diff --git a/src/go.mod b/src/go.mod
index 77f1af98..cc434cd6 100644
--- a/src/go.mod
+++ b/src/go.mod
@@ -15,13 +15,13 @@ require (
 	github.com/looplab/fsm v1.0.3
 	github.com/minio/minio-go/v7 v7.2.1
 	github.com/pquerna/otp v1.5.0
-	github.com/pressly/goose/v3 v3.27.2
+	github.com/pressly/goose/v3 v3.27.3
 	github.com/redis/go-redis/v9 v9.21.0
 	github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e
 	github.com/srwiley/oksvg v0.0.0-20221011165216-be6e8873101c
 	github.com/srwiley/rasterx v0.0.0-20220730225603-2ab79fcdd4ef
 	github.com/valyala/fastjson v1.6.10
-	golang.org/x/crypto v0.53.0
+	golang.org/x/crypto v0.54.0
 	golang.org/x/image v0.44.0
 	golang.org/x/sync v0.22.0
 	golang.org/x/text v0.40.0
@@ -43,19 +43,19 @@ require (
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
-	github.com/klauspost/compress v1.19.0 // indirect
+	github.com/klauspost/compress v1.19.1 // indirect
 	github.com/klauspost/cpuid/v2 v2.4.0 // indirect
 	github.com/klauspost/crc32 v1.3.0 // indirect
 	github.com/kr/text v0.2.0 // indirect
 	github.com/mattn/go-colorable v0.1.15 // indirect
-	github.com/mattn/go-isatty v0.0.22 // indirect
+	github.com/mattn/go-isatty v0.0.23 // indirect
 	github.com/mfridman/interpolate v0.0.2 // indirect
 	github.com/minio/crc64nvme v1.1.1 // indirect
 	github.com/minio/md5-simd v1.1.2 // indirect
 	github.com/philhofer/fwd v1.2.0 // indirect
 	github.com/rs/xid v1.6.0 // indirect
 	github.com/savsgio/gotils v0.0.0-20250924091648-bce9a52d7761 // indirect
-	github.com/sethvargo/go-retry v0.3.0 // indirect
+	github.com/sethvargo/go-retry v0.4.0 // indirect
 	github.com/tinylib/msgp v1.6.4 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/valyala/fasthttp v1.72.0 // indirect
@@ -64,7 +64,7 @@ require (
 	go.uber.org/atomic v1.11.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/net v0.56.0 // indirect
-	golang.org/x/sys v0.46.0 // indirect
+	golang.org/x/net v0.57.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
 	gopkg.in/ini.v1 v1.67.3 // indirect
 )
diff --git a/src/go.sum b/src/go.sum
index 55fb935b..dd2eacff 100644
--- a/src/go.sum
+++ b/src/go.sum
@@ -61,6 +61,8 @@ github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
 github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
 github.com/klauspost/compress v1.19.0 h1:sXLILfc9jV2QYWkzFOPWStmcUVH2RHEB1JCdY2oVvCQ=
 github.com/klauspost/compress v1.19.0/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.19.1 h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk=
+github.com/klauspost/compress v1.19.1/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid/v2 v2.0.1/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
 github.com/klauspost/cpuid/v2 v2.4.0 h1:S6Hrbc7+ywsr0r+RLapfGBHfyefhCTwEh3A0tV913Dw=
 github.com/klauspost/cpuid/v2 v2.4.0/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU=
@@ -76,6 +78,8 @@ github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy
 github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4=
 github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
+github.com/mattn/go-isatty v0.0.23 h1:cYwCQTQf3HB6xUC+BtyCLZNr7IzbOmoZbmssVNzSyiQ=
+github.com/mattn/go-isatty v0.0.23/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/mfridman/interpolate v0.0.2 h1:pnuTK7MQIxxFz1Gr+rjSIx9u7qVjf5VOoM/u6BbAxPY=
 github.com/mfridman/interpolate v0.0.2/go.mod h1:p+7uk6oE07mpE/Ik1b8EckO0O4ZXiGAfshKBWLUM9Xg=
 github.com/minio/crc64nvme v1.1.1 h1:8dwx/Pz49suywbO+auHCBpCtlW1OfpcLN7wYgVR6wAI=
@@ -95,6 +99,8 @@ github.com/pquerna/otp v1.5.0 h1:NMMR+WrmaqXU4EzdGJEE1aUUI0AMRzsp96fFFWNPwxs=
 github.com/pquerna/otp v1.5.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
 github.com/pressly/goose/v3 v3.27.2 h1:FjKNzcmMdGrQlSIu5alMSmakQtJFBgtw+A0bb1p/LC8=
 github.com/pressly/goose/v3 v3.27.2/go.mod h1:qWW+/8dkVtJYjJrbIpwD5xxnEJTUKvxkQ9JKQp9LaIM=
+github.com/pressly/goose/v3 v3.27.3 h1:pIglVHjw99r4e/hDHHwbl9vfOsDMqUokfkXo6+n/RxA=
+github.com/pressly/goose/v3 v3.27.3/go.mod h1:Dag+xpV6o20HR2LFY1j0q6MDwc3f7vPUFDA77R+0yGY=
 github.com/redis/go-redis/v9 v9.21.0 h1:FPBE4hhbAke+TLmcY3WkpbDffJEomdqPn3HYiqAtL9E=
 github.com/redis/go-redis/v9 v9.21.0/go.mod h1:v/M13XI1PVCDcm01VtPFOADfZtHf8YW3baQf57KlIkA=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
@@ -107,6 +113,8 @@ github.com/savsgio/gotils v0.0.0-20250924091648-bce9a52d7761 h1:McifyVxygw1d67y6
 github.com/savsgio/gotils v0.0.0-20250924091648-bce9a52d7761/go.mod h1:Vi9gvHvTw4yCUHIznFl5TPULS7aXwgaTByGeBY75Wko=
 github.com/sethvargo/go-retry v0.3.0 h1:EEt31A35QhrcRZtrYFDTBg91cqZVnFL2navjDrah2SE=
 github.com/sethvargo/go-retry v0.3.0/go.mod h1:mNX17F0C/HguQMyMyJxcnU471gOZGxCLyYaFyAZraas=
+github.com/sethvargo/go-retry v0.4.0 h1:9qy1OoIAxBL+gBYnkTnTnWle5wlfsXQlwRzIbbpdqPw=
+github.com/sethvargo/go-retry v0.4.0/go.mod h1:tvsjdKG6xfiCx4LSiUZ06kcv38xvdVQwv8R6/VnnVWg=
 github.com/shamaton/msgpack/v3 v3.1.2 h1:d5gWAIyMU4M0WgDjz6IFSCuXJUA2dFwRHBpDclE8CLw=
 github.com/shamaton/msgpack/v3 v3.1.2/go.mod h1:DcQG8jrdrQCIxr3HlMYkiXdMhK+KfN2CitkyzsQV4uc=
 github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e h1:MRM5ITcdelLK2j1vwZ3Je0FKVCfqOLp5zO6trqMLYs0=
@@ -152,14 +160,20 @@ go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
 golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
+golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
+golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
 golang.org/x/image v0.44.0 h1:+tDekMZED9+LrtB3G5xzRggpVh9CARjZqROla3R3R+I=
 golang.org/x/image v0.44.0/go.mod h1:V8K3KE9KKKE+pLpQDOeN18w9oacNSvy1tDOirTu4xtY=
 golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
 golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
+golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
+golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
 golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
 golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
 golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
 golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
diff --git a/src/vendor/github.com/klauspost/compress/README.md b/src/vendor/github.com/klauspost/compress/README.md
index fb023f2c..0e9f170d 100644
--- a/src/vendor/github.com/klauspost/compress/README.md
+++ b/src/vendor/github.com/klauspost/compress/README.md
@@ -27,6 +27,18 @@ Use the links above for more information on each.
 
 # changelog
 
+* Jul 1st, 2026 [1.19.0](https://github.com/klauspost/compress/releases/tag/v1.19.0)
+	* zstd: Add true concurrent stream encodingin https://github.com/klauspost/compress/pull/1136
+	* zstd: arm64 decoder asm by @lizthegrey in https://github.com/klauspost/compress/pull/1160
+	* flate: Add inflate checkpoints in https://github.com/klauspost/compress/pull/1154
+	* zstd: avoid unused BuildDict encoder allocation by @snissn in https://github.com/klauspost/compress/pull/1147
+	* snappy/s2: Limit length of varint in `decodedLen` by @eustas in https://github.com/klauspost/compress/pull/1148
+	* gzhttp: match qvalue parameter case-insensitively (RFC 7231) by @z9z in https://github.com/klauspost/compress/pull/1149
+	* zip: add NameDecoder callback for legacy encoding rewrite by @SAY-5 in https://github.com/klauspost/compress/pull/1150
+	* huff0: Allow building tables from histogram in https://github.com/klauspost/compress/pull/1155
+	* huff0: Allow building table from oversized histogram in https://github.com/klauspost/compress/pull/1156
+	* s2sx: Clean symlink targets in https://github.com/klauspost/compress/pull/1163
+
 * Feb 9th, 2026 [1.18.4](https://github.com/klauspost/compress/releases/tag/v1.18.4)
 	* gzhttp: Add zstandard to server handler wrapper https://github.com/klauspost/compress/pull/1121
 	* zstd: Add ResetWithOptions to encoder/decoder https://github.com/klauspost/compress/pull/1122
diff --git a/src/vendor/github.com/klauspost/compress/flate/inflate_gen.go b/src/vendor/github.com/klauspost/compress/flate/inflate_gen.go
index 2b2f993f..e80f1965 100644
--- a/src/vendor/github.com/klauspost/compress/flate/inflate_gen.go
+++ b/src/vendor/github.com/klauspost/compress/flate/inflate_gen.go
@@ -10,6 +10,15 @@ import (
 	"strings"
 )
 
+func peekBufio(fr *bufio.Reader) ([]byte, error) {
+	if fr.Buffered() == 0 {
+		if _, err := fr.Peek(1); err != nil && fr.Buffered() == 0 {
+			return nil, err
+		}
+	}
+	return fr.Peek(fr.Buffered())
+}
+
 // Decode a single Huffman block from f.
 // hl and hd are the Huffman states for the lit/length values
 // and the distance values, respectively. If hd == nil, using the
@@ -527,6 +536,8 @@ func (f *decompressor) huffmanBufioReader() {
 	// but is smart enough to keep local variables in registers, so use nb and b,
 	// inline call to moreBits and reassign b,nb back to f on return.
 	fnb, fb, dict := f.nb, f.b, &f.dict
+	pbuf, _ := fr.Peek(fr.Buffered())
+	pos := 0
 
 	switch f.stepState {
 	case stateInit:
@@ -548,12 +559,19 @@ readLiteral:
 			n := uint(f.hl.maxRead)
 			for {
 				for fnb < n {
-					c, err := fr.ReadByte()
-					if err != nil {
-						f.b, f.nb = fb, fnb
-						f.err = noEOF(err)
-						return
+					if pos >= len(pbuf) {
+						fr.Discard(pos)
+						var err error
+						pbuf, err = peekBufio(fr)
+						pos = 0
+						if len(pbuf) == 0 {
+							f.b, f.nb = fb, fnb
+							f.err = noEOF(err)
+							return
+						}
 					}
+					c := pbuf[pos]
+					pos++
 					f.roffset++
 					fb |= uint32(c) << (fnb & regSizeMaskUint32)
 					fnb += 8
@@ -566,6 +584,7 @@ readLiteral:
 				}
 				if n <= fnb {
 					if n == 0 {
+						fr.Discard(pos)
 						f.b, f.nb = fb, fnb
 						if debugDecode {
 							fmt.Println("huffsym: n==0")
@@ -586,6 +605,7 @@ readLiteral:
 		case v < 256:
 			dict.writeByte(byte(v))
 			if dict.availWrite() == 0 {
+				fr.Discard(pos)
 				f.toRead = dict.readFlush()
 				f.step = huffmanBufioReader
 				f.stepState = stateInit
@@ -594,6 +614,7 @@ readLiteral:
 			}
 			goto readLiteral
 		case v == 256:
+			fr.Discard(pos)
 			f.b, f.nb = fb, fnb
 			f.finishBlock()
 			return
@@ -605,15 +626,22 @@ readLiteral:
 			length = int(val.length) + 3
 			n := uint(val.extra)
 			for fnb < n {
-				c, err := fr.ReadByte()
-				if err != nil {
-					f.b, f.nb = fb, fnb
-					if debugDecode {
-						fmt.Println("morebits n>0:", err)
+				if pos >= len(pbuf) {
+					fr.Discard(pos)
+					var err error
+					pbuf, err = peekBufio(fr)
+					pos = 0
+					if len(pbuf) == 0 {
+						f.b, f.nb = fb, fnb
+						if debugDecode {
+							fmt.Println("morebits n>0:", err)
+						}
+						f.err = err
+						return
 					}
-					f.err = err
-					return
 				}
+				c := pbuf[pos]
+				pos++
 				f.roffset++
 				fb |= uint32(c) << (fnb & regSizeMaskUint32)
 				fnb += 8
@@ -622,6 +650,7 @@ readLiteral:
 			fb >>= n & regSizeMaskUint32
 			fnb -= n
 		default:
+			fr.Discard(pos)
 			if debugDecode {
 				fmt.Println(v, ">= maxNumLit")
 			}
@@ -633,15 +662,22 @@ readLiteral:
 		var dist uint32
 		if f.hd == nil {
 			for fnb < 5 {
-				c, err := fr.ReadByte()
-				if err != nil {
-					f.b, f.nb = fb, fnb
-					if debugDecode {
-						fmt.Println("morebits f.nb<5:", err)
+				if pos >= len(pbuf) {
+					fr.Discard(pos)
+					var err error
+					pbuf, err = peekBufio(fr)
+					pos = 0
+					if len(pbuf) == 0 {
+						f.b, f.nb = fb, fnb
+						if debugDecode {
+							fmt.Println("morebits f.nb<5:", err)
+						}
+						f.err = err
+						return
 					}
-					f.err = err
-					return
 				}
+				c := pbuf[pos]
+				pos++
 				f.roffset++
 				fb |= uint32(c) << (fnb & regSizeMaskUint32)
 				fnb += 8
@@ -660,12 +696,19 @@ readLiteral:
 			// inline call to moreBits and reassign b,nb back to f on return.
 			for {
 				for fnb < n {
-					c, err := fr.ReadByte()
-					if err != nil {
-						f.b, f.nb = fb, fnb
-						f.err = noEOF(err)
-						return
+					if pos >= len(pbuf) {
+						fr.Discard(pos)
+						var err error
+						pbuf, err = peekBufio(fr)
+						pos = 0
+						if len(pbuf) == 0 {
+							f.b, f.nb = fb, fnb
+							f.err = noEOF(err)
+							return
+						}
 					}
+					c := pbuf[pos]
+					pos++
 					f.roffset++
 					fb |= uint32(c) << (fnb & regSizeMaskUint32)
 					fnb += 8
@@ -678,6 +721,7 @@ readLiteral:
 				}
 				if n <= fnb {
 					if n == 0 {
+						fr.Discard(pos)
 						f.b, f.nb = fb, fnb
 						if debugDecode {
 							fmt.Println("huffsym: n==0")
@@ -701,15 +745,22 @@ readLiteral:
 			// have 1 bit in bottom of dist, need nb more.
 			extra := (dist & 1) << (nb & regSizeMaskUint32)
 			for fnb < nb {
-				c, err := fr.ReadByte()
-				if err != nil {
-					f.b, f.nb = fb, fnb
-					if debugDecode {
-						fmt.Println("morebits f.nb<nb:", err)
+				if pos >= len(pbuf) {
+					fr.Discard(pos)
+					var err error
+					pbuf, err = peekBufio(fr)
+					pos = 0
+					if len(pbuf) == 0 {
+						f.b, f.nb = fb, fnb
+						if debugDecode {
+							fmt.Println("morebits f.nb<nb:", err)
+						}
+						f.err = err
+						return
 					}
-					f.err = err
-					return
 				}
+				c := pbuf[pos]
+				pos++
 				f.roffset++
 				fb |= uint32(c) << (fnb & regSizeMaskUint32)
 				fnb += 8
@@ -720,6 +771,7 @@ readLiteral:
 			dist = 1<<((nb+1)&regSizeMaskUint32) + 1 + extra
 			// slower: dist = bitMask32[nb+1] + 2 + extra
 		default:
+			fr.Discard(pos)
 			f.b, f.nb = fb, fnb
 			if debugDecode {
 				fmt.Println("dist too big:", dist, maxNumDist)
@@ -730,6 +782,7 @@ readLiteral:
 
 		// No check on length; encoding can be prescient.
 		if dist > uint32(dict.histSize()) {
+			fr.Discard(pos)
 			f.b, f.nb = fb, fnb
 			if debugDecode {
 				fmt.Println("dist > dict.histSize():", dist, dict.histSize())
@@ -752,6 +805,7 @@ copyHistory:
 		f.copyLen -= cnt
 
 		if dict.availWrite() == 0 || f.copyLen > 0 {
+			fr.Discard(pos)
 			f.toRead = dict.readFlush()
 			f.step = huffmanBufioReader // We need to continue this work
 			f.stepState = stateDict
diff --git a/src/vendor/github.com/klauspost/compress/s2/encode_all.go b/src/vendor/github.com/klauspost/compress/s2/encode_all.go
index 9d12c44f..794ec8a6 100644
--- a/src/vendor/github.com/klauspost/compress/s2/encode_all.go
+++ b/src/vendor/github.com/klauspost/compress/s2/encode_all.go
@@ -981,7 +981,7 @@ searchDict:
 				cv = load64(src, s)
 				continue
 			}
-		} else if uint32(cv>>(checkRep*8)) == load32(src, s-repeat+checkRep) {
+		} else if repeat > 0 && uint32(cv>>(checkRep*8)) == load32(src, s-repeat+checkRep) {
 			base := s + checkRep
 			// Extend back
 			for i := base - repeat; base > nextEmit && i > 0 && src[i-1] == src[base-1]; {
diff --git a/src/vendor/github.com/klauspost/compress/s2/reader.go b/src/vendor/github.com/klauspost/compress/s2/reader.go
index 4d01c419..17443e2c 100644
--- a/src/vendor/github.com/klauspost/compress/s2/reader.go
+++ b/src/vendor/github.com/klauspost/compress/s2/reader.go
@@ -216,13 +216,18 @@ func (r *Reader) skippable(tmp []byte, n int, allowEOF bool, id uint8) (ok bool)
 		return r.err == nil
 	}
 	if rs, ok := r.r.(io.ReadSeeker); ok {
-		_, err := rs.Seek(int64(n), io.SeekCurrent)
-		if err == nil {
-			return true
-		}
-		if err == io.ErrUnexpectedEOF || (r.err == io.EOF && !allowEOF) {
-			r.err = ErrCorrupt
-			return false
+		if cur, err := rs.Seek(0, io.SeekCurrent); err == nil {
+			if end, err := rs.Seek(0, io.SeekEnd); err == nil {
+				if cur+int64(n) <= end {
+					if _, err := rs.Seek(cur+int64(n), io.SeekStart); err == nil {
+						return true
+					}
+				}
+				if _, err := rs.Seek(cur, io.SeekStart); err != nil {
+					r.err = ErrCorrupt
+					return false
+				}
+			}
 		}
 	}
 	for n > 0 {
diff --git a/src/vendor/github.com/klauspost/compress/zstd/fse_decoder_arm64.s b/src/vendor/github.com/klauspost/compress/zstd/fse_decoder_arm64.s
index 661761fb..77ee3913 100644
--- a/src/vendor/github.com/klauspost/compress/zstd/fse_decoder_arm64.s
+++ b/src/vendor/github.com/klauspost/compress/zstd/fse_decoder_arm64.s
@@ -28,7 +28,10 @@ TEXT ·buildDtable_asm(SB), $0-24
 init_main_loop:
 	ADD  R8<<1, R1, R15
 	MOVH (R15), R9
-	CMN  $1, R9
+	AND  $0xffff, R9, R15
+	MOVD $-1, R16
+	AND  $0xffff, R16, R16
+	CMP  R16, R15
 	BNE  do_not_update_high_threshold
 	ADD  R7<<3, R5, R15
 	MOVB R8, 1(R15)
@@ -126,9 +129,13 @@ build_table_main_table:
 	RET
 
 build_table_check1_ok:
-	TST  R1, R1
+	AND  $0xff, R1, R15
+	AND  $0xff, R1, R16
+	TST  R16, R15
 	BNE  build_table_check2_ok
-	CMP  R6, R7
+	AND  $0xffff, R7, R15
+	AND  $0xffff, R6, R16
+	CMP  R16, R15
 	BNE  build_table_check2_ok
 	MOVD ctx+8(FP), R0
 	MOVD R7, 24(R0)
diff --git a/src/vendor/github.com/klauspost/compress/zstd/seqdec_arm64.s b/src/vendor/github.com/klauspost/compress/zstd/seqdec_arm64.s
index 75b19d73..a468e5fc 100644
--- a/src/vendor/github.com/klauspost/compress/zstd/seqdec_arm64.s
+++ b/src/vendor/github.com/klauspost/compress/zstd/seqdec_arm64.s
@@ -670,9 +670,9 @@ error_overread:
 	MOVD R16, ret+24(FP)
 	RET
 
-// skipped sequenceDecs_decode_bmi2 (BMI2 not available on arm64)
+// skipped sequenceDecs_decode_bmi2 (generic twin preferred on arm64)
 
-// skipped sequenceDecs_decode_56_bmi2 (BMI2 not available on arm64)
+// skipped sequenceDecs_decode_56_bmi2 (generic twin preferred on arm64)
 
 // func sequenceDecs_executeSimple_amd64(ctx *executeAsmContext) bool
 // Requires: SSE
@@ -1966,7 +1966,7 @@ error_not_enough_space:
 	MOVD R16, ret+24(FP)
 	RET
 
-// skipped sequenceDecs_decodeSync_bmi2 (BMI2 not available on arm64)
+// skipped sequenceDecs_decodeSync_bmi2 (generic twin preferred on arm64)
 
 // func sequenceDecs_decodeSync_safe_amd64(s *sequenceDecs, br *bitReader, ctx *decodeSyncAsmContext) int
 // Requires: CMOV, SSE
@@ -2702,4 +2702,4 @@ error_not_enough_space:
 	MOVD R16, ret+24(FP)
 	RET
 
-// skipped sequenceDecs_decodeSync_safe_bmi2 (BMI2 not available on arm64)
+// skipped sequenceDecs_decodeSync_safe_bmi2 (generic twin preferred on arm64)
diff --git a/src/vendor/github.com/klauspost/compress/zstd/snappy.go b/src/vendor/github.com/klauspost/compress/zstd/snappy.go
index 336c2889..36c56f36 100644
--- a/src/vendor/github.com/klauspost/compress/zstd/snappy.go
+++ b/src/vendor/github.com/klauspost/compress/zstd/snappy.go
@@ -334,9 +334,10 @@ func decodeSnappy(blk *blockEnc, src []byte) error {
 
 				return errUnsupportedLiteralLength
 			}
-			//if length > snappyMaxBlockSize-d || uint32(length) > len(src)-s {
-			//	return ErrSnappyCorrupt
-			//}
+			if length > len(src)-s {
+				println("length > len(src)-s", length, len(src)-s)
+				return ErrSnappyCorrupt
+			}
 
 			blk.literals = append(blk.literals, src[s:s+length]...)
 			//println(length, "litLen")
diff --git a/src/vendor/github.com/mattn/go-isatty/isatty_others.go b/src/vendor/github.com/mattn/go-isatty/isatty_others.go
index b24a2fad..569113ea 100644
--- a/src/vendor/github.com/mattn/go-isatty/isatty_others.go
+++ b/src/vendor/github.com/mattn/go-isatty/isatty_others.go
@@ -1,5 +1,5 @@
-//go:build (appengine || js || nacl || tinygo || wasm || wasip1 || wasip2) && !windows
-// +build appengine js nacl tinygo wasm wasip1 wasip2
+//go:build (appengine || js || nacl || tinygo || wasm || wasip1 || wasip2 || haiku) && !windows
+// +build appengine js nacl tinygo wasm wasip1 wasip2 haiku
 // +build !windows
 
 package isatty
diff --git a/src/vendor/github.com/pressly/goose/v3/CHANGELOG.md b/src/vendor/github.com/pressly/goose/v3/CHANGELOG.md
index 900cf23b..315fe5ac 100644
--- a/src/vendor/github.com/pressly/goose/v3/CHANGELOG.md
+++ b/src/vendor/github.com/pressly/goose/v3/CHANGELOG.md
@@ -7,6 +7,12 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [v3.27.3] - 2026-07-22
+
+### Changed
+
+- Various dependency upgrades
+
 ## [v3.27.2] - 2026-06-30
 
 ### Changed
@@ -319,7 +325,8 @@ Here's a quick summary:
 - Add new `context.Context`-aware functions and methods, for both sql and go migrations.
 - Return error when no migration files found or dir is not a directory.
 
-[Unreleased]: https://github.com/pressly/goose/compare/v3.27.2...HEAD
+[Unreleased]: https://github.com/pressly/goose/compare/v3.27.3...HEAD
+[v3.27.3]: https://github.com/pressly/goose/compare/v3.27.2...v3.27.3
 [v3.27.2]: https://github.com/pressly/goose/compare/v3.27.1...v3.27.2
 [v3.27.1]: https://github.com/pressly/goose/compare/v3.27.0...v3.27.1
 [v3.27.0]: https://github.com/pressly/goose/compare/v3.26.0...v3.27.0
diff --git a/src/vendor/github.com/sethvargo/go-retry/README.md b/src/vendor/github.com/sethvargo/go-retry/README.md
index 47731828..3464965a 100644
--- a/src/vendor/github.com/sethvargo/go-retry/README.md
+++ b/src/vendor/github.com/sethvargo/go-retry/README.md
@@ -1,6 +1,6 @@
 # Retry
 
-[![GoDoc](https://img.shields.io/badge/go-documentation-blue.svg?style=flat-square)](https://pkg.go.dev/mod/github.com/sethvargo/go-retry)
+[![Test](https://github.com/sethvargo/go-retry/actions/workflows/test.yml/badge.svg)](https://github.com/sethvargo/go-retry/actions/workflows/test.yml)[![GoDoc](https://img.shields.io/badge/go-documentation-blue.svg?style=flat-square)](https://pkg.go.dev/mod/github.com/sethvargo/go-retry)
 
 Retry is a Go library for facilitating retry logic and backoff. It's highly
 extensible with full control over how and when retries occur. You can also write
@@ -115,7 +115,7 @@ also write custom middleware.
 
 ### Jitter
 
-To reduce the changes of a thundering herd, add random jitter to the returned
+To reduce the chances of a thundering herd, add random jitter to the returned
 value.
 
 ```golang
@@ -126,6 +126,9 @@ b = WithJitter(500*time.Millisecond, b)
 
 // Return the next value, +/- 5% of the result
 b = WithJitterPercent(5, b)
+
+// Return a random value in [0, next value)
+b = WithFullJitter(b)
 ```
 
 ### MaxRetries
@@ -178,8 +181,8 @@ Benchmark/sethvargo-7    203,914,245     5.73 ns/op
 
 ## Notes and Caveats
 
-- Randomization uses `math/rand` seeded with the Unix timestamp instead of
-  `crypto/rand`.
+- Randomization uses `math/rand/v2` (non-cryptographic, automatically seeded),
+  not `crypto/rand`.
 - Ordering of addition of multiple modifiers will make a difference.
   For example; ensure you add `CappedDuration` before `WithMaxDuration`, otherwise it may early out too early.
   Another example is you could add `Jitter` before or after capping depending on your desired outcome.
diff --git a/src/vendor/github.com/sethvargo/go-retry/backoff.go b/src/vendor/github.com/sethvargo/go-retry/backoff.go
index de3974fd..47f74753 100644
--- a/src/vendor/github.com/sethvargo/go-retry/backoff.go
+++ b/src/vendor/github.com/sethvargo/go-retry/backoff.go
@@ -1,6 +1,7 @@
 package retry
 
 import (
+	"math/rand/v2"
 	"sync"
 	"time"
 )
@@ -26,19 +27,18 @@ func (b BackoffFunc) Next() (time.Duration, bool) {
 // returned 20s, the value could be between 15 and 25 seconds. The value can
 // never be less than 0.
 func WithJitter(j time.Duration, next Backoff) Backoff {
-	r := newLockedRandom(time.Now().UnixNano())
-
 	return BackoffFunc(func() (time.Duration, bool) {
 		val, stop := next.Next()
 		if stop {
 			return 0, true
 		}
 
-		diff := time.Duration(r.Int63n(int64(j)*2) - int64(j))
-		val = val + diff
-		if val < 0 {
-			val = 0
+		if j <= 0 {
+			return val, false
 		}
+
+		diff := time.Duration(rand.Int64N(int64(j)*2) - int64(j))
+		val = max(val+diff, 0)
 		return val, false
 	})
 }
@@ -48,26 +48,48 @@ func WithJitter(j time.Duration, next Backoff) Backoff {
 // the backoff returned 20s, the value could be between 19 and 21 seconds. The
 // value can never be less than 0 or greater than 100.
 func WithJitterPercent(j uint64, next Backoff) Backoff {
-	r := newLockedRandom(time.Now().UnixNano())
-
 	return BackoffFunc(func() (time.Duration, bool) {
 		val, stop := next.Next()
 		if stop {
 			return 0, true
 		}
 
+		if j <= 0 {
+			return val, false
+		}
+
 		// Get a value between -j and j, the convert to a percentage
-		top := r.Int63n(int64(j)*2) - int64(j)
+		top := rand.Int64N(int64(j)*2) - int64(j)
 		pct := 1 - float64(top)/100.0
 
-		val = time.Duration(float64(val) * pct)
-		if val < 0 {
-			val = 0
-		}
+		val = max(time.Duration(float64(val)*pct), 0)
 		return val, false
 	})
 }
 
+// WithFullJitter wraps a backoff function and returns a random value between
+// zero (inclusive) and the wrapped backoff's returned value (exclusive). For
+// example, if the backoff returned 20s, the value could be anywhere in [0, 20s).
+//
+// Unlike WithJitter, which applies "+/- j" around the value, full jitter
+// spreads the wait across the entire range, which spreads out retrying clients
+// more effectively. See
+// https://aws.amazon.com/blogs/architecture/exponential-backoff-and-jitter/.
+func WithFullJitter(next Backoff) Backoff {
+	return BackoffFunc(func() (time.Duration, bool) {
+		val, stop := next.Next()
+		if stop {
+			return 0, true
+		}
+
+		if val <= 0 {
+			return val, false
+		}
+
+		return time.Duration(rand.Int64N(int64(val))), false
+	})
+}
+
 // WithMaxRetries executes the backoff function up until the maximum attempts.
 func WithMaxRetries(max uint64, next Backoff) Backoff {
 	var l sync.Mutex
diff --git a/src/vendor/github.com/sethvargo/go-retry/backoff_constant.go b/src/vendor/github.com/sethvargo/go-retry/backoff_constant.go
index ef01fa0a..e25ebf4b 100644
--- a/src/vendor/github.com/sethvargo/go-retry/backoff_constant.go
+++ b/src/vendor/github.com/sethvargo/go-retry/backoff_constant.go
@@ -13,7 +13,7 @@ func Constant(ctx context.Context, t time.Duration, f RetryFunc) error {
 
 // NewConstant creates a new constant backoff using the value t. The wait time
 // is the provided constant value. It panics if the given base is less than
-// zero.
+// or equal to zero.
 func NewConstant(t time.Duration) Backoff {
 	if t <= 0 {
 		panic("t must be greater than 0")
diff --git a/src/vendor/github.com/sethvargo/go-retry/backoff_exponential.go b/src/vendor/github.com/sethvargo/go-retry/backoff_exponential.go
index a85b498e..4fc2788a 100644
--- a/src/vendor/github.com/sethvargo/go-retry/backoff_exponential.go
+++ b/src/vendor/github.com/sethvargo/go-retry/backoff_exponential.go
@@ -9,7 +9,7 @@ import (
 
 type exponentialBackoff struct {
 	base    time.Duration
-	attempt uint64
+	attempt atomic.Uint64
 }
 
 // Exponential is a wrapper around Retry that uses an exponential backoff. See
@@ -37,11 +37,15 @@ func NewExponential(base time.Duration) Backoff {
 
 // Next implements Backoff. It is safe for concurrent use.
 func (b *exponentialBackoff) Next() (time.Duration, bool) {
-	next := b.base << (atomic.AddUint64(&b.attempt, 1) - 1)
-	if next <= 0 {
-		atomic.AddUint64(&b.attempt, ^uint64(0))
-		next = math.MaxInt64
-	}
+	for {
+		attempt := b.attempt.Load()
+		next := b.base << attempt
+		if next <= 0 {
+			return math.MaxInt64, false
+		}
 
-	return next, false
+		if b.attempt.CompareAndSwap(attempt, attempt+1) {
+			return next, false
+		}
+	}
 }
diff --git a/src/vendor/github.com/sethvargo/go-retry/backoff_fibonacci.go b/src/vendor/github.com/sethvargo/go-retry/backoff_fibonacci.go
index 250a026e..747bf408 100644
--- a/src/vendor/github.com/sethvargo/go-retry/backoff_fibonacci.go
+++ b/src/vendor/github.com/sethvargo/go-retry/backoff_fibonacci.go
@@ -5,13 +5,12 @@ import (
 	"math"
 	"sync/atomic"
 	"time"
-	"unsafe"
 )
 
 type state [2]time.Duration
 
 type fibonacciBackoff struct {
-	state unsafe.Pointer
+	state atomic.Pointer[state]
 }
 
 // Fibonacci is a wrapper around Retry that uses a Fibonacci backoff. See
@@ -33,23 +32,22 @@ func NewFibonacci(base time.Duration) Backoff {
 		panic("base must be greater than 0")
 	}
 
-	return &fibonacciBackoff{
-		state: unsafe.Pointer(&state{0, base}),
-	}
+	b := new(fibonacciBackoff)
+	b.state.Store(&state{0, base})
+	return b
 }
 
 // Next implements Backoff. It is safe for concurrent use.
 func (b *fibonacciBackoff) Next() (time.Duration, bool) {
 	for {
-		curr := atomic.LoadPointer(&b.state)
-		currState := (*state)(curr)
-		next := currState[0] + currState[1]
+		curr := b.state.Load()
+		next := curr[0] + curr[1]
 
 		if next <= 0 {
 			return math.MaxInt64, false
 		}
 
-		if atomic.CompareAndSwapPointer(&b.state, curr, unsafe.Pointer(&state{currState[1], next})) {
+		if b.state.CompareAndSwap(curr, &state{curr[1], next}) {
 			return next, false
 		}
 	}
diff --git a/src/vendor/github.com/sethvargo/go-retry/rand.go b/src/vendor/github.com/sethvargo/go-retry/rand.go
deleted file mode 100644
index 4799fb06..00000000
--- a/src/vendor/github.com/sethvargo/go-retry/rand.go
+++ /dev/null
@@ -1,54 +0,0 @@
-package retry
-
-import (
-	"math/rand"
-	"sync"
-)
-
-type lockedSource struct {
-	src *rand.Rand
-	mu  sync.Mutex
-}
-
-var _ rand.Source64 = (*lockedSource)(nil)
-
-func newLockedRandom(seed int64) *lockedSource {
-	return &lockedSource{src: rand.New(rand.NewSource(seed))}
-}
-
-// Int63 mimics math/rand.(*Rand).Int63 with mutex locked.
-func (r *lockedSource) Int63() int64 {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	return r.src.Int63()
-}
-
-// Seed mimics math/rand.(*Rand).Seed with mutex locked.
-func (r *lockedSource) Seed(seed int64) {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	r.src.Seed(seed)
-}
-
-// Uint64 mimics math/rand.(*Rand).Uint64 with mutex locked.
-func (r *lockedSource) Uint64() uint64 {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	return r.src.Uint64()
-}
-
-// Int63n mimics math/rand.(*Rand).Int63n with mutex locked.
-func (r *lockedSource) Int63n(n int64) int64 {
-	if n <= 0 {
-		panic("invalid argument to Int63n")
-	}
-	if n&(n-1) == 0 { // n is power of two, can mask
-		return r.Int63() & (n - 1)
-	}
-	max := int64((1 << 63) - 1 - (1<<63)%uint64(n))
-	v := r.Int63()
-	for v > max {
-		v = r.Int63()
-	}
-	return v % n
-}
diff --git a/src/vendor/github.com/sethvargo/go-retry/retry.go b/src/vendor/github.com/sethvargo/go-retry/retry.go
index a3eeadc1..46453a9f 100644
--- a/src/vendor/github.com/sethvargo/go-retry/retry.go
+++ b/src/vendor/github.com/sethvargo/go-retry/retry.go
@@ -54,10 +54,8 @@ func DoValue[T any](ctx context.Context, b Backoff, f RetryFuncValue[T]) (T, err
 
 	for {
 		// Return immediately if ctx is canceled
-		select {
-		case <-ctx.Done():
-			return nilT, ctx.Err()
-		default:
+		if err := context.Cause(ctx); err != nil {
+			return nilT, err
 		}
 
 		v, err := f(ctx)
@@ -76,20 +74,13 @@ func DoValue[T any](ctx context.Context, b Backoff, f RetryFuncValue[T]) (T, err
 			return nilT, rerr.Unwrap()
 		}
 
-		// ctx.Done() has priority, so we test it alone first
-		select {
-		case <-ctx.Done():
-			return nilT, ctx.Err()
-		default:
-		}
-
+		// Wait until next attempt or until the context expires. Any error will
+		// be caught at the top of the loop.
 		t := time.NewTimer(next)
 		select {
 		case <-ctx.Done():
 			t.Stop()
-			return nilT, ctx.Err()
 		case <-t.C:
-			continue
 		}
 	}
 }
diff --git a/src/vendor/github.com/valyala/fasthttp/coarseTime.go b/src/vendor/github.com/valyala/fasthttp/coarsetime.go
similarity index 100%
rename from src/vendor/github.com/valyala/fasthttp/coarseTime.go
rename to src/vendor/github.com/valyala/fasthttp/coarsetime.go
diff --git a/src/vendor/golang.org/x/crypto/acme/autocert/autocert.go b/src/vendor/golang.org/x/crypto/acme/autocert/autocert.go
index 69461e31..bee6de9c 100644
--- a/src/vendor/golang.org/x/crypto/acme/autocert/autocert.go
+++ b/src/vendor/golang.org/x/crypto/acme/autocert/autocert.go
@@ -564,24 +564,21 @@ func encodeECDSAKey(w io.Writer, key *ecdsa.PrivateKey) error {
 // If the domain is already being verified, it waits for the existing verification to complete.
 // Either way, createCert blocks for the duration of the whole process.
 func (m *Manager) createCert(ctx context.Context, ck certKey) (*tls.Certificate, error) {
-	// TODO: maybe rewrite this whole piece using sync.Once
-	state, err := m.certState(ck)
+	state, owner, err := m.certState(ck)
 	if err != nil {
 		return nil, err
 	}
-	// state may exist if another goroutine is already working on it
-	// in which case just wait for it to finish
-	if !state.locked {
+	// If another goroutine is already working on this state, wait for it
+	// to finish by taking the read lock
+	if !owner {
 		state.RLock()
 		defer state.RUnlock()
 		return state.tlscert()
 	}
 
-	// We are the first; state is locked.
-	// Unblock the readers when domain ownership is verified
-	// and we got the cert or the process failed.
+	// We are the first to work on this certKey, so state is write-locked.
+	// Unblock the readers when our work is complete.
 	defer state.Unlock()
-	state.locked = false
 
 	der, leaf, err := m.authorizedCert(ctx, state.key, ck)
 	if err != nil {
@@ -611,10 +608,15 @@ func (m *Manager) createCert(ctx context.Context, ck certKey) (*tls.Certificate,
 	return state.tlscert()
 }
 
-// certState returns a new or existing certState.
-// If a new certState is returned, state.exist is false and the state is locked.
+// certState returns a new or existing certState along with a boolean
+// indicating whether the caller is the owner of the state.
+//
+// The owner of the state is responsible for performing the ACME work and
+// must unlock the state's write lock when done. Non-owner callers should
+// wait on the state's read lock for the owner to finish.
+//
 // The returned error is non-nil only in the case where a new state could not be created.
-func (m *Manager) certState(ck certKey) (*certState, error) {
+func (m *Manager) certState(ck certKey) (*certState, bool, error) {
 	m.stateMu.Lock()
 	defer m.stateMu.Unlock()
 	if m.state == nil {
@@ -622,7 +624,7 @@ func (m *Manager) certState(ck certKey) (*certState, error) {
 	}
 	// existing state
 	if state, ok := m.state[ck]; ok {
-		return state, nil
+		return state, false, nil
 	}
 
 	// new locked state
@@ -636,16 +638,13 @@ func (m *Manager) certState(ck certKey) (*certState, error) {
 		key, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
 	}
 	if err != nil {
-		return nil, err
+		return nil, false, err
 	}
 
-	state := &certState{
-		key:    key,
-		locked: true,
-	}
+	state := &certState{key: key}
 	state.Lock() // will be unlocked by m.certState caller
 	m.state[ck] = state
-	return state, nil
+	return state, true, nil
 }
 
 // authorizedCert starts the domain ownership verification process and requests a new cert upon success.
@@ -1035,10 +1034,9 @@ func (m *Manager) now() time.Time {
 // certState is ready when its mutex is unlocked for reading.
 type certState struct {
 	sync.RWMutex
-	locked bool              // locked for read/write
-	key    crypto.Signer     // private key for cert
-	cert   [][]byte          // DER encoding
-	leaf   *x509.Certificate // parsed cert[0]; always non-nil if cert != nil
+	key  crypto.Signer     // private key for cert
+	cert [][]byte          // DER encoding
+	leaf *x509.Certificate // parsed cert[0]; always non-nil if cert != nil
 }
 
 // tlscert creates a tls.Certificate from s.key and s.cert.
diff --git a/src/vendor/golang.org/x/crypto/argon2/argon2.go b/src/vendor/golang.org/x/crypto/argon2/argon2.go
index 2b65ec91..57ab8371 100644
--- a/src/vendor/golang.org/x/crypto/argon2/argon2.go
+++ b/src/vendor/golang.org/x/crypto/argon2/argon2.go
@@ -17,8 +17,8 @@
 // It uses data-independent memory access, which is preferred for password
 // hashing and password-based key derivation. Argon2i requires more passes over
 // memory than Argon2id to protect from trade-off attacks. The recommended
-// parameters (taken from [RFC 9106 Section 7.3]) for non-interactive operations are time=3 and to
-// use the maximum available memory.
+// parameters (taken from [RFC 9106 Section 7.3]) for non-interactive
+// operations are time=3 and to use the maximum available memory.
 //
 // # Argon2id
 //
@@ -26,11 +26,14 @@
 // Argon2i and Argon2d. It uses data-independent memory access for the first
 // half of the first iteration over the memory and data-dependent memory access
 // for the rest. Argon2id is side-channel resistant and provides better brute-
-// force cost savings due to time-memory tradeoffs than Argon2i. The recommended
-// parameters for non-interactive operations (taken from [RFC 9106 Section 7.3]) are time=1 and to
-// use the maximum available memory.
+// force cost savings due to time-memory tradeoffs than Argon2i. [RFC 9106
+// Section 4] recommends time=1, memory=2*1024*1024 KiB (2 GiB), and threads=4
+// as the first recommended option. If much less memory is available, it
+// recommends time=3, memory=64*1024 KiB (64 MiB), and threads=4 as the second
+// recommended option.
 //
 // [argon2-specs.pdf]: https://github.com/P-H-C/phc-winner-argon2/blob/master/argon2-specs.pdf
+// [RFC 9106 Section 4]: https://www.rfc-editor.org/rfc/rfc9106.html#section-4
 // [RFC 9106 Section 7.3]: https://www.rfc-editor.org/rfc/rfc9106.html#section-7.3
 package argon2
 
@@ -59,9 +62,9 @@ const (
 //
 //	key := argon2.Key([]byte("some password"), salt, 3, 32*1024, 4, 32)
 //
-// [RFC 9106 Section 7.3] recommends time=3, and memory=32*1024 as a sensible number.
-// If using that amount of memory (32 MB) is not possible in some contexts then
-// the time parameter can be increased to compensate.
+// The example above uses time=3 and memory=32*1024. Argon2i generally
+// requires more passes over memory than Argon2id. If in doubt, prefer IDKey
+// and its Argon2id parameter recommendations.
 //
 // The time parameter specifies the number of passes over the memory and the
 // memory parameter specifies the size of the memory in KiB. For example
@@ -69,8 +72,6 @@ const (
 // adjusted to the number of available CPUs. The cost parameters should be
 // increased as memory latency and CPU parallelism increases. Remember to get a
 // good random salt.
-//
-// [RFC 9106 Section 7.3]: https://www.rfc-editor.org/rfc/rfc9106.html#section-7.3
 func Key(password, salt []byte, time, memory uint32, threads uint8, keyLen uint32) []byte {
 	return deriveKey(argon2i, password, salt, nil, nil, time, memory, threads, keyLen)
 }
@@ -83,20 +84,20 @@ func Key(password, salt []byte, time, memory uint32, threads uint8, keyLen uint3
 // For example, you can get a derived key for e.g. AES-256 (which needs a
 // 32-byte key) by doing:
 //
-//	key := argon2.IDKey([]byte("some password"), salt, 1, 64*1024, 4, 32)
+//	key := argon2.IDKey([]byte("some password"), salt, 1, 2*1024*1024, 4, 32)
 //
-// [RFC 9106 Section 7.3] recommends time=1, and memory=64*1024 as a sensible number.
-// If using that amount of memory (64 MB) is not possible in some contexts then
-// the time parameter can be increased to compensate.
+// The example above uses the first [RFC 9106 Section 4] recommended option.
+// If much less memory is available, the second recommended option is time=3,
+// memory=64*1024 KiB (64 MiB), and threads=4.
 //
 // The time parameter specifies the number of passes over the memory and the
 // memory parameter specifies the size of the memory in KiB. For example
-// memory=64*1024 sets the memory cost to ~64 MB. The number of threads can be
-// adjusted to the numbers of available CPUs. The cost parameters should be
+// memory=2*1024*1024 sets the memory cost to ~2 GiB. The number of threads can
+// be adjusted to the numbers of available CPUs. The cost parameters should be
 // increased as memory latency and CPU parallelism increases. Remember to get a
 // good random salt.
 //
-// [RFC 9106 Section 7.3]: https://www.rfc-editor.org/rfc/rfc9106.html#section-7.3
+// [RFC 9106 Section 4]: https://www.rfc-editor.org/rfc/rfc9106.html#section-4
 func IDKey(password, salt []byte, time, memory uint32, threads uint8, keyLen uint32) []byte {
 	return deriveKey(argon2id, password, salt, nil, nil, time, memory, threads, keyLen)
 }
diff --git a/src/vendor/golang.org/x/net/idna/idna.go b/src/vendor/golang.org/x/net/idna/idna.go
index 22767125..e2f28fed 100644
--- a/src/vendor/golang.org/x/net/idna/idna.go
+++ b/src/vendor/golang.org/x/net/idna/idna.go
@@ -400,7 +400,11 @@ func (p *Profile) process(s string, toASCII bool) (string, error) {
 				// Spec says keep the old label.
 				continue
 			}
-			if unicode16 && err == nil && len(u) > 0 && isASCII(u) {
+			if err == nil && len(u) > 0 && isASCII(u) {
+				// UTS 43 pre-revision 33 doesn't classify a xn-- label
+				// which contains only ASCII characters as an error,
+				// but that's a specification bug and a security issue.
+				// Always return an error in this case.
 				err = punyError(enc)
 			}
 			isBidi = isBidi || bidirule.DirectionString(u) != bidi.LeftToRight
diff --git a/src/vendor/golang.org/x/sys/cpu/parse.go b/src/vendor/golang.org/x/sys/cpu/parse.go
index 56a7e1a1..12a99af5 100644
--- a/src/vendor/golang.org/x/sys/cpu/parse.go
+++ b/src/vendor/golang.org/x/sys/cpu/parse.go
@@ -6,38 +6,50 @@ package cpu
 
 import "strconv"
 
-// parseRelease parses a dot-separated version number. It follows the semver
-// syntax, but allows the minor and patch versions to be elided.
+// parseRelease parses a dot-separated version number from the prefix
+// of rel. It returns ok=true only if at least the major and minor
+// components were successfully parsed; the patch component is
+// best-effort. Trailing vendor or build suffixes such as
+// "-generic", "+", "_hi3535", or "-rc1" are ignored.
 //
 // This is a copy of the Go runtime's parseRelease from
-// https://golang.org/cl/209597.
+// https://golang.org/cl/209597, updated in https://golang.org/cl/781800.
 func parseRelease(rel string) (major, minor, patch int, ok bool) {
-	// Strip anything after a dash or plus.
-	for i := range len(rel) {
-		if rel[i] == '-' || rel[i] == '+' {
-			rel = rel[:i]
-			break
+	// next consumes a run of decimal digits from the front of rel,
+	// returning the parsed value. If the digits are followed by a
+	// '.', it is consumed and more is set so the caller knows to
+	// parse another component; otherwise scanning terminates and
+	// the rest of rel is discarded.
+	next := func() (n int, more, ok bool) {
+		i := 0
+		for i < len(rel) && rel[i] >= '0' && rel[i] <= '9' {
+			i++
 		}
-	}
-
-	next := func() (int, bool) {
-		for i := range len(rel) {
-			if rel[i] == '.' {
-				ver, err := strconv.Atoi(rel[:i])
-				rel = rel[i+1:]
-				return ver, err == nil
-			}
+		if i == 0 {
+			return 0, false, false
+		}
+		n, err := strconv.Atoi(rel[:i])
+		if err != nil {
+			return 0, false, false
+		}
+		if i < len(rel) && rel[i] == '.' {
+			rel = rel[i+1:]
+			return n, true, true
 		}
-		ver, err := strconv.Atoi(rel)
 		rel = ""
-		return ver, err == nil
+		return n, false, true
+	}
+
+	var more bool
+	if major, more, ok = next(); !ok || !more {
+		return 0, 0, 0, false
 	}
-	if major, ok = next(); !ok || rel == "" {
-		return
+	if minor, more, ok = next(); !ok {
+		return 0, 0, 0, false
 	}
-	if minor, ok = next(); !ok || rel == "" {
-		return
+	if !more {
+		return major, minor, 0, true
 	}
-	patch, ok = next()
-	return
+	patch, _, _ = next()
+	return major, minor, patch, true
 }
diff --git a/src/vendor/golang.org/x/sys/unix/syscall_linux.go b/src/vendor/golang.org/x/sys/unix/syscall_linux.go
index ce4d7ab1..21e2bfa3 100644
--- a/src/vendor/golang.org/x/sys/unix/syscall_linux.go
+++ b/src/vendor/golang.org/x/sys/unix/syscall_linux.go
@@ -1874,6 +1874,7 @@ func Dup2(oldfd, newfd int) error {
 //sys	Dup3(oldfd int, newfd int, flags int) (err error)
 //sysnb	EpollCreate1(flag int) (fd int, err error)
 //sysnb	EpollCtl(epfd int, op int, fd int, event *EpollEvent) (err error)
+//sys	EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) = SYS_EPOLL_PWAIT
 //sys	Eventfd(initval uint, flags int) (fd int, err error) = SYS_EVENTFD2
 //sys	Exit(code int) = SYS_EXIT_GROUP
 //sys	Fallocate(fd int, mode uint32, off int64, len int64) (err error)
diff --git a/src/vendor/golang.org/x/sys/unix/syscall_linux_386.go b/src/vendor/golang.org/x/sys/unix/syscall_linux_386.go
index 506dafa7..210d545c 100644
--- a/src/vendor/golang.org/x/sys/unix/syscall_linux_386.go
+++ b/src/vendor/golang.org/x/sys/unix/syscall_linux_386.go
@@ -20,7 +20,6 @@ func setTimeval(sec, usec int64) Timeval {
 
 // 64-bit file system and 32-bit uid calls
 // (386 default is 32-bit file system and 16-bit uid).
-//sys	EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error)
 //sys	Fadvise(fd int, offset int64, length int64, advice int) (err error) = SYS_FADVISE64_64
 //sys	Fchown(fd int, uid int, gid int) (err error) = SYS_FCHOWN32
 //sys	Fstat(fd int, stat *Stat_t) (err error) = SYS_FSTAT64
diff --git a/src/vendor/golang.org/x/sys/unix/syscall_linux_amd64.go b/src/vendor/golang.org/x/sys/unix/syscall_linux_amd64.go
index d557cf8d..a9a52f23 100644
--- a/src/vendor/golang.org/x/sys/unix/syscall_linux_amd64.go
+++ b/src/vendor/golang.org/x/sys/unix/syscall_linux_amd64.go
@@ -6,7 +6,6 @@
 
 package unix
 
-//sys	EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error)
 //sys	Fadvise(fd int, offset int64, length int64, advice int) (err error) = SYS_FADVISE64
 //sys	Fchown(fd int, uid int, gid int) (err error)
 //sys	Fstat(fd int, stat *Stat_t) (err error)
diff --git a/src/vendor/golang.org/x/sys/unix/syscall_linux_arm.go b/src/vendor/golang.org/x/sys/unix/syscall_linux_arm.go
index ecf92bfa..54474c20 100644
--- a/src/vendor/golang.org/x/sys/unix/syscall_linux_arm.go
+++ b/src/vendor/golang.org/x/sys/unix/syscall_linux_arm.go
@@ -44,7 +44,6 @@ func Seek(fd int, offset int64, whence int) (newoffset int64, err error) {
 
 // 64-bit file system and 32-bit uid calls
 // (16-bit uid calls are not always supported in newer kernels)
-//sys	EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error)
 //sys	Fchown(fd int, uid int, gid int) (err error) = SYS_FCHOWN32
 //sys	Fstat(fd int, stat *Stat_t) (err error) = SYS_FSTAT64
 //sys	Fstatat(dirfd int, path string, stat *Stat_t, flags int) (err error) = SYS_FSTATAT64
diff --git a/src/vendor/golang.org/x/sys/unix/syscall_linux_arm64.go b/src/vendor/golang.org/x/sys/unix/syscall_linux_arm64.go
index 17373807..e9f30db9 100644
--- a/src/vendor/golang.org/x/sys/unix/syscall_linux_arm64.go
+++ b/src/vendor/golang.org/x/sys/unix/syscall_linux_arm64.go
@@ -8,7 +8,6 @@ package unix
 
 import "unsafe"
 
-//sys	EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) = SYS_EPOLL_PWAIT
 //sys	Fadvise(fd int, offset int64, length int64, advice int) (err error) = SYS_FADVISE64
 //sys	Fchown(fd int, uid int, gid int) (err error)
 //sys	Fstat(fd int, stat *Stat_t) (err error)
diff --git a/src/vendor/golang.org/x/sys/unix/syscall_linux_loong64.go b/src/vendor/golang.org/x/sys/unix/syscall_linux_loong64.go
index a3fd1d0b..6f09ca20 100644
--- a/src/vendor/golang.org/x/sys/unix/syscall_linux_loong64.go
+++ b/src/vendor/golang.org/x/sys/unix/syscall_linux_loong64.go
@@ -8,7 +8,6 @@ package unix
 
 import "unsafe"
 
-//sys	EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) = SYS_EPOLL_PWAIT
 //sys	Fadvise(fd int, offset int64, length int64, advice int) (err error) = SYS_FADVISE64
 //sys	Fchown(fd int, uid int, gid int) (err error)
 //sys	Fstatfs(fd int, buf *Statfs_t) (err error)
diff --git a/src/vendor/golang.org/x/sys/unix/syscall_linux_mips64x.go b/src/vendor/golang.org/x/sys/unix/syscall_linux_mips64x.go
index 70963a95..ca3b5659 100644
--- a/src/vendor/golang.org/x/sys/unix/syscall_linux_mips64x.go
+++ b/src/vendor/golang.org/x/sys/unix/syscall_linux_mips64x.go
@@ -6,7 +6,6 @@
 
 package unix
 
-//sys	EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error)
 //sys	Fadvise(fd int, offset int64, length int64, advice int) (err error) = SYS_FADVISE64
 //sys	Fchown(fd int, uid int, gid int) (err error)
 //sys	Fstatfs(fd int, buf *Statfs_t) (err error)
diff --git a/src/vendor/golang.org/x/sys/unix/syscall_linux_mipsx.go b/src/vendor/golang.org/x/sys/unix/syscall_linux_mipsx.go
index c218ebd2..54ba667b 100644
--- a/src/vendor/golang.org/x/sys/unix/syscall_linux_mipsx.go
+++ b/src/vendor/golang.org/x/sys/unix/syscall_linux_mipsx.go
@@ -13,7 +13,6 @@ import (
 
 func Syscall9(trap, a1, a2, a3, a4, a5, a6, a7, a8, a9 uintptr) (r1, r2 uintptr, err syscall.Errno)
 
-//sys	EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error)
 //sys	Fadvise(fd int, offset int64, length int64, advice int) (err error) = SYS_FADVISE64
 //sys	Fchown(fd int, uid int, gid int) (err error)
 //sys	Ftruncate(fd int, length int64) (err error) = SYS_FTRUNCATE64
diff --git a/src/vendor/golang.org/x/sys/unix/syscall_linux_ppc.go b/src/vendor/golang.org/x/sys/unix/syscall_linux_ppc.go
index e6c48500..ce462859 100644
--- a/src/vendor/golang.org/x/sys/unix/syscall_linux_ppc.go
+++ b/src/vendor/golang.org/x/sys/unix/syscall_linux_ppc.go
@@ -11,7 +11,6 @@ import (
 	"unsafe"
 )
 
-//sys	EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error)
 //sys	Fchown(fd int, uid int, gid int) (err error)
 //sys	Fstat(fd int, stat *Stat_t) (err error) = SYS_FSTAT64
 //sys	Fstatat(dirfd int, path string, stat *Stat_t, flags int) (err error) = SYS_FSTATAT64
diff --git a/src/vendor/golang.org/x/sys/unix/syscall_linux_ppc64x.go b/src/vendor/golang.org/x/sys/unix/syscall_linux_ppc64x.go
index 7286a9aa..33f7af38 100644
--- a/src/vendor/golang.org/x/sys/unix/syscall_linux_ppc64x.go
+++ b/src/vendor/golang.org/x/sys/unix/syscall_linux_ppc64x.go
@@ -6,7 +6,6 @@
 
 package unix
 
-//sys	EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error)
 //sys	Fadvise(fd int, offset int64, length int64, advice int) (err error) = SYS_FADVISE64
 //sys	Fchown(fd int, uid int, gid int) (err error)
 //sys	Fstat(fd int, stat *Stat_t) (err error)
diff --git a/src/vendor/golang.org/x/sys/unix/syscall_linux_riscv64.go b/src/vendor/golang.org/x/sys/unix/syscall_linux_riscv64.go
index fc5543c5..c658871e 100644
--- a/src/vendor/golang.org/x/sys/unix/syscall_linux_riscv64.go
+++ b/src/vendor/golang.org/x/sys/unix/syscall_linux_riscv64.go
@@ -8,7 +8,6 @@ package unix
 
 import "unsafe"
 
-//sys	EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) = SYS_EPOLL_PWAIT
 //sys	Fadvise(fd int, offset int64, length int64, advice int) (err error) = SYS_FADVISE64
 //sys	Fchown(fd int, uid int, gid int) (err error)
 //sys	Fstat(fd int, stat *Stat_t) (err error)
diff --git a/src/vendor/golang.org/x/sys/unix/syscall_linux_s390x.go b/src/vendor/golang.org/x/sys/unix/syscall_linux_s390x.go
index 66f31210..2c858769 100644
--- a/src/vendor/golang.org/x/sys/unix/syscall_linux_s390x.go
+++ b/src/vendor/golang.org/x/sys/unix/syscall_linux_s390x.go
@@ -10,7 +10,6 @@ import (
 	"unsafe"
 )
 
-//sys	EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error)
 //sys	Fadvise(fd int, offset int64, length int64, advice int) (err error) = SYS_FADVISE64
 //sys	Fchown(fd int, uid int, gid int) (err error)
 //sys	Fstat(fd int, stat *Stat_t) (err error)
diff --git a/src/vendor/golang.org/x/sys/unix/syscall_linux_sparc64.go b/src/vendor/golang.org/x/sys/unix/syscall_linux_sparc64.go
index 11d1f169..4964119a 100644
--- a/src/vendor/golang.org/x/sys/unix/syscall_linux_sparc64.go
+++ b/src/vendor/golang.org/x/sys/unix/syscall_linux_sparc64.go
@@ -6,7 +6,6 @@
 
 package unix
 
-//sys	EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error)
 //sys	Fadvise(fd int, offset int64, length int64, advice int) (err error) = SYS_FADVISE64
 //sys	Fchown(fd int, uid int, gid int) (err error)
 //sys	Fstat(fd int, stat *Stat_t) (err error)
diff --git a/src/vendor/golang.org/x/sys/unix/zerrors_linux.go b/src/vendor/golang.org/x/sys/unix/zerrors_linux.go
index 9d72a6b7..5bb51d7a 100644
--- a/src/vendor/golang.org/x/sys/unix/zerrors_linux.go
+++ b/src/vendor/golang.org/x/sys/unix/zerrors_linux.go
@@ -1359,6 +1359,7 @@ const (
 	FAN_UNLIMITED_MARKS                         = 0x20
 	FAN_UNLIMITED_QUEUE                         = 0x10
 	FD_CLOEXEC                                  = 0x1
+	FD_PIDFS_ROOT                               = -0x2712
 	FD_SETSIZE                                  = 0x400
 	FF0                                         = 0x0
 	FIB_RULE_DEV_DETACHED                       = 0x8
@@ -1970,6 +1971,8 @@ const (
 	MADV_DONTNEED                               = 0x4
 	MADV_DONTNEED_LOCKED                        = 0x18
 	MADV_FREE                                   = 0x8
+	MADV_GUARD_INSTALL                          = 0x66
+	MADV_GUARD_REMOVE                           = 0x67
 	MADV_HUGEPAGE                               = 0xe
 	MADV_HWPOISON                               = 0x64
 	MADV_KEEPONFORK                             = 0x13
@@ -2114,7 +2117,7 @@ const (
 	MS_NOSEC                                    = 0x10000000
 	MS_NOSUID                                   = 0x2
 	MS_NOSYMFOLLOW                              = 0x100
-	MS_NOUSER                                   = -0x80000000
+	MS_NOUSER                                   = 0x80000000
 	MS_POSIXACL                                 = 0x10000
 	MS_PRIVATE                                  = 0x40000
 	MS_RDONLY                                   = 0x1
@@ -3786,6 +3789,9 @@ const (
 	TCPOPT_TIMESTAMP                            = 0x8
 	TCPOPT_TSTAMP_HDR                           = 0x101080a
 	TCPOPT_WINDOW                               = 0x3
+	TCP_AO_KEYF_EXCLUDE_OPT                     = 0x2
+	TCP_AO_KEYF_IFINDEX                         = 0x1
+	TCP_AO_MAXKEYLEN                            = 0x50
 	TCP_CC_INFO                                 = 0x1a
 	TCP_CM_INQ                                  = 0x24
 	TCP_CONGESTION                              = 0xd
diff --git a/src/vendor/golang.org/x/sys/unix/zsyscall_linux.go b/src/vendor/golang.org/x/sys/unix/zsyscall_linux.go
index 80f40e40..5788c2a5 100644
--- a/src/vendor/golang.org/x/sys/unix/zsyscall_linux.go
+++ b/src/vendor/golang.org/x/sys/unix/zsyscall_linux.go
@@ -700,6 +700,23 @@ func EpollCtl(epfd int, op int, fd int, event *EpollEvent) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) {
+	var _p0 unsafe.Pointer
+	if len(events) > 0 {
+		_p0 = unsafe.Pointer(&events[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := Syscall6(SYS_EPOLL_PWAIT, uintptr(epfd), uintptr(_p0), uintptr(len(events)), uintptr(msec), 0, 0)
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Eventfd(initval uint, flags int) (fd int, err error) {
 	r0, _, e1 := Syscall(SYS_EVENTFD2, uintptr(initval), uintptr(flags), 0)
 	fd = int(r0)
diff --git a/src/vendor/golang.org/x/sys/unix/zsyscall_linux_386.go b/src/vendor/golang.org/x/sys/unix/zsyscall_linux_386.go
index 4def3e9f..254f3398 100644
--- a/src/vendor/golang.org/x/sys/unix/zsyscall_linux_386.go
+++ b/src/vendor/golang.org/x/sys/unix/zsyscall_linux_386.go
@@ -45,23 +45,6 @@ func Tee(rfd int, wfd int, len int, flags int) (n int64, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) {
-	var _p0 unsafe.Pointer
-	if len(events) > 0 {
-		_p0 = unsafe.Pointer(&events[0])
-	} else {
-		_p0 = unsafe.Pointer(&_zero)
-	}
-	r0, _, e1 := Syscall6(SYS_EPOLL_WAIT, uintptr(epfd), uintptr(_p0), uintptr(len(events)), uintptr(msec), 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall6(SYS_FADVISE64_64, uintptr(fd), uintptr(offset), uintptr(offset>>32), uintptr(length), uintptr(length>>32), uintptr(advice))
 	if e1 != 0 {
diff --git a/src/vendor/golang.org/x/sys/unix/zsyscall_linux_amd64.go b/src/vendor/golang.org/x/sys/unix/zsyscall_linux_amd64.go
index fef2bc8b..27c05db1 100644
--- a/src/vendor/golang.org/x/sys/unix/zsyscall_linux_amd64.go
+++ b/src/vendor/golang.org/x/sys/unix/zsyscall_linux_amd64.go
@@ -45,23 +45,6 @@ func Tee(rfd int, wfd int, len int, flags int) (n int64, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) {
-	var _p0 unsafe.Pointer
-	if len(events) > 0 {
-		_p0 = unsafe.Pointer(&events[0])
-	} else {
-		_p0 = unsafe.Pointer(&_zero)
-	}
-	r0, _, e1 := Syscall6(SYS_EPOLL_WAIT, uintptr(epfd), uintptr(_p0), uintptr(len(events)), uintptr(msec), 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall6(SYS_FADVISE64, uintptr(fd), uintptr(offset), uintptr(length), uintptr(advice), 0, 0)
 	if e1 != 0 {
diff --git a/src/vendor/golang.org/x/sys/unix/zsyscall_linux_arm.go b/src/vendor/golang.org/x/sys/unix/zsyscall_linux_arm.go
index a9fd76a8..840d85bf 100644
--- a/src/vendor/golang.org/x/sys/unix/zsyscall_linux_arm.go
+++ b/src/vendor/golang.org/x/sys/unix/zsyscall_linux_arm.go
@@ -213,23 +213,6 @@ func sendmsg(s int, msg *Msghdr, flags int) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) {
-	var _p0 unsafe.Pointer
-	if len(events) > 0 {
-		_p0 = unsafe.Pointer(&events[0])
-	} else {
-		_p0 = unsafe.Pointer(&_zero)
-	}
-	r0, _, e1 := Syscall6(SYS_EPOLL_WAIT, uintptr(epfd), uintptr(_p0), uintptr(len(events)), uintptr(msec), 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fchown(fd int, uid int, gid int) (err error) {
 	_, _, e1 := Syscall(SYS_FCHOWN32, uintptr(fd), uintptr(uid), uintptr(gid))
 	if e1 != 0 {
diff --git a/src/vendor/golang.org/x/sys/unix/zsyscall_linux_arm64.go b/src/vendor/golang.org/x/sys/unix/zsyscall_linux_arm64.go
index 46006502..fe414498 100644
--- a/src/vendor/golang.org/x/sys/unix/zsyscall_linux_arm64.go
+++ b/src/vendor/golang.org/x/sys/unix/zsyscall_linux_arm64.go
@@ -45,23 +45,6 @@ func Tee(rfd int, wfd int, len int, flags int) (n int64, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) {
-	var _p0 unsafe.Pointer
-	if len(events) > 0 {
-		_p0 = unsafe.Pointer(&events[0])
-	} else {
-		_p0 = unsafe.Pointer(&_zero)
-	}
-	r0, _, e1 := Syscall6(SYS_EPOLL_PWAIT, uintptr(epfd), uintptr(_p0), uintptr(len(events)), uintptr(msec), 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall6(SYS_FADVISE64, uintptr(fd), uintptr(offset), uintptr(length), uintptr(advice), 0, 0)
 	if e1 != 0 {
diff --git a/src/vendor/golang.org/x/sys/unix/zsyscall_linux_loong64.go b/src/vendor/golang.org/x/sys/unix/zsyscall_linux_loong64.go
index c8987d26..eb358ce0 100644
--- a/src/vendor/golang.org/x/sys/unix/zsyscall_linux_loong64.go
+++ b/src/vendor/golang.org/x/sys/unix/zsyscall_linux_loong64.go
@@ -45,23 +45,6 @@ func Tee(rfd int, wfd int, len int, flags int) (n int64, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) {
-	var _p0 unsafe.Pointer
-	if len(events) > 0 {
-		_p0 = unsafe.Pointer(&events[0])
-	} else {
-		_p0 = unsafe.Pointer(&_zero)
-	}
-	r0, _, e1 := Syscall6(SYS_EPOLL_PWAIT, uintptr(epfd), uintptr(_p0), uintptr(len(events)), uintptr(msec), 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall6(SYS_FADVISE64, uintptr(fd), uintptr(offset), uintptr(length), uintptr(advice), 0, 0)
 	if e1 != 0 {
diff --git a/src/vendor/golang.org/x/sys/unix/zsyscall_linux_mips.go b/src/vendor/golang.org/x/sys/unix/zsyscall_linux_mips.go
index 921f4306..c437622f 100644
--- a/src/vendor/golang.org/x/sys/unix/zsyscall_linux_mips.go
+++ b/src/vendor/golang.org/x/sys/unix/zsyscall_linux_mips.go
@@ -45,23 +45,6 @@ func Tee(rfd int, wfd int, len int, flags int) (n int64, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) {
-	var _p0 unsafe.Pointer
-	if len(events) > 0 {
-		_p0 = unsafe.Pointer(&events[0])
-	} else {
-		_p0 = unsafe.Pointer(&_zero)
-	}
-	r0, _, e1 := Syscall6(SYS_EPOLL_WAIT, uintptr(epfd), uintptr(_p0), uintptr(len(events)), uintptr(msec), 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall9(SYS_FADVISE64, uintptr(fd), 0, uintptr(offset>>32), uintptr(offset), uintptr(length>>32), uintptr(length), uintptr(advice), 0, 0)
 	if e1 != 0 {
diff --git a/src/vendor/golang.org/x/sys/unix/zsyscall_linux_mips64.go b/src/vendor/golang.org/x/sys/unix/zsyscall_linux_mips64.go
index 44f06782..bc4ca255 100644
--- a/src/vendor/golang.org/x/sys/unix/zsyscall_linux_mips64.go
+++ b/src/vendor/golang.org/x/sys/unix/zsyscall_linux_mips64.go
@@ -45,23 +45,6 @@ func Tee(rfd int, wfd int, len int, flags int) (n int64, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) {
-	var _p0 unsafe.Pointer
-	if len(events) > 0 {
-		_p0 = unsafe.Pointer(&events[0])
-	} else {
-		_p0 = unsafe.Pointer(&_zero)
-	}
-	r0, _, e1 := Syscall6(SYS_EPOLL_WAIT, uintptr(epfd), uintptr(_p0), uintptr(len(events)), uintptr(msec), 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall6(SYS_FADVISE64, uintptr(fd), uintptr(offset), uintptr(length), uintptr(advice), 0, 0)
 	if e1 != 0 {
diff --git a/src/vendor/golang.org/x/sys/unix/zsyscall_linux_mips64le.go b/src/vendor/golang.org/x/sys/unix/zsyscall_linux_mips64le.go
index e7fa0abf..5051435c 100644
--- a/src/vendor/golang.org/x/sys/unix/zsyscall_linux_mips64le.go
+++ b/src/vendor/golang.org/x/sys/unix/zsyscall_linux_mips64le.go
@@ -45,23 +45,6 @@ func Tee(rfd int, wfd int, len int, flags int) (n int64, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) {
-	var _p0 unsafe.Pointer
-	if len(events) > 0 {
-		_p0 = unsafe.Pointer(&events[0])
-	} else {
-		_p0 = unsafe.Pointer(&_zero)
-	}
-	r0, _, e1 := Syscall6(SYS_EPOLL_WAIT, uintptr(epfd), uintptr(_p0), uintptr(len(events)), uintptr(msec), 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall6(SYS_FADVISE64, uintptr(fd), uintptr(offset), uintptr(length), uintptr(advice), 0, 0)
 	if e1 != 0 {
diff --git a/src/vendor/golang.org/x/sys/unix/zsyscall_linux_mipsle.go b/src/vendor/golang.org/x/sys/unix/zsyscall_linux_mipsle.go
index 8c512567..33aa5418 100644
--- a/src/vendor/golang.org/x/sys/unix/zsyscall_linux_mipsle.go
+++ b/src/vendor/golang.org/x/sys/unix/zsyscall_linux_mipsle.go
@@ -45,23 +45,6 @@ func Tee(rfd int, wfd int, len int, flags int) (n int64, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) {
-	var _p0 unsafe.Pointer
-	if len(events) > 0 {
-		_p0 = unsafe.Pointer(&events[0])
-	} else {
-		_p0 = unsafe.Pointer(&_zero)
-	}
-	r0, _, e1 := Syscall6(SYS_EPOLL_WAIT, uintptr(epfd), uintptr(_p0), uintptr(len(events)), uintptr(msec), 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall9(SYS_FADVISE64, uintptr(fd), 0, uintptr(offset), uintptr(offset>>32), uintptr(length), uintptr(length>>32), uintptr(advice), 0, 0)
 	if e1 != 0 {
diff --git a/src/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc.go b/src/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc.go
index 7392fd45..3bef8ef1 100644
--- a/src/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc.go
+++ b/src/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc.go
@@ -45,23 +45,6 @@ func Tee(rfd int, wfd int, len int, flags int) (n int64, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) {
-	var _p0 unsafe.Pointer
-	if len(events) > 0 {
-		_p0 = unsafe.Pointer(&events[0])
-	} else {
-		_p0 = unsafe.Pointer(&_zero)
-	}
-	r0, _, e1 := Syscall6(SYS_EPOLL_WAIT, uintptr(epfd), uintptr(_p0), uintptr(len(events)), uintptr(msec), 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fchown(fd int, uid int, gid int) (err error) {
 	_, _, e1 := Syscall(SYS_FCHOWN, uintptr(fd), uintptr(uid), uintptr(gid))
 	if e1 != 0 {
diff --git a/src/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc64.go b/src/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc64.go
index 41180434..fc1bd4e2 100644
--- a/src/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc64.go
+++ b/src/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc64.go
@@ -45,23 +45,6 @@ func Tee(rfd int, wfd int, len int, flags int) (n int64, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) {
-	var _p0 unsafe.Pointer
-	if len(events) > 0 {
-		_p0 = unsafe.Pointer(&events[0])
-	} else {
-		_p0 = unsafe.Pointer(&_zero)
-	}
-	r0, _, e1 := Syscall6(SYS_EPOLL_WAIT, uintptr(epfd), uintptr(_p0), uintptr(len(events)), uintptr(msec), 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall6(SYS_FADVISE64, uintptr(fd), uintptr(offset), uintptr(length), uintptr(advice), 0, 0)
 	if e1 != 0 {
diff --git a/src/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc64le.go b/src/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc64le.go
index 40c6ce7a..d78fe7da 100644
--- a/src/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc64le.go
+++ b/src/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc64le.go
@@ -45,23 +45,6 @@ func Tee(rfd int, wfd int, len int, flags int) (n int64, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) {
-	var _p0 unsafe.Pointer
-	if len(events) > 0 {
-		_p0 = unsafe.Pointer(&events[0])
-	} else {
-		_p0 = unsafe.Pointer(&_zero)
-	}
-	r0, _, e1 := Syscall6(SYS_EPOLL_WAIT, uintptr(epfd), uintptr(_p0), uintptr(len(events)), uintptr(msec), 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall6(SYS_FADVISE64, uintptr(fd), uintptr(offset), uintptr(length), uintptr(advice), 0, 0)
 	if e1 != 0 {
diff --git a/src/vendor/golang.org/x/sys/unix/zsyscall_linux_riscv64.go b/src/vendor/golang.org/x/sys/unix/zsyscall_linux_riscv64.go
index 2cfe34ad..76dcf87d 100644
--- a/src/vendor/golang.org/x/sys/unix/zsyscall_linux_riscv64.go
+++ b/src/vendor/golang.org/x/sys/unix/zsyscall_linux_riscv64.go
@@ -45,23 +45,6 @@ func Tee(rfd int, wfd int, len int, flags int) (n int64, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) {
-	var _p0 unsafe.Pointer
-	if len(events) > 0 {
-		_p0 = unsafe.Pointer(&events[0])
-	} else {
-		_p0 = unsafe.Pointer(&_zero)
-	}
-	r0, _, e1 := Syscall6(SYS_EPOLL_PWAIT, uintptr(epfd), uintptr(_p0), uintptr(len(events)), uintptr(msec), 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall6(SYS_FADVISE64, uintptr(fd), uintptr(offset), uintptr(length), uintptr(advice), 0, 0)
 	if e1 != 0 {
diff --git a/src/vendor/golang.org/x/sys/unix/zsyscall_linux_s390x.go b/src/vendor/golang.org/x/sys/unix/zsyscall_linux_s390x.go
index 61e6f070..2cf020f2 100644
--- a/src/vendor/golang.org/x/sys/unix/zsyscall_linux_s390x.go
+++ b/src/vendor/golang.org/x/sys/unix/zsyscall_linux_s390x.go
@@ -45,23 +45,6 @@ func Tee(rfd int, wfd int, len int, flags int) (n int64, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) {
-	var _p0 unsafe.Pointer
-	if len(events) > 0 {
-		_p0 = unsafe.Pointer(&events[0])
-	} else {
-		_p0 = unsafe.Pointer(&_zero)
-	}
-	r0, _, e1 := Syscall6(SYS_EPOLL_WAIT, uintptr(epfd), uintptr(_p0), uintptr(len(events)), uintptr(msec), 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall6(SYS_FADVISE64, uintptr(fd), uintptr(offset), uintptr(length), uintptr(advice), 0, 0)
 	if e1 != 0 {
diff --git a/src/vendor/golang.org/x/sys/unix/zsyscall_linux_sparc64.go b/src/vendor/golang.org/x/sys/unix/zsyscall_linux_sparc64.go
index 834b8420..52763762 100644
--- a/src/vendor/golang.org/x/sys/unix/zsyscall_linux_sparc64.go
+++ b/src/vendor/golang.org/x/sys/unix/zsyscall_linux_sparc64.go
@@ -45,23 +45,6 @@ func Tee(rfd int, wfd int, len int, flags int) (n int64, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) {
-	var _p0 unsafe.Pointer
-	if len(events) > 0 {
-		_p0 = unsafe.Pointer(&events[0])
-	} else {
-		_p0 = unsafe.Pointer(&_zero)
-	}
-	r0, _, e1 := Syscall6(SYS_EPOLL_WAIT, uintptr(epfd), uintptr(_p0), uintptr(len(events)), uintptr(msec), 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall6(SYS_FADVISE64, uintptr(fd), uintptr(offset), uintptr(length), uintptr(advice), 0, 0)
 	if e1 != 0 {
diff --git a/src/vendor/golang.org/x/sys/windows/security_windows.go b/src/vendor/golang.org/x/sys/windows/security_windows.go
index 6c955cea..78362156 100644
--- a/src/vendor/golang.org/x/sys/windows/security_windows.go
+++ b/src/vendor/golang.org/x/sys/windows/security_windows.go
@@ -1109,17 +1109,53 @@ const (
 )
 
 // This type is the union inside of TRUSTEE and must be created using one of the TrusteeValueFrom* functions.
+//
+// Go pointers stored in a TrusteeValue must be pinned using [runtime.Pinner]
+// for the lifetime of the TrusteeValue.
 type TrusteeValue uintptr
 
+// TrusteeValueFromString is unsafe and should not be used.
+//
+// It returns a uintptr containing a reference to newly-allocated memory
+// which will be freed by the garbage collector.
+// There is no way for the caller to safely reference this memory.
+//
+// To create a [TrusteeValue] from a string, use:
+//
+//	p, err := windows.UTF16PtrFromString(s)
+//	if err != nil {
+//		// handle error
+//	}
+//
+//	// Pin the string for as long as it is used.
+//	var pinner runtime.Pinner
+//	pinner.Pin(p)
+//	defer pinner.Unpin()
+//
+//	tv := TrusteeValue(unsafe.Pointer(p))
+//
+// Deprecated: TrusteeValueFromString is unsafe and should not be used.
 func TrusteeValueFromString(str string) TrusteeValue {
 	return TrusteeValue(unsafe.Pointer(StringToUTF16Ptr(str)))
 }
+
+// TrusteeValueFromSID returns a [TrusteeValue] referencing sid.
+//
+// The caller must pin sid using a [runtime.Pinner] for the lifetime of the TrusteeValue.
 func TrusteeValueFromSID(sid *SID) TrusteeValue {
 	return TrusteeValue(unsafe.Pointer(sid))
 }
+
+// TrusteeValueFromObjectsAndSid returns a [TrusteeValue] referencing objectsAndSid.
+//
+// The caller must pin objectsAndSid using a [runtime.Pinner] for the lifetime of the TrusteeValue.
 func TrusteeValueFromObjectsAndSid(objectsAndSid *OBJECTS_AND_SID) TrusteeValue {
 	return TrusteeValue(unsafe.Pointer(objectsAndSid))
 }
+
+// TrusteeValueFromObjectsAndName returns a [TrusteeValue] referencing objectsAndName.
+//
+// The caller must pin objectsAndName using a [runtime.Pinner] for the lifetime of the TrusteeValue.
 func TrusteeValueFromObjectsAndName(objectsAndName *OBJECTS_AND_NAME) TrusteeValue {
 	return TrusteeValue(unsafe.Pointer(objectsAndName))
 }
diff --git a/src/vendor/golang.org/x/sys/windows/syscall_windows.go b/src/vendor/golang.org/x/sys/windows/syscall_windows.go
index 9755bca9..e6966b4c 100644
--- a/src/vendor/golang.org/x/sys/windows/syscall_windows.go
+++ b/src/vendor/golang.org/x/sys/windows/syscall_windows.go
@@ -1728,11 +1728,15 @@ func (s *NTUnicodeString) String() string {
 // the more common *uint16 string type.
 func NewNTString(s string) (*NTString, error) {
 	var nts NTString
-	s8, err := BytePtrFromString(s)
+	s8, err := ByteSliceFromString(s)
 	if err != nil {
 		return nil, err
 	}
-	RtlInitString(&nts, s8)
+	// The source string plus its terminating NUL must fit within MAX_USHORT.
+	if len(s8) > MAX_USHORT {
+		return nil, syscall.EINVAL
+	}
+	RtlInitString(&nts, &s8[0])
 	return &nts, nil
 }
 
diff --git a/src/vendor/golang.org/x/sys/windows/types_windows.go b/src/vendor/golang.org/x/sys/windows/types_windows.go
index d2574a73..75a50b31 100644
--- a/src/vendor/golang.org/x/sys/windows/types_windows.go
+++ b/src/vendor/golang.org/x/sys/windows/types_windows.go
@@ -169,6 +169,7 @@ const (
 	FORMAT_MESSAGE_ARGUMENT_ARRAY  = 8192
 	FORMAT_MESSAGE_MAX_WIDTH_MASK  = 255
 
+	MAX_USHORT    = 0xffff
 	MAX_PATH      = 260
 	MAX_LONG_PATH = 32768
 
diff --git a/src/vendor/modules.txt b/src/vendor/modules.txt
index 475a0dde..f36dc3ac 100644
--- a/src/vendor/modules.txt
+++ b/src/vendor/modules.txt
@@ -118,7 +118,7 @@ github.com/jackc/puddle/v2/internal/genstack
 # github.com/joho/godotenv v1.5.1
 ## explicit; go 1.12
 github.com/joho/godotenv
-# github.com/klauspost/compress v1.19.0
+# github.com/klauspost/compress v1.19.1
 ## explicit; go 1.24
 github.com/klauspost/compress
 github.com/klauspost/compress/flate
@@ -147,8 +147,8 @@ github.com/looplab/fsm
 # github.com/mattn/go-colorable v0.1.15
 ## explicit; go 1.18
 github.com/mattn/go-colorable
-# github.com/mattn/go-isatty v0.0.22
-## explicit; go 1.21
+# github.com/mattn/go-isatty v0.0.23
+## explicit; go 1.20
 github.com/mattn/go-isatty
 # github.com/mfridman/interpolate v0.0.2
 ## explicit; go 1.19
@@ -184,7 +184,7 @@ github.com/pquerna/otp
 github.com/pquerna/otp/hotp
 github.com/pquerna/otp/internal
 github.com/pquerna/otp/totp
-# github.com/pressly/goose/v3 v3.27.2
+# github.com/pressly/goose/v3 v3.27.3
 ## explicit; go 1.25.7
 github.com/pressly/goose/v3
 github.com/pressly/goose/v3/database
@@ -220,8 +220,8 @@ github.com/rs/xid
 # github.com/savsgio/gotils v0.0.0-20250924091648-bce9a52d7761
 ## explicit; go 1.21
 github.com/savsgio/gotils/strconv
-# github.com/sethvargo/go-retry v0.3.0
-## explicit; go 1.21
+# github.com/sethvargo/go-retry v0.4.0
+## explicit; go 1.25
 github.com/sethvargo/go-retry
 # github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e
 ## explicit; go 1.13
@@ -269,7 +269,7 @@ go.uber.org/multierr
 # go.yaml.in/yaml/v3 v3.0.4
 ## explicit; go 1.16
 go.yaml.in/yaml/v3
-# golang.org/x/crypto v0.53.0
+# golang.org/x/crypto v0.54.0
 ## explicit; go 1.25.0
 golang.org/x/crypto/acme
 golang.org/x/crypto/acme/autocert
@@ -284,7 +284,7 @@ golang.org/x/image/font/opentype
 golang.org/x/image/font/sfnt
 golang.org/x/image/math/fixed
 golang.org/x/image/vector
-# golang.org/x/net v0.56.0
+# golang.org/x/net v0.57.0
 ## explicit; go 1.25.0
 golang.org/x/net/html
 golang.org/x/net/html/atom
@@ -298,7 +298,7 @@ golang.org/x/net/publicsuffix
 ## explicit; go 1.25.0
 golang.org/x/sync/errgroup
 golang.org/x/sync/semaphore
-# golang.org/x/sys v0.46.0
+# golang.org/x/sys v0.47.0
 ## explicit; go 1.25.0
 golang.org/x/sys/cpu
 golang.org/x/sys/unix