diff --git a/.github/workflows/pr-dependabot.yaml b/.github/workflows/pr-dependabot.yaml
index 95a4245721..3c0ff45055 100644
--- a/.github/workflows/pr-dependabot.yaml
+++ b/.github/workflows/pr-dependabot.yaml
@@ -20,15 +20,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Check out code into the Go module directory
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # tag=v7.0.1
     - name: Calculate go version
       id: vars
       run: echo "go_version=$(make go-version)" >> $GITHUB_OUTPUT
     - name: Set up Go
-      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # tag=v6.4.0
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # tag=v7.0.0
       with:
         go-version: ${{ steps.vars.outputs.go_version }}
-    - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # tag=v5.0.5
+    - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # tag=v6.1.0
       name: Restore go cache
       with:
         path: |
diff --git a/.github/workflows/pr-link-check.yaml b/.github/workflows/pr-link-check.yaml
index 5c8dc1678e..43e11b4e44 100644
--- a/.github/workflows/pr-link-check.yaml
+++ b/.github/workflows/pr-link-check.yaml
@@ -16,7 +16,7 @@ jobs:
 
     steps:
     - name: Clone repository
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 0
         ref: ${{github.event.pull_request.head.ref}}
@@ -46,7 +46,7 @@ jobs:
 
     - name: Check links in changed files
       if: env.foundFiles == 'true'
-      uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2.8.0
+      uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2.9.0
       with:
         failIfEmpty: false
         args: |
diff --git a/.github/workflows/pr-verifer.yml b/.github/workflows/pr-verifer.yml
index b209b1daa3..4eba215800 100644
--- a/.github/workflows/pr-verifer.yml
+++ b/.github/workflows/pr-verifer.yml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Check out repository
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Validate PR Title
       env:
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 4866fe3c0c..21a8168dc2 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -20,7 +20,7 @@ jobs:
     if: github.repository == 'kubernetes-sigs/cluster-api-provider-openstack'
     steps:
     - name: Checkout code
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # tag=v7.0.1
       with:
         fetch-depth: 0
     - name: Get changed files
@@ -90,14 +90,14 @@ jobs:
       env:
         RELEASE_TAG: ${{needs.push_release_tags.outputs.release_tag}}
     - name: checkout code
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # tag=v7.0.1
       with:
         fetch-depth: 0
         ref: ${{ env.RELEASE_TAG }}
     - name: Calculate go version
       run: echo "go_version=$(make go-version)" >> ${GITHUB_ENV}
     - name: Set up Go
-      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # tag=v6.4.0
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # tag=v7.0.0
       with:
         go-version: ${{ env.go_version }}
     - name: generate release artifacts
@@ -110,7 +110,7 @@ jobs:
         curl -L "https://raw.githubusercontent.com/${{ github.repository }}/main/releasenotes/${{ env.RELEASE_TAG }}.md" \
         -o "${{ env.RELEASE_TAG }}.md"
     - name: Release
-      uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # tag=v3.0.0
+      uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # tag=v3.0.2
       with:
         draft: true
         files: out/*
diff --git a/.github/workflows/security-scan.yaml b/.github/workflows/security-scan.yaml
index 99cb913aaf..06ed68b57d 100644
--- a/.github/workflows/security-scan.yaml
+++ b/.github/workflows/security-scan.yaml
@@ -18,14 +18,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Check out code
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # tag=v7.0.1
       with:
         ref: ${{ matrix.branch }}
     - name: Calculate go version
       id: vars
       run: echo "go_version=$(make go-version)" >> $GITHUB_OUTPUT
     - name: Set up Go
-      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # tag=v6.4.0
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # tag=v7.0.0
       with:
         go-version: ${{ steps.vars.outputs.go_version }}
     - name: Run verify security target
diff --git a/.github/workflows/update-golangci-lint.yaml b/.github/workflows/update-golangci-lint.yaml
index facda3311b..54d056f00c 100644
--- a/.github/workflows/update-golangci-lint.yaml
+++ b/.github/workflows/update-golangci-lint.yaml
@@ -18,7 +18,7 @@ jobs:
       current_version: ${{ steps.check_version.outputs.current_version }}
     steps:
     - name: Checkout repository
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 0
     - name: Get latest golangci-lint version
diff --git a/.github/workflows/yamllint.yaml b/.github/workflows/yamllint.yaml
index 9ecf6e1658..d9c5992ee2 100644
--- a/.github/workflows/yamllint.yaml
+++ b/.github/workflows/yamllint.yaml
@@ -14,7 +14,7 @@ jobs:
     - name: Install yamllint
       run: sudo apt-get update && sudo apt-get install -y yamllint
 
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: yaml-lint
       run: yamllint -c .yamllint.yaml .
diff --git a/.govuln_exclude b/.govuln_exclude
new file mode 100644
index 0000000000..0aa6eeebba
--- /dev/null
+++ b/.govuln_exclude
@@ -0,0 +1,7 @@
+# Requires a go version bump to fix (golang.org/x/net >= v0.55.0).
+# These vulnerabilities require a compromised OpenStack or Kubernetes API
+# server to exploit, which is not something we defend against.
+# https://pkg.go.dev/vuln/GO-2026-5026
+GO-2026-5026
+# https://pkg.go.dev/vuln/GO-2026-4918
+GO-2026-4918
diff --git a/Dockerfile b/Dockerfile
index 182f423e4c..6f05b98752 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -14,7 +14,7 @@
 
 # Build the manager binary
 ARG GO_VERSION
-FROM golang:${GO_VERSION:-1.25.9} AS builder
+FROM golang:${GO_VERSION:-1.25.12} AS builder
 WORKDIR /workspace
 
 # Run this with docker build --build_arg goproxy=$(go env GOPROXY) to override the goproxy
diff --git a/Makefile b/Makefile
index 6ecf46333b..7ff742073e 100644
--- a/Makefile
+++ b/Makefile
@@ -27,7 +27,7 @@ unexport GOPATH
 TRACE ?= 0
 
 # Go
-GO_VERSION ?= 1.25.9
+GO_VERSION ?= 1.25.12
 
 # Ensure correct toolchain is used
 GOTOOLCHAIN = go$(GO_VERSION)
@@ -57,9 +57,10 @@ GO_APIDIFF_BIN := go-apidiff
 GO_APIDIFF_PKG := github.com/joelanford/go-apidiff
 
 # govulncheck
-GOVULNCHECK_VER := v1.1.4
+GOVULNCHECK_VER := v1.3.0
 GOVULNCHECK_BIN := govulncheck
-GOVULNCHECK_PKG := golang.org/x/vuln/cmd/govulncheck
+GOVULNCHECK_DIR := hack/tools/govulncheck
+GOVULNCHECK_TMP_DIR ?= $(GOVULNCHECK_DIR)/govulncheck.tmp
 
 TRIVY_VER := 0.69.3
 
@@ -81,7 +82,7 @@ RELEASE_NOTES := $(TOOLS_BIN_DIR)/release-notes
 SETUP_ENVTEST := $(TOOLS_BIN_DIR)/setup-envtest
 GEN_CRD_API_REFERENCE_DOCS := $(TOOLS_BIN_DIR)/gen-crd-api-reference-docs
 GO_APIDIFF := $(TOOLS_BIN_DIR)/$(GO_APIDIFF_BIN)-$(GO_APIDIFF_VER)
-GOVULNCHECK := $(TOOLS_BIN_DIR)/$(GOVULNCHECK_BIN)-$(GOVULNCHECK_VER)
+GOVULNCHECK := $(abspath $(TOOLS_BIN_DIR)/$(GOVULNCHECK_BIN))
 
 # Kubebuilder
 export KUBEBUILDER_ENVTEST_KUBERNETES_VERSION ?= 1.28.0
@@ -276,8 +277,26 @@ $(GO_APIDIFF): # Build go-apidiff.
 .PHONY: $(GOVULNCHECK_BIN)
 $(GOVULNCHECK_BIN): $(GOVULNCHECK) ## Build a local copy of govulncheck.
 
-$(GOVULNCHECK): # Build govulncheck.
-	GOBIN=$(abspath $(TOOLS_BIN_DIR)) $(GO_INSTALL) $(GOVULNCHECK_PKG) $(GOVULNCHECK_BIN) $(GOVULNCHECK_VER)
+$(GOVULNCHECK): # Build govulncheck from source with exclusion patch.
+	@if [ -d "$(GOVULNCHECK_TMP_DIR)" ]; then \
+		echo "$(GOVULNCHECK_TMP_DIR) exists, skipping clone"; \
+	else \
+		git clone "https://github.com/golang/vuln.git" "$(GOVULNCHECK_TMP_DIR)"; \
+		cd "$(GOVULNCHECK_TMP_DIR)"; \
+		git checkout "$(GOVULNCHECK_VER)"; \
+		git apply "$(REPO_ROOT)/$(GOVULNCHECK_DIR)/govulncheck.patch"; \
+	fi
+	@cd "$(REPO_ROOT)/$(GOVULNCHECK_TMP_DIR)"; \
+	if [ "$$(git describe --tag 2> /dev/null)" != "$(GOVULNCHECK_VER)" ]; then \
+		echo "ERROR: checked out version does not match expected version $(GOVULNCHECK_VER)"; \
+		exit 1; \
+	fi
+	@rm -f $(GOVULNCHECK)
+	go build -C "$(REPO_ROOT)/$(GOVULNCHECK_TMP_DIR)" -o $(GOVULNCHECK) ./cmd/govulncheck
+
+.PHONY: clean-govulncheck
+clean-govulncheck:
+	rm -fr "$(GOVULNCHECK_TMP_DIR)"
 
 ## --------------------------------------
 ##@ Linting
@@ -691,11 +710,7 @@ verify-container-images: ## Verify container images
 
 .PHONY: verify-govulncheck
 verify-govulncheck: $(GOVULNCHECK) ## Verify code for vulnerabilities
-	$(GOVULNCHECK) $(GOVULNCHECK_ARGS) ./... && R1=$$? || R1=$$?; \
-	$(GOVULNCHECK) $(GOVULNCHECK_ARGS) -C "$(TOOLS_DIR)" ./... && R2=$$? || R2=$$?; \
-	if [ "$$R1" -ne "0" ] || [ "$$R2" -ne "0" ]; then \
-		exit 1; \
-	fi
+	$(GOVULNCHECK) $(GOVULNCHECK_ARGS) ./...
 
 .PHONY: verify-security
 verify-security: ## Verify code and images for vulnerabilities
diff --git a/cloudbuild-nightly.yaml b/cloudbuild-nightly.yaml
index 9c1b180ef1..a00c3a1dd6 100644
--- a/cloudbuild-nightly.yaml
+++ b/cloudbuild-nightly.yaml
@@ -4,7 +4,7 @@ options:
   substitution_option: ALLOW_LOOSE
   machineType: 'N1_HIGHCPU_8'
 steps:
-- name: 'gcr.io/k8s-staging-test-infra/gcb-docker-gcloud@sha256:8d6a3a5b895e6776dbe9115b75db1412fbe57299b8db329d45cb54680e462b0b' # v20251211-4c812d4cd8
+- name: 'gcr.io/k8s-staging-test-infra/gcb-docker-gcloud@sha256:ff388e0dc16351e96f8464e2e185b74a7578a5ccb7a112cf3393468e59e6e2d2' # v20260205-38cfa9523f
   entrypoint: make
   env:
   - DOCKER_CLI_EXPERIMENTAL=enabled
diff --git a/cloudbuild.yaml b/cloudbuild.yaml
index c4bc43f9f2..35d2ddce2a 100644
--- a/cloudbuild.yaml
+++ b/cloudbuild.yaml
@@ -8,7 +8,7 @@ steps:
 # docker run --rm -it -v $(pwd):/workspace gcr.io/k8s-staging-test-infra/gcb-docker-gcloud:${TAG}
 # make clean # make sure we have something to build
 # make staging-manifests
-- name: 'gcr.io/k8s-staging-test-infra/gcb-docker-gcloud@sha256:8d6a3a5b895e6776dbe9115b75db1412fbe57299b8db329d45cb54680e462b0b' # v20251211-4c812d4cd8
+- name: 'gcr.io/k8s-staging-test-infra/gcb-docker-gcloud@sha256:ff388e0dc16351e96f8464e2e185b74a7578a5ccb7a112cf3393468e59e6e2d2' # v20260205-38cfa9523f
   entrypoint: make
   env:
   - DOCKER_CLI_EXPERIMENTAL=enabled
diff --git a/go.mod b/go.mod
index d0b136011e..1339d4e3af 100644
--- a/go.mod
+++ b/go.mod
@@ -4,7 +4,7 @@ go 1.24.0
 
 require (
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
-	github.com/go-logr/logr v1.4.3
+	github.com/go-logr/logr v1.4.4
 	github.com/google/go-cmp v0.7.0
 	github.com/google/gofuzz v1.2.0
 	github.com/google/uuid v1.6.0
@@ -12,27 +12,27 @@ require (
 	github.com/gophercloud/utils/v2 v2.0.0-20241220104409-2e0af06694a1
 	github.com/hashicorp/go-version v1.9.0
 	github.com/k-orc/openstack-resource-controller/v2 v2.4.0
-	github.com/onsi/ginkgo/v2 v2.28.1
-	github.com/onsi/gomega v1.39.1
+	github.com/onsi/ginkgo/v2 v2.28.2
+	github.com/onsi/gomega v1.42.0
 	github.com/prometheus/client_golang v1.23.2
 	github.com/spf13/pflag v1.0.10
 	go.uber.org/mock v0.6.0
 	golang.org/x/crypto v0.48.0
 	golang.org/x/text v0.34.0
-	gopkg.in/ini.v1 v1.67.1
-	k8s.io/api v0.34.7
-	k8s.io/apiextensions-apiserver v0.34.7
-	k8s.io/apimachinery v0.34.7
-	k8s.io/client-go v0.34.7
-	k8s.io/code-generator v0.34.7
-	k8s.io/component-base v0.34.7
+	gopkg.in/ini.v1 v1.67.3
+	k8s.io/api v0.34.9
+	k8s.io/apiextensions-apiserver v0.34.9
+	k8s.io/apimachinery v0.34.10
+	k8s.io/client-go v0.34.9
+	k8s.io/code-generator v0.34.9
+	k8s.io/component-base v0.34.9
 	k8s.io/klog/v2 v2.130.1
 	k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b
 	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397
-	sigs.k8s.io/cluster-api v1.12.7
-	sigs.k8s.io/cluster-api/test v1.12.7
+	sigs.k8s.io/cluster-api v1.12.10
+	sigs.k8s.io/cluster-api/test v1.12.10
 	sigs.k8s.io/controller-runtime v0.22.5
-	sigs.k8s.io/structured-merge-diff/v6 v6.4.0
+	sigs.k8s.io/structured-merge-diff/v6 v6.4.2
 	sigs.k8s.io/yaml v1.6.0
 )
 
@@ -153,11 +153,11 @@ require (
 	google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 // indirect
 	google.golang.org/grpc v1.79.3 // indirect
-	google.golang.org/protobuf v1.36.11 // indirect
+	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/apiserver v0.34.7 // indirect
+	k8s.io/apiserver v0.34.9 // indirect
 	k8s.io/cluster-bootstrap v0.34.2 // indirect
 	k8s.io/gengo/v2 v2.0.0-20250604051438-85fd79dbfd9f // indirect
 	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 // indirect
diff --git a/go.sum b/go.sum
index f0b9bcbbbd..54030f70b6 100644
--- a/go.sum
+++ b/go.sum
@@ -42,8 +42,8 @@ github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151X
 github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
 github.com/coredns/caddy v1.1.1 h1:2eYKZT7i6yxIfGP3qLJoJ7HAsDJqYB+X68g4NYjSrE0=
 github.com/coredns/caddy v1.1.1/go.mod h1:A6ntJQlAWuQfFlsd9hvigKbo2WS0VUs2l1e2F+BawD4=
-github.com/coredns/corefile-migration v1.0.31 h1:f7WGhY8M2Jn8P2dVO0p7wSQ1QKsMARl6WEyUjCb/V38=
-github.com/coredns/corefile-migration v1.0.31/go.mod h1:56DPqONc3njpVPsdilEnfijCwNGC3/kTJLl7i7SPavY=
+github.com/coredns/corefile-migration v1.0.32 h1:tlbtXBpt7UzmedEoMqnfqOTnGCvzYfJ/Rrfqf+/W+TY=
+github.com/coredns/corefile-migration v1.0.32/go.mod h1:56DPqONc3njpVPsdilEnfijCwNGC3/kTJLl7i7SPavY=
 github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=
 github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
 github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf h1:iW4rZ826su+pqaw19uhpSCzhj44qo35pNgKFGqzDKkU=
@@ -86,8 +86,8 @@ github.com/gkampitakis/go-diff v1.3.2/go.mod h1:LLgOrpqleQe26cte8s36HTWcTmMEur6O
 github.com/gkampitakis/go-snaps v0.5.15 h1:amyJrvM1D33cPHwVrjo9jQxX8g/7E2wYdZ+01KS3zGE=
 github.com/gkampitakis/go-snaps v0.5.15/go.mod h1:HNpx/9GoKisdhw9AFOBT1N7DBs9DiHo/hGheFGBZ+mc=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
@@ -210,10 +210,10 @@ github.com/olekukonko/ll v0.1.1 h1:9Dfeed5/Mgaxb9lHRAftLK9pVfYETvHn+If6lywVhJc=
 github.com/olekukonko/ll v0.1.1/go.mod h1:2dJo+hYZcJMLMbKwHEWvxCUbAOLc/CXWS9noET22Mdo=
 github.com/olekukonko/tablewriter v1.0.9 h1:XGwRsYLC2bY7bNd93Dk51bcPZksWZmLYuaTHR0FqfL8=
 github.com/olekukonko/tablewriter v1.0.9/go.mod h1:5c+EBPeSqvXnLLgkm9isDdzR3wjfBkHR9Nhfp3NWrzo=
-github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI=
-github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE=
-github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=
-github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg=
+github.com/onsi/ginkgo/v2 v2.28.2 h1:DTrMfpqxiNUyQ3Y0zhn1n3cOO2euFgQPYIpkWwxVFps=
+github.com/onsi/ginkgo/v2 v2.28.2/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE=
+github.com/onsi/gomega v1.42.0 h1:CJby8u36xb7v34W78F8WKvqTQP7PCMIPB78IVDB73l4=
+github.com/onsi/gomega v1.42.0/go.mod h1:M/Uqpu/8qTjtzCLUA2zJHX9Iilrau25x1PdoSRbWh5A=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
@@ -396,8 +396,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 h1:
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ=
 google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=
 google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
-google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
-google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI=
+google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
@@ -405,29 +405,29 @@ gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSP
 gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
-gopkg.in/ini.v1 v1.67.1 h1:tVBILHy0R6e4wkYOn3XmiITt/hEVH4TFMYvAX2Ytz6k=
-gopkg.in/ini.v1 v1.67.1/go.mod h1:x/cyOwCgZqOkJoDIJ3c1KNHMo10+nLGAhh+kn3Zizss=
+gopkg.in/ini.v1 v1.67.3 h1:iM9Lhz5MRSGhHVGGwCuzG9KO8PoirCXj/m/qTmOJJQw=
+gopkg.in/ini.v1 v1.67.3/go.mod h1:x/cyOwCgZqOkJoDIJ3c1KNHMo10+nLGAhh+kn3Zizss=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
 gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
-k8s.io/api v0.34.7 h1:186BQYhLYaaU0jhC4/uC3s4cQ+YSk0BlazRnEldXiqY=
-k8s.io/api v0.34.7/go.mod h1:2qet0m0IfHSwXp+RLnunTWADUjy6qaXDa4PdeUnTJ9s=
-k8s.io/apiextensions-apiserver v0.34.7 h1:eGo48CGcmTAscn00wumFbo73UWav7jGAht2f1XdNPGQ=
-k8s.io/apiextensions-apiserver v0.34.7/go.mod h1:rtx7XxaKq0ZH/9/wWQgA0J4HQqCAnQMwdaMJGmpGwxE=
-k8s.io/apimachinery v0.34.7 h1:nkAtvxByvBFSyIyOTrFKcy6pgQ4G1NCKsypWArLdNSY=
-k8s.io/apimachinery v0.34.7/go.mod h1:z7dd12Xd400CXIycE8nmn32xZhApV9zskHs0A5xeU/Q=
-k8s.io/apiserver v0.34.7 h1:G0JG/NTBN+FDYxF9r15dmj7vA8Gn3QH06kg8un9N+6c=
-k8s.io/apiserver v0.34.7/go.mod h1:7+me/mC1L/BRkb7MbUwUpppl/BNodyt28bgVmytocrs=
-k8s.io/client-go v0.34.7 h1:zxksYcHi4DMv6HfjMbHTfcV3jYZh7BY3yH18maoRxsA=
-k8s.io/client-go v0.34.7/go.mod h1:GS3K60t9FI20+l3cvB/EfDXyD+JoKr3suIjSGISQLDc=
+k8s.io/api v0.34.9 h1:aVsK5NQL7146suJriGuvpi9giNpwIRSHJ8v5HWakwBo=
+k8s.io/api v0.34.9/go.mod h1:8oYqD5tLKgvBSnkuDbHZTNrk7NTHybkfYjJ6lNjThjQ=
+k8s.io/apiextensions-apiserver v0.34.9 h1:I+VcEFLE/6ueQw3v1OxPslTHD6AiGQJ1M4cUxtYelII=
+k8s.io/apiextensions-apiserver v0.34.9/go.mod h1:z+ylpz3sT+7C+H9jTTfCNR7khCMPDyZVIgvvga79uYc=
+k8s.io/apimachinery v0.34.10 h1:2TkKKtyUGjkdf1fTNEoANuv46QXFIi6UfMfrMxJ9Glg=
+k8s.io/apimachinery v0.34.10/go.mod h1:gCxm98KdKjmJKLtGA2OQOIGmb3tY/csRmlQSymG3tLw=
+k8s.io/apiserver v0.34.9 h1:isiEW5L0OeGi4oDvyLl+cXzKvqFROH+UqkhIYo3tAsw=
+k8s.io/apiserver v0.34.9/go.mod h1:gYau4EBEsam2O3uLF+D9KP8yHpMYdojPSMNq33FQEVA=
+k8s.io/client-go v0.34.9 h1:HlhSEGPyCFH5rQADW6NPKEziGns6ekgUCPK0OsOGU90=
+k8s.io/client-go v0.34.9/go.mod h1:bI3Sqqmwls2JKFZOQN9h8oLaeibvIA5pqqJAaSJWnrk=
 k8s.io/cluster-bootstrap v0.34.2 h1:oKckPeunVCns37BntcsxaOesDul32yzGd3DFLjW2fc8=
 k8s.io/cluster-bootstrap v0.34.2/go.mod h1:f21byPR7X5nt12ivZi+J3pb4sG4SH6VySX8KAAJA8BY=
-k8s.io/code-generator v0.34.7 h1:JSFAiGIcMnDLdUilaP3ZSXshHpPH1Elogw6wHpxeNHI=
-k8s.io/code-generator v0.34.7/go.mod h1:GbTJ/TjHYE2WWDgV+9q1VTI4UkU5wGLnD2koZW0mkPY=
-k8s.io/component-base v0.34.7 h1:MbY8LBCV7+SFzXGdFTxmjCodpeg+lEBVOPBzmbKuD7I=
-k8s.io/component-base v0.34.7/go.mod h1:8nuSOhmTwQ3lz79kDPXtLD7NviHYhAF8vAgX++NCgiY=
+k8s.io/code-generator v0.34.9 h1:jXBgPd5FbFoN1J2uA/qISW3uLHRl8wJ9Gx6L4PiJIPk=
+k8s.io/code-generator v0.34.9/go.mod h1:/doiEA33AIV4kFt4NTMCzV8N5Ued8kq1fZMWUUib990=
+k8s.io/component-base v0.34.9 h1:whlBI2kU+CHKHmeByojCzHX/OTU7RjsTirkHbqDDpz0=
+k8s.io/component-base v0.34.9/go.mod h1:4VmwVaGu+f+5jMIkCpmbJ0HHDu4Wu2rlWhISXAETjos=
 k8s.io/gengo/v2 v2.0.0-20250604051438-85fd79dbfd9f h1:SLb+kxmzfA87x4E4brQzB33VBbT2+x7Zq9ROIHmGn9Q=
 k8s.io/gengo/v2 v2.0.0-20250604051438-85fd79dbfd9f/go.mod h1:EJykeLsmFC60UQbYJezXkEsG2FLrt0GPNkU5iK5GWxU=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
@@ -440,10 +440,10 @@ pgregory.net/rapid v1.2.0 h1:keKAYRcjm+e1F0oAuU5F5+YPAWcyxNNRK2wud503Gnk=
 pgregory.net/rapid v1.2.0/go.mod h1:PY5XlDGj0+V1FCq0o192FdRhpKHGTRIWBgqjDBTrq04=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 h1:jpcvIRr3GLoUoEKRkHKSmGjxb6lWwrBlJsXc+eUYQHM=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw=
-sigs.k8s.io/cluster-api v1.12.7 h1:CbRMWgKN/sHZGBWc/6s8DH9ZnqsSsmYDKlJJ69Rxt8o=
-sigs.k8s.io/cluster-api v1.12.7/go.mod h1:RdmTGGRMvAGIIQBljHUHNov/6Lgz7rmYXqzZNCK+Z4o=
-sigs.k8s.io/cluster-api/test v1.12.7 h1:V6ebtlQq+2veIhQoXMitwOoSQE1JHJoKxe+1T7cvFCk=
-sigs.k8s.io/cluster-api/test v1.12.7/go.mod h1:Q6nLgHZXUzi9Wj47DHBrp8NG9dTfRBtBa5iNwtIW45c=
+sigs.k8s.io/cluster-api v1.12.10 h1:hllwEOtVfotdi+i1/HnVO9B5CJLgr5SBBtBL9yRtFEs=
+sigs.k8s.io/cluster-api v1.12.10/go.mod h1:Xz6YnayDc2+/3OA1i6wlXrhmErV1KKJmyfs7JzMDn+k=
+sigs.k8s.io/cluster-api/test v1.12.10 h1:tH6NdJuXm1hFecXdaLI2M/+Bl/A6Qua6jfgvQM2nIUo=
+sigs.k8s.io/cluster-api/test v1.12.10/go.mod h1:Ol1iUdCI7HnUKjT5KTsSBxMzHsTlpxGfdtLfy5g3/RI=
 sigs.k8s.io/controller-runtime v0.22.5 h1:v3nfSUMowX/2WMp27J9slwGFyAt7IV0YwBxAkrUr0GE=
 sigs.k8s.io/controller-runtime v0.22.5/go.mod h1:pc5SoYWnWI6I+cBHYYdZ7B6YHZVY5xNfll88JB+vniI=
 sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 h1:gBQPwqORJ8d8/YNZWEjoZs7npUVDpVXUUOFfW6CgAqE=
@@ -452,7 +452,7 @@ sigs.k8s.io/kind v0.31.0 h1:UcT4nzm+YM7YEbqiAKECk+b6dsvc/HRZZu9U0FolL1g=
 sigs.k8s.io/kind v0.31.0/go.mod h1:FSqriGaoTPruiXWfRnUXNykF8r2t+fHtK0P0m1AbGF8=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v6 v6.4.0 h1:qmp2e3ZfFi1/jJbDGpD4mt3wyp6PE1NfKHCYLqgNQJo=
-sigs.k8s.io/structured-merge-diff/v6 v6.4.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.2 h1:qdOxHwrl2Kaag1aQEarlYcOA9vSyGCp3CIki3aW8c4Q=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
 sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
 sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/hack/tools/go.mod b/hack/tools/go.mod
index 9b14b443b9..6684d282cd 100644
--- a/hack/tools/go.mod
+++ b/hack/tools/go.mod
@@ -6,9 +6,9 @@ require (
 	github.com/a8m/envsubst v1.4.3
 	github.com/ahmetb/gen-crd-api-reference-docs v0.3.1-0.20220420215017-3f29e6853552
 	github.com/itchyny/gojq v0.12.19
-	github.com/onsi/ginkgo/v2 v2.28.1
+	github.com/onsi/ginkgo/v2 v2.28.2
 	go.uber.org/mock v0.6.0
-	k8s.io/code-generator v0.34.7
+	k8s.io/code-generator v0.34.9
 	sigs.k8s.io/cluster-api-provider-openstack v0.0.0
 	sigs.k8s.io/cluster-api/hack/tools v0.0.0-20250805173327-a7b9f27af519
 	sigs.k8s.io/controller-runtime/tools/setup-envtest v0.0.0-20250620151452-b9a9ca01fd37
@@ -46,7 +46,7 @@ require (
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-git/go-billy/v5 v5.6.0 // indirect
 	github.com/go-git/go-git/v5 v5.13.0 // indirect
-	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-logr/logr v1.4.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-logr/zapr v1.3.0 // indirect
 	github.com/go-openapi/jsonpointer v0.21.0 // indirect
@@ -87,7 +87,7 @@ require (
 	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/nozzle/throttler v0.0.0-20180817012639-2ea982251481 // indirect
-	github.com/onsi/gomega v1.39.1 // indirect
+	github.com/onsi/gomega v1.42.0 // indirect
 	github.com/pjbgf/sha1cd v0.3.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
@@ -135,19 +135,19 @@ require (
 	google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 // indirect
 	google.golang.org/grpc v1.79.3 // indirect
-	google.golang.org/protobuf v1.36.11 // indirect
+	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/api v0.34.7 // indirect
-	k8s.io/apiextensions-apiserver v0.34.7 // indirect
-	k8s.io/apimachinery v0.34.7 // indirect
-	k8s.io/apiserver v0.34.7 // indirect
-	k8s.io/client-go v0.34.7 // indirect
+	k8s.io/api v0.34.9 // indirect
+	k8s.io/apiextensions-apiserver v0.34.9 // indirect
+	k8s.io/apimachinery v0.34.10 // indirect
+	k8s.io/apiserver v0.34.9 // indirect
+	k8s.io/client-go v0.34.9 // indirect
 	k8s.io/cluster-bootstrap v0.34.2 // indirect
-	k8s.io/component-base v0.34.7 // indirect
+	k8s.io/component-base v0.34.9 // indirect
 	k8s.io/gengo v0.0.0-20201203183100-97869a43a9d9 // indirect
 	k8s.io/gengo/v2 v2.0.0-20250604051438-85fd79dbfd9f // indirect
 	k8s.io/klog v0.2.0 // indirect
@@ -156,7 +156,7 @@ require (
 	k8s.io/release v0.16.9 // indirect
 	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 // indirect
 	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 // indirect
-	sigs.k8s.io/cluster-api v1.12.7 // indirect
+	sigs.k8s.io/cluster-api v1.12.10 // indirect
 	sigs.k8s.io/controller-runtime v0.22.5 // indirect
 	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
 	sigs.k8s.io/kubebuilder/docs/book/utils v0.0.0-20211028165026-57688c578b5d // indirect
@@ -166,7 +166,7 @@ require (
 	sigs.k8s.io/randfill v1.0.0 // indirect
 	sigs.k8s.io/release-sdk v0.11.0 // indirect
 	sigs.k8s.io/release-utils v0.8.1 // indirect
-	sigs.k8s.io/structured-merge-diff/v6 v6.4.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.4.2 // indirect
 	sigs.k8s.io/yaml v1.6.0 // indirect
 )
 
diff --git a/hack/tools/go.sum b/hack/tools/go.sum
index 89850e8c32..3a6c251f8d 100644
--- a/hack/tools/go.sum
+++ b/hack/tools/go.sum
@@ -53,8 +53,8 @@ github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151X
 github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
 github.com/coredns/caddy v1.1.1 h1:2eYKZT7i6yxIfGP3qLJoJ7HAsDJqYB+X68g4NYjSrE0=
 github.com/coredns/caddy v1.1.1/go.mod h1:A6ntJQlAWuQfFlsd9hvigKbo2WS0VUs2l1e2F+BawD4=
-github.com/coredns/corefile-migration v1.0.31 h1:f7WGhY8M2Jn8P2dVO0p7wSQ1QKsMARl6WEyUjCb/V38=
-github.com/coredns/corefile-migration v1.0.31/go.mod h1:56DPqONc3njpVPsdilEnfijCwNGC3/kTJLl7i7SPavY=
+github.com/coredns/corefile-migration v1.0.32 h1:tlbtXBpt7UzmedEoMqnfqOTnGCvzYfJ/Rrfqf+/W+TY=
+github.com/coredns/corefile-migration v1.0.32/go.mod h1:56DPqONc3njpVPsdilEnfijCwNGC3/kTJLl7i7SPavY=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/cyphar/filepath-securejoin v0.2.5 h1:6iR5tXJ/e6tJZzzdMc1km3Sa7RRIVBKAK32O2s7AYfo=
@@ -109,8 +109,8 @@ github.com/go-git/go-git/v5 v5.13.0 h1:vLn5wlGIh/X78El6r3Jr+30W16Blk0CTcxTYcYPWi
 github.com/go-git/go-git/v5 v5.13.0/go.mod h1:Wjo7/JyVKtQgUNdXYXIepzWfJQkUEIGvkvVkiXRR/zw=
 github.com/go-logr/logr v0.2.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
@@ -255,10 +255,10 @@ github.com/olekukonko/tablewriter v1.0.9 h1:XGwRsYLC2bY7bNd93Dk51bcPZksWZmLYuaTH
 github.com/olekukonko/tablewriter v1.0.9/go.mod h1:5c+EBPeSqvXnLLgkm9isDdzR3wjfBkHR9Nhfp3NWrzo=
 github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
 github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
-github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI=
-github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE=
-github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=
-github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg=
+github.com/onsi/ginkgo/v2 v2.28.2 h1:DTrMfpqxiNUyQ3Y0zhn1n3cOO2euFgQPYIpkWwxVFps=
+github.com/onsi/ginkgo/v2 v2.28.2/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE=
+github.com/onsi/gomega v1.42.0 h1:CJby8u36xb7v34W78F8WKvqTQP7PCMIPB78IVDB73l4=
+github.com/onsi/gomega v1.42.0/go.mod h1:M/Uqpu/8qTjtzCLUA2zJHX9Iilrau25x1PdoSRbWh5A=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
@@ -456,8 +456,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 h1:
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ=
 google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=
 google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
-google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
-google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI=
+google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
@@ -477,22 +477,22 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/api v0.34.7 h1:186BQYhLYaaU0jhC4/uC3s4cQ+YSk0BlazRnEldXiqY=
-k8s.io/api v0.34.7/go.mod h1:2qet0m0IfHSwXp+RLnunTWADUjy6qaXDa4PdeUnTJ9s=
-k8s.io/apiextensions-apiserver v0.34.7 h1:eGo48CGcmTAscn00wumFbo73UWav7jGAht2f1XdNPGQ=
-k8s.io/apiextensions-apiserver v0.34.7/go.mod h1:rtx7XxaKq0ZH/9/wWQgA0J4HQqCAnQMwdaMJGmpGwxE=
-k8s.io/apimachinery v0.34.7 h1:nkAtvxByvBFSyIyOTrFKcy6pgQ4G1NCKsypWArLdNSY=
-k8s.io/apimachinery v0.34.7/go.mod h1:z7dd12Xd400CXIycE8nmn32xZhApV9zskHs0A5xeU/Q=
-k8s.io/apiserver v0.34.7 h1:G0JG/NTBN+FDYxF9r15dmj7vA8Gn3QH06kg8un9N+6c=
-k8s.io/apiserver v0.34.7/go.mod h1:7+me/mC1L/BRkb7MbUwUpppl/BNodyt28bgVmytocrs=
-k8s.io/client-go v0.34.7 h1:zxksYcHi4DMv6HfjMbHTfcV3jYZh7BY3yH18maoRxsA=
-k8s.io/client-go v0.34.7/go.mod h1:GS3K60t9FI20+l3cvB/EfDXyD+JoKr3suIjSGISQLDc=
+k8s.io/api v0.34.9 h1:aVsK5NQL7146suJriGuvpi9giNpwIRSHJ8v5HWakwBo=
+k8s.io/api v0.34.9/go.mod h1:8oYqD5tLKgvBSnkuDbHZTNrk7NTHybkfYjJ6lNjThjQ=
+k8s.io/apiextensions-apiserver v0.34.9 h1:I+VcEFLE/6ueQw3v1OxPslTHD6AiGQJ1M4cUxtYelII=
+k8s.io/apiextensions-apiserver v0.34.9/go.mod h1:z+ylpz3sT+7C+H9jTTfCNR7khCMPDyZVIgvvga79uYc=
+k8s.io/apimachinery v0.34.10 h1:2TkKKtyUGjkdf1fTNEoANuv46QXFIi6UfMfrMxJ9Glg=
+k8s.io/apimachinery v0.34.10/go.mod h1:gCxm98KdKjmJKLtGA2OQOIGmb3tY/csRmlQSymG3tLw=
+k8s.io/apiserver v0.34.9 h1:isiEW5L0OeGi4oDvyLl+cXzKvqFROH+UqkhIYo3tAsw=
+k8s.io/apiserver v0.34.9/go.mod h1:gYau4EBEsam2O3uLF+D9KP8yHpMYdojPSMNq33FQEVA=
+k8s.io/client-go v0.34.9 h1:HlhSEGPyCFH5rQADW6NPKEziGns6ekgUCPK0OsOGU90=
+k8s.io/client-go v0.34.9/go.mod h1:bI3Sqqmwls2JKFZOQN9h8oLaeibvIA5pqqJAaSJWnrk=
 k8s.io/cluster-bootstrap v0.34.2 h1:oKckPeunVCns37BntcsxaOesDul32yzGd3DFLjW2fc8=
 k8s.io/cluster-bootstrap v0.34.2/go.mod h1:f21byPR7X5nt12ivZi+J3pb4sG4SH6VySX8KAAJA8BY=
-k8s.io/code-generator v0.34.7 h1:JSFAiGIcMnDLdUilaP3ZSXshHpPH1Elogw6wHpxeNHI=
-k8s.io/code-generator v0.34.7/go.mod h1:GbTJ/TjHYE2WWDgV+9q1VTI4UkU5wGLnD2koZW0mkPY=
-k8s.io/component-base v0.34.7 h1:MbY8LBCV7+SFzXGdFTxmjCodpeg+lEBVOPBzmbKuD7I=
-k8s.io/component-base v0.34.7/go.mod h1:8nuSOhmTwQ3lz79kDPXtLD7NviHYhAF8vAgX++NCgiY=
+k8s.io/code-generator v0.34.9 h1:jXBgPd5FbFoN1J2uA/qISW3uLHRl8wJ9Gx6L4PiJIPk=
+k8s.io/code-generator v0.34.9/go.mod h1:/doiEA33AIV4kFt4NTMCzV8N5Ued8kq1fZMWUUib990=
+k8s.io/component-base v0.34.9 h1:whlBI2kU+CHKHmeByojCzHX/OTU7RjsTirkHbqDDpz0=
+k8s.io/component-base v0.34.9/go.mod h1:4VmwVaGu+f+5jMIkCpmbJ0HHDu4Wu2rlWhISXAETjos=
 k8s.io/gengo v0.0.0-20201203183100-97869a43a9d9 h1:1bLA4Agvs1DILmc+q2Bbcqjx6jOHO7YEFA+G+0aTZoc=
 k8s.io/gengo v0.0.0-20201203183100-97869a43a9d9/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
 k8s.io/gengo/v2 v2.0.0-20250604051438-85fd79dbfd9f h1:SLb+kxmzfA87x4E4brQzB33VBbT2+x7Zq9ROIHmGn9Q=
@@ -510,12 +510,12 @@ k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 h1:hwvWFiBzdWw1FhfY1FooPn3kzWuJ8
 k8s.io/utils v0.0.0-20250604170112-4c0f3b243397/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 h1:jpcvIRr3GLoUoEKRkHKSmGjxb6lWwrBlJsXc+eUYQHM=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw=
-sigs.k8s.io/cluster-api v1.12.7 h1:CbRMWgKN/sHZGBWc/6s8DH9ZnqsSsmYDKlJJ69Rxt8o=
-sigs.k8s.io/cluster-api v1.12.7/go.mod h1:RdmTGGRMvAGIIQBljHUHNov/6Lgz7rmYXqzZNCK+Z4o=
+sigs.k8s.io/cluster-api v1.12.10 h1:hllwEOtVfotdi+i1/HnVO9B5CJLgr5SBBtBL9yRtFEs=
+sigs.k8s.io/cluster-api v1.12.10/go.mod h1:Xz6YnayDc2+/3OA1i6wlXrhmErV1KKJmyfs7JzMDn+k=
 sigs.k8s.io/cluster-api/hack/tools v0.0.0-20250805173327-a7b9f27af519 h1:WkOO6Fg3tmbuFXqTMFfs80mapaQyBbdIC5p86LIVlBI=
 sigs.k8s.io/cluster-api/hack/tools v0.0.0-20250805173327-a7b9f27af519/go.mod h1:/Zjkh19AmjuI4piKJ1fAZW7k0cDZsSoAAcGHKGZJTZU=
-sigs.k8s.io/cluster-api/test v1.12.7 h1:V6ebtlQq+2veIhQoXMitwOoSQE1JHJoKxe+1T7cvFCk=
-sigs.k8s.io/cluster-api/test v1.12.7/go.mod h1:Q6nLgHZXUzi9Wj47DHBrp8NG9dTfRBtBa5iNwtIW45c=
+sigs.k8s.io/cluster-api/test v1.12.10 h1:tH6NdJuXm1hFecXdaLI2M/+Bl/A6Qua6jfgvQM2nIUo=
+sigs.k8s.io/cluster-api/test v1.12.10/go.mod h1:Ol1iUdCI7HnUKjT5KTsSBxMzHsTlpxGfdtLfy5g3/RI=
 sigs.k8s.io/controller-runtime v0.22.5 h1:v3nfSUMowX/2WMp27J9slwGFyAt7IV0YwBxAkrUr0GE=
 sigs.k8s.io/controller-runtime v0.22.5/go.mod h1:pc5SoYWnWI6I+cBHYYdZ7B6YHZVY5xNfll88JB+vniI=
 sigs.k8s.io/controller-runtime/tools/setup-envtest v0.0.0-20250620151452-b9a9ca01fd37 h1:NSnbH7C6/fYc5L3FxMQiSlFBqYi+32LnFsXwArzOlIM=
@@ -542,8 +542,8 @@ sigs.k8s.io/release-sdk v0.11.0 h1:a+zjOO3tHm1NiVZgNcUWq5QrKmv7b63UZXw+XGdPGfk=
 sigs.k8s.io/release-sdk v0.11.0/go.mod h1:sjbFpskyVjCXcFBnI3Bj1iGQHGjDYPoHVyld/pT+TvU=
 sigs.k8s.io/release-utils v0.8.1 h1:qSA9p3vZzO6RAq7zvzupCZjR29+n3NK9DSJPe9bSf7w=
 sigs.k8s.io/release-utils v0.8.1/go.mod h1:vrQ3eR1VmudgX4OUwr4pUZEkYLRms9bdbv06mr3kchQ=
-sigs.k8s.io/structured-merge-diff/v6 v6.4.0 h1:qmp2e3ZfFi1/jJbDGpD4mt3wyp6PE1NfKHCYLqgNQJo=
-sigs.k8s.io/structured-merge-diff/v6 v6.4.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.2 h1:qdOxHwrl2Kaag1aQEarlYcOA9vSyGCp3CIki3aW8c4Q=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
 sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
 sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
 sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/hack/tools/govulncheck/.gitignore b/hack/tools/govulncheck/.gitignore
new file mode 100644
index 0000000000..8396eea084
--- /dev/null
+++ b/hack/tools/govulncheck/.gitignore
@@ -0,0 +1 @@
+govulncheck.tmp/
diff --git a/hack/tools/govulncheck/govulncheck.patch b/hack/tools/govulncheck/govulncheck.patch
new file mode 100644
index 0000000000..2f826666bc
--- /dev/null
+++ b/hack/tools/govulncheck/govulncheck.patch
@@ -0,0 +1,200 @@
+diff --git a/README.md b/README.md
+index 0af935a..8db6157 100644
+--- a/README.md
++++ b/README.md
+@@ -1,5 +1,23 @@
+ # Go Vulnerability Management
+ 
++This is a fork of the govulncheck tool which adds the ability to exclude specific
++vulnerebalities.
++
++It is configured through the `.govuln_exclude` file by default which takes the following format
++```
++# Some comment about why the vulnerability is excluded
++GO-2026-4880
++```
++The file should contain the ID of 1 excluded vulnerability per line.
++Only lines starting with `GO-` are considered vulnerability identifiers.
++Any other lines will be discarded.
++
++If the file is missing or parsing otherwise fails, an empty excluded list will be used.
++
++This should make the tool a drop-in replacement for govulncheck.
++
++
++## Original README
+ [![Go Reference](https://pkg.go.dev/badge/golang.org/x/vuln.svg)](https://pkg.go.dev/golang.org/x/vuln)
+ 
+ Go's support for vulnerability management includes tooling for analyzing your
+diff --git a/internal/govulncheck/govulncheck.go b/internal/govulncheck/govulncheck.go
+index 377a378..aca9f41 100644
+--- a/internal/govulncheck/govulncheck.go
++++ b/internal/govulncheck/govulncheck.go
+@@ -84,6 +84,10 @@ type Config struct {
+ 	// what to do with it. Valid values are source, binary, query,
+ 	// and extract.
+ 	ScanMode ScanMode `json:"scan_mode,omitempty"`
++
++	// ExcludedVulnerabilites contains a set of go vuln identifiers that will be
++	// ignored if they are present in the output
++	ExcludedVulnerabilites map[string]struct{} `json:"excluded_vulnerabilities,omitempty"`
+ }
+ 
+ // SBOM contains minimal information about the artifacts govulncheck is scanning.
+diff --git a/internal/govulncheck/jsonhandler.go b/internal/govulncheck/jsonhandler.go
+index b1586e0..51c2f02 100644
+--- a/internal/govulncheck/jsonhandler.go
++++ b/internal/govulncheck/jsonhandler.go
+@@ -13,6 +13,7 @@ import (
+ )
+ 
+ type jsonHandler struct {
++	cfg *Config
+ 	enc *json.Encoder
+ }
+ 
+@@ -25,6 +26,7 @@ func NewJSONHandler(w io.Writer) Handler {
+ 
+ // Config writes config block in JSON to the underlying writer.
+ func (h *jsonHandler) Config(config *Config) error {
++	h.cfg = config
+ 	return h.enc.Encode(Message{Config: config})
+ }
+ 
+@@ -45,5 +47,9 @@ func (h *jsonHandler) OSV(entry *osv.Entry) error {
+ 
+ // Finding writes a finding in JSON to the underlying writer.
+ func (h *jsonHandler) Finding(finding *Finding) error {
++	// Return early if the finding is excluded
++	if _, ok := h.cfg.ExcludedVulnerabilites[finding.OSV]; ok {
++		return nil
++	}
+ 	return h.enc.Encode(Message{Finding: finding})
+ }
+diff --git a/internal/openvex/handler.go b/internal/openvex/handler.go
+index a2d3282..5a5e80b 100644
+--- a/internal/openvex/handler.go
++++ b/internal/openvex/handler.go
+@@ -109,6 +109,10 @@ func moreSpecific(f1, f2 *govulncheck.Finding) int {
+ }
+ 
+ func (h *handler) Finding(f *govulncheck.Finding) error {
++	// Return early if the finding is ignored
++	if _, ok := h.cfg.ExcludedVulnerabilites[f.OSV]; ok {
++		return nil
++	}
+ 	fs := h.findings[f.OSV]
+ 	if len(fs) == 0 {
+ 		fs = []*govulncheck.Finding{f}
+diff --git a/internal/sarif/handler.go b/internal/sarif/handler.go
+index d9e585b..b2d0dcd 100644
+--- a/internal/sarif/handler.go
++++ b/internal/sarif/handler.go
+@@ -87,6 +87,10 @@ func moreSpecific(f1, f2 *govulncheck.Finding) int {
+ }
+ 
+ func (h *handler) Finding(f *govulncheck.Finding) error {
++	// Return early if the OSV is excluded
++	if _, ok := h.cfg.ExcludedVulnerabilites[f.OSV]; ok {
++		return nil
++	}
+ 	fs := h.findings[f.OSV]
+ 	if len(fs) == 0 {
+ 		fs = []*govulncheck.Finding{f}
+diff --git a/internal/scan/flags.go b/internal/scan/flags.go
+index e67c0a1..5c1871f 100644
+--- a/internal/scan/flags.go
++++ b/internal/scan/flags.go
+@@ -27,6 +27,7 @@ type config struct {
+ 	format   FormatFlag
+ 	version  bool
+ 	env      []string
++	exclude  string
+ }
+ 
+ func parseFlags(cfg *config, stderr io.Writer, args []string) error {
+@@ -46,6 +47,7 @@ func parseFlags(cfg *config, stderr io.Writer, args []string) error {
+ 	flags.Var(&cfg.format, "format", "specify format output\nThe supported values are 'text', 'json', 'sarif', and 'openvex' (default 'text')")
+ 	flags.BoolVar(&version, "version", false, "print the version information")
+ 	flags.Var(&scanFlag, "scan", "set the scanning level desired, one of 'module', 'package', or 'symbol' (default 'symbol')")
++	flags.StringVar(&cfg.exclude, "exclude", ".govuln_exclude", "path to a file containing vulnerabilities to exclude (default '.govuln_exclude')")
+ 
+ 	// We don't want to print the whole usage message on each flags
+ 	// error, so we set to a no-op and do the printing ourselves.
+diff --git a/internal/scan/run.go b/internal/scan/run.go
+index 5f6a641..1ae1e0e 100644
+--- a/internal/scan/run.go
++++ b/internal/scan/run.go
+@@ -5,9 +5,11 @@
+ package scan
+ 
+ import (
++	"bufio"
+ 	"context"
+ 	"fmt"
+ 	"io"
++	"os"
+ 	"os/exec"
+ 	"path"
+ 	"path/filepath"
+@@ -104,6 +106,30 @@ func prepareConfig(ctx context.Context, cfg *config, client *client.Client) {
+ 	if mod, err := client.LastModifiedTime(ctx); err == nil {
+ 		cfg.DBLastModified = &mod
+ 	}
++
++	cfg.ExcludedVulnerabilites = excludedVulns(cfg.exclude)
++}
++
++// excludedVulns loads a list of vulnerability IDs to ignore from the given filepath
++// If the file is not present, or cannot be parsed, an empty set will be returned
++func excludedVulns(file string) map[string]struct{} {
++	output := make(map[string]struct{})
++	fd, err := os.Open(file)
++	if err != nil {
++		return output
++	}
++	scanner := bufio.NewScanner(fd)
++	for scanner.Scan() {
++		line := scanner.Text()
++		line = strings.TrimSpace(line)
++		if strings.HasPrefix(line, "GO-") {
++			output[line] = struct{}{}
++		}
++	}
++	if scanner.Err() != nil {
++		return make(map[string]struct{})
++	}
++	return output
+ }
+ 
+ // scannerVersion reconstructs the current version of
+diff --git a/internal/scan/text.go b/internal/scan/text.go
+index ab49bdd..6eb6270 100644
+--- a/internal/scan/text.go
++++ b/internal/scan/text.go
+@@ -40,6 +40,7 @@ type TextHandler struct {
+ 	findings  []*findingSummary
+ 	scanLevel govulncheck.ScanLevel
+ 	scanMode  govulncheck.ScanMode
++	excluded  map[string]struct{}
+ 
+ 	err error
+ 
+@@ -91,6 +92,7 @@ func (h *TextHandler) Flush() error {
+ func (h *TextHandler) Config(config *govulncheck.Config) error {
+ 	h.scanLevel = config.ScanLevel
+ 	h.scanMode = config.ScanMode
++	h.excluded = config.ExcludedVulnerabilites
+ 
+ 	if !h.showVersion {
+ 		return nil
+@@ -182,6 +184,9 @@ func (h *TextHandler) OSV(entry *osv.Entry) error {
+ 
+ // Finding gathers vulnerability findings to be written.
+ func (h *TextHandler) Finding(finding *govulncheck.Finding) error {
++	if _, ok := h.excluded[finding.OSV]; ok {
++		return nil
++	}
+ 	if err := validateFindings(finding); err != nil {
+ 		return err
+ 	}
diff --git a/netlify.toml b/netlify.toml
index 1766771b7b..bd07dac795 100644
--- a/netlify.toml
+++ b/netlify.toml
@@ -4,7 +4,7 @@ command = "make -C docs/book build"
 publish = "docs/book/book"
 
 [build.environment]
-GO_VERSION = "1.25.9"
+GO_VERSION = "1.25.12"
 
 # Standard Netlify redirects
 [[redirects]]
diff --git a/pkg/cloud/services/loadbalancer/loadbalancer.go b/pkg/cloud/services/loadbalancer/loadbalancer.go
index 394a9ed0e0..bbe10b601a 100644
--- a/pkg/cloud/services/loadbalancer/loadbalancer.go
+++ b/pkg/cloud/services/loadbalancer/loadbalancer.go
@@ -646,6 +646,9 @@ func (s *Service) ReconcileLoadBalancerMember(openStackCluster *infrav1.OpenStac
 	if openStackCluster.Status.APIServerLoadBalancer == nil {
 		return errors.New("network.APIServerLoadBalancer is not yet available in openStackCluster.Status")
 	}
+	if openStackCluster.Status.APIServerLoadBalancer.LoadBalancerNetwork == nil {
+		return errors.New("apiServerLoadBalancer.LoadBalancerNetwork is not yet available in openStackCluster.Status")
+	}
 	if openStackCluster.Spec.ControlPlaneEndpoint == nil || !openStackCluster.Spec.ControlPlaneEndpoint.IsValid() {
 		return errors.New("ControlPlaneEndpoint is not yet set in openStackCluster.Spec")
 	}
diff --git a/pkg/cloud/services/loadbalancer/loadbalancer_test.go b/pkg/cloud/services/loadbalancer/loadbalancer_test.go
index 9a2ec0d61e..97cae4ab0f 100644
--- a/pkg/cloud/services/loadbalancer/loadbalancer_test.go
+++ b/pkg/cloud/services/loadbalancer/loadbalancer_test.go
@@ -1180,6 +1180,20 @@ func Test_ReconcileLoadBalancerMember(t *testing.T) {
 			},
 			wantError: nil,
 		},
+		{
+			// LoadBalancerNetwork is nil when the cluster was created with an older CAPO version that
+			// did not populate this field. The reconciler must return an error to requeue and wait
+			// for the cluster controller to populate the field.
+			name: "nil LoadBalancerNetwork, return error and wait",
+			clusterSpec: func() *infrav1.OpenStackCluster {
+				c := makeCluster(nil, clusterNetID)
+				c.Status.APIServerLoadBalancer.LoadBalancerNetwork = nil
+				return c
+			}(),
+			expectNetwork:      func(*mock.MockNetworkClientMockRecorder) {},
+			expectLoadBalancer: func(*mock.MockLbClientMockRecorder) {},
+			wantError:          errors.New("apiServerLoadBalancer.LoadBalancerNetwork is not yet available in openStackCluster.Status"),
+		},
 	}
 
 	for _, tt := range lbtests {
diff --git a/pkg/cloud/services/networking/securitygroups.go b/pkg/cloud/services/networking/securitygroups.go
index 046fb540b8..f8b7b3a26c 100644
--- a/pkg/cloud/services/networking/securitygroups.go
+++ b/pkg/cloud/services/networking/securitygroups.go
@@ -152,8 +152,7 @@ type resolvedSecurityGroupRuleSpec struct {
 }
 
 func (r resolvedSecurityGroupRuleSpec) Matches(other rules.SecGroupRule) bool {
-	return r.Description == other.Description &&
-		r.Direction == other.Direction &&
+	return r.Direction == other.Direction &&
 		r.EtherType == other.EtherType &&
 		r.PortRangeMin == other.PortRangeMin &&
 		r.PortRangeMax == other.PortRangeMax &&
diff --git a/pkg/cloud/services/networking/securitygroups_test.go b/pkg/cloud/services/networking/securitygroups_test.go
index 6dc01b49c2..504813656f 100644
--- a/pkg/cloud/services/networking/securitygroups_test.go
+++ b/pkg/cloud/services/networking/securitygroups_test.go
@@ -740,3 +740,27 @@ func TestGetSGControlPlaneAdditionalPorts(t *testing.T) {
 		})
 	}
 }
+
+func TestMatchesIgnoresDescription(t *testing.T) {
+	rule1 := resolvedSecurityGroupRuleSpec{
+		Description:    "desc1",
+		Direction:      "ingress",
+		EtherType:      "IPv4",
+		PortRangeMin:   30000,
+		PortRangeMax:   32767,
+		Protocol:       "tcp",
+		RemoteIPPrefix: "10.0.0.0/24",
+	}
+	observed := rules.SecGroupRule{
+		Description:    "desc2",
+		Direction:      "ingress",
+		EtherType:      "IPv4",
+		PortRangeMin:   30000,
+		PortRangeMax:   32767,
+		Protocol:       "tcp",
+		RemoteIPPrefix: "10.0.0.0/24",
+	}
+	if !rule1.Matches(observed) {
+		t.Errorf("Matches should ignore Description and return true for functionally identical rules")
+	}
+}
diff --git a/vendor/github.com/go-logr/logr/context_noslog.go b/vendor/github.com/go-logr/logr/context_noslog.go
index f012f9a18e..0a3d1a125e 100644
--- a/vendor/github.com/go-logr/logr/context_noslog.go
+++ b/vendor/github.com/go-logr/logr/context_noslog.go
@@ -1,5 +1,4 @@
 //go:build !go1.21
-// +build !go1.21
 
 /*
 Copyright 2019 The logr Authors.
diff --git a/vendor/github.com/go-logr/logr/context_slog.go b/vendor/github.com/go-logr/logr/context_slog.go
index 065ef0b828..c69eb01ba1 100644
--- a/vendor/github.com/go-logr/logr/context_slog.go
+++ b/vendor/github.com/go-logr/logr/context_slog.go
@@ -1,5 +1,4 @@
 //go:build go1.21
-// +build go1.21
 
 /*
 Copyright 2019 The logr Authors.
diff --git a/vendor/github.com/go-logr/logr/funcr/funcr.go b/vendor/github.com/go-logr/logr/funcr/funcr.go
index b22c57d713..7f4996e9e4 100644
--- a/vendor/github.com/go-logr/logr/funcr/funcr.go
+++ b/vendor/github.com/go-logr/logr/funcr/funcr.go
@@ -426,7 +426,7 @@ func (f Formatter) colon() byte {
 }
 
 func (f Formatter) pretty(value any) string {
-	return f.prettyWithFlags(value, 0, 0)
+	return f.prettyWithFlags(value, 0, 0, 0, nil)
 }
 
 const (
@@ -434,7 +434,13 @@ const (
 )
 
 // TODO: This is not fast. Most of the overhead goes here.
-func (f Formatter) prettyWithFlags(value any, flags uint32, depth int) string {
+// value: The value to render
+// flags: Bitmask of flags (see above)
+// depth: The current depth of nested structs, slices, arrays, and maps
+// ptrDepth: The current depth of including pointer dereferences
+// ptrMap: A map of pointers already seen, to avoid infinite recursion (usually
+// nil unless ptrDepth is large)
+func (f Formatter) prettyWithFlags(value any, flags uint32, depth int, ptrDepth int, ptrMap map[uintptr]bool) string {
 	if depth > f.opts.MaxLogDepth {
 		return `"<max-log-depth-exceeded>"`
 	}
@@ -504,7 +510,7 @@ func (f Formatter) prettyWithFlags(value any, flags uint32, depth int) string {
 			// arbitrary keys might need escaping
 			buf.WriteString(prettyString(k))
 			buf.WriteByte(f.colon())
-			buf.WriteString(f.prettyWithFlags(v[i+1], 0, depth+1))
+			buf.WriteString(f.prettyWithFlags(v[i+1], 0, depth+1, ptrDepth+1, ptrMap))
 		}
 		if flags&flagRawStruct == 0 {
 			buf.WriteByte('}')
@@ -576,7 +582,7 @@ func (f Formatter) prettyWithFlags(value any, flags uint32, depth int) string {
 			}
 			printComma = true // if we got here, we are rendering a field
 			if fld.Anonymous && fld.Type.Kind() == reflect.Struct && name == "" {
-				buf.WriteString(f.prettyWithFlags(v.Field(i).Interface(), flags|flagRawStruct, depth+1))
+				buf.WriteString(f.prettyWithFlags(v.Field(i).Interface(), flags|flagRawStruct, depth+1, ptrDepth+1, ptrMap))
 				continue
 			}
 			if name == "" {
@@ -585,7 +591,7 @@ func (f Formatter) prettyWithFlags(value any, flags uint32, depth int) string {
 			// field names can't contain characters which need escaping
 			buf.WriteString(f.quoted(name, false))
 			buf.WriteByte(f.colon())
-			buf.WriteString(f.prettyWithFlags(v.Field(i).Interface(), 0, depth+1))
+			buf.WriteString(f.prettyWithFlags(v.Field(i).Interface(), 0, depth+1, ptrDepth+1, ptrMap))
 		}
 		if flags&flagRawStruct == 0 {
 			buf.WriteByte('}')
@@ -612,7 +618,7 @@ func (f Formatter) prettyWithFlags(value any, flags uint32, depth int) string {
 				buf.WriteByte(f.comma())
 			}
 			e := v.Index(i)
-			buf.WriteString(f.prettyWithFlags(e.Interface(), 0, depth+1))
+			buf.WriteString(f.prettyWithFlags(e.Interface(), 0, depth+1, ptrDepth+1, ptrMap))
 		}
 		buf.WriteByte(']')
 		return buf.String()
@@ -637,7 +643,8 @@ func (f Formatter) prettyWithFlags(value any, flags uint32, depth int) string {
 				keystr = prettyString(keystr)
 			} else {
 				// prettyWithFlags will produce already-escaped values
-				keystr = f.prettyWithFlags(it.Key().Interface(), 0, depth+1)
+				// key depth is unrelated to overall depth
+				keystr = f.prettyWithFlags(it.Key().Interface(), 0, 0, ptrDepth, ptrMap)
 				if t.Key().Kind() != reflect.String {
 					// JSON only does string keys.  Unlike Go's standard JSON, we'll
 					// convert just about anything to a string.
@@ -646,16 +653,34 @@ func (f Formatter) prettyWithFlags(value any, flags uint32, depth int) string {
 			}
 			buf.WriteString(keystr)
 			buf.WriteByte(f.colon())
-			buf.WriteString(f.prettyWithFlags(it.Value().Interface(), 0, depth+1))
+			buf.WriteString(f.prettyWithFlags(it.Value().Interface(), 0, depth+1, ptrDepth+1, ptrMap))
 			i++
 		}
 		buf.WriteByte('}')
 		return buf.String()
-	case reflect.Ptr, reflect.Interface:
+	case reflect.Pointer, reflect.Interface:
 		if v.IsNil() {
 			return "null"
 		}
-		return f.prettyWithFlags(v.Elem().Interface(), 0, depth)
+		// Special case: recursive pointers.  For normal use we do not want to
+		// count pointer dereferences as depth, but if we see the same pointer
+		// again we have a recursion and need to stop.  After a large number of
+		// pointer dereferences we will start tracking pointers to avoid the
+		// perf hit of doing it in the normal path.
+		//
+		// This should not happen accidentally (e.g. json decoding should never
+		// do this) but we can handle it gracefully.
+		if ptrMap != nil && ptrMap[uintptr(v.Pointer())] {
+			depth = f.opts.MaxLogDepth + 1 // force a depth error
+		}
+		const maxDepthFactor = 4 // arbitrary, but we want it large enough to not false-alert
+		if ptrDepth > f.opts.MaxLogDepth*maxDepthFactor && ptrMap == nil {
+			ptrMap = map[uintptr]bool{}
+		}
+		if ptrMap != nil {
+			ptrMap[(uintptr)(v.Pointer())] = true
+		}
+		return f.prettyWithFlags(v.Elem().Interface(), 0, depth, ptrDepth+1, ptrMap)
 	}
 	return fmt.Sprintf(`"<unhandled-%s>"`, t.Kind().String())
 }
@@ -697,7 +722,7 @@ func isEmpty(v reflect.Value) bool {
 		return v.Float() == 0
 	case reflect.Complex64, reflect.Complex128:
 		return v.Complex() == 0
-	case reflect.Interface, reflect.Ptr:
+	case reflect.Interface, reflect.Pointer:
 		return v.IsNil()
 	}
 	return false
diff --git a/vendor/github.com/go-logr/logr/funcr/slogsink.go b/vendor/github.com/go-logr/logr/funcr/slogsink.go
index 7bd84761e2..8b519c91e1 100644
--- a/vendor/github.com/go-logr/logr/funcr/slogsink.go
+++ b/vendor/github.com/go-logr/logr/funcr/slogsink.go
@@ -1,5 +1,4 @@
 //go:build go1.21
-// +build go1.21
 
 /*
 Copyright 2023 The logr Authors.
@@ -33,7 +32,7 @@ const extraSlogSinkDepth = 3 // 2 for slog, 1 for SlogSink
 func (l fnlogger) Handle(_ context.Context, record slog.Record) error {
 	kvList := make([]any, 0, 2*record.NumAttrs())
 	record.Attrs(func(attr slog.Attr) bool {
-		kvList = attrToKVs(attr, kvList)
+		kvList = attrToKVs(attr, kvList, l.opts.MaxLogDepth)
 		return true
 	})
 
@@ -49,7 +48,7 @@ func (l fnlogger) Handle(_ context.Context, record slog.Record) error {
 func (l fnlogger) WithAttrs(attrs []slog.Attr) logr.SlogSink {
 	kvList := make([]any, 0, 2*len(attrs))
 	for _, attr := range attrs {
-		kvList = attrToKVs(attr, kvList)
+		kvList = attrToKVs(attr, kvList, l.opts.MaxLogDepth)
 	}
 	l.AddValues(kvList)
 	return &l
@@ -61,14 +60,25 @@ func (l fnlogger) WithGroup(name string) logr.SlogSink {
 }
 
 // attrToKVs appends a slog.Attr to a logr-style kvList.  It handle slog Groups
-// and other details of slog.
-func attrToKVs(attr slog.Attr, kvList []any) []any {
+// and other details of slog.  maxDepth bounds recursion into nested groups so a
+// deeply-nested slog.Group cannot exhaust the stack; it is decremented per group
+// level and starts at the Formatter's MaxLogDepth (past which the formatter would
+// truncate the rendering anyway).
+func attrToKVs(attr slog.Attr, kvList []any, maxDepth int) []any {
 	attrVal := attr.Value.Resolve()
 	if attrVal.Kind() == slog.KindGroup {
+		if maxDepth <= 0 {
+			// Nesting is too deep to build without risking a stack overflow.
+			// Stop here; the formatter truncates below MaxLogDepth regardless.
+			if attr.Key != "" {
+				kvList = append(kvList, attr.Key, "<max-log-depth-exceeded>")
+			}
+			return kvList
+		}
 		groupVal := attrVal.Group()
 		grpKVs := make([]any, 0, 2*len(groupVal))
 		for _, attr := range groupVal {
-			grpKVs = attrToKVs(attr, grpKVs)
+			grpKVs = attrToKVs(attr, grpKVs, maxDepth-1)
 		}
 		if attr.Key == "" {
 			// slog says we have to inline these
diff --git a/vendor/github.com/go-logr/logr/sloghandler.go b/vendor/github.com/go-logr/logr/sloghandler.go
index 82d1ba4948..befaf5510f 100644
--- a/vendor/github.com/go-logr/logr/sloghandler.go
+++ b/vendor/github.com/go-logr/logr/sloghandler.go
@@ -1,5 +1,4 @@
 //go:build go1.21
-// +build go1.21
 
 /*
 Copyright 2023 The logr Authors.
diff --git a/vendor/github.com/go-logr/logr/slogr.go b/vendor/github.com/go-logr/logr/slogr.go
index 28a83d0243..bfe80eb8d6 100644
--- a/vendor/github.com/go-logr/logr/slogr.go
+++ b/vendor/github.com/go-logr/logr/slogr.go
@@ -1,5 +1,4 @@
 //go:build go1.21
-// +build go1.21
 
 /*
 Copyright 2023 The logr Authors.
diff --git a/vendor/github.com/go-logr/logr/slogr/slogr.go b/vendor/github.com/go-logr/logr/slogr/slogr.go
index 36432c56fd..933e715b27 100644
--- a/vendor/github.com/go-logr/logr/slogr/slogr.go
+++ b/vendor/github.com/go-logr/logr/slogr/slogr.go
@@ -1,5 +1,4 @@
 //go:build go1.21
-// +build go1.21
 
 /*
 Copyright 2023 The logr Authors.
diff --git a/vendor/github.com/go-logr/logr/slogsink.go b/vendor/github.com/go-logr/logr/slogsink.go
index 4060fcbc2b..ab76ea99fe 100644
--- a/vendor/github.com/go-logr/logr/slogsink.go
+++ b/vendor/github.com/go-logr/logr/slogsink.go
@@ -1,5 +1,4 @@
 //go:build go1.21
-// +build go1.21
 
 /*
 Copyright 2023 The logr Authors.
diff --git a/vendor/github.com/onsi/ginkgo/v2/CHANGELOG.md b/vendor/github.com/onsi/ginkgo/v2/CHANGELOG.md
index 70050f35d1..2233136e60 100644
--- a/vendor/github.com/onsi/ginkgo/v2/CHANGELOG.md
+++ b/vendor/github.com/onsi/ginkgo/v2/CHANGELOG.md
@@ -1,3 +1,12 @@
+## 2.28.2
+
+- Add ArtifactDir() to support Go 1.26 testing.TB interface [f3a36b6]
+- Implement shell completion [94151c8]
+- Add asan CLI option mirroring msan implementation [4d21dbb]
+- Bump uri from 1.0.3 to 1.0.4 in /docs (#1630) [c102161]
+- fix aspect ratio [9619647]
+- update logos [5779304]
+
 ## 2.28.1
 
 Update all dependencies.  This auto-updated the required version of Go to 1.24, consistent with the fact that Go 1.23 has been out of support for almost six months.
diff --git a/vendor/github.com/onsi/ginkgo/v2/README.md b/vendor/github.com/onsi/ginkgo/v2/README.md
index b4c3ce0ad2..6d36e377eb 100644
--- a/vendor/github.com/onsi/ginkgo/v2/README.md
+++ b/vendor/github.com/onsi/ginkgo/v2/README.md
@@ -120,6 +120,6 @@ Sponsors commit to a [sponsorship](https://github.com/sponsors/onsi) for a year.
 
 <p style="font-size:21px; color:black;">Browser testing via 
     <a href="https://www.testmu.ai/" target="_blank">
-        <img src="https://www.testmu.ai/blue-logo.png" style="vertical-align: middle;" width="250" height="45" />
+        <img src="https://assets.testmu.ai/resources/images/logos/white-logo.png" style="vertical-align: middle;" width="250" />
     </a>
 </p>
diff --git a/vendor/github.com/onsi/ginkgo/v2/ginkgo/command/program.go b/vendor/github.com/onsi/ginkgo/v2/ginkgo/command/program.go
index c3f6d3a11e..53114904ca 100644
--- a/vendor/github.com/onsi/ginkgo/v2/ginkgo/command/program.go
+++ b/vendor/github.com/onsi/ginkgo/v2/ginkgo/command/program.go
@@ -1,9 +1,13 @@
 package command
 
 import (
+	"bufio"
 	"fmt"
 	"io"
+	"maps"
 	"os"
+	"path/filepath"
+	"slices"
 	"strings"
 
 	"github.com/onsi/ginkgo/v2/formatter"
@@ -158,6 +162,166 @@ func (p Program) handleHelpRequestsAndExit(writer io.Writer, args []string) {
 	}
 }
 
+type completionOptions = struct {
+	Complete bool
+	Install  bool
+}
+
+func (p *Program) BuildCompletionCommand() Command {
+	opts := completionOptions{}
+	flags, err := types.NewGinkgoFlagSet(
+		types.GinkgoFlags{
+			{Name: "complete", KeyPath: "Complete", Usage: "Generate completion for arguments after --"},
+			{Name: "install", KeyPath: "Install", Usage: "Install shell completion script into $XDG_DATA_HOME, ~/.local/share"},
+		},
+		&opts,
+		types.GinkgoFlagSections{},
+	)
+	if err != nil {
+		panic(err)
+	}
+	return Command{
+		Name:     "completion",
+		Usage:    "ginkgo completion <FLAGS> <SHELL> [-- <COMPLETE>]",
+		Flags:    flags,
+		ShortDoc: "Generate shell completion",
+		Documentation: `To use install completion script for your shell (bash, fish, zsh).
+Or load completion code by: {{bold}}source <(ginkgo completion <SHELL>){{/}}.`,
+		Command: func(args []string, completeArgs []string) {
+			p.handleCompletionAndExit(args, completeArgs, opts)
+		},
+	}
+}
+
+func (p Program) generateShellCompletionScript(shell string) (scriptPath string, script string) {
+	switch shell {
+	case "bash":
+		scriptPath = fmt.Sprintf("bash-completion/completions/%s", p.Name)
+		script = fmt.Sprintf(`__%s_complete_bash() {
+  mapfile -t COMPREPLY < <("${COMP_WORDS[0]}" completion --complete bash -- "${COMP_WORDS[@]:1:COMP_CWORD}")
+}
+complete -o bashdefault -o default -F __%[1]s_complete_bash %[1]s
+`, p.Name)
+
+	case "fish":
+		scriptPath = fmt.Sprintf("fish/vendor_completions.d/%s.fish", p.Name)
+		script = fmt.Sprintf(`function __fish_%[1]s_complete
+  set -l args (commandline -opc) (commandline -ct)
+  set -e args[1]
+  %[1]s completion --complete fish -- $args
+end
+complete -c %[1]s -a "(__fish_%[1]s_complete)"
+`, p.Name)
+
+	case "zsh":
+		scriptPath = fmt.Sprintf("zsh/site-functions/_%s", p.Name)
+		script = fmt.Sprintf(`#compdef %[1]s
+_%[1]s() {
+  local -a completions
+  completions=(${(f)"$("${words[1]}" completion --complete zsh -- "${words[@]:1:$((CURRENT-1))}")"})
+  if (( ${#completions[@]} )); then
+    _describe 'completions' completions
+  else
+    _default
+  fi
+}
+compdef _%[1]s %[1]s
+if [ "$funcstack[1]" = "_%[1]s" ]; then
+  _%[1]s
+fi
+`, p.Name)
+
+	case "":
+		AbortWithUsage("Shell is not specified")
+	default:
+		AbortWith("Shell %q is not supported yet. Choose: bash, fish, zsh", shell)
+	}
+
+	return scriptPath, script
+}
+
+func (p Program) handleCompletionAndExit(args, completeArgs []string, opts completionOptions) {
+	writer := p.OutWriter
+	if writer == nil {
+		writer = os.Stdout
+	}
+	buffer := bufio.NewWriter(writer)
+	defer buffer.Flush()
+
+	var shell string
+	if len(args) > 0 {
+		shell = args[0]
+	}
+
+	if !opts.Complete {
+		scriptPath, script := p.generateShellCompletionScript(shell)
+		if opts.Install {
+			dataHomeDir := os.Getenv("XDG_DATA_HOME")
+			if dataHomeDir == "" {
+				userHomeDir, err := os.UserHomeDir()
+				AbortIfError("Failed to find home", err)
+				dataHomeDir = filepath.Join(userHomeDir, ".local/share")
+			}
+			scriptPath = filepath.Join(dataHomeDir, scriptPath)
+			fmt.Fprintf(buffer, "Installing completion script: %v\n", scriptPath)
+			err := os.WriteFile(scriptPath, []byte(script), 0644)
+			AbortIfError("Failed to install completion script", err)
+		} else {
+			buffer.Write([]byte(script))
+		}
+		Abort(AbortDetails{})
+	}
+
+	var lastArg string
+	var result map[string]string
+	if len(completeArgs) > 0 {
+		lastArg = completeArgs[len(completeArgs)-1]
+	}
+
+	if delim := slices.Index(completeArgs, "--"); delim >= 0 && delim != len(completeArgs)-1 {
+		// No completion for pass-through arguments after "--"
+	} else if len(lastArg) > 0 && lastArg[0] == '-' {
+		// Complete flags
+		cmd := &p.DefaultCommand
+		for i := range p.Commands {
+			if p.Commands[i].Name == completeArgs[0] {
+				cmd = &p.Commands[i]
+				break
+			}
+		}
+		result = cmd.Flags.Completion(lastArg)
+	} else if len(completeArgs) <= 1 {
+		// Complete commands
+		result = make(map[string]string, len(p.Commands)+1)
+		for _, cmd := range append(p.Commands, p.DefaultCommand) {
+			if strings.HasPrefix(cmd.Name, lastArg) {
+				result[cmd.Name] = cmd.Usage
+			}
+		}
+	}
+
+	width := 0
+	for suggest := range result {
+		width = max(width, len(suggest))
+	}
+
+	for _, suggest := range slices.Sorted(maps.Keys(result)) {
+		usage := result[suggest]
+		switch {
+		case shell == "bash" && usage != "" && len(result) > 1:
+			fmt.Fprintf(buffer, "%*s (%s)\n", -width-2, suggest, usage)
+		case shell == "fish":
+			fmt.Fprintf(buffer, "%s\t%s\n", suggest, usage)
+		case shell == "zsh":
+			fmt.Fprintf(buffer, "%s:%s\n", suggest, usage)
+		default:
+			fmt.Fprintln(buffer, suggest)
+		}
+	}
+
+	Abort(AbortDetails{})
+}
+
 func (p Program) EmitUsage(writer io.Writer) {
 	fmt.Fprintln(writer, formatter.F(p.Heading))
 	fmt.Fprintln(writer, formatter.F("{{gray}}%s{{/}}", strings.Repeat("-", len(p.Heading))))
diff --git a/vendor/github.com/onsi/ginkgo/v2/ginkgo/main.go b/vendor/github.com/onsi/ginkgo/v2/ginkgo/main.go
index 419589b48c..596c210cf1 100644
--- a/vendor/github.com/onsi/ginkgo/v2/ginkgo/main.go
+++ b/vendor/github.com/onsi/ginkgo/v2/ginkgo/main.go
@@ -41,6 +41,7 @@ func main() {
 			{Name: "nodot", Deprecation: types.Deprecations.Nodot()},
 		},
 	}
+	program.Commands = append(program.Commands, program.BuildCompletionCommand())
 
 	program.RunAndExit(os.Args)
 }
diff --git a/vendor/github.com/onsi/ginkgo/v2/ginkgo_t_dsl.go b/vendor/github.com/onsi/ginkgo/v2/ginkgo_t_dsl.go
index 40d1e1ab5c..db3e248470 100644
--- a/vendor/github.com/onsi/ginkgo/v2/ginkgo_t_dsl.go
+++ b/vendor/github.com/onsi/ginkgo/v2/ginkgo_t_dsl.go
@@ -72,6 +72,7 @@ type GinkgoTInterface interface {
 	TempDir() string
 	Attr(key, value string)
 	Output() io.Writer
+	ArtifactDir() string
 }
 
 /*
@@ -196,3 +197,6 @@ func (g *GinkgoTBWrapper) Attr(key, value string) {
 func (g *GinkgoTBWrapper) Output() io.Writer {
 	return g.GinkgoT.Output()
 }
+func (g *GinkgoTBWrapper) ArtifactDir() string {
+	return g.GinkgoT.ArtifactDir()
+}
diff --git a/vendor/github.com/onsi/ginkgo/v2/internal/testingtproxy/testing_t_proxy.go b/vendor/github.com/onsi/ginkgo/v2/internal/testingtproxy/testing_t_proxy.go
index 5704f0fdf9..e6fbaee416 100644
--- a/vendor/github.com/onsi/ginkgo/v2/internal/testingtproxy/testing_t_proxy.go
+++ b/vendor/github.com/onsi/ginkgo/v2/internal/testingtproxy/testing_t_proxy.go
@@ -181,6 +181,15 @@ func (t *ginkgoTestingTProxy) TempDir() string {
 	return tmpDir
 }
 
+func (t *ginkgoTestingTProxy) ArtifactDir() string {
+	artifactDir, err := os.MkdirTemp("", "ginkgo")
+	if err != nil {
+		t.fail(fmt.Sprintf("Failed to create artifact directory: %v", err), 1)
+		return ""
+	}
+	return artifactDir
+}
+
 // FullGinkgoTInterface
 func (t *ginkgoTestingTProxy) AddReportEntryVisibilityAlways(name string, args ...any) {
 	finalArgs := []any{internal.Offset(1), types.ReportEntryVisibilityAlways}
diff --git a/vendor/github.com/onsi/ginkgo/v2/types/config.go b/vendor/github.com/onsi/ginkgo/v2/types/config.go
index f847036046..ca64acb27a 100644
--- a/vendor/github.com/onsi/ginkgo/v2/types/config.go
+++ b/vendor/github.com/onsi/ginkgo/v2/types/config.go
@@ -215,6 +215,7 @@ type GoFlagsConfig struct {
 	N             bool
 	ModFile       string
 	ModCacheRW    bool
+	ASan          bool
 	MSan          bool
 	PkgDir        string
 	Tags          string
@@ -570,6 +571,8 @@ var GoBuildFlags = GinkgoFlags{
 		Usage: "leave newly-created directories in the module cache read-write instead of making them read-only."},
 	{KeyPath: "Go.ModFile", Name: "modfile", UsageArgument: "file", SectionKey: "go-build",
 		Usage: `in module aware mode, read (and possibly write) an alternate go.mod file instead of the one in the module root directory. A file named go.mod must still be present in order to determine the module root directory, but it is not accessed. When -modfile is specified, an alternate go.sum file is also used: its path is derived from the -modfile flag by trimming the ".mod" extension and appending ".sum".`},
+	{KeyPath: "Go.ASan", Name: "asan", SectionKey: "go-build",
+		Usage: "enable interoperation with address sanitizer."},
 	{KeyPath: "Go.MSan", Name: "msan", SectionKey: "go-build",
 		Usage: "enable interoperation with memory sanitizer. Supported only on linux/amd64, linux/arm64 and only with Clang/LLVM as the host C compiler. On linux/arm64, pie build mode will be used."},
 	{KeyPath: "Go.N", Name: "n", SectionKey: "go-build",
diff --git a/vendor/github.com/onsi/ginkgo/v2/types/flags.go b/vendor/github.com/onsi/ginkgo/v2/types/flags.go
index 8409653f97..eb04c3e78a 100644
--- a/vendor/github.com/onsi/ginkgo/v2/types/flags.go
+++ b/vendor/github.com/onsi/ginkgo/v2/types/flags.go
@@ -212,6 +212,24 @@ func (f GinkgoFlagSet) IsZero() bool {
 	return f.flagSet == nil
 }
 
+func (f GinkgoFlagSet) Completion(arg string) map[string]string {
+	if f.IsZero() {
+		return nil
+	}
+	prefix := strings.TrimLeft(arg, "-")
+	dash := arg[:len(arg)-len(prefix)]
+	if len(dash) < 1 || len(dash) > 3 {
+		return nil
+	}
+	result := make(map[string]string, len(f.flags))
+	for _, flag := range f.flags {
+		if flag.Name != "" && strings.HasPrefix(flag.Name, prefix) {
+			result[dash+flag.Name] = flag.Usage
+		}
+	}
+	return result
+}
+
 func (f GinkgoFlagSet) WasSet(name string) bool {
 	found := false
 	f.flagSet.Visit(func(f *flag.Flag) {
diff --git a/vendor/github.com/onsi/ginkgo/v2/types/version.go b/vendor/github.com/onsi/ginkgo/v2/types/version.go
index 1df09be005..6874270ac2 100644
--- a/vendor/github.com/onsi/ginkgo/v2/types/version.go
+++ b/vendor/github.com/onsi/ginkgo/v2/types/version.go
@@ -1,3 +1,3 @@
 package types
 
-const VERSION = "2.28.1"
+const VERSION = "2.28.2"
diff --git a/vendor/github.com/onsi/gomega/CHANGELOG.md b/vendor/github.com/onsi/gomega/CHANGELOG.md
index 91e65521b4..e7601cfde9 100644
--- a/vendor/github.com/onsi/gomega/CHANGELOG.md
+++ b/vendor/github.com/onsi/gomega/CHANGELOG.md
@@ -1,3 +1,25 @@
+## 1.42.0
+
+Add a set of Claude skill as a marketplace plugin
+
+## 1.41.0
+
+### Features
+
+Add `BeASlice` and `BeAnArray` matchers
+
+### Fixes
+
+Object formatting now detects pointer cycles to avoid runaway formatting output.
+
+## 1.40.0
+
+We're adopting a new release strategy to minimize dependency bloat in projects that consume Gomega.  It is a limitation of the go mod toolchain that _test_ subdependencies of your project's direct dependencies get pulled in as *indirect* dependencies.  In the case of Gomega, this ends up pulling in all of Ginkgo into your `go.mod` even if you are only using Gomega (Gomega uses Ginkgo for its own tests).
+
+Going forward, releases will strip out all tests, tidy up the `go.mod` and then push this stripped down version to a new `master-lite` branch.  These stripped-down versions will receive the `vx.y.z` git tag and will be picked up by the go toolchain.
+
+Please open an issue if this new release process causes unexpected changes for your projects.
+
 ## 1.39.1
 
 Update all dependencies.  This auto-updated the required version of Go to 1.24, consistent with the fact that Go 1.23 has been out of support for almost six months.
diff --git a/vendor/github.com/onsi/gomega/README.md b/vendor/github.com/onsi/gomega/README.md
index d45a8c4e59..6eb36fdf8c 100644
--- a/vendor/github.com/onsi/gomega/README.md
+++ b/vendor/github.com/onsi/gomega/README.md
@@ -6,6 +6,19 @@ Jump straight to the [docs](http://onsi.github.io/gomega/) to learn about Gomega
 
 If you have a question, comment, bug report, feature request, etc. please open a GitHub issue.
 
+## Using Gomega with Claude Code
+
+Gomega ships a set of [Claude Code](https://claude.com/claude-code) skills as a **plugin**, so an agent writing assertions in *your* suite has Gomega's idioms — the full matcher catalog, `Eventually`/`Consistently`, and the `gstruct`/`ghttp`/`gexec`/`gbytes`/`gleak`/`gmeasure` sub-libraries — on hand. The Gomega repo doubles as the plugin marketplace, so installation is two commands. From inside Claude Code:
+
+```
+/plugin marketplace add onsi/gomega
+/plugin install gomega@gomega
+```
+
+(or non-interactively: `claude plugin marketplace add onsi/gomega` then `claude plugin install gomega@gomega`)
+
+This installs a family of `gomega:*` skills that activate automatically while you write tests. See the [docs](http://onsi.github.io/gomega/#using-gomega-with-claude-code) for the full list.
+
 ## [Ginkgo](http://github.com/onsi/ginkgo): a BDD Testing Framework for Golang
 
 Learn more about Ginkgo [here](http://onsi.github.io/ginkgo/)
diff --git a/vendor/github.com/onsi/gomega/format/format.go b/vendor/github.com/onsi/gomega/format/format.go
index 6c23ba338b..d56f9a4753 100644
--- a/vendor/github.com/onsi/gomega/format/format.go
+++ b/vendor/github.com/onsi/gomega/format/format.go
@@ -262,7 +262,7 @@ func Object(object any, indentation uint) string {
 	if err, ok := object.(error); ok && !isNilValue(value) { // isNilValue check needed here to avoid nil deref due to boxed nil
 		commonRepresentation += "\n" + IndentString(err.Error(), indentation) + "\n" + indent
 	}
-	return fmt.Sprintf("%s<%s>: %s%s", indent, formatType(value), commonRepresentation, formatValue(value, indentation, true))
+	return fmt.Sprintf("%s<%s>: %s%s", indent, formatType(value), commonRepresentation, formatValue(value, indentation, true, map[uintptr]struct{}{}))
 }
 
 /*
@@ -306,7 +306,7 @@ func formatType(v reflect.Value) string {
 	}
 }
 
-func formatValue(value reflect.Value, indentation uint, isTopLevel bool) string {
+func formatValue(value reflect.Value, indentation uint, isTopLevel bool, visited map[uintptr]struct{}) string {
 	if indentation > MaxDepth {
 		return "..."
 	}
@@ -367,23 +367,28 @@ func formatValue(value reflect.Value, indentation uint, isTopLevel bool) string
 	case reflect.Func:
 		return fmt.Sprintf("0x%x", value.Pointer())
 	case reflect.Ptr:
-		return formatValue(value.Elem(), indentation, isTopLevel)
+		ptr := value.Pointer()
+		if _, ok := visited[ptr]; ok {
+			return fmt.Sprintf("0x%x (cyclic reference)", ptr)
+		}
+		visited[ptr] = struct{}{}
+		return formatValue(value.Elem(), indentation, isTopLevel, visited)
 	case reflect.Slice:
-		return truncateLongStrings(formatSlice(value, indentation))
+		return truncateLongStrings(formatSlice(value, indentation, visited))
 	case reflect.String:
 		return truncateLongStrings(formatString(value.String(), indentation, isTopLevel))
 	case reflect.Array:
-		return truncateLongStrings(formatSlice(value, indentation))
+		return truncateLongStrings(formatSlice(value, indentation, visited))
 	case reflect.Map:
-		return truncateLongStrings(formatMap(value, indentation))
+		return truncateLongStrings(formatMap(value, indentation, visited))
 	case reflect.Struct:
 		if value.Type() == timeType && value.CanInterface() {
 			t, _ := value.Interface().(time.Time)
 			return t.Format(time.RFC3339Nano)
 		}
-		return truncateLongStrings(formatStruct(value, indentation))
+		return truncateLongStrings(formatStruct(value, indentation, visited))
 	case reflect.Interface:
-		return formatInterface(value, indentation)
+		return formatInterface(value, indentation, visited)
 	default:
 		if value.CanInterface() {
 			return truncateLongStrings(fmt.Sprintf("%#v", value.Interface()))
@@ -414,7 +419,7 @@ func formatString(object any, indentation uint, isTopLevel bool) string {
 	}
 }
 
-func formatSlice(v reflect.Value, indentation uint) string {
+func formatSlice(v reflect.Value, indentation uint, visited map[uintptr]struct{}) string {
 	if v.Kind() == reflect.Slice && v.Type().Elem().Kind() == reflect.Uint8 && isPrintableString(string(v.Bytes())) {
 		return formatString(v.Bytes(), indentation, false)
 	}
@@ -423,7 +428,7 @@ func formatSlice(v reflect.Value, indentation uint) string {
 	result := make([]string, l)
 	longest := 0
 	for i := range l {
-		result[i] = formatValue(v.Index(i), indentation+1, false)
+		result[i] = formatValue(v.Index(i), indentation+1, false, visited)
 		if len(result[i]) > longest {
 			longest = len(result[i])
 		}
@@ -436,14 +441,14 @@ func formatSlice(v reflect.Value, indentation uint) string {
 	return fmt.Sprintf("[%s]", strings.Join(result, ", "))
 }
 
-func formatMap(v reflect.Value, indentation uint) string {
+func formatMap(v reflect.Value, indentation uint, visited map[uintptr]struct{}) string {
 	l := v.Len()
 	result := make([]string, l)
 
 	longest := 0
 	for i, key := range v.MapKeys() {
 		value := v.MapIndex(key)
-		result[i] = fmt.Sprintf("%s: %s", formatValue(key, indentation+1, false), formatValue(value, indentation+1, false))
+		result[i] = fmt.Sprintf("%s: %s", formatValue(key, indentation+1, false, visited), formatValue(value, indentation+1, false, visited))
 		if len(result[i]) > longest {
 			longest = len(result[i])
 		}
@@ -456,7 +461,7 @@ func formatMap(v reflect.Value, indentation uint) string {
 	return fmt.Sprintf("{%s}", strings.Join(result, ", "))
 }
 
-func formatStruct(v reflect.Value, indentation uint) string {
+func formatStruct(v reflect.Value, indentation uint, visited map[uintptr]struct{}) string {
 	t := v.Type()
 
 	l := v.NumField()
@@ -465,7 +470,7 @@ func formatStruct(v reflect.Value, indentation uint) string {
 	for i := range l {
 		structField := t.Field(i)
 		fieldEntry := v.Field(i)
-		representation := fmt.Sprintf("%s: %s", structField.Name, formatValue(fieldEntry, indentation+1, false))
+		representation := fmt.Sprintf("%s: %s", structField.Name, formatValue(fieldEntry, indentation+1, false, visited))
 		result = append(result, representation)
 		if len(representation) > longest {
 			longest = len(representation)
@@ -478,8 +483,8 @@ func formatStruct(v reflect.Value, indentation uint) string {
 	return fmt.Sprintf("{%s}", strings.Join(result, ", "))
 }
 
-func formatInterface(v reflect.Value, indentation uint) string {
-	return fmt.Sprintf("<%s>%s", formatType(v.Elem()), formatValue(v.Elem(), indentation, false))
+func formatInterface(v reflect.Value, indentation uint, visited map[uintptr]struct{}) string {
+	return fmt.Sprintf("<%s>%s", formatType(v.Elem()), formatValue(v.Elem(), indentation, false, visited))
 }
 
 func isNilValue(a reflect.Value) bool {
diff --git a/vendor/github.com/onsi/gomega/gomega_dsl.go b/vendor/github.com/onsi/gomega/gomega_dsl.go
index 87c70692bf..967d90d0d5 100644
--- a/vendor/github.com/onsi/gomega/gomega_dsl.go
+++ b/vendor/github.com/onsi/gomega/gomega_dsl.go
@@ -22,7 +22,7 @@ import (
 	"github.com/onsi/gomega/types"
 )
 
-const GOMEGA_VERSION = "1.39.1"
+const GOMEGA_VERSION = "1.42.0"
 
 const nilGomegaPanic = `You are trying to make an assertion, but haven't registered Gomega's fail handler.
 If you're using Ginkgo then you probably forgot to put your assertion in an It().
diff --git a/vendor/github.com/onsi/gomega/matchers.go b/vendor/github.com/onsi/gomega/matchers.go
index 16ca8f46dc..bf57226050 100644
--- a/vendor/github.com/onsi/gomega/matchers.go
+++ b/vendor/github.com/onsi/gomega/matchers.go
@@ -621,6 +621,18 @@ func BeADirectory() types.GomegaMatcher {
 	return &matchers.BeADirectoryMatcher{}
 }
 
+// BeASlice succeeds if actual is a value of slice type.
+// This is useful when actual has type any (interface{}) and you want to assert it is a slice.
+func BeASlice() types.GomegaMatcher {
+	return &matchers.BeASliceMatcher{}
+}
+
+// BeAnArray succeeds if actual is a value of array type.
+// This is useful when actual has type any (interface{}) and you want to assert it is an array.
+func BeAnArray() types.GomegaMatcher {
+	return &matchers.BeAnArrayMatcher{}
+}
+
 // HaveHTTPStatus succeeds if the Status or StatusCode field of an HTTP response matches.
 // Actual must be either a *http.Response or *httptest.ResponseRecorder.
 // Expected must be either an int or a string.
diff --git a/vendor/github.com/onsi/gomega/matchers/be_a_slice_matcher.go b/vendor/github.com/onsi/gomega/matchers/be_a_slice_matcher.go
new file mode 100644
index 0000000000..4fcad51271
--- /dev/null
+++ b/vendor/github.com/onsi/gomega/matchers/be_a_slice_matcher.go
@@ -0,0 +1,28 @@
+// untested sections: 1
+
+package matchers
+
+import (
+	"fmt"
+	"reflect"
+
+	"github.com/onsi/gomega/format"
+)
+
+type BeASliceMatcher struct {
+}
+
+func (matcher *BeASliceMatcher) Match(actual any) (success bool, err error) {
+	if actual == nil {
+		return false, fmt.Errorf("BeASlice matcher expects a value, got nil")
+	}
+	return reflect.TypeOf(actual).Kind() == reflect.Slice, nil
+}
+
+func (matcher *BeASliceMatcher) FailureMessage(actual any) (message string) {
+	return format.Message(actual, "to be a slice")
+}
+
+func (matcher *BeASliceMatcher) NegatedFailureMessage(actual any) (message string) {
+	return format.Message(actual, "not to be a slice")
+}
diff --git a/vendor/github.com/onsi/gomega/matchers/be_an_array_matcher.go b/vendor/github.com/onsi/gomega/matchers/be_an_array_matcher.go
new file mode 100644
index 0000000000..573aa81987
--- /dev/null
+++ b/vendor/github.com/onsi/gomega/matchers/be_an_array_matcher.go
@@ -0,0 +1,28 @@
+// untested sections: 1
+
+package matchers
+
+import (
+	"fmt"
+	"reflect"
+
+	"github.com/onsi/gomega/format"
+)
+
+type BeAnArrayMatcher struct {
+}
+
+func (matcher *BeAnArrayMatcher) Match(actual any) (success bool, err error) {
+	if actual == nil {
+		return false, fmt.Errorf("BeAnArray matcher expects a value, got nil")
+	}
+	return reflect.TypeOf(actual).Kind() == reflect.Array, nil
+}
+
+func (matcher *BeAnArrayMatcher) FailureMessage(actual any) (message string) {
+	return format.Message(actual, "to be an array")
+}
+
+func (matcher *BeAnArrayMatcher) NegatedFailureMessage(actual any) (message string) {
+	return format.Message(actual, "not to be an array")
+}
diff --git a/vendor/github.com/onsi/gomega/types/types.go b/vendor/github.com/onsi/gomega/types/types.go
index 685a46f373..e444451ac6 100644
--- a/vendor/github.com/onsi/gomega/types/types.go
+++ b/vendor/github.com/onsi/gomega/types/types.go
@@ -66,6 +66,12 @@ func MatchMayChangeInTheFuture(matcher GomegaMatcher, value any) bool {
 
 // AsyncAssertions are returned by Eventually and Consistently and enable matchers to be polled repeatedly to ensure
 // they are eventually satisfied
+//
+// The optional optionalDescription argument allows you to annotate the assertion with additional information.
+// It is passed as the second argument and can be a format string followed by arguments, or a func() string.
+// The description is included in failure messages to provide context.
+//
+// For details on annotating assertions, see: https://onsi.github.io/gomega/#annotating-assertions
 type AsyncAssertion interface {
 	Should(matcher GomegaMatcher, optionalDescription ...any) bool
 	ShouldNot(matcher GomegaMatcher, optionalDescription ...any) bool
@@ -86,6 +92,12 @@ type AsyncAssertion interface {
 }
 
 // Assertions are returned by Ω and Expect and enable assertions against Gomega matchers
+//
+// The optional optionalDescription argument allows you to annotate the assertion with additional information.
+// It is passed as the second argument and can be a format string followed by arguments, or a func() string.
+// The description is included in failure messages to provide context.
+//
+// For details on annotating assertions, see: https://onsi.github.io/gomega/#annotating-assertions
 type Assertion interface {
 	Should(matcher GomegaMatcher, optionalDescription ...any) bool
 	ShouldNot(matcher GomegaMatcher, optionalDescription ...any) bool
diff --git a/vendor/google.golang.org/protobuf/encoding/protodelim/protodelim.go b/vendor/google.golang.org/protobuf/encoding/protodelim/protodelim.go
index 2ef36bbcf9..ec63689e72 100644
--- a/vendor/google.golang.org/protobuf/encoding/protodelim/protodelim.go
+++ b/vendor/google.golang.org/protobuf/encoding/protodelim/protodelim.go
@@ -10,6 +10,7 @@ import (
 	"encoding/binary"
 	"fmt"
 	"io"
+	"math"
 
 	"google.golang.org/protobuf/encoding/protowire"
 	"google.golang.org/protobuf/internal/errors"
@@ -117,7 +118,13 @@ func (o UnmarshalOptions) UnmarshalFrom(r Reader, m proto.Message) error {
 	if maxSize == 0 {
 		maxSize = defaultMaxSize
 	}
-	if maxSize != -1 && size > uint64(maxSize) {
+	if maxSize == -1 {
+		// No limit specified: Just check that size fits into an integer,
+		// otherwise the make([]byte, size) call below will panic.
+		if size > math.MaxInt {
+			return errors.Wrap(&SizeTooLargeError{Size: size, MaxSize: math.MaxInt}, "")
+		}
+	} else if size > uint64(maxSize) {
 		return errors.Wrap(&SizeTooLargeError{Size: size, MaxSize: uint64(maxSize)}, "")
 	}
 
diff --git a/vendor/google.golang.org/protobuf/encoding/protojson/decode.go b/vendor/google.golang.org/protobuf/encoding/protojson/decode.go
index 737d6876d5..1d6608dc7d 100644
--- a/vendor/google.golang.org/protobuf/encoding/protojson/decode.go
+++ b/vendor/google.golang.org/protobuf/encoding/protojson/decode.go
@@ -365,6 +365,10 @@ func unmarshalInt(tok json.Token, bitSize int) (protoreflect.Value, bool) {
 		if err != nil {
 			return protoreflect.Value{}, false
 		}
+		// Ensure there is no non-number content in this string.
+		if next, err := dec.Read(); err != nil || next.Kind() != json.EOF {
+			return protoreflect.Value{}, false
+		}
 		return getInt(tok, bitSize)
 	}
 	return protoreflect.Value{}, false
@@ -397,6 +401,10 @@ func unmarshalUint(tok json.Token, bitSize int) (protoreflect.Value, bool) {
 		if err != nil {
 			return protoreflect.Value{}, false
 		}
+		// Ensure there is no non-number content in this string.
+		if next, err := dec.Read(); err != nil || next.Kind() != json.EOF {
+			return protoreflect.Value{}, false
+		}
 		return getUint(tok, bitSize)
 	}
 	return protoreflect.Value{}, false
@@ -447,6 +455,10 @@ func unmarshalFloat(tok json.Token, bitSize int) (protoreflect.Value, bool) {
 		if err != nil {
 			return protoreflect.Value{}, false
 		}
+		// Ensure there is no non-number content in this string.
+		if next, err := dec.Read(); err != nil || next.Kind() != json.EOF {
+			return protoreflect.Value{}, false
+		}
 		return getFloat(tok, bitSize)
 	}
 	return protoreflect.Value{}, false
diff --git a/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go b/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go
index e9fe103943..d2eab46947 100644
--- a/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go
+++ b/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go
@@ -52,7 +52,10 @@ func wellKnownTypeMarshaler(name protoreflect.FullName) marshalFunc {
 		case genid.FieldMask_message_name:
 			return encoder.marshalFieldMask
 		case genid.Empty_message_name:
-			return encoder.marshalEmpty
+			// The spec explicitly specifies that the Empty message
+			// is not considered to have any special JSON mapping:
+			// https://protobuf.dev/programming-guides/json/#any
+			return nil
 		}
 	}
 	return nil
diff --git a/vendor/google.golang.org/protobuf/encoding/prototext/decode.go b/vendor/google.golang.org/protobuf/encoding/prototext/decode.go
index b53805056a..20ec09e194 100644
--- a/vendor/google.golang.org/protobuf/encoding/prototext/decode.go
+++ b/vendor/google.golang.org/protobuf/encoding/prototext/decode.go
@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"unicode/utf8"
 
+	"google.golang.org/protobuf/encoding/protowire"
 	"google.golang.org/protobuf/internal/encoding/messageset"
 	"google.golang.org/protobuf/internal/encoding/text"
 	"google.golang.org/protobuf/internal/errors"
@@ -49,12 +50,19 @@ type UnmarshalOptions struct {
 		protoregistry.MessageTypeResolver
 		protoregistry.ExtensionTypeResolver
 	}
+
+	// RecursionLimit limits how deeply messages may be nested.
+	// If zero, a default limit is applied.
+	RecursionLimit int
 }
 
 // Unmarshal reads the given []byte and populates the given [proto.Message]
 // using options in the UnmarshalOptions object.
 // The provided message must be mutable (e.g., a non-nil pointer to a message).
 func (o UnmarshalOptions) Unmarshal(b []byte, m proto.Message) error {
+	if o.RecursionLimit == 0 {
+		o.RecursionLimit = protowire.DefaultRecursionLimit
+	}
 	return o.unmarshal(b, m)
 }
 
@@ -102,8 +110,14 @@ func (d decoder) syntaxError(pos int, f string, x ...any) error {
 	return errors.New(head+f, x...)
 }
 
+var errRecursionDepth = errors.New("exceeded maximum recursion depth")
+
 // unmarshalMessage unmarshals into the given protoreflect.Message.
 func (d decoder) unmarshalMessage(m protoreflect.Message, checkDelims bool) error {
+	if d.opts.RecursionLimit--; d.opts.RecursionLimit < 0 {
+		return errRecursionDepth
+	}
+
 	messageDesc := m.Descriptor()
 	if !flags.ProtoLegacy && messageset.IsMessageSet(messageDesc) {
 		return errors.New("no support for proto1 MessageSets")
@@ -437,6 +451,10 @@ func (d decoder) unmarshalList(fd protoreflect.FieldDescriptor, list protoreflec
 // unmarshalMap unmarshals into given protoreflect.Map. A map value is a
 // textproto message containing {key: <kvalue>, value: <mvalue>}.
 func (d decoder) unmarshalMap(fd protoreflect.FieldDescriptor, mmap protoreflect.Map) error {
+	if d.opts.RecursionLimit--; d.opts.RecursionLimit < 0 {
+		return errRecursionDepth
+	}
+
 	// Determine ahead whether map entry is a scalar type or a message type in
 	// order to call the appropriate unmarshalMapValue func inside
 	// unmarshalMapEntry.
diff --git a/vendor/google.golang.org/protobuf/internal/descfmt/stringer.go b/vendor/google.golang.org/protobuf/internal/descfmt/stringer.go
index 87e46bd4df..0b0dfacbe5 100644
--- a/vendor/google.golang.org/protobuf/internal/descfmt/stringer.go
+++ b/vendor/google.golang.org/protobuf/internal/descfmt/stringer.go
@@ -83,12 +83,13 @@ func formatListOpt(vs list, isRoot, allowMulti bool) string {
 	case protoreflect.FileImports:
 		for i := 0; i < vs.Len(); i++ {
 			var rs records
-			rv := reflect.ValueOf(vs.Get(i))
-			rs.Append(rv, []methodAndName{
-				{rv.MethodByName("Path"), "Path"},
-				{rv.MethodByName("Package"), "Package"},
-				{rv.MethodByName("IsPublic"), "IsPublic"},
-				{rv.MethodByName("IsWeak"), "IsWeak"},
+			fi := vs.Get(i)
+			rv := reflect.ValueOf(fi)
+			rs.Append(rv, []attrAndName{
+				{fi.Path(), "Path"},
+				{fi.Package(), "Package"},
+				{fi.IsPublic, "IsPublic"},
+				{fi.IsWeak, "IsWeak"},
 			}...)
 			ss = append(ss, "{"+rs.Join()+"}")
 		}
@@ -104,9 +105,9 @@ func formatListOpt(vs list, isRoot, allowMulti bool) string {
 	}
 }
 
-type methodAndName struct {
-	method reflect.Value
-	name   string
+type attrAndName struct {
+	attr any
+	name string
 }
 
 func FormatDesc(s fmt.State, r rune, t protoreflect.Descriptor) {
@@ -126,58 +127,58 @@ func formatDescOpt(t protoreflect.Descriptor, isRoot, allowMulti bool, record fu
 		start = rt.Name() + "{"
 	}
 
-	_, isFile := t.(protoreflect.FileDescriptor)
+	fd, isFile := t.(protoreflect.FileDescriptor)
 	rs := records{
 		allowMulti: allowMulti,
 		record:     record,
 	}
 	if t.IsPlaceholder() {
 		if isFile {
-			rs.Append(rv, []methodAndName{
-				{rv.MethodByName("Path"), "Path"},
-				{rv.MethodByName("Package"), "Package"},
-				{rv.MethodByName("IsPlaceholder"), "IsPlaceholder"},
+			rs.Append(rv, []attrAndName{
+				{fd.Path(), "Path"},
+				{fd.Package(), "Package"},
+				{fd.IsPlaceholder(), "IsPlaceholder"},
 			}...)
 		} else {
-			rs.Append(rv, []methodAndName{
-				{rv.MethodByName("FullName"), "FullName"},
-				{rv.MethodByName("IsPlaceholder"), "IsPlaceholder"},
+			rs.Append(rv, []attrAndName{
+				{t.FullName(), "FullName"},
+				{t.IsPlaceholder(), "IsPlaceholder"},
 			}...)
 		}
 	} else {
 		switch {
 		case isFile:
-			rs.Append(rv, methodAndName{rv.MethodByName("Syntax"), "Syntax"})
+			rs.Append(rv, attrAndName{fd.Syntax(), "Syntax"})
 		case isRoot:
-			rs.Append(rv, []methodAndName{
-				{rv.MethodByName("Syntax"), "Syntax"},
-				{rv.MethodByName("FullName"), "FullName"},
+			rs.Append(rv, []attrAndName{
+				{t.Syntax(), "Syntax"},
+				{t.FullName(), "FullName"},
 			}...)
 		default:
-			rs.Append(rv, methodAndName{rv.MethodByName("Name"), "Name"})
+			rs.Append(rv, attrAndName{t.Name(), "Name"})
 		}
 		switch t := t.(type) {
 		case protoreflect.FieldDescriptor:
-			accessors := []methodAndName{
-				{rv.MethodByName("Number"), "Number"},
-				{rv.MethodByName("Cardinality"), "Cardinality"},
-				{rv.MethodByName("Kind"), "Kind"},
-				{rv.MethodByName("HasJSONName"), "HasJSONName"},
-				{rv.MethodByName("JSONName"), "JSONName"},
-				{rv.MethodByName("HasPresence"), "HasPresence"},
-				{rv.MethodByName("IsExtension"), "IsExtension"},
-				{rv.MethodByName("IsPacked"), "IsPacked"},
-				{rv.MethodByName("IsWeak"), "IsWeak"},
-				{rv.MethodByName("IsList"), "IsList"},
-				{rv.MethodByName("IsMap"), "IsMap"},
-				{rv.MethodByName("MapKey"), "MapKey"},
-				{rv.MethodByName("MapValue"), "MapValue"},
-				{rv.MethodByName("HasDefault"), "HasDefault"},
-				{rv.MethodByName("Default"), "Default"},
-				{rv.MethodByName("ContainingOneof"), "ContainingOneof"},
-				{rv.MethodByName("ContainingMessage"), "ContainingMessage"},
-				{rv.MethodByName("Message"), "Message"},
-				{rv.MethodByName("Enum"), "Enum"},
+			accessors := []attrAndName{
+				{t.Number(), "Number"},
+				{t.Cardinality(), "Cardinality"},
+				{t.Kind(), "Kind"},
+				{t.HasJSONName(), "HasJSONName"},
+				{t.JSONName(), "JSONName"},
+				{t.HasPresence(), "HasPresence"},
+				{t.IsExtension(), "IsExtension"},
+				{t.IsPacked(), "IsPacked"},
+				{t.IsWeak(), "IsWeak"},
+				{t.IsList(), "IsList"},
+				{t.IsMap(), "IsMap"},
+				{t.MapKey(), "MapKey"},
+				{t.MapValue(), "MapValue"},
+				{t.HasDefault(), "HasDefault"},
+				{t.Default(), "Default"},
+				{t.ContainingOneof(), "ContainingOneof"},
+				{t.ContainingMessage(), "ContainingMessage"},
+				{t.Message(), "Message"},
+				{t.Enum(), "Enum"},
 			}
 			for _, s := range accessors {
 				switch s.name {
@@ -223,58 +224,54 @@ func formatDescOpt(t protoreflect.Descriptor, isRoot, allowMulti bool, record fu
 			}
 
 		case protoreflect.FileDescriptor:
-			rs.Append(rv, []methodAndName{
-				{rv.MethodByName("Path"), "Path"},
-				{rv.MethodByName("Package"), "Package"},
-				{rv.MethodByName("Imports"), "Imports"},
-				{rv.MethodByName("Messages"), "Messages"},
-				{rv.MethodByName("Enums"), "Enums"},
-				{rv.MethodByName("Extensions"), "Extensions"},
-				{rv.MethodByName("Services"), "Services"},
+			rs.Append(rv, []attrAndName{
+				{t.Path(), "Path"},
+				{t.Package(), "Package"},
+				{t.Imports(), "Imports"},
+				{t.Messages(), "Messages"},
+				{t.Enums(), "Enums"},
+				{t.Extensions(), "Extensions"},
+				{t.Services(), "Services"},
 			}...)
 
 		case protoreflect.MessageDescriptor:
-			rs.Append(rv, []methodAndName{
-				{rv.MethodByName("IsMapEntry"), "IsMapEntry"},
-				{rv.MethodByName("Fields"), "Fields"},
-				{rv.MethodByName("Oneofs"), "Oneofs"},
-				{rv.MethodByName("ReservedNames"), "ReservedNames"},
-				{rv.MethodByName("ReservedRanges"), "ReservedRanges"},
-				{rv.MethodByName("RequiredNumbers"), "RequiredNumbers"},
-				{rv.MethodByName("ExtensionRanges"), "ExtensionRanges"},
-				{rv.MethodByName("Messages"), "Messages"},
-				{rv.MethodByName("Enums"), "Enums"},
-				{rv.MethodByName("Extensions"), "Extensions"},
+			rs.Append(rv, []attrAndName{
+				{t.IsMapEntry(), "IsMapEntry"},
+				{t.Fields(), "Fields"},
+				{t.Oneofs(), "Oneofs"},
+				{t.ReservedNames(), "ReservedNames"},
+				{t.ReservedRanges(), "ReservedRanges"},
+				{t.RequiredNumbers(), "RequiredNumbers"},
+				{t.ExtensionRanges(), "ExtensionRanges"},
+				{t.Messages(), "Messages"},
+				{t.Enums(), "Enums"},
+				{t.Extensions(), "Extensions"},
 			}...)
 
 		case protoreflect.EnumDescriptor:
-			rs.Append(rv, []methodAndName{
-				{rv.MethodByName("Values"), "Values"},
-				{rv.MethodByName("ReservedNames"), "ReservedNames"},
-				{rv.MethodByName("ReservedRanges"), "ReservedRanges"},
-				{rv.MethodByName("IsClosed"), "IsClosed"},
+			rs.Append(rv, []attrAndName{
+				{t.Values(), "Values"},
+				{t.ReservedNames(), "ReservedNames"},
+				{t.ReservedRanges(), "ReservedRanges"},
+				{t.IsClosed(), "IsClosed"},
 			}...)
 
 		case protoreflect.EnumValueDescriptor:
-			rs.Append(rv, []methodAndName{
-				{rv.MethodByName("Number"), "Number"},
-			}...)
+			rs.Append(rv, attrAndName{t.Number(), "Number"})
 
 		case protoreflect.ServiceDescriptor:
-			rs.Append(rv, []methodAndName{
-				{rv.MethodByName("Methods"), "Methods"},
-			}...)
+			rs.Append(rv, attrAndName{t.Methods(), "Methods"})
 
 		case protoreflect.MethodDescriptor:
-			rs.Append(rv, []methodAndName{
-				{rv.MethodByName("Input"), "Input"},
-				{rv.MethodByName("Output"), "Output"},
-				{rv.MethodByName("IsStreamingClient"), "IsStreamingClient"},
-				{rv.MethodByName("IsStreamingServer"), "IsStreamingServer"},
+			rs.Append(rv, []attrAndName{
+				{t.Input(), "Input"},
+				{t.Output(), "Output"},
+				{t.IsStreamingClient(), "IsStreamingClient"},
+				{t.IsStreamingServer(), "IsStreamingServer"},
 			}...)
 		}
-		if m := rv.MethodByName("GoType"); m.IsValid() {
-			rs.Append(rv, methodAndName{m, "GoType"})
+		if m, ok := t.(interface{ GoType() reflect.Type }); ok {
+			rs.Append(rv, attrAndName{m.GoType(), "GoType"})
 		}
 	}
 	return start + rs.Join() + end
@@ -297,68 +294,66 @@ func (rs *records) AppendRecs(fieldName string, newRecs [2]string) {
 	rs.recs = append(rs.recs, newRecs)
 }
 
-func (rs *records) Append(v reflect.Value, accessors ...methodAndName) {
-	for _, a := range accessors {
-		if rs.record != nil {
-			rs.record(a.name)
-		}
-		var rv reflect.Value
-		if a.method.IsValid() {
-			rv = a.method.Call(nil)[0]
-		}
-		if v.Kind() == reflect.Struct && !rv.IsValid() {
-			rv = v.FieldByName(a.name)
-		}
-		if !rv.IsValid() {
-			panic(fmt.Sprintf("unknown accessor: %v.%s", v.Type(), a.name))
-		}
-		if _, ok := rv.Interface().(protoreflect.Value); ok {
-			rv = rv.MethodByName("Interface").Call(nil)[0]
-			if !rv.IsNil() {
-				rv = rv.Elem()
-			}
-		}
+func (rs *records) Append(v reflect.Value, results ...attrAndName) {
+	for _, r := range results {
+		rs.appendAttribute(v, r.name, r.attr)
+	}
+}
 
-		// Ignore zero values.
-		var isZero bool
-		switch rv.Kind() {
-		case reflect.Interface, reflect.Slice:
-			isZero = rv.IsNil()
-		case reflect.Bool:
-			isZero = rv.Bool() == false
-		case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
-			isZero = rv.Int() == 0
-		case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
-			isZero = rv.Uint() == 0
-		case reflect.String:
-			isZero = rv.String() == ""
-		}
-		if n, ok := rv.Interface().(list); ok {
-			isZero = n.Len() == 0
-		}
-		if isZero {
-			continue
+func (rs *records) appendAttribute(val reflect.Value, name string, attrVal any) {
+	if rs.record != nil {
+		rs.record(name)
+	}
+	if attrVal == nil {
+		return
+	}
+	rv := reflect.ValueOf(attrVal)
+	if _, ok := rv.Interface().(protoreflect.Value); ok {
+		rv = rv.MethodByName("Interface").Call(nil)[0]
+		if !rv.IsNil() {
+			rv = rv.Elem()
 		}
+	}
 
-		// Format the value.
-		var s string
-		v := rv.Interface()
-		switch v := v.(type) {
-		case list:
-			s = formatListOpt(v, false, rs.allowMulti)
-		case protoreflect.FieldDescriptor, protoreflect.OneofDescriptor, protoreflect.EnumValueDescriptor, protoreflect.MethodDescriptor:
-			s = string(v.(protoreflect.Descriptor).Name())
-		case protoreflect.Descriptor:
-			s = string(v.FullName())
-		case string:
-			s = strconv.Quote(v)
-		case []byte:
-			s = fmt.Sprintf("%q", v)
-		default:
-			s = fmt.Sprint(v)
-		}
-		rs.recs = append(rs.recs, [2]string{a.name, s})
+	// Ignore zero values.
+	var isZero bool
+	switch rv.Kind() {
+	case reflect.Interface, reflect.Slice:
+		isZero = rv.IsNil()
+	case reflect.Bool:
+		isZero = rv.Bool() == false
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		isZero = rv.Int() == 0
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		isZero = rv.Uint() == 0
+	case reflect.String:
+		isZero = rv.String() == ""
+	}
+	if n, ok := rv.Interface().(list); ok {
+		isZero = n.Len() == 0
+	}
+	if isZero {
+		return
+	}
+
+	// Format the value.
+	var s string
+	v := rv.Interface()
+	switch v := v.(type) {
+	case list:
+		s = formatListOpt(v, false, rs.allowMulti)
+	case protoreflect.FieldDescriptor, protoreflect.OneofDescriptor, protoreflect.EnumValueDescriptor, protoreflect.MethodDescriptor:
+		s = string(v.(protoreflect.Descriptor).Name())
+	case protoreflect.Descriptor:
+		s = string(v.FullName())
+	case string:
+		s = strconv.Quote(v)
+	case []byte:
+		s = fmt.Sprintf("%q", v)
+	default:
+		s = fmt.Sprint(v)
 	}
+	rs.recs = append(rs.recs, [2]string{name, s})
 }
 
 func (rs *records) Join() string {
diff --git a/vendor/google.golang.org/protobuf/internal/version/version.go b/vendor/google.golang.org/protobuf/internal/version/version.go
index 763fd82841..bfb2cfdea5 100644
--- a/vendor/google.golang.org/protobuf/internal/version/version.go
+++ b/vendor/google.golang.org/protobuf/internal/version/version.go
@@ -53,7 +53,7 @@ const (
 	Major      = 1
 	Minor      = 36
 	Patch      = 11
-	PreRelease = ""
+	PreRelease = "devel"
 )
 
 // String formats the version string for this module in semver format.
diff --git a/vendor/google.golang.org/protobuf/reflect/protodesc/desc_init.go b/vendor/google.golang.org/protobuf/reflect/protodesc/desc_init.go
index c826ad0430..84a3228edb 100644
--- a/vendor/google.golang.org/protobuf/reflect/protodesc/desc_init.go
+++ b/vendor/google.golang.org/protobuf/reflect/protodesc/desc_init.go
@@ -201,6 +201,7 @@ func (r descsByName) initExtensionDeclarations(xds []*descriptorpb.FieldDescript
 			return nil, err
 		}
 		x.L1.EditionFeatures = mergeEditionFeatures(parent, xd.GetOptions().GetFeatures())
+		x.L2.IsProto3Optional = xd.GetProto3Optional()
 		if opts := xd.GetOptions(); opts != nil {
 			opts = proto.Clone(opts).(*descriptorpb.FieldOptions)
 			x.L2.Options = func() protoreflect.ProtoMessage { return opts }
diff --git a/vendor/gopkg.in/ini.v1/.golangci.yml b/vendor/gopkg.in/ini.v1/.golangci.yml
index fabbdb621e..6937629460 100644
--- a/vendor/gopkg.in/ini.v1/.golangci.yml
+++ b/vendor/gopkg.in/ini.v1/.golangci.yml
@@ -6,11 +6,6 @@ linters:
     - unconvert
     - unparam
   settings:
-    govet:
-      disable:
-        # printf: non-constant format string in call to fmt.Errorf (govet)
-        # showing up since golangci-lint version 1.60.1
-        - printf
     nakedret:
       max-func-lines: 0 # Disallow any unnamed return statement
   exclusions:
diff --git a/vendor/gopkg.in/ini.v1/data_source.go b/vendor/gopkg.in/ini.v1/data_source.go
index c3a541f1d1..6e2572b72f 100644
--- a/vendor/gopkg.in/ini.v1/data_source.go
+++ b/vendor/gopkg.in/ini.v1/data_source.go
@@ -18,7 +18,6 @@ import (
 	"bytes"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 )
 
@@ -48,7 +47,7 @@ type sourceData struct {
 }
 
 func (s *sourceData) ReadCloser() (io.ReadCloser, error) {
-	return ioutil.NopCloser(bytes.NewReader(s.data)), nil
+	return io.NopCloser(bytes.NewReader(s.data)), nil
 }
 
 // sourceReadCloser represents an input stream with Close method.
@@ -69,7 +68,7 @@ func parseDataSource(source interface{}) (dataSource, error) {
 	case io.ReadCloser:
 		return &sourceReadCloser{s}, nil
 	case io.Reader:
-		return &sourceReadCloser{ioutil.NopCloser(s)}, nil
+		return &sourceReadCloser{io.NopCloser(s)}, nil
 	default:
 		return nil, fmt.Errorf("error parsing data source: unknown type %q", s)
 	}
diff --git a/vendor/gopkg.in/ini.v1/file.go b/vendor/gopkg.in/ini.v1/file.go
index f8b22408be..58beabc2f0 100644
--- a/vendor/gopkg.in/ini.v1/file.go
+++ b/vendor/gopkg.in/ini.v1/file.go
@@ -19,7 +19,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"strings"
 	"sync"
@@ -532,7 +531,7 @@ func (f *File) SaveToIndent(filename, indent string) error {
 		return err
 	}
 
-	return ioutil.WriteFile(filename, buf.Bytes(), 0666)
+	return os.WriteFile(filename, buf.Bytes(), 0666)
 }
 
 // SaveTo writes content to file system.
diff --git a/vendor/gopkg.in/ini.v1/key.go b/vendor/gopkg.in/ini.v1/key.go
index 1a7767a2e6..800d04a473 100644
--- a/vendor/gopkg.in/ini.v1/key.go
+++ b/vendor/gopkg.in/ini.v1/key.go
@@ -15,12 +15,12 @@
 package ini
 
 import (
-	"bytes"
 	"errors"
 	"fmt"
 	"strconv"
 	"strings"
 	"time"
+	"unicode/utf8"
 )
 
 // Key represents a key under a section.
@@ -170,7 +170,7 @@ func (k *Key) transformValue(val string) string {
 		}
 
 		// Substitute by new value and take off leading '%(' and trailing ')s'.
-		val = strings.ReplaceAll(val, vr, nk.value)
+		val = strings.ReplaceAll(val, vr, nk.String())
 	}
 	return val
 }
@@ -495,31 +495,38 @@ func (k *Key) Strings(delim string) []string {
 		return []string{}
 	}
 
-	runes := []rune(str)
-	vals := make([]string, 0, 2)
-	var buf bytes.Buffer
-	escape := false
-	idx := 0
+	maxParts := strings.Count(str, delim) + 1
+	vals := make([]string, 0, maxParts)
+
+	var buf strings.Builder
+	buf.Grow(len(str))
+
+	i := 0
 	for {
-		if escape {
-			escape = false
-			if runes[idx] != '\\' && !strings.HasPrefix(string(runes[idx:]), delim) {
+		if str[i] == '\\' {
+			i++
+			if i >= len(str) {
+				break
+			}
+
+			if str[i] != '\\' && !strings.HasPrefix(str[i:], delim) {
 				buf.WriteRune('\\')
 			}
-			buf.WriteRune(runes[idx])
+
+			r, size := utf8.DecodeRuneInString(str[i:])
+			i += size
+			buf.WriteRune(r)
+		} else if strings.HasPrefix(str[i:], delim) {
+			i += len(delim)
+			vals = append(vals, strings.TrimSpace(buf.String()))
+			buf.Reset()
 		} else {
-			if runes[idx] == '\\' {
-				escape = true
-			} else if strings.HasPrefix(string(runes[idx:]), delim) {
-				idx += len(delim) - 1
-				vals = append(vals, strings.TrimSpace(buf.String()))
-				buf.Reset()
-			} else {
-				buf.WriteRune(runes[idx])
-			}
+			r, size := utf8.DecodeRuneInString(str[i:])
+			i += size
+			buf.WriteRune(r)
 		}
-		idx++
-		if idx == len(runes) {
+
+		if i >= len(str) {
 			break
 		}
 	}
diff --git a/vendor/gopkg.in/ini.v1/struct.go b/vendor/gopkg.in/ini.v1/struct.go
index a486b2fe0f..819a6e5a64 100644
--- a/vendor/gopkg.in/ini.v1/struct.go
+++ b/vendor/gopkg.in/ini.v1/struct.go
@@ -156,7 +156,7 @@ func wrapStrictError(err error, isStrict bool) error {
 // because we want to use default value that is already assigned to struct.
 func setWithProperType(t reflect.Type, key *Key, field reflect.Value, delim string, allowShadow, isStrict bool) error {
 	vt := t
-	isPtr := t.Kind() == reflect.Ptr
+	isPtr := t.Kind() == reflect.Pointer
 	if isPtr {
 		vt = t.Elem()
 	}
@@ -278,7 +278,7 @@ func parseTagOptions(tag string) (rawName string, omitEmpty bool, allowShadow bo
 // mapToField maps the given value to the matching field of the given section.
 // The sectionIndex is the index (if non unique sections are enabled) to which the value should be added.
 func (s *Section) mapToField(val reflect.Value, isStrict bool, sectionIndex int, sectionName string) error {
-	if val.Kind() == reflect.Ptr {
+	if val.Kind() == reflect.Pointer {
 		val = val.Elem()
 	}
 	typ := val.Type()
@@ -299,8 +299,8 @@ func (s *Section) mapToField(val reflect.Value, isStrict bool, sectionIndex int,
 		}
 
 		isStruct := tpField.Type.Kind() == reflect.Struct
-		isStructPtr := tpField.Type.Kind() == reflect.Ptr && tpField.Type.Elem().Kind() == reflect.Struct
-		isAnonymousPtr := tpField.Type.Kind() == reflect.Ptr && tpField.Anonymous
+		isStructPtr := tpField.Type.Kind() == reflect.Pointer && tpField.Type.Elem().Kind() == reflect.Struct
+		isAnonymousPtr := tpField.Type.Kind() == reflect.Pointer && tpField.Anonymous
 		if isAnonymousPtr {
 			field.Set(reflect.New(tpField.Type.Elem()))
 		}
@@ -381,7 +381,7 @@ func (s *Section) mapToSlice(secName string, val reflect.Value, isStrict bool) (
 func (s *Section) mapTo(v interface{}, isStrict bool) error {
 	typ := reflect.TypeOf(v)
 	val := reflect.ValueOf(v)
-	if typ.Kind() == reflect.Ptr {
+	if typ.Kind() == reflect.Pointer {
 		typ = typ.Elem()
 		val = val.Elem()
 	} else {
@@ -500,13 +500,13 @@ func reflectSliceWithProperType(key *Key, field reflect.Value, delim string, all
 		case reflect.String:
 			buf.WriteString(slice.Index(i).String())
 		case reflect.Int, reflect.Int64:
-			buf.WriteString(fmt.Sprint(slice.Index(i).Int()))
+			fmt.Fprint(&buf, slice.Index(i).Int())
 		case reflect.Uint, reflect.Uint64:
-			buf.WriteString(fmt.Sprint(slice.Index(i).Uint()))
+			fmt.Fprint(&buf, slice.Index(i).Uint())
 		case reflect.Float64:
-			buf.WriteString(fmt.Sprint(slice.Index(i).Float()))
+			fmt.Fprint(&buf, slice.Index(i).Float())
 		case reflect.Bool:
-			buf.WriteString(fmt.Sprint(slice.Index(i).Bool()))
+			fmt.Fprint(&buf, slice.Index(i).Bool())
 		case reflectTime:
 			buf.WriteString(slice.Index(i).Interface().(time.Time).Format(time.RFC3339))
 		default:
@@ -535,7 +535,7 @@ func reflectWithProperType(t reflect.Type, key *Key, field reflect.Value, delim
 		key.SetValue(fmt.Sprint(field.Interface().(time.Time).Format(time.RFC3339)))
 	case reflect.Slice:
 		return reflectSliceWithProperType(key, field, delim, allowShadow)
-	case reflect.Ptr:
+	case reflect.Pointer:
 		if !field.IsNil() {
 			return reflectWithProperType(t.Elem(), key, field.Elem(), delim, allowShadow)
 		}
@@ -559,7 +559,7 @@ func isEmptyValue(v reflect.Value) bool {
 		return v.Uint() == 0
 	case reflect.Float32, reflect.Float64:
 		return v.Float() == 0
-	case reflect.Interface, reflect.Ptr:
+	case reflect.Interface, reflect.Pointer:
 		return v.IsNil()
 	case reflectTime:
 		t, ok := v.Interface().(time.Time)
@@ -574,7 +574,7 @@ type StructReflector interface {
 }
 
 func (s *Section) reflectFrom(val reflect.Value) error {
-	if val.Kind() == reflect.Ptr {
+	if val.Kind() == reflect.Pointer {
 		val = val.Elem()
 	}
 	typ := val.Type()
@@ -606,14 +606,14 @@ func (s *Section) reflectFrom(val reflect.Value) error {
 			continue
 		}
 
-		if extends && tpField.Anonymous && (tpField.Type.Kind() == reflect.Ptr || tpField.Type.Kind() == reflect.Struct) {
+		if extends && tpField.Anonymous && (tpField.Type.Kind() == reflect.Pointer || tpField.Type.Kind() == reflect.Struct) {
 			if err := s.reflectFrom(field); err != nil {
 				return fmt.Errorf("reflect from field %q: %v", fieldName, err)
 			}
 			continue
 		}
 
-		if (tpField.Type.Kind() == reflect.Ptr && tpField.Type.Elem().Kind() == reflect.Struct) ||
+		if (tpField.Type.Kind() == reflect.Pointer && tpField.Type.Elem().Kind() == reflect.Struct) ||
 			(tpField.Type.Kind() == reflect.Struct && tpField.Type.Name() != "Time") {
 			// Note: The only error here is section doesn't exist.
 			sec, err := s.f.GetSection(fieldName)
@@ -641,7 +641,7 @@ func (s *Section) reflectFrom(val reflect.Value) error {
 			sliceOf := field.Type().Elem().Kind()
 
 			for i := 0; i < field.Len(); i++ {
-				if sliceOf != reflect.Struct && sliceOf != reflect.Ptr {
+				if sliceOf != reflect.Struct && sliceOf != reflect.Pointer {
 					return fmt.Errorf("field %q is not a slice of pointer or struct", fieldName)
 				}
 
@@ -688,11 +688,11 @@ func (s *Section) ReflectFrom(v interface{}) error {
 	val := reflect.ValueOf(v)
 
 	if s.name != DefaultSection && s.f.options.AllowNonUniqueSections &&
-		(typ.Kind() == reflect.Slice || typ.Kind() == reflect.Ptr) {
+		(typ.Kind() == reflect.Slice || typ.Kind() == reflect.Pointer) {
 		// Clear sections to make sure none exists before adding the new ones
 		s.f.DeleteSection(s.name)
 
-		if typ.Kind() == reflect.Ptr {
+		if typ.Kind() == reflect.Pointer {
 			sec, err := s.f.NewSection(s.name)
 			if err != nil {
 				return err
@@ -702,7 +702,7 @@ func (s *Section) ReflectFrom(v interface{}) error {
 
 		slice := val.Slice(0, val.Len())
 		sliceOf := val.Type().Elem().Kind()
-		if sliceOf != reflect.Ptr {
+		if sliceOf != reflect.Pointer {
 			return fmt.Errorf("not a slice of pointers")
 		}
 
@@ -721,7 +721,7 @@ func (s *Section) ReflectFrom(v interface{}) error {
 		return nil
 	}
 
-	if typ.Kind() == reflect.Ptr {
+	if typ.Kind() == reflect.Pointer {
 		val = val.Elem()
 	} else {
 		return errors.New("not a pointer to a struct")
diff --git a/vendor/modules.txt b/vendor/modules.txt
index aec89aed72..8478fecdc8 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -133,7 +133,7 @@ github.com/fsnotify/fsnotify/internal
 # github.com/fxamacker/cbor/v2 v2.9.0
 ## explicit; go 1.20
 github.com/fxamacker/cbor/v2
-# github.com/go-logr/logr v1.4.3
+# github.com/go-logr/logr v1.4.4
 ## explicit; go 1.18
 github.com/go-logr/logr
 github.com/go-logr/logr/funcr
@@ -386,7 +386,7 @@ github.com/olekukonko/tablewriter/pkg/twwarp
 github.com/olekukonko/tablewriter/pkg/twwidth
 github.com/olekukonko/tablewriter/renderer
 github.com/olekukonko/tablewriter/tw
-# github.com/onsi/ginkgo/v2 v2.28.1
+# github.com/onsi/ginkgo/v2 v2.28.2
 ## explicit; go 1.24.0
 github.com/onsi/ginkgo/v2
 github.com/onsi/ginkgo/v2/config
@@ -410,7 +410,7 @@ github.com/onsi/ginkgo/v2/internal/reporters
 github.com/onsi/ginkgo/v2/internal/testingtproxy
 github.com/onsi/ginkgo/v2/reporters
 github.com/onsi/ginkgo/v2/types
-# github.com/onsi/gomega v1.39.1
+# github.com/onsi/gomega v1.42.0
 ## explicit; go 1.24.0
 github.com/onsi/gomega
 github.com/onsi/gomega/format
@@ -809,7 +809,7 @@ google.golang.org/grpc/serviceconfig
 google.golang.org/grpc/stats
 google.golang.org/grpc/status
 google.golang.org/grpc/tap
-# google.golang.org/protobuf v1.36.11
+# google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af
 ## explicit; go 1.23
 google.golang.org/protobuf/encoding/protodelim
 google.golang.org/protobuf/encoding/protojson
@@ -860,13 +860,13 @@ gopkg.in/evanphx/json-patch.v4
 # gopkg.in/inf.v0 v0.9.1
 ## explicit
 gopkg.in/inf.v0
-# gopkg.in/ini.v1 v1.67.1
+# gopkg.in/ini.v1 v1.67.3
 ## explicit; go 1.13
 gopkg.in/ini.v1
 # gopkg.in/yaml.v3 v3.0.1
 ## explicit
 gopkg.in/yaml.v3
-# k8s.io/api v0.34.7
+# k8s.io/api v0.34.9
 ## explicit; go 1.24.0
 k8s.io/api/admission/v1
 k8s.io/api/admission/v1beta1
@@ -928,7 +928,7 @@ k8s.io/api/storage/v1
 k8s.io/api/storage/v1alpha1
 k8s.io/api/storage/v1beta1
 k8s.io/api/storagemigration/v1alpha1
-# k8s.io/apiextensions-apiserver v0.34.7
+# k8s.io/apiextensions-apiserver v0.34.9
 ## explicit; go 1.24.0
 k8s.io/apiextensions-apiserver/pkg/apihelpers
 k8s.io/apiextensions-apiserver/pkg/apis/apiextensions
@@ -949,7 +949,7 @@ k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset/scheme
 k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset/typed/apiextensions/v1
 k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset/typed/apiextensions/v1beta1
 k8s.io/apiextensions-apiserver/pkg/features
-# k8s.io/apimachinery v0.34.7
+# k8s.io/apimachinery v0.34.10
 ## explicit; go 1.24.0
 k8s.io/apimachinery/pkg/api/apitesting
 k8s.io/apimachinery/pkg/api/apitesting/fuzzer
@@ -1021,7 +1021,7 @@ k8s.io/apimachinery/pkg/version
 k8s.io/apimachinery/pkg/watch
 k8s.io/apimachinery/third_party/forked/golang/json
 k8s.io/apimachinery/third_party/forked/golang/reflect
-# k8s.io/apiserver v0.34.7
+# k8s.io/apiserver v0.34.9
 ## explicit; go 1.24.0
 k8s.io/apiserver/pkg/admission
 k8s.io/apiserver/pkg/apis/apiserver
@@ -1086,7 +1086,7 @@ k8s.io/apiserver/pkg/warning
 k8s.io/apiserver/plugin/pkg/authenticator/token/webhook
 k8s.io/apiserver/plugin/pkg/authorizer/webhook
 k8s.io/apiserver/plugin/pkg/authorizer/webhook/metrics
-# k8s.io/client-go v0.34.7
+# k8s.io/client-go v0.34.9
 ## explicit; go 1.24.0
 k8s.io/client-go/applyconfigurations
 k8s.io/client-go/applyconfigurations/admissionregistration/v1
@@ -1369,7 +1369,7 @@ k8s.io/client-go/util/workqueue
 ## explicit; go 1.24.0
 k8s.io/cluster-bootstrap/token/api
 k8s.io/cluster-bootstrap/token/util
-# k8s.io/code-generator v0.34.7
+# k8s.io/code-generator v0.34.9
 ## explicit; go 1.24.0
 k8s.io/code-generator
 k8s.io/code-generator/cmd/applyconfiguration-gen
@@ -1405,7 +1405,7 @@ k8s.io/code-generator/cmd/register-gen/generators
 k8s.io/code-generator/pkg/namer
 k8s.io/code-generator/pkg/util
 k8s.io/code-generator/third_party/forked/golang/reflect
-# k8s.io/component-base v0.34.7
+# k8s.io/component-base v0.34.9
 ## explicit; go 1.24.0
 k8s.io/component-base/cli/flag
 k8s.io/component-base/compatibility
@@ -1490,7 +1490,7 @@ sigs.k8s.io/apiserver-network-proxy/konnectivity-client/pkg/client
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client/pkg/client/metrics
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client/pkg/common/metrics
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client/proto/client
-# sigs.k8s.io/cluster-api v1.12.7
+# sigs.k8s.io/cluster-api v1.12.10
 ## explicit; go 1.24.0
 sigs.k8s.io/cluster-api/api/addons/v1beta2
 sigs.k8s.io/cluster-api/api/bootstrap/kubeadm/v1beta2
@@ -1570,7 +1570,7 @@ sigs.k8s.io/cluster-api/util/topology
 sigs.k8s.io/cluster-api/util/version
 sigs.k8s.io/cluster-api/util/yaml
 sigs.k8s.io/cluster-api/version
-# sigs.k8s.io/cluster-api/test v1.12.7
+# sigs.k8s.io/cluster-api/test v1.12.10
 ## explicit; go 1.24.0
 sigs.k8s.io/cluster-api/test/e2e
 sigs.k8s.io/cluster-api/test/e2e/internal/log
@@ -1692,7 +1692,7 @@ sigs.k8s.io/kind/pkg/log
 ## explicit; go 1.18
 sigs.k8s.io/randfill
 sigs.k8s.io/randfill/bytesource
-# sigs.k8s.io/structured-merge-diff/v6 v6.4.0
+# sigs.k8s.io/structured-merge-diff/v6 v6.4.2
 ## explicit; go 1.23
 sigs.k8s.io/structured-merge-diff/v6/fieldpath
 sigs.k8s.io/structured-merge-diff/v6/merge
diff --git a/vendor/sigs.k8s.io/cluster-api/cmd/clusterctl/client/config/cert_manager_client.go b/vendor/sigs.k8s.io/cluster-api/cmd/clusterctl/client/config/cert_manager_client.go
index 2a529db58c..3462c7075a 100644
--- a/vendor/sigs.k8s.io/cluster-api/cmd/clusterctl/client/config/cert_manager_client.go
+++ b/vendor/sigs.k8s.io/cluster-api/cmd/clusterctl/client/config/cert_manager_client.go
@@ -29,7 +29,7 @@ const (
 	CertManagerConfigKey = "cert-manager"
 
 	// CertManagerDefaultVersion defines the default cert-manager version to be used by clusterctl.
-	CertManagerDefaultVersion = "v1.20.2"
+	CertManagerDefaultVersion = "v1.20.3"
 
 	// CertManagerDefaultURL defines the default cert-manager repository url to be used by clusterctl.
 	// NOTE: At runtime CertManagerDefaultVersion may be replaced with the
diff --git a/vendor/sigs.k8s.io/cluster-api/test/framework/controlplane_helpers.go b/vendor/sigs.k8s.io/cluster-api/test/framework/controlplane_helpers.go
index a7eb3b0a2b..cb9724aa00 100644
--- a/vendor/sigs.k8s.io/cluster-api/test/framework/controlplane_helpers.go
+++ b/vendor/sigs.k8s.io/cluster-api/test/framework/controlplane_helpers.go
@@ -188,7 +188,7 @@ func WaitForControlPlaneToBeReady(ctx context.Context, input WaitForControlPlane
 		}
 
 		return true, nil
-	}, intervals...).Should(BeTrue(), PrettyPrint(controlplane)+"\n")
+	}, intervals...).Should(BeTrue(), func() string { return PrettyPrint(controlplane) + "\n" })
 }
 
 // AssertControlPlaneFailureDomainsInput is the input for AssertControlPlaneFailureDomains.
diff --git a/vendor/sigs.k8s.io/structured-merge-diff/v6/fieldpath/serialize-pe.go b/vendor/sigs.k8s.io/structured-merge-diff/v6/fieldpath/serialize-pe.go
index f4b00c2ee5..b2f62dc693 100644
--- a/vendor/sigs.k8s.io/structured-merge-diff/v6/fieldpath/serialize-pe.go
+++ b/vendor/sigs.k8s.io/structured-merge-diff/v6/fieldpath/serialize-pe.go
@@ -97,6 +97,14 @@ func DeserializePathElement(s string) (PathElement, error) {
 		if err != nil {
 			return PathElement{}, err
 		}
+		// Lookahead validates that there is no unexpected trailing data.
+		// io.EOF is a successful termination indicator; all other errors or trailing data fail.
+		if iter.WhatIsNext(); iter.Error != io.EOF {
+			if iter.Error == nil {
+				iter.ReportError("managedFields parsing", "unexpected trailing data after JSON object")
+			}
+			return PathElement{}, iter.Error
+		}
 		return PathElement{Value: &v}, nil
 	case peKeySepBytes[0]:
 		iter := readPool.BorrowIterator(b)
@@ -112,8 +120,16 @@ func DeserializePathElement(s string) (PathElement, error) {
 			fields = append(fields, value.Field{Name: key, Value: v})
 			return true
 		})
+		// Lookahead validates that there is no unexpected trailing data.
+		// io.EOF is a successful termination indicator; all other errors or trailing data fail.
+		if iter.WhatIsNext(); iter.Error != io.EOF {
+			if iter.Error == nil {
+				iter.ReportError("managedFields parsing", "unexpected trailing data after JSON object")
+			}
+			return PathElement{}, iter.Error
+		}
 		fields.Sort()
-		return PathElement{Key: &fields}, iter.Error
+		return PathElement{Key: &fields}, nil
 	case peIndexSepBytes[0]:
 		i, err := strconv.Atoi(s[2:])
 		if err != nil {
diff --git a/vendor/sigs.k8s.io/structured-merge-diff/v6/fieldpath/serialize.go b/vendor/sigs.k8s.io/structured-merge-diff/v6/fieldpath/serialize.go
index b992b93c5f..6701f17ee9 100644
--- a/vendor/sigs.k8s.io/structured-merge-diff/v6/fieldpath/serialize.go
+++ b/vendor/sigs.k8s.io/structured-merge-diff/v6/fieldpath/serialize.go
@@ -175,6 +175,17 @@ func (s *Set) FromJSON(r io.Reader) error {
 	} else {
 		*s = *found
 	}
+	if iter.Error != nil {
+		return iter.Error
+	}
+	if iter.WhatIsNext(); iter.Error == nil {
+		// Piggy back on scanner aware error reporting here.
+		iter.ReportError("managedFields parsing", "unexpected trailing data after JSON object")
+		return iter.Error
+	}
+	if iter.Error == io.EOF {
+		return nil
+	}
 	return iter.Error
 }
 
diff --git a/vendor/sigs.k8s.io/structured-merge-diff/v6/schema/elements.go b/vendor/sigs.k8s.io/structured-merge-diff/v6/schema/elements.go
index c8138a6548..4c0e30b257 100644
--- a/vendor/sigs.k8s.io/structured-merge-diff/v6/schema/elements.go
+++ b/vendor/sigs.k8s.io/structured-merge-diff/v6/schema/elements.go
@@ -62,6 +62,10 @@ type TypeRef struct {
 	// If this field is nil, then it has no effect.
 	// See `Map` and `List` for more information about `ElementRelationship`
 	ElementRelationship *ElementRelationship `yaml:"elementRelationship,omitempty"`
+
+	// Nullable indicates that an explicit null is a valid value,
+	// corresponding to OpenAPI's `nullable: true`.
+	Nullable bool `yaml:"nullable,omitempty"`
 }
 
 // Atom represents the smallest possible pieces of the type system.
diff --git a/vendor/sigs.k8s.io/structured-merge-diff/v6/schema/equals.go b/vendor/sigs.k8s.io/structured-merge-diff/v6/schema/equals.go
index b668eff833..e1fa5c95dd 100644
--- a/vendor/sigs.k8s.io/structured-merge-diff/v6/schema/equals.go
+++ b/vendor/sigs.k8s.io/structured-merge-diff/v6/schema/equals.go
@@ -55,6 +55,9 @@ func (a *TypeRef) Equals(b *TypeRef) bool {
 	if a.ElementRelationship != b.ElementRelationship {
 		return false
 	}
+	if a.Nullable != b.Nullable {
+		return false
+	}
 	return a.Inlined.Equals(&b.Inlined)
 }
 
diff --git a/vendor/sigs.k8s.io/structured-merge-diff/v6/schema/schemaschema.go b/vendor/sigs.k8s.io/structured-merge-diff/v6/schema/schemaschema.go
index 6eb6c36df3..4eb367b657 100644
--- a/vendor/sigs.k8s.io/structured-merge-diff/v6/schema/schemaschema.go
+++ b/vendor/sigs.k8s.io/structured-merge-diff/v6/schema/schemaschema.go
@@ -69,6 +69,9 @@ var SchemaSchemaYAML = `types:
     - name: elementRelationship
       type:
         scalar: string
+    - name: nullable
+      type:
+        scalar: boolean
 - name: scalar
   scalar: string
 - name: map
diff --git a/vendor/sigs.k8s.io/structured-merge-diff/v6/typed/remove.go b/vendor/sigs.k8s.io/structured-merge-diff/v6/typed/remove.go
index 0db1734f94..78ba6f50d0 100644
--- a/vendor/sigs.k8s.io/structured-merge-diff/v6/typed/remove.go
+++ b/vendor/sigs.k8s.io/structured-merge-diff/v6/typed/remove.go
@@ -75,7 +75,6 @@ func (w *removingWalker) doList(t *schema.List) (errs ValidationErrors) {
 	}
 
 	var newItems []interface{}
-	hadMatches := false
 	iter := l.RangeUsing(w.allocator)
 	defer w.allocator.Free(iter)
 	for iter.Next() {
@@ -99,26 +98,12 @@ func (w *removingWalker) doList(t *schema.List) (errs ValidationErrors) {
 				continue
 			}
 			if isPrefixMatch {
-				// Removing nested items within this list item and preserve if it becomes empty
-				hadMatches = true
-				wasMap := item.IsMap()
-				wasList := item.IsList()
 				item = removeItemsWithSchema(item, w.toRemove.WithPrefix(pe), w.schema, t.ElementType, w.shouldExtract)
-				// If item returned null but we're removing items within the structure(not the item itself),
-				// preserve the empty container structure
-				if item.IsNull() && !w.shouldExtract {
-					if wasMap {
-						item = value.NewValueInterface(map[string]interface{}{})
-					} else if wasList {
-						item = value.NewValueInterface([]interface{}{})
-					}
-				}
 			}
 			newItems = append(newItems, item.Unstructured())
 		}
 	}
-	// Preserve empty lists (non-nil) instead of converting to null when items were matched and removed
-	if len(newItems) > 0 || (hadMatches && !w.shouldExtract) {
+	if len(newItems) > 0 {
 		w.out = newItems
 	}
 	return nil
@@ -156,7 +141,6 @@ func (w *removingWalker) doMap(t *schema.Map) ValidationErrors {
 	}
 
 	newMap := map[string]interface{}{}
-	hadMatches := false
 	m.Iterate(func(k string, val value.Value) bool {
 		pe := fieldpath.PathElement{FieldName: &k}
 		path, _ := fieldpath.MakePath(pe)
@@ -174,19 +158,7 @@ func (w *removingWalker) doMap(t *schema.Map) ValidationErrors {
 			return true
 		}
 		if subset := w.toRemove.WithPrefix(pe); !subset.Empty() {
-			hadMatches = true
-			wasMap := val.IsMap()
-			wasList := val.IsList()
 			val = removeItemsWithSchema(val, subset, w.schema, fieldType, w.shouldExtract)
-			// If val returned null but we're removing items within the structure (not the field itself),
-			// preserve the empty container structure
-			if val.IsNull() && !w.shouldExtract {
-				if wasMap {
-					val = value.NewValueInterface(map[string]interface{}{})
-				} else if wasList {
-					val = value.NewValueInterface([]interface{}{})
-				}
-			}
 		} else {
 			// don't save values not on the path when we shouldExtract.
 			if w.shouldExtract {
@@ -196,8 +168,7 @@ func (w *removingWalker) doMap(t *schema.Map) ValidationErrors {
 		newMap[k] = val.Unstructured()
 		return true
 	})
-	// Preserve empty maps (non-nil) instead of converting to null when items were matched and removed
-	if len(newMap) > 0 || (hadMatches && !w.shouldExtract) {
+	if len(newMap) > 0 {
 		w.out = newMap
 	}
 	return nil
diff --git a/vendor/sigs.k8s.io/structured-merge-diff/v6/value/reflectcache.go b/vendor/sigs.k8s.io/structured-merge-diff/v6/value/reflectcache.go
index 75b7085c3e..f4f4c2b44d 100644
--- a/vendor/sigs.k8s.io/structured-merge-diff/v6/value/reflectcache.go
+++ b/vendor/sigs.k8s.io/structured-merge-diff/v6/value/reflectcache.go
@@ -39,14 +39,28 @@ type UnstructuredConverter interface {
 	ToUnstructured() interface{}
 }
 
+// UnstructuredConverterWithError is implemented instead of UnstructuredConverter by types for which
+// some, but not all, values can be converted directly to unstructured. If a type implements both
+// UnstructuredConverter and UnstructuredConverterWithError, its UnstructuredConverterWithError
+// implementation takes precedence during conversion.
+type UnstructuredConverterWithError interface {
+	json.Marshaler // require that json.Marshaler is implemented
+
+	// ToUnstructured returns the unstructured representation, or a non-nil error if the value
+	// cannot be converted to unstructured.
+	ToUnstructuredWithError() (any, error)
+}
+
 // TypeReflectCacheEntry keeps data gathered using reflection about how a type is converted to/from unstructured.
 type TypeReflectCacheEntry struct {
-	isJsonMarshaler        bool
-	ptrIsJsonMarshaler     bool
-	isJsonUnmarshaler      bool
-	ptrIsJsonUnmarshaler   bool
-	isStringConvertable    bool
-	ptrIsStringConvertable bool
+	isJsonMarshaler                     bool
+	ptrIsJsonMarshaler                  bool
+	isJsonUnmarshaler                   bool
+	ptrIsJsonUnmarshaler                bool
+	isUnstructuredConverter             bool
+	ptrIsUnstructuredConverter          bool
+	isUnstructuredConverterWithError    bool
+	ptrIsUnstructuredConverterWithError bool
 
 	structFields        map[string]*FieldCacheEntry
 	orderedStructFields []*FieldCacheEntry
@@ -93,9 +107,10 @@ func (f *FieldCacheEntry) GetFrom(structVal reflect.Value) reflect.Value {
 	return structVal
 }
 
-var marshalerType = reflect.TypeOf(new(json.Marshaler)).Elem()
-var unmarshalerType = reflect.TypeOf(new(json.Unmarshaler)).Elem()
-var unstructuredConvertableType = reflect.TypeOf(new(UnstructuredConverter)).Elem()
+var marshalerType = reflect.TypeFor[json.Marshaler]()
+var unmarshalerType = reflect.TypeFor[json.Unmarshaler]()
+var unstructuredConverterType = reflect.TypeFor[UnstructuredConverter]()
+var unstructuredConverterWithErrorType = reflect.TypeFor[UnstructuredConverterWithError]()
 var defaultReflectCache = newReflectCache()
 
 // TypeReflectEntryOf returns the TypeReflectCacheEntry of the provided reflect.Type.
@@ -122,11 +137,13 @@ func typeReflectEntryOf(cm reflectCacheMap, t reflect.Type, updates reflectCache
 		return record
 	}
 	typeEntry := &TypeReflectCacheEntry{
-		isJsonMarshaler:        t.Implements(marshalerType),
-		ptrIsJsonMarshaler:     reflect.PtrTo(t).Implements(marshalerType),
-		isJsonUnmarshaler:      reflect.PtrTo(t).Implements(unmarshalerType),
-		isStringConvertable:    t.Implements(unstructuredConvertableType),
-		ptrIsStringConvertable: reflect.PtrTo(t).Implements(unstructuredConvertableType),
+		isJsonMarshaler:                     t.Implements(marshalerType),
+		ptrIsJsonMarshaler:                  reflect.PointerTo(t).Implements(marshalerType),
+		isJsonUnmarshaler:                   reflect.PointerTo(t).Implements(unmarshalerType),
+		isUnstructuredConverter:             t.Implements(unstructuredConverterType),
+		ptrIsUnstructuredConverter:          reflect.PointerTo(t).Implements(unstructuredConverterType),
+		isUnstructuredConverterWithError:    t.Implements(unstructuredConverterWithErrorType),
+		ptrIsUnstructuredConverterWithError: reflect.PointerTo(t).Implements(unstructuredConverterWithErrorType),
 	}
 	if t.Kind() == reflect.Struct {
 		fieldEntries := map[string]*FieldCacheEntry{}
@@ -190,7 +207,7 @@ func (e TypeReflectCacheEntry) OrderedFields() []*FieldCacheEntry {
 
 // CanConvertToUnstructured returns true if this TypeReflectCacheEntry can convert values of its type to unstructured.
 func (e TypeReflectCacheEntry) CanConvertToUnstructured() bool {
-	return e.isJsonMarshaler || e.ptrIsJsonMarshaler || e.isStringConvertable || e.ptrIsStringConvertable
+	return e.isJsonMarshaler || e.ptrIsJsonMarshaler || e.isUnstructuredConverter || e.ptrIsUnstructuredConverter || e.isUnstructuredConverterWithError || e.ptrIsUnstructuredConverterWithError
 }
 
 // ToUnstructured converts the provided value to unstructured and returns it.
@@ -206,7 +223,7 @@ func (e TypeReflectCacheEntry) ToUnstructured(sv reflect.Value) (interface{}, er
 	// Check if the object has a custom string converter and use it if available, since it is much more efficient
 	// than round tripping through json.
 	if converter, ok := e.getUnstructuredConverter(sv); ok {
-		return converter.ToUnstructured(), nil
+		return converter.ToUnstructuredWithError()
 	}
 	// Check if the object has a custom JSON marshaller/unmarshaller.
 	if marshaler, ok := e.getJsonMarshaler(sv); ok {
@@ -318,16 +335,26 @@ func (e TypeReflectCacheEntry) getJsonUnmarshaler(v reflect.Value) (json.Unmarsh
 	return v.Addr().Interface().(json.Unmarshaler), true
 }
 
-func (e TypeReflectCacheEntry) getUnstructuredConverter(v reflect.Value) (UnstructuredConverter, bool) {
-	if e.isStringConvertable {
-		return v.Interface().(UnstructuredConverter), true
-	}
-	if e.ptrIsStringConvertable {
+type unstructuredConverterWithNilError struct {
+	UnstructuredConverter
+}
+
+func (c unstructuredConverterWithNilError) ToUnstructuredWithError() (any, error) {
+	return c.UnstructuredConverter.ToUnstructured(), nil
+}
+
+func (e TypeReflectCacheEntry) getUnstructuredConverter(v reflect.Value) (UnstructuredConverterWithError, bool) {
+	switch {
+	case e.isUnstructuredConverterWithError:
+		return v.Interface().(UnstructuredConverterWithError), true
+	case e.ptrIsUnstructuredConverterWithError && v.CanAddr():
 		// Check pointer receivers if v is not a pointer
-		if v.CanAddr() {
-			v = v.Addr()
-			return v.Interface().(UnstructuredConverter), true
-		}
+		return v.Addr().Interface().(UnstructuredConverterWithError), true
+	case e.isUnstructuredConverter:
+		return unstructuredConverterWithNilError{v.Interface().(UnstructuredConverter)}, true
+	case e.ptrIsUnstructuredConverter && v.CanAddr():
+		// Check pointer receivers if v is not a pointer
+		return unstructuredConverterWithNilError{v.Addr().Interface().(UnstructuredConverter)}, true
 	}
 	return nil, false
 }
diff --git a/vendor/sigs.k8s.io/structured-merge-diff/v6/value/value.go b/vendor/sigs.k8s.io/structured-merge-diff/v6/value/value.go
index 140b99038e..167848ebeb 100644
--- a/vendor/sigs.k8s.io/structured-merge-diff/v6/value/value.go
+++ b/vendor/sigs.k8s.io/structured-merge-diff/v6/value/value.go
@@ -118,6 +118,11 @@ func readJSONIter(iter *jsoniter.Iterator) (Value, error) {
 	if iter.Error != nil && iter.Error != io.EOF {
 		return nil, iter.Error
 	}
+	if iter.WhatIsNext(); iter.Error == nil {
+		// Piggy back on scanner aware error reporting here.
+		iter.ReportError("managedFields parsing", "unexpected trailing data after JSON object")
+		return nil, iter.Error
+	}
 	return NewValueInterface(v), nil
 }