ -97,7 +97,7 @@ func (c *Client) addOperationGetDelegatedAccessTokenMiddlewares(stack *middlewar
 	if err = addComputePayloadSHA256(stack); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -121,9 +121,6 @@ func (c *Client) addOperationGetDelegatedAccessTokenMiddlewares(stack *middlewar
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
-	if err = addTimeOffsetBuild(stack, c); err != nil {
-		return err
-	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetFederationToken.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetFederationToken.go
index e0fc9a5484..57b77ebcc3 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetFederationToken.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetFederationToken.go
@@ -321,7 +321,7 @@ func (c *Client) addOperationGetFederationTokenMiddlewares(stack *middleware.Sta
 	if err = addComputePayloadSHA256(stack); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -345,9 +345,6 @@ func (c *Client) addOperationGetFederationTokenMiddlewares(stack *middleware.Sta
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
-	if err = addTimeOffsetBuild(stack, c); err != nil {
-		return err
-	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetSessionToken.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetSessionToken.go
index 2f931f4446..4b4083501d 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetSessionToken.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetSessionToken.go
@@ -170,7 +170,7 @@ func (c *Client) addOperationGetSessionTokenMiddlewares(stack *middleware.Stack,
 	if err = addComputePayloadSHA256(stack); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -194,9 +194,6 @@ func (c *Client) addOperationGetSessionTokenMiddlewares(stack *middleware.Stack,
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
-	if err = addTimeOffsetBuild(stack, c); err != nil {
-		return err
-	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetWebIdentityToken.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetWebIdentityToken.go
index 306ee43b1e..7738de5f60 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetWebIdentityToken.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetWebIdentityToken.go
@@ -120,7 +120,7 @@ func (c *Client) addOperationGetWebIdentityTokenMiddlewares(stack *middleware.St
 	if err = addComputePayloadSHA256(stack); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -144,9 +144,6 @@ func (c *Client) addOperationGetWebIdentityTokenMiddlewares(stack *middleware.St
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
-	if err = addTimeOffsetBuild(stack, c); err != nil {
-		return err
-	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/auth.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/auth.go
index 4db5a51f93..71c5db38b7 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/auth.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/auth.go
@@ -149,6 +149,16 @@ func serviceAuthOptions(params *AuthResolverParameters) []*smithyauth.Option {
 				return props
 			}(),
 		},
+
+		{
+			SchemeID: smithyauth.SchemeIDSigV4A,
+			SignerProperties: func() smithy.Properties {
+				var props smithy.Properties
+				smithyhttp.SetSigV4ASigningName(&props, "sts")
+				smithyhttp.SetSigV4ASigningRegions(&props, []string{params.Region})
+				return props
+			}(),
+		},
 	}
 }
 
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/generated.json b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/generated.json
index b5556cbfbf..2fc7b400f7 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/generated.json
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/generated.json
@@ -3,6 +3,7 @@
         "github.com/aws/aws-sdk-go-v2": "v1.4.0",
         "github.com/aws/aws-sdk-go-v2/internal/configsources": "v0.0.0-00010101000000-000000000000",
         "github.com/aws/aws-sdk-go-v2/internal/endpoints/v2": "v2.0.0-00010101000000-000000000000",
+        "github.com/aws/aws-sdk-go-v2/internal/v4a": "v0.0.0-00010101000000-000000000000",
         "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding": "v1.0.5",
         "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url": "v1.0.7",
         "github.com/aws/smithy-go": "v1.4.0"
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/go_module_metadata.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/go_module_metadata.go
index 88f4eb9f19..bdd6a15d8f 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/go_module_metadata.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/go_module_metadata.go
@@ -3,4 +3,4 @@
 package sts
 
 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.41.9"
+const goModuleVersion = "1.42.1"
diff --git a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/options.go b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/options.go
index c66e69a8d9..a9f2361fd3 100644
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/options.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/options.go
@@ -4,9 +4,11 @@ package sts
 
 import (
 	"context"
+	"fmt"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	awsmiddleware "github.com/aws/aws-sdk-go-v2/aws/middleware"
 	internalauthsmithy "github.com/aws/aws-sdk-go-v2/internal/auth/smithy"
+	"github.com/aws/aws-sdk-go-v2/internal/v4a"
 	smithyauth "github.com/aws/smithy-go/auth"
 	"github.com/aws/smithy-go/logging"
 	"github.com/aws/smithy-go/metrics"
@@ -107,6 +109,9 @@ type Options struct {
 	// The client tracer provider.
 	TracerProvider tracing.TracerProvider
 
+	// Signature Version 4a (SigV4a) Signer
+	httpSignerV4a httpSignerV4a
+
 	// The initial DefaultsMode used when the client options were constructed. If the
 	// DefaultsMode was set to aws.DefaultsModeAuto this will store what the resolved
 	// value was at that point in time.
@@ -146,6 +151,9 @@ func (o Options) GetIdentityResolver(schemeID string) smithyauth.IdentityResolve
 	if schemeID == "aws.auth#sigv4" {
 		return getSigV4IdentityResolver(o)
 	}
+	if schemeID == "aws.auth#sigv4a" {
+		return getSigV4AIdentityResolver(o)
+	}
 	if schemeID == "smithy.api#noAuth" {
 		return &smithyauth.AnonymousIdentityResolver{}
 	}
@@ -231,6 +239,46 @@ func WithSigV4SigningRegion(region string) func(*Options) {
 	}
 }
 
+func getSigV4AIdentityResolver(o Options) smithyauth.IdentityResolver {
+	if o.Credentials != nil {
+		return &v4a.CredentialsProviderAdapter{
+			Provider: &v4a.SymmetricCredentialAdaptor{
+				SymmetricProvider: o.Credentials,
+			},
+		}
+	}
+	return nil
+}
+
+// WithSigV4ASigningRegions applies an override to the authentication workflow to
+// use the given signing region set for SigV4A-authenticated operations.
+//
+// This is an advanced setting. The value here is FINAL, taking precedence over
+// the resolved signing region set from both auth scheme resolution and endpoint
+// resolution.
+func WithSigV4ASigningRegions(regions []string) func(*Options) {
+	fn := func(ctx context.Context, in middleware.FinalizeInput, next middleware.FinalizeHandler) (
+		out middleware.FinalizeOutput, metadata middleware.Metadata, err error,
+	) {
+		rscheme := getResolvedAuthScheme(ctx)
+		if rscheme == nil {
+			return out, metadata, fmt.Errorf("no resolved auth scheme")
+		}
+
+		smithyhttp.SetSigV4ASigningRegions(&rscheme.SignerProperties, regions)
+		return next.HandleFinalize(ctx, in)
+	}
+	return func(o *Options) {
+		o.APIOptions = append(o.APIOptions, func(s *middleware.Stack) error {
+			return s.Finalize.Insert(
+				middleware.FinalizeMiddlewareFunc("withSigV4ASigningRegions", fn),
+				"Signing",
+				middleware.Before,
+			)
+		})
+	}
+}
+
 func ignoreAnonymousAuth(options *Options) {
 	if aws.IsCredentialsProvider(options.Credentials, (*aws.AnonymousCredentials)(nil)) {
 		options.Credentials = nil
diff --git a/vendor/github.com/aws/smithy-go/AGENTS.md b/vendor/github.com/aws/smithy-go/AGENTS.md
new file mode 100644
index 0000000000..e2a75b8ea1
--- /dev/null
+++ b/vendor/github.com/aws/smithy-go/AGENTS.md
@@ -0,0 +1,172 @@
+# AGENTS.md
+
+## Project overview
+
+smithy-go is the Go code generator and runtime for [Smithy](https://smithy.io/).
+It has two major components:
+
+1. **Codegen** (`codegen/`) — A Smithy build plugin written in Java that
+   generates Go client/server/shape code from Smithy models.
+2. **Runtime** (`./`, top-level Go module) — The Go packages that generated
+   code depends on at runtime.
+
+The primary downstream consumer is
+[aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2).
+
+## Repository layout
+
+```
+.                               # Root Go module (github.com/aws/smithy-go)
+├── auth/                       # Auth identity + scheme interfaces
+│   └── bearer/                 # Bearer token auth
+├── aws-http-auth/              # Separate module: AWS SigV4/SigV4A HTTP signing
+├── codegen/                    # Java/Gradle: Smithy code generator
+│   ├── smithy-go-codegen/      # Main codegen source (Java)
+│   └── smithy-go-codegen-test/ # Codegen integration tests
+├── container/                  # Generic container types
+├── context/                    # Context helpers
+├── document/                   # Smithy document type abstraction
+│   └── json/                   # JSON document codec
+├── encoding/                   # Wire format encoders/decoders
+│   ├── cbor/                   # CBOR (used by rpcv2Cbor)
+│   ├── httpbinding/            # HTTP binding serde helpers
+│   ├── json/                   # JSON encoder/decoder
+│   └── xml/                    # XML encoder/decoder
+├── endpoints/                  # Endpoint resolution types
+├── internal/                   # Internal utilities (singleflight, etc.)
+├── io/                         # I/O helpers
+├── logging/                    # Logging interfaces
+├── metrics/                    # Metrics interfaces
+│   └── smithyotelmetrics/      # Separate module: OpenTelemetry metrics adapter
+├── middleware/                 # Middleware stack (the core of the operation pipeline)
+├── ptr/                        # Pointer-to/from-value helpers
+├── testing/                    # Test assertion helpers for generated protocol tests
+│   └── xml/                    # XML comparison utilities
+├── time/                       # Smithy timestamp format helpers
+├── tracing/                    # Tracing interfaces
+│   └── smithyoteltracing/      # Separate module: OpenTelemetry tracing adapter
+└── transport/
+    └── http/                   # HTTP request/response types and middleware
+```
+
+## Building and testing
+
+### Runtime (Go)
+
+```bash
+# Run unit tests
+make unit
+```
+
+### Codegen (Java)
+
+```bash
+# Build and test codegen
+cd codegen && ./gradlew build
+
+# Publish to local Maven for downstream use
+cd codegen && ./gradlew publishToMavenLocal
+```
+
+The codegen artifact version is fixed at `0.1.0` and is not published to
+Maven Central — you **MUST** `publishToMavenLocal`.
+
+## Runtime architecture
+
+### Middleware stack
+
+The operation pipeline is built on a middleware stack defined in `middleware/`.
+Steps execute in order: Initialize → Serialize → Build → Finalize →
+Deserialize. Each step is a `middleware.Step` that holds an ordered list of
+middleware. The codegen generates middleware registrations for each operation.
+
+### Encoding packages
+
+Each wire format has its own encoder/decoder under `encoding/`. These are
+low-level — they produce/consume raw tokens or values, not full Smithy shapes.
+Generated serde code calls into these packages.
+
+## Codegen: GoWriter and template system
+
+GoWriter extends Smithy's `SymbolWriter` and is the primary mechanism for
+generating Go source. It has **two distinct writing styles** that must not be
+confused.
+
+### Style 1: Positional args (`writer.write` / `writer.openBlock`)
+
+Inherited from `SymbolWriter`. Arguments are positional and referenced with
+`$`-prefixed format characters. Each `$X` consumes the next argument in order.
+
+Format characters:
+- `$L` — Literal (toString). Strings, names, anything that should be inserted
+  verbatim.
+- `$S` — String, quoted. Wraps the value in Go double-quotes.
+- `$T` — Type (Symbol). Inserts the symbol name and auto-adds its import.
+- `$P` — Pointable type (Symbol). Like `$T` but prepends `*` if the symbol is
+  marked pointable.
+- `$W` — Writable. Evaluates a `Writable` (lambda/closure) inline.
+- `$D` — Dependency. Adds a `GoDependency` import, expands to empty string.
+
+Numbered variants (`$1L`, `$2T`, etc.) allow reusing the same argument
+multiple times. The number is 1-indexed and refers to the position in the
+argument list:
+
+```java
+// $1L is used twice, $2L once — only 2 args needed
+writer.write("type $1L struct{}\nvar _ $2L = (*$1L)(nil)",
+    DEFAULT_NAME, INTERFACE_NAME);
+```
+
+`openBlock`/`closeBlock` manage indentation for braced blocks. Arguments are
+positional:
+
+```java
+writer.openBlock("func (c $P) $T(ctx $T) ($P, error) {", "}",
+    serviceSymbol, operationSymbol, contextSymbol, outputSymbol,
+    () -> {
+        writer.write("return nil, nil");
+    });
+```
+
+### Style 2: Named template args (`goTemplate` / `writeGoTemplate`)
+
+Uses `$name:X` syntax where `name` is a key in a `Map<String, Object>` and `X`
+is the format character. Arguments are passed as one or more maps. This is the
+**preferred style for new code** — it is more readable and less error-prone
+than positional args.
+
+```java
+return goTemplate("""
+    func $name:L(v $cborValue:T) ($type:T, error) {
+        return $coercer:T(v)
+    }
+    """,
+    Map.of(
+        "name", getDeserializerName(shape),
+        "cborValue", SmithyGoTypes.Encoding.Cbor.Value,
+        "type", symbolProvider.toSymbol(shape),
+        "coercer", coercer
+    ));
+```
+
+Rules:
+- `goTemplate(String, Map...)` is a **static** method that returns a
+  `Writable` (a `Consumer<GoWriter>` lambda). It does NOT write immediately.
+- `writeGoTemplate(String, Map...)` is an **instance** method that writes
+  immediately to the writer.
+- Maps are merged into the writer's context scope for the duration of the
+  template. Multiple maps can be passed and are applied in order.
+- The writer pre-populates common symbols in context: `fmt.Sprintf`,
+  `fmt.Errorf`, `errors.As`, `context.Context`, `time.Now`.
+
+### Composing writables
+
+- `ChainWritable` — Collects multiple `Writable`s and composes them with
+  newlines between each. Use `.compose()` (with newlines) or
+  `.compose(false)` (without).
+
+### Symbol constants
+
+For symbols, use `SmithyGoDependency.*.valueSymbol("Name")` or
+`SmithyGoDependency.*.pointableSymbol("Name")`.
+
diff --git a/vendor/github.com/aws/smithy-go/CHANGELOG.md b/vendor/github.com/aws/smithy-go/CHANGELOG.md
index 27fc881232..b9cd114ed1 100644
--- a/vendor/github.com/aws/smithy-go/CHANGELOG.md
+++ b/vendor/github.com/aws/smithy-go/CHANGELOG.md
@@ -1,8 +1,37 @@
-# Release (2026-02-27)
+# Release (2026-04-23)
+
+## General Highlights
+* **Dependency Update**: Updated to the latest SDK module versions
+
+## Module Highlights
+* `github.com/aws/smithy-go`: v1.25.1
+  * **Bug Fix**: Fixed a memory leak in the LRU cache implementation used by some AWS services.
+
+# Release (2026-04-15)
 
 ## General Highlights
 * **Dependency Update**: Updated to the latest SDK module versions
 
+## Module Highlights
+* `github.com/aws/smithy-go`: v1.25.0
+  * **Feature**: Add support for endpointBdd trait
+
+# Release (2026-04-02)
+
+## General Highlights
+* **Dependency Update**: Updated to the latest SDK module versions
+
+## Module Highlights
+* `github.com/aws/smithy-go`: v1.24.3
+  * **Bug Fix**: Add additional sigv4 configuration.
+* `github.com/aws/smithy-go/aws-http-auth`: [v1.1.3](aws-http-auth/CHANGELOG.md#v113-2026-04-02)
+  * **Bug Fix**: Add additional sigv4 configuration.
+
+# Release (2026-02-27)
+
+## General Highlights
+* **Dependency Update**: Bump minimum go version to 1.24.
+
 # Release (2026-02-20)
 
 ## General Highlights
diff --git a/vendor/github.com/aws/smithy-go/endpoints/private/rulesfn/split.go b/vendor/github.com/aws/smithy-go/endpoints/private/rulesfn/split.go
new file mode 100644
index 0000000000..f8b30789a0
--- /dev/null
+++ b/vendor/github.com/aws/smithy-go/endpoints/private/rulesfn/split.go
@@ -0,0 +1,16 @@
+package rulesfn
+
+import "strings"
+
+// Split splits the input string by the delimiter and returns the resulting
+// parts. If limit is > 0, at most limit substrings are returned.
+// Returns a slice with a single empty string if the input is empty.
+func Split(input, delimiter string, limit int) []string {
+	if len(input) == 0 {
+		return []string{""}
+	}
+	if limit > 0 {
+		return strings.SplitN(input, delimiter, limit)
+	}
+	return strings.Split(input, delimiter)
+}
diff --git a/vendor/github.com/aws/smithy-go/go_module_metadata.go b/vendor/github.com/aws/smithy-go/go_module_metadata.go
index dc9dfd0d86..a1e928754a 100644
--- a/vendor/github.com/aws/smithy-go/go_module_metadata.go
+++ b/vendor/github.com/aws/smithy-go/go_module_metadata.go
@@ -3,4 +3,4 @@
 package smithy
 
 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.24.2"
+const goModuleVersion = "1.25.1"
diff --git a/vendor/github.com/go-openapi/analysis/.codecov.yml b/vendor/github.com/go-openapi/analysis/.codecov.yml
index 841c4281e2..a5ba8e96d8 100644
--- a/vendor/github.com/go-openapi/analysis/.codecov.yml
+++ b/vendor/github.com/go-openapi/analysis/.codecov.yml
@@ -1,3 +1,7 @@
+codecov:
+  notify:
+    after_n_builds: 2
+
 coverage:
   status:
     patch:
diff --git a/vendor/github.com/go-openapi/analysis/.gitignore b/vendor/github.com/go-openapi/analysis/.gitignore
index 885dc27ab0..d8f4186fe5 100644
--- a/vendor/github.com/go-openapi/analysis/.gitignore
+++ b/vendor/github.com/go-openapi/analysis/.gitignore
@@ -3,4 +3,3 @@
 .idea
 .env
 .mcp.json
-.claude/
diff --git a/vendor/github.com/go-openapi/analysis/.golangci.yml b/vendor/github.com/go-openapi/analysis/.golangci.yml
index 02edc1b9fa..b97d68077f 100644
--- a/vendor/github.com/go-openapi/analysis/.golangci.yml
+++ b/vendor/github.com/go-openapi/analysis/.golangci.yml
@@ -14,6 +14,7 @@ linters:
     - recvcheck
     - testpackage
     - thelper
+    - tagliatelle
     - tparallel
     - varnamelen
     - whitespace
diff --git a/vendor/github.com/go-openapi/analysis/CONTRIBUTORS.md b/vendor/github.com/go-openapi/analysis/CONTRIBUTORS.md
index cf8fcaa7dc..2f85f1c050 100644
--- a/vendor/github.com/go-openapi/analysis/CONTRIBUTORS.md
+++ b/vendor/github.com/go-openapi/analysis/CONTRIBUTORS.md
@@ -4,11 +4,11 @@
 
 | Total Contributors | Total Contributions |
 | --- | --- |
-| 15  | 202  |
+| 15  | 207  |
 
 | Username | All Time Contribution Count | All Commits |
 | --- | --- | --- |
-| @fredbi | 99 | <https://github.com/go-openapi/analysis/commits?author=fredbi> |
+| @fredbi | 104 | <https://github.com/go-openapi/analysis/commits?author=fredbi> |
 | @casualjim | 70 | <https://github.com/go-openapi/analysis/commits?author=casualjim> |
 | @keramix | 9 | <https://github.com/go-openapi/analysis/commits?author=keramix> |
 | @youyuanwu | 8 | <https://github.com/go-openapi/analysis/commits?author=youyuanwu> |
@@ -24,4 +24,4 @@
 | @cuishuang | 1 | <https://github.com/go-openapi/analysis/commits?author=cuishuang> |
 | @ujjwalsh | 1 | <https://github.com/go-openapi/analysis/commits?author=ujjwalsh> |
 
- _this file was generated by the [Contributors GitHub Action](https://github.com/github/contributors)_
+ _this file was generated by the [Contributors GitHub Action](https://github.com/github-community-projects/contributors)_
diff --git a/vendor/github.com/go-openapi/analysis/README.md b/vendor/github.com/go-openapi/analysis/README.md
index 96821d3e43..82c782fcdd 100644
--- a/vendor/github.com/go-openapi/analysis/README.md
+++ b/vendor/github.com/go-openapi/analysis/README.md
@@ -115,7 +115,7 @@ Maintainers can cut a new release by either:
 [slack-badge]: https://img.shields.io/badge/slack-blue?link=https%3A%2F%2Fgoswagger.slack.com%2Farchives%2FC04R30YM
 [slack-url]: https://goswagger.slack.com/archives/C04R30YMU
 [discord-badge]: https://img.shields.io/discord/1446918742398341256?logo=discord&label=discord&color=blue
-[discord-url]: https://discord.gg/twZ9BwT3
+[discord-url]: https://discord.gg/FfnFYaC3k5
 
 <!-- Badges: license & compliance -->
 [license-badge]: http://img.shields.io/badge/license-Apache%20v2-orange.svg
diff --git a/vendor/github.com/go-openapi/analysis/go.work b/vendor/github.com/go-openapi/analysis/go.work
index 1794cfc979..c0f02a78f6 100644
--- a/vendor/github.com/go-openapi/analysis/go.work
+++ b/vendor/github.com/go-openapi/analysis/go.work
@@ -1,4 +1,4 @@
-go 1.24.0
+go 1.25.0
 
 use (
 	.
diff --git a/vendor/github.com/go-openapi/analysis/go.work.sum b/vendor/github.com/go-openapi/analysis/go.work.sum
index b767fb6171..899a68976e 100644
--- a/vendor/github.com/go-openapi/analysis/go.work.sum
+++ b/vendor/github.com/go-openapi/analysis/go.work.sum
@@ -1,4 +1,6 @@
 github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/klauspost/compress v1.16.7/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
 github.com/montanaflynn/stats v0.7.1/go.mod h1:etXPPgVO6n31NxCd9KQUMvCM+ve0ruNzt6R8Bnaayow=
 github.com/oklog/ulid v1.3.1 h1:EGfNDEx6MqHz8B3uNV6QAib1UR2Lm97sHi3ocA6ESJ4=
@@ -8,22 +10,38 @@ github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT
 github.com/xdg-go/scram v1.1.2/go.mod h1:RT/sEzTbU5y00aCK8UOx6R7YryM0iF1N2MOmC3kKLN4=
 github.com/xdg-go/stringprep v1.0.4/go.mod h1:mPGuuIYwz7CmR2bT9j4GbQqutWS1zV24gijq1dTyGkM=
 github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78/go.mod h1:aL8wCCfTfSfmXjznFBSZNN13rSJjlIOI1fUNAtF7rmI=
+github.com/yuin/goldmark v1.4.13 h1:fVcFKWvrslecOb/tg+Cc05dkeYx540o0FuFt3nUVDoE=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 go.mongodb.org/mongo-driver v1.17.6 h1:87JUG1wZfWsr6rIz3ZmpH90rL5tea7O3IHuSwHUpsss=
 go.mongodb.org/mongo-driver v1.17.6/go.mod h1:Hy04i7O2kC4RS06ZrhPRqj/u4DTYkFDAAccj+rVKqgQ=
 golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0=
 golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
 golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
+golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
+golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
 golang.org/x/mod v0.30.0/go.mod h1:lAsf5O2EvJeSFMiBxXDki7sCgAxEUcZHXoXMKT4GJKc=
 golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c=
 golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU=
+golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
+golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
 golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
 golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
 golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
+golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/telemetry v0.0.0-20260209163413-e7419c687ee4 h1:bTLqdHv7xrGlFbvf5/TXNxy/iUwwdkjhqQTJDjW7aj0=
+golang.org/x/telemetry v0.0.0-20260209163413-e7419c687ee4/go.mod h1:g5NllXBEermZrmR51cJDQxmJUHUOfRAaNyWBM+R+548=
 golang.org/x/term v0.38.0/go.mod h1:bSEAKrOT1W+VSu9TSCMtoGEOUcKxOKgl3LE5QEF/xVg=
 golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
 golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
+golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
+golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
 golang.org/x/tools v0.39.0/go.mod h1:JnefbkDPyD8UU2kI5fuf8ZX4/yUeh9W877ZeBONxUqQ=
 golang.org/x/tools v0.41.0 h1:a9b8iMweWG+S0OBnlU36rzLp20z1Rp10w+IY2czHTQc=
 golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg=
+golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=
+golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=
diff --git a/vendor/github.com/go-openapi/jsonpointer/.cliff.toml b/vendor/github.com/go-openapi/jsonpointer/.cliff.toml
deleted file mode 100644
index 702629f5dc..0000000000
--- a/vendor/github.com/go-openapi/jsonpointer/.cliff.toml
+++ /dev/null
@@ -1,181 +0,0 @@
-# git-cliff ~ configuration file
-# https://git-cliff.org/docs/configuration
-
-[changelog]
-header = """
-"""
-
-footer = """
-
------
-
-**[{{ remote.github.repo }}]({{ self::remote_url() }}) license terms**
-
-[![License][license-badge]][license-url]
-
-[license-badge]: http://img.shields.io/badge/license-Apache%20v2-orange.svg
-[license-url]: {{ self::remote_url() }}/?tab=Apache-2.0-1-ov-file#readme
-
-{%- macro remote_url() -%}
-  https://github.com/{{ remote.github.owner }}/{{ remote.github.repo }}
-{%- endmacro -%}
-"""
-
-body = """
-{%- if version %}
-## [{{ version | trim_start_matches(pat="v") }}]({{ self::remote_url() }}/tree/{{ version }}) - {{ timestamp | date(format="%Y-%m-%d") }}
-{%- else %}
-## [unreleased]
-{%- endif %}
-{%- if message %}
-  {%- raw %}\n{% endraw %}
-{{ message }}
-  {%- raw %}\n{% endraw %}
-{%- endif %}
-{%- if version %}
-  {%- if previous.version %}
-
-**Full Changelog**: <{{ self::remote_url() }}/compare/{{ previous.version }}...{{ version }}>
-  {%- endif %}
-{%- else %}
-  {%- raw %}\n{% endraw %}
-{%- endif %}
-
-{%- if statistics %}{% if statistics.commit_count %}
-  {%- raw %}\n{% endraw %}
-{{ statistics.commit_count }} commits in this release.
-  {%- raw %}\n{% endraw %}
-{%- endif %}{% endif %}
------
-
-{%- for group, commits in commits | group_by(attribute="group") %}
-  {%- raw %}\n{% endraw %}
-### {{ group | upper_first }}
-    {%- raw %}\n{% endraw %}
-    {%- for commit in commits %}
-      {%- if commit.remote.pr_title %}
-        {%- set commit_message = commit.remote.pr_title %}
-      {%- else %}
-        {%- set commit_message = commit.message %}
-      {%- endif %}
-* {{ commit_message | split(pat="\n") | first | trim }}
-      {%- if commit.remote.username %}
-{%- raw %} {% endraw %}by [@{{ commit.remote.username }}](https://github.com/{{ commit.remote.username }})
-      {%- endif %}
-      {%- if commit.remote.pr_number %}
-{%- raw %} {% endraw %}in [#{{ commit.remote.pr_number }}]({{ self::remote_url() }}/pull/{{ commit.remote.pr_number }})
-      {%- endif %}
-{%- raw %} {% endraw %}[...]({{ self::remote_url() }}/commit/{{ commit.id }})
-  {%- endfor %}
-{%- endfor %}
-
-{%- if github %}
-{%- raw %}\n{% endraw -%}
-  {%- set all_contributors = github.contributors | length %}
-  {%- if github.contributors | filter(attribute="username", value="dependabot[bot]") | length < all_contributors %}
------
-
-### People who contributed to this release
-  {% endif %}
-  {%- for contributor in github.contributors | filter(attribute="username") | sort(attribute="username") %}
-    {%- if contributor.username != "dependabot[bot]" and contributor.username != "github-actions[bot]" %}
-* [@{{ contributor.username }}](https://github.com/{{ contributor.username }})
-    {%- endif %}
-  {%- endfor %}
-
-  {% if github.contributors | filter(attribute="is_first_time", value=true) | length != 0 %}
------
-    {%- raw %}\n{% endraw %}
-
-### New Contributors
-  {%- endif %}
-
-  {%- for contributor in github.contributors | filter(attribute="is_first_time", value=true) %}
-    {%- if contributor.username != "dependabot[bot]" and contributor.username != "github-actions[bot]" %}
-* @{{ contributor.username }} made their first contribution
-      {%- if contributor.pr_number %}
-  in [#{{ contributor.pr_number }}]({{ self::remote_url() }}/pull/{{ contributor.pr_number }}) \
-      {%- endif %}
-    {%- endif %}
-  {%- endfor %}
-{%- endif %}
-
-{%- raw %}\n{% endraw %}
-
-{%- macro remote_url() -%}
-  https://github.com/{{ remote.github.owner }}/{{ remote.github.repo }}
-{%- endmacro -%}
-"""
-# Remove leading and trailing whitespaces from the changelog's body.
-trim = true
-# Render body even when there are no releases to process.
-render_always = true
-# An array of regex based postprocessors to modify the changelog.
-postprocessors = [
-    # Replace the placeholder <REPO> with a URL.
-    #{ pattern = '<REPO>', replace = "https://github.com/orhun/git-cliff" },
-]
-# output file path
-# output = "test.md"
-
-[git]
-# Parse commits according to the conventional commits specification.
-# See https://www.conventionalcommits.org
-conventional_commits = false
-# Exclude commits that do not match the conventional commits specification.
-filter_unconventional = false
-# Require all commits to be conventional.
-# Takes precedence over filter_unconventional.
-require_conventional = false
-# Split commits on newlines, treating each line as an individual commit.
-split_commits = false
-# An array of regex based parsers to modify commit messages prior to further processing.
-commit_preprocessors = [
-    # Replace issue numbers with link templates to be updated in `changelog.postprocessors`.
-    #{ pattern = '\((\w+\s)?#([0-9]+)\)', replace = "([#${2}](<REPO>/issues/${2}))"},
-    # Check spelling of the commit message using https://github.com/crate-ci/typos.
-    # If the spelling is incorrect, it will be fixed automatically.
-    #{ pattern = '.*', replace_command = 'typos --write-changes -' }
-]
-# Prevent commits that are breaking from being excluded by commit parsers.
-protect_breaking_commits = false
-# An array of regex based parsers for extracting data from the commit message.
-# Assigns commits to groups.
-# Optionally sets the commit's scope and can decide to exclude commits from further processing.
-commit_parsers = [
-    { message = "^[Cc]hore\\([Rr]elease\\): prepare for", skip = true },
-    { message = "(^[Mm]erge)|([Mm]erge conflict)", skip = true },
-    { field = "author.name", pattern = "dependabot*", group = "<!-- 0A -->Updates" },
-    { message = "([Ss]ecurity)|([Vv]uln)", group = "<!-- 08 -->Security" },
-    { body = "(.*[Ss]ecurity)|([Vv]uln)", group = "<!-- 08 -->Security" },
-    { message = "([Cc]hore\\(lint\\))|(style)|(lint)|(codeql)|(golangci)", group = "<!-- 05 -->Code quality" },
-    { message = "(^[Dd]oc)|((?i)readme)|(badge)|(typo)|(documentation)", group = "<!-- 03 -->Documentation" },
-    { message = "(^[Ff]eat)|(^[Ee]nhancement)", group = "<!-- 00 -->Implemented enhancements" },
-    { message = "(^ci)|(\\(ci\\))|(fixup\\s+ci)|(fix\\s+ci)|(license)|(example)", group = "<!-- 07 -->Miscellaneous tasks" },
-    { message = "^test", group = "<!-- 06 -->Testing" },
-    { message = "(^fix)|(panic)", group = "<!-- 01 -->Fixed bugs" },
-    { message = "(^refact)|(rework)", group = "<!-- 02 -->Refactor" },
-    { message = "(^[Pp]erf)|(performance)", group = "<!-- 04 -->Performance" },
-    { message = "(^[Cc]hore)", group = "<!-- 07 -->Miscellaneous tasks" },
-    { message = "^[Rr]evert", group = "<!-- 09 -->Reverted changes" },
-    { message = "(upgrade.*?go)|(go\\s+version)", group = "<!-- 0A -->Updates" },
-    { message = ".*", group = "<!-- 0B -->Other" },
-]
-# Exclude commits that are not matched by any commit parser.
-filter_commits = false
-# An array of link parsers for extracting external references, and turning them into URLs, using regex.
-link_parsers = []
-# Include only the tags that belong to the current branch.
-use_branch_tags = false
-# Order releases topologically instead of chronologically.
-topo_order = false
-# Order releases topologically instead of chronologically.
-topo_order_commits = true
-# Order of commits in each group/release within the changelog.
-# Allowed values: newest, oldest
-sort_commits = "newest"
-# Process submodules commits
-recurse_submodules = false
-
-#[remote.github]
-#owner = "go-openapi"
diff --git a/vendor/github.com/go-openapi/jsonpointer/.gitignore b/vendor/github.com/go-openapi/jsonpointer/.gitignore
index 885dc27ab0..d8f4186fe5 100644
--- a/vendor/github.com/go-openapi/jsonpointer/.gitignore
+++ b/vendor/github.com/go-openapi/jsonpointer/.gitignore
@@ -3,4 +3,3 @@
 .idea
 .env
 .mcp.json
-.claude/
diff --git a/vendor/github.com/go-openapi/jsonpointer/CONTRIBUTORS.md b/vendor/github.com/go-openapi/jsonpointer/CONTRIBUTORS.md
index 2ebebedc15..9990f4a354 100644
--- a/vendor/github.com/go-openapi/jsonpointer/CONTRIBUTORS.md
+++ b/vendor/github.com/go-openapi/jsonpointer/CONTRIBUTORS.md
@@ -4,11 +4,11 @@
 
 | Total Contributors | Total Contributions |
 | --- | --- |
-| 12  | 101  |
+| 13  | 111  |
 
 | Username | All Time Contribution Count | All Commits |
 | --- | --- | --- |
-| @fredbi | 54 | <https://github.com/go-openapi/jsonpointer/commits?author=fredbi> |
+| @fredbi | 63 | <https://github.com/go-openapi/jsonpointer/commits?author=fredbi> |
 | @casualjim | 33 | <https://github.com/go-openapi/jsonpointer/commits?author=casualjim> |
 | @magodo | 3 | <https://github.com/go-openapi/jsonpointer/commits?author=magodo> |
 | @youyuanwu | 3 | <https://github.com/go-openapi/jsonpointer/commits?author=youyuanwu> |
@@ -18,7 +18,8 @@
 | @ianlancetaylor | 1 | <https://github.com/go-openapi/jsonpointer/commits?author=ianlancetaylor> |
 | @mfleader | 1 | <https://github.com/go-openapi/jsonpointer/commits?author=mfleader> |
 | @Neo2308 | 1 | <https://github.com/go-openapi/jsonpointer/commits?author=Neo2308> |
+| @alexandear | 1 | <https://github.com/go-openapi/jsonpointer/commits?author=alexandear> |
 | @olivierlemasle | 1 | <https://github.com/go-openapi/jsonpointer/commits?author=olivierlemasle> |
 | @testwill | 1 | <https://github.com/go-openapi/jsonpointer/commits?author=testwill> |
 
- _this file was generated by the [Contributors GitHub Action](https://github.com/github/contributors)_
+ _this file was generated by the [Contributors GitHub Action](https://github.com/github-community-projects/contributors)_
diff --git a/vendor/github.com/go-openapi/jsonpointer/NOTICE b/vendor/github.com/go-openapi/jsonpointer/NOTICE
index f3b51939a9..201908d2f0 100644
--- a/vendor/github.com/go-openapi/jsonpointer/NOTICE
+++ b/vendor/github.com/go-openapi/jsonpointer/NOTICE
@@ -18,7 +18,7 @@ It ships with copies of other software which license terms are recalled below.
 
 The original software was authored on 25-02-2013 by sigu-399 (https://github.com/sigu-399, sigu.399@gmail.com).
 
-github.com/sigh-399/jsonpointer
+github.com/sigu-399/jsonpointer
 ===========================
 
 // SPDX-FileCopyrightText: Copyright 2013 sigu-399 ( https://github.com/sigu-399 )
diff --git a/vendor/github.com/go-openapi/jsonpointer/README.md b/vendor/github.com/go-openapi/jsonpointer/README.md
index c52803e2e8..24fbe1bf68 100644
--- a/vendor/github.com/go-openapi/jsonpointer/README.md
+++ b/vendor/github.com/go-openapi/jsonpointer/README.md
@@ -16,17 +16,25 @@ An implementation of JSON Pointer for golang, which supports go `struct`.
 
 ## Announcements
 
-* **2025-12-19** : new community chat on discord
-  * a new discord community channel is available to be notified of changes and support users
-  * our venerable Slack channel remains open, and will be eventually discontinued on **2026-03-31**
-
-You may join the discord community by clicking the invite link on the discord badge (also above). [![Discord Channel][discord-badge]][discord-url]
-
-Or join our Slack channel: [![Slack Channel][slack-logo]![slack-badge]][slack-url]
+* **2026-04-15** : added support for trailing "-" for arrays (v0.23.0)
+  * this brings full support of [RFC6901][RFC6901]
+  * this is supported for types relying on the reflection-based implemented
+  * API semantics remain essentially unaltered. Exception: `Pointer.Set(document any,value any) (document any, err error)` 
+    can only perform a best-effort to mutate the input document in place. In the case of adding elements to an array with a
+    trailing "-", either pass a mutable array (`*[]T`) as the input document, or use the returned updated document instead.
+  * types that implement the `JSONSetable` interface may not implement the mutation implied by the trailing "-"
+
+* **2026-04-15** : added support for optional alternate JSON name providers
+  * for struct support the defaults might not suit all situations: there are known limitations
+    when it comes to handle untagged fields or embedded types.
+  * the default name provider in use is not fully aligned with go JSON stdlib
+  * exposed an option (or global setting) to change the provider that resolves a struct into json keys
+  * the default behavior is not altered
+  * a new alternate name provider is added (imported from `go-openapi/swag/jsonname`), aligned with JSON stdlib behavior
 
 ## Status
 
-API is stable.
+API is stable and feature-complete.
 
 ## Import this library in your project
 
@@ -88,7 +96,7 @@ See <https://github.com/go-openapi/jsonpointer/releases>
 
 <https://tools.ietf.org/html/draft-ietf-appsawg-json-pointer-07>
 
-also known as [RFC6901](https://www.rfc-editor.org/rfc/rfc6901)
+also known as [RFC6901][RFC6901].
 
 ## Licensing
 
@@ -99,19 +107,19 @@ on top of which it has been built.
 
 ## Limitations
 
-The 4.Evaluation part of the previous reference, starting with 'If the currently referenced value is a JSON array,
-the reference token MUST contain either...' is not implemented.
-
-That is because our implementation of the JSON pointer only supports explicit references to array elements:
-the provision in the spec to resolve non-existent members as "the last element in the array",
-using the special trailing character "-" is not implemented.
+* [RFC6901][RFC6901] is now fully supported, including trailing "-" semantics for arrays (for `Set` operations).
+* Default behavior: JSON name detection in go `struct`s
+   - Unlike go standard marshaling, untagged fields do not default to the go field name and are ignored.
+   - anonymous fields are not traversed if untagged
+   - the above limitations may be overcome by calling `UseGoNameProvider()` at initialization time.
+   - alternatively, users may inject the desired custom behavior for naming fields as an option.
 
 ## Other documentation
 
 * [All-time contributors](./CONTRIBUTORS.md)
-* [Contributing guidelines](.github/CONTRIBUTING.md)
-* [Maintainers documentation](docs/MAINTAINERS.md)
-* [Code style](docs/STYLE.md)
+* [Contributing guidelines][contributing-doc-site]
+* [Maintainers documentation][maintainers-doc-site]
+* [Code style][style-doc-site]
 
 ## Cutting a new release
 
@@ -142,11 +150,8 @@ Maintainers can cut a new release by either:
 <!-- Badges: documentation & support -->
 [godoc-badge]: https://pkg.go.dev/badge/github.com/go-openapi/jsonpointer
 [godoc-url]: http://pkg.go.dev/github.com/go-openapi/jsonpointer
-[slack-logo]: https://a.slack-edge.com/e6a93c1/img/icons/favicon-32.png
-[slack-badge]: https://img.shields.io/badge/slack-blue?link=https%3A%2F%2Fgoswagger.slack.com%2Farchives%2FC04R30YM
-[slack-url]: https://goswagger.slack.com/archives/C04R30YMU
 [discord-badge]: https://img.shields.io/discord/1446918742398341256?logo=discord&label=discord&color=blue
-[discord-url]: https://discord.gg/twZ9BwT3
+[discord-url]: https://discord.gg/FfnFYaC3k5
 
 <!-- Badges: license & compliance -->
 [license-badge]: http://img.shields.io/badge/license-Apache%20v2-orange.svg
@@ -156,3 +161,8 @@ Maintainers can cut a new release by either:
 [goversion-url]: https://github.com/go-openapi/jsonpointer/blob/master/go.mod
 [top-badge]: https://img.shields.io/github/languages/top/go-openapi/jsonpointer
 [commits-badge]: https://img.shields.io/github/commits-since/go-openapi/jsonpointer/latest
+[RFC6901]: https://www.rfc-editor.org/rfc/rfc6901
+<!-- Organization docs -->
+[contributing-doc-site]: https://go-openapi.github.io/doc-site/contributing/contributing/index.html
+[maintainers-doc-site]: https://go-openapi.github.io/doc-site/maintainers/index.html
+[style-doc-site]: https://go-openapi.github.io/doc-site/contributing/style/index.html
diff --git a/vendor/github.com/go-openapi/jsonpointer/errors.go b/vendor/github.com/go-openapi/jsonpointer/errors.go
index 8c50dde8bc..8813474d44 100644
--- a/vendor/github.com/go-openapi/jsonpointer/errors.go
+++ b/vendor/github.com/go-openapi/jsonpointer/errors.go
@@ -16,12 +16,24 @@ const (
 	ErrPointer pointerError = "JSON pointer error"
 
 	// ErrInvalidStart states that a JSON pointer must start with a separator ("/").
-	ErrInvalidStart pointerError = `JSON pointer must be empty or start with a "` + pointerSeparator
+	ErrInvalidStart pointerError = `JSON pointer must be empty or start with a "` + pointerSeparator + `"`
 
 	// ErrUnsupportedValueType indicates that a value of the wrong type is being set.
 	ErrUnsupportedValueType pointerError = "only structs, pointers, maps and slices are supported for setting values"
+
+	// ErrDashToken indicates use of the RFC 6901 "-" reference token
+	// in a context where it cannot be resolved.
+	//
+	// Per RFC 6901 §4 the "-" token refers to the (nonexistent) element
+	// after the last array element. It may only be used as the terminal
+	// token of a [Pointer.Set] against a slice, where it means "append".
+	// Any other use (get, offset, intermediate traversal, non-slice target)
+	// is an error condition that wraps this sentinel.
+	ErrDashToken pointerError = `the "-" array token cannot be resolved here` //nolint:gosec // G101 false positive: this is a JSON Pointer reference token, not a credential.
 )
 
+const dashToken = "-"
+
 func errNoKey(key string) error {
 	return fmt.Errorf("object has no key %q: %w", key, ErrPointer)
 }
@@ -33,3 +45,15 @@ func errOutOfBounds(length, idx int) error {
 func errInvalidReference(token string) error {
 	return fmt.Errorf("invalid token reference %q: %w", token, ErrPointer)
 }
+
+func errDashOnGet() error {
+	return fmt.Errorf("cannot resolve %q token on get: %w: %w", dashToken, ErrDashToken, ErrPointer)
+}
+
+func errDashIntermediate() error {
+	return fmt.Errorf("the %q token may only appear as the terminal token of a pointer: %w: %w", dashToken, ErrDashToken, ErrPointer)
+}
+
+func errDashOnOffset() error {
+	return fmt.Errorf("cannot compute offset for %q token (nonexistent element): %w: %w", dashToken, ErrDashToken, ErrPointer)
+}
diff --git a/vendor/github.com/go-openapi/jsonpointer/ifaces.go b/vendor/github.com/go-openapi/jsonpointer/ifaces.go
new file mode 100644
index 0000000000..1e56ac0442
--- /dev/null
+++ b/vendor/github.com/go-openapi/jsonpointer/ifaces.go
@@ -0,0 +1,47 @@
+// SPDX-FileCopyrightText: Copyright (c) 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package jsonpointer
+
+import "reflect"
+
+// JSONPointable is an interface for structs to implement,
+// when they need to customize the json pointer process or want to avoid the use of reflection.
+type JSONPointable interface {
+	// JSONLookup returns a value pointed at this (unescaped) key.
+	JSONLookup(key string) (any, error)
+}
+
+// JSONSetable is an interface for structs to implement,
+// when they need to customize the json pointer process or want to avoid the use of reflection.
+//
+// # Handling of the RFC 6901 "-" token
+//
+// When a type implementing JSONSetable is the terminal parent of a [Pointer.Set]
+// call, the library passes the raw reference token to JSONSet without
+// interpretation. In particular, the RFC 6901 "-" token (which conventionally
+// means "append" for arrays, per RFC 6902) is forwarded verbatim as the key
+// argument. Implementations that model an array-like container are expected
+// to give "-" the append semantics; implementations that do not should return
+// an error wrapping [ErrDashToken] (or [ErrPointer]) for clarity.
+//
+// Implementations are responsible for any in-place mutation: the library does
+// not attempt to rebind the result of JSONSet into a parent container.
+type JSONSetable interface {
+	// JSONSet sets the value pointed at the (unescaped) key.
+	//
+	// The key may be the RFC 6901 "-" token when the pointer targets a
+	// slice-like member; see the interface documentation for details.
+	JSONSet(key string, value any) error
+}
+
+// NameProvider knows how to resolve go struct fields into json names.
+//
+// The default provider is brought by [github.com/go-openapi/swag/jsonname.DefaultJSONNameProvider].
+type NameProvider interface {
+	// GetGoName gets the go name for a json property name
+	GetGoName(subject any, name string) (string, bool)
+
+	// GetGoNameForType gets the go name for a given type for a json property name
+	GetGoNameForType(tpe reflect.Type, name string) (string, bool)
+}
diff --git a/vendor/github.com/go-openapi/jsonpointer/options.go b/vendor/github.com/go-openapi/jsonpointer/options.go
new file mode 100644
index 0000000000..d52caab222
--- /dev/null
+++ b/vendor/github.com/go-openapi/jsonpointer/options.go
@@ -0,0 +1,86 @@
+// SPDX-FileCopyrightText: Copyright (c) 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package jsonpointer
+
+import (
+	"sync"
+
+	"github.com/go-openapi/swag/jsonname"
+)
+
+// Option to tune the behavior of a JSON [Pointer].
+type Option func(*options)
+
+var (
+	//nolint:gochecknoglobals // package level defaults are provided as a convenient, backward-compatible way to adopt options.
+	defaultOptions = options{
+		provider: jsonname.DefaultJSONNameProvider,
+	}
+	//nolint:gochecknoglobals // guards defaultOptions against concurrent SetDefaultNameProvider / read races (testing)
+	defaultOptionsMu sync.RWMutex
+)
+
+// SetDefaultNameProvider sets the [NameProvider] as a package-level default.
+//
+// By default, the default provider is [jsonname.DefaultJSONNameProvider].
+//
+// It is safe to call concurrently with [Pointer.Get], [Pointer.Set],
+// [GetForToken] and [SetForToken]. The typical usage is to call it once
+// at initialization time.
+//
+// A nil provider is ignored.
+func SetDefaultNameProvider(provider NameProvider) {
+	if provider == nil {
+		return
+	}
+
+	defaultOptionsMu.Lock()
+	defer defaultOptionsMu.Unlock()
+
+	defaultOptions.provider = provider
+}
+
+// UseGoNameProvider sets the [NameProvider] as a package-level default
+// to the alternative provider [jsonname.GoNameProvider], that covers a few areas
+// not supported by the default name provider.
+//
+// This implementation supports untagged exported fields and embedded types in go struct.
+// It follows strictly the behavior of the JSON standard library regarding field naming conventions.
+//
+// It is safe to call concurrently with [Pointer.Get], [Pointer.Set],
+// [GetForToken] and [SetForToken]. The typical usage is to call it once
+// at initialization time.
+func UseGoNameProvider() {
+	SetDefaultNameProvider(jsonname.NewGoNameProvider())
+}
+
+// DefaultNameProvider returns the current package-level [NameProvider].
+func DefaultNameProvider() NameProvider { //nolint:ireturn // returning the interface is the point — callers pick their own implementation.
+	defaultOptionsMu.RLock()
+	defer defaultOptionsMu.RUnlock()
+
+	return defaultOptions.provider
+}
+
+// WithNameProvider injects a custom [NameProvider] to resolve json names from go struct types.
+func WithNameProvider(provider NameProvider) Option {
+	return func(o *options) {
+		o.provider = provider
+	}
+}
+
+type options struct {
+	provider NameProvider
+}
+
+func optionsWithDefaults(opts []Option) options {
+	var o options
+	o.provider = DefaultNameProvider()
+
+	for _, apply := range opts {
+		apply(&o)
+	}
+
+	return o
+}
diff --git a/vendor/github.com/go-openapi/jsonpointer/pointer.go b/vendor/github.com/go-openapi/jsonpointer/pointer.go
index 7df49af3b9..2369c1827e 100644
--- a/vendor/github.com/go-openapi/jsonpointer/pointer.go
+++ b/vendor/github.com/go-openapi/jsonpointer/pointer.go
@@ -11,8 +11,6 @@ import (
 	"reflect"
 	"strconv"
 	"strings"
-
-	"github.com/go-openapi/swag/jsonname"
 )
 
 const (
@@ -20,20 +18,6 @@ const (
 	pointerSeparator = `/`
 )
 
-// JSONPointable is an interface for structs to implement,
-// when they need to customize the json pointer process or want to avoid the use of reflection.
-type JSONPointable interface {
-	// JSONLookup returns a value pointed at this (unescaped) key.
-	JSONLookup(key string) (any, error)
-}
-
-// JSONSetable is an interface for structs to implement,
-// when they need to customize the json pointer process or want to avoid the use of reflection.
-type JSONSetable interface {
-	// JSONSet sets the value pointed at the (unescaped) key.
-	JSONSet(key string, value any) error
-}
-
 // Pointer is a representation of a json pointer.
 //
 // Use [Pointer.Get] to retrieve a value or [Pointer.Set] to set a value.
@@ -41,7 +25,7 @@ type JSONSetable interface {
 // It works with any go type interpreted as a JSON document, which means:
 //
 //   - if a type implements [JSONPointable], its [JSONPointable.JSONLookup] method is used to resolve [Pointer.Get]
-//   - if a type implements [JSONSetable], its [JSONPointable.JSONSet] method is used to resolve [Pointer.Set]
+//   - if a type implements [JSONSetable], its [JSONSetable.JSONSet] method is used to resolve [Pointer.Set]
 //   - a go map[K]V is interpreted as an object, with type K assignable to a string
 //   - a go slice []T is interpreted as an array
 //   - a go struct is interpreted as an object, with exported fields interpreted as keys
@@ -71,16 +55,35 @@ func New(jsonPointerString string) (Pointer, error) {
 // Get uses the pointer to retrieve a value from a JSON document.
 //
 // It returns the value with its type as a [reflect.Kind] or an error.
-func (p *Pointer) Get(document any) (any, reflect.Kind, error) {
-	return p.get(document, jsonname.DefaultJSONNameProvider)
+func (p *Pointer) Get(document any, opts ...Option) (any, reflect.Kind, error) {
+	o := optionsWithDefaults(opts)
+
+	return p.get(document, o.provider)
 }
 
 // Set uses the pointer to set a value from a data type
 // that represent a JSON document.
 //
-// It returns the updated document.
-func (p *Pointer) Set(document any, value any) (any, error) {
-	return document, p.set(document, value, jsonname.DefaultJSONNameProvider)
+// # Mutation contract
+//
+// Set mutates the provided document in place whenever Go's type system allows
+// it: when document is a map, a pointer, or when the targeted value is reached
+// through an addressable ancestor (e.g. a struct field traversed via a pointer,
+// a slice element). Callers that rely on this in-place behavior may continue
+// to ignore the returned document.
+//
+// The returned document is only load-bearing when Set cannot mutate in place.
+// This happens in one specific case: appending to a top-level slice passed by
+// value (e.g. document of type []T rather than *[]T) via the RFC 6901 "-"
+// terminal token. reflect.Append produces a new slice header that the library
+// cannot rebind into the caller's variable; the updated document is returned
+// instead. Pass *[]T if you want in-place rebind for that case as well.
+//
+// See [ErrDashToken] for the semantics of the "-" token.
+func (p *Pointer) Set(document any, value any, opts ...Option) (any, error) {
+	o := optionsWithDefaults(opts)
+
+	return p.set(document, value, o.provider)
 }
 
 // DecodedTokens returns the decoded (unescaped) tokens of this JSON pointer.
@@ -109,6 +112,46 @@ func (p *Pointer) String() string {
 	return pointerSeparator + strings.Join(p.referenceTokens, pointerSeparator)
 }
 
+// Offset returns the byte offset, in the raw JSON text of document, of the
+// location referenced by this pointer's terminal token.
+//
+// Unlike [Pointer.Get] and [Pointer.Set], which operate on a decoded Go value,
+// Offset operates directly on the textual JSON source. It drives an
+// [encoding/json.Decoder] over the string and stops at the terminal token,
+// returning the position at which the decoder was about to read that token.
+//
+// It is primarily intended for tooling that needs to map a pointer back to a
+// region of the original source: reporting line/column for validation or
+// parse diagnostics, extracting a sub-document by slicing the raw bytes, or
+// highlighting the referenced span in an editor.
+//
+// # Offset semantics
+//
+// The meaning of the returned offset depends on whether the terminal token
+// addresses an object property or an array element:
+//
+//   - Object property: the offset points to the first byte of the key (its
+//     opening quote character), not to the associated value. For example,
+//     pointer "/foo/bar" against {"foo": {"bar": 21}} returns 9, the index of
+//     the opening quote of "bar".
+//   - Array element: the offset points to the first byte of the value at that
+//     index. For example, pointer "/0/1" against [[1,2], [3,4]] returns 4,
+//     the index of the digit 2.
+//
+// # Errors
+//
+// Offset returns an error in any of these cases:
+//
+//   - document is not syntactically valid JSON;
+//   - the structure of document does not match the pointer (e.g. traversing
+//     into a scalar, or a token that is neither a valid key nor a valid
+//     numeric index);
+//   - a referenced key or index does not exist in document;
+//   - the pointer's terminal token is the RFC 6901 "-" array token, which
+//     designates a nonexistent element and therefore has no offset in the
+//     source. The returned error wraps [ErrDashToken].
+//
+// All errors wrap [ErrPointer].
 func (p *Pointer) Offset(document string) (int64, error) {
 	dec := json.NewDecoder(strings.NewReader(document))
 	var offset int64
@@ -137,7 +180,35 @@ func (p *Pointer) Offset(document string) (int64, error) {
 			return 0, fmt.Errorf("invalid token %#v: %w", tk, ErrPointer)
 		}
 	}
-	return offset, nil
+	return skipJSONSeparator(document, offset), nil
+}
+
+// skipJSONSeparator advances offset past trailing JSON whitespace and at most
+// one value separator (comma) in document, so the result points at the first
+// byte of the next JSON token.
+//
+// The streaming decoder's InputOffset sits right after the most recently
+// consumed token, which between values is the comma (or whitespace) — not
+// the following token. Normalizing here keeps Offset's contract uniform:
+// for both object keys and array elements, and regardless of position within
+// the parent container, the returned offset always points at the first byte
+// of the addressed token.
+func skipJSONSeparator(document string, offset int64) int64 {
+	n := int64(len(document))
+	for offset < n && isJSONWhitespace(document[offset]) {
+		offset++
+	}
+	if offset < n && document[offset] == ',' {
+		offset++
+	}
+	for offset < n && isJSONWhitespace(document[offset]) {
+		offset++
+	}
+	return offset
+}
+
+func isJSONWhitespace(c byte) bool {
+	return c == ' ' || c == '\t' || c == '\n' || c == '\r'
 }
 
 // "Constructor", parses the given string JSON pointer.
@@ -157,9 +228,9 @@ func (p *Pointer) parse(jsonPointerString string) error {
 	return nil
 }
 
-func (p *Pointer) get(node any, nameProvider *jsonname.NameProvider) (any, reflect.Kind, error) {
+func (p *Pointer) get(node any, nameProvider NameProvider) (any, reflect.Kind, error) {
 	if nameProvider == nil {
-		nameProvider = jsonname.DefaultJSONNameProvider
+		nameProvider = defaultOptions.provider
 	}
 
 	kind := reflect.Invalid
@@ -185,50 +256,130 @@ func (p *Pointer) get(node any, nameProvider *jsonname.NameProvider) (any, refle
 	return node, kind, nil
 }
 
-func (p *Pointer) set(node, data any, nameProvider *jsonname.NameProvider) error {
+func (p *Pointer) set(node, data any, nameProvider NameProvider) (any, error) {
 	knd := reflect.ValueOf(node).Kind()
 
 	if knd != reflect.Pointer && knd != reflect.Struct && knd != reflect.Map && knd != reflect.Slice && knd != reflect.Array {
-		return errors.Join(
+		return node, errors.Join(
 			fmt.Errorf("unexpected type: %T", node), //nolint:err113 // err wrapping is carried out by errors.Join, not fmt.Errorf.
 			ErrUnsupportedValueType,
 			ErrPointer,
 		)
 	}
 
-	l := len(p.referenceTokens)
-
 	// full document when empty
-	if l == 0 {
-		return nil
+	if len(p.referenceTokens) == 0 {
+		return node, nil
 	}
 
 	if nameProvider == nil {
-		nameProvider = jsonname.DefaultJSONNameProvider
+		nameProvider = defaultOptions.provider
 	}
 
-	var decodedToken string
-	lastIndex := l - 1
+	return p.setAt(node, p.referenceTokens, data, nameProvider)
+}
 
-	if lastIndex > 0 { // skip if we only have one token in pointer
-		for _, token := range p.referenceTokens[:lastIndex] {
-			decodedToken = Unescape(token)
-			next, err := p.resolveNodeForToken(node, decodedToken, nameProvider)
-			if err != nil {
-				return err
-			}
+// setAt recursively walks the token list, setting the data at the terminal
+// token and rebinding any new child reference (e.g. a slice header returned
+// by an "-" append) into its parent on the way back up.
+//
+// Returning the (possibly new) node at each level is what makes append work
+// at any depth without requiring the caller to pass a pointer to the
+// containing slice: the new slice header propagates up and each parent
+// rebinds it via the appropriate kind-specific setter.
+func (p *Pointer) setAt(node any, tokens []string, data any, nameProvider NameProvider) (any, error) {
+	decodedToken := Unescape(tokens[0])
+
+	if len(tokens) == 1 {
+		return setSingleImpl(node, data, decodedToken, nameProvider)
+	}
 
-			node = next
-		}
+	child, err := p.resolveNodeForToken(node, decodedToken, nameProvider)
+	if err != nil {
+		return node, err
+	}
+
+	newChild, err := p.setAt(child, tokens[1:], data, nameProvider)
+	if err != nil {
+		return node, err
 	}
 
-	// last token
-	decodedToken = Unescape(p.referenceTokens[lastIndex])
+	return rebindChild(node, decodedToken, newChild, nameProvider)
+}
+
+// rebindChild writes newChild back into node at decodedToken.
+//
+// For cases where the child was already mutated in place (pointer aliasing,
+// addressable slice elements) the rebind is a safe no-op. For cases where
+// the child was returned by value (map entries holding a slice, slices
+// reached through a non-addressable ancestor), the rebind propagates the
+// new value into the parent.
+//
+// Parents implementing [JSONPointable] are left alone: they took ownership
+// of the child via JSONLookup and did not opt into a JSONSet-based rebind
+// on intermediate tokens.
+func rebindChild(node any, decodedToken string, newChild any, nameProvider NameProvider) (any, error) {
+	if _, ok := node.(JSONPointable); ok {
+		return node, nil
+	}
+
+	rValue := reflect.Indirect(reflect.ValueOf(node))
+
+	switch rValue.Kind() {
+	case reflect.Struct:
+		nm, ok := nameProvider.GetGoNameForType(rValue.Type(), decodedToken)
+		if !ok {
+			return node, fmt.Errorf("object has no field %q: %w", decodedToken, ErrPointer)
+		}
+		fld := rValue.FieldByName(nm)
+		if !fld.CanSet() {
+			return node, nil
+		}
+		assignReflectValue(fld, newChild)
+		return node, nil
+
+	case reflect.Map:
+		rValue.SetMapIndex(reflect.ValueOf(decodedToken), reflect.ValueOf(newChild))
+		return node, nil
+
+	case reflect.Slice:
+		if decodedToken == dashToken {
+			return node, errDashIntermediate()
+		}
+		idx, err := strconv.Atoi(decodedToken)
+		if err != nil {
+			return node, errors.Join(err, ErrPointer)
+		}
+		elem := rValue.Index(idx)
+		if !elem.CanSet() {
+			return node, nil
+		}
+		assignReflectValue(elem, newChild)
+		return node, nil
+
+	default:
+		return node, errInvalidReference(decodedToken)
+	}
+}
 
-	return setSingleImpl(node, data, decodedToken, nameProvider)
+// assignReflectValue assigns src into dst, unwrapping a pointer when dst
+// expects the pointee type. This tolerates the pointer-wrapping performed
+// by [typeFromValue] for addressable fields.
+func assignReflectValue(dst reflect.Value, src any) {
+	nv := reflect.ValueOf(src)
+	if !nv.IsValid() {
+		return
+	}
+	if nv.Type().AssignableTo(dst.Type()) {
+		dst.Set(nv)
+		return
+	}
+	if nv.Kind() == reflect.Pointer && nv.Elem().Type().AssignableTo(dst.Type()) {
+		dst.Set(nv.Elem())
+	}
 }
 
-func (p *Pointer) resolveNodeForToken(node any, decodedToken string, nameProvider *jsonname.NameProvider) (next any, err error) {
+func (p *Pointer) resolveNodeForToken(node any, decodedToken string, nameProvider NameProvider) (next any, err error) {
 	// check for nil during traversal
 	if isNil(node) {
 		return nil, fmt.Errorf("cannot traverse through nil value at %q: %w", decodedToken, ErrPointer)
@@ -272,6 +423,9 @@ func (p *Pointer) resolveNodeForToken(node any, decodedToken string, nameProvide
 		return typeFromValue(mv), nil
 
 	case reflect.Slice:
+		if decodedToken == dashToken {
+			return nil, errDashIntermediate()
+		}
 		tokenIndex, err := strconv.Atoi(decodedToken)
 		if err != nil {
 			return nil, errors.Join(err, ErrPointer)
@@ -312,16 +466,23 @@ func typeFromValue(v reflect.Value) any {
 }
 
 // GetForToken gets a value for a json pointer token 1 level deep.
-func GetForToken(document any, decodedToken string) (any, reflect.Kind, error) {
-	return getSingleImpl(document, decodedToken, jsonname.DefaultJSONNameProvider)
+func GetForToken(document any, decodedToken string, opts ...Option) (any, reflect.Kind, error) {
+	o := optionsWithDefaults(opts)
+
+	return getSingleImpl(document, decodedToken, o.provider)
 }
 
 // SetForToken sets a value for a json pointer token 1 level deep.
-func SetForToken(document any, decodedToken string, value any) (any, error) {
-	return document, setSingleImpl(document, value, decodedToken, jsonname.DefaultJSONNameProvider)
+//
+// See [Pointer.Set] for the mutation contract, in particular the handling of
+// the RFC 6901 "-" token on slices.
+func SetForToken(document any, decodedToken string, value any, opts ...Option) (any, error) {
+	o := optionsWithDefaults(opts)
+
+	return setSingleImpl(document, value, decodedToken, o.provider)
 }
 
-func getSingleImpl(node any, decodedToken string, nameProvider *jsonname.NameProvider) (any, reflect.Kind, error) {
+func getSingleImpl(node any, decodedToken string, nameProvider NameProvider) (any, reflect.Kind, error) {
 	rValue := reflect.Indirect(reflect.ValueOf(node))
 	kind := rValue.Kind()
 	if isNil(node) {
@@ -361,6 +522,9 @@ func getSingleImpl(node any, decodedToken string, nameProvider *jsonname.NamePro
 		return nil, kind, errNoKey(decodedToken)
 
 	case reflect.Slice:
+		if decodedToken == dashToken {
+			return nil, kind, errDashOnGet()
+		}
 		tokenIndex, err := strconv.Atoi(decodedToken)
 		if err != nil {
 			return nil, kind, errors.Join(err, ErrPointer)
@@ -378,14 +542,14 @@ func getSingleImpl(node any, decodedToken string, nameProvider *jsonname.NamePro
 	}
 }
 
-func setSingleImpl(node, data any, decodedToken string, nameProvider *jsonname.NameProvider) error {
+func setSingleImpl(node, data any, decodedToken string, nameProvider NameProvider) (any, error) {
 	// check for nil to prevent panic when calling rValue.Type()
 	if isNil(node) {
-		return fmt.Errorf("cannot set field %q on nil value: %w", decodedToken, ErrPointer)
+		return node, fmt.Errorf("cannot set field %q on nil value: %w", decodedToken, ErrPointer)
 	}
 
 	if ns, ok := node.(JSONSetable); ok {
-		return ns.JSONSet(decodedToken, data)
+		return node, ns.JSONSet(decodedToken, data)
 	}
 
 	rValue := reflect.Indirect(reflect.ValueOf(node))
@@ -394,12 +558,12 @@ func setSingleImpl(node, data any, decodedToken string, nameProvider *jsonname.N
 	case reflect.Struct:
 		nm, ok := nameProvider.GetGoNameForType(rValue.Type(), decodedToken)
 		if !ok {
-			return fmt.Errorf("object has no field %q: %w", decodedToken, ErrPointer)
+			return node, fmt.Errorf("object has no field %q: %w", decodedToken, ErrPointer)
 		}
 
 		fld := rValue.FieldByName(nm)
 		if !fld.CanSet() {
-			return fmt.Errorf("can't set struct field %s to %v: %w", nm, data, ErrPointer)
+			return node, fmt.Errorf("can't set struct field %s to %v: %w", nm, data, ErrPointer)
 		}
 
 		value := reflect.ValueOf(data)
@@ -407,33 +571,51 @@ func setSingleImpl(node, data any, decodedToken string, nameProvider *jsonname.N
 		assignedType := fld.Type()
 
 		if !valueType.AssignableTo(assignedType) {
-			return fmt.Errorf("can't set value with type %T to field %s with type %v: %w", data, nm, assignedType, ErrPointer)
+			return node, fmt.Errorf("can't set value with type %T to field %s with type %v: %w", data, nm, assignedType, ErrPointer)
 		}
 
 		fld.Set(value)
 
-		return nil
+		return node, nil
 
 	case reflect.Map:
 		kv := reflect.ValueOf(decodedToken)
 		rValue.SetMapIndex(kv, reflect.ValueOf(data))
 
-		return nil
+		return node, nil
 
 	case reflect.Slice:
+		if decodedToken == dashToken {
+			// RFC 6901 §4 / RFC 6902 append semantics: terminal "-" appends
+			// the value to the slice. We rebind in place when the slice is
+			// reachable via an addressable ancestor; otherwise we return the
+			// new slice header for the parent (or the public Set) to rebind.
+			value := reflect.ValueOf(data)
+			elemType := rValue.Type().Elem()
+			if !value.Type().AssignableTo(elemType) {
+				return node, fmt.Errorf("can't append value of type %T to slice of %v: %w", data, elemType, ErrPointer)
+			}
+			newSlice := reflect.Append(rValue, value)
+			if rValue.CanSet() {
+				rValue.Set(newSlice)
+				return node, nil
+			}
+			return newSlice.Interface(), nil
+		}
+
 		tokenIndex, err := strconv.Atoi(decodedToken)
 		if err != nil {
-			return errors.Join(err, ErrPointer)
+			return node, errors.Join(err, ErrPointer)
 		}
 
 		sLength := rValue.Len()
 		if tokenIndex < 0 || tokenIndex >= sLength {
-			return errOutOfBounds(sLength, tokenIndex)
+			return node, errOutOfBounds(sLength, tokenIndex)
 		}
 
 		elem := rValue.Index(tokenIndex)
 		if !elem.CanSet() {
-			return fmt.Errorf("can't set slice index %s to %v: %w", decodedToken, data, ErrPointer)
+			return node, fmt.Errorf("can't set slice index %s to %v: %w", decodedToken, data, ErrPointer)
 		}
 
 		value := reflect.ValueOf(data)
@@ -441,15 +623,15 @@ func setSingleImpl(node, data any, decodedToken string, nameProvider *jsonname.N
 		assignedType := elem.Type()
 
 		if !valueType.AssignableTo(assignedType) {
-			return fmt.Errorf("can't set value with type %T to slice element %d with type %v: %w", data, tokenIndex, assignedType, ErrPointer)
+			return node, fmt.Errorf("can't set value with type %T to slice element %d with type %v: %w", data, tokenIndex, assignedType, ErrPointer)
 		}
 
 		elem.Set(value)
 
-		return nil
+		return node, nil
 
 	default:
-		return errInvalidReference(decodedToken)
+		return node, errInvalidReference(decodedToken)
 	}
 }
 
@@ -460,24 +642,27 @@ func offsetSingleObject(dec *json.Decoder, decodedToken string) (int64, error) {
 		if err != nil {
 			return 0, err
 		}
-		switch tk := tk.(type) {
-		case json.Delim:
-			switch tk {
-			case '{':
-				if err = drainSingle(dec); err != nil {
-					return 0, err
-				}
-			case '[':
+		key, ok := tk.(string)
+		if !ok {
+			return 0, fmt.Errorf("invalid key token %#v: %w", tk, ErrPointer)
+		}
+		if key == decodedToken {
+			return offset, nil
+		}
+
+		// Consume the associated value. Scalars are fully read by a single
+		// Token() call; composite values must be drained.
+		tk, err = dec.Token()
+		if err != nil {
+			return 0, err
+		}
+		if delim, isDelim := tk.(json.Delim); isDelim {
+			switch delim {
+			case '{', '[':
 				if err = drainSingle(dec); err != nil {
 					return 0, err
 				}
 			}
-		case string:
-			if tk == decodedToken {
-				return offset, nil
-			}
-		default:
-			return 0, fmt.Errorf("invalid token %#v: %w", tk, ErrPointer)
 		}
 	}
 
@@ -485,6 +670,9 @@ func offsetSingleObject(dec *json.Decoder, decodedToken string) (int64, error) {
 }
 
 func offsetSingleArray(dec *json.Decoder, decodedToken string) (int64, error) {
+	if decodedToken == dashToken {
+		return 0, errDashOnOffset()
+	}
 	idx, err := strconv.Atoi(decodedToken)
 	if err != nil {
 		return 0, fmt.Errorf("token reference %q is not a number: %w: %w", decodedToken, err, ErrPointer)
diff --git a/vendor/github.com/go-openapi/runtime/.gitignore b/vendor/github.com/go-openapi/runtime/.gitignore
index d8f4186fe5..c0bc15bebe 100644
--- a/vendor/github.com/go-openapi/runtime/.gitignore
+++ b/vendor/github.com/go-openapi/runtime/.gitignore
@@ -3,3 +3,5 @@
 .idea
 .env
 .mcp.json
+go.work.sum
+.worktrees/
diff --git a/vendor/github.com/go-openapi/runtime/.golangci.yml b/vendor/github.com/go-openapi/runtime/.golangci.yml
index 0087ed3113..ef2ff12bea 100644
--- a/vendor/github.com/go-openapi/runtime/.golangci.yml
+++ b/vendor/github.com/go-openapi/runtime/.golangci.yml
@@ -2,13 +2,9 @@ version: "2"
 linters:
   default: all
   disable:
-    - cyclop
     - depguard
     - err113 # disabled temporarily: there are just too many issues to address
-    - errchkjson
-    - errorlint
     - exhaustruct
-    - forcetypeassert
     - funlen
     - gochecknoglobals
     - gochecknoinits
@@ -16,12 +12,12 @@ linters:
     - godot
     - godox
     - gomoddirectives # moved to mono-repo, multi-modules, so replace directives are needed
+    - gomodguard
+    - gomodguard_v2
     - gosmopolitan
     - inamedparam
-    - ireturn
-    - lll
+    - ireturn # this repo adopted a pattern where there are quite many returned interfaces. To be challenged with v2
     - musttag
-    - nestif
     - nilerr # nilerr crashes on this repo
     - nlreturn
     - noinlineerr
@@ -31,7 +27,6 @@ linters:
     - testpackage
     - thelper
     - tparallel
-    - unparam
     - varnamelen
     - whitespace
     - wrapcheck
@@ -43,8 +38,17 @@ linters:
     goconst:
       min-len: 2
       min-occurrences: 3
+    cyclop:
+      max-complexity: 25
     gocyclo:
-      min-complexity: 45
+      min-complexity: 25
+    gocognit:
+      min-complexity: 35
+    exhaustive:
+      default-signifies-exhaustive: true
+      default-case-required: true
+    lll:
+      line-length: 180
   exclusions:
     generated: lax
     presets:
@@ -53,6 +57,7 @@ linters:
       - legacy
       - std-error-handling
     paths:
+      - .worktrees
       - third_party$
       - builtin$
       - examples$
@@ -60,12 +65,17 @@ formatters:
   enable:
     - gofmt
     - goimports
+  settings:
+    # local prefixes regroup imports from these packages
+    goimports:
+      local-prefixes:
+        - github.com/go-openapi
   exclusions:
     generated: lax
     paths:
+      - .worktrees
       - third_party$
       - builtin$
-      - examples$
 issues:
   # Maximum issues count per one linter.
   # Set to 0 to disable.
diff --git a/vendor/github.com/go-openapi/runtime/CONTRIBUTORS.md b/vendor/github.com/go-openapi/runtime/CONTRIBUTORS.md
new file mode 100644
index 0000000000..443d104c3c
--- /dev/null
+++ b/vendor/github.com/go-openapi/runtime/CONTRIBUTORS.md
@@ -0,0 +1,83 @@
+# Contributors
+
+- Repository: ['go-openapi/runtime']
+
+| Total Contributors | Total Contributions |
+| --- | --- |
+| 71  | 542  |
+
+| Username | All Time Contribution Count | All Commits |
+| --- | --- | --- |
+| @casualjim | 268 | <https://github.com/go-openapi/runtime/commits?author=casualjim> |
+| @fredbi | 117 | <https://github.com/go-openapi/runtime/commits?author=fredbi> |
+| @youyuanwu | 19 | <https://github.com/go-openapi/runtime/commits?author=youyuanwu> |
+| @josephwoodward | 13 | <https://github.com/go-openapi/runtime/commits?author=josephwoodward> |
+| @kenjones-cisco | 12 | <https://github.com/go-openapi/runtime/commits?author=kenjones-cisco> |
+| @GlenDC | 7 | <https://github.com/go-openapi/runtime/commits?author=GlenDC> |
+| @moenning | 6 | <https://github.com/go-openapi/runtime/commits?author=moenning> |
+| @mstoykov | 6 | <https://github.com/go-openapi/runtime/commits?author=mstoykov> |
+| @elakito | 6 | <https://github.com/go-openapi/runtime/commits?author=elakito> |
+| @ifraixedes | 5 | <https://github.com/go-openapi/runtime/commits?author=ifraixedes> |
+| @zeitlinger | 4 | <https://github.com/go-openapi/runtime/commits?author=zeitlinger> |
+| @Copilot | 3 | <https://github.com/go-openapi/runtime/commits?author=Copilot> |
+| @jkawamoto | 3 | <https://github.com/go-openapi/runtime/commits?author=jkawamoto> |
+| @stoyanr | 3 | <https://github.com/go-openapi/runtime/commits?author=stoyanr> |
+| @keramix | 2 | <https://github.com/go-openapi/runtime/commits?author=keramix> |
+| @Equanox | 2 | <https://github.com/go-openapi/runtime/commits?author=Equanox> |
+| @ederavilaprado | 2 | <https://github.com/go-openapi/runtime/commits?author=ederavilaprado> |
+| @nan0tube | 2 | <https://github.com/go-openapi/runtime/commits?author=nan0tube> |
+| @thomdixon | 2 | <https://github.com/go-openapi/runtime/commits?author=thomdixon> |
+| @deborggraever | 2 | <https://github.com/go-openapi/runtime/commits?author=deborggraever> |
+| @MakarandNsd | 2 | <https://github.com/go-openapi/runtime/commits?author=MakarandNsd> |
+| @Vadskye | 2 | <https://github.com/go-openapi/runtime/commits?author=Vadskye> |
+| @jsilland | 2 | <https://github.com/go-openapi/runtime/commits?author=jsilland> |
+| @Kunde21 | 2 | <https://github.com/go-openapi/runtime/commits?author=Kunde21> |
+| @bcomnes | 2 | <https://github.com/go-openapi/runtime/commits?author=bcomnes> |
+| @galaxie | 2 | <https://github.com/go-openapi/runtime/commits?author=galaxie> |
+| @anfernee | 2 | <https://github.com/go-openapi/runtime/commits?author=anfernee> |
+| @wahabmk | 1 | <https://github.com/go-openapi/runtime/commits?author=wahabmk> |
+| @vearutop | 1 | <https://github.com/go-openapi/runtime/commits?author=vearutop> |
+| @tschaub | 1 | <https://github.com/go-openapi/runtime/commits?author=tschaub> |
+| @pytlesk4 | 1 | <https://github.com/go-openapi/runtime/commits?author=pytlesk4> |
+| @tgraf | 1 | <https://github.com/go-openapi/runtime/commits?author=tgraf> |
+| @seanprince | 1 | <https://github.com/go-openapi/runtime/commits?author=seanprince> |
+| @rodriguise | 1 | <https://github.com/go-openapi/runtime/commits?author=rodriguise> |
+| @petrkotas | 1 | <https://github.com/go-openapi/runtime/commits?author=petrkotas> |
+| @maxatome | 1 | <https://github.com/go-openapi/runtime/commits?author=maxatome> |
+| @maxkarelov | 1 | <https://github.com/go-openapi/runtime/commits?author=maxkarelov> |
+| @tooolbox | 1 | <https://github.com/go-openapi/runtime/commits?author=tooolbox> |
+| @akutz | 1 | <https://github.com/go-openapi/runtime/commits?author=akutz> |
+| @yabberyabber | 1 | <https://github.com/go-openapi/runtime/commits?author=yabberyabber> |
+| @elv-gilles | 1 | <https://github.com/go-openapi/runtime/commits?author=elv-gilles> |
+| @gregmarr | 1 | <https://github.com/go-openapi/runtime/commits?author=gregmarr> |
+| @jwalter1-quest | 1 | <https://github.com/go-openapi/runtime/commits?author=jwalter1-quest> |
+| @s4s7 | 1 | <https://github.com/go-openapi/runtime/commits?author=s4s7> |
+| @stingshen | 1 | <https://github.com/go-openapi/runtime/commits?author=stingshen> |
+| @tamalsaha | 1 | <https://github.com/go-openapi/runtime/commits?author=tamalsaha> |
+| @tte | 1 | <https://github.com/go-openapi/runtime/commits?author=tte> |
+| @martian4202 | 1 | <https://github.com/go-openapi/runtime/commits?author=martian4202> |
+| @yan-zhuang | 1 | <https://github.com/go-openapi/runtime/commits?author=yan-zhuang> |
+| @aleksandr-vin | 1 | <https://github.com/go-openapi/runtime/commits?author=aleksandr-vin> |
+| @azylman | 1 | <https://github.com/go-openapi/runtime/commits?author=azylman> |
+| @anasmuhmd | 1 | <https://github.com/go-openapi/runtime/commits?author=anasmuhmd> |
+| @ArFe | 1 | <https://github.com/go-openapi/runtime/commits?author=ArFe> |
+| @CodeLingoBot | 1 | <https://github.com/go-openapi/runtime/commits?author=CodeLingoBot> |
+| @dlmiddlecote | 1 | <https://github.com/go-openapi/runtime/commits?author=dlmiddlecote> |
+| @danny-cheung | 1 | <https://github.com/go-openapi/runtime/commits?author=danny-cheung> |
+| @calavera | 1 | <https://github.com/go-openapi/runtime/commits?author=calavera> |
+| @EdwardBetts | 1 | <https://github.com/go-openapi/runtime/commits?author=EdwardBetts> |
+| @etsangsplk | 1 | <https://github.com/go-openapi/runtime/commits?author=etsangsplk> |
+| @ericzsplk | 1 | <https://github.com/go-openapi/runtime/commits?author=ericzsplk> |
+| @faguirre1 | 1 | <https://github.com/go-openapi/runtime/commits?author=faguirre1> |
+| @florindragos | 1 | <https://github.com/go-openapi/runtime/commits?author=florindragos> |
+| @gbjk | 1 | <https://github.com/go-openapi/runtime/commits?author=gbjk> |
+| @taisho6339 | 1 | <https://github.com/go-openapi/runtime/commits?author=taisho6339> |
+| @jbowes | 1 | <https://github.com/go-openapi/runtime/commits?author=jbowes> |
+| @JoakimSoderberg | 1 | <https://github.com/go-openapi/runtime/commits?author=JoakimSoderberg> |
+| @robbert229 | 1 | <https://github.com/go-openapi/runtime/commits?author=robbert229> |
+| @jonathaningram | 1 | <https://github.com/go-openapi/runtime/commits?author=jonathaningram> |
+| @KuaaMU | 1 | <https://github.com/go-openapi/runtime/commits?author=KuaaMU> |
+| @germanhs | 1 | <https://github.com/go-openapi/runtime/commits?author=germanhs> |
+| @pracucci | 1 | <https://github.com/go-openapi/runtime/commits?author=pracucci> |
+
+ _this file was generated by the [Contributors GitHub Action](https://github.com/github-community-projects/contributors)_
diff --git a/vendor/github.com/go-openapi/runtime/README.md b/vendor/github.com/go-openapi/runtime/README.md
index dd7f5039a7..134d930cd9 100644
--- a/vendor/github.com/go-openapi/runtime/README.md
+++ b/vendor/github.com/go-openapi/runtime/README.md
@@ -8,8 +8,7 @@
 [![Release][release-badge]][release-url] [![Go Report Card][gocard-badge]][gocard-url] [![CodeFactor Grade][codefactor-badge]][codefactor-url] [![License][license-badge]][license-url]
 <!-- Badges: documentation & support -->
 <!-- Badges: others & stats -->
-[![GoDoc][godoc-badge]][godoc-url] [![Discord Channel][discord-badge]][discord-url] [![go version][goversion-badge]][goversion-url] ![Top language][top-badge] ![Commits since latest release][commits-badge]
-
+[![Doc][doc-badge]][doc-url] [![GoDoc][godoc-badge]][godoc-url] [![Discord Channel][discord-badge]][discord-url] [![go version][goversion-badge]][goversion-url] ![Top language][top-badge] ![Commits since latest release][commits-badge]
 ---
 
 A runtime for go OpenAPI toolkit.
@@ -18,13 +17,44 @@ The runtime component for use in code generation or as untyped usage.
 
 ## Announcements
 
-* **2025-12-19** : new community chat on discord
-  * a new discord community channel is available to be notified of changes and support users
-  * our venerable Slack channel remains open, and will be eventually discontinued on **2026-03-31**
+[**Complete documentation as github pages**][doc-url]
+
+**Changes to the API surface in `v0.30.0`**:
+
+* utility package `header` has now moved to `github.com/go-openapi/runtime/server-middleware/negotiate/header`
+
+> A shim is provided to support existing programs, with a deprecation notice.
+
+**Changes in semantics in `v0.30.0`**:
+
+Function `negotiate.NegotiateContentType` (available as an alias for backward compatibility as `middleware.NegotiateContentType`
+now performs a full match considering MIME parameters.
+
+The previous behavior (matching in order of appearance after stripping parameters) may be enabled explicitly with
+option `negotiate.WithIgnoreParameters`.
+
+* **2026-05-07** : exposed UI and Spec middleware as a separate, dependency-free module.
+
+> Newly available package: `github.com/go-openapi/runtime/server-middleware/docui` that now holds our
+> UI and spec serve middleware.
+>
+> A shim is available in `github.com/go-openapi/runtime/middleware` to bridge the older UI options to the new ones,
+> with a deprecation notice.
+>
+> Methods that were unduly exported and purely used to manipulate options (e.g. `SwaggerUIOpts.EnsureDefaults`) have been
+> removed. New options in `docui` should be used instead.
+
+> Users may reuse this middleware to serve a Redoc, Rapidoc or SwaggerUI documentation without
+> importing the complete go-openapi scaffolding.
 
-You may join the discord community by clicking the invite link on the discord badge (also above). [![Discord Channel][discord-badge]][discord-url]
+* **2026-05-05** : exposed content negotiation methods as a separate, dependency-free module
 
-Or join our Slack channel: [![Slack Channel][slack-logo]![slack-badge]][slack-url]
+> Users may reuse these utilities to support content-negotiation without extra dependencies.
+>
+> Newly available module: `github.com/go-openapi/runtime/server-middleware`
+>
+> Newly available packages: `github.com/go-openapi/runtime/server-middleware/negotiate` and
+> `github.com/go-openapi/runtime/server-middleware/mediatype`.
 
 ## Status
 
@@ -40,18 +70,21 @@ go get github.com/go-openapi/runtime
 
 See <https://github.com/go-openapi/runtime/releases>
 
-For pre-v0.30.0 releases see [release notes](docs/NOTES.md).
+For v0.29.0 release see [release notes](docs/NOTES.md).
+From that release onwards, changes are tracked in the github release notes.
 
 **What coming next?**
 
 Moving forward, we want to :
 
-* [ ] continue narrowing down the scope of dependencies:
-  * yaml support in an independent module
+* [x] fix a few known issues with some file upload requests (e.g. #286)
+* [] continue narrowing down the scope of dependencies:
+  * [x] split middleware and other useful utilities as a separate dependency-free module
+  * yaml support in an independent module (v2)
   * introduce more up-to-date support for opentelemetry as a separate module that evolves
     independently from the main package (to avoid breaking changes, the existing API
-    will remain maintained, but evolve at a slower pace than opentelemetry).
-* [ ] fix a few known issues with some file upload requests (e.g. #286)
+    will remain maintained, but evolve at a slower pace than opentelemetry). (v2)
+* [] publish proper documentation and examples
 
 ## Licensing
 
@@ -62,11 +95,11 @@ on top of which it has been built.
 
 ## Other documentation
 
-* [FAQ](docs/FAQ.md)
+* [FAQ](https://go-openapi.github.io/runtime/tutorials/faq/) · [Media-type selection](https://go-openapi.github.io/runtime/tutorials/media-types/) · [Client keep-alive](https://go-openapi.github.io/runtime/tutorials/keep-alive/)
 * [All-time contributors](./CONTRIBUTORS.md)
-* [Contributing guidelines](.github/CONTRIBUTING.md)
-* [Maintainers documentation](docs/MAINTAINERS.md)
-* [Code style](docs/STYLE.md)
+* [Contributing guidelines][contributing-doc-site]
+* [Maintainers documentation][maintainers-doc-site]
+* [Code style][style-doc-site]
 
 ## Cutting a new release
 
@@ -95,13 +128,12 @@ Maintainers can cut a new release by either:
 [codefactor-badge]: https://img.shields.io/codefactor/grade/github/go-openapi/runtime
 [codefactor-url]: https://www.codefactor.io/repository/github/go-openapi/runtime
 <!-- Badges: documentation & support -->
+[doc-badge]: https://img.shields.io/badge/doc-site-blue?link=https%3A%2F%2Fgo-openapi.github.io%2Fruntime%2F
+[doc-url]: https://go-openapi.github.io/runtime
 [godoc-badge]: https://pkg.go.dev/badge/github.com/go-openapi/runtime
 [godoc-url]: http://pkg.go.dev/github.com/go-openapi/runtime
-[slack-logo]: https://a.slack-edge.com/e6a93c1/img/icons/favicon-32.png
-[slack-badge]: https://img.shields.io/badge/slack-blue?link=https%3A%2F%2Fgoswagger.slack.com%2Farchives%2FC04R30YM
-[slack-url]: https://goswagger.slack.com/archives/C04R30YMU
 [discord-badge]: https://img.shields.io/discord/1446918742398341256?logo=discord&label=discord&color=blue
-[discord-url]: https://discord.gg/twZ9BwT3
+[discord-url]: https://discord.gg/FfnFYaC3k5
 
 <!-- Badges: license & compliance -->
 [license-badge]: http://img.shields.io/badge/license-Apache%20v2-orange.svg
@@ -111,3 +143,7 @@ Maintainers can cut a new release by either:
 [goversion-url]: https://github.com/go-openapi/runtime/blob/master/go.mod
 [top-badge]: https://img.shields.io/github/languages/top/go-openapi/runtime
 [commits-badge]: https://img.shields.io/github/commits-since/go-openapi/runtime/latest
+<!-- Organization docs -->
+[contributing-doc-site]: https://go-openapi.github.io/doc-site/contributing/contributing/index.html
+[maintainers-doc-site]: https://go-openapi.github.io/doc-site/maintainers/index.html
+[style-doc-site]: https://go-openapi.github.io/doc-site/contributing/style/index.html
diff --git a/vendor/github.com/go-openapi/runtime/bytestream.go b/vendor/github.com/go-openapi/runtime/bytestream.go
index 8701c8e3d6..9371ea4ea1 100644
--- a/vendor/github.com/go-openapi/runtime/bytestream.go
+++ b/vendor/github.com/go-openapi/runtime/bytestream.go
@@ -97,7 +97,7 @@ func ByteStreamConsumer(opts ...byteStreamOpt) Consumer {
 			}
 		default:
 			// check for the underlying type to be pointer to []byte or string,
-			if ptr := reflect.TypeOf(data); ptr.Kind() != reflect.Ptr {
+			if ptr := reflect.TypeOf(data); ptr.Kind() != reflect.Pointer {
 				return errors.New("destination must be a pointer")
 			}
 
@@ -126,13 +126,13 @@ func ByteStreamConsumer(opts ...byteStreamOpt) Consumer {
 //
 // Supported input underlying types and interfaces, prioritized in this order:
 //
-// - [io.WriterTo] (for maximum control)
-// - [io.Reader] (performs [io.Copy]). A ReadCloser is closed before exiting.
-// - [encoding.BinaryMarshaler]
-// - error (writes as a string)
-// - []byte
-// - string
-// - struct, other slices: writes as JSON.
+//   - [io.WriterTo] (for maximum control)
+//   - [io.Reader] (performs [io.Copy]). A ReadCloser is closed before exiting.
+//   - [encoding.BinaryMarshaler]
+//   - error (writes as a string)
+//   - []byte
+//   - string
+//   - struct, other slices: writes as JSON.
 func ByteStreamProducer(opts ...byteStreamOpt) Producer {
 	var vals byteStreamOpts
 	for _, opt := range opts {
diff --git a/vendor/github.com/go-openapi/runtime/client/httptrace.go b/vendor/github.com/go-openapi/runtime/client/httptrace.go
new file mode 100644
index 0000000000..5bdea4e241
--- /dev/null
+++ b/vendor/github.com/go-openapi/runtime/client/httptrace.go
@@ -0,0 +1,520 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package client
+
+import (
+	"context"
+	"crypto/tls"
+	"fmt"
+	"io"
+	"net/http/httptrace"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/go-openapi/runtime/logger"
+)
+
+// traceSession owns the per-request state for [Runtime.Trace].
+//
+// It tracks the t=0 anchor for the connection phase, accumulates
+// per-phase timestamps (for the trailing summary), and emits each
+// event to the runtime logger as it fires. One session per
+// SubmitContext call.
+type traceSession struct {
+	logger logger.Logger
+	method string
+	url    string
+
+	// tlsCfg points at the *tls.Config of the http.Transport that
+	// will run the request, when introspectable (i.e. the transport
+	// is an *http.Transport). Used by the TLS diagnostic mode to
+	// cross-check user configuration against what the handshake
+	// actually attempted. Nil when the transport is custom and
+	// the config cannot be reached.
+	tlsCfg *tls.Config
+
+	mu      sync.Mutex
+	start   time.Time
+	last    time.Time // last printed event, for relative-dt rendering
+	phases  phaseTimings
+	gotConn httptrace.GotConnInfo
+	tlsDone tlsResult
+
+	dnsStartAt          time.Time
+	connectStartAt      time.Time
+	tlsHandshakeStartAt time.Time
+	wait100StartAt      time.Time
+	gotConnAt           time.Time
+	wroteHeadersAt      time.Time
+	wroteRequestAt      time.Time
+	ttfbAt              time.Time
+
+	statusCode int
+	rtError    error
+}
+
+// phaseTimings holds the per-phase durations for the trailing
+// summary line. Zero values mean "phase did not occur" (e.g. no
+// DNS lookup on a reused conn, no TLS on http://).
+type phaseTimings struct {
+	dns  time.Duration
+	dial time.Duration
+	tls  time.Duration
+	ttfb time.Duration // time from GotConn to first response byte
+}
+
+// tlsResult captures whatever we learned from TLSHandshakeDone.
+// On the happy path err is nil and state is fully populated; on
+// failure state may be partial (and is what the TLS diagnostic
+// mode in httptrace_tls.go works from).
+type tlsResult struct {
+	state tls.ConnectionState
+	err   error
+	done  bool
+}
+
+const tracePrefix = "[trace] "
+
+// staleIdleThreshold is the idle duration above which a reused
+// pooled connection earns a HEADS-UP annotation. Per-runtime
+// configurability is deferred to v2; 30s matches the issue #336
+// territory (typical NAT idle timeouts start in the 60–350s
+// range, so a 30s reuse is already in "could be stale" zone).
+const staleIdleThreshold = 30 * time.Second
+
+// newTraceSession allocates a session and pre-renders the opening
+// line (method + url). The session is not yet attached to a
+// context — that's the caller's responsibility via session.attach.
+//
+// tlsCfg may be nil; when non-nil it is used by the TLS diagnostic
+// mode to cross-check user-configured constraints (MinVersion,
+// CipherSuites, custom RootCAs) against handshake failures.
+func newTraceSession(log logger.Logger, method, url string, tlsCfg *tls.Config) *traceSession {
+	s := &traceSession{
+		logger: log,
+		method: method,
+		url:    url,
+		tlsCfg: tlsCfg,
+		start:  time.Now(),
+	}
+	s.last = s.start
+	s.emitf("%s %s", method, url)
+	return s
+}
+
+// attach installs the session's ClientTrace on ctx and returns the
+// derived context. Callers pass the returned context to
+// http.Client.Do (typically by setting it on req via
+// req.WithContext) so the transport fires the hooks.
+func (s *traceSession) attach(ctx context.Context) context.Context {
+	return httptrace.WithClientTrace(ctx, s.clientTrace())
+}
+
+// clientTrace wires every httptrace hook to the corresponding
+// session method. Each callback is responsible for its own
+// locking; the stdlib does not serialize trace callbacks.
+func (s *traceSession) clientTrace() *httptrace.ClientTrace {
+	return &httptrace.ClientTrace{
+		GetConn:              s.onGetConn,
+		GotConn:              s.onGotConn,
+		PutIdleConn:          s.onPutIdleConn,
+		GotFirstResponseByte: s.onGotFirstResponseByte,
+		Got100Continue:       s.onGot100Continue,
+		DNSStart:             s.onDNSStart,
+		DNSDone:              s.onDNSDone,
+		ConnectStart:         s.onConnectStart,
+		ConnectDone:          s.onConnectDone,
+		TLSHandshakeStart:    s.onTLSHandshakeStart,
+		TLSHandshakeDone:     s.onTLSHandshakeDone,
+		WroteHeaders:         s.onWroteHeaders,
+		Wait100Continue:      s.onWait100Continue,
+		WroteRequest:         s.onWroteRequest,
+	}
+}
+
+// ---------------------------------------------------------------
+// Phase callbacks (stdlib httptrace hooks)
+// ---------------------------------------------------------------
+
+func (s *traceSession) onGetConn(hostPort string) {
+	s.emitTf("GetConn(%s)", hostPort)
+}
+
+func (s *traceSession) onGotConn(info httptrace.GotConnInfo) {
+	s.mu.Lock()
+	s.gotConn = info
+	s.gotConnAt = time.Now()
+	s.mu.Unlock()
+
+	if info.Reused {
+		s.emitTf("GotConn(reused=true, idle=%t, idle-time=%s)",
+			info.WasIdle, info.IdleTime.Round(time.Millisecond))
+	} else {
+		s.emitTf("GotConn(reused=false)")
+	}
+
+	if isStaleIdleReuse(info) {
+		s.emitf("# HEADS-UP: reused idle connection (idle for %s).",
+			info.IdleTime.Round(time.Second))
+		s.emitf("# If this request fails with EOF/connection reset, the server")
+		s.emitf("# or an in-path NAT may have dropped the conn silently.")
+	}
+}
+
+// isStaleIdleReuse reports whether a GotConn info indicates the
+// connection came from the idle pool after sitting idle for
+// longer than [staleIdleThreshold]. This is the issue #336
+// pattern: long-idle pooled conns are the ones most likely to be
+// dead by the time the next request tries to use them.
+func isStaleIdleReuse(info httptrace.GotConnInfo) bool {
+	return info.Reused && info.WasIdle && info.IdleTime > staleIdleThreshold
+}
+
+func (s *traceSession) onPutIdleConn(err error) {
+	if err != nil {
+		s.emitTf("PutIdleConn(err=%v)", err)
+		return
+	}
+	s.emitTf("PutIdleConn")
+}
+
+func (s *traceSession) onGotFirstResponseByte() {
+	s.mu.Lock()
+	s.ttfbAt = time.Now()
+	if !s.gotConnAt.IsZero() {
+		s.phases.ttfb = s.ttfbAt.Sub(s.gotConnAt)
+	}
+	s.mu.Unlock()
+	s.emitTf("GotFirstResponseByte (TTFB)")
+}
+
+func (s *traceSession) onGot100Continue() {
+	s.emitTf("Got100Continue")
+}
+
+func (s *traceSession) onDNSStart(info httptrace.DNSStartInfo) {
+	s.mu.Lock()
+	s.dnsStartAt = time.Now()
+	s.mu.Unlock()
+	s.emitTf("DNSStart(host=%s)", info.Host)
+}
+
+func (s *traceSession) onDNSDone(info httptrace.DNSDoneInfo) {
+	s.mu.Lock()
+	if !s.dnsStartAt.IsZero() {
+		s.phases.dns = time.Since(s.dnsStartAt)
+	}
+	s.mu.Unlock()
+
+	addrs := make([]string, 0, len(info.Addrs))
+	for _, a := range info.Addrs {
+		addrs = append(addrs, a.String())
+	}
+	if info.Err != nil {
+		s.emitTf("DNSDone(err=%v, addrs=[%s], coalesced=%t)",
+			info.Err, strings.Join(addrs, " "), info.Coalesced)
+		return
+	}
+	s.emitTf("DNSDone(addrs=[%s], coalesced=%t)",
+		strings.Join(addrs, " "), info.Coalesced)
+}
+
+func (s *traceSession) onConnectStart(network, addr string) {
+	s.mu.Lock()
+	s.connectStartAt = time.Now()
+	s.mu.Unlock()
+	s.emitTf("ConnectStart(%s %s)", network, addr)
+}
+
+func (s *traceSession) onConnectDone(network, addr string, err error) {
+	s.mu.Lock()
+	if !s.connectStartAt.IsZero() {
+		s.phases.dial = time.Since(s.connectStartAt)
+	}
+	s.mu.Unlock()
+
+	if err != nil {
+		s.emitTf("ConnectDone(%s %s, err=%v)", network, addr, err)
+		return
+	}
+	s.emitTf("ConnectDone(%s %s)", network, addr)
+}
+
+func (s *traceSession) onTLSHandshakeStart() {
+	s.mu.Lock()
+	s.tlsHandshakeStartAt = time.Now()
+	s.mu.Unlock()
+	s.emitTf("TLSHandshakeStart")
+}
+
+func (s *traceSession) onTLSHandshakeDone(state tls.ConnectionState, err error) {
+	s.mu.Lock()
+	if !s.tlsHandshakeStartAt.IsZero() {
+		s.phases.tls = time.Since(s.tlsHandshakeStartAt)
+	}
+	s.tlsDone = tlsResult{state: state, err: err, done: true}
+	s.mu.Unlock()
+
+	if err != nil {
+		s.emitTf("TLSHandshakeDone(err=%v)", err)
+		s.emitTLSDiagnostic(state, err)
+		return
+	}
+	s.emitTf("TLSHandshakeDone(tls=%s, cipher=%s, server=%s%s)",
+		tlsVersionName(state.Version),
+		tls.CipherSuiteName(state.CipherSuite),
+		state.ServerName,
+		certExpiryFragment(state),
+	)
+}
+
+func (s *traceSession) onWroteHeaders() {
+	s.mu.Lock()
+	s.wroteHeadersAt = time.Now()
+	s.mu.Unlock()
+	s.emitTf("WroteHeaders")
+}
+
+func (s *traceSession) onWait100Continue() {
+	s.mu.Lock()
+	s.wait100StartAt = time.Now()
+	s.mu.Unlock()
+	s.emitTf("Wait100Continue")
+}
+
+func (s *traceSession) onWroteRequest(info httptrace.WroteRequestInfo) {
+	s.mu.Lock()
+	s.wroteRequestAt = time.Now()
+	s.mu.Unlock()
+
+	if info.Err != nil {
+		s.emitTf("WroteRequest(err=%v)", info.Err)
+		return
+	}
+	s.emitTf("WroteRequest")
+}
+
+// ---------------------------------------------------------------
+// Body wrapping
+// ---------------------------------------------------------------
+
+// bodySide identifies which direction an instrumented body is on.
+type bodySide string
+
+const (
+	bodySend bodySide = "Sent"
+	bodyRecv bodySide = "Received"
+)
+
+// instrumentedBody wraps an [io.ReadCloser] and emits a
+// BodyChunk{Sent,Received} trace event per Read call. Tracks the
+// inter-read delay in `dt` so users can see streaming-body
+// cadence.
+//
+// Read granularity: bytes returned by the underlying body, not
+// HTTP/1.1 chunked-framing units. For wire-level chunking, use
+// [Runtime.Debug] instead.
+//
+// Concurrency: a single body is read from a single goroutine in
+// practice (http.Transport for request bodies, the application
+// for response bodies), so no internal locking is needed beyond
+// what the underlying ReadCloser provides.
+type instrumentedBody struct {
+	wrapped io.ReadCloser
+	sess    *traceSession
+	side    bodySide
+	last    time.Time
+}
+
+func (b *instrumentedBody) Read(p []byte) (int, error) {
+	n, err := b.wrapped.Read(p)
+	if n > 0 {
+		first := b.last.IsZero()
+		var dt time.Duration
+		if !first {
+			dt = time.Since(b.last)
+		}
+		b.last = time.Now()
+		b.sess.onBodyChunk(b.side, n, dt, first)
+	}
+	return n, err
+}
+
+func (b *instrumentedBody) Close() error {
+	return b.wrapped.Close()
+}
+
+// wrapRequestBody returns an instrumented wrapper around the
+// outgoing request body, or the original body if nil (which is
+// the common case for GET requests). The wrapper observes
+// Transport-side reads, so BodyChunkSent events appear between
+// WroteHeaders and WroteRequest in the trace timeline.
+func (s *traceSession) wrapRequestBody(body io.ReadCloser) io.ReadCloser {
+	if body == nil {
+		return nil
+	}
+	return &instrumentedBody{wrapped: body, sess: s, side: bodySend}
+}
+
+// wrapResponseBody returns an instrumented wrapper around the
+// incoming response body. Stacks cleanly above
+// [KeepAliveTransport]'s drain-on-close behavior.
+func (s *traceSession) wrapResponseBody(body io.ReadCloser) io.ReadCloser {
+	if body == nil {
+		return nil
+	}
+	return &instrumentedBody{wrapped: body, sess: s, side: bodyRecv}
+}
+
+// onBodyChunk renders a single BodyChunk{Sent,Received} event.
+// dt is the duration since the previous Read on the same body and
+// is meaningful only when `first` is false. The first chunk has no
+// preceding read, so the dt= field is suppressed; every subsequent
+// chunk emits dt= unconditionally — even when the measured value
+// rounds to zero (common on Windows, where the system clock
+// resolution is coarser than a fast loopback read loop).
+func (s *traceSession) onBodyChunk(side bodySide, n int, dt time.Duration, first bool) {
+	if first {
+		s.emitTf("BodyChunk%s(n=%d)", side, n)
+		return
+	}
+	s.emitTf("BodyChunk%s(n=%d, dt=%s)", side, n, round(dt))
+}
+
+// ---------------------------------------------------------------
+// Submit-level lifecycle hooks (called from SubmitContext)
+// ---------------------------------------------------------------
+
+// onRoundTripError is called by SubmitContext when http.Client.Do
+// returns an error. It records the error for the summary line.
+func (s *traceSession) onRoundTripError(err error) {
+	s.mu.Lock()
+	s.rtError = err
+	s.mu.Unlock()
+	s.emitTf("! error: %v", err)
+}
+
+// onResponse is called when http.Client.Do returns successfully.
+// It records the status code for the summary line.
+func (s *traceSession) onResponse(statusCode int) {
+	s.mu.Lock()
+	s.statusCode = statusCode
+	s.mu.Unlock()
+}
+
+// finish renders the trailing single-line summary and is called
+// by SubmitContext after the response body has been consumed (or
+// on error path, after the error was recorded). When a round-trip
+// error happened on a stale-idle reused connection, a tail block
+// flags the issue #336 pattern explicitly.
+func (s *traceSession) finish() {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	total := time.Since(s.start)
+	var b strings.Builder
+	fmt.Fprintf(&b, "Summary: %s — ", s.method)
+	if s.rtError != nil {
+		fmt.Fprintf(&b, "FAILED (%v)", s.rtError)
+	} else {
+		fmt.Fprintf(&b, "%d", s.statusCode)
+	}
+	if s.phases.dns > 0 {
+		fmt.Fprintf(&b, ", dns=%s", round(s.phases.dns))
+	}
+	if s.phases.dial > 0 {
+		fmt.Fprintf(&b, ", dial=%s", round(s.phases.dial))
+	}
+	if s.phases.tls > 0 {
+		fmt.Fprintf(&b, ", tls=%s", round(s.phases.tls))
+	}
+	if s.phases.ttfb > 0 {
+		fmt.Fprintf(&b, ", ttfb=%s", round(s.phases.ttfb))
+	}
+	fmt.Fprintf(&b, ", total=%s", round(total))
+
+	s.emitRaw(b.String())
+
+	// issue #336 tail annotation: a round-trip failure on a
+	// stale-idle reused conn is the canonical pattern.
+	if s.rtError != nil && isStaleIdleReuse(s.gotConn) {
+		s.emitf("# FAILED on a reused idle conn (%s idle).",
+			s.gotConn.IdleTime.Round(time.Second))
+		s.emitf("# Silently closed the conn while it sat in the idle pool.")
+		s.emitf("# Consider lowering http.Transport.IdleConnTimeout to evict")
+		s.emitf("# pooled conns before the NAT/server side does.")
+	}
+}
+
+// ---------------------------------------------------------------
+// Emission helpers
+// ---------------------------------------------------------------
+
+// emitf prints a plain event line (no t= timestamp). Used for the
+// opening line and the summary.
+func (s *traceSession) emitf(format string, args ...any) {
+	s.logger.Debugf(tracePrefix+format, args...)
+}
+
+// emitRaw is like emitf but takes an already-rendered string. Used
+// by finish() which builds its line via strings.Builder.
+func (s *traceSession) emitRaw(line string) {
+	s.logger.Debugf("%s", tracePrefix+line)
+}
+
+// emitTf prints a phase event with a cumulative t=... offset from
+// the session start.
+func (s *traceSession) emitTf(format string, args ...any) {
+	t := round(time.Since(s.start))
+	msg := fmt.Sprintf(format, args...)
+	s.logger.Debugf(tracePrefix+"%s (t=%s)", msg, t)
+}
+
+// traceRoundUnit is the rounding granularity for >=1ms durations
+// rendered in trace output. 100µs keeps lines readable while
+// preserving enough resolution to spot millisecond-scale phase
+// differences.
+const traceRoundUnit = 100 * time.Microsecond
+
+// round trims durations for human-readable trace output.
+// Sub-millisecond durations round to 1µs (preserves visibility on
+// fast loopback servers); >=1ms durations round to [traceRoundUnit].
+func round(d time.Duration) time.Duration {
+	if d <= 0 {
+		return 0
+	}
+	if d < time.Millisecond {
+		return d.Round(time.Microsecond)
+	}
+	return d.Round(traceRoundUnit)
+}
+
+// ---------------------------------------------------------------
+// TLS rendering helpers
+// ---------------------------------------------------------------
+
+func tlsVersionName(v uint16) string {
+	switch v {
+	case tls.VersionTLS10:
+		return "1.0"
+	case tls.VersionTLS11:
+		return "1.1"
+	case tls.VersionTLS12:
+		return "1.2"
+	case tls.VersionTLS13:
+		return "1.3"
+	default:
+		return fmt.Sprintf("0x%04x", v)
+	}
+}
+
+// certExpiryFragment renders ", expires=YYYY-MM-DD" for the leaf
+// cert when available, or an empty string otherwise.
+func certExpiryFragment(state tls.ConnectionState) string {
+	if len(state.PeerCertificates) == 0 {
+		return ""
+	}
+	return ", expires=" + state.PeerCertificates[0].NotAfter.UTC().Format("2006-01-02")
+}
diff --git a/vendor/github.com/go-openapi/runtime/client/httptrace_tls.go b/vendor/github.com/go-openapi/runtime/client/httptrace_tls.go
new file mode 100644
index 0000000000..063fb25927
--- /dev/null
+++ b/vendor/github.com/go-openapi/runtime/client/httptrace_tls.go
@@ -0,0 +1,353 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package client
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+)
+
+// TLS alert codes used by the diagnostic to classify handshake
+// failures. The crypto/tls package does not export named constants
+// for individual alerts, so we declare the ones we care about.
+// Values are from RFC 8446 §6 (the TLS 1.3 alert protocol; the
+// numbering is shared with earlier TLS versions for these alerts).
+//
+// The `err`-prefixed names satisfy the errname linter — tls.AlertError
+// implements error, so these are sentinel errors.
+const (
+	errTLSAlertHandshakeFailure tls.AlertError = 40
+	errTLSAlertProtocolVersion  tls.AlertError = 70
+)
+
+// introspectTLSConfig returns the *tls.Config of the http.Transport
+// that will run a request, when reachable, or nil otherwise.
+//
+// Reachable means the client's Transport is an *http.Transport
+// (the default and most common case). Custom transports — wrappers
+// around the default, or entirely user-provided — break introspection;
+// the TLS diagnostic falls back to "configured: not introspectable"
+// in that case.
+//
+// A nil client (zero value) or nil Transport falls through to
+// [http.DefaultTransport], whose TLSClientConfig is also nil; the
+// function returns nil and the diagnostic reports defaults.
+func introspectTLSConfig(client *http.Client) *tls.Config {
+	if client == nil {
+		return nil
+	}
+	transport := client.Transport
+	if transport == nil {
+		transport = http.DefaultTransport
+	}
+	t, ok := transport.(*http.Transport)
+	if !ok {
+		return nil
+	}
+	return t.TLSClientConfig
+}
+
+// emitTLSDiagnostic renders the failure-mode TLS diagnostic block.
+// Called from [traceSession.onTLSHandshakeDone] when err != nil.
+//
+// The block covers three axes (per the plan):
+//
+//  1. Protocol-version negotiation — detected from
+//     [errTLSAlertProtocolVersion] or a "protocol version" substring.
+//  2. Cipher-suite negotiation — detected from
+//     [errTLSAlertHandshakeFailure] when the user pinned CipherSuites.
+//  3. Certificate-chain validity — detected from
+//     [x509.CertificateInvalidError], [x509.UnknownAuthorityError]
+//     or [x509.HostnameError].
+//
+// When none of the specific axes match, a generic fallback emits
+// the raw error and whatever inspectable config the session holds.
+func (s *traceSession) emitTLSDiagnostic(state tls.ConnectionState, err error) {
+	s.emitf("# TLS DIAGNOSTIC")
+
+	// tlsAxisGeneric is handled by the default branch.
+	switch axis := classifyTLSError(err); axis {
+	case tlsAxisProtocolVersion:
+		s.diagnoseProtocolVersion(state, err)
+	case tlsAxisCipher:
+		s.diagnoseCipher(err)
+	case tlsAxisCertChain:
+		s.diagnoseCertChain(err)
+	default:
+		s.diagnoseTLSGeneric(err)
+	}
+}
+
+// tlsAxis is the diagnostic dimension a TLS handshake error maps
+// to. Axes are mutually exclusive at classification time.
+type tlsAxis int
+
+const (
+	tlsAxisGeneric tlsAxis = iota
+	tlsAxisProtocolVersion
+	tlsAxisCipher
+	tlsAxisCertChain
+)
+
+// classifyTLSError maps a TLS handshake error to one of the
+// diagnostic axes. The ordering matters: cert-chain errors win
+// over the generic handshake_failure alert because the alert is
+// what the server sends back, but the local error type carries
+// the more specific reason.
+func classifyTLSError(err error) tlsAxis {
+	if err == nil {
+		return tlsAxisGeneric
+	}
+
+	// Cert-chain errors are the most specific local diagnostic
+	// and should be reported even if a generic alert is also
+	// present in the chain.
+	var certInvalid x509.CertificateInvalidError
+	if errors.As(err, &certInvalid) {
+		return tlsAxisCertChain
+	}
+	var unknownAuth x509.UnknownAuthorityError
+	if errors.As(err, &unknownAuth) {
+		return tlsAxisCertChain
+	}
+	var hostnameErr x509.HostnameError
+	if errors.As(err, &hostnameErr) {
+		return tlsAxisCertChain
+	}
+
+	// TLS alert classification.
+	var alert tls.AlertError
+	if errors.As(err, &alert) {
+		switch alert {
+		case errTLSAlertProtocolVersion:
+			return tlsAxisProtocolVersion
+		case errTLSAlertHandshakeFailure:
+			return tlsAxisCipher
+		}
+	}
+
+	// Fall back on substring detection for protocol-version
+	// failures that arrive via the local error path rather than
+	// a server-side alert (e.g. when the client refuses the
+	// server's offered version).
+	msg := err.Error()
+	if strings.Contains(msg, "protocol version") || strings.Contains(msg, "unsupported protocol") {
+		return tlsAxisProtocolVersion
+	}
+
+	return tlsAxisGeneric
+}
+
+// ---------------------------------------------------------------
+// Axis renderers
+// ---------------------------------------------------------------
+
+func (s *traceSession) diagnoseProtocolVersion(state tls.ConnectionState, err error) {
+	s.emitf("#   axis: protocol-version")
+	s.emitf("#   error: %v", err)
+
+	configuredMin, configuredMax := configuredVersionRange(s.tlsCfg)
+	s.emitf("#   client offered: TLS %s — TLS %s",
+		tlsVersionName(configuredMin), tlsVersionName(configuredMax))
+
+	if state.Version != 0 {
+		s.emitf("#   negotiated up to: TLS %s", tlsVersionName(state.Version))
+	}
+	s.emitf("#   suggested: widen TLSClientOptions.MinVersion/MaxVersion,")
+	s.emitf("#              or pin to a version the server speaks.")
+}
+
+func (s *traceSession) diagnoseCipher(err error) {
+	s.emitf("#   axis: cipher-suite")
+	s.emitf("#   error: %v", err)
+
+	if s.tlsCfg != nil && len(s.tlsCfg.CipherSuites) > 0 {
+		s.emitf("#   client configured: [%s]",
+			strings.Join(cipherSuiteNames(s.tlsCfg.CipherSuites), ", "))
+		s.emitf("#   server set: not exposed by Go stdlib")
+		s.emitf("#              (capture with: openssl s_client -cipher ALL)")
+		s.emitf("#   suggested: drop the explicit CipherSuites restriction,")
+		s.emitf("#              or align it with the server's policy.")
+		return
+	}
+	// No client-side restriction. The handshake_failure alert
+	// is generic; without more info we can only surface the
+	// fact and suggest investigation.
+	s.emitf("#   client configured: defaults (no CipherSuites restriction)")
+	s.emitf("#   note: alert 40 is generic; the server may have rejected")
+	s.emitf("#         the handshake for a non-cipher reason. Try")
+	s.emitf("#         openssl s_client to capture details.")
+}
+
+func (s *traceSession) diagnoseCertChain(err error) {
+	s.emitf("#   axis: cert-chain")
+
+	var certInvalid x509.CertificateInvalidError
+	if errors.As(err, &certInvalid) {
+		s.diagnoseCertInvalid(certInvalid)
+		return
+	}
+
+	var unknownAuth x509.UnknownAuthorityError
+	if errors.As(err, &unknownAuth) {
+		s.diagnoseUnknownAuthority(unknownAuth)
+		return
+	}
+
+	var hostnameErr x509.HostnameError
+	if errors.As(err, &hostnameErr) {
+		s.diagnoseHostnameMismatch(hostnameErr)
+		return
+	}
+
+	// Defensive: should not happen — classifyTLSError already
+	// matched one of the three.
+	s.emitf("#   error: %v", err)
+}
+
+func (s *traceSession) diagnoseCertInvalid(certInvalid x509.CertificateInvalidError) {
+	cert := certInvalid.Cert
+	s.emitf("#   reason: %s", certInvalidReasonName(certInvalid.Reason))
+
+	switch certInvalid.Reason {
+	case x509.Expired:
+		s.emitf("#   leaf:    subject=%s", cert.Subject)
+		s.emitf("#            NotBefore=%s", cert.NotBefore.UTC().Format(time.RFC3339))
+		s.emitf("#            NotAfter=%s", cert.NotAfter.UTC().Format(time.RFC3339))
+		s.emitf("#            now=%s", time.Now().UTC().Format(time.RFC3339))
+		delta := time.Since(cert.NotAfter).Round(time.Hour)
+		s.emitf("#            expired %s ago", delta)
+		s.emitf("#   suggested: renew the server cert.")
+	case x509.NameMismatch, x509.CANotAuthorizedForThisName:
+		s.emitf("#   leaf:    subject=%s", cert.Subject)
+		s.emitf("#            DNS SANs=%v", cert.DNSNames)
+		s.emitf("#   suggested: set TLSClientOptions.ServerName to match")
+		s.emitf("#              one of the cert SANs, or fix the cert.")
+	default:
+		// Less-common reasons render via the default branch (issuer + NotAfter dump).
+		s.emitf("#   leaf:    subject=%s, issuer=%s", cert.Subject, cert.Issuer)
+		s.emitf("#            NotBefore=%s", cert.NotBefore.UTC().Format(time.RFC3339))
+		s.emitf("#            NotAfter=%s", cert.NotAfter.UTC().Format(time.RFC3339))
+		s.emitf("#   error: %v", certInvalid)
+	}
+}
+
+func (s *traceSession) diagnoseUnknownAuthority(unknownAuth x509.UnknownAuthorityError) {
+	s.emitf("#   reason: chain root not in trust store (unknown-CA)")
+	if cert := unknownAuth.Cert; cert != nil {
+		s.emitf("#   offending: subject=%s", cert.Subject)
+		s.emitf("#              issuer=%s", cert.Issuer)
+		s.emitf("#              NotAfter=%s", cert.NotAfter.UTC().Format(time.RFC3339))
+	}
+
+	trust := "SystemCertPool"
+	if s.tlsCfg != nil && s.tlsCfg.RootCAs != nil {
+		trust = "TLSClientOptions.CA (custom RootCAs)"
+	}
+	s.emitf("#   trust store in use: %s", trust)
+
+	s.emitf("#   suggested: set TLSClientOptions.CA to a bundle that")
+	s.emitf("#              includes the issuing CA, or add it to the")
+	s.emitf("#              OS trust store.")
+}
+
+func (s *traceSession) diagnoseHostnameMismatch(hostnameErr x509.HostnameError) {
+	s.emitf("#   reason: hostname mismatch")
+	s.emitf("#   dialed: %s", hostnameErr.Host)
+	if cert := hostnameErr.Certificate; cert != nil {
+		s.emitf("#   leaf:    subject=%s", cert.Subject)
+		s.emitf("#            DNS SANs=%v", cert.DNSNames)
+		s.emitf("#            IP SANs=%v", cert.IPAddresses)
+	}
+	if s.tlsCfg != nil && s.tlsCfg.ServerName != "" {
+		s.emitf("#   TLSClientOptions.ServerName=%q", s.tlsCfg.ServerName)
+	}
+	s.emitf("#   suggested: dial the hostname listed in the cert SANs,")
+	s.emitf("#              or set TLSClientOptions.ServerName to match.")
+}
+
+func (s *traceSession) diagnoseTLSGeneric(err error) {
+	s.emitf("#   axis: unclassified")
+	s.emitf("#   error: %v", err)
+	if s.tlsCfg != nil {
+		minV, maxV := configuredVersionRange(s.tlsCfg)
+		s.emitf("#   configured: MinVersion=TLS %s, MaxVersion=TLS %s",
+			tlsVersionName(minV), tlsVersionName(maxV))
+		if s.tlsCfg.InsecureSkipVerify {
+			s.emitf("#   note: TLSClientOptions.InsecureSkipVerify=true — yet")
+			s.emitf("#         a TLS error still surfaced. Something deeper than")
+			s.emitf("#         certificate verification is failing.")
+		}
+	}
+}
+
+// ---------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------
+
+// configuredVersionRange returns the effective (Min, Max) TLS
+// version range a client config negotiates. Zero values in the
+// stdlib config mean "use Go default", which is TLS 1.2 .. 1.3 in
+// modern Go. We materialize those defaults for display.
+func configuredVersionRange(cfg *tls.Config) (uint16, uint16) {
+	const (
+		defaultMin = tls.VersionTLS12
+		defaultMax = tls.VersionTLS13
+	)
+	if cfg == nil {
+		return defaultMin, defaultMax
+	}
+	minV := cfg.MinVersion
+	if minV == 0 {
+		minV = defaultMin
+	}
+	maxV := cfg.MaxVersion
+	if maxV == 0 {
+		maxV = defaultMax
+	}
+	return minV, maxV
+}
+
+func cipherSuiteNames(ids []uint16) []string {
+	out := make([]string, 0, len(ids))
+	for _, id := range ids {
+		out = append(out, tls.CipherSuiteName(id))
+	}
+	return out
+}
+
+// certInvalidReasonName renders an x509.InvalidReason as a short
+// human-readable label. The stdlib does not expose a String()
+// method for these, so we keep a small table.
+//
+// Anything outside the listed cases falls through to the numeric default.
+func certInvalidReasonName(r x509.InvalidReason) string {
+	switch r {
+	case x509.NotAuthorizedToSign:
+		return "not-authorized-to-sign"
+	case x509.Expired:
+		return "expired"
+	case x509.CANotAuthorizedForThisName:
+		return "ca-not-authorized-for-this-name"
+	case x509.TooManyIntermediates:
+		return "too-many-intermediates"
+	case x509.IncompatibleUsage:
+		return "incompatible-usage"
+	case x509.NameMismatch:
+		return "name-mismatch"
+	case x509.NameConstraintsWithoutSANs:
+		return "name-constraints-without-sans"
+	case x509.TooManyConstraints:
+		return "too-many-constraints"
+	case x509.CANotAuthorizedForExtKeyUsage:
+		return "ca-not-authorized-for-ext-key-usage"
+	default:
+		return fmt.Sprintf("invalid-reason-%d", r)
+	}
+}
diff --git a/vendor/github.com/go-openapi/runtime/client/internal/request/request.go b/vendor/github.com/go-openapi/runtime/client/internal/request/request.go
new file mode 100644
index 0000000000..a736c578d7
--- /dev/null
+++ b/vendor/github.com/go-openapi/runtime/client/internal/request/request.go
@@ -0,0 +1,941 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package request
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"log"
+	"mime"
+	"mime/multipart"
+	"net/http"
+	"net/textproto"
+	"net/url"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/strfmt"
+)
+
+var _ runtime.ClientRequest = new(Request) // ensure compliance to the interface
+
+// Request represents a swagger client request.
+// It binds parameters to a HTTP request.
+//
+// The main purpose of this struct is to hide the machinery of adding OpenAPI v2 parameters to a transport request.
+//
+// A generated client only implements what is necessary to turn a parameter into a valid value for these methods.
+//
+// There is no parameter validation here, it is assumed to be used after a spec has been validated.
+//
+// # Request binding
+//
+// The binding of parameters is carried out by method [Request.BuildHTTPContext].
+//
+// It analyzes parameters, which may come in different flavors:
+//
+//   - a file or multipart form containing a file
+//   - a body which is a [io.Reader]
+//   - a buffered body (regular schema body, including urlencoded form)
+//
+// In all cases, we may also have query or path parameters encoded in the URL, or header parameters.
+//
+// The result is a [http.Request], with the following properties:
+//
+//   - file, multipart form or [io.Reader] body: a streaming request with an attached go routine that consumes the [io.Reader].
+//   - buffered body: a simple request
+//
+// The caller passes the parent [context.Context] to [Request.BuildHTTPContext] and receives back a cancel
+// function to release the resources held by the derived request context once the response is consumed.
+//
+// # Authentication
+//
+// Authentication is built in the request by using a [runtime.ClientAuthInfoWriter].
+// This helper may need to inspect the body of the request before sending authentication info.
+// To cover that case, streaming bodies use a copy of the body [io.Reader] for the [runtime.ClientAuthInfoWriter]
+// to consume if it wants to.
+//
+// # Content negotiation
+//
+// The [Request] detects `multipart/form-data` to switch to streamed request.
+//
+// `application/x-www-form-urlencoded` is also honored, even for file parameters, which are not streamed in this case.
+// File parameters default behavior is `multipart/form-data`.
+//
+// The natural way to define the `Content-Type` header is to use the `contentType` parameter to switch to the map of
+// available body producers.
+//
+// For buffered requests, this setting override any `Content-Type` header possibly set by calling [Request.SetHeaderParam].
+//
+// For streamed requests, users may want more flexibility, as we enter custom territory, with use-cases not supported by OpenAPI v2.
+//
+// The `Content-Type` header of a streamed request is defined using the following sequence:
+//
+//  1. if the caller sets an explicit value already in header — the user set it via
+//     [Request.SetHeaderParam] during WriteToRequest, and we treat that as an intentional escape hatch
+//  2. use payload's [runtime.ContentTyper] declaration (in this case, the produced payload knows its content type)
+//  3. use `application/octet-stream` if it is available in the registered producers
+//  4. otherwise set the picker's mediaType
+//
+// For multi-part requests, the content type of each part is auto-detected using the following sequence:
+//
+//  1. use [runtime.ContentTyper] declaration (in this case, the file payload knows its content type)
+//  2. use [http.DetectContentType] on the first 512 bytes of the file
+//
+// # Concurrency
+//
+// A [Request] is a disposable object that is NOT intended to be reused or called concurrently.
+//
+// # Future evolutions
+//
+// There might be other similar structs that convert to other transports.
+type Request struct {
+	pathPattern string
+	method      string
+	writer      runtime.ClientRequestWriter
+
+	pathParams map[string]string
+	header     http.Header
+	query      url.Values
+	formFields url.Values
+	fileFields map[string][]runtime.NamedReadCloser
+	payload    any
+	// consumes carries the operation's full ConsumesMediaTypes list so
+	// that buildHTTP — which runs after the writer populates the payload
+	// — can apply payload-aware fallback rules (see streamFallbackMime).
+	//
+	// This is set by Runtime.createHttpRequest.
+	consumes []string
+	timeout  time.Duration
+	buf      *bytes.Buffer
+
+	getBody func(r *Request) []byte
+}
+
+// New creates a new http client [Request] to handle OpenAPI v2 parameters.
+func New(method, pathPattern string, writer runtime.ClientRequestWriter) *Request {
+	return &Request{
+		pathPattern: pathPattern,
+		method:      method,
+		writer:      writer,
+		header:      make(http.Header),
+		query:       make(url.Values),
+		timeout:     0,
+		getBody:     getRequestBuffer,
+	}
+}
+
+// GetMethod yields the method being used.
+func (r *Request) GetMethod() string {
+	return r.method
+}
+
+// GetPath yields the URL path being used.
+func (r *Request) GetPath() string {
+	pth := r.pathPattern
+	for k, v := range r.pathParams {
+		pth = strings.ReplaceAll(pth, "{"+k+"}", v)
+	}
+
+	return pth
+}
+
+// GetBody returns the request body, if any.
+//
+// For streaming requests, this is a copy of the original [io.Reader].
+func (r *Request) GetBody() []byte {
+	return r.getBody(r)
+}
+
+// SetHeaderParam adds a header parameter to the request.
+//
+// The header key is always canonicalized.
+//
+//   - when there is only 1 value provided, it will set it.
+//   - when there are several values provided, it will add all of those (no overriding).
+func (r *Request) SetHeaderParam(name string, values ...string) error {
+	if r.header == nil {
+		r.header = make(http.Header)
+	}
+	r.header[http.CanonicalHeaderKey(name)] = values
+
+	return nil
+}
+
+// GetHeaderParams returns all headers currently set for the request.
+func (r *Request) GetHeaderParams() http.Header {
+	return r.header
+}
+
+// SetQueryParam adds a query parameter to the request.
+//
+//   - when there is only 1 value provided, it will set it.
+//   - when there are several values provided, it will add all of those (no overriding).
+func (r *Request) SetQueryParam(name string, values ...string) error {
+	if r.query == nil {
+		r.query = make(url.Values)
+	}
+	r.query[name] = values
+
+	return nil
+}
+
+// GetQueryParams returns a copy of all query params currently set for the request.
+func (r *Request) GetQueryParams() url.Values {
+	result := make(url.Values, len(r.query))
+	for key, values := range r.query {
+		result[key] = append([]string{}, values...)
+	}
+
+	return result
+}
+
+// SetFormParam adds a form param to the request.
+//
+//   - when there is only 1 value provided, it will set it.
+//   - when there are several values provided, it will add all of those (no overriding).
+func (r *Request) SetFormParam(name string, values ...string) error {
+	if r.formFields == nil {
+		r.formFields = make(url.Values)
+	}
+	r.formFields[name] = values
+
+	return nil
+}
+
+// SetPathParam adds a path param to the request.
+func (r *Request) SetPathParam(name string, value string) error {
+	if r.pathParams == nil {
+		r.pathParams = make(map[string]string)
+	}
+
+	r.pathParams[name] = value
+
+	return nil
+}
+
+// SetFileParam adds a file parameter to the request.
+//
+// Files must implement [runtime.NamedReadCloser].
+//
+// [runtime.File] is proposed as the default concrete implementation.
+func (r *Request) SetFileParam(name string, files ...runtime.NamedReadCloser) error {
+	for _, file := range files {
+		if actualFile, ok := file.(*os.File); ok {
+			fi, err := os.Stat(actualFile.Name())
+			if err != nil {
+				return err
+			}
+
+			if fi.IsDir() {
+				return fmt.Errorf("%q is a directory, only files are supported", file.Name())
+			}
+		}
+	}
+
+	if r.fileFields == nil {
+		r.fileFields = make(map[string][]runtime.NamedReadCloser)
+	}
+
+	if r.formFields == nil {
+		r.formFields = make(url.Values)
+	}
+
+	r.fileFields[name] = files
+
+	return nil
+}
+
+// GetFileParam yields all file parameters.
+func (r *Request) GetFileParam() map[string][]runtime.NamedReadCloser {
+	return r.fileFields
+}
+
+// SetBodyParam sets a body parameter on the request.
+//
+// This does not yet serialize the object: actual serialization happens as late as possible.
+func (r *Request) SetBodyParam(payload any) error {
+	r.payload = payload
+
+	return nil
+}
+
+// GetBodyParam returns the body payload.
+func (r *Request) GetBodyParam() any {
+	return r.payload
+}
+
+// GetTimeout sets the timeout for a request.
+func (r *Request) GetTimeout() time.Duration {
+	return r.timeout
+}
+
+// SetTimeout sets the timeout for a request.
+func (r *Request) SetTimeout(timeout time.Duration) error {
+	r.timeout = timeout
+
+	return nil
+}
+
+// SetConsumes sets the list of registered consumed content for a request.
+func (r *Request) SetConsumes(consumers []string) {
+	r.consumes = consumers
+}
+
+// BuildHTTPContext binds the request parameters and returns a ready-to-send [http.Request].
+//
+// Dispatch picks one of two end-to-end builders based on whether:
+//
+//   - the body source is a stream (multipart pipe or stream payload)
+//   - or a buffer (urlencoded form, producer output, or no body)
+//
+// It starts by writing the request, then proceed with adding authentication,
+// then finally assembling URL or header parameters.
+//
+// The split mirrors the auth question: streaming bodies require a lazy body-copy closure during [AuthenticateRequest],
+// whereas buffered bodies do not.
+//
+// The returned [http.Request] carries a context derived from parentCtx that:
+//
+//   - inherits any deadline or cancellation already set on parentCtx;
+//   - additionally honors the per-request timeout set via [Request.SetTimeout]
+//     (the [runtime.ClientRequestWriter] may override the runtime default during
+//     WriteToRequest, which is why the derivation happens here rather than
+//     at the call site).
+//
+// The returned cancel must be invoked by the caller (typically deferred)
+// once the response has been fully read; otherwise resources held by the
+// derived context — including any timeout timer — are leaked.
+//
+// On error the cancel is invoked internally and a no-op cancel is returned,
+// so callers can defer cancel unconditionally.
+func (r *Request) BuildHTTPContext(parentCtx context.Context, mediaType, basePath string,
+	producers map[string]runtime.Producer, registry strfmt.Registry, auth runtime.ClientAuthInfoWriter,
+) (*http.Request, context.CancelFunc, error) {
+	if err := r.writer.WriteToRequest(r, registry); err != nil {
+		return nil, noop, err
+	}
+
+	ctx, cancel := deriveRequestContext(parentCtx, r.timeout)
+	r.buf = bytes.NewBuffer(nil)
+
+	var (
+		httpReq *http.Request
+		err     error
+	)
+	if r.usesStreamingBody(mediaType) {
+		httpReq, err = r.buildStreamingRequest(ctx, mediaType, basePath, producers, registry, auth)
+	} else {
+		httpReq, err = r.buildBufferedRequest(ctx, mediaType, basePath, producers, registry, auth)
+	}
+	if err != nil {
+		cancel()
+		return nil, noop, err
+	}
+	return httpReq, cancel, nil
+}
+
+func noop() {}
+
+// deriveRequestContext returns a child of parent bounded by timeout.
+// If timeout == 0 the child is only canceled when the caller invokes
+// cancel; any deadline already on parent is preserved. If timeout > 0
+// the child uses the shortest of timeout and parent's existing deadline.
+func deriveRequestContext(parent context.Context, timeout time.Duration) (context.Context, context.CancelFunc) {
+	if timeout == 0 {
+		return context.WithCancel(parent)
+	}
+	return context.WithTimeout(parent, timeout)
+}
+
+// usesStreamingBody reports whether the request body must be assembled
+// as a stream (an io.Pipe for multipart, or the payload's own reader
+// for stream payloads).
+//
+// The complementary case is a fully buffered body in r.buf — urlencoded form, producer output, or no body at all.
+func (r *Request) usesStreamingBody(mediaType string) bool {
+	if (len(r.formFields) > 0 || len(r.fileFields) > 0) && r.isMultipart(mediaType) {
+		return true
+	}
+
+	if r.payload != nil {
+		if _, ok := r.payload.(io.Reader); ok {
+			return true
+		}
+	}
+
+	return false
+}
+
+func (r *Request) isMultipart(mediaType string) bool {
+	// Strip media-type parameters before comparing: callers may legally
+	// pass `multipart/form-data; boundary=…` or
+	// `application/x-www-form-urlencoded; charset=utf-8` per RFC 7231,
+	// and a bare-string compare would route those to the wrong flow.
+	//
+	// mime.ParseMediaType lowercases the type/subtype and is
+	// case-insensitive on input, so plain == against our (lowercase)
+	// constants is sufficient on the happy path.
+	base, _, err := mime.ParseMediaType(mediaType)
+	if err != nil {
+		// Malformed mediaType: only the file-presence shortcut can
+		// fire — by definition we cannot recognize either canonical
+		// form mime in unparseable input.
+		return len(r.fileFields) > 0
+	}
+
+	// An explicit application/x-www-form-urlencoded choice is honored even when
+	// file fields are present: the spec allows files to travel as URL-encoded
+	// form values, although it does not stream and is discouraged. Without this
+	// short-circuit, picking urlencoded with files would silently fall back to
+	// multipart and emit an inconsistent Content-Type.
+	if base == runtime.URLencodedFormMime {
+		return false
+	}
+
+	if len(r.fileFields) > 0 {
+		return true
+	}
+
+	return base == runtime.MultipartFormMime
+}
+
+// buildBufferedRequest assembles a request whose body is fully
+// buffered in r.buf before AuthenticateRequest runs — urlencoded form,
+// producer-serialized payload, or no body.
+//
+// Auth is trivial in this flow because the buffer is already populated when the auth helper
+// asks for the body via r.GetBody().
+func (r *Request) buildBufferedRequest(ctx context.Context, mediaType, basePath string,
+	producers map[string]runtime.Producer, registry strfmt.Registry, auth runtime.ClientAuthInfoWriter,
+) (*http.Request, error) {
+	var body io.Reader
+	var err error
+
+	switch {
+	case len(r.formFields) > 0 || len(r.fileFields) > 0:
+		body, err = r.writeURLEncodedBody(mediaType)
+	case r.payload != nil:
+		body, err = r.writeNonStreamPayload(mediaType, producers)
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	if runtime.CanHaveBody(r.method) && body != nil && r.header.Get(runtime.HeaderContentType) == "" {
+		r.header.Set(runtime.HeaderContentType, mediaType)
+	}
+
+	if auth != nil {
+		if err := auth.AuthenticateRequest(r, registry); err != nil {
+			return nil, err
+		}
+	}
+
+	return r.assembleRequest(ctx, basePath, body)
+}
+
+// buildStreamingRequest assembles a request whose body is a stream —
+// either an io.Pipe filled by the multipart goroutine, or the
+// payload's own io.Reader.
+//
+// AuthenticateRequest consumes the body lazily through the getBody closure installed by
+// applyAuthWithBodyCopy, which buffers the stream into r.buf so the http.Request can use the buffered copy.
+//
+// On any error path before the http.Request takes ownership of body, we close the body to release
+// the underlying resource.
+//
+// For multipart this unblocks the spawned writer goroutine
+// (it would otherwise park forever on pw.Write with no reader).
+//
+// For stream payloads it closes the user-provided io.ReadCloser.
+func (r *Request) buildStreamingRequest(ctx context.Context, mediaType, basePath string,
+	producers map[string]runtime.Producer, registry strfmt.Registry, auth runtime.ClientAuthInfoWriter,
+) (req *http.Request, retErr error) {
+	var body io.Reader
+	if len(r.formFields) > 0 || len(r.fileFields) > 0 {
+		body = r.writeMultipartBody(ctx, mediaType)
+	} else {
+		body = r.writeStreamPayload(mediaType, producers)
+	}
+
+	defer func() {
+		if retErr == nil {
+			return
+		}
+		if c, ok := body.(io.Closer); ok {
+			_ = c.Close()
+		}
+	}()
+
+	if runtime.CanHaveBody(r.method) && body != nil && r.header.Get(runtime.HeaderContentType) == "" {
+		r.header.Set(runtime.HeaderContentType, mediaType)
+	}
+
+	body, err := r.applyAuthWithBodyCopy(auth, body, registry)
+	if err != nil {
+		return nil, err
+	}
+
+	return r.assembleRequest(ctx, basePath, body)
+}
+
+// assembleRequest is the shared tail of both flows: build the URL
+// path, create the http.Request, merge static query parameters, and
+// finalize headers/query.
+func (r *Request) assembleRequest(ctx context.Context, basePath string, body io.Reader) (*http.Request, error) {
+	urlPath, staticQueryParams, err := r.resolveURLPath(basePath)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequestWithContext(ctx, r.method, urlPath, body)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := r.mergeStaticQuery(staticQueryParams); err != nil {
+		return nil, err
+	}
+
+	req.URL.RawQuery = r.query.Encode()
+	req.Header = r.header
+
+	return req, nil
+}
+
+// resolveURLPath builds the final url path string and returns the static
+// query parameters extracted from basePath and r.pathPattern.
+//
+// Static query parameters from the path pattern take precedence over those
+// from the base path; merging with r.query is the caller's responsibility
+// (see [request.mergeStaticQuery]).
+//
+// The path is assembled from basePath + pathPattern with path-param
+// substitution and trailing-slash preservation when the original
+// pathPattern carried one.
+func (r *Request) resolveURLPath(basePath string) (string, url.Values, error) {
+	basePathURL, err := url.Parse(basePath)
+	if err != nil {
+		return "", nil, err
+	}
+	staticQueryParams := basePathURL.Query()
+
+	pathPatternURL, err := url.Parse(r.pathPattern)
+	if err != nil {
+		return "", nil, err
+	}
+	for name, values := range pathPatternURL.Query() {
+		if _, present := staticQueryParams[name]; present {
+			staticQueryParams.Del(name)
+		}
+		for _, value := range values {
+			staticQueryParams.Add(name, value)
+		}
+	}
+
+	// path.Join strips trailing slashes; reinstate one whenever the
+	// pathPattern carried it, including the bare-root case ("/" under a
+	// non-empty basePath, which path.Join would collapse to "/basepath").
+	// The HasSuffix check on urlPath keeps the rewrite idempotent and
+	// avoids producing "//" when basePath is "/" or empty.
+	reinstateSlash := strings.HasSuffix(pathPatternURL.Path, "/")
+
+	urlPath := path.Join(basePathURL.Path, pathPatternURL.Path)
+	for k, v := range r.pathParams {
+		urlPath = strings.ReplaceAll(urlPath, "{"+k+"}", url.PathEscape(v))
+	}
+	if reinstateSlash && !strings.HasSuffix(urlPath, "/") {
+		urlPath += "/"
+	}
+
+	return urlPath, staticQueryParams, nil
+}
+
+// applyAuthWithBodyCopy runs auth.AuthenticateRequest for the
+// streaming flow, where the http.Request body is a pipe or a payload
+// reader rather than r.buf. If AuthenticateRequest asks for the body
+// via r.GetBody(), the lazy closure copies the stream into r.buf on
+// demand and reassigns body to r.buf so the post-auth source passed
+// to http.NewRequestWithContext is the buffered copy.
+//
+// The closure is registered lazily because there is no way to know
+// ahead of time whether AuthenticateRequest will read the body.
+//
+// On error precedence: a copy error is reported in preference to the
+// AuthenticateRequest error, because a mis-read body may have
+// interfered with auth.
+//
+// No-op when auth is nil; returns body unchanged.
+func (r *Request) applyAuthWithBodyCopy(auth runtime.ClientAuthInfoWriter, body io.Reader, registry strfmt.Registry) (io.Reader, error) {
+	if auth == nil {
+		return body, nil
+	}
+
+	var copyErr error
+	var copied bool
+	r.getBody = func(r *Request) []byte {
+		if copied {
+			return getRequestBuffer(r)
+		}
+
+		defer func() {
+			copied = true
+		}()
+
+		if _, copyErr = io.Copy(r.buf, body); copyErr != nil {
+			return nil
+		}
+
+		if closer, ok := body.(io.ReadCloser); ok {
+			if copyErr = closer.Close(); copyErr != nil {
+				return nil
+			}
+		}
+
+		body = r.buf
+		return getRequestBuffer(r)
+	}
+
+	authErr := auth.AuthenticateRequest(r, registry)
+
+	// On error we return body alongside the error so the caller's
+	// cleanup defer (in buildStreamingRequest) can close the
+	// underlying pipe/stream. Caller treats body as ignorable when
+	// err != nil per Go convention; the defer reads it via closure.
+	if copyErr != nil {
+		return body, fmt.Errorf("error copying the request body: %w", copyErr)
+	}
+
+	if authErr != nil {
+		return body, authErr
+	}
+
+	return body, nil
+}
+
+// mergeStaticQuery overlays staticQuery onto r.query. On conflict r.query
+// wins — the parameters set by the client take precedence over the ones
+// extracted from basePath / pathPattern.
+func (r *Request) mergeStaticQuery(staticQuery url.Values) error {
+	originalParams := r.GetQueryParams()
+	for k, v := range staticQuery {
+		if _, present := originalParams[k]; present {
+			continue
+		}
+		if err := r.SetQueryParam(k, v...); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// writeURLEncodedBody serializes form fields (and any file fields, per
+// Swagger 2.0 fallback semantics) into r.buf as
+// application/x-www-form-urlencoded. Sets Content-Type to mediaType and
+// returns r.buf as the body source.
+//
+// Per Swagger 2.0, file form parameters can be sent under
+// application/x-www-form-urlencoded by including the file content as a
+// regular form-field value. The whole form is then percent-encoded as
+// usual. This buffers the entire payload and does not preserve a
+// per-file Content-Type — multipart/form-data is preferred when both
+// are advertised by the operation.
+func (r *Request) writeURLEncodedBody(mediaType string) (io.Reader, error) {
+	r.header.Set(runtime.HeaderContentType, mediaType)
+	values := url.Values{}
+	for k, vs := range r.formFields {
+		values[k] = append(values[k], vs...)
+	}
+	for fn, ff := range r.fileFields {
+		for _, fi := range ff {
+			data, ferr := io.ReadAll(fi)
+			if cerr := fi.Close(); cerr != nil && ferr == nil {
+				ferr = cerr
+			}
+			if ferr != nil {
+				return nil, ferr
+			}
+			values.Add(fn, string(data))
+		}
+	}
+	r.buf.WriteString(values.Encode())
+	return r.buf, nil
+}
+
+// writeMultipartBody assembles a multipart/form-data body via an
+// io.Pipe. A goroutine streams form fields and files into the pipe
+// writer; the pipe reader is returned as the body. Sets Content-Type to
+// the multipart media type with the writer's boundary parameter.
+//
+// The goroutine owns the pipe writer's lifecycle: it closes the
+// multipart writer (flushing the closing boundary) and the pipe writer
+// when it finishes or hits an error.
+func (r *Request) writeMultipartBody(ctx context.Context, mediaType string) io.Reader {
+	pr, pw := io.Pipe()
+	mp := multipart.NewWriter(pw)
+	r.header.Set(runtime.HeaderContentType, mangleContentType(mediaType, mp.Boundary()))
+
+	go r.streamMultipartParts(ctx, mp, pw)
+
+	return pr
+}
+
+// streamMultipartParts writes form fields then file fields to mp,
+// closing mp and pw when done.
+//
+// Errors are reported by closing pw with the error so the consumer of pr observes them on its next Read.
+//
+// Context cancellation is observed at iteration boundaries (between
+// fields and between files) and during file copy via a context-aware
+// reader. When ctx is canceled the pipe writer is closed with ctx.Err()
+// so the body consumer surfaces the cancellation as the read error.
+func (r *Request) streamMultipartParts(ctx context.Context, mp *multipart.Writer, pw *io.PipeWriter) {
+	defer func() {
+		mp.Close()
+		pw.Close()
+	}()
+
+	for fn, v := range r.formFields {
+		for _, vi := range v {
+			if err := ctx.Err(); err != nil {
+				_ = pw.CloseWithError(err)
+				return
+			}
+			if err := mp.WriteField(fn, vi); err != nil {
+				logClose(err, pw)
+				return
+			}
+		}
+	}
+
+	defer func() {
+		for _, ff := range r.fileFields {
+			for _, ffi := range ff {
+				ffi.Close()
+			}
+		}
+	}()
+
+	for fn, f := range r.fileFields {
+		for _, fi := range f {
+			if err := ctx.Err(); err != nil {
+				_ = pw.CloseWithError(err)
+				return
+			}
+
+			var fileContentType string
+			if p, ok := fi.(runtime.ContentTyper); ok {
+				fileContentType = p.ContentType()
+			} else {
+				// Need to read the data so that we can detect the content type
+				const contentTypeBufferSize = 512
+				buf := make([]byte, contentTypeBufferSize)
+				size, err := fi.Read(buf)
+				if err != nil && !errors.Is(err, io.EOF) {
+					logClose(err, pw)
+					return
+				}
+				fileContentType = http.DetectContentType(buf)
+				fi = runtime.NamedReader(fi.Name(), io.MultiReader(bytes.NewReader(buf[:size]), fi))
+			}
+
+			// Create the MIME headers for the new part
+			h := make(textproto.MIMEHeader)
+			h.Set("Content-Disposition",
+				fmt.Sprintf(`form-data; name="%s"; filename="%s"`,
+					escapeQuotes(fn), escapeQuotes(filepath.Base(fi.Name()))))
+			h.Set("Content-Type", fileContentType)
+
+			wrtr, err := mp.CreatePart(h)
+			if err != nil {
+				logClose(err, pw)
+				return
+			}
+			if _, err := io.Copy(wrtr, &ctxReader{ctx: ctx, r: fi}); err != nil {
+				logClose(err, pw)
+				return
+			}
+		}
+	}
+}
+
+// ctxReader wraps an [io.Reader] with a context check on each Read. Once
+// ctx is done, subsequent Reads return ctx.Err() instead of delegating
+// to the underlying reader. It does not preempt a Read already in flight
+// — that is the source's responsibility (e.g. *os.File honors Close from
+// another goroutine, network sources honor SetDeadline).
+type ctxReader struct {
+	ctx context.Context //nolint:containedctx  // io.Reader's Read method has no ctx parameter, so the wrapper must carry it on the struct
+	r   io.Reader
+}
+
+func (cr *ctxReader) Read(p []byte) (int, error) {
+	if err := cr.ctx.Err(); err != nil {
+		return 0, err
+	}
+	return cr.r.Read(p)
+}
+
+// writeStreamPayload handles a stream payload (io.Reader /
+// io.ReadCloser). The bytes flow through verbatim — no producer is
+// invoked. The wire Content-Type is resolved via setStreamContentType
+// (priority: existing header, payload's ContentTyper,
+// streamFallbackMime, mediaType).
+//
+// Caller must ensure r.payload satisfies io.Reader (see
+// [request.usesStreamingBody]).
+func (r *Request) writeStreamPayload(mediaType string, producers map[string]runtime.Producer) io.Reader {
+	setStreamContentType(r.header, r.payload, mediaType, r.consumes, producers)
+	if rdr, ok := r.payload.(io.ReadCloser); ok {
+		return rdr
+	}
+
+	rdr, ok := r.payload.(io.Reader)
+	if !ok {
+		panic("internal error: payload expected to be an io.Reader") // guaranteed by earlier checks
+	}
+
+	return rdr
+}
+
+// writeNonStreamPayload runs the producer registered for mediaType
+// against r.payload, writing into r.buf. The Content-Type header
+// reflects the picker.
+//
+// SetHeaderParam("Content-Type", …) is intentionally NOT honored on
+// the producer path because the producer is dispatched off mediaType —
+// the wire header would otherwise misrepresent the body.
+//
+// The same reasoning applies to the form/multipart branch.
+func (r *Request) writeNonStreamPayload(mediaType string, producers map[string]runtime.Producer) (io.Reader, error) {
+	r.header.Set(runtime.HeaderContentType, mediaType)
+	producer := producers[mediaType]
+	if err := producer.Produce(r.buf, r.payload); err != nil {
+		return nil, err
+	}
+	return r.buf, nil
+}
+
+var quoter = strings.NewReplacer(
+	"\\", "\\\\",
+	`"`, "\\\"",
+	"\r", "_",
+	"\n", "_",
+)
+
+// escapeQuotes escapes backslash and double-quote for embedding in a
+// quoted-string Content-Disposition parameter value, and rewrites
+// CR / LF to '_' to prevent header-injection through attacker-influenced
+// field names or filenames.
+//
+// RFC 7578 §4.2 limits parameter values to printable characters; this
+// is the conservative subset relevant to security (control characters
+// that would split the header line into a forged header or part).
+// Mirrors the known stdlib gap golang/go#19038.
+func escapeQuotes(s string) string {
+	return quoter.Replace(s)
+}
+
+// setStreamContentType resolves and writes the wire Content-Type for a
+// stream payload (io.Reader / io.ReadCloser). Priority:
+//
+//  1. an explicit value already in header — the user set it via
+//     SetHeaderParam during [ClientRequestWriter.WriteToRequest], and we treat that as an
+//     intentional escape hatch;
+//  2. payload's [runtime.ContentTyper] declaration;
+//  3. [streamFallbackMime] (Stage-2 octet-stream upgrade);
+//  4. the picker's mediaType (passed in as the chain's terminal
+//     fallback).
+//
+// Does not apply to non-stream payloads or to form/multipart bodies —
+// see the comment above the call site in [request.buildHTTP].
+func setStreamContentType(
+	header http.Header,
+	payload any,
+	mediaType string,
+	candidates []string,
+	producers map[string]runtime.Producer,
+) {
+	if header.Get(runtime.HeaderContentType) != "" {
+		return
+	}
+	fallback := streamFallbackMime(mediaType, candidates, producers)
+	header.Set(runtime.HeaderContentType, payloadContentType(payload, fallback))
+}
+
+// payloadContentType returns the payload's declared content type when
+// it implements [runtime.ContentTyper] with a non-empty result, and
+// fallback otherwise. Mirrors the per-file convention already used for
+// multipart upload parts (see [request.buildHTTP] file-fields branch).
+func payloadContentType(payload any, fallback string) string {
+	if t, ok := payload.(runtime.ContentTyper); ok {
+		if ct := t.ContentType(); ct != "" {
+			return ct
+		}
+	}
+
+	return fallback
+}
+
+// streamFallbackMime selects a wire content-type for a stream payload
+// (io.Reader / io.ReadCloser) that has neither implemented
+// `ContentType() string` nor declared an explicit value.
+//
+// The picker (Stage 1) ran without seeing the payload, so its choice
+// may be wildly wrong for raw bytes — e.g. picking application/json
+// for a payload that is just a stream of opaque data. When the
+// candidate consumes list also offers application/octet-stream and
+// the runtime has an octet-stream producer registered, that's a
+// safer wire type than the picker's choice: it advertises "raw bytes"
+// rather than making a structural claim about the body.
+//
+// If octet-stream is unavailable in either the candidate list or the
+// producer set, the picker's choice is preserved. The wire header
+// then continues to misrepresent the body — but no correct
+// alternative exists and we cannot infer one without more
+// information from the caller.
+func streamFallbackMime(picked string, candidates []string, producers map[string]runtime.Producer) string {
+	if strings.EqualFold(picked, runtime.DefaultMime) {
+		return picked
+	}
+
+	for _, c := range candidates {
+		if strings.EqualFold(c, runtime.DefaultMime) {
+			if _, ok := producers[runtime.DefaultMime]; ok {
+				return runtime.DefaultMime
+			}
+		}
+	}
+
+	return picked
+}
+
+func getRequestBuffer(r *Request) []byte {
+	if r.buf == nil {
+		return nil
+	}
+	return r.buf.Bytes()
+}
+
+func logClose(err error, pw *io.PipeWriter) {
+	log.Println(err)
+	closeErr := pw.CloseWithError(err)
+	if closeErr != nil {
+		log.Println(closeErr)
+	}
+}
+
+func mangleContentType(mediaType, boundary string) string {
+	_ = mediaType // reserved for future enhancement: honor caller-provided media type
+	// Proposal for enhancement: honor caller's boundary if specified
+	return "multipart/form-data; boundary=" + boundary
+}
diff --git a/vendor/github.com/go-openapi/runtime/client/keepalive.go b/vendor/github.com/go-openapi/runtime/client/keepalive.go
index 3bac5e272c..6b6097d206 100644
--- a/vendor/github.com/go-openapi/runtime/client/keepalive.go
+++ b/vendor/github.com/go-openapi/runtime/client/keepalive.go
@@ -34,20 +34,20 @@ func (k *keepAliveTransport) RoundTrip(r *http.Request) (*http.Response, error)
 
 type drainingReadCloser struct {
 	rdr     io.ReadCloser
-	seenEOF uint32
+	seenEOF atomic.Uint32
 }
 
 func (d *drainingReadCloser) Read(p []byte) (n int, err error) {
 	n, err = d.rdr.Read(p)
 	if err == io.EOF || n == 0 {
-		atomic.StoreUint32(&d.seenEOF, 1)
+		d.seenEOF.Store(1)
 	}
 	return
 }
 
 func (d *drainingReadCloser) Close() error {
 	// drain buffer
-	if atomic.LoadUint32(&d.seenEOF) != 1 {
+	if d.seenEOF.Load() != 1 {
 		// If the reader side (a HTTP server) is misbehaving, it still may send
 		// some bytes, but the closer ignores them to keep the underling
 		// connection open.
diff --git a/vendor/github.com/go-openapi/runtime/client/opentelemetry.go b/vendor/github.com/go-openapi/runtime/client/opentelemetry.go
index 5054878c06..d11f791972 100644
--- a/vendor/github.com/go-openapi/runtime/client/opentelemetry.go
+++ b/vendor/github.com/go-openapi/runtime/client/opentelemetry.go
@@ -8,14 +8,15 @@ import (
 	"net/http"
 	"strings"
 
-	"github.com/go-openapi/runtime"
-	"github.com/go-openapi/strfmt"
 	"go.opentelemetry.io/otel"
 	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/codes"
 	"go.opentelemetry.io/otel/propagation"
 	semconv "go.opentelemetry.io/otel/semconv/v1.37.0"
 	"go.opentelemetry.io/otel/trace"
+
+	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/strfmt"
 )
 
 const (
@@ -23,6 +24,47 @@ const (
 	tracerName             = "go-openapi"
 )
 
+// WithOpenTelemetry adds opentelemetry support to the provided runtime.
+// A new client span is created for each request.
+// If the context of the client operation does not contain an active span, no span is created.
+// The provided opts are applied to each spans - for example to add global tags.
+func (r *Runtime) WithOpenTelemetry(opts ...OpenTelemetryOpt) runtime.ClientTransport {
+	return newOpenTelemetryTransport(r, r.Host, opts)
+}
+
+// WithOpenTracing adds opentracing support to the provided runtime.
+// A new client span is created for each request.
+// If the context of the client operation does not contain an active span, no span is created.
+// The provided opts are applied to each spans - for example to add global tags.
+//
+// Deprecated: use [WithOpenTelemetry] instead, as opentracing is now archived and superseded by opentelemetry.
+//
+// # Deprecation notice
+//
+// The [Runtime.WithOpenTracing] method has been deprecated in favor of [Runtime.WithOpenTelemetry].
+//
+// The method is still around so programs calling it will still build. However, it will return
+// an opentelemetry transport.
+//
+// If you have a strict requirement on using opentracing, you may still do so by importing
+// module [github.com/go-openapi/runtime/client-[middleware]/opentracing] and using
+// [github.com/go-openapi/runtime/client-[middleware]/opentracing.WithOpenTracing] with your
+// usual opentracing options and opentracing-enabled transport.
+//
+// Passed options are ignored unless they are of type [OpenTelemetryOpt].
+func (r *Runtime) WithOpenTracing(opts ...any) runtime.ClientTransport {
+	otelOpts := make([]OpenTelemetryOpt, 0, len(opts))
+	for _, o := range opts {
+		otelOpt, ok := o.(OpenTelemetryOpt)
+		if !ok {
+			continue
+		}
+		otelOpts = append(otelOpts, otelOpt)
+	}
+
+	return r.WithOpenTelemetry(otelOpts...)
+}
+
 type config struct {
 	Tracer            trace.Tracer
 	Propagator        propagation.TextMapPropagator
diff --git a/vendor/github.com/go-openapi/runtime/client/request.go b/vendor/github.com/go-openapi/runtime/client/request.go
deleted file mode 100644
index f16ee487ba..0000000000
--- a/vendor/github.com/go-openapi/runtime/client/request.go
+++ /dev/null
@@ -1,468 +0,0 @@
-// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
-// SPDX-License-Identifier: Apache-2.0
-
-package client
-
-import (
-	"bytes"
-	"context"
-	"fmt"
-	"io"
-	"log"
-	"mime/multipart"
-	"net/http"
-	"net/textproto"
-	"net/url"
-	"os"
-	"path"
-	"path/filepath"
-	"strings"
-	"time"
-
-	"github.com/go-openapi/runtime"
-	"github.com/go-openapi/strfmt"
-)
-
-var _ runtime.ClientRequest = new(request) // ensure compliance to the interface
-
-// Request represents a swagger client request.
-//
-// This Request struct converts to a HTTP request.
-// There might be others that convert to other transports.
-// There is no error checking here, it is assumed to be used after a spec has been validated.
-// so impossible combinations should not arise (hopefully).
-//
-// The main purpose of this struct is to hide the machinery of adding params to a transport request.
-// The generated code only implements what is necessary to turn a param into a valid value for these methods.
-type request struct {
-	pathPattern string
-	method      string
-	writer      runtime.ClientRequestWriter
-
-	pathParams map[string]string
-	header     http.Header
-	query      url.Values
-	formFields url.Values
-	fileFields map[string][]runtime.NamedReadCloser
-	payload    any
-	timeout    time.Duration
-	buf        *bytes.Buffer
-
-	getBody func(r *request) []byte
-}
-
-// NewRequest creates a new swagger http client request.
-func newRequest(method, pathPattern string, writer runtime.ClientRequestWriter) *request {
-	return &request{
-		pathPattern: pathPattern,
-		method:      method,
-		writer:      writer,
-		header:      make(http.Header),
-		query:       make(url.Values),
-		timeout:     DefaultTimeout,
-		getBody:     getRequestBuffer,
-	}
-}
-
-// BuildHTTP creates a new http request based on the data from the params.
-func (r *request) BuildHTTP(mediaType, basePath string, producers map[string]runtime.Producer, registry strfmt.Registry) (*http.Request, error) {
-	return r.buildHTTP(mediaType, basePath, producers, registry, nil)
-}
-
-func (r *request) GetMethod() string {
-	return r.method
-}
-
-func (r *request) GetPath() string {
-	path := r.pathPattern
-	for k, v := range r.pathParams {
-		path = strings.ReplaceAll(path, "{"+k+"}", v)
-	}
-	return path
-}
-
-func (r *request) GetBody() []byte {
-	return r.getBody(r)
-}
-
-// SetHeaderParam adds a header param to the request
-// when there is only 1 value provided for the varargs, it will set it.
-// when there are several values provided for the varargs it will add it (no overriding).
-func (r *request) SetHeaderParam(name string, values ...string) error {
-	if r.header == nil {
-		r.header = make(http.Header)
-	}
-	r.header[http.CanonicalHeaderKey(name)] = values
-	return nil
-}
-
-// GetHeaderParams returns the all headers currently set for the request.
-func (r *request) GetHeaderParams() http.Header {
-	return r.header
-}
-
-// SetQueryParam adds a query param to the request
-// when there is only 1 value provided for the varargs, it will set it.
-// when there are several values provided for the varargs it will add it (no overriding).
-func (r *request) SetQueryParam(name string, values ...string) error {
-	if r.query == nil {
-		r.query = make(url.Values)
-	}
-	r.query[name] = values
-	return nil
-}
-
-// GetQueryParams returns a copy of all query params currently set for the request.
-func (r *request) GetQueryParams() url.Values {
-	var result = make(url.Values)
-	for key, value := range r.query {
-		result[key] = append([]string{}, value...)
-	}
-	return result
-}
-
-// SetFormParam adds a forn param to the request
-// when there is only 1 value provided for the varargs, it will set it.
-// when there are several values provided for the varargs it will add it (no overriding).
-func (r *request) SetFormParam(name string, values ...string) error {
-	if r.formFields == nil {
-		r.formFields = make(url.Values)
-	}
-	r.formFields[name] = values
-	return nil
-}
-
-// SetPathParam adds a path param to the request.
-func (r *request) SetPathParam(name string, value string) error {
-	if r.pathParams == nil {
-		r.pathParams = make(map[string]string)
-	}
-
-	r.pathParams[name] = value
-	return nil
-}
-
-// SetFileParam adds a file param to the request.
-func (r *request) SetFileParam(name string, files ...runtime.NamedReadCloser) error {
-	for _, file := range files {
-		if actualFile, ok := file.(*os.File); ok {
-			fi, err := os.Stat(actualFile.Name())
-			if err != nil {
-				return err
-			}
-			if fi.IsDir() {
-				return fmt.Errorf("%q is a directory, only files are supported", file.Name())
-			}
-		}
-	}
-
-	if r.fileFields == nil {
-		r.fileFields = make(map[string][]runtime.NamedReadCloser)
-	}
-	if r.formFields == nil {
-		r.formFields = make(url.Values)
-	}
-
-	r.fileFields[name] = files
-	return nil
-}
-
-func (r *request) GetFileParam() map[string][]runtime.NamedReadCloser {
-	return r.fileFields
-}
-
-// SetBodyParam sets a body parameter on the request.
-// This does not yet serialze the object, this happens as late as possible.
-func (r *request) SetBodyParam(payload any) error {
-	r.payload = payload
-	return nil
-}
-
-func (r *request) GetBodyParam() any {
-	return r.payload
-}
-
-// SetTimeout sets the timeout for a request.
-func (r *request) SetTimeout(timeout time.Duration) error {
-	r.timeout = timeout
-	return nil
-}
-
-func (r *request) isMultipart(mediaType string) bool {
-	if len(r.fileFields) > 0 {
-		return true
-	}
-
-	return runtime.MultipartFormMime == mediaType
-}
-
-func (r *request) buildHTTP(mediaType, basePath string, producers map[string]runtime.Producer, registry strfmt.Registry, auth runtime.ClientAuthInfoWriter) (*http.Request, error) { //nolint:gocyclo,maintidx
-	// build the data
-	if err := r.writer.WriteToRequest(r, registry); err != nil {
-		return nil, err
-	}
-
-	// Our body must be an io.Reader.
-	// When we create the http.Request, if we pass it a
-	// bytes.Buffer then it will wrap it in an io.ReadCloser
-	// and set the content length automatically.
-	var body io.Reader
-	var pr *io.PipeReader
-	var pw *io.PipeWriter
-
-	r.buf = bytes.NewBuffer(nil)
-	if r.payload != nil || len(r.formFields) > 0 || len(r.fileFields) > 0 {
-		body = r.buf
-		if r.isMultipart(mediaType) {
-			pr, pw = io.Pipe()
-			body = pr
-		}
-	}
-
-	// check if this is a form type request
-	if len(r.formFields) > 0 || len(r.fileFields) > 0 {
-		if !r.isMultipart(mediaType) {
-			r.header.Set(runtime.HeaderContentType, mediaType)
-			formString := r.formFields.Encode()
-			r.buf.WriteString(formString)
-			goto DoneChoosingBodySource
-		}
-
-		mp := multipart.NewWriter(pw)
-		r.header.Set(runtime.HeaderContentType, mangleContentType(mediaType, mp.Boundary()))
-
-		go func() {
-			defer func() {
-				mp.Close()
-				pw.Close()
-			}()
-
-			for fn, v := range r.formFields {
-				for _, vi := range v {
-					if err := mp.WriteField(fn, vi); err != nil {
-						logClose(err, pw)
-						return
-					}
-				}
-			}
-
-			defer func() {
-				for _, ff := range r.fileFields {
-					for _, ffi := range ff {
-						ffi.Close()
-					}
-				}
-			}()
-			for fn, f := range r.fileFields {
-				for _, fi := range f {
-					var fileContentType string
-					if p, ok := fi.(interface {
-						ContentType() string
-					}); ok {
-						fileContentType = p.ContentType()
-					} else {
-						// Need to read the data so that we can detect the content type
-						const contentTypeBufferSize = 512
-						buf := make([]byte, contentTypeBufferSize)
-						size, err := fi.Read(buf)
-						if err != nil && err != io.EOF {
-							logClose(err, pw)
-							return
-						}
-						fileContentType = http.DetectContentType(buf)
-						fi = runtime.NamedReader(fi.Name(), io.MultiReader(bytes.NewReader(buf[:size]), fi))
-					}
-
-					// Create the MIME headers for the new part
-					h := make(textproto.MIMEHeader)
-					h.Set("Content-Disposition",
-						fmt.Sprintf(`form-data; name="%s"; filename="%s"`,
-							escapeQuotes(fn), escapeQuotes(filepath.Base(fi.Name()))))
-					h.Set("Content-Type", fileContentType)
-
-					wrtr, err := mp.CreatePart(h)
-					if err != nil {
-						logClose(err, pw)
-						return
-					}
-					if _, err := io.Copy(wrtr, fi); err != nil {
-						logClose(err, pw)
-					}
-				}
-			}
-		}()
-
-		goto DoneChoosingBodySource
-	}
-
-	// if there is payload, use the producer to write the payload, and then
-	// set the header to the content-type appropriate for the payload produced
-	if r.payload != nil {
-		// Enhancement proposal: https://github.com/go-openapi/runtime/issues/387
-		r.header.Set(runtime.HeaderContentType, mediaType)
-		if rdr, ok := r.payload.(io.ReadCloser); ok {
-			body = rdr
-			goto DoneChoosingBodySource
-		}
-
-		if rdr, ok := r.payload.(io.Reader); ok {
-			body = rdr
-			goto DoneChoosingBodySource
-		}
-
-		producer := producers[mediaType]
-		if err := producer.Produce(r.buf, r.payload); err != nil {
-			return nil, err
-		}
-	}
-
-DoneChoosingBodySource:
-
-	if runtime.CanHaveBody(r.method) && body != nil && r.header.Get(runtime.HeaderContentType) == "" {
-		r.header.Set(runtime.HeaderContentType, mediaType)
-	}
-
-	if auth != nil {
-		// If we're not using r.buf as our http.Request's body,
-		// either the payload is an io.Reader or io.ReadCloser,
-		// or we're doing a multipart form/file.
-		//
-		// In those cases, if the AuthenticateRequest call asks for the body,
-		// we must read it into a buffer and provide that, then use that buffer
-		// as the body of our http.Request.
-		//
-		// This is done in-line with the GetBody() request rather than ahead
-		// of time, because there's no way to know if the AuthenticateRequest
-		// will even ask for the body of the request.
-		//
-		// If for some reason the copy fails, there's no way to return that
-		// error to the GetBody() call, so return it afterwards.
-		//
-		// An error from the copy action is prioritized over any error
-		// from the AuthenticateRequest call, because the mis-read
-		// body may have interfered with the auth.
-		//
-		var copyErr error
-		if buf, ok := body.(*bytes.Buffer); body != nil && (!ok || buf != r.buf) {
-			var copied bool
-			r.getBody = func(r *request) []byte {
-				if copied {
-					return getRequestBuffer(r)
-				}
-
-				defer func() {
-					copied = true
-				}()
-
-				if _, copyErr = io.Copy(r.buf, body); copyErr != nil {
-					return nil
-				}
-
-				if closer, ok := body.(io.ReadCloser); ok {
-					if copyErr = closer.Close(); copyErr != nil {
-						return nil
-					}
-				}
-
-				body = r.buf
-				return getRequestBuffer(r)
-			}
-		}
-
-		authErr := auth.AuthenticateRequest(r, registry)
-
-		if copyErr != nil {
-			return nil, fmt.Errorf("error retrieving the response body: %v", copyErr)
-		}
-
-		if authErr != nil {
-			return nil, authErr
-		}
-	}
-
-	// In case the basePath or the request pathPattern include static query parameters,
-	// parse those out before constructing the final path. The parameters themselves
-	// will be merged with the ones set by the client, with the priority given first to
-	// the ones set by the client, then the path pattern, and lastly the base path.
-	basePathURL, err := url.Parse(basePath)
-	if err != nil {
-		return nil, err
-	}
-	staticQueryParams := basePathURL.Query()
-
-	pathPatternURL, err := url.Parse(r.pathPattern)
-	if err != nil {
-		return nil, err
-	}
-	for name, values := range pathPatternURL.Query() {
-		if _, present := staticQueryParams[name]; present {
-			staticQueryParams.Del(name)
-		}
-		for _, value := range values {
-			staticQueryParams.Add(name, value)
-		}
-	}
-
-	// create http request
-	var reinstateSlash bool
-	if pathPatternURL.Path != "" && pathPatternURL.Path != "/" && pathPatternURL.Path[len(pathPatternURL.Path)-1] == '/' {
-		reinstateSlash = true
-	}
-
-	urlPath := path.Join(basePathURL.Path, pathPatternURL.Path)
-	for k, v := range r.pathParams {
-		urlPath = strings.ReplaceAll(urlPath, "{"+k+"}", url.PathEscape(v))
-	}
-	if reinstateSlash {
-		urlPath += "/"
-	}
-
-	req, err := http.NewRequestWithContext(context.Background(), r.method, urlPath, body)
-	if err != nil {
-		return nil, err
-	}
-
-	originalParams := r.GetQueryParams()
-
-	// Merge the query parameters extracted from the basePath with the ones set by
-	// the client in this struct. In case of conflict, the client wins.
-	for k, v := range staticQueryParams {
-		_, present := originalParams[k]
-		if !present {
-			if err = r.SetQueryParam(k, v...); err != nil {
-				return nil, err
-			}
-		}
-	}
-
-	req.URL.RawQuery = r.query.Encode()
-	req.Header = r.header
-
-	return req, nil
-}
-
-func escapeQuotes(s string) string {
-	return strings.NewReplacer("\\", "\\\\", `"`, "\\\"").Replace(s)
-}
-
-func getRequestBuffer(r *request) []byte {
-	if r.buf == nil {
-		return nil
-	}
-	return r.buf.Bytes()
-}
-
-func logClose(err error, pw *io.PipeWriter) {
-	log.Println(err)
-	closeErr := pw.CloseWithError(err)
-	if closeErr != nil {
-		log.Println(closeErr)
-	}
-}
-
-func mangleContentType(mediaType, boundary string) string {
-	if strings.ToLower(mediaType) == runtime.URLencodedFormMime {
-		return fmt.Sprintf("%s; boundary=%s", mediaType, boundary)
-	}
-	return "multipart/form-data; boundary=" + boundary
-}
diff --git a/vendor/github.com/go-openapi/runtime/client/runtime.go b/vendor/github.com/go-openapi/runtime/client/runtime.go
index eeb17dfb24..efbe8e4943 100644
--- a/vendor/github.com/go-openapi/runtime/client/runtime.go
+++ b/vendor/github.com/go-openapi/runtime/client/runtime.go
@@ -5,25 +5,19 @@ package client
 
 import (
 	"context"
-	"crypto"
-	"crypto/ecdsa"
-	"crypto/rsa"
-	"crypto/tls"
-	"crypto/x509"
-	"encoding/pem"
-	"errors"
 	"fmt"
 	"mime"
 	"net/http"
 	"net/http/httputil"
-	"os"
 	"strings"
 	"sync"
 	"time"
 
 	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/runtime/client/internal/request"
 	"github.com/go-openapi/runtime/logger"
 	"github.com/go-openapi/runtime/middleware"
+	"github.com/go-openapi/runtime/server-middleware/mediatype"
 	"github.com/go-openapi/runtime/yamlpc"
 	"github.com/go-openapi/strfmt"
 )
@@ -36,184 +30,6 @@ const (
 // DefaultTimeout the default request timeout.
 var DefaultTimeout = 30 * time.Second
 
-// TLSClientOptions to configure client authentication with mutual TLS.
-type TLSClientOptions struct {
-	// Certificate is the path to a PEM-encoded certificate to be used for
-	// client authentication. If set then Key must also be set.
-	Certificate string
-
-	// LoadedCertificate is the certificate to be used for client authentication.
-	// This field is ignored if Certificate is set. If this field is set, LoadedKey
-	// is also required.
-	LoadedCertificate *x509.Certificate
-
-	// Key is the path to an unencrypted PEM-encoded private key for client
-	// authentication. This field is required if Certificate is set.
-	Key string
-
-	// LoadedKey is the key for client authentication. This field is required if
-	// LoadedCertificate is set.
-	LoadedKey crypto.PrivateKey
-
-	// CA is a path to a PEM-encoded certificate that specifies the root certificate
-	// to use when validating the TLS certificate presented by the server. If this field
-	// (and LoadedCA) is not set, the system certificate pool is used. This field is ignored if LoadedCA
-	// is set.
-	CA string
-
-	// LoadedCA specifies the root certificate to use when validating the server's TLS certificate.
-	// If this field (and CA) is not set, the system certificate pool is used.
-	LoadedCA *x509.Certificate
-
-	// LoadedCAPool specifies a pool of RootCAs to use when validating the server's TLS certificate.
-	// If set, it will be combined with the other loaded certificates (see LoadedCA and CA).
-	// If neither LoadedCA or CA is set, the provided pool with override the system
-	// certificate pool.
-	// The caller must not use the supplied pool after calling TLSClientAuth.
-	LoadedCAPool *x509.CertPool
-
-	// ServerName specifies the hostname to use when verifying the server certificate.
-	// If this field is set then InsecureSkipVerify will be ignored and treated as
-	// false.
-	ServerName string
-
-	// InsecureSkipVerify controls whether the certificate chain and hostname presented
-	// by the server are validated. If true, any certificate is accepted.
-	InsecureSkipVerify bool
-
-	// VerifyPeerCertificate, if not nil, is called after normal
-	// certificate verification. It receives the raw ASN.1 certificates
-	// provided by the peer and also any verified chains that normal processing found.
-	// If it returns a non-nil error, the handshake is aborted and that error results.
-	//
-	// If normal verification fails then the handshake will abort before
-	// considering this callback. If normal verification is disabled by
-	// setting InsecureSkipVerify then this callback will be considered but
-	// the verifiedChains argument will always be nil.
-	VerifyPeerCertificate func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error
-
-	// VerifyConnection, if not nil, is called after normal certificate
-	// verification and after [TLSClientOptions.VerifyPeerCertificate] by either a TLS client or
-	// server. It receives the [tls.ConnectionState] which may be inspected.
-	//
-	// Unlike VerifyPeerCertificate, this callback is invoked on every
-	// connection, including resumed ones, making it suitable for checks
-	// that must always apply (e.g. certificate pinning).
-	//
-	// If it returns a non-nil error, the handshake is aborted and that error results.
-	VerifyConnection func(tls.ConnectionState) error
-
-	// SessionTicketsDisabled may be set to true to disable session ticket and
-	// PSK (resumption) support. Note that on clients, session ticket support is
-	// also disabled if ClientSessionCache is nil.
-	SessionTicketsDisabled bool
-
-	// ClientSessionCache is a cache of ClientSessionState entries for TLS
-	// session resumption. It is only used by clients.
-	ClientSessionCache tls.ClientSessionCache
-
-	// Prevents callers using unkeyed fields.
-	_ struct{}
-}
-
-// TLSClientAuth creates a [tls.Config] for mutual auth.
-func TLSClientAuth(opts TLSClientOptions) (*tls.Config, error) {
-	// create client tls config
-	cfg := &tls.Config{
-		MinVersion: tls.VersionTLS12,
-	}
-
-	// load client cert if specified
-	if opts.Certificate != "" {
-		cert, err := tls.LoadX509KeyPair(opts.Certificate, opts.Key)
-		if err != nil {
-			return nil, fmt.Errorf("tls client cert: %v", err)
-		}
-		cfg.Certificates = []tls.Certificate{cert}
-	} else if opts.LoadedCertificate != nil {
-		block := pem.Block{Type: "CERTIFICATE", Bytes: opts.LoadedCertificate.Raw}
-		certPem := pem.EncodeToMemory(&block)
-
-		var keyBytes []byte
-		switch k := opts.LoadedKey.(type) {
-		case *rsa.PrivateKey:
-			keyBytes = x509.MarshalPKCS1PrivateKey(k)
-		case *ecdsa.PrivateKey:
-			var err error
-			keyBytes, err = x509.MarshalECPrivateKey(k)
-			if err != nil {
-				return nil, fmt.Errorf("tls client priv key: %v", err)
-			}
-		default:
-			return nil, errors.New("tls client priv key: unsupported key type")
-		}
-
-		block = pem.Block{Type: "PRIVATE KEY", Bytes: keyBytes}
-		keyPem := pem.EncodeToMemory(&block)
-
-		cert, err := tls.X509KeyPair(certPem, keyPem)
-		if err != nil {
-			return nil, fmt.Errorf("tls client cert: %v", err)
-		}
-		cfg.Certificates = []tls.Certificate{cert}
-	}
-
-	cfg.InsecureSkipVerify = opts.InsecureSkipVerify
-
-	cfg.VerifyPeerCertificate = opts.VerifyPeerCertificate
-	cfg.VerifyConnection = opts.VerifyConnection
-	cfg.SessionTicketsDisabled = opts.SessionTicketsDisabled
-	cfg.ClientSessionCache = opts.ClientSessionCache
-
-	// When no CA certificate is provided, default to the system cert pool
-	// that way when a request is made to a server known by the system trust store,
-	// the name is still verified
-	switch {
-	case opts.LoadedCA != nil:
-		caCertPool := basePool(opts.LoadedCAPool)
-		caCertPool.AddCert(opts.LoadedCA)
-		cfg.RootCAs = caCertPool
-	case opts.CA != "":
-		// load ca cert
-		caCert, err := os.ReadFile(opts.CA)
-		if err != nil {
-			return nil, fmt.Errorf("tls client ca: %v", err)
-		}
-		caCertPool := basePool(opts.LoadedCAPool)
-		caCertPool.AppendCertsFromPEM(caCert)
-		cfg.RootCAs = caCertPool
-	case opts.LoadedCAPool != nil:
-		cfg.RootCAs = opts.LoadedCAPool
-	}
-
-	// apply servername overrride
-	if opts.ServerName != "" {
-		cfg.InsecureSkipVerify = false
-		cfg.ServerName = opts.ServerName
-	}
-
-	return cfg, nil
-}
-
-// TLSTransport creates a [http] client transport suitable for mutual [tls] auth.
-func TLSTransport(opts TLSClientOptions) (http.RoundTripper, error) {
-	cfg, err := TLSClientAuth(opts)
-	if err != nil {
-		return nil, err
-	}
-
-	return &http.Transport{TLSClientConfig: cfg}, nil
-}
-
-// TLSClient creates a [http.Client] for mutual auth.
-func TLSClient(opts TLSClientOptions) (*http.Client, error) {
-	transport, err := TLSTransport(opts)
-	if err != nil {
-		return nil, err
-	}
-	return &http.Client{Transport: transport}, nil
-}
-
 // Runtime represents an API client that uses the transport
 // to make [http] requests based on a swagger specification.
 type Runtime struct {
@@ -230,9 +46,39 @@ type Runtime struct {
 	Formats  strfmt.Registry
 	Context  context.Context //nolint:containedctx  // we precisely want this type to contain the request context
 
-	Debug  bool
+	Debug bool
+
+	// Trace enables connection-level diagnostic output via
+	// [net/http/httptrace]. When true, the runtime narrates the
+	// connection lifecycle of every request through r.logger.Debugf:
+	// DNS, dial, TLS handshake, idle-pool reuse, request body
+	// transfer, time-to-first-byte, response body transfer, and a
+	// trailing per-request summary line.
+	//
+	// Trace is orthogonal to Debug: Debug dumps wire bytes (request
+	// and response headers and body), Trace narrates how the
+	// connection got there. Both may be enabled independently.
+	//
+	// Trace is not coupled to the SWAGGER_DEBUG / DEBUG environment
+	// variables: it defaults to false and is only enabled by
+	// explicit assignment.
+	//
+	// Trace is primarily intended as a problem-investigation tool
+	// (the local equivalent of curl -vvv), not an always-on tracer.
+	// For distributed-trace correlation, use the OpenTelemetry
+	// integration ([Runtime.WithOpenTelemetry]).
+	Trace bool
+
 	logger logger.Logger
 
+	// MatchSuffix enables RFC 6839 structured-syntax suffix tolerance
+	// for codec lookup. When true, a response with Content-Type
+	// "application/problem+json" finds the JSON consumer registered
+	// under "application/json"; with the default false, the lookup
+	// is strict and falls through to the "*/*" wildcard if present.
+	// See [mediatype.AllowSuffix] for the semantics.
+	MatchSuffix bool
+
 	clientOnce *sync.Once
 	client     *http.Client
 	schemes    []string
@@ -294,47 +140,6 @@ func NewWithClient(host, basePath string, schemes []string, client *http.Client)
 	return rt
 }
 
-// WithOpenTracing adds opentracing support to the provided runtime.
-// A new client span is created for each request.
-// If the context of the client operation does not contain an active span, no span is created.
-// The provided opts are applied to each spans - for example to add global tags.
-//
-// Deprecated: use [WithOpenTelemetry] instead, as opentracing is now archived and superseded by opentelemetry.
-//
-// # Deprecation notice
-//
-// The [Runtime.WithOpenTracing] method has been deprecated in favor of [Runtime.WithOpenTelemetry].
-//
-// The method is still around so programs calling it will still build. However, it will return
-// an opentelemetry transport.
-//
-// If you have a strict requirement on using opentracing, you may still do so by importing
-// module [github.com/go-openapi/runtime/client-[middleware]/opentracing] and using
-// [github.com/go-openapi/runtime/client-[middleware]/opentracing.WithOpenTracing] with your
-// usual opentracing options and opentracing-enabled transport.
-//
-// Passed options are ignored unless they are of type [OpenTelemetryOpt].
-func (r *Runtime) WithOpenTracing(opts ...any) runtime.ClientTransport {
-	otelOpts := make([]OpenTelemetryOpt, 0, len(opts))
-	for _, o := range opts {
-		otelOpt, ok := o.(OpenTelemetryOpt)
-		if !ok {
-			continue
-		}
-		otelOpts = append(otelOpts, otelOpt)
-	}
-
-	return r.WithOpenTelemetry(otelOpts...)
-}
-
-// WithOpenTelemetry adds opentelemetry support to the provided runtime.
-// A new client span is created for each request.
-// If the context of the client operation does not contain an active span, no span is created.
-// The provided opts are applied to each spans - for example to add global tags.
-func (r *Runtime) WithOpenTelemetry(opts ...OpenTelemetryOpt) runtime.ClientTransport {
-	return newOpenTelemetryTransport(r, r.Host, opts)
-}
-
 // EnableConnectionReuse drains the remaining body from a response
 // so that go will reuse the TCP connections.
 //
@@ -357,105 +162,109 @@ func (r *Runtime) EnableConnectionReuse() {
 	)
 }
 
+// CreateHTTPRequestContext creates the requests and bind the parameters, but does not send it over the wire
+// like [Runtime.SubmitContext].
+//
+// The [http.Request] is complete with authentication, headers and body (including streamed body) and ready for callers
+// to submit it to a [http.Client] of their choice, then consume the [http.Response].
+//
+// Most users would simply use [Runtime.SubmitContext], which wraps all these operations in one call.
+func (r *Runtime) CreateHTTPRequestContext(ctx context.Context, operation *runtime.ClientOperation) (req *http.Request, cancel context.CancelFunc, err error) {
+	req, cancel, err = r.createHTTPRequestContext(ctx, operation)
+	return
+}
+
+// CreateHttpRequest builds the [http.Request] for the given operation, using
+// [context.Background] as the request context.
+//
+// Any per-operation timeout declared by the operation's [runtime.ClientRequestWriter]
+// is silently ignored here, which can leak a context-cancellation channel if the
+// caller relies on it.
+//
+// Deprecated: use [Runtime.CreateHTTPRequestContext] instead, with explicit
+// control over the request context and its cancellation.
 func (r *Runtime) CreateHttpRequest(operation *runtime.ClientOperation) (req *http.Request, err error) { //nolint:revive
-	_, req, err = r.createHttpRequest(operation)
+	req, _, err = r.createHTTPRequestContext(context.Background(), operation)
 	return
 }
 
 // Submit a request and when there is a body on success it will turn that into the result
 // all other things are turned into an api error for swagger which retains the status code.
+//
+// This call inherits the context possibly put in the operation, otherwise the one possibly put in the [Runtime].
+// If none are set, use [context.Background].
+//
+// Any timeout set by parameters is honored.
 func (r *Runtime) Submit(operation *runtime.ClientOperation) (any, error) {
-	_, readResponse, _ := operation.Params, operation.Reader, operation.AuthInfo
+	return r.SubmitContext(r.ensureContext(operation), operation)
+}
 
-	request, req, err := r.createHttpRequest(operation)
+// SubmitContext submits a request and returns the result.
+//
+// Errors are turned into an api error for swagger which retains the status code.
+//
+// Unlike [Submit], [SubmitContext] only injects the context provided by the caller:
+// contexts possibly cached in operation or runtime are ignored.
+//
+// On the other hand, a timeout set by parameters is honored.
+func (r *Runtime) SubmitContext(parentCtx context.Context, operation *runtime.ClientOperation) (any, error) {
+	req, cancel, err := r.createHTTPRequestContext(parentCtx, operation)
 	if err != nil {
 		return nil, err
 	}
+	defer cancel()
 
-	r.clientOnce.Do(func() {
-		r.client = &http.Client{
-			Transport: r.Transport,
-			Jar:       r.Jar,
-		}
-	})
-
-	if r.Debug {
-		b, err2 := httputil.DumpRequestOut(req, true)
-		if err2 != nil {
-			return nil, err2
-		}
-		r.logger.Debugf("%s\n", string(b))
-	}
+	r.ensureClient()
 
-	var parentCtx context.Context
-	switch {
-	case operation.Context != nil:
-		parentCtx = operation.Context
-	case r.Context != nil:
-		parentCtx = r.Context
-	default:
-		parentCtx = context.Background()
+	if err := r.dumpRequest(req); err != nil {
+		return nil, err
 	}
 
-	var (
-		ctx    context.Context
-		cancel context.CancelFunc
-	)
-	if request.timeout == 0 {
-		// There may be a deadline in the context passed to the operation.
-		// Otherwise, there is no timeout set.
-		ctx, cancel = context.WithCancel(parentCtx)
-	} else {
-		// Sets the timeout passed from request params (by default runtime.DefaultTimeout).
-		// If there is already a deadline in the parent context, the shortest will
-		// apply.
-		ctx, cancel = context.WithTimeout(parentCtx, request.timeout)
+	// Attach the trace session before Do so the httptrace hooks
+	// fire during the round-trip. The session emits its trailing
+	// summary on finish; the response body is consumed by
+	// ReadResponse downstream, after which finish is called.
+	var trace *traceSession
+	if r.Trace {
+		trace = newTraceSession(r.logger, req.Method, req.URL.String(),
+			introspectTLSConfig(r.pickClient(operation)))
+		//nolint:contextcheck // We intentionally derive from req.Context() to layer the trace hooks onto the existing request context.
+		req = req.WithContext(trace.attach(req.Context()))
+		if req.Body != nil {
+			req.Body = trace.wrapRequestBody(req.Body)
+		}
+		defer trace.finish()
 	}
-	defer cancel()
 
-	var client *http.Client
-	if operation.Client != nil {
-		client = operation.Client
-	} else {
-		client = r.client
-	}
-	req = req.WithContext(ctx)
-	res, err := client.Do(req) // make requests, by default follows 10 redirects before failing
+	res, err := r.pickClient(operation).Do(req)
 	if err != nil {
+		if trace != nil {
+			trace.onRoundTripError(err)
+		}
 		return nil, err
 	}
 	defer res.Body.Close()
 
+	if trace != nil {
+		trace.onResponse(res.StatusCode)
+		res.Body = trace.wrapResponseBody(res.Body)
+	}
+
 	ct := res.Header.Get(runtime.HeaderContentType)
 	if ct == "" { // this should really never occur
 		ct = r.DefaultMediaType
 	}
 
-	if r.Debug {
-		printBody := true
-		if ct == runtime.DefaultMime {
-			printBody = false // Spare the terminal from a binary blob.
-		}
-		b, err2 := httputil.DumpResponse(res, printBody)
-		if err2 != nil {
-			return nil, err2
-		}
-		r.logger.Debugf("%s\n", string(b))
+	if err := r.dumpResponse(res, ct); err != nil {
+		return nil, err
 	}
 
-	mt, _, err := mime.ParseMediaType(ct)
+	cons, err := r.resolveConsumer(ct)
 	if err != nil {
-		return nil, fmt.Errorf("parse content type: %s", err)
+		return nil, err
 	}
 
-	cons, ok := r.Consumers[mt]
-	if !ok {
-		if cons, ok = r.Consumers["*/*"]; !ok {
-			// scream about not knowing what to do
-			return nil, fmt.Errorf("no consumer: %q", ct)
-		}
-	}
-	return readResponse.ReadResponse(r.response(res), cons)
+	return operation.Reader.ReadResponse(r.response(res), cons)
 }
 
 // SetDebug changes the debug flag.
@@ -482,6 +291,17 @@ func (r *Runtime) SetResponseReader(f ClientResponseFunc) {
 	r.response = f
 }
 
+func (r *Runtime) ensureContext(operation *runtime.ClientOperation) context.Context {
+	switch {
+	case operation.Context != nil:
+		return operation.Context
+	case r.Context != nil:
+		return r.Context
+	default:
+		return context.Background()
+	}
+}
+
 func (r *Runtime) pickScheme(schemes []string) string {
 	if v := r.selectScheme(r.schemes); v != "" {
 		return v
@@ -518,16 +338,121 @@ func transportOrDefault(left, right http.RoundTripper) http.RoundTripper {
 	return left
 }
 
-// takes a client operation and creates equivalent http.Request.
-func (r *Runtime) createHttpRequest(operation *runtime.ClientOperation) (*request, *http.Request, error) { //nolint:revive
+// ensureClient lazily initializes r.client from r.Transport and r.Jar
+// on first use. Safe under concurrent calls via sync.Once.
+func (r *Runtime) ensureClient() {
+	r.clientOnce.Do(func() {
+		r.client = &http.Client{
+			Transport: r.Transport,
+			Jar:       r.Jar,
+		}
+	})
+}
+
+// pickClient returns the http.Client to use for this operation: the
+// per-operation override if set, else the runtime's shared client.
+func (r *Runtime) pickClient(operation *runtime.ClientOperation) *http.Client {
+	if operation.Client != nil {
+		return operation.Client
+	}
+	return r.client
+}
+
+// dumpRequest writes the outgoing request to the debug logger when
+// r.Debug is enabled. No-op otherwise. Returns the dump error so the
+// caller can decide whether to abort the submit.
+func (r *Runtime) dumpRequest(req *http.Request) error {
+	if !r.Debug {
+		return nil
+	}
+	b, err := httputil.DumpRequestOut(req, true)
+	if err != nil {
+		return err
+	}
+	r.logger.Debugf("%s\n", string(b))
+	return nil
+}
+
+// dumpResponse writes the incoming response to the debug logger when
+// r.Debug is enabled. The body is omitted for runtime.DefaultMime
+// (binary blob). No-op otherwise.
+func (r *Runtime) dumpResponse(res *http.Response, ct string) error {
+	if !r.Debug {
+		return nil
+	}
+	printBody := ct != runtime.DefaultMime // Spare the terminal from a binary blob.
+	b, err := httputil.DumpResponse(res, printBody)
+	if err != nil {
+		return err
+	}
+	r.logger.Debugf("%s\n", string(b))
+	return nil
+}
+
+// resolveConsumer parses ct and returns the registered Consumer for
+// that media type. Lookup is alias-aware (RFC 9512 §2.1 — yaml
+// aliases) and, when [Runtime.MatchSuffix] is true, also tolerates
+// RFC 6839 structured-syntax suffix media types (+json, +xml, +yaml).
+// Falls back to the "*/*" entry if no match found.
+func (r *Runtime) resolveConsumer(ct string) (runtime.Consumer, error) {
+	if _, _, err := mime.ParseMediaType(ct); err != nil {
+		return nil, fmt.Errorf("parse content type: %w", err)
+	}
+	if cons, ok := mediatype.Lookup(r.Consumers, ct, r.matchOpts()...); ok {
+		return cons, nil
+	}
+	if cons, ok := r.Consumers["*/*"]; ok {
+		return cons, nil
+	}
+	// scream about not knowing what to do
+	return nil, fmt.Errorf("no consumer: %q", ct)
+}
+
+// matchOpts builds the mediatype.MatchOption slice for codec
+// lookups on the Runtime, currently just the AllowSuffix opt-in.
+func (r *Runtime) matchOpts() []mediatype.MatchOption {
+	if !r.MatchSuffix {
+		return nil
+	}
+
+	return []mediatype.MatchOption{mediatype.AllowSuffix()}
+}
+
+// createHTTPRequestContext is the context-aware builder of a [http.Request].
+//
+// The returned [http.Request] carries a context derived from parentCtx that
+// honors the per-request timeout set during WriteToRequest. Callers must
+// invoke cancel once the response is fully read.
+func (r *Runtime) createHTTPRequestContext(parentCtx context.Context, operation *runtime.ClientOperation) (*http.Request, context.CancelFunc, error) {
+	req, cmt, auth, err := r.prepareRequest(operation)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	httpReq, cancel, err := req.BuildHTTPContext(parentCtx, cmt, r.BasePath, r.Producers, r.Formats, auth)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	r.applyHostScheme(httpReq, operation)
+
+	return httpReq, cancel, nil
+}
+
+// prepareRequest performs the operation-to-request setup that is
+// independent of how the http.Request is finally assembled: parameters,
+// headers, default authentication, and consumes-media-type selection.
+func (r *Runtime) prepareRequest(operation *runtime.ClientOperation) (*request.Request, string, runtime.ClientAuthInfoWriter, error) {
 	params, _, auth := operation.Params, operation.Reader, operation.AuthInfo
 
-	request := newRequest(operation.Method, operation.PathPattern, params)
+	req := request.New(operation.Method, operation.PathPattern, params)
+	_ = req.SetTimeout(DefaultTimeout) // the timeout may be overridden by ClientRequestWriter
+	req.SetConsumes(operation.ConsumesMediaTypes)
 
 	accept := make([]string, 0, len(operation.ProducesMediaTypes))
 	accept = append(accept, operation.ProducesMediaTypes...)
-	if err := request.SetHeaderParam(runtime.HeaderAccept, accept...); err != nil {
-		return nil, nil, err
+	if err := req.SetHeaderParam(runtime.HeaderAccept, accept...); err != nil {
+		return nil, "", nil, err
 	}
 
 	if auth == nil && r.DefaultAuthentication != nil {
@@ -538,39 +463,75 @@ func (r *Runtime) createHttpRequest(operation *runtime.ClientOperation) (*reques
 			return r.DefaultAuthentication.AuthenticateRequest(req, reg)
 		})
 	}
-	// if auth != nil {
-	//	if err := auth.AuthenticateRequest(request, r.Formats); err != nil {
-	//		return nil, err
-	//	}
-	//}
-
-	// Enhancement proposal: https://github.com/go-openapi/runtime/issues/386
-	cmt := r.DefaultMediaType
-	for _, mediaType := range operation.ConsumesMediaTypes {
-		// Pick first non-empty media type
-		if mediaType != "" {
-			cmt = mediaType
-			break
-		}
-	}
 
-	if _, ok := r.Producers[cmt]; !ok && cmt != runtime.MultipartFormMime && cmt != runtime.URLencodedFormMime {
-		return nil, nil, fmt.Errorf("none of producers: %v registered. try %s", r.Producers, cmt)
+	cmt := pickConsumesMediaType(operation.ConsumesMediaTypes, r.Producers, r.DefaultMediaType, r.matchOpts()...)
+	if _, ok := mediatype.Lookup(r.Producers, cmt, r.matchOpts()...); !ok && cmt != runtime.MultipartFormMime && cmt != runtime.URLencodedFormMime {
+		return nil, "", nil, fmt.Errorf("none of producers: %v registered. try %s", r.Producers, cmt)
 	}
 
-	req, err := request.buildHTTP(cmt, r.BasePath, r.Producers, r.Formats, auth)
-	if err != nil {
-		return nil, nil, err
-	}
-	req.URL.Scheme = r.pickScheme(operation.Schemes)
-	req.URL.Host = r.Host
-	req.Host = r.Host
-	return request, req, nil
+	return req, cmt, auth, nil
 }
 
-func basePool(pool *x509.CertPool) *x509.CertPool {
-	if pool == nil {
-		return x509.NewCertPool()
+// applyHostScheme stamps the runtime's host and the operation-selected
+// scheme onto the freshly built http.Request.
+func (r *Runtime) applyHostScheme(httpReq *http.Request, operation *runtime.ClientOperation) {
+	httpReq.URL.Scheme = r.pickScheme(operation.Schemes)
+	httpReq.URL.Host = r.Host
+	httpReq.Host = r.Host
+}
+
+// pickConsumesMediaType selects which Content-Type the client will send.
+//
+// Selection rules, in priority order:
+//
+//  1. multipart/form-data if any consumes entry advertises it (it streams
+//     and preserves per-file Content-Type, regardless of codegen ordering;
+//     resolves issue #286);
+//  2. the first non-empty entry whose mime is either structural
+//     (multipart/form-data or application/x-www-form-urlencoded — these
+//     do not need a producer in the map) or has a producer registered in
+//     producers — this lets the client gracefully skip unregistered
+//     spec entries instead of erroring at the gate that follows;
+//  3. the first non-empty entry overall (preserves the historical error
+//     path: the gate at the call site reports "none of producers" with
+//     the unregistered mime, so the diagnostic is unchanged when nothing
+//     in consumes is registered);
+//  4. def, if consumes is empty or all empty strings.
+//
+// Step 2 closes part of issues #32 and #386: an operation declaring
+// `consumes: [application/x-vendor, application/json]` with no vendor
+// producer registered now silently uses JSON instead of erroring.
+func pickConsumesMediaType(consumes []string, producers map[string]runtime.Producer, def string, opts ...mediatype.MatchOption) string {
+	for _, mt := range consumes {
+		if strings.EqualFold(mt, runtime.MultipartFormMime) {
+			return mt
+		}
+	}
+	var firstNonEmpty string
+	for _, mt := range consumes {
+		if mt == "" {
+			continue
+		}
+		if firstNonEmpty == "" {
+			firstNonEmpty = mt
+		}
+		if isStructuralMime(mt) {
+			return mt
+		}
+		if _, ok := mediatype.Lookup(producers, mt, opts...); ok {
+			return mt
+		}
+	}
+	if firstNonEmpty != "" {
+		return firstNonEmpty
 	}
-	return pool
+	return def
+}
+
+// isStructuralMime reports whether mt is a media type whose body shape
+// is owned by the runtime (multipart envelope, urlencoded form). These
+// do not require an entry in the producers map.
+func isStructuralMime(mt string) bool {
+	return strings.EqualFold(mt, runtime.MultipartFormMime) ||
+		strings.EqualFold(mt, runtime.URLencodedFormMime)
 }
diff --git a/vendor/github.com/go-openapi/runtime/client/tls.go b/vendor/github.com/go-openapi/runtime/client/tls.go
new file mode 100644
index 0000000000..017694fae0
--- /dev/null
+++ b/vendor/github.com/go-openapi/runtime/client/tls.go
@@ -0,0 +1,197 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package client
+
+import (
+	"crypto"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/pem"
+	"fmt"
+	"net/http"
+	"os"
+)
+
+// TLSClientOptions to configure client authentication with mutual TLS.
+type TLSClientOptions struct {
+	// Certificate is the path to a PEM-encoded certificate to be used for
+	// client authentication. If set then Key must also be set.
+	Certificate string
+
+	// LoadedCertificate is the certificate to be used for client authentication.
+	// This field is ignored if Certificate is set. If this field is set, LoadedKey
+	// is also required.
+	LoadedCertificate *x509.Certificate
+
+	// Key is the path to an unencrypted PEM-encoded private key for client
+	// authentication. This field is required if Certificate is set.
+	Key string
+
+	// LoadedKey is the key for client authentication. This field is required if
+	// LoadedCertificate is set.
+	LoadedKey crypto.PrivateKey
+
+	// CA is a path to a PEM-encoded certificate that specifies the root certificate
+	// to use when validating the TLS certificate presented by the server. If this field
+	// (and LoadedCA) is not set, the system certificate pool is used. This field is ignored if LoadedCA
+	// is set.
+	CA string
+
+	// LoadedCA specifies the root certificate to use when validating the server's TLS certificate.
+	// If this field (and CA) is not set, the system certificate pool is used.
+	LoadedCA *x509.Certificate
+
+	// LoadedCAPool specifies a pool of RootCAs to use when validating the server's TLS certificate.
+	// If set, it will be combined with the other loaded certificates (see LoadedCA and CA).
+	// If neither LoadedCA or CA is set, the provided pool will override the system
+	// certificate pool.
+	//
+	// The caller must not use the supplied pool after calling TLSClientAuth.
+	LoadedCAPool *x509.CertPool
+
+	// ServerName specifies the hostname to use when verifying the server certificate.
+	// If this field is set then InsecureSkipVerify will be ignored and treated as
+	// false.
+	ServerName string
+
+	// InsecureSkipVerify controls whether the certificate chain and hostname presented
+	// by the server are validated. If true, any certificate is accepted.
+	InsecureSkipVerify bool
+
+	// VerifyPeerCertificate, if not nil, is called after normal
+	// certificate verification. It receives the raw ASN.1 certificates
+	// provided by the peer and also any verified chains that normal processing found.
+	// If it returns a non-nil error, the handshake is aborted and that error results.
+	//
+	// If normal verification fails then the handshake will abort before
+	// considering this callback. If normal verification is disabled by
+	// setting InsecureSkipVerify then this callback will be considered but
+	// the verifiedChains argument will always be nil.
+	VerifyPeerCertificate func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error
+
+	// VerifyConnection, if not nil, is called after normal certificate
+	// verification and after [TLSClientOptions.VerifyPeerCertificate] by either a TLS client or
+	// server. It receives the [tls.ConnectionState] which may be inspected.
+	//
+	// Unlike VerifyPeerCertificate, this callback is invoked on every
+	// connection, including resumed ones, making it suitable for checks
+	// that must always apply (e.g. certificate pinning).
+	//
+	// If it returns a non-nil error, the handshake is aborted and that error results.
+	VerifyConnection func(tls.ConnectionState) error
+
+	// SessionTicketsDisabled may be set to true to disable session ticket and
+	// PSK (resumption) support. Note that on clients, session ticket support is
+	// also disabled if ClientSessionCache is nil.
+	SessionTicketsDisabled bool
+
+	// ClientSessionCache is a cache of ClientSessionState entries for TLS
+	// session resumption. It is only used by clients.
+	ClientSessionCache tls.ClientSessionCache
+
+	// Prevents callers using unkeyed fields.
+	_ struct{}
+}
+
+// TLSClientAuth creates a [tls.Config] for mutual auth.
+func TLSClientAuth(opts TLSClientOptions) (*tls.Config, error) {
+	// create client tls config
+	cfg := &tls.Config{
+		MinVersion: tls.VersionTLS12,
+	}
+
+	// load client cert if specified
+	if opts.Certificate != "" {
+		cert, err := tls.LoadX509KeyPair(opts.Certificate, opts.Key)
+		if err != nil {
+			return nil, fmt.Errorf("tls client cert: %w", err)
+		}
+		cfg.Certificates = []tls.Certificate{cert}
+	} else if opts.LoadedCertificate != nil {
+		block := pem.Block{Type: "CERTIFICATE", Bytes: opts.LoadedCertificate.Raw}
+		certPem := pem.EncodeToMemory(&block)
+
+		// PKCS#8 covers RSA, ECDSA, Ed25519, X25519 (the key types tls.X509KeyPair
+		// understands) and pairs with the canonical "PRIVATE KEY" PEM label.
+		keyBytes, err := x509.MarshalPKCS8PrivateKey(opts.LoadedKey)
+		if err != nil {
+			return nil, fmt.Errorf("tls client priv key: %w", err)
+		}
+
+		block = pem.Block{Type: "PRIVATE KEY", Bytes: keyBytes}
+		keyPem := pem.EncodeToMemory(&block)
+
+		cert, err := tls.X509KeyPair(certPem, keyPem)
+		if err != nil {
+			return nil, fmt.Errorf("tls client cert: %w", err)
+		}
+		cfg.Certificates = []tls.Certificate{cert}
+	}
+
+	cfg.InsecureSkipVerify = opts.InsecureSkipVerify
+
+	cfg.VerifyPeerCertificate = opts.VerifyPeerCertificate
+	cfg.VerifyConnection = opts.VerifyConnection
+	cfg.SessionTicketsDisabled = opts.SessionTicketsDisabled
+	cfg.ClientSessionCache = opts.ClientSessionCache
+
+	// When no CA certificate is provided, default to the system cert pool
+	// that way when a request is made to a server known by the system trust store,
+	// the name is still verified
+	switch {
+	case opts.LoadedCA != nil:
+		caCertPool := basePool(opts.LoadedCAPool)
+		caCertPool.AddCert(opts.LoadedCA)
+		cfg.RootCAs = caCertPool
+	case opts.CA != "":
+		// load ca cert
+		caCert, err := os.ReadFile(opts.CA)
+		if err != nil {
+			return nil, fmt.Errorf("tls client ca: %w", err)
+		}
+		caCertPool := basePool(opts.LoadedCAPool)
+		caCertPool.AppendCertsFromPEM(caCert)
+		cfg.RootCAs = caCertPool
+	case opts.LoadedCAPool != nil:
+		cfg.RootCAs = opts.LoadedCAPool
+	}
+
+	// apply servername override
+	if opts.ServerName != "" {
+		cfg.InsecureSkipVerify = false
+		cfg.ServerName = opts.ServerName
+	}
+
+	return cfg, nil
+}
+
+// TLSTransport creates a [http.RoundTripper] for a client transport,suitable for mutual TLS auth.
+func TLSTransport(opts TLSClientOptions) (http.RoundTripper, error) {
+	cfg, err := TLSClientAuth(opts)
+	if err != nil {
+		return nil, err
+	}
+
+	return &http.Transport{TLSClientConfig: cfg}, nil
+}
+
+// TLSClient creates a [http.Client] for mutual auth.
+func TLSClient(opts TLSClientOptions) (*http.Client, error) {
+	transport, err := TLSTransport(opts)
+	if err != nil {
+		return nil, err
+	}
+	return &http.Client{Transport: transport}, nil
+}
+
+// basePool returns pool if non-nil; otherwise it returns a new empty cert pool.
+//
+// Clones the pool provided up front by the caller.
+func basePool(pool *x509.CertPool) *x509.CertPool {
+	if pool == nil {
+		return x509.NewCertPool()
+	}
+
+	return pool.Clone()
+}
diff --git a/vendor/github.com/go-openapi/runtime/client_response.go b/vendor/github.com/go-openapi/runtime/client_response.go
index 92668db4ec..7b4b7e40df 100644
--- a/vendor/github.com/go-openapi/runtime/client_response.go
+++ b/vendor/github.com/go-openapi/runtime/client_response.go
@@ -59,7 +59,7 @@ func (o *APIError) Error() string {
 	if err, ok := o.Response.(error); ok {
 		resp = []byte("'" + sanitizer.Replace(err.Error()) + "'")
 	} else {
-		resp, _ = json.Marshal(o.Response)
+		resp, _ = json.Marshal(o.Response) //nolint:errchkjson // error swallowed as this is our last best effort attempt
 	}
 
 	return fmt.Sprintf("%s (status %d): %s", o.OperationName, o.Code, resp)
diff --git a/vendor/github.com/go-openapi/runtime/constants.go b/vendor/github.com/go-openapi/runtime/constants.go
index 80de6c8086..ea86cfadbc 100644
--- a/vendor/github.com/go-openapi/runtime/constants.go
+++ b/vendor/github.com/go-openapi/runtime/constants.go
@@ -21,8 +21,12 @@ const (
 	DefaultMime = "application/octet-stream"
 	// JSONMime the json mime type.
 	JSONMime = "application/json"
-	// YAMLMime the [yaml] mime type.
-	YAMLMime = "application/x-yaml"
+	// YAMLMime the [yaml] mime type. Set to the canonical RFC 9512
+	// name (application/yaml). Legacy forms application/x-yaml,
+	// text/yaml, and text/x-yaml — per RFC 9512 §2.1 "Deprecated
+	// alias names for this type" — resolve to the same codec via
+	// the mediatype alias bridge.
+	YAMLMime = "application/yaml"
 	// XMLMime the [xml] mime type.
 	XMLMime = "application/xml"
 	// TextMime the text mime type.
diff --git a/vendor/github.com/go-openapi/runtime/csv.go b/vendor/github.com/go-openapi/runtime/csv.go
index 558d0cb99a..11d60872c3 100644
--- a/vendor/github.com/go-openapi/runtime/csv.go
+++ b/vendor/github.com/go-openapi/runtime/csv.go
@@ -100,7 +100,7 @@ func CSVConsumer(opts ...CSVOpt) Consumer {
 
 		default:
 			// support *[][]string, *[]byte, *string
-			if ptr := reflect.TypeOf(data); ptr.Kind() != reflect.Ptr {
+			if ptr := reflect.TypeOf(data); ptr.Kind() != reflect.Pointer {
 				return errors.New("destination must be a pointer")
 			}
 
@@ -159,14 +159,14 @@ func CSVConsumer(opts ...CSVOpt) Consumer {
 //
 // Supported input underlying types and interfaces, prioritized in this order:
 //
-// - *[csv.Reader]
-// - [CSVReader] (reader options are ignored)
-// - [io.Reader]
-// - [io.WriterTo]
-// - [encoding.BinaryMarshaler]
-// - [][]string
-// - []byte
-// - string
+//   - *[csv.Reader]
+//   - [CSVReader] (reader options are ignored)
+//   - [io.Reader]
+//   - [io.WriterTo]
+//   - [encoding.BinaryMarshaler]
+//   - [][]string
+//   - []byte
+//   - string
 //
 // The producer prioritizes situations where buffering the input is not required.
 func CSVProducer(opts ...CSVOpt) Producer {
diff --git a/vendor/github.com/go-openapi/runtime/file.go b/vendor/github.com/go-openapi/runtime/file.go
index 2a85379a74..0420db9440 100644
--- a/vendor/github.com/go-openapi/runtime/file.go
+++ b/vendor/github.com/go-openapi/runtime/file.go
@@ -5,4 +5,10 @@ package runtime
 
 import "github.com/go-openapi/swag/fileutils"
 
+// File represents an uploaded file. Re-exported from
+// [fileutils.File] for backwards compatibility.
+//
+// See [BindForm] (in form.go) for the orchestrator that parses
+// multipart / urlencoded request bodies and binds declared file
+// fields onto handler-side targets.
 type File = fileutils.File
diff --git a/vendor/github.com/go-openapi/runtime/form.go b/vendor/github.com/go-openapi/runtime/form.go
new file mode 100644
index 0000000000..2293920b32
--- /dev/null
+++ b/vendor/github.com/go-openapi/runtime/form.go
@@ -0,0 +1,307 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package runtime
+
+import (
+	stderrors "errors"
+	"fmt"
+	"mime/multipart"
+	"net/http"
+
+	"github.com/go-openapi/errors"
+)
+
+// DefaultMaxUploadFilenameLength is the default cap applied to
+// FileHeader.Filename for each declared file when [BindForm] is invoked
+// without an explicit [BindFormMaxFilenameLen] option.
+//
+// Multipart headers are allocated per part; an attacker submitting
+// multi-MB filenames inflates the parser's memory footprint. 1 KiB
+// matches the IETF guidance for sane filename length and is enough
+// for realistic uploads.
+const DefaultMaxUploadFilenameLength = 1024
+
+// DefaultMaxUploadBodySize limits the size of the body to upload forms to 32MB.
+//
+// Use an explicit [BindFormMaxBody] option to change this limit.
+const DefaultMaxUploadBodySize = int64(32) << 20
+
+// filenamePreviewLen caps the byte length of the FileHeader.Filename
+// preview embedded as the ParseError.Value field when the helper
+// rejects a too-long filename.
+const filenamePreviewLen = 32
+
+// ValidateFilenameLength enforces the FileHeader.Filename length cap
+// that [BindForm] applies via [BindFormFile] declarations. Untyped
+// binder paths that fetch the file via [http.Request.FormFile]
+// directly (rather than declaring the file through [BindFormFile]) call
+// this to opt into the same protection.
+//
+// Returns nil if filename length is within maxLen or maxLen <= 0.
+// Otherwise returns a [*errors.ParseError] suitable for direct return
+// from a parameter binder. The error embeds a truncated preview of
+// the offending filename to keep the error message bounded.
+func ValidateFilenameLength(paramName, paramIn, filename string, maxLen int) error {
+	if maxLen <= 0 || len(filename) <= maxLen {
+		return nil
+	}
+	preview := filename[:min(len(filename), filenamePreviewLen)]
+	return errors.NewParseError(paramName, paramIn, preview,
+		fmt.Errorf("filename length %d exceeds limit %d", len(filename), maxLen))
+}
+
+// FileBinder is the per-file callback invoked by [BindForm] when a
+// declared file field is present.
+//
+// The callback is responsible for BOTH validating the file (size, MIME, etc.) AND assigning the bound
+// file to its destination — typically using:
+//
+//	o.FieldName = &runtime.File{Data: file, Header: header}
+//
+// Returning a non-nil error surfaces the error in [BindForm]'s per-field
+// accumulator. Errors from the binder flow through verbatim — the
+// binder is expected to produce HTTP-aware errors (e.g.
+// [errors.ExceedsMaximum] from go-openapi/validate).
+type FileBinder func(file multipart.File, header *multipart.FileHeader) error
+
+// BindOption configures [BindForm]. The variadic style keeps simple
+// call sites simple and lets new knobs (security caps, additional
+// behaviour) be added without breaking the signature.
+type BindOption func(*bindConfig)
+
+type bindConfig struct {
+	maxParseMemory int64
+	maxBody        int64
+	maxFiles       int
+	maxFilenameLen int
+	files          []formFileSpec
+}
+
+type formFileSpec struct {
+	name     string
+	required bool
+	bind     FileBinder
+}
+
+// BindFormMaxParseMemory caps the in-memory portion of a multipart
+// body. Bytes beyond this are spilled to temporary files on disk by
+// the stdlib parser. 0 (the default) defers to the stdlib's 32 MB.
+//
+// This option does NOT cap total body bytes — see [BindFormMaxBody]
+// for that. The default body cap ([DefaultMaxUploadBodySize] = 32 MB)
+// is applied even when this option is not supplied, so out of the box
+// [BindForm] is bounded; callers with stricter or looser requirements
+// adjust via [BindFormMaxBody].
+func BindFormMaxParseMemory(n int64) BindOption {
+	return func(c *bindConfig) { c.maxParseMemory = n }
+}
+
+// BindFormMaxBody caps the size of the body read from a http form before parsing.
+//
+// The limit is set to 32MB by default. This default limit is applied for any n=0.
+//
+// The limit is disabled for n<0, assuming the caller has already capped the body size upstream.
+func BindFormMaxBody(n int64) BindOption {
+	return func(c *bindConfig) { c.maxBody = n }
+}
+
+// BindFormMaxFiles rejects parses where the total number of file
+// parts across all field names exceeds n. 0 (the default) means no
+// cap. Exceeding the cap is a fatal error — [BindForm] returns
+// fatal=true and no per-file binders run.
+func BindFormMaxFiles(n int) BindOption {
+	return func(c *bindConfig) { c.maxFiles = n }
+}
+
+// BindFormMaxFilenameLen rejects per-file headers whose Filename
+// length exceeds n. 0 means no cap; the default applied when this
+// option is not supplied is [DefaultMaxUploadFilenameLength]. The
+// cap is a per-field bind error (non-fatal); other declared files
+// still run.
+func BindFormMaxFilenameLen(n int) BindOption {
+	return func(c *bindConfig) { c.maxFilenameLen = n }
+}
+
+// BindFormFile declares a file field to bind under the given form
+// name. If required is true and the field is absent, [BindForm]
+// produces the per-field error.
+//
+//	errors.NewParseError(name, "formData", "", http.ErrMissingFile)
+//
+// If required is false, absence is silent (no error, no bind).
+//
+// The bind callback runs only when the field is present. It is the
+// site where both validation and assignment happen — see [FileBinder].
+//
+// FileHeader.Filename is attacker-controlled text; the binder MUST
+// NOT use it directly as a filesystem path. The helper does not
+// touch the filesystem.
+func BindFormFile(name string, required bool, bind FileBinder) BindOption {
+	return func(c *bindConfig) {
+		c.files = append(c.files, formFileSpec{
+			name:     name,
+			required: required,
+			bind:     bind,
+		})
+	}
+}
+
+// BindForm parses r as multipart/form-data, falling back to
+// application/x-www-form-urlencoded when the request is not
+// multipart. On success, r.MultipartForm and r.PostForm are populated;
+// the caller can read non-file form values via [Values](r.Form) after
+// the call returns.
+//
+// All errors produced by BindForm itself (parse failure, missing
+// required field, cap exceeded) are [*errors.ParseError] values built
+// via [errors.NewParseError], matching the untyped
+// middleware/parameter.go path. Errors returned by per-file binders
+// flow through verbatim — binders own their HTTP-aware error shape.
+//
+// Per-file binders declared via [BindFormFile] run in declaration
+// order after a successful parse. Their errors are accumulated and
+// returned wrapped in [errors.CompositeValidationError]; the caller
+// typically appends the returned err to its own []error and continues
+// with non-file parameter binding.
+//
+// Return semantics:
+//
+//   - fatal=true, err!=nil: parse failure or a hard cap (e.g.
+//     [BindFormMaxFiles]) was exceeded. No per-file binders ran; the
+//     caller MUST return err immediately.
+//   - fatal=false, err!=nil: one or more per-file binders produced
+//     errors. The form parsed successfully; r.Form is populated. The
+//     caller appends err to its accumulator and continues.
+//   - fatal=false, err==nil: full success.
+//
+// fatal==true implies err!=nil.
+//
+// Defaults applied out of the box:
+//
+//   - Total body bytes capped at [DefaultMaxUploadBodySize] (32 MB)
+//     via [http.MaxBytesReader]. Adjust with [BindFormMaxBody]
+//     (negative n disables, when the caller has already capped the
+//     body upstream).
+//   - FileHeader.Filename length capped at
+//     [DefaultMaxUploadFilenameLength]. Adjust with
+//     [BindFormMaxFilenameLen].
+//
+// Caller responsibilities the helper does NOT cover:
+//
+//   - Set [http.Server.ReadTimeout] / [http.Server.IdleTimeout] to defend
+//     against slow-read attacks.
+//   - Decompress Content-Encoding: gzip request bodies upstream if
+//     the API accepts them, using a size-limited reader.
+//   - Treat FileHeader.Filename as untrusted user input; never use
+//     it directly as a filesystem path.
+func BindForm(r *http.Request, opts ...BindOption) (fatal bool, err error) {
+	cfg := bindConfig{
+		maxFilenameLen: DefaultMaxUploadFilenameLength,
+	}
+	for _, opt := range opts {
+		opt(&cfg)
+	}
+
+	if perr := parseFormBody(r, cfg.maxParseMemory, cfg.maxBody); perr != nil {
+		// Body-cap hit gets the 413 status; everything else maps to a
+		// 400 ParseError. parseFormBody returns the raw stdlib error
+		// in both cases — the HTTP-aware wrapping happens here.
+		var maxBytesErr *http.MaxBytesError
+		if stderrors.As(perr, &maxBytesErr) {
+			return true, errors.New(http.StatusRequestEntityTooLarge, "formData: %v", perr)
+		}
+		return true, errors.NewParseError("body", "formData", "", perr)
+	}
+
+	if cfg.maxFiles > 0 {
+		if got := countFileParts(r); got > cfg.maxFiles {
+			return true, errors.NewParseError("body", "formData", "",
+				fmt.Errorf("multipart form contains %d file parts, exceeds limit %d", got, cfg.maxFiles))
+		}
+	}
+
+	var bindErrs []error
+	for _, spec := range cfg.files {
+		if e := bindFormFile(r, spec, cfg.maxFilenameLen); e != nil {
+			bindErrs = append(bindErrs, e)
+		}
+	}
+	if len(bindErrs) > 0 {
+		return false, errors.CompositeValidationError(bindErrs...)
+	}
+	return false, nil
+}
+
+// parseFormBody parses the request body. Content-Type drives the
+// parser: multipart/form-data → r.ParseMultipartForm, everything else
+// → r.ParseForm (stdlib's parsePostForm only actually reads the body
+// when Content-Type is application/x-www-form-urlencoded, so calling
+// ParseForm is safe for unrecognised types).
+//
+// Caveat: ParseMultipartForm calls ParseForm internally and discards its error
+// when the body turns out not to be multipart, returning ErrNotMultipart instead
+// — the subsequent retry then short-circuits because r.PostForm is already
+// set. Content-type-based routing avoids the lossy detour.
+//
+// Returns the raw stdlib error on failure; the caller (BindForm)
+// handles HTTP-aware wrapping (413 for MaxBytesError, 400 ParseError
+// otherwise).
+//
+// maxMemory == 0 falls through to the stdlib default (32 MB).
+// maxBody == 0 defaults to DefaultMaxUploadBodySize; maxBody < 0
+// disables the body cap (caller has capped upstream).
+func parseFormBody(r *http.Request, maxMemory, maxBody int64) error {
+	if r.Body != nil && maxBody >= 0 {
+		if maxBody == 0 {
+			maxBody = DefaultMaxUploadBodySize
+		}
+		r.Body = http.MaxBytesReader(nil, r.Body, maxBody)
+	}
+
+	mt, _, _ := ContentType(r.Header)
+	if mt == MultipartFormMime {
+		//nolint:gosec // G120: false positive -- see below
+		// gosec doesn't track the Body.
+		// See https://github.com/securego/gosec/blob/de65614d10a6b84029e3e1215567b8ce7e490f23/testutils/g120_samples.go#L57
+		return r.ParseMultipartForm(maxMemory)
+	}
+	return r.ParseForm()
+}
+
+func countFileParts(r *http.Request) int {
+	if r.MultipartForm == nil {
+		return 0
+	}
+	var n int
+	for _, fhs := range r.MultipartForm.File {
+		n += len(fhs)
+	}
+
+	return n
+}
+
+func bindFormFile(r *http.Request, spec formFileSpec, maxFilenameLen int) error {
+	file, header, err := r.FormFile(spec.name)
+	if err != nil {
+		if stderrors.Is(err, http.ErrMissingFile) {
+			if spec.required {
+				return errors.New(http.StatusBadRequest, "formData: %v", http.ErrMissingFile)
+			}
+
+			return nil
+		}
+
+		return errors.NewParseError(spec.name, "formData", "", err)
+	}
+
+	if err := ValidateFilenameLength(spec.name, "formData", header.Filename, maxFilenameLen); err != nil {
+		return err
+	}
+
+	if spec.bind == nil {
+		return nil
+	}
+
+	return spec.bind(file, header)
+}
diff --git a/vendor/github.com/go-openapi/runtime/go.work b/vendor/github.com/go-openapi/runtime/go.work
index b4cd9e01e8..73479f9ad8 100644
--- a/vendor/github.com/go-openapi/runtime/go.work
+++ b/vendor/github.com/go-openapi/runtime/go.work
@@ -1,6 +1,8 @@
 use (
 	.
 	./client-middleware/opentracing
+	./docs/examples
+	./server-middleware
 )
 
-go 1.24.0
+go 1.25.0
diff --git a/vendor/github.com/go-openapi/runtime/go.work.sum b/vendor/github.com/go-openapi/runtime/go.work.sum
deleted file mode 100644
index b24a8cfaf9..0000000000
--- a/vendor/github.com/go-openapi/runtime/go.work.sum
+++ /dev/null
@@ -1,109 +0,0 @@
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
-github.com/go-openapi/errors v0.22.2/go.mod h1:+n/5UdIqdVnLIJ6Q9Se8HNGUXYaY6CN8ImWzfi/Gzp0=
-github.com/go-openapi/jsonpointer v0.22.0/go.mod h1:xt3jV88UtExdIkkL7NloURjRQjbeUgcxFblMjq2iaiU=
-github.com/go-openapi/jsonreference v0.21.1/go.mod h1:PWs8rO4xxTUqKGu+lEvvCxD5k2X7QYkKAepJyCmSTT8=
-github.com/go-openapi/swag v0.24.1/go.mod h1:sm8I3lCPlspsBBwUm1t5oZeWZS0s7m/A+Psg0ooRU0A=
-github.com/go-openapi/swag/cmdutils v0.24.0/go.mod h1:uxib2FAeQMByyHomTlsP8h1TtPd54Msu2ZDU/H5Vuf8=
-github.com/go-openapi/swag/conv v0.24.0/go.mod h1:jbn140mZd7EW2g8a8Y5bwm8/Wy1slLySQQ0ND6DPc2c=
-github.com/go-openapi/swag/fileutils v0.24.0/go.mod h1:3SCrCSBHyP1/N+3oErQ1gP+OX1GV2QYFSnrTbzwli90=
-github.com/go-openapi/swag/jsonname v0.24.0/go.mod h1:GXqrPzGJe611P7LG4QB9JKPtUZ7flE4DOVechNaDd7Q=
-github.com/go-openapi/swag/jsonutils v0.24.0/go.mod h1:vBowZtF5Z4DDApIoxcIVfR8v0l9oq5PpYRUuteVu6f0=
-github.com/go-openapi/swag/loading v0.24.0/go.mod h1:gShCN4woKZYIxPxbfbyHgjXAhO61m88tmjy0lp/LkJk=
-github.com/go-openapi/swag/mangling v0.24.0/go.mod h1:Jm5Go9LHkycsz0wfoaBDkdc4CkpuSnIEf62brzyCbhc=
-github.com/go-openapi/swag/netutils v0.24.0/go.mod h1:WRgiHcYTnx+IqfMCtu0hy9oOaPR0HnPbmArSRN1SkZM=
-github.com/go-openapi/swag/stringutils v0.24.0/go.mod h1:5nUXB4xA0kw2df5PRipZDslPJgJut+NjL7D25zPZ/4w=
-github.com/go-openapi/swag/typeutils v0.24.0/go.mod h1:q8C3Kmk/vh2VhpCLaoR2MVWOGP8y7Jc8l82qCTd1DYI=
-github.com/go-openapi/swag/yamlutils v0.24.0/go.mod h1:DpKv5aYuaGm/sULePoeiG8uwMpZSfReo1HR3Ik0yaG8=
-github.com/go-openapi/testify/enable/yaml/v2 v2.4.0/go.mod h1:14iV8jyyQlinc9StD7w1xVPW3CO3q1Gj04Jy//Kw4VM=
-github.com/go-openapi/testify/v2 v2.4.0/go.mod h1:HCPmvFFnheKK2BuwSA0TbbdxJ3I16pjwMkYkP4Ywn54=
-github.com/golang/snappy v0.0.1/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
-github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/klauspost/compress v1.13.6/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk=
-github.com/klauspost/compress v1.16.7/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
-github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
-github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
-github.com/montanaflynn/stats v0.0.0-20171201202039-1bf9dbcd8cbe/go.mod h1:wL8QJuTMNUDYhXwkmfOly8iTdp5TEcJFWZD2D7SIkUc=
-github.com/montanaflynn/stats v0.7.1/go.mod h1:etXPPgVO6n31NxCd9KQUMvCM+ve0ruNzt6R8Bnaayow=
-github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
-github.com/oklog/ulid v1.3.1 h1:EGfNDEx6MqHz8B3uNV6QAib1UR2Lm97sHi3ocA6ESJ4=
-github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
-github.com/pborman/getopt v0.0.0-20170112200414-7148bc3a4c30 h1:BHT1/DKsYDGkUgQ2jmMaozVcdk+sVfz0+1ZJq4zkWgw=
-github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
-github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
-github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
-github.com/stretchr/objx v0.1.0 h1:4G4v2dO3VZwixGIRoQ5Lfboy6nUhCyYzaqnIAPPhYs4=
-github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
-github.com/xdg-go/scram v1.1.2/go.mod h1:RT/sEzTbU5y00aCK8UOx6R7YryM0iF1N2MOmC3kKLN4=
-github.com/xdg-go/stringprep v1.0.4/go.mod h1:mPGuuIYwz7CmR2bT9j4GbQqutWS1zV24gijq1dTyGkM=
-github.com/youmark/pkcs8 v0.0.0-20181117223130-1be2e3e5546d/go.mod h1:rHwXgn7JulP+udvsHwJoVG1YGAP6VLg4y9I5dyZdqmA=
-github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78/go.mod h1:aL8wCCfTfSfmXjznFBSZNN13rSJjlIOI1fUNAtF7rmI=
-github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-go.mongodb.org/mongo-driver v1.17.6/go.mod h1:Hy04i7O2kC4RS06ZrhPRqj/u4DTYkFDAAccj+rVKqgQ=
-go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
-golang.org/x/crypto v0.26.0/go.mod h1:GY7jblb9wI+FOo5y8/S2oY4zWP07AkOJ4+jxCqdqn54=
-golang.org/x/crypto v0.42.0/go.mod h1:4+rDnOTJhQCx2q7/j6rAN5XDw8kPjeaXEUR2eL94ix8=
-golang.org/x/crypto v0.43.0/go.mod h1:BFbav4mRNlXJL4wNeejLpWxB7wMbc79PdRGhWKncxR0=
-golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
-golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
-golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.18.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.21.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
-golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
-golang.org/x/mod v0.28.0/go.mod h1:yfB/L0NOf/kmEbXjzCPOx1iK1fRutOydrCMsqRhEBxI=
-golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c=
-golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE=
-golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
-golang.org/x/net v0.45.0/go.mod h1:ECOoLqd5U3Lhyeyo/QDCEVQ4sNgYsqvCZ722XogGieY=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.26.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
-golang.org/x/telemetry v0.0.0-20240521205824-bda55230c457/go.mod h1:pRgIJT+bRLFKnoM1ldnzKoxTIn14Yxz928LQRYYgIN0=
-golang.org/x/telemetry v0.0.0-20250807160809-1a19826ec488/go.mod h1:fGb/2+tgXXjhjHsTNdVEEMZNWA0quBnfrO+AfoDSAKw=
-golang.org/x/telemetry v0.0.0-20260109210033-bd525da824e2/go.mod h1:b7fPSJ0pKZ3ccUh8gnTONJxhn3c/PS6tyzQvyqw4iA8=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.23.0/go.mod h1:DgV24QBUrK6jhZXl+20l6UWznPlwAHm1Q1mGHtydmSk=
-golang.org/x/term v0.35.0/go.mod h1:TPGtkTLesOwf2DE8CgVYiZinHAOuy5AYUYT1lENIZnA=
-golang.org/x/term v0.36.0/go.mod h1:Qu394IJq6V6dCBRgwqshf3mPF85AqzYEzofzRdZkWss=
-golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
-golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.17.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.22.0/go.mod h1:aCwcsjqvq7Yqt6TNyX7QMU2enbQ/Gt0bo6krSeEri+c=
-golang.org/x/tools v0.26.0/go.mod h1:TPVVj70c7JJ3WCazhD8OdXcZg/og+b9+tH/KxylGwH0=
-golang.org/x/tools v0.35.0/go.mod h1:NKdj5HkL/73byiZSJjqJgKn3ep7KjFkBOkR/Hps3VPw=
-golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
-golang.org/x/tools v0.37.0/go.mod h1:MBN5QPQtLMHVdvsbtarmTNukZDdgwdwlO5qGacAzF0w=
-golang.org/x/tools v0.41.0 h1:a9b8iMweWG+S0OBnlU36rzLp20z1Rp10w+IY2czHTQc=
-golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
diff --git a/vendor/github.com/go-openapi/runtime/interfaces.go b/vendor/github.com/go-openapi/runtime/interfaces.go
index a8b4b318d9..8521198907 100644
--- a/vendor/github.com/go-openapi/runtime/interfaces.go
+++ b/vendor/github.com/go-openapi/runtime/interfaces.go
@@ -99,3 +99,25 @@ type Validatable interface {
 type ContextValidatable interface {
 	ContextValidate(context.Context, strfmt.Registry) error
 }
+
+// ContentTyper is implemented by values that declare their own MIME
+// content type. The client runtime consults it in two places:
+//
+//   - on a body payload set via [SetBodyParam]: when the payload is a
+//     stream (io.Reader, io.ReadCloser) and ContentType returns a
+//     non-empty value, that value becomes the wire Content-Type
+//     header instead of the operation's picked consumes entry.
+//
+//   - on individual file values inside a multipart upload: their per-
+//     part Content-Type header is taken from ContentType() rather
+//     than sniffed via http.DetectContentType.
+//
+// An empty string return is treated as "no opinion" and the runtime
+// falls back to its default selection. Values that have no content
+// type to declare may simply not implement the interface.
+//
+// See docs/MEDIA_TYPES.md for the full client-side selection
+// algorithm.
+type ContentTyper interface {
+	ContentType() string
+}
diff --git a/vendor/github.com/go-openapi/runtime/middleware/context.go b/vendor/github.com/go-openapi/runtime/middleware/context.go
index 1f85e86b53..0942edef39 100644
--- a/vendor/github.com/go-openapi/runtime/middleware/context.go
+++ b/vendor/github.com/go-openapi/runtime/middleware/context.go
@@ -5,10 +5,9 @@ package middleware
 
 import (
 	stdContext "context"
+	stderrors "errors"
 	"fmt"
 	"net/http"
-	"net/url"
-	"path"
 	"strings"
 	"sync"
 
@@ -17,19 +16,21 @@ import (
 	"github.com/go-openapi/loads"
 	"github.com/go-openapi/spec"
 	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag/typeutils"
 
 	"github.com/go-openapi/runtime"
 	"github.com/go-openapi/runtime/logger"
 	"github.com/go-openapi/runtime/middleware/untyped"
 	"github.com/go-openapi/runtime/security"
+	"github.com/go-openapi/runtime/server-middleware/docui"
+	"github.com/go-openapi/runtime/server-middleware/mediatype"
+	"github.com/go-openapi/runtime/server-middleware/negotiate"
 )
 
 // Debug when true turns on verbose logging.
 var Debug = logger.DebugEnabled()
 
 // Logger is the standard library logger used for printing debug messages.
-//
-// (Note: The correct spelling is "library", not "libra". "Libra" is a zodiac sign/constellation and wouldn't make sense in this context.)
 var Logger logger.Logger = logger.StandardLogger{}
 
 func debugLogfFunc(lg logger.Logger) func(string, ...any) {
@@ -75,11 +76,103 @@ func (fn ResponderFunc) WriteResponse(rw http.ResponseWriter, pr runtime.Produce
 // used throughout to store request context with the standard context attached
 // to the [http.Request].
 type Context struct {
-	spec      *loads.Document
-	analyzer  *analysis.Spec
-	api       RoutableAPI
-	router    Router
-	debugLogf func(string, ...any) // a logging function to debug context and all components using it
+	spec             *loads.Document
+	analyzer         *analysis.Spec
+	api              RoutableAPI
+	router           Router
+	debugLogf        func(string, ...any) // a logging function to debug context and all components using it
+	ignoreParameters bool                 // see SetIgnoreParameters / WithIgnoreParameters
+	matchSuffix      bool                 // see SetMatchSuffix / WithMatchSuffix
+}
+
+// NewRoutableContext creates a new context for a routable API.
+//
+// If a nil Router is provided, the [DefaultRouter] ([denco]-based) will be used.
+func NewRoutableContext(spec *loads.Document, routableAPI RoutableAPI, routes Router) *Context {
+	var an *analysis.Spec
+	if spec != nil {
+		an = analysis.New(spec.Spec())
+	}
+
+	return NewRoutableContextWithAnalyzedSpec(spec, an, routableAPI, routes)
+}
+
+// NewRoutableContextWithAnalyzedSpec is like [NewRoutableContext] but takes as input an already analysed spec.
+//
+// If a nil Router is provided, the [DefaultRouter] ([denco]-based) will be used.
+func NewRoutableContextWithAnalyzedSpec(spec *loads.Document, an *analysis.Spec, routableAPI RoutableAPI, routes Router) *Context {
+	// Either there are no spec doc and analysis, or both of them.
+	if (spec != nil || an != nil) && (spec == nil || an == nil) {
+		panic(fmt.Errorf("%d: %s", http.StatusInternalServerError, "routable context requires either both spec doc and analysis, or none of them"))
+	}
+
+	return &Context{
+		spec:      spec,
+		api:       routableAPI,
+		analyzer:  an,
+		router:    routes,
+		debugLogf: debugLogfFunc(nil),
+	}
+}
+
+// NewContext creates a new context wrapper.
+//
+// If a nil Router is provided, the [DefaultRouter] ([denco]-based) will be used.
+func NewContext(spec *loads.Document, api *untyped.API, routes Router) *Context {
+	var an *analysis.Spec
+	if spec != nil {
+		an = analysis.New(spec.Spec())
+	}
+	ctx := &Context{
+		spec:      spec,
+		analyzer:  an,
+		router:    routes,
+		debugLogf: debugLogfFunc(nil),
+	}
+	ctx.api = newRoutableUntypedAPI(spec, api, ctx)
+
+	return ctx
+}
+
+// Serve serves the specified spec with the specified api registrations as a [http.Handler].
+func Serve(spec *loads.Document, api *untyped.API) http.Handler {
+	return ServeWithBuilder(spec, api, PassthroughBuilder)
+}
+
+// SetIgnoreParameters toggles the legacy parameter-stripping behaviour for
+// Accept negotiation server-wide. When set, every internal call to
+// [NegotiateContentType] from this Context applies [WithIgnoreParameters].
+//
+// Returns the receiver for fluent configuration:
+//
+//	ctx := middleware.NewContext(spec, api, nil).SetIgnoreParameters(true)
+//
+// See [WithIgnoreParameters] for the rationale and an example.
+func (c *Context) SetIgnoreParameters(ignore bool) *Context {
+	c.ignoreParameters = ignore
+
+	return c
+}
+
+// SetMatchSuffix toggles RFC 6839 structured-syntax suffix tolerance
+// server-wide. When enabled, both Accept negotiation and codec lookup
+// fall back through the suffix base for the recognised suffixes
+// (+json, +xml, +yaml) — so an operation declaring
+// consumes: [application/json] also accepts request bodies sent with
+// Content-Type: application/vnd.api+json (or any other +json variant).
+//
+// Default: strict (false). Use only when interoperating with clients
+// that do not strictly abide by the spec.
+//
+// Returns the receiver for fluent configuration:
+//
+//	ctx := middleware.NewContext(spec, api, nil).SetMatchSuffix(true)
+//
+// See [negotiate.WithMatchSuffix] for the per-call form and rationale.
+func (c *Context) SetMatchSuffix(enable bool) *Context {
+	c.matchSuffix = enable
+
+	return c
 }
 
 type routableUntypedAPI struct {
@@ -95,53 +188,57 @@ func newRoutableUntypedAPI(spec *loads.Document, api *untyped.API, context *Cont
 	if spec == nil || api == nil {
 		return nil
 	}
+
 	analyzer := analysis.New(spec.Spec())
 	for method, hls := range analyzer.Operations() {
 		um := strings.ToUpper(method)
 		for path, op := range hls {
 			schemes := analyzer.SecurityRequirementsFor(op)
 
-			if oh, ok := api.OperationHandlerFor(method, path); ok {
-				if handlers == nil {
-					handlers = make(map[string]map[string]http.Handler)
+			oh, ok := api.OperationHandlerFor(method, path)
+			if !ok {
+				continue
+			}
+
+			if handlers == nil {
+				handlers = make(map[string]map[string]http.Handler)
+			}
+			if b, ok := handlers[um]; !ok || b == nil {
+				handlers[um] = make(map[string]http.Handler)
+			}
+
+			var handler http.Handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				// lookup route info in the context
+				route, rCtx, _ := context.RouteInfo(r)
+				if rCtx != nil {
+					r = rCtx
 				}
-				if b, ok := handlers[um]; !ok || b == nil {
-					handlers[um] = make(map[string]http.Handler)
+
+				// bind and validate the request using reflection
+				var bound any
+				var validation error
+				bound, r, validation = context.BindAndValidate(r, route)
+				if validation != nil {
+					context.Respond(w, r, route.Produces, route, validation)
+					return
 				}
 
-				var handler http.Handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-					// lookup route info in the context
-					route, rCtx, _ := context.RouteInfo(r)
-					if rCtx != nil {
-						r = rCtx
-					}
-
-					// bind and validate the request using reflection
-					var bound any
-					var validation error
-					bound, r, validation = context.BindAndValidate(r, route)
-					if validation != nil {
-						context.Respond(w, r, route.Produces, route, validation)
-						return
-					}
-
-					// actually handle the request
-					result, err := oh.Handle(bound)
-					if err != nil {
-						// respond with failure
-						context.Respond(w, r, route.Produces, route, err)
-						return
-					}
-
-					// respond with success
-					context.Respond(w, r, route.Produces, route, result)
-				})
-
-				if len(schemes) > 0 {
-					handler = newSecureAPI(context, handler)
+				// actually handle the request
+				result, err := oh.Handle(bound)
+				if err != nil {
+					// respond with failure
+					context.Respond(w, r, route.Produces, route, err)
+					return
 				}
-				handlers[um][path] = handler
+
+				// respond with success
+				context.Respond(w, r, route.Produces, route, result)
+			})
+
+			if len(schemes) > 0 {
+				handler = newSecureAPI(context, handler)
 			}
+			handlers[um][path] = handler
 		}
 	}
 
@@ -192,60 +289,6 @@ func (r *routableUntypedAPI) DefaultConsumes() string {
 	return r.defaultConsumes
 }
 
-// NewRoutableContext creates a new context for a routable API.
-//
-// If a nil Router is provided, the [DefaultRouter] ([denco]-based) will be used.
-func NewRoutableContext(spec *loads.Document, routableAPI RoutableAPI, routes Router) *Context {
-	var an *analysis.Spec
-	if spec != nil {
-		an = analysis.New(spec.Spec())
-	}
-
-	return NewRoutableContextWithAnalyzedSpec(spec, an, routableAPI, routes)
-}
-
-// NewRoutableContextWithAnalyzedSpec is like [NewRoutableContext] but takes as input an already analysed spec.
-//
-// If a nil Router is provided, the [DefaultRouter] ([denco]-based) will be used.
-func NewRoutableContextWithAnalyzedSpec(spec *loads.Document, an *analysis.Spec, routableAPI RoutableAPI, routes Router) *Context {
-	// Either there are no spec doc and analysis, or both of them.
-	if (spec != nil || an != nil) && (spec == nil || an == nil) {
-		panic(fmt.Errorf("%d: %s", http.StatusInternalServerError, "routable context requires either both spec doc and analysis, or none of them"))
-	}
-
-	return &Context{
-		spec:      spec,
-		api:       routableAPI,
-		analyzer:  an,
-		router:    routes,
-		debugLogf: debugLogfFunc(nil),
-	}
-}
-
-// NewContext creates a new context wrapper.
-//
-// If a nil Router is provided, the [DefaultRouter] ([denco]-based) will be used.
-func NewContext(spec *loads.Document, api *untyped.API, routes Router) *Context {
-	var an *analysis.Spec
-	if spec != nil {
-		an = analysis.New(spec.Spec())
-	}
-	ctx := &Context{
-		spec:      spec,
-		analyzer:  an,
-		router:    routes,
-		debugLogf: debugLogfFunc(nil),
-	}
-	ctx.api = newRoutableUntypedAPI(spec, api, ctx)
-
-	return ctx
-}
-
-// Serve serves the specified spec with the specified api registrations as a [http.Handler].
-func Serve(spec *loads.Document, api *untyped.API) http.Handler {
-	return ServeWithBuilder(spec, api, PassthroughBuilder)
-}
-
 // ServeWithBuilder serves the specified spec with the specified api registrations as a [http.Handler] that is decorated
 // by the Builder.
 func ServeWithBuilder(spec *loads.Document, api *untyped.API, builder Builder) http.Handler {
@@ -319,57 +362,42 @@ func (c *Context) RequiredProduces() []string {
 // BindValidRequest binds a params object to a request but only when the request is valid
 // if the request is not valid an error will be returned.
 func (c *Context) BindValidRequest(request *http.Request, route *MatchedRoute, binder RequestBinder) error {
-	var res []error
 	var requestContentType string
 
 	// check and validate content type, select consumer
 	if runtime.HasBody(request) {
-		ct, _, err := runtime.ContentType(request.Header)
+		ct, cons, err := c.bindRequestBody(request, route)
 		if err != nil {
-			res = append(res, err)
-		} else {
-			c.debugLogf("validating content type for %q against [%s]", ct, strings.Join(route.Consumes, ", "))
-			if err := validateContentType(route.Consumes, ct); err != nil {
-				res = append(res, err)
-			}
-			if len(res) == 0 {
-				cons, ok := route.Consumers[ct]
-				if !ok {
-					res = append(res, errors.New(http.StatusInternalServerError, "no consumer registered for %s", ct))
-				} else {
-					route.Consumer = cons
-					requestContentType = ct
-				}
-			}
+			return errors.CompositeValidationError(err)
 		}
+
+		// happy path
+		requestContentType = ct
+		route.Consumer = cons
 	}
 
 	// check and validate the response format
-	if len(res) == 0 {
-		// if the route does not provide Produces and a default contentType could not be identified
-		// based on a body, typical for GET and DELETE requests, then default contentType to.
-		if len(route.Produces) == 0 && requestContentType == "" {
-			requestContentType = "*/*"
-		}
+	// if the route does not provide Produces and a default contentType could not be identified
+	// based on a body, typical for GET and DELETE requests, then default contentType to.
+	if len(route.Produces) == 0 && requestContentType == "" {
+		requestContentType = "*/*"
+	}
 
-		if str := NegotiateContentType(request, route.Produces, requestContentType); str == "" {
-			res = append(res, errors.InvalidResponseFormat(request.Header.Get(runtime.HeaderAccept), route.Produces))
-		}
+	str := negotiate.ContentType(request, route.Produces, requestContentType, c.negotiateOpts()...)
+	if str == "" {
+		return errors.CompositeValidationError(
+			errors.InvalidResponseFormat(request.Header.Get(runtime.HeaderAccept), route.Produces),
+		)
+	}
+
+	if binder == nil {
+		return nil
 	}
 
 	// now bind the request with the provided binder
 	// it's assumed the binder will also validate the request and return an error if the
 	// request is invalid
-	if binder != nil && len(res) == 0 {
-		if err := binder.BindRequest(request, route); err != nil {
-			return err
-		}
-	}
-
-	if len(res) > 0 {
-		return errors.CompositeValidationError(res...)
-	}
-	return nil
+	return binder.BindRequest(request, route)
 }
 
 // ContentType gets the parsed value of a content type
@@ -431,7 +459,7 @@ func (c *Context) ResponseFormat(r *http.Request, offers []string) (string, *htt
 		return v, r
 	}
 
-	format := NegotiateContentType(r, offers, "")
+	format := negotiate.ContentType(r, offers, "", c.negotiateOpts()...)
 	if format != "" {
 		c.debugLogf("[%s %s] set response format %q in context", r.Method, r.URL.Path, format)
 		r = r.WithContext(stdContext.WithValue(rCtx, ctxResponseFormat, format))
@@ -453,7 +481,8 @@ func (c *Context) ResetAuth(request *http.Request) *http.Request {
 	return request.WithContext(rctx)
 }
 
-// Authorize authorizes the request
+// Authorize authorizes the request.
+//
 // Returns the principal object and a shallow copy of the request when its
 // context doesn't contain the principal, otherwise the same request or an error
 // (the last) if one of the authenticators returns one or an Unauthenticated error.
@@ -468,7 +497,7 @@ func (c *Context) Authorize(request *http.Request, route *MatchedRoute) (any, *h
 	}
 
 	applies, usr, err := route.Authenticators.Authenticate(request, route)
-	if !applies || err != nil || !route.Authenticators.AllowsAnonymous() && usr == nil {
+	if !applies || err != nil || !route.Authenticators.AllowsAnonymous() && typeutils.IsZero(usr) {
 		if err != nil {
 			return nil, nil, err
 		}
@@ -476,7 +505,8 @@ func (c *Context) Authorize(request *http.Request, route *MatchedRoute) (any, *h
 	}
 	if route.Authorizer != nil {
 		if err := route.Authorizer.Authorize(request, usr); err != nil {
-			if _, ok := err.(errors.Error); ok {
+			var apiError errors.Error
+			if stderrors.As(err, &apiError) {
 				return nil, nil, err
 			}
 
@@ -523,91 +553,29 @@ func (c *Context) NotFound(rw http.ResponseWriter, r *http.Request) {
 // Respond renders the response after doing some content negotiation.
 func (c *Context) Respond(rw http.ResponseWriter, r *http.Request, produces []string, route *MatchedRoute, data any) {
 	c.debugLogf("responding to %s %s with produces: %v", r.Method, r.URL.Path, produces)
-	offers := []string{}
-	for _, mt := range produces {
-		if mt != c.api.DefaultProduces() {
-			offers = append(offers, mt)
-		}
-	}
-	// the default producer is last so more specific producers take precedence
-	offers = append(offers, c.api.DefaultProduces())
-	c.debugLogf("offers: %v", offers)
+	offers := c.buildOffers(produces)
 
 	var format string
 	format, r = c.ResponseFormat(r, offers)
 	rw.Header().Set(runtime.HeaderContentType, format)
 
 	if resp, ok := data.(Responder); ok {
-		producers := route.Producers
-		// producers contains keys with normalized format, if a format has MIME type parameter such as `text/plain; charset=utf-8`
-		// then you must provide `text/plain` to get the correct producer. HOWEVER, format here is not normalized.
-		prod, ok := producers[normalizeOffer(format)]
-		if !ok {
-			prods := c.api.ProducersFor(normalizeOffers([]string{c.api.DefaultProduces()}))
-			pr, ok := prods[c.api.DefaultProduces()]
-			if !ok {
-				panic(fmt.Errorf("%d: %s", http.StatusInternalServerError, cantFindProducer(format)))
-			}
-			prod = pr
-		}
-		resp.WriteResponse(rw, prod)
+		c.respondWithResponder(rw, r, route, resp, format)
 		return
 	}
 
 	if err, ok := data.(error); ok {
-		if format == "" {
-			rw.Header().Set(runtime.HeaderContentType, runtime.JSONMime)
-		}
-
-		if realm := security.FailedBasicAuth(r); realm != "" {
-			rw.Header().Set("WWW-Authenticate", fmt.Sprintf("Basic realm=%q", realm))
-		}
-
-		if route == nil || route.Operation == nil {
-			c.api.ServeErrorFor("")(rw, r, err)
-			return
-		}
-		c.api.ServeErrorFor(route.Operation.ID)(rw, r, err)
+		c.respondWithError(rw, r, produces, route, err, format)
 		return
 	}
 
 	if route == nil || route.Operation == nil {
-		rw.WriteHeader(http.StatusOK)
-		if r.Method == http.MethodHead {
-			return
-		}
-		producers := c.api.ProducersFor(normalizeOffers(offers))
-		prod, ok := producers[format]
-		if !ok {
-			panic(fmt.Errorf("%d: %s", http.StatusInternalServerError, cantFindProducer(format)))
-		}
-		if err := prod.Produce(rw, data); err != nil {
-			panic(err) // let the recovery middleware deal with this
-		}
+		c.respondWithoutCode(rw, r, data, format, offers)
 		return
 	}
 
 	if _, code, ok := route.Operation.SuccessResponse(); ok {
-		rw.WriteHeader(code)
-		if code == http.StatusNoContent || r.Method == http.MethodHead {
-			return
-		}
-
-		producers := route.Producers
-		prod, ok := producers[format]
-		if !ok {
-			if !ok {
-				prods := c.api.ProducersFor(normalizeOffers([]string{c.api.DefaultProduces()}))
-				pr, ok := prods[c.api.DefaultProduces()]
-				if !ok {
-					panic(fmt.Errorf("%d: %s", http.StatusInternalServerError, cantFindProducer(format)))
-				}
-				prod = pr
-			}
-		}
-		if err := prod.Produce(rw, data); err != nil {
-			panic(err) // let the recovery middleware deal with this
-		}
+		c.respondWithCode(rw, r, route, code, data, format)
 		return
 	}
 
@@ -618,57 +586,76 @@ func (c *Context) Respond(rw http.ResponseWriter, r *http.Request, produces []st
 //
 // This handler includes a swagger spec, router and the contract defined in the swagger spec.
 //
-// A spec UI ([SwaggerUI]) is served at {API base path}/docs and the spec document at /swagger.json
-// (these can be modified with uiOptions).
+// A spec UI ([docui.SwaggerUI]) is served at {API base path}/docs and the spec document at /swagger.json
+// (these can be modified with combined [UIOption]).
+//
+// Deprecated: use [Context.APIHandlerWithUI] with [docui.SwaggerUI] middleware instead.
 func (c *Context) APIHandlerSwaggerUI(builder Builder, opts ...UIOption) http.Handler {
-	b := builder
-	if b == nil {
-		b = PassthroughBuilder
-	}
-
-	specPath, uiOpts, specOpts := c.uiOptionsForHandler(opts)
-	var swaggerUIOpts SwaggerUIOpts
-	fromCommonToAnyOptions(uiOpts, &swaggerUIOpts)
-
-	return Spec(specPath, c.spec.Raw(), SwaggerUI(swaggerUIOpts, c.RoutesHandler(b)), specOpts...)
+	return c.APIHandlerWithUI(builder, docui.UseSwaggerUI, c.uiOptionsForHandler(opts)...)
 }
 
 // APIHandlerRapiDoc returns a handler to serve the API.
 //
 // This handler includes a swagger spec, router and the contract defined in the swagger spec.
 //
-// A spec UI ([RapiDoc]) is served at {API base path}/docs and the spec document at /swagger.json
-// (these can be modified with uiOptions).
+// A spec UI ([docui.RapiDoc]) is served at {API base path}/docs and the spec document at /swagger.json
+// (these can be modified with combined [UIOption]).
+//
+// Deprecated: use [Context.APIHandlerWithUI] with [docui.UseRapiDoc] middleware instead.
 func (c *Context) APIHandlerRapiDoc(builder Builder, opts ...UIOption) http.Handler {
-	b := builder
-	if b == nil {
-		b = PassthroughBuilder
-	}
-
-	specPath, uiOpts, specOpts := c.uiOptionsForHandler(opts)
-	var rapidocUIOpts RapiDocOpts
-	fromCommonToAnyOptions(uiOpts, &rapidocUIOpts)
-
-	return Spec(specPath, c.spec.Raw(), RapiDoc(rapidocUIOpts, c.RoutesHandler(b)), specOpts...)
+	return c.APIHandlerWithUI(builder, docui.UseRapiDoc, c.uiOptionsForHandler(opts)...)
 }
 
 // APIHandler returns a handler to serve the API.
 //
 // This handler includes a swagger spec, router and the contract defined in the swagger spec.
 //
-// A spec UI ([Redoc]) is served at {API base path}/docs and the spec document at /swagger.json
-// (these can be modified with uiOptions).
+// A spec UI ([docui.Redoc]) is served at {API base path}/docs and the spec document at /swagger.json
+// (these can be modified with combined [UIOption]).
+//
+// Notice that you may use [Context.APIHandlerWithUI] to use an alternate UI-serving middleware.
 func (c *Context) APIHandler(builder Builder, opts ...UIOption) http.Handler {
+	return c.APIHandlerWithUI(builder, docui.UseRedoc, c.uiOptionsForHandler(opts)...)
+}
+
+// APIHandlerWithUI returns a handler to serve the API with a swagger spec and a UI.
+//
+// This handler includes a swagger spec, router and the contract defined in the swagger spec.
+//
+// A spec UI is served at {API base path}/docs and the spec document at /swagger.json
+// (these can be modified with combined [UIOption]).
+//
+// Notice that any function that accepts the [docui.Option] set and returns a valid middleware may be injected here.
+//
+// [Context.APIHandlerWithUI] extends [Context.APIHandler], and supersedes [Context.APIHandlerRapiDoc] and [Context.APIHandlerSwaggerUI].
+func (c *Context) APIHandlerWithUI(builder Builder, uiMiddleware docui.UIMiddleware, opts ...docui.Option) http.Handler {
 	b := builder
 	if b == nil {
 		b = PassthroughBuilder
 	}
 
-	specPath, uiOpts, specOpts := c.uiOptionsForHandler(opts)
-	var redocOpts RedocOpts
-	fromCommonToAnyOptions(uiOpts, &redocOpts)
+	// the UI titles defaults to the title in the spec
+	const extraOptions = 2
+	prepend := make([]docui.Option, 0, len(opts)+extraOptions)
+	var title string
+
+	sp := c.spec.Spec()
+	if sp != nil && sp.Info != nil && sp.Info.Title != "" {
+		title = sp.Info.Title
+	}
+	if title != "" {
+		prepend = append(prepend, docui.WithUITitle(title))
+	}
+
+	prepend = append(prepend, docui.WithUIBasePath(c.BasePath()))
+	prepend = append(prepend, opts...)
 
-	return Spec(specPath, c.spec.Raw(), Redoc(redocOpts, c.RoutesHandler(b)), specOpts...)
+	// aligns spec serve path with UI setting to fetch spec document.
+	return docui.UseSpec(c.spec.Raw(), docui.WithSpecPathFromOptions(prepend...))(
+		uiMiddleware(prepend...)(
+			c.RoutesHandler(b),
+		),
+	)
 }
 
 // RoutesHandler returns a handler to serve the API, just the routes and the contract defined in the swagger spec.
@@ -680,37 +667,149 @@ func (c *Context) RoutesHandler(builder Builder) http.Handler {
 	return NewRouter(c, b(NewOperationExecutor(c)))
 }
 
-func (c Context) uiOptionsForHandler(opts []UIOption) (string, uiOptions, []SpecOption) {
-	var title string
-	sp := c.spec.Spec()
-	if sp != nil && sp.Info != nil && sp.Info.Title != "" {
-		title = sp.Info.Title
+func (c *Context) bindRequestBody(request *http.Request, route *MatchedRoute) (string, runtime.Consumer, error) {
+	ct, _, err := runtime.ContentType(request.Header)
+	if err != nil {
+		return "", nil, err
 	}
 
-	// default options (may be overridden)
-	const baseOptions = 2
-	optsForContext := make([]UIOption, 0, len(opts)+baseOptions)
-	optsForContext = append(optsForContext,
-		WithUIBasePath(c.BasePath()),
-		WithUITitle(title),
-	)
-	optsForContext = append(optsForContext, opts...)
-	uiOpts := uiOptionsWithDefaults(optsForContext)
+	c.debugLogf("validating content type for %q against [%s]", ct, strings.Join(route.Consumes, ", "))
+	if err := validateContentType(route.Consumes, ct); err != nil {
+		return "", nil, err
+	}
+
+	cons, ok := mediatype.Lookup(route.Consumers, ct, c.matchOpts()...)
+	if !ok {
+		return "", nil, errors.New(http.StatusInternalServerError, "no consumer registered for %s", ct)
+	}
+
+	return ct, cons, nil
+}
+
+func (c *Context) respondWithResponder(rw http.ResponseWriter, r *http.Request, route *MatchedRoute, resp Responder, format string) {
+	_ = r
+	producers := route.Producers
+
+	// producers contains keys with normalized format, if a format has MIME type parameter such as `text/plain; charset=utf-8`
+	// then you must provide `text/plain` to get the correct producer. HOWEVER, format here is not normalized.
+	prod, ok := producers[normalizeOffer(format)]
+	if !ok {
+		prods := c.api.ProducersFor(normalizeOffers([]string{c.api.DefaultProduces()}))
+		pr, ok := prods[c.api.DefaultProduces()]
+		if !ok {
+			panic(fmt.Errorf("%d: %s", http.StatusInternalServerError, cantFindProducer(format)))
+		}
+		prod = pr
+	}
+
+	resp.WriteResponse(rw, prod)
+}
+
+func (c *Context) respondWithError(rw http.ResponseWriter, r *http.Request, produces []string, route *MatchedRoute, err error, format string) {
+	_ = produces
+
+	if format == "" {
+		rw.Header().Set(runtime.HeaderContentType, runtime.JSONMime)
+	}
+
+	if realm := security.FailedBasicAuth(r); realm != "" {
+		rw.Header().Set("WWW-Authenticate", fmt.Sprintf("Basic realm=%q", realm))
+	}
+
+	if route == nil || route.Operation == nil {
+		c.api.ServeErrorFor("")(rw, r, err)
+		return
+	}
+
+	c.api.ServeErrorFor(route.Operation.ID)(rw, r, err)
+}
+
+func (c *Context) respondWithoutCode(rw http.ResponseWriter, r *http.Request, data any, format string, offers []string) {
+	rw.WriteHeader(http.StatusOK)
+	if r.Method == http.MethodHead {
+		return
+	}
+
+	producers := c.api.ProducersFor(normalizeOffers(offers))
+	prod, ok := producers[format]
+	if !ok {
+		panic(fmt.Errorf("%d: %s", http.StatusInternalServerError, cantFindProducer(format)))
+	}
+
+	if err := prod.Produce(rw, data); err != nil {
+		panic(err) // let the recovery middleware deal with this
+	}
+}
+
+func (c *Context) buildOffers(produces []string) []string {
+	offers := make([]string, 0, len(produces)+1)
 
-	// If spec URL is provided, there is a non-default path to serve the spec.
-	// This makes sure that the UI middleware is aligned with the Spec middleware.
-	u, _ := url.Parse(uiOpts.SpecURL)
-	var specPath string
-	if u != nil {
-		specPath = u.Path
+	for _, mt := range produces {
+		if mt != c.api.DefaultProduces() {
+			offers = append(offers, mt)
+		}
+	}
+
+	// the default producer is last so more specific producers take precedence
+	offers = append(offers, c.api.DefaultProduces())
+	c.debugLogf("offers: %v", offers)
+
+	return offers
+}
+
+func (c *Context) respondWithCode(rw http.ResponseWriter, r *http.Request, route *MatchedRoute, code int, data any, format string) {
+	rw.WriteHeader(code)
+	if code == http.StatusNoContent || r.Method == http.MethodHead {
+		return
+	}
+
+	producers := route.Producers
+	prod, ok := producers[format]
+	if !ok {
+		if !ok {
+			prods := c.api.ProducersFor(normalizeOffers([]string{c.api.DefaultProduces()}))
+			pr, ok := prods[c.api.DefaultProduces()]
+			if !ok {
+				panic(fmt.Errorf("%d: %s", http.StatusInternalServerError, cantFindProducer(format)))
+			}
+			prod = pr
+		}
+	}
+
+	if err := prod.Produce(rw, data); err != nil {
+		panic(err) // let the recovery middleware deal with this
+	}
+}
+
+// uiOptionsForHandler bridges the deprecated [UIOption] set to the new [docui.Option] set.
+func (c Context) uiOptionsForHandler(opts []UIOption) []docui.Option {
+	uiOpts := uiOptionsWithDefaults(opts)
+
+	return uiOpts.toFuncOptions()
+}
+
+func (c *Context) negotiateOpts() []negotiate.Option {
+	var opts []negotiate.Option
+	if c.ignoreParameters {
+		opts = append(opts, negotiate.WithIgnoreParameters(true))
 	}
+	if c.matchSuffix {
+		opts = append(opts, negotiate.WithMatchSuffix(true))
+	}
+
+	return opts
+}
 
-	pth, doc := path.Split(specPath)
-	if pth == "." {
-		pth = ""
+// matchOpts builds the mediatype.MatchOption slice that the
+// codec-lookup and Content-Type validation paths apply server-wide.
+// Mirrors negotiateOpts but at the mediatype level (without going
+// through the negotiate.Option wrapper).
+func (c *Context) matchOpts() []mediatype.MatchOption {
+	if !c.matchSuffix {
+		return nil
 	}
 
-	return pth, uiOpts, []SpecOption{WithSpecDocument(doc)}
+	return []mediatype.MatchOption{mediatype.AllowSuffix()}
 }
 
 func cantFindProducer(format string) string {
diff --git a/vendor/github.com/go-openapi/runtime/middleware/denco/router.go b/vendor/github.com/go-openapi/runtime/middleware/denco/router.go
index f89d761cf2..e380a138d5 100644
--- a/vendor/github.com/go-openapi/runtime/middleware/denco/router.go
+++ b/vendor/github.com/go-openapi/runtime/middleware/denco/router.go
@@ -9,6 +9,7 @@ package denco
 import (
 	"errors"
 	"fmt"
+	"slices"
 	"sort"
 	"strings"
 )
@@ -29,8 +30,8 @@ const (
 	// PathParamCharacter indicates a RESTCONF path param.
 	PathParamCharacter = '='
 
-	// MaxSize is max size of records and internal slice.
-	MaxSize = (1 << 22) - 1 //nolint:mnd
+	// MaxSize is the maximum size of records and internal slice (encoded over 22 bits).
+	MaxSize = (1 << baseBits) - 1
 )
 
 // Router represents a URL router.
@@ -53,9 +54,12 @@ func New() *Router {
 	}
 }
 
-// Lookup returns data and path parameters that associated with path.
+// Lookup returns data and path parameters which are associated to the path.
+//
 // params is a slice of the [Param] that arranged in the order in which parameters appeared.
-// e.g. when built routing path is "/path/to/:id/:name" and given path is "/path/to/1/alice". params order is [{"id": "1"}, {"name": "alice"}], not [{"name": "alice"}, {"id": "1"}].
+//
+// e.g. when built routing path is "/path/to/:id/:name" and given path is "/path/to/1/alice",
+// params order is [{"id": "1"}, {"name": "alice"}], not [{"name": "alice"}, {"id": "1"}].
 func (rt *Router) Lookup(path string) (data any, params Params, found bool) {
 	if data, found = rt.static[path]; found {
 		return data, nil, true
@@ -144,6 +148,7 @@ func newDoubleArray() *doubleArray {
 type baseCheck uint32
 
 const (
+	baseBits  = 22
 	flagsBits = 10
 	checkBits = 8
 )
@@ -157,7 +162,7 @@ func (bc *baseCheck) SetBase(base int) {
 }
 
 func (bc baseCheck) Check() byte {
-	return byte(bc) //nolint:gosec // integer conversion is ok
+	return byte(bc) //nolint:gosec // integer conversion is ok: we pick the last 8 bits
 }
 
 func (bc *baseCheck) SetCheck(check byte) {
@@ -213,8 +218,8 @@ func (da *doubleArray) lookup(path string, params []Param, idx int) (*node, []Pa
 	}
 
 BACKTRACKING:
-	for j := len(indices) - 1; j >= 0; j-- {
-		i, idx := int(indices[j]>>indexOffset), int(indices[j]&indexMask)
+	for _, j := range slices.Backward(indices) {
+		i, idx := int(j>>indexOffset), int(j&indexMask)
 		if da.bc[idx].IsSingleParam() {
 			nextIdx := nextIndex(da.bc[idx].Base(), ParamCharacter)
 			if nextIdx >= len(da.bc) {
diff --git a/vendor/github.com/go-openapi/runtime/middleware/denco/server.go b/vendor/github.com/go-openapi/runtime/middleware/denco/server.go
index e6c0976d8b..3bbbc679d9 100644
--- a/vendor/github.com/go-openapi/runtime/middleware/denco/server.go
+++ b/vendor/github.com/go-openapi/runtime/middleware/denco/server.go
@@ -9,7 +9,7 @@ import (
 	"net/http"
 )
 
-// Mux represents a multiplexer for HTTP request.
+// Mux represents a multiplexer for HTTP requests.
 type Mux struct{}
 
 // NewMux returns a new [Mux].
@@ -17,27 +17,27 @@ func NewMux() *Mux {
 	return &Mux{}
 }
 
-// GET is shorthand of [Mux].Handler("GET", path, handler).
+// GET is shorthand for [Mux.Handler] ("GET", path, handler).
 func (m *Mux) GET(path string, handler HandlerFunc) Handler {
 	return m.Handler("GET", path, handler)
 }
 
-// POST is shorthand of [Mux].Handler("POST", path, handler).
+// POST is shorthand for [Mux.Handler] ("POST", path, handler).
 func (m *Mux) POST(path string, handler HandlerFunc) Handler {
 	return m.Handler("POST", path, handler)
 }
 
-// PUT is shorthand of [Mux].Handler("PUT", path, handler).
+// PUT is shorthand for [Mux.Handler] ("PUT", path, handler).
 func (m *Mux) PUT(path string, handler HandlerFunc) Handler {
 	return m.Handler("PUT", path, handler)
 }
 
-// HEAD is shorthand of [Mux].Handler("HEAD", path, handler).
+// HEAD is shorthand for [Mux.Handler]("HEAD", path, handler).
 func (m *Mux) HEAD(path string, handler HandlerFunc) Handler {
 	return m.Handler("HEAD", path, handler)
 }
 
-// Handler returns a handler for HTTP method.
+// Handler returns a [Handler] for a HTTP method.
 func (m *Mux) Handler(method, path string, handler HandlerFunc) Handler {
 	return Handler{
 		Method: method,
@@ -63,7 +63,7 @@ func (m *Mux) Build(handlers []Handler) (http.Handler, error) {
 	return mux, nil
 }
 
-// Handler represents a handler of HTTP request.
+// Handler represents a handler of HTTP requests.
 type Handler struct {
 	// Method is an HTTP method.
 	Method string
@@ -75,7 +75,7 @@ type Handler struct {
 	Func HandlerFunc
 }
 
-// HandlerFunc is aliased to type of handler function.
+// HandlerFunc is an alias to the handler function, similar to [http.HandlerFunc].
 type HandlerFunc func(w http.ResponseWriter, r *http.Request, params Params)
 
 type serveMux struct {
@@ -88,7 +88,7 @@ func newServeMux() *serveMux {
 	}
 }
 
-// ServeHTTP implements http.Handler interface.
+// ServeHTTP implements the [http.Handler] interface.
 func (mux *serveMux) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	handler, params := mux.handler(r.Method, r.URL.Path)
 	handler(w, r, params)
@@ -97,15 +97,17 @@ func (mux *serveMux) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 func (mux *serveMux) handler(method, path string) (HandlerFunc, []Param) {
 	if router, found := mux.routers[method]; found {
 		if handler, params, found := router.Lookup(path); found {
-			return handler.(HandlerFunc), params
+			return handler.(HandlerFunc), params //nolint:forcetypeassert // type is guaranteed when the path is found
 		}
 	}
 	return NotFound, nil
 }
 
 // NotFound replies to the request with an HTTP 404 not found error.
-// NotFound is called when unknown HTTP method or a handler not found.
-// If you want to use the your own NotFound handler, please overwrite this variable.
+//
+// NotFound is called when unknown HTTP methods are being user or a handler not found.
+//
+// If you want to use your own NotFound handler, please overwrite this variable.
 var NotFound = func(w http.ResponseWriter, r *http.Request, _ Params) {
 	http.NotFound(w, r)
 }
diff --git a/vendor/github.com/go-openapi/runtime/middleware/negotiate.go b/vendor/github.com/go-openapi/runtime/middleware/negotiate.go
deleted file mode 100644
index cb0a85283c..0000000000
--- a/vendor/github.com/go-openapi/runtime/middleware/negotiate.go
+++ /dev/null
@@ -1,102 +0,0 @@
-// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
-// SPDX-License-Identifier: Apache-2.0
-
-// Copyright 2013 The Go Authors. All rights reserved.
-//
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file or at
-// https://developers.google.com/open-source/licenses/bsd.
-
-// this file was taken from the github.com/golang/gddo repository
-
-package middleware
-
-import (
-	"net/http"
-	"strings"
-
-	"github.com/go-openapi/runtime/middleware/header"
-)
-
-// NegotiateContentEncoding returns the best offered content encoding for the
-// request's Accept-Encoding header. If two offers match with equal weight and
-// then the offer earlier in the list is preferred. If no offers are
-// acceptable, then "" is returned.
-func NegotiateContentEncoding(r *http.Request, offers []string) string {
-	bestOffer := "identity"
-	bestQ := -1.0
-	specs := header.ParseAccept(r.Header, "Accept-Encoding")
-	for _, offer := range offers {
-		for _, spec := range specs {
-			if spec.Q > bestQ &&
-				(spec.Value == "*" || spec.Value == offer) {
-				bestQ = spec.Q
-				bestOffer = offer
-			}
-		}
-	}
-	if bestQ == 0 {
-		bestOffer = ""
-	}
-	return bestOffer
-}
-
-// NegotiateContentType returns the best offered content type for the request's
-// Accept header. If two offers match with equal weight, then the more specific
-// offer is preferred.  For example, text/* trumps */*. If two offers match
-// with equal weight and specificity, then the offer earlier in the list is
-// preferred. If no offers match, then defaultOffer is returned.
-func NegotiateContentType(r *http.Request, offers []string, defaultOffer string) string {
-	bestOffer := defaultOffer
-	bestQ := -1.0
-	bestWild := 3
-	specs := header.ParseAccept(r.Header, "Accept")
-	for _, rawOffer := range offers {
-		offer := normalizeOffer(rawOffer)
-		// No Accept header: just return the first offer.
-		if len(specs) == 0 {
-			return rawOffer
-		}
-		for _, spec := range specs {
-			switch {
-			case spec.Q == 0.0:
-				// ignore
-			case spec.Q < bestQ:
-				// better match found
-			case spec.Value == "*/*":
-				if spec.Q > bestQ || bestWild > 2 {
-					bestQ = spec.Q
-					bestWild = 2
-					bestOffer = rawOffer
-				}
-			case strings.HasSuffix(spec.Value, "/*"):
-				if strings.HasPrefix(offer, spec.Value[:len(spec.Value)-1]) &&
-					(spec.Q > bestQ || bestWild > 1) {
-					bestQ = spec.Q
-					bestWild = 1
-					bestOffer = rawOffer
-				}
-			default:
-				if spec.Value == offer &&
-					(spec.Q > bestQ || bestWild > 0) {
-					bestQ = spec.Q
-					bestWild = 0
-					bestOffer = rawOffer
-				}
-			}
-		}
-	}
-	return bestOffer
-}
-
-func normalizeOffers(orig []string) (norm []string) {
-	for _, o := range orig {
-		norm = append(norm, normalizeOffer(o))
-	}
-	return
-}
-
-func normalizeOffer(orig string) string {
-	const maxParts = 2
-	return strings.SplitN(orig, ";", maxParts)[0]
-}
diff --git a/vendor/github.com/go-openapi/runtime/middleware/parameter.go b/vendor/github.com/go-openapi/runtime/middleware/parameter.go
index a9d2a36460..3c96b21c13 100644
--- a/vendor/github.com/go-openapi/runtime/middleware/parameter.go
+++ b/vendor/github.com/go-openapi/runtime/middleware/parameter.go
@@ -6,7 +6,7 @@ package middleware
 import (
 	"encoding"
 	"encoding/base64"
-	"fmt"
+	stderrors "errors"
 	"io"
 	"net/http"
 	"reflect"
@@ -56,126 +56,147 @@ func (p *untypedParamBinder) Type() reflect.Type {
 }
 
 func (p *untypedParamBinder) Bind(request *http.Request, routeParams RouteParams, consumer runtime.Consumer, target reflect.Value) error {
-	// fmt.Println("binding", p.name, "as", p.Type())
 	switch p.parameter.In {
 	case "query":
-		data, custom, hasKey, err := p.readValue(runtime.Values(request.URL.Query()), target)
-		if err != nil {
-			return err
-		}
-		if custom {
-			return nil
-		}
-
-		return p.bindValue(data, hasKey, target)
+		return p.bindQuery(request, routeParams, consumer, target)
 
 	case "header":
-		data, custom, hasKey, err := p.readValue(runtime.Values(request.Header), target)
-		if err != nil {
-			return err
-		}
-		if custom {
-			return nil
-		}
-		return p.bindValue(data, hasKey, target)
+		return p.bindHeader(request, routeParams, consumer, target)
 
 	case "path":
-		data, custom, hasKey, err := p.readValue(routeParams, target)
-		if err != nil {
-			return err
-		}
-		if custom {
-			return nil
-		}
-		return p.bindValue(data, hasKey, target)
+		return p.bindPath(request, routeParams, consumer, target)
 
 	case "formData":
-		var err error
-		var mt string
+		return p.bindFormData(request, routeParams, consumer, target)
 
-		mt, _, e := runtime.ContentType(request.Header)
-		if e != nil {
-			// because of the interface conversion go thinks the error is not nil
-			// so we first check for nil and then set the err var if it's not nil
-			err = e
-		}
+	case "body":
+		return p.bindBody(request, routeParams, consumer, target)
+	default:
+		return errors.New(http.StatusInternalServerError, "invalid parameter location: %q", p.parameter.In)
+	}
+}
 
-		if err != nil {
-			return errors.InvalidContentType("", []string{"multipart/form-data", "application/x-www-form-urlencoded"})
-		}
+func (p *untypedParamBinder) bindQuery(request *http.Request, _ RouteParams, _ runtime.Consumer, target reflect.Value) error {
+	data, custom, hasKey, err := p.readValue(runtime.Values(request.URL.Query()), target)
+	if err != nil {
+		return err
+	}
+	if custom {
+		return nil
+	}
 
-		if mt != "multipart/form-data" && mt != "application/x-www-form-urlencoded" {
-			return errors.InvalidContentType(mt, []string{"multipart/form-data", "application/x-www-form-urlencoded"})
-		}
+	return p.bindValue(data, hasKey, target)
+}
 
-		if mt == "multipart/form-data" {
-			if err = request.ParseMultipartForm(defaultMaxMemory); err != nil {
-				return errors.NewParseError(p.Name, p.parameter.In, "", err)
-			}
-		}
+func (p *untypedParamBinder) bindHeader(request *http.Request, _ RouteParams, _ runtime.Consumer, target reflect.Value) error {
+	data, custom, hasKey, err := p.readValue(runtime.Values(request.Header), target)
+	if err != nil {
+		return err
+	}
+	if custom {
+		return nil
+	}
+	return p.bindValue(data, hasKey, target)
+}
 
-		if err = request.ParseForm(); err != nil {
-			return errors.NewParseError(p.Name, p.parameter.In, "", err)
-		}
+func (p *untypedParamBinder) bindPath(_ *http.Request, routeParams RouteParams, _ runtime.Consumer, target reflect.Value) error {
+	data, custom, hasKey, err := p.readValue(routeParams, target)
+	if err != nil {
+		return err
+	}
+	if custom {
+		return nil
+	}
+	return p.bindValue(data, hasKey, target)
+}
+
+func (p *untypedParamBinder) bindFormData(request *http.Request, _ RouteParams, _ runtime.Consumer, target reflect.Value) error {
+	mt, _, ctErr := runtime.ContentType(request.Header)
+	if ctErr != nil {
+		return errors.InvalidContentType("", []string{runtime.MultipartFormMime, runtime.URLencodedFormMime})
+	}
+
+	if mt != runtime.MultipartFormMime && mt != runtime.URLencodedFormMime {
+		return errors.InvalidContentType(mt, []string{runtime.MultipartFormMime, runtime.URLencodedFormMime})
+	}
 
-		if p.parameter.Type == "file" {
-			file, header, ffErr := request.FormFile(p.parameter.Name)
-			if ffErr != nil {
-				if p.parameter.Required {
-					return errors.NewParseError(p.Name, p.parameter.In, "", ffErr)
-				}
+	// Parse via the shared helper. The helper routes on Content-Type
+	// (multipart/form-data → ParseMultipartForm; all non-multipart types,
+	// including application/x-www-form-urlencoded, → ParseForm)
+	// and applies the default 32 MiB body cap via http.MaxBytesReader.
+	// Idempotent across the per-parameter loop: stdlib short-circuits
+	// when r.MultipartForm / r.PostForm are already populated.
+	if _, perr := runtime.BindForm(request, runtime.BindFormMaxParseMemory(defaultMaxMemory)); perr != nil {
+		return perr
+	}
 
-				return nil
+	if p.parameter.Type == "file" {
+		file, header, ffErr := request.FormFile(p.parameter.Name)
+		if ffErr != nil {
+			if p.parameter.Required {
+				return errors.NewParseError(p.Name, p.parameter.In, "", ffErr)
 			}
 
-			target.Set(reflect.ValueOf(runtime.File{Data: file, Header: header}))
 			return nil
 		}
 
-		if request.MultipartForm != nil {
-			data, custom, hasKey, rvErr := p.readValue(runtime.Values(request.MultipartForm.Value), target)
-			if rvErr != nil {
-				return rvErr
-			}
-			if custom {
-				return nil
-			}
-			return p.bindValue(data, hasKey, target)
-		}
-		data, custom, hasKey, err := p.readValue(runtime.Values(request.PostForm), target)
-		if err != nil {
+		// Mirror the FileHeader.Filename length cap that BindForm
+		// applies to typed (codegen) paths through BindFormFile, so
+		// untyped formData bindings get the same protection.
+		if err := runtime.ValidateFilenameLength(p.Name, p.parameter.In, header.Filename,
+			runtime.DefaultMaxUploadFilenameLength); err != nil {
 			return err
 		}
+
+		target.Set(reflect.ValueOf(runtime.File{Data: file, Header: header}))
+		return nil
+	}
+
+	if request.MultipartForm != nil {
+		data, custom, hasKey, rvErr := p.readValue(runtime.Values(request.MultipartForm.Value), target)
+		if rvErr != nil {
+			return rvErr
+		}
 		if custom {
 			return nil
 		}
 		return p.bindValue(data, hasKey, target)
+	}
+	data, custom, hasKey, err := p.readValue(runtime.Values(request.PostForm), target)
+	if err != nil {
+		return err
+	}
+	if custom {
+		return nil
+	}
+	return p.bindValue(data, hasKey, target)
+}
 
-	case "body":
-		newValue := reflect.New(target.Type())
-		if !runtime.HasBody(request) {
-			if p.parameter.Default != nil {
-				target.Set(reflect.ValueOf(p.parameter.Default))
-			}
+func (p *untypedParamBinder) bindBody(request *http.Request, _ RouteParams, consumer runtime.Consumer, target reflect.Value) error {
+	newValue := reflect.New(target.Type())
+	if !runtime.HasBody(request) {
+		if p.parameter.Default != nil {
+			target.Set(reflect.ValueOf(p.parameter.Default))
+		}
+
+		return nil
+	}
 
+	if err := consumer.Consume(request.Body, newValue.Interface()); err != nil {
+		if stderrors.Is(err, io.EOF) && p.parameter.Default != nil {
+			target.Set(reflect.ValueOf(p.parameter.Default))
 			return nil
 		}
-		if err := consumer.Consume(request.Body, newValue.Interface()); err != nil {
-			if err == io.EOF && p.parameter.Default != nil {
-				target.Set(reflect.ValueOf(p.parameter.Default))
-				return nil
-			}
-			tpe := p.parameter.Type
-			if p.parameter.Format != "" {
-				tpe = p.parameter.Format
-			}
-			return errors.InvalidType(p.Name, p.parameter.In, tpe, nil)
+		tpe := p.parameter.Type
+		if p.parameter.Format != "" {
+			tpe = p.parameter.Format
 		}
-		target.Set(reflect.Indirect(newValue))
-		return nil
-	default:
-		return fmt.Errorf("%d: invalid parameter location %q", http.StatusInternalServerError, p.parameter.In)
+		return errors.InvalidType(p.Name, p.parameter.In, tpe, nil)
 	}
+
+	target.Set(reflect.Indirect(newValue))
+
+	return nil
 }
 
 func (p *untypedParamBinder) typeForSchema(tpe, format string, items *spec.Items) reflect.Type {
@@ -261,20 +282,51 @@ func (p *untypedParamBinder) bindValue(data []string, hasKey bool, target reflec
 	if p.parameter.Type == typeArray {
 		return p.setSliceFieldValue(target, p.parameter.Default, data, hasKey)
 	}
+
 	var d string
 	if len(data) > 0 {
 		d = data[len(data)-1]
 	}
+
 	return p.setFieldValue(target, p.parameter.Default, d, hasKey)
 }
 
-func (p *untypedParamBinder) setFieldValue(target reflect.Value, defaultValue any, data string, hasKey bool) error { //nolint:gocyclo
+func (p *untypedParamBinder) isMissingAndRequired(hasKey bool, data string) bool {
+	return p.parameter.Required &&
+		p.parameter.Default == nil &&
+		(!hasKey || (!p.parameter.AllowEmptyValue && data == ""))
+}
+
+func (p *untypedParamBinder) setByte(target, defVal reflect.Value, tpe, data string) error {
+	if data == "" {
+		if target.CanSet() {
+			target.SetBytes(defVal.Bytes())
+		}
+
+		return nil
+	}
+
+	b, err := base64.StdEncoding.DecodeString(data)
+	if err != nil {
+		b, err = base64.URLEncoding.DecodeString(data)
+		if err != nil {
+			return errors.InvalidType(p.Name, p.parameter.In, tpe, data)
+		}
+	}
+	if target.CanSet() {
+		target.SetBytes(b)
+	}
+
+	return nil
+}
+
+func (p *untypedParamBinder) setFieldValue(target reflect.Value, defaultValue any, data string, hasKey bool) error {
 	tpe := p.parameter.Type
 	if p.parameter.Format != "" {
 		tpe = p.parameter.Format
 	}
 
-	if (!hasKey || (!p.parameter.AllowEmptyValue && data == "")) && p.parameter.Required && p.parameter.Default == nil {
+	if p.isMissingAndRequired(hasKey, data) {
 		return errors.Required(p.Name, p.parameter.In, data)
 	}
 
@@ -292,27 +344,15 @@ func (p *untypedParamBinder) setFieldValue(target reflect.Value, defaultValue an
 	}
 
 	if tpe == "byte" {
-		if data == "" {
-			if target.CanSet() {
-				target.SetBytes(defVal.Bytes())
-			}
-			return nil
-		}
-
-		b, err := base64.StdEncoding.DecodeString(data)
-		if err != nil {
-			b, err = base64.URLEncoding.DecodeString(data)
-			if err != nil {
-				return errors.InvalidType(p.Name, p.parameter.In, tpe, data)
-			}
-		}
-		if target.CanSet() {
-			target.SetBytes(b)
-		}
-		return nil
+		return p.setByte(target, defVal, tpe, data)
 	}
 
-	switch target.Kind() { //nolint:exhaustive // we want to check only types that map from a swagger parameter
+	return p.setReflectFieldValue(target, defVal, tpe, data, hasKey)
+}
+
+//nolint:gocyclo,cyclop // not much we can simplify further significantly: the big case with all types is unavoidable.
+func (p *untypedParamBinder) setReflectFieldValue(target, defVal reflect.Value, tpe, data string, hasKey bool) error {
+	switch target.Kind() { // we want to check only types that map from a swagger parameter
 	case reflect.Bool:
 		if data == "" {
 			if target.CanSet() {
@@ -327,6 +367,7 @@ func (p *untypedParamBinder) setFieldValue(target reflect.Value, defaultValue an
 		if target.CanSet() {
 			target.SetBool(b)
 		}
+
 	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
 		if data == "" {
 			if target.CanSet() {
@@ -394,8 +435,8 @@ func (p *untypedParamBinder) setFieldValue(target reflect.Value, defaultValue an
 			target.SetString(value)
 		}
 
-	case reflect.Ptr:
-		if data == "" && defVal.Kind() == reflect.Ptr {
+	case reflect.Pointer:
+		if data == "" && defVal.Kind() == reflect.Pointer {
 			if target.CanSet() {
 				target.Set(defVal)
 			}
@@ -412,6 +453,7 @@ func (p *untypedParamBinder) setFieldValue(target reflect.Value, defaultValue an
 	default:
 		return errors.InvalidType(p.Name, p.parameter.In, tpe, data)
 	}
+
 	return nil
 }
 
@@ -419,20 +461,30 @@ func (p *untypedParamBinder) tryUnmarshaler(target reflect.Value, defaultValue a
 	if !target.CanSet() {
 		return false, nil
 	}
+
 	// When a type implements encoding.TextUnmarshaler we'll use that instead of reflecting some more
-	if reflect.PointerTo(target.Type()).Implements(textUnmarshalType) {
-		if defaultValue != nil && len(data) == 0 {
-			target.Set(reflect.ValueOf(defaultValue))
-			return true, nil
-		}
-		value := reflect.New(target.Type())
-		if err := value.Interface().(encoding.TextUnmarshaler).UnmarshalText([]byte(data)); err != nil {
-			return true, err
-		}
-		target.Set(reflect.Indirect(value))
+	ttyp := target.Type()
+	if !reflect.PointerTo(ttyp).Implements(textUnmarshalType) {
+		return false, nil
+	}
+
+	if defaultValue != nil && len(data) == 0 {
+		target.Set(reflect.ValueOf(defaultValue))
 		return true, nil
 	}
-	return false, nil
+
+	value := reflect.New(ttyp)
+	if !value.CanInterface() {
+		return false, nil
+	}
+
+	if err := value.Interface().(encoding.TextUnmarshaler).UnmarshalText([]byte(data)); err != nil { //nolint:forcetypeassert // this is guaranteed by the reflect check above
+		return true, err
+	}
+
+	target.Set(reflect.Indirect(value))
+
+	return true, nil
 }
 
 func (p *untypedParamBinder) readFormattedSliceFieldValue(data string, target reflect.Value) ([]string, bool, error) {
diff --git a/vendor/github.com/go-openapi/runtime/middleware/rapidoc.go b/vendor/github.com/go-openapi/runtime/middleware/rapidoc.go
deleted file mode 100644
index 1574defb41..0000000000
--- a/vendor/github.com/go-openapi/runtime/middleware/rapidoc.go
+++ /dev/null
@@ -1,83 +0,0 @@
-// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
-// SPDX-License-Identifier: Apache-2.0
-
-package middleware
-
-import (
-	"bytes"
-	"fmt"
-	"html/template"
-	"net/http"
-	"path"
-)
-
-// RapiDocOpts configures the [RapiDoc] middlewares.
-type RapiDocOpts struct {
-	// BasePath for the UI, defaults to: /
-	BasePath string
-
-	// Path combines with BasePath to construct the path to the UI, defaults to: "docs".
-	Path string
-
-	// SpecURL is the URL of the spec document.
-	//
-	// Defaults to: /swagger.json
-	SpecURL string
-
-	// Title for the documentation site, default to: API documentation
-	Title string
-
-	// Template specifies a custom template to serve the UI
-	Template string
-
-	// RapiDocURL points to the js asset that generates the rapidoc site.
-	//
-	// Defaults to https://unpkg.com/rapidoc/dist/rapidoc-min.js
-	RapiDocURL string
-}
-
-func (r *RapiDocOpts) EnsureDefaults() {
-	common := toCommonUIOptions(r)
-	common.EnsureDefaults()
-	fromCommonToAnyOptions(common, r)
-
-	// rapidoc-specifics
-	if r.RapiDocURL == "" {
-		r.RapiDocURL = rapidocLatest
-	}
-	if r.Template == "" {
-		r.Template = rapidocTemplate
-	}
-}
-
-// RapiDoc creates a [middleware] to serve a documentation site for a swagger spec.
-//
-// This allows for altering the spec before starting the [http] listener.
-func RapiDoc(opts RapiDocOpts, next http.Handler) http.Handler {
-	opts.EnsureDefaults()
-
-	pth := path.Join(opts.BasePath, opts.Path)
-	tmpl := template.Must(template.New("rapidoc").Parse(opts.Template))
-	assets := bytes.NewBuffer(nil)
-	if err := tmpl.Execute(assets, opts); err != nil {
-		panic(fmt.Errorf("cannot execute template: %w", err))
-	}
-
-	return serveUI(pth, assets.Bytes(), next)
-}
-
-const (
-	rapidocLatest   = "https://unpkg.com/rapidoc/dist/rapidoc-min.js"
-	rapidocTemplate = `<!doctype html>
-<html>
-<head>
-  <title>{{ .Title }}</title>
-  <meta charset="utf-8"> <!-- Important: rapi-doc uses utf8 characters -->
-  <script type="module" src="{{ .RapiDocURL }}"></script>
-</head>
-<body>
-  <rapi-doc spec-url="{{ .SpecURL }}"></rapi-doc>
-</body>
-</html>
-`
-)
diff --git a/vendor/github.com/go-openapi/runtime/middleware/redoc.go b/vendor/github.com/go-openapi/runtime/middleware/redoc.go
deleted file mode 100644
index 1007409a30..0000000000
--- a/vendor/github.com/go-openapi/runtime/middleware/redoc.go
+++ /dev/null
@@ -1,97 +0,0 @@
-// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
-// SPDX-License-Identifier: Apache-2.0
-
-package middleware
-
-import (
-	"bytes"
-	"fmt"
-	"html/template"
-	"net/http"
-	"path"
-)
-
-// RedocOpts configures the [Redoc] middlewares.
-type RedocOpts struct {
-	// BasePath for the UI, defaults to: /
-	BasePath string
-
-	// Path combines with BasePath to construct the path to the UI, defaults to: "docs".
-	Path string
-
-	// SpecURL is the URL of the spec document.
-	//
-	// Defaults to: /swagger.json
-	SpecURL string
-
-	// Title for the documentation site, default to: API documentation
-	Title string
-
-	// Template specifies a custom template to serve the UI
-	Template string
-
-	// RedocURL points to the js that generates the redoc site.
-	//
-	// Defaults to: https://cdn.jsdelivr.net/npm/redoc/bundles/redoc.standalone.js
-	RedocURL string
-}
-
-// EnsureDefaults in case some options are missing.
-func (r *RedocOpts) EnsureDefaults() {
-	common := toCommonUIOptions(r)
-	common.EnsureDefaults()
-	fromCommonToAnyOptions(common, r)
-
-	// redoc-specifics
-	if r.RedocURL == "" {
-		r.RedocURL = redocLatest
-	}
-	if r.Template == "" {
-		r.Template = redocTemplate
-	}
-}
-
-// Redoc creates a [middleware] to serve a documentation site for a swagger spec.
-//
-// This allows for altering the spec before starting the [http] listener.
-func Redoc(opts RedocOpts, next http.Handler) http.Handler {
-	opts.EnsureDefaults()
-
-	pth := path.Join(opts.BasePath, opts.Path)
-	tmpl := template.Must(template.New("redoc").Parse(opts.Template))
-	assets := bytes.NewBuffer(nil)
-	if err := tmpl.Execute(assets, opts); err != nil {
-		panic(fmt.Errorf("cannot execute template: %w", err))
-	}
-
-	return serveUI(pth, assets.Bytes(), next)
-}
-
-const (
-	redocLatest   = "https://cdn.jsdelivr.net/npm/redoc/bundles/redoc.standalone.js"
-	redocTemplate = `<!DOCTYPE html>
-<html>
-  <head>
-    <title>{{ .Title }}</title>
-		<!-- needed for adaptive design -->
-		<meta charset="utf-8"/>
-		<meta name="viewport" content="width=device-width, initial-scale=1">
-		<link href="https://fonts.googleapis.com/css?family=Montserrat:300,400,700|Roboto:300,400,700" rel="stylesheet">
-
-    <!--
-    ReDoc doesn't change outer page styles
-    -->
-    <style>
-      body {
-        margin: 0;
-        padding: 0;
-      }
-    </style>
-  </head>
-  <body>
-    <redoc spec-url='{{ .SpecURL }}'></redoc>
-    <script src="{{ .RedocURL }}"> </script>
-  </body>
-</html>
-`
-)
diff --git a/vendor/github.com/go-openapi/runtime/middleware/request.go b/vendor/github.com/go-openapi/runtime/middleware/request.go
index ad781663b8..08a0362da2 100644
--- a/vendor/github.com/go-openapi/runtime/middleware/request.go
+++ b/vendor/github.com/go-openapi/runtime/middleware/request.go
@@ -40,8 +40,25 @@ func NewUntypedRequestBinder(parameters map[string]spec.Parameter, spec *spec.Sw
 
 // Bind perform the databinding and validation.
 func (o *UntypedRequestBinder) Bind(request *http.Request, routeParams RouteParams, consumer runtime.Consumer, data any) error {
+	err := o.bind(request, routeParams, consumer, data)
+	if err == nil {
+		return nil // avoids returning a nil-interface
+	}
+
+	return err
+}
+
+// SetLogger allows for injecting a logger to catch debug entries.
+//
+// The logger is enabled in DEBUG mode only.
+func (o *UntypedRequestBinder) SetLogger(lg logger.Logger) {
+	o.debugLogf = debugLogfFunc(lg)
+}
+
+func (o *UntypedRequestBinder) bind(request *http.Request, routeParams RouteParams, consumer runtime.Consumer, data any) *errors.CompositeError {
 	val := reflect.Indirect(reflect.ValueOf(data))
 	isMap := val.Kind() == reflect.Map
+
 	var result []error
 	o.debugLogf("binding %d parameters for %s %s", len(o.Parameters), request.Method, request.URL.EscapedPath())
 	for fieldName, param := range o.Parameters {
@@ -94,13 +111,6 @@ func (o *UntypedRequestBinder) Bind(request *http.Request, routeParams RoutePara
 	return nil
 }
 
-// SetLogger allows for injecting a logger to catch debug entries.
-//
-// The logger is enabled in DEBUG mode only.
-func (o *UntypedRequestBinder) SetLogger(lg logger.Logger) {
-	o.debugLogf = debugLogfFunc(lg)
-}
-
 func (o *UntypedRequestBinder) setDebugLogf(fn func(string, ...any)) {
 	o.debugLogf = fn
 }
diff --git a/vendor/github.com/go-openapi/runtime/middleware/router.go b/vendor/github.com/go-openapi/runtime/middleware/router.go
index e828653be7..939cf7337a 100644
--- a/vendor/github.com/go-openapi/runtime/middleware/router.go
+++ b/vendor/github.com/go-openapi/runtime/middleware/router.go
@@ -21,6 +21,7 @@ import (
 	"github.com/go-openapi/spec"
 	"github.com/go-openapi/strfmt"
 	"github.com/go-openapi/swag/stringutils"
+	"github.com/go-openapi/swag/typeutils"
 )
 
 // RouteParam is a object to capture route params in a framework agnostic way.
@@ -292,7 +293,7 @@ func (ras RouteAuthenticators) Authenticate(req *http.Request, route *MatchedRou
 			continue
 		}
 		applies, usr, err := ra.Authenticate(req, route)
-		if !applies || err != nil || usr == nil {
+		if !applies || err != nil || typeutils.IsZero(usr) {
 			if err != nil {
 				lastError = err
 			}
@@ -348,49 +349,62 @@ func (m *MatchedRoute) NeedsAuth() bool {
 func (d *defaultRouter) Lookup(method, path string) (*MatchedRoute, bool) {
 	mth := strings.ToUpper(method)
 	d.debugLogf("looking up route for %s %s", method, path)
-	if Debug {
-		if len(d.routers) == 0 {
+	if len(d.routers) == 0 {
+		if Debug {
 			d.debugLogf("there are no known routers")
 		}
+		panic("internal error: no router is configured")
+	}
+
+	if Debug {
 		for meth := range d.routers {
 			d.debugLogf("got a router for %s", meth)
 		}
 	}
-	if router, ok := d.routers[mth]; ok {
-		if m, rp, ok := router.Lookup(fpath.Clean(path)); ok && m != nil {
-			if entry, ok := m.(*routeEntry); ok {
-				d.debugLogf("found a route for %s %s with %d parameters", method, path, len(entry.Parameters))
-				var params RouteParams
-				for _, p := range rp {
-					v, err := url.PathUnescape(p.Value)
-					if err != nil {
-						d.debugLogf("failed to escape %q: %v", p.Value, err)
-						v = p.Value
-					}
-					// a workaround to handle fragment/composing parameters until they are supported in denco router
-					// check if this parameter is a fragment within a path segment
-					const enclosureSize = 2
-					if xpos := strings.Index(entry.PathPattern, fmt.Sprintf("{%s}", p.Name)) + len(p.Name) + enclosureSize; xpos < len(entry.PathPattern) && entry.PathPattern[xpos] != '/' {
-						// extract fragment parameters
-						ep := strings.Split(entry.PathPattern[xpos:], "/")[0]
-						pnames, pvalues := decodeCompositParams(p.Name, v, ep, nil, nil)
-						for i, pname := range pnames {
-							params = append(params, RouteParam{Name: pname, Value: pvalues[i]})
-						}
-					} else {
-						// use the parameter directly
-						params = append(params, RouteParam{Name: p.Name, Value: v})
-					}
-				}
-				return &MatchedRoute{routeEntry: *entry, Params: params}, true
+
+	router, ok := d.routers[mth]
+	if !ok {
+		d.debugLogf("couldn't find a route by method for %s %s", method, path)
+		return nil, false
+	}
+
+	m, rp, ok := router.Lookup(fpath.Clean(escapeLiteralColons(path)))
+	if !ok || m == nil {
+		d.debugLogf("couldn't find a route by path for %s %s", method, path)
+		return nil, false
+	}
+
+	entry, ok := m.(*routeEntry)
+	if !ok {
+		return nil, false
+	}
+
+	d.debugLogf("found a route for %s %s with %d parameters", method, path, len(entry.Parameters))
+	var params RouteParams
+	for _, p := range rp {
+		v, err := url.PathUnescape(p.Value)
+		if err != nil {
+			d.debugLogf("failed to escape %q: %v", p.Value, err)
+			v = p.Value
+		}
+
+		// a workaround to handle fragment/composing parameters until they are supported in denco router
+		// check if this parameter is a fragment within a path segment
+		const enclosureSize = 2
+		if xpos := strings.Index(entry.PathPattern, fmt.Sprintf("{%s}", p.Name)) + len(p.Name) + enclosureSize; xpos < len(entry.PathPattern) && entry.PathPattern[xpos] != '/' {
+			// extract fragment parameters
+			ep := strings.Split(entry.PathPattern[xpos:], "/")[0]
+			pnames, pvalues := decodeCompositParams(p.Name, v, ep, nil, nil)
+			for i, pname := range pnames {
+				params = append(params, RouteParam{Name: pname, Value: pvalues[i]})
 			}
 		} else {
-			d.debugLogf("couldn't find a route by path for %s %s", method, path)
+			// use the parameter directly
+			params = append(params, RouteParam{Name: p.Name, Value: v})
 		}
-	} else {
-		d.debugLogf("couldn't find a route by method for %s %s", method, path)
 	}
-	return nil, false
+
+	return &MatchedRoute{routeEntry: *entry, Params: params}, true
 }
 
 func (d *defaultRouter) OtherMethods(method, path string) []string {
@@ -398,7 +412,7 @@ func (d *defaultRouter) OtherMethods(method, path string) []string {
 	var methods []string
 	for k, v := range d.routers {
 		if k != mn {
-			if _, _, ok := v.Lookup(fpath.Clean(path)); ok {
+			if _, _, ok := v.Lookup(fpath.Clean(escapeLiteralColons(path))); ok {
 				methods = append(methods, k)
 				continue
 			}
@@ -414,28 +428,39 @@ func (d *defaultRouter) SetLogger(lg logger.Logger) {
 // convert swagger parameters per path segment into a denco parameter as multiple parameters per segment are not supported in denco.
 var pathConverter = regexp.MustCompile(`{(.+?)}([^/]*)`)
 
+// escapeLiteralColons replaces literal ':' characters with their URL-encoded
+// equivalent "%3A". This prevents the denco router from misinterpreting ':'
+// in URL path segments as parameter delimiters. The ':' character is valid in
+// URL paths per RFC 3986 section 3.3.
+func escapeLiteralColons(path string) string {
+	return strings.ReplaceAll(path, ":", "%3A")
+}
+
 func decodeCompositParams(name string, value string, pattern string, names []string, values []string) ([]string, []string) {
 	pleft := strings.Index(pattern, "{")
 	names = append(names, name)
+
 	if pleft < 0 {
 		if strings.HasSuffix(value, pattern) {
 			values = append(values, value[:len(value)-len(pattern)])
 		} else {
 			values = append(values, "")
 		}
+
+		return names, values
+	}
+
+	toskip := pattern[:pleft]
+	pright := strings.Index(pattern, "}")
+	vright := strings.Index(value, toskip)
+	if vright >= 0 {
+		values = append(values, value[:vright])
 	} else {
-		toskip := pattern[:pleft]
-		pright := strings.Index(pattern, "}")
-		vright := strings.Index(value, toskip)
-		if vright >= 0 {
-			values = append(values, value[:vright])
-		} else {
-			values = append(values, "")
-			value = ""
-		}
-		return decodeCompositParams(pattern[pleft+1:pright], value[vright+len(toskip):], pattern[pright+1:], names, values)
+		values = append(values, "")
+		value = ""
 	}
-	return names, values
+
+	return decodeCompositParams(pattern[pleft+1:pright], value[vright+len(toskip):], pattern[pright+1:], names, values)
 }
 
 func (d *defaultRouteBuilder) AddRoute(method, path string, operation *spec.Operation) {
@@ -463,7 +488,7 @@ func (d *defaultRouteBuilder) AddRoute(method, path string, operation *spec.Oper
 
 		requestBinder := NewUntypedRequestBinder(parameters, d.spec.Spec(), d.api.Formats())
 		requestBinder.setDebugLogf(d.debugLogf)
-		record := denco.NewRecord(pathConverter.ReplaceAllString(path, ":$1"), &routeEntry{
+		record := denco.NewRecord(pathConverter.ReplaceAllString(escapeLiteralColons(path), ":$1"), &routeEntry{
 			BasePath:       bp,
 			PathPattern:    path,
 			Operation:      operation,
diff --git a/vendor/github.com/go-openapi/runtime/middleware/seam.go b/vendor/github.com/go-openapi/runtime/middleware/seam.go
new file mode 100644
index 0000000000..b234395f19
--- /dev/null
+++ b/vendor/github.com/go-openapi/runtime/middleware/seam.go
@@ -0,0 +1,482 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package middleware
+
+import (
+	"net/http"
+	"path"
+	"strings"
+
+	"github.com/go-openapi/runtime/server-middleware/docui"
+	"github.com/go-openapi/runtime/server-middleware/negotiate"
+)
+
+/////////////////////////////////////////////////////////:
+// Seam to the negotiate options introduced in v0.29.5
+/////////////////////////////////////////////////////////:
+
+// NegotiateOption configures [NegotiateContentType] behaviour.
+//
+// Deprecated: moved to the [negotiate] package. Use [negotiate.Option] instead.
+type NegotiateOption = negotiate.Option
+
+// NegotiateContentType returns the best offered content type for the
+// request's Accept header.
+//
+// Deprecated: moved to the [negotiate] package. Use [negotiate.ContentType] instead.
+func NegotiateContentType(r *http.Request, offers []string, defaultOffer string, opts ...NegotiateOption) string {
+	return negotiate.ContentType(r, offers, defaultOffer, opts...)
+}
+
+// NegotiateContentEncoding returns the best offered content encoding for
+// the request's Accept-Encoding header.
+//
+// Deprecated: moved to the [negotiate] package. Use [negotiate.ContentEncoding] instead.
+func NegotiateContentEncoding(r *http.Request, offers []string) string {
+	return negotiate.ContentEncoding(r, offers)
+}
+
+// WithIgnoreParameters returns a [NegotiateOption] that strips MIME-type
+// parameters from both Accept entries and offers before matching,
+// restoring the pre-v0.30 behaviour.
+//
+// Deprecated: moved to the [negotiate] package. Use [negotiate.WithIgnoreParameters] instead.
+func WithIgnoreParameters(ignore bool) NegotiateOption {
+	return negotiate.WithIgnoreParameters(ignore)
+}
+
+/////////////////////////////////////////////////////////:
+// Seam to the UI options
+/////////////////////////////////////////////////////////:
+
+// RapiDoc creates a [http.Handler] to serve a documentation site for a swagger spec.
+//
+// This allows for altering the spec before starting the [http] listener.
+//
+// Deprecated: moved to the [docui] package. Use [docui.RapiDoc] instead.
+func RapiDoc(opts RapiDocOpts, next http.Handler) http.Handler {
+	return docui.RapiDoc(next, opts.toFuncOptions()...)
+}
+
+// Redoc creates a [http.Handler] to serve a documentation site for a swagger spec.
+//
+// This allows for altering the spec before starting the [http] listener.
+//
+// Deprecated: moved to the [docui] package. Use [docui.Redoc] instead.
+func Redoc(opts RedocOpts, next http.Handler) http.Handler {
+	return docui.Redoc(next, opts.toFuncOptions()...)
+}
+
+// SwaggerUI creates a [http.Handler] to serve a documentation site for a swagger spec.
+//
+// This allows for altering the spec before starting the [http] listener.
+//
+// Deprecated: moved to the [docui] package. Use [docui.SwaggerUI] instead.
+func SwaggerUI(opts SwaggerUIOpts, next http.Handler) http.Handler {
+	return docui.SwaggerUI(next, opts.toFuncOptions()...)
+}
+
+// SwaggerUIOAuth2Callback creates a middleware that serves the OAuth2 callback page used by Swagger UI.
+//
+// Deprecated: moved to the [docui] package. Use [docui.SwaggerUIOAuth2Callback] instead.
+func SwaggerUIOAuth2Callback(opts SwaggerUIOpts, next http.Handler) http.Handler {
+	return docui.SwaggerUIOAuth2Callback(next, opts.toFuncOptions()...)
+}
+
+/////////////////////////////////////////////////////////:
+// Seam to the spec middleware options
+/////////////////////////////////////////////////////////:
+
+// SpecOption can be applied to the [Spec] serving [middleware].
+//
+// Deprecated: moved to the [docui] package. Use [docui.SpecOption] instead.
+type SpecOption func(*specOptions)
+
+type specOptions struct {
+	BasePath string
+	Path     string
+	Document string
+}
+
+func (o specOptions) fullPath() string {
+	return path.Join(o.BasePath, o.Path, o.Document)
+}
+
+func specOptionsWithDefaults(basePath string, opts []SpecOption) specOptions {
+	o := specOptions{
+		BasePath: "/",
+		Path:     "",
+		Document: "swagger.json",
+	}
+
+	for _, apply := range opts {
+		apply(&o)
+	}
+	if basePath != "" {
+		o.BasePath = basePath
+	}
+
+	return o
+}
+
+// Spec creates a [middleware] to serve a swagger spec as a JSON document.
+//
+// This allows for altering the spec before starting the [http] listener.
+//
+// The basePath argument indicates the path of the spec document (defaults to "/").
+// Additional [SpecOption] can be used to change the name of the document (defaults to "swagger.json").
+//
+// Deprecated: moved to the [docui] package as [docui.ServeSpec].
+func Spec(basePath string, spec []byte, next http.Handler, opts ...SpecOption) http.Handler {
+	o := specOptionsWithDefaults(basePath, opts)
+
+	return docui.ServeSpec(spec, next, docui.WithSpecPath(o.fullPath()))
+
+}
+
+// WithSpecPath sets the path to be joined to the base path of the
+// spec-serving middleware (see [docui.ServeSpec]).
+//
+// This is empty by default.
+func WithSpecPath(pth string) SpecOption {
+	return func(o *specOptions) {
+		o.Path = pth
+	}
+}
+
+// WithSpecDocument sets the name of the JSON document served as a spec.
+//
+// By default, this is "swagger.json".
+func WithSpecDocument(doc string) SpecOption {
+	return func(o *specOptions) {
+		if doc == "" {
+			return
+		}
+
+		o.Document = doc
+	}
+}
+
+// UIOptions defines common options for UI serving middlewares.
+//
+// Deprecated: use instead the function options provided by [docui].
+type UIOptions struct {
+	// BasePath for the UI, defaults to: /
+	BasePath string
+
+	// Path combines with BasePath to construct the path to the UI, defaults to: "docs".
+	Path string
+
+	// SpecURL is the URL of the spec document.
+	//
+	// Defaults to: /swagger.json
+	SpecURL string
+
+	// Title for the documentation site, default to: API documentation
+	Title string
+
+	// Template specifies a custom template to serve the UI
+	Template string
+}
+
+// toFuncOptions bridges the deprecated options struct with the newer function options in [docui].
+func (o UIOptions) toFuncOptions() []docui.Option {
+	const structMembers = 5
+	opts := make([]docui.Option, 0, structMembers)
+
+	if o.BasePath != "" {
+		opts = append(opts, docui.WithUIBasePath(o.BasePath))
+	}
+
+	if o.Path != "" {
+		opts = append(opts, docui.WithUIPath(o.Path))
+	}
+
+	if o.SpecURL != "" {
+		opts = append(opts, docui.WithSpecURL(o.SpecURL))
+	}
+
+	if o.Title != "" {
+		opts = append(opts, docui.WithUITitle(o.Title))
+	}
+
+	if o.Template != "" {
+		opts = append(opts, docui.WithUITemplate(o.Template))
+	}
+
+	return opts
+}
+
+// RapiDocOpts configures the [RapiDoc] middlewares.
+//
+// Deprecated: use instead the function options provided by [docui].
+type RapiDocOpts struct {
+	// BasePath for the UI, defaults to: /
+	BasePath string
+
+	// Path combines with BasePath to construct the path to the UI, defaults to: "docs".
+	Path string
+
+	// SpecURL is the URL of the spec document.
+	//
+	// Defaults to: /swagger.json
+	SpecURL string
+
+	// Title for the documentation site, default to: API documentation
+	Title string
+
+	// Template specifies a custom template to serve the UI
+	Template string
+
+	// RapiDocURL points to the js asset that generates the rapidoc site.
+	//
+	// Defaults to https://unpkg.com/rapidoc/dist/rapidoc-min.js
+	RapiDocURL string
+}
+
+func (o RapiDocOpts) toFuncOptions() []docui.Option {
+	const structMembers = 6
+	opts := make([]docui.Option, 0, structMembers)
+
+	if o.BasePath != "" {
+		opts = append(opts, docui.WithUIBasePath(o.BasePath))
+	}
+
+	if o.Path != "" {
+		opts = append(opts, docui.WithUIPath(o.Path))
+	}
+
+	if o.SpecURL != "" {
+		opts = append(opts, docui.WithSpecURL(o.SpecURL))
+	}
+
+	if o.Title != "" {
+		opts = append(opts, docui.WithUITitle(o.Title))
+	}
+
+	if o.Template != "" {
+		opts = append(opts, docui.WithUITemplate(o.Template))
+	}
+
+	if o.RapiDocURL != "" {
+		opts = append(opts, docui.WithUIAssetsURL(o.RapiDocURL))
+	}
+
+	return opts
+}
+
+// RedocOpts configures the [Redoc] middlewares.
+//
+// Deprecated: use instead the function options provided by [docui].
+type RedocOpts struct {
+	// BasePath for the UI, defaults to: /
+	BasePath string
+
+	// Path combines with BasePath to construct the path to the UI, defaults to: "docs".
+	Path string
+
+	// SpecURL is the URL of the spec document.
+	//
+	// Defaults to: /swagger.json
+	SpecURL string
+
+	// Title for the documentation site, default to: API documentation
+	Title string
+
+	// Template specifies a custom template to serve the UI
+	Template string
+
+	// RedocURL points to the js that generates the redoc site.
+	//
+	// Defaults to: https://cdn.jsdelivr.net/npm/redoc/bundles/redoc.standalone.js
+	RedocURL string
+}
+
+func (o RedocOpts) toFuncOptions() []docui.Option {
+	const structMembers = 6
+	opts := make([]docui.Option, 0, structMembers)
+
+	if o.BasePath != "" {
+		opts = append(opts, docui.WithUIBasePath(o.BasePath))
+	}
+
+	if o.Path != "" {
+		opts = append(opts, docui.WithUIPath(o.Path))
+	}
+
+	if o.SpecURL != "" {
+		opts = append(opts, docui.WithSpecURL(o.SpecURL))
+	}
+
+	if o.Title != "" {
+		opts = append(opts, docui.WithUITitle(o.Title))
+	}
+
+	if o.Template != "" {
+		opts = append(opts, docui.WithUITemplate(o.Template))
+	}
+
+	if o.RedocURL != "" {
+		opts = append(opts, docui.WithUIAssetsURL(o.RedocURL))
+	}
+
+	return opts
+}
+
+// SwaggerUIOpts configures the [SwaggerUI] [middleware].
+//
+// Deprecated: use instead the function options provided by [docui].
+type SwaggerUIOpts struct {
+	// BasePath for the API, defaults to: /
+	BasePath string
+
+	// Path combines with BasePath to construct the path to the UI, defaults to: "docs".
+	Path string
+
+	// SpecURL is the URL of the spec document.
+	//
+	// Defaults to: /swagger.json
+	SpecURL string
+
+	// Title for the documentation site, default to: API documentation
+	Title string
+
+	// Template specifies a custom template to serve the UI
+	Template string
+
+	// OAuthCallbackURL the url called after OAuth2 login
+	//
+	// NOTE: in the new [docui.SwaggerUIOptions] type, this field is named `OAuth2CallbackURL`,
+	// which is more appropriate.
+	OAuthCallbackURL string
+
+	// The three components needed to embed swagger-ui
+
+	// SwaggerURL points to the js that generates the SwaggerUI site.
+	//
+	// Defaults to: https://unpkg.com/swagger-ui-dist/swagger-ui-bundle.js
+	SwaggerURL string
+
+	SwaggerPresetURL string
+	SwaggerStylesURL string
+
+	Favicon32 string
+	Favicon16 string
+}
+
+func (o SwaggerUIOpts) toFuncOptions() []docui.Option {
+	const structMembers = 6
+	opts := make([]docui.Option, 0, structMembers)
+
+	if o.BasePath != "" {
+		opts = append(opts, docui.WithUIBasePath(o.BasePath))
+	}
+
+	if o.Path != "" {
+		opts = append(opts, docui.WithUIPath(o.Path))
+	}
+
+	if o.SpecURL != "" {
+		opts = append(opts, docui.WithSpecURL(o.SpecURL))
+	}
+
+	if o.Title != "" {
+		opts = append(opts, docui.WithUITitle(o.Title))
+	}
+
+	if o.Template != "" {
+		opts = append(opts, docui.WithUITemplate(o.Template))
+	}
+
+	if o.SwaggerURL != "" {
+		opts = append(opts, docui.WithUIAssetsURL(o.SwaggerURL))
+	}
+
+	var empty SwaggerUIOpts
+	if o != empty {
+		swaggeruiOpts := docui.SwaggerUIOptions{
+			OAuth2CallbackURL: o.OAuthCallbackURL,
+			SwaggerPresetURL:  o.SwaggerPresetURL,
+			SwaggerStylesURL:  o.SwaggerStylesURL,
+			Favicon32:         o.Favicon32,
+			Favicon16:         o.Favicon16,
+		}
+		opts = append(opts, docui.WithSwaggerUIOptions(swaggeruiOpts))
+	}
+
+	return opts
+}
+
+// UIOption can be applied to UI serving [middleware] to alter the default
+// behavior.
+//
+// Deprecated: use instead the function options provided by [docui].
+type UIOption func(*UIOptions)
+
+// uiOptionsWithDefaults applies the given options on top of an empty
+// [UIOptions]. Per-flavor handlers ([SwaggerUI], [Redoc], [RapiDoc])
+// fill in the remaining defaults via [UIOptions.EnsureDefaults] when
+// the option struct is used.
+func uiOptionsWithDefaults(opts []UIOption) UIOptions {
+	var o UIOptions
+	for _, apply := range opts {
+		apply(&o)
+	}
+
+	return o
+}
+
+// WithUIBasePath sets the base path from where to serve the UI assets.
+//
+// Deprecated: use instead the function options provided by [docui].
+func WithUIBasePath(base string) UIOption {
+	return func(o *UIOptions) {
+		if !strings.HasPrefix(base, "/") {
+			base = "/" + base
+		}
+		o.BasePath = base
+	}
+}
+
+// WithUIPath sets the path from where to serve the UI assets (i.e. /{basepath}/{path}.
+//
+// Deprecated: use instead the function options provided by [docui].
+func WithUIPath(pth string) UIOption {
+	return func(o *UIOptions) {
+		o.Path = pth
+	}
+}
+
+// WithUISpecURL sets the path from where to serve swagger spec document.
+//
+// This may be specified as a full URL or a path.
+//
+// By default, this is "/swagger.json".
+//
+// Deprecated: use instead the function options provided by [docui].
+func WithUISpecURL(specURL string) UIOption {
+	return func(o *UIOptions) {
+		o.SpecURL = specURL
+	}
+}
+
+// WithUITitle sets the title of the UI.
+//
+// Deprecated: use instead the function options provided by [docui].
+func WithUITitle(title string) UIOption {
+	return func(o *UIOptions) {
+		o.Title = title
+	}
+}
+
+// WithTemplate allows to set a custom template for the UI.
+//
+// UI [middleware] will panic if the template does not parse or execute properly.
+//
+// Deprecated: use instead the function options provided by [docui].
+func WithTemplate(tpl string) UIOption {
+	return func(o *UIOptions) {
+		o.Template = tpl
+	}
+}
diff --git a/vendor/github.com/go-openapi/runtime/middleware/spec.go b/vendor/github.com/go-openapi/runtime/middleware/spec.go
deleted file mode 100644
index 0a64a9572b..0000000000
--- a/vendor/github.com/go-openapi/runtime/middleware/spec.go
+++ /dev/null
@@ -1,91 +0,0 @@
-// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
-// SPDX-License-Identifier: Apache-2.0
-
-package middleware
-
-import (
-	"net/http"
-	"path"
-)
-
-const (
-	contentTypeHeader = "Content-Type"
-	applicationJSON   = "application/json"
-)
-
-// SpecOption can be applied to the Spec serving [middleware].
-type SpecOption func(*specOptions)
-
-var defaultSpecOptions = specOptions{
-	Path:     "",
-	Document: "swagger.json",
-}
-
-type specOptions struct {
-	Path     string
-	Document string
-}
-
-func specOptionsWithDefaults(opts []SpecOption) specOptions {
-	o := defaultSpecOptions
-	for _, apply := range opts {
-		apply(&o)
-	}
-
-	return o
-}
-
-// Spec creates a [middleware] to serve a swagger spec as a JSON document.
-//
-// This allows for altering the spec before starting the [http] listener.
-//
-// The basePath argument indicates the path of the spec document (defaults to "/").
-// Additional [SpecOption] can be used to change the name of the document (defaults to "swagger.json").
-func Spec(basePath string, b []byte, next http.Handler, opts ...SpecOption) http.Handler {
-	if basePath == "" {
-		basePath = "/"
-	}
-	o := specOptionsWithDefaults(opts)
-	pth := path.Join(basePath, o.Path, o.Document)
-
-	return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
-		if path.Clean(r.URL.Path) == pth {
-			rw.Header().Set(contentTypeHeader, applicationJSON)
-			rw.WriteHeader(http.StatusOK)
-			_, _ = rw.Write(b)
-
-			return
-		}
-
-		if next != nil {
-			next.ServeHTTP(rw, r)
-
-			return
-		}
-
-		rw.Header().Set(contentTypeHeader, applicationJSON)
-		rw.WriteHeader(http.StatusNotFound)
-	})
-}
-
-// WithSpecPath sets the path to be joined to the base path of the Spec [middleware].
-//
-// This is empty by default.
-func WithSpecPath(pth string) SpecOption {
-	return func(o *specOptions) {
-		o.Path = pth
-	}
-}
-
-// WithSpecDocument sets the name of the JSON document served as a spec.
-//
-// By default, this is "swagger.json".
-func WithSpecDocument(doc string) SpecOption {
-	return func(o *specOptions) {
-		if doc == "" {
-			return
-		}
-
-		o.Document = doc
-	}
-}
diff --git a/vendor/github.com/go-openapi/runtime/middleware/swaggerui.go b/vendor/github.com/go-openapi/runtime/middleware/swaggerui.go
deleted file mode 100644
index 14ed37ced6..0000000000
--- a/vendor/github.com/go-openapi/runtime/middleware/swaggerui.go
+++ /dev/null
@@ -1,178 +0,0 @@
-// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
-// SPDX-License-Identifier: Apache-2.0
-
-package middleware
-
-import (
-	"bytes"
-	"fmt"
-	"html/template"
-	"net/http"
-	"path"
-)
-
-// SwaggerUIOpts configures the [SwaggerUI] [middleware].
-type SwaggerUIOpts struct {
-	// BasePath for the API, defaults to: /
-	BasePath string
-
-	// Path combines with BasePath to construct the path to the UI, defaults to: "docs".
-	Path string
-
-	// SpecURL is the URL of the spec document.
-	//
-	// Defaults to: /swagger.json
-	SpecURL string
-
-	// Title for the documentation site, default to: API documentation
-	Title string
-
-	// Template specifies a custom template to serve the UI
-	Template string
-
-	// OAuthCallbackURL the url called after OAuth2 login
-	OAuthCallbackURL string
-
-	// The three components needed to embed swagger-ui
-
-	// SwaggerURL points to the js that generates the SwaggerUI site.
-	//
-	// Defaults to: https://unpkg.com/swagger-ui-dist/swagger-ui-bundle.js
-	SwaggerURL string
-
-	SwaggerPresetURL string
-	SwaggerStylesURL string
-
-	Favicon32 string
-	Favicon16 string
-}
-
-// EnsureDefaults in case some options are missing.
-func (r *SwaggerUIOpts) EnsureDefaults() {
-	r.ensureDefaults()
-
-	if r.Template == "" {
-		r.Template = swaggeruiTemplate
-	}
-}
-
-func (r *SwaggerUIOpts) EnsureDefaultsOauth2() {
-	r.ensureDefaults()
-
-	if r.Template == "" {
-		r.Template = swaggerOAuthTemplate
-	}
-}
-
-func (r *SwaggerUIOpts) ensureDefaults() {
-	common := toCommonUIOptions(r)
-	common.EnsureDefaults()
-	fromCommonToAnyOptions(common, r)
-
-	// swaggerui-specifics
-	if r.OAuthCallbackURL == "" {
-		r.OAuthCallbackURL = path.Join(r.BasePath, r.Path, "oauth2-callback")
-	}
-	if r.SwaggerURL == "" {
-		r.SwaggerURL = swaggerLatest
-	}
-	if r.SwaggerPresetURL == "" {
-		r.SwaggerPresetURL = swaggerPresetLatest
-	}
-	if r.SwaggerStylesURL == "" {
-		r.SwaggerStylesURL = swaggerStylesLatest
-	}
-	if r.Favicon16 == "" {
-		r.Favicon16 = swaggerFavicon16Latest
-	}
-	if r.Favicon32 == "" {
-		r.Favicon32 = swaggerFavicon32Latest
-	}
-}
-
-// SwaggerUI creates a [middleware] to serve a documentation site for a swagger spec.
-//
-// This allows for altering the spec before starting the [http] listener.
-func SwaggerUI(opts SwaggerUIOpts, next http.Handler) http.Handler {
-	opts.EnsureDefaults()
-
-	pth := path.Join(opts.BasePath, opts.Path)
-	tmpl := template.Must(template.New("swaggerui").Parse(opts.Template))
-	assets := bytes.NewBuffer(nil)
-	if err := tmpl.Execute(assets, opts); err != nil {
-		panic(fmt.Errorf("cannot execute template: %w", err))
-	}
-
-	return serveUI(pth, assets.Bytes(), next)
-}
-
-const (
-	swaggerLatest          = "https://unpkg.com/swagger-ui-dist/swagger-ui-bundle.js"
-	swaggerPresetLatest    = "https://unpkg.com/swagger-ui-dist/swagger-ui-standalone-preset.js"
-	swaggerStylesLatest    = "https://unpkg.com/swagger-ui-dist/swagger-ui.css"
-	swaggerFavicon32Latest = "https://unpkg.com/swagger-ui-dist/favicon-32x32.png"
-	swaggerFavicon16Latest = "https://unpkg.com/swagger-ui-dist/favicon-16x16.png"
-	swaggeruiTemplate      = `
-<!DOCTYPE html>
-<html lang="en">
-  <head>
-    <meta charset="UTF-8">
-		<title>{{ .Title }}</title>
-
-    <link rel="stylesheet" type="text/css" href="{{ .SwaggerStylesURL }}" >
-    <link rel="icon" type="image/png" href="{{ .Favicon32 }}" sizes="32x32" />
-    <link rel="icon" type="image/png" href="{{ .Favicon16 }}" sizes="16x16" />
-    <style>
-      html
-      {
-        box-sizing: border-box;
-        overflow: -moz-scrollbars-vertical;
-        overflow-y: scroll;
-      }
-
-      *,
-      *:before,
-      *:after
-      {
-        box-sizing: inherit;
-      }
-
-      body
-      {
-        margin:0;
-        background: #fafafa;
-      }
-    </style>
-  </head>
-
-  <body>
-    <div id="swagger-ui"></div>
-
-    <script src="{{ .SwaggerURL }}"> </script>
-    <script src="{{ .SwaggerPresetURL }}"> </script>
-    <script>
-    window.onload = function() {
-      // Begin Swagger UI call region
-      const ui = SwaggerUIBundle({
-        url: '{{ .SpecURL }}',
-        dom_id: '#swagger-ui',
-        deepLinking: true,
-        presets: [
-          SwaggerUIBundle.presets.apis,
-          SwaggerUIStandalonePreset
-        ],
-        plugins: [
-          SwaggerUIBundle.plugins.DownloadUrl
-        ],
-        layout: "StandaloneLayout",
-		oauth2RedirectUrl: '{{ .OAuthCallbackURL }}'
-      })
-      // End Swagger UI call region
-
-      window.ui = ui
-    }
-  </script>
-  </body>
-</html>
-`
-)
diff --git a/vendor/github.com/go-openapi/runtime/middleware/typeutils.go b/vendor/github.com/go-openapi/runtime/middleware/typeutils.go
new file mode 100644
index 0000000000..3f7d7976a1
--- /dev/null
+++ b/vendor/github.com/go-openapi/runtime/middleware/typeutils.go
@@ -0,0 +1,30 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package middleware
+
+import "strings"
+
+// normalizeOffer strips the parameter section (";...") from a media-type
+// string.
+func normalizeOffer(orig string) string {
+	// NOTE(maintainers): Despite its name (kept for historical reasons), this helper is
+	// not about Accept negotiation — it is used to derive the bare type that
+	// keys the producer/consumer maps registered on a [RoutableAPI].
+	// Those maps are looked up by the bare media type, so an entry registered as
+	// "application/json" satisfies a route that declares "application/json;
+	// charset=utf-8" and vice-versa.
+	const maxParts = 2
+
+	return strings.SplitN(orig, ";", maxParts)[0]
+}
+
+// normalizeOffers is the slice form of [normalizeOffer].
+func normalizeOffers(orig []string) []string {
+	norm := make([]string, 0, len(orig))
+	for _, o := range orig {
+		norm = append(norm, normalizeOffer(o))
+	}
+
+	return norm
+}
diff --git a/vendor/github.com/go-openapi/runtime/middleware/ui_options.go b/vendor/github.com/go-openapi/runtime/middleware/ui_options.go
deleted file mode 100644
index ed255426ad..0000000000
--- a/vendor/github.com/go-openapi/runtime/middleware/ui_options.go
+++ /dev/null
@@ -1,176 +0,0 @@
-// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
-// SPDX-License-Identifier: Apache-2.0
-
-package middleware
-
-import (
-	"bytes"
-	"encoding/gob"
-	"fmt"
-	"net/http"
-	"path"
-	"strings"
-)
-
-const (
-	// constants that are common to all UI-serving middlewares.
-	defaultDocsPath  = "docs"
-	defaultDocsURL   = "/swagger.json"
-	defaultDocsTitle = "API Documentation"
-)
-
-// uiOptions defines common options for UI serving middlewares.
-type uiOptions struct {
-	// BasePath for the UI, defaults to: /
-	BasePath string
-
-	// Path combines with BasePath to construct the path to the UI, defaults to: "docs".
-	Path string
-
-	// SpecURL is the URL of the spec document.
-	//
-	// Defaults to: /swagger.json
-	SpecURL string
-
-	// Title for the documentation site, default to: API documentation
-	Title string
-
-	// Template specifies a custom template to serve the UI
-	Template string
-}
-
-// toCommonUIOptions converts any UI option type to retain the common options.
-//
-// This uses gob encoding/decoding to convert common fields from one struct to another.
-func toCommonUIOptions(opts any) uiOptions {
-	var buf bytes.Buffer
-	enc := gob.NewEncoder(&buf)
-	dec := gob.NewDecoder(&buf)
-	var o uiOptions
-	err := enc.Encode(opts)
-	if err != nil {
-		panic(err)
-	}
-
-	err = dec.Decode(&o)
-	if err != nil {
-		panic(err)
-	}
-
-	return o
-}
-
-func fromCommonToAnyOptions[T any](source uiOptions, target *T) {
-	var buf bytes.Buffer
-	enc := gob.NewEncoder(&buf)
-	dec := gob.NewDecoder(&buf)
-	err := enc.Encode(source)
-	if err != nil {
-		panic(err)
-	}
-
-	err = dec.Decode(target)
-	if err != nil {
-		panic(err)
-	}
-}
-
-// UIOption can be applied to UI serving [middleware], such as Context.[APIHandler] or
-// Context.[APIHandlerSwaggerUI] to alter the default behavior.
-type UIOption func(*uiOptions)
-
-func uiOptionsWithDefaults(opts []UIOption) uiOptions {
-	var o uiOptions
-	for _, apply := range opts {
-		apply(&o)
-	}
-
-	return o
-}
-
-// WithUIBasePath sets the base path from where to serve the UI assets.
-//
-// By default, Context [middleware] sets this value to the API base path.
-func WithUIBasePath(base string) UIOption {
-	return func(o *uiOptions) {
-		if !strings.HasPrefix(base, "/") {
-			base = "/" + base
-		}
-		o.BasePath = base
-	}
-}
-
-// WithUIPath sets the path from where to serve the UI assets (i.e. /{basepath}/{path}.
-func WithUIPath(pth string) UIOption {
-	return func(o *uiOptions) {
-		o.Path = pth
-	}
-}
-
-// WithUISpecURL sets the path from where to serve swagger spec document.
-//
-// This may be specified as a full URL or a path.
-//
-// By default, this is "/swagger.json".
-func WithUISpecURL(specURL string) UIOption {
-	return func(o *uiOptions) {
-		o.SpecURL = specURL
-	}
-}
-
-// WithUITitle sets the title of the UI.
-//
-// By default, Context [middleware] sets this value to the title found in the API spec.
-func WithUITitle(title string) UIOption {
-	return func(o *uiOptions) {
-		o.Title = title
-	}
-}
-
-// WithTemplate allows to set a custom template for the UI.
-//
-// UI [middleware] will panic if the template does not parse or execute properly.
-func WithTemplate(tpl string) UIOption {
-	return func(o *uiOptions) {
-		o.Template = tpl
-	}
-}
-
-// EnsureDefaults in case some options are missing.
-func (r *uiOptions) EnsureDefaults() {
-	if r.BasePath == "" {
-		r.BasePath = "/"
-	}
-	if r.Path == "" {
-		r.Path = defaultDocsPath
-	}
-	if r.SpecURL == "" {
-		r.SpecURL = defaultDocsURL
-	}
-	if r.Title == "" {
-		r.Title = defaultDocsTitle
-	}
-}
-
-// serveUI creates a middleware that serves a templated asset as text/html.
-func serveUI(pth string, assets []byte, next http.Handler) http.Handler {
-	return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
-		if path.Clean(r.URL.Path) == pth {
-			rw.Header().Set(contentTypeHeader, "text/html; charset=utf-8")
-			rw.WriteHeader(http.StatusOK)
-			_, _ = rw.Write(assets)
-
-			return
-		}
-
-		if next != nil {
-			next.ServeHTTP(rw, r)
-
-			return
-		}
-
-		rw.Header().Set(contentTypeHeader, "text/plain")
-		rw.WriteHeader(http.StatusNotFound)
-		_, _ = fmt.Fprintf(rw, "%q not found", pth)
-	})
-}
diff --git a/vendor/github.com/go-openapi/runtime/middleware/validation.go b/vendor/github.com/go-openapi/runtime/middleware/validation.go
index 8a56490639..63a78d482a 100644
--- a/vendor/github.com/go-openapi/runtime/middleware/validation.go
+++ b/vendor/github.com/go-openapi/runtime/middleware/validation.go
@@ -4,13 +4,14 @@
 package middleware
 
 import (
-	"mime"
+	stderrors "errors"
 	"net/http"
 	"strings"
 
 	"github.com/go-openapi/errors"
+
 	"github.com/go-openapi/runtime"
-	"github.com/go-openapi/swag/stringutils"
+	"github.com/go-openapi/runtime/server-middleware/mediatype"
 )
 
 type validation struct {
@@ -21,24 +22,28 @@ type validation struct {
 	bound   map[string]any
 }
 
-// ContentType validates the content type of a request.
-func validateContentType(allowed []string, actual string) error {
+// validateContentType maps [mediatype.MatchFirst] to the runtime's
+// validation errors:
+//
+//   - actual fails to parse        → HTTP 400 ([errors.NewParseError]).
+//   - actual is well-formed but
+//     no allowed entry accepts it  → HTTP 415 ([errors.InvalidContentType]).
+//
+// In the standard runtime flow, malformed Content-Type headers are
+// already caught upstream by [runtime.ContentType] (which itself returns
+// a 400 [errors.ParseError]). This function therefore only sees the
+// malformed case when invoked directly by callers that have bypassed
+// that step.
+func validateContentType(allowed []string, actual string, opts ...mediatype.MatchOption) error {
 	if len(allowed) == 0 {
 		return nil
 	}
-	mt, _, err := mime.ParseMediaType(actual)
-	if err != nil {
-		return errors.InvalidContentType(actual, allowed)
-	}
-	if stringutils.ContainsStringsCI(allowed, mt) {
-		return nil
-	}
-	if stringutils.ContainsStringsCI(allowed, "*/*") {
+	_, ok, err := mediatype.MatchFirst(allowed, actual, opts...)
+	if ok {
 		return nil
 	}
-	parts := strings.Split(actual, "/")
-	if len(parts) == 2 && stringutils.ContainsStringsCI(allowed, parts[0]+"/*") {
-		return nil
+	if err != nil {
+		return errors.NewParseError(runtime.HeaderContentType, "header", actual, err)
 	}
 	return errors.InvalidContentType(actual, allowed)
 }
@@ -69,46 +74,53 @@ func (v *validation) debugLogf(format string, args ...any) {
 
 func (v *validation) parameters() {
 	v.debugLogf("validating request parameters for %s %s", v.request.Method, v.request.URL.EscapedPath())
-	if result := v.route.Binder.Bind(v.request, v.route.Params, v.route.Consumer, v.bound); result != nil {
-		if result.Error() == "validation failure list" {
-			for _, e := range result.(*errors.Validation).Value.([]any) {
-				v.result = append(v.result, e.(error))
-			}
-			return
+	result := v.route.Binder.bind(v.request, v.route.Params, v.route.Consumer, v.bound)
+	if result == nil {
+		return
+	}
+
+	for _, e := range result.Errors {
+		var validationErr *errors.Validation
+		if stderrors.As(e, &validationErr) {
+			v.result = append(v.result, validationErr)
 		}
-		v.result = append(v.result, result)
 	}
 }
 
 func (v *validation) contentType() {
-	if len(v.result) == 0 && runtime.HasBody(v.request) {
-		v.debugLogf("validating body content type for %s %s", v.request.Method, v.request.URL.EscapedPath())
-		ct, _, req, err := v.context.ContentType(v.request)
-		if err != nil {
+	if len(v.result) > 0 || !runtime.HasBody(v.request) {
+		return
+	}
+
+	v.debugLogf("validating body content type for %s %s", v.request.Method, v.request.URL.EscapedPath())
+	ct, _, req, err := v.context.ContentType(v.request)
+	if err != nil {
+		v.result = append(v.result, err)
+	} else {
+		v.request = req
+	}
+
+	if len(v.result) == 0 {
+		v.debugLogf("validating content type for %q against [%s]", ct, strings.Join(v.route.Consumes, ", "))
+		if err := validateContentType(v.route.Consumes, ct, v.context.matchOpts()...); err != nil {
 			v.result = append(v.result, err)
-		} else {
-			v.request = req
 		}
+	}
 
-		if len(v.result) == 0 {
-			v.debugLogf("validating content type for %q against [%s]", ct, strings.Join(v.route.Consumes, ", "))
-			if err := validateContentType(v.route.Consumes, ct); err != nil {
-				v.result = append(v.result, err)
-			}
-		}
-		if ct != "" && v.route.Consumer == nil {
-			cons, ok := v.route.Consumers[ct]
-			if !ok {
-				v.result = append(v.result, errors.New(http.StatusInternalServerError, "no consumer registered for %s", ct))
-			} else {
-				v.route.Consumer = cons
-			}
-		}
+	if ct == "" || v.route.Consumer != nil {
+		return
+	}
+
+	cons, ok := mediatype.Lookup(v.route.Consumers, ct, v.context.matchOpts()...)
+	if !ok {
+		v.result = append(v.result, errors.New(http.StatusInternalServerError, "no consumer registered for %s", ct))
+	} else {
+		v.route.Consumer = cons
 	}
 }
 
 func (v *validation) responseFormat() {
-	// if the route provides values for Produces and no format could be identify then return an error.
+	// if the route provides values for Produces and no format could be identified then return an error.
 	// if the route does not specify values for Produces then treat request as valid since the API designer
 	// choose not to specify the format for responses.
 	if str, rCtx := v.context.ResponseFormat(v.request, v.route.Produces); str == "" && len(v.route.Produces) > 0 {
diff --git a/vendor/github.com/go-openapi/runtime/security/authenticator.go b/vendor/github.com/go-openapi/runtime/security/authenticator.go
index 4c09101826..e521d95ef1 100644
--- a/vendor/github.com/go-openapi/runtime/security/authenticator.go
+++ b/vendor/github.com/go-openapi/runtime/security/authenticator.go
@@ -19,8 +19,8 @@ const (
 	accessTokenParam = "access_token"
 )
 
-// HttpAuthenticator is a function that authenticates a HTTP request.
-func HttpAuthenticator(handler func(*http.Request) (bool, any, error)) runtime.Authenticator { //nolint:revive
+// HTTPAuthenticator is a function that authenticates a HTTP request.
+func HTTPAuthenticator(handler func(*http.Request) (bool, any, error)) runtime.Authenticator {
 	return runtime.AuthenticatorFunc(func(params any) (bool, any, error) {
 		if request, ok := params.(*http.Request); ok {
 			return handler(request)
@@ -32,7 +32,14 @@ func HttpAuthenticator(handler func(*http.Request) (bool, any, error)) runtime.A
 	})
 }
 
-// ScopedAuthenticator is a function that authenticates a HTTP request against a list of valid scopes.
+// HttpAuthenticator aliases [HTTPAuthenticator] for backward-compatibility.
+//
+// Deprecated: use [HTTPAuthenticator] instead.
+func HttpAuthenticator(handler func(*http.Request) (bool, any, error)) runtime.Authenticator { //nolint:revive
+	return HTTPAuthenticator(handler)
+}
+
+// ScopedAuthenticator is a function that authenticates an [http.Request] against a list of valid scopes.
 func ScopedAuthenticator(handler func(*ScopedAuthRequest) (bool, any, error)) runtime.Authenticator {
 	return runtime.AuthenticatorFunc(func(params any) (bool, any, error) {
 		if request, ok := params.(*ScopedAuthRequest); ok {
@@ -42,22 +49,42 @@ func ScopedAuthenticator(handler func(*ScopedAuthRequest) (bool, any, error)) ru
 	})
 }
 
-// UserPassAuthentication authentication function.
+// UserPassAuthentication validates a basic-auth credential.
+//
+// Implementations comparing the password (or any derived secret) against a
+// known value MUST use [crypto/subtle.ConstantTimeCompare]: the runtime
+// extracts the credential from the request and delegates the comparison
+// here, and does not enforce a constant-time posture on the caller's behalf.
 type UserPassAuthentication func(string, string) (any, error)
 
-// UserPassAuthenticationCtx authentication function with [context.Context].
+// UserPassAuthenticationCtx is the [context.Context]-aware variant of
+// [UserPassAuthentication]. The same constant-time-comparison guidance
+// applies.
 type UserPassAuthenticationCtx func(context.Context, string, string) (context.Context, any, error)
 
-// TokenAuthentication authentication function.
+// TokenAuthentication validates an API-key token.
+//
+// Implementations comparing the token against a known value MUST use
+// [crypto/subtle.ConstantTimeCompare]; the runtime delegates the comparison
+// here and does not enforce a constant-time posture on the caller's behalf.
 type TokenAuthentication func(string) (any, error)
 
-// TokenAuthenticationCtx authentication function with [context.Context].
+// TokenAuthenticationCtx is the [context.Context]-aware variant of
+// [TokenAuthentication]. The same constant-time-comparison guidance
+// applies.
 type TokenAuthenticationCtx func(context.Context, string) (context.Context, any, error)
 
-// ScopedTokenAuthentication authentication function.
+// ScopedTokenAuthentication validates a bearer/OAuth2 token along with the
+// scopes required for the operation.
+//
+// Implementations comparing the token against a known value MUST use
+// [crypto/subtle.ConstantTimeCompare]; the runtime delegates the comparison
+// here and does not enforce a constant-time posture on the caller's behalf.
 type ScopedTokenAuthentication func(string, []string) (any, error)
 
-// ScopedTokenAuthenticationCtx authentication function with [context.Context].
+// ScopedTokenAuthenticationCtx is the [context.Context]-aware variant of
+// [ScopedTokenAuthentication]. The same constant-time-comparison guidance
+// applies.
 type ScopedTokenAuthenticationCtx func(context.Context, string, []string) (context.Context, any, error)
 
 var DefaultRealmName = "API"
@@ -199,7 +226,7 @@ func APIKeyAuthCtx(name, in string, authenticate TokenAuthenticationCtx) runtime
 	})
 }
 
-// ScopedAuthRequest contains both a [http] request and the required scopes for a particular operation.
+// ScopedAuthRequest contains both the [http.Request] and the required scopes for a particular operation.
 type ScopedAuthRequest struct {
 	Request        *http.Request
 	RequiredScopes []string
diff --git a/vendor/github.com/go-openapi/runtime/server-middleware/LICENSE b/vendor/github.com/go-openapi/runtime/server-middleware/LICENSE
new file mode 100644
index 0000000000..d645695673
--- /dev/null
+++ b/vendor/github.com/go-openapi/runtime/server-middleware/LICENSE
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/vendor/github.com/go-openapi/runtime/server-middleware/docui/doc.go b/vendor/github.com/go-openapi/runtime/server-middleware/docui/doc.go
new file mode 100644
index 0000000000..809296d5c4
--- /dev/null
+++ b/vendor/github.com/go-openapi/runtime/server-middleware/docui/doc.go
@@ -0,0 +1,12 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+// Package docui provides standalone HTTP middlewares that serve OpenAPI
+// documentation UIs (Swagger UI, ReDoc, RapiDoc) and the spec document
+// itself.
+//
+// The package is stdlib-only and has no transitive dependency on any
+// OpenAPI spec, loading or validation library, so it may be imported by
+// any net/http application that simply wants to mount a documentation
+// site.
+package docui
diff --git a/vendor/github.com/go-openapi/runtime/server-middleware/docui/options.go b/vendor/github.com/go-openapi/runtime/server-middleware/docui/options.go
new file mode 100644
index 0000000000..c9e45f7794
--- /dev/null
+++ b/vendor/github.com/go-openapi/runtime/server-middleware/docui/options.go
@@ -0,0 +1,253 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package docui
+
+import (
+	"net/http"
+	"net/url"
+	"strings"
+)
+
+const (
+	// constants that are common to all UI-serving middlewares.
+	defaultDocsPath  = "docs"
+	defaultDocsURL   = "/swagger.json"
+	defaultDocsTitle = "API Documentation"
+
+	contentTypeHeader = "Content-Type"
+	applicationJSON   = "application/json"
+)
+
+// UIMiddleware is a function returning a http middleware which accepts UI [Option].
+type UIMiddleware func(...Option) func(http.Handler) http.Handler
+
+// Option to tune your swagger documentation UI middleware.
+//
+// Options may be combined to alter the route at which the UI asset is served,
+// the URL of the spec document, the source URL of the UI asset and the title of the UI page.
+//
+// The embedded js scriptlet served may be modified using [WithUITemplate].
+type Option func(*options)
+
+// SpecOption can be applied to the [ServeSpec] middleware.
+type SpecOption func(*specOptions)
+
+// SwaggerUIOptions define a group of extra options specific to the SwaggerUI component.
+type SwaggerUIOptions struct {
+	// OAuth2CallbackURL sets the URL called after OAuth2 login
+	OAuth2CallbackURL string
+
+	// Defines the URL of the swagger UI assets with presets.
+	//
+	// Default: https://unpkg.com/swagger-ui-dist/swagger-ui-standalone-preset.js
+	SwaggerPresetURL string
+
+	// Defines style sheet URL.
+	//
+	// Default: https://unpkg.com/swagger-ui-dist/swagger-ui.css
+	SwaggerStylesURL string
+
+	// Define the favicons URLs.
+	//
+	// Defaults:
+	//
+	//   - 16x16: https://unpkg.com/swagger-ui-dist/favicon-16x16.png
+	//   - 32x32: https://unpkg.com/swagger-ui-dist/favicon-32x32.png
+	Favicon32 string
+	Favicon16 string
+}
+
+func (o *SwaggerUIOptions) applySwaggerUIDefaults() {
+	if o.SwaggerPresetURL == "" {
+		o.SwaggerPresetURL = swaggerPresetLatest
+	}
+	if o.SwaggerStylesURL == "" {
+		o.SwaggerStylesURL = swaggerStylesLatest
+	}
+	if o.Favicon16 == "" || o.Favicon32 == "" {
+		o.Favicon16 = swaggerFavicon16Latest
+		o.Favicon32 = swaggerFavicon32Latest
+	}
+}
+
+type (
+	options struct {
+		SwaggerUIOptions
+
+		// BasePath for the UI, defaults to: /
+		BasePath string
+
+		// Path combines with BasePath to construct the path to the UI, defaults to: "docs".
+		Path string
+
+		// SpecURL is the URL of the spec document.
+		SpecURL string
+
+		// Title for the documentation site, default to: API documentation
+		Title string
+
+		// Template specifies a custom template to serve the UI
+		Template string
+
+		// AssetsURL points to the js asset that generates the documentation page.
+		AssetsURL string
+	}
+
+	specOptions struct {
+		Path     string
+		Document string
+	}
+)
+
+////////////////////////////////////////////////////////////
+// Common UI options
+////////////////////////////////////////////////////////////
+
+// WithUIBasePath sets the base path from where to serve the UI assets.
+//
+// Default: "/"
+func WithUIBasePath(base string) Option {
+	return func(o *options) {
+		if !strings.HasPrefix(base, "/") {
+			base = "/" + base
+		}
+		o.BasePath = base
+	}
+}
+
+// WithUIPath sets the path from where to serve the UI assets (i.e. /{basepath}/{path}).
+//
+// Default: "docs"
+func WithUIPath(pth string) Option {
+	return func(o *options) {
+		o.Path = pth
+	}
+}
+
+// WithUITitle sets the title of the UI.
+//
+// Default: "API documentation"
+func WithUITitle(title string) Option {
+	return func(o *options) {
+		o.Title = title
+	}
+}
+
+// WithUIAssetsURL sets the URL from where to fetch the js assets.
+//
+// Defaults:
+//
+//   - for Redoc: https://cdn.jsdelivr.net/npm/redoc/bundles/redoc.standalone.js
+//   - for RapiDoc, this defaults to: https://unpkg.com/rapidoc/dist/rapidoc-min.js
+//   - for SwaggerUI: https://unpkg.com/swagger-ui-dist/swagger-ui-bundle.js
+func WithUIAssetsURL(assets string) Option {
+	return func(o *options) {
+		o.AssetsURL = assets
+	}
+}
+
+// WithUITemplate allows to set a custom template for the UI.
+//
+// This allows the caller to fully customize the rendered UI, using the advanced options
+// provided by any UI.
+//
+// The UI [middleware] will panic if the template does not parse or execute properly.
+//
+// Reference documentations to customize your js scriptlet:
+//
+//   - for Redoc: https://github.com/Redocly/redoc/blob/main/docs/deployment/html.md
+//   - for RapiDoc: https://github.com/rapi-doc/RapiDoc
+//   - for SwaggerUI: https://github.com/swagger-api/swagger-ui
+func WithUITemplate[StringOrBytes ~string | ~[]byte](tpl StringOrBytes) Option {
+	return func(o *options) {
+		o.Template = string(tpl)
+	}
+}
+
+// WithSpecURL sets the URL of the spec document.
+//
+// Defaults to: /swagger.json
+func WithSpecURL(u string) Option {
+	return func(o *options) {
+		o.SpecURL = u
+	}
+}
+
+////////////////////////////////////////////////////////////
+// SwaggerUI UI options
+////////////////////////////////////////////////////////////
+
+func WithSwaggerUIOptions(opts SwaggerUIOptions) Option {
+	return func(o *options) {
+		o.SwaggerUIOptions = opts
+	}
+}
+
+////////////////////////////////////////////////////////////
+// Spec options
+////////////////////////////////////////////////////////////
+
+// WithSpecPath sets the path of the spec document.
+//
+// This is "/swagger.json" by default.
+func WithSpecPath(pth string) SpecOption {
+	return func(o *specOptions) {
+		if pth == "" {
+			return
+		}
+
+		o.Path = pth
+	}
+}
+
+// WithSpecPathFromOptions reuses the same SpecPath as the one specified in
+// a set of UI [Option] (extract the path from the URL provided by [WithSpecURL]).
+func WithSpecPathFromOptions(opts ...Option) SpecOption {
+	return func(o *specOptions) {
+		uiOpts := optionsWithDefaults(opts)
+
+		// If the spec URL is provided, there is a non-default path to serve the spec.
+		//
+		// This makes sure that the UI middleware is aligned with the Spec middleware.
+		u, _ := url.Parse(uiOpts.SpecURL)
+
+		if u.Path == "" {
+			return
+		}
+
+		o.Path = u.Path
+	}
+}
+
+func optionsWithDefaults(opts []Option, prepend ...Option) options {
+	o := options{
+		BasePath: "/",
+		Path:     defaultDocsPath,
+		SpecURL:  defaultDocsURL,
+		Title:    defaultDocsTitle,
+	}
+
+	prepend = append(prepend, opts...)
+	for _, apply := range prepend {
+		apply(&o)
+	}
+
+	return o
+}
+
+func specOptionsWithDefaults(opts []SpecOption) specOptions {
+	o := specOptions{
+		Path: defaultDocsURL,
+	}
+
+	for _, apply := range opts {
+		apply(&o)
+	}
+
+	if !strings.HasPrefix(o.Path, "/") {
+		o.Path = "/" + o.Path
+	}
+
+	return o
+}
diff --git a/vendor/github.com/go-openapi/runtime/server-middleware/docui/rapidoc.go b/vendor/github.com/go-openapi/runtime/server-middleware/docui/rapidoc.go
new file mode 100644
index 0000000000..c050331b4b
--- /dev/null
+++ b/vendor/github.com/go-openapi/runtime/server-middleware/docui/rapidoc.go
@@ -0,0 +1,67 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package docui
+
+import (
+	"bytes"
+	"fmt"
+	"html/template"
+	"net/http"
+	"path"
+)
+
+// UseRapiDoc creates a middleware to serve a documentation site for a swagger spec using [RapidDoc].
+//
+// [RapiDoc]: https://github.com/rapi-doc/RapiDoc
+func UseRapiDoc(opts ...Option) func(next http.Handler) http.Handler {
+	pth, assets := rapiDocSetup(opts)
+	return func(next http.Handler) http.Handler {
+		return serveUI(pth, assets, next)
+	}
+}
+
+// RapiDoc creates a [http.Handler] to serve a documentation site for a swagger spec using [RapidDoc].
+//
+// By default, the UI is served at route "/docs"
+//
+// This allows for altering the spec before starting the [http] listener.
+//
+// [RapiDoc]: https://github.com/rapi-doc/RapiDoc
+func RapiDoc(next http.Handler, opts ...Option) http.Handler {
+	pth, assets := rapiDocSetup(opts)
+
+	return serveUI(pth, assets, next)
+}
+
+func rapiDocSetup(opts []Option) (pth string, assets []byte) {
+	o := optionsWithDefaults(opts,
+		// defaults for rapiDoc
+		WithUITemplate(rapidocTemplate),
+		WithUIAssetsURL(rapidocLatest),
+	)
+	pth = path.Join(o.BasePath, o.Path)
+	tmpl := template.Must(template.New("rapidoc").Parse(o.Template))
+	buf := bytes.NewBuffer(nil)
+	if err := tmpl.Execute(buf, o); err != nil {
+		panic(fmt.Errorf("cannot execute template: %w", err))
+	}
+
+	return pth, buf.Bytes()
+}
+
+const (
+	rapidocLatest   = "https://unpkg.com/rapidoc/dist/rapidoc-min.js"
+	rapidocTemplate = `<!doctype html>
+<html>
+<head>
+  <title>{{ .Title }}</title>
+  <meta charset="utf-8"> <!-- Important: rapi-doc uses utf8 characters -->
+  <script type="module" src="{{ .AssetsURL }}"></script>
+</head>
+<body>
+  <rapi-doc spec-url="{{ .SpecURL }}"></rapi-doc>
+</body>
+</html>
+`
+)
diff --git a/vendor/github.com/go-openapi/runtime/server-middleware/docui/redoc.go b/vendor/github.com/go-openapi/runtime/server-middleware/docui/redoc.go
new file mode 100644
index 0000000000..31054a2476
--- /dev/null
+++ b/vendor/github.com/go-openapi/runtime/server-middleware/docui/redoc.go
@@ -0,0 +1,82 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package docui
+
+import (
+	"bytes"
+	"fmt"
+	"html/template"
+	"net/http"
+	"path"
+)
+
+// UseRedoc creates a middleware to serve a documentation site for a swagger spec using [Redoc].
+//
+// [Redoc]: https://redocly.com/docs/redoc
+func UseRedoc(opts ...Option) func(next http.Handler) http.Handler {
+	pth, assets := redocSetup(opts)
+
+	return func(next http.Handler) http.Handler {
+		return serveUI(pth, assets, next)
+	}
+}
+
+// Redoc creates a [http.Handler] to serve a documentation site for a swagger spec using [Redoc].
+//
+// By default, the UI is served at route "/docs"
+//
+// This allows for altering the spec before starting the [http] listener.
+//
+// [Redoc]: https://redocly.com/docs/redoc
+func Redoc(next http.Handler, opts ...Option) http.Handler {
+	pth, assets := redocSetup(opts)
+
+	return serveUI(pth, assets, next)
+}
+
+func redocSetup(opts []Option) (pth string, assets []byte) {
+	o := optionsWithDefaults(opts,
+		// defaults for redoc
+		WithUITemplate(redocTemplate),
+		WithUIAssetsURL(redocLatest),
+	)
+
+	pth = path.Join(o.BasePath, o.Path)
+	tmpl := template.Must(template.New("redoc").Parse(o.Template))
+	buf := bytes.NewBuffer(nil)
+	if err := tmpl.Execute(buf, o); err != nil {
+		panic(fmt.Errorf("cannot execute template: %w", err))
+	}
+
+	return pth, buf.Bytes()
+}
+
+const (
+	redocLatest   = "https://cdn.redoc.ly/redoc/latest/bundles/redoc.standalone.js" // "https://cdn.jsdelivr.net/npm/redoc/bundles/redoc.standalone.js"
+	redocTemplate = `<!DOCTYPE html>
+<html>
+  <head>
+    <title>{{ .Title }}</title>
+		<!-- needed for adaptive design -->
+		<meta charset="utf-8"/>
+		<meta name="viewport" content="width=device-width, initial-scale=1">
+		<link href="https://fonts.googleapis.com/css?family=Montserrat:300,400,700|Roboto:300,400,700" rel="stylesheet">
+
+    <!--
+    ReDoc doesn't change outer page styles
+    -->
+    <style>
+      body {
+        margin: 0;
+        padding: 0;
+      }
+    </style>
+  </head>
+  <body>
+    <redoc spec-url='{{ .SpecURL }}'></redoc>
+    <script src="{{ .AssetsURL }}"> </script>
+  </body>
+</html>
+`
+)
diff --git a/vendor/github.com/go-openapi/runtime/server-middleware/docui/render.go b/vendor/github.com/go-openapi/runtime/server-middleware/docui/render.go
new file mode 100644
index 0000000000..1fb744fd00
--- /dev/null
+++ b/vendor/github.com/go-openapi/runtime/server-middleware/docui/render.go
@@ -0,0 +1,33 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package docui
+
+import (
+	"fmt"
+	"net/http"
+	"path"
+)
+
+// serveUI creates a [http.Handler] that serves a templated asset as text/html.
+func serveUI(pth string, assets []byte, next http.Handler) http.Handler {
+	return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+		if path.Clean(r.URL.Path) == pth {
+			rw.Header().Set(contentTypeHeader, "text/html; charset=utf-8")
+			rw.WriteHeader(http.StatusOK)
+			_, _ = rw.Write(assets)
+
+			return
+		}
+
+		if next != nil {
+			next.ServeHTTP(rw, r)
+
+			return
+		}
+
+		rw.Header().Set(contentTypeHeader, "text/plain")
+		rw.WriteHeader(http.StatusNotFound)
+		_, _ = fmt.Fprintf(rw, "%q not found", pth)
+	})
+}
diff --git a/vendor/github.com/go-openapi/runtime/server-middleware/docui/spec.go b/vendor/github.com/go-openapi/runtime/server-middleware/docui/spec.go
new file mode 100644
index 0000000000..59780199d5
--- /dev/null
+++ b/vendor/github.com/go-openapi/runtime/server-middleware/docui/spec.go
@@ -0,0 +1,50 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package docui
+
+import (
+	"net/http"
+	"path"
+)
+
+// UseSpec creates a middleware to serve a swagger spec as a JSON document.
+func UseSpec(spec []byte, opts ...SpecOption) func(next http.Handler) http.Handler {
+	o := specOptionsWithDefaults(opts)
+
+	return func(next http.Handler) http.Handler {
+		return handleSpec(o.Path, spec, next)
+	}
+}
+
+// ServeSpec creates a [http.Handler] to serve a swagger spec as a JSON document.
+//
+// This allows for altering the spec before starting the [http] listener.
+//
+// Additional [SpecOption] can be used to change the path and the name of the document (defaults to "/swagger.json").
+func ServeSpec(spec []byte, next http.Handler, opts ...SpecOption) http.Handler {
+	o := specOptionsWithDefaults(opts)
+
+	return handleSpec(o.Path, spec, next)
+}
+
+func handleSpec(pth string, spec []byte, next http.Handler) http.Handler {
+	return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+		if path.Clean(r.URL.Path) == pth {
+			rw.Header().Set(contentTypeHeader, applicationJSON)
+			rw.WriteHeader(http.StatusOK)
+			_, _ = rw.Write(spec)
+
+			return
+		}
+
+		if next != nil {
+			next.ServeHTTP(rw, r)
+
+			return
+		}
+
+		rw.Header().Set(contentTypeHeader, applicationJSON)
+		rw.WriteHeader(http.StatusNotFound)
+	})
+}
diff --git a/vendor/github.com/go-openapi/runtime/server-middleware/docui/swaggerui.go b/vendor/github.com/go-openapi/runtime/server-middleware/docui/swaggerui.go
new file mode 100644
index 0000000000..db0aa05e6a
--- /dev/null
+++ b/vendor/github.com/go-openapi/runtime/server-middleware/docui/swaggerui.go
@@ -0,0 +1,138 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package docui
+
+import (
+	"bytes"
+	"fmt"
+	"html/template"
+	"net/http"
+	"path"
+)
+
+// UseSwaggerUI creates a middleware to serve a documentation site for a swagger spec using [SwaggerUI].
+//
+// [SwaggerUI]: https://swagger.io/tools/swagger-ui
+func UseSwaggerUI(opts ...Option) func(next http.Handler) http.Handler {
+	pth, assets := swaggeruiSetup(opts)
+
+	return func(next http.Handler) http.Handler {
+		return serveUI(pth, assets, next)
+	}
+}
+
+// SwaggerUI creates a [http.Handler] to serve a documentation site for a swagger spec using [SwaggerUI].
+//
+// By default, the UI is served at route "/docs"
+//
+// This allows for altering the spec before starting the [http] listener.
+//
+// [SwaggerUI]: https://swagger.io/tools/swagger-ui
+func SwaggerUI(next http.Handler, opts ...Option) http.Handler {
+	pth, assets := swaggeruiSetup(opts)
+
+	return serveUI(pth, assets, next)
+}
+
+func swaggeruiSetup(opts []Option) (pth string, assets []byte) {
+	o := optionsWithDefaults(opts,
+		// defaults for SwaggerUI
+		WithUITemplate(swaggeruiTemplate),
+		WithUIAssetsURL(swaggerLatest),
+	)
+	o.applySwaggerUIDefaults()
+	if o.OAuth2CallbackURL == "" {
+		o.OAuth2CallbackURL = path.Join(o.BasePath, o.Path, "oauth2-callback")
+	}
+
+	pth = path.Join(o.BasePath, o.Path)
+	tmpl := template.Must(template.New("swaggerui").Parse(o.Template))
+	buf := bytes.NewBuffer(nil)
+	if err := tmpl.Execute(buf, o); err != nil {
+		panic(fmt.Errorf("cannot execute template: %w", err))
+	}
+
+	return pth, buf.Bytes()
+}
+
+const (
+	swaggerLatest          = "https://unpkg.com/swagger-ui-dist/swagger-ui-bundle.js"
+	swaggerPresetLatest    = "https://unpkg.com/swagger-ui-dist/swagger-ui-standalone-preset.js"
+	swaggerStylesLatest    = "https://unpkg.com/swagger-ui-dist/swagger-ui.css"
+	swaggerFavicon32Latest = "https://unpkg.com/swagger-ui-dist/favicon-32x32.png"
+	swaggerFavicon16Latest = "https://unpkg.com/swagger-ui-dist/favicon-16x16.png"
+	swaggeruiTemplate      = `
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8">
+		<title>{{ .Title }}</title>
+
+	  {{- if .SwaggerStylesURL }}
+    <link rel="stylesheet" type="text/css" href="{{ .SwaggerStylesURL }}" />
+	  {{- end }}
+	  {{- if .Favicon32 }}
+    <link rel="icon" type="image/png" href="{{ .Favicon32 }}" sizes="32x32" />
+	  {{- end }}
+	  {{- if .Favicon16 }}
+    <link rel="icon" type="image/png" href="{{ .Favicon16 }}" sizes="16x16" />
+	  {{- end }}
+    <style>
+      html
+      {
+        box-sizing: border-box;
+        overflow: -moz-scrollbars-vertical;
+        overflow-y: scroll;
+      }
+
+      *,
+      *:before,
+      *:after
+      {
+        box-sizing: inherit;
+      }
+
+      body
+      {
+        margin:0;
+        background: #fafafa;
+      }
+    </style>
+  </head>
+
+  <body>
+    <div id="swagger-ui"></div>
+
+    <script src="{{ .AssetsURL }}"> </script>
+	  {{- if .SwaggerPresetURL }}
+    <script src="{{ .SwaggerPresetURL }}"> </script>
+	  {{- end }}
+    <script>
+    window.onload = function() {
+      // Begin Swagger UI call region
+      const ui = SwaggerUIBundle({
+        url: '{{ .SpecURL }}',
+        dom_id: '#swagger-ui',
+        deepLinking: true,
+        presets: [
+          SwaggerUIBundle.presets.apis,
+          SwaggerUIStandalonePreset
+        ],
+        plugins: [
+          SwaggerUIBundle.plugins.DownloadUrl
+        ],
+        layout: "StandaloneLayout",
+	      {{- if .OAuth2CallbackURL }}
+        oauth2RedirectUrl: '{{ .OAuth2CallbackURL }}'
+	      {{- end }}
+      })
+      // End Swagger UI call region
+
+      window.ui = ui
+    }
+  </script>
+  </body>
+</html>
+`
+)
diff --git a/vendor/github.com/go-openapi/runtime/middleware/swaggerui_oauth2.go b/vendor/github.com/go-openapi/runtime/server-middleware/docui/swaggerui_oauth2.go
similarity index 70%
rename from vendor/github.com/go-openapi/runtime/middleware/swaggerui_oauth2.go
rename to vendor/github.com/go-openapi/runtime/server-middleware/docui/swaggerui_oauth2.go
index 879bdbaade..a38e408f15 100644
--- a/vendor/github.com/go-openapi/runtime/middleware/swaggerui_oauth2.go
+++ b/vendor/github.com/go-openapi/runtime/server-middleware/docui/swaggerui_oauth2.go
@@ -1,30 +1,56 @@
 // SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
 // SPDX-License-Identifier: Apache-2.0
 
-package middleware
+package docui
 
 import (
 	"bytes"
 	"fmt"
 	"net/http"
+	"path"
 	"text/template"
 )
 
-func SwaggerUIOAuth2Callback(opts SwaggerUIOpts, next http.Handler) http.Handler {
-	opts.EnsureDefaultsOauth2()
+// UseSwaggerUIOAuth2Callback creates a middleware that serves a callback URL to complete
+// a OAuth2 token handshake.
+func UseSwaggerUIOAuth2Callback(opts ...Option) func(next http.Handler) http.Handler {
+	pth, assets := swaggeruiOAuth2Setup(opts)
 
-	pth := opts.OAuthCallbackURL
-	tmpl := template.Must(template.New("swaggeroauth").Parse(opts.Template))
-	assets := bytes.NewBuffer(nil)
-	if err := tmpl.Execute(assets, opts); err != nil {
+	return func(next http.Handler) http.Handler {
+		return serveUI(pth, assets, next)
+	}
+}
+
+// SwaggerUIOAuth2Callback creates a [http.Handler] that serves a callback URL to complete
+// a OAuth2 token handshake.
+func SwaggerUIOAuth2Callback(next http.Handler, opts ...Option) http.Handler {
+	pth, assets := swaggeruiOAuth2Setup(opts)
+
+	return serveUI(pth, assets, next)
+}
+
+func swaggeruiOAuth2Setup(opts []Option) (pth string, assets []byte) {
+	o := optionsWithDefaults(opts,
+		// defaults for SwaggerUI OAuth2 callback endpoint
+		WithUITemplate(swaggerOAuth2Template),
+		WithUIAssetsURL(swaggerLatest),
+	)
+	o.applySwaggerUIDefaults()
+	if o.OAuth2CallbackURL == "" {
+		o.OAuth2CallbackURL = path.Join(o.BasePath, o.Path, "oauth2-callback")
+	}
+
+	pth = o.OAuth2CallbackURL
+	tmpl := template.Must(template.New("swaggeroauth2").Parse(o.Template))
+	buf := bytes.NewBuffer(nil)
+	if err := tmpl.Execute(buf, o); err != nil {
 		panic(fmt.Errorf("cannot execute template: %w", err))
 	}
 
-	return serveUI(pth, assets.Bytes(), next)
+	return pth, buf.Bytes()
 }
 
-const (
-	swaggerOAuthTemplate = `
+const swaggerOAuth2Template = `
 <!DOCTYPE html>
 <html lang="en">
 <head>
@@ -105,4 +131,3 @@ const (
 </body>
 </html>
 `
-)
diff --git a/vendor/github.com/go-openapi/runtime/server-middleware/mediatype/doc.go b/vendor/github.com/go-openapi/runtime/server-middleware/mediatype/doc.go
new file mode 100644
index 0000000000..6f8aa31352
--- /dev/null
+++ b/vendor/github.com/go-openapi/runtime/server-middleware/mediatype/doc.go
@@ -0,0 +1,30 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+// Package mediatype provides a typed value for media types
+// defined by RFC 7231 and RFC 2045.
+//
+// The matching/selection primitives used by both server-side
+// validation and Accept-header negotiation.
+//
+// The package is stdlib-only.
+//
+// # The matching rule
+//
+// [MediaType.Matches] is asymmetric. The receiver acts as the "bound"
+// (an allowed entry on the server side, or a candidate offer when
+// matching against an Accept entry); the argument is the constraint
+// (the actual incoming request, or the Accept entry being satisfied).
+//
+//   - bare type/subtype must agree, with wildcard handling on either
+//     side ("*/*" matches anything; "type/*" matches any subtype);
+//   - if the receiver carries no parameters, any constraint is
+//     accepted regardless of its parameters;
+//   - otherwise every (key,value) pair on the constraint must be
+//     present on the receiver, with case-insensitive value
+//     comparison. The receiver may carry additional parameters the
+//     constraint does not list.
+//
+// q-values are NOT considered by [MediaType.Matches] — they are the
+// negotiator's concern, handled inside [Set.BestMatch].
+package mediatype
diff --git a/vendor/github.com/go-openapi/runtime/server-middleware/mediatype/lookup.go b/vendor/github.com/go-openapi/runtime/server-middleware/mediatype/lookup.go
new file mode 100644
index 0000000000..598b60aca3
--- /dev/null
+++ b/vendor/github.com/go-openapi/runtime/server-middleware/mediatype/lookup.go
@@ -0,0 +1,116 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package mediatype
+
+// Lookup finds the entry in m matching mediaType, with alias-aware
+// fallback. It is the canonical seam for codec-map lookups in both
+// the client and server runtimes — placing the fallback policy here
+// keeps alias definitions (and any future lookup tolerances) in one
+// place.
+//
+// Lookup tries the following, in order, returning the first hit:
+//
+//  1. mediaType verbatim (fast path for callers that already pass a
+//     canonical, parameter-free string and store map keys in the
+//     same form).
+//  2. An alias-aware walk against the parsed "type/subtype" form:
+//     a direct map hit on the parsed key, on its alias canonical
+//     if any, and finally an O(len(m)) scan returning any map
+//     entry whose key alias-canonicalizes to the same target.
+//     Catches both "map keyed by canonical, query uses alias" and
+//     "map keyed by one alias, query uses another alias of the
+//     same canonical".
+//  3. When [AllowSuffix] is passed in opts: the same alias-aware
+//     walk against the RFC 6839 structured-syntax suffix base.
+//     Catches the "spec/traffic divergence" case (request for
+//     application/vnd.api+json finds a JSON consumer registered
+//     under application/json). Query-side suffix fold only — no
+//     map-side suffix folding.
+//
+// Lookup does NOT fall back to "*/*". Callers that want wildcard
+// behavior (the historical resolveConsumer pattern in the client
+// runtime) chain that themselves after a Lookup miss — keeping
+// wildcard semantics explicit at each call site.
+//
+// Map keys are expected in canonical "type/subtype" form (no
+// parameters). The runtime's default Consumers / Producers maps
+// follow this convention.
+//
+// Returns (zero, false) when:
+//
+//   - m is empty;
+//   - mediaType fails to parse and is not present verbatim;
+//   - none of the active steps hits.
+//
+// The malformed-vs-not-found distinction is intentionally elided:
+// codec-lookup callers treat both as the same "no codec" error path.
+func Lookup[T any](m map[string]T, mediaType string, opts ...MatchOption) (T, bool) {
+	var zero T
+	if len(m) == 0 {
+		return zero, false
+	}
+	o := applyMatchOptions(opts)
+	// Fast path: raw key (preserves any caller behaviour that stored
+	// non-canonical strings as map keys, and skips parsing in the
+	// common already-canonical case).
+	if v, ok := m[mediaType]; ok {
+		return v, true
+	}
+	mt, err := Parse(mediaType)
+	if err != nil {
+		return zero, false
+	}
+	key := mt.Type + "/" + mt.Subtype
+	if v, ok := findByCanonical(m, key); ok {
+		return v, true
+	}
+	if o.allowSuffix && mt.Suffix != "" {
+		base := mt.Base()
+		if baseKey := base.Type + "/" + base.Subtype; baseKey != key {
+			if v, ok := findByCanonical(m, baseKey); ok {
+				return v, true
+			}
+		}
+	}
+	return zero, false
+}
+
+// findByCanonical returns the first entry in m whose key
+// alias-canonicalizes to the same value as target.
+//
+// Tries direct hits before the O(len(m)) walk:
+//
+//  1. m[target] — map keyed by the same string.
+//  2. m[aliases[target]] — map keyed by the canonical when target
+//     is an alias.
+//  3. Walk m: return any entry where canonical(k) == canonical(target).
+//     Catches the "map keyed by an alias different from the query
+//     side" case (e.g. registered under text/yaml, queried as
+//     application/x-yaml — both canonicalize to application/yaml).
+//
+// Map size is single-digit for the runtime's codec maps, so the
+// walk is negligible.
+func findByCanonical[T any](m map[string]T, target string) (T, bool) {
+	if v, ok := m[target]; ok {
+		return v, true
+	}
+	canonTarget := target
+	if canon, ok := aliases[target]; ok {
+		canonTarget = canon
+		if v, ok := m[canonTarget]; ok {
+			return v, true
+		}
+	}
+	for k, v := range m {
+		kCanon := k
+		if c, ok := aliases[k]; ok {
+			kCanon = c
+		}
+		if kCanon == canonTarget {
+			return v, true
+		}
+	}
+	var zero T
+	return zero, false
+}
diff --git a/vendor/github.com/go-openapi/runtime/server-middleware/mediatype/match.go b/vendor/github.com/go-openapi/runtime/server-middleware/mediatype/match.go
new file mode 100644
index 0000000000..6a16d0b6f2
--- /dev/null
+++ b/vendor/github.com/go-openapi/runtime/server-middleware/mediatype/match.go
@@ -0,0 +1,65 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package mediatype
+
+// MatchFirst reports whether actual matches any entry in allowed,
+// using [MediaType.Match] — the param-aware RFC 7231 rule plus the
+// alias bridge from the package-internal alias table.
+//
+// The scan is multi-pass and tier-ordered: the first pass returns
+// the first allowed entry that matches under [MatchExact] (RFC 7231
+// semantics); the second pass looks for a [MatchAlias] match; when
+// [AllowSuffix] is in opts a third pass looks for a [MatchSuffix]
+// match. This preserves the "stronger tier wins" ordering from
+// [Set.BestMatch] while keeping the "first match wins" semantics
+// within each tier.
+//
+// Return values:
+//
+//   - (matched, true,  nil)        — the first allowed entry that
+//     matches, with exact matches preferred over alias matches.
+//   - (zero,    false, nil)        — actual is well-formed but no
+//     allowed entry accepts it. Maps to an HTTP 415 outcome.
+//   - (zero,    false, err)        — actual fails to parse. err
+//     wraps [ErrMalformed], so callers can use [errors.Is] to
+//     distinguish this case. Maps to an HTTP 400 outcome.
+//
+// Allowed entries that themselves fail to parse are skipped (they
+// cannot match any well-formed actual), and no error is surfaced
+// for them.
+//
+// An empty allowed list returns (zero, false, nil). MatchFirst is
+// the primitive; callers decide what no-constraints means in their
+// context.
+func MatchFirst(allowed []string, actual string, opts ...MatchOption) (MediaType, bool, error) {
+	if len(allowed) == 0 {
+		return MediaType{}, false, nil
+	}
+	actualMT, err := Parse(actual)
+	if err != nil {
+		return MediaType{}, false, err
+	}
+	o := applyMatchOptions(opts)
+	// Tier-ordered passes over the allowed list. The list is
+	// typically short (an operation's Consumes set), so re-parsing
+	// each entry on every pass is cheaper than caching parses across
+	// passes.
+	tiers := []MatchKind{MatchExact, MatchAlias}
+	if o.allowSuffix {
+		tiers = append(tiers, MatchSuffix)
+	}
+	for _, want := range tiers {
+		for _, a := range allowed {
+			allowedMT, perr := Parse(a)
+			if perr != nil {
+				continue
+			}
+			if allowedMT.Match(actualMT) == want {
+				return allowedMT, true, nil
+			}
+		}
+	}
+
+	return MediaType{}, false, nil
+}
diff --git a/vendor/github.com/go-openapi/runtime/server-middleware/mediatype/mediatype.go b/vendor/github.com/go-openapi/runtime/server-middleware/mediatype/mediatype.go
new file mode 100644
index 0000000000..2138b82669
--- /dev/null
+++ b/vendor/github.com/go-openapi/runtime/server-middleware/mediatype/mediatype.go
@@ -0,0 +1,379 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package mediatype
+
+import (
+	"fmt"
+	"mime"
+	"strconv"
+	"strings"
+)
+
+const wildcard = "*"
+
+// Internal constants for the suffixBase table and any future
+// in-package references to the well-known base media types.
+const (
+	typeApplication = "application"
+	subtypeJSON     = "json"
+	subtypeXML      = "xml"
+	subtypeYAML     = "yaml"
+
+	mtYAML = typeApplication + "/" + subtypeYAML
+)
+
+// Specificity scores returned by [MediaType.Specificity], ordered from
+// least to most specific.
+const (
+	SpecificityAny             = iota // "*/*"
+	SpecificityType                   // "type/*"
+	SpecificityExact                  // "type/subtype" (no params)
+	SpecificityExactWithParams        // "type/subtype;k=v"
+)
+
+// MatchKind classifies the strength of a match between two media
+// types. Larger values represent stronger matches and win in
+// negotiation tie-breaks.
+//
+// MatchExact covers direct subtype or wildcard agreement under RFC
+// 7231 rules; MatchAlias is returned when the strict comparison
+// fails but the two values agree after canonicalization through the
+// internal alias table (see [MediaType.Canonical]); MatchSuffix is
+// returned only when both alias and exact comparisons fail but the
+// two values agree after folding the RFC 6839 structured-syntax
+// suffix (see [MediaType.Base]).
+//
+// MatchSuffix matches are off by default at the negotiation /
+// lookup callers — they count only when [AllowSuffix] is passed to
+// [Set.BestMatch], [MatchFirst], or [Lookup]. The opt-in is the
+// single user-visible knob; [MediaType.Match] itself always returns
+// the strongest tier that succeeds.
+type MatchKind int
+
+// MatchKind values. Returned by [MediaType.Match].
+const (
+	MatchNone   MatchKind = iota // no match
+	MatchSuffix                  // matched via the RFC 6839 suffix base
+	MatchAlias                   // matched via the alias table
+	MatchExact                   // matched directly (RFC 7231 semantics)
+)
+
+// MatchOption configures the matching tolerances used by
+// [Set.BestMatch], [MatchFirst], and [Lookup]. The zero behaviour
+// is strict: only [MatchAlias] and [MatchExact] count.
+type MatchOption func(*matchOptions)
+
+type matchOptions struct {
+	allowSuffix bool
+}
+
+func applyMatchOptions(opts []MatchOption) matchOptions {
+	var o matchOptions
+	for _, opt := range opts {
+		opt(&o)
+	}
+	return o
+}
+
+// AllowSuffix returns a [MatchOption] that lets the caller count
+// [MatchSuffix] results as valid matches. Use this to opt into
+// RFC 6839 structured-syntax suffix tolerance for situations where
+// the client/server traffic does not strictly abide by the spec
+// (typical example: server returning application/problem+json
+// against operations that only declare application/json in
+// produces).
+func AllowSuffix() MatchOption {
+	return func(o *matchOptions) {
+		o.allowSuffix = true
+	}
+}
+
+type mediaTypeError string
+
+func (e mediaTypeError) Error() string {
+	return string(e)
+}
+
+// ErrMalformed is the sentinel returned (wrapped) by [Parse] when its input
+// cannot be parsed as an RFC 7231 media type.
+//
+// Callers can test for it with [errors.Is] to distinguish a client-side
+// malformed Content-Type header (an HTTP 400 outcome) from a well-formed
+// value that simply matches no allowed entry (an HTTP 415 outcome).
+const ErrMalformed mediaTypeError = "mediatype: malformed"
+
+// MediaType is a parsed RFC 7231 media type with optional parameters and
+// an optional q-value (used by Accept negotiation).
+//
+// Type, Subtype and the keys of Params are lowercased. Parameter values
+// are preserved verbatim; comparisons are case-insensitive (matching the
+// pre-v0.30 behaviour and the common convention for charset, version, etc.).
+//
+// Suffix exposes the RFC 6839 structured syntax suffix (the token after
+// the final '+' in Subtype) as a parallel hint. Subtype itself retains
+// the full wire value, so existing callers comparing Subtype against a
+// string see no change.
+type MediaType struct {
+	Type    string
+	Subtype string
+	Suffix  string
+	Params  map[string]string
+	Q       float64
+}
+
+// suffixBase maps a known RFC 6839 / RFC 9512 structured syntax
+// suffix (without the leading '+', lowercased) to its base media
+// type. It is the authoritative table consulted by [MediaType.Base].
+//
+// The table is intentionally small: only suffixes whose base type
+// has a codec in the default runtime maps are listed. CBOR, zip,
+// BER, DER, FastInfoset and WBXML are registered by IANA but have
+// no default codec in this runtime; adding them is gated on having
+// something to do with them.
+//
+// Package-internal by design: the external API is [MediaType.Base].
+// If users ever need to extend the table, a Register-style function
+// is the right answer, not an exported mutable map.
+var suffixBase = map[string]MediaType{
+	subtypeJSON: {Type: typeApplication, Subtype: subtypeJSON},
+	subtypeXML:  {Type: typeApplication, Subtype: subtypeXML},
+	subtypeYAML: {Type: typeApplication, Subtype: subtypeYAML},
+}
+
+// aliases maps a deprecated or legacy media-type name to its
+// canonical registered equivalent. Keys are the lowercased
+// "type/subtype" form with no parameters; values are the canonical
+// "type/subtype" form, also without parameters.
+//
+// Entries are limited to media types whose authoritative RFC
+// explicitly names the alias. The seed entries cite RFC 9512 §2.1,
+// which enumerates "Deprecated alias names for this type:
+// application/x-yaml, text/yaml, and text/x-yaml" as part of the
+// IANA registration template for application/yaml.
+//
+// Pull requests adding entries need an analogous citation in the
+// commit message; entries without authoritative backing belong in
+// caller-side canonicalization, not here.
+//
+// Package-internal by design: the external API is
+// [MediaType.Canonical] and [MediaType.Match]. If users ever need
+// to register their own aliases, a Register-style function is the
+// right answer, not an exported mutable map.
+var aliases = map[string]string{
+	"application/x-yaml": mtYAML, // RFC 9512 §2.1
+	"text/yaml":          mtYAML, // RFC 9512 §2.1
+	"text/x-yaml":        mtYAML, // RFC 9512 §2.1
+}
+
+// Parse parses a single media type. The input may carry parameters and a
+// q-value; the q-value is extracted into [MediaType.Q] and removed from
+// [MediaType.Params].
+//
+// An empty input returns an error.
+func Parse(s string) (MediaType, error) {
+	s = strings.TrimSpace(s)
+	if s == "" {
+		return MediaType{}, fmt.Errorf("%w: empty value", ErrMalformed)
+	}
+	full, params, err := mime.ParseMediaType(s)
+	if err != nil {
+		return MediaType{}, fmt.Errorf("%w: %w", ErrMalformed, err)
+	}
+	slash := strings.IndexByte(full, '/')
+	if slash <= 0 || slash == len(full)-1 {
+		return MediaType{}, fmt.Errorf("%w: %q has no subtype", ErrMalformed, s)
+	}
+	mt := MediaType{
+		Type:    full[:slash],
+		Subtype: full[slash+1:],
+		Q:       1.0,
+	}
+	// RFC 6839: structured syntax suffix is the trailing '+'-delimited
+	// token of the subtype. Only the last '+' counts ("foo+bar+json" →
+	// suffix "json"). A trailing '+' with nothing after it is not a
+	// valid suffix and is ignored. mime.ParseMediaType has already
+	// lowercased the subtype, so no further ToLower is needed.
+	if plus := strings.LastIndexByte(mt.Subtype, '+'); plus >= 0 && plus < len(mt.Subtype)-1 {
+		mt.Suffix = mt.Subtype[plus+1:]
+	}
+	if q, ok := params["q"]; ok {
+		if qf, perr := strconv.ParseFloat(q, 64); perr == nil {
+			if qf < 0 {
+				qf = 0
+			}
+			if qf > 1 {
+				qf = 1
+			}
+			mt.Q = qf
+		}
+		delete(params, "q")
+	}
+	if len(params) > 0 {
+		mt.Params = params
+	}
+
+	return mt, nil
+}
+
+// String renders the canonical "type/subtype;k=v;k=v" form. Parameters are
+// emitted in lexicographic key order (the standard library guarantees this)
+// so the result is stable. The q-value is NOT emitted — it is meta, not
+// part of the media type identity.
+func (m MediaType) String() string {
+	if m.Type == "" && m.Subtype == "" {
+		return ""
+	}
+
+	return mime.FormatMediaType(m.Type+"/"+m.Subtype, m.Params)
+}
+
+// Matches reports whether the receiver accepts other, per the package
+// documentation: the receiver is the bound, other is the constraint.
+func (m MediaType) Matches(other MediaType) bool {
+	if !typeAgrees(m.Type, other.Type) {
+		return false
+	}
+	if !subtypeAgrees(m.Type, m.Subtype, other.Type, other.Subtype) {
+		return false
+	}
+	if len(m.Params) == 0 {
+		return true
+	}
+	for k, v := range other.Params {
+		sv, ok := m.Params[k]
+		if !ok || !strings.EqualFold(sv, v) {
+			return false
+		}
+	}
+
+	return true
+}
+
+// Specificity returns a numeric score for ordering matches. Higher is more
+// specific. The returned value is one of [SpecificityAny],
+// [SpecificityType], [SpecificityExact] or [SpecificityExactWithParams].
+func (m MediaType) Specificity() int {
+	if m.Type == wildcard && m.Subtype == wildcard {
+		return SpecificityAny
+	}
+	if m.Subtype == wildcard {
+		return SpecificityType
+	}
+	if len(m.Params) == 0 {
+		return SpecificityExact
+	}
+
+	return SpecificityExactWithParams
+}
+
+// typeAgrees reports whether two top-level types match, allowing "*" on
+// either side. A type of "*" without a "*" subtype is rejected per RFC
+// 7231 §5.3.2 ("*/sub" is not valid), but Parse never produces such a
+// shape — it goes through mime.ParseMediaType.
+func typeAgrees(a, b string) bool {
+	return a == wildcard || b == wildcard || a == b
+}
+
+// subtypeAgrees handles the "type/*" wildcard: the bare type must match
+// (a "*/*" pair has already been accepted by typeAgrees above).
+func subtypeAgrees(at, asub, bt, bsub string) bool {
+	if at == wildcard || bt == wildcard {
+		// at least one side is "*/*" or "*/sub". With typeAgrees having
+		// returned true, we accept.
+		return true
+	}
+	if asub == wildcard || bsub == wildcard {
+		return true
+	}
+
+	return asub == bsub
+}
+
+// StripParams returns a copy of m with no parameters. Q is preserved
+// because it drives negotiation ordering, not media-type identity.
+//
+// Useful for the legacy "ignore parameters" negotiation mode.
+func (m MediaType) StripParams() MediaType {
+	return MediaType{Type: m.Type, Subtype: m.Subtype, Suffix: m.Suffix, Q: m.Q}
+}
+
+// Base returns the base media type implied by the RFC 6839 structured
+// syntax suffix, or m unchanged when:
+//
+//   - Suffix is empty;
+//   - Suffix is not present in the package-internal suffix→base table.
+//
+// The returned value represents the structural base only: it carries
+// no parameters and no q-value. Use it to find a codec for the
+// underlying wire format — for example, "application/vnd.api+json"
+// resolves to "application/json".
+//
+// Base does not mutate the receiver.
+func (m MediaType) Base() MediaType {
+	if m.Suffix == "" {
+		return m
+	}
+	base, ok := suffixBase[m.Suffix]
+	if !ok {
+		return m
+	}
+	return base
+}
+
+// Canonical returns m rewritten to its canonical media type via
+// the package-internal alias table, or m unchanged when
+// (Type, Subtype) is not a known alias. Params and Q are preserved on the returned value; Suffix
+// is recomputed from the canonical Subtype (none of the current
+// entries carry a suffix, but the contract is forward-safe).
+//
+// Canonical does not mutate the receiver.
+func (m MediaType) Canonical() MediaType {
+	key := m.Type + "/" + m.Subtype
+	canon, ok := aliases[key]
+	if !ok {
+		return m
+	}
+	slash := strings.IndexByte(canon, '/')
+	out := m
+	out.Type = canon[:slash]
+	out.Subtype = canon[slash+1:]
+	out.Suffix = ""
+	if plus := strings.LastIndexByte(out.Subtype, '+'); plus >= 0 && plus < len(out.Subtype)-1 {
+		out.Suffix = out.Subtype[plus+1:]
+	}
+	return out
+}
+
+// Match reports how m matches other, classifying the result by
+// [MatchKind]. Used by negotiation to rank candidate offers:
+// stronger tiers win when both apply.
+//
+// Returns, strongest first:
+//
+//   - MatchExact when m.Matches(other) is true under the strict
+//     RFC 7231 rules (including wildcards and the param subset
+//     rule).
+//   - MatchAlias when m.Canonical().Matches(other.Canonical())
+//     is true but the strict comparison failed.
+//   - MatchSuffix when m.Base().Canonical().Matches(
+//     other.Base().Canonical()) is true but the alias comparison
+//     failed (RFC 6839 structured-syntax suffix fold).
+//   - MatchNone otherwise.
+//
+// The asymmetric "bound vs constraint" rule of [MediaType.Matches]
+// is preserved at every tier. Match itself is always lenient — the
+// opt-in to count MatchSuffix lives one level up at [Set.BestMatch],
+// [MatchFirst], and [Lookup] via [AllowSuffix].
+func (m MediaType) Match(other MediaType) MatchKind {
+	if m.Matches(other) {
+		return MatchExact
+	}
+	if m.Canonical().Matches(other.Canonical()) {
+		return MatchAlias
+	}
+	if m.Base().Canonical().Matches(other.Base().Canonical()) {
+		return MatchSuffix
+	}
+	return MatchNone
+}
diff --git a/vendor/github.com/go-openapi/runtime/server-middleware/mediatype/set.go b/vendor/github.com/go-openapi/runtime/server-middleware/mediatype/set.go
new file mode 100644
index 0000000000..70f62a18d4
--- /dev/null
+++ b/vendor/github.com/go-openapi/runtime/server-middleware/mediatype/set.go
@@ -0,0 +1,138 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package mediatype
+
+import (
+	"strings"
+)
+
+// Set is a list of media types — typically the parsed value of an Accept
+// header, or a list of server-side offers.
+type Set []MediaType
+
+// ParseAccept parses a comma-separated list of media types, as found in
+// the Accept, Accept-Charset (etc.) HTTP headers. Malformed entries are
+// skipped silently — be liberal in what you accept.
+//
+// An empty input returns nil.
+func ParseAccept(s string) Set {
+	parts := splitTopLevel(s)
+	if len(parts) == 0 {
+		return nil
+	}
+	out := make(Set, 0, len(parts))
+	for _, p := range parts {
+		mt, err := Parse(p)
+		if err != nil {
+			continue
+		}
+		out = append(out, mt)
+	}
+
+	return out
+}
+
+// BestMatch picks the offer most acceptable to the receiver's Accept
+// entries. Selection follows RFC 7231 §5.3.2 plus tier-aware
+// ranking:
+//
+//   - highest q-value wins;
+//   - ties on q broken by the highest [MediaType.Specificity] of the
+//     matching Accept entry;
+//   - ties on specificity broken by [MatchKind] (MatchExact beats
+//     MatchAlias beats MatchSuffix);
+//   - ties on match kind broken by earliest position in offered.
+//
+// Accept entries with q=0 are treated as exclusions and never match.
+// MatchSuffix results are only counted when [AllowSuffix] is passed.
+// Returns ok=false if no offer matched any non-zero-q entry.
+func (s Set) BestMatch(offered Set, opts ...MatchOption) (best MediaType, ok bool) {
+	if len(s) == 0 || len(offered) == 0 {
+		return MediaType{}, false
+	}
+	o := applyMatchOptions(opts)
+	bestQ := -1.0
+	bestSpec := -1
+	bestKind := MatchNone
+	bestIdx := -1
+	for i, offer := range offered {
+		for _, entry := range s {
+			if entry.Q == 0 {
+				continue
+			}
+			kind := offer.Match(entry)
+			if kind == MatchNone {
+				continue
+			}
+			if kind == MatchSuffix && !o.allowSuffix {
+				continue
+			}
+			spec := entry.Specificity()
+			switch {
+			case entry.Q > bestQ:
+				best, ok = offer, true
+				bestQ = entry.Q
+				bestSpec = spec
+				bestKind = kind
+				bestIdx = i
+			case entry.Q < bestQ:
+				// not better
+			case spec > bestSpec:
+				best, ok = offer, true
+				bestSpec = spec
+				bestKind = kind
+				bestIdx = i
+			case spec < bestSpec:
+				// not better
+			case kind > bestKind:
+				best, ok = offer, true
+				bestKind = kind
+				bestIdx = i
+			case kind < bestKind:
+				// not better
+			case bestIdx < 0 || i < bestIdx:
+				best, ok = offer, true
+				bestIdx = i
+			}
+		}
+	}
+
+	return best, ok
+}
+
+// splitTopLevel splits s on top-level commas, respecting double-quoted
+// strings (RFC 7230 §3.2.6 — quoted-string).
+func splitTopLevel(s string) []string {
+	if strings.IndexByte(s, ',') < 0 {
+		if t := strings.TrimSpace(s); t != "" {
+			return []string{t}
+		}
+		return nil
+	}
+	var out []string
+	start := 0
+	inQuote := false
+	escape := false
+	for i := range len(s) {
+		c := s[i]
+		switch {
+		case escape:
+			escape = false
+		case inQuote && c == '\\':
+			escape = true
+		case c == '"':
+			inQuote = !inQuote
+		case c == ',' && !inQuote:
+			if t := strings.TrimSpace(s[start:i]); t != "" {
+				out = append(out, t)
+			}
+			start = i + 1
+		}
+	}
+	if t := strings.TrimSpace(s[start:]); t != "" {
+		out = append(out, t)
+	}
+
+	return out
+}
diff --git a/vendor/github.com/go-openapi/runtime/server-middleware/negotiate/doc.go b/vendor/github.com/go-openapi/runtime/server-middleware/negotiate/doc.go
new file mode 100644
index 0000000000..a9f278c31b
--- /dev/null
+++ b/vendor/github.com/go-openapi/runtime/server-middleware/negotiate/doc.go
@@ -0,0 +1,13 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+// Package negotiate provides server-side HTTP content negotiation
+// helpers — selecting the response Content-Type from an Accept header
+// and the response Content-Encoding from an Accept-Encoding header.
+//
+// The package is stdlib-only (modulo the typed [mediatype.MediaType]
+// values it consumes).
+//
+// The exported [ContentType] honours MIME-type parameters by default;
+// use [WithIgnoreParameters] to restore the pre-v0.30 looser match.
+package negotiate
diff --git a/vendor/github.com/go-openapi/runtime/middleware/header/header.go b/vendor/github.com/go-openapi/runtime/server-middleware/negotiate/header/header.go
similarity index 100%
rename from vendor/github.com/go-openapi/runtime/middleware/header/header.go
rename to vendor/github.com/go-openapi/runtime/server-middleware/negotiate/header/header.go
diff --git a/vendor/github.com/go-openapi/runtime/server-middleware/negotiate/negotiate.go b/vendor/github.com/go-openapi/runtime/server-middleware/negotiate/negotiate.go
new file mode 100644
index 0000000000..c36ad5adae
--- /dev/null
+++ b/vendor/github.com/go-openapi/runtime/server-middleware/negotiate/negotiate.go
@@ -0,0 +1,205 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package negotiate
+
+import (
+	"net/http"
+	"strings"
+
+	"github.com/go-openapi/runtime/server-middleware/mediatype"
+	"github.com/go-openapi/runtime/server-middleware/negotiate/header"
+)
+
+// Option configures [ContentType] behaviour.
+type Option func(*options)
+
+type options struct {
+	ignoreParameters bool
+	matchSuffix      bool
+}
+
+func optionsWithDefaults(opts []Option) options {
+	var o options
+	for _, apply := range opts {
+		apply(&o)
+	}
+
+	return o
+}
+
+// WithIgnoreParameters returns an [Option] that strips MIME-type
+// parameters from both Accept entries and offers before matching, restoring
+// the behaviour the runtime had before v0.30.
+//
+// New code should leave parameters honoured (the default). This option
+// exists for applications that depend on the looser pre-v0.30 match —
+// most often because their producers and Accept clients use mismatched
+// charset or version params that they treat as informational.
+//
+// Example — per-call opt-out:
+//
+//	chosen := negotiate.ContentType(r, offers, "",
+//	    negotiate.WithIgnoreParameters(true),
+//	)
+//
+// Example — server-wide opt-out (via [middleware.Context]):
+//
+//	ctx := middleware.NewContext(spec, api, nil).SetIgnoreParameters(true)
+func WithIgnoreParameters(ignore bool) Option {
+	return func(o *options) {
+		o.ignoreParameters = ignore
+	}
+}
+
+// WithMatchSuffix returns an [Option] that extends content
+// negotiation to tolerate RFC 6839 structured-syntax suffix media
+// types. When enabled, an Accept entry of "application/json"
+// matches an offer of "application/vnd.api+json" and vice versa,
+// for the suffixes recognised by the runtime (+json, +xml, +yaml).
+//
+// Default: strict (false). Use only when interoperating with
+// clients or servers that do not strictly abide by the spec — for
+// example, servers returning application/problem+json error
+// responses against operations that only declare application/json
+// in produces.
+//
+// Suffix matches always lose to exact and alias matches when those
+// are on offer; see [mediatype.MatchKind] for the tier ordering.
+//
+// Example — per-call opt-in:
+//
+//	chosen := negotiate.ContentType(r, offers, "",
+//	    negotiate.WithMatchSuffix(true),
+//	)
+//
+// Example — server-wide opt-in (via [middleware.Context]):
+//
+//	ctx := middleware.NewContext(spec, api, nil).SetMatchSuffix(true)
+func WithMatchSuffix(enable bool) Option {
+	return func(o *options) {
+		o.matchSuffix = enable
+	}
+}
+
+// ContentEncoding returns the best offered content encoding for the
+// request's Accept-Encoding header. If two offers match with equal
+// weight then the offer earlier in the list is preferred. If no offers
+// are acceptable, then "" is returned.
+//
+// Encoding tokens have no parameters, so this function is unaffected by
+// the v0.30 parameter-honouring change to [ContentType].
+func ContentEncoding(r *http.Request, offers []string) string {
+	bestOffer := "identity"
+	bestQ := -1.0
+	specs := header.ParseAccept(r.Header, "Accept-Encoding")
+	for _, offer := range offers {
+		for _, spec := range specs {
+			if spec.Q > bestQ &&
+				(spec.Value == "*" || spec.Value == offer) {
+				bestQ = spec.Q
+				bestOffer = offer
+			}
+		}
+	}
+	if bestQ == 0 {
+		bestOffer = ""
+	}
+
+	return bestOffer
+}
+
+// ContentType returns the best offered content type for the request's
+// Accept header. If two offers match with equal weight, then the more
+// specific offer is preferred (text/* trumps */*; type/subtype trumps
+// type/*). If two offers match with equal weight and specificity, then
+// the offer earlier in the list is preferred. If no offers match, then
+// defaultOffer is returned.
+//
+// As of v0.30 the matching rule honours MIME-type parameters: an Accept
+// entry of "text/plain;charset=utf-8" matches an offer of bare
+// "text/plain" (offer carries no constraint), but it does NOT match an
+// offer of "text/plain;charset=ascii" (charset values disagree). Pass
+// [WithIgnoreParameters](true) to restore the pre-v0.30 behaviour where
+// parameters were stripped before matching — see [WithIgnoreParameters]
+// for details and an example.
+//
+// When the Accept header is absent, the first offer is returned
+// unchanged (param-stripping is irrelevant in that case).
+func ContentType(r *http.Request, offers []string, defaultOffer string, opts ...Option) string {
+	if len(offers) == 0 {
+		return defaultOffer
+	}
+	o := optionsWithDefaults(opts)
+
+	// Per RFC 7230 §3.2.2, multiple Accept headers are equivalent to a
+	// single comma-joined value. Join before parsing so we don't drop
+	// later entries.
+	acceptValues := r.Header.Values("Accept")
+	if len(acceptValues) == 0 {
+		return offers[0]
+	}
+	acceptSet := mediatype.ParseAccept(strings.Join(acceptValues, ", "))
+	if len(acceptSet) == 0 {
+		return defaultOffer
+	}
+
+	offerSet := make(mediatype.Set, 0, len(offers))
+	rawByIdx := make([]string, 0, len(offers))
+	for _, raw := range offers {
+		mt, err := mediatype.Parse(raw)
+		if err != nil {
+			continue
+		}
+		offerSet = append(offerSet, mt)
+		rawByIdx = append(rawByIdx, raw)
+	}
+	if len(offerSet) == 0 {
+		return defaultOffer
+	}
+
+	if o.ignoreParameters {
+		acceptSet = stripSet(acceptSet)
+		offerSet = stripSet(offerSet)
+	}
+
+	var matchOpts []mediatype.MatchOption
+	if o.matchSuffix {
+		matchOpts = append(matchOpts, mediatype.AllowSuffix())
+	}
+	best, ok := acceptSet.BestMatch(offerSet, matchOpts...)
+	if !ok {
+		return defaultOffer
+	}
+	// Return the original raw offer string so callers receive the value
+	// they declared, with its parameters preserved.
+	for i, mt := range offerSet {
+		if mt.Type == best.Type && mt.Subtype == best.Subtype && sameParams(mt.Params, best.Params) {
+			return rawByIdx[i]
+		}
+	}
+
+	return best.String()
+}
+
+func stripSet(s mediatype.Set) mediatype.Set {
+	out := make(mediatype.Set, len(s))
+	for i, m := range s {
+		out[i] = m.StripParams()
+	}
+
+	return out
+}
+
+func sameParams(a, b map[string]string) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for k, v := range a {
+		if b[k] != v {
+			return false
+		}
+	}
+
+	return true
+}
diff --git a/vendor/github.com/go-openapi/runtime/statuses.go b/vendor/github.com/go-openapi/runtime/statuses.go
index c0f3e6b447..273d9c6ced 100644
--- a/vendor/github.com/go-openapi/runtime/statuses.go
+++ b/vendor/github.com/go-openapi/runtime/statuses.go
@@ -60,7 +60,7 @@ var Statuses = map[int]string{
 	444: "No Response",
 	449: "Retry With",
 	450: "Blocked by Windows Parental Controls",
-	451: "Wrong Exchange Server",
+	451: "Unavailable For Legal Reasons",
 	499: "Client Closed Request",
 	500: "Internal Server Error",
 	501: "Not Implemented",
diff --git a/vendor/github.com/go-openapi/runtime/text.go b/vendor/github.com/go-openapi/runtime/text.go
index 1252ac88c7..3764a87fe5 100644
--- a/vendor/github.com/go-openapi/runtime/text.go
+++ b/vendor/github.com/go-openapi/runtime/text.go
@@ -36,14 +36,14 @@ func TextConsumer() Consumer {
 		if tu, ok := data.(encoding.TextUnmarshaler); ok {
 			err := tu.UnmarshalText(b)
 			if err != nil {
-				return fmt.Errorf("text consumer: %v", err)
+				return fmt.Errorf("text consumer: %w", err)
 			}
 
 			return nil
 		}
 
 		t := reflect.TypeOf(data)
-		if data != nil && t.Kind() == reflect.Ptr {
+		if data != nil && t.Kind() == reflect.Pointer {
 			v := reflect.Indirect(reflect.ValueOf(data))
 			if t.Elem().Kind() == reflect.String {
 				v.SetString(string(b))
@@ -70,7 +70,7 @@ func TextProducer() Producer {
 		if tm, ok := data.(encoding.TextMarshaler); ok {
 			txt, err := tm.MarshalText()
 			if err != nil {
-				return fmt.Errorf("text producer: %v", err)
+				return fmt.Errorf("text producer: %w", err)
 			}
 			_, err = writer.Write(txt)
 			return err
diff --git a/vendor/github.com/go-openapi/runtime/yamlpc/yaml.go b/vendor/github.com/go-openapi/runtime/yamlpc/yaml.go
index ca71edbb1b..b7fab88906 100644
--- a/vendor/github.com/go-openapi/runtime/yamlpc/yaml.go
+++ b/vendor/github.com/go-openapi/runtime/yamlpc/yaml.go
@@ -6,8 +6,9 @@ package yamlpc
 import (
 	"io"
 
-	"github.com/go-openapi/runtime"
 	yaml "go.yaml.in/yaml/v3"
+
+	"github.com/go-openapi/runtime"
 )
 
 // YAMLConsumer creates a consumer for [yaml] data.
diff --git a/vendor/github.com/go-openapi/strfmt/.gitignore b/vendor/github.com/go-openapi/strfmt/.gitignore
index 885dc27ab0..bbdffea78a 100644
--- a/vendor/github.com/go-openapi/strfmt/.gitignore
+++ b/vendor/github.com/go-openapi/strfmt/.gitignore
@@ -3,4 +3,4 @@
 .idea
 .env
 .mcp.json
-.claude/
+go.work.sum
diff --git a/vendor/github.com/go-openapi/strfmt/CONTRIBUTORS.md b/vendor/github.com/go-openapi/strfmt/CONTRIBUTORS.md
index e49700d4d2..a5d5ed6e62 100644
--- a/vendor/github.com/go-openapi/strfmt/CONTRIBUTORS.md
+++ b/vendor/github.com/go-openapi/strfmt/CONTRIBUTORS.md
@@ -4,12 +4,12 @@
 
 | Total Contributors | Total Contributions |
 | --- | --- |
-| 40  | 225  |
+| 40  | 231  |
 
 | Username | All Time Contribution Count | All Commits |
 | --- | --- | --- |
 | @casualjim | 88 | <https://github.com/go-openapi/strfmt/commits?author=casualjim> |
-| @fredbi | 57 | <https://github.com/go-openapi/strfmt/commits?author=fredbi> |
+| @fredbi | 63 | <https://github.com/go-openapi/strfmt/commits?author=fredbi> |
 | @youyuanwu | 13 | <https://github.com/go-openapi/strfmt/commits?author=youyuanwu> |
 | @jlambatl | 9 | <https://github.com/go-openapi/strfmt/commits?author=jlambatl> |
 | @GlenDC | 5 | <https://github.com/go-openapi/strfmt/commits?author=GlenDC> |
diff --git a/vendor/github.com/go-openapi/strfmt/README.md b/vendor/github.com/go-openapi/strfmt/README.md
index a0cf642754..4afef43733 100644
--- a/vendor/github.com/go-openapi/strfmt/README.md
+++ b/vendor/github.com/go-openapi/strfmt/README.md
@@ -16,14 +16,6 @@ Golang support for string formats defined by JSON Schema and OpenAPI.
 
 ## Announcements
 
-* **2025-12-19** : new community chat on discord
-  * a new discord community channel is available to be notified of changes and support users
-  * our venerable Slack channel remains open, and will be eventually discontinued on **2026-03-31**
-
-You may join the discord community by clicking the invite link on the discord badge (also above). [![Discord Channel][discord-badge]][discord-url]
-
-Or join our Slack channel: [![Slack Channel][slack-logo]![slack-badge]][slack-url]
-
 * **2026-03-07** : v0.26.0 **dropped dependency to the mongodb driver**
   * mongodb users can still use this package without any change
   * however, we have frozen the back-compatible support for mongodb driver at v2.5.0
@@ -177,9 +169,9 @@ This library ships under the [SPDX-License-Identifier: Apache-2.0](./LICENSE).
 ## Other documentation
 
 * [All-time contributors](./CONTRIBUTORS.md)
-* [Contributing guidelines](.github/CONTRIBUTING.md)
-* [Maintainers documentation](docs/MAINTAINERS.md)
-* [Code style](docs/STYLE.md)
+* [Contributing guidelines][contributing-doc-site]
+* [Maintainers documentation][maintainers-doc-site]
+* [Code style][style-doc-site]
 
 ## Cutting a new release
 
@@ -214,9 +206,6 @@ Maintainers can cut a new release by either:
 [doc-url]: https://goswagger.io/go-openapi
 [godoc-badge]: https://pkg.go.dev/badge/github.com/go-openapi/strfmt
 [godoc-url]: http://pkg.go.dev/github.com/go-openapi/strfmt
-[slack-logo]: https://a.slack-edge.com/e6a93c1/img/icons/favicon-32.png
-[slack-badge]: https://img.shields.io/badge/slack-blue?link=https%3A%2F%2Fgoswagger.slack.com%2Farchives%2FC04R30YM
-[slack-url]: https://goswagger.slack.com/archives/C04R30YMU
 [discord-badge]: https://img.shields.io/discord/1446918742398341256?logo=discord&label=discord&color=blue
 [discord-url]: https://discord.gg/FfnFYaC3k5
 
@@ -228,3 +217,7 @@ Maintainers can cut a new release by either:
 [goversion-url]: https://github.com/go-openapi/strfmt/blob/master/go.mod
 [top-badge]: https://img.shields.io/github/languages/top/go-openapi/strfmt
 [commits-badge]: https://img.shields.io/github/commits-since/go-openapi/strfmt/latest
+<!-- Organization docs -->
+[contributing-doc-site]: https://go-openapi.github.io/doc-site/contributing/contributing/index.html
+[maintainers-doc-site]: https://go-openapi.github.io/doc-site/maintainers/index.html
+[style-doc-site]: https://go-openapi.github.io/doc-site/contributing/style/index.html
diff --git a/vendor/github.com/go-openapi/strfmt/duration.go b/vendor/github.com/go-openapi/strfmt/duration.go
index b710bfbf53..f2ab7ff834 100644
--- a/vendor/github.com/go-openapi/strfmt/duration.go
+++ b/vendor/github.com/go-openapi/strfmt/duration.go
@@ -7,11 +7,9 @@ import (
 	"database/sql/driver"
 	"encoding/json"
 	"fmt"
-	"math"
-	"regexp"
-	"strconv"
 	"strings"
 	"time"
+	"unicode"
 )
 
 func init() { //nolint:gochecknoinits // registers duration format in the default registry
@@ -22,34 +20,62 @@ func init() { //nolint:gochecknoinits // registers duration format in the defaul
 const (
 	hoursInDay = 24
 	daysInWeek = 7
+	nanos      = uint64(time.Nanosecond)
+	micros     = uint64(time.Microsecond)
+	millis     = uint64(time.Millisecond)
+	seconds    = uint64(time.Second)
+	minutes    = uint64(time.Minute)
+	hours      = uint64(time.Hour)
+	days       = uint64(hoursInDay * time.Hour)
+	weeks      = uint64(hoursInDay * daysInWeek * time.Hour)
+	maxUint64  = uint64(1 << 63)
 )
 
+// timeMultiplier holds all supported aliases for duration units, including their plural form.
+//
 //nolint:gochecknoglobals // package-level lookup tables for duration parsing
-var (
-	timeUnits = [][]string{
-		{"ns", "nano"},
-		{"us", "µs", "micro"},
-		{"ms", "milli"},
-		{"s", "sec"},
-		{"m", "min"},
-		{"h", "hr", "hour"},
-		{"d", "day"},
-		{"w", "wk", "week"},
-	}
-
-	timeMultiplier = map[string]time.Duration{
-		"ns": time.Nanosecond,
-		"us": time.Microsecond,
-		"ms": time.Millisecond,
-		"s":  time.Second,
-		"m":  time.Minute,
-		"h":  time.Hour,
-		"d":  hoursInDay * time.Hour,
-		"w":  hoursInDay * daysInWeek * time.Hour,
-	}
-
-	durationMatcher = regexp.MustCompile(`^(((?:-\s?)?\d+)(\.\d+)?\s*([A-Za-zµ]+))`)
-)
+var timeMultiplier = map[string]uint64{
+	"ns":           nanos,
+	"nano":         nanos,
+	"nanosecond":   nanos,
+	"nanoseconds":  nanos,
+	"nanos":        nanos,
+	"us":           micros,
+	"µs":           micros, // U+00B5 = micro symbol
+	"μs":           micros, // U+03BC = Greek letter mu
+	"micro":        micros,
+	"micros":       micros,
+	"microsecond":  micros,
+	"microseconds": micros,
+	"ms":           millis,
+	"milli":        millis,
+	"millis":       millis,
+	"millisecond":  millis,
+	"milliseconds": millis,
+	"s":            seconds,
+	"sec":          seconds,
+	"secs":         seconds,
+	"second":       seconds,
+	"seconds":      seconds,
+	"m":            minutes,
+	"min":          minutes,
+	"mins":         minutes,
+	"minute":       minutes,
+	"minutes":      minutes,
+	"h":            hours,
+	"hr":           hours,
+	"hrs":          hours,
+	"hour":         hours,
+	"hours":        hours,
+	"d":            days,
+	"day":          days,
+	"days":         days,
+	"w":            weeks,
+	"wk":           weeks,
+	"wks":          weeks,
+	"week":         weeks,
+	"weeks":        weeks,
+}
 
 // IsDuration returns true if the provided string is a valid duration.
 func IsDuration(str string) bool {
@@ -80,64 +106,157 @@ func (d *Duration) UnmarshalText(data []byte) error { // validation is performed
 	return nil
 }
 
-// ParseDuration parses a duration from a string, compatible with scala duration syntax.
-func ParseDuration(cand string) (time.Duration, error) {
-	if dur, err := time.ParseDuration(cand); err == nil {
-		return dur, nil
+// ParseDuration parses a duration from a string
+//
+// It is similar to [time.ParseDuration] but support additional units like days and weeks,
+// additional abreviations for units and is more tolerant on the presence of blank spaces.
+//
+// A duration may be negative or fractional.
+//
+// # Differences with [time.ParseDuration]
+//
+//   - more supported units and aliases (see below)
+//   - sign followed by blank space is tolerated
+//   - tolerates blanks between duration and unit (e.g. "300 ms")
+//
+// # Supported units
+//
+// Units may be specified using aliases or a plural form.
+//
+//   - "ns", "nano", "nanosecond", "nanoseconds", "nanos"
+//   - "us", "µs" (U+00B5 = micro symbol), "μs" (U+03BC = Greek letter mu), "micro", "micros", "microsecond", "microseconds"
+//   - "ms", "milli", "millis", "millisecond", "milliseconds"
+//   - "s", "sec", "secs", "second", "seconds"
+//   - "m", "min", "mins", "minute", "minutes"
+//   - "h", "hr", "hrs", "hour", "hours"
+//   - "d", "day", "days"
+//   - "w", "wk", "wks", "week", "weeks"
+//
+// NOTE: inspired by scala duration syntax.
+//
+// # Examples
+//
+// "300ms", "-1.5h", "2h45m",
+// ".5 week",
+// "2 minutes 45 seconds".
+//
+//nolint:gocognit,gocyclo,cyclop // complexity is only slightly above the usual level, may be tolerated as it mimicks the stdlib.
+func ParseDuration(s string) (time.Duration, error) {
+	// NOTE: this code is largely inspired by the standard library.
+	orig := s
+	var d uint64
+	neg := false
+
+	// Consume [-+]?
+	if s != "" {
+		c := s[0]
+		if c == '-' || c == '+' {
+			neg = c == '-'
+			s = s[1:]
+		}
 	}
 
-	var dur time.Duration
-	ok := false
-	const expectGroups = 4
-	for _, match := range durationMatcher.FindAllStringSubmatch(cand, -1) {
-		if len(match) < expectGroups {
-			continue
+	// Consume space
+	s = strings.TrimLeftFunc(s, unicode.IsSpace)
+
+	// Special case: if all that is left is "0", this is zero.
+	if s == "0" {
+		return 0, nil
+	}
+
+	if s == "" {
+		return 0, parseDurationError(orig, "empty duration")
+	}
+
+	for s != "" {
+		var (
+			v, f  uint64      // integers before, after decimal point
+			scale float64 = 1 // value = v + f/scale
+		)
+		s = strings.TrimLeftFunc(s, unicode.IsSpace)
+
+		// The next character must be 0-9.]
+		if s[0] != '.' && ('0' > s[0] || s[0] > '9') {
+			return 0, parseDurationError(orig, fmt.Sprintf("expected a numerical value, but got %q", s[0]))
+		}
+
+		// Consume integer part [0-9]*
+		pl := len(s)
+		var ok bool
+		v, s, ok = leadingInt(s)
+		if !ok {
+			return 0, parseDurationError(orig, "expected a leading integer part")
 		}
+		pre := pl != len(s) // whether we consumed anything before a period
 
-		// remove possible leading - and spaces
-		value, negative := strings.CutPrefix(match[2], "-")
+		// Consume fractional part (\.[0-9]*)?
+		post := false
+		if s != "" && s[0] == '.' {
+			s = s[1:]
+			pl := len(s)
+			f, scale, s = leadingFraction(s)
+			post = pl != len(s)
+		}
 
-		// if the duration contains a decimal separator determine a divising factor
-		const neutral = 1.0
-		divisor := neutral
-		decimal, hasDecimal := strings.CutPrefix(match[3], ".")
-		if hasDecimal {
-			divisor = math.Pow10(len(decimal))
-			value += decimal // consider the value as an integer: will change units later on
+		if !pre && !post {
+			// no digits (e.g. ".s" or "-.s")
+			return 0, parseDurationError(orig, "expected digits")
 		}
 
-		// if the string is a valid duration, parse it
-		factor, err := strconv.Atoi(strings.TrimSpace(value)) // converts string to int
-		if err != nil {
-			return 0, err
+		// Consume space.
+		s = strings.TrimLeftFunc(s, unicode.IsSpace)
+
+		// Consume unit.
+		i := 0
+		for ; i < len(s); i++ {
+			c := s[i]
+			if c == '.' || '0' <= c && c <= '9' || unicode.IsSpace(rune(c)) {
+				break
+			}
 		}
 
-		if negative {
-			factor = -factor
+		if i == 0 {
+			return 0, parseDurationError(orig, "missing unit in duration")
 		}
 
-		unit := strings.ToLower(strings.TrimSpace(match[4]))
+		u := s[:i]
+		s = s[i:]
+		unit, ok := timeMultiplier[u]
+		if !ok {
+			return 0, parseDurationError(orig, fmt.Sprintf("unknown unit %q in duration", u))
+		}
 
-		for _, variants := range timeUnits {
-			last := len(variants) - 1
-			multiplier := timeMultiplier[variants[0]]
+		if v > maxUint64/unit {
+			// overflow
+			return 0, parseDurationError(orig, "numerical overflow")
+		}
 
-			for i, variant := range variants {
-				if (last == i && strings.HasPrefix(unit, variant)) || strings.EqualFold(variant, unit) {
-					ok = true
-					if divisor != neutral {
-						multiplier = time.Duration(float64(multiplier) / divisor) // convert to duration only after having reduced the scale
-					}
-					dur += (time.Duration(factor) * multiplier)
-				}
+		v *= unit
+		if f > 0 {
+			// float64 is needed to be nanosecond accurate for fractions of hours.
+			// v >= 0 && (f*unit/scale) <= 3.6e+12 (ns/h, h is the largest unit)
+			v += uint64(float64(f) * (float64(unit) / scale))
+			if v > maxUint64 {
+				// overflow
+				return 0, parseDurationError(orig, "numerical overflow")
 			}
 		}
+
+		d += v
+		if d > maxUint64 {
+			return 0, parseDurationError(orig, "numerical overflow")
+		}
 	}
 
-	if ok {
-		return dur, nil
+	if neg {
+		return -time.Duration(d), nil
 	}
-	return 0, fmt.Errorf("unable to parse %s as duration: %w", cand, ErrFormat)
+
+	if d > maxUint64-1 {
+		return 0, parseDurationError(orig, "numerical overflow")
+	}
+
+	return time.Duration(d), nil
 }
 
 // Scan reads a Duration value from database driver type.
@@ -204,3 +323,70 @@ func (d *Duration) DeepCopy() *Duration {
 	d.DeepCopyInto(out)
 	return out
 }
+
+func parseDurationError(s, msg string) error {
+	if msg == "" {
+		return fmt.Errorf("invalid duration: %s: %w", s, ErrFormat)
+	}
+
+	return fmt.Errorf("invalid duration: %s: %s: %w", s, msg, ErrFormat)
+}
+
+// leadingInt consumes the leading [0-9]* from s.
+func leadingInt[bytes []byte | string](s bytes) (x uint64, rem bytes, ok bool) { //nolint:ireturn // false positive
+	i := 0
+	for ; i < len(s); i++ {
+		c := s[i]
+		if c < '0' || c > '9' {
+			break
+		}
+
+		if x > maxUint64/10 { // overflow
+			return 0, rem, false
+		}
+
+		x = x*10 + uint64(c) - '0'
+		if x > maxUint64 { // overflow
+			return 0, rem, false
+		}
+	}
+
+	return x, s[i:], true
+}
+
+// leadingFraction consumes the leading [0-9]* from s.
+// //
+// It is used only for fractions, so it does not return an error on overflow,
+// it just stops accumulating precision.
+func leadingFraction(s string) (x uint64, scale float64, rem string) {
+	i := 0
+	scale = 1
+	overflow := false
+	for ; i < len(s); i++ {
+		c := s[i]
+		if c < '0' || c > '9' {
+			break
+		}
+
+		if overflow {
+			continue
+		}
+
+		if x > (maxUint64-1)/10 {
+			// It's possible for overflow to give a positive number, so take care.
+			overflow = true
+			continue
+		}
+
+		y := x*10 + uint64(c) - '0'
+		if y > maxUint64 {
+			overflow = true
+			continue
+		}
+
+		x = y
+		scale *= 10
+	}
+
+	return x, scale, s[i:]
+}
diff --git a/vendor/github.com/go-openapi/strfmt/go.work b/vendor/github.com/go-openapi/strfmt/go.work
index 288e7655d4..f233e74cfd 100644
--- a/vendor/github.com/go-openapi/strfmt/go.work
+++ b/vendor/github.com/go-openapi/strfmt/go.work
@@ -4,4 +4,4 @@ use (
 	./internal/testintegration
 )
 
-go 1.24.0
+go 1.25.0
diff --git a/vendor/github.com/go-openapi/strfmt/go.work.sum b/vendor/github.com/go-openapi/strfmt/go.work.sum
deleted file mode 100644
index 33dac969b6..0000000000
--- a/vendor/github.com/go-openapi/strfmt/go.work.sum
+++ /dev/null
@@ -1,16 +0,0 @@
-github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
-github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
-github.com/pborman/getopt v0.0.0-20170112200414-7148bc3a4c30 h1:BHT1/DKsYDGkUgQ2jmMaozVcdk+sVfz0+1ZJq4zkWgw=
-github.com/stretchr/objx v0.1.0 h1:4G4v2dO3VZwixGIRoQ5Lfboy6nUhCyYzaqnIAPPhYs4=
-github.com/yuin/goldmark v1.4.13 h1:fVcFKWvrslecOb/tg+Cc05dkeYx540o0FuFt3nUVDoE=
-golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c=
-golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU=
-golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
-golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
-golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
-golang.org/x/tools v0.41.0 h1:a9b8iMweWG+S0OBnlU36rzLp20z1Rp10w+IY2czHTQc=
-golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7 h1:9zdDQZ7Thm29KFXgAX/+yaf3eVbP7djjWp/dXAppNCc=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
diff --git a/vendor/github.com/go-openapi/swag/.gitignore b/vendor/github.com/go-openapi/swag/.gitignore
index a0a95a96b3..1680db44c0 100644
--- a/vendor/github.com/go-openapi/swag/.gitignore
+++ b/vendor/github.com/go-openapi/swag/.gitignore
@@ -4,4 +4,3 @@ Godeps
 .idea
 *.out
 .mcp.json
-.claude/
diff --git a/vendor/github.com/go-openapi/swag/CONTRIBUTORS.md b/vendor/github.com/go-openapi/swag/CONTRIBUTORS.md
index bc76fe820c..286878acff 100644
--- a/vendor/github.com/go-openapi/swag/CONTRIBUTORS.md
+++ b/vendor/github.com/go-openapi/swag/CONTRIBUTORS.md
@@ -4,11 +4,11 @@
 
 | Total Contributors | Total Contributions |
 | --- | --- |
-| 24  | 235  |
+| 24  | 242  |
 
 | Username | All Time Contribution Count | All Commits |
 | --- | --- | --- |
-| @fredbi | 105 | <https://github.com/go-openapi/swag/commits?author=fredbi> |
+| @fredbi | 112 | <https://github.com/go-openapi/swag/commits?author=fredbi> |
 | @casualjim | 98 | <https://github.com/go-openapi/swag/commits?author=casualjim> |
 | @alexandear | 4 | <https://github.com/go-openapi/swag/commits?author=alexandear> |
 | @orisano | 3 | <https://github.com/go-openapi/swag/commits?author=orisano> |
@@ -33,4 +33,4 @@
 | @davidalpert | 1 | <https://github.com/go-openapi/swag/commits?author=davidalpert> |
 | @Xe | 1 | <https://github.com/go-openapi/swag/commits?author=Xe> |
 
- _this file was generated by the [Contributors GitHub Action](https://github.com/github/contributors)_
+ _this file was generated by the [Contributors GitHub Action](https://github.com/github-community-projects/contributors)_
diff --git a/vendor/github.com/go-openapi/swag/README.md b/vendor/github.com/go-openapi/swag/README.md
index 834eb2ffb9..64f6671039 100644
--- a/vendor/github.com/go-openapi/swag/README.md
+++ b/vendor/github.com/go-openapi/swag/README.md
@@ -212,7 +212,7 @@ Maintainers can cut a new release by either:
 [slack-badge]: https://img.shields.io/badge/slack-blue?link=https%3A%2F%2Fgoswagger.slack.com%2Farchives%2FC04R30YM
 [slack-url]: https://goswagger.slack.com/archives/C04R30YMU
 [discord-badge]: https://img.shields.io/discord/1446918742398341256?logo=discord&label=discord&color=blue
-[discord-url]: https://discord.gg/twZ9BwT3
+[discord-url]: https://discord.gg/FfnFYaC3k5
 
 <!-- Badges: license & compliance -->
 [license-badge]: http://img.shields.io/badge/license-Apache%20v2-orange.svg
diff --git a/vendor/github.com/go-openapi/swag/SECURITY.md b/vendor/github.com/go-openapi/swag/SECURITY.md
index 72296a8313..1fea2c5736 100644
--- a/vendor/github.com/go-openapi/swag/SECURITY.md
+++ b/vendor/github.com/go-openapi/swag/SECURITY.md
@@ -6,14 +6,32 @@ This policy outlines the commitment and practices of the go-openapi maintainers
 
 | Version | Supported          |
 | ------- | ------------------ |
-| 0.25.x  | :white_check_mark: |
+| O.x     | :white_check_mark: |
+
+## Vulnerability checks in place
+
+This repository uses automated vulnerability scans, at every merged commit and at least once a week.
+
+We use:
+
+* [`GitHub CodeQL`][codeql-url]
+* [`trivy`][trivy-url]
+* [`govulncheck`][govulncheck-url]
+
+Reports are centralized in github security reports and visible only to the maintainers.
 
 ## Reporting a vulnerability
 
 If you become aware of a security vulnerability that affects the current repository,
-please report it privately to the maintainers.
+**please report it privately to the maintainers**
+rather than opening a publicly visible GitHub issue.
+
+Please follow the instructions provided by github to [Privately report a security vulnerability][github-guidance-url].
 
-Please follow the instructions provided by github to
-[Privately report a security vulnerability](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability#privately-reporting-a-security-vulnerability).
+> [!NOTE]
+> On Github, navigate to the project's "Security" tab then click on "Report a vulnerability".
 
-TL;DR: on Github, navigate to the project's "Security" tab then click on "Report a vulnerability".
+[codeql-url]: https://github.com/github/codeql
+[trivy-url]: https://trivy.dev/docs/latest/getting-started
+[govulncheck-url]: https://go.dev/blog/govulncheck
+[github-guidance-url]: https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability#privately-reporting-a-security-vulnerability
diff --git a/vendor/github.com/go-openapi/swag/go.work b/vendor/github.com/go-openapi/swag/go.work
index 1e537f0749..8537cb2a76 100644
--- a/vendor/github.com/go-openapi/swag/go.work
+++ b/vendor/github.com/go-openapi/swag/go.work
@@ -17,4 +17,4 @@ use (
 	./yamlutils
 )
 
-go 1.24.0
+go 1.25.0
diff --git a/vendor/github.com/go-openapi/swag/jsonname/go_name_provider.go b/vendor/github.com/go-openapi/swag/jsonname/go_name_provider.go
new file mode 100644
index 0000000000..adc4426873
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/jsonname/go_name_provider.go
@@ -0,0 +1,286 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package jsonname
+
+import (
+	"reflect"
+	"strings"
+	"sync"
+)
+
+var _ providerIface = (*GoNameProvider)(nil)
+
+// GoNameProvider resolves json property names to go struct field names following
+// the same rules as the standard library's [encoding/json] package.
+//
+// Contrary to [NameProvider], it considers exported fields without a json tag,
+// and promotes fields from anonymous embedded struct types.
+//
+// Rules (aligned with encoding/json):
+//
+//   - unexported fields are ignored;
+//   - a field tagged `json:"-"` is ignored;
+//   - a field tagged `json:"-,"` is kept under the json name "-" (stdlib quirk);
+//   - a field tagged `json:""` or with no json tag at all keeps its Go name as json name;
+//   - anonymous struct fields without an explicit json tag have their fields
+//     promoted into the parent, following breadth-first depth rules:
+//     a shallower field wins over a deeper one; at equal depth, a conflict
+//     discards all conflicting fields unless exactly one has an explicit json tag.
+//
+// This type is safe for concurrent use.
+type GoNameProvider struct {
+	lock  sync.Mutex
+	index map[reflect.Type]nameIndex
+}
+
+// NewGoNameProvider creates a new [GoNameProvider].
+func NewGoNameProvider() *GoNameProvider {
+	return &GoNameProvider{
+		index: make(map[reflect.Type]nameIndex),
+	}
+}
+
+// GetJSONNames gets all the json property names for a type.
+func (n *GoNameProvider) GetJSONNames(subject any) []string {
+	n.lock.Lock()
+	defer n.lock.Unlock()
+
+	tpe := reflect.Indirect(reflect.ValueOf(subject)).Type()
+	names := n.nameIndexFor(tpe)
+
+	res := make([]string, 0, len(names.jsonNames))
+	for k := range names.jsonNames {
+		res = append(res, k)
+	}
+
+	return res
+}
+
+// GetJSONName gets the json name for a go property name.
+func (n *GoNameProvider) GetJSONName(subject any, name string) (string, bool) {
+	tpe := reflect.Indirect(reflect.ValueOf(subject)).Type()
+
+	return n.GetJSONNameForType(tpe, name)
+}
+
+// GetJSONNameForType gets the json name for a go property name on a given type.
+func (n *GoNameProvider) GetJSONNameForType(tpe reflect.Type, name string) (string, bool) {
+	n.lock.Lock()
+	defer n.lock.Unlock()
+
+	names := n.nameIndexFor(tpe)
+	nme, ok := names.goNames[name]
+
+	return nme, ok
+}
+
+// GetGoName gets the go name for a json property name.
+func (n *GoNameProvider) GetGoName(subject any, name string) (string, bool) {
+	tpe := reflect.Indirect(reflect.ValueOf(subject)).Type()
+
+	return n.GetGoNameForType(tpe, name)
+}
+
+// GetGoNameForType gets the go name for a given type for a json property name.
+func (n *GoNameProvider) GetGoNameForType(tpe reflect.Type, name string) (string, bool) {
+	n.lock.Lock()
+	defer n.lock.Unlock()
+
+	names := n.nameIndexFor(tpe)
+	nme, ok := names.jsonNames[name]
+
+	return nme, ok
+}
+
+func (n *GoNameProvider) nameIndexFor(tpe reflect.Type) nameIndex {
+	if names, ok := n.index[tpe]; ok {
+		return names
+	}
+
+	names := buildGoNameIndex(tpe)
+	n.index[tpe] = names
+
+	return names
+}
+
+// fieldEntry captures a candidate field discovered while walking a struct
+// along with the indirection path from the root type (used to resolve conflicts
+// by depth in the same way encoding/json does).
+type fieldEntry struct {
+	goName   string
+	jsonName string
+	index    []int
+	tagged   bool
+}
+
+func buildGoNameIndex(tpe reflect.Type) nameIndex {
+	fields := collectGoFields(tpe)
+
+	idx := make(map[string]string, len(fields))
+	reverseIdx := make(map[string]string, len(fields))
+	for _, f := range fields {
+		idx[f.jsonName] = f.goName
+		reverseIdx[f.goName] = f.jsonName
+	}
+
+	return nameIndex{jsonNames: idx, goNames: reverseIdx}
+}
+
+// collectGoFields walks tpe breadth-first along anonymous struct fields,
+// reproducing the field selection performed by encoding/json.typeFields.
+func collectGoFields(tpe reflect.Type) []fieldEntry {
+	if tpe.Kind() != reflect.Struct {
+		return nil
+	}
+
+	type queued struct {
+		typ   reflect.Type
+		index []int
+	}
+
+	current := []queued{}
+	next := []queued{{typ: tpe}}
+	visited := map[reflect.Type]bool{tpe: true}
+
+	var (
+		candidates []fieldEntry
+		count      = map[string]int{}
+		nextCount  = map[string]int{}
+	)
+
+	for len(next) > 0 {
+		current, next = next, current[:0]
+		count, nextCount = nextCount, count
+		for k := range nextCount {
+			delete(nextCount, k)
+		}
+
+		for _, q := range current {
+			for i := 0; i < q.typ.NumField(); i++ {
+				sf := q.typ.Field(i)
+
+				if sf.Anonymous {
+					ft := sf.Type
+					if ft.Kind() == reflect.Ptr {
+						ft = ft.Elem()
+					}
+					if !sf.IsExported() && ft.Kind() != reflect.Struct {
+						continue
+					}
+				} else if !sf.IsExported() {
+					continue
+				}
+
+				tag := sf.Tag.Get("json")
+				if tag == "-" {
+					continue
+				}
+				jsonName, _ := parseJSONTag(tag)
+				tagged := jsonName != ""
+
+				ft := sf.Type
+				if ft.Kind() == reflect.Ptr {
+					ft = ft.Elem()
+				}
+
+				if sf.Anonymous && ft.Kind() == reflect.Struct && !tagged {
+					if visited[ft] {
+						continue
+					}
+					visited[ft] = true
+
+					index := make([]int, len(q.index)+1)
+					copy(index, q.index)
+					index[len(q.index)] = i
+					next = append(next, queued{typ: ft, index: index})
+
+					continue
+				}
+
+				name := jsonName
+				if name == "" {
+					name = sf.Name
+				}
+
+				index := make([]int, len(q.index)+1)
+				copy(index, q.index)
+				index[len(q.index)] = i
+
+				candidates = append(candidates, fieldEntry{
+					goName:   sf.Name,
+					jsonName: name,
+					index:    index,
+					tagged:   tagged,
+				})
+				nextCount[name]++
+			}
+		}
+	}
+
+	return dominantFields(candidates)
+}
+
+// dominantFields applies the Go encoding/json conflict resolution rules:
+// at each JSON name, the shallowest field wins; at equal depth, a uniquely
+// tagged candidate wins; otherwise all candidates for that name are dropped.
+func dominantFields(candidates []fieldEntry) []fieldEntry {
+	byName := make(map[string][]fieldEntry, len(candidates))
+	for _, c := range candidates {
+		byName[c.jsonName] = append(byName[c.jsonName], c)
+	}
+
+	out := make([]fieldEntry, 0, len(byName))
+	for _, group := range byName {
+		if len(group) == 1 {
+			out = append(out, group[0])
+
+			continue
+		}
+
+		minDepth := len(group[0].index)
+		for _, c := range group[1:] {
+			if len(c.index) < minDepth {
+				minDepth = len(c.index)
+			}
+		}
+
+		var shallow []fieldEntry
+		for _, c := range group {
+			if len(c.index) == minDepth {
+				shallow = append(shallow, c)
+			}
+		}
+
+		if len(shallow) == 1 {
+			out = append(out, shallow[0])
+
+			continue
+		}
+
+		var tagged []fieldEntry
+		for _, c := range shallow {
+			if c.tagged {
+				tagged = append(tagged, c)
+			}
+		}
+		if len(tagged) == 1 {
+			out = append(out, tagged[0])
+		}
+	}
+
+	return out
+}
+
+// parseJSONTag returns the name component of a json struct tag and whether
+// it carried any non-name option (kept for future-proofing, e.g. "omitempty").
+func parseJSONTag(tag string) (string, string) {
+	if tag == "" {
+		return "", ""
+	}
+	if idx := strings.IndexByte(tag, ','); idx >= 0 {
+		return tag[:idx], tag[idx+1:]
+	}
+
+	return tag, ""
+}
diff --git a/vendor/github.com/go-openapi/swag/jsonname/ifaces.go b/vendor/github.com/go-openapi/swag/jsonname/ifaces.go
new file mode 100644
index 0000000000..812ace5639
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/jsonname/ifaces.go
@@ -0,0 +1,14 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package jsonname
+
+import "reflect"
+
+// providerIface is an unexported compile-time contract that every name provider
+// in this package is expected to satisfy.
+// It mirrors the interface declared by the main consumer of this module: [github.com/go-openapi/jsonpointer.NameProvider].
+type providerIface interface {
+	GetGoName(subject any, name string) (string, bool)
+	GetGoNameForType(tpe reflect.Type, name string) (string, bool)
+}
diff --git a/vendor/github.com/go-openapi/swag/jsonname/name_provider.go b/vendor/github.com/go-openapi/swag/jsonname/name_provider.go
index 8eaf1bece8..9f5da7a016 100644
--- a/vendor/github.com/go-openapi/swag/jsonname/name_provider.go
+++ b/vendor/github.com/go-openapi/swag/jsonname/name_provider.go
@@ -12,6 +12,8 @@ import (
 // DefaultJSONNameProvider is the default cache for types.
 var DefaultJSONNameProvider = NewNameProvider()
 
+var _ providerIface = (*NameProvider)(nil)
+
 // NameProvider represents an object capable of translating from go property names
 // to json property names.
 //
diff --git a/vendor/github.com/googleapis/gax-go/v2/CHANGES.md b/vendor/github.com/googleapis/gax-go/v2/CHANGES.md
index 692e0b95b2..ed27c5ee71 100644
--- a/vendor/github.com/googleapis/gax-go/v2/CHANGES.md
+++ b/vendor/github.com/googleapis/gax-go/v2/CHANGES.md
@@ -1,5 +1,21 @@
 # Changes
 
+## [2.22.0](https://github.com/googleapis/google-cloud-go/releases/tag/v2.22.0) (2026-04-14)
+
+## [2.21.0](https://github.com/googleapis/google-cloud-go/releases/tag/v2.21.0) (2026-04-01)
+
+### Features
+
+* hook transport telemetry into gax.Invoke and record (#496) ([d531001](https://github.com/googleapis/google-cloud-go/commit/d5310019d6c635956b61558627b13c2c2419044e))
+* update IsFeatureEnabled to not require EXPERIMENTAL (#497) ([a2a329e](https://github.com/googleapis/google-cloud-go/commit/a2a329e31d8ef8348a1ef7bea1c7072f8abcc145))
+
+## [2.20.0](https://github.com/googleapis/google-cloud-go/releases/tag/v2.20.0) (2026-03-25)
+
+### Features
+
+* add TelemetryErrorInfo and ExtractTelemetryErrorInfo (#487) ([defdded](https://github.com/googleapis/google-cloud-go/commit/defdded3eac5d97e32243ef79216f1865f3250fb))
+* hook metric recording into gax.Invoke (#494) ([1f3e9ae](https://github.com/googleapis/google-cloud-go/commit/1f3e9aefd21a1a18a6e4da1e03ea84a0b46f2d49))
+
 ## [2.19.0](https://github.com/googleapis/google-cloud-go/releases/tag/v2.19.0) (2026-03-17)
 
 ### Features
diff --git a/vendor/github.com/googleapis/gax-go/v2/apierror/apierror.go b/vendor/github.com/googleapis/gax-go/v2/apierror/apierror.go
index 90a40d29c1..cba5919195 100644
--- a/vendor/github.com/googleapis/gax-go/v2/apierror/apierror.go
+++ b/vendor/github.com/googleapis/gax-go/v2/apierror/apierror.go
@@ -248,6 +248,17 @@ func (a *APIError) Error() string {
 	return strings.TrimSpace(fmt.Sprintf("%s\n%s", msg, a.details))
 }
 
+// Message returns the original, unformatted error message from the underlying
+// googleapi.Error or gRPC Status, without additional details or context.
+func (a *APIError) Message() string {
+	if a.httpErr != nil {
+		return a.httpErr.Message
+	} else if a.status != nil {
+		return a.status.Message()
+	}
+	return ""
+}
+
 // GRPCStatus extracts the underlying gRPC Status error.
 // This method is necessary to fulfill the interface
 // described in https://pkg.go.dev/google.golang.org/grpc/status#FromError.
diff --git a/vendor/github.com/googleapis/gax-go/v2/feature.go b/vendor/github.com/googleapis/gax-go/v2/feature.go
index 32e05a3234..c7a9ec88bb 100644
--- a/vendor/github.com/googleapis/gax-go/v2/feature.go
+++ b/vendor/github.com/googleapis/gax-go/v2/feature.go
@@ -51,11 +51,17 @@ func IsFeatureEnabled(name string) bool {
 	featureEnabledOnce.Do(func() {
 		featureEnabledStore = make(map[string]bool)
 		for _, env := range os.Environ() {
+			prefix := ""
 			if strings.HasPrefix(env, "GOOGLE_SDK_GO_EXPERIMENTAL_") {
+				prefix = "GOOGLE_SDK_GO_EXPERIMENTAL_"
+			} else if strings.HasPrefix(env, "GOOGLE_SDK_GO_") {
+				prefix = "GOOGLE_SDK_GO_"
+			}
+			if prefix != "" {
 				// Parse "KEY=VALUE"
 				kv := strings.SplitN(env, "=", 2)
 				if len(kv) == 2 && strings.ToLower(kv[1]) == "true" {
-					key := strings.TrimPrefix(kv[0], "GOOGLE_SDK_GO_EXPERIMENTAL_")
+					key := strings.TrimPrefix(kv[0], prefix)
 					featureEnabledStore[key] = true
 				}
 			}
diff --git a/vendor/github.com/googleapis/gax-go/v2/internal/version.go b/vendor/github.com/googleapis/gax-go/v2/internal/version.go
index b374c67db9..f324d1ab82 100644
--- a/vendor/github.com/googleapis/gax-go/v2/internal/version.go
+++ b/vendor/github.com/googleapis/gax-go/v2/internal/version.go
@@ -17,4 +17,4 @@
 package internal
 
 // Version is the current tagged release of the library.
-const Version = "2.19.0"
+const Version = "2.22.0"
diff --git a/vendor/github.com/googleapis/gax-go/v2/invoke.go b/vendor/github.com/googleapis/gax-go/v2/invoke.go
index 594ac168c1..ea16c3c5ac 100644
--- a/vendor/github.com/googleapis/gax-go/v2/invoke.go
+++ b/vendor/github.com/googleapis/gax-go/v2/invoke.go
@@ -77,7 +77,7 @@ func Sleep(ctx context.Context, d time.Duration) error {
 type sleeper func(ctx context.Context, d time.Duration) error
 
 // invoke implements Invoke, taking an additional sleeper argument for testing.
-func invoke(ctx context.Context, call APICall, settings CallSettings, sp sleeper) error {
+func invoke(ctx context.Context, call APICall, settings CallSettings, sp sleeper) (err error) {
 	var retryer Retryer
 
 	// Only use the value provided via WithTimeout if the context doesn't
@@ -89,6 +89,14 @@ func invoke(ctx context.Context, call APICall, settings CallSettings, sp sleeper
 		ctx = c
 	}
 
+	if IsFeatureEnabled("METRICS") {
+		start := time.Now()
+		ctx = InjectTransportTelemetry(ctx, &TransportTelemetryData{})
+		defer func() {
+			recordMetric(ctx, settings, time.Since(start), err)
+		}()
+	}
+
 	retryCount := 0
 	// Feature gate: GOOGLE_SDK_GO_EXPERIMENTAL_TRACING=true
 	tracingEnabled := IsFeatureEnabled("TRACING")
@@ -97,7 +105,7 @@ func invoke(ctx context.Context, call APICall, settings CallSettings, sp sleeper
 		if tracingEnabled {
 			ctxToUse = withRetryCount(ctx, retryCount)
 		}
-		err := call(ctxToUse, settings)
+		err = call(ctxToUse, settings)
 		if err == nil {
 			return nil
 		}
diff --git a/vendor/github.com/googleapis/gax-go/v2/telemetry.go b/vendor/github.com/googleapis/gax-go/v2/telemetry.go
index 1e0320a201..b849b36919 100644
--- a/vendor/github.com/googleapis/gax-go/v2/telemetry.go
+++ b/vendor/github.com/googleapis/gax-go/v2/telemetry.go
@@ -31,12 +31,20 @@ package gax
 
 import (
 	"context"
+	"errors"
+	"fmt"
 	"log/slog"
+	"strconv"
 	"sync"
+	"time"
 
+	"github.com/googleapis/gax-go/v2/apierror"
+	"github.com/googleapis/gax-go/v2/callctx"
 	"go.opentelemetry.io/otel"
 	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/metric"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 )
 
 // TransportTelemetryData contains mutable telemetry information that the transport
@@ -46,9 +54,8 @@ import (
 // regardless of any other documented package stability guarantees.
 // It should not be used by external consumers.
 type TransportTelemetryData struct {
-	serverAddress      string
-	serverPort         int
-	responseStatusCode int
+	serverAddress string
+	serverPort    int
 }
 
 // SetServerAddress sets the server address.
@@ -71,16 +78,6 @@ func (d *TransportTelemetryData) SetServerPort(port int) { d.serverPort = port }
 // regardless of any other documented package stability guarantees.
 func (d *TransportTelemetryData) ServerPort() int { return d.serverPort }
 
-// SetResponseStatusCode sets the response status code.
-// Experimental: This function is experimental and may be modified or removed in future versions,
-// regardless of any other documented package stability guarantees.
-func (d *TransportTelemetryData) SetResponseStatusCode(code int) { d.responseStatusCode = code }
-
-// ResponseStatusCode returns the response status code.
-// Experimental: This function is experimental and may be modified or removed in future versions,
-// regardless of any other documented package stability guarantees.
-func (d *TransportTelemetryData) ResponseStatusCode() int { return d.responseStatusCode }
-
 // transportTelemetryKey is the private context key used to inject TransportTelemetryData
 type transportTelemetryKey struct{}
 
@@ -293,3 +290,180 @@ func (cm *ClientMetrics) attributes() []attribute.KeyValue {
 	}
 	return cm.get().attr
 }
+
+var codeToStr = [...]string{
+	"OK",                  // codes.OK = 0
+	"CANCELED",            // codes.Canceled = 1
+	"UNKNOWN",             // codes.Unknown = 2
+	"INVALID_ARGUMENT",    // codes.InvalidArgument = 3
+	"DEADLINE_EXCEEDED",   // codes.DeadlineExceeded = 4
+	"NOT_FOUND",           // codes.NotFound = 5
+	"ALREADY_EXISTS",      // codes.AlreadyExists = 6
+	"PERMISSION_DENIED",   // codes.PermissionDenied = 7
+	"RESOURCE_EXHAUSTED",  // codes.ResourceExhausted = 8
+	"FAILED_PRECONDITION", // codes.FailedPrecondition = 9
+	"ABORTED",             // codes.Aborted = 10
+	"OUT_OF_RANGE",        // codes.OutOfRange = 11
+	"UNIMPLEMENTED",       // codes.Unimplemented = 12
+	"INTERNAL",            // codes.Internal = 13
+	"UNAVAILABLE",         // codes.Unavailable = 14
+	"DATA_LOSS",           // codes.DataLoss = 15
+	"UNAUTHENTICATED",     // codes.Unauthenticated = 16
+}
+
+// grpcCodeToStatusString converts a codes.Code to its string representation.
+// Experimental: This function is experimental and may be modified or removed in future versions,
+// regardless of any other documented package stability guarantees.
+func grpcCodeToStatusString(c codes.Code) string {
+	if int(c) >= 0 && int(c) < len(codeToStr) {
+		return codeToStr[c]
+	}
+	return "UNKNOWN"
+}
+
+// TelemetryErrorInfo contains the mapped error type and status code, as well as
+// additional details like status message, domain, and metadata, extracted from an error
+// for telemetry purposes.
+type TelemetryErrorInfo struct {
+	// ErrorType is a mapped string for the error type.
+	// For stability, this maps client-side cancellations, timeouts, and known gRPC
+	// status codes to standard string literals (e.g., "CLIENT_TIMEOUT",
+	// "PERMISSION_DENIED"), and falls back to %T for unhandled types. If an
+	// apierror.APIError is found, it uses its fine-grained Reason() (e.g.,
+	// "SERVICE_DISABLED").
+	// This is used by metrics, tracing, and logging.
+	ErrorType string
+	// StatusCode is the string representation of the RPC status code.
+	// This is used by metrics, tracing, and logging.
+	StatusCode string
+	// StatusMessage is the raw message from the error.
+	// This is used for structured logging.
+	StatusMessage string
+	// Domain is the domain of the error, extracted from an ErrorInfo, if available.
+	// This is used for structured logging.
+	Domain string
+	// Metadata is the metadata of the error, extracted from an ErrorInfo, if available.
+	// This is used for structured logging.
+	Metadata map[string]string
+
+	// _ struct{} prevents unkeyed struct literals, ensuring backwards
+	// compatibility when new fields are added in the future.
+	_ struct{}
+}
+
+// ExtractTelemetryErrorInfo parses an error into a TelemetryErrorInfo struct.
+// It relies on standard gRPC status codes, apierror.APIError parsing, and
+// context inspection to determine the most accurate error classification and
+// provide detailed metadata for telemetry systems.
+//
+// Experimental: This function is experimental and may be modified or removed in future versions,
+// regardless of any other documented package stability guarantees.
+func ExtractTelemetryErrorInfo(ctx context.Context, err error) TelemetryErrorInfo {
+	if err == nil {
+		return TelemetryErrorInfo{ErrorType: "", StatusCode: "OK"}
+	}
+
+	st, ok := status.FromError(err)
+	if !ok {
+		st = status.FromContextError(err)
+	}
+	rpcStatusCode := grpcCodeToStatusString(st.Code())
+
+	var errType string
+	// 1. Check if the local context expired or was cancelled. This is the only
+	// reliable way to distinguish a local client timeout from a server timeout
+	// because gRPC does not wrap context errors in its status.Error types.
+	if errors.Is(ctx.Err(), context.DeadlineExceeded) {
+		errType = "CLIENT_TIMEOUT"
+	} else if errors.Is(ctx.Err(), context.Canceled) {
+		errType = "CLIENT_CANCELLED"
+	} else if !ok || st.Code() == codes.Unknown || st.Code() == codes.Internal {
+		// 2. If the error isn't a context breakdown and the gRPC framework
+		// doesn't "understand" it (returning ok=false or a generic catch-all
+		// bucket like Unknown/Internal), we "pack" the actual Go error type
+		// name into error.type (e.g., "*net.OpError"). This is per the error.type
+		// [spec](https://opentelemetry.io/docs/specs/semconv/registry/attributes/error/#error-type).
+		// "When error.type is set to a type (e.g., an exception type), its canonical
+		// class name identifying the type within the artifact SHOULD be used."
+		errType = fmt.Sprintf("%T", err)
+	} else {
+		// 3. Otherwise, it is a well-understood gRPC protocol error (e.g.,
+		// PERMISSION_DENIED) likely returned by the server.
+		errType = rpcStatusCode
+	}
+
+	var msg, domain string
+	var metadata map[string]string
+	if ok {
+		msg = st.Message()
+	} else {
+		msg = err.Error()
+	}
+
+	if parsedErr, parsedOk := apierror.ParseError(err, false); parsedOk {
+		// If there's an actionable error, the reason takes precedence over our calculated error type.
+		if reason := parsedErr.Reason(); reason != "" {
+			errType = reason
+		} else if httpCode := parsedErr.HTTPCode(); httpCode > 0 {
+			errType = strconv.Itoa(httpCode)
+		}
+		if message := parsedErr.Message(); message != "" {
+			msg = message
+		} else if parsedErr.HTTPCode() > 0 {
+			// For HTTP errors, avoid returning the raw, unformatted err.Error() (e.g. "googleapi: got HTTP response...")
+			// if the actual parsed message from the response is empty.
+			msg = ""
+		}
+		domain = parsedErr.Domain()
+		metadata = parsedErr.Metadata()
+	}
+
+	return TelemetryErrorInfo{
+		ErrorType:     errType,
+		StatusCode:    rpcStatusCode,
+		StatusMessage: msg,
+		Domain:        domain,
+		Metadata:      metadata,
+	}
+}
+
+// recordMetric records a duration measurement for the configured metric.
+func recordMetric(ctx context.Context, settings CallSettings, d time.Duration, err error) {
+	if settings.clientMetrics == nil || settings.clientMetrics.durationHistogram() == nil {
+		return
+	}
+
+	// Use context.WithoutCancel to ensure metric records even if context is canceled
+	// preserving any trace context that might be required for exemplars.
+	recordCtx := context.WithoutCancel(ctx)
+
+	// Pre-allocate to avoid repeated appends (5 is the max number of dynamic attributes added here)
+	attrs := make([]attribute.KeyValue, 0, len(settings.clientMetrics.attributes())+5)
+	attrs = append(attrs, settings.clientMetrics.attributes()...)
+
+	errInfo := ExtractTelemetryErrorInfo(ctx, err)
+
+	if td := ExtractTransportTelemetry(ctx); td != nil {
+		if td.ServerAddress() != "" {
+			attrs = append(attrs, attribute.String("server.address", td.ServerAddress()))
+		}
+		if td.ServerPort() != 0 {
+			attrs = append(attrs, attribute.Int("server.port", td.ServerPort()))
+		}
+	}
+
+	if errInfo.ErrorType != "" {
+		attrs = append(attrs, attribute.String("error.type", errInfo.ErrorType))
+	}
+
+	attrs = append(attrs, attribute.String("rpc.response.status_code", errInfo.StatusCode))
+
+	if rpcMethod, ok := callctx.TelemetryFromContext(ctx, "rpc_method"); ok && rpcMethod != "" {
+		attrs = append(attrs, attribute.String("rpc.method", rpcMethod))
+	}
+	if urlTemplate, ok := callctx.TelemetryFromContext(ctx, "url_template"); ok && urlTemplate != "" {
+		attrs = append(attrs, attribute.String("url.template", urlTemplate))
+	}
+
+	settings.clientMetrics.durationHistogram().Record(recordCtx, d.Seconds(), metric.WithAttributes(attrs...))
+}
diff --git a/vendor/github.com/sigstore/timestamp-authority/v2/pkg/verification/verify.go b/vendor/github.com/sigstore/timestamp-authority/v2/pkg/verification/verify.go
index 9c6d141798..2f799e0301 100644
--- a/vendor/github.com/sigstore/timestamp-authority/v2/pkg/verification/verify.go
+++ b/vendor/github.com/sigstore/timestamp-authority/v2/pkg/verification/verify.go
@@ -17,6 +17,7 @@ package verification
 
 import (
 	"bytes"
+	"crypto"
 	"crypto/x509"
 	"encoding/asn1"
 	"fmt"
@@ -96,7 +97,7 @@ func verifyLeafCertCriticalEKU(cert *x509.Certificate) error {
 	return nil
 }
 
-func verifyLeafCert(leafCert *x509.Certificate, opts VerifyOpts) error {
+func verifyLeafCert(leafCert *x509.Certificate, verifiedChains [][]*x509.Certificate, opts VerifyOpts) error {
 	if leafCert == nil {
 		// should never happen
 		return fmt.Errorf("signer certificate is required")
@@ -121,7 +122,7 @@ func verifyLeafCert(leafCert *x509.Certificate, opts VerifyOpts) error {
 
 	// verifies that the leaf certificate and any intermediate certificates
 	// have EKU set to only time stamping usage
-	err = verifyLeafAndIntermediatesTimestampingEKU(leafCert, opts)
+	err = verifyLeafAndIntermediatesTimestampingEKU(leafCert, verifiedChains)
 	if err != nil {
 		return fmt.Errorf("failed to verify EKU on leaf certificate: %w", err)
 	}
@@ -167,18 +168,31 @@ func verifyIntermediateExtendedKeyUsage(cert *x509.Certificate) error {
 // Leaf certificates must have exactly one EKU set to Timestamping
 // Intermediates can have no EKU (unrestricted) or multiple EKUs,
 // which need to include Timestamping or UsageAny.
-func verifyLeafAndIntermediatesTimestampingEKU(leafCert *x509.Certificate, opts VerifyOpts) error {
+func verifyLeafAndIntermediatesTimestampingEKU(leafCert *x509.Certificate, verifiedChains [][]*x509.Certificate) error {
 	err := verifyLeafExtendedKeyUsage(leafCert)
 	if err != nil {
 		return fmt.Errorf("failed to verify EKU on leaf certificate: %w", err)
 	}
 
-	for _, cert := range opts.Intermediates {
-		err := verifyIntermediateExtendedKeyUsage(cert)
-		if err != nil {
-			return fmt.Errorf("failed to verify EKU on intermediate certificate: %w", err)
+	var lastErr error
+	for _, chain := range verifiedChains {
+		chainOK := true
+		// Skip the leaf cert (index 0) and the root (last index)
+		for i := 1; i < len(chain)-1; i++ {
+			err := verifyIntermediateExtendedKeyUsage(chain[i])
+			if err != nil {
+				chainOK = false
+				lastErr = err
+				break
+			}
+		}
+		if chainOK {
+			return nil // Found at least one fully valid chain with proper EKU chaining
 		}
 	}
+	if lastErr != nil {
+		return fmt.Errorf("no verified certificate chain met EKU requirements: %w", lastErr)
+	}
 	return nil
 }
 
@@ -224,8 +238,16 @@ func VerifyTimestampResponse(tsrBytes []byte, artifact io.Reader, opts VerifyOpt
 		return nil, fmt.Errorf("error parsing response into Timestamp: %w", err)
 	}
 
+	switch ts.HashAlgorithm {
+	case crypto.SHA1:
+		return nil, ErrWeakHashAlg
+	case crypto.SHA256, crypto.SHA384, crypto.SHA512:
+	default:
+		return nil, ErrUnsupportedHashAlg
+	}
+
 	// verify the timestamp response signature using the provided certificate pool
-	signerCert, err := verifyTSRWithChain(ts, opts)
+	signerCert, verifiedChains, err := verifyTSRWithChain(ts, opts)
 	if err != nil {
 		return nil, err
 	}
@@ -238,7 +260,7 @@ func VerifyTimestampResponse(tsrBytes []byte, artifact io.Reader, opts VerifyOpt
 		return nil, err
 	}
 
-	if err = verifyLeafCert(signerCert, opts); err != nil {
+	if err = verifyLeafCert(signerCert, verifiedChains, opts); err != nil {
 		return nil, err
 	}
 
@@ -252,18 +274,18 @@ func VerifyTimestampResponse(tsrBytes []byte, artifact io.Reader, opts VerifyOpt
 }
 
 // Returns the TSA signer certificate after verifying the certificate chain validity.
-func verifyTSRWithChain(ts *timestamp.Timestamp, opts VerifyOpts) (*x509.Certificate, error) {
+func verifyTSRWithChain(ts *timestamp.Timestamp, opts VerifyOpts) (*x509.Certificate, [][]*x509.Certificate, error) {
 	p7Message, err := pkcs7.Parse(ts.RawToken)
 	if err != nil {
-		return nil, fmt.Errorf("error parsing hashed message: %w", err)
+		return nil, nil, fmt.Errorf("error parsing hashed message: %w", err)
 	}
 
 	if len(opts.Roots) == 0 {
-		return nil, fmt.Errorf("no root certificates provided for verifying the certificate chain")
+		return nil, nil, fmt.Errorf("no root certificates provided for verifying the certificate chain")
 	}
 
 	if p7Message.Certificates == nil && opts.TSACertificate == nil {
-		return nil, fmt.Errorf("leaf certificate must be present in the TSR or as a verify option")
+		return nil, nil, fmt.Errorf("leaf certificate must be present in the TSR or as a verify option")
 	}
 
 	rootCertPool := x509.NewCertPool()
@@ -273,7 +295,7 @@ func verifyTSRWithChain(ts *timestamp.Timestamp, opts VerifyOpts) (*x509.Certifi
 		}
 	}
 	if rootCertPool.Equal(x509.NewCertPool()) {
-		return nil, fmt.Errorf("no valid root certificates provided for verifying the certificate chain")
+		return nil, nil, fmt.Errorf("no valid root certificates provided for verifying the certificate chain")
 	}
 	intermediateCertPool := x509.NewCertPool()
 	for _, cert := range opts.Intermediates {
@@ -281,10 +303,16 @@ func verifyTSRWithChain(ts *timestamp.Timestamp, opts VerifyOpts) (*x509.Certifi
 			intermediateCertPool.AddCert(cert)
 		}
 	}
+	for _, cert := range p7Message.Certificates {
+		if cert != nil {
+			intermediateCertPool.AddCert(cert)
+		}
+	}
 
 	x509Opts := x509.VerifyOptions{
 		Roots:         rootCertPool,
 		Intermediates: intermediateCertPool,
+		KeyUsages:     []x509.ExtKeyUsage{x509.ExtKeyUsageTimeStamping},
 	}
 
 	// if the PCKS7 object does not have any certificates set in the
@@ -297,21 +325,26 @@ func verifyTSRWithChain(ts *timestamp.Timestamp, opts VerifyOpts) (*x509.Certifi
 		p7Message.Certificates = []*x509.Certificate{opts.TSACertificate}
 	}
 
-	err = p7Message.VerifyWithOpts(x509Opts)
+	err = p7Message.Verify()
 	if err != nil {
-		return nil, fmt.Errorf("error while verifying with chain: %w", err)
+		return nil, nil, fmt.Errorf("error while verifying signature: %w", err)
 	}
 
 	signerCert := p7Message.GetOnlySigner()
 	if signerCert == nil {
-		return nil, fmt.Errorf("signer certificate was not found")
+		return nil, nil, fmt.Errorf("signer certificate was not found")
 	}
 
 	if opts.TSACertificate != nil && !opts.TSACertificate.Equal(signerCert) {
-		return nil, fmt.Errorf("certificate embedded in the TSR does not match the provided TSA certificate")
+		return nil, nil, fmt.Errorf("certificate embedded in the TSR does not match the provided TSA certificate")
+	}
+
+	chains, err := signerCert.Verify(x509Opts)
+	if err != nil {
+		return nil, nil, fmt.Errorf("error while verifying signer certificate chain: %w", err)
 	}
 
-	return signerCert, nil
+	return signerCert, chains, nil
 }
 
 // Verify that the TSR's hashed message matches the digest of the artifact to be timestamped
diff --git a/vendor/github.com/sigstore/timestamp-authority/v2/pkg/verification/verify_request.go b/vendor/github.com/sigstore/timestamp-authority/v2/pkg/verification/verify_request.go
index ba7511d755..c07371fdf7 100644
--- a/vendor/github.com/sigstore/timestamp-authority/v2/pkg/verification/verify_request.go
+++ b/vendor/github.com/sigstore/timestamp-authority/v2/pkg/verification/verify_request.go
@@ -25,6 +25,8 @@ import (
 var ErrWeakHashAlg = errors.New("weak hash algorithm: must be SHA-256, SHA-384, or SHA-512")
 var ErrUnsupportedHashAlg = errors.New("unsupported hash algorithm")
 var ErrInconsistentDigestLength = errors.New("digest length inconsistent with specified hash algorithm")
+var ErrUnacceptedPolicy = errors.New("unaccepted policy: requested TSA policy is not supported by the TSA")
+var ErrUnacceptedExtension = errors.New("unaccepted extension: requested extensions are not supported by the TSA")
 
 func VerifyRequest(ts *timestamp.Request) error {
 	// only SHA-1, SHA-256, SHA-384, and SHA-512 are supported by the underlying library
diff --git a/vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/config.go b/vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/config.go
index e65c4907c9..2a64fd330c 100644
--- a/vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/config.go
+++ b/vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/config.go
@@ -31,14 +31,16 @@ type Filter func(*stats.RPCTagInfo) bool
 
 // config is a group of options for this instrumentation.
 type config struct {
-	Filter            Filter
-	InterceptorFilter InterceptorFilter
-	Propagators       propagation.TextMapPropagator
-	TracerProvider    trace.TracerProvider
-	MeterProvider     metric.MeterProvider
-	SpanStartOptions  []trace.SpanStartOption
-	SpanAttributes    []attribute.KeyValue
-	MetricAttributes  []attribute.KeyValue
+	Filter             Filter
+	InterceptorFilter  InterceptorFilter
+	Propagators        propagation.TextMapPropagator
+	TracerProvider     trace.TracerProvider
+	MeterProvider      metric.MeterProvider
+	SpanKind           trace.SpanKind
+	SpanStartOptions   []trace.SpanStartOption
+	SpanAttributes     []attribute.KeyValue
+	MetricAttributes   []attribute.KeyValue
+	MetricAttributesFn func(ctx context.Context) []attribute.KeyValue
 
 	PublicEndpoint   bool
 	PublicEndpointFn func(ctx context.Context, info *stats.RPCTagInfo) bool
@@ -52,6 +54,12 @@ type Option interface {
 	apply(*config)
 }
 
+type optionFunc func(*config)
+
+func (f optionFunc) apply(c *config) {
+	f(c)
+}
+
 // newConfig returns a config configured with all the passed Options.
 func newConfig(opts []Option) *config {
 	c := &config{
@@ -65,27 +73,13 @@ func newConfig(opts []Option) *config {
 	return c
 }
 
-type publicEndpointOption struct{ p bool }
-
-func (o publicEndpointOption) apply(c *config) {
-	c.PublicEndpoint = o.p
-}
-
 // WithPublicEndpoint configures the Handler to link the span with an incoming
 // span context. If this option is not provided, then the association is a child
 // association instead of a link.
 func WithPublicEndpoint() Option {
-	return publicEndpointOption{p: true}
-}
-
-type publicEndpointFnOption struct {
-	fn func(context.Context, *stats.RPCTagInfo) bool
-}
-
-func (o publicEndpointFnOption) apply(c *config) {
-	if o.fn != nil {
-		c.PublicEndpointFn = o.fn
-	}
+	return optionFunc(func(c *config) {
+		c.PublicEndpoint = true
+	})
 }
 
 // WithPublicEndpointFn runs with every request, and allows conditionally
@@ -94,81 +88,59 @@ func (o publicEndpointFnOption) apply(c *config) {
 // child association instead of a link.
 // Note: WithPublicEndpoint takes precedence over WithPublicEndpointFn.
 func WithPublicEndpointFn(fn func(context.Context, *stats.RPCTagInfo) bool) Option {
-	return publicEndpointFnOption{fn: fn}
-}
-
-type propagatorsOption struct{ p propagation.TextMapPropagator }
-
-func (o propagatorsOption) apply(c *config) {
-	if o.p != nil {
-		c.Propagators = o.p
-	}
+	return optionFunc(func(c *config) {
+		c.PublicEndpointFn = fn
+	})
 }
 
 // WithPropagators returns an Option to use the Propagators when extracting
 // and injecting trace context from requests.
 func WithPropagators(p propagation.TextMapPropagator) Option {
-	return propagatorsOption{p: p}
-}
-
-type tracerProviderOption struct{ tp trace.TracerProvider }
-
-func (o tracerProviderOption) apply(c *config) {
-	if o.tp != nil {
-		c.TracerProvider = o.tp
-	}
+	return optionFunc(func(c *config) {
+		if p != nil {
+			c.Propagators = p
+		}
+	})
 }
 
 // WithInterceptorFilter returns an Option to use the request filter.
 //
 // Deprecated: Use stats handlers instead.
 func WithInterceptorFilter(f InterceptorFilter) Option {
-	return interceptorFilterOption{f: f}
-}
-
-type interceptorFilterOption struct {
-	f InterceptorFilter
-}
-
-func (o interceptorFilterOption) apply(c *config) {
-	if o.f != nil {
-		c.InterceptorFilter = o.f
-	}
+	return optionFunc(func(c *config) {
+		if f != nil {
+			c.InterceptorFilter = f
+		}
+	})
 }
 
 // WithFilter returns an Option to use the request filter.
 func WithFilter(f Filter) Option {
-	return filterOption{f: f}
-}
-
-type filterOption struct {
-	f Filter
-}
-
-func (o filterOption) apply(c *config) {
-	if o.f != nil {
-		c.Filter = o.f
-	}
+	return optionFunc(func(c *config) {
+		if f != nil {
+			c.Filter = f
+		}
+	})
 }
 
 // WithTracerProvider returns an Option to use the TracerProvider when
 // creating a Tracer.
 func WithTracerProvider(tp trace.TracerProvider) Option {
-	return tracerProviderOption{tp: tp}
-}
-
-type meterProviderOption struct{ mp metric.MeterProvider }
-
-func (o meterProviderOption) apply(c *config) {
-	if o.mp != nil {
-		c.MeterProvider = o.mp
-	}
+	return optionFunc(func(c *config) {
+		if tp != nil {
+			c.TracerProvider = tp
+		}
+	})
 }
 
 // WithMeterProvider returns an Option to use the MeterProvider when
 // creating a Meter. If this option is not provide the global MeterProvider will be used.
 func WithMeterProvider(mp metric.MeterProvider) Option {
-	return meterProviderOption{mp: mp}
+	return optionFunc(func(c *config) {
+		if mp != nil {
+			c.MeterProvider = mp
+		}
+	})
 }
 
 // Event type that can be recorded, see WithMessageEvents.
@@ -180,21 +152,6 @@ const (
 	SentEvents
 )
 
-type messageEventsProviderOption struct {
-	events []Event
-}
-
-func (m messageEventsProviderOption) apply(c *config) {
-	for _, e := range m.events {
-		switch e {
-		case ReceivedEvents:
-			c.ReceivedEvent = true
-		case SentEvents:
-			c.SentEvent = true
-		}
-	}
-}
-
 // WithMessageEvents configures the Handler to record the specified events
 // (span.AddEvent) on spans. By default only summary attributes are added at the
 // end of the request.
@@ -203,13 +160,16 @@ func (m messageEventsProviderOption) apply(c *config) {
 //   - ReceivedEvents: Record the number of bytes read after every gRPC read operation.
 //   - SentEvents: Record the number of bytes written after every gRPC write operation.
 func WithMessageEvents(events ...Event) Option {
-	return messageEventsProviderOption{events: events}
-}
-
-type spanStartOption struct{ opts []trace.SpanStartOption }
-
-func (o spanStartOption) apply(c *config) {
-	c.SpanStartOptions = append(c.SpanStartOptions, o.opts...)
+	return optionFunc(func(c *config) {
+		for _, e := range events {
+			switch e {
+			case ReceivedEvents:
+				c.ReceivedEvent = true
+			case SentEvents:
+				c.SentEvent = true
+			}
+		}
+	})
 }
 
 // WithSpanOptions configures an additional set of
@@ -217,31 +177,49 @@ func (o spanStartOption) apply(c *config) {
 //
 // Deprecated: It is only used by the deprecated interceptor, and is unused by [NewClientHandler] and [NewServerHandler].
 func WithSpanOptions(opts ...trace.SpanStartOption) Option {
-	return spanStartOption{opts}
+	return optionFunc(func(c *config) {
+		c.SpanStartOptions = append(c.SpanStartOptions, opts...)
+	})
 }
 
-type spanAttributesOption struct{ a []attribute.KeyValue }
-
-func (o spanAttributesOption) apply(c *config) {
-	if o.a != nil {
-		c.SpanAttributes = o.a
-	}
+// WithSpanKind returns an Option to set the span kind for spans created by
+// the handler.
+//
+// By default, [NewServerHandler] creates spans with
+// [trace.SpanKindServer] and [NewClientHandler] creates spans with
+// [trace.SpanKindClient].
+func WithSpanKind(sk trace.SpanKind) Option {
+	return optionFunc(func(c *config) {
+		c.SpanKind = sk
+	})
 }
 
 // WithSpanAttributes returns an Option to add custom attributes to the spans.
 func WithSpanAttributes(a ...attribute.KeyValue) Option {
-	return spanAttributesOption{a: a}
-}
-
-type metricAttributesOption struct{ a []attribute.KeyValue }
-
-func (o metricAttributesOption) apply(c *config) {
-	if o.a != nil {
-		c.MetricAttributes = o.a
-	}
+	return optionFunc(func(c *config) {
+		if a != nil {
+			c.SpanAttributes = a
+		}
+	})
 }
 
 // WithMetricAttributes returns an Option to add custom attributes to the metrics.
 func WithMetricAttributes(a ...attribute.KeyValue) Option {
-	return metricAttributesOption{a: a}
+	return optionFunc(func(c *config) {
+		if a != nil {
+			c.MetricAttributes = append(c.MetricAttributes, a...)
+		}
+	})
+}
+
+// WithMetricAttributesFn returns an Option to add dynamic custom attributes to the handler's metrics.
+// The function is called once per RPC and the returned attributes are applied to all metrics recorded by this handler.
+//
+// The context parameter is the standard gRPC request context and provides access to request-scoped data.
+func WithMetricAttributesFn(fn func(ctx context.Context) []attribute.KeyValue) Option {
+	return optionFunc(func(c *config) {
+		if fn != nil {
+			c.MetricAttributesFn = fn
+		}
+	})
 }
diff --git a/vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/interceptor.go b/vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/interceptor.go
index 99f88ec3b9..69e8506ffd 100644
--- a/vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/interceptor.go
+++ b/vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/interceptor.go
@@ -11,7 +11,7 @@ import (
 
 	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/codes"
-	semconv "go.opentelemetry.io/otel/semconv/v1.37.0"
+	semconv "go.opentelemetry.io/otel/semconv/v1.40.0"
 	grpc_codes "google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 )
diff --git a/vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/internal/parse.go b/vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/internal/parse.go
index e46185e0b1..7d7f172e0a 100644
--- a/vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/internal/parse.go
+++ b/vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/internal/parse.go
@@ -8,7 +8,7 @@ import (
 	"strings"
 
 	"go.opentelemetry.io/otel/attribute"
-	semconv "go.opentelemetry.io/otel/semconv/v1.37.0"
+	semconv "go.opentelemetry.io/otel/semconv/v1.40.0"
 )
 
 // ParseFullMethod returns a span name following the OpenTelemetry semantic
@@ -23,19 +23,5 @@ func ParseFullMethod(fullMethod string) (string, []attribute.KeyValue) {
 		return fullMethod, nil
 	}
 	name := fullMethod[1:]
-	pos := strings.LastIndex(name, "/")
-	if pos < 0 {
-		// Invalid format, does not follow `/package.service/method`.
-		return name, nil
-	}
-	service, method := name[:pos], name[pos+1:]
-
-	var attrs []attribute.KeyValue
-	if service != "" {
-		attrs = append(attrs, semconv.RPCService(service))
-	}
-	if method != "" {
-		attrs = append(attrs, semconv.RPCMethod(method))
-	}
-	return name, attrs
+	return name, []attribute.KeyValue{semconv.RPCMethod(name)}
 }
diff --git a/vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/metadata_supplier.go b/vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/metadata_supplier.go
index b427e17247..4c62341d66 100644
--- a/vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/metadata_supplier.go
+++ b/vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/metadata_supplier.go
@@ -6,9 +6,7 @@ package otelgrpc // import "go.opentelemetry.io/contrib/instrumentation/google.g
 import (
 	"context"
 
-	"go.opentelemetry.io/otel/baggage"
 	"go.opentelemetry.io/otel/propagation"
-	"go.opentelemetry.io/otel/trace"
 	"google.golang.org/grpc/metadata"
 )
 
@@ -17,9 +15,9 @@ type metadataSupplier struct {
 }
 
 // assert that metadataSupplier implements the TextMapCarrier interface.
-var _ propagation.TextMapCarrier = &metadataSupplier{}
+var _ propagation.TextMapCarrier = metadataSupplier{}
 
-func (s *metadataSupplier) Get(key string) string {
+func (s metadataSupplier) Get(key string) string {
 	values := s.metadata.Get(key)
 	if len(values) == 0 {
 		return ""
@@ -27,11 +25,11 @@ func (s *metadataSupplier) Get(key string) string {
 	return values[0]
 }
 
-func (s *metadataSupplier) Set(key, value string) {
+func (s metadataSupplier) Set(key, value string) {
 	s.metadata.Set(key, value)
 }
 
-func (s *metadataSupplier) Keys() []string {
+func (s metadataSupplier) Keys() []string {
 	out := make([]string, 0, len(s.metadata))
 	for key := range s.metadata {
 		out = append(out, key)
@@ -39,50 +37,24 @@ func (s *metadataSupplier) Keys() []string {
 	return out
 }
 
-// Inject injects correlation context and span context into the gRPC
-// metadata object. This function is meant to be used on outgoing
-// requests.
-//
-// Deprecated: Unnecessary public func.
-func Inject(ctx context.Context, md *metadata.MD, opts ...Option) {
-	c := newConfig(opts)
-	c.Propagators.Inject(ctx, &metadataSupplier{
-		metadata: *md,
-	})
-}
-
 func inject(ctx context.Context, propagators propagation.TextMapPropagator) context.Context {
 	md, ok := metadata.FromOutgoingContext(ctx)
 	if !ok {
 		md = metadata.MD{}
 	}
-	propagators.Inject(ctx, &metadataSupplier{
+	propagators.Inject(ctx, metadataSupplier{
 		metadata: md,
 	})
 	return metadata.NewOutgoingContext(ctx, md)
 }
 
-// Extract returns the correlation context and span context that
-// another service encoded in the gRPC metadata object with Inject.
-// This function is meant to be used on incoming requests.
-//
-// Deprecated: Unnecessary public func.
-func Extract(ctx context.Context, md *metadata.MD, opts ...Option) (baggage.Baggage, trace.SpanContext) {
-	c := newConfig(opts)
-	ctx = c.Propagators.Extract(ctx, &metadataSupplier{
-		metadata: *md,
-	})
-
-	return baggage.FromContext(ctx), trace.SpanContextFromContext(ctx)
-}
-
 func extract(ctx context.Context, propagators propagation.TextMapPropagator) context.Context {
 	md, ok := metadata.FromIncomingContext(ctx)
 	if !ok {
 		md = metadata.MD{}
 	}
 
-	return propagators.Extract(ctx, &metadataSupplier{
+	return propagators.Extract(ctx, metadataSupplier{
 		metadata: md,
 	})
 }
diff --git a/vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/stats_handler.go b/vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/stats_handler.go
index 29d7ab2bda..be9282f29f 100644
--- a/vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/stats_handler.go
+++ b/vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/stats_handler.go
@@ -5,15 +5,15 @@ package otelgrpc // import "go.opentelemetry.io/contrib/instrumentation/google.g
 
 import (
 	"context"
-	"sync/atomic"
+	"strconv"
 	"time"
 
 	"go.opentelemetry.io/otel"
 	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/codes"
 	"go.opentelemetry.io/otel/metric"
-	semconv "go.opentelemetry.io/otel/semconv/v1.37.0"
-	"go.opentelemetry.io/otel/semconv/v1.37.0/rpcconv"
+	semconv "go.opentelemetry.io/otel/semconv/v1.40.0"
+	"go.opentelemetry.io/otel/semconv/v1.40.0/rpcconv"
 	"go.opentelemetry.io/otel/trace"
 	grpc_codes "google.golang.org/grpc/codes"
 	"google.golang.org/grpc/peer"
@@ -26,8 +26,6 @@ import (
 type gRPCContextKey struct{}
 
 type gRPCContext struct {
-	inMessages  int64
-	outMessages int64
 	metricAttrs []attribute.KeyValue
 	record      bool
 }
@@ -37,51 +35,37 @@ type serverHandler struct {
 
 	tracer trace.Tracer
 
-	duration rpcconv.ServerDuration
-	inSize   rpcconv.ServerRequestSize
-	outSize  rpcconv.ServerResponseSize
-	inMsg    rpcconv.ServerRequestsPerRPC
-	outMsg   rpcconv.ServerResponsesPerRPC
+	duration rpcconv.ServerCallDuration
 }
 
 // NewServerHandler creates a stats.Handler for a gRPC server.
 func NewServerHandler(opts ...Option) stats.Handler {
 	c := newConfig(opts)
+	if c.SpanKind == trace.SpanKindUnspecified {
+		c.SpanKind = trace.SpanKindServer
+	}
+
 	h := &serverHandler{config: c}
 
 	h.tracer = c.TracerProvider.Tracer(
 		ScopeName,
-		trace.WithInstrumentationVersion(Version()),
+		trace.WithInstrumentationVersion(Version),
 	)
 
 	meter := c.MeterProvider.Meter(
 		ScopeName,
-		metric.WithInstrumentationVersion(Version()),
+		metric.WithInstrumentationVersion(Version),
 		metric.WithSchemaURL(semconv.SchemaURL),
 	)
 
 	var err error
-	h.duration, err = rpcconv.NewServerDuration(meter)
-	if err != nil {
-		otel.Handle(err)
-	}
-
-	h.inSize, err = rpcconv.NewServerRequestSize(meter)
-	if err != nil {
-		otel.Handle(err)
-	}
-
-	h.outSize, err = rpcconv.NewServerResponseSize(meter)
-	if err != nil {
-		otel.Handle(err)
-	}
-
-	h.inMsg, err = rpcconv.NewServerRequestsPerRPC(meter)
-	if err != nil {
-		otel.Handle(err)
-	}
-
-	h.outMsg, err = rpcconv.NewServerResponsesPerRPC(meter)
+	h.duration, err = rpcconv.NewServerCallDuration(
+		meter,
+		metric.WithExplicitBucketBoundaries(
+			0.005, 0.01, 0.025, 0.05, 0.075, 0.1,
+			0.25, 0.5, 0.75, 1, 2.5, 5, 7.5, 10,
+		),
+	)
 	if err != nil {
 		otel.Handle(err)
 	}
@@ -103,7 +87,7 @@ func (h *serverHandler) TagRPC(ctx context.Context, info *stats.RPCTagInfo) cont
 	ctx = extract(ctx, h.Propagators)
 
 	name, attrs := internal.ParseFullMethod(info.FullMethodName)
-	attrs = append(attrs, semconv.RPCSystemGRPC)
+	attrs = append(attrs, semconv.RPCSystemNameGRPC)
 
 	record := true
 	if h.Filter != nil {
@@ -111,9 +95,12 @@ func (h *serverHandler) TagRPC(ctx context.Context, info *stats.RPCTagInfo) cont
 	}
 
 	if record {
+		// Make a new slice to avoid aliasing into the same attrs slice used by metrics.
+		spanAttributes := make([]attribute.KeyValue, 0, len(attrs)+len(h.SpanAttributes))
+		spanAttributes = append(append(spanAttributes, attrs...), h.SpanAttributes...)
 		opts := []trace.SpanStartOption{
-			trace.WithSpanKind(trace.SpanKindServer),
-			trace.WithAttributes(append(attrs, h.SpanAttributes...)...),
+			trace.WithSpanKind(h.SpanKind),
+			trace.WithAttributes(spanAttributes...),
 		}
 		if h.PublicEndpoint || (h.PublicEndpointFn != nil && h.PublicEndpointFn(ctx, info)) {
 			opts = append(opts, trace.WithNewRoot())
@@ -134,6 +121,11 @@ func (h *serverHandler) TagRPC(ctx context.Context, info *stats.RPCTagInfo) cont
 		record:      record,
 	}
 
+	if h.MetricAttributesFn != nil {
+		extraAttrs := h.MetricAttributesFn(ctx)
+		gctx.metricAttrs = append(gctx.metricAttrs, extraAttrs...)
+	}
+
 	return context.WithValue(ctx, gRPCContextKey{}, &gctx)
 }
 
@@ -143,10 +135,6 @@ func (h *serverHandler) HandleRPC(ctx context.Context, rs stats.RPCStats) {
 		ctx,
 		rs,
 		h.duration.Inst(),
-		h.inSize,
-		h.outSize,
-		h.inMsg.Inst(),
-		h.outMsg.Inst(),
 		serverStatus,
 	)
 }
@@ -156,51 +144,37 @@ type clientHandler struct {
 
 	tracer trace.Tracer
 
-	duration rpcconv.ClientDuration
-	inSize   rpcconv.ClientResponseSize
-	outSize  rpcconv.ClientRequestSize
-	inMsg    rpcconv.ClientResponsesPerRPC
-	outMsg   rpcconv.ClientRequestsPerRPC
+	duration rpcconv.ClientCallDuration
 }
 
 // NewClientHandler creates a stats.Handler for a gRPC client.
 func NewClientHandler(opts ...Option) stats.Handler {
 	c := newConfig(opts)
+	if c.SpanKind == trace.SpanKindUnspecified {
+		c.SpanKind = trace.SpanKindClient
+	}
+
 	h := &clientHandler{config: c}
 
 	h.tracer = c.TracerProvider.Tracer(
 		ScopeName,
-		trace.WithInstrumentationVersion(Version()),
+		trace.WithInstrumentationVersion(Version),
 	)
 
 	meter := c.MeterProvider.Meter(
 		ScopeName,
-		metric.WithInstrumentationVersion(Version()),
+		metric.WithInstrumentationVersion(Version),
 		metric.WithSchemaURL(semconv.SchemaURL),
 	)
 
 	var err error
-	h.duration, err = rpcconv.NewClientDuration(meter)
-	if err != nil {
-		otel.Handle(err)
-	}
-
-	h.inSize, err = rpcconv.NewClientResponseSize(meter)
-	if err != nil {
-		otel.Handle(err)
-	}
-
-	h.outSize, err = rpcconv.NewClientRequestSize(meter)
-	if err != nil {
-		otel.Handle(err)
-	}
-
-	h.inMsg, err = rpcconv.NewClientResponsesPerRPC(meter)
-	if err != nil {
-		otel.Handle(err)
-	}
-
-	h.outMsg, err = rpcconv.NewClientRequestsPerRPC(meter)
+	h.duration, err = rpcconv.NewClientCallDuration(
+		meter,
+		metric.WithExplicitBucketBoundaries(
+			0.005, 0.01, 0.025, 0.05, 0.075, 0.1,
+			0.25, 0.5, 0.75, 1, 2.5, 5, 7.5, 10,
+		),
+	)
 	if err != nil {
 		otel.Handle(err)
 	}
@@ -211,7 +185,7 @@ func NewClientHandler(opts ...Option) stats.Handler {
 // TagRPC can attach some information to the given context.
 func (h *clientHandler) TagRPC(ctx context.Context, info *stats.RPCTagInfo) context.Context {
 	name, attrs := internal.ParseFullMethod(info.FullMethodName)
-	attrs = append(attrs, semconv.RPCSystemGRPC)
+	attrs = append(attrs, semconv.RPCSystemNameGRPC)
 
 	record := true
 	if h.Filter != nil {
@@ -219,11 +193,14 @@ func (h *clientHandler) TagRPC(ctx context.Context, info *stats.RPCTagInfo) cont
 	}
 
 	if record {
+		// Make a new slice to avoid aliasing into the same attrs slice used by metrics.
+		spanAttributes := make([]attribute.KeyValue, 0, len(attrs)+len(h.SpanAttributes))
+		spanAttributes = append(append(spanAttributes, attrs...), h.SpanAttributes...)
 		ctx, _ = h.tracer.Start(
 			ctx,
 			name,
-			trace.WithSpanKind(trace.SpanKindClient),
-			trace.WithAttributes(append(attrs, h.SpanAttributes...)...),
+			trace.WithSpanKind(h.SpanKind),
+			trace.WithAttributes(spanAttributes...),
 		)
 	}
 
@@ -232,6 +209,11 @@ func (h *clientHandler) TagRPC(ctx context.Context, info *stats.RPCTagInfo) cont
 		record:      record,
 	}
 
+	if h.MetricAttributesFn != nil {
+		extraAttrs := h.MetricAttributesFn(ctx)
+		gctx.metricAttrs = append(gctx.metricAttrs, extraAttrs...)
+	}
+
 	return inject(context.WithValue(ctx, gRPCContextKey{}, &gctx), h.Propagators)
 }
 
@@ -241,10 +223,6 @@ func (h *clientHandler) HandleRPC(ctx context.Context, rs stats.RPCStats) {
 		ctx,
 		rs,
 		h.duration.Inst(),
-		h.inSize,
-		h.outSize,
-		h.inMsg.Inst(),
-		h.outMsg.Inst(),
 		func(s *status.Status) (codes.Code, string) {
 			return codes.Error, s.Message()
 		},
@@ -261,16 +239,10 @@ func (*clientHandler) HandleConn(context.Context, stats.ConnStats) {
 	// no-op
 }
 
-type int64Hist interface {
-	Record(context.Context, int64, ...attribute.KeyValue)
-}
-
-func (c *config) handleRPC(
+func (*config) handleRPC(
 	ctx context.Context,
 	rs stats.RPCStats,
 	duration metric.Float64Histogram,
-	inSize, outSize int64Hist,
-	inMsg, outMsg metric.Int64Histogram,
 	recordStatus func(*status.Status) (codes.Code, string),
 ) {
 	gctx, _ := ctx.Value(gRPCContextKey{}).(*gRPCContext)
@@ -279,42 +251,11 @@ func (c *config) handleRPC(
 	}
 
 	span := trace.SpanFromContext(ctx)
-	var messageId int64
 
 	switch rs := rs.(type) {
 	case *stats.Begin:
 	case *stats.InPayload:
-		if gctx != nil {
-			messageId = atomic.AddInt64(&gctx.inMessages, 1)
-			inSize.Record(ctx, int64(rs.Length), gctx.metricAttrs...)
-		}
-
-		if c.ReceivedEvent && span.IsRecording() {
-			span.AddEvent("message",
-				trace.WithAttributes(
-					semconv.RPCMessageTypeReceived,
-					semconv.RPCMessageIDKey.Int64(messageId),
-					semconv.RPCMessageCompressedSizeKey.Int(rs.CompressedLength),
-					semconv.RPCMessageUncompressedSizeKey.Int(rs.Length),
-				),
-			)
-		}
 	case *stats.OutPayload:
-		if gctx != nil {
-			messageId = atomic.AddInt64(&gctx.outMessages, 1)
-			outSize.Record(ctx, int64(rs.Length), gctx.metricAttrs...)
-		}
-
-		if c.SentEvent && span.IsRecording() {
-			span.AddEvent("message",
-				trace.WithAttributes(
-					semconv.RPCMessageTypeSent,
-					semconv.RPCMessageIDKey.Int64(messageId),
-					semconv.RPCMessageCompressedSizeKey.Int(rs.CompressedLength),
-					semconv.RPCMessageUncompressedSizeKey.Int(rs.Length),
-				),
-			)
-		}
 	case *stats.OutTrailer:
 	case *stats.OutHeader:
 		if span.IsRecording() {
@@ -328,9 +269,9 @@ func (c *config) handleRPC(
 		var s *status.Status
 		if rs.Error != nil {
 			s, _ = status.FromError(rs.Error)
-			rpcStatusAttr = semconv.RPCGRPCStatusCodeKey.Int(int(s.Code()))
+			rpcStatusAttr = semconv.RPCResponseStatusCode(canonicalString(s.Code()))
 		} else {
-			rpcStatusAttr = semconv.RPCGRPCStatusCodeKey.Int(int(grpc_codes.OK))
+			rpcStatusAttr = semconv.RPCResponseStatusCode(canonicalString(grpc_codes.OK))
 		}
 		if span.IsRecording() {
 			if s != nil {
@@ -343,6 +284,9 @@ func (c *config) handleRPC(
 
 		var metricAttrs []attribute.KeyValue
 		if gctx != nil {
+			// Don't use gctx.metricAttrSet here, because it requires passing
+			// multiple RecordOptions, which would call metric.mergeSets and
+			// allocate a new set for each Record call.
 			metricAttrs = make([]attribute.KeyValue, 0, len(gctx.metricAttrs)+1)
 			metricAttrs = append(metricAttrs, gctx.metricAttrs...)
 		}
@@ -352,14 +296,51 @@ func (c *config) handleRPC(
 
 		// Use floating point division here for higher precision (instead of Millisecond method).
 		// Measure right before calling Record() to capture as much elapsed time as possible.
-		elapsedTime := float64(rs.EndTime.Sub(rs.BeginTime)) / float64(time.Millisecond)
+		elapsedTime := float64(rs.EndTime.Sub(rs.BeginTime)) / float64(time.Second)
 
 		duration.Record(ctx, elapsedTime, recordOpts...)
-		if gctx != nil {
-			inMsg.Record(ctx, atomic.LoadInt64(&gctx.inMessages), recordOpts...)
-			outMsg.Record(ctx, atomic.LoadInt64(&gctx.outMessages), recordOpts...)
-		}
 	default:
 		return
 	}
 }
+
+func canonicalString(code grpc_codes.Code) string {
+	switch code {
+	case grpc_codes.OK:
+		return "OK"
+	case grpc_codes.Canceled:
+		return "CANCELLED"
+	case grpc_codes.Unknown:
+		return "UNKNOWN"
+	case grpc_codes.InvalidArgument:
+		return "INVALID_ARGUMENT"
+	case grpc_codes.DeadlineExceeded:
+		return "DEADLINE_EXCEEDED"
+	case grpc_codes.NotFound:
+		return "NOT_FOUND"
+	case grpc_codes.AlreadyExists:
+		return "ALREADY_EXISTS"
+	case grpc_codes.PermissionDenied:
+		return "PERMISSION_DENIED"
+	case grpc_codes.ResourceExhausted:
+		return "RESOURCE_EXHAUSTED"
+	case grpc_codes.FailedPrecondition:
+		return "FAILED_PRECONDITION"
+	case grpc_codes.Aborted:
+		return "ABORTED"
+	case grpc_codes.OutOfRange:
+		return "OUT_OF_RANGE"
+	case grpc_codes.Unimplemented:
+		return "UNIMPLEMENTED"
+	case grpc_codes.Internal:
+		return "INTERNAL"
+	case grpc_codes.Unavailable:
+		return "UNAVAILABLE"
+	case grpc_codes.DataLoss:
+		return "DATA_LOSS"
+	case grpc_codes.Unauthenticated:
+		return "UNAUTHENTICATED"
+	default:
+		return "CODE(" + strconv.FormatInt(int64(code), 10) + ")"
+	}
+}
diff --git a/vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/version.go b/vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/version.go
index aa4f4e2129..535e63a07b 100644
--- a/vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/version.go
+++ b/vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/version.go
@@ -4,7 +4,4 @@
 package otelgrpc // import "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc"
 
 // Version is the current release version of the gRPC instrumentation.
-func Version() string {
-	return "0.63.0"
-	// This string is updated by the pre_release.sh script during release
-}
+const Version = "0.67.0"
diff --git a/vendor/go.opentelemetry.io/otel/semconv/v1.37.0/rpcconv/metric.go b/vendor/go.opentelemetry.io/otel/semconv/v1.37.0/rpcconv/metric.go
deleted file mode 100644
index 089b0c457f..0000000000
--- a/vendor/go.opentelemetry.io/otel/semconv/v1.37.0/rpcconv/metric.go
+++ /dev/null
@@ -1,1010 +0,0 @@
-// Code generated from semantic convention specification. DO NOT EDIT.
-
-// Copyright The OpenTelemetry Authors
-// SPDX-License-Identifier: Apache-2.0
-
-// Package rpcconv provides types and functionality for OpenTelemetry semantic
-// conventions in the "rpc" namespace.
-package rpcconv
-
-import (
-	"context"
-	"sync"
-
-	"go.opentelemetry.io/otel/attribute"
-	"go.opentelemetry.io/otel/metric"
-	"go.opentelemetry.io/otel/metric/noop"
-)
-
-var (
-	addOptPool = &sync.Pool{New: func() any { return &[]metric.AddOption{} }}
-	recOptPool = &sync.Pool{New: func() any { return &[]metric.RecordOption{} }}
-)
-
-// ClientDuration is an instrument used to record metric values conforming to the
-// "rpc.client.duration" semantic conventions. It represents the measures the
-// duration of outbound RPC.
-type ClientDuration struct {
-	metric.Float64Histogram
-}
-
-var newClientDurationOpts = []metric.Float64HistogramOption{
-	metric.WithDescription("Measures the duration of outbound RPC."),
-	metric.WithUnit("ms"),
-}
-
-// NewClientDuration returns a new ClientDuration instrument.
-func NewClientDuration(
-	m metric.Meter,
-	opt ...metric.Float64HistogramOption,
-) (ClientDuration, error) {
-	// Check if the meter is nil.
-	if m == nil {
-		return ClientDuration{noop.Float64Histogram{}}, nil
-	}
-
-	if len(opt) == 0 {
-		opt = newClientDurationOpts
-	} else {
-		opt = append(opt, newClientDurationOpts...)
-	}
-
-	i, err := m.Float64Histogram(
-		"rpc.client.duration",
-		opt...,
-	)
-	if err != nil {
-		return ClientDuration{noop.Float64Histogram{}}, err
-	}
-	return ClientDuration{i}, nil
-}
-
-// Inst returns the underlying metric instrument.
-func (m ClientDuration) Inst() metric.Float64Histogram {
-	return m.Float64Histogram
-}
-
-// Name returns the semantic convention name of the instrument.
-func (ClientDuration) Name() string {
-	return "rpc.client.duration"
-}
-
-// Unit returns the semantic convention unit of the instrument
-func (ClientDuration) Unit() string {
-	return "ms"
-}
-
-// Description returns the semantic convention description of the instrument
-func (ClientDuration) Description() string {
-	return "Measures the duration of outbound RPC."
-}
-
-// Record records val to the current distribution for attrs.
-//
-// While streaming RPCs may record this metric as start-of-batch
-// to end-of-batch, it's hard to interpret in practice.
-//
-// **Streaming**: N/A.
-func (m ClientDuration) Record(ctx context.Context, val float64, attrs ...attribute.KeyValue) {
-	if len(attrs) == 0 {
-		m.Float64Histogram.Record(ctx, val)
-		return
-	}
-
-	o := recOptPool.Get().(*[]metric.RecordOption)
-	defer func() {
-		*o = (*o)[:0]
-		recOptPool.Put(o)
-	}()
-
-	*o = append(*o, metric.WithAttributes(attrs...))
-	m.Float64Histogram.Record(ctx, val, *o...)
-}
-
-// RecordSet records val to the current distribution for set.
-//
-// While streaming RPCs may record this metric as start-of-batch
-// to end-of-batch, it's hard to interpret in practice.
-//
-// **Streaming**: N/A.
-func (m ClientDuration) RecordSet(ctx context.Context, val float64, set attribute.Set) {
-	if set.Len() == 0 {
-		m.Float64Histogram.Record(ctx, val)
-		return
-	}
-
-	o := recOptPool.Get().(*[]metric.RecordOption)
-	defer func() {
-		*o = (*o)[:0]
-		recOptPool.Put(o)
-	}()
-
-	*o = append(*o, metric.WithAttributeSet(set))
-	m.Float64Histogram.Record(ctx, val, *o...)
-}
-
-// ClientRequestSize is an instrument used to record metric values conforming to
-// the "rpc.client.request.size" semantic conventions. It represents the measures
-// the size of RPC request messages (uncompressed).
-type ClientRequestSize struct {
-	metric.Int64Histogram
-}
-
-var newClientRequestSizeOpts = []metric.Int64HistogramOption{
-	metric.WithDescription("Measures the size of RPC request messages (uncompressed)."),
-	metric.WithUnit("By"),
-}
-
-// NewClientRequestSize returns a new ClientRequestSize instrument.
-func NewClientRequestSize(
-	m metric.Meter,
-	opt ...metric.Int64HistogramOption,
-) (ClientRequestSize, error) {
-	// Check if the meter is nil.
-	if m == nil {
-		return ClientRequestSize{noop.Int64Histogram{}}, nil
-	}
-
-	if len(opt) == 0 {
-		opt = newClientRequestSizeOpts
-	} else {
-		opt = append(opt, newClientRequestSizeOpts...)
-	}
-
-	i, err := m.Int64Histogram(
-		"rpc.client.request.size",
-		opt...,
-	)
-	if err != nil {
-		return ClientRequestSize{noop.Int64Histogram{}}, err
-	}
-	return ClientRequestSize{i}, nil
-}
-
-// Inst returns the underlying metric instrument.
-func (m ClientRequestSize) Inst() metric.Int64Histogram {
-	return m.Int64Histogram
-}
-
-// Name returns the semantic convention name of the instrument.
-func (ClientRequestSize) Name() string {
-	return "rpc.client.request.size"
-}
-
-// Unit returns the semantic convention unit of the instrument
-func (ClientRequestSize) Unit() string {
-	return "By"
-}
-
-// Description returns the semantic convention description of the instrument
-func (ClientRequestSize) Description() string {
-	return "Measures the size of RPC request messages (uncompressed)."
-}
-
-// Record records val to the current distribution for attrs.
-//
-// **Streaming**: Recorded per message in a streaming batch
-func (m ClientRequestSize) Record(ctx context.Context, val int64, attrs ...attribute.KeyValue) {
-	if len(attrs) == 0 {
-		m.Int64Histogram.Record(ctx, val)
-		return
-	}
-
-	o := recOptPool.Get().(*[]metric.RecordOption)
-	defer func() {
-		*o = (*o)[:0]
-		recOptPool.Put(o)
-	}()
-
-	*o = append(*o, metric.WithAttributes(attrs...))
-	m.Int64Histogram.Record(ctx, val, *o...)
-}
-
-// RecordSet records val to the current distribution for set.
-//
-// **Streaming**: Recorded per message in a streaming batch
-func (m ClientRequestSize) RecordSet(ctx context.Context, val int64, set attribute.Set) {
-	if set.Len() == 0 {
-		m.Int64Histogram.Record(ctx, val)
-		return
-	}
-
-	o := recOptPool.Get().(*[]metric.RecordOption)
-	defer func() {
-		*o = (*o)[:0]
-		recOptPool.Put(o)
-	}()
-
-	*o = append(*o, metric.WithAttributeSet(set))
-	m.Int64Histogram.Record(ctx, val, *o...)
-}
-
-// ClientRequestsPerRPC is an instrument used to record metric values conforming
-// to the "rpc.client.requests_per_rpc" semantic conventions. It represents the
-// measures the number of messages received per RPC.
-type ClientRequestsPerRPC struct {
-	metric.Int64Histogram
-}
-
-var newClientRequestsPerRPCOpts = []metric.Int64HistogramOption{
-	metric.WithDescription("Measures the number of messages received per RPC."),
-	metric.WithUnit("{count}"),
-}
-
-// NewClientRequestsPerRPC returns a new ClientRequestsPerRPC instrument.
-func NewClientRequestsPerRPC(
-	m metric.Meter,
-	opt ...metric.Int64HistogramOption,
-) (ClientRequestsPerRPC, error) {
-	// Check if the meter is nil.
-	if m == nil {
-		return ClientRequestsPerRPC{noop.Int64Histogram{}}, nil
-	}
-
-	if len(opt) == 0 {
-		opt = newClientRequestsPerRPCOpts
-	} else {
-		opt = append(opt, newClientRequestsPerRPCOpts...)
-	}
-
-	i, err := m.Int64Histogram(
-		"rpc.client.requests_per_rpc",
-		opt...,
-	)
-	if err != nil {
-		return ClientRequestsPerRPC{noop.Int64Histogram{}}, err
-	}
-	return ClientRequestsPerRPC{i}, nil
-}
-
-// Inst returns the underlying metric instrument.
-func (m ClientRequestsPerRPC) Inst() metric.Int64Histogram {
-	return m.Int64Histogram
-}
-
-// Name returns the semantic convention name of the instrument.
-func (ClientRequestsPerRPC) Name() string {
-	return "rpc.client.requests_per_rpc"
-}
-
-// Unit returns the semantic convention unit of the instrument
-func (ClientRequestsPerRPC) Unit() string {
-	return "{count}"
-}
-
-// Description returns the semantic convention description of the instrument
-func (ClientRequestsPerRPC) Description() string {
-	return "Measures the number of messages received per RPC."
-}
-
-// Record records val to the current distribution for attrs.
-//
-// Should be 1 for all non-streaming RPCs.
-//
-// **Streaming**: This metric is required for server and client streaming RPCs
-func (m ClientRequestsPerRPC) Record(ctx context.Context, val int64, attrs ...attribute.KeyValue) {
-	if len(attrs) == 0 {
-		m.Int64Histogram.Record(ctx, val)
-		return
-	}
-
-	o := recOptPool.Get().(*[]metric.RecordOption)
-	defer func() {
-		*o = (*o)[:0]
-		recOptPool.Put(o)
-	}()
-
-	*o = append(*o, metric.WithAttributes(attrs...))
-	m.Int64Histogram.Record(ctx, val, *o...)
-}
-
-// RecordSet records val to the current distribution for set.
-//
-// Should be 1 for all non-streaming RPCs.
-//
-// **Streaming**: This metric is required for server and client streaming RPCs
-func (m ClientRequestsPerRPC) RecordSet(ctx context.Context, val int64, set attribute.Set) {
-	if set.Len() == 0 {
-		m.Int64Histogram.Record(ctx, val)
-		return
-	}
-
-	o := recOptPool.Get().(*[]metric.RecordOption)
-	defer func() {
-		*o = (*o)[:0]
-		recOptPool.Put(o)
-	}()
-
-	*o = append(*o, metric.WithAttributeSet(set))
-	m.Int64Histogram.Record(ctx, val, *o...)
-}
-
-// ClientResponseSize is an instrument used to record metric values conforming to
-// the "rpc.client.response.size" semantic conventions. It represents the
-// measures the size of RPC response messages (uncompressed).
-type ClientResponseSize struct {
-	metric.Int64Histogram
-}
-
-var newClientResponseSizeOpts = []metric.Int64HistogramOption{
-	metric.WithDescription("Measures the size of RPC response messages (uncompressed)."),
-	metric.WithUnit("By"),
-}
-
-// NewClientResponseSize returns a new ClientResponseSize instrument.
-func NewClientResponseSize(
-	m metric.Meter,
-	opt ...metric.Int64HistogramOption,
-) (ClientResponseSize, error) {
-	// Check if the meter is nil.
-	if m == nil {
-		return ClientResponseSize{noop.Int64Histogram{}}, nil
-	}
-
-	if len(opt) == 0 {
-		opt = newClientResponseSizeOpts
-	} else {
-		opt = append(opt, newClientResponseSizeOpts...)
-	}
-
-	i, err := m.Int64Histogram(
-		"rpc.client.response.size",
-		opt...,
-	)
-	if err != nil {
-		return ClientResponseSize{noop.Int64Histogram{}}, err
-	}
-	return ClientResponseSize{i}, nil
-}
-
-// Inst returns the underlying metric instrument.
-func (m ClientResponseSize) Inst() metric.Int64Histogram {
-	return m.Int64Histogram
-}
-
-// Name returns the semantic convention name of the instrument.
-func (ClientResponseSize) Name() string {
-	return "rpc.client.response.size"
-}
-
-// Unit returns the semantic convention unit of the instrument
-func (ClientResponseSize) Unit() string {
-	return "By"
-}
-
-// Description returns the semantic convention description of the instrument
-func (ClientResponseSize) Description() string {
-	return "Measures the size of RPC response messages (uncompressed)."
-}
-
-// Record records val to the current distribution for attrs.
-//
-// **Streaming**: Recorded per response in a streaming batch
-func (m ClientResponseSize) Record(ctx context.Context, val int64, attrs ...attribute.KeyValue) {
-	if len(attrs) == 0 {
-		m.Int64Histogram.Record(ctx, val)
-		return
-	}
-
-	o := recOptPool.Get().(*[]metric.RecordOption)
-	defer func() {
-		*o = (*o)[:0]
-		recOptPool.Put(o)
-	}()
-
-	*o = append(*o, metric.WithAttributes(attrs...))
-	m.Int64Histogram.Record(ctx, val, *o...)
-}
-
-// RecordSet records val to the current distribution for set.
-//
-// **Streaming**: Recorded per response in a streaming batch
-func (m ClientResponseSize) RecordSet(ctx context.Context, val int64, set attribute.Set) {
-	if set.Len() == 0 {
-		m.Int64Histogram.Record(ctx, val)
-		return
-	}
-
-	o := recOptPool.Get().(*[]metric.RecordOption)
-	defer func() {
-		*o = (*o)[:0]
-		recOptPool.Put(o)
-	}()
-
-	*o = append(*o, metric.WithAttributeSet(set))
-	m.Int64Histogram.Record(ctx, val, *o...)
-}
-
-// ClientResponsesPerRPC is an instrument used to record metric values conforming
-// to the "rpc.client.responses_per_rpc" semantic conventions. It represents the
-// measures the number of messages sent per RPC.
-type ClientResponsesPerRPC struct {
-	metric.Int64Histogram
-}
-
-var newClientResponsesPerRPCOpts = []metric.Int64HistogramOption{
-	metric.WithDescription("Measures the number of messages sent per RPC."),
-	metric.WithUnit("{count}"),
-}
-
-// NewClientResponsesPerRPC returns a new ClientResponsesPerRPC instrument.
-func NewClientResponsesPerRPC(
-	m metric.Meter,
-	opt ...metric.Int64HistogramOption,
-) (ClientResponsesPerRPC, error) {
-	// Check if the meter is nil.
-	if m == nil {
-		return ClientResponsesPerRPC{noop.Int64Histogram{}}, nil
-	}
-
-	if len(opt) == 0 {
-		opt = newClientResponsesPerRPCOpts
-	} else {
-		opt = append(opt, newClientResponsesPerRPCOpts...)
-	}
-
-	i, err := m.Int64Histogram(
-		"rpc.client.responses_per_rpc",
-		opt...,
-	)
-	if err != nil {
-		return ClientResponsesPerRPC{noop.Int64Histogram{}}, err
-	}
-	return ClientResponsesPerRPC{i}, nil
-}
-
-// Inst returns the underlying metric instrument.
-func (m ClientResponsesPerRPC) Inst() metric.Int64Histogram {
-	return m.Int64Histogram
-}
-
-// Name returns the semantic convention name of the instrument.
-func (ClientResponsesPerRPC) Name() string {
-	return "rpc.client.responses_per_rpc"
-}
-
-// Unit returns the semantic convention unit of the instrument
-func (ClientResponsesPerRPC) Unit() string {
-	return "{count}"
-}
-
-// Description returns the semantic convention description of the instrument
-func (ClientResponsesPerRPC) Description() string {
-	return "Measures the number of messages sent per RPC."
-}
-
-// Record records val to the current distribution for attrs.
-//
-// Should be 1 for all non-streaming RPCs.
-//
-// **Streaming**: This metric is required for server and client streaming RPCs
-func (m ClientResponsesPerRPC) Record(ctx context.Context, val int64, attrs ...attribute.KeyValue) {
-	if len(attrs) == 0 {
-		m.Int64Histogram.Record(ctx, val)
-		return
-	}
-
-	o := recOptPool.Get().(*[]metric.RecordOption)
-	defer func() {
-		*o = (*o)[:0]
-		recOptPool.Put(o)
-	}()
-
-	*o = append(*o, metric.WithAttributes(attrs...))
-	m.Int64Histogram.Record(ctx, val, *o...)
-}
-
-// RecordSet records val to the current distribution for set.
-//
-// Should be 1 for all non-streaming RPCs.
-//
-// **Streaming**: This metric is required for server and client streaming RPCs
-func (m ClientResponsesPerRPC) RecordSet(ctx context.Context, val int64, set attribute.Set) {
-	if set.Len() == 0 {
-		m.Int64Histogram.Record(ctx, val)
-		return
-	}
-
-	o := recOptPool.Get().(*[]metric.RecordOption)
-	defer func() {
-		*o = (*o)[:0]
-		recOptPool.Put(o)
-	}()
-
-	*o = append(*o, metric.WithAttributeSet(set))
-	m.Int64Histogram.Record(ctx, val, *o...)
-}
-
-// ServerDuration is an instrument used to record metric values conforming to the
-// "rpc.server.duration" semantic conventions. It represents the measures the
-// duration of inbound RPC.
-type ServerDuration struct {
-	metric.Float64Histogram
-}
-
-var newServerDurationOpts = []metric.Float64HistogramOption{
-	metric.WithDescription("Measures the duration of inbound RPC."),
-	metric.WithUnit("ms"),
-}
-
-// NewServerDuration returns a new ServerDuration instrument.
-func NewServerDuration(
-	m metric.Meter,
-	opt ...metric.Float64HistogramOption,
-) (ServerDuration, error) {
-	// Check if the meter is nil.
-	if m == nil {
-		return ServerDuration{noop.Float64Histogram{}}, nil
-	}
-
-	if len(opt) == 0 {
-		opt = newServerDurationOpts
-	} else {
-		opt = append(opt, newServerDurationOpts...)
-	}
-
-	i, err := m.Float64Histogram(
-		"rpc.server.duration",
-		opt...,
-	)
-	if err != nil {
-		return ServerDuration{noop.Float64Histogram{}}, err
-	}
-	return ServerDuration{i}, nil
-}
-
-// Inst returns the underlying metric instrument.
-func (m ServerDuration) Inst() metric.Float64Histogram {
-	return m.Float64Histogram
-}
-
-// Name returns the semantic convention name of the instrument.
-func (ServerDuration) Name() string {
-	return "rpc.server.duration"
-}
-
-// Unit returns the semantic convention unit of the instrument
-func (ServerDuration) Unit() string {
-	return "ms"
-}
-
-// Description returns the semantic convention description of the instrument
-func (ServerDuration) Description() string {
-	return "Measures the duration of inbound RPC."
-}
-
-// Record records val to the current distribution for attrs.
-//
-// While streaming RPCs may record this metric as start-of-batch
-// to end-of-batch, it's hard to interpret in practice.
-//
-// **Streaming**: N/A.
-func (m ServerDuration) Record(ctx context.Context, val float64, attrs ...attribute.KeyValue) {
-	if len(attrs) == 0 {
-		m.Float64Histogram.Record(ctx, val)
-		return
-	}
-
-	o := recOptPool.Get().(*[]metric.RecordOption)
-	defer func() {
-		*o = (*o)[:0]
-		recOptPool.Put(o)
-	}()
-
-	*o = append(*o, metric.WithAttributes(attrs...))
-	m.Float64Histogram.Record(ctx, val, *o...)
-}
-
-// RecordSet records val to the current distribution for set.
-//
-// While streaming RPCs may record this metric as start-of-batch
-// to end-of-batch, it's hard to interpret in practice.
-//
-// **Streaming**: N/A.
-func (m ServerDuration) RecordSet(ctx context.Context, val float64, set attribute.Set) {
-	if set.Len() == 0 {
-		m.Float64Histogram.Record(ctx, val)
-		return
-	}
-
-	o := recOptPool.Get().(*[]metric.RecordOption)
-	defer func() {
-		*o = (*o)[:0]
-		recOptPool.Put(o)
-	}()
-
-	*o = append(*o, metric.WithAttributeSet(set))
-	m.Float64Histogram.Record(ctx, val, *o...)
-}
-
-// ServerRequestSize is an instrument used to record metric values conforming to
-// the "rpc.server.request.size" semantic conventions. It represents the measures
-// the size of RPC request messages (uncompressed).
-type ServerRequestSize struct {
-	metric.Int64Histogram
-}
-
-var newServerRequestSizeOpts = []metric.Int64HistogramOption{
-	metric.WithDescription("Measures the size of RPC request messages (uncompressed)."),
-	metric.WithUnit("By"),
-}
-
-// NewServerRequestSize returns a new ServerRequestSize instrument.
-func NewServerRequestSize(
-	m metric.Meter,
-	opt ...metric.Int64HistogramOption,
-) (ServerRequestSize, error) {
-	// Check if the meter is nil.
-	if m == nil {
-		return ServerRequestSize{noop.Int64Histogram{}}, nil
-	}
-
-	if len(opt) == 0 {
-		opt = newServerRequestSizeOpts
-	} else {
-		opt = append(opt, newServerRequestSizeOpts...)
-	}
-
-	i, err := m.Int64Histogram(
-		"rpc.server.request.size",
-		opt...,
-	)
-	if err != nil {
-		return ServerRequestSize{noop.Int64Histogram{}}, err
-	}
-	return ServerRequestSize{i}, nil
-}
-
-// Inst returns the underlying metric instrument.
-func (m ServerRequestSize) Inst() metric.Int64Histogram {
-	return m.Int64Histogram
-}
-
-// Name returns the semantic convention name of the instrument.
-func (ServerRequestSize) Name() string {
-	return "rpc.server.request.size"
-}
-
-// Unit returns the semantic convention unit of the instrument
-func (ServerRequestSize) Unit() string {
-	return "By"
-}
-
-// Description returns the semantic convention description of the instrument
-func (ServerRequestSize) Description() string {
-	return "Measures the size of RPC request messages (uncompressed)."
-}
-
-// Record records val to the current distribution for attrs.
-//
-// **Streaming**: Recorded per message in a streaming batch
-func (m ServerRequestSize) Record(ctx context.Context, val int64, attrs ...attribute.KeyValue) {
-	if len(attrs) == 0 {
-		m.Int64Histogram.Record(ctx, val)
-		return
-	}
-
-	o := recOptPool.Get().(*[]metric.RecordOption)
-	defer func() {
-		*o = (*o)[:0]
-		recOptPool.Put(o)
-	}()
-
-	*o = append(*o, metric.WithAttributes(attrs...))
-	m.Int64Histogram.Record(ctx, val, *o...)
-}
-
-// RecordSet records val to the current distribution for set.
-//
-// **Streaming**: Recorded per message in a streaming batch
-func (m ServerRequestSize) RecordSet(ctx context.Context, val int64, set attribute.Set) {
-	if set.Len() == 0 {
-		m.Int64Histogram.Record(ctx, val)
-		return
-	}
-
-	o := recOptPool.Get().(*[]metric.RecordOption)
-	defer func() {
-		*o = (*o)[:0]
-		recOptPool.Put(o)
-	}()
-
-	*o = append(*o, metric.WithAttributeSet(set))
-	m.Int64Histogram.Record(ctx, val, *o...)
-}
-
-// ServerRequestsPerRPC is an instrument used to record metric values conforming
-// to the "rpc.server.requests_per_rpc" semantic conventions. It represents the
-// measures the number of messages received per RPC.
-type ServerRequestsPerRPC struct {
-	metric.Int64Histogram
-}
-
-var newServerRequestsPerRPCOpts = []metric.Int64HistogramOption{
-	metric.WithDescription("Measures the number of messages received per RPC."),
-	metric.WithUnit("{count}"),
-}
-
-// NewServerRequestsPerRPC returns a new ServerRequestsPerRPC instrument.
-func NewServerRequestsPerRPC(
-	m metric.Meter,
-	opt ...metric.Int64HistogramOption,
-) (ServerRequestsPerRPC, error) {
-	// Check if the meter is nil.
-	if m == nil {
-		return ServerRequestsPerRPC{noop.Int64Histogram{}}, nil
-	}
-
-	if len(opt) == 0 {
-		opt = newServerRequestsPerRPCOpts
-	} else {
-		opt = append(opt, newServerRequestsPerRPCOpts...)
-	}
-
-	i, err := m.Int64Histogram(
-		"rpc.server.requests_per_rpc",
-		opt...,
-	)
-	if err != nil {
-		return ServerRequestsPerRPC{noop.Int64Histogram{}}, err
-	}
-	return ServerRequestsPerRPC{i}, nil
-}
-
-// Inst returns the underlying metric instrument.
-func (m ServerRequestsPerRPC) Inst() metric.Int64Histogram {
-	return m.Int64Histogram
-}
-
-// Name returns the semantic convention name of the instrument.
-func (ServerRequestsPerRPC) Name() string {
-	return "rpc.server.requests_per_rpc"
-}
-
-// Unit returns the semantic convention unit of the instrument
-func (ServerRequestsPerRPC) Unit() string {
-	return "{count}"
-}
-
-// Description returns the semantic convention description of the instrument
-func (ServerRequestsPerRPC) Description() string {
-	return "Measures the number of messages received per RPC."
-}
-
-// Record records val to the current distribution for attrs.
-//
-// Should be 1 for all non-streaming RPCs.
-//
-// **Streaming** : This metric is required for server and client streaming RPCs
-func (m ServerRequestsPerRPC) Record(ctx context.Context, val int64, attrs ...attribute.KeyValue) {
-	if len(attrs) == 0 {
-		m.Int64Histogram.Record(ctx, val)
-		return
-	}
-
-	o := recOptPool.Get().(*[]metric.RecordOption)
-	defer func() {
-		*o = (*o)[:0]
-		recOptPool.Put(o)
-	}()
-
-	*o = append(*o, metric.WithAttributes(attrs...))
-	m.Int64Histogram.Record(ctx, val, *o...)
-}
-
-// RecordSet records val to the current distribution for set.
-//
-// Should be 1 for all non-streaming RPCs.
-//
-// **Streaming** : This metric is required for server and client streaming RPCs
-func (m ServerRequestsPerRPC) RecordSet(ctx context.Context, val int64, set attribute.Set) {
-	if set.Len() == 0 {
-		m.Int64Histogram.Record(ctx, val)
-		return
-	}
-
-	o := recOptPool.Get().(*[]metric.RecordOption)
-	defer func() {
-		*o = (*o)[:0]
-		recOptPool.Put(o)
-	}()
-
-	*o = append(*o, metric.WithAttributeSet(set))
-	m.Int64Histogram.Record(ctx, val, *o...)
-}
-
-// ServerResponseSize is an instrument used to record metric values conforming to
-// the "rpc.server.response.size" semantic conventions. It represents the
-// measures the size of RPC response messages (uncompressed).
-type ServerResponseSize struct {
-	metric.Int64Histogram
-}
-
-var newServerResponseSizeOpts = []metric.Int64HistogramOption{
-	metric.WithDescription("Measures the size of RPC response messages (uncompressed)."),
-	metric.WithUnit("By"),
-}
-
-// NewServerResponseSize returns a new ServerResponseSize instrument.
-func NewServerResponseSize(
-	m metric.Meter,
-	opt ...metric.Int64HistogramOption,
-) (ServerResponseSize, error) {
-	// Check if the meter is nil.
-	if m == nil {
-		return ServerResponseSize{noop.Int64Histogram{}}, nil
-	}
-
-	if len(opt) == 0 {
-		opt = newServerResponseSizeOpts
-	} else {
-		opt = append(opt, newServerResponseSizeOpts...)
-	}
-
-	i, err := m.Int64Histogram(
-		"rpc.server.response.size",
-		opt...,
-	)
-	if err != nil {
-		return ServerResponseSize{noop.Int64Histogram{}}, err
-	}
-	return ServerResponseSize{i}, nil
-}
-
-// Inst returns the underlying metric instrument.
-func (m ServerResponseSize) Inst() metric.Int64Histogram {
-	return m.Int64Histogram
-}
-
-// Name returns the semantic convention name of the instrument.
-func (ServerResponseSize) Name() string {
-	return "rpc.server.response.size"
-}
-
-// Unit returns the semantic convention unit of the instrument
-func (ServerResponseSize) Unit() string {
-	return "By"
-}
-
-// Description returns the semantic convention description of the instrument
-func (ServerResponseSize) Description() string {
-	return "Measures the size of RPC response messages (uncompressed)."
-}
-
-// Record records val to the current distribution for attrs.
-//
-// **Streaming**: Recorded per response in a streaming batch
-func (m ServerResponseSize) Record(ctx context.Context, val int64, attrs ...attribute.KeyValue) {
-	if len(attrs) == 0 {
-		m.Int64Histogram.Record(ctx, val)
-		return
-	}
-
-	o := recOptPool.Get().(*[]metric.RecordOption)
-	defer func() {
-		*o = (*o)[:0]
-		recOptPool.Put(o)
-	}()
-
-	*o = append(*o, metric.WithAttributes(attrs...))
-	m.Int64Histogram.Record(ctx, val, *o...)
-}
-
-// RecordSet records val to the current distribution for set.
-//
-// **Streaming**: Recorded per response in a streaming batch
-func (m ServerResponseSize) RecordSet(ctx context.Context, val int64, set attribute.Set) {
-	if set.Len() == 0 {
-		m.Int64Histogram.Record(ctx, val)
-		return
-	}
-
-	o := recOptPool.Get().(*[]metric.RecordOption)
-	defer func() {
-		*o = (*o)[:0]
-		recOptPool.Put(o)
-	}()
-
-	*o = append(*o, metric.WithAttributeSet(set))
-	m.Int64Histogram.Record(ctx, val, *o...)
-}
-
-// ServerResponsesPerRPC is an instrument used to record metric values conforming
-// to the "rpc.server.responses_per_rpc" semantic conventions. It represents the
-// measures the number of messages sent per RPC.
-type ServerResponsesPerRPC struct {
-	metric.Int64Histogram
-}
-
-var newServerResponsesPerRPCOpts = []metric.Int64HistogramOption{
-	metric.WithDescription("Measures the number of messages sent per RPC."),
-	metric.WithUnit("{count}"),
-}
-
-// NewServerResponsesPerRPC returns a new ServerResponsesPerRPC instrument.
-func NewServerResponsesPerRPC(
-	m metric.Meter,
-	opt ...metric.Int64HistogramOption,
-) (ServerResponsesPerRPC, error) {
-	// Check if the meter is nil.
-	if m == nil {
-		return ServerResponsesPerRPC{noop.Int64Histogram{}}, nil
-	}
-
-	if len(opt) == 0 {
-		opt = newServerResponsesPerRPCOpts
-	} else {
-		opt = append(opt, newServerResponsesPerRPCOpts...)
-	}
-
-	i, err := m.Int64Histogram(
-		"rpc.server.responses_per_rpc",
-		opt...,
-	)
-	if err != nil {
-		return ServerResponsesPerRPC{noop.Int64Histogram{}}, err
-	}
-	return ServerResponsesPerRPC{i}, nil
-}
-
-// Inst returns the underlying metric instrument.
-func (m ServerResponsesPerRPC) Inst() metric.Int64Histogram {
-	return m.Int64Histogram
-}
-
-// Name returns the semantic convention name of the instrument.
-func (ServerResponsesPerRPC) Name() string {
-	return "rpc.server.responses_per_rpc"
-}
-
-// Unit returns the semantic convention unit of the instrument
-func (ServerResponsesPerRPC) Unit() string {
-	return "{count}"
-}
-
-// Description returns the semantic convention description of the instrument
-func (ServerResponsesPerRPC) Description() string {
-	return "Measures the number of messages sent per RPC."
-}
-
-// Record records val to the current distribution for attrs.
-//
-// Should be 1 for all non-streaming RPCs.
-//
-// **Streaming**: This metric is required for server and client streaming RPCs
-func (m ServerResponsesPerRPC) Record(ctx context.Context, val int64, attrs ...attribute.KeyValue) {
-	if len(attrs) == 0 {
-		m.Int64Histogram.Record(ctx, val)
-		return
-	}
-
-	o := recOptPool.Get().(*[]metric.RecordOption)
-	defer func() {
-		*o = (*o)[:0]
-		recOptPool.Put(o)
-	}()
-
-	*o = append(*o, metric.WithAttributes(attrs...))
-	m.Int64Histogram.Record(ctx, val, *o...)
-}
-
-// RecordSet records val to the current distribution for set.
-//
-// Should be 1 for all non-streaming RPCs.
-//
-// **Streaming**: This metric is required for server and client streaming RPCs
-func (m ServerResponsesPerRPC) RecordSet(ctx context.Context, val int64, set attribute.Set) {
-	if set.Len() == 0 {
-		m.Int64Histogram.Record(ctx, val)
-		return
-	}
-
-	o := recOptPool.Get().(*[]metric.RecordOption)
-	defer func() {
-		*o = (*o)[:0]
-		recOptPool.Put(o)
-	}()
-
-	*o = append(*o, metric.WithAttributeSet(set))
-	m.Int64Histogram.Record(ctx, val, *o...)
-}
diff --git a/vendor/go.opentelemetry.io/otel/semconv/v1.40.0/rpcconv/metric.go b/vendor/go.opentelemetry.io/otel/semconv/v1.40.0/rpcconv/metric.go
new file mode 100644
index 0000000000..2086ffce5d
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/semconv/v1.40.0/rpcconv/metric.go
@@ -0,0 +1,360 @@
+// Code generated from semantic convention specification. DO NOT EDIT.
+
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+// Package rpcconv provides types and functionality for OpenTelemetry semantic
+// conventions in the "rpc" namespace.
+package rpcconv
+
+import (
+	"context"
+	"sync"
+
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/metric"
+	"go.opentelemetry.io/otel/metric/noop"
+)
+
+var (
+	addOptPool = &sync.Pool{New: func() any { return &[]metric.AddOption{} }}
+	recOptPool = &sync.Pool{New: func() any { return &[]metric.RecordOption{} }}
+)
+
+// ErrorTypeAttr is an attribute conforming to the error.type semantic
+// conventions. It represents the describes a class of error the operation ended
+// with.
+type ErrorTypeAttr string
+
+var (
+	// ErrorTypeOther is a fallback error value to be used when the instrumentation
+	// doesn't define a custom value.
+	ErrorTypeOther ErrorTypeAttr = "_OTHER"
+)
+
+// SystemNameAttr is an attribute conforming to the rpc.system.name semantic
+// conventions. It represents the Remote Procedure Call (RPC) system.
+type SystemNameAttr string
+
+var (
+	// SystemNameGRPC is the [gRPC].
+	//
+	// [gRPC]: https://grpc.io/
+	SystemNameGRPC SystemNameAttr = "grpc"
+	// SystemNameDubbo is the [Apache Dubbo].
+	//
+	// [Apache Dubbo]: https://dubbo.apache.org/
+	SystemNameDubbo SystemNameAttr = "dubbo"
+	// SystemNameConnectrpc is the [Connect RPC].
+	//
+	// [Connect RPC]: https://connectrpc.com/
+	SystemNameConnectrpc SystemNameAttr = "connectrpc"
+	// SystemNameJSONRPC is the [JSON-RPC].
+	//
+	// [JSON-RPC]: https://www.jsonrpc.org/
+	SystemNameJSONRPC SystemNameAttr = "jsonrpc"
+)
+
+// ClientCallDuration is an instrument used to record metric values conforming to
+// the "rpc.client.call.duration" semantic conventions. It represents the
+// measures the duration of an outgoing Remote Procedure Call (RPC).
+type ClientCallDuration struct {
+	metric.Float64Histogram
+}
+
+var newClientCallDurationOpts = []metric.Float64HistogramOption{
+	metric.WithDescription("Measures the duration of an outgoing Remote Procedure Call (RPC)."),
+	metric.WithUnit("s"),
+}
+
+// NewClientCallDuration returns a new ClientCallDuration instrument.
+func NewClientCallDuration(
+	m metric.Meter,
+	opt ...metric.Float64HistogramOption,
+) (ClientCallDuration, error) {
+	// Check if the meter is nil.
+	if m == nil {
+		return ClientCallDuration{noop.Float64Histogram{}}, nil
+	}
+
+	if len(opt) == 0 {
+		opt = newClientCallDurationOpts
+	} else {
+		opt = append(opt, newClientCallDurationOpts...)
+	}
+
+	i, err := m.Float64Histogram(
+		"rpc.client.call.duration",
+		opt...,
+	)
+	if err != nil {
+		return ClientCallDuration{noop.Float64Histogram{}}, err
+	}
+	return ClientCallDuration{i}, nil
+}
+
+// Inst returns the underlying metric instrument.
+func (m ClientCallDuration) Inst() metric.Float64Histogram {
+	return m.Float64Histogram
+}
+
+// Name returns the semantic convention name of the instrument.
+func (ClientCallDuration) Name() string {
+	return "rpc.client.call.duration"
+}
+
+// Unit returns the semantic convention unit of the instrument
+func (ClientCallDuration) Unit() string {
+	return "s"
+}
+
+// Description returns the semantic convention description of the instrument
+func (ClientCallDuration) Description() string {
+	return "Measures the duration of an outgoing Remote Procedure Call (RPC)."
+}
+
+// Record records val to the current distribution for attrs.
+//
+// The systemName is the the Remote Procedure Call (RPC) system.
+//
+// All additional attrs passed are included in the recorded value.
+//
+// When this metric is reported alongside an RPC client span, the metric value
+// SHOULD be the same as the RPC client span duration.
+func (m ClientCallDuration) Record(
+	ctx context.Context,
+	val float64,
+	systemName SystemNameAttr,
+	attrs ...attribute.KeyValue,
+) {
+	if len(attrs) == 0 {
+		m.Float64Histogram.Record(ctx, val, metric.WithAttributes(
+			attribute.String("rpc.system.name", string(systemName)),
+		))
+		return
+	}
+
+	o := recOptPool.Get().(*[]metric.RecordOption)
+	defer func() {
+		*o = (*o)[:0]
+		recOptPool.Put(o)
+	}()
+
+	*o = append(
+		*o,
+		metric.WithAttributes(
+			append(
+				attrs[:len(attrs):len(attrs)],
+				attribute.String("rpc.system.name", string(systemName)),
+			)...,
+		),
+	)
+
+	m.Float64Histogram.Record(ctx, val, *o...)
+}
+
+// RecordSet records val to the current distribution for set.
+//
+// When this metric is reported alongside an RPC client span, the metric value
+// SHOULD be the same as the RPC client span duration.
+func (m ClientCallDuration) RecordSet(ctx context.Context, val float64, set attribute.Set) {
+	if set.Len() == 0 {
+		m.Float64Histogram.Record(ctx, val)
+		return
+	}
+
+	o := recOptPool.Get().(*[]metric.RecordOption)
+	defer func() {
+		*o = (*o)[:0]
+		recOptPool.Put(o)
+	}()
+
+	*o = append(*o, metric.WithAttributeSet(set))
+	m.Float64Histogram.Record(ctx, val, *o...)
+}
+
+// AttrErrorType returns an optional attribute for the "error.type" semantic
+// convention. It represents the describes a class of error the operation ended
+// with.
+func (ClientCallDuration) AttrErrorType(val ErrorTypeAttr) attribute.KeyValue {
+	return attribute.String("error.type", string(val))
+}
+
+// AttrMethod returns an optional attribute for the "rpc.method" semantic
+// convention. It represents the fully-qualified logical name of the method from
+// the RPC interface perspective.
+func (ClientCallDuration) AttrMethod(val string) attribute.KeyValue {
+	return attribute.String("rpc.method", val)
+}
+
+// AttrResponseStatusCode returns an optional attribute for the
+// "rpc.response.status_code" semantic convention. It represents the status code
+// of the RPC returned by the RPC server or generated by the client.
+func (ClientCallDuration) AttrResponseStatusCode(val string) attribute.KeyValue {
+	return attribute.String("rpc.response.status_code", val)
+}
+
+// AttrServerAddress returns an optional attribute for the "server.address"
+// semantic convention. It represents a string identifying a group of RPC server
+// instances request is sent to.
+func (ClientCallDuration) AttrServerAddress(val string) attribute.KeyValue {
+	return attribute.String("server.address", val)
+}
+
+// AttrServerPort returns an optional attribute for the "server.port" semantic
+// convention. It represents the server port number.
+func (ClientCallDuration) AttrServerPort(val int) attribute.KeyValue {
+	return attribute.Int("server.port", val)
+}
+
+// ServerCallDuration is an instrument used to record metric values conforming to
+// the "rpc.server.call.duration" semantic conventions. It represents the
+// measures the duration of an incoming Remote Procedure Call (RPC).
+type ServerCallDuration struct {
+	metric.Float64Histogram
+}
+
+var newServerCallDurationOpts = []metric.Float64HistogramOption{
+	metric.WithDescription("Measures the duration of an incoming Remote Procedure Call (RPC)."),
+	metric.WithUnit("s"),
+}
+
+// NewServerCallDuration returns a new ServerCallDuration instrument.
+func NewServerCallDuration(
+	m metric.Meter,
+	opt ...metric.Float64HistogramOption,
+) (ServerCallDuration, error) {
+	// Check if the meter is nil.
+	if m == nil {
+		return ServerCallDuration{noop.Float64Histogram{}}, nil
+	}
+
+	if len(opt) == 0 {
+		opt = newServerCallDurationOpts
+	} else {
+		opt = append(opt, newServerCallDurationOpts...)
+	}
+
+	i, err := m.Float64Histogram(
+		"rpc.server.call.duration",
+		opt...,
+	)
+	if err != nil {
+		return ServerCallDuration{noop.Float64Histogram{}}, err
+	}
+	return ServerCallDuration{i}, nil
+}
+
+// Inst returns the underlying metric instrument.
+func (m ServerCallDuration) Inst() metric.Float64Histogram {
+	return m.Float64Histogram
+}
+
+// Name returns the semantic convention name of the instrument.
+func (ServerCallDuration) Name() string {
+	return "rpc.server.call.duration"
+}
+
+// Unit returns the semantic convention unit of the instrument
+func (ServerCallDuration) Unit() string {
+	return "s"
+}
+
+// Description returns the semantic convention description of the instrument
+func (ServerCallDuration) Description() string {
+	return "Measures the duration of an incoming Remote Procedure Call (RPC)."
+}
+
+// Record records val to the current distribution for attrs.
+//
+// The systemName is the the Remote Procedure Call (RPC) system.
+//
+// All additional attrs passed are included in the recorded value.
+//
+// When this metric is reported alongside an RPC server span, the metric value
+// SHOULD be the same as the RPC server span duration.
+func (m ServerCallDuration) Record(
+	ctx context.Context,
+	val float64,
+	systemName SystemNameAttr,
+	attrs ...attribute.KeyValue,
+) {
+	if len(attrs) == 0 {
+		m.Float64Histogram.Record(ctx, val, metric.WithAttributes(
+			attribute.String("rpc.system.name", string(systemName)),
+		))
+		return
+	}
+
+	o := recOptPool.Get().(*[]metric.RecordOption)
+	defer func() {
+		*o = (*o)[:0]
+		recOptPool.Put(o)
+	}()
+
+	*o = append(
+		*o,
+		metric.WithAttributes(
+			append(
+				attrs[:len(attrs):len(attrs)],
+				attribute.String("rpc.system.name", string(systemName)),
+			)...,
+		),
+	)
+
+	m.Float64Histogram.Record(ctx, val, *o...)
+}
+
+// RecordSet records val to the current distribution for set.
+//
+// When this metric is reported alongside an RPC server span, the metric value
+// SHOULD be the same as the RPC server span duration.
+func (m ServerCallDuration) RecordSet(ctx context.Context, val float64, set attribute.Set) {
+	if set.Len() == 0 {
+		m.Float64Histogram.Record(ctx, val)
+		return
+	}
+
+	o := recOptPool.Get().(*[]metric.RecordOption)
+	defer func() {
+		*o = (*o)[:0]
+		recOptPool.Put(o)
+	}()
+
+	*o = append(*o, metric.WithAttributeSet(set))
+	m.Float64Histogram.Record(ctx, val, *o...)
+}
+
+// AttrErrorType returns an optional attribute for the "error.type" semantic
+// convention. It represents the describes a class of error the operation ended
+// with.
+func (ServerCallDuration) AttrErrorType(val ErrorTypeAttr) attribute.KeyValue {
+	return attribute.String("error.type", string(val))
+}
+
+// AttrMethod returns an optional attribute for the "rpc.method" semantic
+// convention. It represents the fully-qualified logical name of the method from
+// the RPC interface perspective.
+func (ServerCallDuration) AttrMethod(val string) attribute.KeyValue {
+	return attribute.String("rpc.method", val)
+}
+
+// AttrResponseStatusCode returns an optional attribute for the
+// "rpc.response.status_code" semantic convention. It represents the status code
+// of the RPC returned by the RPC server or generated by the client.
+func (ServerCallDuration) AttrResponseStatusCode(val string) attribute.KeyValue {
+	return attribute.String("rpc.response.status_code", val)
+}
+
+// AttrServerAddress returns an optional attribute for the "server.address"
+// semantic convention. It represents a string identifying a group of RPC server
+// instances request is sent to.
+func (ServerCallDuration) AttrServerAddress(val string) attribute.KeyValue {
+	return attribute.String("server.address", val)
+}
+
+// AttrServerPort returns an optional attribute for the "server.port" semantic
+// convention. It represents the server port number.
+func (ServerCallDuration) AttrServerPort(val int) attribute.KeyValue {
+	return attribute.Int("server.port", val)
+}
diff --git a/vendor/google.golang.org/api/iamcredentials/v1/iamcredentials-api.json b/vendor/google.golang.org/api/iamcredentials/v1/iamcredentials-api.json
index 3694e4aebb..610501f1ea 100644
--- a/vendor/google.golang.org/api/iamcredentials/v1/iamcredentials-api.json
+++ b/vendor/google.golang.org/api/iamcredentials/v1/iamcredentials-api.json
@@ -151,7 +151,7 @@
               ],
               "parameters": {
                 "name": {
-                  "description": "Required. Resource name of workforce pool.",
+                  "description": "Required. Resource name of workforce pool. Format: `locations/global/workforcePools/{pool_id}`",
                   "location": "path",
                   "pattern": "^locations/[^/]+/workforcePools/[^/]+$",
                   "required": true,
@@ -183,7 +183,7 @@
                   ],
                   "parameters": {
                     "name": {
-                      "description": "Required. Resource name of workload identity pool.",
+                      "description": "Required. Resource name of workload identity pool. Format: `projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}`",
                       "location": "path",
                       "pattern": "^projects/[^/]+/locations/[^/]+/workloadIdentityPools/[^/]+$",
                       "required": true,
@@ -267,7 +267,7 @@
               ],
               "parameters": {
                 "name": {
-                  "description": "Required. Resource name of service account.",
+                  "description": "Required. Resource name of service account. Format: `projects/-/serviceAccounts/{service_account_email}`",
                   "location": "path",
                   "pattern": "^projects/[^/]+/serviceAccounts/[^/]+$",
                   "required": true,
@@ -340,7 +340,7 @@
       }
     }
   },
-  "revision": "20251022",
+  "revision": "20260326",
   "rootUrl": "https://iamcredentials.googleapis.com/",
   "schemas": {
     "GenerateAccessTokenRequest": {
diff --git a/vendor/google.golang.org/api/iamcredentials/v1/iamcredentials-gen.go b/vendor/google.golang.org/api/iamcredentials/v1/iamcredentials-gen.go
index e9885ea2a4..95826774a7 100644
--- a/vendor/google.golang.org/api/iamcredentials/v1/iamcredentials-gen.go
+++ b/vendor/google.golang.org/api/iamcredentials/v1/iamcredentials-gen.go
@@ -609,7 +609,8 @@ type LocationsWorkforcePoolsGetAllowedLocationsCall struct {
 // GetAllowedLocations: Returns the trust boundary info for a given workforce
 // pool.
 //
-// - name: Resource name of workforce pool.
+//   - name: Resource name of workforce pool. Format:
+//     `locations/global/workforcePools/{pool_id}`.
 func (r *LocationsWorkforcePoolsService) GetAllowedLocations(name string) *LocationsWorkforcePoolsGetAllowedLocationsCall {
 	c := &LocationsWorkforcePoolsGetAllowedLocationsCall{s: r.s, urlParams_: make(gensupport.URLParams)}
 	c.name = name
@@ -720,7 +721,9 @@ type ProjectsLocationsWorkloadIdentityPoolsGetAllowedLocationsCall struct {
 // GetAllowedLocations: Returns the trust boundary info for a given workload
 // identity pool.
 //
-// - name: Resource name of workload identity pool.
+//   - name: Resource name of workload identity pool. Format:
+//     `projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}
+//     `.
 func (r *ProjectsLocationsWorkloadIdentityPoolsService) GetAllowedLocations(name string) *ProjectsLocationsWorkloadIdentityPoolsGetAllowedLocationsCall {
 	c := &ProjectsLocationsWorkloadIdentityPoolsGetAllowedLocationsCall{s: r.s, urlParams_: make(gensupport.URLParams)}
 	c.name = name
@@ -1046,7 +1049,8 @@ type ProjectsServiceAccountsGetAllowedLocationsCall struct {
 // GetAllowedLocations: Returns the trust boundary info for a given service
 // account.
 //
-// - name: Resource name of service account.
+//   - name: Resource name of service account. Format:
+//     `projects/-/serviceAccounts/{service_account_email}`.
 func (r *ProjectsServiceAccountsService) GetAllowedLocations(name string) *ProjectsServiceAccountsGetAllowedLocationsCall {
 	c := &ProjectsServiceAccountsGetAllowedLocationsCall{s: r.s, urlParams_: make(gensupport.URLParams)}
 	c.name = name
diff --git a/vendor/google.golang.org/api/internal/gensupport/send.go b/vendor/google.golang.org/api/internal/gensupport/send.go
index 1c91f147ab..86b9ac0e1f 100644
--- a/vendor/google.golang.org/api/internal/gensupport/send.go
+++ b/vendor/google.golang.org/api/internal/gensupport/send.go
@@ -40,36 +40,50 @@ func (e wrappedCallErr) Is(target error) bool {
 	return errors.Is(e.ctxErr, target) || errors.Is(e.wrappedErr, target)
 }
 
+// addContextHeaders adds headers set in context metadata.
+// x-goog-api-client and x-goog-request-params are merged properly.
+func addContextHeaders(ctx context.Context, req *http.Request) {
+	if ctx == nil {
+		return
+	}
+	headers := callctx.HeadersFromContext(ctx)
+	for k, vals := range headers {
+		if strings.EqualFold(k, "x-goog-api-client") {
+			mergeHeader(req.Header, k, vals, ' ')
+		} else if strings.EqualFold(k, "x-goog-request-params") {
+			mergeHeader(req.Header, k, vals, '&')
+		} else {
+			for _, v := range vals {
+				req.Header.Add(k, v)
+			}
+		}
+	}
+}
+
+// mergeHeader merges multiple values into a single header.
+func mergeHeader(header http.Header, key string, vals []string, separator rune) {
+	var mergedVal strings.Builder
+	baseHeader := header.Get(key)
+	if baseHeader != "" {
+		mergedVal.WriteString(baseHeader)
+		mergedVal.WriteRune(separator)
+	}
+	for _, v := range vals {
+		mergedVal.WriteString(v)
+		mergedVal.WriteRune(separator)
+	}
+	if mergedVal.Len() > 0 {
+		// Remove the last separator and replace the header on the request.
+		header.Set(key, mergedVal.String()[:mergedVal.Len()-1])
+	}
+}
+
 // SendRequest sends a single HTTP request using the given client.
 // If ctx is non-nil, it calls all hooks, then sends the request with
 // req.WithContext, then calls any functions returned by the hooks in
 // reverse order.
 func SendRequest(ctx context.Context, client *http.Client, req *http.Request) (*http.Response, error) {
-	// Add headers set in context metadata.
-	if ctx != nil {
-		headers := callctx.HeadersFromContext(ctx)
-		for k, vals := range headers {
-			if k == "x-goog-api-client" {
-				// Merge all values into a single "x-goog-api-client" header.
-				var mergedVal strings.Builder
-				baseXGoogHeader := req.Header.Get("X-Goog-Api-Client")
-				if baseXGoogHeader != "" {
-					mergedVal.WriteString(baseXGoogHeader)
-					mergedVal.WriteRune(' ')
-				}
-				for _, v := range vals {
-					mergedVal.WriteString(v)
-					mergedVal.WriteRune(' ')
-				}
-				// Remove the last space and replace the header on the request.
-				req.Header.Set(k, mergedVal.String()[:mergedVal.Len()-1])
-			} else {
-				for _, v := range vals {
-					req.Header.Add(k, v)
-				}
-			}
-		}
-	}
+	addContextHeaders(ctx, req)
 
 	// Disallow Accept-Encoding because it interferes with the automatic gzip handling
 	// done by the default http.Transport. See https://github.com/google/google-api-go-client/issues/219.
@@ -105,15 +119,7 @@ func send(ctx context.Context, client *http.Client, req *http.Request) (*http.Re
 // req.WithContext, then calls any functions returned by the hooks in
 // reverse order.
 func SendRequestWithRetry(ctx context.Context, client *http.Client, req *http.Request, retry *RetryConfig) (*http.Response, error) {
-	// Add headers set in context metadata.
-	if ctx != nil {
-		headers := callctx.HeadersFromContext(ctx)
-		for k, vals := range headers {
-			for _, v := range vals {
-				req.Header.Add(k, v)
-			}
-		}
-	}
+	addContextHeaders(ctx, req)
 
 	// Disallow Accept-Encoding because it interferes with the automatic gzip handling
 	// done by the default http.Transport. See https://github.com/google/google-api-go-client/issues/219.
diff --git a/vendor/google.golang.org/api/internal/version.go b/vendor/google.golang.org/api/internal/version.go
index bde19895e7..3219b97762 100644
--- a/vendor/google.golang.org/api/internal/version.go
+++ b/vendor/google.golang.org/api/internal/version.go
@@ -5,4 +5,4 @@
 package internal
 
 // Version is the current tagged release of the library.
-const Version = "0.272.0"
+const Version = "0.277.0"
diff --git a/vendor/google.golang.org/api/storage/v1/storage-api.json b/vendor/google.golang.org/api/storage/v1/storage-api.json
index cb32e75a94..9bd7de921c 100644
--- a/vendor/google.golang.org/api/storage/v1/storage-api.json
+++ b/vendor/google.golang.org/api/storage/v1/storage-api.json
@@ -253,7 +253,7 @@
       "location": "northamerica-south1"
     }
   ],
-  "etag": "\"31363539393037303230303637393438373935\"",
+  "etag": "\"3136383236333536383830353031333435373432\"",
   "icons": {
     "x16": "https://www.google.com/images/icons/product/cloud_storage-16.png",
     "x32": "https://www.google.com/images/icons/product/cloud_storage-32.png"
@@ -521,7 +521,7 @@
           ]
         },
         "update": {
-          "description": "Updates the config(ttl and admissionPolicy) of an Anywhere Cache instance.",
+          "description": "Updates the config of an Anywhere Cache instance.",
           "httpMethod": "PATCH",
           "id": "storage.anywhereCaches.update",
           "parameterOrder": [
@@ -4605,7 +4605,7 @@
       }
     }
   },
-  "revision": "20260204",
+  "revision": "20260408",
   "rootUrl": "https://storage.googleapis.com/",
   "schemas": {
     "AdvanceRelocateBucketOperationRequest": {
@@ -4650,6 +4650,10 @@
           "description": "The ID of the resource, including the project number, bucket name and anywhere cache ID.",
           "type": "string"
         },
+        "ingestOnWrite": {
+          "description": "Specifies whether objects are ingested into the cache upon write.",
+          "type": "boolean"
+        },
         "kind": {
           "default": "storage#anywhereCache",
           "description": "The kind of item this is. For Anywhere Cache, this is always storage#anywhereCache.",
diff --git a/vendor/google.golang.org/api/storage/v1/storage-gen.go b/vendor/google.golang.org/api/storage/v1/storage-gen.go
index 5f2dd2ccee..e35ce697a4 100644
--- a/vendor/google.golang.org/api/storage/v1/storage-gen.go
+++ b/vendor/google.golang.org/api/storage/v1/storage-gen.go
@@ -384,6 +384,9 @@ type AnywhereCache struct {
 	// Id: The ID of the resource, including the project number, bucket name and
 	// anywhere cache ID.
 	Id string `json:"id,omitempty"`
+	// IngestOnWrite: Specifies whether objects are ingested into the cache upon
+	// write.
+	IngestOnWrite bool `json:"ingestOnWrite,omitempty"`
 	// Kind: The kind of item this is. For Anywhere Cache, this is always
 	// storage#anywhereCache.
 	Kind string `json:"kind,omitempty"`
@@ -3726,8 +3729,7 @@ type AnywhereCachesUpdateCall struct {
 	header_         http.Header
 }
 
-// Update: Updates the config(ttl and admissionPolicy) of an Anywhere Cache
-// instance.
+// Update: Updates the config of an Anywhere Cache instance.
 //
 // - anywhereCacheId: The ID of requested Anywhere Cache instance.
 // - bucket: Name of the parent bucket.
diff --git a/vendor/modules.txt b/vendor/modules.txt
index f8a9905946..163df6807f 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -7,8 +7,8 @@ cloud.google.com/go/internal
 cloud.google.com/go/internal/optional
 cloud.google.com/go/internal/trace
 cloud.google.com/go/internal/version
-# cloud.google.com/go/auth v0.18.2
-## explicit; go 1.24.0
+# cloud.google.com/go/auth v0.20.0
+## explicit; go 1.25.0
 cloud.google.com/go/auth
 cloud.google.com/go/auth/credentials
 cloud.google.com/go/auth/credentials/internal/externalaccount
@@ -38,12 +38,12 @@ cloud.google.com/go/compute/metadata
 cloud.google.com/go/firestore/apiv1
 cloud.google.com/go/firestore/apiv1/firestorepb
 cloud.google.com/go/firestore/internal
-# cloud.google.com/go/iam v1.5.3
-## explicit; go 1.24.0
+# cloud.google.com/go/iam v1.7.0
+## explicit; go 1.25.0
 cloud.google.com/go/iam
 cloud.google.com/go/iam/apiv1/iampb
-# cloud.google.com/go/longrunning v0.8.0
-## explicit; go 1.24.0
+# cloud.google.com/go/longrunning v0.9.0
+## explicit; go 1.25.0
 cloud.google.com/go/longrunning/autogen/longrunningpb
 # cloud.google.com/go/monitoring v1.24.3
 ## explicit; go 1.24.0
@@ -69,8 +69,8 @@ github.com/ActiveState/vt10x
 github.com/AlecAivazis/survey/v2
 github.com/AlecAivazis/survey/v2/core
 github.com/AlecAivazis/survey/v2/terminal
-# github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0
-## explicit; go 1.24.0
+# github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.1
+## explicit; go 1.25.0
 github.com/Azure/azure-sdk-for-go/sdk/azcore
 github.com/Azure/azure-sdk-for-go/sdk/azcore/arm/internal/resource
 github.com/Azure/azure-sdk-for-go/sdk/azcore/arm/policy
@@ -98,8 +98,8 @@ github.com/Azure/azure-sdk-for-go/sdk/azidentity/internal
 # github.com/Azure/azure-sdk-for-go/sdk/containers/azcontainerregistry v0.2.3
 ## explicit; go 1.23.0
 github.com/Azure/azure-sdk-for-go/sdk/containers/azcontainerregistry
-# github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2
-## explicit; go 1.23.0
+# github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0
+## explicit; go 1.24.0
 github.com/Azure/azure-sdk-for-go/sdk/internal/diag
 github.com/Azure/azure-sdk-for-go/sdk/internal/errorinfo
 github.com/Azure/azure-sdk-for-go/sdk/internal/exported
@@ -214,7 +214,7 @@ github.com/aws/aws-sdk-go/service/sso/ssoiface
 github.com/aws/aws-sdk-go/service/ssooidc
 github.com/aws/aws-sdk-go/service/sts
 github.com/aws/aws-sdk-go/service/sts/stsiface
-# github.com/aws/aws-sdk-go-v2 v1.41.5
+# github.com/aws/aws-sdk-go-v2 v1.41.7
 ## explicit; go 1.24
 github.com/aws/aws-sdk-go-v2/aws
 github.com/aws/aws-sdk-go-v2/aws/defaults
@@ -240,10 +240,11 @@ github.com/aws/aws-sdk-go-v2/internal/shareddefaults
 github.com/aws/aws-sdk-go-v2/internal/strings
 github.com/aws/aws-sdk-go-v2/internal/sync/singleflight
 github.com/aws/aws-sdk-go-v2/internal/timeconv
-# github.com/aws/aws-sdk-go-v2/config v1.32.12
+# github.com/aws/aws-sdk-go-v2/config v1.32.17
 ## explicit; go 1.24
 github.com/aws/aws-sdk-go-v2/config
-# github.com/aws/aws-sdk-go-v2/credentials v1.19.12
+github.com/aws/aws-sdk-go-v2/config/internal/ini
+# github.com/aws/aws-sdk-go-v2/credentials v1.19.16
 ## explicit; go 1.24
 github.com/aws/aws-sdk-go-v2/credentials
 github.com/aws/aws-sdk-go-v2/credentials/ec2rolecreds
@@ -253,19 +254,21 @@ github.com/aws/aws-sdk-go-v2/credentials/logincreds
 github.com/aws/aws-sdk-go-v2/credentials/processcreds
 github.com/aws/aws-sdk-go-v2/credentials/ssocreds
 github.com/aws/aws-sdk-go-v2/credentials/stscreds
-# github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20
+# github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.23
 ## explicit; go 1.24
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds/internal/config
-# github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21
+# github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23
 ## explicit; go 1.24
 github.com/aws/aws-sdk-go-v2/internal/configsources
-# github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21
+# github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23
 ## explicit; go 1.24
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2
-# github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6
+# github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24
 ## explicit; go 1.24
-github.com/aws/aws-sdk-go-v2/internal/ini
+github.com/aws/aws-sdk-go-v2/internal/v4a
+github.com/aws/aws-sdk-go-v2/internal/v4a/internal/crypto
+github.com/aws/aws-sdk-go-v2/internal/v4a/internal/v4
 # github.com/aws/aws-sdk-go-v2/service/ecr v1.55.3
 ## explicit; go 1.23
 github.com/aws/aws-sdk-go-v2/service/ecr
@@ -276,33 +279,33 @@ github.com/aws/aws-sdk-go-v2/service/ecr/types
 github.com/aws/aws-sdk-go-v2/service/ecrpublic
 github.com/aws/aws-sdk-go-v2/service/ecrpublic/internal/endpoints
 github.com/aws/aws-sdk-go-v2/service/ecrpublic/types
-# github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7
+# github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.9
 ## explicit; go 1.24
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding
-# github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21
+# github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.23
 ## explicit; go 1.24
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url
-# github.com/aws/aws-sdk-go-v2/service/signin v1.0.8
+# github.com/aws/aws-sdk-go-v2/service/signin v1.0.11
 ## explicit; go 1.24
 github.com/aws/aws-sdk-go-v2/service/signin
 github.com/aws/aws-sdk-go-v2/service/signin/internal/endpoints
 github.com/aws/aws-sdk-go-v2/service/signin/types
-# github.com/aws/aws-sdk-go-v2/service/sso v1.30.13
+# github.com/aws/aws-sdk-go-v2/service/sso v1.30.17
 ## explicit; go 1.24
 github.com/aws/aws-sdk-go-v2/service/sso
 github.com/aws/aws-sdk-go-v2/service/sso/internal/endpoints
 github.com/aws/aws-sdk-go-v2/service/sso/types
-# github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17
+# github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.21
 ## explicit; go 1.24
 github.com/aws/aws-sdk-go-v2/service/ssooidc
 github.com/aws/aws-sdk-go-v2/service/ssooidc/internal/endpoints
 github.com/aws/aws-sdk-go-v2/service/ssooidc/types
-# github.com/aws/aws-sdk-go-v2/service/sts v1.41.9
+# github.com/aws/aws-sdk-go-v2/service/sts v1.42.1
 ## explicit; go 1.24
 github.com/aws/aws-sdk-go-v2/service/sts
 github.com/aws/aws-sdk-go-v2/service/sts/internal/endpoints
 github.com/aws/aws-sdk-go-v2/service/sts/types
-# github.com/aws/smithy-go v1.24.2
+# github.com/aws/smithy-go v1.25.1
 ## explicit; go 1.24
 github.com/aws/smithy-go
 github.com/aws/smithy-go/auth
@@ -569,8 +572,8 @@ github.com/go-logr/logr/funcr
 # github.com/go-logr/stdr v1.2.2
 ## explicit; go 1.16
 github.com/go-logr/stdr
-# github.com/go-openapi/analysis v0.24.3
-## explicit; go 1.24.0
+# github.com/go-openapi/analysis v0.25.0
+## explicit; go 1.25.0
 github.com/go-openapi/analysis
 github.com/go-openapi/analysis/internal/debug
 github.com/go-openapi/analysis/internal/flatten/normalize
@@ -581,8 +584,8 @@ github.com/go-openapi/analysis/internal/flatten/sortref
 # github.com/go-openapi/errors v0.22.7
 ## explicit; go 1.24.0
 github.com/go-openapi/errors
-# github.com/go-openapi/jsonpointer v0.22.5
-## explicit; go 1.24.0
+# github.com/go-openapi/jsonpointer v0.23.1
+## explicit; go 1.25.0
 github.com/go-openapi/jsonpointer
 # github.com/go-openapi/jsonreference v0.21.5
 ## explicit; go 1.24.0
@@ -591,62 +594,68 @@ github.com/go-openapi/jsonreference/internal
 # github.com/go-openapi/loads v0.23.3
 ## explicit; go 1.24.0
 github.com/go-openapi/loads
-# github.com/go-openapi/runtime v0.29.3
-## explicit; go 1.24.0
+# github.com/go-openapi/runtime v0.31.0
+## explicit; go 1.25.0
 github.com/go-openapi/runtime
 github.com/go-openapi/runtime/client
+github.com/go-openapi/runtime/client/internal/request
 github.com/go-openapi/runtime/logger
 github.com/go-openapi/runtime/middleware
 github.com/go-openapi/runtime/middleware/denco
-github.com/go-openapi/runtime/middleware/header
 github.com/go-openapi/runtime/middleware/untyped
 github.com/go-openapi/runtime/security
 github.com/go-openapi/runtime/yamlpc
+# github.com/go-openapi/runtime/server-middleware v0.30.0
+## explicit; go 1.25.0
+github.com/go-openapi/runtime/server-middleware/docui
+github.com/go-openapi/runtime/server-middleware/mediatype
+github.com/go-openapi/runtime/server-middleware/negotiate
+github.com/go-openapi/runtime/server-middleware/negotiate/header
 # github.com/go-openapi/spec v0.22.4
 ## explicit; go 1.24.0
 github.com/go-openapi/spec
-# github.com/go-openapi/strfmt v0.26.1
-## explicit; go 1.24.0
+# github.com/go-openapi/strfmt v0.26.2
+## explicit; go 1.25.0
 github.com/go-openapi/strfmt
 github.com/go-openapi/strfmt/internal/bsonlite
-# github.com/go-openapi/swag v0.25.5
-## explicit; go 1.24.0
+# github.com/go-openapi/swag v0.26.0
+## explicit; go 1.25.0
 github.com/go-openapi/swag
-# github.com/go-openapi/swag/cmdutils v0.25.5
-## explicit; go 1.24.0
+# github.com/go-openapi/swag/cmdutils v0.26.0
+## explicit; go 1.25.0
 github.com/go-openapi/swag/cmdutils
-# github.com/go-openapi/swag/conv v0.25.5
-## explicit; go 1.24.0
+# github.com/go-openapi/swag/conv v0.26.0
+## explicit; go 1.25.0
 github.com/go-openapi/swag/conv
-# github.com/go-openapi/swag/fileutils v0.25.5
-## explicit; go 1.24.0
+# github.com/go-openapi/swag/fileutils v0.26.0
+## explicit; go 1.25.0
 github.com/go-openapi/swag/fileutils
-# github.com/go-openapi/swag/jsonname v0.25.5
-## explicit; go 1.24.0
+# github.com/go-openapi/swag/jsonname v0.26.0
+## explicit; go 1.25.0
 github.com/go-openapi/swag/jsonname
-# github.com/go-openapi/swag/jsonutils v0.25.5
-## explicit; go 1.24.0
+# github.com/go-openapi/swag/jsonutils v0.26.0
+## explicit; go 1.25.0
 github.com/go-openapi/swag/jsonutils
 github.com/go-openapi/swag/jsonutils/adapters
 github.com/go-openapi/swag/jsonutils/adapters/ifaces
 github.com/go-openapi/swag/jsonutils/adapters/stdlib/json
-# github.com/go-openapi/swag/loading v0.25.5
-## explicit; go 1.24.0
+# github.com/go-openapi/swag/loading v0.26.0
+## explicit; go 1.25.0
 github.com/go-openapi/swag/loading
-# github.com/go-openapi/swag/mangling v0.25.5
-## explicit; go 1.24.0
+# github.com/go-openapi/swag/mangling v0.26.0
+## explicit; go 1.25.0
 github.com/go-openapi/swag/mangling
-# github.com/go-openapi/swag/netutils v0.25.5
-## explicit; go 1.24.0
+# github.com/go-openapi/swag/netutils v0.26.0
+## explicit; go 1.25.0
 github.com/go-openapi/swag/netutils
-# github.com/go-openapi/swag/stringutils v0.25.5
-## explicit; go 1.24.0
+# github.com/go-openapi/swag/stringutils v0.26.0
+## explicit; go 1.25.0
 github.com/go-openapi/swag/stringutils
-# github.com/go-openapi/swag/typeutils v0.25.5
-## explicit; go 1.24.0
+# github.com/go-openapi/swag/typeutils v0.26.0
+## explicit; go 1.25.0
 github.com/go-openapi/swag/typeutils
-# github.com/go-openapi/swag/yamlutils v0.25.5
-## explicit; go 1.24.0
+# github.com/go-openapi/swag/yamlutils v0.26.0
+## explicit; go 1.25.0
 github.com/go-openapi/swag/yamlutils
 # github.com/go-openapi/validate v0.25.2
 ## explicit; go 1.24.0
@@ -799,11 +808,11 @@ github.com/google/uuid
 # github.com/google/wire v0.6.0
 ## explicit; go 1.12
 github.com/google/wire
-# github.com/googleapis/enterprise-certificate-proxy v0.3.14
+# github.com/googleapis/enterprise-certificate-proxy v0.3.15
 ## explicit; go 1.24.11
 github.com/googleapis/enterprise-certificate-proxy/client
 github.com/googleapis/enterprise-certificate-proxy/client/util
-# github.com/googleapis/gax-go/v2 v2.19.0
+# github.com/googleapis/gax-go/v2 v2.22.0
 ## explicit; go 1.25.0
 github.com/googleapis/gax-go/v2
 github.com/googleapis/gax-go/v2/apierror
@@ -1227,8 +1236,8 @@ github.com/sigstore/sigstore-go/pkg/tlog
 github.com/sigstore/sigstore-go/pkg/tuf
 github.com/sigstore/sigstore-go/pkg/util
 github.com/sigstore/sigstore-go/pkg/verify
-# github.com/sigstore/timestamp-authority/v2 v2.0.6
-## explicit; go 1.25.0
+# github.com/sigstore/timestamp-authority/v2 v2.1.0
+## explicit; go 1.25.1
 github.com/sigstore/timestamp-authority/v2/pkg/verification
 # github.com/sirupsen/logrus v1.9.4
 ## explicit; go 1.17
@@ -1589,8 +1598,8 @@ go.opentelemetry.io/auto/sdk/internal/telemetry
 # go.opentelemetry.io/contrib/detectors/gcp v1.42.0
 ## explicit; go 1.25.0
 go.opentelemetry.io/contrib/detectors/gcp
-# go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0
-## explicit; go 1.23.0
+# go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0
+## explicit; go 1.25.0
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/internal
 # go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0
@@ -1611,10 +1620,10 @@ go.opentelemetry.io/otel/internal/errorhandler
 go.opentelemetry.io/otel/internal/global
 go.opentelemetry.io/otel/propagation
 go.opentelemetry.io/otel/semconv/v1.37.0
-go.opentelemetry.io/otel/semconv/v1.37.0/rpcconv
 go.opentelemetry.io/otel/semconv/v1.40.0
 go.opentelemetry.io/otel/semconv/v1.40.0/httpconv
 go.opentelemetry.io/otel/semconv/v1.40.0/otelconv
+go.opentelemetry.io/otel/semconv/v1.40.0/rpcconv
 # go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0
 ## explicit; go 1.25.0
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc
@@ -1715,8 +1724,8 @@ go.starlark.net/resolve
 go.starlark.net/starlark
 go.starlark.net/starlarkstruct
 go.starlark.net/syntax
-# go.step.sm/crypto v0.77.2
-## explicit; go 1.25.0
+# go.step.sm/crypto v0.81.0
+## explicit; go 1.25.1
 go.step.sm/crypto/fingerprint
 go.step.sm/crypto/internal/bcrypt_pbkdf
 go.step.sm/crypto/internal/emoji
@@ -1894,7 +1903,7 @@ golang.org/x/xerrors/internal
 # gomodules.xyz/jsonpatch/v2 v2.5.0
 ## explicit; go 1.20
 gomodules.xyz/jsonpatch/v2
-# google.golang.org/api v0.272.0
+# google.golang.org/api v0.277.0
 ## explicit; go 1.25.0
 google.golang.org/api/googleapi
 google.golang.org/api/googleapi/transport
@@ -1912,7 +1921,7 @@ google.golang.org/api/storage/v1
 google.golang.org/api/transport
 google.golang.org/api/transport/grpc
 google.golang.org/api/transport/http
-# google.golang.org/genproto v0.0.0-20260316180232-0b37fe3546d5
+# google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7
 ## explicit; go 1.25.0
 google.golang.org/genproto/googleapis/type/calendarperiod
 google.golang.org/genproto/googleapis/type/date