From 5684cc20ef145b0f151cd13491466bf3b29042ee Mon Sep 17 00:00:00 2001
From: Praveen Kumar <kumarpraveen.nitdgp@gmail.com>
Date: Mon, 12 Jun 2023 15:46:36 +0530
Subject: [PATCH] go.mod: Update gvisor_vsock_tap dependency

Updating to https://github.com/containers/gvisor-tap-vsock/commit/b79db04d368ef24620553026a977dcff5749e2bc
which resolve https://github.com/crc-org/crc/issues/3643 issue.
---
 go.mod                                        |  30 +-
 go.sum                                        |  67 +-
 .../Microsoft/go-winio/.golangci.yml          |  27 +-
 .../github.com/Microsoft/go-winio/hvsock.go   |   6 +-
 .../Microsoft/go-winio/internal/fs/doc.go     |   2 +
 .../Microsoft/go-winio/internal/fs/fs.go      | 202 +++++
 .../go-winio/internal/fs/security.go          |  12 +
 .../go-winio/internal/fs/zsyscall_windows.go  |  64 ++
 .../go-winio/internal/socket/socket.go        |   4 +-
 .../go-winio/internal/stringbuffer/wstring.go | 132 +++
 vendor/github.com/Microsoft/go-winio/pipe.go  |  22 +-
 .../Microsoft/go-winio/zsyscall_windows.go    |  19 -
 .../gvisor-tap-vsock/pkg/client/client.go     |  37 +
 .../gvisor-tap-vsock/pkg/net/stdio/dial.go    |  51 ++
 .../gvisor-tap-vsock/pkg/net/stdio/ioaddr.go  |  12 +
 .../gvisor-tap-vsock/pkg/net/stdio/ioconn.go  |  50 ++
 .../gvisor-tap-vsock/pkg/services/dns/dns.go  |  64 +-
 .../pkg/sshclient/npipe_unsupported.go        |   2 +-
 .../gvisor-tap-vsock/pkg/tap/connection.go    |  10 +
 .../gvisor-tap-vsock/pkg/tap/link.go          |   4 +-
 .../gvisor-tap-vsock/pkg/tap/protocol.go      |   4 +-
 .../gvisor-tap-vsock/pkg/tap/switch.go        |  83 +-
 .../pkg/transport/dial_linux.go               |  11 +
 .../pkg/types/configuration.go                |  14 +-
 .../pkg/virtualnetwork/bess.go                |   4 +-
 .../pkg/virtualnetwork/mux.go                 |   2 +-
 .../pkg/virtualnetwork/qemu.go                |   4 +-
 .../pkg/virtualnetwork/services.go            |  31 +-
 .../pkg/virtualnetwork/stdio.go               |  12 +
 .../pkg/virtualnetwork/virtualnetwork.go      |   2 +-
 .../pkg/virtualnetwork/vpnkit.go              |   2 +-
 vendor/github.com/go-logr/logr/.golangci.yaml |   3 -
 vendor/github.com/go-logr/logr/discard.go     |  32 +-
 vendor/github.com/go-logr/logr/funcr/funcr.go |  27 +-
 vendor/github.com/go-logr/logr/logr.go        | 166 ++--
 .../golang/protobuf/jsonpb/decode.go          |   8 +-
 .../github.com/mdlayher/socket/CHANGELOG.md   |   6 +
 vendor/github.com/mdlayher/socket/conn.go     | 521 ++++++------
 .../github.com/mdlayher/socket/conn_linux.go  |  91 +--
 vendor/github.com/mdlayher/vsock/CHANGELOG.md |   4 +
 .../mdlayher/vsock/listener_linux.go          |   3 +-
 vendor/github.com/miekg/dns/LICENSE           |  49 +-
 vendor/github.com/miekg/dns/README.md         |   6 +
 vendor/github.com/miekg/dns/acceptfunc.go     |   1 -
 vendor/github.com/miekg/dns/client.go         |  62 +-
 vendor/github.com/miekg/dns/clientconfig.go   |   2 +-
 vendor/github.com/miekg/dns/defaults.go       |  22 +-
 vendor/github.com/miekg/dns/dnssec.go         |  14 +-
 vendor/github.com/miekg/dns/doc.go            |  86 +-
 vendor/github.com/miekg/dns/edns.go           |  52 +-
 vendor/github.com/miekg/dns/fuzz.go           |   1 +
 vendor/github.com/miekg/dns/labels.go         |   2 +-
 .../miekg/dns/listen_no_reuseport.go          |   3 +-
 .../github.com/miekg/dns/listen_reuseport.go  |   2 +-
 vendor/github.com/miekg/dns/msg.go            |  60 +-
 vendor/github.com/miekg/dns/msg_helpers.go    |  42 +-
 vendor/github.com/miekg/dns/scan.go           |  20 +-
 vendor/github.com/miekg/dns/scan_rr.go        | 125 ++-
 vendor/github.com/miekg/dns/server.go         |   4 +-
 vendor/github.com/miekg/dns/singleinflight.go |  61 --
 vendor/github.com/miekg/dns/svcb.go           |  63 +-
 vendor/github.com/miekg/dns/tools.go          |   1 +
 vendor/github.com/miekg/dns/types.go          | 119 ++-
 vendor/github.com/miekg/dns/udp.go            |   1 +
 vendor/github.com/miekg/dns/udp_windows.go    |   8 +-
 vendor/github.com/miekg/dns/version.go        |   2 +-
 vendor/github.com/miekg/dns/xfr.go            |   1 -
 vendor/github.com/miekg/dns/zduplicate.go     |  58 ++
 vendor/github.com/miekg/dns/zmsg.go           | 110 +++
 vendor/github.com/miekg/dns/ztypes.go         | 453 +++++++++--
 vendor/github.com/onsi/ginkgo/v2/.gitignore   |   2 +-
 vendor/github.com/onsi/ginkgo/v2/CHANGELOG.md |  92 +++
 vendor/github.com/onsi/ginkgo/v2/core_dsl.go  |  23 +-
 .../onsi/ginkgo/v2/ginkgo/internal/compile.go |  11 +-
 .../{tools.go => ginkgo_cli_dependencies.go}  |   4 +-
 .../github.com/onsi/ginkgo/v2/ginkgo_t_dsl.go |  61 +-
 .../interrupt_handler/interrupt_handler.go    |  47 +-
 .../onsi/ginkgo/v2/internal/node.go           |   9 +
 .../onsi/ginkgo/v2/internal/ordering.go       |  51 +-
 .../v2/internal/output_interceptor_unix.go    |  11 +
 .../v2/internal/progress_reporter_manager.go  |  79 ++
 .../onsi/ginkgo/v2/internal/spec_context.go   |  53 +-
 .../onsi/ginkgo/v2/internal/suite.go          |  23 +-
 .../internal/testingtproxy/testing_t_proxy.go | 112 ++-
 .../onsi/ginkgo/v2/internal/writer.go         |   2 +-
 .../onsi/ginkgo/v2/reporters/json_report.go   |  13 +-
 .../onsi/ginkgo/v2/reporters/junit_report.go  |  19 +-
 .../ginkgo/v2/reporters/teamcity_report.go    |   4 +
 .../github.com/onsi/ginkgo/v2/types/config.go |  19 +-
 .../ginkgo/v2/types/deprecation_support.go    |   2 +-
 .../onsi/ginkgo/v2/types/version.go           |   2 +-
 vendor/github.com/onsi/gomega/.gitignore      |   2 +-
 vendor/github.com/onsi/gomega/CHANGELOG.md    |  65 ++
 .../github.com/onsi/gomega/format/format.go   |   8 +-
 vendor/github.com/onsi/gomega/gomega_dsl.go   |   4 +-
 .../onsi/gomega/internal/async_assertion.go   |  16 +-
 vendor/github.com/onsi/gomega/matchers.go     |  11 +-
 .../onsi/gomega/matchers/consist_of.go        |  29 +-
 .../gomega/matchers/have_exact_elements.go    |  15 +-
 .../gomega/matchers/have_occurred_matcher.go  |   2 +-
 .../onsi/gomega/matchers/succeed_matcher.go   |   2 +-
 vendor/github.com/onsi/gomega/tools           |   8 -
 vendor/github.com/sirupsen/logrus/README.md   |   8 +-
 vendor/github.com/sirupsen/logrus/writer.go   |  34 +-
 .../x/tools/go/types/objectpath/objectpath.go | 764 ++++++++++++++++++
 .../x/tools/internal/gcimporter/gcimporter.go |  12 +
 .../x/tools/internal/gcimporter/iexport.go    |   8 +-
 .../x/tools/internal/gcimporter/iimport.go    |  34 +-
 .../tools/internal/gcimporter/ureader_yes.go  |  41 +-
 .../x/tools/internal/gocommand/invoke.go      | 128 ++-
 .../x/tools/internal/gocommand/version.go     |  18 +-
 .../internal/tokeninternal/tokeninternal.go   |  92 +++
 .../x/tools/internal/typeparams/common.go     |   1 -
 .../x/tools/internal/typesinternal/types.go   |   9 +
 vendor/modules.txt                            |  40 +-
 115 files changed, 4047 insertions(+), 1220 deletions(-)
 create mode 100644 vendor/github.com/Microsoft/go-winio/internal/fs/doc.go
 create mode 100644 vendor/github.com/Microsoft/go-winio/internal/fs/fs.go
 create mode 100644 vendor/github.com/Microsoft/go-winio/internal/fs/security.go
 create mode 100644 vendor/github.com/Microsoft/go-winio/internal/fs/zsyscall_windows.go
 create mode 100644 vendor/github.com/Microsoft/go-winio/internal/stringbuffer/wstring.go
 create mode 100644 vendor/github.com/containers/gvisor-tap-vsock/pkg/net/stdio/dial.go
 create mode 100644 vendor/github.com/containers/gvisor-tap-vsock/pkg/net/stdio/ioaddr.go
 create mode 100644 vendor/github.com/containers/gvisor-tap-vsock/pkg/net/stdio/ioconn.go
 create mode 100644 vendor/github.com/containers/gvisor-tap-vsock/pkg/tap/connection.go
 create mode 100644 vendor/github.com/containers/gvisor-tap-vsock/pkg/virtualnetwork/stdio.go
 delete mode 100644 vendor/github.com/miekg/dns/singleinflight.go
 rename vendor/github.com/onsi/ginkgo/v2/{tools.go => ginkgo_cli_dependencies.go} (50%)
 create mode 100644 vendor/github.com/onsi/ginkgo/v2/internal/progress_reporter_manager.go
 delete mode 100644 vendor/github.com/onsi/gomega/tools
 create mode 100644 vendor/golang.org/x/tools/go/types/objectpath/objectpath.go

diff --git a/go.mod b/go.mod
index b888899138..c536bc5202 100644
--- a/go.mod
+++ b/go.mod
@@ -5,13 +5,13 @@ go 1.19
 require (
 	github.com/AlecAivazis/survey/v2 v2.3.6
 	github.com/Masterminds/semver/v3 v3.2.0
-	github.com/Microsoft/go-winio v0.6.0
+	github.com/Microsoft/go-winio v0.6.1
 	github.com/ProtonMail/go-crypto v0.0.0-20230217124315-7d5c6f04bbb8
 	github.com/YourFin/binappend v0.0.0-20181105185800-0add4bf0b9ad
 	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d
 	github.com/cavaliergopher/grab/v3 v3.0.1
 	github.com/cheggaaa/pb/v3 v3.1.0
-	github.com/containers/gvisor-tap-vsock v0.5.0
+	github.com/containers/gvisor-tap-vsock v0.6.2-0.20230609094134-b79db04d368e
 	github.com/containers/image/v5 v5.24.1
 	github.com/coreos/go-systemd/v22 v22.5.0
 	github.com/crc-org/admin-helper v0.0.12-0.20221012143549-fd5acd1c478e
@@ -28,9 +28,9 @@ require (
 	github.com/klauspost/cpuid/v2 v2.2.4
 	github.com/kofalt/go-memoize v0.0.0-20220914132407-0b5d6a304579
 	github.com/mattn/go-colorable v0.1.13
-	github.com/mdlayher/vsock v1.2.0
-	github.com/onsi/ginkgo/v2 v2.8.3
-	github.com/onsi/gomega v1.27.1
+	github.com/mdlayher/vsock v1.2.1
+	github.com/onsi/ginkgo/v2 v2.9.7
+	github.com/onsi/gomega v1.27.8
 	github.com/opencontainers/image-spec v1.1.0-rc2
 	github.com/openshift/api v0.0.0-20230213134911-7ba313770556
 	github.com/openshift/client-go v0.0.0-20221019143426-16aed247da5c
@@ -41,18 +41,18 @@ require (
 	github.com/pkg/errors v0.9.1
 	github.com/segmentio/analytics-go/v3 v3.2.1
 	github.com/shirou/gopsutil/v3 v3.23.1
-	github.com/sirupsen/logrus v1.9.0
+	github.com/sirupsen/logrus v1.9.3
 	github.com/spf13/cast v1.5.0
 	github.com/spf13/cobra v1.6.1
 	github.com/spf13/pflag v1.0.5
 	github.com/spf13/viper v1.15.0
-	github.com/stretchr/testify v1.8.3
+	github.com/stretchr/testify v1.8.4
 	github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8
 	github.com/yusufpapurcu/wmi v1.2.2
 	github.com/zalando/go-keyring v0.2.2
 	golang.org/x/crypto v0.9.0
 	golang.org/x/net v0.10.0
-	golang.org/x/sync v0.1.0
+	golang.org/x/sync v0.2.0
 	golang.org/x/sys v0.8.0
 	golang.org/x/term v0.8.0
 	golang.org/x/text v0.9.0
@@ -95,7 +95,7 @@ require (
 	github.com/fsnotify/fsnotify v1.6.0 // indirect
 	github.com/ghodss/yaml v1.0.0 // indirect
 	github.com/gin-gonic/gin v1.9.1 // indirect
-	github.com/go-logr/logr v1.2.3 // indirect
+	github.com/go-logr/logr v1.2.4 // indirect
 	github.com/go-ole/go-ole v1.2.6 // indirect
 	github.com/go-openapi/analysis v0.21.4 // indirect
 	github.com/go-openapi/errors v0.20.3 // indirect
@@ -107,11 +107,11 @@ require (
 	github.com/go-openapi/strfmt v0.21.3 // indirect
 	github.com/go-openapi/swag v0.22.3 // indirect
 	github.com/go-openapi/validate v0.22.0 // indirect
-	github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 // indirect
+	github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 // indirect
 	github.com/godbus/dbus/v5 v5.1.0 // indirect
 	github.com/gofrs/uuid v4.2.0+incompatible // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/protobuf v1.5.2 // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/goodhosts/hostsfile v0.1.1 // indirect
 	github.com/google/btree v1.0.1 // indirect
 	github.com/google/gnostic v0.5.7-v3refs // indirect
@@ -142,9 +142,9 @@ require (
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-isatty v0.0.19 // indirect
 	github.com/mattn/go-runewidth v0.0.14 // indirect
-	github.com/mdlayher/socket v0.4.0 // indirect
+	github.com/mdlayher/socket v0.4.1 // indirect
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
-	github.com/miekg/dns v1.1.50 // indirect
+	github.com/miekg/dns v1.1.54 // indirect
 	github.com/miekg/pkcs11 v1.1.1 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/moby/sys/mountinfo v0.6.2 // indirect
@@ -186,10 +186,10 @@ require (
 	go.etcd.io/bbolt v1.3.6 // indirect
 	go.mongodb.org/mongo-driver v1.11.1 // indirect
 	go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352 // indirect
-	golang.org/x/mod v0.8.0 // indirect
+	golang.org/x/mod v0.10.0 // indirect
 	golang.org/x/oauth2 v0.4.0 // indirect
 	golang.org/x/time v0.2.0 // indirect
-	golang.org/x/tools v0.6.0 // indirect
+	golang.org/x/tools v0.9.1 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/genproto v0.0.0-20221227171554-f9683d7f8bef // indirect
 	google.golang.org/grpc v1.52.0 // indirect
diff --git a/go.sum b/go.sum
index e9483827f2..e938af50c9 100644
--- a/go.sum
+++ b/go.sum
@@ -47,8 +47,8 @@ github.com/BurntSushi/toml v1.2.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbi
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/Masterminds/semver/v3 v3.2.0 h1:3MEsd0SM6jqZojhjLWWeBY+Kcjy9i6MQAeY7YgDP83g=
 github.com/Masterminds/semver/v3 v3.2.0/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
-github.com/Microsoft/go-winio v0.6.0 h1:slsWYD/zyx7lCXoZVlvQrj0hPTM1HI4+v1sIda2yDvg=
-github.com/Microsoft/go-winio v0.6.0/go.mod h1:cTAf44im0RAYeL23bpB+fzCyDH2MJiz2BO69KH/soAE=
+github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
+github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
 github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2 h1:+vx7roKuyA63nhn5WAunQHLTznkw5W8b1Xc0dNjp83s=
 github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2/go.mod h1:HBCaDeC1lPdgDeDbhX8XFpy1jqjK0IBG8W5K+xYqA0w=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
@@ -111,8 +111,8 @@ github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGX
 github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/containerd/console v1.0.3/go.mod h1:7LqA/THxQ86k76b8c/EMSiaJ3h1eZkMkXar0TQ1gf3U=
-github.com/containers/gvisor-tap-vsock v0.5.0 h1:hoCkrfQ96tjek2BtiW1BHy50zAQCzkqeiAQY96y6NLk=
-github.com/containers/gvisor-tap-vsock v0.5.0/go.mod h1:jrnI5plQtmys5LEKpXcCCrLqZlrHsozQg0V2Jw1UG74=
+github.com/containers/gvisor-tap-vsock v0.6.2-0.20230609094134-b79db04d368e h1:GobY0j/IDZJ/xi0ZIeNVK99+gUPkQENlXuu4Dz6mJ2k=
+github.com/containers/gvisor-tap-vsock v0.6.2-0.20230609094134-b79db04d368e/go.mod h1:hwxlujaj1GDO3Sip28RSO3l3PqBzQfc8kgTwICib35g=
 github.com/containers/image/v5 v5.24.1 h1:XaRw3FJmvZtI297uBVTJluUVH4AQJ//YpHviaOw0C4M=
 github.com/containers/image/v5 v5.24.1/go.mod h1:oss5F6ssGQz8ZtC79oY+fuzYA3m3zBek9tq9gmhuvHc=
 github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01 h1:Qzk5C6cYglewc+UyGf6lc8Mj2UaPTHy/iF2De0/77CA=
@@ -216,8 +216,8 @@ github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
 github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.2.3 h1:2DntVwHkVopvECVRSlL5PSo9eG+cAkDCuckLubN+rq0=
-github.com/go-logr/logr v1.2.3/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ=
+github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=
 github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
 github.com/go-openapi/analysis v0.21.2/go.mod h1:HZwRk4RRisyG8vx2Oe6aqeSQcoxRp47Xkp3+K6q+LdY=
@@ -265,8 +265,8 @@ github.com/go-playground/validator/v10 v10.2.0/go.mod h1:uOYAAleCW8F/7oMFd6aG0GO
 github.com/go-playground/validator/v10 v10.14.0 h1:vgvQWe3XCz3gIeFDm/HnTIbj6UGmg/+t63MyGU2n5js=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/go-stack/stack v1.8.1/go.mod h1:dcoOX6HbPZSZptuspn9bctJ+N/CnF5gGygcUP3XYfe4=
-github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 h1:p104kn46Q8WdvHunIJ9dAyjPVtrBPhSr3KT2yUst43I=
-github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
+github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
+github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls=
 github.com/go-test/deep v1.1.0 h1:WOcxcdHcvdgThNXjw0t76K42FXTU7HpNQWHpA2HHNlg=
 github.com/gobuffalo/attrs v0.0.0-20190224210810-a9411de4debd/go.mod h1:4duuawTqi2wkkpB4ePgWMaai6/Kc6WEz83bhFwpHzj0=
 github.com/gobuffalo/depgen v0.0.0-20190329151759-d478694a28d3/go.mod h1:3STtPUQYuzV0gBVOY3vy6CfMm/ljR4pABfrTeHNLHUY=
@@ -339,8 +339,9 @@ github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QD
 github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
 github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
+github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/golang/snappy v0.0.1/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/goodhosts/hostsfile v0.1.1 h1:SqRUTFOshOCon0ZSXDrW1bkKZvs4+5pRgYFWySdaLno=
 github.com/goodhosts/hostsfile v0.1.1/go.mod h1:lXcUP8xO4WR5vvuQ3F/N0bMQoclOtYKEEUnyY2jTusY=
@@ -554,16 +555,16 @@ github.com/mdlayher/netlink v1.1.1/go.mod h1:WTYpFb/WTvlRJAyKhZL5/uy69TDDpHHu2VZ
 github.com/mdlayher/raw v0.0.0-20190606142536-fef19f00fc18/go.mod h1:7EpbotpCmVZcu+KCX4g9WaRNuu11uyhiW7+Le1dKawg=
 github.com/mdlayher/raw v0.0.0-20191009151244-50f2db8cc065 h1:aFkJ6lx4FPip+S+Uw4aTegFMct9shDvP+79PsSxpm3w=
 github.com/mdlayher/raw v0.0.0-20191009151244-50f2db8cc065/go.mod h1:7EpbotpCmVZcu+KCX4g9WaRNuu11uyhiW7+Le1dKawg=
-github.com/mdlayher/socket v0.4.0 h1:280wsy40IC9M9q1uPGcLBwXpcTQDtoGwVt+BNoITxIw=
-github.com/mdlayher/socket v0.4.0/go.mod h1:xxFqz5GRCUN3UEOm9CZqEJsAbe1C8OwSK46NlmWuVoc=
-github.com/mdlayher/vsock v1.2.0 h1:klRY9lndjmg6k/QWbX/ucQ3e2JFRm1M7vfG9hijbQ0A=
-github.com/mdlayher/vsock v1.2.0/go.mod h1:w4kdSTQB9p1l/WwGmAs0V62qQ869qRYoongwgN+Y1HE=
+github.com/mdlayher/socket v0.4.1 h1:eM9y2/jlbs1M615oshPQOHZzj6R6wMT7bX5NPiQvn2U=
+github.com/mdlayher/socket v0.4.1/go.mod h1:cAqeGjoufqdxWkD7DkpyS+wcefOtmu5OQ8KuoJGIReA=
+github.com/mdlayher/vsock v1.2.1 h1:pC1mTJTvjo1r9n9fbm7S1j04rCgCzhCOS5DY0zqHlnQ=
+github.com/mdlayher/vsock v1.2.1/go.mod h1:NRfCibel++DgeMD8z/hP+PPTjlNJsdPOmxcnENvE+SE=
 github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d h1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
 github.com/miekg/dns v1.0.14/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
-github.com/miekg/dns v1.1.50 h1:DQUfb9uc6smULcREF09Uc+/Gd46YWqJd5DbpPE9xkcA=
-github.com/miekg/dns v1.1.50/go.mod h1:e3IlAVfNqAllflbibAZEWOXOQ+Ynzk/dDozDxY7XnME=
+github.com/miekg/dns v1.1.54 h1:5jon9mWcb0sFJGpnI99tOMhCPyJ+RPVz5b63MQG0VWI=
+github.com/miekg/dns v1.1.54/go.mod h1:uInx36IzPl7FYnDcMeVWxj9byh7DutNykX4G9Sj60FY=
 github.com/miekg/pkcs11 v1.1.1 h1:Ugu9pdy6vAYku5DEpVWVFPYnzV+bxB+iRdbuFSu7TvU=
 github.com/miekg/pkcs11 v1.1.1/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
 github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
@@ -599,10 +600,10 @@ github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRW
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
 github.com/oklog/ulid v1.3.1 h1:EGfNDEx6MqHz8B3uNV6QAib1UR2Lm97sHi3ocA6ESJ4=
 github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
-github.com/onsi/ginkgo/v2 v2.8.3 h1:RpbK1G8nWPNaCVFBWsOGnEQQGgASi6b8fxcWBvDYjxQ=
-github.com/onsi/ginkgo/v2 v2.8.3/go.mod h1:6OaUA8BCi0aZfmzYT/q9AacwTzDpNbxILUT+TlBq6MY=
-github.com/onsi/gomega v1.27.1 h1:rfztXRbg6nv/5f+Raen9RcGoSecHIFgBBLQK3Wdj754=
-github.com/onsi/gomega v1.27.1/go.mod h1:aHX5xOykVYzWOV4WqQy0sy8BQptgukenXpCXfadcIAw=
+github.com/onsi/ginkgo/v2 v2.9.7 h1:06xGQy5www2oN160RtEZoTvnP2sPhEfePYmCDc2szss=
+github.com/onsi/ginkgo/v2 v2.9.7/go.mod h1:cxrmXWykAwTwhQsJOPfdIDiJ+l2RYq7U8hFU+M/1uw0=
+github.com/onsi/gomega v1.27.8 h1:gegWiwZjBsf2DgiSbf5hpokZ98JVDMcWkUiigk6/KXc=
+github.com/onsi/gomega v1.27.8/go.mod h1:2J8vzI/s+2shY9XHRApDkdgPo1TKT7P2u6fXeJKFnNQ=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.0.2/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
@@ -700,8 +701,8 @@ github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMB
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
-github.com/sirupsen/logrus v1.9.0 h1:trlNQbNUG3OdDrDil03MCb1H2o9nJ1x4/5LYw7byDE0=
-github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
 github.com/smartystreets/assertions v1.2.0 h1:42S6lae5dvLc7BrLu/0ugRtcFVjoJNMC/N3yZFZkDFs=
 github.com/smartystreets/goconvey v1.6.4 h1:fv0U8FUIMPNf1L9lnHLvLhgicrIVChEkdzIKYqbNC9s=
@@ -746,8 +747,9 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.8.3 h1:RP3t2pwF7cMEbC1dqtB6poj3niw/9gnV4Cjg5oW5gtY=
 github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
 github.com/subosito/gotenv v1.4.2 h1:X1TuBLAMDFbaTAChgCBLu3DU3UPyELpnF2jjJ2cz/S8=
 github.com/subosito/gotenv v1.4.2/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0=
@@ -767,6 +769,7 @@ github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1
 github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
 github.com/u-root/uio v0.0.0-20210528114334-82958018845c h1:BFvcl34IGnw8yvJi8hlqLFo9EshRInwWBs2M5fGWzQA=
 github.com/u-root/uio v0.0.0-20210528114334-82958018845c/go.mod h1:LpEX5FO/cB+WF4TYGY1V5qktpaZLkKkSegbr0V4eYXA=
+github.com/ugorji/go v1.1.7 h1:/68gy2h+1mWMrwZFeD1kQialdSzAb432dtpeJ42ovdo=
 github.com/ugorji/go v1.1.7/go.mod h1:kZn38zHttfInRq0xu/PH0az30d+z6vm202qpg1oXVMw=
 github.com/ugorji/go/codec v1.1.7/go.mod h1:Ax+UKWsSmolVDwsd+7N3ZtXu+yMGCf907BLYF3GoBXY=
 github.com/ugorji/go/codec v1.2.11 h1:BMaWp1Bb6fHwEtbplGBGJ498wD+LKlNSl25MjdZY4dU=
@@ -798,7 +801,6 @@ github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yusufpapurcu/wmi v1.2.2 h1:KBNDSne4vP5mbSWnJbO+51IMOXJB67QiYCSBrubbPRg=
 github.com/yusufpapurcu/wmi v1.2.2/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
 github.com/zalando/go-keyring v0.2.2 h1:f0xmpYiSrHtSNAVgwip93Cg8tuF45HJM6rHq/A5RI/4=
@@ -875,9 +877,8 @@ golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.8.0 h1:LUYupSeNrTNCGzR/hVBk2NHZO4hXcVaW1k4Qx7rjPx8=
-golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.10.0 h1:lFO9qtOdlre5W1jxS3r/4szv2/6iXxScdzjoBMXNhYk=
+golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -918,9 +919,7 @@ golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwY
 golang.org/x/net v0.0.0-20201209123823-ac852fbbde11/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
 golang.org/x/net v0.0.0-20210421230115-4e50805a0758/go.mod h1:72T/g9IO56b78aLF+1Kcs5dz7/ng1VjMUvfKvpfy+jM=
-golang.org/x/net v0.0.0-20210726213435-c6fcb2dbf985/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.10.0 h1:X2//UzNDwYmtCLn7To6G58Wr6f5ahEAQgKNzv9Y951M=
@@ -948,8 +947,8 @@ golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=
-golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.2.0 h1:PUR+T4wwASmuSTYdKjYHI5TD22Wy5ogLU5qZCOLxBrI=
+golang.org/x/sync v0.2.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1008,16 +1007,13 @@ golang.org/x/sys v0.0.0-20210104204734-6f8348627aad/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210225134936-a50acf3fe073/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210420072515-93ed5bcd2bfe/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423185535-09eb48e85fd7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210525143221-35b2ab0089ea/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210616045830-e2b7044e8c71/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210819135213-f52c844e1c1c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210906170528-6f6e22806c34/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -1117,9 +1113,8 @@ golang.org/x/tools v0.0.0-20210105154028-b0ab187a4818/go.mod h1:emZCQorbCU4vsT4f
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20210108195828-e2f9c7f1fc8e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
-golang.org/x/tools v0.1.6-0.20210726203631-07bc1bf47fb2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.6.0 h1:BOw41kyTf3PuCW1pVQf8+Cyg8pMlkYB1oo9iJ6D/lKM=
-golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.9.1 h1:8WMNJAz3zrtPmnYC7ISf5dEn3MT0gY7jBJfw27yrrLo=
+golang.org/x/tools v0.9.1/go.mod h1:owI94Op576fPu3cIGQeHs3joujW/2Oc6MtlxbF5dfNc=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
diff --git a/vendor/github.com/Microsoft/go-winio/.golangci.yml b/vendor/github.com/Microsoft/go-winio/.golangci.yml
index af403bb13a..7b503d26a3 100644
--- a/vendor/github.com/Microsoft/go-winio/.golangci.yml
+++ b/vendor/github.com/Microsoft/go-winio/.golangci.yml
@@ -8,12 +8,8 @@ linters:
     - containedctx # struct contains a context
     - dupl # duplicate code
     - errname # erorrs are named correctly
-    - goconst # strings that should be constants
-    - godot # comments end in a period
-    - misspell
     - nolintlint # "//nolint" directives are properly explained
     - revive # golint replacement
-    - stylecheck # golint replacement, less configurable than revive
     - unconvert # unnecessary conversions
     - wastedassign
 
@@ -23,10 +19,7 @@ linters:
     - exhaustive # check exhaustiveness of enum switch statements
     - gofmt # files are gofmt'ed
     - gosec # security
-    - nestif # deeply nested ifs
     - nilerr # returns nil even with non-nil error
-    - prealloc # slices that can be pre-allocated
-    - structcheck # unused struct fields
     - unparam # unused function params
 
 issues:
@@ -42,6 +35,18 @@ issues:
       text: "^line-length-limit: "
       source: "^//(go:generate|sys) "
 
+    #TODO: remove after upgrading to go1.18
+    # ignore comment spacing for nolint and sys directives
+    - linters:
+        - revive
+      text: "^comment-spacings: no space between comment delimiter and comment text"
+      source: "//(cspell:|nolint:|sys |todo)"
+
+    # not on go 1.18 yet, so no any
+    - linters:
+        - revive
+      text: "^use-any: since GO 1.18 'interface{}' can be replaced by 'any'"
+
     # allow unjustified ignores of error checks in defer statements
     - linters:
         - nolintlint
@@ -56,6 +61,8 @@ issues:
 
 
 linters-settings:
+  exhaustive:
+    default-signifies-exhaustive: true
   govet:
     enable-all: true
     disable:
@@ -98,6 +105,8 @@ linters-settings:
         disabled: true
       - name: flag-parameter # excessive, and a common idiom we use
         disabled: true
+      - name: unhandled-error # warns over common fmt.Print* and io.Close; rely on errcheck instead
+        disabled: true
       # general config
       - name: line-length-limit
         arguments:
@@ -138,7 +147,3 @@ linters-settings:
             - VPCI
             - WCOW
             - WIM
-  stylecheck:
-    checks:
-      - "all"
-      - "-ST1003" # use revive's var naming
diff --git a/vendor/github.com/Microsoft/go-winio/hvsock.go b/vendor/github.com/Microsoft/go-winio/hvsock.go
index 52f1c280f6..c881916583 100644
--- a/vendor/github.com/Microsoft/go-winio/hvsock.go
+++ b/vendor/github.com/Microsoft/go-winio/hvsock.go
@@ -23,7 +23,7 @@ import (
 const afHVSock = 34 // AF_HYPERV
 
 // Well known Service and VM IDs
-//https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/user-guide/make-integration-service#vmid-wildcards
+// https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/user-guide/make-integration-service#vmid-wildcards
 
 // HvsockGUIDWildcard is the wildcard VmId for accepting connections from all partitions.
 func HvsockGUIDWildcard() guid.GUID { // 00000000-0000-0000-0000-000000000000
@@ -31,7 +31,7 @@ func HvsockGUIDWildcard() guid.GUID { // 00000000-0000-0000-0000-000000000000
 }
 
 // HvsockGUIDBroadcast is the wildcard VmId for broadcasting sends to all partitions.
-func HvsockGUIDBroadcast() guid.GUID { //ffffffff-ffff-ffff-ffff-ffffffffffff
+func HvsockGUIDBroadcast() guid.GUID { // ffffffff-ffff-ffff-ffff-ffffffffffff
 	return guid.GUID{
 		Data1: 0xffffffff,
 		Data2: 0xffff,
@@ -246,7 +246,7 @@ func (l *HvsockListener) Accept() (_ net.Conn, err error) {
 	var addrbuf [addrlen * 2]byte
 
 	var bytes uint32
-	err = syscall.AcceptEx(l.sock.handle, sock.handle, &addrbuf[0], 0 /*rxdatalen*/, addrlen, addrlen, &bytes, &c.o)
+	err = syscall.AcceptEx(l.sock.handle, sock.handle, &addrbuf[0], 0 /* rxdatalen */, addrlen, addrlen, &bytes, &c.o)
 	if _, err = l.sock.asyncIO(c, nil, bytes, err); err != nil {
 		return nil, l.opErr("accept", os.NewSyscallError("acceptex", err))
 	}
diff --git a/vendor/github.com/Microsoft/go-winio/internal/fs/doc.go b/vendor/github.com/Microsoft/go-winio/internal/fs/doc.go
new file mode 100644
index 0000000000..1f65388178
--- /dev/null
+++ b/vendor/github.com/Microsoft/go-winio/internal/fs/doc.go
@@ -0,0 +1,2 @@
+// This package contains Win32 filesystem functionality.
+package fs
diff --git a/vendor/github.com/Microsoft/go-winio/internal/fs/fs.go b/vendor/github.com/Microsoft/go-winio/internal/fs/fs.go
new file mode 100644
index 0000000000..509b3ec641
--- /dev/null
+++ b/vendor/github.com/Microsoft/go-winio/internal/fs/fs.go
@@ -0,0 +1,202 @@
+//go:build windows
+
+package fs
+
+import (
+	"golang.org/x/sys/windows"
+
+	"github.com/Microsoft/go-winio/internal/stringbuffer"
+)
+
+//go:generate go run github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go fs.go
+
+// https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-createfilew
+//sys CreateFile(name string, access AccessMask, mode FileShareMode, sa *syscall.SecurityAttributes, createmode FileCreationDisposition, attrs FileFlagOrAttribute, templatefile windows.Handle) (handle windows.Handle, err error) [failretval==windows.InvalidHandle] = CreateFileW
+
+const NullHandle windows.Handle = 0
+
+// AccessMask defines standard, specific, and generic rights.
+//
+//	Bitmask:
+//	 3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1
+//	 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
+//	+---------------+---------------+-------------------------------+
+//	|G|G|G|G|Resvd|A| StandardRights|         SpecificRights        |
+//	|R|W|E|A|     |S|               |                               |
+//	+-+-------------+---------------+-------------------------------+
+//
+//	GR     Generic Read
+//	GW     Generic Write
+//	GE     Generic Exectue
+//	GA     Generic All
+//	Resvd  Reserved
+//	AS     Access Security System
+//
+// https://learn.microsoft.com/en-us/windows/win32/secauthz/access-mask
+//
+// https://learn.microsoft.com/en-us/windows/win32/secauthz/generic-access-rights
+//
+// https://learn.microsoft.com/en-us/windows/win32/fileio/file-access-rights-constants
+type AccessMask = windows.ACCESS_MASK
+
+//nolint:revive // SNAKE_CASE is not idiomatic in Go, but aligned with Win32 API.
+const (
+	// Not actually any.
+	//
+	// For CreateFile: "query certain metadata such as file, directory, or device attributes without accessing that file or device"
+	// https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-createfilew#parameters
+	FILE_ANY_ACCESS AccessMask = 0
+
+	// Specific Object Access
+	// from ntioapi.h
+
+	FILE_READ_DATA      AccessMask = (0x0001) // file & pipe
+	FILE_LIST_DIRECTORY AccessMask = (0x0001) // directory
+
+	FILE_WRITE_DATA AccessMask = (0x0002) // file & pipe
+	FILE_ADD_FILE   AccessMask = (0x0002) // directory
+
+	FILE_APPEND_DATA          AccessMask = (0x0004) // file
+	FILE_ADD_SUBDIRECTORY     AccessMask = (0x0004) // directory
+	FILE_CREATE_PIPE_INSTANCE AccessMask = (0x0004) // named pipe
+
+	FILE_READ_EA         AccessMask = (0x0008) // file & directory
+	FILE_READ_PROPERTIES AccessMask = FILE_READ_EA
+
+	FILE_WRITE_EA         AccessMask = (0x0010) // file & directory
+	FILE_WRITE_PROPERTIES AccessMask = FILE_WRITE_EA
+
+	FILE_EXECUTE  AccessMask = (0x0020) // file
+	FILE_TRAVERSE AccessMask = (0x0020) // directory
+
+	FILE_DELETE_CHILD AccessMask = (0x0040) // directory
+
+	FILE_READ_ATTRIBUTES AccessMask = (0x0080) // all
+
+	FILE_WRITE_ATTRIBUTES AccessMask = (0x0100) // all
+
+	FILE_ALL_ACCESS      AccessMask = (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x1FF)
+	FILE_GENERIC_READ    AccessMask = (STANDARD_RIGHTS_READ | FILE_READ_DATA | FILE_READ_ATTRIBUTES | FILE_READ_EA | SYNCHRONIZE)
+	FILE_GENERIC_WRITE   AccessMask = (STANDARD_RIGHTS_WRITE | FILE_WRITE_DATA | FILE_WRITE_ATTRIBUTES | FILE_WRITE_EA | FILE_APPEND_DATA | SYNCHRONIZE)
+	FILE_GENERIC_EXECUTE AccessMask = (STANDARD_RIGHTS_EXECUTE | FILE_READ_ATTRIBUTES | FILE_EXECUTE | SYNCHRONIZE)
+
+	SPECIFIC_RIGHTS_ALL AccessMask = 0x0000FFFF
+
+	// Standard Access
+	// from ntseapi.h
+
+	DELETE       AccessMask = 0x0001_0000
+	READ_CONTROL AccessMask = 0x0002_0000
+	WRITE_DAC    AccessMask = 0x0004_0000
+	WRITE_OWNER  AccessMask = 0x0008_0000
+	SYNCHRONIZE  AccessMask = 0x0010_0000
+
+	STANDARD_RIGHTS_REQUIRED AccessMask = 0x000F_0000
+
+	STANDARD_RIGHTS_READ    AccessMask = READ_CONTROL
+	STANDARD_RIGHTS_WRITE   AccessMask = READ_CONTROL
+	STANDARD_RIGHTS_EXECUTE AccessMask = READ_CONTROL
+
+	STANDARD_RIGHTS_ALL AccessMask = 0x001F_0000
+)
+
+type FileShareMode uint32
+
+//nolint:revive // SNAKE_CASE is not idiomatic in Go, but aligned with Win32 API.
+const (
+	FILE_SHARE_NONE        FileShareMode = 0x00
+	FILE_SHARE_READ        FileShareMode = 0x01
+	FILE_SHARE_WRITE       FileShareMode = 0x02
+	FILE_SHARE_DELETE      FileShareMode = 0x04
+	FILE_SHARE_VALID_FLAGS FileShareMode = 0x07
+)
+
+type FileCreationDisposition uint32
+
+//nolint:revive // SNAKE_CASE is not idiomatic in Go, but aligned with Win32 API.
+const (
+	// from winbase.h
+
+	CREATE_NEW        FileCreationDisposition = 0x01
+	CREATE_ALWAYS     FileCreationDisposition = 0x02
+	OPEN_EXISTING     FileCreationDisposition = 0x03
+	OPEN_ALWAYS       FileCreationDisposition = 0x04
+	TRUNCATE_EXISTING FileCreationDisposition = 0x05
+)
+
+// CreateFile and co. take flags or attributes together as one parameter.
+// Define alias until we can use generics to allow both
+
+// https://learn.microsoft.com/en-us/windows/win32/fileio/file-attribute-constants
+type FileFlagOrAttribute uint32
+
+//nolint:revive // SNAKE_CASE is not idiomatic in Go, but aligned with Win32 API.
+const ( // from winnt.h
+	FILE_FLAG_WRITE_THROUGH       FileFlagOrAttribute = 0x8000_0000
+	FILE_FLAG_OVERLAPPED          FileFlagOrAttribute = 0x4000_0000
+	FILE_FLAG_NO_BUFFERING        FileFlagOrAttribute = 0x2000_0000
+	FILE_FLAG_RANDOM_ACCESS       FileFlagOrAttribute = 0x1000_0000
+	FILE_FLAG_SEQUENTIAL_SCAN     FileFlagOrAttribute = 0x0800_0000
+	FILE_FLAG_DELETE_ON_CLOSE     FileFlagOrAttribute = 0x0400_0000
+	FILE_FLAG_BACKUP_SEMANTICS    FileFlagOrAttribute = 0x0200_0000
+	FILE_FLAG_POSIX_SEMANTICS     FileFlagOrAttribute = 0x0100_0000
+	FILE_FLAG_OPEN_REPARSE_POINT  FileFlagOrAttribute = 0x0020_0000
+	FILE_FLAG_OPEN_NO_RECALL      FileFlagOrAttribute = 0x0010_0000
+	FILE_FLAG_FIRST_PIPE_INSTANCE FileFlagOrAttribute = 0x0008_0000
+)
+
+type FileSQSFlag = FileFlagOrAttribute
+
+//nolint:revive // SNAKE_CASE is not idiomatic in Go, but aligned with Win32 API.
+const ( // from winbase.h
+	SECURITY_ANONYMOUS      FileSQSFlag = FileSQSFlag(SecurityAnonymous << 16)
+	SECURITY_IDENTIFICATION FileSQSFlag = FileSQSFlag(SecurityIdentification << 16)
+	SECURITY_IMPERSONATION  FileSQSFlag = FileSQSFlag(SecurityImpersonation << 16)
+	SECURITY_DELEGATION     FileSQSFlag = FileSQSFlag(SecurityDelegation << 16)
+
+	SECURITY_SQOS_PRESENT     FileSQSFlag = 0x00100000
+	SECURITY_VALID_SQOS_FLAGS FileSQSFlag = 0x001F0000
+)
+
+// GetFinalPathNameByHandle flags
+//
+// https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-getfinalpathnamebyhandlew#parameters
+type GetFinalPathFlag uint32
+
+//nolint:revive // SNAKE_CASE is not idiomatic in Go, but aligned with Win32 API.
+const (
+	GetFinalPathDefaultFlag GetFinalPathFlag = 0x0
+
+	FILE_NAME_NORMALIZED GetFinalPathFlag = 0x0
+	FILE_NAME_OPENED     GetFinalPathFlag = 0x8
+
+	VOLUME_NAME_DOS  GetFinalPathFlag = 0x0
+	VOLUME_NAME_GUID GetFinalPathFlag = 0x1
+	VOLUME_NAME_NT   GetFinalPathFlag = 0x2
+	VOLUME_NAME_NONE GetFinalPathFlag = 0x4
+)
+
+// getFinalPathNameByHandle facilitates calling the Windows API GetFinalPathNameByHandle
+// with the given handle and flags. It transparently takes care of creating a buffer of the
+// correct size for the call.
+//
+// https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-getfinalpathnamebyhandlew
+func GetFinalPathNameByHandle(h windows.Handle, flags GetFinalPathFlag) (string, error) {
+	b := stringbuffer.NewWString()
+	//TODO: can loop infinitely if Win32 keeps returning the same (or a larger) n?
+	for {
+		n, err := windows.GetFinalPathNameByHandle(h, b.Pointer(), b.Cap(), uint32(flags))
+		if err != nil {
+			return "", err
+		}
+		// If the buffer wasn't large enough, n will be the total size needed (including null terminator).
+		// Resize and try again.
+		if n > b.Cap() {
+			b.ResizeTo(n)
+			continue
+		}
+		// If the buffer is large enough, n will be the size not including the null terminator.
+		// Convert to a Go string and return.
+		return b.String(), nil
+	}
+}
diff --git a/vendor/github.com/Microsoft/go-winio/internal/fs/security.go b/vendor/github.com/Microsoft/go-winio/internal/fs/security.go
new file mode 100644
index 0000000000..81760ac67e
--- /dev/null
+++ b/vendor/github.com/Microsoft/go-winio/internal/fs/security.go
@@ -0,0 +1,12 @@
+package fs
+
+// https://learn.microsoft.com/en-us/windows/win32/api/winnt/ne-winnt-security_impersonation_level
+type SecurityImpersonationLevel int32 // C default enums underlying type is `int`, which is Go `int32`
+
+// Impersonation levels
+const (
+	SecurityAnonymous      SecurityImpersonationLevel = 0
+	SecurityIdentification SecurityImpersonationLevel = 1
+	SecurityImpersonation  SecurityImpersonationLevel = 2
+	SecurityDelegation     SecurityImpersonationLevel = 3
+)
diff --git a/vendor/github.com/Microsoft/go-winio/internal/fs/zsyscall_windows.go b/vendor/github.com/Microsoft/go-winio/internal/fs/zsyscall_windows.go
new file mode 100644
index 0000000000..e2f7bb24e5
--- /dev/null
+++ b/vendor/github.com/Microsoft/go-winio/internal/fs/zsyscall_windows.go
@@ -0,0 +1,64 @@
+//go:build windows
+
+// Code generated by 'go generate' using "github.com/Microsoft/go-winio/tools/mkwinsyscall"; DO NOT EDIT.
+
+package fs
+
+import (
+	"syscall"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+var _ unsafe.Pointer
+
+// Do the interface allocations only once for common
+// Errno values.
+const (
+	errnoERROR_IO_PENDING = 997
+)
+
+var (
+	errERROR_IO_PENDING error = syscall.Errno(errnoERROR_IO_PENDING)
+	errERROR_EINVAL     error = syscall.EINVAL
+)
+
+// errnoErr returns common boxed Errno values, to prevent
+// allocations at runtime.
+func errnoErr(e syscall.Errno) error {
+	switch e {
+	case 0:
+		return errERROR_EINVAL
+	case errnoERROR_IO_PENDING:
+		return errERROR_IO_PENDING
+	}
+	// TODO: add more here, after collecting data on the common
+	// error values see on Windows. (perhaps when running
+	// all.bat?)
+	return e
+}
+
+var (
+	modkernel32 = windows.NewLazySystemDLL("kernel32.dll")
+
+	procCreateFileW = modkernel32.NewProc("CreateFileW")
+)
+
+func CreateFile(name string, access AccessMask, mode FileShareMode, sa *syscall.SecurityAttributes, createmode FileCreationDisposition, attrs FileFlagOrAttribute, templatefile windows.Handle) (handle windows.Handle, err error) {
+	var _p0 *uint16
+	_p0, err = syscall.UTF16PtrFromString(name)
+	if err != nil {
+		return
+	}
+	return _CreateFile(_p0, access, mode, sa, createmode, attrs, templatefile)
+}
+
+func _CreateFile(name *uint16, access AccessMask, mode FileShareMode, sa *syscall.SecurityAttributes, createmode FileCreationDisposition, attrs FileFlagOrAttribute, templatefile windows.Handle) (handle windows.Handle, err error) {
+	r0, _, e1 := syscall.Syscall9(procCreateFileW.Addr(), 7, uintptr(unsafe.Pointer(name)), uintptr(access), uintptr(mode), uintptr(unsafe.Pointer(sa)), uintptr(createmode), uintptr(attrs), uintptr(templatefile), 0, 0)
+	handle = windows.Handle(r0)
+	if handle == windows.InvalidHandle {
+		err = errnoErr(e1)
+	}
+	return
+}
diff --git a/vendor/github.com/Microsoft/go-winio/internal/socket/socket.go b/vendor/github.com/Microsoft/go-winio/internal/socket/socket.go
index 39e8c05f8f..aeb7b7250f 100644
--- a/vendor/github.com/Microsoft/go-winio/internal/socket/socket.go
+++ b/vendor/github.com/Microsoft/go-winio/internal/socket/socket.go
@@ -100,8 +100,8 @@ func (f *runtimeFunc) Load() error {
 			(*byte)(unsafe.Pointer(&f.addr)),
 			uint32(unsafe.Sizeof(f.addr)),
 			&n,
-			nil, //overlapped
-			0,   //completionRoutine
+			nil, // overlapped
+			0,   // completionRoutine
 		)
 	})
 	return f.err
diff --git a/vendor/github.com/Microsoft/go-winio/internal/stringbuffer/wstring.go b/vendor/github.com/Microsoft/go-winio/internal/stringbuffer/wstring.go
new file mode 100644
index 0000000000..7ad5057024
--- /dev/null
+++ b/vendor/github.com/Microsoft/go-winio/internal/stringbuffer/wstring.go
@@ -0,0 +1,132 @@
+package stringbuffer
+
+import (
+	"sync"
+	"unicode/utf16"
+)
+
+// TODO: worth exporting and using in mkwinsyscall?
+
+// Uint16BufferSize is the buffer size in the pool, chosen somewhat arbitrarily to accommodate
+// large path strings:
+// MAX_PATH (260) + size of volume GUID prefix (49) + null terminator = 310.
+const MinWStringCap = 310
+
+// use *[]uint16 since []uint16 creates an extra allocation where the slice header
+// is copied to heap and then referenced via pointer in the interface header that sync.Pool
+// stores.
+var pathPool = sync.Pool{ // if go1.18+ adds Pool[T], use that to store []uint16 directly
+	New: func() interface{} {
+		b := make([]uint16, MinWStringCap)
+		return &b
+	},
+}
+
+func newBuffer() []uint16 { return *(pathPool.Get().(*[]uint16)) }
+
+// freeBuffer copies the slice header data, and puts a pointer to that in the pool.
+// This avoids taking a pointer to the slice header in WString, which can be set to nil.
+func freeBuffer(b []uint16) { pathPool.Put(&b) }
+
+// WString is a wide string buffer ([]uint16) meant for storing UTF-16 encoded strings
+// for interacting with Win32 APIs.
+// Sizes are specified as uint32 and not int.
+//
+// It is not thread safe.
+type WString struct {
+	// type-def allows casting to []uint16 directly, use struct to prevent that and allow adding fields in the future.
+
+	// raw buffer
+	b []uint16
+}
+
+// NewWString returns a [WString] allocated from a shared pool with an
+// initial capacity of at least [MinWStringCap].
+// Since the buffer may have been previously used, its contents are not guaranteed to be empty.
+//
+// The buffer should be freed via [WString.Free]
+func NewWString() *WString {
+	return &WString{
+		b: newBuffer(),
+	}
+}
+
+func (b *WString) Free() {
+	if b.empty() {
+		return
+	}
+	freeBuffer(b.b)
+	b.b = nil
+}
+
+// ResizeTo grows the buffer to at least c and returns the new capacity, freeing the
+// previous buffer back into pool.
+func (b *WString) ResizeTo(c uint32) uint32 {
+	// allready sufficient (or n is 0)
+	if c <= b.Cap() {
+		return b.Cap()
+	}
+
+	if c <= MinWStringCap {
+		c = MinWStringCap
+	}
+	// allocate at-least double buffer size, as is done in [bytes.Buffer] and other places
+	if c <= 2*b.Cap() {
+		c = 2 * b.Cap()
+	}
+
+	b2 := make([]uint16, c)
+	if !b.empty() {
+		copy(b2, b.b)
+		freeBuffer(b.b)
+	}
+	b.b = b2
+	return c
+}
+
+// Buffer returns the underlying []uint16 buffer.
+func (b *WString) Buffer() []uint16 {
+	if b.empty() {
+		return nil
+	}
+	return b.b
+}
+
+// Pointer returns a pointer to the first uint16 in the buffer.
+// If the [WString.Free] has already been called, the pointer will be nil.
+func (b *WString) Pointer() *uint16 {
+	if b.empty() {
+		return nil
+	}
+	return &b.b[0]
+}
+
+// String returns the returns the UTF-8 encoding of the UTF-16 string in the buffer.
+//
+// It assumes that the data is null-terminated.
+func (b *WString) String() string {
+	// Using [windows.UTF16ToString] would require importing "golang.org/x/sys/windows"
+	// and would make this code Windows-only, which makes no sense.
+	// So copy UTF16ToString code into here.
+	// If other windows-specific code is added, switch to [windows.UTF16ToString]
+
+	s := b.b
+	for i, v := range s {
+		if v == 0 {
+			s = s[:i]
+			break
+		}
+	}
+	return string(utf16.Decode(s))
+}
+
+// Cap returns the underlying buffer capacity.
+func (b *WString) Cap() uint32 {
+	if b.empty() {
+		return 0
+	}
+	return b.cap()
+}
+
+func (b *WString) cap() uint32 { return uint32(cap(b.b)) }
+func (b *WString) empty() bool { return b == nil || b.cap() == 0 }
diff --git a/vendor/github.com/Microsoft/go-winio/pipe.go b/vendor/github.com/Microsoft/go-winio/pipe.go
index ca6e38fc00..25cc811031 100644
--- a/vendor/github.com/Microsoft/go-winio/pipe.go
+++ b/vendor/github.com/Microsoft/go-winio/pipe.go
@@ -16,11 +16,12 @@ import (
 	"unsafe"
 
 	"golang.org/x/sys/windows"
+
+	"github.com/Microsoft/go-winio/internal/fs"
 )
 
 //sys connectNamedPipe(pipe syscall.Handle, o *syscall.Overlapped) (err error) = ConnectNamedPipe
 //sys createNamedPipe(name string, flags uint32, pipeMode uint32, maxInstances uint32, outSize uint32, inSize uint32, defaultTimeout uint32, sa *syscall.SecurityAttributes) (handle syscall.Handle, err error)  [failretval==syscall.InvalidHandle] = CreateNamedPipeW
-//sys createFile(name string, access uint32, mode uint32, sa *syscall.SecurityAttributes, createmode uint32, attrs uint32, templatefile syscall.Handle) (handle syscall.Handle, err error) [failretval==syscall.InvalidHandle] = CreateFileW
 //sys getNamedPipeInfo(pipe syscall.Handle, flags *uint32, outSize *uint32, inSize *uint32, maxInstances *uint32) (err error) = GetNamedPipeInfo
 //sys getNamedPipeHandleState(pipe syscall.Handle, state *uint32, curInstances *uint32, maxCollectionCount *uint32, collectDataTimeout *uint32, userName *uint16, maxUserNameSize uint32) (err error) = GetNamedPipeHandleStateW
 //sys localAlloc(uFlags uint32, length uint32) (ptr uintptr) = LocalAlloc
@@ -163,19 +164,21 @@ func (s pipeAddress) String() string {
 }
 
 // tryDialPipe attempts to dial the pipe at `path` until `ctx` cancellation or timeout.
-func tryDialPipe(ctx context.Context, path *string, access uint32) (syscall.Handle, error) {
+func tryDialPipe(ctx context.Context, path *string, access fs.AccessMask) (syscall.Handle, error) {
 	for {
 		select {
 		case <-ctx.Done():
 			return syscall.Handle(0), ctx.Err()
 		default:
-			h, err := createFile(*path,
+			wh, err := fs.CreateFile(*path,
 				access,
-				0,
-				nil,
-				syscall.OPEN_EXISTING,
-				windows.FILE_FLAG_OVERLAPPED|windows.SECURITY_SQOS_PRESENT|windows.SECURITY_ANONYMOUS,
-				0)
+				0,   // mode
+				nil, // security attributes
+				fs.OPEN_EXISTING,
+				fs.FILE_FLAG_OVERLAPPED|fs.SECURITY_SQOS_PRESENT|fs.SECURITY_ANONYMOUS,
+				0, // template file handle
+			)
+			h := syscall.Handle(wh)
 			if err == nil {
 				return h, nil
 			}
@@ -219,7 +222,7 @@ func DialPipeContext(ctx context.Context, path string) (net.Conn, error) {
 func DialPipeAccess(ctx context.Context, path string, access uint32) (net.Conn, error) {
 	var err error
 	var h syscall.Handle
-	h, err = tryDialPipe(ctx, &path, access)
+	h, err = tryDialPipe(ctx, &path, fs.AccessMask(access))
 	if err != nil {
 		return nil, err
 	}
@@ -279,6 +282,7 @@ func makeServerPipeHandle(path string, sd []byte, c *PipeConfig, first bool) (sy
 	}
 	defer localFree(ntPath.Buffer)
 	oa.ObjectName = &ntPath
+	oa.Attributes = windows.OBJ_CASE_INSENSITIVE
 
 	// The security descriptor is only needed for the first pipe.
 	if first {
diff --git a/vendor/github.com/Microsoft/go-winio/zsyscall_windows.go b/vendor/github.com/Microsoft/go-winio/zsyscall_windows.go
index 83f45a1351..469b16f639 100644
--- a/vendor/github.com/Microsoft/go-winio/zsyscall_windows.go
+++ b/vendor/github.com/Microsoft/go-winio/zsyscall_windows.go
@@ -63,7 +63,6 @@ var (
 	procBackupWrite                                          = modkernel32.NewProc("BackupWrite")
 	procCancelIoEx                                           = modkernel32.NewProc("CancelIoEx")
 	procConnectNamedPipe                                     = modkernel32.NewProc("ConnectNamedPipe")
-	procCreateFileW                                          = modkernel32.NewProc("CreateFileW")
 	procCreateIoCompletionPort                               = modkernel32.NewProc("CreateIoCompletionPort")
 	procCreateNamedPipeW                                     = modkernel32.NewProc("CreateNamedPipeW")
 	procGetCurrentThread                                     = modkernel32.NewProc("GetCurrentThread")
@@ -305,24 +304,6 @@ func connectNamedPipe(pipe syscall.Handle, o *syscall.Overlapped) (err error) {
 	return
 }
 
-func createFile(name string, access uint32, mode uint32, sa *syscall.SecurityAttributes, createmode uint32, attrs uint32, templatefile syscall.Handle) (handle syscall.Handle, err error) {
-	var _p0 *uint16
-	_p0, err = syscall.UTF16PtrFromString(name)
-	if err != nil {
-		return
-	}
-	return _createFile(_p0, access, mode, sa, createmode, attrs, templatefile)
-}
-
-func _createFile(name *uint16, access uint32, mode uint32, sa *syscall.SecurityAttributes, createmode uint32, attrs uint32, templatefile syscall.Handle) (handle syscall.Handle, err error) {
-	r0, _, e1 := syscall.Syscall9(procCreateFileW.Addr(), 7, uintptr(unsafe.Pointer(name)), uintptr(access), uintptr(mode), uintptr(unsafe.Pointer(sa)), uintptr(createmode), uintptr(attrs), uintptr(templatefile), 0, 0)
-	handle = syscall.Handle(r0)
-	if handle == syscall.InvalidHandle {
-		err = errnoErr(e1)
-	}
-	return
-}
-
 func createIoCompletionPort(file syscall.Handle, port syscall.Handle, key uintptr, threadCount uint32) (newport syscall.Handle, err error) {
 	r0, _, e1 := syscall.Syscall6(procCreateIoCompletionPort.Addr(), 4, uintptr(file), uintptr(port), uintptr(key), uintptr(threadCount), 0, 0)
 	newport = syscall.Handle(r0)
diff --git a/vendor/github.com/containers/gvisor-tap-vsock/pkg/client/client.go b/vendor/github.com/containers/gvisor-tap-vsock/pkg/client/client.go
index 554d21886b..63a80420bb 100644
--- a/vendor/github.com/containers/gvisor-tap-vsock/pkg/client/client.go
+++ b/vendor/github.com/containers/gvisor-tap-vsock/pkg/client/client.go
@@ -80,3 +80,40 @@ func (c *Client) Unexpose(req *types.UnexposeRequest) error {
 	}
 	return nil
 }
+
+func (c *Client) ListDNS() ([]types.Zone, error) {
+	res, err := c.client.Get(fmt.Sprintf("%s%s", c.base, "/services/dns/all"))
+	if err != nil {
+		return nil, err
+	}
+	defer res.Body.Close()
+	if res.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("unexpected status: %d", res.StatusCode)
+	}
+	dec := json.NewDecoder(res.Body)
+	var dnsZone []types.Zone
+	if err := dec.Decode(&dnsZone); err != nil {
+		return nil, err
+	}
+	return dnsZone, nil
+}
+
+func (c *Client) AddDNS(req *types.Zone) error {
+	bin, err := json.Marshal(req)
+	if err != nil {
+		return err
+	}
+	res, err := c.client.Post(fmt.Sprintf("%s%s", c.base, "/services/dns/add"), "application/json", bytes.NewReader(bin))
+	if err != nil {
+		return err
+	}
+	defer res.Body.Close()
+	if res.StatusCode != http.StatusOK {
+		err, readErr := io.ReadAll(res.Body)
+		if readErr != nil {
+			return fmt.Errorf("error while reading error message: %v", readErr)
+		}
+		return errors.New(strings.TrimSpace(string(err)))
+	}
+	return nil
+}
diff --git a/vendor/github.com/containers/gvisor-tap-vsock/pkg/net/stdio/dial.go b/vendor/github.com/containers/gvisor-tap-vsock/pkg/net/stdio/dial.go
new file mode 100644
index 0000000000..51b69b7fc5
--- /dev/null
+++ b/vendor/github.com/containers/gvisor-tap-vsock/pkg/net/stdio/dial.go
@@ -0,0 +1,51 @@
+package stdio
+
+import (
+	"net"
+	"os"
+	"os/exec"
+	"strconv"
+)
+
+func Dial(endpoint string, arg ...string) (net.Conn, error) {
+	cmd := exec.Command(endpoint, arg...)
+	cmd.Stderr = os.Stderr
+
+	stdin, err := cmd.StdinPipe()
+	if err != nil {
+		return nil, err
+	}
+
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		return nil, err
+	}
+
+	err = cmd.Start()
+	if err != nil {
+		return nil, err
+	}
+
+	local := IoAddr{path: strconv.Itoa(os.Getpid())}
+	remote := IoAddr{path: strconv.Itoa(cmd.Process.Pid)}
+	conn := IoConn{
+		reader: stdout,
+		writer: stdin,
+		local:  local,
+		remote: remote,
+		close:  cmd.Process.Kill,
+	}
+	return conn, nil
+}
+
+func GetStdioConn() net.Conn {
+	local := IoAddr{path: strconv.Itoa(os.Getpid())}
+	remote := IoAddr{path: "remote"}
+	conn := IoConn{
+		writer: os.Stdout,
+		reader: os.Stdin,
+		local:  local,
+		remote: remote,
+	}
+	return conn
+}
diff --git a/vendor/github.com/containers/gvisor-tap-vsock/pkg/net/stdio/ioaddr.go b/vendor/github.com/containers/gvisor-tap-vsock/pkg/net/stdio/ioaddr.go
new file mode 100644
index 0000000000..4ed69a525f
--- /dev/null
+++ b/vendor/github.com/containers/gvisor-tap-vsock/pkg/net/stdio/ioaddr.go
@@ -0,0 +1,12 @@
+package stdio
+
+type IoAddr struct {
+	path string
+}
+
+func (a IoAddr) Network() string {
+	return "stdio"
+}
+func (a IoAddr) String() string {
+	return a.path
+}
diff --git a/vendor/github.com/containers/gvisor-tap-vsock/pkg/net/stdio/ioconn.go b/vendor/github.com/containers/gvisor-tap-vsock/pkg/net/stdio/ioconn.go
new file mode 100644
index 0000000000..6c180da249
--- /dev/null
+++ b/vendor/github.com/containers/gvisor-tap-vsock/pkg/net/stdio/ioconn.go
@@ -0,0 +1,50 @@
+package stdio
+
+import (
+	"io"
+	"net"
+	"time"
+)
+
+type IoConn struct {
+	writer io.Writer
+	reader io.Reader
+	local  net.Addr
+	remote net.Addr
+	close  func() error
+}
+
+func (c IoConn) Read(b []byte) (n int, err error) {
+	return c.reader.Read(b)
+}
+
+func (c IoConn) Write(b []byte) (n int, err error) {
+	return c.writer.Write(b)
+}
+
+func (c IoConn) Close() error {
+	if c.close != nil {
+		return c.close()
+	}
+	return nil
+}
+
+func (c IoConn) LocalAddr() net.Addr {
+	return c.local
+}
+
+func (c IoConn) RemoteAddr() net.Addr {
+	return c.remote
+}
+
+func (c IoConn) SetDeadline(_ time.Time) error {
+	return nil
+}
+
+func (c IoConn) SetReadDeadline(_ time.Time) error {
+	return nil
+}
+
+func (c IoConn) SetWriteDeadline(_ time.Time) error {
+	return nil
+}
diff --git a/vendor/github.com/containers/gvisor-tap-vsock/pkg/services/dns/dns.go b/vendor/github.com/containers/gvisor-tap-vsock/pkg/services/dns/dns.go
index d3dd2c817a..484f035ec0 100644
--- a/vendor/github.com/containers/gvisor-tap-vsock/pkg/services/dns/dns.go
+++ b/vendor/github.com/containers/gvisor-tap-vsock/pkg/services/dns/dns.go
@@ -2,9 +2,12 @@ package dns
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
 	"net"
+	"net/http"
 	"strings"
+	"sync"
 
 	"github.com/containers/gvisor-tap-vsock/pkg/types"
 	"github.com/miekg/dns"
@@ -12,13 +15,15 @@ import (
 )
 
 type dnsHandler struct {
-	zones []types.Zone
+	zones     []types.Zone
+	zonesLock sync.RWMutex
 }
 
 func (h *dnsHandler) handle(w dns.ResponseWriter, r *dns.Msg) {
 	m := new(dns.Msg)
 	m.SetReply(r)
 	m.RecursionAvailable = true
+	m.Compress = true
 	h.addAnswers(m)
 	if err := w.WriteMsg(m); err != nil {
 		log.Error(err)
@@ -26,6 +31,8 @@ func (h *dnsHandler) handle(w dns.ResponseWriter, r *dns.Msg) {
 }
 
 func (h *dnsHandler) addAnswers(m *dns.Msg) {
+	h.zonesLock.RLock()
+	defer h.zonesLock.RUnlock()
 	for _, q := range m.Question {
 		for _, zone := range h.zones {
 			zoneSuffix := fmt.Sprintf(".%s", zone.Name)
@@ -111,13 +118,60 @@ func (h *dnsHandler) addAnswers(m *dns.Msg) {
 	}
 }
 
-func Serve(udpConn net.PacketConn, zones []types.Zone) error {
-	mux := dns.NewServeMux()
+type Server struct {
+	udpConn net.PacketConn
+	tcpLn   net.Listener
+	handler *dnsHandler
+}
+
+func New(udpConn net.PacketConn, tcpLn net.Listener, zones []types.Zone) (*Server, error) {
 	handler := &dnsHandler{zones: zones}
-	mux.HandleFunc(".", handler.handle)
+	return &Server{udpConn: udpConn, tcpLn: tcpLn, handler: handler}, nil
+}
+
+func (s *Server) Serve() error {
+	mux := dns.NewServeMux()
+	mux.HandleFunc(".", s.handler.handle)
 	srv := &dns.Server{
-		PacketConn: udpConn,
+		PacketConn: s.udpConn,
 		Handler:    mux,
 	}
 	return srv.ActivateAndServe()
 }
+
+func (s *Server) ServeTCP() error {
+	mux := dns.NewServeMux()
+	mux.HandleFunc(".", s.handler.handle)
+	tcpSrv := &dns.Server{
+		Listener: s.tcpLn,
+		Handler:  mux,
+	}
+	return tcpSrv.ActivateAndServe()
+}
+
+func (s *Server) Mux() http.Handler {
+	mux := http.NewServeMux()
+	mux.HandleFunc("/all", func(w http.ResponseWriter, r *http.Request) {
+		s.handler.zonesLock.RLock()
+		_ = json.NewEncoder(w).Encode(s.handler.zones)
+		s.handler.zonesLock.RUnlock()
+	})
+
+	mux.HandleFunc("/add", func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost {
+			http.Error(w, "post only", http.StatusBadRequest)
+			return
+		}
+		var req types.Zone
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+			http.Error(w, err.Error(), http.StatusBadRequest)
+			return
+		}
+
+		s.handler.zonesLock.Lock()
+		s.handler.zones = append([]types.Zone{req}, s.handler.zones...)
+		s.handler.zonesLock.Unlock()
+		w.WriteHeader(http.StatusOK)
+	})
+	return mux
+}
diff --git a/vendor/github.com/containers/gvisor-tap-vsock/pkg/sshclient/npipe_unsupported.go b/vendor/github.com/containers/gvisor-tap-vsock/pkg/sshclient/npipe_unsupported.go
index e120b0018a..1cb4ee7ecf 100644
--- a/vendor/github.com/containers/gvisor-tap-vsock/pkg/sshclient/npipe_unsupported.go
+++ b/vendor/github.com/containers/gvisor-tap-vsock/pkg/sshclient/npipe_unsupported.go
@@ -9,6 +9,6 @@ import (
 	"net/url"
 )
 
-func ListenNpipe(socketURI *url.URL) (net.Listener, error) {
+func ListenNpipe(_ *url.URL) (net.Listener, error) {
 	return nil, errors.New("named pipes are not supported by this platform")
 }
diff --git a/vendor/github.com/containers/gvisor-tap-vsock/pkg/tap/connection.go b/vendor/github.com/containers/gvisor-tap-vsock/pkg/tap/connection.go
new file mode 100644
index 0000000000..1ab6e87341
--- /dev/null
+++ b/vendor/github.com/containers/gvisor-tap-vsock/pkg/tap/connection.go
@@ -0,0 +1,10 @@
+package tap
+
+import (
+	"net"
+)
+
+type protocolConn struct {
+	net.Conn
+	protocolImpl protocol
+}
diff --git a/vendor/github.com/containers/gvisor-tap-vsock/pkg/tap/link.go b/vendor/github.com/containers/gvisor-tap-vsock/pkg/tap/link.go
index c5ff3a7882..9aebf8573d 100644
--- a/vendor/github.com/containers/gvisor-tap-vsock/pkg/tap/link.go
+++ b/vendor/github.com/containers/gvisor-tap-vsock/pkg/tap/link.go
@@ -60,7 +60,7 @@ func (e *LinkEndpoint) DeliverNetworkPacket(protocol tcpip.NetworkProtocolNumber
 	e.dispatcher.DeliverNetworkPacket(protocol, pkt)
 }
 
-func (e *LinkEndpoint) AddHeader(pkt stack.PacketBufferPtr) {
+func (e *LinkEndpoint) AddHeader(_ stack.PacketBufferPtr) {
 }
 
 func (e *LinkEndpoint) Capabilities() stack.LinkEndpointCapabilities {
@@ -126,7 +126,7 @@ func (e *LinkEndpoint) writePacket(r stack.RouteInfo, protocol tcpip.NetworkProt
 	return nil
 }
 
-func (e *LinkEndpoint) WriteRawPacket(pkt stack.PacketBufferPtr) tcpip.Error {
+func (e *LinkEndpoint) WriteRawPacket(_ stack.PacketBufferPtr) tcpip.Error {
 	return &tcpip.ErrNotSupported{}
 }
 
diff --git a/vendor/github.com/containers/gvisor-tap-vsock/pkg/tap/protocol.go b/vendor/github.com/containers/gvisor-tap-vsock/pkg/tap/protocol.go
index d32d859aca..4fe09fefe5 100644
--- a/vendor/github.com/containers/gvisor-tap-vsock/pkg/tap/protocol.go
+++ b/vendor/github.com/containers/gvisor-tap-vsock/pkg/tap/protocol.go
@@ -1,6 +1,8 @@
 package tap
 
-import "encoding/binary"
+import (
+	"encoding/binary"
+)
 
 type protocol interface {
 	Stream() bool
diff --git a/vendor/github.com/containers/gvisor-tap-vsock/pkg/tap/switch.go b/vendor/github.com/containers/gvisor-tap-vsock/pkg/tap/switch.go
index 654fd5ea9e..a05b9ccbfc 100644
--- a/vendor/github.com/containers/gvisor-tap-vsock/pkg/tap/switch.go
+++ b/vendor/github.com/containers/gvisor-tap-vsock/pkg/tap/switch.go
@@ -1,6 +1,7 @@
 package tap
 
 import (
+	"bufio"
 	"context"
 	"io"
 	"net"
@@ -36,7 +37,7 @@ type Switch struct {
 	maxTransmissionUnit int
 
 	nextConnID int
-	conns      map[int]net.Conn
+	conns      map[int]protocolConn
 	connLock   sync.Mutex
 
 	cam     map[tcpip.LinkAddress]int
@@ -45,17 +46,14 @@ type Switch struct {
 	writeLock sync.Mutex
 
 	gateway VirtualDevice
-
-	protocol protocol
 }
 
-func NewSwitch(debug bool, mtu int, protocol types.Protocol) *Switch {
+func NewSwitch(debug bool, mtu int) *Switch {
 	return &Switch{
 		debug:               debug,
 		maxTransmissionUnit: mtu,
-		conns:               make(map[int]net.Conn),
+		conns:               make(map[int]protocolConn),
 		cam:                 make(map[tcpip.LinkAddress]int),
-		protocol:            protocolImplementation(protocol),
 	}
 }
 
@@ -73,13 +71,14 @@ func (e *Switch) Connect(ep VirtualDevice) {
 	e.gateway = ep
 }
 
-func (e *Switch) DeliverNetworkPacket(protocol tcpip.NetworkProtocolNumber, pkt stack.PacketBufferPtr) {
+func (e *Switch) DeliverNetworkPacket(_ tcpip.NetworkProtocolNumber, pkt stack.PacketBufferPtr) {
 	if err := e.tx(pkt); err != nil {
 		log.Error(err)
 	}
 }
 
-func (e *Switch) Accept(ctx context.Context, conn net.Conn) error {
+func (e *Switch) Accept(ctx context.Context, rawConn net.Conn, protocol types.Protocol) error {
+	conn := protocolConn{Conn: rawConn, protocolImpl: protocolImplementation(protocol)}
 	log.Infof("new connection from %s to %s", conn.RemoteAddr().String(), conn.LocalAddr().String())
 	id, failed := e.connect(conn)
 	if failed {
@@ -100,7 +99,7 @@ func (e *Switch) Accept(ctx context.Context, conn net.Conn) error {
 	return nil
 }
 
-func (e *Switch) connect(conn net.Conn) (int, bool) {
+func (e *Switch) connect(conn protocolConn) (int, bool) {
 	e.connLock.Lock()
 	defer e.connLock.Unlock()
 
@@ -112,23 +111,10 @@ func (e *Switch) connect(conn net.Conn) (int, bool) {
 }
 
 func (e *Switch) tx(pkt stack.PacketBufferPtr) error {
-	if e.protocol.Stream() {
-		return e.txStream(pkt, e.protocol.(streamProtocol))
-	}
-	return e.txNonStream(pkt)
-}
-
-func (e *Switch) txNonStream(pkt stack.PacketBufferPtr) error {
-	return e.txBuf(pkt, nil)
-}
-
-func (e *Switch) txStream(pkt stack.PacketBufferPtr, sProtocol streamProtocol) error {
-	size := sProtocol.Buf()
-	sProtocol.Write(size, pkt.Size())
-	return e.txBuf(pkt, size)
+	return e.txPkt(pkt)
 }
 
-func (e *Switch) txBuf(pkt stack.PacketBufferPtr, size []byte) error {
+func (e *Switch) txPkt(pkt stack.PacketBufferPtr) error {
 	e.writeLock.Lock()
 	defer e.writeLock.Unlock()
 
@@ -151,14 +137,9 @@ func (e *Switch) txBuf(pkt stack.PacketBufferPtr, size []byte) error {
 			if id == srcID {
 				continue
 			}
-			if len(size) > 0 {
-				if _, err := conn.Write(size); err != nil {
-					e.disconnect(id, conn)
-					return err
-				}
-			}
-			if _, err := conn.Write(buf); err != nil {
-				e.disconnect(id, conn)
+
+			err := e.txBuf(id, conn, buf)
+			if err != nil {
 				return err
 			}
 
@@ -173,17 +154,28 @@ func (e *Switch) txBuf(pkt stack.PacketBufferPtr, size []byte) error {
 		}
 		e.camLock.RUnlock()
 		conn := e.conns[id]
-		if len(size) > 0 {
-			if _, err := conn.Write(size); err != nil {
-				e.disconnect(id, conn)
-				return err
-			}
+		err := e.txBuf(id, conn, buf)
+		if err != nil {
+			return err
 		}
-		if _, err := conn.Write(buf); err != nil {
+		atomic.AddUint64(&e.Sent, uint64(pkt.Size()))
+	}
+	return nil
+}
+
+func (e *Switch) txBuf(id int, conn protocolConn, buf []byte) error {
+	if conn.protocolImpl.Stream() {
+		size := conn.protocolImpl.(streamProtocol).Buf()
+		conn.protocolImpl.(streamProtocol).Write(size, len(buf))
+
+		if _, err := conn.Write(size); err != nil {
 			e.disconnect(id, conn)
 			return err
 		}
-		atomic.AddUint64(&e.Sent, uint64(pkt.Size()))
+	}
+	if _, err := conn.Write(buf); err != nil {
+		e.disconnect(id, conn)
+		return err
 	}
 	return nil
 }
@@ -201,9 +193,9 @@ func (e *Switch) disconnect(id int, conn net.Conn) {
 	delete(e.conns, id)
 }
 
-func (e *Switch) rx(ctx context.Context, id int, conn net.Conn) error {
-	if e.protocol.Stream() {
-		return e.rxStream(ctx, id, conn, e.protocol.(streamProtocol))
+func (e *Switch) rx(ctx context.Context, id int, conn protocolConn) error {
+	if conn.protocolImpl.Stream() {
+		return e.rxStream(ctx, id, conn, conn.protocolImpl.(streamProtocol))
 	}
 	return e.rxNonStream(ctx, id, conn)
 }
@@ -229,6 +221,7 @@ loop:
 }
 
 func (e *Switch) rxStream(ctx context.Context, id int, conn net.Conn, sProtocol streamProtocol) error {
+	reader := bufio.NewReader(conn)
 	sizeBuf := sProtocol.Buf()
 loop:
 	for {
@@ -238,14 +231,14 @@ loop:
 		default:
 			// passthrough
 		}
-		_, err := io.ReadFull(conn, sizeBuf)
+		_, err := io.ReadFull(reader, sizeBuf)
 		if err != nil {
 			return errors.Wrap(err, "cannot read size from socket")
 		}
 		size := sProtocol.Read(sizeBuf)
 
 		buf := make([]byte, size)
-		_, err = io.ReadFull(conn, buf)
+		_, err = io.ReadFull(reader, buf)
 		if err != nil {
 			return errors.Wrap(err, "cannot read packet from socket")
 		}
@@ -254,7 +247,7 @@ loop:
 	return nil
 }
 
-func (e *Switch) rxBuf(ctx context.Context, id int, buf []byte) {
+func (e *Switch) rxBuf(_ context.Context, id int, buf []byte) {
 	if e.debug {
 		packet := gopacket.NewPacket(buf, layers.LayerTypeEthernet, gopacket.Default)
 		log.Info(packet.String())
diff --git a/vendor/github.com/containers/gvisor-tap-vsock/pkg/transport/dial_linux.go b/vendor/github.com/containers/gvisor-tap-vsock/pkg/transport/dial_linux.go
index 396652a7b1..6030bf043c 100644
--- a/vendor/github.com/containers/gvisor-tap-vsock/pkg/transport/dial_linux.go
+++ b/vendor/github.com/containers/gvisor-tap-vsock/pkg/transport/dial_linux.go
@@ -1,10 +1,12 @@
 package transport
 
 import (
+	"fmt"
 	"net"
 	"net/url"
 	"strconv"
 
+	"github.com/containers/gvisor-tap-vsock/pkg/net/stdio"
 	mdlayhervsock "github.com/mdlayher/vsock"
 	"github.com/pkg/errors"
 )
@@ -29,6 +31,15 @@ func Dial(endpoint string) (net.Conn, string, error) {
 	case "unix":
 		conn, err := net.Dial("unix", parsed.Path)
 		return conn, "/connect", err
+	case "stdio":
+		var values []string
+		for k, vs := range parsed.Query() {
+			for _, v := range vs {
+				values = append(values, fmt.Sprintf("-%s=%s", k, v))
+			}
+		}
+		conn, err := stdio.Dial(parsed.Path, values...)
+		return conn, "", err
 	default:
 		return nil, "", errors.New("unexpected scheme")
 	}
diff --git a/vendor/github.com/containers/gvisor-tap-vsock/pkg/types/configuration.go b/vendor/github.com/containers/gvisor-tap-vsock/pkg/types/configuration.go
index e4728a656a..ec48c844f0 100644
--- a/vendor/github.com/containers/gvisor-tap-vsock/pkg/types/configuration.go
+++ b/vendor/github.com/containers/gvisor-tap-vsock/pkg/types/configuration.go
@@ -48,19 +48,21 @@ type Configuration struct {
 	// Allow to assign a pre-defined MAC address to an Hyperkit VM
 	VpnKitUUIDMacAddresses map[string]string
 
-	// Qemu or Hyperkit protocol
-	// Qemu protocol is 32bits big endian size of the packet, then the packet.
-	// Hyperkit protocol is handshake, then 16bits little endian size of packet, then the packet.
-	// Bess protocol transfers bare L2 packets as SOCK_SEQPACKET.
+	// Protocol to be used. Only for /connect mux
 	Protocol Protocol
 }
 
 type Protocol string
 
 const (
+	// HyperKitProtocol is handshake, then 16bits little endian size of packet, then the packet.
 	HyperKitProtocol Protocol = "hyperkit"
-	QemuProtocol     Protocol = "qemu"
-	BessProtocol     Protocol = "bess"
+	// QemuProtocol is 32bits big endian size of the packet, then the packet.
+	QemuProtocol Protocol = "qemu"
+	// BessProtocol transfers bare L2 packets as SOCK_SEQPACKET.
+	BessProtocol Protocol = "bess"
+	// StdioProtocol is HyperKitProtocol without the handshake
+	StdioProtocol Protocol = "stdio"
 )
 
 type Zone struct {
diff --git a/vendor/github.com/containers/gvisor-tap-vsock/pkg/virtualnetwork/bess.go b/vendor/github.com/containers/gvisor-tap-vsock/pkg/virtualnetwork/bess.go
index 71734e2436..a797731421 100644
--- a/vendor/github.com/containers/gvisor-tap-vsock/pkg/virtualnetwork/bess.go
+++ b/vendor/github.com/containers/gvisor-tap-vsock/pkg/virtualnetwork/bess.go
@@ -3,8 +3,10 @@ package virtualnetwork
 import (
 	"context"
 	"net"
+
+	"github.com/containers/gvisor-tap-vsock/pkg/types"
 )
 
 func (n *VirtualNetwork) AcceptBess(ctx context.Context, conn net.Conn) error {
-	return n.networkSwitch.Accept(ctx, conn)
+	return n.networkSwitch.Accept(ctx, conn, types.BessProtocol)
 }
diff --git a/vendor/github.com/containers/gvisor-tap-vsock/pkg/virtualnetwork/mux.go b/vendor/github.com/containers/gvisor-tap-vsock/pkg/virtualnetwork/mux.go
index b81d493a5c..0b9c416057 100644
--- a/vendor/github.com/containers/gvisor-tap-vsock/pkg/virtualnetwork/mux.go
+++ b/vendor/github.com/containers/gvisor-tap-vsock/pkg/virtualnetwork/mux.go
@@ -45,7 +45,7 @@ func (n *VirtualNetwork) Mux() *http.ServeMux {
 			return
 		}
 
-		_ = n.networkSwitch.Accept(context.Background(), conn)
+		_ = n.networkSwitch.Accept(context.Background(), conn, n.configuration.Protocol)
 	})
 	mux.HandleFunc("/tunnel", func(w http.ResponseWriter, r *http.Request) {
 		ip := r.URL.Query().Get("ip")
diff --git a/vendor/github.com/containers/gvisor-tap-vsock/pkg/virtualnetwork/qemu.go b/vendor/github.com/containers/gvisor-tap-vsock/pkg/virtualnetwork/qemu.go
index 1e1d15af25..20fbfede8d 100644
--- a/vendor/github.com/containers/gvisor-tap-vsock/pkg/virtualnetwork/qemu.go
+++ b/vendor/github.com/containers/gvisor-tap-vsock/pkg/virtualnetwork/qemu.go
@@ -3,8 +3,10 @@ package virtualnetwork
 import (
 	"context"
 	"net"
+
+	"github.com/containers/gvisor-tap-vsock/pkg/types"
 )
 
 func (n *VirtualNetwork) AcceptQemu(ctx context.Context, conn net.Conn) error {
-	return n.networkSwitch.Accept(ctx, conn)
+	return n.networkSwitch.Accept(ctx, conn, types.QemuProtocol)
 }
diff --git a/vendor/github.com/containers/gvisor-tap-vsock/pkg/virtualnetwork/services.go b/vendor/github.com/containers/gvisor-tap-vsock/pkg/virtualnetwork/services.go
index 606e52cc10..ec2173a2e5 100644
--- a/vendor/github.com/containers/gvisor-tap-vsock/pkg/virtualnetwork/services.go
+++ b/vendor/github.com/containers/gvisor-tap-vsock/pkg/virtualnetwork/services.go
@@ -29,7 +29,8 @@ func addServices(configuration *types.Configuration, s *stack.Stack, ipPool *tap
 	udpForwarder := forwarder.UDP(s, translation, &natLock)
 	s.SetTransportProtocolHandler(udp.ProtocolNumber, udpForwarder.HandlePacket)
 
-	if err := dnsServer(configuration, s); err != nil {
+	dnsMux, err := dnsServer(configuration, s)
+	if err != nil {
 		return nil, err
 	}
 
@@ -45,6 +46,7 @@ func addServices(configuration *types.Configuration, s *stack.Stack, ipPool *tap
 	mux := http.NewServeMux()
 	mux.Handle("/forwarder/", http.StripPrefix("/forwarder", forwarderMux))
 	mux.Handle("/dhcp/", http.StripPrefix("/dhcp", dhcpMux))
+	mux.Handle("/dns/", http.StripPrefix("/dns", dnsMux))
 	return mux, nil
 }
 
@@ -56,22 +58,41 @@ func parseNATTable(configuration *types.Configuration) map[tcpip.Address]tcpip.A
 	return translation
 }
 
-func dnsServer(configuration *types.Configuration, s *stack.Stack) error {
+func dnsServer(configuration *types.Configuration, s *stack.Stack) (http.Handler, error) {
 	udpConn, err := gonet.DialUDP(s, &tcpip.FullAddress{
 		NIC:  1,
 		Addr: tcpip.Address(net.ParseIP(configuration.GatewayIP).To4()),
 		Port: uint16(53),
 	}, nil, ipv4.ProtocolNumber)
 	if err != nil {
-		return err
+		return nil, err
+	}
+
+	tcpLn, err := gonet.ListenTCP(s, tcpip.FullAddress{
+		NIC:  1,
+		Addr: tcpip.Address(net.ParseIP(configuration.GatewayIP).To4()),
+		Port: uint16(53),
+	}, ipv4.ProtocolNumber)
+	if err != nil {
+		return nil, err
+	}
+
+	server, err := dns.New(udpConn, tcpLn, configuration.DNS)
+	if err != nil {
+		return nil, err
 	}
 
 	go func() {
-		if err := dns.Serve(udpConn, configuration.DNS); err != nil {
+		if err := server.Serve(); err != nil {
 			log.Error(err)
 		}
 	}()
-	return nil
+	go func() {
+		if err := server.ServeTCP(); err != nil {
+			log.Error(err)
+		}
+	}()
+	return server.Mux(), nil
 }
 
 func dhcpServer(configuration *types.Configuration, s *stack.Stack, ipPool *tap.IPPool) (http.Handler, error) {
diff --git a/vendor/github.com/containers/gvisor-tap-vsock/pkg/virtualnetwork/stdio.go b/vendor/github.com/containers/gvisor-tap-vsock/pkg/virtualnetwork/stdio.go
new file mode 100644
index 0000000000..cf193d5411
--- /dev/null
+++ b/vendor/github.com/containers/gvisor-tap-vsock/pkg/virtualnetwork/stdio.go
@@ -0,0 +1,12 @@
+package virtualnetwork
+
+import (
+	"context"
+	"net"
+
+	"github.com/containers/gvisor-tap-vsock/pkg/types"
+)
+
+func (n *VirtualNetwork) AcceptStdio(ctx context.Context, conn net.Conn) error {
+	return n.networkSwitch.Accept(ctx, conn, types.StdioProtocol)
+}
diff --git a/vendor/github.com/containers/gvisor-tap-vsock/pkg/virtualnetwork/virtualnetwork.go b/vendor/github.com/containers/gvisor-tap-vsock/pkg/virtualnetwork/virtualnetwork.go
index 7b3aeb82c5..5958738774 100644
--- a/vendor/github.com/containers/gvisor-tap-vsock/pkg/virtualnetwork/virtualnetwork.go
+++ b/vendor/github.com/containers/gvisor-tap-vsock/pkg/virtualnetwork/virtualnetwork.go
@@ -45,7 +45,7 @@ func New(configuration *types.Configuration) (*VirtualNetwork, error) {
 	if err != nil {
 		return nil, errors.Wrap(err, "cannot create tap endpoint")
 	}
-	networkSwitch := tap.NewSwitch(configuration.Debug, configuration.MTU, configuration.Protocol)
+	networkSwitch := tap.NewSwitch(configuration.Debug, configuration.MTU)
 	tapEndpoint.Connect(networkSwitch)
 	networkSwitch.Connect(tapEndpoint)
 
diff --git a/vendor/github.com/containers/gvisor-tap-vsock/pkg/virtualnetwork/vpnkit.go b/vendor/github.com/containers/gvisor-tap-vsock/pkg/virtualnetwork/vpnkit.go
index 0a699705ae..577670c6e2 100644
--- a/vendor/github.com/containers/gvisor-tap-vsock/pkg/virtualnetwork/vpnkit.go
+++ b/vendor/github.com/containers/gvisor-tap-vsock/pkg/virtualnetwork/vpnkit.go
@@ -16,7 +16,7 @@ func (n *VirtualNetwork) AcceptVpnKit(conn net.Conn) error {
 	if err := vpnkitHandshake(conn, n.configuration); err != nil {
 		log.Error(err)
 	}
-	_ = n.networkSwitch.Accept(context.Background(), conn)
+	_ = n.networkSwitch.Accept(context.Background(), conn, types.HyperKitProtocol)
 	return nil
 }
 
diff --git a/vendor/github.com/go-logr/logr/.golangci.yaml b/vendor/github.com/go-logr/logr/.golangci.yaml
index 94ff801df1..0cffafa7bf 100644
--- a/vendor/github.com/go-logr/logr/.golangci.yaml
+++ b/vendor/github.com/go-logr/logr/.golangci.yaml
@@ -6,7 +6,6 @@ linters:
   disable-all: true
   enable:
     - asciicheck
-    - deadcode
     - errcheck
     - forcetypeassert
     - gocritic
@@ -18,10 +17,8 @@ linters:
     - misspell
     - revive
     - staticcheck
-    - structcheck
     - typecheck
     - unused
-    - varcheck
 
 issues:
   exclude-use-default: false
diff --git a/vendor/github.com/go-logr/logr/discard.go b/vendor/github.com/go-logr/logr/discard.go
index 9d92a38f1d..99fe8be93c 100644
--- a/vendor/github.com/go-logr/logr/discard.go
+++ b/vendor/github.com/go-logr/logr/discard.go
@@ -20,35 +20,5 @@ package logr
 // used whenever the caller is not interested in the logs.  Logger instances
 // produced by this function always compare as equal.
 func Discard() Logger {
-	return Logger{
-		level: 0,
-		sink:  discardLogSink{},
-	}
-}
-
-// discardLogSink is a LogSink that discards all messages.
-type discardLogSink struct{}
-
-// Verify that it actually implements the interface
-var _ LogSink = discardLogSink{}
-
-func (l discardLogSink) Init(RuntimeInfo) {
-}
-
-func (l discardLogSink) Enabled(int) bool {
-	return false
-}
-
-func (l discardLogSink) Info(int, string, ...interface{}) {
-}
-
-func (l discardLogSink) Error(error, string, ...interface{}) {
-}
-
-func (l discardLogSink) WithValues(...interface{}) LogSink {
-	return l
-}
-
-func (l discardLogSink) WithName(string) LogSink {
-	return l
+	return New(nil)
 }
diff --git a/vendor/github.com/go-logr/logr/funcr/funcr.go b/vendor/github.com/go-logr/logr/funcr/funcr.go
index 7accdb0c40..e52f0cd01e 100644
--- a/vendor/github.com/go-logr/logr/funcr/funcr.go
+++ b/vendor/github.com/go-logr/logr/funcr/funcr.go
@@ -21,13 +21,13 @@ limitations under the License.
 // github.com/go-logr/logr.LogSink with output through an arbitrary
 // "write" function.  See New and NewJSON for details.
 //
-// Custom LogSinks
+// # Custom LogSinks
 //
 // For users who need more control, a funcr.Formatter can be embedded inside
 // your own custom LogSink implementation. This is useful when the LogSink
 // needs to implement additional methods, for example.
 //
-// Formatting
+// # Formatting
 //
 // This will respect logr.Marshaler, fmt.Stringer, and error interfaces for
 // values which are being logged.  When rendering a struct, funcr will use Go's
@@ -37,6 +37,7 @@ package funcr
 import (
 	"bytes"
 	"encoding"
+	"encoding/json"
 	"fmt"
 	"path/filepath"
 	"reflect"
@@ -217,7 +218,7 @@ func newFormatter(opts Options, outfmt outputFormat) Formatter {
 		prefix:       "",
 		values:       nil,
 		depth:        0,
-		opts:         opts,
+		opts:         &opts,
 	}
 	return f
 }
@@ -231,7 +232,7 @@ type Formatter struct {
 	values       []interface{}
 	valuesStr    string
 	depth        int
-	opts         Options
+	opts         *Options
 }
 
 // outputFormat indicates which outputFormat to use.
@@ -447,6 +448,7 @@ func (f Formatter) prettyWithFlags(value interface{}, flags uint32, depth int) s
 		if flags&flagRawStruct == 0 {
 			buf.WriteByte('{')
 		}
+		printComma := false // testing i>0 is not enough because of JSON omitted fields
 		for i := 0; i < t.NumField(); i++ {
 			fld := t.Field(i)
 			if fld.PkgPath != "" {
@@ -478,9 +480,10 @@ func (f Formatter) prettyWithFlags(value interface{}, flags uint32, depth int) s
 			if omitempty && isEmpty(v.Field(i)) {
 				continue
 			}
-			if i > 0 {
+			if printComma {
 				buf.WriteByte(',')
 			}
+			printComma = true // if we got here, we are rendering a field
 			if fld.Anonymous && fld.Type.Kind() == reflect.Struct && name == "" {
 				buf.WriteString(f.prettyWithFlags(v.Field(i).Interface(), flags|flagRawStruct, depth+1))
 				continue
@@ -500,6 +503,20 @@ func (f Formatter) prettyWithFlags(value interface{}, flags uint32, depth int) s
 		}
 		return buf.String()
 	case reflect.Slice, reflect.Array:
+		// If this is outputing as JSON make sure this isn't really a json.RawMessage.
+		// If so just emit "as-is" and don't pretty it as that will just print
+		// it as [X,Y,Z,...] which isn't terribly useful vs the string form you really want.
+		if f.outputFormat == outputJSON {
+			if rm, ok := value.(json.RawMessage); ok {
+				// If it's empty make sure we emit an empty value as the array style would below.
+				if len(rm) > 0 {
+					buf.Write(rm)
+				} else {
+					buf.WriteString("null")
+				}
+				return buf.String()
+			}
+		}
 		buf.WriteByte('[')
 		for i := 0; i < v.Len(); i++ {
 			if i > 0 {
diff --git a/vendor/github.com/go-logr/logr/logr.go b/vendor/github.com/go-logr/logr/logr.go
index c3b56b3d2c..e027aea3fd 100644
--- a/vendor/github.com/go-logr/logr/logr.go
+++ b/vendor/github.com/go-logr/logr/logr.go
@@ -21,7 +21,7 @@ limitations under the License.
 // to back that API.  Packages in the Go ecosystem can depend on this package,
 // while callers can implement logging with whatever backend is appropriate.
 //
-// Usage
+// # Usage
 //
 // Logging is done using a Logger instance.  Logger is a concrete type with
 // methods, which defers the actual logging to a LogSink interface.  The main
@@ -30,16 +30,20 @@ limitations under the License.
 // "structured logging".
 //
 // With Go's standard log package, we might write:
-//   log.Printf("setting target value %s", targetValue)
+//
+//	log.Printf("setting target value %s", targetValue)
 //
 // With logr's structured logging, we'd write:
-//   logger.Info("setting target", "value", targetValue)
+//
+//	logger.Info("setting target", "value", targetValue)
 //
 // Errors are much the same.  Instead of:
-//   log.Printf("failed to open the pod bay door for user %s: %v", user, err)
+//
+//	log.Printf("failed to open the pod bay door for user %s: %v", user, err)
 //
 // We'd write:
-//   logger.Error(err, "failed to open the pod bay door", "user", user)
+//
+//	logger.Error(err, "failed to open the pod bay door", "user", user)
 //
 // Info() and Error() are very similar, but they are separate methods so that
 // LogSink implementations can choose to do things like attach additional
@@ -47,7 +51,7 @@ limitations under the License.
 // always logged, regardless of the current verbosity.  If there is no error
 // instance available, passing nil is valid.
 //
-// Verbosity
+// # Verbosity
 //
 // Often we want to log information only when the application in "verbose
 // mode".  To write log lines that are more verbose, Logger has a V() method.
@@ -58,20 +62,22 @@ limitations under the License.
 // Error messages do not have a verbosity level and are always logged.
 //
 // Where we might have written:
-//   if flVerbose >= 2 {
-//       log.Printf("an unusual thing happened")
-//   }
+//
+//	if flVerbose >= 2 {
+//	    log.Printf("an unusual thing happened")
+//	}
 //
 // We can write:
-//   logger.V(2).Info("an unusual thing happened")
 //
-// Logger Names
+//	logger.V(2).Info("an unusual thing happened")
+//
+// # Logger Names
 //
 // Logger instances can have name strings so that all messages logged through
 // that instance have additional context.  For example, you might want to add
 // a subsystem name:
 //
-//   logger.WithName("compactor").Info("started", "time", time.Now())
+//	logger.WithName("compactor").Info("started", "time", time.Now())
 //
 // The WithName() method returns a new Logger, which can be passed to
 // constructors or other functions for further use.  Repeated use of WithName()
@@ -82,25 +88,27 @@ limitations under the License.
 // joining operation (e.g. whitespace, commas, periods, slashes, brackets,
 // quotes, etc).
 //
-// Saved Values
+// # Saved Values
 //
 // Logger instances can store any number of key/value pairs, which will be
 // logged alongside all messages logged through that instance.  For example,
 // you might want to create a Logger instance per managed object:
 //
 // With the standard log package, we might write:
-//   log.Printf("decided to set field foo to value %q for object %s/%s",
-//       targetValue, object.Namespace, object.Name)
+//
+//	log.Printf("decided to set field foo to value %q for object %s/%s",
+//	    targetValue, object.Namespace, object.Name)
 //
 // With logr we'd write:
-//   // Elsewhere: set up the logger to log the object name.
-//   obj.logger = mainLogger.WithValues(
-//       "name", obj.name, "namespace", obj.namespace)
 //
-//   // later on...
-//   obj.logger.Info("setting foo", "value", targetValue)
+//	// Elsewhere: set up the logger to log the object name.
+//	obj.logger = mainLogger.WithValues(
+//	    "name", obj.name, "namespace", obj.namespace)
+//
+//	// later on...
+//	obj.logger.Info("setting foo", "value", targetValue)
 //
-// Best Practices
+// # Best Practices
 //
 // Logger has very few hard rules, with the goal that LogSink implementations
 // might have a lot of freedom to differentiate.  There are, however, some
@@ -124,15 +132,15 @@ limitations under the License.
 // around. For cases where passing a logger is optional, a pointer to Logger
 // should be used.
 //
-// Key Naming Conventions
+// # Key Naming Conventions
 //
 // Keys are not strictly required to conform to any specification or regex, but
 // it is recommended that they:
-//   * be human-readable and meaningful (not auto-generated or simple ordinals)
-//   * be constant (not dependent on input data)
-//   * contain only printable characters
-//   * not contain whitespace or punctuation
-//   * use lower case for simple keys and lowerCamelCase for more complex ones
+//   - be human-readable and meaningful (not auto-generated or simple ordinals)
+//   - be constant (not dependent on input data)
+//   - contain only printable characters
+//   - not contain whitespace or punctuation
+//   - use lower case for simple keys and lowerCamelCase for more complex ones
 //
 // These guidelines help ensure that log data is processed properly regardless
 // of the log implementation.  For example, log implementations will try to
@@ -141,51 +149,54 @@ limitations under the License.
 // While users are generally free to use key names of their choice, it's
 // generally best to avoid using the following keys, as they're frequently used
 // by implementations:
-//   * "caller": the calling information (file/line) of a particular log line
-//   * "error": the underlying error value in the `Error` method
-//   * "level": the log level
-//   * "logger": the name of the associated logger
-//   * "msg": the log message
-//   * "stacktrace": the stack trace associated with a particular log line or
-//                   error (often from the `Error` message)
-//   * "ts": the timestamp for a log line
+//   - "caller": the calling information (file/line) of a particular log line
+//   - "error": the underlying error value in the `Error` method
+//   - "level": the log level
+//   - "logger": the name of the associated logger
+//   - "msg": the log message
+//   - "stacktrace": the stack trace associated with a particular log line or
+//     error (often from the `Error` message)
+//   - "ts": the timestamp for a log line
 //
 // Implementations are encouraged to make use of these keys to represent the
 // above concepts, when necessary (for example, in a pure-JSON output form, it
 // would be necessary to represent at least message and timestamp as ordinary
 // named values).
 //
-// Break Glass
+// # Break Glass
 //
 // Implementations may choose to give callers access to the underlying
 // logging implementation.  The recommended pattern for this is:
-//   // Underlier exposes access to the underlying logging implementation.
-//   // Since callers only have a logr.Logger, they have to know which
-//   // implementation is in use, so this interface is less of an abstraction
-//   // and more of way to test type conversion.
-//   type Underlier interface {
-//       GetUnderlying() <underlying-type>
-//   }
+//
+//	// Underlier exposes access to the underlying logging implementation.
+//	// Since callers only have a logr.Logger, they have to know which
+//	// implementation is in use, so this interface is less of an abstraction
+//	// and more of way to test type conversion.
+//	type Underlier interface {
+//	    GetUnderlying() <underlying-type>
+//	}
 //
 // Logger grants access to the sink to enable type assertions like this:
-//   func DoSomethingWithImpl(log logr.Logger) {
-//       if underlier, ok := log.GetSink()(impl.Underlier) {
-//          implLogger := underlier.GetUnderlying()
-//          ...
-//       }
-//   }
+//
+//	func DoSomethingWithImpl(log logr.Logger) {
+//	    if underlier, ok := log.GetSink().(impl.Underlier); ok {
+//	       implLogger := underlier.GetUnderlying()
+//	       ...
+//	    }
+//	}
 //
 // Custom `With*` functions can be implemented by copying the complete
 // Logger struct and replacing the sink in the copy:
-//   // WithFooBar changes the foobar parameter in the log sink and returns a
-//   // new logger with that modified sink.  It does nothing for loggers where
-//   // the sink doesn't support that parameter.
-//   func WithFoobar(log logr.Logger, foobar int) logr.Logger {
-//      if foobarLogSink, ok := log.GetSink()(FoobarSink); ok {
-//         log = log.WithSink(foobarLogSink.WithFooBar(foobar))
-//      }
-//      return log
-//   }
+//
+//	// WithFooBar changes the foobar parameter in the log sink and returns a
+//	// new logger with that modified sink.  It does nothing for loggers where
+//	// the sink doesn't support that parameter.
+//	func WithFoobar(log logr.Logger, foobar int) logr.Logger {
+//	   if foobarLogSink, ok := log.GetSink().(FoobarSink); ok {
+//	      log = log.WithSink(foobarLogSink.WithFooBar(foobar))
+//	   }
+//	   return log
+//	}
 //
 // Don't use New to construct a new Logger with a LogSink retrieved from an
 // existing Logger. Source code attribution might not work correctly and
@@ -201,11 +212,14 @@ import (
 )
 
 // New returns a new Logger instance.  This is primarily used by libraries
-// implementing LogSink, rather than end users.
+// implementing LogSink, rather than end users.  Passing a nil sink will create
+// a Logger which discards all log lines.
 func New(sink LogSink) Logger {
 	logger := Logger{}
 	logger.setSink(sink)
-	sink.Init(runtimeInfo)
+	if sink != nil {
+		sink.Init(runtimeInfo)
+	}
 	return logger
 }
 
@@ -244,7 +258,7 @@ type Logger struct {
 // Enabled tests whether this Logger is enabled.  For example, commandline
 // flags might be used to set the logging verbosity and disable some info logs.
 func (l Logger) Enabled() bool {
-	return l.sink.Enabled(l.level)
+	return l.sink != nil && l.sink.Enabled(l.level)
 }
 
 // Info logs a non-error message with the given key/value pairs as context.
@@ -254,6 +268,9 @@ func (l Logger) Enabled() bool {
 // information.  The key/value pairs must alternate string keys and arbitrary
 // values.
 func (l Logger) Info(msg string, keysAndValues ...interface{}) {
+	if l.sink == nil {
+		return
+	}
 	if l.Enabled() {
 		if withHelper, ok := l.sink.(CallStackHelperLogSink); ok {
 			withHelper.GetCallStackHelper()()
@@ -273,6 +290,9 @@ func (l Logger) Info(msg string, keysAndValues ...interface{}) {
 // triggered this log line, if present. The err parameter is optional
 // and nil may be passed instead of an error instance.
 func (l Logger) Error(err error, msg string, keysAndValues ...interface{}) {
+	if l.sink == nil {
+		return
+	}
 	if withHelper, ok := l.sink.(CallStackHelperLogSink); ok {
 		withHelper.GetCallStackHelper()()
 	}
@@ -284,6 +304,9 @@ func (l Logger) Error(err error, msg string, keysAndValues ...interface{}) {
 // level means a log message is less important.  Negative V-levels are treated
 // as 0.
 func (l Logger) V(level int) Logger {
+	if l.sink == nil {
+		return l
+	}
 	if level < 0 {
 		level = 0
 	}
@@ -294,6 +317,9 @@ func (l Logger) V(level int) Logger {
 // WithValues returns a new Logger instance with additional key/value pairs.
 // See Info for documentation on how key/value pairs work.
 func (l Logger) WithValues(keysAndValues ...interface{}) Logger {
+	if l.sink == nil {
+		return l
+	}
 	l.setSink(l.sink.WithValues(keysAndValues...))
 	return l
 }
@@ -304,6 +330,9 @@ func (l Logger) WithValues(keysAndValues ...interface{}) Logger {
 // contain only letters, digits, and hyphens (see the package documentation for
 // more information).
 func (l Logger) WithName(name string) Logger {
+	if l.sink == nil {
+		return l
+	}
 	l.setSink(l.sink.WithName(name))
 	return l
 }
@@ -324,6 +353,9 @@ func (l Logger) WithName(name string) Logger {
 // WithCallDepth(1) because it works with implementions that support the
 // CallDepthLogSink and/or CallStackHelperLogSink interfaces.
 func (l Logger) WithCallDepth(depth int) Logger {
+	if l.sink == nil {
+		return l
+	}
 	if withCallDepth, ok := l.sink.(CallDepthLogSink); ok {
 		l.setSink(withCallDepth.WithCallDepth(depth))
 	}
@@ -345,6 +377,9 @@ func (l Logger) WithCallDepth(depth int) Logger {
 // implementation does not support either of these, the original Logger will be
 // returned.
 func (l Logger) WithCallStackHelper() (func(), Logger) {
+	if l.sink == nil {
+		return func() {}, l
+	}
 	var helper func()
 	if withCallDepth, ok := l.sink.(CallDepthLogSink); ok {
 		l.setSink(withCallDepth.WithCallDepth(1))
@@ -357,6 +392,11 @@ func (l Logger) WithCallStackHelper() (func(), Logger) {
 	return helper, l
 }
 
+// IsZero returns true if this logger is an uninitialized zero value
+func (l Logger) IsZero() bool {
+	return l.sink == nil
+}
+
 // contextKey is how we find Loggers in a context.Context.
 type contextKey struct{}
 
@@ -442,7 +482,7 @@ type LogSink interface {
 	WithName(name string) LogSink
 }
 
-// CallDepthLogSink represents a Logger that knows how to climb the call stack
+// CallDepthLogSink represents a LogSink that knows how to climb the call stack
 // to identify the original call site and can offset the depth by a specified
 // number of frames.  This is useful for users who have helper functions
 // between the "real" call site and the actual calls to Logger methods.
@@ -467,7 +507,7 @@ type CallDepthLogSink interface {
 	WithCallDepth(depth int) LogSink
 }
 
-// CallStackHelperLogSink represents a Logger that knows how to climb
+// CallStackHelperLogSink represents a LogSink that knows how to climb
 // the call stack to identify the original call site and can skip
 // intermediate helper functions if they mark themselves as
 // helper. Go's testing package uses that approach.
diff --git a/vendor/github.com/golang/protobuf/jsonpb/decode.go b/vendor/github.com/golang/protobuf/jsonpb/decode.go
index 60e82caa9a..6c16c255ff 100644
--- a/vendor/github.com/golang/protobuf/jsonpb/decode.go
+++ b/vendor/github.com/golang/protobuf/jsonpb/decode.go
@@ -386,8 +386,14 @@ func (u *Unmarshaler) unmarshalMessage(m protoreflect.Message, in []byte) error
 }
 
 func isSingularWellKnownValue(fd protoreflect.FieldDescriptor) bool {
+	if fd.Cardinality() == protoreflect.Repeated {
+		return false
+	}
 	if md := fd.Message(); md != nil {
-		return md.FullName() == "google.protobuf.Value" && fd.Cardinality() != protoreflect.Repeated
+		return md.FullName() == "google.protobuf.Value"
+	}
+	if ed := fd.Enum(); ed != nil {
+		return ed.FullName() == "google.protobuf.NullValue"
 	}
 	return false
 }
diff --git a/vendor/github.com/mdlayher/socket/CHANGELOG.md b/vendor/github.com/mdlayher/socket/CHANGELOG.md
index 0f24ed2c56..f0d01641a2 100644
--- a/vendor/github.com/mdlayher/socket/CHANGELOG.md
+++ b/vendor/github.com/mdlayher/socket/CHANGELOG.md
@@ -1,5 +1,11 @@
 # CHANGELOG
 
+## v0.4.1
+
+- [Bug Fix] [commit](https://github.com/mdlayher/socket/commit/2a14ceef4da279de1f957c5761fffcc6c87bbd3b):
+  ensure `socket.Conn` can be used with non-socket file descriptors by handling
+  `ENOTSOCK` in the constructor.
+
 ## v0.4.0
 
 **This is the first release of package socket that only supports Go 1.18+.
diff --git a/vendor/github.com/mdlayher/socket/conn.go b/vendor/github.com/mdlayher/socket/conn.go
index ba1e5b41df..7b3cc7a6e7 100644
--- a/vendor/github.com/mdlayher/socket/conn.go
+++ b/vendor/github.com/mdlayher/socket/conn.go
@@ -2,8 +2,10 @@ package socket
 
 import (
 	"context"
+	"errors"
 	"io"
 	"os"
+	"sync"
 	"sync/atomic"
 	"syscall"
 	"time"
@@ -22,6 +24,11 @@ var _ interface {
 
 // A Conn is a low-level network connection which integrates with Go's runtime
 // network poller to provide asynchronous I/O and deadline support.
+//
+// Many of a Conn's blocking methods support net.Conn deadlines as well as
+// cancelation via context. Note that passing a context with a deadline set will
+// override any of the previous deadlines set by calls to the SetDeadline family
+// of methods.
 type Conn struct {
 	// Indicates whether or not Conn.Close has been called. Must be accessed
 	// atomically. Atomics definitions must come first in the Conn struct.
@@ -31,13 +38,9 @@ type Conn struct {
 	// descriptors such as those created by accept(2).
 	name string
 
-	// Whether this is a streaming descriptor, as opposed to a
-	// packet-based descriptor like a UDP socket.
-	isStream bool
-
-	// Whether a zero byte read indicates EOF. This is false for a
-	// message based socket connection.
-	zeroReadIsEOF bool
+	// facts contains information we have determined about Conn to trigger
+	// alternate behavior in certain functions.
+	facts facts
 
 	// Provides access to the underlying file registered with the runtime
 	// network poller, and arbitrary raw I/O calls.
@@ -45,6 +48,17 @@ type Conn struct {
 	rc syscall.RawConn
 }
 
+// facts contains facts about a Conn.
+type facts struct {
+	// isStream reports whether this is a streaming descriptor, as opposed to a
+	// packet-based descriptor like a UDP socket.
+	isStream bool
+
+	// zeroReadIsEOF reports Whether a zero byte read indicates EOF. This is
+	// false for a message based socket connection.
+	zeroReadIsEOF bool
+}
+
 // A Config contains options for a Conn.
 type Config struct {
 	// NetNS specifies the Linux network namespace the Conn will operate in.
@@ -102,23 +116,14 @@ func (c *Conn) Read(b []byte) (int, error) { return c.fd.Read(b) }
 // ReadContext reads from the underlying file descriptor with added support for
 // context cancelation.
 func (c *Conn) ReadContext(ctx context.Context, b []byte) (int, error) {
-	var (
-		n   int
-		err error
-	)
-
-	if c.isStream && len(b) > maxRW {
+	if c.facts.isStream && len(b) > maxRW {
 		b = b[:maxRW]
 	}
-	doErr := c.read(ctx, "read", func(fd int) error {
-		n, err = unix.Read(fd, b)
-		return err
-	})
 
-	switch {
-	case doErr != nil:
-		return 0, doErr
-	case n == 0 && err == nil && c.zeroReadIsEOF:
+	n, err := readT(c, ctx, "read", func(fd int) (int, error) {
+		return unix.Read(fd, b)
+	})
+	if n == 0 && err == nil && c.facts.zeroReadIsEOF {
 		return 0, io.EOF
 	}
 
@@ -138,7 +143,7 @@ func (c *Conn) WriteContext(ctx context.Context, b []byte) (int, error) {
 
 	doErr := c.write(ctx, "write", func(fd int) error {
 		max := len(b)
-		if c.isStream && max-nn > maxRW {
+		if c.facts.isStream && max-nn > maxRW {
 			max = nn + maxRW
 		}
 
@@ -369,13 +374,25 @@ func New(fd int, name string) (*Conn, error) {
 		rc:   rc,
 	}
 
+	// Probe the file descriptor for socket settings.
 	sotype, err := c.GetsockoptInt(unix.SOL_SOCKET, unix.SO_TYPE)
-	if err != nil {
+	switch {
+	case err == nil:
+		// File is a socket, check its properties.
+		c.facts = facts{
+			isStream:      sotype == unix.SOCK_STREAM,
+			zeroReadIsEOF: sotype != unix.SOCK_DGRAM && sotype != unix.SOCK_RAW,
+		}
+	case errors.Is(err, unix.ENOTSOCK):
+		// File is not a socket, treat it as a regular file.
+		c.facts = facts{
+			isStream:      true,
+			zeroReadIsEOF: true,
+		}
+	default:
 		return nil, err
 	}
 
-	c.isStream = sotype == unix.SOCK_STREAM
-	c.zeroReadIsEOF = sotype != unix.SOCK_DGRAM && sotype != unix.SOCK_RAW
 	return c, nil
 }
 
@@ -390,39 +407,40 @@ func New(fd int, name string) (*Conn, error) {
 //
 // If the operating system only supports accept(2) (which does not allow flags)
 // and flags is not zero, an error will be returned.
-func (c *Conn) Accept(flags int) (*Conn, unix.Sockaddr, error) {
-	var (
+//
+// Accept obeys context cancelation and uses the deadline set on the context to
+// cancel accepting the next connection. If a deadline is set on ctx, this
+// deadline will override any previous deadlines set using SetDeadline or
+// SetReadDeadline. Upon return, the read deadline is cleared.
+func (c *Conn) Accept(ctx context.Context, flags int) (*Conn, unix.Sockaddr, error) {
+	type ret struct {
 		nfd int
 		sa  unix.Sockaddr
-		err error
-	)
+	}
 
-	doErr := c.read(context.Background(), sysAccept, func(fd int) error {
+	r, err := readT(c, ctx, sysAccept, func(fd int) (ret, error) {
 		// Either accept(2) or accept4(2) depending on the OS.
-		nfd, sa, err = accept(fd, flags|socketFlags)
-		return err
+		nfd, sa, err := accept(fd, flags|socketFlags)
+		return ret{nfd, sa}, err
 	})
-	if doErr != nil {
-		return nil, nil, doErr
-	}
 	if err != nil {
-		// sysAccept is either "accept" or "accept4" depending on the OS.
-		return nil, nil, os.NewSyscallError(sysAccept, err)
+		// internal/poll, context error, or user function error.
+		return nil, nil, err
 	}
 
 	// Successfully accepted a connection, wrap it in a Conn for use by the
 	// caller.
-	ac, err := New(nfd, c.name)
+	ac, err := New(r.nfd, c.name)
 	if err != nil {
 		return nil, nil, err
 	}
 
-	return ac, sa, nil
+	return ac, r.sa, nil
 }
 
 // Bind wraps bind(2).
 func (c *Conn) Bind(sa unix.Sockaddr) error {
-	return c.controlErr(context.Background(), "bind", func(fd int) error {
+	return c.control(context.Background(), "bind", func(fd int) error {
 		return unix.Bind(fd, sa)
 	})
 }
@@ -430,6 +448,11 @@ func (c *Conn) Bind(sa unix.Sockaddr) error {
 // Connect wraps connect(2). In order to verify that the underlying socket is
 // connected to a remote peer, Connect calls getpeername(2) and returns the
 // unix.Sockaddr from that call.
+//
+// Connect obeys context cancelation and uses the deadline set on the context to
+// cancel connecting to a remote peer. If a deadline is set on ctx, this
+// deadline will override any previous deadlines set using SetDeadline or
+// SetWriteDeadline. Upon return, the write deadline is cleared.
 func (c *Conn) Connect(ctx context.Context, sa unix.Sockaddr) (unix.Sockaddr, error) {
 	const op = "connect"
 
@@ -459,9 +482,6 @@ func (c *Conn) Connect(ctx context.Context, sa unix.Sockaddr) (unix.Sockaddr, er
 		// Subsequent calls: the runtime network poller indicates fd is
 		// writable. Check for errno.
 		errno, gerr := c.GetsockoptInt(unix.SOL_SOCKET, unix.SO_ERROR)
-		if err := ctx.Err(); err != nil {
-			return err
-		}
 		if gerr != nil {
 			return gerr
 		}
@@ -479,9 +499,6 @@ func (c *Conn) Connect(ctx context.Context, sa unix.Sockaddr) (unix.Sockaddr, er
 		// poller to spuriously wake us and return errno 0 for SO_ERROR.
 		// Make sure we are actually connected to a peer.
 		peer, err := c.Getpeername()
-		if err := ctx.Err(); err != nil {
-			return err
-		}
 		if err != nil {
 			// internal/poll unconditionally goes back to WaitWrite.
 			// Synthesize an error that will do the same for us.
@@ -493,6 +510,7 @@ func (c *Conn) Connect(ctx context.Context, sa unix.Sockaddr) (unix.Sockaddr, er
 		return nil
 	})
 	if doErr != nil {
+		// internal/poll or context error.
 		return nil, doErr
 	}
 
@@ -512,297 +530,327 @@ func (c *Conn) Connect(ctx context.Context, sa unix.Sockaddr) (unix.Sockaddr, er
 
 // Getsockname wraps getsockname(2).
 func (c *Conn) Getsockname() (unix.Sockaddr, error) {
-	const op = "getsockname"
-
-	var (
-		sa  unix.Sockaddr
-		err error
-	)
-
-	doErr := c.control(context.Background(), op, func(fd int) error {
-		sa, err = unix.Getsockname(fd)
-		return err
-	})
-	if doErr != nil {
-		return nil, doErr
-	}
-
-	return sa, os.NewSyscallError(op, err)
+	return controlT(c, context.Background(), "getsockname", unix.Getsockname)
 }
 
 // Getpeername wraps getpeername(2).
 func (c *Conn) Getpeername() (unix.Sockaddr, error) {
-	const op = "getpeername"
-
-	var (
-		sa  unix.Sockaddr
-		err error
-	)
-
-	doErr := c.control(context.Background(), op, func(fd int) error {
-		sa, err = unix.Getpeername(fd)
-		return err
-	})
-	if doErr != nil {
-		return nil, doErr
-	}
-
-	return sa, os.NewSyscallError(op, err)
+	return controlT(c, context.Background(), "getpeername", unix.Getpeername)
 }
 
 // GetsockoptInt wraps getsockopt(2) for integer values.
 func (c *Conn) GetsockoptInt(level, opt int) (int, error) {
-	const op = "getsockopt"
-
-	var (
-		value int
-		err   error
-	)
-
-	doErr := c.control(context.Background(), op, func(fd int) error {
-		value, err = unix.GetsockoptInt(fd, level, opt)
-		return err
+	return controlT(c, context.Background(), "getsockopt", func(fd int) (int, error) {
+		return unix.GetsockoptInt(fd, level, opt)
 	})
-	if doErr != nil {
-		return 0, doErr
-	}
-
-	return value, os.NewSyscallError(op, err)
 }
 
 // Listen wraps listen(2).
 func (c *Conn) Listen(n int) error {
-	return c.controlErr(context.Background(), "listen", func(fd int) error {
+	return c.control(context.Background(), "listen", func(fd int) error {
 		return unix.Listen(fd, n)
 	})
 }
 
 // Recvmsg wraps recvmsg(2).
 func (c *Conn) Recvmsg(ctx context.Context, p, oob []byte, flags int) (int, int, int, unix.Sockaddr, error) {
-	const op = "recvmsg"
-
-	var (
+	type ret struct {
 		n, oobn, recvflags int
 		from               unix.Sockaddr
-		err                error
-	)
+	}
 
-	doErr := c.read(ctx, op, func(fd int) error {
-		n, oobn, recvflags, from, err = unix.Recvmsg(fd, p, oob, flags)
-		return err
+	r, err := readT(c, ctx, "recvmsg", func(fd int) (ret, error) {
+		n, oobn, recvflags, from, err := unix.Recvmsg(fd, p, oob, flags)
+		return ret{n, oobn, recvflags, from}, err
 	})
-
-	switch {
-	case doErr != nil:
-		return 0, 0, 0, nil, doErr
-	case n == 0 && err == nil && c.zeroReadIsEOF:
+	if r.n == 0 && err == nil && c.facts.zeroReadIsEOF {
 		return 0, 0, 0, nil, io.EOF
 	}
 
-	return n, oobn, recvflags, from, os.NewSyscallError(op, err)
+	return r.n, r.oobn, r.recvflags, r.from, err
 }
 
 // Recvfrom wraps recvfrom(2).
 func (c *Conn) Recvfrom(ctx context.Context, p []byte, flags int) (int, unix.Sockaddr, error) {
-	const op = "recvfrom"
-
-	var (
+	type ret struct {
 		n    int
 		addr unix.Sockaddr
-		err  error
-	)
+	}
 
-	doErr := c.read(ctx, op, func(fd int) error {
-		n, addr, err = unix.Recvfrom(fd, p, flags)
-		return err
+	out, err := readT(c, ctx, "recvfrom", func(fd int) (ret, error) {
+		n, addr, err := unix.Recvfrom(fd, p, flags)
+		return ret{n, addr}, err
 	})
-
-	switch {
-	case doErr != nil:
-		return 0, nil, doErr
-	case n == 0 && err == nil && c.zeroReadIsEOF:
+	if out.n == 0 && err == nil && c.facts.zeroReadIsEOF {
 		return 0, nil, io.EOF
 	}
 
-	return n, addr, os.NewSyscallError(op, err)
+	return out.n, out.addr, err
 }
 
 // Sendmsg wraps sendmsg(2).
 func (c *Conn) Sendmsg(ctx context.Context, p, oob []byte, to unix.Sockaddr, flags int) (int, error) {
-	var (
-		n   int
-		err error
-	)
-
-	doErr := c.writeErr(ctx, "sendmsg", func(fd int) error {
-		n, err = unix.SendmsgN(fd, p, oob, to, flags)
-		return err
+	return writeT(c, ctx, "sendmsg", func(fd int) (int, error) {
+		return unix.SendmsgN(fd, p, oob, to, flags)
 	})
-	if doErr != nil {
-		return 0, doErr
-	}
-
-	return n, err
 }
 
 // Sendto wraps sendto(2).
 func (c *Conn) Sendto(ctx context.Context, p []byte, flags int, to unix.Sockaddr) error {
-	return c.writeErr(ctx, "sendto", func(fd int) error {
+	return c.write(ctx, "sendto", func(fd int) error {
 		return unix.Sendto(fd, p, flags, to)
 	})
 }
 
 // SetsockoptInt wraps setsockopt(2) for integer values.
 func (c *Conn) SetsockoptInt(level, opt, value int) error {
-	return c.controlErr(context.Background(), "setsockopt", func(fd int) error {
+	return c.control(context.Background(), "setsockopt", func(fd int) error {
 		return unix.SetsockoptInt(fd, level, opt, value)
 	})
 }
 
 // Shutdown wraps shutdown(2).
 func (c *Conn) Shutdown(how int) error {
-	return c.controlErr(context.Background(), "shutdown", func(fd int) error {
+	return c.control(context.Background(), "shutdown", func(fd int) error {
 		return unix.Shutdown(fd, how)
 	})
 }
 
 // Conn low-level read/write/control functions. These functions mirror the
 // syscall.RawConn APIs but the input closures return errors rather than
-// booleans. Any syscalls invoked within f should return their error to allow
-// the Conn to check for readiness with the runtime network poller, or to retry
-// operations which may have been interrupted by EINTR or similar.
-//
-// Note that errors from the input closure functions are not propagated to the
-// error return values of read/write/control, and the caller is still
-// responsible for error handling.
+// booleans.
 
-// read executes f, a read function, against the associated file descriptor.
-// op is used to create an *os.SyscallError if the file descriptor is closed.
-//
-// It obeys context cancelation and the context must not be nil.
+// read wraps readT to execute a function and capture its error result. This is
+// a convenience wrapper for functions which don't return any extra values.
 func (c *Conn) read(ctx context.Context, op string, f func(fd int) error) error {
-	if atomic.LoadUint32(&c.closed) != 0 {
-		return os.NewSyscallError(op, unix.EBADF)
-	}
+	_, err := readT(c, ctx, op, func(fd int) (struct{}, error) {
+		return struct{}{}, f(fd)
+	})
+	return err
+}
 
-	err := c.rc.Read(func(fd uintptr) bool {
-		select {
-		default:
-			return ready(f(int(fd)))
-		case <-ctx.Done():
-			return ready(ctx.Err())
-		}
+// write executes f, a write function, against the associated file descriptor.
+// op is used to create an *os.SyscallError if the file descriptor is closed.
+func (c *Conn) write(ctx context.Context, op string, f func(fd int) error) error {
+	_, err := writeT(c, ctx, op, func(fd int) (struct{}, error) {
+		return struct{}{}, f(fd)
 	})
-	if err := ctx.Err(); err != nil {
-		return err
-	}
 	return err
 }
 
-// readErr wraps read to execute a function and capture its error result.
-// This is a convenience wrapper for functions which don't return any extra
-// values to capture in a closure.
-//
-// It obeys context cancelation and the context must not be nil.
-func (c *Conn) readErr(ctx context.Context, op string, f func(fd int) error) error {
-	var err error
-	doErr := c.read(ctx, op, func(fd int) error {
-		return f(fd)
+// readT executes c.rc.Read for op using the input function, returning a newly
+// allocated result T.
+func readT[T any](c *Conn, ctx context.Context, op string, f func(fd int) (T, error)) (T, error) {
+	return rwT(c, rwContext[T]{
+		Context: ctx,
+		Type:    read,
+		Op:      op,
+		Do:      f,
 	})
-	if doErr != nil {
-		return doErr
-	}
+}
 
-	return os.NewSyscallError(op, err)
+// writeT executes c.rc.Write for op using the input function, returning a newly
+// allocated result T.
+func writeT[T any](c *Conn, ctx context.Context, op string, f func(fd int) (T, error)) (T, error) {
+	return rwT(c, rwContext[T]{
+		Context: ctx,
+		Type:    write,
+		Op:      op,
+		Do:      f,
+	})
 }
 
-// write executes f, a write function, against the associated file descriptor.
-// op is used to create an *os.SyscallError if the file descriptor is closed.
+// readWrite indicates if an operation intends to read or write.
+type readWrite bool
+
+// Possible readWrite values.
+const (
+	read  readWrite = false
+	write readWrite = true
+)
+
+// An rwContext provides arguments to rwT.
+type rwContext[T any] struct {
+	// The caller's context passed for cancelation.
+	Context context.Context
+
+	// The type of an operation: read or write.
+	Type readWrite
+
+	// The name of the operation used in errors.
+	Op string
+
+	// The actual function to perform.
+	Do func(fd int) (T, error)
+}
+
+// rwT executes c.rc.Read or c.rc.Write (depending on the value of rw.Type) for
+// rw.Op using the input function, returning a newly allocated result T.
 //
-// It obeys context cancelation and the context must not be nil.
-func (c *Conn) write(ctx context.Context, op string, f func(fd int) error) error {
+// It obeys context cancelation and the rw.Context must not be nil.
+func rwT[T any](c *Conn, rw rwContext[T]) (T, error) {
 	if atomic.LoadUint32(&c.closed) != 0 {
-		return os.NewSyscallError(op, unix.EBADF)
+		// If the file descriptor is already closed, do nothing.
+		return *new(T), os.NewSyscallError(rw.Op, unix.EBADF)
 	}
 
-	err := c.rc.Write(func(fd uintptr) (done bool) {
-		select {
-		default:
-			return ready(f(int(fd)))
-		case <-ctx.Done():
-			return ready(ctx.Err())
+	if err := rw.Context.Err(); err != nil {
+		// Early exit due to context cancel.
+		return *new(T), os.NewSyscallError(rw.Op, err)
+	}
+
+	var (
+		// The read or write function used to access the runtime network poller.
+		poll func(func(uintptr) bool) error
+
+		// The read or write function used to set the matching deadline.
+		deadline func(time.Time) error
+	)
+
+	if rw.Type == write {
+		poll = c.rc.Write
+		deadline = c.SetWriteDeadline
+	} else {
+		poll = c.rc.Read
+		deadline = c.SetReadDeadline
+	}
+
+	var (
+		// Whether or not the context carried a deadline we are actively using
+		// for cancelation.
+		setDeadline bool
+
+		// Signals for the cancelation watcher goroutine.
+		wg    sync.WaitGroup
+		doneC = make(chan struct{})
+
+		// Atomic: reports whether we have to disarm the deadline.
+		//
+		// TODO(mdlayher): switch back to atomic.Bool when we drop support for
+		// Go 1.18.
+		needDisarm int64
+	)
+
+	// On cancel, clean up the watcher.
+	defer func() {
+		close(doneC)
+		wg.Wait()
+	}()
+
+	if d, ok := rw.Context.Deadline(); ok {
+		// The context has an explicit deadline. We will use it for cancelation
+		// but disarm it after poll for the next call.
+		if err := deadline(d); err != nil {
+			return *new(T), err
 		}
-	})
-	if err := ctx.Err(); err != nil {
-		return err
+		setDeadline = true
+		atomic.AddInt64(&needDisarm, 1)
+	} else {
+		// The context does not have an explicit deadline. We have to watch for
+		// cancelation so we can propagate that signal to immediately unblock
+		// the runtime network poller.
+		//
+		// TODO(mdlayher): is it possible to detect a background context vs a
+		// context with possible future cancel?
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+
+			select {
+			case <-rw.Context.Done():
+				// Cancel the operation. Make the caller disarm after poll
+				// returns.
+				atomic.AddInt64(&needDisarm, 1)
+				_ = deadline(time.Unix(0, 1))
+			case <-doneC:
+				// Nothing to do.
+			}
+		}()
 	}
-	return err
-}
 
-// writeErr wraps write to execute a function and capture its error result.
-// This is a convenience wrapper for functions which don't return any extra
-// values to capture in a closure.
-//
-// It obeys context cancelation and the context must not be nil.
-func (c *Conn) writeErr(ctx context.Context, op string, f func(fd int) error) error {
-	var err error
-	doErr := c.write(ctx, op, func(fd int) error {
-		return f(fd)
+	var (
+		t   T
+		err error
+	)
+
+	pollErr := poll(func(fd uintptr) bool {
+		t, err = rw.Do(int(fd))
+		return ready(err)
 	})
-	if doErr != nil {
-		return doErr
+
+	if atomic.LoadInt64(&needDisarm) > 0 {
+		_ = deadline(time.Time{})
 	}
 
-	return os.NewSyscallError(op, err)
+	if pollErr != nil {
+		if rw.Context.Err() != nil || (setDeadline && errors.Is(pollErr, os.ErrDeadlineExceeded)) {
+			// The caller canceled the operation or we set a deadline internally
+			// and it was reached.
+			//
+			// Unpack a plain context error. We wait for the context to be done
+			// to synchronize state externally. Otherwise we have noticed I/O
+			// timeout wakeups when we set a deadline but the context was not
+			// yet marked done.
+			<-rw.Context.Done()
+			return *new(T), os.NewSyscallError(rw.Op, rw.Context.Err())
+		}
+
+		// Error from syscall.RawConn methods. Conventionally the standard
+		// library does not wrap internal/poll errors in os.NewSyscallError.
+		return *new(T), pollErr
+	}
+
+	// Result from user function.
+	return t, os.NewSyscallError(rw.Op, err)
 }
 
-// control executes f, a control function, against the associated file
-// descriptor. op is used to create an *os.SyscallError if the file descriptor
-// is closed.
-//
-// It obeys context cancelation and the context must not be nil.
+// control executes Conn.control for op using the input function.
 func (c *Conn) control(ctx context.Context, op string, f func(fd int) error) error {
+	_, err := controlT(c, ctx, op, func(fd int) (struct{}, error) {
+		return struct{}{}, f(fd)
+	})
+	return err
+}
+
+// controlT executes c.rc.Control for op using the input function, returning a
+// newly allocated result T.
+func controlT[T any](c *Conn, ctx context.Context, op string, f func(fd int) (T, error)) (T, error) {
 	if atomic.LoadUint32(&c.closed) != 0 {
-		return os.NewSyscallError(op, unix.EBADF)
+		// If the file descriptor is already closed, do nothing.
+		return *new(T), os.NewSyscallError(op, unix.EBADF)
 	}
 
-	var cerr error
-	err := c.rc.Control(func(fd uintptr) {
+	var (
+		t   T
+		err error
+	)
+
+	doErr := c.rc.Control(func(fd uintptr) {
 		// Repeatedly attempt the syscall(s) invoked by f until completion is
-		// indicated by the return value of ready.
+		// indicated by the return value of ready or the context is canceled.
+		//
+		// The last values for t and err are captured outside of the closure for
+		// use when the loop breaks.
 		for {
-			if err := ctx.Err(); err != nil {
-				cerr = err
+			if err = ctx.Err(); err != nil {
+				// Early exit due to context cancel.
 				return
 			}
-			if ready(f(int(fd))) {
+
+			t, err = f(int(fd))
+			if ready(err) {
 				return
 			}
 		}
 	})
-	if cerr != nil {
-		err = cerr
-	}
-
-	return err
-}
-
-// controlErr wraps control to execute a function and capture its error result.
-// This is a convenience wrapper for functions which don't return any extra
-// values to capture in a closure.
-//
-// It obeys context cancelation and the context must not be nil.
-func (c *Conn) controlErr(ctx context.Context, op string, f func(fd int) error) error {
-	var err error
-	doErr := c.control(ctx, op, func(fd int) error {
-		err = f(fd)
-		return err
-	})
 	if doErr != nil {
-		return doErr
+		// Error from syscall.RawConn methods. Conventionally the standard
+		// library does not wrap internal/poll errors in os.NewSyscallError.
+		return *new(T), doErr
 	}
 
-	return os.NewSyscallError(op, err)
+	// Result from user function.
+	return t, os.NewSyscallError(op, err)
 }
 
 // ready indicates readiness based on the value of err.
@@ -818,9 +866,6 @@ func ready(err error) bool {
 		// Return false to let the poller wait for readiness. See the source code
 		// for internal/poll.FD.RawRead for more details.
 		return false
-	case context.Canceled, context.DeadlineExceeded:
-		// The caller canceled the operation.
-		return true
 	default:
 		// Ready regardless of whether there was an error or no error.
 		return true
diff --git a/vendor/github.com/mdlayher/socket/conn_linux.go b/vendor/github.com/mdlayher/socket/conn_linux.go
index d0d9ee5295..37579d4a0c 100644
--- a/vendor/github.com/mdlayher/socket/conn_linux.go
+++ b/vendor/github.com/mdlayher/socket/conn_linux.go
@@ -15,22 +15,9 @@ import (
 // IoctlKCMClone wraps ioctl(2) for unix.KCMClone values, but returns a Conn
 // rather than a raw file descriptor.
 func (c *Conn) IoctlKCMClone() (*Conn, error) {
-	const op = "ioctl"
-
-	var (
-		info *unix.KCMClone
-		err  error
-	)
-
-	doErr := c.control(context.Background(), op, func(fd int) error {
-		info, err = unix.IoctlKCMClone(fd)
-		return err
-	})
-	if doErr != nil {
-		return nil, doErr
-	}
+	info, err := controlT(c, context.Background(), "ioctl", unix.IoctlKCMClone)
 	if err != nil {
-		return nil, os.NewSyscallError(op, err)
+		return nil, err
 	}
 
 	// Successful clone, wrap in a Conn for use by the caller.
@@ -39,14 +26,14 @@ func (c *Conn) IoctlKCMClone() (*Conn, error) {
 
 // IoctlKCMAttach wraps ioctl(2) for unix.KCMAttach values.
 func (c *Conn) IoctlKCMAttach(info unix.KCMAttach) error {
-	return c.controlErr(context.Background(), "ioctl", func(fd int) error {
+	return c.control(context.Background(), "ioctl", func(fd int) error {
 		return unix.IoctlKCMAttach(fd, info)
 	})
 }
 
 // IoctlKCMUnattach wraps ioctl(2) for unix.KCMUnattach values.
 func (c *Conn) IoctlKCMUnattach(info unix.KCMUnattach) error {
-	return c.controlErr(context.Background(), "ioctl", func(fd int) error {
+	return c.control(context.Background(), "ioctl", func(fd int) error {
 		return unix.IoctlKCMUnattach(fd, info)
 	})
 }
@@ -54,22 +41,11 @@ func (c *Conn) IoctlKCMUnattach(info unix.KCMUnattach) error {
 // PidfdGetfd wraps pidfd_getfd(2) for a Conn which wraps a pidfd, but returns a
 // Conn rather than a raw file descriptor.
 func (c *Conn) PidfdGetfd(targetFD, flags int) (*Conn, error) {
-	const op = "pidfd_getfd"
-
-	var (
-		outFD int
-		err   error
-	)
-
-	doErr := c.control(context.Background(), op, func(fd int) error {
-		outFD, err = unix.PidfdGetfd(fd, targetFD, flags)
-		return err
+	outFD, err := controlT(c, context.Background(), "pidfd_getfd", func(fd int) (int, error) {
+		return unix.PidfdGetfd(fd, targetFD, flags)
 	})
-	if doErr != nil {
-		return nil, doErr
-	}
 	if err != nil {
-		return nil, os.NewSyscallError(op, err)
+		return nil, err
 	}
 
 	// Successful getfd, wrap in a Conn for use by the caller.
@@ -79,7 +55,7 @@ func (c *Conn) PidfdGetfd(targetFD, flags int) (*Conn, error) {
 // PidfdSendSignal wraps pidfd_send_signal(2) for a Conn which wraps a Linux
 // pidfd.
 func (c *Conn) PidfdSendSignal(sig unix.Signal, info *unix.Siginfo, flags int) error {
-	return c.controlErr(context.Background(), "pidfd_send_signal", func(fd int) error {
+	return c.control(context.Background(), "pidfd_send_signal", func(fd int) error {
 		return unix.PidfdSendSignal(fd, sig, info, flags)
 	})
 }
@@ -108,64 +84,35 @@ func (c *Conn) RemoveBPF() error {
 
 // SetsockoptPacketMreq wraps setsockopt(2) for unix.PacketMreq values.
 func (c *Conn) SetsockoptPacketMreq(level, opt int, mreq *unix.PacketMreq) error {
-	return c.controlErr(context.Background(), "setsockopt", func(fd int) error {
+	return c.control(context.Background(), "setsockopt", func(fd int) error {
 		return unix.SetsockoptPacketMreq(fd, level, opt, mreq)
 	})
 }
 
 // SetsockoptSockFprog wraps setsockopt(2) for unix.SockFprog values.
 func (c *Conn) SetsockoptSockFprog(level, opt int, fprog *unix.SockFprog) error {
-	return c.controlErr(context.Background(), "setsockopt", func(fd int) error {
+	return c.control(context.Background(), "setsockopt", func(fd int) error {
 		return unix.SetsockoptSockFprog(fd, level, opt, fprog)
 	})
 }
 
-// TODO(mdlayher): we accidentally called these GetSockopt rather than
-// Getsockopt by package unix convention. Consider fixing.
-
-// GetSockoptTpacketStats wraps getsockopt(2) for unix.TpacketStats values.
-func (c *Conn) GetSockoptTpacketStats(level, name int) (*unix.TpacketStats, error) {
-	const op = "getsockopt"
-
-	var (
-		stats *unix.TpacketStats
-		err   error
-	)
-
-	doErr := c.control(context.Background(), op, func(fd int) error {
-		stats, err = unix.GetsockoptTpacketStats(fd, level, name)
-		return err
+// GetsockoptTpacketStats wraps getsockopt(2) for unix.TpacketStats values.
+func (c *Conn) GetsockoptTpacketStats(level, name int) (*unix.TpacketStats, error) {
+	return controlT(c, context.Background(), "getsockopt", func(fd int) (*unix.TpacketStats, error) {
+		return unix.GetsockoptTpacketStats(fd, level, name)
 	})
-	if doErr != nil {
-		return nil, doErr
-	}
-
-	return stats, os.NewSyscallError(op, err)
 }
 
-// GetSockoptTpacketStatsV3 wraps getsockopt(2) for unix.TpacketStatsV3 values.
-func (c *Conn) GetSockoptTpacketStatsV3(level, name int) (*unix.TpacketStatsV3, error) {
-	const op = "getsockopt"
-
-	var (
-		stats *unix.TpacketStatsV3
-		err   error
-	)
-
-	doErr := c.control(context.Background(), op, func(fd int) error {
-		stats, err = unix.GetsockoptTpacketStatsV3(fd, level, name)
-		return err
+// GetsockoptTpacketStatsV3 wraps getsockopt(2) for unix.TpacketStatsV3 values.
+func (c *Conn) GetsockoptTpacketStatsV3(level, name int) (*unix.TpacketStatsV3, error) {
+	return controlT(c, context.Background(), "getsockopt", func(fd int) (*unix.TpacketStatsV3, error) {
+		return unix.GetsockoptTpacketStatsV3(fd, level, name)
 	})
-	if doErr != nil {
-		return nil, doErr
-	}
-
-	return stats, os.NewSyscallError(op, err)
 }
 
 // Waitid wraps waitid(2).
 func (c *Conn) Waitid(idType int, info *unix.Siginfo, options int, rusage *unix.Rusage) error {
-	return c.readErr(context.Background(), "waitid", func(fd int) error {
+	return c.read(context.Background(), "waitid", func(fd int) error {
 		return unix.Waitid(idType, fd, info, options, rusage)
 	})
 }
diff --git a/vendor/github.com/mdlayher/vsock/CHANGELOG.md b/vendor/github.com/mdlayher/vsock/CHANGELOG.md
index 55f058cd11..c64a797bc2 100644
--- a/vendor/github.com/mdlayher/vsock/CHANGELOG.md
+++ b/vendor/github.com/mdlayher/vsock/CHANGELOG.md
@@ -1,5 +1,9 @@
 # CHANGELOG
 
+# v1.2.1
+
+- [Improvement]: updated dependencies, test with Go 1.20.
+
 # v1.2.0
 
 **This is the first release of package vsock that only supports Go 1.18+. Users
diff --git a/vendor/github.com/mdlayher/vsock/listener_linux.go b/vendor/github.com/mdlayher/vsock/listener_linux.go
index 458449ad12..50fa1b7a49 100644
--- a/vendor/github.com/mdlayher/vsock/listener_linux.go
+++ b/vendor/github.com/mdlayher/vsock/listener_linux.go
@@ -4,6 +4,7 @@
 package vsock
 
 import (
+	"context"
 	"net"
 	"os"
 	"time"
@@ -29,7 +30,7 @@ func (l *listener) SetDeadline(t time.Time) error { return l.c.SetDeadline(t) }
 // Accept accepts a single connection from the listener, and sets up
 // a net.Conn backed by conn.
 func (l *listener) Accept() (net.Conn, error) {
-	c, rsa, err := l.c.Accept(0)
+	c, rsa, err := l.c.Accept(context.Background(), 0)
 	if err != nil {
 		return nil, err
 	}
diff --git a/vendor/github.com/miekg/dns/LICENSE b/vendor/github.com/miekg/dns/LICENSE
index 55f12ab777..852ab9ced4 100644
--- a/vendor/github.com/miekg/dns/LICENSE
+++ b/vendor/github.com/miekg/dns/LICENSE
@@ -1,30 +1,29 @@
-Copyright (c) 2009 The Go Authors. All rights reserved.
+BSD 3-Clause License
+
+Copyright (c) 2009, The Go Authors. Extensions copyright (c) 2011, Miek Gieben. 
+All rights reserved.
 
 Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are
-met:
+modification, are permitted provided that the following conditions are met:
 
-   * Redistributions of source code must retain the above copyright
-notice, this list of conditions and the following disclaimer.
-   * Redistributions in binary form must reproduce the above
-copyright notice, this list of conditions and the following disclaimer
-in the documentation and/or other materials provided with the
-distribution.
-   * Neither the name of Google Inc. nor the names of its
-contributors may be used to endorse or promote products derived from
-this software without specific prior written permission.
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
 
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
 
-As this is fork of the official Go code the same license applies.
-Extensions of the original work are copyright (c) 2011 Miek Gieben
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/vendor/github.com/miekg/dns/README.md b/vendor/github.com/miekg/dns/README.md
index 5a799d88f8..06bea9fab7 100644
--- a/vendor/github.com/miekg/dns/README.md
+++ b/vendor/github.com/miekg/dns/README.md
@@ -77,6 +77,10 @@ A not-so-up-to-date-list-that-may-be-actually-current:
 * https://ping.sx/dig
 * https://fleetdeck.io/
 * https://github.com/markdingo/autoreverse
+* https://github.com/slackhq/nebula
+* https://addr.tools/
+* https://dnscheck.tools/
+* https://github.com/egbakou/domainverifier
 
 
 Send pull request if you want to be listed here.
@@ -140,6 +144,7 @@ Example programs can be found in the `github.com/miekg/exdns` repository.
 * 340{1,2,3} - NAPTR record
 * 3445 - Limiting the scope of (DNS)KEY
 * 3597 - Unknown RRs
+* 4025 - A Method for Storing IPsec Keying Material in DNS
 * 403{3,4,5} - DNSSEC + validation functions
 * 4255 - SSHFP record
 * 4343 - Case insensitivity
@@ -175,6 +180,7 @@ Example programs can be found in the `github.com/miekg/exdns` repository.
 * 8080 - EdDSA for DNSSEC
 * 8499 - DNS Terminology
 * 8659 - DNS Certification Authority Authorization (CAA) Resource Record
+* 8777 - DNS Reverse IP Automatic Multicast Tunneling (AMT) Discovery
 * 8914 - Extended DNS Errors
 * 8976 - Message Digest for DNS Zones (ZONEMD RR)
 
diff --git a/vendor/github.com/miekg/dns/acceptfunc.go b/vendor/github.com/miekg/dns/acceptfunc.go
index ac479db954..ab2812e334 100644
--- a/vendor/github.com/miekg/dns/acceptfunc.go
+++ b/vendor/github.com/miekg/dns/acceptfunc.go
@@ -19,7 +19,6 @@ type MsgAcceptFunc func(dh Header) MsgAcceptAction
 // * has more than 0 RRs in the Authority section
 //
 // * has more than 2 RRs in the Additional section
-//
 var DefaultMsgAcceptFunc MsgAcceptFunc = defaultMsgAcceptFunc
 
 // MsgAcceptAction represents the action to be taken.
diff --git a/vendor/github.com/miekg/dns/client.go b/vendor/github.com/miekg/dns/client.go
index 9aa6585300..2cdd49af17 100644
--- a/vendor/github.com/miekg/dns/client.go
+++ b/vendor/github.com/miekg/dns/client.go
@@ -6,7 +6,6 @@ import (
 	"context"
 	"crypto/tls"
 	"encoding/binary"
-	"fmt"
 	"io"
 	"net"
 	"strings"
@@ -56,14 +55,20 @@ type Client struct {
 	// Timeout is a cumulative timeout for dial, write and read, defaults to 0 (disabled) - overrides DialTimeout, ReadTimeout,
 	// WriteTimeout when non-zero. Can be overridden with net.Dialer.Timeout (see Client.ExchangeWithDialer and
 	// Client.Dialer) or context.Context.Deadline (see ExchangeContext)
-	Timeout        time.Duration
-	DialTimeout    time.Duration     // net.DialTimeout, defaults to 2 seconds, or net.Dialer.Timeout if expiring earlier - overridden by Timeout when that value is non-zero
-	ReadTimeout    time.Duration     // net.Conn.SetReadTimeout value for connections, defaults to 2 seconds - overridden by Timeout when that value is non-zero
-	WriteTimeout   time.Duration     // net.Conn.SetWriteTimeout value for connections, defaults to 2 seconds - overridden by Timeout when that value is non-zero
-	TsigSecret     map[string]string // secret(s) for Tsig map[<zonename>]<base64 secret>, zonename must be in canonical form (lowercase, fqdn, see RFC 4034 Section 6.2)
-	TsigProvider   TsigProvider      // An implementation of the TsigProvider interface. If defined it replaces TsigSecret and is used for all TSIG operations.
-	SingleInflight bool              // if true suppress multiple outstanding queries for the same Qname, Qtype and Qclass
-	group          singleflight
+	Timeout      time.Duration
+	DialTimeout  time.Duration     // net.DialTimeout, defaults to 2 seconds, or net.Dialer.Timeout if expiring earlier - overridden by Timeout when that value is non-zero
+	ReadTimeout  time.Duration     // net.Conn.SetReadTimeout value for connections, defaults to 2 seconds - overridden by Timeout when that value is non-zero
+	WriteTimeout time.Duration     // net.Conn.SetWriteTimeout value for connections, defaults to 2 seconds - overridden by Timeout when that value is non-zero
+	TsigSecret   map[string]string // secret(s) for Tsig map[<zonename>]<base64 secret>, zonename must be in canonical form (lowercase, fqdn, see RFC 4034 Section 6.2)
+	TsigProvider TsigProvider      // An implementation of the TsigProvider interface. If defined it replaces TsigSecret and is used for all TSIG operations.
+
+	// SingleInflight previously serialised multiple concurrent queries for the
+	// same Qname, Qtype and Qclass to ensure only one would be in flight at a
+	// time.
+	//
+	// Deprecated: This is a no-op. Callers should implement their own in flight
+	// query caching if needed. See github.com/miekg/dns/issues/1449.
+	SingleInflight bool
 }
 
 // Exchange performs a synchronous UDP query. It sends the message m to the address
@@ -106,7 +111,6 @@ func (c *Client) Dial(address string) (conn *Conn, err error) {
 }
 
 // DialContext connects to the address on the named network, with a context.Context.
-// For TLS over TCP (DoT) the context isn't used yet. This will be enabled when Go 1.18 is released.
 func (c *Client) DialContext(ctx context.Context, address string) (conn *Conn, err error) {
 	// create a new dialer with the appropriate timeout
 	var d net.Dialer
@@ -127,15 +131,11 @@ func (c *Client) DialContext(ctx context.Context, address string) (conn *Conn, e
 	if useTLS {
 		network = strings.TrimSuffix(network, "-tls")
 
-		// TODO(miekg): Enable after Go 1.18 is released, to be able to support two prev. releases.
-		/*
-			tlsDialer := tls.Dialer{
-				NetDialer: &d,
-				Config:    c.TLSConfig,
-			}
-			conn.Conn, err = tlsDialer.DialContext(ctx, network, address)
-		*/
-		conn.Conn, err = tls.DialWithDialer(&d, network, address, c.TLSConfig)
+		tlsDialer := tls.Dialer{
+			NetDialer: &d,
+			Config:    c.TLSConfig,
+		}
+		conn.Conn, err = tlsDialer.DialContext(ctx, network, address)
 	} else {
 		conn.Conn, err = d.DialContext(ctx, network, address)
 	}
@@ -185,31 +185,12 @@ func (c *Client) Exchange(m *Msg, address string) (r *Msg, rtt time.Duration, er
 // that entails when using "tcp" and especially "tcp-tls" clients.
 //
 // When the singleflight is set for this client the context is _not_ forwarded to the (shared) exchange, to
-// prevent one cancelation from canceling all outstanding requests.
+// prevent one cancellation from canceling all outstanding requests.
 func (c *Client) ExchangeWithConn(m *Msg, conn *Conn) (r *Msg, rtt time.Duration, err error) {
 	return c.exchangeWithConnContext(context.Background(), m, conn)
 }
 
-func (c *Client) exchangeWithConnContext(ctx context.Context, m *Msg, conn *Conn) (r *Msg, rtt time.Duration, err error) {
-	if !c.SingleInflight {
-		return c.exchangeContext(ctx, m, conn)
-	}
-
-	q := m.Question[0]
-	key := fmt.Sprintf("%s:%d:%d", q.Name, q.Qtype, q.Qclass)
-	r, rtt, err, shared := c.group.Do(key, func() (*Msg, time.Duration, error) {
-		// When we're doing singleflight we don't want one context cancelation, cancel _all_ outstanding queries.
-		// Hence we ignore the context and use Background().
-		return c.exchangeContext(context.Background(), m, conn)
-	})
-	if r != nil && shared {
-		r = r.Copy()
-	}
-
-	return r, rtt, err
-}
-
-func (c *Client) exchangeContext(ctx context.Context, m *Msg, co *Conn) (r *Msg, rtt time.Duration, err error) {
+func (c *Client) exchangeWithConnContext(ctx context.Context, m *Msg, co *Conn) (r *Msg, rtt time.Duration, err error) {
 	opt := m.IsEdns0()
 	// If EDNS0 is used use that for size.
 	if opt != nil && opt.UDPSize() >= MinMsgSize {
@@ -431,7 +412,6 @@ func ExchangeContext(ctx context.Context, m *Msg, a string) (r *Msg, err error)
 //	co.WriteMsg(m)
 //	in, _  := co.ReadMsg()
 //	co.Close()
-//
 func ExchangeConn(c net.Conn, m *Msg) (r *Msg, err error) {
 	println("dns: ExchangeConn: this function is deprecated")
 	co := new(Conn)
diff --git a/vendor/github.com/miekg/dns/clientconfig.go b/vendor/github.com/miekg/dns/clientconfig.go
index e11b630df9..d00ac62fb6 100644
--- a/vendor/github.com/miekg/dns/clientconfig.go
+++ b/vendor/github.com/miekg/dns/clientconfig.go
@@ -68,7 +68,7 @@ func ClientConfigFromReader(resolvconf io.Reader) (*ClientConfig, error) {
 			}
 
 		case "search": // set search path to given servers
-			c.Search = append([]string(nil), f[1:]...)
+			c.Search = cloneSlice(f[1:])
 
 		case "options": // magic options
 			for _, s := range f[1:] {
diff --git a/vendor/github.com/miekg/dns/defaults.go b/vendor/github.com/miekg/dns/defaults.go
index f2cdbf4302..c1558b79c3 100644
--- a/vendor/github.com/miekg/dns/defaults.go
+++ b/vendor/github.com/miekg/dns/defaults.go
@@ -208,7 +208,7 @@ func IsDomainName(s string) (labels int, ok bool) {
 			}
 
 			// check for \DDD
-			if i+3 < len(s) && isDigit(s[i+1]) && isDigit(s[i+2]) && isDigit(s[i+3]) {
+			if isDDD(s[i+1:]) {
 				i += 3
 				begin += 3
 			} else {
@@ -272,18 +272,24 @@ func IsMsg(buf []byte) error {
 
 // IsFqdn checks if a domain name is fully qualified.
 func IsFqdn(s string) bool {
-	s2 := strings.TrimSuffix(s, ".")
-	if s == s2 {
+	// Check for (and remove) a trailing dot, returning if there isn't one.
+	if s == "" || s[len(s)-1] != '.' {
 		return false
 	}
+	s = s[:len(s)-1]
 
-	i := strings.LastIndexFunc(s2, func(r rune) bool {
+	// If we don't have an escape sequence before the final dot, we know it's
+	// fully qualified and can return here.
+	if s == "" || s[len(s)-1] != '\\' {
+		return true
+	}
+
+	// Otherwise we have to check if the dot is escaped or not by checking if
+	// there are an odd or even number of escape sequences before the dot.
+	i := strings.LastIndexFunc(s, func(r rune) bool {
 		return r != '\\'
 	})
-
-	// Test whether we have an even number of escape sequences before
-	// the dot or none.
-	return (len(s2)-i)%2 != 0
+	return (len(s)-i)%2 != 0
 }
 
 // IsRRset checks if a set of RRs is a valid RRset as defined by RFC 2181.
diff --git a/vendor/github.com/miekg/dns/dnssec.go b/vendor/github.com/miekg/dns/dnssec.go
index ea01aa81fc..1be87eae63 100644
--- a/vendor/github.com/miekg/dns/dnssec.go
+++ b/vendor/github.com/miekg/dns/dnssec.go
@@ -128,10 +128,6 @@ type dnskeyWireFmt struct {
 	/* Nothing is left out */
 }
 
-func divRoundUp(a, b int) int {
-	return (a + b - 1) / b
-}
-
 // KeyTag calculates the keytag (or key-id) of the DNSKEY.
 func (k *DNSKEY) KeyTag() uint16 {
 	if k == nil {
@@ -417,11 +413,11 @@ func (rr *RRSIG) Verify(k *DNSKEY, rrset []RR) error {
 		return err
 	}
 
-	sigbuf := rr.sigBuf()           // Get the binary signature data
-	if rr.Algorithm == PRIVATEDNS { // PRIVATEOID
-		// TODO(miek)
-		// remove the domain name and assume its ours?
-	}
+	sigbuf := rr.sigBuf() // Get the binary signature data
+	// TODO(miek)
+	// remove the domain name and assume its ours?
+	// if rr.Algorithm == PRIVATEDNS { // PRIVATEOID
+	// }
 
 	h, cryptohash, err := hashFromAlgorithm(rr.Algorithm)
 	if err != nil {
diff --git a/vendor/github.com/miekg/dns/doc.go b/vendor/github.com/miekg/dns/doc.go
index f00f5722c2..586ab6917e 100644
--- a/vendor/github.com/miekg/dns/doc.go
+++ b/vendor/github.com/miekg/dns/doc.go
@@ -13,28 +13,28 @@ names in a message will result in a packing failure.
 Resource records are native types. They are not stored in wire format. Basic
 usage pattern for creating a new resource record:
 
-     r := new(dns.MX)
-     r.Hdr = dns.RR_Header{Name: "miek.nl.", Rrtype: dns.TypeMX, Class: dns.ClassINET, Ttl: 3600}
-     r.Preference = 10
-     r.Mx = "mx.miek.nl."
+	r := new(dns.MX)
+	r.Hdr = dns.RR_Header{Name: "miek.nl.", Rrtype: dns.TypeMX, Class: dns.ClassINET, Ttl: 3600}
+	r.Preference = 10
+	r.Mx = "mx.miek.nl."
 
 Or directly from a string:
 
-     mx, err := dns.NewRR("miek.nl. 3600 IN MX 10 mx.miek.nl.")
+	mx, err := dns.NewRR("miek.nl. 3600 IN MX 10 mx.miek.nl.")
 
 Or when the default origin (.) and TTL (3600) and class (IN) suit you:
 
-     mx, err := dns.NewRR("miek.nl MX 10 mx.miek.nl")
+	mx, err := dns.NewRR("miek.nl MX 10 mx.miek.nl")
 
 Or even:
 
-     mx, err := dns.NewRR("$ORIGIN nl.\nmiek 1H IN MX 10 mx.miek")
+	mx, err := dns.NewRR("$ORIGIN nl.\nmiek 1H IN MX 10 mx.miek")
 
 In the DNS messages are exchanged, these messages contain resource records
 (sets). Use pattern for creating a message:
 
-     m := new(dns.Msg)
-     m.SetQuestion("miek.nl.", dns.TypeMX)
+	m := new(dns.Msg)
+	m.SetQuestion("miek.nl.", dns.TypeMX)
 
 Or when not certain if the domain name is fully qualified:
 
@@ -45,17 +45,17 @@ records for the miek.nl. zone.
 
 The following is slightly more verbose, but more flexible:
 
-     m1 := new(dns.Msg)
-     m1.Id = dns.Id()
-     m1.RecursionDesired = true
-     m1.Question = make([]dns.Question, 1)
-     m1.Question[0] = dns.Question{"miek.nl.", dns.TypeMX, dns.ClassINET}
+	m1 := new(dns.Msg)
+	m1.Id = dns.Id()
+	m1.RecursionDesired = true
+	m1.Question = make([]dns.Question, 1)
+	m1.Question[0] = dns.Question{"miek.nl.", dns.TypeMX, dns.ClassINET}
 
 After creating a message it can be sent. Basic use pattern for synchronous
 querying the DNS at a server configured on 127.0.0.1 and port 53:
 
-     c := new(dns.Client)
-     in, rtt, err := c.Exchange(m1, "127.0.0.1:53")
+	c := new(dns.Client)
+	in, rtt, err := c.Exchange(m1, "127.0.0.1:53")
 
 Suppressing multiple outstanding queries (with the same question, type and
 class) is as easy as setting:
@@ -72,7 +72,7 @@ and port to use for the connection:
 		Port: 12345,
 		Zone: "",
 	}
-	c.Dialer := &net.Dialer{
+	c.Dialer = &net.Dialer{
 		Timeout: 200 * time.Millisecond,
 		LocalAddr: &laddr,
 	}
@@ -96,7 +96,7 @@ the Answer section:
 		// do something with t.Txt
 	}
 
-Domain Name and TXT Character String Representations
+# Domain Name and TXT Character String Representations
 
 Both domain names and TXT character strings are converted to presentation form
 both when unpacked and when converted to strings.
@@ -108,7 +108,7 @@ be escaped. Bytes below 32 and above 127 will be converted to \DDD form.
 For domain names, in addition to the above rules brackets, periods, spaces,
 semicolons and the at symbol are escaped.
 
-DNSSEC
+# DNSSEC
 
 DNSSEC (DNS Security Extension) adds a layer of security to the DNS. It uses
 public key cryptography to sign resource records. The public keys are stored in
@@ -117,12 +117,12 @@ DNSKEY records and the signatures in RRSIG records.
 Requesting DNSSEC information for a zone is done by adding the DO (DNSSEC OK)
 bit to a request.
 
-     m := new(dns.Msg)
-     m.SetEdns0(4096, true)
+	m := new(dns.Msg)
+	m.SetEdns0(4096, true)
 
 Signature generation, signature verification and key generation are all supported.
 
-DYNAMIC UPDATES
+# DYNAMIC UPDATES
 
 Dynamic updates reuses the DNS message format, but renames three of the
 sections. Question is Zone, Answer is Prerequisite, Authority is Update, only
@@ -133,30 +133,30 @@ certain resource records or names in a zone to specify if resource records
 should be added or removed. The table from RFC 2136 supplemented with the Go
 DNS function shows which functions exist to specify the prerequisites.
 
- 3.2.4 - Table Of Metavalues Used In Prerequisite Section
+	3.2.4 - Table Of Metavalues Used In Prerequisite Section
 
-  CLASS    TYPE     RDATA    Meaning                    Function
-  --------------------------------------------------------------
-  ANY      ANY      empty    Name is in use             dns.NameUsed
-  ANY      rrset    empty    RRset exists (value indep) dns.RRsetUsed
-  NONE     ANY      empty    Name is not in use         dns.NameNotUsed
-  NONE     rrset    empty    RRset does not exist       dns.RRsetNotUsed
-  zone     rrset    rr       RRset exists (value dep)   dns.Used
+	 CLASS    TYPE     RDATA    Meaning                    Function
+	 --------------------------------------------------------------
+	 ANY      ANY      empty    Name is in use             dns.NameUsed
+	 ANY      rrset    empty    RRset exists (value indep) dns.RRsetUsed
+	 NONE     ANY      empty    Name is not in use         dns.NameNotUsed
+	 NONE     rrset    empty    RRset does not exist       dns.RRsetNotUsed
+	 zone     rrset    rr       RRset exists (value dep)   dns.Used
 
 The prerequisite section can also be left empty. If you have decided on the
 prerequisites you can tell what RRs should be added or deleted. The next table
 shows the options you have and what functions to call.
 
- 3.4.2.6 - Table Of Metavalues Used In Update Section
+	3.4.2.6 - Table Of Metavalues Used In Update Section
 
-  CLASS    TYPE     RDATA    Meaning                     Function
-  ---------------------------------------------------------------
-  ANY      ANY      empty    Delete all RRsets from name dns.RemoveName
-  ANY      rrset    empty    Delete an RRset             dns.RemoveRRset
-  NONE     rrset    rr       Delete an RR from RRset     dns.Remove
-  zone     rrset    rr       Add to an RRset             dns.Insert
+	 CLASS    TYPE     RDATA    Meaning                     Function
+	 ---------------------------------------------------------------
+	 ANY      ANY      empty    Delete all RRsets from name dns.RemoveName
+	 ANY      rrset    empty    Delete an RRset             dns.RemoveRRset
+	 NONE     rrset    rr       Delete an RR from RRset     dns.Remove
+	 zone     rrset    rr       Add to an RRset             dns.Insert
 
-TRANSACTION SIGNATURE
+# TRANSACTION SIGNATURE
 
 An TSIG or transaction signature adds a HMAC TSIG record to each message sent.
 The supported algorithms include: HmacSHA1, HmacSHA256 and HmacSHA512.
@@ -239,7 +239,7 @@ Basic use pattern validating and replying to a message that has TSIG set.
 		w.WriteMsg(m)
 	}
 
-PRIVATE RRS
+# PRIVATE RRS
 
 RFC 6895 sets aside a range of type codes for private use. This range is 65,280
 - 65,534 (0xFF00 - 0xFFFE). When experimenting with new Resource Records these
@@ -248,7 +248,7 @@ can be used, before requesting an official type code from IANA.
 See https://miek.nl/2014/september/21/idn-and-private-rr-in-go-dns/ for more
 information.
 
-EDNS0
+# EDNS0
 
 EDNS0 is an extension mechanism for the DNS defined in RFC 2671 and updated by
 RFC 6891. It defines a new RR type, the OPT RR, which is then completely
@@ -279,9 +279,9 @@ SIG(0)
 
 From RFC 2931:
 
-    SIG(0) provides protection for DNS transactions and requests ....
-    ... protection for glue records, DNS requests, protection for message headers
-    on requests and responses, and protection of the overall integrity of a response.
+	SIG(0) provides protection for DNS transactions and requests ....
+	... protection for glue records, DNS requests, protection for message headers
+	on requests and responses, and protection of the overall integrity of a response.
 
 It works like TSIG, except that SIG(0) uses public key cryptography, instead of
 the shared secret approach in TSIG. Supported algorithms: ECDSAP256SHA256,
diff --git a/vendor/github.com/miekg/dns/edns.go b/vendor/github.com/miekg/dns/edns.go
index 14568c2e96..b5bdac8160 100644
--- a/vendor/github.com/miekg/dns/edns.go
+++ b/vendor/github.com/miekg/dns/edns.go
@@ -78,7 +78,10 @@ func (rr *OPT) String() string {
 	if rr.Do() {
 		s += "flags: do; "
 	} else {
-		s += "flags: ; "
+		s += "flags:; "
+	}
+	if rr.Hdr.Ttl&0x7FFF != 0 {
+		s += fmt.Sprintf("MBZ: 0x%04x, ", rr.Hdr.Ttl&0x7FFF)
 	}
 	s += "udp: " + strconv.Itoa(int(rr.UDPSize()))
 
@@ -98,6 +101,8 @@ func (rr *OPT) String() string {
 			s += "\n; SUBNET: " + o.String()
 		case *EDNS0_COOKIE:
 			s += "\n; COOKIE: " + o.String()
+		case *EDNS0_EXPIRE:
+			s += "\n; EXPIRE: " + o.String()
 		case *EDNS0_TCP_KEEPALIVE:
 			s += "\n; KEEPALIVE: " + o.String()
 		case *EDNS0_UL:
@@ -258,7 +263,7 @@ func (e *EDNS0_NSID) copy() EDNS0           { return &EDNS0_NSID{e.Code, e.Nsid}
 //	o.Hdr.Name = "."
 //	o.Hdr.Rrtype = dns.TypeOPT
 //	e := new(dns.EDNS0_SUBNET)
-//	e.Code = dns.EDNS0SUBNET
+//	e.Code = dns.EDNS0SUBNET // by default this is filled in through unpacking OPT packets (unpackDataOpt)
 //	e.Family = 1	// 1 for IPv4 source address, 2 for IPv6
 //	e.SourceNetmask = 32	// 32 for IPV4, 128 for IPv6
 //	e.SourceScope = 0
@@ -515,8 +520,8 @@ type EDNS0_DAU struct {
 
 // Option implements the EDNS0 interface.
 func (e *EDNS0_DAU) Option() uint16        { return EDNS0DAU }
-func (e *EDNS0_DAU) pack() ([]byte, error) { return e.AlgCode, nil }
-func (e *EDNS0_DAU) unpack(b []byte) error { e.AlgCode = b; return nil }
+func (e *EDNS0_DAU) pack() ([]byte, error) { return cloneSlice(e.AlgCode), nil }
+func (e *EDNS0_DAU) unpack(b []byte) error { e.AlgCode = cloneSlice(b); return nil }
 
 func (e *EDNS0_DAU) String() string {
 	s := ""
@@ -539,8 +544,8 @@ type EDNS0_DHU struct {
 
 // Option implements the EDNS0 interface.
 func (e *EDNS0_DHU) Option() uint16        { return EDNS0DHU }
-func (e *EDNS0_DHU) pack() ([]byte, error) { return e.AlgCode, nil }
-func (e *EDNS0_DHU) unpack(b []byte) error { e.AlgCode = b; return nil }
+func (e *EDNS0_DHU) pack() ([]byte, error) { return cloneSlice(e.AlgCode), nil }
+func (e *EDNS0_DHU) unpack(b []byte) error { e.AlgCode = cloneSlice(b); return nil }
 
 func (e *EDNS0_DHU) String() string {
 	s := ""
@@ -563,8 +568,8 @@ type EDNS0_N3U struct {
 
 // Option implements the EDNS0 interface.
 func (e *EDNS0_N3U) Option() uint16        { return EDNS0N3U }
-func (e *EDNS0_N3U) pack() ([]byte, error) { return e.AlgCode, nil }
-func (e *EDNS0_N3U) unpack(b []byte) error { e.AlgCode = b; return nil }
+func (e *EDNS0_N3U) pack() ([]byte, error) { return cloneSlice(e.AlgCode), nil }
+func (e *EDNS0_N3U) unpack(b []byte) error { e.AlgCode = cloneSlice(b); return nil }
 
 func (e *EDNS0_N3U) String() string {
 	// Re-use the hash map
@@ -641,30 +646,21 @@ type EDNS0_LOCAL struct {
 
 // Option implements the EDNS0 interface.
 func (e *EDNS0_LOCAL) Option() uint16 { return e.Code }
+
 func (e *EDNS0_LOCAL) String() string {
 	return strconv.FormatInt(int64(e.Code), 10) + ":0x" + hex.EncodeToString(e.Data)
 }
+
 func (e *EDNS0_LOCAL) copy() EDNS0 {
-	b := make([]byte, len(e.Data))
-	copy(b, e.Data)
-	return &EDNS0_LOCAL{e.Code, b}
+	return &EDNS0_LOCAL{e.Code, cloneSlice(e.Data)}
 }
 
 func (e *EDNS0_LOCAL) pack() ([]byte, error) {
-	b := make([]byte, len(e.Data))
-	copied := copy(b, e.Data)
-	if copied != len(e.Data) {
-		return nil, ErrBuf
-	}
-	return b, nil
+	return cloneSlice(e.Data), nil
 }
 
 func (e *EDNS0_LOCAL) unpack(b []byte) error {
-	e.Data = make([]byte, len(b))
-	copied := copy(e.Data, b)
-	if copied != len(b) {
-		return ErrBuf
-	}
+	e.Data = cloneSlice(b)
 	return nil
 }
 
@@ -727,14 +723,10 @@ type EDNS0_PADDING struct {
 
 // Option implements the EDNS0 interface.
 func (e *EDNS0_PADDING) Option() uint16        { return EDNS0PADDING }
-func (e *EDNS0_PADDING) pack() ([]byte, error) { return e.Padding, nil }
-func (e *EDNS0_PADDING) unpack(b []byte) error { e.Padding = b; return nil }
+func (e *EDNS0_PADDING) pack() ([]byte, error) { return cloneSlice(e.Padding), nil }
+func (e *EDNS0_PADDING) unpack(b []byte) error { e.Padding = cloneSlice(b); return nil }
 func (e *EDNS0_PADDING) String() string        { return fmt.Sprintf("%0X", e.Padding) }
-func (e *EDNS0_PADDING) copy() EDNS0 {
-	b := make([]byte, len(e.Padding))
-	copy(b, e.Padding)
-	return &EDNS0_PADDING{b}
-}
+func (e *EDNS0_PADDING) copy() EDNS0           { return &EDNS0_PADDING{cloneSlice(e.Padding)} }
 
 // Extended DNS Error Codes (RFC 8914).
 const (
@@ -821,7 +813,7 @@ func (e *EDNS0_EDE) String() string {
 func (e *EDNS0_EDE) pack() ([]byte, error) {
 	b := make([]byte, 2+len(e.ExtraText))
 	binary.BigEndian.PutUint16(b[0:], e.InfoCode)
-	copy(b[2:], []byte(e.ExtraText))
+	copy(b[2:], e.ExtraText)
 	return b, nil
 }
 
diff --git a/vendor/github.com/miekg/dns/fuzz.go b/vendor/github.com/miekg/dns/fuzz.go
index 57410acda7..505ae43086 100644
--- a/vendor/github.com/miekg/dns/fuzz.go
+++ b/vendor/github.com/miekg/dns/fuzz.go
@@ -1,3 +1,4 @@
+//go:build fuzz
 // +build fuzz
 
 package dns
diff --git a/vendor/github.com/miekg/dns/labels.go b/vendor/github.com/miekg/dns/labels.go
index f9faacfeb4..cd498d2e9e 100644
--- a/vendor/github.com/miekg/dns/labels.go
+++ b/vendor/github.com/miekg/dns/labels.go
@@ -122,7 +122,7 @@ func Split(s string) []int {
 }
 
 // NextLabel returns the index of the start of the next label in the
-// string s starting at offset.
+// string s starting at offset. A negative offset will cause a panic.
 // The bool end is true when the end of the string has been reached.
 // Also see PrevLabel.
 func NextLabel(s string, offset int) (i int, end bool) {
diff --git a/vendor/github.com/miekg/dns/listen_no_reuseport.go b/vendor/github.com/miekg/dns/listen_no_reuseport.go
index b9201417ab..6ed50f86be 100644
--- a/vendor/github.com/miekg/dns/listen_no_reuseport.go
+++ b/vendor/github.com/miekg/dns/listen_no_reuseport.go
@@ -1,4 +1,5 @@
-// +build !go1.11 !aix,!darwin,!dragonfly,!freebsd,!linux,!netbsd,!openbsd
+//go:build !aix && !darwin && !dragonfly && !freebsd && !linux && !netbsd && !openbsd
+// +build !aix,!darwin,!dragonfly,!freebsd,!linux,!netbsd,!openbsd
 
 package dns
 
diff --git a/vendor/github.com/miekg/dns/listen_reuseport.go b/vendor/github.com/miekg/dns/listen_reuseport.go
index fad195cfeb..89bac90342 100644
--- a/vendor/github.com/miekg/dns/listen_reuseport.go
+++ b/vendor/github.com/miekg/dns/listen_reuseport.go
@@ -1,4 +1,4 @@
-// +build go1.11
+//go:build aix || darwin || dragonfly || freebsd || linux || netbsd || openbsd
 // +build aix darwin dragonfly freebsd linux netbsd openbsd
 
 package dns
diff --git a/vendor/github.com/miekg/dns/msg.go b/vendor/github.com/miekg/dns/msg.go
index 89ebb64abc..d5049a4f95 100644
--- a/vendor/github.com/miekg/dns/msg.go
+++ b/vendor/github.com/miekg/dns/msg.go
@@ -252,7 +252,7 @@ loop:
 			}
 
 			// check for \DDD
-			if i+3 < ls && isDigit(bs[i+1]) && isDigit(bs[i+2]) && isDigit(bs[i+3]) {
+			if isDDD(bs[i+1:]) {
 				bs[i] = dddToByte(bs[i+1:])
 				copy(bs[i+1:ls-3], bs[i+4:])
 				ls -= 3
@@ -448,7 +448,7 @@ Loop:
 	return string(s), off1, nil
 }
 
-func packTxt(txt []string, msg []byte, offset int, tmp []byte) (int, error) {
+func packTxt(txt []string, msg []byte, offset int) (int, error) {
 	if len(txt) == 0 {
 		if offset >= len(msg) {
 			return offset, ErrBuf
@@ -458,10 +458,7 @@ func packTxt(txt []string, msg []byte, offset int, tmp []byte) (int, error) {
 	}
 	var err error
 	for _, s := range txt {
-		if len(s) > len(tmp) {
-			return offset, ErrBuf
-		}
-		offset, err = packTxtString(s, msg, offset, tmp)
+		offset, err = packTxtString(s, msg, offset)
 		if err != nil {
 			return offset, err
 		}
@@ -469,32 +466,30 @@ func packTxt(txt []string, msg []byte, offset int, tmp []byte) (int, error) {
 	return offset, nil
 }
 
-func packTxtString(s string, msg []byte, offset int, tmp []byte) (int, error) {
+func packTxtString(s string, msg []byte, offset int) (int, error) {
 	lenByteOffset := offset
-	if offset >= len(msg) || len(s) > len(tmp) {
+	if offset >= len(msg) || len(s) > 256*4+1 /* If all \DDD */ {
 		return offset, ErrBuf
 	}
 	offset++
-	bs := tmp[:len(s)]
-	copy(bs, s)
-	for i := 0; i < len(bs); i++ {
+	for i := 0; i < len(s); i++ {
 		if len(msg) <= offset {
 			return offset, ErrBuf
 		}
-		if bs[i] == '\\' {
+		if s[i] == '\\' {
 			i++
-			if i == len(bs) {
+			if i == len(s) {
 				break
 			}
 			// check for \DDD
-			if i+2 < len(bs) && isDigit(bs[i]) && isDigit(bs[i+1]) && isDigit(bs[i+2]) {
-				msg[offset] = dddToByte(bs[i:])
+			if isDDD(s[i:]) {
+				msg[offset] = dddToByte(s[i:])
 				i += 2
 			} else {
-				msg[offset] = bs[i]
+				msg[offset] = s[i]
 			}
 		} else {
-			msg[offset] = bs[i]
+			msg[offset] = s[i]
 		}
 		offset++
 	}
@@ -522,7 +517,7 @@ func packOctetString(s string, msg []byte, offset int, tmp []byte) (int, error)
 				break
 			}
 			// check for \DDD
-			if i+2 < len(bs) && isDigit(bs[i]) && isDigit(bs[i+1]) && isDigit(bs[i+2]) {
+			if isDDD(bs[i:]) {
 				msg[offset] = dddToByte(bs[i:])
 				i += 2
 			} else {
@@ -551,12 +546,11 @@ func unpackTxt(msg []byte, off0 int) (ss []string, off int, err error) {
 // Helpers for dealing with escaped bytes
 func isDigit(b byte) bool { return b >= '0' && b <= '9' }
 
-func dddToByte(s []byte) byte {
-	_ = s[2] // bounds check hint to compiler; see golang.org/issue/14808
-	return byte((s[0]-'0')*100 + (s[1]-'0')*10 + (s[2] - '0'))
+func isDDD[T ~[]byte | ~string](s T) bool {
+	return len(s) >= 3 && isDigit(s[0]) && isDigit(s[1]) && isDigit(s[2])
 }
 
-func dddStringToByte(s string) byte {
+func dddToByte[T ~[]byte | ~string](s T) byte {
 	_ = s[2] // bounds check hint to compiler; see golang.org/issue/14808
 	return byte((s[0]-'0')*100 + (s[1]-'0')*10 + (s[2] - '0'))
 }
@@ -680,9 +674,9 @@ func unpackRRslice(l int, msg []byte, off int) (dst1 []RR, off1 int, err error)
 
 // Convert a MsgHdr to a string, with dig-like headers:
 //
-//;; opcode: QUERY, status: NOERROR, id: 48404
+// ;; opcode: QUERY, status: NOERROR, id: 48404
 //
-//;; flags: qr aa rd ra;
+// ;; flags: qr aa rd ra;
 func (h *MsgHdr) String() string {
 	if h == nil {
 		return "<nil> MsgHdr"
@@ -866,7 +860,7 @@ func (dns *Msg) unpack(dh Header, msg []byte, off int) (err error) {
 	// The header counts might have been wrong so we need to update it
 	dh.Nscount = uint16(len(dns.Ns))
 	if err == nil {
-		dns.Extra, off, err = unpackRRslice(int(dh.Arcount), msg, off)
+		dns.Extra, _, err = unpackRRslice(int(dh.Arcount), msg, off)
 	}
 	// The header counts might have been wrong so we need to update it
 	dh.Arcount = uint16(len(dns.Extra))
@@ -876,11 +870,11 @@ func (dns *Msg) unpack(dh Header, msg []byte, off int) (err error) {
 		dns.Rcode |= opt.ExtendedRcode()
 	}
 
-	if off != len(msg) {
-		// TODO(miek) make this an error?
-		// use PackOpt to let people tell how detailed the error reporting should be?
-		// println("dns: extra bytes in dns packet", off, "<", len(msg))
-	}
+	// TODO(miek) make this an error?
+	// use PackOpt to let people tell how detailed the error reporting should be?
+	// if off != len(msg) {
+	// 	// println("dns: extra bytes in dns packet", off, "<", len(msg))
+	// }
 	return err
 
 }
@@ -1024,7 +1018,7 @@ func escapedNameLen(s string) int {
 			continue
 		}
 
-		if i+3 < len(s) && isDigit(s[i+1]) && isDigit(s[i+2]) && isDigit(s[i+3]) {
+		if isDDD(s[i+1:]) {
 			nameLen -= 3
 			i += 3
 		} else {
@@ -1065,8 +1059,8 @@ func (dns *Msg) CopyTo(r1 *Msg) *Msg {
 	r1.Compress = dns.Compress
 
 	if len(dns.Question) > 0 {
-		r1.Question = make([]Question, len(dns.Question))
-		copy(r1.Question, dns.Question) // TODO(miek): Question is an immutable value, ok to do a shallow-copy
+		// TODO(miek): Question is an immutable value, ok to do a shallow-copy
+		r1.Question = cloneSlice(dns.Question)
 	}
 
 	rrArr := make([]RR, len(dns.Answer)+len(dns.Ns)+len(dns.Extra))
diff --git a/vendor/github.com/miekg/dns/msg_helpers.go b/vendor/github.com/miekg/dns/msg_helpers.go
index ea2035cd24..8582fc0adb 100644
--- a/vendor/github.com/miekg/dns/msg_helpers.go
+++ b/vendor/github.com/miekg/dns/msg_helpers.go
@@ -299,8 +299,7 @@ func unpackString(msg []byte, off int) (string, int, error) {
 }
 
 func packString(s string, msg []byte, off int) (int, error) {
-	txtTmp := make([]byte, 256*4+1)
-	off, err := packTxtString(s, msg, off, txtTmp)
+	off, err := packTxtString(s, msg, off)
 	if err != nil {
 		return len(msg), err
 	}
@@ -402,8 +401,7 @@ func unpackStringTxt(msg []byte, off int) ([]string, int, error) {
 }
 
 func packStringTxt(s []string, msg []byte, off int) (int, error) {
-	txtTmp := make([]byte, 256*4+1) // If the whole string consists out of \DDD we need this many.
-	off, err := packTxt(s, msg, off, txtTmp)
+	off, err := packTxt(s, msg, off)
 	if err != nil {
 		return len(msg), err
 	}
@@ -625,7 +623,7 @@ func unpackDataSVCB(msg []byte, off int) ([]SVCBKeyValue, int, error) {
 }
 
 func packDataSVCB(pairs []SVCBKeyValue, msg []byte, off int) (int, error) {
-	pairs = append([]SVCBKeyValue(nil), pairs...)
+	pairs = cloneSlice(pairs)
 	sort.Slice(pairs, func(i, j int) bool {
 		return pairs[i].Key() < pairs[j].Key()
 	})
@@ -810,3 +808,37 @@ func unpackDataAplPrefix(msg []byte, off int) (APLPrefix, int, error) {
 		Network:  ipnet,
 	}, off, nil
 }
+
+func unpackIPSECGateway(msg []byte, off int, gatewayType uint8) (net.IP, string, int, error) {
+	var retAddr net.IP
+	var retString string
+	var err error
+
+	switch gatewayType {
+	case IPSECGatewayNone: // do nothing
+	case IPSECGatewayIPv4:
+		retAddr, off, err = unpackDataA(msg, off)
+	case IPSECGatewayIPv6:
+		retAddr, off, err = unpackDataAAAA(msg, off)
+	case IPSECGatewayHost:
+		retString, off, err = UnpackDomainName(msg, off)
+	}
+
+	return retAddr, retString, off, err
+}
+
+func packIPSECGateway(gatewayAddr net.IP, gatewayString string, msg []byte, off int, gatewayType uint8, compression compressionMap, compress bool) (int, error) {
+	var err error
+
+	switch gatewayType {
+	case IPSECGatewayNone: // do nothing
+	case IPSECGatewayIPv4:
+		off, err = packDataA(gatewayAddr, msg, off)
+	case IPSECGatewayIPv6:
+		off, err = packDataAAAA(gatewayAddr, msg, off)
+	case IPSECGatewayHost:
+		off, err = packDomainName(gatewayString, msg, off, compression, compress)
+	}
+
+	return off, err
+}
diff --git a/vendor/github.com/miekg/dns/scan.go b/vendor/github.com/miekg/dns/scan.go
index 57be988277..3083c3e5f3 100644
--- a/vendor/github.com/miekg/dns/scan.go
+++ b/vendor/github.com/miekg/dns/scan.go
@@ -10,13 +10,13 @@ import (
 	"strings"
 )
 
-const maxTok = 2048 // Largest token we can return.
+const maxTok = 512 // Token buffer start size, and growth size amount.
 
 // The maximum depth of $INCLUDE directives supported by the
 // ZoneParser API.
 const maxIncludeDepth = 7
 
-// Tokinize a RFC 1035 zone file. The tokenizer will normalize it:
+// Tokenize a RFC 1035 zone file. The tokenizer will normalize it:
 // * Add ownernames if they are left blank;
 // * Suppress sequences of spaces;
 // * Make each RR fit on one line (_NEWLINE is send as last)
@@ -765,8 +765,8 @@ func (zl *zlexer) Next() (lex, bool) {
 	}
 
 	var (
-		str [maxTok]byte // Hold string text
-		com [maxTok]byte // Hold comment text
+		str = make([]byte, maxTok) // Hold string text
+		com = make([]byte, maxTok) // Hold comment text
 
 		stri int // Offset in str (0 means empty)
 		comi int // Offset in com (0 means empty)
@@ -785,14 +785,12 @@ func (zl *zlexer) Next() (lex, bool) {
 		l.line, l.column = zl.line, zl.column
 
 		if stri >= len(str) {
-			l.token = "token length insufficient for parsing"
-			l.err = true
-			return *l, true
+			// if buffer length is insufficient, increase it.
+			str = append(str[:], make([]byte, maxTok)...)
 		}
 		if comi >= len(com) {
-			l.token = "comment length insufficient for parsing"
-			l.err = true
-			return *l, true
+			// if buffer length is insufficient, increase it.
+			com = append(com[:], make([]byte, maxTok)...)
 		}
 
 		switch x {
@@ -816,7 +814,7 @@ func (zl *zlexer) Next() (lex, bool) {
 			if stri == 0 {
 				// Space directly in the beginning, handled in the grammar
 			} else if zl.owner {
-				// If we have a string and its the first, make it an owner
+				// If we have a string and it's the first, make it an owner
 				l.value = zOwner
 				l.token = string(str[:stri])
 
diff --git a/vendor/github.com/miekg/dns/scan_rr.go b/vendor/github.com/miekg/dns/scan_rr.go
index e398484da9..d08c8e6a72 100644
--- a/vendor/github.com/miekg/dns/scan_rr.go
+++ b/vendor/github.com/miekg/dns/scan_rr.go
@@ -3,6 +3,7 @@ package dns
 import (
 	"bytes"
 	"encoding/base64"
+	"errors"
 	"net"
 	"strconv"
 	"strings"
@@ -903,11 +904,18 @@ func (rr *RRSIG) parse(c *zlexer, o string) *ParseError {
 
 	c.Next() // zBlank
 	l, _ = c.Next()
-	i, e := strconv.ParseUint(l.token, 10, 8)
-	if e != nil || l.err {
+	if l.err {
 		return &ParseError{"", "bad RRSIG Algorithm", l}
 	}
-	rr.Algorithm = uint8(i)
+	i, e := strconv.ParseUint(l.token, 10, 8)
+	rr.Algorithm = uint8(i) // if 0 we'll check the mnemonic in the if
+	if e != nil {
+		v, ok := StringToAlgorithm[l.token]
+		if !ok {
+			return &ParseError{"", "bad RRSIG Algorithm", l}
+		}
+		rr.Algorithm = v
+	}
 
 	c.Next() // zBlank
 	l, _ = c.Next()
@@ -1216,6 +1224,117 @@ func (rr *DS) parse(c *zlexer, o string) *ParseError      { return rr.parseDS(c,
 func (rr *DLV) parse(c *zlexer, o string) *ParseError     { return rr.parseDS(c, o, "DLV") }
 func (rr *CDS) parse(c *zlexer, o string) *ParseError     { return rr.parseDS(c, o, "CDS") }
 
+func (rr *IPSECKEY) parse(c *zlexer, o string) *ParseError {
+	l, _ := c.Next()
+	num, err := strconv.ParseUint(l.token, 10, 8)
+	if err != nil || l.err {
+		return &ParseError{"", "bad IPSECKEY value", l}
+	}
+	rr.Precedence = uint8(num)
+	c.Next() // zBlank
+
+	l, _ = c.Next()
+	num, err = strconv.ParseUint(l.token, 10, 8)
+	if err != nil || l.err {
+		return &ParseError{"", "bad IPSECKEY value", l}
+	}
+	rr.GatewayType = uint8(num)
+	c.Next() // zBlank
+
+	l, _ = c.Next()
+	num, err = strconv.ParseUint(l.token, 10, 8)
+	if err != nil || l.err {
+		return &ParseError{"", "bad IPSECKEY value", l}
+	}
+	rr.Algorithm = uint8(num)
+	c.Next() // zBlank
+
+	l, _ = c.Next()
+	if l.err {
+		return &ParseError{"", "bad IPSECKEY gateway", l}
+	}
+
+	rr.GatewayAddr, rr.GatewayHost, err = parseAddrHostUnion(l.token, o, rr.GatewayType)
+	if err != nil {
+		return &ParseError{"", "IPSECKEY " + err.Error(), l}
+	}
+
+	c.Next() // zBlank
+
+	s, pErr := endingToString(c, "bad IPSECKEY PublicKey")
+	if pErr != nil {
+		return pErr
+	}
+	rr.PublicKey = s
+	return slurpRemainder(c)
+}
+
+func (rr *AMTRELAY) parse(c *zlexer, o string) *ParseError {
+	l, _ := c.Next()
+	num, err := strconv.ParseUint(l.token, 10, 8)
+	if err != nil || l.err {
+		return &ParseError{"", "bad AMTRELAY value", l}
+	}
+	rr.Precedence = uint8(num)
+	c.Next() // zBlank
+
+	l, _ = c.Next()
+	if l.err || !(l.token == "0" || l.token == "1") {
+		return &ParseError{"", "bad discovery value", l}
+	}
+	if l.token == "1" {
+		rr.GatewayType = 0x80
+	}
+
+	c.Next() // zBlank
+
+	l, _ = c.Next()
+	num, err = strconv.ParseUint(l.token, 10, 8)
+	if err != nil || l.err {
+		return &ParseError{"", "bad AMTRELAY value", l}
+	}
+	rr.GatewayType |= uint8(num)
+	c.Next() // zBlank
+
+	l, _ = c.Next()
+	if l.err {
+		return &ParseError{"", "bad AMTRELAY gateway", l}
+	}
+
+	rr.GatewayAddr, rr.GatewayHost, err = parseAddrHostUnion(l.token, o, rr.GatewayType&0x7f)
+	if err != nil {
+		return &ParseError{"", "AMTRELAY " + err.Error(), l}
+	}
+
+	return slurpRemainder(c)
+}
+
+// same constants and parsing between IPSECKEY and AMTRELAY
+func parseAddrHostUnion(token, o string, gatewayType uint8) (addr net.IP, host string, err error) {
+	switch gatewayType {
+	case IPSECGatewayNone:
+		if token != "." {
+			return addr, host, errors.New("gateway type none with gateway set")
+		}
+	case IPSECGatewayIPv4, IPSECGatewayIPv6:
+		addr = net.ParseIP(token)
+		if addr == nil {
+			return addr, host, errors.New("gateway IP invalid")
+		}
+		if (addr.To4() == nil) == (gatewayType == IPSECGatewayIPv4) {
+			return addr, host, errors.New("gateway IP family mismatch")
+		}
+	case IPSECGatewayHost:
+		var ok bool
+		host, ok = toAbsoluteName(token, o)
+		if !ok {
+			return addr, host, errors.New("invalid gateway host")
+		}
+	}
+
+	return addr, host, nil
+}
+
 func (rr *RKEY) parse(c *zlexer, o string) *ParseError {
 	l, _ := c.Next()
 	i, e := strconv.ParseUint(l.token, 10, 16)
diff --git a/vendor/github.com/miekg/dns/server.go b/vendor/github.com/miekg/dns/server.go
index 4e5a9aa8a1..64e3885462 100644
--- a/vendor/github.com/miekg/dns/server.go
+++ b/vendor/github.com/miekg/dns/server.go
@@ -18,7 +18,7 @@ import (
 const maxTCPQueries = 128
 
 // aLongTimeAgo is a non-zero time, far in the past, used for
-// immediate cancelation of network operations.
+// immediate cancellation of network operations.
 var aLongTimeAgo = time.Unix(1, 0)
 
 // Handler is implemented by any value that implements ServeDNS.
@@ -224,7 +224,7 @@ type Server struct {
 	// Maximum number of TCP queries before we close the socket. Default is maxTCPQueries (unlimited if -1).
 	MaxTCPQueries int
 	// Whether to set the SO_REUSEPORT socket option, allowing multiple listeners to be bound to a single address.
-	// It is only supported on go1.11+ and when using ListenAndServe.
+	// It is only supported on certain GOOSes and when using ListenAndServe.
 	ReusePort bool
 	// AcceptMsgFunc will check the incoming message and will reject it early in the process.
 	// By default DefaultMsgAcceptFunc will be used.
diff --git a/vendor/github.com/miekg/dns/singleinflight.go b/vendor/github.com/miekg/dns/singleinflight.go
deleted file mode 100644
index febcc300fe..0000000000
--- a/vendor/github.com/miekg/dns/singleinflight.go
+++ /dev/null
@@ -1,61 +0,0 @@
-// Copyright 2013 The Go Authors.  All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// Adapted for dns package usage by Miek Gieben.
-
-package dns
-
-import "sync"
-import "time"
-
-// call is an in-flight or completed singleflight.Do call
-type call struct {
-	wg   sync.WaitGroup
-	val  *Msg
-	rtt  time.Duration
-	err  error
-	dups int
-}
-
-// singleflight represents a class of work and forms a namespace in
-// which units of work can be executed with duplicate suppression.
-type singleflight struct {
-	sync.Mutex                  // protects m
-	m          map[string]*call // lazily initialized
-
-	dontDeleteForTesting bool // this is only to be used by TestConcurrentExchanges
-}
-
-// Do executes and returns the results of the given function, making
-// sure that only one execution is in-flight for a given key at a
-// time. If a duplicate comes in, the duplicate caller waits for the
-// original to complete and receives the same results.
-// The return value shared indicates whether v was given to multiple callers.
-func (g *singleflight) Do(key string, fn func() (*Msg, time.Duration, error)) (v *Msg, rtt time.Duration, err error, shared bool) {
-	g.Lock()
-	if g.m == nil {
-		g.m = make(map[string]*call)
-	}
-	if c, ok := g.m[key]; ok {
-		c.dups++
-		g.Unlock()
-		c.wg.Wait()
-		return c.val, c.rtt, c.err, true
-	}
-	c := new(call)
-	c.wg.Add(1)
-	g.m[key] = c
-	g.Unlock()
-
-	c.val, c.rtt, c.err = fn()
-	c.wg.Done()
-
-	if !g.dontDeleteForTesting {
-		g.Lock()
-		delete(g.m, key)
-		g.Unlock()
-	}
-
-	return c.val, c.rtt, c.err, c.dups > 0
-}
diff --git a/vendor/github.com/miekg/dns/svcb.go b/vendor/github.com/miekg/dns/svcb.go
index ea58710da9..6d496d74de 100644
--- a/vendor/github.com/miekg/dns/svcb.go
+++ b/vendor/github.com/miekg/dns/svcb.go
@@ -289,7 +289,7 @@ func (s *SVCBMandatory) String() string {
 }
 
 func (s *SVCBMandatory) pack() ([]byte, error) {
-	codes := append([]SVCBKey(nil), s.Code...)
+	codes := cloneSlice(s.Code)
 	sort.Slice(codes, func(i, j int) bool {
 		return codes[i] < codes[j]
 	})
@@ -328,9 +328,7 @@ func (s *SVCBMandatory) len() int {
 }
 
 func (s *SVCBMandatory) copy() SVCBKeyValue {
-	return &SVCBMandatory{
-		append([]SVCBKey(nil), s.Code...),
-	}
+	return &SVCBMandatory{cloneSlice(s.Code)}
 }
 
 // SVCBAlpn pair is used to list supported connection protocols.
@@ -353,7 +351,7 @@ func (*SVCBAlpn) Key() SVCBKey { return SVCB_ALPN }
 func (s *SVCBAlpn) String() string {
 	// An ALPN value is a comma-separated list of values, each of which can be
 	// an arbitrary binary value. In order to allow parsing, the comma and
-	// backslash characters are themselves excaped.
+	// backslash characters are themselves escaped.
 	//
 	// However, this escaping is done in addition to the normal escaping which
 	// happens in zone files, meaning that these values must be
@@ -481,9 +479,7 @@ func (s *SVCBAlpn) len() int {
 }
 
 func (s *SVCBAlpn) copy() SVCBKeyValue {
-	return &SVCBAlpn{
-		append([]string(nil), s.Alpn...),
-	}
+	return &SVCBAlpn{cloneSlice(s.Alpn)}
 }
 
 // SVCBNoDefaultAlpn pair signifies no support for default connection protocols.
@@ -563,15 +559,15 @@ func (s *SVCBPort) parse(b string) error {
 // to the hinted IP address may be terminated and a new connection may be opened.
 // Basic use pattern for creating an ipv4hint option:
 //
-//	h := new(dns.HTTPS)
-//	h.Hdr = dns.RR_Header{Name: ".", Rrtype: dns.TypeHTTPS, Class: dns.ClassINET}
-//	e := new(dns.SVCBIPv4Hint)
-//	e.Hint = []net.IP{net.IPv4(1,1,1,1).To4()}
+//		h := new(dns.HTTPS)
+//		h.Hdr = dns.RR_Header{Name: ".", Rrtype: dns.TypeHTTPS, Class: dns.ClassINET}
+//		e := new(dns.SVCBIPv4Hint)
+//		e.Hint = []net.IP{net.IPv4(1,1,1,1).To4()}
 //
-//  Or
+//	 Or
 //
-//	e.Hint = []net.IP{net.ParseIP("1.1.1.1").To4()}
-//	h.Value = append(h.Value, e)
+//		e.Hint = []net.IP{net.ParseIP("1.1.1.1").To4()}
+//		h.Value = append(h.Value, e)
 type SVCBIPv4Hint struct {
 	Hint []net.IP
 }
@@ -595,6 +591,7 @@ func (s *SVCBIPv4Hint) unpack(b []byte) error {
 	if len(b) == 0 || len(b)%4 != 0 {
 		return errors.New("dns: svcbipv4hint: ipv4 address byte array length is not a multiple of 4")
 	}
+	b = cloneSlice(b)
 	x := make([]net.IP, 0, len(b)/4)
 	for i := 0; i < len(b); i += 4 {
 		x = append(x, net.IP(b[i:i+4]))
@@ -635,12 +632,9 @@ func (s *SVCBIPv4Hint) parse(b string) error {
 func (s *SVCBIPv4Hint) copy() SVCBKeyValue {
 	hint := make([]net.IP, len(s.Hint))
 	for i, ip := range s.Hint {
-		hint[i] = copyIP(ip)
-	}
-
-	return &SVCBIPv4Hint{
-		Hint: hint,
+		hint[i] = cloneSlice(ip)
 	}
+	return &SVCBIPv4Hint{Hint: hint}
 }
 
 // SVCBECHConfig pair contains the ECHConfig structure defined in draft-ietf-tls-esni [RFC xxxx].
@@ -660,19 +654,18 @@ func (s *SVCBECHConfig) String() string { return toBase64(s.ECH) }
 func (s *SVCBECHConfig) len() int       { return len(s.ECH) }
 
 func (s *SVCBECHConfig) pack() ([]byte, error) {
-	return append([]byte(nil), s.ECH...), nil
+	return cloneSlice(s.ECH), nil
 }
 
 func (s *SVCBECHConfig) copy() SVCBKeyValue {
-	return &SVCBECHConfig{
-		append([]byte(nil), s.ECH...),
-	}
+	return &SVCBECHConfig{cloneSlice(s.ECH)}
 }
 
 func (s *SVCBECHConfig) unpack(b []byte) error {
-	s.ECH = append([]byte(nil), b...)
+	s.ECH = cloneSlice(b)
 	return nil
 }
+
 func (s *SVCBECHConfig) parse(b string) error {
 	x, err := fromBase64([]byte(b))
 	if err != nil {
@@ -715,6 +708,7 @@ func (s *SVCBIPv6Hint) unpack(b []byte) error {
 	if len(b) == 0 || len(b)%16 != 0 {
 		return errors.New("dns: svcbipv6hint: ipv6 address byte array length not a multiple of 16")
 	}
+	b = cloneSlice(b)
 	x := make([]net.IP, 0, len(b)/16)
 	for i := 0; i < len(b); i += 16 {
 		ip := net.IP(b[i : i+16])
@@ -758,12 +752,9 @@ func (s *SVCBIPv6Hint) parse(b string) error {
 func (s *SVCBIPv6Hint) copy() SVCBKeyValue {
 	hint := make([]net.IP, len(s.Hint))
 	for i, ip := range s.Hint {
-		hint[i] = copyIP(ip)
-	}
-
-	return &SVCBIPv6Hint{
-		Hint: hint,
+		hint[i] = cloneSlice(ip)
 	}
+	return &SVCBIPv6Hint{Hint: hint}
 }
 
 // SVCBDoHPath pair is used to indicate the URI template that the
@@ -831,11 +822,11 @@ type SVCBLocal struct {
 
 func (s *SVCBLocal) Key() SVCBKey          { return s.KeyCode }
 func (s *SVCBLocal) String() string        { return svcbParamToStr(s.Data) }
-func (s *SVCBLocal) pack() ([]byte, error) { return append([]byte(nil), s.Data...), nil }
+func (s *SVCBLocal) pack() ([]byte, error) { return cloneSlice(s.Data), nil }
 func (s *SVCBLocal) len() int              { return len(s.Data) }
 
 func (s *SVCBLocal) unpack(b []byte) error {
-	s.Data = append([]byte(nil), b...)
+	s.Data = cloneSlice(b)
 	return nil
 }
 
@@ -849,9 +840,7 @@ func (s *SVCBLocal) parse(b string) error {
 }
 
 func (s *SVCBLocal) copy() SVCBKeyValue {
-	return &SVCBLocal{s.KeyCode,
-		append([]byte(nil), s.Data...),
-	}
+	return &SVCBLocal{s.KeyCode, cloneSlice(s.Data)}
 }
 
 func (rr *SVCB) String() string {
@@ -867,8 +856,8 @@ func (rr *SVCB) String() string {
 // areSVCBPairArraysEqual checks if SVCBKeyValue arrays are equal after sorting their
 // copies. arrA and arrB have equal lengths, otherwise zduplicate.go wouldn't call this function.
 func areSVCBPairArraysEqual(a []SVCBKeyValue, b []SVCBKeyValue) bool {
-	a = append([]SVCBKeyValue(nil), a...)
-	b = append([]SVCBKeyValue(nil), b...)
+	a = cloneSlice(a)
+	b = cloneSlice(b)
 	sort.Slice(a, func(i, j int) bool { return a[i].Key() < a[j].Key() })
 	sort.Slice(b, func(i, j int) bool { return b[i].Key() < b[j].Key() })
 	for i, e := range a {
diff --git a/vendor/github.com/miekg/dns/tools.go b/vendor/github.com/miekg/dns/tools.go
index d111825360..ccf8f6bfc7 100644
--- a/vendor/github.com/miekg/dns/tools.go
+++ b/vendor/github.com/miekg/dns/tools.go
@@ -1,3 +1,4 @@
+//go:build tools
 // +build tools
 
 // We include our tool dependencies for `go generate` here to ensure they're
diff --git a/vendor/github.com/miekg/dns/types.go b/vendor/github.com/miekg/dns/types.go
index d9becb67cd..03afeccda3 100644
--- a/vendor/github.com/miekg/dns/types.go
+++ b/vendor/github.com/miekg/dns/types.go
@@ -65,6 +65,7 @@ const (
 	TypeAPL        uint16 = 42
 	TypeDS         uint16 = 43
 	TypeSSHFP      uint16 = 44
+	TypeIPSECKEY   uint16 = 45
 	TypeRRSIG      uint16 = 46
 	TypeNSEC       uint16 = 47
 	TypeDNSKEY     uint16 = 48
@@ -98,6 +99,7 @@ const (
 	TypeURI        uint16 = 256
 	TypeCAA        uint16 = 257
 	TypeAVC        uint16 = 258
+	TypeAMTRELAY   uint16 = 260
 
 	TypeTKEY uint16 = 249
 	TypeTSIG uint16 = 250
@@ -159,6 +161,22 @@ const (
 	ZoneMDHashAlgSHA512 = 2
 )
 
+// Used in IPSEC https://datatracker.ietf.org/doc/html/rfc4025#section-2.3
+const (
+	IPSECGatewayNone uint8 = iota
+	IPSECGatewayIPv4
+	IPSECGatewayIPv6
+	IPSECGatewayHost
+)
+
+// Used in AMTRELAY https://datatracker.ietf.org/doc/html/rfc8777#section-4.2.3
+const (
+	AMTRELAYNone = IPSECGatewayNone
+	AMTRELAYIPv4 = IPSECGatewayIPv4
+	AMTRELAYIPv6 = IPSECGatewayIPv6
+	AMTRELAYHost = IPSECGatewayHost
+)
+
 // Header is the wire format for the DNS packet header.
 type Header struct {
 	Id                                 uint16
@@ -180,7 +198,7 @@ const (
 	_CD = 1 << 4  // checking disabled
 )
 
-// Various constants used in the LOC RR. See RFC 1887.
+// Various constants used in the LOC RR. See RFC 1876.
 const (
 	LOC_EQUATOR       = 1 << 31 // RFC 1876, Section 2.
 	LOC_PRIMEMERIDIAN = 1 << 31 // RFC 1876, Section 2.
@@ -613,8 +631,8 @@ func nextByte(s string, offset int) (byte, int) {
 		return 0, 0
 	case 2, 3: // too short to be \ddd
 	default: // maybe \ddd
-		if isDigit(s[offset+1]) && isDigit(s[offset+2]) && isDigit(s[offset+3]) {
-			return dddStringToByte(s[offset+1:]), 4
+		if isDDD(s[offset+1:]) {
+			return dddToByte(s[offset+1:]), 4
 		}
 	}
 	// not \ddd, just an RFC 1035 "quoted" character
@@ -774,7 +792,10 @@ type LOC struct {
 
 // cmToM takes a cm value expressed in RFC 1876 SIZE mantissa/exponent
 // format and returns a string in m (two decimals for the cm).
-func cmToM(m, e uint8) string {
+func cmToM(x uint8) string {
+	m := x & 0xf0 >> 4
+	e := x & 0x0f
+
 	if e < 2 {
 		if e == 1 {
 			m *= 10
@@ -830,10 +851,9 @@ func (rr *LOC) String() string {
 		s += fmt.Sprintf("%.0fm ", alt)
 	}
 
-	s += cmToM(rr.Size&0xf0>>4, rr.Size&0x0f) + "m "
-	s += cmToM(rr.HorizPre&0xf0>>4, rr.HorizPre&0x0f) + "m "
-	s += cmToM(rr.VertPre&0xf0>>4, rr.VertPre&0x0f) + "m"
-
+	s += cmToM(rr.Size) + "m "
+	s += cmToM(rr.HorizPre) + "m "
+	s += cmToM(rr.VertPre) + "m"
 	return s
 }
 
@@ -994,6 +1014,69 @@ func (rr *DNSKEY) String() string {
 		" " + rr.PublicKey
 }
 
+// IPSECKEY RR. See RFC 4025.
+type IPSECKEY struct {
+	Hdr         RR_Header
+	Precedence  uint8
+	GatewayType uint8
+	Algorithm   uint8
+	GatewayAddr net.IP `dns:"-"` // packing/unpacking/parsing/etc handled together with GatewayHost
+	GatewayHost string `dns:"ipsechost"`
+	PublicKey   string `dns:"base64"`
+}
+
+func (rr *IPSECKEY) String() string {
+	var gateway string
+	switch rr.GatewayType {
+	case IPSECGatewayIPv4, IPSECGatewayIPv6:
+		gateway = rr.GatewayAddr.String()
+	case IPSECGatewayHost:
+		gateway = rr.GatewayHost
+	case IPSECGatewayNone:
+		fallthrough
+	default:
+		gateway = "."
+	}
+
+	return rr.Hdr.String() + strconv.Itoa(int(rr.Precedence)) +
+		" " + strconv.Itoa(int(rr.GatewayType)) +
+		" " + strconv.Itoa(int(rr.Algorithm)) +
+		" " + gateway +
+		" " + rr.PublicKey
+}
+
+// AMTRELAY RR. See RFC 8777.
+type AMTRELAY struct {
+	Hdr         RR_Header
+	Precedence  uint8
+	GatewayType uint8  // discovery is packed in here at bit 0x80
+	GatewayAddr net.IP `dns:"-"` // packing/unpacking/parsing/etc handled together with GatewayHost
+	GatewayHost string `dns:"amtrelayhost"`
+}
+
+func (rr *AMTRELAY) String() string {
+	var gateway string
+	switch rr.GatewayType & 0x7f {
+	case AMTRELAYIPv4, AMTRELAYIPv6:
+		gateway = rr.GatewayAddr.String()
+	case AMTRELAYHost:
+		gateway = rr.GatewayHost
+	case AMTRELAYNone:
+		fallthrough
+	default:
+		gateway = "."
+	}
+	boolS := "0"
+	if rr.GatewayType&0x80 == 0x80 {
+		boolS = "1"
+	}
+
+	return rr.Hdr.String() + strconv.Itoa(int(rr.Precedence)) +
+		" " + boolS +
+		" " + strconv.Itoa(int(rr.GatewayType&0x7f)) +
+		" " + gateway
+}
+
 // RKEY RR. See https://www.iana.org/assignments/dns-parameters/RKEY/rkey-completed-template.
 type RKEY struct {
 	Hdr       RR_Header
@@ -1450,7 +1533,7 @@ func (a *APLPrefix) str() string {
 // equals reports whether two APL prefixes are identical.
 func (a *APLPrefix) equals(b *APLPrefix) bool {
 	return a.Negation == b.Negation &&
-		bytes.Equal(a.Network.IP, b.Network.IP) &&
+		a.Network.IP.Equal(b.Network.IP) &&
 		bytes.Equal(a.Network.Mask, b.Network.Mask)
 }
 
@@ -1518,21 +1601,19 @@ func euiToString(eui uint64, bits int) (hex string) {
 	return
 }
 
-// copyIP returns a copy of ip.
-func copyIP(ip net.IP) net.IP {
-	p := make(net.IP, len(ip))
-	copy(p, ip)
-	return p
+// cloneSlice returns a shallow copy of s.
+func cloneSlice[E any, S ~[]E](s S) S {
+	if s == nil {
+		return nil
+	}
+	return append(S(nil), s...)
 }
 
 // copyNet returns a copy of a subnet.
 func copyNet(n net.IPNet) net.IPNet {
-	m := make(net.IPMask, len(n.Mask))
-	copy(m, n.Mask)
-
 	return net.IPNet{
-		IP:   copyIP(n.IP),
-		Mask: m,
+		IP:   cloneSlice(n.IP),
+		Mask: cloneSlice(n.Mask),
 	}
 }
 
diff --git a/vendor/github.com/miekg/dns/udp.go b/vendor/github.com/miekg/dns/udp.go
index a4826ee2ff..c018ad43da 100644
--- a/vendor/github.com/miekg/dns/udp.go
+++ b/vendor/github.com/miekg/dns/udp.go
@@ -1,3 +1,4 @@
+//go:build !windows
 // +build !windows
 
 package dns
diff --git a/vendor/github.com/miekg/dns/udp_windows.go b/vendor/github.com/miekg/dns/udp_windows.go
index e7dd8ca313..a259b67e4d 100644
--- a/vendor/github.com/miekg/dns/udp_windows.go
+++ b/vendor/github.com/miekg/dns/udp_windows.go
@@ -1,5 +1,9 @@
+//go:build windows
 // +build windows
 
+// TODO(tmthrgd): Remove this Windows-specific code if go.dev/issue/7175 and
+//   go.dev/issue/7174 are ever fixed.
+
 package dns
 
 import "net"
@@ -14,7 +18,6 @@ func (s *SessionUDP) RemoteAddr() net.Addr { return s.raddr }
 
 // ReadFromSessionUDP acts just like net.UDPConn.ReadFrom(), but returns a session object instead of a
 // net.UDPAddr.
-// TODO(fastest963): Once go1.10 is released, use ReadMsgUDP.
 func ReadFromSessionUDP(conn *net.UDPConn, b []byte) (int, *SessionUDP, error) {
 	n, raddr, err := conn.ReadFrom(b)
 	if err != nil {
@@ -24,12 +27,9 @@ func ReadFromSessionUDP(conn *net.UDPConn, b []byte) (int, *SessionUDP, error) {
 }
 
 // WriteToSessionUDP acts just like net.UDPConn.WriteTo(), but uses a *SessionUDP instead of a net.Addr.
-// TODO(fastest963): Once go1.10 is released, use WriteMsgUDP.
 func WriteToSessionUDP(conn *net.UDPConn, b []byte, session *SessionUDP) (int, error) {
 	return conn.WriteTo(b, session.raddr)
 }
 
-// TODO(fastest963): Once go1.10 is released and we can use *MsgUDP methods
-// use the standard method in udp.go for these.
 func setUDPSocketOptions(*net.UDPConn) error { return nil }
 func parseDstFromOOB([]byte, net.IP) net.IP  { return nil }
diff --git a/vendor/github.com/miekg/dns/version.go b/vendor/github.com/miekg/dns/version.go
index b1a872bd59..6094585d8b 100644
--- a/vendor/github.com/miekg/dns/version.go
+++ b/vendor/github.com/miekg/dns/version.go
@@ -3,7 +3,7 @@ package dns
 import "fmt"
 
 // Version is current version of this library.
-var Version = v{1, 1, 50}
+var Version = v{1, 1, 54}
 
 // v holds the version of this library.
 type v struct {
diff --git a/vendor/github.com/miekg/dns/xfr.go b/vendor/github.com/miekg/dns/xfr.go
index 1917e91c80..0a831c8805 100644
--- a/vendor/github.com/miekg/dns/xfr.go
+++ b/vendor/github.com/miekg/dns/xfr.go
@@ -44,7 +44,6 @@ func (t *Transfer) tsigProvider() TsigProvider {
 //	dnscon := &dns.Conn{Conn:con}
 //	transfer = &dns.Transfer{Conn: dnscon}
 //	channel, err := transfer.In(message, master)
-//
 func (t *Transfer) In(q *Msg, a string) (env chan *Envelope, err error) {
 	switch q.Question[0].Qtype {
 	case TypeAXFR, TypeIXFR:
diff --git a/vendor/github.com/miekg/dns/zduplicate.go b/vendor/github.com/miekg/dns/zduplicate.go
index 9eb1dac299..450bbbc29d 100644
--- a/vendor/github.com/miekg/dns/zduplicate.go
+++ b/vendor/github.com/miekg/dns/zduplicate.go
@@ -43,6 +43,32 @@ func (r1 *AFSDB) isDuplicate(_r2 RR) bool {
 	return true
 }
 
+func (r1 *AMTRELAY) isDuplicate(_r2 RR) bool {
+	r2, ok := _r2.(*AMTRELAY)
+	if !ok {
+		return false
+	}
+	_ = r2
+	if r1.Precedence != r2.Precedence {
+		return false
+	}
+	if r1.GatewayType != r2.GatewayType {
+		return false
+	}
+	switch r1.GatewayType {
+	case IPSECGatewayIPv4, IPSECGatewayIPv6:
+		if !r1.GatewayAddr.Equal(r2.GatewayAddr) {
+			return false
+		}
+	case IPSECGatewayHost:
+		if !isDuplicateName(r1.GatewayHost, r2.GatewayHost) {
+			return false
+		}
+	}
+
+	return true
+}
+
 func (r1 *ANY) isDuplicate(_r2 RR) bool {
 	r2, ok := _r2.(*ANY)
 	if !ok {
@@ -423,6 +449,38 @@ func (r1 *HTTPS) isDuplicate(_r2 RR) bool {
 	return true
 }
 
+func (r1 *IPSECKEY) isDuplicate(_r2 RR) bool {
+	r2, ok := _r2.(*IPSECKEY)
+	if !ok {
+		return false
+	}
+	_ = r2
+	if r1.Precedence != r2.Precedence {
+		return false
+	}
+	if r1.GatewayType != r2.GatewayType {
+		return false
+	}
+	if r1.Algorithm != r2.Algorithm {
+		return false
+	}
+	switch r1.GatewayType {
+	case IPSECGatewayIPv4, IPSECGatewayIPv6:
+		if !r1.GatewayAddr.Equal(r2.GatewayAddr) {
+			return false
+		}
+	case IPSECGatewayHost:
+		if !isDuplicateName(r1.GatewayHost, r2.GatewayHost) {
+			return false
+		}
+	}
+
+	if r1.PublicKey != r2.PublicKey {
+		return false
+	}
+	return true
+}
+
 func (r1 *KEY) isDuplicate(_r2 RR) bool {
 	r2, ok := _r2.(*KEY)
 	if !ok {
diff --git a/vendor/github.com/miekg/dns/zmsg.go b/vendor/github.com/miekg/dns/zmsg.go
index fc0822f982..3ea0eb423a 100644
--- a/vendor/github.com/miekg/dns/zmsg.go
+++ b/vendor/github.com/miekg/dns/zmsg.go
@@ -32,6 +32,22 @@ func (rr *AFSDB) pack(msg []byte, off int, compression compressionMap, compress
 	return off, nil
 }
 
+func (rr *AMTRELAY) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
+	off, err = packUint8(rr.Precedence, msg, off)
+	if err != nil {
+		return off, err
+	}
+	off, err = packUint8(rr.GatewayType, msg, off)
+	if err != nil {
+		return off, err
+	}
+	off, err = packIPSECGateway(rr.GatewayAddr, rr.GatewayHost, msg, off, rr.GatewayType, compression, false)
+	if err != nil {
+		return off, err
+	}
+	return off, nil
+}
+
 func (rr *ANY) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
 	return off, nil
 }
@@ -332,6 +348,30 @@ func (rr *HTTPS) pack(msg []byte, off int, compression compressionMap, compress
 	return off, nil
 }
 
+func (rr *IPSECKEY) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
+	off, err = packUint8(rr.Precedence, msg, off)
+	if err != nil {
+		return off, err
+	}
+	off, err = packUint8(rr.GatewayType, msg, off)
+	if err != nil {
+		return off, err
+	}
+	off, err = packUint8(rr.Algorithm, msg, off)
+	if err != nil {
+		return off, err
+	}
+	off, err = packIPSECGateway(rr.GatewayAddr, rr.GatewayHost, msg, off, rr.GatewayType, compression, false)
+	if err != nil {
+		return off, err
+	}
+	off, err = packStringBase64(rr.PublicKey, msg, off)
+	if err != nil {
+		return off, err
+	}
+	return off, nil
+}
+
 func (rr *KEY) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
 	off, err = packUint16(rr.Flags, msg, off)
 	if err != nil {
@@ -1180,6 +1220,34 @@ func (rr *AFSDB) unpack(msg []byte, off int) (off1 int, err error) {
 	return off, nil
 }
 
+func (rr *AMTRELAY) unpack(msg []byte, off int) (off1 int, err error) {
+	rdStart := off
+	_ = rdStart
+
+	rr.Precedence, off, err = unpackUint8(msg, off)
+	if err != nil {
+		return off, err
+	}
+	if off == len(msg) {
+		return off, nil
+	}
+	rr.GatewayType, off, err = unpackUint8(msg, off)
+	if err != nil {
+		return off, err
+	}
+	if off == len(msg) {
+		return off, nil
+	}
+	if off == len(msg) {
+		return off, nil
+	}
+	rr.GatewayAddr, rr.GatewayHost, off, err = unpackIPSECGateway(msg, off, rr.GatewayType)
+	if err != nil {
+		return off, err
+	}
+	return off, nil
+}
+
 func (rr *ANY) unpack(msg []byte, off int) (off1 int, err error) {
 	rdStart := off
 	_ = rdStart
@@ -1636,6 +1704,48 @@ func (rr *HTTPS) unpack(msg []byte, off int) (off1 int, err error) {
 	return off, nil
 }
 
+func (rr *IPSECKEY) unpack(msg []byte, off int) (off1 int, err error) {
+	rdStart := off
+	_ = rdStart
+
+	rr.Precedence, off, err = unpackUint8(msg, off)
+	if err != nil {
+		return off, err
+	}
+	if off == len(msg) {
+		return off, nil
+	}
+	rr.GatewayType, off, err = unpackUint8(msg, off)
+	if err != nil {
+		return off, err
+	}
+	if off == len(msg) {
+		return off, nil
+	}
+	rr.Algorithm, off, err = unpackUint8(msg, off)
+	if err != nil {
+		return off, err
+	}
+	if off == len(msg) {
+		return off, nil
+	}
+	if off == len(msg) {
+		return off, nil
+	}
+	rr.GatewayAddr, rr.GatewayHost, off, err = unpackIPSECGateway(msg, off, rr.GatewayType)
+	if err != nil {
+		return off, err
+	}
+	if off == len(msg) {
+		return off, nil
+	}
+	rr.PublicKey, off, err = unpackStringBase64(msg, off, rdStart+int(rr.Hdr.Rdlength))
+	if err != nil {
+		return off, err
+	}
+	return off, nil
+}
+
 func (rr *KEY) unpack(msg []byte, off int) (off1 int, err error) {
 	rdStart := off
 	_ = rdStart
diff --git a/vendor/github.com/miekg/dns/ztypes.go b/vendor/github.com/miekg/dns/ztypes.go
index 5d060cfee1..1b6f43200f 100644
--- a/vendor/github.com/miekg/dns/ztypes.go
+++ b/vendor/github.com/miekg/dns/ztypes.go
@@ -12,6 +12,7 @@ var TypeToRR = map[uint16]func() RR{
 	TypeA:          func() RR { return new(A) },
 	TypeAAAA:       func() RR { return new(AAAA) },
 	TypeAFSDB:      func() RR { return new(AFSDB) },
+	TypeAMTRELAY:   func() RR { return new(AMTRELAY) },
 	TypeANY:        func() RR { return new(ANY) },
 	TypeAPL:        func() RR { return new(APL) },
 	TypeAVC:        func() RR { return new(AVC) },
@@ -34,6 +35,7 @@ var TypeToRR = map[uint16]func() RR{
 	TypeHINFO:      func() RR { return new(HINFO) },
 	TypeHIP:        func() RR { return new(HIP) },
 	TypeHTTPS:      func() RR { return new(HTTPS) },
+	TypeIPSECKEY:   func() RR { return new(IPSECKEY) },
 	TypeKEY:        func() RR { return new(KEY) },
 	TypeKX:         func() RR { return new(KX) },
 	TypeL32:        func() RR { return new(L32) },
@@ -90,6 +92,7 @@ var TypeToString = map[uint16]string{
 	TypeA:          "A",
 	TypeAAAA:       "AAAA",
 	TypeAFSDB:      "AFSDB",
+	TypeAMTRELAY:   "AMTRELAY",
 	TypeANY:        "ANY",
 	TypeAPL:        "APL",
 	TypeATMA:       "ATMA",
@@ -114,6 +117,7 @@ var TypeToString = map[uint16]string{
 	TypeHINFO:      "HINFO",
 	TypeHIP:        "HIP",
 	TypeHTTPS:      "HTTPS",
+	TypeIPSECKEY:   "IPSECKEY",
 	TypeISDN:       "ISDN",
 	TypeIXFR:       "IXFR",
 	TypeKEY:        "KEY",
@@ -176,6 +180,7 @@ var TypeToString = map[uint16]string{
 func (rr *A) Header() *RR_Header          { return &rr.Hdr }
 func (rr *AAAA) Header() *RR_Header       { return &rr.Hdr }
 func (rr *AFSDB) Header() *RR_Header      { return &rr.Hdr }
+func (rr *AMTRELAY) Header() *RR_Header   { return &rr.Hdr }
 func (rr *ANY) Header() *RR_Header        { return &rr.Hdr }
 func (rr *APL) Header() *RR_Header        { return &rr.Hdr }
 func (rr *AVC) Header() *RR_Header        { return &rr.Hdr }
@@ -198,6 +203,7 @@ func (rr *GPOS) Header() *RR_Header       { return &rr.Hdr }
 func (rr *HINFO) Header() *RR_Header      { return &rr.Hdr }
 func (rr *HIP) Header() *RR_Header        { return &rr.Hdr }
 func (rr *HTTPS) Header() *RR_Header      { return &rr.Hdr }
+func (rr *IPSECKEY) Header() *RR_Header   { return &rr.Hdr }
 func (rr *KEY) Header() *RR_Header        { return &rr.Hdr }
 func (rr *KX) Header() *RR_Header         { return &rr.Hdr }
 func (rr *L32) Header() *RR_Header        { return &rr.Hdr }
@@ -257,6 +263,7 @@ func (rr *A) len(off int, compression map[string]struct{}) int {
 	}
 	return l
 }
+
 func (rr *AAAA) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	if len(rr.AAAA) != 0 {
@@ -264,16 +271,34 @@ func (rr *AAAA) len(off int, compression map[string]struct{}) int {
 	}
 	return l
 }
+
 func (rr *AFSDB) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += 2 // Subtype
 	l += domainNameLen(rr.Hostname, off+l, compression, false)
 	return l
 }
+
+func (rr *AMTRELAY) len(off int, compression map[string]struct{}) int {
+	l := rr.Hdr.len(off, compression)
+	l++ // Precedence
+	l++ // GatewayType
+	switch rr.GatewayType {
+	case AMTRELAYIPv4:
+		l += net.IPv4len
+	case AMTRELAYIPv6:
+		l += net.IPv6len
+	case AMTRELAYHost:
+		l += len(rr.GatewayHost) + 1
+	}
+	return l
+}
+
 func (rr *ANY) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	return l
 }
+
 func (rr *APL) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	for _, x := range rr.Prefixes {
@@ -281,6 +306,7 @@ func (rr *APL) len(off int, compression map[string]struct{}) int {
 	}
 	return l
 }
+
 func (rr *AVC) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	for _, x := range rr.Txt {
@@ -288,6 +314,7 @@ func (rr *AVC) len(off int, compression map[string]struct{}) int {
 	}
 	return l
 }
+
 func (rr *CAA) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l++ // Flag
@@ -295,6 +322,7 @@ func (rr *CAA) len(off int, compression map[string]struct{}) int {
 	l += len(rr.Value)
 	return l
 }
+
 func (rr *CERT) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += 2 // Type
@@ -303,21 +331,25 @@ func (rr *CERT) len(off int, compression map[string]struct{}) int {
 	l += base64.StdEncoding.DecodedLen(len(rr.Certificate))
 	return l
 }
+
 func (rr *CNAME) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += domainNameLen(rr.Target, off+l, compression, true)
 	return l
 }
+
 func (rr *DHCID) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += base64.StdEncoding.DecodedLen(len(rr.Digest))
 	return l
 }
+
 func (rr *DNAME) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += domainNameLen(rr.Target, off+l, compression, false)
 	return l
 }
+
 func (rr *DNSKEY) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += 2 // Flags
@@ -326,6 +358,7 @@ func (rr *DNSKEY) len(off int, compression map[string]struct{}) int {
 	l += base64.StdEncoding.DecodedLen(len(rr.PublicKey))
 	return l
 }
+
 func (rr *DS) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += 2 // KeyTag
@@ -334,26 +367,31 @@ func (rr *DS) len(off int, compression map[string]struct{}) int {
 	l += len(rr.Digest) / 2
 	return l
 }
+
 func (rr *EID) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += len(rr.Endpoint) / 2
 	return l
 }
+
 func (rr *EUI48) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += 6 // Address
 	return l
 }
+
 func (rr *EUI64) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += 8 // Address
 	return l
 }
+
 func (rr *GID) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += 4 // Gid
 	return l
 }
+
 func (rr *GPOS) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += len(rr.Longitude) + 1
@@ -361,12 +399,14 @@ func (rr *GPOS) len(off int, compression map[string]struct{}) int {
 	l += len(rr.Altitude) + 1
 	return l
 }
+
 func (rr *HINFO) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += len(rr.Cpu) + 1
 	l += len(rr.Os) + 1
 	return l
 }
+
 func (rr *HIP) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l++    // HitLength
@@ -379,12 +419,31 @@ func (rr *HIP) len(off int, compression map[string]struct{}) int {
 	}
 	return l
 }
+
+func (rr *IPSECKEY) len(off int, compression map[string]struct{}) int {
+	l := rr.Hdr.len(off, compression)
+	l++ // Precedence
+	l++ // GatewayType
+	l++ // Algorithm
+	switch rr.GatewayType {
+	case IPSECGatewayIPv4:
+		l += net.IPv4len
+	case IPSECGatewayIPv6:
+		l += net.IPv6len
+	case IPSECGatewayHost:
+		l += len(rr.GatewayHost) + 1
+	}
+	l += base64.StdEncoding.DecodedLen(len(rr.PublicKey))
+	return l
+}
+
 func (rr *KX) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += 2 // Preference
 	l += domainNameLen(rr.Exchanger, off+l, compression, false)
 	return l
 }
+
 func (rr *L32) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += 2 // Preference
@@ -393,12 +452,14 @@ func (rr *L32) len(off int, compression map[string]struct{}) int {
 	}
 	return l
 }
+
 func (rr *L64) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += 2 // Preference
 	l += 8 // Locator64
 	return l
 }
+
 func (rr *LOC) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l++    // Version
@@ -410,49 +471,58 @@ func (rr *LOC) len(off int, compression map[string]struct{}) int {
 	l += 4 // Altitude
 	return l
 }
+
 func (rr *LP) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += 2 // Preference
 	l += domainNameLen(rr.Fqdn, off+l, compression, false)
 	return l
 }
+
 func (rr *MB) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += domainNameLen(rr.Mb, off+l, compression, true)
 	return l
 }
+
 func (rr *MD) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += domainNameLen(rr.Md, off+l, compression, true)
 	return l
 }
+
 func (rr *MF) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += domainNameLen(rr.Mf, off+l, compression, true)
 	return l
 }
+
 func (rr *MG) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += domainNameLen(rr.Mg, off+l, compression, true)
 	return l
 }
+
 func (rr *MINFO) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += domainNameLen(rr.Rmail, off+l, compression, true)
 	l += domainNameLen(rr.Email, off+l, compression, true)
 	return l
 }
+
 func (rr *MR) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += domainNameLen(rr.Mr, off+l, compression, true)
 	return l
 }
+
 func (rr *MX) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += 2 // Preference
 	l += domainNameLen(rr.Mx, off+l, compression, true)
 	return l
 }
+
 func (rr *NAPTR) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += 2 // Order
@@ -463,17 +533,20 @@ func (rr *NAPTR) len(off int, compression map[string]struct{}) int {
 	l += domainNameLen(rr.Replacement, off+l, compression, false)
 	return l
 }
+
 func (rr *NID) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += 2 // Preference
 	l += 8 // NodeID
 	return l
 }
+
 func (rr *NIMLOC) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += len(rr.Locator) / 2
 	return l
 }
+
 func (rr *NINFO) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	for _, x := range rr.ZSData {
@@ -481,16 +554,19 @@ func (rr *NINFO) len(off int, compression map[string]struct{}) int {
 	}
 	return l
 }
+
 func (rr *NS) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += domainNameLen(rr.Ns, off+l, compression, true)
 	return l
 }
+
 func (rr *NSAPPTR) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += domainNameLen(rr.Ptr, off+l, compression, false)
 	return l
 }
+
 func (rr *NSEC3PARAM) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l++    // Hash
@@ -500,21 +576,25 @@ func (rr *NSEC3PARAM) len(off int, compression map[string]struct{}) int {
 	l += len(rr.Salt) / 2
 	return l
 }
+
 func (rr *NULL) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += len(rr.Data)
 	return l
 }
+
 func (rr *OPENPGPKEY) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += base64.StdEncoding.DecodedLen(len(rr.PublicKey))
 	return l
 }
+
 func (rr *PTR) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += domainNameLen(rr.Ptr, off+l, compression, true)
 	return l
 }
+
 func (rr *PX) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += 2 // Preference
@@ -522,11 +602,13 @@ func (rr *PX) len(off int, compression map[string]struct{}) int {
 	l += domainNameLen(rr.Mapx400, off+l, compression, false)
 	return l
 }
+
 func (rr *RFC3597) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += len(rr.Rdata) / 2
 	return l
 }
+
 func (rr *RKEY) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += 2 // Flags
@@ -535,12 +617,14 @@ func (rr *RKEY) len(off int, compression map[string]struct{}) int {
 	l += base64.StdEncoding.DecodedLen(len(rr.PublicKey))
 	return l
 }
+
 func (rr *RP) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += domainNameLen(rr.Mbox, off+l, compression, false)
 	l += domainNameLen(rr.Txt, off+l, compression, false)
 	return l
 }
+
 func (rr *RRSIG) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += 2 // TypeCovered
@@ -554,12 +638,14 @@ func (rr *RRSIG) len(off int, compression map[string]struct{}) int {
 	l += base64.StdEncoding.DecodedLen(len(rr.Signature))
 	return l
 }
+
 func (rr *RT) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += 2 // Preference
 	l += domainNameLen(rr.Host, off+l, compression, false)
 	return l
 }
+
 func (rr *SMIMEA) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l++ // Usage
@@ -568,6 +654,7 @@ func (rr *SMIMEA) len(off int, compression map[string]struct{}) int {
 	l += len(rr.Certificate) / 2
 	return l
 }
+
 func (rr *SOA) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += domainNameLen(rr.Ns, off+l, compression, true)
@@ -579,6 +666,7 @@ func (rr *SOA) len(off int, compression map[string]struct{}) int {
 	l += 4 // Minttl
 	return l
 }
+
 func (rr *SPF) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	for _, x := range rr.Txt {
@@ -586,6 +674,7 @@ func (rr *SPF) len(off int, compression map[string]struct{}) int {
 	}
 	return l
 }
+
 func (rr *SRV) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += 2 // Priority
@@ -594,6 +683,7 @@ func (rr *SRV) len(off int, compression map[string]struct{}) int {
 	l += domainNameLen(rr.Target, off+l, compression, false)
 	return l
 }
+
 func (rr *SSHFP) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l++ // Algorithm
@@ -601,6 +691,7 @@ func (rr *SSHFP) len(off int, compression map[string]struct{}) int {
 	l += len(rr.FingerPrint) / 2
 	return l
 }
+
 func (rr *SVCB) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += 2 // Priority
@@ -610,6 +701,7 @@ func (rr *SVCB) len(off int, compression map[string]struct{}) int {
 	}
 	return l
 }
+
 func (rr *TA) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += 2 // KeyTag
@@ -618,12 +710,14 @@ func (rr *TA) len(off int, compression map[string]struct{}) int {
 	l += len(rr.Digest) / 2
 	return l
 }
+
 func (rr *TALINK) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += domainNameLen(rr.PreviousName, off+l, compression, false)
 	l += domainNameLen(rr.NextName, off+l, compression, false)
 	return l
 }
+
 func (rr *TKEY) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += domainNameLen(rr.Algorithm, off+l, compression, false)
@@ -637,6 +731,7 @@ func (rr *TKEY) len(off int, compression map[string]struct{}) int {
 	l += len(rr.OtherData) / 2
 	return l
 }
+
 func (rr *TLSA) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l++ // Usage
@@ -645,6 +740,7 @@ func (rr *TLSA) len(off int, compression map[string]struct{}) int {
 	l += len(rr.Certificate) / 2
 	return l
 }
+
 func (rr *TSIG) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += domainNameLen(rr.Algorithm, off+l, compression, false)
@@ -658,6 +754,7 @@ func (rr *TSIG) len(off int, compression map[string]struct{}) int {
 	l += len(rr.OtherData) / 2
 	return l
 }
+
 func (rr *TXT) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	for _, x := range rr.Txt {
@@ -665,16 +762,19 @@ func (rr *TXT) len(off int, compression map[string]struct{}) int {
 	}
 	return l
 }
+
 func (rr *UID) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += 4 // Uid
 	return l
 }
+
 func (rr *UINFO) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += len(rr.Uinfo) + 1
 	return l
 }
+
 func (rr *URI) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += 2 // Priority
@@ -682,11 +782,13 @@ func (rr *URI) len(off int, compression map[string]struct{}) int {
 	l += len(rr.Target)
 	return l
 }
+
 func (rr *X25) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += len(rr.PSDNAddress) + 1
 	return l
 }
+
 func (rr *ZONEMD) len(off int, compression map[string]struct{}) int {
 	l := rr.Hdr.len(off, compression)
 	l += 4 // Serial
@@ -698,17 +800,31 @@ func (rr *ZONEMD) len(off int, compression map[string]struct{}) int {
 
 // copy() functions
 func (rr *A) copy() RR {
-	return &A{rr.Hdr, copyIP(rr.A)}
+	return &A{rr.Hdr, cloneSlice(rr.A)}
 }
+
 func (rr *AAAA) copy() RR {
-	return &AAAA{rr.Hdr, copyIP(rr.AAAA)}
+	return &AAAA{rr.Hdr, cloneSlice(rr.AAAA)}
 }
+
 func (rr *AFSDB) copy() RR {
 	return &AFSDB{rr.Hdr, rr.Subtype, rr.Hostname}
 }
+
+func (rr *AMTRELAY) copy() RR {
+	return &AMTRELAY{
+		rr.Hdr,
+		rr.Precedence,
+		rr.GatewayType,
+		cloneSlice(rr.GatewayAddr),
+		rr.GatewayHost,
+	}
+}
+
 func (rr *ANY) copy() RR {
 	return &ANY{rr.Hdr}
 }
+
 func (rr *APL) copy() RR {
 	Prefixes := make([]APLPrefix, len(rr.Prefixes))
 	for i, e := range rr.Prefixes {
@@ -716,150 +832,270 @@ func (rr *APL) copy() RR {
 	}
 	return &APL{rr.Hdr, Prefixes}
 }
+
 func (rr *AVC) copy() RR {
-	Txt := make([]string, len(rr.Txt))
-	copy(Txt, rr.Txt)
-	return &AVC{rr.Hdr, Txt}
+	return &AVC{rr.Hdr, cloneSlice(rr.Txt)}
 }
+
 func (rr *CAA) copy() RR {
-	return &CAA{rr.Hdr, rr.Flag, rr.Tag, rr.Value}
+	return &CAA{
+		rr.Hdr,
+		rr.Flag,
+		rr.Tag,
+		rr.Value,
+	}
 }
+
 func (rr *CDNSKEY) copy() RR {
 	return &CDNSKEY{*rr.DNSKEY.copy().(*DNSKEY)}
 }
+
 func (rr *CDS) copy() RR {
 	return &CDS{*rr.DS.copy().(*DS)}
 }
+
 func (rr *CERT) copy() RR {
-	return &CERT{rr.Hdr, rr.Type, rr.KeyTag, rr.Algorithm, rr.Certificate}
+	return &CERT{
+		rr.Hdr,
+		rr.Type,
+		rr.KeyTag,
+		rr.Algorithm,
+		rr.Certificate,
+	}
 }
+
 func (rr *CNAME) copy() RR {
 	return &CNAME{rr.Hdr, rr.Target}
 }
+
 func (rr *CSYNC) copy() RR {
-	TypeBitMap := make([]uint16, len(rr.TypeBitMap))
-	copy(TypeBitMap, rr.TypeBitMap)
-	return &CSYNC{rr.Hdr, rr.Serial, rr.Flags, TypeBitMap}
+	return &CSYNC{
+		rr.Hdr,
+		rr.Serial,
+		rr.Flags,
+		cloneSlice(rr.TypeBitMap),
+	}
 }
+
 func (rr *DHCID) copy() RR {
 	return &DHCID{rr.Hdr, rr.Digest}
 }
+
 func (rr *DLV) copy() RR {
 	return &DLV{*rr.DS.copy().(*DS)}
 }
+
 func (rr *DNAME) copy() RR {
 	return &DNAME{rr.Hdr, rr.Target}
 }
+
 func (rr *DNSKEY) copy() RR {
-	return &DNSKEY{rr.Hdr, rr.Flags, rr.Protocol, rr.Algorithm, rr.PublicKey}
+	return &DNSKEY{
+		rr.Hdr,
+		rr.Flags,
+		rr.Protocol,
+		rr.Algorithm,
+		rr.PublicKey,
+	}
 }
+
 func (rr *DS) copy() RR {
-	return &DS{rr.Hdr, rr.KeyTag, rr.Algorithm, rr.DigestType, rr.Digest}
+	return &DS{
+		rr.Hdr,
+		rr.KeyTag,
+		rr.Algorithm,
+		rr.DigestType,
+		rr.Digest,
+	}
 }
+
 func (rr *EID) copy() RR {
 	return &EID{rr.Hdr, rr.Endpoint}
 }
+
 func (rr *EUI48) copy() RR {
 	return &EUI48{rr.Hdr, rr.Address}
 }
+
 func (rr *EUI64) copy() RR {
 	return &EUI64{rr.Hdr, rr.Address}
 }
+
 func (rr *GID) copy() RR {
 	return &GID{rr.Hdr, rr.Gid}
 }
+
 func (rr *GPOS) copy() RR {
-	return &GPOS{rr.Hdr, rr.Longitude, rr.Latitude, rr.Altitude}
+	return &GPOS{
+		rr.Hdr,
+		rr.Longitude,
+		rr.Latitude,
+		rr.Altitude,
+	}
 }
+
 func (rr *HINFO) copy() RR {
 	return &HINFO{rr.Hdr, rr.Cpu, rr.Os}
 }
+
 func (rr *HIP) copy() RR {
-	RendezvousServers := make([]string, len(rr.RendezvousServers))
-	copy(RendezvousServers, rr.RendezvousServers)
-	return &HIP{rr.Hdr, rr.HitLength, rr.PublicKeyAlgorithm, rr.PublicKeyLength, rr.Hit, rr.PublicKey, RendezvousServers}
+	return &HIP{
+		rr.Hdr,
+		rr.HitLength,
+		rr.PublicKeyAlgorithm,
+		rr.PublicKeyLength,
+		rr.Hit,
+		rr.PublicKey,
+		cloneSlice(rr.RendezvousServers),
+	}
 }
+
 func (rr *HTTPS) copy() RR {
 	return &HTTPS{*rr.SVCB.copy().(*SVCB)}
 }
+
+func (rr *IPSECKEY) copy() RR {
+	return &IPSECKEY{
+		rr.Hdr,
+		rr.Precedence,
+		rr.GatewayType,
+		rr.Algorithm,
+		cloneSlice(rr.GatewayAddr),
+		rr.GatewayHost,
+		rr.PublicKey,
+	}
+}
+
 func (rr *KEY) copy() RR {
 	return &KEY{*rr.DNSKEY.copy().(*DNSKEY)}
 }
+
 func (rr *KX) copy() RR {
 	return &KX{rr.Hdr, rr.Preference, rr.Exchanger}
 }
+
 func (rr *L32) copy() RR {
-	return &L32{rr.Hdr, rr.Preference, copyIP(rr.Locator32)}
+	return &L32{rr.Hdr, rr.Preference, cloneSlice(rr.Locator32)}
 }
+
 func (rr *L64) copy() RR {
 	return &L64{rr.Hdr, rr.Preference, rr.Locator64}
 }
+
 func (rr *LOC) copy() RR {
-	return &LOC{rr.Hdr, rr.Version, rr.Size, rr.HorizPre, rr.VertPre, rr.Latitude, rr.Longitude, rr.Altitude}
+	return &LOC{
+		rr.Hdr,
+		rr.Version,
+		rr.Size,
+		rr.HorizPre,
+		rr.VertPre,
+		rr.Latitude,
+		rr.Longitude,
+		rr.Altitude,
+	}
 }
+
 func (rr *LP) copy() RR {
 	return &LP{rr.Hdr, rr.Preference, rr.Fqdn}
 }
+
 func (rr *MB) copy() RR {
 	return &MB{rr.Hdr, rr.Mb}
 }
+
 func (rr *MD) copy() RR {
 	return &MD{rr.Hdr, rr.Md}
 }
+
 func (rr *MF) copy() RR {
 	return &MF{rr.Hdr, rr.Mf}
 }
+
 func (rr *MG) copy() RR {
 	return &MG{rr.Hdr, rr.Mg}
 }
+
 func (rr *MINFO) copy() RR {
 	return &MINFO{rr.Hdr, rr.Rmail, rr.Email}
 }
+
 func (rr *MR) copy() RR {
 	return &MR{rr.Hdr, rr.Mr}
 }
+
 func (rr *MX) copy() RR {
 	return &MX{rr.Hdr, rr.Preference, rr.Mx}
 }
+
 func (rr *NAPTR) copy() RR {
-	return &NAPTR{rr.Hdr, rr.Order, rr.Preference, rr.Flags, rr.Service, rr.Regexp, rr.Replacement}
+	return &NAPTR{
+		rr.Hdr,
+		rr.Order,
+		rr.Preference,
+		rr.Flags,
+		rr.Service,
+		rr.Regexp,
+		rr.Replacement,
+	}
 }
+
 func (rr *NID) copy() RR {
 	return &NID{rr.Hdr, rr.Preference, rr.NodeID}
 }
+
 func (rr *NIMLOC) copy() RR {
 	return &NIMLOC{rr.Hdr, rr.Locator}
 }
+
 func (rr *NINFO) copy() RR {
-	ZSData := make([]string, len(rr.ZSData))
-	copy(ZSData, rr.ZSData)
-	return &NINFO{rr.Hdr, ZSData}
+	return &NINFO{rr.Hdr, cloneSlice(rr.ZSData)}
 }
+
 func (rr *NS) copy() RR {
 	return &NS{rr.Hdr, rr.Ns}
 }
+
 func (rr *NSAPPTR) copy() RR {
 	return &NSAPPTR{rr.Hdr, rr.Ptr}
 }
+
 func (rr *NSEC) copy() RR {
-	TypeBitMap := make([]uint16, len(rr.TypeBitMap))
-	copy(TypeBitMap, rr.TypeBitMap)
-	return &NSEC{rr.Hdr, rr.NextDomain, TypeBitMap}
+	return &NSEC{rr.Hdr, rr.NextDomain, cloneSlice(rr.TypeBitMap)}
 }
+
 func (rr *NSEC3) copy() RR {
-	TypeBitMap := make([]uint16, len(rr.TypeBitMap))
-	copy(TypeBitMap, rr.TypeBitMap)
-	return &NSEC3{rr.Hdr, rr.Hash, rr.Flags, rr.Iterations, rr.SaltLength, rr.Salt, rr.HashLength, rr.NextDomain, TypeBitMap}
+	return &NSEC3{
+		rr.Hdr,
+		rr.Hash,
+		rr.Flags,
+		rr.Iterations,
+		rr.SaltLength,
+		rr.Salt,
+		rr.HashLength,
+		rr.NextDomain,
+		cloneSlice(rr.TypeBitMap),
+	}
 }
+
 func (rr *NSEC3PARAM) copy() RR {
-	return &NSEC3PARAM{rr.Hdr, rr.Hash, rr.Flags, rr.Iterations, rr.SaltLength, rr.Salt}
+	return &NSEC3PARAM{
+		rr.Hdr,
+		rr.Hash,
+		rr.Flags,
+		rr.Iterations,
+		rr.SaltLength,
+		rr.Salt,
+	}
 }
+
 func (rr *NULL) copy() RR {
 	return &NULL{rr.Hdr, rr.Data}
 }
+
 func (rr *OPENPGPKEY) copy() RR {
 	return &OPENPGPKEY{rr.Hdr, rr.PublicKey}
 }
+
 func (rr *OPT) copy() RR {
 	Option := make([]EDNS0, len(rr.Option))
 	for i, e := range rr.Option {
@@ -867,86 +1103,205 @@ func (rr *OPT) copy() RR {
 	}
 	return &OPT{rr.Hdr, Option}
 }
+
 func (rr *PTR) copy() RR {
 	return &PTR{rr.Hdr, rr.Ptr}
 }
+
 func (rr *PX) copy() RR {
-	return &PX{rr.Hdr, rr.Preference, rr.Map822, rr.Mapx400}
+	return &PX{
+		rr.Hdr,
+		rr.Preference,
+		rr.Map822,
+		rr.Mapx400,
+	}
 }
+
 func (rr *RFC3597) copy() RR {
 	return &RFC3597{rr.Hdr, rr.Rdata}
 }
+
 func (rr *RKEY) copy() RR {
-	return &RKEY{rr.Hdr, rr.Flags, rr.Protocol, rr.Algorithm, rr.PublicKey}
+	return &RKEY{
+		rr.Hdr,
+		rr.Flags,
+		rr.Protocol,
+		rr.Algorithm,
+		rr.PublicKey,
+	}
 }
+
 func (rr *RP) copy() RR {
 	return &RP{rr.Hdr, rr.Mbox, rr.Txt}
 }
+
 func (rr *RRSIG) copy() RR {
-	return &RRSIG{rr.Hdr, rr.TypeCovered, rr.Algorithm, rr.Labels, rr.OrigTtl, rr.Expiration, rr.Inception, rr.KeyTag, rr.SignerName, rr.Signature}
+	return &RRSIG{
+		rr.Hdr,
+		rr.TypeCovered,
+		rr.Algorithm,
+		rr.Labels,
+		rr.OrigTtl,
+		rr.Expiration,
+		rr.Inception,
+		rr.KeyTag,
+		rr.SignerName,
+		rr.Signature,
+	}
 }
+
 func (rr *RT) copy() RR {
 	return &RT{rr.Hdr, rr.Preference, rr.Host}
 }
+
 func (rr *SIG) copy() RR {
 	return &SIG{*rr.RRSIG.copy().(*RRSIG)}
 }
+
 func (rr *SMIMEA) copy() RR {
-	return &SMIMEA{rr.Hdr, rr.Usage, rr.Selector, rr.MatchingType, rr.Certificate}
+	return &SMIMEA{
+		rr.Hdr,
+		rr.Usage,
+		rr.Selector,
+		rr.MatchingType,
+		rr.Certificate,
+	}
 }
+
 func (rr *SOA) copy() RR {
-	return &SOA{rr.Hdr, rr.Ns, rr.Mbox, rr.Serial, rr.Refresh, rr.Retry, rr.Expire, rr.Minttl}
+	return &SOA{
+		rr.Hdr,
+		rr.Ns,
+		rr.Mbox,
+		rr.Serial,
+		rr.Refresh,
+		rr.Retry,
+		rr.Expire,
+		rr.Minttl,
+	}
 }
+
 func (rr *SPF) copy() RR {
-	Txt := make([]string, len(rr.Txt))
-	copy(Txt, rr.Txt)
-	return &SPF{rr.Hdr, Txt}
+	return &SPF{rr.Hdr, cloneSlice(rr.Txt)}
 }
+
 func (rr *SRV) copy() RR {
-	return &SRV{rr.Hdr, rr.Priority, rr.Weight, rr.Port, rr.Target}
+	return &SRV{
+		rr.Hdr,
+		rr.Priority,
+		rr.Weight,
+		rr.Port,
+		rr.Target,
+	}
 }
+
 func (rr *SSHFP) copy() RR {
-	return &SSHFP{rr.Hdr, rr.Algorithm, rr.Type, rr.FingerPrint}
+	return &SSHFP{
+		rr.Hdr,
+		rr.Algorithm,
+		rr.Type,
+		rr.FingerPrint,
+	}
 }
+
 func (rr *SVCB) copy() RR {
 	Value := make([]SVCBKeyValue, len(rr.Value))
 	for i, e := range rr.Value {
 		Value[i] = e.copy()
 	}
-	return &SVCB{rr.Hdr, rr.Priority, rr.Target, Value}
+	return &SVCB{
+		rr.Hdr,
+		rr.Priority,
+		rr.Target,
+		Value,
+	}
 }
+
 func (rr *TA) copy() RR {
-	return &TA{rr.Hdr, rr.KeyTag, rr.Algorithm, rr.DigestType, rr.Digest}
+	return &TA{
+		rr.Hdr,
+		rr.KeyTag,
+		rr.Algorithm,
+		rr.DigestType,
+		rr.Digest,
+	}
 }
+
 func (rr *TALINK) copy() RR {
 	return &TALINK{rr.Hdr, rr.PreviousName, rr.NextName}
 }
+
 func (rr *TKEY) copy() RR {
-	return &TKEY{rr.Hdr, rr.Algorithm, rr.Inception, rr.Expiration, rr.Mode, rr.Error, rr.KeySize, rr.Key, rr.OtherLen, rr.OtherData}
+	return &TKEY{
+		rr.Hdr,
+		rr.Algorithm,
+		rr.Inception,
+		rr.Expiration,
+		rr.Mode,
+		rr.Error,
+		rr.KeySize,
+		rr.Key,
+		rr.OtherLen,
+		rr.OtherData,
+	}
 }
+
 func (rr *TLSA) copy() RR {
-	return &TLSA{rr.Hdr, rr.Usage, rr.Selector, rr.MatchingType, rr.Certificate}
+	return &TLSA{
+		rr.Hdr,
+		rr.Usage,
+		rr.Selector,
+		rr.MatchingType,
+		rr.Certificate,
+	}
 }
+
 func (rr *TSIG) copy() RR {
-	return &TSIG{rr.Hdr, rr.Algorithm, rr.TimeSigned, rr.Fudge, rr.MACSize, rr.MAC, rr.OrigId, rr.Error, rr.OtherLen, rr.OtherData}
+	return &TSIG{
+		rr.Hdr,
+		rr.Algorithm,
+		rr.TimeSigned,
+		rr.Fudge,
+		rr.MACSize,
+		rr.MAC,
+		rr.OrigId,
+		rr.Error,
+		rr.OtherLen,
+		rr.OtherData,
+	}
 }
+
 func (rr *TXT) copy() RR {
-	Txt := make([]string, len(rr.Txt))
-	copy(Txt, rr.Txt)
-	return &TXT{rr.Hdr, Txt}
+	return &TXT{rr.Hdr, cloneSlice(rr.Txt)}
 }
+
 func (rr *UID) copy() RR {
 	return &UID{rr.Hdr, rr.Uid}
 }
+
 func (rr *UINFO) copy() RR {
 	return &UINFO{rr.Hdr, rr.Uinfo}
 }
+
 func (rr *URI) copy() RR {
-	return &URI{rr.Hdr, rr.Priority, rr.Weight, rr.Target}
+	return &URI{
+		rr.Hdr,
+		rr.Priority,
+		rr.Weight,
+		rr.Target,
+	}
 }
+
 func (rr *X25) copy() RR {
 	return &X25{rr.Hdr, rr.PSDNAddress}
 }
+
 func (rr *ZONEMD) copy() RR {
-	return &ZONEMD{rr.Hdr, rr.Serial, rr.Scheme, rr.Hash, rr.Digest}
+	return &ZONEMD{
+		rr.Hdr,
+		rr.Serial,
+		rr.Scheme,
+		rr.Hash,
+		rr.Digest,
+	}
 }
diff --git a/vendor/github.com/onsi/ginkgo/v2/.gitignore b/vendor/github.com/onsi/ginkgo/v2/.gitignore
index edf0231cdf..18793c248a 100644
--- a/vendor/github.com/onsi/ginkgo/v2/.gitignore
+++ b/vendor/github.com/onsi/ginkgo/v2/.gitignore
@@ -1,5 +1,5 @@
 .DS_Store
-TODO.md
+TODO
 tmp/**/*
 *.coverprofile
 .vscode
diff --git a/vendor/github.com/onsi/ginkgo/v2/CHANGELOG.md b/vendor/github.com/onsi/ginkgo/v2/CHANGELOG.md
index a77e95e254..f4671ec1c7 100644
--- a/vendor/github.com/onsi/ginkgo/v2/CHANGELOG.md
+++ b/vendor/github.com/onsi/ginkgo/v2/CHANGELOG.md
@@ -1,3 +1,95 @@
+## 2.9.7
+
+### Fixes
+- fix race when multiple defercleanups are called in goroutines [07fc3a0]
+
+## 2.9.6
+
+### Fixes
+- fix: create parent directory before report files (#1212) [0ac65de]
+
+### Maintenance
+- Bump github.com/onsi/gomega from 1.27.6 to 1.27.7 (#1202) [3e39231]
+
+## 2.9.5
+
+### Fixes
+- ensure the correct deterministic sort order is produced when ordered specs are generated by a helper function [7fa0b6b]
+
+### Maintenance
+- fix generators link (#1200) [9f9d8b9]
+- Bump golang.org/x/tools from 0.8.0 to 0.9.1 (#1196) [150e3f2]
+- fix spelling err in docs (#1199) [0013b1a]
+- Bump golang.org/x/sys from 0.7.0 to 0.8.0 (#1193) [9e9e3e5]
+
+## 2.9.4
+
+### Fixes
+- fix hang with ginkgo -p (#1192) [15d4bdc] - this addresses a _long_ standing issue related to Ginkgo hanging when a child process spawned by the test does not exit.
+
+- fix: fail fast may cause Serial spec or cleanup Node interrupted (#1178) [8dea88b] - prior to this there was a small gap in which specs on other processes might start even if one process has tried to abort the suite.
+
+
+### Maintenance
+- Document run order when multiple setup nodes are at the same nesting level [903be81]
+
+## 2.9.3
+
+### Features
+- Add RenderTimeline to GinkgoT() [c0c77b6]
+
+### Fixes
+- update Measure deprecation message. fixes #1176 [227c662]
+- add newlines to GinkgoLogr (#1170) (#1171) [0de0e7c]
+
+### Maintenance
+- Bump commonmarker from 0.23.8 to 0.23.9 in /docs (#1183) [8b925ab]
+- Bump nokogiri from 1.14.1 to 1.14.3 in /docs (#1184) [e3795a4]
+- Bump golang.org/x/tools from 0.7.0 to 0.8.0 (#1182) [b453793]
+- Bump actions/setup-go from 3 to 4 (#1164) [73ed75b]
+- Bump github.com/onsi/gomega from 1.27.4 to 1.27.6 (#1173) [0a2bc64]
+- Bump github.com/go-logr/logr from 1.2.3 to 1.2.4 (#1174) [f41c557]
+- Bump golang.org/x/sys from 0.6.0 to 0.7.0 (#1179) [8e423e5]
+
+## 2.9.2
+
+### Maintenance
+- Bump github.com/go-task/slim-sprig (#1167) [3fcc5bf]
+- Bump github.com/onsi/gomega from 1.27.3 to 1.27.4 (#1163) [6143ffe]
+
+## 2.9.1
+
+### Fixes
+This release fixes a longstanding issue where `ginkgo -coverpkg=./...` would not work.  This is now resolved and fixes [#1161](https://github.com/onsi/ginkgo/issues/1161) and [#995](https://github.com/onsi/ginkgo/issues/995)
+- Support -coverpkg=./... [26ca1b5]
+- document coverpkg a bit more clearly [fc44c3b]
+
+### Maintenance
+- bump various dependencies
+- Improve Documentation and fix typo (#1158) [93de676]
+
+## 2.9.0
+
+### Features
+- AttachProgressReporter is an experimental feature that allows users to provide arbitrary information when a ProgressReport is requested [28801fe]
+
+- GinkgoT() has been expanded to include several Ginkgo-specific methods [2bd5a3b]
+
+  The intent is to enable the development of third-party libraries that integrate deeply with Ginkgo using `GinkgoT()` to access Ginkgo's functionality.
+
+## 2.8.4
+
+### Features
+- Add OmitSuiteSetupNodes to JunitReportConfig (#1147) [979fbc2]
+- Add a reference to ginkgolinter in docs.index.md (#1143) [8432589]
+
+### Fixes
+- rename tools hack to see if it fixes things for downstream users [a8bb39a]
+
+### Maintenance
+- Bump golang.org/x/text (#1144) [41b2a8a]
+- Bump github.com/onsi/gomega from 1.27.0 to 1.27.1 (#1142) [7c4f583]
+
 ## 2.8.3
 
 Released to fix security issue in golang.org/x/net dependency
diff --git a/vendor/github.com/onsi/ginkgo/v2/core_dsl.go b/vendor/github.com/onsi/ginkgo/v2/core_dsl.go
index 0b13b0d22c..a244bdc180 100644
--- a/vendor/github.com/onsi/ginkgo/v2/core_dsl.go
+++ b/vendor/github.com/onsi/ginkgo/v2/core_dsl.go
@@ -540,7 +540,7 @@ and will simply log the passed in text to the GinkgoWriter.  If By is handed a f
 
 By will also generate and attach a ReportEntry to the spec.  This will ensure that By annotations appear in Ginkgo's machine-readable reports.
 
-Note that By does not generate a new Ginkgo node - rather it is simply synctactic sugar around GinkgoWriter and AddReportEntry
+Note that By does not generate a new Ginkgo node - rather it is simply syntactic sugar around GinkgoWriter and AddReportEntry
 You can learn more about By here: https://onsi.github.io/ginkgo/#documenting-complex-specs-by
 */
 func By(text string, callback ...func()) {
@@ -771,3 +771,24 @@ func DeferCleanup(args ...interface{}) {
 	}
 	pushNode(internal.NewCleanupNode(deprecationTracker, fail, args...))
 }
+
+/*
+AttachProgressReporter allows you to register a function that will be called whenever Ginkgo generates a Progress Report.  The contents returned by the function will be included in the report.
+
+**This is an experimental feature and the public-facing interface may change in a future minor version of Ginkgo**
+
+Progress Reports are generated:
+- whenever the user explicitly requests one (via `SIGINFO` or `SIGUSR1`)
+- on nodes decorated  with PollProgressAfter
+- on suites run with --poll-progress-after
+- whenever a test times out
+
+Ginkgo uses Progress Reports to convey the current state of the test suite, including any running goroutines.  By attaching a progress reporter you are able to supplement these reports with additional information.
+
+# AttachProgressReporter returns a function that can be called to detach the progress reporter
+
+You can learn more about AttachProgressReporter here: https://onsi.github.io/ginkgo/#attaching-additional-information-to-progress-reports
+*/
+func AttachProgressReporter(reporter func() string) func() {
+	return global.Suite.AttachProgressReporter(reporter)
+}
diff --git a/vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/compile.go b/vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/compile.go
index 496ec4a28a..86da7340d1 100644
--- a/vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/compile.go
+++ b/vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/compile.go
@@ -25,7 +25,16 @@ func CompileSuite(suite TestSuite, goFlagsConfig types.GoFlagsConfig) TestSuite
 		return suite
 	}
 
-	args, err := types.GenerateGoTestCompileArgs(goFlagsConfig, path, "./")
+	ginkgoInvocationPath, _ := os.Getwd()
+	ginkgoInvocationPath, _ = filepath.Abs(ginkgoInvocationPath)
+	packagePath := suite.AbsPath()
+	pathToInvocationPath, err := filepath.Rel(packagePath, ginkgoInvocationPath)
+	if err != nil {
+		suite.State = TestSuiteStateFailedToCompile
+		suite.CompilationError = fmt.Errorf("Failed to get relative path from package to the current working directory:\n%s", err.Error())
+		return suite
+	}
+	args, err := types.GenerateGoTestCompileArgs(goFlagsConfig, path, "./", pathToInvocationPath)
 	if err != nil {
 		suite.State = TestSuiteStateFailedToCompile
 		suite.CompilationError = fmt.Errorf("Failed to generate go test compile flags:\n%s", err.Error())
diff --git a/vendor/github.com/onsi/ginkgo/v2/tools.go b/vendor/github.com/onsi/ginkgo/v2/ginkgo_cli_dependencies.go
similarity index 50%
rename from vendor/github.com/onsi/ginkgo/v2/tools.go
rename to vendor/github.com/onsi/ginkgo/v2/ginkgo_cli_dependencies.go
index 974294467a..85162720f9 100644
--- a/vendor/github.com/onsi/ginkgo/v2/tools.go
+++ b/vendor/github.com/onsi/ginkgo/v2/ginkgo_cli_dependencies.go
@@ -1,5 +1,5 @@
-//go:build tools
-// +build tools
+//go:build ginkgoclidependencies
+// +build ginkgoclidependencies
 
 package ginkgo
 
diff --git a/vendor/github.com/onsi/ginkgo/v2/ginkgo_t_dsl.go b/vendor/github.com/onsi/ginkgo/v2/ginkgo_t_dsl.go
index c5a7eb94d4..28447ffdd2 100644
--- a/vendor/github.com/onsi/ginkgo/v2/ginkgo_t_dsl.go
+++ b/vendor/github.com/onsi/ginkgo/v2/ginkgo_t_dsl.go
@@ -1,26 +1,42 @@
 package ginkgo
 
-import "github.com/onsi/ginkgo/v2/internal/testingtproxy"
+import (
+	"github.com/onsi/ginkgo/v2/internal/testingtproxy"
+)
 
 /*
-GinkgoT() implements an interface analogous to *testing.T and can be used with
-third-party libraries that accept *testing.T through an interface.
+GinkgoT() implements an interface that allows third party libraries to integrate with and build on top of Ginkgo.
+
+GinkgoT() is analogous to *testing.T and implements the majority of *testing.T's methods.  It can be typically be used a a drop-in replacement with third-party libraries that accept *testing.T through an interface.
 
 GinkgoT() takes an optional offset argument that can be used to get the
 correct line number associated with the failure - though you do not need to use this if you call GinkgoHelper() or GinkgoT().Helper() appropriately
 
 You can learn more here: https://onsi.github.io/ginkgo/#using-third-party-libraries
 */
-func GinkgoT(optionalOffset ...int) GinkgoTInterface {
+func GinkgoT(optionalOffset ...int) FullGinkgoTInterface {
 	offset := 3
 	if len(optionalOffset) > 0 {
 		offset = optionalOffset[0]
 	}
-	return testingtproxy.New(GinkgoWriter, Fail, Skip, DeferCleanup, CurrentSpecReport, offset)
+	return testingtproxy.New(
+		GinkgoWriter,
+		Fail,
+		Skip,
+		DeferCleanup,
+		CurrentSpecReport,
+		AddReportEntry,
+		GinkgoRecover,
+		AttachProgressReporter,
+		suiteConfig.RandomSeed,
+		suiteConfig.ParallelProcess,
+		suiteConfig.ParallelTotal,
+		reporterConfig.NoColor,
+		offset)
 }
 
 /*
-The interface returned by GinkgoT().  This covers most of the methods in the testing package's T.
+The portion of the interface returned by GinkgoT() that maps onto methods in the testing package's T.
 */
 type GinkgoTInterface interface {
 	Cleanup(func())
@@ -43,3 +59,36 @@ type GinkgoTInterface interface {
 	Skipped() bool
 	TempDir() string
 }
+
+/*
+Additional methods returned by GinkgoT() that provide deeper integration points into Ginkgo
+*/
+type FullGinkgoTInterface interface {
+	GinkgoTInterface
+
+	AddReportEntryVisibilityAlways(name string, args ...any)
+	AddReportEntryVisibilityFailureOrVerbose(name string, args ...any)
+	AddReportEntryVisibilityNever(name string, args ...any)
+
+	//Prints to the GinkgoWriter
+	Print(a ...interface{})
+	Printf(format string, a ...interface{})
+	Println(a ...interface{})
+
+	//Provides access to Ginkgo's color formatting, correctly configured to match the color settings specified in the invocation of ginkgo
+	F(format string, args ...any) string
+	Fi(indentation uint, format string, args ...any) string
+	Fiw(indentation uint, maxWidth uint, format string, args ...any) string
+
+	//Generates a formatted string version of the current spec's timeline
+	RenderTimeline() string
+
+	GinkgoRecover()
+	DeferCleanup(args ...any)
+
+	RandomSeed() int64
+	ParallelProcess() int
+	ParallelTotal() int
+
+	AttachProgressReporter(func() string) func()
+}
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/interrupt_handler/interrupt_handler.go b/vendor/github.com/onsi/ginkgo/v2/internal/interrupt_handler/interrupt_handler.go
index ac6f510408..8ed86111f7 100644
--- a/vendor/github.com/onsi/ginkgo/v2/internal/interrupt_handler/interrupt_handler.go
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/interrupt_handler/interrupt_handler.go
@@ -10,7 +10,7 @@ import (
 	"github.com/onsi/ginkgo/v2/internal/parallel_support"
 )
 
-const ABORT_POLLING_INTERVAL = 500 * time.Millisecond
+var ABORT_POLLING_INTERVAL = 500 * time.Millisecond
 
 type InterruptCause uint
 
@@ -62,13 +62,14 @@ type InterruptHandlerInterface interface {
 }
 
 type InterruptHandler struct {
-	c       chan interface{}
-	lock    *sync.Mutex
-	level   InterruptLevel
-	cause   InterruptCause
-	client  parallel_support.Client
-	stop    chan interface{}
-	signals []os.Signal
+	c                 chan interface{}
+	lock              *sync.Mutex
+	level             InterruptLevel
+	cause             InterruptCause
+	client            parallel_support.Client
+	stop              chan interface{}
+	signals           []os.Signal
+	requestAbortCheck chan interface{}
 }
 
 func NewInterruptHandler(client parallel_support.Client, signals ...os.Signal) *InterruptHandler {
@@ -76,11 +77,12 @@ func NewInterruptHandler(client parallel_support.Client, signals ...os.Signal) *
 		signals = []os.Signal{os.Interrupt, syscall.SIGTERM}
 	}
 	handler := &InterruptHandler{
-		c:       make(chan interface{}),
-		lock:    &sync.Mutex{},
-		stop:    make(chan interface{}),
-		client:  client,
-		signals: signals,
+		c:                 make(chan interface{}),
+		lock:              &sync.Mutex{},
+		stop:              make(chan interface{}),
+		requestAbortCheck: make(chan interface{}),
+		client:            client,
+		signals:           signals,
 	}
 	handler.registerForInterrupts()
 	return handler
@@ -109,6 +111,12 @@ func (handler *InterruptHandler) registerForInterrupts() {
 						pollTicker.Stop()
 						return
 					}
+				case <-handler.requestAbortCheck:
+					if handler.client.ShouldAbort() {
+						close(abortChannel)
+						pollTicker.Stop()
+						return
+					}
 				case <-handler.stop:
 					pollTicker.Stop()
 					return
@@ -152,11 +160,18 @@ func (handler *InterruptHandler) registerForInterrupts() {
 
 func (handler *InterruptHandler) Status() InterruptStatus {
 	handler.lock.Lock()
-	defer handler.lock.Unlock()
-
-	return InterruptStatus{
+	status := InterruptStatus{
 		Level:   handler.level,
 		Channel: handler.c,
 		Cause:   handler.cause,
 	}
+	handler.lock.Unlock()
+
+	if handler.client != nil && handler.client.ShouldAbort() && !status.Interrupted() {
+		close(handler.requestAbortCheck)
+		<-status.Channel
+		return handler.Status()
+	}
+
+	return status
 }
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/node.go b/vendor/github.com/onsi/ginkgo/v2/internal/node.go
index 0869bffb39..14c7cf54ed 100644
--- a/vendor/github.com/onsi/ginkgo/v2/internal/node.go
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/node.go
@@ -875,6 +875,15 @@ func (n Nodes) FirstNodeMarkedOrdered() Node {
 	return Node{}
 }
 
+func (n Nodes) IndexOfFirstNodeMarkedOrdered() int {
+	for i := range n {
+		if n[i].MarkedOrdered {
+			return i
+		}
+	}
+	return -1
+}
+
 func (n Nodes) GetMaxFlakeAttempts() int {
 	maxFlakeAttempts := 0
 	for i := range n {
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/ordering.go b/vendor/github.com/onsi/ginkgo/v2/internal/ordering.go
index 7ed43c7fdc..84eea0a59e 100644
--- a/vendor/github.com/onsi/ginkgo/v2/internal/ordering.go
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/ordering.go
@@ -27,36 +27,43 @@ func (s *SortableSpecs) Swap(i, j int) { s.Indexes[i], s.Indexes[j] = s.Indexes[
 func (s *SortableSpecs) Less(i, j int) bool {
 	a, b := s.Specs[s.Indexes[i]], s.Specs[s.Indexes[j]]
 
-	firstOrderedA := a.Nodes.FirstNodeMarkedOrdered()
-	firstOrderedB := b.Nodes.FirstNodeMarkedOrdered()
-	if firstOrderedA.ID == firstOrderedB.ID && !firstOrderedA.IsZero() {
-		// strictly preserve order in ordered containers.  ID will track this as IDs are generated monotonically
-		return a.FirstNodeWithType(types.NodeTypeIt).ID < b.FirstNodeWithType(types.NodeTypeIt).ID
+	aNodes, bNodes := a.Nodes.WithType(types.NodeTypesForContainerAndIt), b.Nodes.WithType(types.NodeTypesForContainerAndIt)
+
+	firstOrderedAIdx, firstOrderedBIdx := aNodes.IndexOfFirstNodeMarkedOrdered(), bNodes.IndexOfFirstNodeMarkedOrdered()
+	if firstOrderedAIdx > -1 && firstOrderedBIdx > -1 && aNodes[firstOrderedAIdx].ID == bNodes[firstOrderedBIdx].ID {
+		// strictly preserve order within an ordered containers.  ID will track this as IDs are generated monotonically
+		return aNodes.FirstNodeWithType(types.NodeTypeIt).ID < bNodes.FirstNodeWithType(types.NodeTypeIt).ID
+	}
+
+	// if either spec is in an ordered container - only use the nodes up to the outermost ordered container
+	if firstOrderedAIdx > -1 {
+		aNodes = aNodes[:firstOrderedAIdx+1]
+	}
+	if firstOrderedBIdx > -1 {
+		bNodes = bNodes[:firstOrderedBIdx+1]
 	}
 
-	aCLs := a.Nodes.WithType(types.NodeTypesForContainerAndIt).CodeLocations()
-	bCLs := b.Nodes.WithType(types.NodeTypesForContainerAndIt).CodeLocations()
-	for i := 0; i < len(aCLs) && i < len(bCLs); i++ {
-		aCL, bCL := aCLs[i], bCLs[i]
-		if aCL.FileName < bCL.FileName {
-			return true
-		} else if aCL.FileName > bCL.FileName {
-			return false
+	for i := 0; i < len(aNodes) && i < len(bNodes); i++ {
+		aCL, bCL := aNodes[i].CodeLocation, bNodes[i].CodeLocation
+		if aCL.FileName != bCL.FileName {
+			return aCL.FileName < bCL.FileName
 		}
-		if aCL.LineNumber < bCL.LineNumber {
-			return true
-		} else if aCL.LineNumber > bCL.LineNumber {
-			return false
+		if aCL.LineNumber != bCL.LineNumber {
+			return aCL.LineNumber < bCL.LineNumber
 		}
 	}
 	// either everything is equal or we have different lengths of CLs
-	if len(aCLs) < len(bCLs) {
-		return true
-	} else if len(aCLs) > len(bCLs) {
-		return false
+	if len(aNodes) != len(bNodes) {
+		return len(aNodes) < len(bNodes)
 	}
 	// ok, now we are sure everything was equal. so we use the spec text to break ties
-	return a.Text() < b.Text()
+	for i := 0; i < len(aNodes); i++ {
+		if aNodes[i].Text != bNodes[i].Text {
+			return aNodes[i].Text < bNodes[i].Text
+		}
+	}
+	// ok, all those texts were equal.  we'll use the ID of the most deeply nested node as a last resort
+	return aNodes[len(aNodes)-1].ID < bNodes[len(bNodes)-1].ID
 }
 
 type GroupedSpecIndices []SpecIndices
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor_unix.go b/vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor_unix.go
index f5ae15b8b5..8a237f4463 100644
--- a/vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor_unix.go
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor_unix.go
@@ -26,6 +26,17 @@ func (impl *dupSyscallOutputInterceptorImpl) CreateStdoutStderrClones() (*os.Fil
 	stdoutCloneFD, _ := unix.Dup(1)
 	stderrCloneFD, _ := unix.Dup(2)
 
+	// Important, set the fds to FD_CLOEXEC to prevent them leaking into childs
+	// https://github.com/onsi/ginkgo/issues/1191
+	flags, err := unix.FcntlInt(uintptr(stdoutCloneFD), unix.F_GETFD, 0)
+	if err == nil {
+		unix.FcntlInt(uintptr(stdoutCloneFD), unix.F_SETFD, flags|unix.FD_CLOEXEC)
+	}
+	flags, err = unix.FcntlInt(uintptr(stderrCloneFD), unix.F_GETFD, 0)
+	if err == nil {
+		unix.FcntlInt(uintptr(stderrCloneFD), unix.F_SETFD, flags|unix.FD_CLOEXEC)
+	}
+
 	// And then wrap the clone file descriptors in files.
 	// One benefit of this (that we don't use yet) is that we can actually write
 	// to these files to emit output to the console even though we're intercepting output
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/progress_reporter_manager.go b/vendor/github.com/onsi/ginkgo/v2/internal/progress_reporter_manager.go
new file mode 100644
index 0000000000..2c6e260f7d
--- /dev/null
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/progress_reporter_manager.go
@@ -0,0 +1,79 @@
+package internal
+
+import (
+	"context"
+	"sort"
+	"strings"
+	"sync"
+
+	"github.com/onsi/ginkgo/v2/types"
+)
+
+type ProgressReporterManager struct {
+	lock              *sync.Mutex
+	progressReporters map[int]func() string
+	prCounter         int
+}
+
+func NewProgressReporterManager() *ProgressReporterManager {
+	return &ProgressReporterManager{
+		progressReporters: map[int]func() string{},
+		lock:              &sync.Mutex{},
+	}
+}
+
+func (prm *ProgressReporterManager) AttachProgressReporter(reporter func() string) func() {
+	prm.lock.Lock()
+	defer prm.lock.Unlock()
+	prm.prCounter += 1
+	prCounter := prm.prCounter
+	prm.progressReporters[prCounter] = reporter
+
+	return func() {
+		prm.lock.Lock()
+		defer prm.lock.Unlock()
+		delete(prm.progressReporters, prCounter)
+	}
+}
+
+func (prm *ProgressReporterManager) QueryProgressReporters(ctx context.Context, failer *Failer) []string {
+	prm.lock.Lock()
+	keys := []int{}
+	for key := range prm.progressReporters {
+		keys = append(keys, key)
+	}
+	sort.Ints(keys)
+	reporters := []func() string{}
+	for _, key := range keys {
+		reporters = append(reporters, prm.progressReporters[key])
+	}
+	prm.lock.Unlock()
+
+	if len(reporters) == 0 {
+		return nil
+	}
+	out := []string{}
+	for _, reporter := range reporters {
+		reportC := make(chan string, 1)
+		go func() {
+			defer func() {
+				e := recover()
+				if e != nil {
+					failer.Panic(types.NewCodeLocationWithStackTrace(1), e)
+					reportC <- "failed to query attached progress reporter"
+				}
+			}()
+			reportC <- reporter()
+		}()
+		var report string
+		select {
+		case report = <-reportC:
+		case <-ctx.Done():
+			return out
+		}
+		if strings.TrimSpace(report) != "" {
+			out = append(out, report)
+		}
+	}
+	return out
+}
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/spec_context.go b/vendor/github.com/onsi/ginkgo/v2/internal/spec_context.go
index 8f569dd359..2515b84a14 100644
--- a/vendor/github.com/onsi/ginkgo/v2/internal/spec_context.go
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/spec_context.go
@@ -2,8 +2,6 @@ package internal
 
 import (
 	"context"
-	"sort"
-	"sync"
 
 	"github.com/onsi/ginkgo/v2/types"
 )
@@ -17,11 +15,9 @@ type SpecContext interface {
 
 type specContext struct {
 	context.Context
+	*ProgressReporterManager
 
-	cancel            context.CancelFunc
-	lock              *sync.Mutex
-	progressReporters map[int]func() string
-	prCounter         int
+	cancel context.CancelFunc
 
 	suite *Suite
 }
@@ -36,11 +32,9 @@ This is because Ginkgo needs finer control over when the context is canceled.  S
 func NewSpecContext(suite *Suite) *specContext {
 	ctx, cancel := context.WithCancel(context.Background())
 	sc := &specContext{
-		cancel:            cancel,
-		suite:             suite,
-		lock:              &sync.Mutex{},
-		prCounter:         0,
-		progressReporters: map[int]func() string{},
+		cancel:                  cancel,
+		suite:                   suite,
+		ProgressReporterManager: NewProgressReporterManager(),
 	}
 	ctx = context.WithValue(ctx, "GINKGO_SPEC_CONTEXT", sc) //yes, yes, the go docs say don't use a string for a key... but we'd rather avoid a circular dependency between Gomega and Ginkgo
 	sc.Context = ctx                                        //thank goodness for garbage collectors that can handle circular dependencies
@@ -51,40 +45,3 @@ func NewSpecContext(suite *Suite) *specContext {
 func (sc *specContext) SpecReport() types.SpecReport {
 	return sc.suite.CurrentSpecReport()
 }
-
-func (sc *specContext) AttachProgressReporter(reporter func() string) func() {
-	sc.lock.Lock()
-	defer sc.lock.Unlock()
-	sc.prCounter += 1
-	prCounter := sc.prCounter
-	sc.progressReporters[prCounter] = reporter
-
-	return func() {
-		sc.lock.Lock()
-		defer sc.lock.Unlock()
-		delete(sc.progressReporters, prCounter)
-	}
-}
-
-func (sc *specContext) QueryProgressReporters() []string {
-	sc.lock.Lock()
-	keys := []int{}
-	for key := range sc.progressReporters {
-		keys = append(keys, key)
-	}
-	sort.Ints(keys)
-	reporters := []func() string{}
-	for _, key := range keys {
-		reporters = append(reporters, sc.progressReporters[key])
-	}
-	sc.lock.Unlock()
-
-	if len(reporters) == 0 {
-		return nil
-	}
-	out := []string{}
-	for _, reporter := range reporters {
-		out = append(out, reporter())
-	}
-	return out
-}
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/suite.go b/vendor/github.com/onsi/ginkgo/v2/internal/suite.go
index 5ddf10072b..ea0d259d92 100644
--- a/vendor/github.com/onsi/ginkgo/v2/internal/suite.go
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/suite.go
@@ -9,6 +9,7 @@ import (
 	"github.com/onsi/ginkgo/v2/internal/parallel_support"
 	"github.com/onsi/ginkgo/v2/reporters"
 	"github.com/onsi/ginkgo/v2/types"
+	"golang.org/x/net/context"
 )
 
 type Phase uint
@@ -19,10 +20,14 @@ const (
 	PhaseRun
 )
 
+var PROGRESS_REPORTER_DEADLING = 5 * time.Second
+
 type Suite struct {
 	tree               *TreeNode
 	topLevelContainers Nodes
 
+	*ProgressReporterManager
+
 	phase Phase
 
 	suiteNodes   Nodes
@@ -64,8 +69,9 @@ type Suite struct {
 
 func NewSuite() *Suite {
 	return &Suite{
-		tree:  &TreeNode{},
-		phase: PhaseBuildTopLevel,
+		tree:                    &TreeNode{},
+		phase:                   PhaseBuildTopLevel,
+		ProgressReporterManager: NewProgressReporterManager(),
 
 		selectiveLock: &sync.Mutex{},
 	}
@@ -239,7 +245,9 @@ func (suite *Suite) pushCleanupNode(node Node) error {
 
 	node.NodeIDWhereCleanupWasGenerated = suite.currentNode.ID
 	node.NestingLevel = suite.currentNode.NestingLevel
+	suite.selectiveLock.Lock()
 	suite.cleanupNodes = append(suite.cleanupNodes, node)
+	suite.selectiveLock.Unlock()
 
 	return nil
 }
@@ -338,10 +346,13 @@ func (suite *Suite) generateProgressReport(fullReport bool) types.ProgressReport
 	suite.selectiveLock.Lock()
 	defer suite.selectiveLock.Unlock()
 
+	deadline, cancel := context.WithTimeout(context.Background(), PROGRESS_REPORTER_DEADLING)
+	defer cancel()
 	var additionalReports []string
 	if suite.currentSpecContext != nil {
-		additionalReports = suite.currentSpecContext.QueryProgressReporters()
+		additionalReports = append(additionalReports, suite.currentSpecContext.QueryProgressReporters(deadline, suite.failer)...)
 	}
+	additionalReports = append(additionalReports, suite.QueryProgressReporters(deadline, suite.failer)...)
 	gwOutput := suite.currentSpecReport.CapturedGinkgoWriterOutput + string(suite.writer.Bytes())
 	pr, err := NewProgressReport(suite.isRunningInParallel(), suite.currentSpecReport, suite.currentNode, suite.currentNodeStartTime, suite.currentByStep, gwOutput, timelineLocation, additionalReports, suite.config.SourceRoots, fullReport)
 
@@ -928,6 +939,12 @@ func (suite *Suite) runNode(node Node, specDeadline time.Time, text string) (typ
 			gracePeriodChannel = time.After(gracePeriod)
 		case <-interruptStatus.Channel:
 			interruptStatus = suite.interruptHandler.Status()
+			// ignore interruption from other process if we are cleaning up or reporting
+			if interruptStatus.Cause == interrupt_handler.InterruptCauseAbortByOtherProcess &&
+				node.NodeType.Is(types.NodeTypesAllowedDuringReportInterrupt|types.NodeTypesAllowedDuringCleanupInterrupt) {
+				continue
+			}
+
 			deadlineChannel = nil // don't worry about deadlines, time's up now
 
 			failureTimelineLocation := suite.generateTimelineLocation()
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/testingtproxy/testing_t_proxy.go b/vendor/github.com/onsi/ginkgo/v2/internal/testingtproxy/testing_t_proxy.go
index c797c95d4b..73e2655656 100644
--- a/vendor/github.com/onsi/ginkgo/v2/internal/testingtproxy/testing_t_proxy.go
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/testingtproxy/testing_t_proxy.go
@@ -5,34 +5,62 @@ import (
 	"io"
 	"os"
 
+	"github.com/onsi/ginkgo/v2/formatter"
 	"github.com/onsi/ginkgo/v2/internal"
+	"github.com/onsi/ginkgo/v2/reporters"
 	"github.com/onsi/ginkgo/v2/types"
 )
 
 type failFunc func(message string, callerSkip ...int)
 type skipFunc func(message string, callerSkip ...int)
-type cleanupFunc func(args ...interface{})
+type cleanupFunc func(args ...any)
 type reportFunc func() types.SpecReport
+type addReportEntryFunc func(names string, args ...any)
+type ginkgoWriterInterface interface {
+	io.Writer
 
-func New(writer io.Writer, fail failFunc, skip skipFunc, cleanup cleanupFunc, report reportFunc, offset int) *ginkgoTestingTProxy {
+	Print(a ...interface{})
+	Printf(format string, a ...interface{})
+	Println(a ...interface{})
+}
+type ginkgoRecoverFunc func()
+type attachProgressReporterFunc func(func() string) func()
+
+func New(writer ginkgoWriterInterface, fail failFunc, skip skipFunc, cleanup cleanupFunc, report reportFunc, addReportEntry addReportEntryFunc, ginkgoRecover ginkgoRecoverFunc, attachProgressReporter attachProgressReporterFunc, randomSeed int64, parallelProcess int, parallelTotal int, noColor bool, offset int) *ginkgoTestingTProxy {
 	return &ginkgoTestingTProxy{
-		fail:    fail,
-		offset:  offset,
-		writer:  writer,
-		skip:    skip,
-		cleanup: cleanup,
-		report:  report,
+		fail:                   fail,
+		offset:                 offset,
+		writer:                 writer,
+		skip:                   skip,
+		cleanup:                cleanup,
+		report:                 report,
+		addReportEntry:         addReportEntry,
+		ginkgoRecover:          ginkgoRecover,
+		attachProgressReporter: attachProgressReporter,
+		randomSeed:             randomSeed,
+		parallelProcess:        parallelProcess,
+		parallelTotal:          parallelTotal,
+		f:                      formatter.NewWithNoColorBool(noColor),
 	}
 }
 
 type ginkgoTestingTProxy struct {
-	fail    failFunc
-	skip    skipFunc
-	cleanup cleanupFunc
-	report  reportFunc
-	offset  int
-	writer  io.Writer
-}
+	fail                   failFunc
+	skip                   skipFunc
+	cleanup                cleanupFunc
+	report                 reportFunc
+	offset                 int
+	writer                 ginkgoWriterInterface
+	addReportEntry         addReportEntryFunc
+	ginkgoRecover          ginkgoRecoverFunc
+	attachProgressReporter attachProgressReporterFunc
+	randomSeed             int64
+	parallelProcess        int
+	parallelTotal          int
+	f                      formatter.Formatter
+}
+
+// basic testing.T support
 
 func (t *ginkgoTestingTProxy) Cleanup(f func()) {
 	t.cleanup(f, internal.Offset(1))
@@ -126,3 +154,57 @@ func (t *ginkgoTestingTProxy) TempDir() string {
 
 	return tmpDir
 }
+
+// FullGinkgoTInterface
+func (t *ginkgoTestingTProxy) AddReportEntryVisibilityAlways(name string, args ...any) {
+	finalArgs := []any{internal.Offset(1), types.ReportEntryVisibilityAlways}
+	t.addReportEntry(name, append(finalArgs, args...)...)
+}
+func (t *ginkgoTestingTProxy) AddReportEntryVisibilityFailureOrVerbose(name string, args ...any) {
+	finalArgs := []any{internal.Offset(1), types.ReportEntryVisibilityFailureOrVerbose}
+	t.addReportEntry(name, append(finalArgs, args...)...)
+}
+func (t *ginkgoTestingTProxy) AddReportEntryVisibilityNever(name string, args ...any) {
+	finalArgs := []any{internal.Offset(1), types.ReportEntryVisibilityNever}
+	t.addReportEntry(name, append(finalArgs, args...)...)
+}
+func (t *ginkgoTestingTProxy) Print(a ...any) {
+	t.writer.Print(a...)
+}
+func (t *ginkgoTestingTProxy) Printf(format string, a ...any) {
+	t.writer.Printf(format, a...)
+}
+func (t *ginkgoTestingTProxy) Println(a ...any) {
+	t.writer.Println(a...)
+}
+func (t *ginkgoTestingTProxy) F(format string, args ...any) string {
+	return t.f.F(format, args...)
+}
+func (t *ginkgoTestingTProxy) Fi(indentation uint, format string, args ...any) string {
+	return t.f.Fi(indentation, format, args...)
+}
+func (t *ginkgoTestingTProxy) Fiw(indentation uint, maxWidth uint, format string, args ...any) string {
+	return t.f.Fiw(indentation, maxWidth, format, args...)
+}
+func (t *ginkgoTestingTProxy) RenderTimeline() string {
+	return reporters.RenderTimeline(t.report(), false)
+}
+func (t *ginkgoTestingTProxy) GinkgoRecover() {
+	t.ginkgoRecover()
+}
+func (t *ginkgoTestingTProxy) DeferCleanup(args ...any) {
+	finalArgs := []any{internal.Offset(1)}
+	t.cleanup(append(finalArgs, args...)...)
+}
+func (t *ginkgoTestingTProxy) RandomSeed() int64 {
+	return t.randomSeed
+}
+func (t *ginkgoTestingTProxy) ParallelProcess() int {
+	return t.parallelProcess
+}
+func (t *ginkgoTestingTProxy) ParallelTotal() int {
+	return t.parallelTotal
+}
+func (t *ginkgoTestingTProxy) AttachProgressReporter(f func() string) func() {
+	return t.attachProgressReporter(f)
+}
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/writer.go b/vendor/github.com/onsi/ginkgo/v2/internal/writer.go
index 28a45b0faa..574f172df3 100644
--- a/vendor/github.com/onsi/ginkgo/v2/internal/writer.go
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/writer.go
@@ -135,6 +135,6 @@ func (w *Writer) Println(a ...interface{}) {
 
 func GinkgoLogrFunc(writer *Writer) logr.Logger {
 	return funcr.New(func(prefix, args string) {
-		writer.Printf("%s", args)
+		writer.Printf("%s\n", args)
 	}, funcr.Options{})
 }
diff --git a/vendor/github.com/onsi/ginkgo/v2/reporters/json_report.go b/vendor/github.com/onsi/ginkgo/v2/reporters/json_report.go
index 7f96c450fe..be506f9b47 100644
--- a/vendor/github.com/onsi/ginkgo/v2/reporters/json_report.go
+++ b/vendor/github.com/onsi/ginkgo/v2/reporters/json_report.go
@@ -4,12 +4,16 @@ import (
 	"encoding/json"
 	"fmt"
 	"os"
+	"path"
 
 	"github.com/onsi/ginkgo/v2/types"
 )
 
-//GenerateJSONReport produces a JSON-formatted report at the passed in destination
+// GenerateJSONReport produces a JSON-formatted report at the passed in destination
 func GenerateJSONReport(report types.Report, destination string) error {
+	if err := os.MkdirAll(path.Dir(destination), 0770); err != nil {
+		return err
+	}
 	f, err := os.Create(destination)
 	if err != nil {
 		return err
@@ -25,8 +29,8 @@ func GenerateJSONReport(report types.Report, destination string) error {
 	return f.Close()
 }
 
-//MergeJSONReports produces a single JSON-formatted report at the passed in destination by merging the JSON-formatted reports provided in sources
-//It skips over reports that fail to decode but reports on them via the returned messages []string
+// MergeJSONReports produces a single JSON-formatted report at the passed in destination by merging the JSON-formatted reports provided in sources
+// It skips over reports that fail to decode but reports on them via the returned messages []string
 func MergeAndCleanupJSONReports(sources []string, destination string) ([]string, error) {
 	messages := []string{}
 	allReports := []types.Report{}
@@ -46,6 +50,9 @@ func MergeAndCleanupJSONReports(sources []string, destination string) ([]string,
 		allReports = append(allReports, reports...)
 	}
 
+	if err := os.MkdirAll(path.Dir(destination), 0770); err != nil {
+		return messages, err
+	}
 	f, err := os.Create(destination)
 	if err != nil {
 		return messages, err
diff --git a/vendor/github.com/onsi/ginkgo/v2/reporters/junit_report.go b/vendor/github.com/onsi/ginkgo/v2/reporters/junit_report.go
index fb87e24d71..816042208c 100644
--- a/vendor/github.com/onsi/ginkgo/v2/reporters/junit_report.go
+++ b/vendor/github.com/onsi/ginkgo/v2/reporters/junit_report.go
@@ -14,6 +14,7 @@ import (
 	"encoding/xml"
 	"fmt"
 	"os"
+	"path"
 	"strings"
 
 	"github.com/onsi/ginkgo/v2/config"
@@ -36,6 +37,9 @@ type JunitReportConfig struct {
 
 	// Enable OmitLeafNodeType to prevent the spec leaf node type from appearing in the spec name
 	OmitLeafNodeType bool
+
+	// Enable OmitSuiteSetupNodes to prevent the creation of testcase entries for setup nodes
+	OmitSuiteSetupNodes bool
 }
 
 type JUnitTestSuites struct {
@@ -177,6 +181,9 @@ func GenerateJUnitReportWithConfig(report types.Report, dst string, config Junit
 		},
 	}
 	for _, spec := range report.SpecReports {
+		if config.OmitSuiteSetupNodes && spec.LeafNodeType != types.NodeTypeIt {
+			continue
+		}
 		name := fmt.Sprintf("[%s]", spec.LeafNodeType)
 		if config.OmitLeafNodeType {
 			name = ""
@@ -279,6 +286,9 @@ func GenerateJUnitReportWithConfig(report types.Report, dst string, config Junit
 		TestSuites: []JUnitTestSuite{suite},
 	}
 
+	if err := os.MkdirAll(path.Dir(dst), 0770); err != nil {
+		return err
+	}
 	f, err := os.Create(dst)
 	if err != nil {
 		return err
@@ -316,6 +326,9 @@ func MergeAndCleanupJUnitReports(sources []string, dst string) ([]string, error)
 		mergedReport.TestSuites = append(mergedReport.TestSuites, report.TestSuites...)
 	}
 
+	if err := os.MkdirAll(path.Dir(dst), 0770); err != nil {
+		return messages, err
+	}
 	f, err := os.Create(dst)
 	if err != nil {
 		return messages, err
@@ -338,8 +351,12 @@ func failureDescriptionForUnstructuredReporters(spec types.SpecReport) string {
 }
 
 func systemErrForUnstructuredReporters(spec types.SpecReport) string {
+	return RenderTimeline(spec, true)
+}
+
+func RenderTimeline(spec types.SpecReport, noColor bool) string {
 	out := &strings.Builder{}
-	NewDefaultReporter(types.ReporterConfig{NoColor: true, VeryVerbose: true}, out).emitTimeline(0, spec, spec.Timeline())
+	NewDefaultReporter(types.ReporterConfig{NoColor: noColor, VeryVerbose: true}, out).emitTimeline(0, spec, spec.Timeline())
 	return out.String()
 }
 
diff --git a/vendor/github.com/onsi/ginkgo/v2/reporters/teamcity_report.go b/vendor/github.com/onsi/ginkgo/v2/reporters/teamcity_report.go
index c1863496dc..e990ad82e1 100644
--- a/vendor/github.com/onsi/ginkgo/v2/reporters/teamcity_report.go
+++ b/vendor/github.com/onsi/ginkgo/v2/reporters/teamcity_report.go
@@ -11,6 +11,7 @@ package reporters
 import (
 	"fmt"
 	"os"
+	"path"
 	"strings"
 
 	"github.com/onsi/ginkgo/v2/types"
@@ -27,6 +28,9 @@ func tcEscape(s string) string {
 }
 
 func GenerateTeamcityReport(report types.Report, dst string) error {
+	if err := os.MkdirAll(path.Dir(dst), 0770); err != nil {
+		return err
+	}
 	f, err := os.Create(dst)
 	if err != nil {
 		return err
diff --git a/vendor/github.com/onsi/ginkgo/v2/types/config.go b/vendor/github.com/onsi/ginkgo/v2/types/config.go
index 1efd77d39e..1014c7b49f 100644
--- a/vendor/github.com/onsi/ginkgo/v2/types/config.go
+++ b/vendor/github.com/onsi/ginkgo/v2/types/config.go
@@ -8,6 +8,7 @@ package types
 import (
 	"flag"
 	"os"
+	"path/filepath"
 	"runtime"
 	"strconv"
 	"strings"
@@ -600,13 +601,29 @@ func VetAndInitializeCLIAndGoConfig(cliConfig CLIConfig, goFlagsConfig GoFlagsCo
 }
 
 // GenerateGoTestCompileArgs is used by the Ginkgo CLI to generate command line arguments to pass to the go test -c command when compiling the test
-func GenerateGoTestCompileArgs(goFlagsConfig GoFlagsConfig, destination string, packageToBuild string) ([]string, error) {
+func GenerateGoTestCompileArgs(goFlagsConfig GoFlagsConfig, destination string, packageToBuild string, pathToInvocationPath string) ([]string, error) {
 	// if the user has set the CoverProfile run-time flag make sure to set the build-time cover flag to make sure
 	// the built test binary can generate a coverprofile
 	if goFlagsConfig.CoverProfile != "" {
 		goFlagsConfig.Cover = true
 	}
 
+	if goFlagsConfig.CoverPkg != "" {
+		coverPkgs := strings.Split(goFlagsConfig.CoverPkg, ",")
+		adjustedCoverPkgs := make([]string, len(coverPkgs))
+		for i, coverPkg := range coverPkgs {
+			coverPkg = strings.Trim(coverPkg, " ")
+			if strings.HasPrefix(coverPkg, "./") {
+				// this is a relative coverPkg - we need to reroot it
+				adjustedCoverPkgs[i] = "./" + filepath.Join(pathToInvocationPath, strings.TrimPrefix(coverPkg, "./"))
+			} else {
+				// this is a package name - don't touch it
+				adjustedCoverPkgs[i] = coverPkg
+			}
+		}
+		goFlagsConfig.CoverPkg = strings.Join(adjustedCoverPkgs, ",")
+	}
+
 	args := []string{"test", "-c", "-o", destination, packageToBuild}
 	goArgs, err := GenerateFlagArgs(
 		GoBuildFlags,
diff --git a/vendor/github.com/onsi/ginkgo/v2/types/deprecation_support.go b/vendor/github.com/onsi/ginkgo/v2/types/deprecation_support.go
index f267bdefd5..e2519f673f 100644
--- a/vendor/github.com/onsi/ginkgo/v2/types/deprecation_support.go
+++ b/vendor/github.com/onsi/ginkgo/v2/types/deprecation_support.go
@@ -38,7 +38,7 @@ func (d deprecations) Async() Deprecation {
 
 func (d deprecations) Measure() Deprecation {
 	return Deprecation{
-		Message: "Measure is deprecated and will be removed in Ginkgo V2.  Please migrate to gomega/gmeasure.",
+		Message: "Measure is deprecated and has been removed from Ginkgo V2.  Any Measure tests in your spec will not run.  Please migrate to gomega/gmeasure.",
 		DocLink: "removed-measure",
 		Version: "1.16.3",
 	}
diff --git a/vendor/github.com/onsi/ginkgo/v2/types/version.go b/vendor/github.com/onsi/ginkgo/v2/types/version.go
index 185317c635..6bc46150e7 100644
--- a/vendor/github.com/onsi/ginkgo/v2/types/version.go
+++ b/vendor/github.com/onsi/ginkgo/v2/types/version.go
@@ -1,3 +1,3 @@
 package types
 
-const VERSION = "2.8.3"
+const VERSION = "2.9.7"
diff --git a/vendor/github.com/onsi/gomega/.gitignore b/vendor/github.com/onsi/gomega/.gitignore
index 52266eae11..425d0a509f 100644
--- a/vendor/github.com/onsi/gomega/.gitignore
+++ b/vendor/github.com/onsi/gomega/.gitignore
@@ -3,5 +3,5 @@
 .
 .idea
 gomega.iml
-TODO.md
+TODO
 .vscode
\ No newline at end of file
diff --git a/vendor/github.com/onsi/gomega/CHANGELOG.md b/vendor/github.com/onsi/gomega/CHANGELOG.md
index 99ea940785..9b83dd6d48 100644
--- a/vendor/github.com/onsi/gomega/CHANGELOG.md
+++ b/vendor/github.com/onsi/gomega/CHANGELOG.md
@@ -1,3 +1,68 @@
+## 1.27.8
+
+### Fixes
+- HaveExactElement should not call FailureMessage if a submatcher returned an error [096f392]
+
+### Maintenance
+- Bump github.com/onsi/ginkgo/v2 from 2.9.5 to 2.9.7 (#669) [8884bee]
+
+## 1.27.7
+
+### Fixes
+- fix: gcustom.MakeMatcher accepts nil as actual value (#666) [57054d5]
+
+### Maintenance
+- update gitignore [05c1bc6]
+- Bump github.com/onsi/ginkgo/v2 from 2.9.4 to 2.9.5 (#663) [7cadcf6]
+- Bump golang.org/x/net from 0.9.0 to 0.10.0 (#662) [b524839]
+- Bump github.com/onsi/ginkgo/v2 from 2.9.2 to 2.9.4 (#661) [5f44694]
+- Bump commonmarker from 0.23.8 to 0.23.9 in /docs (#657) [05dc99a]
+- Bump nokogiri from 1.14.1 to 1.14.3 in /docs (#658) [3a033d1]
+- Replace deprecated NewGomegaWithT with NewWithT (#659) [a19238f]
+- Bump golang.org/x/net from 0.8.0 to 0.9.0 (#656) [29ed041]
+- Bump actions/setup-go from 3 to 4 (#651) [11b2080]
+
+## 1.27.6
+
+### Fixes
+- Allow collections matchers to work correctly when expected has nil elements [60e7cf3]
+
+### Maintenance
+- updates MatchError godoc comment to also accept a Gomega matcher (#654) [67b869d]
+
+## 1.27.5
+
+### Maintenance
+- Bump github.com/onsi/ginkgo/v2 from 2.9.1 to 2.9.2 (#653) [a215021]
+- Bump github.com/go-task/slim-sprig (#652) [a26fed8]
+
+## 1.27.4
+
+### Fixes
+- improve error formatting and remove duplication of error message in Eventually/Consistently [854f075]
+
+### Maintenance
+- Bump github.com/onsi/ginkgo/v2 from 2.9.0 to 2.9.1 (#650) [ccebd9b]
+
+## 1.27.3
+
+### Fixes
+- format.Object now always includes err.Error() when passed an error [86d97ef]
+- Fix HaveExactElements to work inside ContainElement or other collection matchers (#648) [636757e]
+
+### Maintenance
+- Bump github.com/golang/protobuf from 1.5.2 to 1.5.3 (#649) [cc16689]
+- Bump github.com/onsi/ginkgo/v2 from 2.8.4 to 2.9.0 (#646) [e783366]
+
+## 1.27.2
+
+### Fixes
+- improve poll progress message when polling a consistently that has been passing [28a319b]
+
+### Maintenance
+- bump ginkgo
+- remove tools.go hack as Ginkgo 2.8.2 automatically pulls in the cli dependencies [81443b3]
+
 ## 1.27.1
 
 ### Maintenance
diff --git a/vendor/github.com/onsi/gomega/format/format.go b/vendor/github.com/onsi/gomega/format/format.go
index 1a2ed877a9..56bdd053bb 100644
--- a/vendor/github.com/onsi/gomega/format/format.go
+++ b/vendor/github.com/onsi/gomega/format/format.go
@@ -52,7 +52,7 @@ var CharactersAroundMismatchToInclude uint = 5
 var contextType = reflect.TypeOf((*context.Context)(nil)).Elem()
 var timeType = reflect.TypeOf(time.Time{})
 
-//The default indentation string emitted by the format package
+// The default indentation string emitted by the format package
 var Indent = "    "
 
 var longFormThreshold = 20
@@ -258,7 +258,11 @@ Set PrintContextObjects to true to print the content of objects implementing con
 func Object(object interface{}, indentation uint) string {
 	indent := strings.Repeat(Indent, int(indentation))
 	value := reflect.ValueOf(object)
-	return fmt.Sprintf("%s<%s>: %s", indent, formatType(value), formatValue(value, indentation))
+	commonRepresentation := ""
+	if err, ok := object.(error); ok {
+		commonRepresentation += "\n" + IndentString(err.Error(), indentation) + "\n" + indent
+	}
+	return fmt.Sprintf("%s<%s>: %s%s", indent, formatType(value), commonRepresentation, formatValue(value, indentation))
 }
 
 /*
diff --git a/vendor/github.com/onsi/gomega/gomega_dsl.go b/vendor/github.com/onsi/gomega/gomega_dsl.go
index 4405c06825..bc7ec293de 100644
--- a/vendor/github.com/onsi/gomega/gomega_dsl.go
+++ b/vendor/github.com/onsi/gomega/gomega_dsl.go
@@ -22,7 +22,7 @@ import (
 	"github.com/onsi/gomega/types"
 )
 
-const GOMEGA_VERSION = "1.27.1"
+const GOMEGA_VERSION = "1.27.8"
 
 const nilGomegaPanic = `You are trying to make an assertion, but haven't registered Gomega's fail handler.
 If you're using Ginkgo then you probably forgot to put your assertion in an It().
@@ -204,7 +204,7 @@ func Ω(actual interface{}, extra ...interface{}) Assertion {
 // All subsequent arguments will be required to be nil/zero.
 //
 // This is convenient if you want to make an assertion on a method/function that returns
-// a value and an error - a common patter in Go.
+// a value and an error - a common pattern in Go.
 //
 // For example, given a function with signature:
 //
diff --git a/vendor/github.com/onsi/gomega/internal/async_assertion.go b/vendor/github.com/onsi/gomega/internal/async_assertion.go
index 7f62269689..1188b0bce3 100644
--- a/vendor/github.com/onsi/gomega/internal/async_assertion.go
+++ b/vendor/github.com/onsi/gomega/internal/async_assertion.go
@@ -412,7 +412,7 @@ func (assertion *AsyncAssertion) match(matcher types.GomegaMatcher, desiredMatch
 				message += format.Object(attachment.Object, 1)
 			}
 		} else {
-			message = preamble + "\n" + err.Error() + "\n" + format.Object(err, 1)
+			message = preamble + "\n" + format.Object(err, 1)
 		}
 		return message
 	}
@@ -425,10 +425,18 @@ func (assertion *AsyncAssertion) match(matcher types.GomegaMatcher, desiredMatch
 
 		if actualErr == nil {
 			if matcherErr == nil {
-				if desiredMatch {
-					message += matcher.FailureMessage(actual)
+				if desiredMatch != matches {
+					if desiredMatch {
+						message += matcher.FailureMessage(actual)
+					} else {
+						message += matcher.NegatedFailureMessage(actual)
+					}
 				} else {
-					message += matcher.NegatedFailureMessage(actual)
+					if assertion.asyncType == AsyncAssertionTypeConsistently {
+						message += "There is no failure as the matcher passed to Consistently has not yet failed"
+					} else {
+						message += "There is no failure as the matcher passed to Eventually succeeded on its most recent iteration"
+					}
 				}
 			} else {
 				var fgErr formattedGomegaError
diff --git a/vendor/github.com/onsi/gomega/matchers.go b/vendor/github.com/onsi/gomega/matchers.go
index 44056ad643..b832f3dbaf 100644
--- a/vendor/github.com/onsi/gomega/matchers.go
+++ b/vendor/github.com/onsi/gomega/matchers.go
@@ -87,14 +87,17 @@ func Succeed() types.GomegaMatcher {
 	return &matchers.SucceedMatcher{}
 }
 
-// MatchError succeeds if actual is a non-nil error that matches the passed in string/error.
+// MatchError succeeds if actual is a non-nil error that matches the passed in
+// string, error, or matcher.
 //
 // These are valid use-cases:
 //
-//	Expect(err).Should(MatchError("an error")) //asserts that err.Error() == "an error"
-//	Expect(err).Should(MatchError(SomeError)) //asserts that err == SomeError (via reflect.DeepEqual)
+//  Expect(err).Should(MatchError("an error")) //asserts that err.Error() == "an error"
+//  Expect(err).Should(MatchError(SomeError)) //asserts that err == SomeError (via reflect.DeepEqual)
+//  Expect(err).Should(MatchError(ContainsSubstring("sprocket not found"))) // asserts that edrr.Error() contains substring "sprocket not found"
 //
-// It is an error for err to be nil or an object that does not implement the Error interface
+// It is an error for err to be nil or an object that does not implement the
+// Error interface
 func MatchError(expected interface{}) types.GomegaMatcher {
 	return &matchers.MatchErrorMatcher{
 		Expected: expected,
diff --git a/vendor/github.com/onsi/gomega/matchers/consist_of.go b/vendor/github.com/onsi/gomega/matchers/consist_of.go
index e8ef0dee1f..f69037a4f0 100644
--- a/vendor/github.com/onsi/gomega/matchers/consist_of.go
+++ b/vendor/github.com/onsi/gomega/matchers/consist_of.go
@@ -48,11 +48,13 @@ func neighbours(value, matcher interface{}) (bool, error) {
 
 func equalMatchersToElements(matchers []interface{}) (elements []interface{}) {
 	for _, matcher := range matchers {
-		equalMatcher, ok := matcher.(*EqualMatcher)
-		if ok {
-			matcher = equalMatcher.Expected
+		if equalMatcher, ok := matcher.(*EqualMatcher); ok {
+			elements = append(elements, equalMatcher.Expected)
+		} else if _, ok := matcher.(*BeNilMatcher); ok {
+			elements = append(elements, nil)
+		} else {
+			elements = append(elements, matcher)
 		}
-		elements = append(elements, matcher)
 	}
 	return
 }
@@ -72,11 +74,13 @@ func flatten(elems []interface{}) []interface{} {
 
 func matchers(expectedElems []interface{}) (matchers []interface{}) {
 	for _, e := range flatten(expectedElems) {
-		matcher, isMatcher := e.(omegaMatcher)
-		if !isMatcher {
-			matcher = &EqualMatcher{Expected: e}
+		if e == nil {
+			matchers = append(matchers, &BeNilMatcher{})
+		} else if matcher, isMatcher := e.(omegaMatcher); isMatcher {
+			matchers = append(matchers, matcher)
+		} else {
+			matchers = append(matchers, &EqualMatcher{Expected: e})
 		}
-		matchers = append(matchers, matcher)
 	}
 	return
 }
@@ -89,9 +93,14 @@ func presentable(elems []interface{}) interface{} {
 	}
 
 	sv := reflect.ValueOf(elems)
-	tt := sv.Index(0).Elem().Type()
+	firstEl := sv.Index(0)
+	if firstEl.IsNil() {
+		return elems
+	}
+	tt := firstEl.Elem().Type()
 	for i := 1; i < sv.Len(); i++ {
-		if sv.Index(i).Elem().Type() != tt {
+		el := sv.Index(i)
+		if el.IsNil() || (sv.Index(i).Elem().Type() != tt) {
 			return elems
 		}
 	}
diff --git a/vendor/github.com/onsi/gomega/matchers/have_exact_elements.go b/vendor/github.com/onsi/gomega/matchers/have_exact_elements.go
index 19d8f3d1d3..dca5b94467 100644
--- a/vendor/github.com/onsi/gomega/matchers/have_exact_elements.go
+++ b/vendor/github.com/onsi/gomega/matchers/have_exact_elements.go
@@ -19,6 +19,8 @@ type HaveExactElementsMatcher struct {
 }
 
 func (matcher *HaveExactElementsMatcher) Match(actual interface{}) (success bool, err error) {
+	matcher.resetState()
+
 	if isMap(actual) {
 		return false, fmt.Errorf("error")
 	}
@@ -42,7 +44,12 @@ func (matcher *HaveExactElementsMatcher) Match(actual interface{}) (success bool
 
 		elemMatcher := matchers[i].(omegaMatcher)
 		match, err := elemMatcher.Match(values[i])
-		if err != nil || !match {
+		if err != nil {
+			matcher.mismatchFailures = append(matcher.mismatchFailures, mismatchFailure{
+				index:   i,
+				failure: err.Error(),
+			})
+		} else if !match {
 			matcher.mismatchFailures = append(matcher.mismatchFailures, mismatchFailure{
 				index:   i,
 				failure: elemMatcher.FailureMessage(values[i]),
@@ -73,3 +80,9 @@ func (matcher *HaveExactElementsMatcher) FailureMessage(actual interface{}) (mes
 func (matcher *HaveExactElementsMatcher) NegatedFailureMessage(actual interface{}) (message string) {
 	return format.Message(actual, "not to contain elements", presentable(matcher.Elements))
 }
+
+func (matcher *HaveExactElementsMatcher) resetState() {
+	matcher.mismatchFailures = nil
+	matcher.missingIndex = 0
+	matcher.extraIndex = 0
+}
diff --git a/vendor/github.com/onsi/gomega/matchers/have_occurred_matcher.go b/vendor/github.com/onsi/gomega/matchers/have_occurred_matcher.go
index 5bcfdd2ade..22a1b67306 100644
--- a/vendor/github.com/onsi/gomega/matchers/have_occurred_matcher.go
+++ b/vendor/github.com/onsi/gomega/matchers/have_occurred_matcher.go
@@ -31,5 +31,5 @@ func (matcher *HaveOccurredMatcher) FailureMessage(actual interface{}) (message
 }
 
 func (matcher *HaveOccurredMatcher) NegatedFailureMessage(actual interface{}) (message string) {
-	return fmt.Sprintf("Unexpected error:\n%s\n%s\n%s", format.Object(actual, 1), format.IndentString(actual.(error).Error(), 1), "occurred")
+	return fmt.Sprintf("Unexpected error:\n%s\n%s", format.Object(actual, 1), "occurred")
 }
diff --git a/vendor/github.com/onsi/gomega/matchers/succeed_matcher.go b/vendor/github.com/onsi/gomega/matchers/succeed_matcher.go
index da5a395944..327350f7b7 100644
--- a/vendor/github.com/onsi/gomega/matchers/succeed_matcher.go
+++ b/vendor/github.com/onsi/gomega/matchers/succeed_matcher.go
@@ -34,7 +34,7 @@ func (matcher *SucceedMatcher) FailureMessage(actual interface{}) (message strin
 	if errors.As(actual.(error), &fgErr) {
 		return fgErr.FormattedGomegaError()
 	}
-	return fmt.Sprintf("Expected success, but got an error:\n%s\n%s", format.Object(actual, 1), format.IndentString(actual.(error).Error(), 1))
+	return fmt.Sprintf("Expected success, but got an error:\n%s", format.Object(actual, 1))
 }
 
 func (matcher *SucceedMatcher) NegatedFailureMessage(actual interface{}) (message string) {
diff --git a/vendor/github.com/onsi/gomega/tools b/vendor/github.com/onsi/gomega/tools
deleted file mode 100644
index e4195cf362..0000000000
--- a/vendor/github.com/onsi/gomega/tools
+++ /dev/null
@@ -1,8 +0,0 @@
-//go:build tools
-// +build tools
-
-package main
-
-import (
-	_ "github.com/onsi/ginkgo/v2/ginkgo"
-)
diff --git a/vendor/github.com/sirupsen/logrus/README.md b/vendor/github.com/sirupsen/logrus/README.md
index b042c896f2..d1d4a85fd7 100644
--- a/vendor/github.com/sirupsen/logrus/README.md
+++ b/vendor/github.com/sirupsen/logrus/README.md
@@ -9,7 +9,7 @@ the last thing you want from your Logging library (again...).
 
 This does not mean Logrus is dead. Logrus will continue to be maintained for
 security, (backwards compatible) bug fixes, and performance (where we are
-limited by the interface). 
+limited by the interface).
 
 I believe Logrus' biggest contribution is to have played a part in today's
 widespread use of structured logging in Golang. There doesn't seem to be a
@@ -43,7 +43,7 @@ plain text):
 With `log.SetFormatter(&log.JSONFormatter{})`, for easy parsing by logstash
 or Splunk:
 
-```json
+```text
 {"animal":"walrus","level":"info","msg":"A group of walrus emerges from the
 ocean","size":10,"time":"2014-03-10 19:57:38.562264131 -0400 EDT"}
 
@@ -99,7 +99,7 @@ time="2015-03-26T01:27:38-04:00" level=fatal method=github.com/sirupsen/arcticcr
 ```
 Note that this does add measurable overhead - the cost will depend on the version of Go, but is
 between 20 and 40% in recent tests with 1.6 and 1.7.  You can validate this in your
-environment via benchmarks: 
+environment via benchmarks:
 ```
 go test -bench=.*CallerTracing
 ```
@@ -317,6 +317,8 @@ log.SetLevel(log.InfoLevel)
 It may be useful to set `log.Level = logrus.DebugLevel` in a debug or verbose
 environment if your application has that.
 
+Note: If you want different log levels for global (`log.SetLevel(...)`) and syslog logging, please check the [syslog hook README](hooks/syslog/README.md#different-log-levels-for-local-and-remote-logging).
+
 #### Entries
 
 Besides the fields added with `WithField` or `WithFields` some fields are
diff --git a/vendor/github.com/sirupsen/logrus/writer.go b/vendor/github.com/sirupsen/logrus/writer.go
index 72e8e3a1b6..074fd4b8bd 100644
--- a/vendor/github.com/sirupsen/logrus/writer.go
+++ b/vendor/github.com/sirupsen/logrus/writer.go
@@ -4,6 +4,7 @@ import (
 	"bufio"
 	"io"
 	"runtime"
+	"strings"
 )
 
 // Writer at INFO level. See WriterLevel for details.
@@ -20,15 +21,18 @@ func (logger *Logger) WriterLevel(level Level) *io.PipeWriter {
 	return NewEntry(logger).WriterLevel(level)
 }
 
+// Writer returns an io.Writer that writes to the logger at the info log level
 func (entry *Entry) Writer() *io.PipeWriter {
 	return entry.WriterLevel(InfoLevel)
 }
 
+// WriterLevel returns an io.Writer that writes to the logger at the given log level
 func (entry *Entry) WriterLevel(level Level) *io.PipeWriter {
 	reader, writer := io.Pipe()
 
 	var printFunc func(args ...interface{})
 
+	// Determine which log function to use based on the specified log level
 	switch level {
 	case TraceLevel:
 		printFunc = entry.Trace
@@ -48,23 +52,51 @@ func (entry *Entry) WriterLevel(level Level) *io.PipeWriter {
 		printFunc = entry.Print
 	}
 
+	// Start a new goroutine to scan the input and write it to the logger using the specified print function.
+	// It splits the input into chunks of up to 64KB to avoid buffer overflows.
 	go entry.writerScanner(reader, printFunc)
+
+	// Set a finalizer function to close the writer when it is garbage collected
 	runtime.SetFinalizer(writer, writerFinalizer)
 
 	return writer
 }
 
+// writerScanner scans the input from the reader and writes it to the logger
 func (entry *Entry) writerScanner(reader *io.PipeReader, printFunc func(args ...interface{})) {
 	scanner := bufio.NewScanner(reader)
+
+	// Set the buffer size to the maximum token size to avoid buffer overflows
+	scanner.Buffer(make([]byte, bufio.MaxScanTokenSize), bufio.MaxScanTokenSize)
+
+	// Define a split function to split the input into chunks of up to 64KB
+	chunkSize := bufio.MaxScanTokenSize // 64KB
+	splitFunc := func(data []byte, atEOF bool) (int, []byte, error) {
+		if len(data) >= chunkSize {
+			return chunkSize, data[:chunkSize], nil
+		}
+
+		return bufio.ScanLines(data, atEOF)
+	}
+
+	// Use the custom split function to split the input
+	scanner.Split(splitFunc)
+
+	// Scan the input and write it to the logger using the specified print function
 	for scanner.Scan() {
-		printFunc(scanner.Text())
+		printFunc(strings.TrimRight(scanner.Text(), "\r\n"))
 	}
+
+	// If there was an error while scanning the input, log an error
 	if err := scanner.Err(); err != nil {
 		entry.Errorf("Error while reading from Writer: %s", err)
 	}
+
+	// Close the reader when we are done
 	reader.Close()
 }
 
+// WriterFinalizer is a finalizer function that closes then given writer when it is garbage collected
 func writerFinalizer(writer *io.PipeWriter) {
 	writer.Close()
 }
diff --git a/vendor/golang.org/x/tools/go/types/objectpath/objectpath.go b/vendor/golang.org/x/tools/go/types/objectpath/objectpath.go
new file mode 100644
index 0000000000..aa7dfaccf5
--- /dev/null
+++ b/vendor/golang.org/x/tools/go/types/objectpath/objectpath.go
@@ -0,0 +1,764 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package objectpath defines a naming scheme for types.Objects
+// (that is, named entities in Go programs) relative to their enclosing
+// package.
+//
+// Type-checker objects are canonical, so they are usually identified by
+// their address in memory (a pointer), but a pointer has meaning only
+// within one address space. By contrast, objectpath names allow the
+// identity of an object to be sent from one program to another,
+// establishing a correspondence between types.Object variables that are
+// distinct but logically equivalent.
+//
+// A single object may have multiple paths. In this example,
+//
+//	type A struct{ X int }
+//	type B A
+//
+// the field X has two paths due to its membership of both A and B.
+// The For(obj) function always returns one of these paths, arbitrarily
+// but consistently.
+package objectpath
+
+import (
+	"fmt"
+	"go/types"
+	"sort"
+	"strconv"
+	"strings"
+
+	"golang.org/x/tools/internal/typeparams"
+
+	_ "unsafe" // for go:linkname
+)
+
+// A Path is an opaque name that identifies a types.Object
+// relative to its package. Conceptually, the name consists of a
+// sequence of destructuring operations applied to the package scope
+// to obtain the original object.
+// The name does not include the package itself.
+type Path string
+
+// Encoding
+//
+// An object path is a textual and (with training) human-readable encoding
+// of a sequence of destructuring operators, starting from a types.Package.
+// The sequences represent a path through the package/object/type graph.
+// We classify these operators by their type:
+//
+//	PO package->object	Package.Scope.Lookup
+//	OT  object->type 	Object.Type
+//	TT    type->type 	Type.{Elem,Key,Params,Results,Underlying} [EKPRU]
+//	TO   type->object	Type.{At,Field,Method,Obj} [AFMO]
+//
+// All valid paths start with a package and end at an object
+// and thus may be defined by the regular language:
+//
+//	objectpath = PO (OT TT* TO)*
+//
+// The concrete encoding follows directly:
+//   - The only PO operator is Package.Scope.Lookup, which requires an identifier.
+//   - The only OT operator is Object.Type,
+//     which we encode as '.' because dot cannot appear in an identifier.
+//   - The TT operators are encoded as [EKPRUTC];
+//     one of these (TypeParam) requires an integer operand,
+//     which is encoded as a string of decimal digits.
+//   - The TO operators are encoded as [AFMO];
+//     three of these (At,Field,Method) require an integer operand,
+//     which is encoded as a string of decimal digits.
+//     These indices are stable across different representations
+//     of the same package, even source and export data.
+//     The indices used are implementation specific and may not correspond to
+//     the argument to the go/types function.
+//
+// In the example below,
+//
+//	package p
+//
+//	type T interface {
+//		f() (a string, b struct{ X int })
+//	}
+//
+// field X has the path "T.UM0.RA1.F0",
+// representing the following sequence of operations:
+//
+//	p.Lookup("T")					T
+//	.Type().Underlying().Method(0).			f
+//	.Type().Results().At(1)				b
+//	.Type().Field(0)					X
+//
+// The encoding is not maximally compact---every R or P is
+// followed by an A, for example---but this simplifies the
+// encoder and decoder.
+const (
+	// object->type operators
+	opType = '.' // .Type()		  (Object)
+
+	// type->type operators
+	opElem       = 'E' // .Elem()		        (Pointer, Slice, Array, Chan, Map)
+	opKey        = 'K' // .Key()		        (Map)
+	opParams     = 'P' // .Params()		      (Signature)
+	opResults    = 'R' // .Results()	      (Signature)
+	opUnderlying = 'U' // .Underlying()	    (Named)
+	opTypeParam  = 'T' // .TypeParams.At(i) (Named, Signature)
+	opConstraint = 'C' // .Constraint()     (TypeParam)
+
+	// type->object operators
+	opAt     = 'A' // .At(i)		 (Tuple)
+	opField  = 'F' // .Field(i)	 (Struct)
+	opMethod = 'M' // .Method(i) (Named or Interface; not Struct: "promoted" names are ignored)
+	opObj    = 'O' // .Obj()		 (Named, TypeParam)
+)
+
+// For is equivalent to new(Encoder).For(obj).
+//
+// It may be more efficient to reuse a single Encoder across several calls.
+func For(obj types.Object) (Path, error) {
+	return new(Encoder).For(obj)
+}
+
+// An Encoder amortizes the cost of encoding the paths of multiple objects.
+// The zero value of an Encoder is ready to use.
+type Encoder struct {
+	scopeNamesMemo   map[*types.Scope][]string      // memoization of Scope.Names()
+	namedMethodsMemo map[*types.Named][]*types.Func // memoization of namedMethods()
+}
+
+// For returns the path to an object relative to its package,
+// or an error if the object is not accessible from the package's Scope.
+//
+// The For function guarantees to return a path only for the following objects:
+// - package-level types
+// - exported package-level non-types
+// - methods
+// - parameter and result variables
+// - struct fields
+// These objects are sufficient to define the API of their package.
+// The objects described by a package's export data are drawn from this set.
+//
+// For does not return a path for predeclared names, imported package
+// names, local names, and unexported package-level names (except
+// types).
+//
+// Example: given this definition,
+//
+//	package p
+//
+//	type T interface {
+//		f() (a string, b struct{ X int })
+//	}
+//
+// For(X) would return a path that denotes the following sequence of operations:
+//
+//	p.Scope().Lookup("T")				(TypeName T)
+//	.Type().Underlying().Method(0).			(method Func f)
+//	.Type().Results().At(1)				(field Var b)
+//	.Type().Field(0)					(field Var X)
+//
+// where p is the package (*types.Package) to which X belongs.
+func (enc *Encoder) For(obj types.Object) (Path, error) {
+	pkg := obj.Pkg()
+
+	// This table lists the cases of interest.
+	//
+	// Object				Action
+	// ------                               ------
+	// nil					reject
+	// builtin				reject
+	// pkgname				reject
+	// label				reject
+	// var
+	//    package-level			accept
+	//    func param/result			accept
+	//    local				reject
+	//    struct field			accept
+	// const
+	//    package-level			accept
+	//    local				reject
+	// func
+	//    package-level			accept
+	//    init functions			reject
+	//    concrete method			accept
+	//    interface method			accept
+	// type
+	//    package-level			accept
+	//    local				reject
+	//
+	// The only accessible package-level objects are members of pkg itself.
+	//
+	// The cases are handled in four steps:
+	//
+	// 1. reject nil and builtin
+	// 2. accept package-level objects
+	// 3. reject obviously invalid objects
+	// 4. search the API for the path to the param/result/field/method.
+
+	// 1. reference to nil or builtin?
+	if pkg == nil {
+		return "", fmt.Errorf("predeclared %s has no path", obj)
+	}
+	scope := pkg.Scope()
+
+	// 2. package-level object?
+	if scope.Lookup(obj.Name()) == obj {
+		// Only exported objects (and non-exported types) have a path.
+		// Non-exported types may be referenced by other objects.
+		if _, ok := obj.(*types.TypeName); !ok && !obj.Exported() {
+			return "", fmt.Errorf("no path for non-exported %v", obj)
+		}
+		return Path(obj.Name()), nil
+	}
+
+	// 3. Not a package-level object.
+	//    Reject obviously non-viable cases.
+	switch obj := obj.(type) {
+	case *types.TypeName:
+		if _, ok := obj.Type().(*typeparams.TypeParam); !ok {
+			// With the exception of type parameters, only package-level type names
+			// have a path.
+			return "", fmt.Errorf("no path for %v", obj)
+		}
+	case *types.Const, // Only package-level constants have a path.
+		*types.Label,   // Labels are function-local.
+		*types.PkgName: // PkgNames are file-local.
+		return "", fmt.Errorf("no path for %v", obj)
+
+	case *types.Var:
+		// Could be:
+		// - a field (obj.IsField())
+		// - a func parameter or result
+		// - a local var.
+		// Sadly there is no way to distinguish
+		// a param/result from a local
+		// so we must proceed to the find.
+
+	case *types.Func:
+		// A func, if not package-level, must be a method.
+		if recv := obj.Type().(*types.Signature).Recv(); recv == nil {
+			return "", fmt.Errorf("func is not a method: %v", obj)
+		}
+
+		if path, ok := enc.concreteMethod(obj); ok {
+			// Fast path for concrete methods that avoids looping over scope.
+			return path, nil
+		}
+
+	default:
+		panic(obj)
+	}
+
+	// 4. Search the API for the path to the var (field/param/result) or method.
+
+	// First inspect package-level named types.
+	// In the presence of path aliases, these give
+	// the best paths because non-types may
+	// refer to types, but not the reverse.
+	empty := make([]byte, 0, 48) // initial space
+	names := enc.scopeNames(scope)
+	for _, name := range names {
+		o := scope.Lookup(name)
+		tname, ok := o.(*types.TypeName)
+		if !ok {
+			continue // handle non-types in second pass
+		}
+
+		path := append(empty, name...)
+		path = append(path, opType)
+
+		T := o.Type()
+
+		if tname.IsAlias() {
+			// type alias
+			if r := find(obj, T, path, nil); r != nil {
+				return Path(r), nil
+			}
+		} else {
+			if named, _ := T.(*types.Named); named != nil {
+				if r := findTypeParam(obj, typeparams.ForNamed(named), path, nil); r != nil {
+					// generic named type
+					return Path(r), nil
+				}
+			}
+			// defined (named) type
+			if r := find(obj, T.Underlying(), append(path, opUnderlying), nil); r != nil {
+				return Path(r), nil
+			}
+		}
+	}
+
+	// Then inspect everything else:
+	// non-types, and declared methods of defined types.
+	for _, name := range names {
+		o := scope.Lookup(name)
+		path := append(empty, name...)
+		if _, ok := o.(*types.TypeName); !ok {
+			if o.Exported() {
+				// exported non-type (const, var, func)
+				if r := find(obj, o.Type(), append(path, opType), nil); r != nil {
+					return Path(r), nil
+				}
+			}
+			continue
+		}
+
+		// Inspect declared methods of defined types.
+		if T, ok := o.Type().(*types.Named); ok {
+			path = append(path, opType)
+			// Note that method index here is always with respect
+			// to canonical ordering of methods, regardless of how
+			// they appear in the underlying type.
+			for i, m := range enc.namedMethods(T) {
+				path2 := appendOpArg(path, opMethod, i)
+				if m == obj {
+					return Path(path2), nil // found declared method
+				}
+				if r := find(obj, m.Type(), append(path2, opType), nil); r != nil {
+					return Path(r), nil
+				}
+			}
+		}
+	}
+
+	return "", fmt.Errorf("can't find path for %v in %s", obj, pkg.Path())
+}
+
+func appendOpArg(path []byte, op byte, arg int) []byte {
+	path = append(path, op)
+	path = strconv.AppendInt(path, int64(arg), 10)
+	return path
+}
+
+// concreteMethod returns the path for meth, which must have a non-nil receiver.
+// The second return value indicates success and may be false if the method is
+// an interface method or if it is an instantiated method.
+//
+// This function is just an optimization that avoids the general scope walking
+// approach. You are expected to fall back to the general approach if this
+// function fails.
+func (enc *Encoder) concreteMethod(meth *types.Func) (Path, bool) {
+	// Concrete methods can only be declared on package-scoped named types. For
+	// that reason we can skip the expensive walk over the package scope: the
+	// path will always be package -> named type -> method. We can trivially get
+	// the type name from the receiver, and only have to look over the type's
+	// methods to find the method index.
+	//
+	// Methods on generic types require special consideration, however. Consider
+	// the following package:
+	//
+	// 	L1: type S[T any] struct{}
+	// 	L2: func (recv S[A]) Foo() { recv.Bar() }
+	// 	L3: func (recv S[B]) Bar() { }
+	// 	L4: type Alias = S[int]
+	// 	L5: func _[T any]() { var s S[int]; s.Foo() }
+	//
+	// The receivers of methods on generic types are instantiations. L2 and L3
+	// instantiate S with the type-parameters A and B, which are scoped to the
+	// respective methods. L4 and L5 each instantiate S with int. Each of these
+	// instantiations has its own method set, full of methods (and thus objects)
+	// with receivers whose types are the respective instantiations. In other
+	// words, we have
+	//
+	// S[A].Foo, S[A].Bar
+	// S[B].Foo, S[B].Bar
+	// S[int].Foo, S[int].Bar
+	//
+	// We may thus be trying to produce object paths for any of these objects.
+	//
+	// S[A].Foo and S[B].Bar are the origin methods, and their paths are S.Foo
+	// and S.Bar, which are the paths that this function naturally produces.
+	//
+	// S[A].Bar, S[B].Foo, and both methods on S[int] are instantiations that
+	// don't correspond to the origin methods. For S[int], this is significant.
+	// The most precise object path for S[int].Foo, for example, is Alias.Foo,
+	// not S.Foo. Our function, however, would produce S.Foo, which would
+	// resolve to a different object.
+	//
+	// For S[A].Bar and S[B].Foo it could be argued that S.Bar and S.Foo are
+	// still the correct paths, since only the origin methods have meaningful
+	// paths. But this is likely only true for trivial cases and has edge cases.
+	// Since this function is only an optimization, we err on the side of giving
+	// up, deferring to the slower but definitely correct algorithm. Most users
+	// of objectpath will only be giving us origin methods, anyway, as referring
+	// to instantiated methods is usually not useful.
+
+	if typeparams.OriginMethod(meth) != meth {
+		return "", false
+	}
+
+	recvT := meth.Type().(*types.Signature).Recv().Type()
+	if ptr, ok := recvT.(*types.Pointer); ok {
+		recvT = ptr.Elem()
+	}
+
+	named, ok := recvT.(*types.Named)
+	if !ok {
+		return "", false
+	}
+
+	if types.IsInterface(named) {
+		// Named interfaces don't have to be package-scoped
+		//
+		// TODO(dominikh): opt: if scope.Lookup(name) == named, then we can apply this optimization to interface
+		// methods, too, I think.
+		return "", false
+	}
+
+	// Preallocate space for the name, opType, opMethod, and some digits.
+	name := named.Obj().Name()
+	path := make([]byte, 0, len(name)+8)
+	path = append(path, name...)
+	path = append(path, opType)
+	for i, m := range enc.namedMethods(named) {
+		if m == meth {
+			path = appendOpArg(path, opMethod, i)
+			return Path(path), true
+		}
+	}
+
+	// Due to golang/go#59944, go/types fails to associate the receiver with
+	// certain methods on cgo types.
+	//
+	// TODO(rfindley): replace this panic once golang/go#59944 is fixed in all Go
+	// versions gopls supports.
+	return "", false
+	// panic(fmt.Sprintf("couldn't find method %s on type %s; methods: %#v", meth, named, enc.namedMethods(named)))
+}
+
+// find finds obj within type T, returning the path to it, or nil if not found.
+//
+// The seen map is used to short circuit cycles through type parameters. If
+// nil, it will be allocated as necessary.
+func find(obj types.Object, T types.Type, path []byte, seen map[*types.TypeName]bool) []byte {
+	switch T := T.(type) {
+	case *types.Basic, *types.Named:
+		// Named types belonging to pkg were handled already,
+		// so T must belong to another package. No path.
+		return nil
+	case *types.Pointer:
+		return find(obj, T.Elem(), append(path, opElem), seen)
+	case *types.Slice:
+		return find(obj, T.Elem(), append(path, opElem), seen)
+	case *types.Array:
+		return find(obj, T.Elem(), append(path, opElem), seen)
+	case *types.Chan:
+		return find(obj, T.Elem(), append(path, opElem), seen)
+	case *types.Map:
+		if r := find(obj, T.Key(), append(path, opKey), seen); r != nil {
+			return r
+		}
+		return find(obj, T.Elem(), append(path, opElem), seen)
+	case *types.Signature:
+		if r := findTypeParam(obj, typeparams.ForSignature(T), path, seen); r != nil {
+			return r
+		}
+		if r := find(obj, T.Params(), append(path, opParams), seen); r != nil {
+			return r
+		}
+		return find(obj, T.Results(), append(path, opResults), seen)
+	case *types.Struct:
+		for i := 0; i < T.NumFields(); i++ {
+			fld := T.Field(i)
+			path2 := appendOpArg(path, opField, i)
+			if fld == obj {
+				return path2 // found field var
+			}
+			if r := find(obj, fld.Type(), append(path2, opType), seen); r != nil {
+				return r
+			}
+		}
+		return nil
+	case *types.Tuple:
+		for i := 0; i < T.Len(); i++ {
+			v := T.At(i)
+			path2 := appendOpArg(path, opAt, i)
+			if v == obj {
+				return path2 // found param/result var
+			}
+			if r := find(obj, v.Type(), append(path2, opType), seen); r != nil {
+				return r
+			}
+		}
+		return nil
+	case *types.Interface:
+		for i := 0; i < T.NumMethods(); i++ {
+			m := T.Method(i)
+			path2 := appendOpArg(path, opMethod, i)
+			if m == obj {
+				return path2 // found interface method
+			}
+			if r := find(obj, m.Type(), append(path2, opType), seen); r != nil {
+				return r
+			}
+		}
+		return nil
+	case *typeparams.TypeParam:
+		name := T.Obj()
+		if name == obj {
+			return append(path, opObj)
+		}
+		if seen[name] {
+			return nil
+		}
+		if seen == nil {
+			seen = make(map[*types.TypeName]bool)
+		}
+		seen[name] = true
+		if r := find(obj, T.Constraint(), append(path, opConstraint), seen); r != nil {
+			return r
+		}
+		return nil
+	}
+	panic(T)
+}
+
+func findTypeParam(obj types.Object, list *typeparams.TypeParamList, path []byte, seen map[*types.TypeName]bool) []byte {
+	for i := 0; i < list.Len(); i++ {
+		tparam := list.At(i)
+		path2 := appendOpArg(path, opTypeParam, i)
+		if r := find(obj, tparam, path2, seen); r != nil {
+			return r
+		}
+	}
+	return nil
+}
+
+// Object returns the object denoted by path p within the package pkg.
+func Object(pkg *types.Package, p Path) (types.Object, error) {
+	if p == "" {
+		return nil, fmt.Errorf("empty path")
+	}
+
+	pathstr := string(p)
+	var pkgobj, suffix string
+	if dot := strings.IndexByte(pathstr, opType); dot < 0 {
+		pkgobj = pathstr
+	} else {
+		pkgobj = pathstr[:dot]
+		suffix = pathstr[dot:] // suffix starts with "."
+	}
+
+	obj := pkg.Scope().Lookup(pkgobj)
+	if obj == nil {
+		return nil, fmt.Errorf("package %s does not contain %q", pkg.Path(), pkgobj)
+	}
+
+	// abstraction of *types.{Pointer,Slice,Array,Chan,Map}
+	type hasElem interface {
+		Elem() types.Type
+	}
+	// abstraction of *types.{Named,Signature}
+	type hasTypeParams interface {
+		TypeParams() *typeparams.TypeParamList
+	}
+	// abstraction of *types.{Named,TypeParam}
+	type hasObj interface {
+		Obj() *types.TypeName
+	}
+
+	// The loop state is the pair (t, obj),
+	// exactly one of which is non-nil, initially obj.
+	// All suffixes start with '.' (the only object->type operation),
+	// followed by optional type->type operations,
+	// then a type->object operation.
+	// The cycle then repeats.
+	var t types.Type
+	for suffix != "" {
+		code := suffix[0]
+		suffix = suffix[1:]
+
+		// Codes [AFM] have an integer operand.
+		var index int
+		switch code {
+		case opAt, opField, opMethod, opTypeParam:
+			rest := strings.TrimLeft(suffix, "0123456789")
+			numerals := suffix[:len(suffix)-len(rest)]
+			suffix = rest
+			i, err := strconv.Atoi(numerals)
+			if err != nil {
+				return nil, fmt.Errorf("invalid path: bad numeric operand %q for code %q", numerals, code)
+			}
+			index = int(i)
+		case opObj:
+			// no operand
+		default:
+			// The suffix must end with a type->object operation.
+			if suffix == "" {
+				return nil, fmt.Errorf("invalid path: ends with %q, want [AFMO]", code)
+			}
+		}
+
+		if code == opType {
+			if t != nil {
+				return nil, fmt.Errorf("invalid path: unexpected %q in type context", opType)
+			}
+			t = obj.Type()
+			obj = nil
+			continue
+		}
+
+		if t == nil {
+			return nil, fmt.Errorf("invalid path: code %q in object context", code)
+		}
+
+		// Inv: t != nil, obj == nil
+
+		switch code {
+		case opElem:
+			hasElem, ok := t.(hasElem) // Pointer, Slice, Array, Chan, Map
+			if !ok {
+				return nil, fmt.Errorf("cannot apply %q to %s (got %T, want pointer, slice, array, chan or map)", code, t, t)
+			}
+			t = hasElem.Elem()
+
+		case opKey:
+			mapType, ok := t.(*types.Map)
+			if !ok {
+				return nil, fmt.Errorf("cannot apply %q to %s (got %T, want map)", code, t, t)
+			}
+			t = mapType.Key()
+
+		case opParams:
+			sig, ok := t.(*types.Signature)
+			if !ok {
+				return nil, fmt.Errorf("cannot apply %q to %s (got %T, want signature)", code, t, t)
+			}
+			t = sig.Params()
+
+		case opResults:
+			sig, ok := t.(*types.Signature)
+			if !ok {
+				return nil, fmt.Errorf("cannot apply %q to %s (got %T, want signature)", code, t, t)
+			}
+			t = sig.Results()
+
+		case opUnderlying:
+			named, ok := t.(*types.Named)
+			if !ok {
+				return nil, fmt.Errorf("cannot apply %q to %s (got %T, want named)", code, t, t)
+			}
+			t = named.Underlying()
+
+		case opTypeParam:
+			hasTypeParams, ok := t.(hasTypeParams) // Named, Signature
+			if !ok {
+				return nil, fmt.Errorf("cannot apply %q to %s (got %T, want named or signature)", code, t, t)
+			}
+			tparams := hasTypeParams.TypeParams()
+			if n := tparams.Len(); index >= n {
+				return nil, fmt.Errorf("tuple index %d out of range [0-%d)", index, n)
+			}
+			t = tparams.At(index)
+
+		case opConstraint:
+			tparam, ok := t.(*typeparams.TypeParam)
+			if !ok {
+				return nil, fmt.Errorf("cannot apply %q to %s (got %T, want type parameter)", code, t, t)
+			}
+			t = tparam.Constraint()
+
+		case opAt:
+			tuple, ok := t.(*types.Tuple)
+			if !ok {
+				return nil, fmt.Errorf("cannot apply %q to %s (got %T, want tuple)", code, t, t)
+			}
+			if n := tuple.Len(); index >= n {
+				return nil, fmt.Errorf("tuple index %d out of range [0-%d)", index, n)
+			}
+			obj = tuple.At(index)
+			t = nil
+
+		case opField:
+			structType, ok := t.(*types.Struct)
+			if !ok {
+				return nil, fmt.Errorf("cannot apply %q to %s (got %T, want struct)", code, t, t)
+			}
+			if n := structType.NumFields(); index >= n {
+				return nil, fmt.Errorf("field index %d out of range [0-%d)", index, n)
+			}
+			obj = structType.Field(index)
+			t = nil
+
+		case opMethod:
+			switch t := t.(type) {
+			case *types.Interface:
+				if index >= t.NumMethods() {
+					return nil, fmt.Errorf("method index %d out of range [0-%d)", index, t.NumMethods())
+				}
+				obj = t.Method(index) // Id-ordered
+
+			case *types.Named:
+				methods := namedMethods(t) // (unmemoized)
+				if index >= len(methods) {
+					return nil, fmt.Errorf("method index %d out of range [0-%d)", index, len(methods))
+				}
+				obj = methods[index] // Id-ordered
+
+			default:
+				return nil, fmt.Errorf("cannot apply %q to %s (got %T, want interface or named)", code, t, t)
+			}
+			t = nil
+
+		case opObj:
+			hasObj, ok := t.(hasObj)
+			if !ok {
+				return nil, fmt.Errorf("cannot apply %q to %s (got %T, want named or type param)", code, t, t)
+			}
+			obj = hasObj.Obj()
+			t = nil
+
+		default:
+			return nil, fmt.Errorf("invalid path: unknown code %q", code)
+		}
+	}
+
+	if obj.Pkg() != pkg {
+		return nil, fmt.Errorf("path denotes %s, which belongs to a different package", obj)
+	}
+
+	return obj, nil // success
+}
+
+// namedMethods returns the methods of a Named type in ascending Id order.
+func namedMethods(named *types.Named) []*types.Func {
+	methods := make([]*types.Func, named.NumMethods())
+	for i := range methods {
+		methods[i] = named.Method(i)
+	}
+	sort.Slice(methods, func(i, j int) bool {
+		return methods[i].Id() < methods[j].Id()
+	})
+	return methods
+}
+
+// namedMethods is a memoization of the namedMethods function. Callers must not modify the result.
+func (enc *Encoder) namedMethods(named *types.Named) []*types.Func {
+	m := enc.namedMethodsMemo
+	if m == nil {
+		m = make(map[*types.Named][]*types.Func)
+		enc.namedMethodsMemo = m
+	}
+	methods, ok := m[named]
+	if !ok {
+		methods = namedMethods(named) // allocates and sorts
+		m[named] = methods
+	}
+	return methods
+}
+
+// scopeNames is a memoization of scope.Names. Callers must not modify the result.
+func (enc *Encoder) scopeNames(scope *types.Scope) []string {
+	m := enc.scopeNamesMemo
+	if m == nil {
+		m = make(map[*types.Scope][]string)
+		enc.scopeNamesMemo = m
+	}
+	names, ok := m[scope]
+	if !ok {
+		names = scope.Names() // allocates and sorts
+		m[scope] = names
+	}
+	return names
+}
diff --git a/vendor/golang.org/x/tools/internal/gcimporter/gcimporter.go b/vendor/golang.org/x/tools/internal/gcimporter/gcimporter.go
index 0372fb3a64..a973dece93 100644
--- a/vendor/golang.org/x/tools/internal/gcimporter/gcimporter.go
+++ b/vendor/golang.org/x/tools/internal/gcimporter/gcimporter.go
@@ -7,6 +7,18 @@
 // Package gcimporter provides various functions for reading
 // gc-generated object files that can be used to implement the
 // Importer interface defined by the Go 1.5 standard library package.
+//
+// The encoding is deterministic: if the encoder is applied twice to
+// the same types.Package data structure, both encodings are equal.
+// This property may be important to avoid spurious changes in
+// applications such as build systems.
+//
+// However, the encoder is not necessarily idempotent. Importing an
+// exported package may yield a types.Package that, while it
+// represents the same set of Go types as the original, may differ in
+// the details of its internal representation. Because of these
+// differences, re-encoding the imported package may yield a
+// different, but equally valid, encoding of the package.
 package gcimporter // import "golang.org/x/tools/internal/gcimporter"
 
 import (
diff --git a/vendor/golang.org/x/tools/internal/gcimporter/iexport.go b/vendor/golang.org/x/tools/internal/gcimporter/iexport.go
index ba53cdcdd1..a0dc0b5e27 100644
--- a/vendor/golang.org/x/tools/internal/gcimporter/iexport.go
+++ b/vendor/golang.org/x/tools/internal/gcimporter/iexport.go
@@ -44,12 +44,12 @@ func IExportShallow(fset *token.FileSet, pkg *types.Package) ([]byte, error) {
 	return out.Bytes(), err
 }
 
-// IImportShallow decodes "shallow" types.Package data encoded by IExportShallow
-// in the same executable. This function cannot import data from
+// IImportShallow decodes "shallow" types.Package data encoded by
+// IExportShallow in the same executable. This function cannot import data from
 // cmd/compile or gcexportdata.Write.
-func IImportShallow(fset *token.FileSet, imports map[string]*types.Package, data []byte, path string, insert InsertType) (*types.Package, error) {
+func IImportShallow(fset *token.FileSet, getPackage GetPackageFunc, data []byte, path string, insert InsertType) (*types.Package, error) {
 	const bundle = false
-	pkgs, err := iimportCommon(fset, imports, data, bundle, path, insert)
+	pkgs, err := iimportCommon(fset, getPackage, data, bundle, path, insert)
 	if err != nil {
 		return nil, err
 	}
diff --git a/vendor/golang.org/x/tools/internal/gcimporter/iimport.go b/vendor/golang.org/x/tools/internal/gcimporter/iimport.go
index 448f903e86..be6dace153 100644
--- a/vendor/golang.org/x/tools/internal/gcimporter/iimport.go
+++ b/vendor/golang.org/x/tools/internal/gcimporter/iimport.go
@@ -85,7 +85,7 @@ const (
 // If the export data version is not recognized or the format is otherwise
 // compromised, an error is returned.
 func IImportData(fset *token.FileSet, imports map[string]*types.Package, data []byte, path string) (int, *types.Package, error) {
-	pkgs, err := iimportCommon(fset, imports, data, false, path, nil)
+	pkgs, err := iimportCommon(fset, GetPackageFromMap(imports), data, false, path, nil)
 	if err != nil {
 		return 0, nil, err
 	}
@@ -94,10 +94,33 @@ func IImportData(fset *token.FileSet, imports map[string]*types.Package, data []
 
 // IImportBundle imports a set of packages from the serialized package bundle.
 func IImportBundle(fset *token.FileSet, imports map[string]*types.Package, data []byte) ([]*types.Package, error) {
-	return iimportCommon(fset, imports, data, true, "", nil)
+	return iimportCommon(fset, GetPackageFromMap(imports), data, true, "", nil)
 }
 
-func iimportCommon(fset *token.FileSet, imports map[string]*types.Package, data []byte, bundle bool, path string, insert InsertType) (pkgs []*types.Package, err error) {
+// A GetPackageFunc is a function that gets the package with the given path
+// from the importer state, creating it (with the specified name) if necessary.
+// It is an abstraction of the map historically used to memoize package creation.
+//
+// Two calls with the same path must return the same package.
+//
+// If the given getPackage func returns nil, the import will fail.
+type GetPackageFunc = func(path, name string) *types.Package
+
+// GetPackageFromMap returns a GetPackageFunc that retrieves packages from the
+// given map of package path -> package.
+//
+// The resulting func may mutate m: if a requested package is not found, a new
+// package will be inserted into m.
+func GetPackageFromMap(m map[string]*types.Package) GetPackageFunc {
+	return func(path, name string) *types.Package {
+		if _, ok := m[path]; !ok {
+			m[path] = types.NewPackage(path, name)
+		}
+		return m[path]
+	}
+}
+
+func iimportCommon(fset *token.FileSet, getPackage GetPackageFunc, data []byte, bundle bool, path string, insert InsertType) (pkgs []*types.Package, err error) {
 	const currentVersion = iexportVersionCurrent
 	version := int64(-1)
 	if !debug {
@@ -195,10 +218,9 @@ func iimportCommon(fset *token.FileSet, imports map[string]*types.Package, data
 		if pkgPath == "" {
 			pkgPath = path
 		}
-		pkg := imports[pkgPath]
+		pkg := getPackage(pkgPath, pkgName)
 		if pkg == nil {
-			pkg = types.NewPackage(pkgPath, pkgName)
-			imports[pkgPath] = pkg
+			errorf("internal error: getPackage returned nil package for %s", pkgPath)
 		} else if pkg.Name() != pkgName {
 			errorf("conflicting names %s and %s for package %q", pkg.Name(), pkgName, path)
 		}
diff --git a/vendor/golang.org/x/tools/internal/gcimporter/ureader_yes.go b/vendor/golang.org/x/tools/internal/gcimporter/ureader_yes.go
index b285a11ce2..34fc783f82 100644
--- a/vendor/golang.org/x/tools/internal/gcimporter/ureader_yes.go
+++ b/vendor/golang.org/x/tools/internal/gcimporter/ureader_yes.go
@@ -12,6 +12,7 @@ package gcimporter
 import (
 	"go/token"
 	"go/types"
+	"sort"
 	"strings"
 
 	"golang.org/x/tools/internal/pkgbits"
@@ -121,6 +122,16 @@ func readUnifiedPackage(fset *token.FileSet, ctxt *types.Context, imports map[st
 		iface.Complete()
 	}
 
+	// Imports() of pkg are all of the transitive packages that were loaded.
+	var imps []*types.Package
+	for _, imp := range pr.pkgs {
+		if imp != nil && imp != pkg {
+			imps = append(imps, imp)
+		}
+	}
+	sort.Sort(byPath(imps))
+	pkg.SetImports(imps)
+
 	pkg.MarkComplete()
 	return pkg
 }
@@ -260,39 +271,9 @@ func (r *reader) doPkg() *types.Package {
 	pkg := types.NewPackage(path, name)
 	r.p.imports[path] = pkg
 
-	imports := make([]*types.Package, r.Len())
-	for i := range imports {
-		imports[i] = r.pkg()
-	}
-	pkg.SetImports(flattenImports(imports))
-
 	return pkg
 }
 
-// flattenImports returns the transitive closure of all imported
-// packages rooted from pkgs.
-func flattenImports(pkgs []*types.Package) []*types.Package {
-	var res []*types.Package
-	seen := make(map[*types.Package]struct{})
-	for _, pkg := range pkgs {
-		if _, ok := seen[pkg]; ok {
-			continue
-		}
-		seen[pkg] = struct{}{}
-		res = append(res, pkg)
-
-		// pkg.Imports() is already flattened.
-		for _, pkg := range pkg.Imports() {
-			if _, ok := seen[pkg]; ok {
-				continue
-			}
-			seen[pkg] = struct{}{}
-			res = append(res, pkg)
-		}
-	}
-	return res
-}
-
 // @@@ Types
 
 func (r *reader) typ() types.Type {
diff --git a/vendor/golang.org/x/tools/internal/gocommand/invoke.go b/vendor/golang.org/x/tools/internal/gocommand/invoke.go
index d50551693f..3c0afe723b 100644
--- a/vendor/golang.org/x/tools/internal/gocommand/invoke.go
+++ b/vendor/golang.org/x/tools/internal/gocommand/invoke.go
@@ -8,10 +8,12 @@ package gocommand
 import (
 	"bytes"
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"log"
 	"os"
+	"reflect"
 	"regexp"
 	"runtime"
 	"strconv"
@@ -215,6 +217,18 @@ func (i *Invocation) run(ctx context.Context, stdout, stderr io.Writer) error {
 	cmd := exec.Command("go", goArgs...)
 	cmd.Stdout = stdout
 	cmd.Stderr = stderr
+
+	// cmd.WaitDelay was added only in go1.20 (see #50436).
+	if waitDelay := reflect.ValueOf(cmd).Elem().FieldByName("WaitDelay"); waitDelay.IsValid() {
+		// https://go.dev/issue/59541: don't wait forever copying stderr
+		// after the command has exited.
+		// After CL 484741 we copy stdout manually, so we we'll stop reading that as
+		// soon as ctx is done. However, we also don't want to wait around forever
+		// for stderr. Give a much-longer-than-reasonable delay and then assume that
+		// something has wedged in the kernel or runtime.
+		waitDelay.Set(reflect.ValueOf(30 * time.Second))
+	}
+
 	// On darwin the cwd gets resolved to the real path, which breaks anything that
 	// expects the working directory to keep the original path, including the
 	// go command when dealing with modules.
@@ -229,6 +243,7 @@ func (i *Invocation) run(ctx context.Context, stdout, stderr io.Writer) error {
 		cmd.Env = append(cmd.Env, "PWD="+i.WorkingDir)
 		cmd.Dir = i.WorkingDir
 	}
+
 	defer func(start time.Time) { log("%s for %v", time.Since(start), cmdDebugStr(cmd)) }(time.Now())
 
 	return runCmdContext(ctx, cmd)
@@ -242,10 +257,85 @@ var DebugHangingGoCommands = false
 
 // runCmdContext is like exec.CommandContext except it sends os.Interrupt
 // before os.Kill.
-func runCmdContext(ctx context.Context, cmd *exec.Cmd) error {
-	if err := cmd.Start(); err != nil {
+func runCmdContext(ctx context.Context, cmd *exec.Cmd) (err error) {
+	// If cmd.Stdout is not an *os.File, the exec package will create a pipe and
+	// copy it to the Writer in a goroutine until the process has finished and
+	// either the pipe reaches EOF or command's WaitDelay expires.
+	//
+	// However, the output from 'go list' can be quite large, and we don't want to
+	// keep reading (and allocating buffers) if we've already decided we don't
+	// care about the output. We don't want to wait for the process to finish, and
+	// we don't wait to wait for the WaitDelay to expire either.
+	//
+	// Instead, if cmd.Stdout requires a copying goroutine we explicitly replace
+	// it with a pipe (which is an *os.File), which we can close in order to stop
+	// copying output as soon as we realize we don't care about it.
+	var stdoutW *os.File
+	if cmd.Stdout != nil {
+		if _, ok := cmd.Stdout.(*os.File); !ok {
+			var stdoutR *os.File
+			stdoutR, stdoutW, err = os.Pipe()
+			if err != nil {
+				return err
+			}
+			prevStdout := cmd.Stdout
+			cmd.Stdout = stdoutW
+
+			stdoutErr := make(chan error, 1)
+			go func() {
+				_, err := io.Copy(prevStdout, stdoutR)
+				if err != nil {
+					err = fmt.Errorf("copying stdout: %w", err)
+				}
+				stdoutErr <- err
+			}()
+			defer func() {
+				// We started a goroutine to copy a stdout pipe.
+				// Wait for it to finish, or terminate it if need be.
+				var err2 error
+				select {
+				case err2 = <-stdoutErr:
+					stdoutR.Close()
+				case <-ctx.Done():
+					stdoutR.Close()
+					// Per https://pkg.go.dev/os#File.Close, the call to stdoutR.Close
+					// should cause the Read call in io.Copy to unblock and return
+					// immediately, but we still need to receive from stdoutErr to confirm
+					// that that has happened.
+					<-stdoutErr
+					err2 = ctx.Err()
+				}
+				if err == nil {
+					err = err2
+				}
+			}()
+
+			// Per https://pkg.go.dev/os/exec#Cmd, “If Stdout and Stderr are the
+			// same writer, and have a type that can be compared with ==, at most
+			// one goroutine at a time will call Write.”
+			//
+			// Since we're starting a goroutine that writes to cmd.Stdout, we must
+			// also update cmd.Stderr so that that still holds.
+			func() {
+				defer func() { recover() }()
+				if cmd.Stderr == prevStdout {
+					cmd.Stderr = cmd.Stdout
+				}
+			}()
+		}
+	}
+
+	err = cmd.Start()
+	if stdoutW != nil {
+		// The child process has inherited the pipe file,
+		// so close the copy held in this process.
+		stdoutW.Close()
+		stdoutW = nil
+	}
+	if err != nil {
 		return err
 	}
+
 	resChan := make(chan error, 1)
 	go func() {
 		resChan <- cmd.Wait()
@@ -253,11 +343,14 @@ func runCmdContext(ctx context.Context, cmd *exec.Cmd) error {
 
 	// If we're interested in debugging hanging Go commands, stop waiting after a
 	// minute and panic with interesting information.
-	if DebugHangingGoCommands {
+	debug := DebugHangingGoCommands
+	if debug {
+		timer := time.NewTimer(1 * time.Minute)
+		defer timer.Stop()
 		select {
 		case err := <-resChan:
 			return err
-		case <-time.After(1 * time.Minute):
+		case <-timer.C:
 			HandleHangingGoCommand(cmd.Process)
 		case <-ctx.Done():
 		}
@@ -270,30 +363,25 @@ func runCmdContext(ctx context.Context, cmd *exec.Cmd) error {
 	}
 
 	// Cancelled. Interrupt and see if it ends voluntarily.
-	cmd.Process.Signal(os.Interrupt)
-	select {
-	case err := <-resChan:
-		return err
-	case <-time.After(time.Second):
+	if err := cmd.Process.Signal(os.Interrupt); err == nil {
+		// (We used to wait only 1s but this proved
+		// fragile on loaded builder machines.)
+		timer := time.NewTimer(5 * time.Second)
+		defer timer.Stop()
+		select {
+		case err := <-resChan:
+			return err
+		case <-timer.C:
+		}
 	}
 
 	// Didn't shut down in response to interrupt. Kill it hard.
 	// TODO(rfindley): per advice from bcmills@, it may be better to send SIGQUIT
 	// on certain platforms, such as unix.
-	if err := cmd.Process.Kill(); err != nil && DebugHangingGoCommands {
-		// Don't panic here as this reliably fails on windows with EINVAL.
+	if err := cmd.Process.Kill(); err != nil && !errors.Is(err, os.ErrProcessDone) && debug {
 		log.Printf("error killing the Go command: %v", err)
 	}
 
-	// See above: don't wait indefinitely if we're debugging hanging Go commands.
-	if DebugHangingGoCommands {
-		select {
-		case err := <-resChan:
-			return err
-		case <-time.After(10 * time.Second): // a shorter wait as resChan should return quickly following Kill
-			HandleHangingGoCommand(cmd.Process)
-		}
-	}
 	return <-resChan
 }
 
diff --git a/vendor/golang.org/x/tools/internal/gocommand/version.go b/vendor/golang.org/x/tools/internal/gocommand/version.go
index 307a76d474..446c5846a6 100644
--- a/vendor/golang.org/x/tools/internal/gocommand/version.go
+++ b/vendor/golang.org/x/tools/internal/gocommand/version.go
@@ -23,21 +23,11 @@ import (
 func GoVersion(ctx context.Context, inv Invocation, r *Runner) (int, error) {
 	inv.Verb = "list"
 	inv.Args = []string{"-e", "-f", `{{context.ReleaseTags}}`, `--`, `unsafe`}
-	inv.Env = append(append([]string{}, inv.Env...), "GO111MODULE=off")
-	// Unset any unneeded flags, and remove them from BuildFlags, if they're
-	// present.
-	inv.ModFile = ""
+	inv.BuildFlags = nil // This is not a build command.
 	inv.ModFlag = ""
-	var buildFlags []string
-	for _, flag := range inv.BuildFlags {
-		// Flags can be prefixed by one or two dashes.
-		f := strings.TrimPrefix(strings.TrimPrefix(flag, "-"), "-")
-		if strings.HasPrefix(f, "mod=") || strings.HasPrefix(f, "modfile=") {
-			continue
-		}
-		buildFlags = append(buildFlags, flag)
-	}
-	inv.BuildFlags = buildFlags
+	inv.ModFile = ""
+	inv.Env = append(inv.Env[:len(inv.Env):len(inv.Env)], "GO111MODULE=off")
+
 	stdoutBytes, err := r.Run(ctx, inv)
 	if err != nil {
 		return 0, err
diff --git a/vendor/golang.org/x/tools/internal/tokeninternal/tokeninternal.go b/vendor/golang.org/x/tools/internal/tokeninternal/tokeninternal.go
index a3fb2d4f29..7e638ec24f 100644
--- a/vendor/golang.org/x/tools/internal/tokeninternal/tokeninternal.go
+++ b/vendor/golang.org/x/tools/internal/tokeninternal/tokeninternal.go
@@ -7,7 +7,9 @@
 package tokeninternal
 
 import (
+	"fmt"
 	"go/token"
+	"sort"
 	"sync"
 	"unsafe"
 )
@@ -57,3 +59,93 @@ func GetLines(file *token.File) []int {
 		panic("unexpected token.File size")
 	}
 }
+
+// AddExistingFiles adds the specified files to the FileSet if they
+// are not already present. It panics if any pair of files in the
+// resulting FileSet would overlap.
+func AddExistingFiles(fset *token.FileSet, files []*token.File) {
+	// Punch through the FileSet encapsulation.
+	type tokenFileSet struct {
+		// This type remained essentially consistent from go1.16 to go1.21.
+		mutex sync.RWMutex
+		base  int
+		files []*token.File
+		_     *token.File // changed to atomic.Pointer[token.File] in go1.19
+	}
+
+	// If the size of token.FileSet changes, this will fail to compile.
+	const delta = int64(unsafe.Sizeof(tokenFileSet{})) - int64(unsafe.Sizeof(token.FileSet{}))
+	var _ [-delta * delta]int
+
+	type uP = unsafe.Pointer
+	var ptr *tokenFileSet
+	*(*uP)(uP(&ptr)) = uP(fset)
+	ptr.mutex.Lock()
+	defer ptr.mutex.Unlock()
+
+	// Merge and sort.
+	newFiles := append(ptr.files, files...)
+	sort.Slice(newFiles, func(i, j int) bool {
+		return newFiles[i].Base() < newFiles[j].Base()
+	})
+
+	// Reject overlapping files.
+	// Discard adjacent identical files.
+	out := newFiles[:0]
+	for i, file := range newFiles {
+		if i > 0 {
+			prev := newFiles[i-1]
+			if file == prev {
+				continue
+			}
+			if prev.Base()+prev.Size()+1 > file.Base() {
+				panic(fmt.Sprintf("file %s (%d-%d) overlaps with file %s (%d-%d)",
+					prev.Name(), prev.Base(), prev.Base()+prev.Size(),
+					file.Name(), file.Base(), file.Base()+file.Size()))
+			}
+		}
+		out = append(out, file)
+	}
+	newFiles = out
+
+	ptr.files = newFiles
+
+	// Advance FileSet.Base().
+	if len(newFiles) > 0 {
+		last := newFiles[len(newFiles)-1]
+		newBase := last.Base() + last.Size() + 1
+		if ptr.base < newBase {
+			ptr.base = newBase
+		}
+	}
+}
+
+// FileSetFor returns a new FileSet containing a sequence of new Files with
+// the same base, size, and line as the input files, for use in APIs that
+// require a FileSet.
+//
+// Precondition: the input files must be non-overlapping, and sorted in order
+// of their Base.
+func FileSetFor(files ...*token.File) *token.FileSet {
+	fset := token.NewFileSet()
+	for _, f := range files {
+		f2 := fset.AddFile(f.Name(), f.Base(), f.Size())
+		lines := GetLines(f)
+		f2.SetLines(lines)
+	}
+	return fset
+}
+
+// CloneFileSet creates a new FileSet holding all files in fset. It does not
+// create copies of the token.Files in fset: they are added to the resulting
+// FileSet unmodified.
+func CloneFileSet(fset *token.FileSet) *token.FileSet {
+	var files []*token.File
+	fset.Iterate(func(f *token.File) bool {
+		files = append(files, f)
+		return true
+	})
+	newFileSet := token.NewFileSet()
+	AddExistingFiles(newFileSet, files)
+	return newFileSet
+}
diff --git a/vendor/golang.org/x/tools/internal/typeparams/common.go b/vendor/golang.org/x/tools/internal/typeparams/common.go
index 25a1426d30..cfba8189f1 100644
--- a/vendor/golang.org/x/tools/internal/typeparams/common.go
+++ b/vendor/golang.org/x/tools/internal/typeparams/common.go
@@ -87,7 +87,6 @@ func IsTypeParam(t types.Type) bool {
 func OriginMethod(fn *types.Func) *types.Func {
 	recv := fn.Type().(*types.Signature).Recv()
 	if recv == nil {
-
 		return fn
 	}
 	base := recv.Type()
diff --git a/vendor/golang.org/x/tools/internal/typesinternal/types.go b/vendor/golang.org/x/tools/internal/typesinternal/types.go
index ce7d4351b2..3c53fbc63b 100644
--- a/vendor/golang.org/x/tools/internal/typesinternal/types.go
+++ b/vendor/golang.org/x/tools/internal/typesinternal/types.go
@@ -11,6 +11,8 @@ import (
 	"go/types"
 	"reflect"
 	"unsafe"
+
+	"golang.org/x/tools/go/types/objectpath"
 )
 
 func SetUsesCgo(conf *types.Config) bool {
@@ -50,3 +52,10 @@ func ReadGo116ErrorData(err types.Error) (code ErrorCode, start, end token.Pos,
 }
 
 var SetGoVersion = func(conf *types.Config, version string) bool { return false }
+
+// NewObjectpathEncoder returns a function closure equivalent to
+// objectpath.For but amortized for multiple (sequential) calls.
+// It is a temporary workaround, pending the approval of proposal 58668.
+//
+//go:linkname NewObjectpathFunc golang.org/x/tools/go/types/objectpath.newEncoderFor
+func NewObjectpathFunc() func(types.Object) (objectpath.Path, error)
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 889c07a233..9278617c21 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -14,10 +14,12 @@ github.com/BurntSushi/toml/internal
 # github.com/Masterminds/semver/v3 v3.2.0
 ## explicit; go 1.18
 github.com/Masterminds/semver/v3
-# github.com/Microsoft/go-winio v0.6.0
+# github.com/Microsoft/go-winio v0.6.1
 ## explicit; go 1.17
 github.com/Microsoft/go-winio
+github.com/Microsoft/go-winio/internal/fs
 github.com/Microsoft/go-winio/internal/socket
+github.com/Microsoft/go-winio/internal/stringbuffer
 github.com/Microsoft/go-winio/pkg/guid
 # github.com/ProtonMail/go-crypto v0.0.0-20230217124315-7d5c6f04bbb8
 ## explicit; go 1.13
@@ -91,10 +93,11 @@ github.com/cloudflare/circl/math/mlsbset
 github.com/cloudflare/circl/sign
 github.com/cloudflare/circl/sign/ed25519
 github.com/cloudflare/circl/sign/ed448
-# github.com/containers/gvisor-tap-vsock v0.5.0
+# github.com/containers/gvisor-tap-vsock v0.6.2-0.20230609094134-b79db04d368e
 ## explicit; go 1.18
 github.com/containers/gvisor-tap-vsock/pkg/client
 github.com/containers/gvisor-tap-vsock/pkg/fs
+github.com/containers/gvisor-tap-vsock/pkg/net/stdio
 github.com/containers/gvisor-tap-vsock/pkg/services/dhcp
 github.com/containers/gvisor-tap-vsock/pkg/services/dns
 github.com/containers/gvisor-tap-vsock/pkg/services/forwarder
@@ -280,7 +283,7 @@ github.com/fsnotify/fsnotify
 github.com/ghodss/yaml
 # github.com/gin-gonic/gin v1.9.1
 ## explicit; go 1.20
-# github.com/go-logr/logr v1.2.3
+# github.com/go-logr/logr v1.2.4
 ## explicit; go 1.16
 github.com/go-logr/logr
 github.com/go-logr/logr/funcr
@@ -325,7 +328,7 @@ github.com/go-openapi/swag
 # github.com/go-openapi/validate v0.22.0
 ## explicit; go 1.14
 github.com/go-openapi/validate
-# github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0
+# github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572
 ## explicit; go 1.13
 github.com/go-task/slim-sprig
 # github.com/godbus/dbus/v5 v5.1.0
@@ -338,7 +341,7 @@ github.com/gofrs/uuid
 ## explicit; go 1.15
 github.com/gogo/protobuf/proto
 github.com/gogo/protobuf/sortkeys
-# github.com/golang/protobuf v1.5.2
+# github.com/golang/protobuf v1.5.3
 ## explicit; go 1.9
 github.com/golang/protobuf/jsonpb
 github.com/golang/protobuf/proto
@@ -504,17 +507,17 @@ github.com/mattn/go-isatty
 # github.com/mattn/go-runewidth v0.0.14
 ## explicit; go 1.9
 github.com/mattn/go-runewidth
-# github.com/mdlayher/socket v0.4.0
-## explicit; go 1.18
+# github.com/mdlayher/socket v0.4.1
+## explicit; go 1.20
 github.com/mdlayher/socket
-# github.com/mdlayher/vsock v1.2.0
-## explicit; go 1.18
+# github.com/mdlayher/vsock v1.2.1
+## explicit; go 1.20
 github.com/mdlayher/vsock
 # github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d
 ## explicit
 github.com/mgutz/ansi
-# github.com/miekg/dns v1.1.50
-## explicit; go 1.14
+# github.com/miekg/dns v1.1.54
+## explicit; go 1.19
 github.com/miekg/dns
 # github.com/miekg/pkcs11 v1.1.1
 ## explicit; go 1.12
@@ -541,7 +544,7 @@ github.com/munnerz/goautoneg
 # github.com/oklog/ulid v1.3.1
 ## explicit
 github.com/oklog/ulid
-# github.com/onsi/ginkgo/v2 v2.8.3
+# github.com/onsi/ginkgo/v2 v2.9.7
 ## explicit; go 1.18
 github.com/onsi/ginkgo/v2
 github.com/onsi/ginkgo/v2/config
@@ -563,7 +566,7 @@ github.com/onsi/ginkgo/v2/internal/parallel_support
 github.com/onsi/ginkgo/v2/internal/testingtproxy
 github.com/onsi/ginkgo/v2/reporters
 github.com/onsi/ginkgo/v2/types
-# github.com/onsi/gomega v1.27.1
+# github.com/onsi/gomega v1.27.8
 ## explicit; go 1.18
 github.com/onsi/gomega
 github.com/onsi/gomega/format
@@ -672,7 +675,7 @@ github.com/sigstore/sigstore/pkg/cryptoutils
 github.com/sigstore/sigstore/pkg/signature
 github.com/sigstore/sigstore/pkg/signature/options
 github.com/sigstore/sigstore/pkg/signature/payload
-# github.com/sirupsen/logrus v1.9.0
+# github.com/sirupsen/logrus v1.9.3
 ## explicit; go 1.13
 github.com/sirupsen/logrus
 # github.com/spf13/afero v1.9.3
@@ -709,7 +712,7 @@ github.com/stefanberger/go-pkcs11uri
 # github.com/stretchr/objx v0.5.0
 ## explicit; go 1.12
 github.com/stretchr/objx
-# github.com/stretchr/testify v1.8.3
+# github.com/stretchr/testify v1.8.4
 ## explicit; go 1.20
 github.com/stretchr/testify/assert
 github.com/stretchr/testify/mock
@@ -805,7 +808,7 @@ golang.org/x/crypto/sha3
 golang.org/x/crypto/ssh
 golang.org/x/crypto/ssh/internal/bcrypt_pbkdf
 golang.org/x/crypto/ssh/knownhosts
-# golang.org/x/mod v0.8.0
+# golang.org/x/mod v0.10.0
 ## explicit; go 1.17
 golang.org/x/mod/semver
 # golang.org/x/net v0.10.0
@@ -831,7 +834,7 @@ golang.org/x/net/trace
 ## explicit; go 1.17
 golang.org/x/oauth2
 golang.org/x/oauth2/internal
-# golang.org/x/sync v0.1.0
+# golang.org/x/sync v0.2.0
 ## explicit
 golang.org/x/sync/errgroup
 golang.org/x/sync/semaphore
@@ -873,13 +876,14 @@ golang.org/x/text/width
 # golang.org/x/time v0.2.0
 ## explicit
 golang.org/x/time/rate
-# golang.org/x/tools v0.6.0
+# golang.org/x/tools v0.9.1
 ## explicit; go 1.18
 golang.org/x/tools/cmd/stringer
 golang.org/x/tools/go/ast/inspector
 golang.org/x/tools/go/gcexportdata
 golang.org/x/tools/go/internal/packagesdriver
 golang.org/x/tools/go/packages
+golang.org/x/tools/go/types/objectpath
 golang.org/x/tools/internal/event
 golang.org/x/tools/internal/event/core
 golang.org/x/tools/internal/event/keys