From 1165d9d5de51282bcb41efbea8f9a1071076f2f0 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 9 Oct 2026 04:03:32 +0000
Subject: [PATCH] Bump code.cloudfoundry.org/cfhttp/v2 from 2.97.0 to 2.98.0

---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/cfhttp/v2
  dependency-version: 2.98.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod                                        |  6 +-
 go.sum                                        | 12 +--
 .../x/tools/go/gcexportdata/gcexportdata.go   | 24 +++++-
 .../golang.org/x/tools/go/packages/golist.go  | 82 +++++++++++--------
 .../x/tools/go/packages/golist_overlay.go     | 11 +--
 .../x/tools/go/packages/packages.go           |  2 +-
 .../x/tools/go/types/objectpath/objectpath.go | 12 ++-
 .../x/tools/internal/aliases/aliases.go       | 18 ----
 .../x/tools/internal/gcimporter/bimport.go    |  1 +
 .../x/tools/internal/gcimporter/exportdata.go |  1 +
 .../x/tools/internal/gcimporter/gcimporter.go | 14 ++++
 .../x/tools/internal/gcimporter/iexport.go    |  1 +
 .../x/tools/internal/gcimporter/iimport.go    | 18 ++--
 .../tools/internal/gcimporter/predeclared.go  |  1 +
 .../x/tools/internal/gcimporter/support.go    |  1 +
 .../x/tools/internal/gcimporter/ureader.go    | 11 +--
 .../x/tools/internal/pkgbits/codes.go         |  2 +
 .../x/tools/internal/pkgbits/decoder.go       |  1 +
 .../x/tools/internal/pkgbits/doc.go           |  2 +
 .../x/tools/internal/pkgbits/encoder.go       |  1 +
 .../x/tools/internal/pkgbits/reloc.go         |  2 +
 .../x/tools/internal/pkgbits/support.go       |  1 +
 .../x/tools/internal/pkgbits/sync.go          |  1 +
 .../x/tools/internal/pkgbits/version.go       |  2 +
 .../x/tools/internal/typesinternal/isnamed.go | 10 +--
 .../x/tools/internal/typesinternal/recv.go    | 35 +++++---
 .../x/tools/internal/typesinternal/types.go   | 14 ++--
 .../x/tools/internal/typesinternal/varkind.go | 23 ------
 .../internal/typesinternal/varkind_go124.go   | 39 ---------
 vendor/modules.txt                            |  7 +-
 30 files changed, 175 insertions(+), 180 deletions(-)
 delete mode 100644 vendor/golang.org/x/tools/internal/aliases/aliases.go
 delete mode 100644 vendor/golang.org/x/tools/internal/typesinternal/varkind.go
 delete mode 100644 vendor/golang.org/x/tools/internal/typesinternal/varkind_go124.go

diff --git a/go.mod b/go.mod
index 4f4afcb1..37738c98 100644
--- a/go.mod
+++ b/go.mod
@@ -3,7 +3,7 @@ module code.cloudfoundry.org/cc-uploader
 go 1.26.0
 
 require (
-	code.cloudfoundry.org/cfhttp/v2 v2.97.0
+	code.cloudfoundry.org/cfhttp/v2 v2.98.0
 	code.cloudfoundry.org/debugserver v0.117.0
 	code.cloudfoundry.org/lager/v3 v3.89.0
 	code.cloudfoundry.org/runtimeschema v0.0.0-20240514235758-31be7684c5bf
@@ -24,7 +24,7 @@ require (
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
-	github.com/google/pprof v0.0.0-20260926063103-aaccee046517 // indirect
+	github.com/google/pprof v0.0.0-20261005154351-639476b4d215 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20231201235250-de7065d80cb9 // indirect
 	github.com/jackc/puddle/v2 v2.2.1 // indirect
@@ -37,6 +37,6 @@ require (
 	golang.org/x/sync v0.23.0 // indirect
 	golang.org/x/sys v0.48.0 // indirect
 	golang.org/x/text v0.42.0 // indirect
-	golang.org/x/tools v0.50.0 // indirect
+	golang.org/x/tools v0.51.0 // indirect
 	google.golang.org/protobuf v1.36.12 // indirect
 )
diff --git a/go.sum b/go.sum
index 79a3ad8e..74360bd2 100644
--- a/go.sum
+++ b/go.sum
@@ -1,7 +1,7 @@
 code.cloudfoundry.org/bbs v0.0.0-20240418184526-a7ed0dccd9f7 h1:vmwkTM1T0Hx6V4LgOGrU6dgkwNNJg5yf8Wyk1I6ptpg=
 code.cloudfoundry.org/bbs v0.0.0-20240418184526-a7ed0dccd9f7/go.mod h1:XKlGVVXFi5EcHHMPzw3xgONK9PeEZuUbIC43XNwxD10=
-code.cloudfoundry.org/cfhttp/v2 v2.97.0 h1:XawcYFCZW7Kih/FjwD5leLj7kcNkIJY8KybsosjotDQ=
-code.cloudfoundry.org/cfhttp/v2 v2.97.0/go.mod h1:Z0bOhXfB+FdYUxMviiQvGXGRkXEfMWguiP5gdWJKohE=
+code.cloudfoundry.org/cfhttp/v2 v2.98.0 h1:v4j2Jf+xuRM+IOPJk61WOLSVTnwVTNfBNvhVkQui4wQ=
+code.cloudfoundry.org/cfhttp/v2 v2.98.0/go.mod h1:uoB379h2eBLtUXx/Z/kEyflYJ5DD/pdd978jZqK0sxg=
 code.cloudfoundry.org/clock v1.0.0 h1:kFXWQM4bxYvdBw2X8BbBeXwQNgfoWv1vqAk2ZZyBN2o=
 code.cloudfoundry.org/clock v1.0.0/go.mod h1:QD9Lzhd/ux6eNQVUDVRJX/RKTigpewimNYBi7ivZKY8=
 code.cloudfoundry.org/debugserver v0.117.0 h1:yU9K3/EoGZT3L7ONggrpCzei2q4Wk2qiKiLgMJ4KdK4=
@@ -53,8 +53,8 @@ github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/pprof v0.0.0-20260926063103-aaccee046517 h1:joNby64wfCIWh0HXBMrjZc6ii70nntnG9u3CQSXXwiA=
-github.com/google/pprof v0.0.0-20260926063103-aaccee046517/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=
+github.com/google/pprof v0.0.0-20261005154351-639476b4d215 h1:uMfyq+ydobW4jp0SfVGnfgrrJDm/0wLH8wdnGsBBqaM=
+github.com/google/pprof v0.0.0-20261005154351-639476b4d215/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=
 github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
 github.com/jackc/pgservicefile v0.0.0-20231201235250-de7065d80cb9 h1:L0QtFUgDarD7Fpv9jeVMgy/+Ec0mtnmYuImjTz6dtDA=
@@ -152,8 +152,8 @@ golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGm
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.50.0 h1:c2ifzfcuY7L90lZ2aKd8S4K2NpASF08SZx9ZuJkHmSU=
-golang.org/x/tools v0.50.0/go.mod h1:7ulVMw3831Mwi5EZD6RomGyffr4VFjuNYXf2BbCEAV0=
+golang.org/x/tools v0.51.0 h1:k4Xc/1Om9jwkBJBo4NVLMSARBoWtK10mx+W5BnXCeAI=
+golang.org/x/tools v0.51.0/go.mod h1:9eEncMayCV6zRMGhR5eZEC2iBx98qWcF1HZ9Z7wJOoA=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
diff --git a/vendor/golang.org/x/tools/go/gcexportdata/gcexportdata.go b/vendor/golang.org/x/tools/go/gcexportdata/gcexportdata.go
index e6159d71..5b0e3b47 100644
--- a/vendor/golang.org/x/tools/go/gcexportdata/gcexportdata.go
+++ b/vendor/golang.org/x/tools/go/gcexportdata/gcexportdata.go
@@ -82,14 +82,30 @@ func Find(importPath, srcDir string) (filename, path string) {
 	return data.Export, data.ImportPath
 }
 
-// NewReader returns a reader for the export data section of an object
-// (.o) or archive (.a) file read from r.  The new reader may provide
-// additional trailing data beyond the end of the export data.
+// NewReader returns a reader for export data read from r. Export data
+// may be read from:
+//
+//   - The export data section of an object (.o) or archive file (.a).
+//     In this case, the new reader may provide additional trailing data
+//     beyond the end of the export data.
+//   - The output of the cmd/export tool (e.g. via "go list -export").
+//     In this case, the new reader contains no trailing data.
 //
 // Deprecated: This package will stop supporting the reading of export
-// data from compiler-produced archive files in Go 1.29.
+// data from compiler-produced archive files in Go 1.29. To read
+// cmd/export files, use [Read] directly instead.
 func NewReader(r io.Reader) (io.Reader, error) {
 	buf := bufio.NewReader(r)
+	peek, err := buf.Peek(1)
+	if err != nil {
+		return nil, err
+	}
+	if peek[0] == 'i' {
+		// We were given an output of cmd/export. The entire file is
+		// export data.
+		return buf, nil
+	}
+
 	size, err := gcimporter.FindExportData(buf)
 	if err != nil {
 		return nil, err
diff --git a/vendor/golang.org/x/tools/go/packages/golist.go b/vendor/golang.org/x/tools/go/packages/golist.go
index 8e60cbbe..8f66c355 100644
--- a/vendor/golang.org/x/tools/go/packages/golist.go
+++ b/vendor/golang.org/x/tools/go/packages/golist.go
@@ -317,10 +317,17 @@ func (state *golistState) adhocPackage(pattern, query string) (*DriverResponse,
 	if err != nil {
 		return nil, err
 	}
-	// If we get nothing back from `go list`,
-	// try to make this file into its own ad-hoc package.
-	// TODO(rstambler): Should this check against the original response?
-	if len(response.Packages) == 0 {
+	// Only .go files can form ad-hoc packages (command-line-arguments);
+	// non-Go files cannot be compiled as Go packages (golang.org/issue/54815).
+	if filepath.Ext(query) != ".go" {
+		return response, nil
+	}
+
+	switch len(response.Packages) {
+	case 0:
+		// If we get nothing back from `go list`,
+		// try to make this file into its own ad-hoc package.
+		// TODO(rstambler): Should this check against the original response?
 		response.Packages = append(response.Packages, &Package{
 			ID:              "command-line-arguments",
 			PkgPath:         query,
@@ -329,22 +336,23 @@ func (state *golistState) adhocPackage(pattern, query string) (*DriverResponse,
 			Imports:         make(map[string]*Package),
 		})
 		response.Roots = append(response.Roots, "command-line-arguments")
-	}
-	// Handle special cases.
-	if len(response.Packages) == 1 {
+
+	case 1:
+		// Handle special cases.
 		// golang/go#33482: If this is a file= query for ad-hoc packages where
 		// the file only exists on an overlay, and exists outside of a module,
 		// add the file to the package and remove the errors.
-		if response.Packages[0].ID == "command-line-arguments" ||
-			filepath.ToSlash(response.Packages[0].PkgPath) == filepath.ToSlash(query) {
-			if len(response.Packages[0].GoFiles) == 0 {
+		pkg := response.Packages[0]
+		if pkg.ID == "command-line-arguments" ||
+			filepath.ToSlash(pkg.PkgPath) == filepath.ToSlash(query) {
+			if len(pkg.GoFiles) == 0 {
 				filename := filepath.Join(pattern, filepath.Base(query)) // avoid recomputing abspath
 				// TODO(matloob): check if the file is outside of a root dir?
 				for path := range state.cfg.Overlay {
 					if path == filename {
-						response.Packages[0].Errors = nil
-						response.Packages[0].GoFiles = []string{path}
-						response.Packages[0].CompiledGoFiles = []string{path}
+						pkg.Errors = nil
+						pkg.GoFiles = []string{path}
+						pkg.CompiledGoFiles = []string{path}
 					}
 				}
 			}
@@ -683,9 +691,14 @@ func (state *golistState) createDriverResponse(words ...string) (*DriverResponse
 
 		if p.Error != nil {
 			msg := strings.TrimSpace(p.Error.Err) // Trim to work around golang.org/issue/32363.
-			// Address golang.org/issue/35964 by appending import stack to error message.
-			if msg == "import cycle not allowed" && len(p.Error.ImportStack) != 0 {
-				msg += fmt.Sprintf(": import stack: %v", p.Error.ImportStack)
+			// Address golang.org/issue/35964 and golang.org/issue/38826 by appending import stack to error message.
+			// Address golang/go#38826 by removing " (test)"
+			if (msg == "import cycle not allowed" || msg == "import cycle not allowed in test") && len(p.Error.ImportStack) != 0 {
+				stack := make([]string, len(p.Error.ImportStack))
+				for i, s := range p.Error.ImportStack {
+					stack[i] = strings.TrimSuffix(s, " (test)")
+				}
+				msg += fmt.Sprintf(": import stack: %v", stack)
 			}
 			pkg.Errors = append(pkg.Errors, Error{
 				Pos:  p.Error.Pos,
@@ -752,29 +765,27 @@ func (state *golistState) getPkgPath(dir string) (string, bool, error) {
 		return "", false, err
 	}
 
+	// A directory can be contained in multiple roots, for example when a
+	// replaced module is nested inside the main module. Choose the most
+	// specific root, breaking ties lexically for deterministic behavior.
+	var bestRoot, bestPath, bestRel string
 	for rdir, rpath := range roots {
-		// Make sure that the directory is in the module,
-		// to avoid creating a path relative to another module.
-		if !strings.HasPrefix(dir, rdir) {
-			continue
-		}
 		// TODO(matloob): This doesn't properly handle symlinks.
 		r, err := filepath.Rel(rdir, dir)
-		if err != nil {
+		if err != nil || !filepath.IsLocal(r) {
 			continue
 		}
-		if rpath != "" {
-			// We choose only one root even though the directory even it can belong in multiple modules
-			// or GOPATH entries. This is okay because we only need to work with absolute dirs when a
-			// file is missing from disk, for instance when gopls calls go/packages in an overlay.
-			// Once the file is saved, gopls, or the next invocation of the tool will get the correct
-			// result straight from golist.
-			// TODO(matloob): Implement module tiebreaking?
-			return path.Join(rpath, filepath.ToSlash(r)), true, nil
+		if bestRoot == "" || len(rdir) > len(bestRoot) || len(rdir) == len(bestRoot) && rdir < bestRoot {
+			bestRoot, bestPath, bestRel = rdir, rpath, r
 		}
-		return filepath.ToSlash(r), true, nil
 	}
-	return "", false, nil
+	if bestRoot == "" {
+		return "", false, nil
+	}
+	if bestPath != "" {
+		return path.Join(bestPath, filepath.ToSlash(bestRel)), true, nil
+	}
+	return filepath.ToSlash(bestRel), true, nil
 }
 
 // absJoin absolutizes and flattens the lists of files.
@@ -996,9 +1007,12 @@ func (state *golistState) invokeGo(verb string, args ...string) (*bytes.Buffer,
 			return bytes.NewBufferString(output), nil
 		}
 
-		// Workaround for #29280: go list -e has incorrect behavior when an ad-hoc package doesn't exist.
+		// Workaround for #29280 and #31344: go list -e has incorrect behavior when an ad-hoc package doesn't exist.
 		// Note that the error message we look for in this case is different that the one looked for above.
-		if len(stderr.String()) > 0 && strings.Contains(stderr.String(), "no such file or directory") {
+		// "no such file or directory" is emitted on Unix,
+		if len(stderr.String()) > 0 && (strings.Contains(stderr.String(), "no such file or directory") || // Unix
+			strings.Contains(stderr.String(), "The system cannot find the file specified") || // Windows ERROR_FILE_NOT_FOUND
+			strings.Contains(stderr.String(), "The system cannot find the path specified")) { // Windows ERROR_PATH_NOT_FOUND
 			output := fmt.Sprintf(`{"ImportPath": "command-line-arguments","Incomplete": true,"Error": {"Pos": "","Err": %q}}`,
 				strings.Trim(stderr.String(), "\n"))
 			return bytes.NewBufferString(output), nil
diff --git a/vendor/golang.org/x/tools/go/packages/golist_overlay.go b/vendor/golang.org/x/tools/go/packages/golist_overlay.go
index d9d5a45c..8bd0f7fa 100644
--- a/vendor/golang.org/x/tools/go/packages/golist_overlay.go
+++ b/vendor/golang.org/x/tools/go/packages/golist_overlay.go
@@ -31,8 +31,8 @@ func (state *golistState) determineRootDirs() (map[string]string, error) {
 }
 
 func (state *golistState) determineRootDirsModules() (map[string]string, error) {
-	// List all of the modules--the first will be the directory for the main
-	// module. Any replaced modules will also need to be treated as roots.
+	// List all of the modules. Main modules and replaced modules need to be
+	// treated as roots.
 	// Editing files in the module cache isn't a great idea, so we don't
 	// plan to ever support that.
 	out, err := state.invokeGo("list", "-m", "-json", "all")
@@ -46,8 +46,6 @@ func (state *golistState) determineRootDirsModules() (map[string]string, error)
 		}
 	}
 	roots := map[string]string{}
-	modules := map[string]string{}
-	var i int
 	for dec := json.NewDecoder(out); dec.More(); {
 		mod := new(gocommand.ModuleJSON)
 		if err := dec.Decode(mod); err != nil {
@@ -59,13 +57,10 @@ func (state *golistState) determineRootDirsModules() (map[string]string, error)
 			if err != nil {
 				return nil, err
 			}
-			modules[absDir] = mod.Path
-			// The first result is the main module.
-			if i == 0 || mod.Replace != nil && mod.Replace.Path != "" {
+			if mod.Main || mod.Replace != nil && mod.Replace.Path != "" {
 				roots[absDir] = mod.Path
 			}
 		}
-		i++
 	}
 	return roots, nil
 }
diff --git a/vendor/golang.org/x/tools/go/packages/packages.go b/vendor/golang.org/x/tools/go/packages/packages.go
index 1e5549ab..5dadc1b0 100644
--- a/vendor/golang.org/x/tools/go/packages/packages.go
+++ b/vendor/golang.org/x/tools/go/packages/packages.go
@@ -1508,7 +1508,7 @@ func (ld *loader) loadFromExportData(lpkg *loaderPackage) error {
 	}
 	defer f.Close()
 
-	// Read gc export data.
+	// Read gc or cmd/export export data.
 	//
 	// We don't currently support gccgo export data because all
 	// underlying workspaces use the gc toolchain. (Even build
diff --git a/vendor/golang.org/x/tools/go/types/objectpath/objectpath.go b/vendor/golang.org/x/tools/go/types/objectpath/objectpath.go
index 9c7401c9..91add849 100644
--- a/vendor/golang.org/x/tools/go/types/objectpath/objectpath.go
+++ b/vendor/golang.org/x/tools/go/types/objectpath/objectpath.go
@@ -31,8 +31,7 @@ import (
 	"strconv"
 	"strings"
 	"sync"
-
-	"golang.org/x/tools/internal/typesinternal"
+	// This package is dependency-restricted; see x/tools/go/gcexportdata.TestDeps.
 )
 
 // TODO(adonovan): think about generic aliases.
@@ -692,8 +691,13 @@ func (enc *Encoder) concreteMethod(meth *types.Func) (Path, bool) {
 		return "", false
 	}
 
-	_, named := typesinternal.ReceiverNamed(meth.Signature().Recv())
-	if named == nil {
+	// Avoid dependency on typesinternal.RecvBase here.
+	t := meth.Signature().Recv().Type()
+	if ptr, ok := types.Unalias(t).(*types.Pointer); ok {
+		t = ptr.Elem()
+	}
+	named, ok := types.Unalias(t).(*types.Named)
+	if !ok {
 		return "", false
 	}
 
diff --git a/vendor/golang.org/x/tools/internal/aliases/aliases.go b/vendor/golang.org/x/tools/internal/aliases/aliases.go
deleted file mode 100644
index a4ae04bc..00000000
--- a/vendor/golang.org/x/tools/internal/aliases/aliases.go
+++ /dev/null
@@ -1,18 +0,0 @@
-// Copyright 2024 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package aliases
-
-import (
-	"go/token"
-	"go/types"
-)
-
-// New creates a new TypeName in Package pkg that
-// is an alias for the type rhs.
-func New(pos token.Pos, pkg *types.Package, name string, rhs types.Type, tparams []*types.TypeParam) *types.TypeName {
-	tname := types.NewTypeName(pos, pkg, name, nil)
-	types.NewAlias(tname, rhs).SetTypeParams(tparams)
-	return tname
-}
diff --git a/vendor/golang.org/x/tools/internal/gcimporter/bimport.go b/vendor/golang.org/x/tools/internal/gcimporter/bimport.go
index 555ef626..3fca56c0 100644
--- a/vendor/golang.org/x/tools/internal/gcimporter/bimport.go
+++ b/vendor/golang.org/x/tools/internal/gcimporter/bimport.go
@@ -12,6 +12,7 @@ import (
 	"go/token"
 	"go/types"
 	"sync"
+	// This package is dependency-restricted; see x/tools/go/gcexportdata.TestDeps.
 )
 
 func errorf(format string, args ...any) {
diff --git a/vendor/golang.org/x/tools/internal/gcimporter/exportdata.go b/vendor/golang.org/x/tools/internal/gcimporter/exportdata.go
index 5662a311..885369d4 100644
--- a/vendor/golang.org/x/tools/internal/gcimporter/exportdata.go
+++ b/vendor/golang.org/x/tools/internal/gcimporter/exportdata.go
@@ -19,6 +19,7 @@ import (
 	"path/filepath"
 	"strings"
 	"sync"
+	// This package is dependency-restricted; see x/tools/go/gcexportdata.TestDeps.
 )
 
 // FindExportData positions the reader r at the beginning of the
diff --git a/vendor/golang.org/x/tools/internal/gcimporter/gcimporter.go b/vendor/golang.org/x/tools/internal/gcimporter/gcimporter.go
index 3dbd21d1..8c56f5d9 100644
--- a/vendor/golang.org/x/tools/internal/gcimporter/gcimporter.go
+++ b/vendor/golang.org/x/tools/internal/gcimporter/gcimporter.go
@@ -28,6 +28,7 @@ import (
 	"go/types"
 	"io"
 	"os"
+	// This package is dependency-restricted; see x/tools/go/gcexportdata.TestDeps.
 )
 
 const (
@@ -95,6 +96,19 @@ func Import(fset *token.FileSet, packages map[string]*types.Package, path, srcDi
 	defer rc.Close()
 
 	buf := bufio.NewReader(rc)
+	peek, err := buf.Peek(1)
+	if err != nil {
+		return
+	}
+	if peek[0] == 'i' {
+		var data []byte // avoid redeclaring err
+		data, err = io.ReadAll(buf)
+		if err != nil {
+			return
+		}
+		pkg, err = IImportData(fset, packages, data[1:], path)
+		return
+	}
 	data, err := ReadUnified(buf)
 	if err != nil {
 		err = fmt.Errorf("import %q: %v", path, err)
diff --git a/vendor/golang.org/x/tools/internal/gcimporter/iexport.go b/vendor/golang.org/x/tools/internal/gcimporter/iexport.go
index 1dc51b7f..6bee3c41 100644
--- a/vendor/golang.org/x/tools/internal/gcimporter/iexport.go
+++ b/vendor/golang.org/x/tools/internal/gcimporter/iexport.go
@@ -242,6 +242,7 @@ import (
 	"strings"
 
 	"golang.org/x/tools/go/types/objectpath"
+	// This package is dependency-restricted; see x/tools/go/gcexportdata.TestDeps.
 )
 
 // IExportShallow encodes "shallow" export data for the specified package.
diff --git a/vendor/golang.org/x/tools/internal/gcimporter/iimport.go b/vendor/golang.org/x/tools/internal/gcimporter/iimport.go
index 06f07bc3..e9149882 100644
--- a/vendor/golang.org/x/tools/internal/gcimporter/iimport.go
+++ b/vendor/golang.org/x/tools/internal/gcimporter/iimport.go
@@ -21,8 +21,7 @@ import (
 	"strings"
 
 	"golang.org/x/tools/go/types/objectpath"
-	"golang.org/x/tools/internal/aliases"
-	"golang.org/x/tools/internal/typesinternal"
+	// This package is dependency-restricted; see x/tools/go/gcexportdata.TestDeps.
 )
 
 type intReader struct {
@@ -566,8 +565,8 @@ func (r *importReader) obj(pkg *types.Package, name string) {
 		if tag == genericAliasTag {
 			tparams = r.tparamList()
 		}
-		typ := r.typ()
-		obj := aliases.New(pos, pkg, name, typ, tparams)
+		obj := types.NewTypeName(pos, pkg, name, nil)
+		types.NewAlias(obj, r.typ()).SetTypeParams(tparams)
 		markBlack(obj) // workaround for golang/go#69912
 		r.declare(obj)
 
@@ -616,8 +615,13 @@ func (r *importReader) obj(pkg *types.Package, name string) {
 				// If the receiver has any targs, set those as the
 				// rparams of the method (since those are the
 				// typeparams being used in the method sig/body).
-				_, recvNamed := typesinternal.ReceiverNamed(recv)
-				targs := recvNamed.TypeArgs()
+				//
+				// Avoid dependency on typesinternal.RecvBase here.
+				t := recv.Type()
+				if ptr, ok := types.Unalias(t).(*types.Pointer); ok {
+					t = ptr.Elem()
+				}
+				targs := types.Unalias(t).(*types.Named).TypeArgs()
 				var rparams []*types.TypeParam
 				if targs.Len() > 0 {
 					rparams = make([]*types.TypeParam, targs.Len())
@@ -667,7 +671,7 @@ func (r *importReader) obj(pkg *types.Package, name string) {
 		typ := r.typ()
 
 		v := types.NewVar(pos, pkg, name, typ)
-		typesinternal.SetVarKind(v, typesinternal.PackageVar)
+		v.SetKind(types.PackageVar)
 		r.declare(v)
 
 	default:
diff --git a/vendor/golang.org/x/tools/internal/gcimporter/predeclared.go b/vendor/golang.org/x/tools/internal/gcimporter/predeclared.go
index 907c8557..a8bfa875 100644
--- a/vendor/golang.org/x/tools/internal/gcimporter/predeclared.go
+++ b/vendor/golang.org/x/tools/internal/gcimporter/predeclared.go
@@ -7,6 +7,7 @@ package gcimporter
 import (
 	"go/types"
 	"sync"
+	// This package is dependency-restricted; see x/tools/go/gcexportdata.TestDeps.
 )
 
 // predecl is a cache for the predeclared types in types.Universe.
diff --git a/vendor/golang.org/x/tools/internal/gcimporter/support.go b/vendor/golang.org/x/tools/internal/gcimporter/support.go
index 4af810dc..28b17694 100644
--- a/vendor/golang.org/x/tools/internal/gcimporter/support.go
+++ b/vendor/golang.org/x/tools/internal/gcimporter/support.go
@@ -9,6 +9,7 @@ import (
 	"io"
 	"strconv"
 	"strings"
+	// This package is dependency-restricted; see x/tools/go/gcexportdata.TestDeps.
 )
 
 // Copy of $GOROOT/src/cmd/internal/archive.ReadHeader.
diff --git a/vendor/golang.org/x/tools/internal/gcimporter/ureader.go b/vendor/golang.org/x/tools/internal/gcimporter/ureader.go
index 3c258c2e..09e833ce 100644
--- a/vendor/golang.org/x/tools/internal/gcimporter/ureader.go
+++ b/vendor/golang.org/x/tools/internal/gcimporter/ureader.go
@@ -13,9 +13,8 @@ import (
 	"sort"
 	"strings"
 
-	"golang.org/x/tools/internal/aliases"
 	"golang.org/x/tools/internal/pkgbits"
-	"golang.org/x/tools/internal/typesinternal"
+	// This package is dependency-restricted; see x/tools/go/gcexportdata.TestDeps.
 )
 
 // A pkgReader holds the shared state for reading a unified IR package
@@ -551,7 +550,9 @@ func (pr *pkgReader) objIdx(idx pkgbits.Index) (*types.Package, string) {
 				tparams = r.typeParamNames(false)
 			}
 			typ := r.typ()
-			declare(aliases.New(pos, objPkg, objName, typ, tparams))
+			tname := types.NewTypeName(pos, objPkg, objName, nil)
+			types.NewAlias(tname, typ).SetTypeParams(tparams)
+			declare(tname)
 
 		case pkgbits.ObjConst:
 			pos := r.pos()
@@ -588,7 +589,7 @@ func (pr *pkgReader) objIdx(idx pkgbits.Index) (*types.Package, string) {
 						sig := fn.Type().(*types.Signature)
 
 						recv := types.NewVar(fn.Pos(), fn.Pkg(), "", named)
-						typesinternal.SetVarKind(recv, typesinternal.RecvVar)
+						recv.SetKind(types.RecvVar)
 						methods[i] = types.NewFunc(fn.Pos(), fn.Pkg(), fn.Name(), types.NewSignatureType(recv, nil, nil, sig.Params(), sig.Results(), sig.Variadic()))
 					}
 
@@ -695,7 +696,7 @@ func (pr *pkgReader) objIdx(idx pkgbits.Index) (*types.Package, string) {
 			pos := r.pos()
 			typ := r.typ()
 			v := types.NewVar(pos, objPkg, objName, typ)
-			typesinternal.SetVarKind(v, typesinternal.PackageVar)
+			v.SetKind(types.PackageVar)
 			declare(v)
 		}
 	}
diff --git a/vendor/golang.org/x/tools/internal/pkgbits/codes.go b/vendor/golang.org/x/tools/internal/pkgbits/codes.go
index f0cabde9..21f44d96 100644
--- a/vendor/golang.org/x/tools/internal/pkgbits/codes.go
+++ b/vendor/golang.org/x/tools/internal/pkgbits/codes.go
@@ -4,6 +4,8 @@
 
 package pkgbits
 
+// This package is dependency-restricted; see x/tools/go/gcexportdata.TestDeps.
+
 // A Code is an enum value that can be encoded into bitstreams.
 //
 // Code types are preferable for enum types, because they allow
diff --git a/vendor/golang.org/x/tools/internal/pkgbits/decoder.go b/vendor/golang.org/x/tools/internal/pkgbits/decoder.go
index c0aba26c..f05e2696 100644
--- a/vendor/golang.org/x/tools/internal/pkgbits/decoder.go
+++ b/vendor/golang.org/x/tools/internal/pkgbits/decoder.go
@@ -15,6 +15,7 @@ import (
 	"os"
 	"runtime"
 	"strings"
+	// This package is dependency-restricted; see x/tools/go/gcexportdata.TestDeps.
 )
 
 // A PkgDecoder provides methods for decoding a package's Unified IR
diff --git a/vendor/golang.org/x/tools/internal/pkgbits/doc.go b/vendor/golang.org/x/tools/internal/pkgbits/doc.go
index c8a2796b..f5a9badf 100644
--- a/vendor/golang.org/x/tools/internal/pkgbits/doc.go
+++ b/vendor/golang.org/x/tools/internal/pkgbits/doc.go
@@ -30,3 +30,5 @@
 //
 // This is a copy of internal/pkgbits in the Go implementation.
 package pkgbits
+
+// This package is dependency-restricted; see x/tools/go/gcexportdata.TestDeps.
diff --git a/vendor/golang.org/x/tools/internal/pkgbits/encoder.go b/vendor/golang.org/x/tools/internal/pkgbits/encoder.go
index c17a1239..ac9c8e8b 100644
--- a/vendor/golang.org/x/tools/internal/pkgbits/encoder.go
+++ b/vendor/golang.org/x/tools/internal/pkgbits/encoder.go
@@ -13,6 +13,7 @@ import (
 	"math/big"
 	"runtime"
 	"strings"
+	// This package is dependency-restricted; see x/tools/go/gcexportdata.TestDeps.
 )
 
 // A PkgEncoder provides methods for encoding a package's Unified IR
diff --git a/vendor/golang.org/x/tools/internal/pkgbits/reloc.go b/vendor/golang.org/x/tools/internal/pkgbits/reloc.go
index fcdfb97c..99494aa3 100644
--- a/vendor/golang.org/x/tools/internal/pkgbits/reloc.go
+++ b/vendor/golang.org/x/tools/internal/pkgbits/reloc.go
@@ -4,6 +4,8 @@
 
 package pkgbits
 
+// This package is dependency-restricted; see x/tools/go/gcexportdata.TestDeps.
+
 // A RelocKind indicates a particular section within a unified IR export.
 type RelocKind int32
 
diff --git a/vendor/golang.org/x/tools/internal/pkgbits/support.go b/vendor/golang.org/x/tools/internal/pkgbits/support.go
index 50534a29..b0011600 100644
--- a/vendor/golang.org/x/tools/internal/pkgbits/support.go
+++ b/vendor/golang.org/x/tools/internal/pkgbits/support.go
@@ -4,6 +4,7 @@
 
 package pkgbits
 
+// This package is dependency-restricted; see x/tools/go/gcexportdata.TestDeps.
 import "fmt"
 
 func assert(b bool) {
diff --git a/vendor/golang.org/x/tools/internal/pkgbits/sync.go b/vendor/golang.org/x/tools/internal/pkgbits/sync.go
index 1520b73a..4cf7f1ee 100644
--- a/vendor/golang.org/x/tools/internal/pkgbits/sync.go
+++ b/vendor/golang.org/x/tools/internal/pkgbits/sync.go
@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"runtime"
 	"strings"
+	// This package is dependency-restricted; see x/tools/go/gcexportdata.TestDeps.
 )
 
 // fmtFrames formats a backtrace for reporting reader/writer desyncs.
diff --git a/vendor/golang.org/x/tools/internal/pkgbits/version.go b/vendor/golang.org/x/tools/internal/pkgbits/version.go
index 684b4717..932a9267 100644
--- a/vendor/golang.org/x/tools/internal/pkgbits/version.go
+++ b/vendor/golang.org/x/tools/internal/pkgbits/version.go
@@ -4,6 +4,8 @@
 
 package pkgbits
 
+// This package is dependency-restricted; see x/tools/go/gcexportdata.TestDeps.
+
 // Version indicates a version of a unified IR bitstream.
 // Each Version indicates the addition, removal, or change of
 // new data in the bitstream.
diff --git a/vendor/golang.org/x/tools/internal/typesinternal/isnamed.go b/vendor/golang.org/x/tools/internal/typesinternal/isnamed.go
index e0d63c46..9af27f80 100644
--- a/vendor/golang.org/x/tools/internal/typesinternal/isnamed.go
+++ b/vendor/golang.org/x/tools/internal/typesinternal/isnamed.go
@@ -60,12 +60,10 @@ func IsFunctionNamed(obj types.Object, pkgPath string, names ...string) bool {
 // which is important for the performance of syntax matching.
 func IsMethodNamed(obj types.Object, pkgPath string, typeName string, names ...string) bool {
 	if fn, ok := obj.(*types.Func); ok {
-		if recv := fn.Signature().Recv(); recv != nil {
-			_, T := ReceiverNamed(recv)
-			return T != nil &&
-				IsTypeNamed(T, pkgPath, typeName) &&
-				slices.Contains(names, fn.Name())
-		}
+		_, T := RecvBase(fn)
+		return T != nil &&
+			IsTypeNamed(T, pkgPath, typeName) &&
+			slices.Contains(names, fn.Name())
 	}
 	return false
 }
diff --git a/vendor/golang.org/x/tools/internal/typesinternal/recv.go b/vendor/golang.org/x/tools/internal/typesinternal/recv.go
index 8352ea76..564e93b1 100644
--- a/vendor/golang.org/x/tools/internal/typesinternal/recv.go
+++ b/vendor/golang.org/x/tools/internal/typesinternal/recv.go
@@ -8,19 +8,32 @@ import (
 	"go/types"
 )
 
-// ReceiverNamed returns the named type (if any) associated with the
-// type of recv, which may be of the form N or *N, or aliases thereof.
-// It also reports whether a Pointer was present.
+// RecvBase returns the receiver base type (if any) of the method fn,
+// and reports whether the receiver is a pointer to it.
 //
-// The named result may be nil if recv is from a method on an
-// anonymous interface or struct types or in ill-typed code.
-func ReceiverNamed(recv *types.Var) (isPtr bool, named *types.Named) {
-	t := recv.Type()
-	if ptr, ok := types.Unalias(t).(*types.Pointer); ok {
-		isPtr = true
-		t = ptr.Elem()
+// The spec says of a method declaration: the receiver's "type must be
+// a defined type T or a pointer to a defined type T, possibly followed
+// by a list of type parameter names [P1, P2, …] enclosed in square
+// brackets. T is called the receiver base type."
+//
+// The named result is nil if fn is not a method, or if its receiver
+// is an anonymous interface or struct type, as in interface{ f() }.
+//
+// TODO(adonovan): go.dev/issue/81715 proposes this as a method of *types.Func.
+func RecvBase(fn *types.Func) (isPtr bool, named *types.Named) {
+	// The boolean result appears first to
+	// avoid misinterpretation as an 'ok'
+	// bool, and because that's the natural
+	// reading order in "*Named".
+
+	if recv := fn.Signature().Recv(); recv != nil {
+		t := recv.Type()
+		if ptr, ok := types.Unalias(t).(*types.Pointer); ok {
+			isPtr = true
+			t = ptr.Elem()
+		}
+		named, _ = types.Unalias(t).(*types.Named)
 	}
-	named, _ = types.Unalias(t).(*types.Named)
 	return
 }
 
diff --git a/vendor/golang.org/x/tools/internal/typesinternal/types.go b/vendor/golang.org/x/tools/internal/typesinternal/types.go
index 3e4c7c3b..b916df22 100644
--- a/vendor/golang.org/x/tools/internal/typesinternal/types.go
+++ b/vendor/golang.org/x/tools/internal/typesinternal/types.go
@@ -9,7 +9,7 @@
 //   - functions for converting types to strings or syntax (e.g. [TypeExpr], FileQualifier]);
 //   - helpers for working with the [go/types] API (e.g. [NewTypesInfo]);
 //   - access to internal go/types APIs that are not yet
-//     exported (e.g. [SetUsesCgo], [ErrorCodeStartEnd], [VarKind]); and
+//     exported (e.g. [SetUsesCgo], [ErrorCodeStartEnd]); and
 //   - common algorithms related to types (e.g. [TooNewStdSymbols]).
 //
 // See also:
@@ -215,17 +215,17 @@ func ObjectKind(obj types.Object) string {
 		}
 	case *types.Var:
 		switch obj.Kind() {
-		case PackageVar:
+		case types.PackageVar:
 			return "package-level variable"
-		case LocalVar:
+		case types.LocalVar:
 			return "local variable"
-		case RecvVar:
+		case types.RecvVar:
 			return "receiver"
-		case ParamVar:
+		case types.ParamVar:
 			return "parameter"
-		case ResultVar:
+		case types.ResultVar:
 			return "result variable"
-		case FieldVar:
+		case types.FieldVar:
 			return "struct field"
 		}
 	case *types.Func:
diff --git a/vendor/golang.org/x/tools/internal/typesinternal/varkind.go b/vendor/golang.org/x/tools/internal/typesinternal/varkind.go
deleted file mode 100644
index 26499cdd..00000000
--- a/vendor/golang.org/x/tools/internal/typesinternal/varkind.go
+++ /dev/null
@@ -1,23 +0,0 @@
-// Copyright 2024 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build go1.25
-
-package typesinternal
-
-import "go/types"
-
-type VarKind = types.VarKind
-
-const (
-	PackageVar = types.PackageVar
-	LocalVar   = types.LocalVar
-	RecvVar    = types.RecvVar
-	ParamVar   = types.ParamVar
-	ResultVar  = types.ResultVar
-	FieldVar   = types.FieldVar
-)
-
-func GetVarKind(v *types.Var) VarKind       { return v.Kind() }
-func SetVarKind(v *types.Var, kind VarKind) { v.SetKind(kind) }
diff --git a/vendor/golang.org/x/tools/internal/typesinternal/varkind_go124.go b/vendor/golang.org/x/tools/internal/typesinternal/varkind_go124.go
deleted file mode 100644
index 17b1804b..00000000
--- a/vendor/golang.org/x/tools/internal/typesinternal/varkind_go124.go
+++ /dev/null
@@ -1,39 +0,0 @@
-// Copyright 2024 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build !go1.25
-
-package typesinternal
-
-import "go/types"
-
-type VarKind uint8
-
-const (
-	_          VarKind = iota // (not meaningful)
-	PackageVar                // a package-level variable
-	LocalVar                  // a local variable
-	RecvVar                   // a method receiver variable
-	ParamVar                  // a function parameter variable
-	ResultVar                 // a function result variable
-	FieldVar                  // a struct field
-)
-
-func (kind VarKind) String() string {
-	return [...]string{
-		0:          "VarKind(0)",
-		PackageVar: "PackageVar",
-		LocalVar:   "LocalVar",
-		RecvVar:    "RecvVar",
-		ParamVar:   "ParamVar",
-		ResultVar:  "ResultVar",
-		FieldVar:   "FieldVar",
-	}[kind]
-}
-
-// GetVarKind returns an invalid VarKind.
-func GetVarKind(v *types.Var) VarKind { return 0 }
-
-// SetVarKind has no effect.
-func SetVarKind(v *types.Var, kind VarKind) {}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 039b2fae..b063a10f 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -3,7 +3,7 @@
 code.cloudfoundry.org/bbs/encryption
 code.cloudfoundry.org/bbs/format
 code.cloudfoundry.org/bbs/models
-# code.cloudfoundry.org/cfhttp/v2 v2.97.0
+# code.cloudfoundry.org/cfhttp/v2 v2.98.0
 ## explicit; go 1.26.0
 code.cloudfoundry.org/cfhttp/v2
 # code.cloudfoundry.org/debugserver v0.117.0
@@ -66,7 +66,7 @@ github.com/google/go-cmp/cmp/internal/diff
 github.com/google/go-cmp/cmp/internal/flags
 github.com/google/go-cmp/cmp/internal/function
 github.com/google/go-cmp/cmp/internal/value
-# github.com/google/pprof v0.0.0-20260926063103-aaccee046517
+# github.com/google/pprof v0.0.0-20261005154351-639476b4d215
 ## explicit; go 1.25.0
 github.com/google/pprof/profile
 # github.com/jackc/pgpassfile v1.0.0
@@ -169,7 +169,7 @@ golang.org/x/text/internal/utf8internal
 golang.org/x/text/language
 golang.org/x/text/runes
 golang.org/x/text/transform
-# golang.org/x/tools v0.50.0
+# golang.org/x/tools v0.51.0
 ## explicit; go 1.26.0
 golang.org/x/tools/cover
 golang.org/x/tools/go/ast/edge
@@ -177,7 +177,6 @@ golang.org/x/tools/go/ast/inspector
 golang.org/x/tools/go/gcexportdata
 golang.org/x/tools/go/packages
 golang.org/x/tools/go/types/objectpath
-golang.org/x/tools/internal/aliases
 golang.org/x/tools/internal/event
 golang.org/x/tools/internal/event/core
 golang.org/x/tools/internal/event/keys