From ec02b0c2555a451d8abf9420f21979507abadea5 Mon Sep 17 00:00:00 2001
From: "renovate-rancher[bot]"
 <119870437+renovate-rancher[bot]@users.noreply.github.com>
Date: Wed, 17 Jun 2026 06:24:20 +0000
Subject: [PATCH] Update module github.com/sigstore/rekor-tiles/v2 to v2.3.0

---
 go.mod                                        |   33 +-
 go.sum                                        |  182 +--
 .../protoc-gen-openapiv2/options/BUILD.bazel  |    2 +-
 .../grpc-gateway/v2/runtime/handler.go        |    4 +-
 .../grpc-gateway/v2/runtime/mux.go            |   29 +-
 .../go-securesystemslib/dsse/envelope.go      |   26 +-
 .../go-securesystemslib/dsse/verify.go        |   22 +-
 .../gen/pb-go/bundle/v1/sigstore_bundle.pb.go |  104 +-
 .../gen/pb-go/common/v1/sigstore_common.pb.go |  278 ++--
 .../gen/pb-go/dsse/envelope.pb.go             |   36 +-
 .../gen/pb-go/rekor/v1/sigstore_rekor.pb.go   |  105 +-
 .../trustroot/v1/sigstore_trustroot.pb.go     |  221 +--
 .../rekor-tiles/v2/pkg/client/write/write.go  |   25 +-
 .../v2/pkg/generated/protobuf/dsse.pb.go      |   72 +-
 .../v2/pkg/generated/protobuf/entry.pb.go     |   60 +-
 .../rekor-tiles/v2/pkg/verify/verify.go       |   18 +
 .../sigstore/pkg/cryptoutils/privatekey.go    |   34 +
 .../sigstore/pkg/signature/dsse/dsse.go       |   36 +-
 .../sigstore/pkg/signature/dsse/multidsse.go  |   55 +-
 .../sigstore/pkg/signature/dsse/options.go    |   53 +
 .../go-tuf/v2/metadata/marshal.go             |    4 +
 .../go-tuf/v2/metadata/metadata.go            |    4 +
 vendor/github.com/youmark/pkcs8/.gitignore    |   23 +
 vendor/github.com/youmark/pkcs8/LICENSE       |   21 +
 vendor/github.com/youmark/pkcs8/README        |    1 +
 vendor/github.com/youmark/pkcs8/README.md     |   22 +
 vendor/github.com/youmark/pkcs8/cipher.go     |   60 +
 .../github.com/youmark/pkcs8/cipher_3des.go   |   24 +
 vendor/github.com/youmark/pkcs8/cipher_aes.go |   84 +
 vendor/github.com/youmark/pkcs8/kdf_pbkdf2.go |   91 ++
 vendor/github.com/youmark/pkcs8/kdf_scrypt.go |   62 +
 vendor/github.com/youmark/pkcs8/pkcs8.go      |  309 ++++
 .../net/http/otelhttp/config.go               |    3 +
 .../net/http/otelhttp/handler.go              |   26 +-
 .../internal/request/resp_writer_wrapper.go   |    9 +-
 .../http/otelhttp/internal/semconv/client.go  |   50 +-
 .../http/otelhttp/internal/semconv/server.go  |   29 +-
 .../http/otelhttp/internal/semconv/util.go    |    8 +-
 .../net/http/otelhttp/transport.go            |   90 +-
 .../net/http/otelhttp/version.go              |    2 +-
 vendor/go.opentelemetry.io/otel/.golangci.yml |   18 +-
 vendor/go.opentelemetry.io/otel/AGENTS.md     |  109 ++
 vendor/go.opentelemetry.io/otel/CHANGELOG.md  |   97 +-
 vendor/go.opentelemetry.io/otel/CLAUDE.md     |    3 +
 .../go.opentelemetry.io/otel/CONTRIBUTING.md  |  101 +-
 vendor/go.opentelemetry.io/otel/Makefile      |   10 +-
 .../otel/attribute/encoder.go                 |    4 +-
 .../otel/attribute/hash.go                    |   58 +-
 .../go.opentelemetry.io/otel/attribute/key.go |   22 +
 .../go.opentelemetry.io/otel/attribute/kv.go  |   10 +
 .../go.opentelemetry.io/otel/attribute/set.go |    4 +-
 .../otel/attribute/type_string.go             |    6 +-
 .../otel/attribute/value.go                   |  742 +++++++++
 .../otel/baggage/baggage.go                   |   30 +-
 .../otel/dependencies.Dockerfile              |    2 +-
 .../otel/metric/asyncfloat64.go               |    9 +
 .../otel/metric/asyncint64.go                 |    9 +
 .../go.opentelemetry.io/otel/metric/config.go |    7 +
 vendor/go.opentelemetry.io/otel/metric/doc.go |   51 +-
 .../otel/metric/instrument.go                 |   39 +-
 .../otel/metric/syncfloat64.go                |   12 +
 .../otel/metric/syncint64.go                  |   12 +
 .../otel/propagation/baggage.go               |   72 +-
 .../otel/semconv/v1.37.0/attribute_group.go   |   12 +-
 .../otel/semconv/v1.39.0/MIGRATION.md         |   78 -
 .../otel/semconv/v1.39.0/README.md            |    3 -
 .../otel/semconv/v1.39.0/error_type.go        |   56 -
 .../otel/semconv/v1.40.0/attribute_group.go   |   12 +-
 .../otel/semconv/v1.40.0/error_type.go        |   19 +-
 .../{v1.39.0 => v1.40.0}/httpconv/metric.go   |   94 +-
 .../otel/semconv/v1.41.0/MIGRATION.md         |   17 +
 .../otel/semconv/v1.41.0/README.md            |    3 +
 .../{v1.39.0 => v1.41.0}/attribute_group.go   | 1418 ++++++++++++++---
 .../otel/semconv/{v1.39.0 => v1.41.0}/doc.go  |    6 +-
 .../otel/semconv/v1.41.0/error_type.go        |   83 +
 .../semconv/{v1.39.0 => v1.41.0}/exception.go |    4 +-
 .../semconv/{v1.39.0 => v1.41.0}/schema.go    |    6 +-
 vendor/go.opentelemetry.io/otel/trace/auto.go |   20 +-
 .../go.opentelemetry.io/otel/trace/config.go  |   16 +
 .../otel/trace/internal/telemetry/span.go     |    8 +-
 vendor/go.opentelemetry.io/otel/version.go    |    2 +-
 vendor/go.opentelemetry.io/otel/versions.yaml |   12 +-
 .../googleapis/api/annotations/client.pb.go   |  930 ++++++++---
 .../api/annotations/field_behavior.pb.go      |    2 +-
 .../api/annotations/field_info.pb.go          |    2 +-
 .../googleapis/api/annotations/http.pb.go     |    2 +-
 .../googleapis/api/annotations/resource.pb.go |    2 +-
 .../googleapis/api/annotations/routing.pb.go  |   12 +-
 .../googleapis/api/httpbody/httpbody.pb.go    |    2 +-
 .../googleapis/api/launch_stage.pb.go         |    2 +-
 .../googleapis/rpc/status/status.pb.go        |    7 +-
 vendor/k8s.io/klog/v2/README.md               |    2 -
 .../klog/v2/internal/serialize/keyvalues.go   |  232 +--
 .../internal/serialize/keyvalues_no_slog.go   |   10 +-
 .../v2/internal/serialize/keyvalues_slog.go   |   12 +-
 vendor/k8s.io/klog/v2/klog.go                 |   87 +-
 vendor/k8s.io/klog/v2/klogr.go                |    4 +-
 vendor/k8s.io/klog/v2/klogr_slog.go           |   11 +-
 vendor/modules.txt                            |   53 +-
 99 files changed, 5314 insertions(+), 1671 deletions(-)
 create mode 100644 vendor/github.com/sigstore/sigstore/pkg/signature/dsse/options.go
 create mode 100644 vendor/github.com/youmark/pkcs8/.gitignore
 create mode 100644 vendor/github.com/youmark/pkcs8/LICENSE
 create mode 100644 vendor/github.com/youmark/pkcs8/README
 create mode 100644 vendor/github.com/youmark/pkcs8/README.md
 create mode 100644 vendor/github.com/youmark/pkcs8/cipher.go
 create mode 100644 vendor/github.com/youmark/pkcs8/cipher_3des.go
 create mode 100644 vendor/github.com/youmark/pkcs8/cipher_aes.go
 create mode 100644 vendor/github.com/youmark/pkcs8/kdf_pbkdf2.go
 create mode 100644 vendor/github.com/youmark/pkcs8/kdf_scrypt.go
 create mode 100644 vendor/github.com/youmark/pkcs8/pkcs8.go
 create mode 100644 vendor/go.opentelemetry.io/otel/AGENTS.md
 create mode 100644 vendor/go.opentelemetry.io/otel/CLAUDE.md
 delete mode 100644 vendor/go.opentelemetry.io/otel/semconv/v1.39.0/MIGRATION.md
 delete mode 100644 vendor/go.opentelemetry.io/otel/semconv/v1.39.0/README.md
 delete mode 100644 vendor/go.opentelemetry.io/otel/semconv/v1.39.0/error_type.go
 rename vendor/go.opentelemetry.io/otel/semconv/{v1.39.0 => v1.40.0}/httpconv/metric.go (97%)
 create mode 100644 vendor/go.opentelemetry.io/otel/semconv/v1.41.0/MIGRATION.md
 create mode 100644 vendor/go.opentelemetry.io/otel/semconv/v1.41.0/README.md
 rename vendor/go.opentelemetry.io/otel/semconv/{v1.39.0 => v1.41.0}/attribute_group.go (92%)
 rename vendor/go.opentelemetry.io/otel/semconv/{v1.39.0 => v1.41.0}/doc.go (68%)
 create mode 100644 vendor/go.opentelemetry.io/otel/semconv/v1.41.0/error_type.go
 rename vendor/go.opentelemetry.io/otel/semconv/{v1.39.0 => v1.41.0}/exception.go (59%)
 rename vendor/go.opentelemetry.io/otel/semconv/{v1.39.0 => v1.41.0}/schema.go (61%)

diff --git a/go.mod b/go.mod
index 0a93718e4..1c555796b 100644
--- a/go.mod
+++ b/go.mod
@@ -14,7 +14,7 @@ require (
 	github.com/quay/clair/v2 v2.1.8
 	github.com/sigstore/cosign/v3 v3.0.6
 	github.com/sigstore/rekor v1.5.1
-	github.com/sigstore/sigstore v1.10.6
+	github.com/sigstore/sigstore v1.10.8
 	github.com/sirupsen/logrus v1.9.4
 	github.com/stretchr/testify v1.11.1
 	github.com/theupdateframework/go-tuf v0.7.0
@@ -98,7 +98,7 @@ require (
 	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/go-github/v73 v73.0.0 // indirect
 	github.com/google/go-querystring v1.2.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
 	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
@@ -110,7 +110,7 @@ require (
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/klauspost/compress v1.18.6 // indirect
 	github.com/knqyf263/go-rpmdb v0.1.1 // indirect
-	github.com/letsencrypt/boulder v0.20260223.0 // indirect
+	github.com/letsencrypt/boulder v0.20260309.0 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-runewidth v0.0.16 // indirect
 	github.com/miekg/pkcs11 v1.1.2 // indirect
@@ -140,10 +140,10 @@ require (
 	github.com/remyoudompheng/bigfft v0.0.0-20230126093431-47fa9a501578 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/sassoftware/relic v7.2.1+incompatible // indirect
-	github.com/secure-systems-lab/go-securesystemslib v0.10.0 // indirect
+	github.com/secure-systems-lab/go-securesystemslib v0.11.0 // indirect
 	github.com/shibumi/go-pathspec v1.3.0 // indirect
-	github.com/sigstore/protobuf-specs v0.5.0 // indirect
-	github.com/sigstore/rekor-tiles/v2 v2.2.1 // indirect
+	github.com/sigstore/protobuf-specs v0.5.1 // indirect
+	github.com/sigstore/rekor-tiles/v2 v2.3.0 // indirect
 	github.com/sigstore/sigstore-go v1.1.4 // indirect
 	github.com/sigstore/timestamp-authority/v2 v2.0.6 // indirect
 	github.com/spf13/cobra v1.10.2 // indirect
@@ -152,23 +152,24 @@ require (
 	github.com/streadway/simpleuuid v0.0.0-20130420165545-6617b501e485 // indirect
 	github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d // indirect
 	github.com/thales-e-security/pool v0.0.2 // indirect
-	github.com/theupdateframework/go-tuf/v2 v2.4.1 // indirect
+	github.com/theupdateframework/go-tuf/v2 v2.4.2-0.20260407074541-7e8f69f906ef // indirect
 	github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
-	github.com/transparency-dev/formats v0.0.0-20251017110053-404c0d5b696c // indirect
+	github.com/transparency-dev/formats v0.1.0 // indirect
 	github.com/transparency-dev/merkle v0.0.2 // indirect
 	github.com/vishvananda/netlink v1.3.1 // indirect
 	github.com/vishvananda/netns v0.0.5 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
+	github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
 	gitlab.com/gitlab-org/api/client-go v1.46.0 // indirect
 	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0 // indirect
-	go.opentelemetry.io/otel v1.43.0 // indirect
-	go.opentelemetry.io/otel/metric v1.43.0 // indirect
-	go.opentelemetry.io/otel/trace v1.43.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect
+	go.opentelemetry.io/otel v1.44.0 // indirect
+	go.opentelemetry.io/otel/metric v1.44.0 // indirect
+	go.opentelemetry.io/otel/trace v1.44.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.1 // indirect
-	go.yaml.in/yaml/v2 v2.4.3 // indirect
+	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/crypto v0.52.0 // indirect
 	golang.org/x/mod v0.36.0 // indirect
@@ -180,8 +181,8 @@ require (
 	golang.org/x/text v0.37.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260316180232-0b37fe3546d5 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260316180232-0b37fe3546d5 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260523011958-0a33c5d7ca68 // indirect
 	google.golang.org/grpc/security/advancedtls v1.0.0 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
@@ -191,7 +192,7 @@ require (
 	k8s.io/apimachinery v0.35.3 // indirect
 	k8s.io/client-go v0.35.3 // indirect
 	k8s.io/cri-api v0.34.1 // indirect
-	k8s.io/klog/v2 v2.130.1 // indirect
+	k8s.io/klog/v2 v2.140.0 // indirect
 	k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
 	k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 // indirect
 	modernc.org/libc v1.22.2 // indirect
diff --git a/go.sum b/go.sum
index e307fe795..82f4b92f8 100644
--- a/go.sum
+++ b/go.sum
@@ -3,18 +3,18 @@ al.essio.dev/pkg/shellescape v1.6.0/go.mod h1:6sIqp7X2P6mThCQ7twERpZTuigpr6KbZWt
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.123.0 h1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE=
 cloud.google.com/go v0.123.0/go.mod h1:xBoMV08QcqUGuPW65Qfm1o9Y4zKZBpGS+7bImXLTAZU=
-cloud.google.com/go/auth v0.18.2 h1:+Nbt5Ev0xEqxlNjd6c+yYUeosQ5TtEUaNcN/3FozlaM=
-cloud.google.com/go/auth v0.18.2/go.mod h1:xD+oY7gcahcu7G2SG2DsBerfFxgPAJz17zz2joOFF3M=
+cloud.google.com/go/auth v0.20.0 h1:kXTssoVb4azsVDoUiF8KvxAqrsQcQtB53DcSgta74CA=
+cloud.google.com/go/auth v0.20.0/go.mod h1:942/yi/itH1SsmpyrbnTMDgGfdy2BUqIKyd0cyYLc5Q=
 cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
 cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
 cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
 cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
-cloud.google.com/go/iam v1.5.3 h1:+vMINPiDF2ognBJ97ABAYYwRgsaqxPbQDlMnbHMjolc=
-cloud.google.com/go/iam v1.5.3/go.mod h1:MR3v9oLkZCTlaqljW6Eb2d3HGDGK5/bDv93jhfISFvU=
-cloud.google.com/go/kms v1.26.0 h1:cK9mN2cf+9V63D3H1f6koxTatWy39aTI/hCjz1I+adU=
-cloud.google.com/go/kms v1.26.0/go.mod h1:pHKOdFJm63hxBsiPkYtowZPltu9dW0MWvBa6IA4HM58=
-cloud.google.com/go/longrunning v0.8.0 h1:LiKK77J3bx5gDLi4SMViHixjD2ohlkwBi+mKA7EhfW8=
-cloud.google.com/go/longrunning v0.8.0/go.mod h1:UmErU2Onzi+fKDg2gR7dusz11Pe26aknR4kHmJJqIfk=
+cloud.google.com/go/iam v1.7.0 h1:JD3zh0C6LHl16aCn5Akff0+GELdp1+4hmh6ndoFLl8U=
+cloud.google.com/go/iam v1.7.0/go.mod h1:tetWZW1PD/m6vcuY2Zj/aU0eCHNPuxedbnbRTyKXvdY=
+cloud.google.com/go/kms v1.31.0 h1:LS8N92OxFDgOLg5NCo3OmbvjtQAIVT5gUHVLKIDHaFE=
+cloud.google.com/go/kms v1.31.0/go.mod h1:YIyXZym11R5uovJJt4oN5eUL3oPmirF3yKeIh6QAf4U=
+cloud.google.com/go/longrunning v0.9.0 h1:0EzbDEGsAvOZNbqXopgniY0w0a1phvu5IdUFq8grmqY=
+cloud.google.com/go/longrunning v0.9.0/go.mod h1:pkTz846W7bF4o2SzdWJ40Hu0Re+UoNT6Q5t+igIcb8E=
 cyphar.com/go-pathrs v0.2.1 h1:9nx1vOgwVvX1mNBWDu93+vaceedpbsDqo+XuBGL40b8=
 cyphar.com/go-pathrs v0.2.1/go.mod h1:y8f1EMG7r+hCuFf/rXsKqMJrJAUoADZGNh5/vZPKcGc=
 filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
@@ -52,36 +52,36 @@ github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3d
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
 github.com/aws/aws-sdk-go v1.55.8 h1:JRmEUbU52aJQZ2AjX4q4Wu7t4uZjOu71uyNmaWlUkJQ=
 github.com/aws/aws-sdk-go v1.55.8/go.mod h1:ZkViS9AqA6otK+JBBNH2++sx1sgxrPKcSzPPvQkUtXk=
-github.com/aws/aws-sdk-go-v2 v1.41.4 h1:10f50G7WyU02T56ox1wWXq+zTX9I1zxG46HYuG1hH/k=
-github.com/aws/aws-sdk-go-v2 v1.41.4/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o=
-github.com/aws/aws-sdk-go-v2/config v1.32.12 h1:O3csC7HUGn2895eNrLytOJQdoL2xyJy0iYXhoZ1OmP0=
-github.com/aws/aws-sdk-go-v2/config v1.32.12/go.mod h1:96zTvoOFR4FURjI+/5wY1vc1ABceROO4lWgWJuxgy0g=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.12 h1:oqtA6v+y5fZg//tcTWahyN9PEn5eDU/Wpvc2+kJ4aY8=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.12/go.mod h1:U3R1RtSHx6NB0DvEQFGyf/0sbrpJrluENHdPy1j/3TE=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 h1:zOgq3uezl5nznfoK3ODuqbhVg1JzAGDUhXOsU0IDCAo=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20/go.mod h1:z/MVwUARehy6GAg/yQ1GO2IMl0k++cu1ohP9zo887wE=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.20 h1:CNXO7mvgThFGqOFgbNAP2nol2qAWBOGfqR/7tQlvLmc=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.20/go.mod h1:oydPDJKcfMhgfcgBUZaG+toBbwy8yPWubJXBVERtI4o=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.20 h1:tN6W/hg+pkM+tf9XDkWUbDEjGLb+raoBMFsTodcoYKw=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.20/go.mod h1:YJ898MhD067hSHA6xYCx5ts/jEd8BSOLtQDL3iZsvbc=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 h1:qYQ4pzQ2Oz6WpQ8T3HvGHnZydA72MnLuFK9tJwmrbHw=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6/go.mod h1:O3h0IK87yXci+kg6flUKzJnWeziQUKciKrLjcatSNcY=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 h1:5EniKhLZe4xzL7a+fU3C2tfUN4nWIqlLesfrjkuPFTY=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7/go.mod h1:x0nZssQ3qZSnIcePWLvcoFisRXJzcTVvYpAAdYX8+GI=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.20 h1:2HvVAIq+YqgGotK6EkMf+KIEqTISmTYh5zLpYyeTo1Y=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.20/go.mod h1:V4X406Y666khGa8ghKmphma/7C0DAtEQYhkq9z4vpbk=
-github.com/aws/aws-sdk-go-v2/service/kms v1.50.3 h1:s/zDSG/a/Su9aX+v0Ld9cimUCdkr5FWPmBV8owaEbZY=
-github.com/aws/aws-sdk-go-v2/service/kms v1.50.3/go.mod h1:/iSgiUor15ZuxFGQSTf3lA2FmKxFsQoc2tADOarQBSw=
-github.com/aws/aws-sdk-go-v2/service/signin v1.0.8 h1:0GFOLzEbOyZABS3PhYfBIx2rNBACYcKty+XGkTgw1ow=
-github.com/aws/aws-sdk-go-v2/service/signin v1.0.8/go.mod h1:LXypKvk85AROkKhOG6/YEcHFPoX+prKTowKnVdcaIxE=
-github.com/aws/aws-sdk-go-v2/service/sso v1.30.13 h1:kiIDLZ005EcKomYYITtfsjn7dtOwHDOFy7IbPXKek2o=
-github.com/aws/aws-sdk-go-v2/service/sso v1.30.13/go.mod h1:2h/xGEowcW/g38g06g3KpRWDlT+OTfxxI0o1KqayAB8=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17 h1:jzKAXIlhZhJbnYwHbvUQZEB8KfgAEuG0dc08Bkda7NU=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17/go.mod h1:Al9fFsXjv4KfbzQHGe6V4NZSZQXecFcvaIF4e70FoRA=
-github.com/aws/aws-sdk-go-v2/service/sts v1.41.9 h1:Cng+OOwCHmFljXIxpEVXAGMnBia8MSU6Ch5i9PgBkcU=
-github.com/aws/aws-sdk-go-v2/service/sts v1.41.9/go.mod h1:LrlIndBDdjA/EeXeyNBle+gyCwTlizzW5ycgWnvIxkk=
-github.com/aws/smithy-go v1.24.2 h1:FzA3bu/nt/vDvmnkg+R8Xl46gmzEDam6mZ1hzmwXFng=
-github.com/aws/smithy-go v1.24.2/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
+github.com/aws/aws-sdk-go-v2 v1.41.9 h1:/rYeyO2+HrMztAmxAq9++XJtFMqSIpSsNA0yDGALYq4=
+github.com/aws/aws-sdk-go-v2 v1.41.9/go.mod h1:+HsoOEX80qAVUitj1A2DhCNTjmb3edVyuDypb6LNEeo=
+github.com/aws/aws-sdk-go-v2/config v1.32.20 h1:8VMDnWc/kEzxsI/1ngGM9mG81a8IGmIHD8KLcYGwagc=
+github.com/aws/aws-sdk-go-v2/config v1.32.20/go.mod h1:PuwEpciweIXGULWeOeSTXtSbH4CW9mWdWrhdCKQI1sM=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.19 h1:yuFzSV1U0aRNYCQGVaTY2zW2M/L93pYHnXnrJUphYhU=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.19/go.mod h1:7y63L1kGzeoDlJaQ3Z578KrnmfBut96JjvJUzGwR+YE=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.25 h1:0w6dCiO8iez+YKwRhRBlL1CH/E3GTfdkuzrwj1by8vo=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.25/go.mod h1:9FDWUothyr5RCRAHc45XOiVCzUR8n/IhCYX+uVqw6vk=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.25 h1:Uii3frf9ztec/ABM2/FSH9/z7PLzxfpG8h4RpkUFflQ=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.25/go.mod h1:G6kntsA2GorAxDPbap6xgB2F+amSLUF8GJTi7PUoX44=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.25 h1:r1+/l6m+WaUJF9HISEsNOLHSNj5EXYQxK8VX6Cz9NlA=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.25/go.mod h1:cKf+D+NMDK1LndD7BowHbBZPgR9V0/5HubH0PFWvA+c=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.26 h1:A1PmWU2zfkIm9EyFlJncFXL4W4phML+h8KjltUsCvNQ=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.26/go.mod h1:dY4MRzXEizrD4hqtpKvWVGPX7QleSGGVY+EBolo1RmM=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.10 h1:d5/908OJ4bXg8lyjeMPvXetEKqoDoLi5Owy1zNue3yg=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.10/go.mod h1:a57l7Hwh+FWI+we50g5NPJHYUKeJKfXbc4w8SyXu8Ig=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.25 h1:dD3dhHNglpd98gs72my22Ndqi1hqQGllFFg1F+twfxg=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.25/go.mod h1:0yAbjPfd64gG7mj85RW+fMEYdfBgCRZw8g/oWcL1pjc=
+github.com/aws/aws-sdk-go-v2/service/kms v1.51.1 h1:zuSf4olLKZW8cF/W9Y5wvGT+/0raY/3kVp49KsGs0QY=
+github.com/aws/aws-sdk-go-v2/service/kms v1.51.1/go.mod h1:Y0+uxvxz6ib4KktRdK0V4X45Vcs/JyYoz8H71pO8xeI=
+github.com/aws/aws-sdk-go-v2/service/signin v1.1.1 h1:1VwbP3qMNfxUDEXWki4rCE5iA+44VA1lokTz9HasGzw=
+github.com/aws/aws-sdk-go-v2/service/signin v1.1.1/go.mod h1:vUtyoSj0OPji3kjIVSc/GlKuWEiL33f/WFxl6dmpy/A=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.19 h1:N6pIsdFOW1Kd9S4KyFKXdGRBojPPxkP32+uHFWLv4Hc=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.19/go.mod h1:3gt5WJArFooNmyLONS+h/R4J+o86II8du38IgCwj9dE=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.36.2 h1:hc+lBYiiTr8Zk4MTzIsQ92MeDWCIDvWGmzKUWOaBcOg=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.36.2/go.mod h1:hU6fqB3OJA6/ePheD47LQnxvjYk6br6PtQxs+Q9ojvk=
+github.com/aws/aws-sdk-go-v2/service/sts v1.42.3 h1:ErklX/7uhSbkAAeyQD/Y1OoQ9hO3SJXQNEgksORW3Js=
+github.com/aws/aws-sdk-go-v2/service/sts v1.42.3/go.mod h1:ULe4HCzfKPiR6R3HEurE3b1upEkuk8AkMrOKtaOxKO8=
+github.com/aws/smithy-go v1.26.0 h1:9ouqbi+NyKP7fV3Te7UElCwdAb6Y8uk7LGwPE5tVe/s=
+github.com/aws/smithy-go v1.26.0/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
 github.com/beorn7/perks v0.0.0-20160804104726-4c0e84591b9a/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
@@ -315,18 +315,18 @@ github.com/google/trillian v1.7.2/go.mod h1:mfQJW4qRH6/ilABtPYNBerVJAJ/upxHLX81z
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/enterprise-certificate-proxy v0.3.14 h1:yh8ncqsbUY4shRD5dA6RlzjJaT4hi3kII+zYw8wmLb8=
-github.com/googleapis/enterprise-certificate-proxy v0.3.14/go.mod h1:vqVt9yG9480NtzREnTlmGSBmFrA+bzb0yl0TxoBQXOg=
-github.com/googleapis/gax-go/v2 v2.19.0 h1:fYQaUOiGwll0cGj7jmHT/0nPlcrZDFPrZRhTsoCr8hE=
-github.com/googleapis/gax-go/v2 v2.19.0/go.mod h1:w2ROXVdfGEVFXzmlciUU4EdjHgWvB5h2n6x/8XSTTJA=
+github.com/googleapis/enterprise-certificate-proxy v0.3.16 h1:F/VPrx0YPBdksZJQdCAp0WUsqnNmZpUZszzfYt0M5Dw=
+github.com/googleapis/enterprise-certificate-proxy v0.3.16/go.mod h1:9Yb0eAkH/Xqhvv3zbeKf/+wMJqCeocWc6KIhDvEAuYE=
+github.com/googleapis/gax-go/v2 v2.22.0 h1:PjIWBpgGIVKGoCXuiCoP64altEJCj3/Ei+kSU5vlZD4=
+github.com/googleapis/gax-go/v2 v2.22.0/go.mod h1:irWBbALSr0Sk3qlqb9SyJ1h68WjgeFuiOzI4Rqw5+aY=
 github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
 github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
 github.com/graph-gophers/graphql-go v1.9.0 h1:yu0ucKHLc5qGpRwLYKIWtr9bOoxovkWasuBrPQwlHls=
 github.com/graph-gophers/graphql-go v1.9.0/go.mod h1:23olKZ7duEvHlF/2ELEoSZaY1aNPfShjP782SOoNTyM=
 github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 h1:UH//fgunKIs4JdUbpDl1VZCDaL56wXCB/5+wF6uHfaI=
 github.com/grpc-ecosystem/go-grpc-middleware v1.4.0/go.mod h1:g5qyo/la0ALbONm6Vbp88Yd8NsDy6rZz+RcrMPxvld8=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7 h1:X+2YciYSxvMQK0UZ7sg45ZVabVZBeBuvMkmuI2V3Fak=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7/go.mod h1:lW34nIZuQ8UDPdkon5fmfp2l3+ZkQ2me/+oecHYLOII=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 h1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0/go.mod h1:Hyl3n6Twe1hvtd9XUXDec4pTvgMSEixRuQKPTMH2bNs=
 github.com/guregu/null v3.0.2-0.20160228005316-41961cea0328+incompatible/go.mod h1:ePGpQaN9cw0tj45IR5E5ehMvsFlLlQZAkkOXZurJ3NM=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -399,8 +399,8 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
-github.com/letsencrypt/boulder v0.20260223.0 h1:xdS2OnJNUasR6TgVIOpqqcvdkOu47+PQQMBk9ThuWBw=
-github.com/letsencrypt/boulder v0.20260223.0/go.mod h1:r3aTSA7UZ7dbDfiGK+HLHJz0bWNbHk6YSPiXgzl23sA=
+github.com/letsencrypt/boulder v0.20260309.0 h1:kZynrxK3QfqLGx6hhoz+Rfs3hgltJs1p9Mp+4+VwnY0=
+github.com/letsencrypt/boulder v0.20260309.0/go.mod h1:yG8lj8pNPZ8taq3oNdTpfBS+eC74IaEuiewqzVpXiWE=
 github.com/lib/pq v0.0.0-20170324204654-2704adc878c2/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
@@ -500,8 +500,8 @@ github.com/prometheus/common v0.0.0-20170427095455-13ba4ddd0caa/go.mod h1:daVV7q
 github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4=
 github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw=
 github.com/prometheus/procfs v0.0.0-20170502131342-d098ca18df8b/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
-github.com/prometheus/procfs v0.19.2 h1:zUMhqEW66Ex7OXIiDkll3tl9a1ZdilUOd/F6ZXw4Vws=
-github.com/prometheus/procfs v0.19.2/go.mod h1:M0aotyiemPhBCM0z5w87kL22CxfcH05ZpYlu+b4J7mw=
+github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc=
+github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo=
 github.com/quay/clair/v2 v2.1.8 h1:F3C4CTno0UaGYOajWg19orY4sZe1YBYszL5o7UP6Lc8=
 github.com/quay/clair/v2 v2.1.8/go.mod h1:W98TX5hlrJA0+InaAtyM0R7x8e5SVonTSTj/Pj7ZGiY=
 github.com/remind101/migrate v0.0.0-20160423010909-d22d647232c2/go.mod h1:rhSvwcijY9wfmrBYrfCvapX8/xOTV46NAUjBRgUyJqc=
@@ -520,30 +520,30 @@ github.com/sassoftware/relic v7.2.1+incompatible h1:Pwyh1F3I0r4clFJXkSI8bOyJINGq
 github.com/sassoftware/relic v7.2.1+incompatible/go.mod h1:CWfAxv73/iLZ17rbyhIEq3K9hs5w6FpNMdUT//qR+zk=
 github.com/sassoftware/relic/v7 v7.6.2 h1:rS44Lbv9G9eXsukknS4mSjIAuuX+lMq/FnStgmZlUv4=
 github.com/sassoftware/relic/v7 v7.6.2/go.mod h1:kjmP0IBVkJZ6gXeAu35/KCEfca//+PKM6vTAsyDPY+k=
-github.com/secure-systems-lab/go-securesystemslib v0.10.0 h1:l+H5ErcW0PAehBNrBxoGv1jjNpGYdZ9RcheFkB2WI14=
-github.com/secure-systems-lab/go-securesystemslib v0.10.0/go.mod h1:MRKONWmRoFzPNQ9USRF9i1mc7MvAVvF1LlW8X5VWDvk=
+github.com/secure-systems-lab/go-securesystemslib v0.11.0 h1:iuCR9kcMFD4QurdKrGvPLoKZLv9YvwPYVr0473BdtFs=
+github.com/secure-systems-lab/go-securesystemslib v0.11.0/go.mod h1:+PMOTjUGwHj2vcZ+TFKlb1tXRbrdWE1LYDT5i9JC80Q=
 github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
 github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/shibumi/go-pathspec v1.3.0 h1:QUyMZhFo0Md5B8zV8x2tesohbb5kfbpTi9rBnKh5dkI=
 github.com/shibumi/go-pathspec v1.3.0/go.mod h1:Xutfslp817l2I1cZvgcfeMQJG5QnU2lh5tVaaMCl3jE=
 github.com/sigstore/cosign/v3 v3.0.6 h1:k8XaUd9pmLknHBst/v0rUGHVdB4D9cfaBmWUaMAOocE=
 github.com/sigstore/cosign/v3 v3.0.6/go.mod h1:ckLRkVecfUCYxL8isHODY9lwyKmDaRCPn00p6yFxHg0=
-github.com/sigstore/protobuf-specs v0.5.0 h1:F8YTI65xOHw70NrvPwJ5PhAzsvTnuJMGLkA4FIkofAY=
-github.com/sigstore/protobuf-specs v0.5.0/go.mod h1:+gXR+38nIa2oEupqDdzg4qSBT0Os+sP7oYv6alWewWc=
+github.com/sigstore/protobuf-specs v0.5.1 h1:/5OPaNuolRJmQfeZLayJGFXMpsRJEdgC6ah1/+7Px7U=
+github.com/sigstore/protobuf-specs v0.5.1/go.mod h1:DRBzpFuE+LnvQMN10/dU6nBeKwVLGEQ6o2FovN2Rats=
 github.com/sigstore/rekor v1.5.1 h1:Ca1egHRWRuDvXV4tZu9aXEXc3Gej9FG+HKeapV9OAMQ=
 github.com/sigstore/rekor v1.5.1/go.mod h1:gTLDuZuo3SyQCuZvKqwRPA79Qo/2rw39/WtLP/rZjUQ=
-github.com/sigstore/rekor-tiles/v2 v2.2.1 h1:UmV1CBQ3SjxxPGpFmwDoOhoIwiKpM2Qm1pU5tPGmvNk=
-github.com/sigstore/rekor-tiles/v2 v2.2.1/go.mod h1:z8n6l6oidpaLjjE6rJERuQqY9X38ulnHZCXyL+DEL7U=
-github.com/sigstore/sigstore v1.10.6 h1:YWhMQfTrJSK80QB1pbxjYeAwGKx+5UwWPPAY9hrPPZg=
-github.com/sigstore/sigstore v1.10.6/go.mod h1:k/mcVVXw3I87dYG/iCVTSW2xTrW7vPzxxGic4KqsqXs=
+github.com/sigstore/rekor-tiles/v2 v2.3.0 h1:HhMgH61UP0t899V8Fjt7pz1YdgOBptbaQdnCF+79cdc=
+github.com/sigstore/rekor-tiles/v2 v2.3.0/go.mod h1:DEFiKSyQ4nF75QRVNdOPaIH3cmvMkO2B6xDZjNYngPc=
+github.com/sigstore/sigstore v1.10.8 h1:1Mgkxvkw4AXMfIP1DOjc6kw0GkUgA8pGVpveN/EfOq4=
+github.com/sigstore/sigstore v1.10.8/go.mod h1:f9+B/4iaYimvUkySyb2mvc73n3RLqNn24grHZM/ET8M=
 github.com/sigstore/sigstore-go v1.1.4 h1:wTTsgCHOfqiEzVyBYA6mDczGtBkN7cM8mPpjJj5QvMg=
 github.com/sigstore/sigstore-go v1.1.4/go.mod h1:2U/mQOT9cjjxrtIUeKDVhL+sHBKsnWddn8URlswdBsg=
-github.com/sigstore/sigstore/pkg/signature/kms/aws v1.10.5 h1:aqHRubTITULckG9JAcq2FEhtKkT/RRE8oErfuV3smSI=
-github.com/sigstore/sigstore/pkg/signature/kms/aws v1.10.5/go.mod h1:h9eK9QyPqpFskF/ewFkRLtwh4/Q3FLc2/DXbym4IHN8=
+github.com/sigstore/sigstore/pkg/signature/kms/aws v1.10.8 h1:tofVQ+UWJgad/69I5zbqxdFCN5gpIn9tRQP7iBzIpBw=
+github.com/sigstore/sigstore/pkg/signature/kms/aws v1.10.8/go.mod h1:73AfJE8H6w5KGCFPBu4x/OG+i1Yxgmh0L/FtV7prd88=
 github.com/sigstore/sigstore/pkg/signature/kms/azure v1.10.5 h1:+9C6CUkv+J4iT67Lx+H1EGBfAdoAHqXumHadeIj9jA4=
 github.com/sigstore/sigstore/pkg/signature/kms/azure v1.10.5/go.mod h1:myZsg7wRiy/vf102g5uUAitYhtXCwepmAGxgHG1VHuE=
-github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.10.5 h1:BpQx6AhjwIN9LmlO4ypkcMcHiWiepgZQGSw5U69frHU=
-github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.10.5/go.mod h1:ejMD/17lMJ4HykQRPdj5NNr+OQYIEZto8HjDKghVMOA=
+github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.10.8 h1:MxpAIMZVzn0Tpbarc9ax1I498oQBp7oYSMgoMSsOmKI=
+github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.10.8/go.mod h1:bnAUEkFNam6STvkVZhptVwWzWR5pS24CEtQ+lhxu7S0=
 github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.10.5 h1:OFwQZgWkB/6J6W5sy3SkXE4pJnhNRnE2cJd8ySXmHpo=
 github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.10.5/go.mod h1:Ee/enmyxi/RFLVlajbnjgH2wOWQwlJ0wY8qZrk43hEw=
 github.com/sigstore/timestamp-authority/v2 v2.0.6 h1:1Vh7/SdmLsVLG6Br6/bisd1SnlicfDm0MJYiA+D7Ppw=
@@ -580,8 +580,8 @@ github.com/thales-e-security/pool v0.0.2 h1:RAPs4q2EbWsTit6tpzuvTFlgFRJ3S8Evf5gt
 github.com/thales-e-security/pool v0.0.2/go.mod h1:qtpMm2+thHtqhLzTwgDBj/OuNnMpupY8mv0Phz0gjhU=
 github.com/theupdateframework/go-tuf v0.7.0 h1:CqbQFrWo1ae3/I0UCblSbczevCCbS31Qvs5LdxRWqRI=
 github.com/theupdateframework/go-tuf v0.7.0/go.mod h1:uEB7WSY+7ZIugK6R1hiBMBjQftaFzn7ZCDJcp1tCUug=
-github.com/theupdateframework/go-tuf/v2 v2.4.1 h1:K6ewW064rKZCPkRo1W/CTbTtm/+IB4+coG1iNURAGCw=
-github.com/theupdateframework/go-tuf/v2 v2.4.1/go.mod h1:Nex2enPVYDFCklrnbTzl3OVwD7fgIAj0J5++z/rvCj8=
+github.com/theupdateframework/go-tuf/v2 v2.4.2-0.20260407074541-7e8f69f906ef h1:jJac5InhEfD0Z46/d5RayZjoavf/se7bPZpOgg8GLrM=
+github.com/theupdateframework/go-tuf/v2 v2.4.2-0.20260407074541-7e8f69f906ef/go.mod h1:cLUSJ2cgR194lNWfp+TJT4P8PX7qGleCXdudqlCMtOE=
 github.com/tink-crypto/tink-go-awskms/v2 v2.1.0 h1:N9UxlsOzu5mttdjhxkDLbzwtEecuXmlxZVo/ds7JKJI=
 github.com/tink-crypto/tink-go-awskms/v2 v2.1.0/go.mod h1:PxSp9GlOkKL9rlybW804uspnHuO9nbD98V/fDX4uSis=
 github.com/tink-crypto/tink-go-gcpkms/v2 v2.2.0 h1:3B9i6XBXNTRspfkTC0asN5W0K6GhOSgcujNiECNRNb0=
@@ -592,8 +592,8 @@ github.com/tink-crypto/tink-go/v2 v2.6.0 h1:+KHNBHhWH33Vn+igZWcsgdEPUxKwBMEe0QC6
 github.com/tink-crypto/tink-go/v2 v2.6.0/go.mod h1:2WbBA6pfNsAfBwDCggboaHeB2X29wkU8XHtGwh2YIk8=
 github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 h1:e/5i7d4oYZ+C1wj2THlRK+oAhjeS/TRQwMfkIuet3w0=
 github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399/go.mod h1:LdwHTNJT99C5fTAzDz0ud328OgXz+gierycbcIx2fRs=
-github.com/transparency-dev/formats v0.0.0-20251017110053-404c0d5b696c h1:5a2XDQ2LiAUV+/RjckMyq9sXudfrPSuCY4FuPC1NyAw=
-github.com/transparency-dev/formats v0.0.0-20251017110053-404c0d5b696c/go.mod h1:g85IafeFJZLxlzZCDRu4JLpfS7HKzR+Hw9qRh3bVzDI=
+github.com/transparency-dev/formats v0.1.0 h1:oL0zUFuYUjg8AbtjPMnIRDmjbaHo5jCjEWU5yaNuz0g=
+github.com/transparency-dev/formats v0.1.0/go.mod h1:d2FibUOHfCMdCe/+/rbKt1IPLBbPTDfwj46kt541/mU=
 github.com/transparency-dev/merkle v0.0.2 h1:Q9nBoQcZcgPamMkGn7ghV8XiTZ/kRxn1yCG81+twTK4=
 github.com/transparency-dev/merkle v0.0.2/go.mod h1:pqSy+OXefQ1EDUVmAJ8MUhHB9TXGuzVAT58PqBoHz1A=
 github.com/tylerb/graceful v1.2.15/go.mod h1:LPYTbOYmUTdabwRt0TGhLllQ0MUNbs0Y5q1WXJOI9II=
@@ -603,6 +603,8 @@ github.com/vishvananda/netns v0.0.5 h1:DfiHV+j8bA32MFM7bfEunvT8IAqQ/NzSJHtcmW5zd
 github.com/vishvananda/netns v0.0.5/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
+github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 h1:ilQV1hzziu+LLM3zUTJ0trRztfwgjqKnBWNtSRkbmwM=
+github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78/go.mod h1:aL8wCCfTfSfmXjznFBSZNN13rSJjlIOI1fUNAtF7rmI=
 github.com/ysmood/fetchup v0.2.3 h1:ulX+SonA0Vma5zUFXtv52Kzip/xe7aj4vqT5AJwQ+ZQ=
 github.com/ysmood/fetchup v0.2.3/go.mod h1:xhibcRKziSvol0H1/pj33dnKrYyI2ebIvz5cOOkYGns=
 github.com/ysmood/goob v0.4.0 h1:HsxXhyLBeGzWXnqVKtmT9qM7EuVs/XOgkX7T6r1o1AQ=
@@ -623,20 +625,20 @@ go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 h1:YH4g8lQroajqUwWbq/tr2QX1JFmEXaDLgG+ew9bLMWo=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0/go.mod h1:fvPi2qXDqFs8M4B4fmJhE92TyQs9Ydjlg3RvfUp+NbQ=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0 h1:7iP2uCb7sGddAr30RRS6xjKy7AZ2JtTOPA3oolgVSw8=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0/go.mod h1:c7hN3ddxs/z6q9xwvfLPk+UHlWRQyaeR1LdgfL/66l0=
-go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
-go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
-go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
-go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
-go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
-go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
-go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
-go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
-go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
-go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 h1:yI1/OhfEPy7J9eoa6Sj051C7n5dvpj0QX8g4sRchg04=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0/go.mod h1:NoUCKYWK+3ecatC4HjkRktREheMeEtrXoQxrqYFeHSc=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 h1:OyrsyzuttWTSur2qN/Lm0m2a8yqyIjUVBZcxFPuXq2o=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0/go.mod h1:C2NGBr+kAB4bk3xtMXfZ94gqFDtg/GkI7e9zqGh5Beg=
+go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=
+go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc=
+go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc=
+go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo=
+go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58=
+go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0=
+go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI=
+go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA=
+go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=
+go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=
 go.step.sm/crypto v0.77.2 h1:qFjjei+RHc5kP5R7NW9OUWT7SqWIuAOvOkXqg4fNWj8=
 go.step.sm/crypto v0.77.2/go.mod h1:W0YJb9onM5l78qgkXIJ2Up6grnwW8EtpCKIza/NCg0o=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
@@ -645,8 +647,8 @@ go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 go.uber.org/zap v1.27.1 h1:08RqriUEv8+ArZRYSTXy1LeBScaMpVSTBhCeaZYfMYc=
 go.uber.org/zap v1.27.1/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
-go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
-go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
+go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
+go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
@@ -745,19 +747,19 @@ golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da h1:noIWHXmPHxILtqtCOPIhS
 golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/api v0.272.0 h1:eLUQZGnAS3OHn31URRf9sAmRk3w2JjMx37d2k8AjJmA=
-google.golang.org/api v0.272.0/go.mod h1:wKjowi5LNJc5qarNvDCvNQBn3rVK8nSy6jg2SwRwzIA=
+google.golang.org/api v0.283.0 h1:0lkp8u0MPwJVHqRL+nJlMAoZVVzbmiXmFHXMOTmSPik=
+google.golang.org/api v0.283.0/go.mod h1:6Wssta4c5n9qHq5CBhmlai5h/PUa1djdDAIhYEHyvcM=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20260316180232-0b37fe3546d5 h1:JNfk58HZ8lfmXbYK2vx/UvsqIL59TzByCxPIX4TDmsE=
-google.golang.org/genproto v0.0.0-20260316180232-0b37fe3546d5/go.mod h1:x5julN69+ED4PcFk/XWayw35O0lf/nGa4aNgODCmNmw=
-google.golang.org/genproto/googleapis/api v0.0.0-20260316180232-0b37fe3546d5 h1:CogIeEXn4qWYzzQU0QqvYBM8yDF9cFYzDq9ojSpv0Js=
-google.golang.org/genproto/googleapis/api v0.0.0-20260316180232-0b37fe3546d5/go.mod h1:EIQZ5bFCfRQDV4MhRle7+OgjNtZ6P1PiZBgAKuxXu/Y=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260316180232-0b37fe3546d5 h1:aJmi6DVGGIStN9Mobk/tZOOQUBbj0BPjZjjnOdoZKts=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260316180232-0b37fe3546d5/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 h1:XzmzkmB14QhVhgnawEVsOn6OFsnpyxNPRY9QV01dNB0=
+google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:L43LFes82YgSonw6iTXTxXUX1OlULt4AQtkik4ULL/I=
+google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 h1:yQugLulqltosq0B/f8l4w9VryjV+N/5gcW0jQ3N8Qec=
+google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478/go.mod h1:C6ADNqOxbgdUUeRTU+LCHDPB9ttAMCTff6auwCVa4uc=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260523011958-0a33c5d7ca68 h1:PvEgGJf9C/1u5CHkInMg7UFYYUoiaQmW2LbtH0pjB78=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260523011958-0a33c5d7ca68/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
@@ -812,8 +814,8 @@ k8s.io/client-go v0.35.3 h1:s1lZbpN4uI6IxeTM2cpdtrwHcSOBML1ODNTCCfsP1pg=
 k8s.io/client-go v0.35.3/go.mod h1:RzoXkc0mzpWIDvBrRnD+VlfXP+lRzqQjCmKtiwZ8Q9c=
 k8s.io/cri-api v0.25.16 h1:NSa4jRRP8zvEKBVfnWvMEaemvAsMXw5UQkLPQCRa2cc=
 k8s.io/cri-api v0.25.16/go.mod h1:0vfZsZhEs3LoY5Lqm6Zgx43M633ToNlTUtEQc+VvXhw=
-k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
-k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
+k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
+k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
 k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 h1:Y3gxNAuB0OBLImH611+UDZcmKS3g6CthxToOb37KgwE=
 k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ=
 k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 h1:SjGebBtkBqHFOli+05xYbK8YF1Dzkbzn+gDM4X9T4Ck=
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options/BUILD.bazel b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options/BUILD.bazel
index d71991e6e..58bdc7657 100644
--- a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options/BUILD.bazel
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options/BUILD.bazel
@@ -1,6 +1,6 @@
+load("@com_google_protobuf//bazel:proto_library.bzl", "proto_library")
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
-load("@rules_proto//proto:defs.bzl", "proto_library")
 
 package(default_visibility = ["//visibility:public"])
 
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/handler.go b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/handler.go
index 2f0b9e9e0..4c9083d79 100644
--- a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/handler.go
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/handler.go
@@ -28,7 +28,9 @@ func ForwardResponseStream(ctx context.Context, mux *ServeMux, marshaler Marshal
 	}
 	handleForwardResponseServerMetadata(w, mux, md)
 
-	w.Header().Set("Transfer-Encoding", "chunked")
+	if !mux.disableChunkedEncoding {
+		w.Header().Set("Transfer-Encoding", "chunked")
+	}
 	if err := handleForwardResponseOptions(ctx, w, nil, opts); err != nil {
 		HTTPError(ctx, mux, marshaler, w, req, err)
 		return
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/mux.go b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/mux.go
index 3eb161671..69edf5eff 100644
--- a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/mux.go
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/mux.go
@@ -71,8 +71,10 @@ type ServeMux struct {
 	streamErrorHandler        StreamErrorHandlerFunc
 	routingErrorHandler       RoutingErrorHandlerFunc
 	disablePathLengthFallback bool
+	disableHTTPMethodOverride bool
 	unescapingMode            UnescapingMode
 	writeContentLength        bool
+	disableChunkedEncoding    bool
 }
 
 // ServeMuxOption is an option that can be given to a ServeMux on construction.
@@ -125,6 +127,16 @@ func WithMiddlewares(middlewares ...Middleware) ServeMuxOption {
 	}
 }
 
+// WithDisableChunkedEncoding disables the Transfer-Encoding: chunked header
+// for streaming responses. This is useful for streaming implementations that use
+// Content-Length, which is mutually exclusive with Transfer-Encoding:chunked.
+// Note that this option will not automatically add Content-Length headers, so it should be used with caution.
+func WithDisableChunkedEncoding() ServeMuxOption {
+	return func(mux *ServeMux) {
+		mux.disableChunkedEncoding = true
+	}
+}
+
 // SetQueryParameterParser sets the query parameter parser, used to populate message from query parameters.
 // Configuring this will mean the generated OpenAPI output is no longer correct, and it should be
 // done with careful consideration.
@@ -260,6 +272,19 @@ func WithDisablePathLengthFallback() ServeMuxOption {
 	}
 }
 
+// WithDisableHTTPMethodOverride returns a ServeMuxOption that disables the
+// X-HTTP-Method-Override header handling.
+//
+// When this option is used, the mux will no longer allow POST requests with
+// the X-HTTP-Method-Override header to override the HTTP method. The path
+// length fallback (POST with application/x-www-form-urlencoded falling back
+// to a matching GET handler) is not affected by this option.
+func WithDisableHTTPMethodOverride() ServeMuxOption {
+	return func(serveMux *ServeMux) {
+		serveMux.disableHTTPMethodOverride = true
+	}
+}
+
 // WithWriteContentLength returns a ServeMuxOption to enable writing content length on non-streaming responses
 func WithWriteContentLength() ServeMuxOption {
 	return func(serveMux *ServeMux) {
@@ -394,7 +419,7 @@ func (s *ServeMux) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		path = r.URL.RawPath
 	}
 
-	if override := r.Header.Get("X-HTTP-Method-Override"); override != "" && s.isPathLengthFallback(r) {
+	if override := r.Header.Get("X-HTTP-Method-Override"); override != "" && !s.disableHTTPMethodOverride && s.isPathLengthFallback(r) {
 		if err := r.ParseForm(); err != nil {
 			_, outboundMarshaler := MarshalerForRequest(s, r)
 			sterr := status.Error(codes.InvalidArgument, err.Error())
@@ -456,6 +481,7 @@ func (s *ServeMux) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 					HTTPStatus: http.StatusBadRequest,
 					Err:        mse,
 				})
+				return
 			}
 			continue
 		}
@@ -498,6 +524,7 @@ func (s *ServeMux) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 						HTTPStatus: http.StatusBadRequest,
 						Err:        mse,
 					})
+					return
 				}
 				continue
 			}
diff --git a/vendor/github.com/secure-systems-lab/go-securesystemslib/dsse/envelope.go b/vendor/github.com/secure-systems-lab/go-securesystemslib/dsse/envelope.go
index 8e48cc6fe..933057650 100644
--- a/vendor/github.com/secure-systems-lab/go-securesystemslib/dsse/envelope.go
+++ b/vendor/github.com/secure-systems-lab/go-securesystemslib/dsse/envelope.go
@@ -1,8 +1,10 @@
 package dsse
 
 import (
+	"bytes"
 	"encoding/base64"
 	"fmt"
+	"strconv"
 )
 
 /*
@@ -42,9 +44,27 @@ PAE implements the DSSE Pre-Authentic Encoding
 https://github.com/secure-systems-lab/dsse/blob/master/protocol.md#signature-definition
 */
 func PAE(payloadType string, payload []byte) []byte {
-	return []byte(fmt.Sprintf("DSSEv1 %d %s %d %s",
-		len(payloadType), payloadType,
-		len(payload), payload))
+	// Pre-size to avoid reallocation. Previously fmt.Sprintf copied payload
+	// into a string and []byte(...) copied it again.
+	const prefix = "DSSEv1 "
+	const sep = " "
+	// Max decimal digits for a non-negative int (len() result) on any
+	// platform: len("9223372036854775807") == 19. Grow is a hint, so a
+	// slight overestimate is harmless.
+	const maxDecimalLen = 19
+	var b bytes.Buffer
+	b.Grow(len(prefix) +
+		maxDecimalLen + len(sep) + len(payloadType) + len(sep) +
+		maxDecimalLen + len(sep) + len(payload))
+	b.WriteString(prefix)
+	b.WriteString(strconv.Itoa(len(payloadType)))
+	b.WriteByte(' ')
+	b.WriteString(payloadType)
+	b.WriteByte(' ')
+	b.WriteString(strconv.Itoa(len(payload)))
+	b.WriteByte(' ')
+	b.Write(payload)
+	return b.Bytes()
 }
 
 /*
diff --git a/vendor/github.com/secure-systems-lab/go-securesystemslib/dsse/verify.go b/vendor/github.com/secure-systems-lab/go-securesystemslib/dsse/verify.go
index 034e4faaf..5c83d2ec0 100644
--- a/vendor/github.com/secure-systems-lab/go-securesystemslib/dsse/verify.go
+++ b/vendor/github.com/secure-systems-lab/go-securesystemslib/dsse/verify.go
@@ -24,18 +24,26 @@ type AcceptedKey struct {
 }
 
 func (ev *EnvelopeVerifier) Verify(ctx context.Context, e *Envelope) ([]AcceptedKey, error) {
+	keys, _, err := ev.VerifyAndDecode(ctx, e)
+	return keys, err
+}
+
+// VerifyAndDecode behaves identically to Verify but also returns the decoded
+// envelope payload, allowing callers who need the payload bytes (e.g., for
+// hashing or further parsing) to avoid a second base64 decode.
+func (ev *EnvelopeVerifier) VerifyAndDecode(ctx context.Context, e *Envelope) ([]AcceptedKey, []byte, error) {
 	if e == nil {
-		return nil, errors.New("cannot verify a nil envelope")
+		return nil, nil, errors.New("cannot verify a nil envelope")
 	}
 
 	if len(e.Signatures) == 0 {
-		return nil, ErrNoSignature
+		return nil, nil, ErrNoSignature
 	}
 
 	// Decode payload (i.e serialized body)
 	body, err := e.DecodeB64Payload()
 	if err != nil {
-		return nil, err
+		return nil, nil, err
 	}
 	// Generate PAE(payloadtype, serialized body)
 	paeEnc := PAE(e.PayloadType, body)
@@ -48,7 +56,7 @@ func (ev *EnvelopeVerifier) Verify(ctx context.Context, e *Envelope) ([]Accepted
 	for _, s := range e.Signatures {
 		sig, err := b64Decode(s.Sig)
 		if err != nil {
-			return nil, err
+			return nil, nil, err
 		}
 
 		// Loop over the providers.
@@ -97,14 +105,14 @@ func (ev *EnvelopeVerifier) Verify(ctx context.Context, e *Envelope) ([]Accepted
 
 	// Sanity if with some reflect magic this happens.
 	if ev.threshold <= 0 || ev.threshold > len(ev.providers) {
-		return nil, errors.New("invalid threshold")
+		return nil, nil, errors.New("invalid threshold")
 	}
 
 	if len(usedKeyids) < ev.threshold {
-		return acceptedKeys, fmt.Errorf("accepted signatures do not match threshold, Found: %d, Expected %d", len(acceptedKeys), ev.threshold)
+		return acceptedKeys, nil, fmt.Errorf("accepted signatures do not match threshold, Found: %d, Expected %d", len(acceptedKeys), ev.threshold)
 	}
 
-	return acceptedKeys, nil
+	return acceptedKeys, body, nil
 }
 
 func NewEnvelopeVerifier(v ...Verifier) (*EnvelopeVerifier, error) {
diff --git a/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/bundle/v1/sigstore_bundle.pb.go b/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/bundle/v1/sigstore_bundle.pb.go
index 9d43f66c0..128977e5e 100644
--- a/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/bundle/v1/sigstore_bundle.pb.go
+++ b/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/bundle/v1/sigstore_bundle.pb.go
@@ -14,8 +14,8 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.5
-// 	protoc        v6.30.2
+// 	protoc-gen-go v1.36.10
+// 	protoc        v7.34.1
 // source: sigstore_bundle.proto
 
 package v1
@@ -387,85 +387,27 @@ func (*Bundle_DsseEnvelope) isBundle_Content() {}
 
 var File_sigstore_bundle_proto protoreflect.FileDescriptor
 
-var file_sigstore_bundle_proto_rawDesc = string([]byte{
-	0x0a, 0x15, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x5f, 0x62, 0x75, 0x6e, 0x64, 0x6c,
-	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x16, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67,
-	0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x62, 0x75, 0x6e, 0x64, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x1a,
-	0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x66, 0x69, 0x65, 0x6c,
-	0x64, 0x5f, 0x62, 0x65, 0x68, 0x61, 0x76, 0x69, 0x6f, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x1a, 0x0e, 0x65, 0x6e, 0x76, 0x65, 0x6c, 0x6f, 0x70, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x1a, 0x15, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x5f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f,
-	0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x14, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72,
-	0x65, 0x5f, 0x72, 0x65, 0x6b, 0x6f, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x7a, 0x0a,
-	0x19, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x56, 0x65, 0x72, 0x69, 0x66, 0x69,
-	0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x44, 0x61, 0x74, 0x61, 0x12, 0x5d, 0x0a, 0x12, 0x72, 0x66,
-	0x63, 0x33, 0x31, 0x36, 0x31, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x73,
-	0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2e, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67,
-	0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e,
-	0x52, 0x46, 0x43, 0x33, 0x31, 0x36, 0x31, 0x53, 0x69, 0x67, 0x6e, 0x65, 0x64, 0x54, 0x69, 0x6d,
-	0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x11, 0x72, 0x66, 0x63, 0x33, 0x31, 0x36, 0x31, 0x54,
-	0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x73, 0x22, 0xf4, 0x03, 0x0a, 0x14, 0x56, 0x65,
-	0x72, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4d, 0x61, 0x74, 0x65, 0x72, 0x69,
-	0x61, 0x6c, 0x12, 0x51, 0x0a, 0x0a, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67,
-	0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e,
-	0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66,
-	0x69, 0x65, 0x72, 0x42, 0x03, 0xe0, 0x41, 0x02, 0x48, 0x00, 0x52, 0x09, 0x70, 0x75, 0x62, 0x6c,
-	0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x69, 0x0a, 0x16, 0x78, 0x35, 0x30, 0x39, 0x5f, 0x63, 0x65,
-	0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x63, 0x68, 0x61, 0x69, 0x6e, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2c, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73,
-	0x74, 0x6f, 0x72, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x58,
-	0x35, 0x30, 0x39, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x43, 0x68,
-	0x61, 0x69, 0x6e, 0x42, 0x03, 0xe0, 0x41, 0x02, 0x48, 0x00, 0x52, 0x14, 0x78, 0x35, 0x30, 0x39,
-	0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x43, 0x68, 0x61, 0x69, 0x6e,
-	0x12, 0x50, 0x0a, 0x0b, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x18,
-	0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73,
-	0x74, 0x6f, 0x72, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x58,
-	0x35, 0x30, 0x39, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x42, 0x03,
-	0xe0, 0x41, 0x02, 0x48, 0x00, 0x52, 0x0b, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61,
-	0x74, 0x65, 0x12, 0x4e, 0x0a, 0x0c, 0x74, 0x6c, 0x6f, 0x67, 0x5f, 0x65, 0x6e, 0x74, 0x72, 0x69,
-	0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73,
-	0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x65, 0x6b, 0x6f, 0x72, 0x2e, 0x76, 0x31,
-	0x2e, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x61, 0x72, 0x65, 0x6e, 0x63, 0x79, 0x4c, 0x6f, 0x67,
-	0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0b, 0x74, 0x6c, 0x6f, 0x67, 0x45, 0x6e, 0x74, 0x72, 0x69,
-	0x65, 0x73, 0x12, 0x71, 0x0a, 0x1b, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x5f,
-	0x76, 0x65, 0x72, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x64, 0x61, 0x74,
-	0x61, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x31, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69,
-	0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x62, 0x75, 0x6e, 0x64, 0x6c, 0x65, 0x2e, 0x76, 0x31,
-	0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x56, 0x65, 0x72, 0x69, 0x66, 0x69,
-	0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x44, 0x61, 0x74, 0x61, 0x52, 0x19, 0x74, 0x69, 0x6d, 0x65,
-	0x73, 0x74, 0x61, 0x6d, 0x70, 0x56, 0x65, 0x72, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f,
-	0x6e, 0x44, 0x61, 0x74, 0x61, 0x42, 0x09, 0x0a, 0x07, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74,
-	0x22, 0xbf, 0x02, 0x0a, 0x06, 0x42, 0x75, 0x6e, 0x64, 0x6c, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x6d,
-	0x65, 0x64, 0x69, 0x61, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x09, 0x6d, 0x65, 0x64, 0x69, 0x61, 0x54, 0x79, 0x70, 0x65, 0x12, 0x66, 0x0a, 0x15, 0x76, 0x65,
-	0x72, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x74, 0x65, 0x72,
-	0x69, 0x61, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2c, 0x2e, 0x64, 0x65, 0x76, 0x2e,
-	0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x62, 0x75, 0x6e, 0x64, 0x6c, 0x65, 0x2e,
-	0x76, 0x31, 0x2e, 0x56, 0x65, 0x72, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4d,
-	0x61, 0x74, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x42, 0x03, 0xe0, 0x41, 0x02, 0x52, 0x14, 0x76, 0x65,
-	0x72, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4d, 0x61, 0x74, 0x65, 0x72, 0x69,
-	0x61, 0x6c, 0x12, 0x5c, 0x0a, 0x11, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x5f, 0x73, 0x69,
-	0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e,
-	0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x63, 0x6f, 0x6d,
-	0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x53, 0x69,
-	0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x42, 0x03, 0xe0, 0x41, 0x02, 0x48, 0x00, 0x52, 0x10,
-	0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65,
-	0x12, 0x3f, 0x0a, 0x0d, 0x64, 0x73, 0x73, 0x65, 0x5f, 0x65, 0x6e, 0x76, 0x65, 0x6c, 0x6f, 0x70,
-	0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x69, 0x6f, 0x2e, 0x69, 0x6e, 0x74,
-	0x6f, 0x74, 0x6f, 0x2e, 0x45, 0x6e, 0x76, 0x65, 0x6c, 0x6f, 0x70, 0x65, 0x42, 0x03, 0xe0, 0x41,
-	0x02, 0x48, 0x00, 0x52, 0x0c, 0x64, 0x73, 0x73, 0x65, 0x45, 0x6e, 0x76, 0x65, 0x6c, 0x6f, 0x70,
-	0x65, 0x42, 0x09, 0x0a, 0x07, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x4a, 0x04, 0x08, 0x05,
-	0x10, 0x33, 0x42, 0x7c, 0x0a, 0x1c, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f,
-	0x72, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x62, 0x75, 0x6e, 0x64, 0x6c, 0x65, 0x2e,
-	0x76, 0x31, 0x42, 0x0b, 0x42, 0x75, 0x6e, 0x64, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50,
-	0x01, 0x5a, 0x36, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x69,
-	0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2d,
-	0x73, 0x70, 0x65, 0x63, 0x73, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x70, 0x62, 0x2d, 0x67, 0x6f, 0x2f,
-	0x62, 0x75, 0x6e, 0x64, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0xea, 0x02, 0x14, 0x53, 0x69, 0x67, 0x73,
-	0x74, 0x6f, 0x72, 0x65, 0x3a, 0x3a, 0x42, 0x75, 0x6e, 0x64, 0x6c, 0x65, 0x3a, 0x3a, 0x56, 0x31,
-	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-})
+const file_sigstore_bundle_proto_rawDesc = "" +
+	"\n" +
+	"\x15sigstore_bundle.proto\x12\x16dev.sigstore.bundle.v1\x1a\x1fgoogle/api/field_behavior.proto\x1a\x0eenvelope.proto\x1a\x15sigstore_common.proto\x1a\x14sigstore_rekor.proto\"z\n" +
+	"\x19TimestampVerificationData\x12]\n" +
+	"\x12rfc3161_timestamps\x18\x01 \x03(\v2..dev.sigstore.common.v1.RFC3161SignedTimestampR\x11rfc3161Timestamps\"\xf4\x03\n" +
+	"\x14VerificationMaterial\x12Q\n" +
+	"\n" +
+	"public_key\x18\x01 \x01(\v2+.dev.sigstore.common.v1.PublicKeyIdentifierB\x03\xe0A\x02H\x00R\tpublicKey\x12i\n" +
+	"\x16x509_certificate_chain\x18\x02 \x01(\v2,.dev.sigstore.common.v1.X509CertificateChainB\x03\xe0A\x02H\x00R\x14x509CertificateChain\x12P\n" +
+	"\vcertificate\x18\x05 \x01(\v2'.dev.sigstore.common.v1.X509CertificateB\x03\xe0A\x02H\x00R\vcertificate\x12N\n" +
+	"\ftlog_entries\x18\x03 \x03(\v2+.dev.sigstore.rekor.v1.TransparencyLogEntryR\vtlogEntries\x12q\n" +
+	"\x1btimestamp_verification_data\x18\x04 \x01(\v21.dev.sigstore.bundle.v1.TimestampVerificationDataR\x19timestampVerificationDataB\t\n" +
+	"\acontent\"\xbf\x02\n" +
+	"\x06Bundle\x12\x1d\n" +
+	"\n" +
+	"media_type\x18\x01 \x01(\tR\tmediaType\x12f\n" +
+	"\x15verification_material\x18\x02 \x01(\v2,.dev.sigstore.bundle.v1.VerificationMaterialB\x03\xe0A\x02R\x14verificationMaterial\x12\\\n" +
+	"\x11message_signature\x18\x03 \x01(\v2(.dev.sigstore.common.v1.MessageSignatureB\x03\xe0A\x02H\x00R\x10messageSignature\x12?\n" +
+	"\rdsse_envelope\x18\x04 \x01(\v2\x13.io.intoto.EnvelopeB\x03\xe0A\x02H\x00R\fdsseEnvelopeB\t\n" +
+	"\acontentJ\x04\b\x05\x103B|\n" +
+	"\x1cdev.sigstore.proto.bundle.v1B\vBundleProtoP\x01Z6github.com/sigstore/protobuf-specs/gen/pb-go/bundle/v1\xea\x02\x14Sigstore::Bundle::V1b\x06proto3"
 
 var (
 	file_sigstore_bundle_proto_rawDescOnce sync.Once
diff --git a/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/common/v1/sigstore_common.pb.go b/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/common/v1/sigstore_common.pb.go
index 5f339b2d7..4730718f4 100644
--- a/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/common/v1/sigstore_common.pb.go
+++ b/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/common/v1/sigstore_common.pb.go
@@ -14,8 +14,8 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.5
-// 	protoc        v6.30.2
+// 	protoc-gen-go v1.36.10
+// 	protoc        v7.34.1
 // source: sigstore_common.proto
 
 package v1
@@ -51,8 +51,14 @@ const (
 	HashAlgorithm_SHA2_256                   HashAlgorithm = 1
 	HashAlgorithm_SHA2_384                   HashAlgorithm = 2
 	HashAlgorithm_SHA2_512                   HashAlgorithm = 3
-	HashAlgorithm_SHA3_256                   HashAlgorithm = 4
-	HashAlgorithm_SHA3_384                   HashAlgorithm = 5
+	// Used for LMS
+	//
+	// Deprecated: Marked as deprecated in sigstore_common.proto.
+	HashAlgorithm_SHA3_256 HashAlgorithm = 4
+	// Used for LMS
+	//
+	// Deprecated: Marked as deprecated in sigstore_common.proto.
+	HashAlgorithm_SHA3_384 HashAlgorithm = 5
 )
 
 // Enum value maps for HashAlgorithm.
@@ -161,9 +167,7 @@ const (
 	// LMS and LM-OTS
 	//
 	// These algorithms are deprecated and should not be used.
-	// Keys and signatures MAY be used by private Sigstore
-	// deployments, but will not be supported by the public
-	// good instance.
+	// There are no plans to support SLH-DSA at this time.
 	//
 	// USER WARNING: LMS and LM-OTS are both stateful signature schemes.
 	// Using them correctly requires discretion and careful consideration
@@ -179,18 +183,21 @@ const (
 	PublicKeyDetails_LMOTS_SHA256 PublicKeyDetails = 15
 	// ML-DSA
 	//
-	// These ML_DSA_65 and ML-DSA_87 algorithms are the pure variants that
-	// take data to sign rather than the prehash variants (HashML-DSA), which
-	// take digests.  While considered quantum-resistant, their usage
+	// These ML_DSA_44, ML_DSA_65 and ML-DSA_87 algorithms are the pure variants
+	// that take data to sign rather than the prehash variants (HashML-DSA), which
+	// take digests. While considered quantum-resistant, their usage
 	// involves tradeoffs in that signatures and keys are much larger, and
 	// this makes deployments more costly.
 	//
-	// USER WARNING: ML_DSA_65 and ML_DSA_87 are experimental algorithms.
+	// USER WARNING: ML_DSA_44, ML_DSA_65 and ML_DSA_87 are experimental algorithms.
 	// In the future they MAY be used by private Sigstore deployments, but
-	// they are not yet fully functional.  This warning will be removed when
+	// they are not yet fully functional. This warning will be removed when
 	// these algorithms are widely supported by Sigstore clients and servers,
 	// but care should still be taken for production environments.
-	PublicKeyDetails_ML_DSA_65 PublicKeyDetails = 21 // See NIST FIPS 204
+	//
+	// See NIST FIPS 204, RFC 9881 for algorithm identifiers
+	PublicKeyDetails_ML_DSA_44 PublicKeyDetails = 23
+	PublicKeyDetails_ML_DSA_65 PublicKeyDetails = 21
 	PublicKeyDetails_ML_DSA_87 PublicKeyDetails = 22
 )
 
@@ -218,6 +225,7 @@ var (
 		20: "PKIX_ECDSA_P521_SHA_256",
 		14: "LMS_SHA256",
 		15: "LMOTS_SHA256",
+		23: "ML_DSA_44",
 		21: "ML_DSA_65",
 		22: "ML_DSA_87",
 	}
@@ -243,6 +251,7 @@ var (
 		"PKIX_ECDSA_P521_SHA_256":        20,
 		"LMS_SHA256":                     14,
 		"LMOTS_SHA256":                   15,
+		"ML_DSA_44":                      23,
 		"ML_DSA_65":                      21,
 		"ML_DSA_87":                      22,
 	}
@@ -1062,160 +1071,95 @@ func (x *TimeRange) GetEnd() *timestamppb.Timestamp {
 
 var File_sigstore_common_proto protoreflect.FileDescriptor
 
-var file_sigstore_common_proto_rawDesc = string([]byte{
-	0x0a, 0x15, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x5f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f,
-	0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x16, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67,
-	0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x1a,
-	0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x66, 0x69, 0x65, 0x6c,
-	0x64, 0x5f, 0x62, 0x65, 0x68, 0x61, 0x76, 0x69, 0x6f, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
-	0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x22, 0x69, 0x0a, 0x0a, 0x48, 0x61, 0x73, 0x68, 0x4f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x12,
-	0x43, 0x0a, 0x09, 0x61, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74, 0x68, 0x6d, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x0e, 0x32, 0x25, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72,
-	0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x48, 0x61, 0x73, 0x68,
-	0x41, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74, 0x68, 0x6d, 0x52, 0x09, 0x61, 0x6c, 0x67, 0x6f, 0x72,
-	0x69, 0x74, 0x68, 0x6d, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x69, 0x67, 0x65, 0x73, 0x74, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x0c, 0x52, 0x06, 0x64, 0x69, 0x67, 0x65, 0x73, 0x74, 0x22, 0x80, 0x01, 0x0a,
-	0x10, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72,
-	0x65, 0x12, 0x49, 0x0a, 0x0e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x5f, 0x64, 0x69, 0x67,
-	0x65, 0x73, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x64, 0x65, 0x76, 0x2e,
-	0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e,
-	0x76, 0x31, 0x2e, 0x48, 0x61, 0x73, 0x68, 0x4f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x52, 0x0d, 0x6d,
-	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x44, 0x69, 0x67, 0x65, 0x73, 0x74, 0x12, 0x21, 0x0a, 0x09,
-	0x73, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x42,
-	0x03, 0xe0, 0x41, 0x02, 0x52, 0x09, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x22,
-	0x23, 0x0a, 0x05, 0x4c, 0x6f, 0x67, 0x49, 0x64, 0x12, 0x1a, 0x0a, 0x06, 0x6b, 0x65, 0x79, 0x5f,
-	0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x42, 0x03, 0xe0, 0x41, 0x02, 0x52, 0x05, 0x6b,
-	0x65, 0x79, 0x49, 0x64, 0x22, 0x48, 0x0a, 0x16, 0x52, 0x46, 0x43, 0x33, 0x31, 0x36, 0x31, 0x53,
-	0x69, 0x67, 0x6e, 0x65, 0x64, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x12, 0x2e,
-	0x0a, 0x10, 0x73, 0x69, 0x67, 0x6e, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61,
-	0x6d, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x42, 0x03, 0xe0, 0x41, 0x02, 0x52, 0x0f, 0x73,
-	0x69, 0x67, 0x6e, 0x65, 0x64, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x22, 0xd9,
-	0x01, 0x0a, 0x09, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x20, 0x0a, 0x09,
-	0x72, 0x61, 0x77, 0x5f, 0x62, 0x79, 0x74, 0x65, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x48,
-	0x00, 0x52, 0x08, 0x72, 0x61, 0x77, 0x42, 0x79, 0x74, 0x65, 0x73, 0x88, 0x01, 0x01, 0x12, 0x49,
-	0x0a, 0x0b, 0x6b, 0x65, 0x79, 0x5f, 0x64, 0x65, 0x74, 0x61, 0x69, 0x6c, 0x73, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x0e, 0x32, 0x28, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f,
-	0x72, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x75, 0x62,
-	0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x44, 0x65, 0x74, 0x61, 0x69, 0x6c, 0x73, 0x52, 0x0a, 0x6b,
-	0x65, 0x79, 0x44, 0x65, 0x74, 0x61, 0x69, 0x6c, 0x73, 0x12, 0x43, 0x0a, 0x09, 0x76, 0x61, 0x6c,
-	0x69, 0x64, 0x5f, 0x66, 0x6f, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x64,
-	0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x6d,
-	0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x48,
-	0x01, 0x52, 0x08, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x46, 0x6f, 0x72, 0x88, 0x01, 0x01, 0x42, 0x0c,
-	0x0a, 0x0a, 0x5f, 0x72, 0x61, 0x77, 0x5f, 0x62, 0x79, 0x74, 0x65, 0x73, 0x42, 0x0c, 0x0a, 0x0a,
-	0x5f, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x5f, 0x66, 0x6f, 0x72, 0x22, 0x29, 0x0a, 0x13, 0x50, 0x75,
-	0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65,
-	0x72, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x69, 0x6e, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x04, 0x68, 0x69, 0x6e, 0x74, 0x22, 0x27, 0x0a, 0x10, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x49,
-	0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x12, 0x13, 0x0a, 0x02, 0x69, 0x64, 0x18,
-	0x01, 0x20, 0x03, 0x28, 0x05, 0x42, 0x03, 0xe0, 0x41, 0x02, 0x52, 0x02, 0x69, 0x64, 0x22, 0x6d,
-	0x0a, 0x19, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69,
-	0x65, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x50, 0x61, 0x69, 0x72, 0x12, 0x3a, 0x0a, 0x03, 0x6f,
-	0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73,
-	0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x76,
-	0x31, 0x2e, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69,
-	0x65, 0x72, 0x52, 0x03, 0x6f, 0x69, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x58, 0x0a,
-	0x11, 0x44, 0x69, 0x73, 0x74, 0x69, 0x6e, 0x67, 0x75, 0x69, 0x73, 0x68, 0x65, 0x64, 0x4e, 0x61,
-	0x6d, 0x65, 0x12, 0x22, 0x0a, 0x0c, 0x6f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69,
-	0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x6f, 0x72, 0x67, 0x61, 0x6e, 0x69,
-	0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x1f, 0x0a, 0x0b, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e,
-	0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x63, 0x6f, 0x6d,
-	0x6d, 0x6f, 0x6e, 0x4e, 0x61, 0x6d, 0x65, 0x22, 0x33, 0x0a, 0x0f, 0x58, 0x35, 0x30, 0x39, 0x43,
-	0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x20, 0x0a, 0x09, 0x72, 0x61,
-	0x77, 0x5f, 0x62, 0x79, 0x74, 0x65, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x42, 0x03, 0xe0,
-	0x41, 0x02, 0x52, 0x08, 0x72, 0x61, 0x77, 0x42, 0x79, 0x74, 0x65, 0x73, 0x22, 0x9e, 0x01, 0x0a,
-	0x16, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x41, 0x6c, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x74,
-	0x69, 0x76, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x46, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x32, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73,
-	0x74, 0x6f, 0x72, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x53,
-	0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x41, 0x6c, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x74, 0x69, 0x76,
-	0x65, 0x4e, 0x61, 0x6d, 0x65, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12,
-	0x18, 0x0a, 0x06, 0x72, 0x65, 0x67, 0x65, 0x78, 0x70, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x48,
-	0x00, 0x52, 0x06, 0x72, 0x65, 0x67, 0x65, 0x78, 0x70, 0x12, 0x16, 0x0a, 0x05, 0x76, 0x61, 0x6c,
-	0x75, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75,
-	0x65, 0x42, 0x0a, 0x0a, 0x08, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x22, 0x63, 0x0a,
-	0x14, 0x58, 0x35, 0x30, 0x39, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65,
-	0x43, 0x68, 0x61, 0x69, 0x6e, 0x12, 0x4b, 0x0a, 0x0c, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69,
-	0x63, 0x61, 0x74, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x64, 0x65,
-	0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f,
-	0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x58, 0x35, 0x30, 0x39, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69,
-	0x63, 0x61, 0x74, 0x65, 0x52, 0x0c, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74,
-	0x65, 0x73, 0x22, 0x78, 0x0a, 0x09, 0x54, 0x69, 0x6d, 0x65, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x12,
-	0x30, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a,
-	0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
-	0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x05, 0x73, 0x74, 0x61, 0x72,
-	0x74, 0x12, 0x31, 0x0a, 0x03, 0x65, 0x6e, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a,
-	0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
-	0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x48, 0x00, 0x52, 0x03, 0x65, 0x6e,
-	0x64, 0x88, 0x01, 0x01, 0x42, 0x06, 0x0a, 0x04, 0x5f, 0x65, 0x6e, 0x64, 0x2a, 0x75, 0x0a, 0x0d,
-	0x48, 0x61, 0x73, 0x68, 0x41, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74, 0x68, 0x6d, 0x12, 0x1e, 0x0a,
-	0x1a, 0x48, 0x41, 0x53, 0x48, 0x5f, 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f,
-	0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x0c, 0x0a,
-	0x08, 0x53, 0x48, 0x41, 0x32, 0x5f, 0x32, 0x35, 0x36, 0x10, 0x01, 0x12, 0x0c, 0x0a, 0x08, 0x53,
-	0x48, 0x41, 0x32, 0x5f, 0x33, 0x38, 0x34, 0x10, 0x02, 0x12, 0x0c, 0x0a, 0x08, 0x53, 0x48, 0x41,
-	0x32, 0x5f, 0x35, 0x31, 0x32, 0x10, 0x03, 0x12, 0x0c, 0x0a, 0x08, 0x53, 0x48, 0x41, 0x33, 0x5f,
-	0x32, 0x35, 0x36, 0x10, 0x04, 0x12, 0x0c, 0x0a, 0x08, 0x53, 0x48, 0x41, 0x33, 0x5f, 0x33, 0x38,
-	0x34, 0x10, 0x05, 0x2a, 0x8f, 0x05, 0x0a, 0x10, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65,
-	0x79, 0x44, 0x65, 0x74, 0x61, 0x69, 0x6c, 0x73, 0x12, 0x22, 0x0a, 0x1e, 0x50, 0x55, 0x42, 0x4c,
-	0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x44, 0x45, 0x54, 0x41, 0x49, 0x4c, 0x53, 0x5f, 0x55,
-	0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x19, 0x0a, 0x11,
-	0x50, 0x4b, 0x43, 0x53, 0x31, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x50, 0x4b, 0x43, 0x53, 0x31, 0x56,
-	0x35, 0x10, 0x01, 0x1a, 0x02, 0x08, 0x01, 0x12, 0x15, 0x0a, 0x0d, 0x50, 0x4b, 0x43, 0x53, 0x31,
-	0x5f, 0x52, 0x53, 0x41, 0x5f, 0x50, 0x53, 0x53, 0x10, 0x02, 0x1a, 0x02, 0x08, 0x01, 0x12, 0x18,
-	0x0a, 0x10, 0x50, 0x4b, 0x49, 0x58, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x50, 0x4b, 0x43, 0x53, 0x31,
-	0x56, 0x35, 0x10, 0x03, 0x1a, 0x02, 0x08, 0x01, 0x12, 0x14, 0x0a, 0x0c, 0x50, 0x4b, 0x49, 0x58,
-	0x5f, 0x52, 0x53, 0x41, 0x5f, 0x50, 0x53, 0x53, 0x10, 0x04, 0x1a, 0x02, 0x08, 0x01, 0x12, 0x21,
-	0x0a, 0x1d, 0x50, 0x4b, 0x49, 0x58, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x50, 0x4b, 0x43, 0x53, 0x31,
-	0x56, 0x31, 0x35, 0x5f, 0x32, 0x30, 0x34, 0x38, 0x5f, 0x53, 0x48, 0x41, 0x32, 0x35, 0x36, 0x10,
-	0x09, 0x12, 0x21, 0x0a, 0x1d, 0x50, 0x4b, 0x49, 0x58, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x50, 0x4b,
-	0x43, 0x53, 0x31, 0x56, 0x31, 0x35, 0x5f, 0x33, 0x30, 0x37, 0x32, 0x5f, 0x53, 0x48, 0x41, 0x32,
-	0x35, 0x36, 0x10, 0x0a, 0x12, 0x21, 0x0a, 0x1d, 0x50, 0x4b, 0x49, 0x58, 0x5f, 0x52, 0x53, 0x41,
-	0x5f, 0x50, 0x4b, 0x43, 0x53, 0x31, 0x56, 0x31, 0x35, 0x5f, 0x34, 0x30, 0x39, 0x36, 0x5f, 0x53,
-	0x48, 0x41, 0x32, 0x35, 0x36, 0x10, 0x0b, 0x12, 0x1c, 0x0a, 0x18, 0x50, 0x4b, 0x49, 0x58, 0x5f,
-	0x52, 0x53, 0x41, 0x5f, 0x50, 0x53, 0x53, 0x5f, 0x32, 0x30, 0x34, 0x38, 0x5f, 0x53, 0x48, 0x41,
-	0x32, 0x35, 0x36, 0x10, 0x10, 0x12, 0x1c, 0x0a, 0x18, 0x50, 0x4b, 0x49, 0x58, 0x5f, 0x52, 0x53,
-	0x41, 0x5f, 0x50, 0x53, 0x53, 0x5f, 0x33, 0x30, 0x37, 0x32, 0x5f, 0x53, 0x48, 0x41, 0x32, 0x35,
-	0x36, 0x10, 0x11, 0x12, 0x1c, 0x0a, 0x18, 0x50, 0x4b, 0x49, 0x58, 0x5f, 0x52, 0x53, 0x41, 0x5f,
-	0x50, 0x53, 0x53, 0x5f, 0x34, 0x30, 0x39, 0x36, 0x5f, 0x53, 0x48, 0x41, 0x32, 0x35, 0x36, 0x10,
-	0x12, 0x12, 0x24, 0x0a, 0x1c, 0x50, 0x4b, 0x49, 0x58, 0x5f, 0x45, 0x43, 0x44, 0x53, 0x41, 0x5f,
-	0x50, 0x32, 0x35, 0x36, 0x5f, 0x48, 0x4d, 0x41, 0x43, 0x5f, 0x53, 0x48, 0x41, 0x5f, 0x32, 0x35,
-	0x36, 0x10, 0x06, 0x1a, 0x02, 0x08, 0x01, 0x12, 0x1b, 0x0a, 0x17, 0x50, 0x4b, 0x49, 0x58, 0x5f,
-	0x45, 0x43, 0x44, 0x53, 0x41, 0x5f, 0x50, 0x32, 0x35, 0x36, 0x5f, 0x53, 0x48, 0x41, 0x5f, 0x32,
-	0x35, 0x36, 0x10, 0x05, 0x12, 0x1b, 0x0a, 0x17, 0x50, 0x4b, 0x49, 0x58, 0x5f, 0x45, 0x43, 0x44,
-	0x53, 0x41, 0x5f, 0x50, 0x33, 0x38, 0x34, 0x5f, 0x53, 0x48, 0x41, 0x5f, 0x33, 0x38, 0x34, 0x10,
-	0x0c, 0x12, 0x1b, 0x0a, 0x17, 0x50, 0x4b, 0x49, 0x58, 0x5f, 0x45, 0x43, 0x44, 0x53, 0x41, 0x5f,
-	0x50, 0x35, 0x32, 0x31, 0x5f, 0x53, 0x48, 0x41, 0x5f, 0x35, 0x31, 0x32, 0x10, 0x0d, 0x12, 0x10,
-	0x0a, 0x0c, 0x50, 0x4b, 0x49, 0x58, 0x5f, 0x45, 0x44, 0x32, 0x35, 0x35, 0x31, 0x39, 0x10, 0x07,
-	0x12, 0x13, 0x0a, 0x0f, 0x50, 0x4b, 0x49, 0x58, 0x5f, 0x45, 0x44, 0x32, 0x35, 0x35, 0x31, 0x39,
-	0x5f, 0x50, 0x48, 0x10, 0x08, 0x12, 0x1f, 0x0a, 0x17, 0x50, 0x4b, 0x49, 0x58, 0x5f, 0x45, 0x43,
-	0x44, 0x53, 0x41, 0x5f, 0x50, 0x33, 0x38, 0x34, 0x5f, 0x53, 0x48, 0x41, 0x5f, 0x32, 0x35, 0x36,
-	0x10, 0x13, 0x1a, 0x02, 0x08, 0x01, 0x12, 0x1f, 0x0a, 0x17, 0x50, 0x4b, 0x49, 0x58, 0x5f, 0x45,
-	0x43, 0x44, 0x53, 0x41, 0x5f, 0x50, 0x35, 0x32, 0x31, 0x5f, 0x53, 0x48, 0x41, 0x5f, 0x32, 0x35,
-	0x36, 0x10, 0x14, 0x1a, 0x02, 0x08, 0x01, 0x12, 0x12, 0x0a, 0x0a, 0x4c, 0x4d, 0x53, 0x5f, 0x53,
-	0x48, 0x41, 0x32, 0x35, 0x36, 0x10, 0x0e, 0x1a, 0x02, 0x08, 0x01, 0x12, 0x14, 0x0a, 0x0c, 0x4c,
-	0x4d, 0x4f, 0x54, 0x53, 0x5f, 0x53, 0x48, 0x41, 0x32, 0x35, 0x36, 0x10, 0x0f, 0x1a, 0x02, 0x08,
-	0x01, 0x12, 0x0d, 0x0a, 0x09, 0x4d, 0x4c, 0x5f, 0x44, 0x53, 0x41, 0x5f, 0x36, 0x35, 0x10, 0x15,
-	0x12, 0x0d, 0x0a, 0x09, 0x4d, 0x4c, 0x5f, 0x44, 0x53, 0x41, 0x5f, 0x38, 0x37, 0x10, 0x16, 0x22,
-	0x04, 0x08, 0x17, 0x10, 0x32, 0x2a, 0x6f, 0x0a, 0x1a, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74,
-	0x41, 0x6c, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x74, 0x69, 0x76, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x54,
-	0x79, 0x70, 0x65, 0x12, 0x2d, 0x0a, 0x29, 0x53, 0x55, 0x42, 0x4a, 0x45, 0x43, 0x54, 0x5f, 0x41,
-	0x4c, 0x54, 0x45, 0x52, 0x4e, 0x41, 0x54, 0x49, 0x56, 0x45, 0x5f, 0x4e, 0x41, 0x4d, 0x45, 0x5f,
-	0x54, 0x59, 0x50, 0x45, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44,
-	0x10, 0x00, 0x12, 0x09, 0x0a, 0x05, 0x45, 0x4d, 0x41, 0x49, 0x4c, 0x10, 0x01, 0x12, 0x07, 0x0a,
-	0x03, 0x55, 0x52, 0x49, 0x10, 0x02, 0x12, 0x0e, 0x0a, 0x0a, 0x4f, 0x54, 0x48, 0x45, 0x52, 0x5f,
-	0x4e, 0x41, 0x4d, 0x45, 0x10, 0x03, 0x42, 0x7c, 0x0a, 0x1c, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69,
-	0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x63, 0x6f, 0x6d,
-	0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x42, 0x0b, 0x43, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x50, 0x72,
-	0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x36, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f,
-	0x6d, 0x2f, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x62, 0x75, 0x66, 0x2d, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x70, 0x62,
-	0x2d, 0x67, 0x6f, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2f, 0x76, 0x31, 0xea, 0x02, 0x14,
-	0x53, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x3a, 0x3a, 0x43, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e,
-	0x3a, 0x3a, 0x56, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-})
+const file_sigstore_common_proto_rawDesc = "" +
+	"\n" +
+	"\x15sigstore_common.proto\x12\x16dev.sigstore.common.v1\x1a\x1fgoogle/api/field_behavior.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"i\n" +
+	"\n" +
+	"HashOutput\x12C\n" +
+	"\talgorithm\x18\x01 \x01(\x0e2%.dev.sigstore.common.v1.HashAlgorithmR\talgorithm\x12\x16\n" +
+	"\x06digest\x18\x02 \x01(\fR\x06digest\"\x80\x01\n" +
+	"\x10MessageSignature\x12I\n" +
+	"\x0emessage_digest\x18\x01 \x01(\v2\".dev.sigstore.common.v1.HashOutputR\rmessageDigest\x12!\n" +
+	"\tsignature\x18\x02 \x01(\fB\x03\xe0A\x02R\tsignature\"#\n" +
+	"\x05LogId\x12\x1a\n" +
+	"\x06key_id\x18\x01 \x01(\fB\x03\xe0A\x02R\x05keyId\"H\n" +
+	"\x16RFC3161SignedTimestamp\x12.\n" +
+	"\x10signed_timestamp\x18\x01 \x01(\fB\x03\xe0A\x02R\x0fsignedTimestamp\"\xd9\x01\n" +
+	"\tPublicKey\x12 \n" +
+	"\traw_bytes\x18\x01 \x01(\fH\x00R\brawBytes\x88\x01\x01\x12I\n" +
+	"\vkey_details\x18\x02 \x01(\x0e2(.dev.sigstore.common.v1.PublicKeyDetailsR\n" +
+	"keyDetails\x12C\n" +
+	"\tvalid_for\x18\x03 \x01(\v2!.dev.sigstore.common.v1.TimeRangeH\x01R\bvalidFor\x88\x01\x01B\f\n" +
+	"\n" +
+	"_raw_bytesB\f\n" +
+	"\n" +
+	"_valid_for\")\n" +
+	"\x13PublicKeyIdentifier\x12\x12\n" +
+	"\x04hint\x18\x01 \x01(\tR\x04hint\"'\n" +
+	"\x10ObjectIdentifier\x12\x13\n" +
+	"\x02id\x18\x01 \x03(\x05B\x03\xe0A\x02R\x02id\"m\n" +
+	"\x19ObjectIdentifierValuePair\x12:\n" +
+	"\x03oid\x18\x01 \x01(\v2(.dev.sigstore.common.v1.ObjectIdentifierR\x03oid\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\fR\x05value\"X\n" +
+	"\x11DistinguishedName\x12\"\n" +
+	"\forganization\x18\x01 \x01(\tR\forganization\x12\x1f\n" +
+	"\vcommon_name\x18\x02 \x01(\tR\n" +
+	"commonName\"3\n" +
+	"\x0fX509Certificate\x12 \n" +
+	"\traw_bytes\x18\x01 \x01(\fB\x03\xe0A\x02R\brawBytes\"\x9e\x01\n" +
+	"\x16SubjectAlternativeName\x12F\n" +
+	"\x04type\x18\x01 \x01(\x0e22.dev.sigstore.common.v1.SubjectAlternativeNameTypeR\x04type\x12\x18\n" +
+	"\x06regexp\x18\x02 \x01(\tH\x00R\x06regexp\x12\x16\n" +
+	"\x05value\x18\x03 \x01(\tH\x00R\x05valueB\n" +
+	"\n" +
+	"\bidentity\"c\n" +
+	"\x14X509CertificateChain\x12K\n" +
+	"\fcertificates\x18\x01 \x03(\v2'.dev.sigstore.common.v1.X509CertificateR\fcertificates\"x\n" +
+	"\tTimeRange\x120\n" +
+	"\x05start\x18\x01 \x01(\v2\x1a.google.protobuf.TimestampR\x05start\x121\n" +
+	"\x03end\x18\x02 \x01(\v2\x1a.google.protobuf.TimestampH\x00R\x03end\x88\x01\x01B\x06\n" +
+	"\x04_end*}\n" +
+	"\rHashAlgorithm\x12\x1e\n" +
+	"\x1aHASH_ALGORITHM_UNSPECIFIED\x10\x00\x12\f\n" +
+	"\bSHA2_256\x10\x01\x12\f\n" +
+	"\bSHA2_384\x10\x02\x12\f\n" +
+	"\bSHA2_512\x10\x03\x12\x10\n" +
+	"\bSHA3_256\x10\x04\x1a\x02\b\x01\x12\x10\n" +
+	"\bSHA3_384\x10\x05\x1a\x02\b\x01*\x9e\x05\n" +
+	"\x10PublicKeyDetails\x12\"\n" +
+	"\x1ePUBLIC_KEY_DETAILS_UNSPECIFIED\x10\x00\x12\x19\n" +
+	"\x11PKCS1_RSA_PKCS1V5\x10\x01\x1a\x02\b\x01\x12\x15\n" +
+	"\rPKCS1_RSA_PSS\x10\x02\x1a\x02\b\x01\x12\x18\n" +
+	"\x10PKIX_RSA_PKCS1V5\x10\x03\x1a\x02\b\x01\x12\x14\n" +
+	"\fPKIX_RSA_PSS\x10\x04\x1a\x02\b\x01\x12!\n" +
+	"\x1dPKIX_RSA_PKCS1V15_2048_SHA256\x10\t\x12!\n" +
+	"\x1dPKIX_RSA_PKCS1V15_3072_SHA256\x10\n" +
+	"\x12!\n" +
+	"\x1dPKIX_RSA_PKCS1V15_4096_SHA256\x10\v\x12\x1c\n" +
+	"\x18PKIX_RSA_PSS_2048_SHA256\x10\x10\x12\x1c\n" +
+	"\x18PKIX_RSA_PSS_3072_SHA256\x10\x11\x12\x1c\n" +
+	"\x18PKIX_RSA_PSS_4096_SHA256\x10\x12\x12$\n" +
+	"\x1cPKIX_ECDSA_P256_HMAC_SHA_256\x10\x06\x1a\x02\b\x01\x12\x1b\n" +
+	"\x17PKIX_ECDSA_P256_SHA_256\x10\x05\x12\x1b\n" +
+	"\x17PKIX_ECDSA_P384_SHA_384\x10\f\x12\x1b\n" +
+	"\x17PKIX_ECDSA_P521_SHA_512\x10\r\x12\x10\n" +
+	"\fPKIX_ED25519\x10\a\x12\x13\n" +
+	"\x0fPKIX_ED25519_PH\x10\b\x12\x1f\n" +
+	"\x17PKIX_ECDSA_P384_SHA_256\x10\x13\x1a\x02\b\x01\x12\x1f\n" +
+	"\x17PKIX_ECDSA_P521_SHA_256\x10\x14\x1a\x02\b\x01\x12\x12\n" +
+	"\n" +
+	"LMS_SHA256\x10\x0e\x1a\x02\b\x01\x12\x14\n" +
+	"\fLMOTS_SHA256\x10\x0f\x1a\x02\b\x01\x12\r\n" +
+	"\tML_DSA_44\x10\x17\x12\r\n" +
+	"\tML_DSA_65\x10\x15\x12\r\n" +
+	"\tML_DSA_87\x10\x16\"\x04\b\x18\x102*o\n" +
+	"\x1aSubjectAlternativeNameType\x12-\n" +
+	")SUBJECT_ALTERNATIVE_NAME_TYPE_UNSPECIFIED\x10\x00\x12\t\n" +
+	"\x05EMAIL\x10\x01\x12\a\n" +
+	"\x03URI\x10\x02\x12\x0e\n" +
+	"\n" +
+	"OTHER_NAME\x10\x03B|\n" +
+	"\x1cdev.sigstore.proto.common.v1B\vCommonProtoP\x01Z6github.com/sigstore/protobuf-specs/gen/pb-go/common/v1\xea\x02\x14Sigstore::Common::V1b\x06proto3"
 
 var (
 	file_sigstore_common_proto_rawDescOnce sync.Once
diff --git a/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/dsse/envelope.pb.go b/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/dsse/envelope.pb.go
index 298e2439e..77a81a40f 100644
--- a/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/dsse/envelope.pb.go
+++ b/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/dsse/envelope.pb.go
@@ -14,8 +14,8 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.5
-// 	protoc        v6.30.2
+// 	protoc-gen-go v1.36.10
+// 	protoc        v7.34.1
 // source: envelope.proto
 
 package dsse
@@ -169,26 +169,18 @@ func (x *Signature) GetKeyid() string {
 
 var File_envelope_proto protoreflect.FileDescriptor
 
-var file_envelope_proto_rawDesc = string([]byte{
-	0x0a, 0x0e, 0x65, 0x6e, 0x76, 0x65, 0x6c, 0x6f, 0x70, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x12, 0x09, 0x69, 0x6f, 0x2e, 0x69, 0x6e, 0x74, 0x6f, 0x74, 0x6f, 0x22, 0x7c, 0x0a, 0x08, 0x45,
-	0x6e, 0x76, 0x65, 0x6c, 0x6f, 0x70, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x70, 0x61, 0x79, 0x6c, 0x6f,
-	0x61, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61,
-	0x64, 0x12, 0x20, 0x0a, 0x0b, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x54, 0x79, 0x70, 0x65,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x54,
-	0x79, 0x70, 0x65, 0x12, 0x34, 0x0a, 0x0a, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65,
-	0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x69, 0x6f, 0x2e, 0x69, 0x6e, 0x74,
-	0x6f, 0x74, 0x6f, 0x2e, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x52, 0x0a, 0x73,
-	0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x73, 0x22, 0x33, 0x0a, 0x09, 0x53, 0x69, 0x67,
-	0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x73, 0x69, 0x67, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x0c, 0x52, 0x03, 0x73, 0x69, 0x67, 0x12, 0x14, 0x0a, 0x05, 0x6b, 0x65, 0x79, 0x69,
-	0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6b, 0x65, 0x79, 0x69, 0x64, 0x42, 0x44,
-	0x5a, 0x31, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x69, 0x67,
-	0x73, 0x74, 0x6f, 0x72, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2d, 0x73,
-	0x70, 0x65, 0x63, 0x73, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x70, 0x62, 0x2d, 0x67, 0x6f, 0x2f, 0x64,
-	0x73, 0x73, 0x65, 0xea, 0x02, 0x0e, 0x53, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x3a, 0x3a,
-	0x44, 0x53, 0x53, 0x45, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-})
+const file_envelope_proto_rawDesc = "" +
+	"\n" +
+	"\x0eenvelope.proto\x12\tio.intoto\"|\n" +
+	"\bEnvelope\x12\x18\n" +
+	"\apayload\x18\x01 \x01(\fR\apayload\x12 \n" +
+	"\vpayloadType\x18\x02 \x01(\tR\vpayloadType\x124\n" +
+	"\n" +
+	"signatures\x18\x03 \x03(\v2\x14.io.intoto.SignatureR\n" +
+	"signatures\"3\n" +
+	"\tSignature\x12\x10\n" +
+	"\x03sig\x18\x01 \x01(\fR\x03sig\x12\x14\n" +
+	"\x05keyid\x18\x02 \x01(\tR\x05keyidBDZ1github.com/sigstore/protobuf-specs/gen/pb-go/dsse\xea\x02\x0eSigstore::DSSEb\x06proto3"
 
 var (
 	file_envelope_proto_rawDescOnce sync.Once
diff --git a/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/rekor/v1/sigstore_rekor.pb.go b/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/rekor/v1/sigstore_rekor.pb.go
index 43b3111eb..2e94c9008 100644
--- a/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/rekor/v1/sigstore_rekor.pb.go
+++ b/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/rekor/v1/sigstore_rekor.pb.go
@@ -14,8 +14,8 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.5
-// 	protoc        v6.30.2
+// 	protoc-gen-go v1.36.10
+// 	protoc        v7.34.1
 // source: sigstore_rekor.proto
 
 package v1
@@ -428,78 +428,35 @@ func (x *TransparencyLogEntry) GetCanonicalizedBody() []byte {
 
 var File_sigstore_rekor_proto protoreflect.FileDescriptor
 
-var file_sigstore_rekor_proto_rawDesc = string([]byte{
-	0x0a, 0x14, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x5f, 0x72, 0x65, 0x6b, 0x6f, 0x72,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x15, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73,
-	0x74, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x65, 0x6b, 0x6f, 0x72, 0x2e, 0x76, 0x31, 0x1a, 0x1f, 0x67,
-	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x5f,
-	0x62, 0x65, 0x68, 0x61, 0x76, 0x69, 0x6f, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x15,
-	0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x5f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x45, 0x0a, 0x0b, 0x4b, 0x69, 0x6e, 0x64, 0x56, 0x65, 0x72,
-	0x73, 0x69, 0x6f, 0x6e, 0x12, 0x17, 0x0a, 0x04, 0x6b, 0x69, 0x6e, 0x64, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x42, 0x03, 0xe0, 0x41, 0x02, 0x52, 0x04, 0x6b, 0x69, 0x6e, 0x64, 0x12, 0x1d, 0x0a,
-	0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x03,
-	0xe0, 0x41, 0x02, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x2d, 0x0a, 0x0a,
-	0x43, 0x68, 0x65, 0x63, 0x6b, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x1f, 0x0a, 0x08, 0x65, 0x6e,
-	0x76, 0x65, 0x6c, 0x6f, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x03, 0xe0, 0x41,
-	0x02, 0x52, 0x08, 0x65, 0x6e, 0x76, 0x65, 0x6c, 0x6f, 0x70, 0x65, 0x22, 0xdb, 0x01, 0x0a, 0x0e,
-	0x49, 0x6e, 0x63, 0x6c, 0x75, 0x73, 0x69, 0x6f, 0x6e, 0x50, 0x72, 0x6f, 0x6f, 0x66, 0x12, 0x20,
-	0x0a, 0x09, 0x6c, 0x6f, 0x67, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x03, 0x42, 0x03, 0xe0, 0x41, 0x02, 0x52, 0x08, 0x6c, 0x6f, 0x67, 0x49, 0x6e, 0x64, 0x65, 0x78,
-	0x12, 0x20, 0x0a, 0x09, 0x72, 0x6f, 0x6f, 0x74, 0x5f, 0x68, 0x61, 0x73, 0x68, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x0c, 0x42, 0x03, 0xe0, 0x41, 0x02, 0x52, 0x08, 0x72, 0x6f, 0x6f, 0x74, 0x48, 0x61,
-	0x73, 0x68, 0x12, 0x20, 0x0a, 0x09, 0x74, 0x72, 0x65, 0x65, 0x5f, 0x73, 0x69, 0x7a, 0x65, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x03, 0x42, 0x03, 0xe0, 0x41, 0x02, 0x52, 0x08, 0x74, 0x72, 0x65, 0x65,
-	0x53, 0x69, 0x7a, 0x65, 0x12, 0x1b, 0x0a, 0x06, 0x68, 0x61, 0x73, 0x68, 0x65, 0x73, 0x18, 0x04,
-	0x20, 0x03, 0x28, 0x0c, 0x42, 0x03, 0xe0, 0x41, 0x02, 0x52, 0x06, 0x68, 0x61, 0x73, 0x68, 0x65,
-	0x73, 0x12, 0x46, 0x0a, 0x0a, 0x63, 0x68, 0x65, 0x63, 0x6b, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18,
-	0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73,
-	0x74, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x65, 0x6b, 0x6f, 0x72, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x68,
-	0x65, 0x63, 0x6b, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x42, 0x03, 0xe0, 0x41, 0x02, 0x52, 0x0a, 0x63,
-	0x68, 0x65, 0x63, 0x6b, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x22, 0x4d, 0x0a, 0x10, 0x49, 0x6e, 0x63,
-	0x6c, 0x75, 0x73, 0x69, 0x6f, 0x6e, 0x50, 0x72, 0x6f, 0x6d, 0x69, 0x73, 0x65, 0x12, 0x39, 0x0a,
-	0x16, 0x73, 0x69, 0x67, 0x6e, 0x65, 0x64, 0x5f, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x5f, 0x74, 0x69,
-	0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x42, 0x03, 0xe0,
-	0x41, 0x02, 0x52, 0x14, 0x73, 0x69, 0x67, 0x6e, 0x65, 0x64, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x54,
-	0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x22, 0xc7, 0x03, 0x0a, 0x14, 0x54, 0x72, 0x61,
-	0x6e, 0x73, 0x70, 0x61, 0x72, 0x65, 0x6e, 0x63, 0x79, 0x4c, 0x6f, 0x67, 0x45, 0x6e, 0x74, 0x72,
-	0x79, 0x12, 0x20, 0x0a, 0x09, 0x6c, 0x6f, 0x67, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x03, 0x42, 0x03, 0xe0, 0x41, 0x02, 0x52, 0x08, 0x6c, 0x6f, 0x67, 0x49, 0x6e,
-	0x64, 0x65, 0x78, 0x12, 0x39, 0x0a, 0x06, 0x6c, 0x6f, 0x67, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f,
-	0x72, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x6f, 0x67,
-	0x49, 0x64, 0x42, 0x03, 0xe0, 0x41, 0x02, 0x52, 0x05, 0x6c, 0x6f, 0x67, 0x49, 0x64, 0x12, 0x4a,
-	0x0a, 0x0c, 0x6b, 0x69, 0x6e, 0x64, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x03,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74,
-	0x6f, 0x72, 0x65, 0x2e, 0x72, 0x65, 0x6b, 0x6f, 0x72, 0x2e, 0x76, 0x31, 0x2e, 0x4b, 0x69, 0x6e,
-	0x64, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x42, 0x03, 0xe0, 0x41, 0x02, 0x52, 0x0b, 0x6b,
-	0x69, 0x6e, 0x64, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x2c, 0x0a, 0x0f, 0x69, 0x6e,
-	0x74, 0x65, 0x67, 0x72, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x04, 0x20,
-	0x01, 0x28, 0x03, 0x42, 0x03, 0xe0, 0x41, 0x02, 0x52, 0x0e, 0x69, 0x6e, 0x74, 0x65, 0x67, 0x72,
-	0x61, 0x74, 0x65, 0x64, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x54, 0x0a, 0x11, 0x69, 0x6e, 0x63, 0x6c,
-	0x75, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x70, 0x72, 0x6f, 0x6d, 0x69, 0x73, 0x65, 0x18, 0x05, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f,
-	0x72, 0x65, 0x2e, 0x72, 0x65, 0x6b, 0x6f, 0x72, 0x2e, 0x76, 0x31, 0x2e, 0x49, 0x6e, 0x63, 0x6c,
-	0x75, 0x73, 0x69, 0x6f, 0x6e, 0x50, 0x72, 0x6f, 0x6d, 0x69, 0x73, 0x65, 0x52, 0x10, 0x69, 0x6e,
-	0x63, 0x6c, 0x75, 0x73, 0x69, 0x6f, 0x6e, 0x50, 0x72, 0x6f, 0x6d, 0x69, 0x73, 0x65, 0x12, 0x53,
-	0x0a, 0x0f, 0x69, 0x6e, 0x63, 0x6c, 0x75, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x70, 0x72, 0x6f, 0x6f,
-	0x66, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69,
-	0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x65, 0x6b, 0x6f, 0x72, 0x2e, 0x76, 0x31, 0x2e,
-	0x49, 0x6e, 0x63, 0x6c, 0x75, 0x73, 0x69, 0x6f, 0x6e, 0x50, 0x72, 0x6f, 0x6f, 0x66, 0x42, 0x03,
-	0xe0, 0x41, 0x02, 0x52, 0x0e, 0x69, 0x6e, 0x63, 0x6c, 0x75, 0x73, 0x69, 0x6f, 0x6e, 0x50, 0x72,
-	0x6f, 0x6f, 0x66, 0x12, 0x2d, 0x0a, 0x12, 0x63, 0x61, 0x6e, 0x6f, 0x6e, 0x69, 0x63, 0x61, 0x6c,
-	0x69, 0x7a, 0x65, 0x64, 0x5f, 0x62, 0x6f, 0x64, 0x79, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0c, 0x52,
-	0x11, 0x63, 0x61, 0x6e, 0x6f, 0x6e, 0x69, 0x63, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x64, 0x42, 0x6f,
-	0x64, 0x79, 0x42, 0x78, 0x0a, 0x1b, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f,
-	0x72, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x72, 0x65, 0x6b, 0x6f, 0x72, 0x2e, 0x76,
-	0x31, 0x42, 0x0a, 0x52, 0x65, 0x6b, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a,
-	0x35, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x69, 0x67, 0x73,
-	0x74, 0x6f, 0x72, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2d, 0x73, 0x70,
-	0x65, 0x63, 0x73, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x70, 0x62, 0x2d, 0x67, 0x6f, 0x2f, 0x72, 0x65,
-	0x6b, 0x6f, 0x72, 0x2f, 0x76, 0x31, 0xea, 0x02, 0x13, 0x53, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72,
-	0x65, 0x3a, 0x3a, 0x52, 0x65, 0x6b, 0x6f, 0x72, 0x3a, 0x3a, 0x56, 0x31, 0x62, 0x06, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x33,
-})
+const file_sigstore_rekor_proto_rawDesc = "" +
+	"\n" +
+	"\x14sigstore_rekor.proto\x12\x15dev.sigstore.rekor.v1\x1a\x1fgoogle/api/field_behavior.proto\x1a\x15sigstore_common.proto\"E\n" +
+	"\vKindVersion\x12\x17\n" +
+	"\x04kind\x18\x01 \x01(\tB\x03\xe0A\x02R\x04kind\x12\x1d\n" +
+	"\aversion\x18\x02 \x01(\tB\x03\xe0A\x02R\aversion\"-\n" +
+	"\n" +
+	"Checkpoint\x12\x1f\n" +
+	"\benvelope\x18\x01 \x01(\tB\x03\xe0A\x02R\benvelope\"\xdb\x01\n" +
+	"\x0eInclusionProof\x12 \n" +
+	"\tlog_index\x18\x01 \x01(\x03B\x03\xe0A\x02R\blogIndex\x12 \n" +
+	"\troot_hash\x18\x02 \x01(\fB\x03\xe0A\x02R\brootHash\x12 \n" +
+	"\ttree_size\x18\x03 \x01(\x03B\x03\xe0A\x02R\btreeSize\x12\x1b\n" +
+	"\x06hashes\x18\x04 \x03(\fB\x03\xe0A\x02R\x06hashes\x12F\n" +
+	"\n" +
+	"checkpoint\x18\x05 \x01(\v2!.dev.sigstore.rekor.v1.CheckpointB\x03\xe0A\x02R\n" +
+	"checkpoint\"M\n" +
+	"\x10InclusionPromise\x129\n" +
+	"\x16signed_entry_timestamp\x18\x01 \x01(\fB\x03\xe0A\x02R\x14signedEntryTimestamp\"\xc7\x03\n" +
+	"\x14TransparencyLogEntry\x12 \n" +
+	"\tlog_index\x18\x01 \x01(\x03B\x03\xe0A\x02R\blogIndex\x129\n" +
+	"\x06log_id\x18\x02 \x01(\v2\x1d.dev.sigstore.common.v1.LogIdB\x03\xe0A\x02R\x05logId\x12J\n" +
+	"\fkind_version\x18\x03 \x01(\v2\".dev.sigstore.rekor.v1.KindVersionB\x03\xe0A\x02R\vkindVersion\x12,\n" +
+	"\x0fintegrated_time\x18\x04 \x01(\x03B\x03\xe0A\x02R\x0eintegratedTime\x12T\n" +
+	"\x11inclusion_promise\x18\x05 \x01(\v2'.dev.sigstore.rekor.v1.InclusionPromiseR\x10inclusionPromise\x12S\n" +
+	"\x0finclusion_proof\x18\x06 \x01(\v2%.dev.sigstore.rekor.v1.InclusionProofB\x03\xe0A\x02R\x0einclusionProof\x12-\n" +
+	"\x12canonicalized_body\x18\a \x01(\fR\x11canonicalizedBodyBx\n" +
+	"\x1bdev.sigstore.proto.rekor.v1B\n" +
+	"RekorProtoP\x01Z5github.com/sigstore/protobuf-specs/gen/pb-go/rekor/v1\xea\x02\x13Sigstore::Rekor::V1b\x06proto3"
 
 var (
 	file_sigstore_rekor_proto_rawDescOnce sync.Once
diff --git a/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/trustroot/v1/sigstore_trustroot.pb.go b/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/trustroot/v1/sigstore_trustroot.pb.go
index 580d1c69f..f1521b9cb 100644
--- a/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/trustroot/v1/sigstore_trustroot.pb.go
+++ b/vendor/github.com/sigstore/protobuf-specs/gen/pb-go/trustroot/v1/sigstore_trustroot.pb.go
@@ -14,8 +14,8 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.5
-// 	protoc        v6.30.2
+// 	protoc-gen-go v1.36.10
+// 	protoc        v7.34.1
 // source: sigstore_trustroot.proto
 
 package v1
@@ -361,13 +361,10 @@ func (x *CertificateAuthority) GetOperator() string {
 // previously used instance -- otherwise signatures made in the past cannot
 // be verified.
 //
-// All the listed instances SHOULD be sorted by the 'valid_for' in ascending
-// order, that is, the oldest instance first. Only the last instance is
-// allowed to have their 'end' timestamp unset. All previous instances MUST
-// have a closed interval of validity. The last instance MAY have a closed
-// interval. Clients MUST accept instances that overlaps in time, if not
-// clients may experience problems during rotations of verification
-// materials.
+// All the listed instances SHOULD be sorted by the 'valid_for.start'
+// in ascending order, that is, the oldest instance first. Clients
+// MUST accept instances that overlaps in time, if not clients may
+// experience problems during rotations of verification materials.
 //
 // To be able to manage planned rotations of either transparency logs or
 // certificate authorities, clienst MUST accept lists of instances where
@@ -852,157 +849,61 @@ func (x *ClientTrustConfig) GetSigningConfig() *SigningConfig {
 
 var File_sigstore_trustroot_proto protoreflect.FileDescriptor
 
-var file_sigstore_trustroot_proto_rawDesc = string([]byte{
-	0x0a, 0x18, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x5f, 0x74, 0x72, 0x75, 0x73, 0x74,
-	0x72, 0x6f, 0x6f, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x19, 0x64, 0x65, 0x76, 0x2e,
-	0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x74, 0x72, 0x75, 0x73, 0x74, 0x72, 0x6f,
-	0x6f, 0x74, 0x2e, 0x76, 0x31, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x61, 0x70,
-	0x69, 0x2f, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x5f, 0x62, 0x65, 0x68, 0x61, 0x76, 0x69, 0x6f, 0x72,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x15, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65,
-	0x5f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xe1, 0x02,
-	0x0a, 0x17, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x61, 0x72, 0x65, 0x6e, 0x63, 0x79, 0x4c, 0x6f,
-	0x67, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x62, 0x61, 0x73,
-	0x65, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x62, 0x61, 0x73,
-	0x65, 0x55, 0x72, 0x6c, 0x12, 0x4c, 0x0a, 0x0e, 0x68, 0x61, 0x73, 0x68, 0x5f, 0x61, 0x6c, 0x67,
-	0x6f, 0x72, 0x69, 0x74, 0x68, 0x6d, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x25, 0x2e, 0x64,
-	0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x6d,
-	0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x48, 0x61, 0x73, 0x68, 0x41, 0x6c, 0x67, 0x6f, 0x72, 0x69,
-	0x74, 0x68, 0x6d, 0x52, 0x0d, 0x68, 0x61, 0x73, 0x68, 0x41, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74,
-	0x68, 0x6d, 0x12, 0x40, 0x0a, 0x0a, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67,
-	0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e,
-	0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x52, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69,
-	0x63, 0x4b, 0x65, 0x79, 0x12, 0x34, 0x0a, 0x06, 0x6c, 0x6f, 0x67, 0x5f, 0x69, 0x64, 0x18, 0x04,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74,
-	0x6f, 0x72, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x6f,
-	0x67, 0x49, 0x64, 0x52, 0x05, 0x6c, 0x6f, 0x67, 0x49, 0x64, 0x12, 0x49, 0x0a, 0x11, 0x63, 0x68,
-	0x65, 0x63, 0x6b, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x69, 0x64, 0x18,
-	0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73,
-	0x74, 0x6f, 0x72, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x4c,
-	0x6f, 0x67, 0x49, 0x64, 0x52, 0x0f, 0x63, 0x68, 0x65, 0x63, 0x6b, 0x70, 0x6f, 0x69, 0x6e, 0x74,
-	0x4b, 0x65, 0x79, 0x49, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f,
-	0x72, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f,
-	0x72, 0x22, 0x96, 0x02, 0x0a, 0x14, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74,
-	0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x12, 0x43, 0x0a, 0x07, 0x73, 0x75,
-	0x62, 0x6a, 0x65, 0x63, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x64, 0x65,
-	0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f,
-	0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x69, 0x73, 0x74, 0x69, 0x6e, 0x67, 0x75, 0x69, 0x73, 0x68,
-	0x65, 0x64, 0x4e, 0x61, 0x6d, 0x65, 0x52, 0x07, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x12,
-	0x10, 0x0a, 0x03, 0x75, 0x72, 0x69, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72,
-	0x69, 0x12, 0x4b, 0x0a, 0x0a, 0x63, 0x65, 0x72, 0x74, 0x5f, 0x63, 0x68, 0x61, 0x69, 0x6e, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2c, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73,
-	0x74, 0x6f, 0x72, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x58,
-	0x35, 0x30, 0x39, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x43, 0x68,
-	0x61, 0x69, 0x6e, 0x52, 0x09, 0x63, 0x65, 0x72, 0x74, 0x43, 0x68, 0x61, 0x69, 0x6e, 0x12, 0x3e,
-	0x0a, 0x09, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x5f, 0x66, 0x6f, 0x72, 0x18, 0x04, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x21, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65,
-	0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x52,
-	0x61, 0x6e, 0x67, 0x65, 0x52, 0x08, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x46, 0x6f, 0x72, 0x12, 0x1a,
-	0x0a, 0x08, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x08, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x22, 0x92, 0x03, 0x0a, 0x0b, 0x54,
-	0x72, 0x75, 0x73, 0x74, 0x65, 0x64, 0x52, 0x6f, 0x6f, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x6d, 0x65,
-	0x64, 0x69, 0x61, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09,
-	0x6d, 0x65, 0x64, 0x69, 0x61, 0x54, 0x79, 0x70, 0x65, 0x12, 0x48, 0x0a, 0x05, 0x74, 0x6c, 0x6f,
-	0x67, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x32, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73,
-	0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x74, 0x72, 0x75, 0x73, 0x74, 0x72, 0x6f, 0x6f,
-	0x74, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x61, 0x72, 0x65, 0x6e, 0x63,
-	0x79, 0x4c, 0x6f, 0x67, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x52, 0x05, 0x74, 0x6c,
-	0x6f, 0x67, 0x73, 0x12, 0x68, 0x0a, 0x17, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61,
-	0x74, 0x65, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x69, 0x65, 0x73, 0x18, 0x03,
-	0x20, 0x03, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74,
-	0x6f, 0x72, 0x65, 0x2e, 0x74, 0x72, 0x75, 0x73, 0x74, 0x72, 0x6f, 0x6f, 0x74, 0x2e, 0x76, 0x31,
-	0x2e, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68,
-	0x6f, 0x72, 0x69, 0x74, 0x79, 0x52, 0x16, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61,
-	0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x69, 0x65, 0x73, 0x12, 0x4a, 0x0a,
-	0x06, 0x63, 0x74, 0x6c, 0x6f, 0x67, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x32, 0x2e,
-	0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x74, 0x72, 0x75,
-	0x73, 0x74, 0x72, 0x6f, 0x6f, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x70,
-	0x61, 0x72, 0x65, 0x6e, 0x63, 0x79, 0x4c, 0x6f, 0x67, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63,
-	0x65, 0x52, 0x06, 0x63, 0x74, 0x6c, 0x6f, 0x67, 0x73, 0x12, 0x64, 0x0a, 0x15, 0x74, 0x69, 0x6d,
-	0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x69,
-	0x65, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73,
-	0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x74, 0x72, 0x75, 0x73, 0x74, 0x72, 0x6f, 0x6f,
-	0x74, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65,
-	0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x52, 0x14, 0x74, 0x69, 0x6d, 0x65, 0x73,
-	0x74, 0x61, 0x6d, 0x70, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x69, 0x65, 0x73, 0x22,
-	0xea, 0x03, 0x0a, 0x0d, 0x53, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67, 0x43, 0x6f, 0x6e, 0x66, 0x69,
-	0x67, 0x12, 0x1d, 0x0a, 0x0a, 0x6d, 0x65, 0x64, 0x69, 0x61, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18,
-	0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6d, 0x65, 0x64, 0x69, 0x61, 0x54, 0x79, 0x70, 0x65,
-	0x12, 0x3b, 0x0a, 0x07, 0x63, 0x61, 0x5f, 0x75, 0x72, 0x6c, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x22, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65,
-	0x2e, 0x74, 0x72, 0x75, 0x73, 0x74, 0x72, 0x6f, 0x6f, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65,
-	0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x06, 0x63, 0x61, 0x55, 0x72, 0x6c, 0x73, 0x12, 0x3f, 0x0a,
-	0x09, 0x6f, 0x69, 0x64, 0x63, 0x5f, 0x75, 0x72, 0x6c, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x0b,
-	0x32, 0x22, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e,
-	0x74, 0x72, 0x75, 0x73, 0x74, 0x72, 0x6f, 0x6f, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x72,
-	0x76, 0x69, 0x63, 0x65, 0x52, 0x08, 0x6f, 0x69, 0x64, 0x63, 0x55, 0x72, 0x6c, 0x73, 0x12, 0x4a,
-	0x0a, 0x0f, 0x72, 0x65, 0x6b, 0x6f, 0x72, 0x5f, 0x74, 0x6c, 0x6f, 0x67, 0x5f, 0x75, 0x72, 0x6c,
-	0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69,
-	0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x74, 0x72, 0x75, 0x73, 0x74, 0x72, 0x6f, 0x6f, 0x74,
-	0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x0d, 0x72, 0x65, 0x6b,
-	0x6f, 0x72, 0x54, 0x6c, 0x6f, 0x67, 0x55, 0x72, 0x6c, 0x73, 0x12, 0x5b, 0x0a, 0x11, 0x72, 0x65,
-	0x6b, 0x6f, 0x72, 0x5f, 0x74, 0x6c, 0x6f, 0x67, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18,
-	0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73,
-	0x74, 0x6f, 0x72, 0x65, 0x2e, 0x74, 0x72, 0x75, 0x73, 0x74, 0x72, 0x6f, 0x6f, 0x74, 0x2e, 0x76,
-	0x31, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75,
-	0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0f, 0x72, 0x65, 0x6b, 0x6f, 0x72, 0x54, 0x6c, 0x6f,
-	0x67, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x3d, 0x0a, 0x08, 0x74, 0x73, 0x61, 0x5f, 0x75,
-	0x72, 0x6c, 0x73, 0x18, 0x0a, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x64, 0x65, 0x76, 0x2e,
-	0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x74, 0x72, 0x75, 0x73, 0x74, 0x72, 0x6f,
-	0x6f, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x07, 0x74,
-	0x73, 0x61, 0x55, 0x72, 0x6c, 0x73, 0x12, 0x4e, 0x0a, 0x0a, 0x74, 0x73, 0x61, 0x5f, 0x63, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x64, 0x65, 0x76,
-	0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x74, 0x72, 0x75, 0x73, 0x74, 0x72,
-	0x6f, 0x6f, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x09, 0x74, 0x73, 0x61,
-	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x4a, 0x04, 0x08, 0x01, 0x10, 0x05, 0x22, 0xa3, 0x01, 0x0a,
-	0x07, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x6c, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x6c, 0x12, 0x2a, 0x0a, 0x11, 0x6d, 0x61,
-	0x6a, 0x6f, 0x72, 0x5f, 0x61, 0x70, 0x69, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0f, 0x6d, 0x61, 0x6a, 0x6f, 0x72, 0x41, 0x70, 0x69, 0x56,
-	0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x3e, 0x0a, 0x09, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x5f,
-	0x66, 0x6f, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x64, 0x65, 0x76, 0x2e,
-	0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e,
-	0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x52, 0x08, 0x76, 0x61,
-	0x6c, 0x69, 0x64, 0x46, 0x6f, 0x72, 0x12, 0x1a, 0x0a, 0x08, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74,
-	0x6f, 0x72, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74,
-	0x6f, 0x72, 0x22, 0x74, 0x0a, 0x14, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x46, 0x0a, 0x08, 0x73, 0x65,
-	0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2a, 0x2e, 0x64,
-	0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x74, 0x72, 0x75, 0x73,
-	0x74, 0x72, 0x6f, 0x6f, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
-	0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x52, 0x08, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74,
-	0x6f, 0x72, 0x12, 0x14, 0x0a, 0x05, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x0d, 0x52, 0x05, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x22, 0xd8, 0x01, 0x0a, 0x11, 0x43, 0x6c, 0x69,
-	0x65, 0x6e, 0x74, 0x54, 0x72, 0x75, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x1d,
-	0x0a, 0x0a, 0x6d, 0x65, 0x64, 0x69, 0x61, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x09, 0x6d, 0x65, 0x64, 0x69, 0x61, 0x54, 0x79, 0x70, 0x65, 0x12, 0x4e, 0x0a,
-	0x0c, 0x74, 0x72, 0x75, 0x73, 0x74, 0x65, 0x64, 0x5f, 0x72, 0x6f, 0x6f, 0x74, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f,
-	0x72, 0x65, 0x2e, 0x74, 0x72, 0x75, 0x73, 0x74, 0x72, 0x6f, 0x6f, 0x74, 0x2e, 0x76, 0x31, 0x2e,
-	0x54, 0x72, 0x75, 0x73, 0x74, 0x65, 0x64, 0x52, 0x6f, 0x6f, 0x74, 0x42, 0x03, 0xe0, 0x41, 0x02,
-	0x52, 0x0b, 0x74, 0x72, 0x75, 0x73, 0x74, 0x65, 0x64, 0x52, 0x6f, 0x6f, 0x74, 0x12, 0x54, 0x0a,
-	0x0e, 0x73, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73,
-	0x74, 0x6f, 0x72, 0x65, 0x2e, 0x74, 0x72, 0x75, 0x73, 0x74, 0x72, 0x6f, 0x6f, 0x74, 0x2e, 0x76,
-	0x31, 0x2e, 0x53, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x42,
-	0x03, 0xe0, 0x41, 0x02, 0x52, 0x0d, 0x73, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67, 0x43, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x2a, 0x4e, 0x0a, 0x0f, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x53, 0x65,
-	0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x12, 0x1e, 0x0a, 0x1a, 0x53, 0x45, 0x52, 0x56, 0x49, 0x43,
-	0x45, 0x5f, 0x53, 0x45, 0x4c, 0x45, 0x43, 0x54, 0x4f, 0x52, 0x5f, 0x55, 0x4e, 0x44, 0x45, 0x46,
-	0x49, 0x4e, 0x45, 0x44, 0x10, 0x00, 0x12, 0x07, 0x0a, 0x03, 0x41, 0x4c, 0x4c, 0x10, 0x01, 0x12,
-	0x07, 0x0a, 0x03, 0x41, 0x4e, 0x59, 0x10, 0x02, 0x12, 0x09, 0x0a, 0x05, 0x45, 0x58, 0x41, 0x43,
-	0x54, 0x10, 0x03, 0x42, 0x88, 0x01, 0x0a, 0x1f, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73,
-	0x74, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x74, 0x72, 0x75, 0x73, 0x74,
-	0x72, 0x6f, 0x6f, 0x74, 0x2e, 0x76, 0x31, 0x42, 0x0e, 0x54, 0x72, 0x75, 0x73, 0x74, 0x52, 0x6f,
-	0x6f, 0x74, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x39, 0x67, 0x69, 0x74, 0x68, 0x75,
-	0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2f, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2d, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2f, 0x67, 0x65,
-	0x6e, 0x2f, 0x70, 0x62, 0x2d, 0x67, 0x6f, 0x2f, 0x74, 0x72, 0x75, 0x73, 0x74, 0x72, 0x6f, 0x6f,
-	0x74, 0x2f, 0x76, 0x31, 0xea, 0x02, 0x17, 0x53, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x3a,
-	0x3a, 0x54, 0x72, 0x75, 0x73, 0x74, 0x52, 0x6f, 0x6f, 0x74, 0x3a, 0x3a, 0x56, 0x31, 0x62, 0x06,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-})
+const file_sigstore_trustroot_proto_rawDesc = "" +
+	"\n" +
+	"\x18sigstore_trustroot.proto\x12\x19dev.sigstore.trustroot.v1\x1a\x1fgoogle/api/field_behavior.proto\x1a\x15sigstore_common.proto\"\xe1\x02\n" +
+	"\x17TransparencyLogInstance\x12\x19\n" +
+	"\bbase_url\x18\x01 \x01(\tR\abaseUrl\x12L\n" +
+	"\x0ehash_algorithm\x18\x02 \x01(\x0e2%.dev.sigstore.common.v1.HashAlgorithmR\rhashAlgorithm\x12@\n" +
+	"\n" +
+	"public_key\x18\x03 \x01(\v2!.dev.sigstore.common.v1.PublicKeyR\tpublicKey\x124\n" +
+	"\x06log_id\x18\x04 \x01(\v2\x1d.dev.sigstore.common.v1.LogIdR\x05logId\x12I\n" +
+	"\x11checkpoint_key_id\x18\x05 \x01(\v2\x1d.dev.sigstore.common.v1.LogIdR\x0fcheckpointKeyId\x12\x1a\n" +
+	"\boperator\x18\x06 \x01(\tR\boperator\"\x96\x02\n" +
+	"\x14CertificateAuthority\x12C\n" +
+	"\asubject\x18\x01 \x01(\v2).dev.sigstore.common.v1.DistinguishedNameR\asubject\x12\x10\n" +
+	"\x03uri\x18\x02 \x01(\tR\x03uri\x12K\n" +
+	"\n" +
+	"cert_chain\x18\x03 \x01(\v2,.dev.sigstore.common.v1.X509CertificateChainR\tcertChain\x12>\n" +
+	"\tvalid_for\x18\x04 \x01(\v2!.dev.sigstore.common.v1.TimeRangeR\bvalidFor\x12\x1a\n" +
+	"\boperator\x18\x05 \x01(\tR\boperator\"\x92\x03\n" +
+	"\vTrustedRoot\x12\x1d\n" +
+	"\n" +
+	"media_type\x18\x01 \x01(\tR\tmediaType\x12H\n" +
+	"\x05tlogs\x18\x02 \x03(\v22.dev.sigstore.trustroot.v1.TransparencyLogInstanceR\x05tlogs\x12h\n" +
+	"\x17certificate_authorities\x18\x03 \x03(\v2/.dev.sigstore.trustroot.v1.CertificateAuthorityR\x16certificateAuthorities\x12J\n" +
+	"\x06ctlogs\x18\x04 \x03(\v22.dev.sigstore.trustroot.v1.TransparencyLogInstanceR\x06ctlogs\x12d\n" +
+	"\x15timestamp_authorities\x18\x05 \x03(\v2/.dev.sigstore.trustroot.v1.CertificateAuthorityR\x14timestampAuthorities\"\xea\x03\n" +
+	"\rSigningConfig\x12\x1d\n" +
+	"\n" +
+	"media_type\x18\x05 \x01(\tR\tmediaType\x12;\n" +
+	"\aca_urls\x18\x06 \x03(\v2\".dev.sigstore.trustroot.v1.ServiceR\x06caUrls\x12?\n" +
+	"\toidc_urls\x18\a \x03(\v2\".dev.sigstore.trustroot.v1.ServiceR\boidcUrls\x12J\n" +
+	"\x0frekor_tlog_urls\x18\b \x03(\v2\".dev.sigstore.trustroot.v1.ServiceR\rrekorTlogUrls\x12[\n" +
+	"\x11rekor_tlog_config\x18\t \x01(\v2/.dev.sigstore.trustroot.v1.ServiceConfigurationR\x0frekorTlogConfig\x12=\n" +
+	"\btsa_urls\x18\n" +
+	" \x03(\v2\".dev.sigstore.trustroot.v1.ServiceR\atsaUrls\x12N\n" +
+	"\n" +
+	"tsa_config\x18\v \x01(\v2/.dev.sigstore.trustroot.v1.ServiceConfigurationR\ttsaConfigJ\x04\b\x01\x10\x05\"\xb7\x01\n" +
+	"\aService\x12\x15\n" +
+	"\x03url\x18\x01 \x01(\tB\x03\xe0A\x02R\x03url\x12/\n" +
+	"\x11major_api_version\x18\x02 \x01(\rB\x03\xe0A\x02R\x0fmajorApiVersion\x12C\n" +
+	"\tvalid_for\x18\x03 \x01(\v2!.dev.sigstore.common.v1.TimeRangeB\x03\xe0A\x02R\bvalidFor\x12\x1f\n" +
+	"\boperator\x18\x04 \x01(\tB\x03\xe0A\x02R\boperator\"y\n" +
+	"\x14ServiceConfiguration\x12K\n" +
+	"\bselector\x18\x01 \x01(\x0e2*.dev.sigstore.trustroot.v1.ServiceSelectorB\x03\xe0A\x02R\bselector\x12\x14\n" +
+	"\x05count\x18\x02 \x01(\rR\x05count\"\xd8\x01\n" +
+	"\x11ClientTrustConfig\x12\x1d\n" +
+	"\n" +
+	"media_type\x18\x01 \x01(\tR\tmediaType\x12N\n" +
+	"\ftrusted_root\x18\x02 \x01(\v2&.dev.sigstore.trustroot.v1.TrustedRootB\x03\xe0A\x02R\vtrustedRoot\x12T\n" +
+	"\x0esigning_config\x18\x03 \x01(\v2(.dev.sigstore.trustroot.v1.SigningConfigB\x03\xe0A\x02R\rsigningConfig*N\n" +
+	"\x0fServiceSelector\x12\x1e\n" +
+	"\x1aSERVICE_SELECTOR_UNDEFINED\x10\x00\x12\a\n" +
+	"\x03ALL\x10\x01\x12\a\n" +
+	"\x03ANY\x10\x02\x12\t\n" +
+	"\x05EXACT\x10\x03B\x88\x01\n" +
+	"\x1fdev.sigstore.proto.trustroot.v1B\x0eTrustRootProtoP\x01Z9github.com/sigstore/protobuf-specs/gen/pb-go/trustroot/v1\xea\x02\x17Sigstore::TrustRoot::V1b\x06proto3"
 
 var (
 	file_sigstore_trustroot_proto_rawDescOnce sync.Once
diff --git a/vendor/github.com/sigstore/rekor-tiles/v2/pkg/client/write/write.go b/vendor/github.com/sigstore/rekor-tiles/v2/pkg/client/write/write.go
index 7fea43051..bcb67dc20 100644
--- a/vendor/github.com/sigstore/rekor-tiles/v2/pkg/client/write/write.go
+++ b/vendor/github.com/sigstore/rekor-tiles/v2/pkg/client/write/write.go
@@ -23,6 +23,7 @@ import (
 	"net/http"
 	"net/url"
 	"path"
+	"time"
 
 	pbs "github.com/sigstore/protobuf-specs/gen/pb-go/rekor/v1"
 	"github.com/sigstore/rekor-tiles/v2/pkg/client"
@@ -31,7 +32,9 @@ import (
 )
 
 const (
-	addPath = "/api/v2/log/entries"
+	addPath         = "/api/v2/log/entries"
+	maxResponseSize = 10 * 1024 * 1024 // 10MB
+	defaultTimeout  = 30 * time.Second
 )
 
 // Client writes entries to rekor.
@@ -60,9 +63,13 @@ func NewWriter(writeURL string, opts ...client.Option) (Client, error) {
 			TLSClientConfig: cfg.TLSConfig,
 		}
 	}
+	timeout := cfg.Timeout
+	if timeout == 0 {
+		timeout = defaultTimeout
+	}
 	httpClient := &http.Client{
 		Transport: client.CreateRoundTripper(transport, cfg.UserAgent),
-		Timeout:   cfg.Timeout,
+		Timeout:   timeout,
 	}
 	return &writeClient{
 		baseURL: baseURL,
@@ -70,7 +77,7 @@ func NewWriter(writeURL string, opts ...client.Option) (Client, error) {
 	}, nil
 }
 
-// Add uploads a hashedrekord or DSSE log entry and returns the TransparencyLogEntry proving the entry's inclusion in the log.
+// Add uploads a hashedrekord log entry and returns the TransparencyLogEntry proving the entry's inclusion in the log.
 func (w *writeClient) Add(ctx context.Context, entry any) (*pbs.TransparencyLogEntry, error) {
 	cer, err := createRequest(entry)
 	if err != nil {
@@ -93,7 +100,7 @@ func (w *writeClient) Add(ctx context.Context, entry any) (*pbs.TransparencyLogE
 		return nil, fmt.Errorf("getting response: %w", err)
 	}
 	defer resp.Body.Close()
-	body, err := io.ReadAll(resp.Body)
+	body, err := io.ReadAll(io.LimitReader(resp.Body, maxResponseSize))
 	if err != nil {
 		return nil, fmt.Errorf("reading response: %w", err)
 	}
@@ -112,8 +119,6 @@ func createRequest(entry any) (*pb.CreateEntryRequest, error) {
 	switch e := entry.(type) {
 	case *pb.HashedRekordRequestV002:
 		return createHashedRekordRequest(e), nil
-	case *pb.DSSERequestV002:
-		return createDSSERequest(e), nil
 	default:
 		return nil, fmt.Errorf("unsupported entry type: %T", entry)
 	}
@@ -126,11 +131,3 @@ func createHashedRekordRequest(h *pb.HashedRekordRequestV002) *pb.CreateEntryReq
 		},
 	}
 }
-
-func createDSSERequest(d *pb.DSSERequestV002) *pb.CreateEntryRequest {
-	return &pb.CreateEntryRequest{
-		Spec: &pb.CreateEntryRequest_DsseRequestV002{
-			DsseRequestV002: d,
-		},
-	}
-}
diff --git a/vendor/github.com/sigstore/rekor-tiles/v2/pkg/generated/protobuf/dsse.pb.go b/vendor/github.com/sigstore/rekor-tiles/v2/pkg/generated/protobuf/dsse.pb.go
index e243eabb9..164a2bdd0 100644
--- a/vendor/github.com/sigstore/rekor-tiles/v2/pkg/generated/protobuf/dsse.pb.go
+++ b/vendor/github.com/sigstore/rekor-tiles/v2/pkg/generated/protobuf/dsse.pb.go
@@ -39,11 +39,18 @@ const (
 )
 
 // A request to add a DSSE v0.0.2 entry to the log
+// Deprecated: Use HashedRekordRequestV002 with the hash of the DSSE PAE instead
+//
+// Deprecated: Marked as deprecated in rekor/v2/dsse.proto.
 type DSSERequestV002 struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// A DSSE envelope
+	//
+	// Deprecated: Marked as deprecated in rekor/v2/dsse.proto.
 	Envelope *dsse.Envelope `protobuf:"bytes,1,opt,name=envelope,proto3" json:"envelope,omitempty"`
 	// All necessary verification material to verify all signatures embedded in the envelope
+	//
+	// Deprecated: Marked as deprecated in rekor/v2/dsse.proto.
 	Verifiers     []*Verifier `protobuf:"bytes,2,rep,name=verifiers,proto3" json:"verifiers,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
@@ -79,6 +86,7 @@ func (*DSSERequestV002) Descriptor() ([]byte, []int) {
 	return file_rekor_v2_dsse_proto_rawDescGZIP(), []int{0}
 }
 
+// Deprecated: Marked as deprecated in rekor/v2/dsse.proto.
 func (x *DSSERequestV002) GetEnvelope() *dsse.Envelope {
 	if x != nil {
 		return x.Envelope
@@ -86,6 +94,7 @@ func (x *DSSERequestV002) GetEnvelope() *dsse.Envelope {
 	return nil
 }
 
+// Deprecated: Marked as deprecated in rekor/v2/dsse.proto.
 func (x *DSSERequestV002) GetVerifiers() []*Verifier {
 	if x != nil {
 		return x.Verifiers
@@ -93,11 +102,18 @@ func (x *DSSERequestV002) GetVerifiers() []*Verifier {
 	return nil
 }
 
+// Deprecated: Use HashedRekordLogEntryV002
+//
+// Deprecated: Marked as deprecated in rekor/v2/dsse.proto.
 type DSSELogEntryV002 struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// The hash of the DSSE payload
+	//
+	// Deprecated: Marked as deprecated in rekor/v2/dsse.proto.
 	PayloadHash *v1.HashOutput `protobuf:"bytes,1,opt,name=payloadHash,proto3" json:"payloadHash,omitempty"`
 	// Signatures and their associated verification material used to verify the payload
+	//
+	// Deprecated: Marked as deprecated in rekor/v2/dsse.proto.
 	Signatures    []*Signature `protobuf:"bytes,2,rep,name=signatures,proto3" json:"signatures,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
@@ -133,6 +149,7 @@ func (*DSSELogEntryV002) Descriptor() ([]byte, []int) {
 	return file_rekor_v2_dsse_proto_rawDescGZIP(), []int{1}
 }
 
+// Deprecated: Marked as deprecated in rekor/v2/dsse.proto.
 func (x *DSSELogEntryV002) GetPayloadHash() *v1.HashOutput {
 	if x != nil {
 		return x.PayloadHash
@@ -140,6 +157,7 @@ func (x *DSSELogEntryV002) GetPayloadHash() *v1.HashOutput {
 	return nil
 }
 
+// Deprecated: Marked as deprecated in rekor/v2/dsse.proto.
 func (x *DSSELogEntryV002) GetSignatures() []*Signature {
 	if x != nil {
 		return x.Signatures
@@ -158,35 +176,35 @@ var file_rekor_v2_dsse_proto_rawDesc = string([]byte{
 	0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x5f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x70,
 	0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x0e, 0x65, 0x6e, 0x76, 0x65, 0x6c, 0x6f, 0x70, 0x65, 0x2e, 0x70,
 	0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x17, 0x72, 0x65, 0x6b, 0x6f, 0x72, 0x2f, 0x76, 0x32, 0x2f, 0x76,
-	0x65, 0x72, 0x69, 0x66, 0x69, 0x65, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x8b, 0x01,
+	0x65, 0x72, 0x69, 0x66, 0x69, 0x65, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x8d, 0x01,
 	0x0a, 0x0f, 0x44, 0x53, 0x53, 0x45, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x56, 0x30, 0x30,
-	0x32, 0x12, 0x34, 0x0a, 0x08, 0x65, 0x6e, 0x76, 0x65, 0x6c, 0x6f, 0x70, 0x65, 0x18, 0x01, 0x20,
+	0x32, 0x12, 0x33, 0x0a, 0x08, 0x65, 0x6e, 0x76, 0x65, 0x6c, 0x6f, 0x70, 0x65, 0x18, 0x01, 0x20,
 	0x01, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x69, 0x6f, 0x2e, 0x69, 0x6e, 0x74, 0x6f, 0x74, 0x6f, 0x2e,
-	0x45, 0x6e, 0x76, 0x65, 0x6c, 0x6f, 0x70, 0x65, 0x42, 0x03, 0xe0, 0x41, 0x02, 0x52, 0x08, 0x65,
-	0x6e, 0x76, 0x65, 0x6c, 0x6f, 0x70, 0x65, 0x12, 0x42, 0x0a, 0x09, 0x76, 0x65, 0x72, 0x69, 0x66,
-	0x69, 0x65, 0x72, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x64, 0x65, 0x76,
-	0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x65, 0x6b, 0x6f, 0x72, 0x2e,
-	0x76, 0x32, 0x2e, 0x56, 0x65, 0x72, 0x69, 0x66, 0x69, 0x65, 0x72, 0x42, 0x03, 0xe0, 0x41, 0x02,
-	0x52, 0x09, 0x76, 0x65, 0x72, 0x69, 0x66, 0x69, 0x65, 0x72, 0x73, 0x22, 0xa4, 0x01, 0x0a, 0x10,
-	0x44, 0x53, 0x53, 0x45, 0x4c, 0x6f, 0x67, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x56, 0x30, 0x30, 0x32,
-	0x12, 0x49, 0x0a, 0x0b, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x48, 0x61, 0x73, 0x68, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73,
-	0x74, 0x6f, 0x72, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x48,
-	0x61, 0x73, 0x68, 0x4f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x42, 0x03, 0xe0, 0x41, 0x02, 0x52, 0x0b,
-	0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x48, 0x61, 0x73, 0x68, 0x12, 0x45, 0x0a, 0x0a, 0x73,
-	0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32,
-	0x20, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x72,
-	0x65, 0x6b, 0x6f, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72,
-	0x65, 0x42, 0x03, 0xe0, 0x41, 0x02, 0x52, 0x0a, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72,
-	0x65, 0x73, 0x42, 0x7d, 0x0a, 0x1b, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f,
-	0x72, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x72, 0x65, 0x6b, 0x6f, 0x72, 0x2e, 0x76,
-	0x32, 0x42, 0x0b, 0x52, 0x65, 0x6b, 0x6f, 0x72, 0x56, 0x32, 0x44, 0x73, 0x73, 0x65, 0x50, 0x01,
-	0x5a, 0x39, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x69, 0x67,
-	0x73, 0x74, 0x6f, 0x72, 0x65, 0x2f, 0x72, 0x65, 0x6b, 0x6f, 0x72, 0x2d, 0x74, 0x69, 0x6c, 0x65,
-	0x73, 0x2f, 0x76, 0x32, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x67, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74,
-	0x65, 0x64, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0xea, 0x02, 0x13, 0x53, 0x69,
-	0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x3a, 0x3a, 0x52, 0x65, 0x6b, 0x6f, 0x72, 0x3a, 0x3a, 0x56,
-	0x32, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x45, 0x6e, 0x76, 0x65, 0x6c, 0x6f, 0x70, 0x65, 0x42, 0x02, 0x18, 0x01, 0x52, 0x08, 0x65, 0x6e,
+	0x76, 0x65, 0x6c, 0x6f, 0x70, 0x65, 0x12, 0x41, 0x0a, 0x09, 0x76, 0x65, 0x72, 0x69, 0x66, 0x69,
+	0x65, 0x72, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x64, 0x65, 0x76, 0x2e,
+	0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x65, 0x6b, 0x6f, 0x72, 0x2e, 0x76,
+	0x32, 0x2e, 0x56, 0x65, 0x72, 0x69, 0x66, 0x69, 0x65, 0x72, 0x42, 0x02, 0x18, 0x01, 0x52, 0x09,
+	0x76, 0x65, 0x72, 0x69, 0x66, 0x69, 0x65, 0x72, 0x73, 0x3a, 0x02, 0x18, 0x01, 0x22, 0xa6, 0x01,
+	0x0a, 0x10, 0x44, 0x53, 0x53, 0x45, 0x4c, 0x6f, 0x67, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x56, 0x30,
+	0x30, 0x32, 0x12, 0x48, 0x0a, 0x0b, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x48, 0x61, 0x73,
+	0x68, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69,
+	0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31,
+	0x2e, 0x48, 0x61, 0x73, 0x68, 0x4f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x42, 0x02, 0x18, 0x01, 0x52,
+	0x0b, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x48, 0x61, 0x73, 0x68, 0x12, 0x44, 0x0a, 0x0a,
+	0x73, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x20, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e,
+	0x72, 0x65, 0x6b, 0x6f, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75,
+	0x72, 0x65, 0x42, 0x02, 0x18, 0x01, 0x52, 0x0a, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72,
+	0x65, 0x73, 0x3a, 0x02, 0x18, 0x01, 0x42, 0x7d, 0x0a, 0x1b, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69,
+	0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x72, 0x65, 0x6b,
+	0x6f, 0x72, 0x2e, 0x76, 0x32, 0x42, 0x0b, 0x52, 0x65, 0x6b, 0x6f, 0x72, 0x56, 0x32, 0x44, 0x73,
+	0x73, 0x65, 0x50, 0x01, 0x5a, 0x39, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d,
+	0x2f, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2f, 0x72, 0x65, 0x6b, 0x6f, 0x72, 0x2d,
+	0x74, 0x69, 0x6c, 0x65, 0x73, 0x2f, 0x76, 0x32, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x67, 0x65, 0x6e,
+	0x65, 0x72, 0x61, 0x74, 0x65, 0x64, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0xea,
+	0x02, 0x13, 0x53, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x3a, 0x3a, 0x52, 0x65, 0x6b, 0x6f,
+	0x72, 0x3a, 0x3a, 0x56, 0x32, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 })
 
 var (
diff --git a/vendor/github.com/sigstore/rekor-tiles/v2/pkg/generated/protobuf/entry.pb.go b/vendor/github.com/sigstore/rekor-tiles/v2/pkg/generated/protobuf/entry.pb.go
index fded303ae..027df237e 100644
--- a/vendor/github.com/sigstore/rekor-tiles/v2/pkg/generated/protobuf/entry.pb.go
+++ b/vendor/github.com/sigstore/rekor-tiles/v2/pkg/generated/protobuf/entry.pb.go
@@ -160,6 +160,7 @@ func (x *Spec) GetHashedRekordV002() *HashedRekordLogEntryV002 {
 	return nil
 }
 
+// Deprecated: Marked as deprecated in rekor/v2/entry.proto.
 func (x *Spec) GetDsseV002() *DSSELogEntryV002 {
 	if x != nil {
 		if x, ok := x.Spec.(*Spec_DsseV002); ok {
@@ -178,6 +179,7 @@ type Spec_HashedRekordV002 struct {
 }
 
 type Spec_DsseV002 struct {
+	// Deprecated: Marked as deprecated in rekor/v2/entry.proto.
 	DsseV002 *DSSELogEntryV002 `protobuf:"bytes,2,opt,name=dsse_v002,json=dsseV002,proto3,oneof"`
 }
 
@@ -243,6 +245,7 @@ func (x *CreateEntryRequest) GetHashedRekordRequestV002() *HashedRekordRequestV0
 	return nil
 }
 
+// Deprecated: Marked as deprecated in rekor/v2/entry.proto.
 func (x *CreateEntryRequest) GetDsseRequestV002() *DSSERequestV002 {
 	if x != nil {
 		if x, ok := x.Spec.(*CreateEntryRequest_DsseRequestV002); ok {
@@ -261,6 +264,7 @@ type CreateEntryRequest_HashedRekordRequestV002 struct {
 }
 
 type CreateEntryRequest_DsseRequestV002 struct {
+	// Deprecated: Marked as deprecated in rekor/v2/entry.proto.
 	DsseRequestV002 *DSSERequestV002 `protobuf:"bytes,2,opt,name=dsse_request_v002,json=dsseRequestV002,proto3,oneof"`
 }
 
@@ -286,43 +290,43 @@ var file_rekor_v2_entry_proto_rawDesc = string([]byte{
 	0x69, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x34, 0x0a, 0x04, 0x73, 0x70, 0x65, 0x63,
 	0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67,
 	0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x65, 0x6b, 0x6f, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x53,
-	0x70, 0x65, 0x63, 0x42, 0x03, 0xe0, 0x41, 0x02, 0x52, 0x04, 0x73, 0x70, 0x65, 0x63, 0x22, 0xc1,
+	0x70, 0x65, 0x63, 0x42, 0x03, 0xe0, 0x41, 0x02, 0x52, 0x04, 0x73, 0x70, 0x65, 0x63, 0x22, 0xc0,
 	0x01, 0x0a, 0x04, 0x53, 0x70, 0x65, 0x63, 0x12, 0x64, 0x0a, 0x12, 0x68, 0x61, 0x73, 0x68, 0x65,
 	0x64, 0x5f, 0x72, 0x65, 0x6b, 0x6f, 0x72, 0x64, 0x5f, 0x76, 0x30, 0x30, 0x32, 0x18, 0x01, 0x20,
 	0x01, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f,
 	0x72, 0x65, 0x2e, 0x72, 0x65, 0x6b, 0x6f, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x48, 0x61, 0x73, 0x68,
 	0x65, 0x64, 0x52, 0x65, 0x6b, 0x6f, 0x72, 0x64, 0x4c, 0x6f, 0x67, 0x45, 0x6e, 0x74, 0x72, 0x79,
 	0x56, 0x30, 0x30, 0x32, 0x42, 0x03, 0xe0, 0x41, 0x02, 0x48, 0x00, 0x52, 0x10, 0x68, 0x61, 0x73,
-	0x68, 0x65, 0x64, 0x52, 0x65, 0x6b, 0x6f, 0x72, 0x64, 0x56, 0x30, 0x30, 0x32, 0x12, 0x4b, 0x0a,
+	0x68, 0x65, 0x64, 0x52, 0x65, 0x6b, 0x6f, 0x72, 0x64, 0x56, 0x30, 0x30, 0x32, 0x12, 0x4a, 0x0a,
 	0x09, 0x64, 0x73, 0x73, 0x65, 0x5f, 0x76, 0x30, 0x30, 0x32, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
 	0x32, 0x27, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e,
 	0x72, 0x65, 0x6b, 0x6f, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x44, 0x53, 0x53, 0x45, 0x4c, 0x6f, 0x67,
-	0x45, 0x6e, 0x74, 0x72, 0x79, 0x56, 0x30, 0x30, 0x32, 0x42, 0x03, 0xe0, 0x41, 0x02, 0x48, 0x00,
-	0x52, 0x08, 0x64, 0x73, 0x73, 0x65, 0x56, 0x30, 0x30, 0x32, 0x42, 0x06, 0x0a, 0x04, 0x73, 0x70,
-	0x65, 0x63, 0x22, 0xeb, 0x01, 0x0a, 0x12, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x45, 0x6e, 0x74,
-	0x72, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x72, 0x0a, 0x1a, 0x68, 0x61, 0x73,
-	0x68, 0x65, 0x64, 0x5f, 0x72, 0x65, 0x6b, 0x6f, 0x72, 0x64, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x5f, 0x76, 0x30, 0x30, 0x32, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2e, 0x2e,
-	0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x65, 0x6b,
-	0x6f, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x48, 0x61, 0x73, 0x68, 0x65, 0x64, 0x52, 0x65, 0x6b, 0x6f,
-	0x72, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x56, 0x30, 0x30, 0x32, 0x42, 0x03, 0xe0,
-	0x41, 0x02, 0x48, 0x00, 0x52, 0x17, 0x68, 0x61, 0x73, 0x68, 0x65, 0x64, 0x52, 0x65, 0x6b, 0x6f,
-	0x72, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x56, 0x30, 0x30, 0x32, 0x12, 0x59, 0x0a,
-	0x11, 0x64, 0x73, 0x73, 0x65, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f, 0x76, 0x30,
-	0x30, 0x32, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73,
-	0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x65, 0x6b, 0x6f, 0x72, 0x2e, 0x76, 0x32,
-	0x2e, 0x44, 0x53, 0x53, 0x45, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x56, 0x30, 0x30, 0x32,
-	0x42, 0x03, 0xe0, 0x41, 0x02, 0x48, 0x00, 0x52, 0x0f, 0x64, 0x73, 0x73, 0x65, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x56, 0x30, 0x30, 0x32, 0x42, 0x06, 0x0a, 0x04, 0x73, 0x70, 0x65, 0x63,
-	0x42, 0x7e, 0x0a, 0x1b, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x72, 0x65, 0x6b, 0x6f, 0x72, 0x2e, 0x76, 0x32, 0x42,
-	0x0c, 0x52, 0x65, 0x6b, 0x6f, 0x72, 0x56, 0x32, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x50, 0x01, 0x5a,
-	0x39, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x69, 0x67, 0x73,
-	0x74, 0x6f, 0x72, 0x65, 0x2f, 0x72, 0x65, 0x6b, 0x6f, 0x72, 0x2d, 0x74, 0x69, 0x6c, 0x65, 0x73,
-	0x2f, 0x76, 0x32, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x67, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x65,
-	0x64, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0xea, 0x02, 0x13, 0x53, 0x69, 0x67,
-	0x73, 0x74, 0x6f, 0x72, 0x65, 0x3a, 0x3a, 0x52, 0x65, 0x6b, 0x6f, 0x72, 0x3a, 0x3a, 0x56, 0x32,
-	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x45, 0x6e, 0x74, 0x72, 0x79, 0x56, 0x30, 0x30, 0x32, 0x42, 0x02, 0x18, 0x01, 0x48, 0x00, 0x52,
+	0x08, 0x64, 0x73, 0x73, 0x65, 0x56, 0x30, 0x30, 0x32, 0x42, 0x06, 0x0a, 0x04, 0x73, 0x70, 0x65,
+	0x63, 0x22, 0xea, 0x01, 0x0a, 0x12, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x45, 0x6e, 0x74, 0x72,
+	0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x72, 0x0a, 0x1a, 0x68, 0x61, 0x73, 0x68,
+	0x65, 0x64, 0x5f, 0x72, 0x65, 0x6b, 0x6f, 0x72, 0x64, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x5f, 0x76, 0x30, 0x30, 0x32, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2e, 0x2e, 0x64,
+	0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x65, 0x6b, 0x6f,
+	0x72, 0x2e, 0x76, 0x32, 0x2e, 0x48, 0x61, 0x73, 0x68, 0x65, 0x64, 0x52, 0x65, 0x6b, 0x6f, 0x72,
+	0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x56, 0x30, 0x30, 0x32, 0x42, 0x03, 0xe0, 0x41,
+	0x02, 0x48, 0x00, 0x52, 0x17, 0x68, 0x61, 0x73, 0x68, 0x65, 0x64, 0x52, 0x65, 0x6b, 0x6f, 0x72,
+	0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x56, 0x30, 0x30, 0x32, 0x12, 0x58, 0x0a, 0x11,
+	0x64, 0x73, 0x73, 0x65, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f, 0x76, 0x30, 0x30,
+	0x32, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69,
+	0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x65, 0x6b, 0x6f, 0x72, 0x2e, 0x76, 0x32, 0x2e,
+	0x44, 0x53, 0x53, 0x45, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x56, 0x30, 0x30, 0x32, 0x42,
+	0x02, 0x18, 0x01, 0x48, 0x00, 0x52, 0x0f, 0x64, 0x73, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x56, 0x30, 0x30, 0x32, 0x42, 0x06, 0x0a, 0x04, 0x73, 0x70, 0x65, 0x63, 0x42, 0x7e,
+	0x0a, 0x1b, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x72, 0x65, 0x6b, 0x6f, 0x72, 0x2e, 0x76, 0x32, 0x42, 0x0c, 0x52,
+	0x65, 0x6b, 0x6f, 0x72, 0x56, 0x32, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x50, 0x01, 0x5a, 0x39, 0x67,
+	0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f,
+	0x72, 0x65, 0x2f, 0x72, 0x65, 0x6b, 0x6f, 0x72, 0x2d, 0x74, 0x69, 0x6c, 0x65, 0x73, 0x2f, 0x76,
+	0x32, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x67, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x65, 0x64, 0x2f,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0xea, 0x02, 0x13, 0x53, 0x69, 0x67, 0x73, 0x74,
+	0x6f, 0x72, 0x65, 0x3a, 0x3a, 0x52, 0x65, 0x6b, 0x6f, 0x72, 0x3a, 0x3a, 0x56, 0x32, 0x62, 0x06,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 })
 
 var (
diff --git a/vendor/github.com/sigstore/rekor-tiles/v2/pkg/verify/verify.go b/vendor/github.com/sigstore/rekor-tiles/v2/pkg/verify/verify.go
index bb4fedf59..706958a05 100644
--- a/vendor/github.com/sigstore/rekor-tiles/v2/pkg/verify/verify.go
+++ b/vendor/github.com/sigstore/rekor-tiles/v2/pkg/verify/verify.go
@@ -68,6 +68,24 @@ func VerifyLogEntry(entry *pbs.TransparencyLogEntry, verifier sumdb_note.Verifie
 	return VerifyInclusionProof(entry, cp)
 }
 
+// VerifyLogEntryWithHash verifies a log entry's checkpoint signature and
+// inclusion proof using a caller-provided entry hash instead of hashing
+// entry.CanonicalizedBody.
+func VerifyLogEntryWithHash(entry *pbs.TransparencyLogEntry, verifier sumdb_note.Verifier, entryHash []byte) error { //nolint: revive
+	cp, err := VerifyCheckpoint(entry.GetInclusionProof().GetCheckpoint().GetEnvelope(), verifier)
+	if err != nil {
+		return err
+	}
+	index, err := safeint.NewSafeInt64(entry.LogIndex)
+	if err != nil {
+		return fmt.Errorf("invalid index: %w", err)
+	}
+	if err := proof.VerifyInclusion(rfc6962.DefaultHasher, index.U(), cp.Size, entryHash, entry.InclusionProof.Hashes, cp.Hash); err != nil {
+		return fmt.Errorf("verifying inclusion: %w", err)
+	}
+	return nil
+}
+
 // VerifyConsistencyProof verifies the latest checkpoint signature and the consistency proof between a previous log size
 // and root hash and the latest checkpoint's size and root hash. This may be used by a C2SP witness.
 func VerifyConsistencyProof(consistencyProof [][]byte, oldSize uint64, oldRootHash []byte, newUnverifiedCp string, verifier sumdb_note.Verifier) error { //nolint: revive
diff --git a/vendor/github.com/sigstore/sigstore/pkg/cryptoutils/privatekey.go b/vendor/github.com/sigstore/sigstore/pkg/cryptoutils/privatekey.go
index 325813d69..5ecf346db 100644
--- a/vendor/github.com/sigstore/sigstore/pkg/cryptoutils/privatekey.go
+++ b/vendor/github.com/sigstore/sigstore/pkg/cryptoutils/privatekey.go
@@ -27,6 +27,7 @@ import (
 	"fmt"
 
 	"github.com/secure-systems-lab/go-securesystemslib/encrypted"
+	"github.com/youmark/pkcs8"
 )
 
 const (
@@ -107,6 +108,26 @@ func UnmarshalPEMToPrivateKey(pemBytes []byte, pf PassFunc) (crypto.PrivateKey,
 	if derBlock == nil {
 		return nil, errors.New("PEM decoding failed")
 	}
+
+	// Handle legacy encrypted PEM blocks
+	if x509.IsEncryptedPEMBlock(derBlock) { //nolint:staticcheck
+		if pf == nil {
+			return nil, errors.New("private key is encrypted, but no password function was provided")
+		}
+		password, err := pf(false)
+		if err != nil {
+			return nil, err
+		}
+		decryptedBytes, err := x509.DecryptPEMBlock(derBlock, password) //nolint:staticcheck
+		if err != nil {
+			return nil, fmt.Errorf("failed to decrypt legacy PEM block: %w", err)
+		}
+		derBlock = &pem.Block{
+			Type:  derBlock.Type,
+			Bytes: decryptedBytes,
+		}
+	}
+
 	switch derBlock.Type {
 	case string(PrivateKeyPEMType):
 		return x509.ParsePKCS8PrivateKey(derBlock.Bytes)
@@ -114,6 +135,19 @@ func UnmarshalPEMToPrivateKey(pemBytes []byte, pf PassFunc) (crypto.PrivateKey,
 		return x509.ParsePKCS1PrivateKey(derBlock.Bytes)
 	case string(ECPrivateKeyPEMType):
 		return x509.ParseECPrivateKey(derBlock.Bytes)
+	case "ENCRYPTED PRIVATE KEY":
+		if pf == nil {
+			return nil, errors.New("private key is encrypted, but no password function was provided")
+		}
+		password, err := pf(false)
+		if err != nil {
+			return nil, err
+		}
+		decryptedKey, err := pkcs8.ParsePKCS8PrivateKey(derBlock.Bytes, password)
+		if err != nil {
+			return nil, fmt.Errorf("failed to decrypt and parse encrypted private key: %w", err)
+		}
+		return decryptedKey, nil
 	case string(EncryptedSigstorePrivateKeyPEMType), string(encryptedCosignPrivateKeyPEMType):
 		derBytes := derBlock.Bytes
 		if pf != nil {
diff --git a/vendor/github.com/sigstore/sigstore/pkg/signature/dsse/dsse.go b/vendor/github.com/sigstore/sigstore/pkg/signature/dsse/dsse.go
index 628e2413c..c2c34c16a 100644
--- a/vendor/github.com/sigstore/sigstore/pkg/signature/dsse/dsse.go
+++ b/vendor/github.com/sigstore/sigstore/pkg/signature/dsse/dsse.go
@@ -21,6 +21,7 @@ import (
 	"crypto"
 	"encoding/base64"
 	"encoding/json"
+	"fmt"
 	"io"
 
 	"github.com/secure-systems-lab/go-securesystemslib/dsse"
@@ -70,14 +71,17 @@ func (w *wrappedSigner) SignMessage(r io.Reader, opts ...signature.SignOption) (
 }
 
 // WrapVerifier returns a signature.Verifier that uses the DSSE encoding format
-func WrapVerifier(v signature.Verifier) signature.Verifier {
+func WrapVerifier(v signature.Verifier, opts ...Option) signature.Verifier {
+	cfg := applyWrapOpts(opts)
 	return &wrappedVerifier{
-		v: v,
+		v:   v,
+		cfg: cfg,
 	}
 }
 
 type wrappedVerifier struct {
-	v signature.Verifier
+	v   signature.Verifier
+	cfg wrapConfig
 }
 
 // PublicKey returns the public key associated with the verifier
@@ -97,6 +101,10 @@ func (w *wrappedVerifier) VerifySignature(s, _ io.Reader, _ ...signature.VerifyO
 		return err
 	}
 
+	if w.cfg.expectedPayloadType != "" && env.PayloadType != w.cfg.expectedPayloadType {
+		return fmt.Errorf("dsse: unexpected payload type: got %q, want %q", env.PayloadType, w.cfg.expectedPayloadType)
+	}
+
 	pub, err := w.PublicKey()
 	if err != nil {
 		return err
@@ -111,18 +119,30 @@ func (w *wrappedVerifier) VerifySignature(s, _ io.Reader, _ ...signature.VerifyO
 		return err
 	}
 
-	_, err = verifier.Verify(context.Background(), &env)
-	return err
+	_, payload, err := verifier.VerifyAndDecode(context.Background(), &env)
+	if err != nil {
+		return err
+	}
+	if w.cfg.decodedPayload != nil {
+		*w.cfg.decodedPayload = payload
+	}
+	return nil
 }
 
-// WrapSignerVerifier returns a signature.SignerVerifier that uses the DSSE encoding format
-func WrapSignerVerifier(sv signature.SignerVerifier, payloadType string) signature.SignerVerifier {
+// WrapSignerVerifier returns a signature.SignerVerifier that uses the DSSE encoding format.
+// The payloadType is automatically enforced during verification via
+// WithExpectedPayloadType; callers may supply additional Option values
+// which are applied after the implicit payload-type option.
+func WrapSignerVerifier(sv signature.SignerVerifier, payloadType string, opts ...Option) signature.SignerVerifier {
+	opts = append([]Option{WithExpectedPayloadType(payloadType)}, opts...)
+	cfg := applyWrapOpts(opts)
 	signer := &wrappedSigner{
 		payloadType: payloadType,
 		s:           sv,
 	}
 	verifier := &wrappedVerifier{
-		v: sv,
+		v:   sv,
+		cfg: cfg,
 	}
 
 	return &wrappedSignerVerifier{
diff --git a/vendor/github.com/sigstore/sigstore/pkg/signature/dsse/multidsse.go b/vendor/github.com/sigstore/sigstore/pkg/signature/dsse/multidsse.go
index 34ebd5a41..29eab3c83 100644
--- a/vendor/github.com/sigstore/sigstore/pkg/signature/dsse/multidsse.go
+++ b/vendor/github.com/sigstore/sigstore/pkg/signature/dsse/multidsse.go
@@ -20,6 +20,7 @@ import (
 	"crypto"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"io"
 
 	"github.com/secure-systems-lab/go-securesystemslib/dsse"
@@ -86,13 +87,25 @@ func (wL *wrappedMultiSigner) SignMessage(r io.Reader, _ ...signature.SignOption
 }
 
 type wrappedMultiVerifier struct {
-	vLAdapters  []dsse.Verifier
-	threshold   int
-	payloadType string
+	vLAdapters []dsse.Verifier
+	threshold  int
+	cfg        wrapConfig
 }
 
-// WrapMultiVerifier returns a signature.Verifier that uses the DSSE encoding format
+// WrapMultiVerifier returns a signature.Verifier that uses the DSSE encoding format.
+//
+// Deprecated: Use WrapMultiVerifierWithOpts instead.
 func WrapMultiVerifier(payloadType string, threshold int, vL ...signature.Verifier) signature.Verifier {
+	return WrapMultiVerifierWithOpts(payloadType, threshold, vL)
+}
+
+// WrapMultiVerifierWithOpts returns a signature.Verifier that uses the DSSE encoding format.
+// If payloadType is non-empty, WithExpectedPayloadType is automatically applied
+// before any caller-supplied options.
+func WrapMultiVerifierWithOpts(payloadType string, threshold int, vL []signature.Verifier, opts ...Option) signature.Verifier {
+	if payloadType != "" {
+		opts = append([]Option{WithExpectedPayloadType(payloadType)}, opts...)
+	}
 	verifierAdapterL := make([]dsse.Verifier, 0, len(vL))
 	for _, v := range vL {
 		pub, err := v.PublicKey()
@@ -114,10 +127,11 @@ func WrapMultiVerifier(payloadType string, threshold int, vL ...signature.Verifi
 		verifierAdapterL = append(verifierAdapterL, verifierAdapter)
 	}
 
+	cfg := applyWrapOpts(opts)
 	return &wrappedMultiVerifier{
-		vLAdapters:  verifierAdapterL,
-		payloadType: payloadType,
-		threshold:   threshold,
+		vLAdapters: verifierAdapterL,
+		threshold:  threshold,
+		cfg:        cfg,
 	}
 }
 
@@ -138,17 +152,36 @@ func (wL *wrappedMultiVerifier) VerifySignature(s, _ io.Reader, _ ...signature.V
 		return err
 	}
 
+	if wL.cfg.expectedPayloadType != "" && env.PayloadType != wL.cfg.expectedPayloadType {
+		return fmt.Errorf("dsse: unexpected payload type: got %q, want %q", env.PayloadType, wL.cfg.expectedPayloadType)
+	}
+
 	envVerifier, err := dsse.NewMultiEnvelopeVerifier(wL.threshold, wL.vLAdapters...)
 	if err != nil {
 		return err
 	}
 
-	_, err = envVerifier.Verify(context.Background(), &env)
-	return err
+	_, payload, err := envVerifier.VerifyAndDecode(context.Background(), &env)
+	if err != nil {
+		return err
+	}
+	if wL.cfg.decodedPayload != nil {
+		*wL.cfg.decodedPayload = payload
+	}
+	return nil
 }
 
-// WrapMultiSignerVerifier returns a signature.SignerVerifier that uses the DSSE encoding format
+// WrapMultiSignerVerifier returns a signature.SignerVerifier that uses the DSSE encoding format.
+//
+// Deprecated: Use WrapMultiSignerVerifierWithOpts instead.
 func WrapMultiSignerVerifier(payloadType string, threshold int, svL ...signature.SignerVerifier) signature.SignerVerifier {
+	return WrapMultiSignerVerifierWithOpts(payloadType, threshold, svL)
+}
+
+// WrapMultiSignerVerifierWithOpts returns a signature.SignerVerifier that uses the DSSE encoding format.
+// The payloadType is automatically enforced during verification via
+// WrapMultiVerifierWithOpts; callers may supply additional Option values.
+func WrapMultiSignerVerifierWithOpts(payloadType string, threshold int, svL []signature.SignerVerifier, opts ...Option) signature.SignerVerifier {
 	signerL := make([]signature.Signer, 0, len(svL))
 	verifierL := make([]signature.Verifier, 0, len(svL))
 	for _, sv := range svL {
@@ -157,7 +190,7 @@ func WrapMultiSignerVerifier(payloadType string, threshold int, svL ...signature
 	}
 
 	sL := WrapMultiSigner(payloadType, signerL...)
-	vL := WrapMultiVerifier(payloadType, threshold, verifierL...)
+	vL := WrapMultiVerifierWithOpts(payloadType, threshold, verifierL, opts...)
 
 	return &wrappedMultiSignerVerifier{
 		signer:   sL,
diff --git a/vendor/github.com/sigstore/sigstore/pkg/signature/dsse/options.go b/vendor/github.com/sigstore/sigstore/pkg/signature/dsse/options.go
new file mode 100644
index 000000000..62f574d2d
--- /dev/null
+++ b/vendor/github.com/sigstore/sigstore/pkg/signature/dsse/options.go
@@ -0,0 +1,53 @@
+//
+// Copyright 2026 The Sigstore Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package dsse
+
+// Option is a functional option for WrapVerifier, WrapSignerVerifier,
+// WrapMultiVerifierWithOpts, and WrapMultiSignerVerifierWithOpts.
+type Option func(*wrapConfig)
+
+type wrapConfig struct {
+	decodedPayload      *[]byte
+	expectedPayloadType string
+}
+
+// WithDecodedPayload returns an Option that causes the verifier to write
+// the decoded envelope payload into the provided byte slice pointer. This
+// avoids a redundant base64 decode when callers need the payload after
+// verification.
+func WithDecodedPayload(p *[]byte) Option {
+	return func(c *wrapConfig) {
+		c.decodedPayload = p
+	}
+}
+
+// WithExpectedPayloadType returns an Option that causes the verifier to
+// check the envelope's payload type against the expected value before
+// verifying. If the types do not match, verification fails immediately.
+// When this option is not set, any payload type is accepted.
+func WithExpectedPayloadType(t string) Option {
+	return func(c *wrapConfig) {
+		c.expectedPayloadType = t
+	}
+}
+
+func applyWrapOpts(opts []Option) wrapConfig {
+	var cfg wrapConfig
+	for _, o := range opts {
+		o(&cfg)
+	}
+	return cfg
+}
diff --git a/vendor/github.com/theupdateframework/go-tuf/v2/metadata/marshal.go b/vendor/github.com/theupdateframework/go-tuf/v2/metadata/marshal.go
index 7ebd1bca5..f0bdc530c 100644
--- a/vendor/github.com/theupdateframework/go-tuf/v2/metadata/marshal.go
+++ b/vendor/github.com/theupdateframework/go-tuf/v2/metadata/marshal.go
@@ -230,6 +230,10 @@ func (signed *TargetFiles) UnmarshalJSON(data []byte) error {
 	if err := json.Unmarshal(data, &s); err != nil {
 		return err
 	}
+	// Per TUF spec, hashes are mandatory for target files
+	if len(s.Hashes) == 0 {
+		return fmt.Errorf("hashes must not be empty for target files")
+	}
 	*signed = TargetFiles(s)
 
 	var dict map[string]any
diff --git a/vendor/github.com/theupdateframework/go-tuf/v2/metadata/metadata.go b/vendor/github.com/theupdateframework/go-tuf/v2/metadata/metadata.go
index 6308d3cba..71a64de81 100644
--- a/vendor/github.com/theupdateframework/go-tuf/v2/metadata/metadata.go
+++ b/vendor/github.com/theupdateframework/go-tuf/v2/metadata/metadata.go
@@ -458,6 +458,10 @@ func (f *MetaFiles) VerifyLengthHashes(data []byte) error {
 // VerifyLengthHashes checks whether the TargetFiles data matches its corresponding
 // length and hashes
 func (f *TargetFiles) VerifyLengthHashes(data []byte) error {
+	// Per TUF spec, hashes are mandatory for target files
+	if len(f.Hashes) == 0 {
+		return &ErrLengthOrHashMismatch{Msg: "hashes must not be empty for target files"}
+	}
 	err := verifyHashes(data, f.Hashes)
 	if err != nil {
 		return err
diff --git a/vendor/github.com/youmark/pkcs8/.gitignore b/vendor/github.com/youmark/pkcs8/.gitignore
new file mode 100644
index 000000000..836562412
--- /dev/null
+++ b/vendor/github.com/youmark/pkcs8/.gitignore
@@ -0,0 +1,23 @@
+# Compiled Object files, Static and Dynamic libs (Shared Objects)
+*.o
+*.a
+*.so
+
+# Folders
+_obj
+_test
+
+# Architecture specific extensions/prefixes
+*.[568vq]
+[568vq].out
+
+*.cgo1.go
+*.cgo2.c
+_cgo_defun.c
+_cgo_gotypes.go
+_cgo_export.*
+
+_testmain.go
+
+*.exe
+*.test
diff --git a/vendor/github.com/youmark/pkcs8/LICENSE b/vendor/github.com/youmark/pkcs8/LICENSE
new file mode 100644
index 000000000..c939f4481
--- /dev/null
+++ b/vendor/github.com/youmark/pkcs8/LICENSE
@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2014 youmark
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
\ No newline at end of file
diff --git a/vendor/github.com/youmark/pkcs8/README b/vendor/github.com/youmark/pkcs8/README
new file mode 100644
index 000000000..376fcaf64
--- /dev/null
+++ b/vendor/github.com/youmark/pkcs8/README
@@ -0,0 +1 @@
+pkcs8 package: implement PKCS#8 private key parsing and conversion as defined in RFC5208 and RFC5958
diff --git a/vendor/github.com/youmark/pkcs8/README.md b/vendor/github.com/youmark/pkcs8/README.md
new file mode 100644
index 000000000..ef6c76257
--- /dev/null
+++ b/vendor/github.com/youmark/pkcs8/README.md
@@ -0,0 +1,22 @@
+pkcs8
+===
+OpenSSL can generate private keys in both "traditional format" and PKCS#8 format. Newer applications are advised to use more secure PKCS#8 format. Go standard crypto package provides a [function](http://golang.org/pkg/crypto/x509/#ParsePKCS8PrivateKey) to parse private key in PKCS#8 format. There is a limitation to this function. It can only handle unencrypted PKCS#8 private keys. To use this function, the user has to save the private key in file without encryption, which is a bad practice to leave private keys unprotected on file systems. In addition, Go standard package lacks the functions to convert RSA/ECDSA private keys into PKCS#8 format.
+
+pkcs8 package fills the gap here. It implements functions to process private keys in PKCS#8 format, as defined in [RFC5208](https://tools.ietf.org/html/rfc5208) and [RFC5958](https://tools.ietf.org/html/rfc5958). It can handle both unencrypted PKCS#8 PrivateKeyInfo format and EncryptedPrivateKeyInfo format with PKCS#5 (v2.0) algorithms.
+
+
+[**Godoc**](http://godoc.org/github.com/youmark/pkcs8)
+
+## Installation
+Supports Go 1.10+. Release v1.1 is the last release supporting Go 1.9 
+
+```text
+go get github.com/youmark/pkcs8
+```
+## dependency
+This package depends on golang.org/x/crypto/pbkdf2 and golang.org/x/crypto/scrypt packages. Use the following command to retrieve them
+```text
+go get golang.org/x/crypto/pbkdf2
+go get golang.org/x/crypto/scrypt
+```
+
diff --git a/vendor/github.com/youmark/pkcs8/cipher.go b/vendor/github.com/youmark/pkcs8/cipher.go
new file mode 100644
index 000000000..2946c93e8
--- /dev/null
+++ b/vendor/github.com/youmark/pkcs8/cipher.go
@@ -0,0 +1,60 @@
+package pkcs8
+
+import (
+	"bytes"
+	"crypto/cipher"
+	"encoding/asn1"
+)
+
+type cipherWithBlock struct {
+	oid      asn1.ObjectIdentifier
+	ivSize   int
+	keySize  int
+	newBlock func(key []byte) (cipher.Block, error)
+}
+
+func (c cipherWithBlock) IVSize() int {
+	return c.ivSize
+}
+
+func (c cipherWithBlock) KeySize() int {
+	return c.keySize
+}
+
+func (c cipherWithBlock) OID() asn1.ObjectIdentifier {
+	return c.oid
+}
+
+func (c cipherWithBlock) Encrypt(key, iv, plaintext []byte) ([]byte, error) {
+	block, err := c.newBlock(key)
+	if err != nil {
+		return nil, err
+	}
+	return cbcEncrypt(block, key, iv, plaintext)
+}
+
+func (c cipherWithBlock) Decrypt(key, iv, ciphertext []byte) ([]byte, error) {
+	block, err := c.newBlock(key)
+	if err != nil {
+		return nil, err
+	}
+	return cbcDecrypt(block, key, iv, ciphertext)
+}
+
+func cbcEncrypt(block cipher.Block, key, iv, plaintext []byte) ([]byte, error) {
+	mode := cipher.NewCBCEncrypter(block, iv)
+	paddingLen := block.BlockSize() - (len(plaintext) % block.BlockSize())
+	ciphertext := make([]byte, len(plaintext)+paddingLen)
+	copy(ciphertext, plaintext)
+	copy(ciphertext[len(plaintext):], bytes.Repeat([]byte{byte(paddingLen)}, paddingLen))
+	mode.CryptBlocks(ciphertext, ciphertext)
+	return ciphertext, nil
+}
+
+func cbcDecrypt(block cipher.Block, key, iv, ciphertext []byte) ([]byte, error) {
+	mode := cipher.NewCBCDecrypter(block, iv)
+	plaintext := make([]byte, len(ciphertext))
+	mode.CryptBlocks(plaintext, ciphertext)
+	// TODO: remove padding
+	return plaintext, nil
+}
diff --git a/vendor/github.com/youmark/pkcs8/cipher_3des.go b/vendor/github.com/youmark/pkcs8/cipher_3des.go
new file mode 100644
index 000000000..562966440
--- /dev/null
+++ b/vendor/github.com/youmark/pkcs8/cipher_3des.go
@@ -0,0 +1,24 @@
+package pkcs8
+
+import (
+	"crypto/des"
+	"encoding/asn1"
+)
+
+var (
+	oidDESEDE3CBC = asn1.ObjectIdentifier{1, 2, 840, 113549, 3, 7}
+)
+
+func init() {
+	RegisterCipher(oidDESEDE3CBC, func() Cipher {
+		return TripleDESCBC
+	})
+}
+
+// TripleDESCBC is the 168-bit key 3DES cipher in CBC mode.
+var TripleDESCBC = cipherWithBlock{
+	ivSize:   des.BlockSize,
+	keySize:  24,
+	newBlock: des.NewTripleDESCipher,
+	oid:      oidDESEDE3CBC,
+}
diff --git a/vendor/github.com/youmark/pkcs8/cipher_aes.go b/vendor/github.com/youmark/pkcs8/cipher_aes.go
new file mode 100644
index 000000000..c0372d1ee
--- /dev/null
+++ b/vendor/github.com/youmark/pkcs8/cipher_aes.go
@@ -0,0 +1,84 @@
+package pkcs8
+
+import (
+	"crypto/aes"
+	"encoding/asn1"
+)
+
+var (
+	oidAES128CBC = asn1.ObjectIdentifier{2, 16, 840, 1, 101, 3, 4, 1, 2}
+	oidAES128GCM = asn1.ObjectIdentifier{2, 16, 840, 1, 101, 3, 4, 1, 6}
+	oidAES192CBC = asn1.ObjectIdentifier{2, 16, 840, 1, 101, 3, 4, 1, 22}
+	oidAES192GCM = asn1.ObjectIdentifier{2, 16, 840, 1, 101, 3, 4, 1, 26}
+	oidAES256CBC = asn1.ObjectIdentifier{2, 16, 840, 1, 101, 3, 4, 1, 42}
+	oidAES256GCM = asn1.ObjectIdentifier{2, 16, 840, 1, 101, 3, 4, 1, 46}
+)
+
+func init() {
+	RegisterCipher(oidAES128CBC, func() Cipher {
+		return AES128CBC
+	})
+	RegisterCipher(oidAES128GCM, func() Cipher {
+		return AES128GCM
+	})
+	RegisterCipher(oidAES192CBC, func() Cipher {
+		return AES192CBC
+	})
+	RegisterCipher(oidAES192GCM, func() Cipher {
+		return AES192GCM
+	})
+	RegisterCipher(oidAES256CBC, func() Cipher {
+		return AES256CBC
+	})
+	RegisterCipher(oidAES256GCM, func() Cipher {
+		return AES256GCM
+	})
+}
+
+// AES128CBC is the 128-bit key AES cipher in CBC mode.
+var AES128CBC = cipherWithBlock{
+	ivSize:   aes.BlockSize,
+	keySize:  16,
+	newBlock: aes.NewCipher,
+	oid:      oidAES128CBC,
+}
+
+// AES128GCM is the 128-bit key AES cipher in GCM mode.
+var AES128GCM = cipherWithBlock{
+	ivSize:   aes.BlockSize,
+	keySize:  16,
+	newBlock: aes.NewCipher,
+	oid:      oidAES128GCM,
+}
+
+// AES192CBC is the 192-bit key AES cipher in CBC mode.
+var AES192CBC = cipherWithBlock{
+	ivSize:   aes.BlockSize,
+	keySize:  24,
+	newBlock: aes.NewCipher,
+	oid:      oidAES192CBC,
+}
+
+// AES192GCM is the 912-bit key AES cipher in GCM mode.
+var AES192GCM = cipherWithBlock{
+	ivSize:   aes.BlockSize,
+	keySize:  24,
+	newBlock: aes.NewCipher,
+	oid:      oidAES192GCM,
+}
+
+// AES256CBC is the 256-bit key AES cipher in CBC mode.
+var AES256CBC = cipherWithBlock{
+	ivSize:   aes.BlockSize,
+	keySize:  32,
+	newBlock: aes.NewCipher,
+	oid:      oidAES256CBC,
+}
+
+// AES256GCM is the 256-bit key AES cipher in GCM mode.
+var AES256GCM = cipherWithBlock{
+	ivSize:   aes.BlockSize,
+	keySize:  32,
+	newBlock: aes.NewCipher,
+	oid:      oidAES256GCM,
+}
diff --git a/vendor/github.com/youmark/pkcs8/kdf_pbkdf2.go b/vendor/github.com/youmark/pkcs8/kdf_pbkdf2.go
new file mode 100644
index 000000000..79697dd82
--- /dev/null
+++ b/vendor/github.com/youmark/pkcs8/kdf_pbkdf2.go
@@ -0,0 +1,91 @@
+package pkcs8
+
+import (
+	"crypto"
+	"crypto/sha1"
+	"crypto/sha256"
+	"crypto/x509/pkix"
+	"encoding/asn1"
+	"errors"
+	"hash"
+
+	"golang.org/x/crypto/pbkdf2"
+)
+
+var (
+	oidPKCS5PBKDF2        = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 5, 12}
+	oidHMACWithSHA1       = asn1.ObjectIdentifier{1, 2, 840, 113549, 2, 7}
+	oidHMACWithSHA256     = asn1.ObjectIdentifier{1, 2, 840, 113549, 2, 9}
+)
+
+func init() {
+	RegisterKDF(oidPKCS5PBKDF2, func() KDFParameters {
+		return new(pbkdf2Params)
+	})
+}
+
+func newHashFromPRF(ai pkix.AlgorithmIdentifier) (func() hash.Hash, error) {
+	switch {
+	case len(ai.Algorithm) == 0 || ai.Algorithm.Equal(oidHMACWithSHA1):
+		return sha1.New, nil
+	case ai.Algorithm.Equal(oidHMACWithSHA256):
+		return sha256.New, nil
+	default:
+		return nil, errors.New("pkcs8: unsupported hash function")
+	}
+}
+
+func newPRFParamFromHash(h crypto.Hash) (pkix.AlgorithmIdentifier, error) {
+	switch h {
+	case crypto.SHA1:
+		return pkix.AlgorithmIdentifier{
+			Algorithm:  oidHMACWithSHA1,
+			Parameters: asn1.RawValue{Tag: asn1.TagNull}}, nil
+	case crypto.SHA256:
+		return pkix.AlgorithmIdentifier{
+			Algorithm:  oidHMACWithSHA256,
+			Parameters: asn1.RawValue{Tag: asn1.TagNull}}, nil
+	}
+	return pkix.AlgorithmIdentifier{}, errors.New("pkcs8: unsupported hash function")
+}
+
+type pbkdf2Params struct {
+	Salt           []byte
+	IterationCount int
+	PRF            pkix.AlgorithmIdentifier `asn1:"optional"`
+}
+
+func (p pbkdf2Params) DeriveKey(password []byte, size int) (key []byte, err error) {
+	h, err := newHashFromPRF(p.PRF)
+	if err != nil {
+		return nil, err
+	}
+	return pbkdf2.Key(password, p.Salt, p.IterationCount, size, h), nil
+}
+
+// PBKDF2Opts contains options for the PBKDF2 key derivation function.
+type PBKDF2Opts struct {
+	SaltSize       int
+	IterationCount int
+	HMACHash       crypto.Hash
+}
+
+func (p PBKDF2Opts) DeriveKey(password, salt []byte, size int) (
+	key []byte, params KDFParameters, err error) {
+
+	key = pbkdf2.Key(password, salt, p.IterationCount, size, p.HMACHash.New)
+	prfParam, err := newPRFParamFromHash(p.HMACHash)
+	if err != nil {
+		return nil, nil, err
+	}
+	params = pbkdf2Params{salt, p.IterationCount, prfParam}
+	return key, params, nil
+}
+
+func (p PBKDF2Opts) GetSaltSize() int {
+	return p.SaltSize
+}
+
+func (p PBKDF2Opts) OID() asn1.ObjectIdentifier {
+	return oidPKCS5PBKDF2
+}
diff --git a/vendor/github.com/youmark/pkcs8/kdf_scrypt.go b/vendor/github.com/youmark/pkcs8/kdf_scrypt.go
new file mode 100644
index 000000000..36c4f4f59
--- /dev/null
+++ b/vendor/github.com/youmark/pkcs8/kdf_scrypt.go
@@ -0,0 +1,62 @@
+package pkcs8
+
+import (
+	"encoding/asn1"
+
+	"golang.org/x/crypto/scrypt"
+)
+
+var (
+	oidScrypt = asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 11591, 4, 11}
+)
+
+func init() {
+	RegisterKDF(oidScrypt, func() KDFParameters {
+		return new(scryptParams)
+	})
+}
+
+type scryptParams struct {
+	Salt                     []byte
+	CostParameter            int
+	BlockSize                int
+	ParallelizationParameter int
+}
+
+func (p scryptParams) DeriveKey(password []byte, size int) (key []byte, err error) {
+	return scrypt.Key(password, p.Salt, p.CostParameter, p.BlockSize,
+		p.ParallelizationParameter, size)
+}
+
+// ScryptOpts contains options for the scrypt key derivation function.
+type ScryptOpts struct {
+	SaltSize                 int
+	CostParameter            int
+	BlockSize                int
+	ParallelizationParameter int
+}
+
+func (p ScryptOpts) DeriveKey(password, salt []byte, size int) (
+	key []byte, params KDFParameters, err error) {
+
+	key, err = scrypt.Key(password, salt, p.CostParameter, p.BlockSize,
+		p.ParallelizationParameter, size)
+	if err != nil {
+		return nil, nil, err
+	}
+	params = scryptParams{
+		BlockSize:                p.BlockSize,
+		CostParameter:            p.CostParameter,
+		ParallelizationParameter: p.ParallelizationParameter,
+		Salt:                     salt,
+	}
+	return key, params, nil
+}
+
+func (p ScryptOpts) GetSaltSize() int {
+	return p.SaltSize
+}
+
+func (p ScryptOpts) OID() asn1.ObjectIdentifier {
+	return oidScrypt
+}
diff --git a/vendor/github.com/youmark/pkcs8/pkcs8.go b/vendor/github.com/youmark/pkcs8/pkcs8.go
new file mode 100644
index 000000000..f27f62752
--- /dev/null
+++ b/vendor/github.com/youmark/pkcs8/pkcs8.go
@@ -0,0 +1,309 @@
+// Package pkcs8 implements functions to parse and convert private keys in PKCS#8 format, as defined in RFC5208 and RFC5958
+package pkcs8
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/asn1"
+	"errors"
+	"fmt"
+)
+
+// DefaultOpts are the default options for encrypting a key if none are given.
+// The defaults can be changed by the library user.
+var DefaultOpts = &Opts{
+	Cipher: AES256CBC,
+	KDFOpts: PBKDF2Opts{
+		SaltSize:       8,
+		IterationCount: 10000,
+		HMACHash:       crypto.SHA256,
+	},
+}
+
+// KDFOpts contains options for a key derivation function.
+// An implementation of this interface must be specified when encrypting a PKCS#8 key.
+type KDFOpts interface {
+	// DeriveKey derives a key of size bytes from the given password and salt.
+	// It returns the key and the ASN.1-encodable parameters used.
+	DeriveKey(password, salt []byte, size int) (key []byte, params KDFParameters, err error)
+	// GetSaltSize returns the salt size specified.
+	GetSaltSize() int
+	// OID returns the OID of the KDF specified.
+	OID() asn1.ObjectIdentifier
+}
+
+// KDFParameters contains parameters (salt, etc.) for a key deriviation function.
+// It must be a ASN.1-decodable structure.
+// An implementation of this interface is created when decoding an encrypted PKCS#8 key.
+type KDFParameters interface {
+	// DeriveKey derives a key of size bytes from the given password.
+	// It uses the salt from the decoded parameters.
+	DeriveKey(password []byte, size int) (key []byte, err error)
+}
+
+var kdfs = make(map[string]func() KDFParameters)
+
+// RegisterKDF registers a function that returns a new instance of the given KDF
+// parameters. This allows the library to support client-provided KDFs.
+func RegisterKDF(oid asn1.ObjectIdentifier, params func() KDFParameters) {
+	kdfs[oid.String()] = params
+}
+
+// Cipher represents a cipher for encrypting the key material.
+type Cipher interface {
+	// IVSize returns the IV size of the cipher, in bytes.
+	IVSize() int
+	// KeySize returns the key size of the cipher, in bytes.
+	KeySize() int
+	// Encrypt encrypts the key material.
+	Encrypt(key, iv, plaintext []byte) ([]byte, error)
+	// Decrypt decrypts the key material.
+	Decrypt(key, iv, ciphertext []byte) ([]byte, error)
+	// OID returns the OID of the cipher specified.
+	OID() asn1.ObjectIdentifier
+}
+
+var ciphers = make(map[string]func() Cipher)
+
+// RegisterCipher registers a function that returns a new instance of the given
+// cipher. This allows the library to support client-provided ciphers.
+func RegisterCipher(oid asn1.ObjectIdentifier, cipher func() Cipher) {
+	ciphers[oid.String()] = cipher
+}
+
+// Opts contains options for encrypting a PKCS#8 key.
+type Opts struct {
+	Cipher  Cipher
+	KDFOpts KDFOpts
+}
+
+// Unecrypted PKCS8
+var (
+	oidPBES2 = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 5, 13}
+)
+
+type encryptedPrivateKeyInfo struct {
+	EncryptionAlgorithm pkix.AlgorithmIdentifier
+	EncryptedData       []byte
+}
+
+type pbes2Params struct {
+	KeyDerivationFunc pkix.AlgorithmIdentifier
+	EncryptionScheme  pkix.AlgorithmIdentifier
+}
+
+type privateKeyInfo struct {
+	Version             int
+	PrivateKeyAlgorithm pkix.AlgorithmIdentifier
+	PrivateKey          []byte
+}
+
+func parseKeyDerivationFunc(keyDerivationFunc pkix.AlgorithmIdentifier) (KDFParameters, error) {
+	oid := keyDerivationFunc.Algorithm.String()
+	newParams, ok := kdfs[oid]
+	if !ok {
+		return nil, fmt.Errorf("pkcs8: unsupported KDF (OID: %s)", oid)
+	}
+	params := newParams()
+	_, err := asn1.Unmarshal(keyDerivationFunc.Parameters.FullBytes, params)
+	if err != nil {
+		return nil, errors.New("pkcs8: invalid KDF parameters")
+	}
+	return params, nil
+}
+
+func parseEncryptionScheme(encryptionScheme pkix.AlgorithmIdentifier) (Cipher, []byte, error) {
+	oid := encryptionScheme.Algorithm.String()
+	newCipher, ok := ciphers[oid]
+	if !ok {
+		return nil, nil, fmt.Errorf("pkcs8: unsupported cipher (OID: %s)", oid)
+	}
+	cipher := newCipher()
+	var iv []byte
+	if _, err := asn1.Unmarshal(encryptionScheme.Parameters.FullBytes, &iv); err != nil {
+		return nil, nil, errors.New("pkcs8: invalid cipher parameters")
+	}
+	return cipher, iv, nil
+}
+
+// ParsePrivateKey parses a DER-encoded PKCS#8 private key.
+// Password can be nil.
+// This is equivalent to ParsePKCS8PrivateKey.
+func ParsePrivateKey(der []byte, password []byte) (interface{}, KDFParameters, error) {
+	// No password provided, assume the private key is unencrypted
+	if len(password) == 0 {
+		privateKey, err := x509.ParsePKCS8PrivateKey(der)
+		return privateKey, nil, err
+	}
+
+	// Use the password provided to decrypt the private key
+	var privKey encryptedPrivateKeyInfo
+	if _, err := asn1.Unmarshal(der, &privKey); err != nil {
+		return nil, nil, errors.New("pkcs8: only PKCS #5 v2.0 supported")
+	}
+
+	if !privKey.EncryptionAlgorithm.Algorithm.Equal(oidPBES2) {
+		return nil, nil, errors.New("pkcs8: only PBES2 supported")
+	}
+
+	var params pbes2Params
+	if _, err := asn1.Unmarshal(privKey.EncryptionAlgorithm.Parameters.FullBytes, &params); err != nil {
+		return nil, nil, errors.New("pkcs8: invalid PBES2 parameters")
+	}
+
+	cipher, iv, err := parseEncryptionScheme(params.EncryptionScheme)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	kdfParams, err := parseKeyDerivationFunc(params.KeyDerivationFunc)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	keySize := cipher.KeySize()
+	symkey, err := kdfParams.DeriveKey(password, keySize)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	encryptedKey := privKey.EncryptedData
+	decryptedKey, err := cipher.Decrypt(symkey, iv, encryptedKey)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	key, err := x509.ParsePKCS8PrivateKey(decryptedKey)
+	if err != nil {
+		return nil, nil, errors.New("pkcs8: incorrect password")
+	}
+	return key, kdfParams, nil
+}
+
+// MarshalPrivateKey encodes a private key into DER-encoded PKCS#8 with the given options.
+// Password can be nil.
+func MarshalPrivateKey(priv interface{}, password []byte, opts *Opts) ([]byte, error) {
+	if len(password) == 0 {
+		return x509.MarshalPKCS8PrivateKey(priv)
+	}
+
+	if opts == nil {
+		opts = DefaultOpts
+	}
+
+	// Convert private key into PKCS8 format
+	pkey, err := x509.MarshalPKCS8PrivateKey(priv)
+	if err != nil {
+		return nil, err
+	}
+
+	encAlg := opts.Cipher
+	salt := make([]byte, opts.KDFOpts.GetSaltSize())
+	_, err = rand.Read(salt)
+	if err != nil {
+		return nil, err
+	}
+	iv := make([]byte, encAlg.IVSize())
+	_, err = rand.Read(iv)
+	if err != nil {
+		return nil, err
+	}
+	key, kdfParams, err := opts.KDFOpts.DeriveKey(password, salt, encAlg.KeySize())
+	if err != nil {
+		return nil, err
+	}
+
+	encryptedKey, err := encAlg.Encrypt(key, iv, pkey)
+	if err != nil {
+		return nil, err
+	}
+
+	marshalledParams, err := asn1.Marshal(kdfParams)
+	if err != nil {
+		return nil, err
+	}
+	keyDerivationFunc := pkix.AlgorithmIdentifier{
+		Algorithm:  opts.KDFOpts.OID(),
+		Parameters: asn1.RawValue{FullBytes: marshalledParams},
+	}
+	marshalledIV, err := asn1.Marshal(iv)
+	if err != nil {
+		return nil, err
+	}
+	encryptionScheme := pkix.AlgorithmIdentifier{
+		Algorithm:  encAlg.OID(),
+		Parameters: asn1.RawValue{FullBytes: marshalledIV},
+	}
+
+	encryptionAlgorithmParams := pbes2Params{
+		EncryptionScheme:  encryptionScheme,
+		KeyDerivationFunc: keyDerivationFunc,
+	}
+	marshalledEncryptionAlgorithmParams, err := asn1.Marshal(encryptionAlgorithmParams)
+	if err != nil {
+		return nil, err
+	}
+	encryptionAlgorithm := pkix.AlgorithmIdentifier{
+		Algorithm:  oidPBES2,
+		Parameters: asn1.RawValue{FullBytes: marshalledEncryptionAlgorithmParams},
+	}
+
+	encryptedPkey := encryptedPrivateKeyInfo{
+		EncryptionAlgorithm: encryptionAlgorithm,
+		EncryptedData:       encryptedKey,
+	}
+
+	return asn1.Marshal(encryptedPkey)
+}
+
+// ParsePKCS8PrivateKey parses encrypted/unencrypted private keys in PKCS#8 format. To parse encrypted private keys, a password of []byte type should be provided to the function as the second parameter.
+func ParsePKCS8PrivateKey(der []byte, v ...[]byte) (interface{}, error) {
+	var password []byte
+	if len(v) > 0 {
+		password = v[0]
+	}
+	privateKey, _, err := ParsePrivateKey(der, password)
+	return privateKey, err
+}
+
+// ParsePKCS8PrivateKeyRSA parses encrypted/unencrypted private keys in PKCS#8 format. To parse encrypted private keys, a password of []byte type should be provided to the function as the second parameter.
+func ParsePKCS8PrivateKeyRSA(der []byte, v ...[]byte) (*rsa.PrivateKey, error) {
+	key, err := ParsePKCS8PrivateKey(der, v...)
+	if err != nil {
+		return nil, err
+	}
+	typedKey, ok := key.(*rsa.PrivateKey)
+	if !ok {
+		return nil, errors.New("key block is not of type RSA")
+	}
+	return typedKey, nil
+}
+
+// ParsePKCS8PrivateKeyECDSA parses encrypted/unencrypted private keys in PKCS#8 format. To parse encrypted private keys, a password of []byte type should be provided to the function as the second parameter.
+func ParsePKCS8PrivateKeyECDSA(der []byte, v ...[]byte) (*ecdsa.PrivateKey, error) {
+	key, err := ParsePKCS8PrivateKey(der, v...)
+	if err != nil {
+		return nil, err
+	}
+	typedKey, ok := key.(*ecdsa.PrivateKey)
+	if !ok {
+		return nil, errors.New("key block is not of type ECDSA")
+	}
+	return typedKey, nil
+}
+
+// ConvertPrivateKeyToPKCS8 converts the private key into PKCS#8 format.
+// To encrypt the private key, the password of []byte type should be provided as the second parameter.
+//
+// The only supported key types are RSA and ECDSA (*rsa.PrivateKey or *ecdsa.PrivateKey for priv)
+func ConvertPrivateKeyToPKCS8(priv interface{}, v ...[]byte) ([]byte, error) {
+	var password []byte
+	if len(v) > 0 {
+		password = v[0]
+	}
+	return MarshalPrivateKey(priv, password, nil)
+}
diff --git a/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/config.go b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/config.go
index f7338b7e5..a7d4b2a81 100644
--- a/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/config.go
+++ b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/config.go
@@ -194,6 +194,9 @@ func WithServerName(server string) Option {
 
 // WithMetricAttributesFn returns an Option to set a function that maps an HTTP request to a slice of attribute.KeyValue.
 // These attributes will be included in metrics for every request.
+//
+// Deprecated: WithMetricAttributesFn is deprecated and will be removed in a
+// future release. Use [Labeler] instead.
 func WithMetricAttributesFn(metricAttributesFn func(r *http.Request) []attribute.KeyValue) Option {
 	return optionFunc(func(c *config) {
 		c.MetricAttributesFn = metricAttributesFn
diff --git a/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/handler.go b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/handler.go
index 1ecd4be2d..a269fce0f 100644
--- a/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/handler.go
+++ b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/handler.go
@@ -184,30 +184,26 @@ func (h *middleware) serveHTTP(w http.ResponseWriter, r *http.Request, next http
 	statusCode := rww.StatusCode()
 	bytesWritten := rww.BytesWritten()
 	span.SetStatus(h.semconv.Status(statusCode))
+	bytesRead := bw.BytesRead()
 	span.SetAttributes(h.semconv.ResponseTraceAttrs(semconv.ResponseTelemetry{
 		StatusCode: statusCode,
-		ReadBytes:  bw.BytesRead(),
+		ReadBytes:  bytesRead,
 		ReadError:  bw.Error(),
 		WriteBytes: bytesWritten,
 		WriteError: rww.Error(),
 	})...)
 
-	// Use floating point division here for higher precision (instead of Millisecond method).
-	elapsedTime := float64(time.Since(requestStartTime)) / float64(time.Millisecond)
-
-	metricAttributes := semconv.MetricAttributes{
-		Req:                  r,
-		StatusCode:           statusCode,
-		AdditionalAttributes: append(labeler.Get(), h.metricAttributesFromRequest(r)...),
-	}
-
 	h.semconv.RecordMetrics(ctx, semconv.ServerMetricData{
-		ServerName:       h.server,
-		ResponseSize:     bytesWritten,
-		MetricAttributes: metricAttributes,
+		ServerName:   h.server,
+		ResponseSize: bytesWritten,
+		MetricAttributes: semconv.MetricAttributes{
+			Req:                  r,
+			StatusCode:           statusCode,
+			AdditionalAttributes: append(labeler.Get(), h.metricAttributesFromRequest(r)...),
+		},
 		MetricData: semconv.MetricData{
-			RequestSize: bw.BytesRead(),
-			ElapsedTime: elapsedTime,
+			RequestSize:     bytesRead,
+			RequestDuration: time.Since(requestStartTime),
 		},
 	})
 }
diff --git a/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/internal/request/resp_writer_wrapper.go b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/internal/request/resp_writer_wrapper.go
index ca2e4c14c..f29f9b7c9 100644
--- a/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/internal/request/resp_writer_wrapper.go
+++ b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/internal/request/resp_writer_wrapper.go
@@ -61,7 +61,7 @@ func (w *RespWriterWrapper) Write(p []byte) (int, error) {
 
 // WriteHeader persists initial statusCode for span attribution.
 // All calls to WriteHeader will be propagated to the underlying ResponseWriter
-// and will persist the statusCode from the first call.
+// and will persist the statusCode from the first call (except for informational response status codes).
 // Blocking consecutive calls to WriteHeader alters expected behavior and will
 // remove warning logs from net/http where developers will notice incorrect handler implementations.
 func (w *RespWriterWrapper) WriteHeader(statusCode int) {
@@ -77,6 +77,13 @@ func (w *RespWriterWrapper) WriteHeader(statusCode int) {
 // parent method.
 func (w *RespWriterWrapper) writeHeader(statusCode int) {
 	if !w.wroteHeader {
+		// Ignore informational response status codes.
+		// Based on https://github.com/golang/go/blob/go1.24.1/src/net/http/server.go#L1216
+		if statusCode >= 100 && statusCode <= 199 && statusCode != http.StatusSwitchingProtocols {
+			w.ResponseWriter.WriteHeader(statusCode)
+			return
+		}
+
 		w.wroteHeader = true
 		w.statusCode = statusCode
 	}
diff --git a/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/internal/semconv/client.go b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/internal/semconv/client.go
index 29d6f508c..1398d85c2 100644
--- a/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/internal/semconv/client.go
+++ b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/internal/semconv/client.go
@@ -19,11 +19,11 @@ import (
 	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/codes"
 	"go.opentelemetry.io/otel/metric"
-	"go.opentelemetry.io/otel/semconv/v1.39.0"
-	"go.opentelemetry.io/otel/semconv/v1.39.0/httpconv"
+	"go.opentelemetry.io/otel/semconv/v1.40.0"
+	"go.opentelemetry.io/otel/semconv/v1.40.0/httpconv"
 )
 
-type HTTPClient struct{
+type HTTPClient struct {
 	requestBodySize httpconv.ClientRequestBodySize
 	requestDuration httpconv.ClientRequestDuration
 }
@@ -57,14 +57,14 @@ func (n HTTPClient) Status(code int) (codes.Code, string) {
 // RequestTraceAttrs returns trace attributes for an HTTP request made by a client.
 func (n HTTPClient) RequestTraceAttrs(req *http.Request) []attribute.KeyValue {
 	/*
-		 below attributes are returned:
-		 - http.request.method
-		 - http.request.method.original
-		 - url.full
-		 - server.address
-		 - server.port
-		 - network.protocol.name
-		 - network.protocol.version
+	 below attributes are returned:
+	 - http.request.method
+	 - http.request.method.original
+	 - url.full
+	 - server.address
+	 - server.port
+	 - network.protocol.name
+	 - network.protocol.version
 	*/
 	numOfAttributes := 3 // URL, server address, proto, and method.
 
@@ -139,9 +139,9 @@ func (n HTTPClient) RequestTraceAttrs(req *http.Request) []attribute.KeyValue {
 // ResponseTraceAttrs returns trace attributes for an HTTP response made by a client.
 func (n HTTPClient) ResponseTraceAttrs(resp *http.Response) []attribute.KeyValue {
 	/*
-		 below attributes are returned:
-		 - http.response.status_code
-		 - error.type
+	 below attributes are returned:
+	 - http.response.status_code
+	 - error.type
 	*/
 	var count int
 	if resp.StatusCode > 0 {
@@ -247,22 +247,26 @@ func (o MetricOpts) AddOptions() metric.AddOption {
 	return o.addOptions
 }
 
-func (n HTTPClient) MetricOptions(ma MetricAttributes) map[string]MetricOpts {
-	opts := map[string]MetricOpts{}
-
+func (n HTTPClient) MetricOptions(ma MetricAttributes) MetricOpts {
 	attributes := n.MetricAttributes(ma.Req, ma.StatusCode, ma.AdditionalAttributes)
 	set := metric.WithAttributeSet(attribute.NewSet(attributes...))
-	opts["new"] = MetricOpts{
+
+	return MetricOpts{
 		measurement: set,
 		addOptions:  set,
 	}
-
-	return opts
 }
 
-func (n HTTPClient) RecordMetrics(ctx context.Context, md MetricData, opts map[string]MetricOpts) {
-	n.requestBodySize.Inst().Record(ctx, md.RequestSize, opts["new"].MeasurementOption())
-	n.requestDuration.Inst().Record(ctx, md.ElapsedTime/1000, opts["new"].MeasurementOption())
+func (n HTTPClient) RecordMetrics(ctx context.Context, md MetricData, opts MetricOpts) {
+	recordOpts := metricRecordOptionPool.Get().(*[]metric.RecordOption)
+	defer func() {
+		*recordOpts = (*recordOpts)[:0]
+		metricRecordOptionPool.Put(recordOpts)
+	}()
+	*recordOpts = append(*recordOpts, opts.MeasurementOption())
+
+	n.requestBodySize.Inst().Record(ctx, md.RequestSize, *recordOpts...)
+	n.requestDuration.Inst().Record(ctx, durationToSeconds(md.RequestDuration), *recordOpts...)
 }
 
 // TraceAttributes returns attributes for httptrace.
diff --git a/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/internal/semconv/server.go b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/internal/semconv/server.go
index e0e9ebc05..6dcf1b5b5 100644
--- a/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/internal/semconv/server.go
+++ b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/internal/semconv/server.go
@@ -15,12 +15,13 @@ import (
 	"slices"
 	"strings"
 	"sync"
+	"time"
 
 	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/codes"
 	"go.opentelemetry.io/otel/metric"
-	"go.opentelemetry.io/otel/semconv/v1.39.0"
-	"go.opentelemetry.io/otel/semconv/v1.39.0/httpconv"
+	"go.opentelemetry.io/otel/semconv/v1.40.0"
+	"go.opentelemetry.io/otel/semconv/v1.40.0/httpconv"
 )
 
 type RequestTraceAttrsOpts struct {
@@ -36,7 +37,7 @@ type ResponseTelemetry struct {
 	WriteError error
 }
 
-type HTTPServer struct{
+type HTTPServer struct {
 	requestBodySizeHistogram  httpconv.ServerRequestBodySize
 	responseBodySizeHistogram httpconv.ServerResponseBodySize
 	requestDurationHistogram  httpconv.ServerRequestDuration
@@ -245,19 +246,11 @@ type MetricAttributes struct {
 }
 
 type MetricData struct {
-	RequestSize int64
-
-	// The request duration, in milliseconds
-	ElapsedTime float64
+	RequestSize     int64
+	RequestDuration time.Duration
 }
 
 var (
-	metricAddOptionPool = &sync.Pool{
-		New: func() any {
-			return &[]metric.AddOption{}
-		},
-	}
-
 	metricRecordOptionPool = &sync.Pool{
 		New: func() any {
 			return &[]metric.RecordOption{}
@@ -272,7 +265,7 @@ func (n HTTPServer) RecordMetrics(ctx context.Context, md ServerMetricData) {
 	*recordOpts = append(*recordOpts, o)
 	n.requestBodySizeHistogram.Inst().Record(ctx, md.RequestSize, *recordOpts...)
 	n.responseBodySizeHistogram.Inst().Record(ctx, md.ResponseSize, *recordOpts...)
-	n.requestDurationHistogram.Inst().Record(ctx, md.ElapsedTime/1000.0, o)
+	n.requestDurationHistogram.Inst().Record(ctx, durationToSeconds(md.RequestDuration), o)
 	*recordOpts = (*recordOpts)[:0]
 	metricRecordOptionPool.Put(recordOpts)
 }
@@ -373,8 +366,8 @@ func (n HTTPServer) MetricAttributes(server string, req *http.Request, statusCod
 	}
 
 	if route != "" {
-        num++
-    }
+		num++
+	}
 
 	attributes := slices.Grow(additionalAttributes, num)
 	attributes = append(attributes,
@@ -397,7 +390,7 @@ func (n HTTPServer) MetricAttributes(server string, req *http.Request, statusCod
 	}
 
 	if route != "" {
-        attributes = append(attributes, semconv.HTTPRoute(route))
-    }
+		attributes = append(attributes, semconv.HTTPRoute(route))
+	}
 	return attributes
 }
diff --git a/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/internal/semconv/util.go b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/internal/semconv/util.go
index 131fda489..2eab2ecab 100644
--- a/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/internal/semconv/util.go
+++ b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/internal/semconv/util.go
@@ -11,10 +11,11 @@ import (
 	"net/http"
 	"strconv"
 	"strings"
+	"time"
 
 	"go.opentelemetry.io/otel"
 	"go.opentelemetry.io/otel/attribute"
-	semconvNew "go.opentelemetry.io/otel/semconv/v1.39.0"
+	semconvNew "go.opentelemetry.io/otel/semconv/v1.40.0"
 )
 
 // SplitHostPort splits a network address hostport of the form "host",
@@ -125,3 +126,8 @@ func standardizeHTTPMethod(method string) string {
 	}
 	return method
 }
+
+func durationToSeconds(d time.Duration) float64 {
+	// Use floating point division here for higher precision (instead of Seconds method).
+	return float64(d) / float64(time.Second)
+}
diff --git a/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/transport.go b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/transport.go
index 59b6c5498..d8d204d1f 100644
--- a/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/transport.go
+++ b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/transport.go
@@ -5,7 +5,6 @@ package otelhttp // import "go.opentelemetry.io/contrib/instrumentation/net/http
 
 import (
 	"context"
-	"fmt"
 	"io"
 	"net/http"
 	"net/http/httptrace"
@@ -16,7 +15,7 @@ import (
 	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/codes"
 	"go.opentelemetry.io/otel/propagation"
-	otelsemconv "go.opentelemetry.io/otel/semconv/v1.39.0"
+	otelsemconv "go.opentelemetry.io/otel/semconv/v1.40.0"
 	"go.opentelemetry.io/otel/trace"
 
 	"go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/internal/request"
@@ -85,8 +84,6 @@ func defaultTransportFormatter(_ string, r *http.Request) string {
 // RoundTrip creates a Span and propagates its context via the provided request's headers
 // before handing the request to the configured base RoundTripper. The created span will
 // end when the response body is closed or when a read from the body returns io.EOF.
-// If GetBody returns an error, the error is reported via otel.Handle and the request
-// continues with the original Body.
 func (t *Transport) RoundTrip(r *http.Request) (*http.Response, error) {
 	requestStartTime := time.Now()
 	for _, f := range t.filters {
@@ -106,9 +103,7 @@ func (t *Transport) RoundTrip(r *http.Request) (*http.Response, error) {
 		}
 	}
 
-	opts := append([]trace.SpanStartOption{}, t.spanStartOptions...) // start with the configured options
-
-	ctx, span := tracer.Start(r.Context(), t.spanNameFormatter("", r), opts...)
+	ctx, span := tracer.Start(r.Context(), t.spanNameFormatter("", r), t.spanStartOptions...)
 
 	if t.clientTrace != nil {
 		ctx = httptrace.WithClientTrace(ctx, t.clientTrace(ctx))
@@ -121,23 +116,26 @@ func (t *Transport) RoundTrip(r *http.Request) (*http.Response, error) {
 
 	r = r.Clone(ctx) // According to RoundTripper spec, we shouldn't modify the origin request.
 
-	// GetBody is preferred over direct access to Body if the function is set.
-	// If the resulting body is nil or is NoBody, we don't want to mutate the body as it
-	// will affect the identity of it in an unforeseeable way because we assert
-	// ReadCloser fulfills a certain interface and it is indeed nil or NoBody.
-	body := r.Body
-	if r.GetBody != nil {
-		b, err := r.GetBody()
-		if err != nil {
-			otel.Handle(fmt.Errorf("http.Request GetBody returned an error: %w", err))
-		} else {
-			body = b
+	var lastBW *request.BodyWrapper // Records the last body wrapper. Can be nil.
+	maybeWrapBody := func(body io.ReadCloser) io.ReadCloser {
+		if body == nil || body == http.NoBody {
+			return body
 		}
+		bw := request.NewBodyWrapper(body, func(int64) {})
+		lastBW = bw
+		return bw
 	}
-
-	bw := request.NewBodyWrapper(body, func(int64) {})
-	if body != nil && body != http.NoBody {
-		r.Body = bw
+	r.Body = maybeWrapBody(r.Body)
+	if r.GetBody != nil {
+		originalGetBody := r.GetBody
+		r.GetBody = func() (io.ReadCloser, error) {
+			b, err := originalGetBody()
+			if err != nil {
+				lastBW = nil // The underlying transport will fail to make a retry request, hence, record no data.
+				return nil, err
+			}
+			return maybeWrapBody(b), nil
+		}
 	}
 
 	span.SetAttributes(t.semconv.RequestTraceAttrs(r)...)
@@ -145,35 +143,27 @@ func (t *Transport) RoundTrip(r *http.Request) (*http.Response, error) {
 
 	res, err := t.rt.RoundTrip(r)
 
-	// Defer metrics recording function to record the metrics on error or no error.
-	defer func() {
-		metricAttributes := semconv.MetricAttributes{
+	// Record the metrics on error or no error.
+	statusCode := 0
+	if err == nil {
+		statusCode = res.StatusCode
+	}
+	var requestSize int64
+	if lastBW != nil {
+		requestSize = lastBW.BytesRead()
+	}
+	t.semconv.RecordMetrics(
+		ctx,
+		semconv.MetricData{
+			RequestSize:     requestSize,
+			RequestDuration: time.Since(requestStartTime),
+		},
+		t.semconv.MetricOptions(semconv.MetricAttributes{
 			Req:                  r,
+			StatusCode:           statusCode,
 			AdditionalAttributes: append(labeler.Get(), t.metricAttributesFromRequest(r)...),
-		}
-
-		if err == nil {
-			metricAttributes.StatusCode = res.StatusCode
-		}
-
-		metricOpts := t.semconv.MetricOptions(metricAttributes)
-
-		metricData := semconv.MetricData{
-			RequestSize: bw.BytesRead(),
-		}
-
-		if err == nil {
-			readRecordFunc := func(int64) {}
-			res.Body = newWrappedBody(span, readRecordFunc, res.Body)
-		}
-
-		// Use floating point division here for higher precision (instead of Millisecond method).
-		elapsedTime := float64(time.Since(requestStartTime)) / float64(time.Millisecond)
-
-		metricData.ElapsedTime = elapsedTime
-
-		t.semconv.RecordMetrics(ctx, metricData, metricOpts)
-	}()
+		}),
+	)
 
 	if err != nil {
 		span.SetAttributes(otelsemconv.ErrorType(err))
@@ -183,6 +173,8 @@ func (t *Transport) RoundTrip(r *http.Request) (*http.Response, error) {
 		return res, err
 	}
 
+	readRecordFunc := func(int64) {}
+	res.Body = newWrappedBody(span, readRecordFunc, res.Body)
 	// traces
 	span.SetAttributes(t.semconv.ResponseTraceAttrs(res)...)
 	span.SetStatus(t.semconv.Status(res.StatusCode))
diff --git a/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/version.go b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/version.go
index d0107952e..1d90fc264 100644
--- a/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/version.go
+++ b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/version.go
@@ -4,4 +4,4 @@
 package otelhttp // import "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
 
 // Version is the current release version of the otelhttp instrumentation.
-const Version = "0.65.0"
+const Version = "0.67.0"
diff --git a/vendor/go.opentelemetry.io/otel/.golangci.yml b/vendor/go.opentelemetry.io/otel/.golangci.yml
index db1f55101..645c7e6af 100644
--- a/vendor/go.opentelemetry.io/otel/.golangci.yml
+++ b/vendor/go.opentelemetry.io/otel/.golangci.yml
@@ -96,9 +96,9 @@ linters:
             - "!**/exporters/zipkin/**"
           deny:
             - pkg: go.opentelemetry.io/otel/semconv
-              desc: "Use go.opentelemetry.io/otel/semconv/v1.40.0 instead. If a newer semconv version has been released, update the depguard rule."
+              desc: "Use go.opentelemetry.io/otel/semconv/v1.41.0 instead. If a newer semconv version has been released, update the depguard rule."
           allow:
-            - go.opentelemetry.io/otel/semconv/v1.40.0
+            - go.opentelemetry.io/otel/semconv/v1.41.0
     gocritic:
       disabled-checks:
         - appendAssign
@@ -134,13 +134,16 @@ linters:
       strconcat: true
     revive:
       confidence: 0.01
+      enable-all-rules: false
+      enable-default-rules: true
+      max-open-files: 2048
       rules:
         - name: blank-imports
         - name: bool-literal-in-expr
         - name: constant-logical-expr
         - name: context-as-argument
           arguments:
-            - allowTypesBefore: '*testing.T'
+            - allow-types-before: '*testing.T'
           disabled: true
         - name: context-keys-type
         - name: deep-exit
@@ -152,7 +155,7 @@ linters:
         - name: duplicated-imports
         - name: early-return
           arguments:
-            - preserveScope
+            - preserve-scope
         - name: empty-block
         - name: empty-lines
         - name: error-naming
@@ -161,7 +164,7 @@ linters:
         - name: errorf
         - name: exported
           arguments:
-            - sayRepetitiveInsteadOfStutters
+            - say-repetitive-instead-of-stutters
         - name: flag-parameter
         - name: identical-branches
         - name: if-return
@@ -169,11 +172,12 @@ linters:
         - name: increment-decrement
         - name: indent-error-flow
           arguments:
-            - preserveScope
+            - preserve-scope
         - name: package-comments
         - name: range
         - name: range-val-in-closure
         - name: range-val-address
+        - name: receiver-naming
         - name: redefines-builtin-id
         - name: string-format
           arguments:
@@ -183,7 +187,7 @@ linters:
         - name: struct-tag
         - name: superfluous-else
           arguments:
-            - preserveScope
+            - preserve-scope
         - name: time-equal
         - name: unconditional-recursion
         - name: unexported-return
diff --git a/vendor/go.opentelemetry.io/otel/AGENTS.md b/vendor/go.opentelemetry.io/otel/AGENTS.md
new file mode 100644
index 000000000..26c0fc4dd
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/AGENTS.md
@@ -0,0 +1,109 @@
+# Agent Guide for opentelemetry-go
+
+This file contains active, task-oriented instructions for autonomous and semi-autonomous coding agents working in this repository.
+
+Before starting any task, read `.github/copilot-instructions.md`, `CONTRIBUTING.md`, and this file.
+Treat `.github/copilot-instructions.md` as global passive guidance for every task, including docs-only and review-only work.
+
+## Core expectations
+
+- Preserve OpenTelemetry specification compliance, API stability, and idiomatic Go.
+- Prefer minimal, surgical changes over broad refactors or speculative cleanup.
+- Read the package you are editing and match its existing naming, option types, error handling, comments, tests, and concurrency patterns.
+- Keep public APIs backward compatible unless the task explicitly requires a breaking change.
+- Keep telemetry resilient and loosely coupled. Do not introduce behavior that can unexpectedly interfere with host applications.
+- Inspect boundaries carefully: input validation, resource limits, cancellation, shutdown, error propagation, concurrency, and memory growth.
+- Prefer fail-safe behavior and explicit invariants over implicit assumptions.
+- Keep dependencies minimal and justified.
+- Preserve host-application safety: telemetry should not panic, block indefinitely, or amplify attacker-controlled input.
+- Be conservative on hot paths. Avoid unnecessary allocations, reflection, interface churn, blocking, global state, and high-cardinality telemetry.
+- Write comments only for intent, invariants, and non-obvious constraints. Do not add comments that restate the code.
+
+## Default workflow
+
+For new features and behavior changes, use this order unless the task explicitly says otherwise:
+
+1. Read the relevant package, its tests, and any package docs or `README.md`.
+2. Add or update a failing unit test that captures the required behavior or regression.
+3. Implement the smallest change that makes the test pass.
+4. Refactor only after the behavior is locked in, and only if the refactor keeps the diff focused.
+5. If the changed code is on a hot path or performance-sensitive, inspect existing benchmarks and run them. Add a benchmark if coverage is missing.
+6. Update documentation artifacts as needed while the context is fresh. Follow the documentation and changelog conventions below for the specific updates required.
+7. Run `make precommit` each time before considering the work complete.
+
+For docs-only, test-only, or review-only tasks, still start with the required repository guidance above, then skip the workflow steps that do not apply while keeping the same discipline around scope, verification, and repository conventions.
+
+## Verification
+
+- Use `make` as the canonical repository verification command. The default target is `precommit`.
+- `make precommit` is the expected final verification step for linting, generation, README checks, module checks, and tests.
+- During iteration, targeted commands are fine for fast feedback, but do not stop there if the task changes code.
+- If you touch performance-sensitive code, run focused benchmarks and compare the results using `benchstat` in addition to `make`.
+
+## Documentation and changelog
+
+- Non-internal, non-test packages should have Go doc comments, usually in `doc.go`.
+- Non-internal, non-test, non-documentation packages should also have a `README.md` with at least a title and a `pkg.go.dev` badge.
+- Prefer examples over long code snippets in GoDoc when practical.
+- Keep docs aligned with actual behavior. Do not leave stale comments, stale examples, or stale package documentation behind.
+- For user-visible changes, update `CHANGELOG.md` under the appropriate `Added`, `Changed`, `Deprecated`, `Fixed`, or `Removed` section within `## [Unreleased]`.
+
+## Repository habits
+
+- Prefer focused diffs. Avoid drive-by cleanup.
+- Follow existing option patterns and exported API conventions instead of inventing new abstractions.
+- Generated files are checked in. If your change affects generation, keep generated output up to date.
+- Prefer fast local search tools such as `rg` when exploring the repository.
+- When changing behavior, make the invariants explicit in tests.
+
+## Personas
+
+### Feature Agent
+
+Use this persona for new behavior, new API surface, or spec-driven feature work.
+
+- Start with a failing unit test.
+- Confirm the expected behavior against the spec, existing package behavior, and public API compatibility.
+- Implement the smallest viable change.
+- Update GoDoc, examples, `README.md`, and `CHANGELOG.md` when the change is user-visible.
+- If the feature touches a hot path, check benchmarks and add one if the coverage is missing.
+
+### Refactoring Agent
+
+Use this persona when improving structure without intentionally changing behavior.
+
+- Treat behavior preservation as the default contract.
+- Add or tighten tests before moving code if current behavior is not already pinned down.
+- Avoid broad rewrites, clever abstractions, or package-wide cleanup unless explicitly requested.
+- If a refactor touches a hot path, benchmark before and after.
+- Keep API shape, semantics, concurrency guarantees, and failure modes unchanged unless the task says otherwise.
+
+### Test Agent
+
+Use this persona when adding missing coverage, reproducing bugs, or hardening regressions.
+
+- Reproduce the bug or missing behavior with the smallest failing test you can.
+- Prefer testing public behavior and externally visible invariants.
+- Add targeted regression tests before changing production code.
+- Only change production code when it is required to make the tested behavior correct or testable.
+- Keep tests deterministic, readable, and aligned with package patterns.
+
+### Performance Agent
+
+Use this persona for hot-path work, allocation reduction, or throughput and latency improvements.
+
+- Benchmark first to establish a baseline.
+- Prefer changes that reduce allocations, copying, interface churn, and unnecessary synchronization.
+- Do not trade away correctness, spec compliance, or API stability for micro-optimizations.
+- Add or update benchmarks when performance-sensitive coverage is missing.
+- If you materially change a hot path, capture before-and-after results, preferably with `benchstat`.
+
+### Review Agent
+
+Use this persona when asked to review code, patches, or pull requests.
+
+- Lead with findings, not summaries.
+- Order findings by severity and include precise file and line references when available.
+- Focus on correctness, spec compliance, API compatibility, concurrency safety, resilience, performance regressions, missing tests, missing benchmarks, documentation gaps, and changelog gaps.
+- Call out when a diff is broader than necessary.
+- If you find no issues, say that explicitly and note any residual risks or verification gaps.
diff --git a/vendor/go.opentelemetry.io/otel/CHANGELOG.md b/vendor/go.opentelemetry.io/otel/CHANGELOG.md
index 20edda441..6a90451f5 100644
--- a/vendor/go.opentelemetry.io/otel/CHANGELOG.md
+++ b/vendor/go.opentelemetry.io/otel/CHANGELOG.md
@@ -11,6 +11,100 @@ This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 <!-- Released section -->
 <!-- Don't change this section unless doing release -->
 
+## [1.44.0/0.66.0/0.20.0/0.0.17] 2026-05-27
+
+### Added
+
+- Add `ByteSlice` and `ByteSliceValue` functions for new `BYTESLICE` attribute type in `go.opentelemetry.io/otel/attribute`. (#7948)
+- Apply attribute value limit to the `KindBytes` attribute type in `go.opentelemetry.io/otel/sdk/log`. (#7990)
+- Apply attribute value limit to the `BYTESLICE` attribute type in `go.opentelemetry.io/otel/sdk/trace`. (#7990)
+- Support `BYTESLICE` attributes in `go.opentelemetry.io/otel/trace`. (#8153)
+- Support `BYTESLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlptrace`. (#8153)
+- Support `BYTESLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlplog`. (#8153)
+- Support `BYTESLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric`. (#8153)
+- Support `BYTESLICE` attributes in `go.opentelemetry.io/otel/exporters/zipkin`. (#8153)
+- Add `String` method for `Value` type in `go.opentelemetry.io/otel/attribute`. (#8142)
+- Add `Slice` and `SliceValue` functions for new `SLICE` attribute type in `go.opentelemetry.io/otel/attribute`. (#8166)
+- Support `SLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlptrace`. (#8216)
+- Support `SLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlplog`. (#8216)
+- Support `SLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric`. (#8216)
+- Support `SLICE` attributes in `go.opentelemetry.io/otel/exporters/zipkin`. (#8216)
+- Apply `AttributeValueLengthLimit` to `attribute.SLICE` type attribute values in `go.opentelemetry.io/otel/sdk/trace`, recursively truncating contained string values. (#8217)
+- Add `Error` field on `Record` type in `go.opentelemetry.io/otel/log/logtest`. (#8148)
+- Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`. (#8157)
+- Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`. (#8157)
+- Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc`. (#8157)
+- Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`. (#8157)
+- Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc`. (#8157)
+- Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. (#8157)
+- Add `Settable` to `go.opentelemetry.io/otel/metric/x` to allow reusing attribute options. (#8178)
+- Add experimental support for splitting metric data across multiple batches in `go.opentelemetry.io/otel/sdk/metric`.
+  Set `OTEL_GO_X_METRIC_EXPORT_BATCH_SIZE=<max_size>` to enable for all periodic readers.
+  See `go.opentelemetry.io/otel/sdk/metric/internal/x` for feature documentation. (#8071)
+- Add experimental self-observability metrics in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc`.
+  Enable with `OTEL_GO_X_SELF_OBSERVABILITY=true` environment variable.
+  See `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc/internal/x` for feature documentation. (#8192)
+- Add experimental self-observability metrics in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`.
+  Enable with `OTEL_GO_X_SELF_OBSERVABILITY=true` environment variable.
+  See `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp/internal/x` for feature documentation. (#8194)
+- Add experimental self-observability metrics in `go.opentelemetry.io/otel/exporters/stdout/stdoutlog`.
+  Enable with `OTEL_GO_X_SELF_OBSERVABILITY=true` environment variable.
+  See `go.opentelemetry.io/otel/stdout/stdoutlog/internal/x` for feature documentation. (#8263)
+- Add `WithDefaultAttributes` to `go.opentelemetry.io/otel/metric/x` to support setting default attributes on instruments. (#8135)
+- Add `go.opentelemetry.io/otel/semconv/v1.41.0` package.
+  The package contains semantic conventions from the `v1.41.0` version of the OpenTelemetry Semantic Conventions.
+  See the [migration documentation](./semconv/v1.41.0/MIGRATION.md) for information on how to upgrade from `go.opentelemetry.io/otel/semconv/v1.40.0`. (#8324)
+- Add Observable variants of instruments to `go.opentelemetry.io/otel/semconv/v1.41.0` package. (#8350)
+- Generate explicit histogram bucket boundaries from weaver configuration for HTTP and RPC duration instruments in `go.opentelemetry.io/otel/semconv/v1.41.0`. (#8002)
+
+### Changed
+
+- ⚠️ **Breaking Change:** `go.opentelemetry.io/otel/sdk/metric` now applies a default cardinality limit of 2000 to comply with the Metrics SDK specification recommendation.
+  New attribute sets are dropped when the cardinality limit is reached. The measurement of these sets are aggregated into a special attribute set containing `attribute.Bool("otel.metric.overflow", true)`.
+  This can break users who relied on the previous unlimited default.
+  Set `WithCardinalityLimit(0)` or the deprecated `OTEL_GO_X_CARDINALITY_LIMIT=0` environment variable to preserve unlimited cardinality.
+  Note that support for `OTEL_GO_X_CARDINALITY_LIMIT` may be removed in a future release. (#8247)
+- `ErrorType` in `go.opentelemetry.io/otel/semconv` now unwraps errors created with `fmt.Errorf` when deriving the `error.type` attribute. (#8133)
+- `go.opentelemetry.io/otel/sdk/log` now unwraps error chains created with `fmt.Errorf` when deriving the `error.type` attribute from errors on log records. (#8133)
+- `Set.MarshalLog` method in `go.opentelemetry.io/otel/attribute` now uses `Value.String` formatting following the [OpenTelemetry AnyValue representation for non-OTLP protocols](https://opentelemetry.io/docs/specs/otel/common/#anyvalue). (#8169)
+- Optimize `go.opentelemetry.io/otel/sdk/metric` to return a drop reservoir and short-circuit `Offer` calls to the exemplar reservoir when `exemplar.AlwaysOffFilter` is configured. (#8211) (#8267)
+- Optimize `go.opentelemetry.io/otel/sdk/metric` to return a drop reservoir for asynchronous instruments when `exemplar.TraceBasedFilter` is configured. (#8286)
+
+### Deprecated
+
+- Deprecate `Value.Emit` method in `go.opentelemetry.io/otel/attribute`.
+  Use `Value.String` instead. (#8176)
+
+### Fixed
+
+- Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`.
+  The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. (#8157, #8365)
+- Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`.
+  The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. (#8157, #8365)
+- Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc`.
+  The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. (#8157, #8365)
+- Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`.
+  The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. (#8157, #8365)
+- Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc`.
+  The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. (#8157, #8365)
+- Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`.
+  The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. (#8157, #8365)
+- Fix gzipped request body replay on redirect in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`. (#8135)
+- Fix gzipped request body replay on redirect in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. (#8152)
+- `go.opentelemetry.io/otel/exporters/prometheus` now uses `Value.String` formatting for label values following the [OpenTelemetry AnyValue representation for non-OTLP protocols](https://opentelemetry.io/docs/specs/otel/common/#anyvalue). (#8170)
+- Propagate errors from the exporter when calling `Shutdown` on `BatchSpanProcessor` in `go.opentelemetry.io/otel/sdk/trace`. (#8197)
+- Fix stale status code reporting on self-observability metrics in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp` and `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. (#8226)
+- Fix a concurrent `Collect` data race and potential panic in `go.opentelemetry.io/otel/exporters/prometheus` when `WithResourceAsConstantLabels` option is used. (#8227)
+- Fix race condition in `FixedSizeReservoir` in `go.opentelemetry.io/otel/sdk/metric/exemplar` by reverting #7447. (#8249)
+- Fix `FixedSizeReservoir` in `go.opentelemetry.io/otel/sdk/metric/exemplar` to safely handle zero size.
+  A capacity check in the constructor initializes the reservoir safely and skips initialization for zero-cap; early returns in `Offer()` and `Collect()` ensure no-op behavior. (#8295)
+- Fix counting of spans and logs in self-observability metrics in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`, `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`, `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc`, and `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. (#8254)
+- Drop conflicting scope attributes named `name`, `version`, or `schema_url` from metric labels in `go.opentelemetry.io/otel/exporters/prometheus`, preserving the dedicated `otel_scope_name`, `otel_scope_version`, and `otel_scope_schema_url` labels. (#8264)
+- Close schema files opened by `ParseFile` in `go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1`. ([GHSA-995v-fvrw-c78m](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-995v-fvrw-c78m))
+- Enforce the 8192-byte baggage size limit during extraction/parsing, changing behavior when the limit is exceeded in `go.opentelemetry.io/otel/baggage` and `go.opentelemetry.io/otel/propagation`. (#8222)
+- Fix `go.opentelemetry.io/otel/semconv/v1.41.0` to include `Attr*` helper methods for required attributes on observable instruments. (#8361)
+- Limit baggage extraction error reporting in `go.opentelemetry.io/otel/propagation` to prevent malformed or oversized baggage headers from flooding logs. ([GHSA-5wrp-cwcj-q835](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835))
+
 ## [1.43.0/0.65.0/0.19.0] 2026-04-02
 
 ### Added
@@ -3619,7 +3713,8 @@ It contains api and sdk for trace and meter.
 - CircleCI build CI manifest files.
 - CODEOWNERS file to track owners of this project.
 
-[Unreleased]: https://github.com/open-telemetry/opentelemetry-go/compare/v1.43.0...HEAD
+[Unreleased]: https://github.com/open-telemetry/opentelemetry-go/compare/v1.44.0...HEAD
+[1.44.0/0.66.0/0.20.0/0.0.17]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.44.0
 [1.43.0/0.65.0/0.19.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.43.0
 [1.42.0/0.64.0/0.18.0/0.0.16]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.42.0
 [1.41.0/0.63.0/0.17.0/0.0.15]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.41.0
diff --git a/vendor/go.opentelemetry.io/otel/CLAUDE.md b/vendor/go.opentelemetry.io/otel/CLAUDE.md
new file mode 100644
index 000000000..dd3c4594f
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/CLAUDE.md
@@ -0,0 +1,3 @@
+# Instructions for Claude Code
+
+@AGENTS.md
diff --git a/vendor/go.opentelemetry.io/otel/CONTRIBUTING.md b/vendor/go.opentelemetry.io/otel/CONTRIBUTING.md
index 12de3607a..3ec17d683 100644
--- a/vendor/go.opentelemetry.io/otel/CONTRIBUTING.md
+++ b/vendor/go.opentelemetry.io/otel/CONTRIBUTING.md
@@ -11,6 +11,12 @@ for a summary description of past meetings. To request edit access,
 join the meeting or get in touch on
 [Slack](https://cloud-native.slack.com/archives/C01NPAXACKT).
 
+The meeting is open for all to join. We invite everyone to join our
+meeting, regardless of your experience level. Whether you're a
+seasoned OpenTelemetry developer, just starting your journey, or
+simply curious about the work we do, you're more than welcome to
+participate!
+
 ## Development
 
 You can view and edit the source code by cloning this repository:
@@ -746,8 +752,8 @@ Encapsulate setup in constructor functions, ensuring clear ownership and scope:
 import (
 	"errors"
 
-	semconv "go.opentelemetry.io/otel/semconv/v1.40.0"
-	"go.opentelemetry.io/otel/semconv/v1.40.0/otelconv"
+	semconv "go.opentelemetry.io/otel/semconv/v1.41.0"
+	"go.opentelemetry.io/otel/semconv/v1.41.0/otelconv"
 )
 
 type SDKComponent struct {
@@ -808,11 +814,11 @@ func (c *Component) initObservability() {
 
 #### Performance
 
-When observability is disabled there should be little to no overhead.
+When observability is disabled or the instrument is not `Enabled`, there should be little to no overhead.
 
 ```go
 func (e *Exporter) ExportSpans(ctx context.Context, spans []trace.ReadOnlySpan) error {
-	if e.inst != nil {
+	if e.inst != nil && e.inst.Enabled(ctx) {
 		attrs := expensiveOperation()
 		e.inst.recordSpanInflight(ctx, int64(len(spans)), attrs...)
 	}
@@ -829,7 +835,7 @@ func (e *Exporter) ExportSpans(ctx context.Context, spans []trace.ReadOnlySpan)
 }
 
 func (i *instrumentation) recordSpanInflight(ctx context.Context, count int64, attrs ...attribute.KeyValue) {
-	if i == nil || i.inflight == nil {
+	if i == nil || i.inflight == nil || !i.inflight.Enabled(ctx) {
 		return
 	}
 	i.inflight.Add(ctx, count, metric.WithAttributes(attrs...))
@@ -865,8 +871,12 @@ var (
 )
 
 func (i *instrumentation) record(ctx context.Context, value int64, baseAttrs ...attribute.KeyValue) {
+    if !i.counter.Enabled(ctx) {
+        return
+    }
     attrs := attrPool.Get().(*[]attribute.KeyValue)
     defer func() {
+		clear(*attrs)         // Clear references to strings/etc to let GC collect them.
         *attrs = (*attrs)[:0] // Reset.
         attrPool.Put(attrs)
     }()
@@ -877,6 +887,7 @@ func (i *instrumentation) record(ctx context.Context, value int64, baseAttrs ...
 
 	addOpt := addOptPool.Get().(*[]metric.AddOption)
 	defer func() {
+		clear(*addOpt)
 		*addOpt = (*addOpt)[:0]
 		addOptPool.Put(addOpt)
 	}()
@@ -1007,16 +1018,20 @@ Ensure observability measurements receive the correct context, especially for tr
 ```go
 func (e *Exporter) ExportSpans(ctx context.Context, spans []trace.ReadOnlySpan) error {
     // Use the provided context for observability measurements
-    e.inst.recordSpanExportStarted(ctx, len(spans))
+    if e.inst.Enabled(ctx) {
+        e.inst.recordSpanExportStarted(ctx, len(spans))
+    }
  
     err := e.doExport(ctx, spans)
 
-    if err != nil {
-        e.inst.recordSpanExportFailed(ctx, len(spans), err)
-    } else {
-        e.inst.recordSpanExportSucceeded(ctx, len(spans))
+    if e.inst.Enabled(ctx) {
+        if err != nil {
+            e.inst.recordSpanExportFailed(ctx, len(spans), err)
+        } else {
+            e.inst.recordSpanExportSucceeded(ctx, len(spans))
+        }
     }
- 
+
     return err
 }
 ```
@@ -1039,7 +1054,7 @@ func (e *Exporter) ExportSpans(ctx context.Context, spans []trace.ReadOnlySpan)
 
 All observability metrics should follow the [OpenTelemetry Semantic Conventions for SDK metrics](https://github.com/open-telemetry/semantic-conventions/blob/1cf2476ae5e518225a766990a28a6d5602bd5a30/docs/otel/sdk-metrics.md).
 
-Use the metric semantic conventions convenience package [otelconv](./semconv/v1.40.0/otelconv/metric.go).
+Use the metric semantic conventions convenience package [otelconv](./semconv/v1.41.0/otelconv/metric.go).
 
 ##### Component Identification
 
@@ -1109,6 +1124,68 @@ func TestObservability(t *testing.T) {
 Test order should not affect results.
 Ensure that any global state (e.g. component ID counters) is reset between tests.
 
+### Experimental Features
+
+To support the development of new features in the specification, we use the following patterns to implement in-development features without adding new public artifacts in stable modules.
+
+#### Experimental behavior with no API artifacts
+
+Features that change behavior without changing the API (e.g., exemplar collection, auto-generation of identifiers) are implemented behind a feature gate.
+The implementation resides in an `/internal/x` package and is activated through environment variables with the `OTEL_GO_X_` prefix (e.g., `OTEL_GO_X_OBSERVABILITY`).
+The feature must be documented in a `README.md` file in the `/internal/x` package.
+
+#### Experimental methods on SDK-only interfaces
+
+Features that require new methods on SDK interfaces are defined as a new interface in an experimental module (e.g., `go.opentelemetry.io/otel/sdk/x`).
+The SDK uses type assertions (without importing the unstable package) to check if passing types implement these experimental interfaces.
+The SDK must not depend on the experimental module.
+
+#### Experimental structs, functions, or interfaces
+
+Features that don't need any changes to the existing stable package are implemented in an experimental module (e.g., `go.opentelemetry.io/otel/sdk/x`).
+
+#### Experimental signals and components
+
+New telemetry signals (e.g., Logs before stabilization) and components (e.g. bridges) are hosted in new, unstable modules (e.g., `go.opentelemetry.io/otel/log` before 1.0.0).
+The package should have the final name it will use once stabilized (i.e. not `/x`), and is released at a v0.x.y version to indicate it is not stable.
+Most new components are hosted in [opentelemetry-go-contrib](https://github.com/open-telemetry/opentelemetry-go-contrib).
+
+#### Experimental options for API or SDK functions
+
+Experimental Options functions are implemented in an experimental module (e.g., `go.opentelemetry.io/otel/sdk/x`).
+The return type of the Option function must embed the option's type (e.g. `metric.InstrumentOption`), and have an `Experimental()` method to prevent the API from panicking when the option is used.
+The SDK uses type assertions (without importing the unstable package) to check if passing types implement these experimental interfaces.
+The SDK must not depend on the experimental module.
+
+For example:
+
+```go
+type myOption struct {
+    // Embed the stable option type.
+    metric.InstrumentOption
+    value string
+}
+
+// Experimental prevents the API from panicking when the option is used.
+func (o myOption) Experimental() {}
+
+// The SDK can use type assertions to use this function.
+func (o myOption) Value() string { return o.value }
+
+func WithMyOption(value string) metric.InstrumentOption {
+    return myOption{value: value}
+}
+```
+
+#### Not Supported
+
+The following kinds of experimental features are **not currently supported** on stable interfaces:
+
+- Experimental methods on API interfaces
+- Experimental fields for API or SDK exported structs
+
+In some cases forks or long-lived branches may be used for prototyping these features.
+
 ## Approvers and Maintainers
 
 ### Maintainers
diff --git a/vendor/go.opentelemetry.io/otel/Makefile b/vendor/go.opentelemetry.io/otel/Makefile
index 42466f2d6..de63a5e9b 100644
--- a/vendor/go.opentelemetry.io/otel/Makefile
+++ b/vendor/go.opentelemetry.io/otel/Makefile
@@ -191,8 +191,16 @@ benchmark: $(OTEL_GO_MOD_DIRS:%=benchmark/%)
 benchmark/%:
 	cd $* && $(GO) test -run='^$$' -bench=. $(ARGS) ./...
 
+# sdk/metric is split into two shards to work around CodSpeed limitations.
+# See https://github.com/CodSpeedHQ/codspeed-go/issues/56
+BENCHMARK_SHARDS := $(filter-out ./sdk/metric,$(OTEL_GO_MOD_DIRS)) ./sdk/metric/root ./sdk/metric/internal
+benchmark/./sdk/metric/root:
+	cd ./sdk/metric && $(GO) test -run='^$$' -bench=. $(ARGS) . ./exemplar/...
+benchmark/./sdk/metric/internal:
+	cd ./sdk/metric && $(GO) test -run='^$$' -bench=. $(ARGS) ./internal/...
+
 print-sharded-benchmarks:
-	@echo $(OTEL_GO_MOD_DIRS) | jq -cR 'split(" ")'
+	@echo $(BENCHMARK_SHARDS) | jq -cR 'split(" ")'
 
 .PHONY: golangci-lint golangci-lint-fix
 golangci-lint-fix: ARGS=--fix
diff --git a/vendor/go.opentelemetry.io/otel/attribute/encoder.go b/vendor/go.opentelemetry.io/otel/attribute/encoder.go
index 771dd69c5..ca186d8ac 100644
--- a/vendor/go.opentelemetry.io/otel/attribute/encoder.go
+++ b/vendor/go.opentelemetry.io/otel/attribute/encoder.go
@@ -105,7 +105,9 @@ func (d *defaultAttrEncoder) Encode(iter Iterator) string {
 		if keyValue.Value.Type() == STRING {
 			copyAndEscape(buf, keyValue.Value.AsString())
 		} else {
-			_, _ = buf.WriteString(keyValue.Value.Emit())
+			_, _ = buf.WriteString(
+				keyValue.Value.Emit(),
+			) //nolint:staticcheck // Preserve the existing default encoder output.
 		}
 	}
 	return buf.String()
diff --git a/vendor/go.opentelemetry.io/otel/attribute/hash.go b/vendor/go.opentelemetry.io/otel/attribute/hash.go
index b09caaa6d..92f39ffe7 100644
--- a/vendor/go.opentelemetry.io/otel/attribute/hash.go
+++ b/vendor/go.opentelemetry.io/otel/attribute/hash.go
@@ -27,6 +27,8 @@ const (
 	int64SliceID   uint64 = 3762322556277578591 // "_[]int64" (little endian)
 	float64SliceID uint64 = 7308324551835016539 // "[]double" (little endian)
 	stringSliceID  uint64 = 7453010373645655387 // "[]string" (little endian)
+	byteSliceID    uint64 = 6874028470941080415 // "_[]byte_" (little endian)
+	sliceID        uint64 = 7883494272577650031 // "__slice_" (little endian)
 	emptyID        uint64 = 7305809155345288421 // "__empty_" (little endian)
 )
 
@@ -42,53 +44,87 @@ func hashKVs(kvs []KeyValue) uint64 {
 // hashKV returns the xxHash64 hash of kv with h as the base.
 func hashKV(h xxhash.Hash, kv KeyValue) xxhash.Hash {
 	h = h.String(string(kv.Key))
+	return hashValue(h, kv.Value)
+}
 
-	switch kv.Value.Type() {
+func hashValue(h xxhash.Hash, v Value) xxhash.Hash {
+	switch v.Type() {
 	case BOOL:
 		h = h.Uint64(boolID)
-		h = h.Uint64(kv.Value.numeric)
+		h = h.Uint64(v.numeric)
 	case INT64:
 		h = h.Uint64(int64ID)
-		h = h.Uint64(kv.Value.numeric)
+		h = h.Uint64(v.numeric)
 	case FLOAT64:
 		h = h.Uint64(float64ID)
 		// Assumes numeric stored with math.Float64bits.
-		h = h.Uint64(kv.Value.numeric)
+		h = h.Uint64(v.numeric)
 	case STRING:
 		h = h.Uint64(stringID)
-		h = h.String(kv.Value.stringly)
+		h = h.String(v.stringly)
 	case BOOLSLICE:
 		h = h.Uint64(boolSliceID)
-		rv := reflect.ValueOf(kv.Value.slice)
+		rv := reflect.ValueOf(v.slice)
 		for i := 0; i < rv.Len(); i++ {
 			h = h.Bool(rv.Index(i).Bool())
 		}
 	case INT64SLICE:
 		h = h.Uint64(int64SliceID)
-		rv := reflect.ValueOf(kv.Value.slice)
+		rv := reflect.ValueOf(v.slice)
 		for i := 0; i < rv.Len(); i++ {
 			h = h.Int64(rv.Index(i).Int())
 		}
 	case FLOAT64SLICE:
 		h = h.Uint64(float64SliceID)
-		rv := reflect.ValueOf(kv.Value.slice)
+		rv := reflect.ValueOf(v.slice)
 		for i := 0; i < rv.Len(); i++ {
 			h = h.Float64(rv.Index(i).Float())
 		}
 	case STRINGSLICE:
 		h = h.Uint64(stringSliceID)
-		rv := reflect.ValueOf(kv.Value.slice)
+		rv := reflect.ValueOf(v.slice)
 		for i := 0; i < rv.Len(); i++ {
 			h = h.String(rv.Index(i).String())
 		}
+	case BYTESLICE:
+		h = h.Uint64(byteSliceID)
+		h = h.String(v.stringly)
+	case SLICE:
+		h = h.Uint64(sliceID)
+		switch vals := v.slice.(type) {
+		case [0]Value:
+			// No values to hash, but the type identifier is still hashed above.
+		case [1]Value:
+			h = hashValueSlice(h, vals[:])
+		case [2]Value:
+			h = hashValueSlice(h, vals[:])
+		case [3]Value:
+			h = hashValueSlice(h, vals[:])
+		case [4]Value:
+			h = hashValueSlice(h, vals[:])
+		case [5]Value:
+			h = hashValueSlice(h, vals[:])
+		default:
+			rv := reflect.ValueOf(v.slice)
+			for i := 0; i < rv.Len(); i++ {
+				h = hashValue(h, rv.Index(i).Interface().(Value))
+			}
+		}
 	case EMPTY:
 		h = h.Uint64(emptyID)
 	default:
 		// Logging is an alternative, but using the internal logger here
 		// causes an import cycle so it is not done.
-		v := kv.Value.AsInterface()
-		msg := fmt.Sprintf("unknown value type: %[1]v (%[1]T)", v)
+		val := v.AsInterface()
+		msg := fmt.Sprintf("unknown value type: %[1]v (%[1]T)", val)
 		panic(msg)
 	}
 	return h
 }
+
+func hashValueSlice(h xxhash.Hash, vals []Value) xxhash.Hash {
+	for _, v := range vals {
+		h = hashValue(h, v)
+	}
+	return h
+}
diff --git a/vendor/go.opentelemetry.io/otel/attribute/key.go b/vendor/go.opentelemetry.io/otel/attribute/key.go
index 80a9e5643..cdc7089e8 100644
--- a/vendor/go.opentelemetry.io/otel/attribute/key.go
+++ b/vendor/go.opentelemetry.io/otel/attribute/key.go
@@ -117,6 +117,28 @@ func (k Key) StringSlice(v []string) KeyValue {
 	}
 }
 
+// ByteSlice creates a KeyValue instance with a BYTESLICE Value.
+//
+// If creating both a key and value at the same time, use the provided
+// convenience function instead -- ByteSlice(name, value).
+func (k Key) ByteSlice(v []byte) KeyValue {
+	return KeyValue{
+		Key:   k,
+		Value: ByteSliceValue(v),
+	}
+}
+
+// Slice creates a KeyValue instance with a SLICE Value.
+//
+// If creating both a key and value at the same time, use the provided
+// convenience function instead -- Slice(name, values...).
+func (k Key) Slice(v ...Value) KeyValue {
+	return KeyValue{
+		Key:   k,
+		Value: SliceValue(v...),
+	}
+}
+
 // Defined reports whether the key is not empty.
 func (k Key) Defined() bool {
 	return len(k) != 0
diff --git a/vendor/go.opentelemetry.io/otel/attribute/kv.go b/vendor/go.opentelemetry.io/otel/attribute/kv.go
index 0cc368018..eeb76a134 100644
--- a/vendor/go.opentelemetry.io/otel/attribute/kv.go
+++ b/vendor/go.opentelemetry.io/otel/attribute/kv.go
@@ -68,6 +68,16 @@ func StringSlice(k string, v []string) KeyValue {
 	return Key(k).StringSlice(v)
 }
 
+// ByteSlice creates a KeyValue with a BYTESLICE Value type.
+func ByteSlice(k string, v []byte) KeyValue {
+	return Key(k).ByteSlice(v)
+}
+
+// Slice creates a KeyValue with a SLICE Value type.
+func Slice(k string, v ...Value) KeyValue {
+	return Key(k).Slice(v...)
+}
+
 // Stringer creates a new key-value pair with a passed name and a string
 // value generated by the passed Stringer interface.
 func Stringer(k string, v fmt.Stringer) KeyValue {
diff --git a/vendor/go.opentelemetry.io/otel/attribute/set.go b/vendor/go.opentelemetry.io/otel/attribute/set.go
index 6572c98b1..a4b6ce81d 100644
--- a/vendor/go.opentelemetry.io/otel/attribute/set.go
+++ b/vendor/go.opentelemetry.io/otel/attribute/set.go
@@ -401,7 +401,7 @@ func computeDataFixed(kvs []KeyValue) any {
 func computeDataReflect(kvs []KeyValue) any {
 	at := reflect.New(reflect.ArrayOf(len(kvs), keyValueType)).Elem()
 	for i, keyValue := range kvs {
-		*(at.Index(i).Addr().Interface().(*KeyValue)) = keyValue
+		*at.Index(i).Addr().Interface().(*KeyValue) = keyValue
 	}
 	return at.Interface()
 }
@@ -415,7 +415,7 @@ func (l *Set) MarshalJSON() ([]byte, error) {
 func (l Set) MarshalLog() any {
 	kvs := make(map[string]string)
 	for _, kv := range l.ToSlice() {
-		kvs[string(kv.Key)] = kv.Value.Emit()
+		kvs[string(kv.Key)] = kv.Value.String()
 	}
 	return kvs
 }
diff --git a/vendor/go.opentelemetry.io/otel/attribute/type_string.go b/vendor/go.opentelemetry.io/otel/attribute/type_string.go
index 6c04448d6..dbc01d324 100644
--- a/vendor/go.opentelemetry.io/otel/attribute/type_string.go
+++ b/vendor/go.opentelemetry.io/otel/attribute/type_string.go
@@ -17,11 +17,13 @@ func _() {
 	_ = x[INT64SLICE-6]
 	_ = x[FLOAT64SLICE-7]
 	_ = x[STRINGSLICE-8]
+	_ = x[BYTESLICE-9]
+	_ = x[SLICE-10]
 }
 
-const _Type_name = "EMPTYBOOLINT64FLOAT64STRINGBOOLSLICEINT64SLICEFLOAT64SLICESTRINGSLICE"
+const _Type_name = "EMPTYBOOLINT64FLOAT64STRINGBOOLSLICEINT64SLICEFLOAT64SLICESTRINGSLICEBYTESLICESLICE"
 
-var _Type_index = [...]uint8{0, 5, 9, 14, 21, 27, 36, 46, 58, 69}
+var _Type_index = [...]uint8{0, 5, 9, 14, 21, 27, 36, 46, 58, 69, 78, 83}
 
 func (i Type) String() string {
 	idx := int(i) - 0
diff --git a/vendor/go.opentelemetry.io/otel/attribute/value.go b/vendor/go.opentelemetry.io/otel/attribute/value.go
index db04b1326..0529fefae 100644
--- a/vendor/go.opentelemetry.io/otel/attribute/value.go
+++ b/vendor/go.opentelemetry.io/otel/attribute/value.go
@@ -4,9 +4,14 @@
 package attribute // import "go.opentelemetry.io/otel/attribute"
 
 import (
+	"encoding/base64"
 	"encoding/json"
 	"fmt"
+	"math"
+	"reflect"
 	"strconv"
+	"strings"
+	"unicode/utf8"
 
 	attribute "go.opentelemetry.io/otel/attribute/internal"
 )
@@ -45,6 +50,10 @@ const (
 	FLOAT64SLICE
 	// STRINGSLICE is a slice of strings Type Value.
 	STRINGSLICE
+	// BYTESLICE is a slice of bytes Type Value.
+	BYTESLICE
+	// SLICE is a slice of Value Type values.
+	SLICE
 	// INVALID is used for a Value with no value set.
 	//
 	// Deprecated: Use EMPTY instead as an empty value is a valid value.
@@ -134,6 +143,19 @@ func StringSliceValue(v []string) Value {
 	return Value{vtype: STRINGSLICE, slice: attribute.SliceValue(v)}
 }
 
+// ByteSliceValue creates a BYTESLICE Value.
+func ByteSliceValue(v []byte) Value {
+	return Value{
+		vtype:    BYTESLICE,
+		stringly: string(v),
+	}
+}
+
+// SliceValue creates a SLICE Value.
+func SliceValue(v ...Value) Value {
+	return Value{vtype: SLICE, slice: sliceValue(v)}
+}
+
 // Type returns a type of the Value.
 func (v Value) Type() Type {
 	return v.vtype
@@ -215,6 +237,59 @@ func (v Value) asStringSlice() []string {
 	return attribute.AsSlice[string](v.slice)
 }
 
+// AsSlice returns the []Value value. Make sure that the Value's type is
+// SLICE.
+func (v Value) AsSlice() []Value {
+	if v.vtype != SLICE {
+		return nil
+	}
+	return v.asSlice()
+}
+
+func (v Value) asSlice() []Value {
+	switch vals := v.slice.(type) {
+	case [0]Value:
+		return []Value{}
+	case [1]Value:
+		return []Value{vals[0]}
+	case [2]Value:
+		return []Value{vals[0], vals[1]}
+	case [3]Value:
+		return []Value{vals[0], vals[1], vals[2]}
+	case [4]Value:
+		return []Value{vals[0], vals[1], vals[2], vals[3]}
+	case [5]Value:
+		return []Value{vals[0], vals[1], vals[2], vals[3], vals[4]}
+	default:
+		return asValueSliceReflect(v.slice)
+	}
+}
+
+func asValueSliceReflect(v any) []Value {
+	rv := reflect.ValueOf(v)
+	if !rv.IsValid() || rv.Kind() != reflect.Array || rv.Type().Elem() != reflect.TypeFor[Value]() {
+		return nil
+	}
+	cpy := make([]Value, rv.Len())
+	if len(cpy) > 0 {
+		_ = reflect.Copy(reflect.ValueOf(cpy), rv)
+	}
+	return cpy
+}
+
+// AsByteSlice returns the bytes value. Make sure that the Value's type
+// is BYTESLICE.
+func (v Value) AsByteSlice() []byte {
+	if v.vtype != BYTESLICE {
+		return nil
+	}
+	return v.asByteSlice()
+}
+
+func (v Value) asByteSlice() []byte {
+	return []byte(v.stringly)
+}
+
 type unknownValueType struct{}
 
 // AsInterface returns Value's data as any.
@@ -236,13 +311,60 @@ func (v Value) AsInterface() any {
 		return v.stringly
 	case STRINGSLICE:
 		return v.asStringSlice()
+	case BYTESLICE:
+		return v.asByteSlice()
+	case SLICE:
+		return v.asSlice()
 	case EMPTY:
 		return nil
 	}
 	return unknownValueType{}
 }
 
+// String returns a string representation of Value using the
+// [OpenTelemetry AnyValue representation for non-OTLP protocols] rules.
+//
+// Strings are returned as-is without JSON quoting, booleans and integers use
+// JSON literals, floating-point values use JSON numbers except that NaN and
+// ±Inf are rendered as NaN, Infinity, and -Infinity, byte slices are
+// base64-encoded, empty values are the empty string, and slices are encoded as
+// JSON arrays. String, byte, and special floating-point values inside arrays
+// are encoded as JSON strings, and empty values inside arrays are encoded as
+// null.
+//
+// [OpenTelemetry AnyValue representation for non-OTLP protocols]: https://opentelemetry.io/docs/specs/otel/common/#anyvalue-representation-for-non-otlp-protocols
+func (v Value) String() string {
+	switch v.Type() {
+	case BOOL:
+		return strconv.FormatBool(v.AsBool())
+	case BOOLSLICE:
+		return formatBoolSliceValue(v.slice)
+	case INT64:
+		return strconv.FormatInt(v.AsInt64(), 10)
+	case INT64SLICE:
+		return formatInt64SliceValue(v.slice)
+	case FLOAT64:
+		return formatFloat64(v.AsFloat64())
+	case FLOAT64SLICE:
+		return formatFloat64SliceValue(v.slice)
+	case STRING:
+		return v.stringly
+	case STRINGSLICE:
+		return formatStringSliceValue(v.slice)
+	case BYTESLICE:
+		return formatByteSlice(v.stringly)
+	case SLICE:
+		return formatValueSliceValue(v.slice)
+	case EMPTY:
+		return ""
+	default:
+		return "unknown"
+	}
+}
+
 // Emit returns a string representation of Value's data.
+//
+// Deprecated: Use [Value.String] instead.
 func (v Value) Emit() string {
 	switch v.Type() {
 	case BOOLSLICE:
@@ -273,6 +395,10 @@ func (v Value) Emit() string {
 		return string(j)
 	case STRING:
 		return v.stringly
+	case BYTESLICE:
+		return formatByteSlice(v.stringly)
+	case SLICE:
+		return formatValueSliceValue(v.slice)
 	case EMPTY:
 		return ""
 	default:
@@ -280,6 +406,622 @@ func (v Value) Emit() string {
 	}
 }
 
+const (
+	jsonArrayBracketsLen   = len("[]")
+	boolArrayElemMaxLen    = len("false")
+	int64ArrayElemMaxLen   = len("-9223372036854775808")
+	float64ArrayElemMaxLen = len("-1.7976931348623157e+308")
+	commaLen               = len(",")
+)
+
+func sliceValue(v []Value) any {
+	switch len(v) {
+	case 0:
+		return [0]Value{}
+	case 1:
+		return [1]Value{v[0]}
+	case 2:
+		return [2]Value{v[0], v[1]}
+	case 3:
+		return [3]Value{v[0], v[1], v[2]}
+	case 4:
+		return [4]Value{v[0], v[1], v[2], v[3]}
+	case 5:
+		return [5]Value{v[0], v[1], v[2], v[3], v[4]}
+	default:
+		return sliceValueReflect(v)
+	}
+}
+
+func sliceValueReflect(v []Value) any {
+	cp := reflect.New(reflect.ArrayOf(len(v), reflect.TypeFor[Value]())).Elem()
+	reflect.Copy(cp, reflect.ValueOf(v))
+	return cp.Interface()
+}
+
+func formatBoolSliceValue(v any) string {
+	switch vals := v.(type) {
+	case [0]bool:
+		return "[]"
+	case [1]bool:
+		return formatBoolSlice(vals[:])
+	case [2]bool:
+		return formatBoolSlice(vals[:])
+	case [3]bool:
+		return formatBoolSlice(vals[:])
+	default:
+		return formatBoolSliceReflect(v)
+	}
+}
+
+func formatBoolSlice(vals []bool) string {
+	var b strings.Builder
+	appendBoolSlice(&b, vals)
+	return b.String()
+}
+
+func formatBoolSliceReflect(v any) string {
+	var b strings.Builder
+	appendBoolSliceReflect(&b, reflect.ValueOf(v))
+	return b.String()
+}
+
+func appendBoolSliceValue(dst *strings.Builder, v any) {
+	switch vals := v.(type) {
+	case [0]bool:
+		_, _ = dst.WriteString("[]")
+	case [1]bool:
+		appendBoolSlice(dst, vals[:])
+	case [2]bool:
+		appendBoolSlice(dst, vals[:])
+	case [3]bool:
+		appendBoolSlice(dst, vals[:])
+	default:
+		appendBoolSliceReflect(dst, reflect.ValueOf(v))
+	}
+}
+
+func appendBoolSlice(dst *strings.Builder, vals []bool) {
+	dst.Grow(jsonArrayBracketsLen + len(vals)*(boolArrayElemMaxLen+commaLen))
+	_ = dst.WriteByte('[')
+	for i, val := range vals {
+		if i > 0 {
+			_ = dst.WriteByte(',')
+		}
+		if val {
+			_, _ = dst.WriteString("true")
+		} else {
+			_, _ = dst.WriteString("false")
+		}
+	}
+	_ = dst.WriteByte(']')
+}
+
+func appendBoolSliceReflect(dst *strings.Builder, rv reflect.Value) {
+	dst.Grow(jsonArrayBracketsLen + rv.Len()*(boolArrayElemMaxLen+commaLen))
+	_ = dst.WriteByte('[')
+	for i := 0; i < rv.Len(); i++ {
+		if i > 0 {
+			_ = dst.WriteByte(',')
+		}
+		if rv.Index(i).Bool() {
+			_, _ = dst.WriteString("true")
+		} else {
+			_, _ = dst.WriteString("false")
+		}
+	}
+	_ = dst.WriteByte(']')
+}
+
+func formatInt64SliceValue(v any) string {
+	switch vals := v.(type) {
+	case [0]int64:
+		return "[]"
+	case [1]int64:
+		return formatInt64Slice(vals[:])
+	case [2]int64:
+		return formatInt64Slice(vals[:])
+	case [3]int64:
+		return formatInt64Slice(vals[:])
+	default:
+		return formatInt64SliceReflect(v)
+	}
+}
+
+func formatInt64Slice(vals []int64) string {
+	var b strings.Builder
+	appendInt64Slice(&b, vals)
+	return b.String()
+}
+
+func formatInt64SliceReflect(v any) string {
+	var b strings.Builder
+	appendInt64SliceReflect(&b, reflect.ValueOf(v))
+	return b.String()
+}
+
+func appendInt64SliceValue(dst *strings.Builder, v any) {
+	switch vals := v.(type) {
+	case [0]int64:
+		_, _ = dst.WriteString("[]")
+	case [1]int64:
+		appendInt64Slice(dst, vals[:])
+	case [2]int64:
+		appendInt64Slice(dst, vals[:])
+	case [3]int64:
+		appendInt64Slice(dst, vals[:])
+	default:
+		appendInt64SliceReflect(dst, reflect.ValueOf(v))
+	}
+}
+
+func appendInt64Slice(dst *strings.Builder, vals []int64) {
+	dst.Grow(jsonArrayBracketsLen + len(vals)*(int64ArrayElemMaxLen+commaLen))
+	_ = dst.WriteByte('[')
+
+	var buf [int64ArrayElemMaxLen]byte
+	for i, val := range vals {
+		if i > 0 {
+			_ = dst.WriteByte(',')
+		}
+		out := strconv.AppendInt(buf[:0], val, 10)
+		_, _ = dst.Write(out)
+	}
+
+	_ = dst.WriteByte(']')
+}
+
+func appendInt64SliceReflect(dst *strings.Builder, rv reflect.Value) {
+	dst.Grow(jsonArrayBracketsLen + rv.Len()*(int64ArrayElemMaxLen+commaLen))
+	_ = dst.WriteByte('[')
+
+	var scratch [int64ArrayElemMaxLen]byte
+	for i := 0; i < rv.Len(); i++ {
+		if i > 0 {
+			_ = dst.WriteByte(',')
+		}
+		out := strconv.AppendInt(scratch[:0], rv.Index(i).Int(), 10)
+		_, _ = dst.Write(out)
+	}
+
+	_ = dst.WriteByte(']')
+}
+
+func formatFloat64(v float64) string {
+	switch {
+	case math.IsNaN(v):
+		return "NaN"
+	case math.IsInf(v, 1):
+		return "Infinity"
+	case math.IsInf(v, -1):
+		return "-Infinity"
+	default:
+		return strconv.FormatFloat(v, 'g', -1, 64)
+	}
+}
+
+func formatFloat64SliceValue(v any) string {
+	switch vals := v.(type) {
+	case [0]float64:
+		return "[]"
+	case [1]float64:
+		return formatFloat64Slice(vals[:])
+	case [2]float64:
+		return formatFloat64Slice(vals[:])
+	case [3]float64:
+		return formatFloat64Slice(vals[:])
+	default:
+		return formatFloat64SliceReflect(v)
+	}
+}
+
+func formatFloat64Slice(vals []float64) string {
+	var b strings.Builder
+	appendFloat64Slice(&b, vals)
+	return b.String()
+}
+
+func formatFloat64SliceReflect(v any) string {
+	var b strings.Builder
+	appendFloat64SliceReflect(&b, reflect.ValueOf(v))
+	return b.String()
+}
+
+func appendFloat64SliceValue(dst *strings.Builder, v any) {
+	switch vals := v.(type) {
+	case [0]float64:
+		_, _ = dst.WriteString("[]")
+	case [1]float64:
+		appendFloat64Slice(dst, vals[:])
+	case [2]float64:
+		appendFloat64Slice(dst, vals[:])
+	case [3]float64:
+		appendFloat64Slice(dst, vals[:])
+	default:
+		appendFloat64SliceReflect(dst, reflect.ValueOf(v))
+	}
+}
+
+func appendFloat64Slice(dst *strings.Builder, vals []float64) {
+	dst.Grow(jsonArrayBracketsLen + len(vals)*(float64ArrayElemMaxLen+commaLen))
+	_ = dst.WriteByte('[')
+
+	var buf [float64ArrayElemMaxLen]byte
+	for i, val := range vals {
+		if i > 0 {
+			_ = dst.WriteByte(',')
+		}
+
+		switch {
+		case math.IsNaN(val):
+			_, _ = dst.WriteString(`"NaN"`)
+		case math.IsInf(val, 1):
+			_, _ = dst.WriteString(`"Infinity"`)
+		case math.IsInf(val, -1):
+			_, _ = dst.WriteString(`"-Infinity"`)
+		default:
+			out := strconv.AppendFloat(buf[:0], val, 'g', -1, 64)
+			_, _ = dst.Write(out)
+		}
+	}
+
+	_ = dst.WriteByte(']')
+}
+
+func appendFloat64SliceReflect(dst *strings.Builder, rv reflect.Value) {
+	dst.Grow(jsonArrayBracketsLen + rv.Len()*(float64ArrayElemMaxLen+commaLen))
+	_ = dst.WriteByte('[')
+
+	var scratch [float64ArrayElemMaxLen]byte
+	for i := 0; i < rv.Len(); i++ {
+		if i > 0 {
+			_ = dst.WriteByte(',')
+		}
+		val := rv.Index(i).Float()
+		switch {
+		case math.IsNaN(val):
+			_, _ = dst.WriteString(`"NaN"`)
+		case math.IsInf(val, 1):
+			_, _ = dst.WriteString(`"Infinity"`)
+		case math.IsInf(val, -1):
+			_, _ = dst.WriteString(`"-Infinity"`)
+		default:
+			out := strconv.AppendFloat(scratch[:0], val, 'g', -1, 64)
+			_, _ = dst.Write(out)
+		}
+	}
+
+	_ = dst.WriteByte(']')
+}
+
+func formatStringSliceValue(v any) string {
+	switch vals := v.(type) {
+	case [0]string:
+		return "[]"
+	case [1]string:
+		return formatStringSlice(vals[:])
+	case [2]string:
+		return formatStringSlice(vals[:])
+	case [3]string:
+		return formatStringSlice(vals[:])
+	default:
+		return formatStringSliceReflect(v)
+	}
+}
+
+func formatStringSlice(vals []string) string {
+	var b strings.Builder
+	appendStringSlice(&b, vals)
+	return b.String()
+}
+
+func formatStringSliceReflect(v any) string {
+	var b strings.Builder
+	appendStringSliceReflect(&b, reflect.ValueOf(v))
+	return b.String()
+}
+
+func appendStringSliceValue(dst *strings.Builder, v any) {
+	switch vals := v.(type) {
+	case [0]string:
+		_, _ = dst.WriteString("[]")
+	case [1]string:
+		appendStringSlice(dst, vals[:])
+	case [2]string:
+		appendStringSlice(dst, vals[:])
+	case [3]string:
+		appendStringSlice(dst, vals[:])
+	default:
+		appendStringSliceReflect(dst, reflect.ValueOf(v))
+	}
+}
+
+func appendStringSlice(dst *strings.Builder, vals []string) {
+	size := jsonArrayBracketsLen
+	for _, val := range vals {
+		size += len(val) + commaLen + 2 // Account for JSON string quotes and comma.
+	}
+
+	dst.Grow(size)
+	_ = dst.WriteByte('[')
+	for i, val := range vals {
+		if i > 0 {
+			_ = dst.WriteByte(',')
+		}
+		appendJSONString(dst, val)
+	}
+	_ = dst.WriteByte(']')
+}
+
+func appendStringSliceReflect(dst *strings.Builder, rv reflect.Value) {
+	size := jsonArrayBracketsLen
+	for i := 0; i < rv.Len(); i++ {
+		size += len(rv.Index(i).String()) + commaLen + 2 // Account for JSON string quotes and comma.
+	}
+
+	dst.Grow(size)
+	_ = dst.WriteByte('[')
+	for i := 0; i < rv.Len(); i++ {
+		if i > 0 {
+			_ = dst.WriteByte(',')
+		}
+		appendJSONString(dst, rv.Index(i).String())
+	}
+	_ = dst.WriteByte(']')
+}
+
+func formatByteSlice(v string) string {
+	var b strings.Builder
+	appendBase64(&b, v)
+	return b.String()
+}
+
+func formatValueSliceValue(v any) string {
+	switch vals := v.(type) {
+	case [0]Value:
+		return "[]"
+	case [1]Value:
+		return formatValueSlice(vals[:])
+	case [2]Value:
+		return formatValueSlice(vals[:])
+	case [3]Value:
+		return formatValueSlice(vals[:])
+	case [4]Value:
+		return formatValueSlice(vals[:])
+	case [5]Value:
+		return formatValueSlice(vals[:])
+	default:
+		return formatValueSliceReflect(v)
+	}
+}
+
+func formatValueSlice(vals []Value) string {
+	var b strings.Builder
+	appendValueSlice(&b, vals)
+	return b.String()
+}
+
+func formatValueSliceReflect(v any) string {
+	var b strings.Builder
+	appendValueSliceReflect(&b, reflect.ValueOf(v))
+	return b.String()
+}
+
+func appendValueSliceValue(dst *strings.Builder, v any) {
+	switch vals := v.(type) {
+	case [0]Value:
+		_, _ = dst.WriteString("[]")
+	case [1]Value:
+		appendValueSlice(dst, vals[:])
+	case [2]Value:
+		appendValueSlice(dst, vals[:])
+	case [3]Value:
+		appendValueSlice(dst, vals[:])
+	case [4]Value:
+		appendValueSlice(dst, vals[:])
+	case [5]Value:
+		appendValueSlice(dst, vals[:])
+	default:
+		appendValueSliceReflect(dst, reflect.ValueOf(v))
+	}
+}
+
+func appendValueSlice(dst *strings.Builder, vals []Value) {
+	// Estimate 10 bytes per value for small values and commas.
+	dst.Grow(jsonArrayBracketsLen + len(vals)*commaLen + len(vals)*10)
+	_ = dst.WriteByte('[')
+	for i, val := range vals {
+		if i > 0 {
+			_ = dst.WriteByte(',')
+		}
+		appendJSONValue(dst, val)
+	}
+	_ = dst.WriteByte(']')
+}
+
+func appendValueSliceReflect(dst *strings.Builder, rv reflect.Value) {
+	// Estimate 10 bytes per value for small values and commas.
+	dst.Grow(jsonArrayBracketsLen + rv.Len()*commaLen + rv.Len()*10)
+	_ = dst.WriteByte('[')
+	for i := 0; i < rv.Len(); i++ {
+		if i > 0 {
+			_ = dst.WriteByte(',')
+		}
+		appendJSONValue(dst, rv.Index(i).Interface().(Value))
+	}
+	_ = dst.WriteByte(']')
+}
+
+func appendJSONValue(dst *strings.Builder, v Value) {
+	switch v.Type() {
+	case BOOL:
+		if v.AsBool() {
+			_, _ = dst.WriteString("true")
+		} else {
+			_, _ = dst.WriteString("false")
+		}
+	case BOOLSLICE:
+		appendBoolSliceValue(dst, v.slice)
+	case INT64:
+		var buf [int64ArrayElemMaxLen]byte
+		out := strconv.AppendInt(buf[:0], v.AsInt64(), 10)
+		_, _ = dst.Write(out)
+	case INT64SLICE:
+		appendInt64SliceValue(dst, v.slice)
+	case FLOAT64:
+		val := v.AsFloat64()
+		switch {
+		case math.IsNaN(val):
+			appendJSONString(dst, "NaN")
+		case math.IsInf(val, 1):
+			appendJSONString(dst, "Infinity")
+		case math.IsInf(val, -1):
+			appendJSONString(dst, "-Infinity")
+		default:
+			var buf [float64ArrayElemMaxLen]byte
+			out := strconv.AppendFloat(buf[:0], val, 'g', -1, 64)
+			_, _ = dst.Write(out)
+		}
+	case FLOAT64SLICE:
+		appendFloat64SliceValue(dst, v.slice)
+	case STRING:
+		appendJSONString(dst, v.stringly)
+	case STRINGSLICE:
+		appendStringSliceValue(dst, v.slice)
+	case BYTESLICE:
+		_ = dst.WriteByte('"')
+		appendBase64(dst, v.stringly)
+		_ = dst.WriteByte('"')
+	case SLICE:
+		appendValueSliceValue(dst, v.slice)
+	case EMPTY:
+		_, _ = dst.WriteString("null")
+	default:
+		appendJSONString(dst, "unknown")
+	}
+}
+
+// appendJSONString appends s to dst as a JSON string literal.
+//
+// This is adapted from the Go standard library's encoding/json
+// [appendString implementation]. It keeps the same escaping behavior we need
+// here, but writes directly into a strings.Builder and intentionally does not
+// apply HTML escaping because the OpenTelemetry non-OTLP AnyValue representation
+// only requires JSON array string encoding. We inline this instead of using
+// encoding/json so slice formatting avoids allocations and reflection.
+//
+// [appendString implementation]: https://github.com/golang/go/blob/3b5954c6349d31465dca409b45ab6597e0942d9f/src/encoding/json/encode.go#L998-L1064
+func appendJSONString(dst *strings.Builder, s string) {
+	const hex = "0123456789abcdef" // For escaping bytes to hex.
+
+	_ = dst.WriteByte('"')
+	start := 0
+
+	for i := 0; i < len(s); {
+		if c := s[i]; c < utf8.RuneSelf {
+			if c >= 0x20 && c != '\\' && c != '"' {
+				i++
+				continue
+			}
+
+			if start < i {
+				_, _ = dst.WriteString(s[start:i])
+			}
+
+			switch c {
+			case '\\', '"':
+				_ = dst.WriteByte('\\')
+				_ = dst.WriteByte(c)
+			case '\b':
+				_, _ = dst.WriteString(`\b`)
+			case '\f':
+				_, _ = dst.WriteString(`\f`)
+			case '\n':
+				_, _ = dst.WriteString(`\n`)
+			case '\r':
+				_, _ = dst.WriteString(`\r`)
+			case '\t':
+				_, _ = dst.WriteString(`\t`)
+			default:
+				_, _ = dst.WriteString(`\u00`)
+				_ = dst.WriteByte(hex[c>>4])
+				_ = dst.WriteByte(hex[c&0x0f])
+			}
+
+			i++
+			start = i
+			continue
+		}
+
+		r, size := utf8.DecodeRuneInString(s[i:])
+		if r == utf8.RuneError && size == 1 {
+			if start < i {
+				_, _ = dst.WriteString(s[start:i])
+			}
+			// Match encoding/json by replacing invalid UTF-8 with U+FFFD.
+			_, _ = dst.WriteString(`\ufffd`)
+			i++
+			start = i
+			continue
+		}
+
+		if r == '\u2028' || r == '\u2029' {
+			if start < i {
+				_, _ = dst.WriteString(s[start:i])
+			}
+			// Escape JSONP-sensitive separators unconditionally, like encoding/json.
+			_, _ = dst.WriteString(`\u202`)
+			_ = dst.WriteByte(hex[r&0x0f])
+			i += size
+			start = i
+			continue
+		}
+
+		i += size
+	}
+
+	if start < len(s) {
+		_, _ = dst.WriteString(s[start:])
+	}
+	_ = dst.WriteByte('"')
+}
+
+// This is adapted from the Go standard library's encoding/base64
+// [Encoding.Encode implementation]. It keeps the same encoding behavior we need
+// here, but writes directly into a strings.Builder. We inline this instead of using
+// encoding/base64 to avoid allocations.
+//
+// [Encoding.Encode implementation]: https://github.com/golang/go/blob/3b5954c6349d31465dca409b45ab6597e0942d9f/src/encoding/base64/base64.go#L139-L189
+func appendBase64(dst *strings.Builder, s string) {
+	const encode = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
+
+	dst.Grow(base64.StdEncoding.EncodedLen(len(s)))
+
+	i := 0
+	for ; i+2 < len(s); i += 3 {
+		n := uint32(s[i])<<16 | uint32(s[i+1])<<8 | uint32(s[i+2])
+		_ = dst.WriteByte(encode[n>>18&0x3f])
+		_ = dst.WriteByte(encode[n>>12&0x3f])
+		_ = dst.WriteByte(encode[n>>6&0x3f])
+		_ = dst.WriteByte(encode[n&0x3f])
+	}
+
+	switch len(s) - i {
+	case 1:
+		n := uint32(s[i]) << 16
+		_ = dst.WriteByte(encode[n>>18&0x3f])
+		_ = dst.WriteByte(encode[n>>12&0x3f])
+		_ = dst.WriteByte('=')
+		_ = dst.WriteByte('=')
+	case 2:
+		n := uint32(s[i])<<16 | uint32(s[i+1])<<8
+		_ = dst.WriteByte(encode[n>>18&0x3f])
+		_ = dst.WriteByte(encode[n>>12&0x3f])
+		_ = dst.WriteByte(encode[n>>6&0x3f])
+		_ = dst.WriteByte('=')
+	}
+}
+
 // MarshalJSON returns the JSON encoding of the Value.
 func (v Value) MarshalJSON() ([]byte, error) {
 	var jsonVal struct {
diff --git a/vendor/go.opentelemetry.io/otel/baggage/baggage.go b/vendor/go.opentelemetry.io/otel/baggage/baggage.go
index 878ffbe43..b290c6d6c 100644
--- a/vendor/go.opentelemetry.io/otel/baggage/baggage.go
+++ b/vendor/go.opentelemetry.io/otel/baggage/baggage.go
@@ -14,6 +14,10 @@ import (
 )
 
 const (
+	maxParseErrors = 5
+
+	// W3C Baggage specification limits.
+	// https://www.w3.org/TR/baggage/#limits
 	maxMembers               = 64
 	maxBytesPerBaggageString = 8192
 
@@ -493,9 +497,15 @@ func New(members ...Member) (Baggage, error) {
 // from the W3C Baggage specification which allows duplicate list-members, but
 // conforms to the OpenTelemetry Baggage specification.
 //
-// If the baggage-string exceeds the maximum allowed members (64) or bytes
-// (8192), members are dropped until the limits are satisfied and an error is
-// returned along with the partial result.
+// If the raw baggage-string exceeds the maximum allowed bytes (8192), an
+// empty Baggage and an error are returned.
+//
+// Otherwise, members are parsed left-to-right and accumulated until one of
+// the following conditions is reached, at which point parsing stops and an
+// error is returned alongside the partial result:
+//   - accepting the next member would cause the encoded baggage to exceed
+//     8192 bytes, or
+//   - the baggage already contains 64 distinct keys.
 //
 // Invalid members are skipped and the error is returned along with the
 // partial result containing the valid members.
@@ -504,9 +514,14 @@ func Parse(bStr string) (Baggage, error) {
 		return Baggage{}, nil
 	}
 
+	if n := len(bStr); n > maxBytesPerBaggageString {
+		return Baggage{}, fmt.Errorf("%w: %d", errBaggageBytes, n)
+	}
+
 	b := make(baggage.List)
 	sizes := make(map[string]int) // Track per-key byte sizes
 	var totalBytes int
+	var parseErrors int
 	var truncateErr error
 	for memberStr := range strings.SplitSeq(bStr, listDelimiter) {
 		// Check member count limit.
@@ -517,7 +532,10 @@ func Parse(bStr string) (Baggage, error) {
 
 		m, err := parseMember(memberStr)
 		if err != nil {
-			truncateErr = errors.Join(truncateErr, err)
+			parseErrors++
+			if parseErrors <= maxParseErrors {
+				truncateErr = errors.Join(truncateErr, err)
+			}
 			continue // skip invalid member, keep processing
 		}
 
@@ -553,6 +571,10 @@ func Parse(bStr string) (Baggage, error) {
 		totalBytes = newTotalBytes
 	}
 
+	if dropped := parseErrors - maxParseErrors; dropped > 0 {
+		truncateErr = errors.Join(truncateErr, fmt.Errorf("and %d more invalid member(s)", dropped))
+	}
+
 	if len(b) == 0 {
 		return Baggage{}, truncateErr
 	}
diff --git a/vendor/go.opentelemetry.io/otel/dependencies.Dockerfile b/vendor/go.opentelemetry.io/otel/dependencies.Dockerfile
index 7a9b3c055..74fa510bc 100644
--- a/vendor/go.opentelemetry.io/otel/dependencies.Dockerfile
+++ b/vendor/go.opentelemetry.io/otel/dependencies.Dockerfile
@@ -1,4 +1,4 @@
 # This is a renovate-friendly source of Docker images.
 FROM python:3.13.6-slim-bullseye@sha256:e98b521460ee75bca92175c16247bdf7275637a8faaeb2bcfa19d879ae5c4b9a AS python
-FROM otel/weaver:v0.22.1@sha256:33ae522ae4b71c1c562563c1d81f46aa0f79f088a0873199143a1f11ac30e5c9 AS weaver
+FROM otel/weaver:v0.23.0@sha256:7984ecb55b859eb3034ae9d836c4eeda137e2bdd0873b7ba2bb6c3d24d6ff457 AS weaver
 FROM avtodev/markdown-lint:v1@sha256:6aeedc2f49138ce7a1cd0adffc1b1c0321b841dc2102408967d9301c031949ee AS markdown
diff --git a/vendor/go.opentelemetry.io/otel/metric/asyncfloat64.go b/vendor/go.opentelemetry.io/otel/metric/asyncfloat64.go
index 466812d34..1d21e2eb7 100644
--- a/vendor/go.opentelemetry.io/otel/metric/asyncfloat64.go
+++ b/vendor/go.opentelemetry.io/otel/metric/asyncfloat64.go
@@ -51,6 +51,9 @@ type Float64ObservableCounterConfig struct {
 func NewFloat64ObservableCounterConfig(opts ...Float64ObservableCounterOption) Float64ObservableCounterConfig {
 	var config Float64ObservableCounterConfig
 	for _, o := range opts {
+		if _, ok := o.(experimentalOption); ok {
+			continue
+		}
 		config = o.applyFloat64ObservableCounter(config)
 	}
 	return config
@@ -111,6 +114,9 @@ func NewFloat64ObservableUpDownCounterConfig(
 ) Float64ObservableUpDownCounterConfig {
 	var config Float64ObservableUpDownCounterConfig
 	for _, o := range opts {
+		if _, ok := o.(experimentalOption); ok {
+			continue
+		}
 		config = o.applyFloat64ObservableUpDownCounter(config)
 	}
 	return config
@@ -168,6 +174,9 @@ type Float64ObservableGaugeConfig struct {
 func NewFloat64ObservableGaugeConfig(opts ...Float64ObservableGaugeOption) Float64ObservableGaugeConfig {
 	var config Float64ObservableGaugeConfig
 	for _, o := range opts {
+		if _, ok := o.(experimentalOption); ok {
+			continue
+		}
 		config = o.applyFloat64ObservableGauge(config)
 	}
 	return config
diff --git a/vendor/go.opentelemetry.io/otel/metric/asyncint64.go b/vendor/go.opentelemetry.io/otel/metric/asyncint64.go
index 66c971bd8..9d45a4d41 100644
--- a/vendor/go.opentelemetry.io/otel/metric/asyncint64.go
+++ b/vendor/go.opentelemetry.io/otel/metric/asyncint64.go
@@ -50,6 +50,9 @@ type Int64ObservableCounterConfig struct {
 func NewInt64ObservableCounterConfig(opts ...Int64ObservableCounterOption) Int64ObservableCounterConfig {
 	var config Int64ObservableCounterConfig
 	for _, o := range opts {
+		if _, ok := o.(experimentalOption); ok {
+			continue
+		}
 		config = o.applyInt64ObservableCounter(config)
 	}
 	return config
@@ -110,6 +113,9 @@ func NewInt64ObservableUpDownCounterConfig(
 ) Int64ObservableUpDownCounterConfig {
 	var config Int64ObservableUpDownCounterConfig
 	for _, o := range opts {
+		if _, ok := o.(experimentalOption); ok {
+			continue
+		}
 		config = o.applyInt64ObservableUpDownCounter(config)
 	}
 	return config
@@ -167,6 +173,9 @@ type Int64ObservableGaugeConfig struct {
 func NewInt64ObservableGaugeConfig(opts ...Int64ObservableGaugeOption) Int64ObservableGaugeConfig {
 	var config Int64ObservableGaugeConfig
 	for _, o := range opts {
+		if _, ok := o.(experimentalOption); ok {
+			continue
+		}
 		config = o.applyInt64ObservableGauge(config)
 	}
 	return config
diff --git a/vendor/go.opentelemetry.io/otel/metric/config.go b/vendor/go.opentelemetry.io/otel/metric/config.go
index e42dd6e70..889545e23 100644
--- a/vendor/go.opentelemetry.io/otel/metric/config.go
+++ b/vendor/go.opentelemetry.io/otel/metric/config.go
@@ -42,11 +42,18 @@ type MeterOption interface {
 	applyMeter(MeterConfig) MeterConfig
 }
 
+type experimentalOption interface {
+	Experimental()
+}
+
 // NewMeterConfig creates a new MeterConfig and applies
 // all the given options.
 func NewMeterConfig(opts ...MeterOption) MeterConfig {
 	var config MeterConfig
 	for _, o := range opts {
+		if _, ok := o.(experimentalOption); ok {
+			continue
+		}
 		config = o.applyMeter(config)
 	}
 	return config
diff --git a/vendor/go.opentelemetry.io/otel/metric/doc.go b/vendor/go.opentelemetry.io/otel/metric/doc.go
index f153745b0..794e1a8ba 100644
--- a/vendor/go.opentelemetry.io/otel/metric/doc.go
+++ b/vendor/go.opentelemetry.io/otel/metric/doc.go
@@ -24,10 +24,10 @@ all instruments fall into two overlapping logical categories: asynchronous or
 synchronous, and int64 or float64.
 
 All synchronous instruments ([Int64Counter], [Int64UpDownCounter],
-[Int64Histogram], [Float64Counter], [Float64UpDownCounter], and
-[Float64Histogram]) are used to measure the operation and performance of source
-code during the source code execution. These instruments only make measurements
-when the source code they instrument is run.
+[Int64Histogram], [Int64Gauge], [Float64Counter], [Float64UpDownCounter],
+[Float64Histogram], and [Float64Gauge]) are used to measure the operation and
+performance of source code during the source code execution. These instruments
+only make measurements when the source code they instrument is run.
 
 All asynchronous instruments ([Int64ObservableCounter],
 [Int64ObservableUpDownCounter], [Int64ObservableGauge],
@@ -50,9 +50,11 @@ incrementally increase in value. UpDownCounters ([Int64UpDownCounter],
 values that can increase and decrease. When more information needs to be
 conveyed about all the synchronous measurements made during a collection cycle,
 a Histogram ([Int64Histogram] and [Float64Histogram]) should be used. Finally,
-when just the most recent measurement needs to be conveyed about an
-asynchronous measurement, a Gauge ([Int64ObservableGauge] and
-[Float64ObservableGauge]) should be used.
+when just the most recent measurement needs to be conveyed, a Gauge
+([Int64Gauge], [Float64Gauge], [Int64ObservableGauge], and
+[Float64ObservableGauge]) should be used: the synchronous variants record an
+instantaneous value at a specific point in code, while the observable variants
+sample the value via a callback once per collection cycle.
 
 See the [OpenTelemetry documentation] for more information about instruments
 and their intended use.
@@ -80,11 +82,11 @@ Measurements are made by recording values and information about the values with
 an instrument. How these measurements are recorded depends on the instrument.
 
 Measurements for synchronous instruments ([Int64Counter], [Int64UpDownCounter],
-[Int64Histogram], [Float64Counter], [Float64UpDownCounter], and
-[Float64Histogram]) are recorded using the instrument methods directly. All
-counter instruments have an Add method that is used to measure an increment
-value, and all histogram instruments have a Record method to measure a data
-point.
+[Int64Histogram], [Int64Gauge], [Float64Counter], [Float64UpDownCounter],
+[Float64Histogram], and [Float64Gauge]) are recorded using the instrument
+methods directly. All counter instruments have an Add method that is used to
+measure an increment value, and all histogram and synchronous gauge
+instruments have a Record method to measure a data point.
 
 Asynchronous instruments ([Int64ObservableCounter],
 [Int64ObservableUpDownCounter], [Int64ObservableGauge],
@@ -107,6 +109,31 @@ respectively):
 If the criteria are not met, use the RegisterCallback method of the [Meter] that
 created the instrument to register a [Callback].
 
+# Avoiding Expensive Computations
+
+All synchronous instruments provide an Enabled method that reports whether the
+instrument will process measurements for the given context. When no SDK is
+registered or the instrument is otherwise disabled, Enabled returns false. This
+can be used to avoid expensive measurement work when a measurement will not be
+recorded:
+
+	if counter.Enabled(ctx) {
+		counter.Add(ctx, 1, metric.WithAttributes(expensiveAttributes()...))
+	}
+
+This is especially valuable when computing attributes is expensive.
+[WithAttributes] performs non-trivial work on every call to build an
+[attribute.Set] from the provided attributes, and that work is wasted if the
+measurement is not recorded.
+
+For performance sensitive code where the same attribute set is used repeatedly,
+prefer [WithAttributeSet]. It accepts a pre-built [attribute.Set], letting you
+pay the construction cost once and reuse it across many measurements:
+
+	attrs := attribute.NewSet(attribute.String("key", "val"))
+	// ... later, on each call:
+	counter.Add(ctx, 1, metric.WithAttributeSet(attrs))
+
 # API Implementations
 
 This package does not conform to the standard Go versioning policy, all of its
diff --git a/vendor/go.opentelemetry.io/otel/metric/instrument.go b/vendor/go.opentelemetry.io/otel/metric/instrument.go
index 9f48d5f11..2e79ab568 100644
--- a/vendor/go.opentelemetry.io/otel/metric/instrument.go
+++ b/vendor/go.opentelemetry.io/otel/metric/instrument.go
@@ -3,7 +3,9 @@
 
 package metric // import "go.opentelemetry.io/otel/metric"
 
-import "go.opentelemetry.io/otel/attribute"
+import (
+	"go.opentelemetry.io/otel/attribute"
+)
 
 // Observable is used as a grouping mechanism for all instruments that are
 // updated within a Callback.
@@ -228,6 +230,9 @@ type AddConfig struct {
 func NewAddConfig(opts []AddOption) AddConfig {
 	config := AddConfig{attrs: *attribute.EmptySet()}
 	for _, o := range opts {
+		if _, ok := o.(experimentalOption); ok {
+			continue
+		}
 		config = o.applyAdd(config)
 	}
 	return config
@@ -253,6 +258,9 @@ type RecordConfig struct {
 func NewRecordConfig(opts []RecordOption) RecordConfig {
 	config := RecordConfig{attrs: *attribute.EmptySet()}
 	for _, o := range opts {
+		if _, ok := o.(experimentalOption); ok {
+			continue
+		}
 		config = o.applyRecord(config)
 	}
 	return config
@@ -278,6 +286,9 @@ type ObserveConfig struct {
 func NewObserveConfig(opts []ObserveOption) ObserveConfig {
 	config := ObserveConfig{attrs: *attribute.EmptySet()}
 	for _, o := range opts {
+		if _, ok := o.(experimentalOption); ok {
+			continue
+		}
 		config = o.applyObserve(config)
 	}
 	return config
@@ -299,6 +310,10 @@ type attrOpt struct {
 	set attribute.Set
 }
 
+func (o *attrOpt) Set(set attribute.Set) {
+	o.set = set
+}
+
 // mergeSets returns the union of keys between a and b. Any duplicate keys will
 // use the value associated with b.
 func mergeSets(a, b attribute.Set) attribute.Set {
@@ -311,7 +326,7 @@ func mergeSets(a, b attribute.Set) attribute.Set {
 	return attribute.NewSet(merged...)
 }
 
-func (o attrOpt) applyAdd(c AddConfig) AddConfig {
+func (o *attrOpt) applyAdd(c AddConfig) AddConfig {
 	switch {
 	case o.set.Len() == 0:
 	case c.attrs.Len() == 0:
@@ -322,7 +337,7 @@ func (o attrOpt) applyAdd(c AddConfig) AddConfig {
 	return c
 }
 
-func (o attrOpt) applyRecord(c RecordConfig) RecordConfig {
+func (o *attrOpt) applyRecord(c RecordConfig) RecordConfig {
 	switch {
 	case o.set.Len() == 0:
 	case c.attrs.Len() == 0:
@@ -333,7 +348,7 @@ func (o attrOpt) applyRecord(c RecordConfig) RecordConfig {
 	return c
 }
 
-func (o attrOpt) applyObserve(c ObserveConfig) ObserveConfig {
+func (o *attrOpt) applyObserve(c ObserveConfig) ObserveConfig {
 	switch {
 	case o.set.Len() == 0:
 	case c.attrs.Len() == 0:
@@ -350,8 +365,14 @@ func (o attrOpt) applyObserve(c ObserveConfig) ObserveConfig {
 // If multiple WithAttributeSet or WithAttributes options are passed the
 // attributes will be merged together in the order they are passed. Attributes
 // with duplicate keys will use the last value passed.
+//
+// Experimental: The returned option may implement
+// [go.opentelemetry.io/otel/metric/x.Settable][attribute.Set], which can be
+// used to replace the option's attribute set and reuse the option without
+// additional allocations. This behavior is experimental and may be changed or
+// removed in a future release without notice.
 func WithAttributeSet(attributes attribute.Set) MeasurementOption {
-	return attrOpt{set: attributes}
+	return &attrOpt{set: attributes}
 }
 
 // WithAttributes converts attributes into an attribute Set and sets the Set to
@@ -369,8 +390,14 @@ func WithAttributeSet(attributes attribute.Set) MeasurementOption {
 //
 // See [WithAttributeSet] for information about how multiple WithAttributes are
 // merged.
+//
+// Experimental: The returned option may implement
+// [go.opentelemetry.io/otel/metric/x.Settable][[]attribute.KeyValue], which can be
+// used to replace the option's attributes and reuse the option without
+// additional allocations. This behavior is experimental and may be changed or
+// removed in a future release without notice.
 func WithAttributes(attributes ...attribute.KeyValue) MeasurementOption {
 	cp := make([]attribute.KeyValue, len(attributes))
 	copy(cp, attributes)
-	return attrOpt{set: attribute.NewSet(cp...)}
+	return &attrOpt{set: attribute.NewSet(cp...)}
 }
diff --git a/vendor/go.opentelemetry.io/otel/metric/syncfloat64.go b/vendor/go.opentelemetry.io/otel/metric/syncfloat64.go
index abb3051d7..2101f686a 100644
--- a/vendor/go.opentelemetry.io/otel/metric/syncfloat64.go
+++ b/vendor/go.opentelemetry.io/otel/metric/syncfloat64.go
@@ -51,6 +51,9 @@ type Float64CounterConfig struct {
 func NewFloat64CounterConfig(opts ...Float64CounterOption) Float64CounterConfig {
 	var config Float64CounterConfig
 	for _, o := range opts {
+		if _, ok := o.(experimentalOption); ok {
+			continue
+		}
 		config = o.applyFloat64Counter(config)
 	}
 	return config
@@ -116,6 +119,9 @@ type Float64UpDownCounterConfig struct {
 func NewFloat64UpDownCounterConfig(opts ...Float64UpDownCounterOption) Float64UpDownCounterConfig {
 	var config Float64UpDownCounterConfig
 	for _, o := range opts {
+		if _, ok := o.(experimentalOption); ok {
+			continue
+		}
 		config = o.applyFloat64UpDownCounter(config)
 	}
 	return config
@@ -182,6 +188,9 @@ type Float64HistogramConfig struct {
 func NewFloat64HistogramConfig(opts ...Float64HistogramOption) Float64HistogramConfig {
 	var config Float64HistogramConfig
 	for _, o := range opts {
+		if _, ok := o.(experimentalOption); ok {
+			continue
+		}
 		config = o.applyFloat64Histogram(config)
 	}
 	return config
@@ -251,6 +260,9 @@ type Float64GaugeConfig struct {
 func NewFloat64GaugeConfig(opts ...Float64GaugeOption) Float64GaugeConfig {
 	var config Float64GaugeConfig
 	for _, o := range opts {
+		if _, ok := o.(experimentalOption); ok {
+			continue
+		}
 		config = o.applyFloat64Gauge(config)
 	}
 	return config
diff --git a/vendor/go.opentelemetry.io/otel/metric/syncint64.go b/vendor/go.opentelemetry.io/otel/metric/syncint64.go
index 5bbfaf039..425c1a0d5 100644
--- a/vendor/go.opentelemetry.io/otel/metric/syncint64.go
+++ b/vendor/go.opentelemetry.io/otel/metric/syncint64.go
@@ -51,6 +51,9 @@ type Int64CounterConfig struct {
 func NewInt64CounterConfig(opts ...Int64CounterOption) Int64CounterConfig {
 	var config Int64CounterConfig
 	for _, o := range opts {
+		if _, ok := o.(experimentalOption); ok {
+			continue
+		}
 		config = o.applyInt64Counter(config)
 	}
 	return config
@@ -116,6 +119,9 @@ type Int64UpDownCounterConfig struct {
 func NewInt64UpDownCounterConfig(opts ...Int64UpDownCounterOption) Int64UpDownCounterConfig {
 	var config Int64UpDownCounterConfig
 	for _, o := range opts {
+		if _, ok := o.(experimentalOption); ok {
+			continue
+		}
 		config = o.applyInt64UpDownCounter(config)
 	}
 	return config
@@ -182,6 +188,9 @@ type Int64HistogramConfig struct {
 func NewInt64HistogramConfig(opts ...Int64HistogramOption) Int64HistogramConfig {
 	var config Int64HistogramConfig
 	for _, o := range opts {
+		if _, ok := o.(experimentalOption); ok {
+			continue
+		}
 		config = o.applyInt64Histogram(config)
 	}
 	return config
@@ -251,6 +260,9 @@ type Int64GaugeConfig struct {
 func NewInt64GaugeConfig(opts ...Int64GaugeOption) Int64GaugeConfig {
 	var config Int64GaugeConfig
 	for _, o := range opts {
+		if _, ok := o.(experimentalOption); ok {
+			continue
+		}
 		config = o.applyInt64Gauge(config)
 	}
 	return config
diff --git a/vendor/go.opentelemetry.io/otel/propagation/baggage.go b/vendor/go.opentelemetry.io/otel/propagation/baggage.go
index 2ecca3fed..d81b709a2 100644
--- a/vendor/go.opentelemetry.io/otel/propagation/baggage.go
+++ b/vendor/go.opentelemetry.io/otel/propagation/baggage.go
@@ -5,6 +5,9 @@ package propagation // import "go.opentelemetry.io/otel/propagation"
 
 import (
 	"context"
+	"errors"
+	"fmt"
+	"sync"
 
 	"go.opentelemetry.io/otel/baggage"
 	"go.opentelemetry.io/otel/internal/errorhandler"
@@ -13,11 +16,18 @@ import (
 const (
 	baggageHeader = "baggage"
 
+	maxParseErrors = 5
+
 	// W3C Baggage specification limits.
 	// https://www.w3.org/TR/baggage/#limits
-	maxMembers = 64
+	maxMembers               = 64
+	maxBytesPerBaggageString = 8192
 )
 
+// handleExtractErrOnce limits error reporting for attacker-controlled baggage headers
+// to one process-wide emission, preventing repeated extraction from flooding logs.
+var handleExtractErrOnce sync.Once
+
 // Baggage is a propagator that supports the W3C Baggage format.
 //
 // This propagates user-defined baggage associated with a trace. The complete
@@ -57,7 +67,9 @@ func extractSingleBaggage(parent context.Context, carrier TextMapCarrier) contex
 
 	bag, err := baggage.Parse(bStr)
 	if err != nil {
-		errorhandler.GetErrorHandler().Handle(err)
+		handleExtractErrOnce.Do(func() {
+			errorhandler.GetErrorHandler().Handle(err)
+		})
 	}
 	if bag.Len() == 0 {
 		return parent
@@ -72,24 +84,60 @@ func extractMultiBaggage(parent context.Context, carrier ValuesGetter) context.C
 	}
 
 	var members []baggage.Member
-	for _, bStr := range bVals {
-		currBag, err := baggage.Parse(bStr)
-		if err != nil {
-			errorhandler.GetErrorHandler().Handle(err)
+	var totalBytes int
+	var parseErrors int
+	var truncateErr error
+	for i, bStr := range bVals {
+		if i > 0 {
+			totalBytes++ // comma separator between combined header values
 		}
-		if currBag.Len() == 0 {
-			continue
+		totalBytes += len(bStr)
+		if totalBytes > maxBytesPerBaggageString {
+			// Per the W3C Baggage spec, the byte limit applies to the
+			// combination of all baggage headers, not each header
+			// individually. Mirror the single-header behavior of
+			// reporting the error and returning the parent context
+			// with no baggage attached.
+			handleExtractErrOnce.Do(func() {
+				errorhandler.GetErrorHandler().Handle(fmt.Errorf(
+					"baggage: aggregate header size %d exceeds %d byte limit",
+					totalBytes,
+					maxBytesPerBaggageString,
+				))
+			})
+			return parent
 		}
-		members = append(members, currBag.Members()...)
-		if len(members) >= maxMembers {
-			break
+
+		// If members exceed the limit, stop parsing baggage.
+		if len(members) <= maxMembers {
+			currBag, err := baggage.Parse(bStr)
+			if err != nil {
+				parseErrors++
+				if parseErrors <= maxParseErrors {
+					truncateErr = errors.Join(truncateErr, err)
+				}
+			}
+			if currBag.Len() == 0 {
+				continue
+			}
+			members = append(members, currBag.Members()...)
 		}
 	}
 
+	if dropped := parseErrors - maxParseErrors; dropped > 0 {
+		truncateErr = errors.Join(truncateErr, fmt.Errorf("and %d more error(s)", dropped))
+	}
+
 	b, err := baggage.New(members...)
 	if err != nil {
-		errorhandler.GetErrorHandler().Handle(err)
+		truncateErr = errors.Join(truncateErr, err)
 	}
+	if truncateErr != nil {
+		handleExtractErrOnce.Do(func() {
+			errorhandler.GetErrorHandler().Handle(truncateErr)
+		})
+	}
+
 	if b.Len() == 0 {
 		return parent
 	}
diff --git a/vendor/go.opentelemetry.io/otel/semconv/v1.37.0/attribute_group.go b/vendor/go.opentelemetry.io/otel/semconv/v1.37.0/attribute_group.go
index b6b27498f..2fcab2435 100644
--- a/vendor/go.opentelemetry.io/otel/semconv/v1.37.0/attribute_group.go
+++ b/vendor/go.opentelemetry.io/otel/semconv/v1.37.0/attribute_group.go
@@ -1447,9 +1447,11 @@ func AWSExtendedRequestID(val string) attribute.KeyValue {
 // AWSKinesisStreamName returns an attribute KeyValue conforming to the
 // "aws.kinesis.stream_name" semantic conventions. It represents the name of the
 // AWS Kinesis [stream] the request refers to. Corresponds to the `--stream-name`
-//  parameter of the Kinesis [describe-stream] operation.
+//
+//	parameter of the Kinesis [describe-stream] operation.
 //
 // [stream]: https://docs.aws.amazon.com/streams/latest/dev/introduction.html
+//
 // [describe-stream]: https://docs.aws.amazon.com/cli/latest/reference/kinesis/describe-stream.html
 func AWSKinesisStreamName(val string) attribute.KeyValue {
 	return AWSKinesisStreamNameKey.String(val)
@@ -1459,7 +1461,8 @@ func AWSKinesisStreamName(val string) attribute.KeyValue {
 // "aws.lambda.invoked_arn" semantic conventions. It represents the full invoked
 // ARN as provided on the `Context` passed to the function (
 // `Lambda-Runtime-Invoked-Function-Arn` header on the `/runtime/invocation/next`
-//  applicable).
+//
+//	applicable).
 func AWSLambdaInvokedARN(val string) attribute.KeyValue {
 	return AWSLambdaInvokedARNKey.String(val)
 }
@@ -2635,7 +2638,8 @@ func CloudRegion(val string) attribute.KeyValue {
 // "cloud.resource_id" semantic conventions. It represents the cloud
 // provider-specific native identifier of the monitored cloud resource (e.g. an
 // [ARN] on AWS, a [fully qualified resource ID] on Azure, a [full resource name]
-//  on GCP).
+//
+//	on GCP).
 //
 // [ARN]: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
 // [fully qualified resource ID]: https://learn.microsoft.com/rest/api/resources/resources/get-by-id
@@ -15190,4 +15194,4 @@ func ZOSSmfID(val string) attribute.KeyValue {
 // to which the z/OS system belongs too.
 func ZOSSysplexName(val string) attribute.KeyValue {
 	return ZOSSysplexNameKey.String(val)
-}
\ No newline at end of file
+}
diff --git a/vendor/go.opentelemetry.io/otel/semconv/v1.39.0/MIGRATION.md b/vendor/go.opentelemetry.io/otel/semconv/v1.39.0/MIGRATION.md
deleted file mode 100644
index fed7013e6..000000000
--- a/vendor/go.opentelemetry.io/otel/semconv/v1.39.0/MIGRATION.md
+++ /dev/null
@@ -1,78 +0,0 @@
-<!-- Generated. DO NOT MODIFY. -->
-# Migration from v1.38.0 to v1.39.0
-
-The `go.opentelemetry.io/otel/semconv/v1.39.0` package should be a drop-in replacement for `go.opentelemetry.io/otel/semconv/v1.38.0` with the following exceptions.
-
-## Removed
-
-The following declarations have been removed.
-Refer to the [OpenTelemetry Semantic Conventions documentation] for deprecation instructions.
-
-If the type is not listed in the documentation as deprecated, it has been removed in this version due to lack of applicability or use.
-If you use any of these non-deprecated declarations in your Go application, please [open an issue] describing your use-case.
-
-- `LinuxMemorySlabStateKey`
-- `LinuxMemorySlabStateReclaimable`
-- `LinuxMemorySlabStateUnreclaimable`
-- `PeerService`
-- `PeerServiceKey`
-- `RPCConnectRPCErrorCodeAborted`
-- `RPCConnectRPCErrorCodeAlreadyExists`
-- `RPCConnectRPCErrorCodeCancelled`
-- `RPCConnectRPCErrorCodeDataLoss`
-- `RPCConnectRPCErrorCodeDeadlineExceeded`
-- `RPCConnectRPCErrorCodeFailedPrecondition`
-- `RPCConnectRPCErrorCodeInternal`
-- `RPCConnectRPCErrorCodeInvalidArgument`
-- `RPCConnectRPCErrorCodeKey`
-- `RPCConnectRPCErrorCodeNotFound`
-- `RPCConnectRPCErrorCodeOutOfRange`
-- `RPCConnectRPCErrorCodePermissionDenied`
-- `RPCConnectRPCErrorCodeResourceExhausted`
-- `RPCConnectRPCErrorCodeUnauthenticated`
-- `RPCConnectRPCErrorCodeUnavailable`
-- `RPCConnectRPCErrorCodeUnimplemented`
-- `RPCConnectRPCErrorCodeUnknown`
-- `RPCConnectRPCRequestMetadata`
-- `RPCConnectRPCResponseMetadata`
-- `RPCGRPCRequestMetadata`
-- `RPCGRPCResponseMetadata`
-- `RPCGRPCStatusCodeAborted`
-- `RPCGRPCStatusCodeAlreadyExists`
-- `RPCGRPCStatusCodeCancelled`
-- `RPCGRPCStatusCodeDataLoss`
-- `RPCGRPCStatusCodeDeadlineExceeded`
-- `RPCGRPCStatusCodeFailedPrecondition`
-- `RPCGRPCStatusCodeInternal`
-- `RPCGRPCStatusCodeInvalidArgument`
-- `RPCGRPCStatusCodeKey`
-- `RPCGRPCStatusCodeNotFound`
-- `RPCGRPCStatusCodeOk`
-- `RPCGRPCStatusCodeOutOfRange`
-- `RPCGRPCStatusCodePermissionDenied`
-- `RPCGRPCStatusCodeResourceExhausted`
-- `RPCGRPCStatusCodeUnauthenticated`
-- `RPCGRPCStatusCodeUnavailable`
-- `RPCGRPCStatusCodeUnimplemented`
-- `RPCGRPCStatusCodeUnknown`
-- `RPCJSONRPCErrorCode`
-- `RPCJSONRPCErrorCodeKey`
-- `RPCJSONRPCErrorMessage`
-- `RPCJSONRPCErrorMessageKey`
-- `RPCJSONRPCRequestID`
-- `RPCJSONRPCRequestIDKey`
-- `RPCJSONRPCVersion`
-- `RPCJSONRPCVersionKey`
-- `RPCService`
-- `RPCServiceKey`
-- `RPCSystemApacheDubbo`
-- `RPCSystemConnectRPC`
-- `RPCSystemDotnetWcf`
-- `RPCSystemGRPC`
-- `RPCSystemJSONRPC`
-- `RPCSystemJavaRmi`
-- `RPCSystemKey`
-- `RPCSystemOncRPC`
-
-[OpenTelemetry Semantic Conventions documentation]: https://github.com/open-telemetry/semantic-conventions
-[open an issue]: https://github.com/open-telemetry/opentelemetry-go/issues/new?template=Blank+issue
diff --git a/vendor/go.opentelemetry.io/otel/semconv/v1.39.0/README.md b/vendor/go.opentelemetry.io/otel/semconv/v1.39.0/README.md
deleted file mode 100644
index 4b0e6f7f3..000000000
--- a/vendor/go.opentelemetry.io/otel/semconv/v1.39.0/README.md
+++ /dev/null
@@ -1,3 +0,0 @@
-# Semconv v1.39.0
-
-[![PkgGoDev](https://pkg.go.dev/badge/go.opentelemetry.io/otel/semconv/v1.39.0)](https://pkg.go.dev/go.opentelemetry.io/otel/semconv/v1.39.0)
diff --git a/vendor/go.opentelemetry.io/otel/semconv/v1.39.0/error_type.go b/vendor/go.opentelemetry.io/otel/semconv/v1.39.0/error_type.go
deleted file mode 100644
index 84cf636a7..000000000
--- a/vendor/go.opentelemetry.io/otel/semconv/v1.39.0/error_type.go
+++ /dev/null
@@ -1,56 +0,0 @@
-// Copyright The OpenTelemetry Authors
-// SPDX-License-Identifier: Apache-2.0
-
-package semconv // import "go.opentelemetry.io/otel/semconv/v1.39.0"
-
-import (
-	"reflect"
-
-	"go.opentelemetry.io/otel/attribute"
-)
-
-// ErrorType returns an [attribute.KeyValue] identifying the error type of err.
-//
-// If err is nil, the returned attribute has the default value
-// [ErrorTypeOther].
-//
-// If err's type has the method
-//
-//	ErrorType() string
-//
-// then the returned attribute has the value of err.ErrorType(). Otherwise, the
-// returned attribute has a value derived from the concrete type of err.
-//
-// The key of the returned attribute is [ErrorTypeKey].
-func ErrorType(err error) attribute.KeyValue {
-	if err == nil {
-		return ErrorTypeOther
-	}
-
-	return ErrorTypeKey.String(errorType(err))
-}
-
-func errorType(err error) string {
-	var s string
-	if et, ok := err.(interface{ ErrorType() string }); ok {
-		// Prioritize the ErrorType method if available.
-		s = et.ErrorType()
-	}
-	if s == "" {
-		// Fallback to reflection if the ErrorType method is not supported or
-		// returns an empty value.
-
-		t := reflect.TypeOf(err)
-		pkg, name := t.PkgPath(), t.Name()
-		if pkg != "" && name != "" {
-			s = pkg + "." + name
-		} else {
-			// The type has no package path or name (predeclared, not-defined,
-			// or alias for a not-defined type).
-			//
-			// This is not guaranteed to be unique, but is a best effort.
-			s = t.String()
-		}
-	}
-	return s
-}
diff --git a/vendor/go.opentelemetry.io/otel/semconv/v1.40.0/attribute_group.go b/vendor/go.opentelemetry.io/otel/semconv/v1.40.0/attribute_group.go
index ee6b1f79d..c5d40e518 100644
--- a/vendor/go.opentelemetry.io/otel/semconv/v1.40.0/attribute_group.go
+++ b/vendor/go.opentelemetry.io/otel/semconv/v1.40.0/attribute_group.go
@@ -1493,9 +1493,11 @@ func AWSExtendedRequestID(val string) attribute.KeyValue {
 // AWSKinesisStreamName returns an attribute KeyValue conforming to the
 // "aws.kinesis.stream_name" semantic conventions. It represents the name of the
 // AWS Kinesis [stream] the request refers to. Corresponds to the `--stream-name`
-//  parameter of the Kinesis [describe-stream] operation.
+//
+//	parameter of the Kinesis [describe-stream] operation.
 //
 // [stream]: https://docs.aws.amazon.com/streams/latest/dev/introduction.html
+//
 // [describe-stream]: https://docs.aws.amazon.com/cli/latest/reference/kinesis/describe-stream.html
 func AWSKinesisStreamName(val string) attribute.KeyValue {
 	return AWSKinesisStreamNameKey.String(val)
@@ -1505,7 +1507,8 @@ func AWSKinesisStreamName(val string) attribute.KeyValue {
 // "aws.lambda.invoked_arn" semantic conventions. It represents the full invoked
 // ARN as provided on the `Context` passed to the function (
 // `Lambda-Runtime-Invoked-Function-Arn` header on the `/runtime/invocation/next`
-//  applicable).
+//
+//	applicable).
 func AWSLambdaInvokedARN(val string) attribute.KeyValue {
 	return AWSLambdaInvokedARNKey.String(val)
 }
@@ -2681,7 +2684,8 @@ func CloudRegion(val string) attribute.KeyValue {
 // "cloud.resource_id" semantic conventions. It represents the cloud
 // provider-specific native identifier of the monitored cloud resource (e.g. an
 // [ARN] on AWS, a [fully qualified resource ID] on Azure, a [full resource name]
-//  on GCP).
+//
+//	on GCP).
 //
 // [ARN]: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
 // [fully qualified resource ID]: https://learn.microsoft.com/rest/api/resources/resources/get-by-id
@@ -16858,4 +16862,4 @@ func ZOSSmfID(val string) attribute.KeyValue {
 // to which the z/OS system belongs too.
 func ZOSSysplexName(val string) attribute.KeyValue {
 	return ZOSSysplexNameKey.String(val)
-}
\ No newline at end of file
+}
diff --git a/vendor/go.opentelemetry.io/otel/semconv/v1.40.0/error_type.go b/vendor/go.opentelemetry.io/otel/semconv/v1.40.0/error_type.go
index 6d26e5282..1cb89f79d 100644
--- a/vendor/go.opentelemetry.io/otel/semconv/v1.40.0/error_type.go
+++ b/vendor/go.opentelemetry.io/otel/semconv/v1.40.0/error_type.go
@@ -5,6 +5,7 @@ package semconv // import "go.opentelemetry.io/otel/semconv/v1.40.0"
 
 import (
 	"errors"
+	"fmt"
 	"reflect"
 
 	"go.opentelemetry.io/otel/attribute"
@@ -22,7 +23,8 @@ import (
 // the returned attribute has that method's return value. If multiple errors in
 // the chain implement this method, the value from the first match found by
 // [errors.As] is used. Otherwise, the returned attribute has a value derived
-// from the concrete type of err.
+// from the concrete type of err after unwrapping any wrappers created with
+// [fmt.Errorf].
 //
 // The key of the returned attribute is [ErrorTypeKey].
 func ErrorType(err error) attribute.KeyValue {
@@ -50,7 +52,7 @@ func errorType(err error) string {
 		// Fallback to reflection if the ErrorType method is not supported or
 		// returns an empty value.
 
-		t := reflect.TypeOf(err)
+		t := reflect.TypeOf(unwrapFmtWrapped(err))
 		pkg, name := t.PkgPath(), t.Name()
 		if pkg != "" && name != "" {
 			s = pkg + "." + name
@@ -64,3 +66,16 @@ func errorType(err error) string {
 	}
 	return s
 }
+
+var fmtWrapErrorType = reflect.TypeOf(fmt.Errorf("wrapped: %w", errors.New("err")))
+
+func unwrapFmtWrapped(err error) error {
+	for reflect.TypeOf(err) == fmtWrapErrorType {
+		u := errors.Unwrap(err)
+		if u == nil {
+			return err // Should never happen, but avoid returning nil if unwrapping fails.
+		}
+		err = u
+	}
+	return err
+}
diff --git a/vendor/go.opentelemetry.io/otel/semconv/v1.39.0/httpconv/metric.go b/vendor/go.opentelemetry.io/otel/semconv/v1.40.0/httpconv/metric.go
similarity index 97%
rename from vendor/go.opentelemetry.io/otel/semconv/v1.39.0/httpconv/metric.go
rename to vendor/go.opentelemetry.io/otel/semconv/v1.40.0/httpconv/metric.go
index d6ad8735a..013629dc3 100644
--- a/vendor/go.opentelemetry.io/otel/semconv/v1.39.0/httpconv/metric.go
+++ b/vendor/go.opentelemetry.io/otel/semconv/v1.40.0/httpconv/metric.go
@@ -26,11 +26,9 @@ var (
 // with.
 type ErrorTypeAttr string
 
-var (
-	// ErrorTypeOther is a fallback error value to be used when the instrumentation
-	// doesn't define a custom value.
-	ErrorTypeOther ErrorTypeAttr = "_OTHER"
-)
+// ErrorTypeOther is a fallback error value to be used when the instrumentation
+// doesn't define a custom value.
+var ErrorTypeOther ErrorTypeAttr = "_OTHER"
 
 // ConnectionStateAttr is an attribute conforming to the http.connection.state
 // semantic conventions. It represents the state of the HTTP connection in the
@@ -159,6 +157,9 @@ func (m ClientActiveRequests) Add(
 	serverPort int,
 	attrs ...attribute.KeyValue,
 ) {
+	if !m.Int64UpDownCounter.Enabled(ctx) {
+		return
+	}
 	if len(attrs) == 0 {
 		m.Int64UpDownCounter.Add(ctx, incr, metric.WithAttributes(
 			attribute.String("server.address", serverAddress),
@@ -177,7 +178,7 @@ func (m ClientActiveRequests) Add(
 		*o,
 		metric.WithAttributes(
 			append(
-				attrs,
+				attrs[:len(attrs):len(attrs)],
 				attribute.String("server.address", serverAddress),
 				attribute.Int("server.port", serverPort),
 			)...,
@@ -189,6 +190,9 @@ func (m ClientActiveRequests) Add(
 
 // AddSet adds incr to the existing count for set.
 func (m ClientActiveRequests) AddSet(ctx context.Context, incr int64, set attribute.Set) {
+	if !m.Int64UpDownCounter.Enabled(ctx) {
+		return
+	}
 	if set.Len() == 0 {
 		m.Int64UpDownCounter.Add(ctx, incr)
 		return
@@ -302,6 +306,9 @@ func (m ClientConnectionDuration) Record(
 	serverPort int,
 	attrs ...attribute.KeyValue,
 ) {
+	if !m.Float64Histogram.Enabled(ctx) {
+		return
+	}
 	if len(attrs) == 0 {
 		m.Float64Histogram.Record(ctx, val, metric.WithAttributes(
 			attribute.String("server.address", serverAddress),
@@ -320,7 +327,7 @@ func (m ClientConnectionDuration) Record(
 		*o,
 		metric.WithAttributes(
 			append(
-				attrs,
+				attrs[:len(attrs):len(attrs)],
 				attribute.String("server.address", serverAddress),
 				attribute.Int("server.port", serverPort),
 			)...,
@@ -332,6 +339,9 @@ func (m ClientConnectionDuration) Record(
 
 // RecordSet records val to the current distribution for set.
 func (m ClientConnectionDuration) RecordSet(ctx context.Context, val float64, set attribute.Set) {
+	if !m.Float64Histogram.Enabled(ctx) {
+		return
+	}
 	if set.Len() == 0 {
 		m.Float64Histogram.Record(ctx, val)
 		return
@@ -448,6 +458,9 @@ func (m ClientOpenConnections) Add(
 	serverPort int,
 	attrs ...attribute.KeyValue,
 ) {
+	if !m.Int64UpDownCounter.Enabled(ctx) {
+		return
+	}
 	if len(attrs) == 0 {
 		m.Int64UpDownCounter.Add(ctx, incr, metric.WithAttributes(
 			attribute.String("http.connection.state", string(connectionState)),
@@ -467,7 +480,7 @@ func (m ClientOpenConnections) Add(
 		*o,
 		metric.WithAttributes(
 			append(
-				attrs,
+				attrs[:len(attrs):len(attrs)],
 				attribute.String("http.connection.state", string(connectionState)),
 				attribute.String("server.address", serverAddress),
 				attribute.Int("server.port", serverPort),
@@ -480,6 +493,9 @@ func (m ClientOpenConnections) Add(
 
 // AddSet adds incr to the existing count for set.
 func (m ClientOpenConnections) AddSet(ctx context.Context, incr int64, set attribute.Set) {
+	if !m.Int64UpDownCounter.Enabled(ctx) {
+		return
+	}
 	if set.Len() == 0 {
 		m.Int64UpDownCounter.Add(ctx, incr)
 		return
@@ -601,6 +617,9 @@ func (m ClientRequestBodySize) Record(
 	serverPort int,
 	attrs ...attribute.KeyValue,
 ) {
+	if !m.Int64Histogram.Enabled(ctx) {
+		return
+	}
 	if len(attrs) == 0 {
 		m.Int64Histogram.Record(ctx, val, metric.WithAttributes(
 			attribute.String("http.request.method", string(requestMethod)),
@@ -620,7 +639,7 @@ func (m ClientRequestBodySize) Record(
 		*o,
 		metric.WithAttributes(
 			append(
-				attrs,
+				attrs[:len(attrs):len(attrs)],
 				attribute.String("http.request.method", string(requestMethod)),
 				attribute.String("server.address", serverAddress),
 				attribute.Int("server.port", serverPort),
@@ -640,6 +659,9 @@ func (m ClientRequestBodySize) Record(
 //
 // [Content-Length]: https://www.rfc-editor.org/rfc/rfc9110.html#field.content-length
 func (m ClientRequestBodySize) RecordSet(ctx context.Context, val int64, set attribute.Set) {
+	if !m.Int64Histogram.Enabled(ctx) {
+		return
+	}
 	if set.Len() == 0 {
 		m.Int64Histogram.Record(ctx, val)
 		return
@@ -781,6 +803,9 @@ func (m ClientRequestDuration) Record(
 	serverPort int,
 	attrs ...attribute.KeyValue,
 ) {
+	if !m.Float64Histogram.Enabled(ctx) {
+		return
+	}
 	if len(attrs) == 0 {
 		m.Float64Histogram.Record(ctx, val, metric.WithAttributes(
 			attribute.String("http.request.method", string(requestMethod)),
@@ -800,7 +825,7 @@ func (m ClientRequestDuration) Record(
 		*o,
 		metric.WithAttributes(
 			append(
-				attrs,
+				attrs[:len(attrs):len(attrs)],
 				attribute.String("http.request.method", string(requestMethod)),
 				attribute.String("server.address", serverAddress),
 				attribute.Int("server.port", serverPort),
@@ -813,6 +838,9 @@ func (m ClientRequestDuration) Record(
 
 // RecordSet records val to the current distribution for set.
 func (m ClientRequestDuration) RecordSet(ctx context.Context, val float64, set attribute.Set) {
+	if !m.Float64Histogram.Enabled(ctx) {
+		return
+	}
 	if set.Len() == 0 {
 		m.Float64Histogram.Record(ctx, val)
 		return
@@ -961,6 +989,9 @@ func (m ClientResponseBodySize) Record(
 	serverPort int,
 	attrs ...attribute.KeyValue,
 ) {
+	if !m.Int64Histogram.Enabled(ctx) {
+		return
+	}
 	if len(attrs) == 0 {
 		m.Int64Histogram.Record(ctx, val, metric.WithAttributes(
 			attribute.String("http.request.method", string(requestMethod)),
@@ -980,7 +1011,7 @@ func (m ClientResponseBodySize) Record(
 		*o,
 		metric.WithAttributes(
 			append(
-				attrs,
+				attrs[:len(attrs):len(attrs)],
 				attribute.String("http.request.method", string(requestMethod)),
 				attribute.String("server.address", serverAddress),
 				attribute.Int("server.port", serverPort),
@@ -1000,6 +1031,9 @@ func (m ClientResponseBodySize) Record(
 //
 // [Content-Length]: https://www.rfc-editor.org/rfc/rfc9110.html#field.content-length
 func (m ClientResponseBodySize) RecordSet(ctx context.Context, val int64, set attribute.Set) {
+	if !m.Int64Histogram.Enabled(ctx) {
+		return
+	}
 	if set.Len() == 0 {
 		m.Int64Histogram.Record(ctx, val)
 		return
@@ -1139,6 +1173,9 @@ func (m ServerActiveRequests) Add(
 	urlScheme string,
 	attrs ...attribute.KeyValue,
 ) {
+	if !m.Int64UpDownCounter.Enabled(ctx) {
+		return
+	}
 	if len(attrs) == 0 {
 		m.Int64UpDownCounter.Add(ctx, incr, metric.WithAttributes(
 			attribute.String("http.request.method", string(requestMethod)),
@@ -1157,7 +1194,7 @@ func (m ServerActiveRequests) Add(
 		*o,
 		metric.WithAttributes(
 			append(
-				attrs,
+				attrs[:len(attrs):len(attrs)],
 				attribute.String("http.request.method", string(requestMethod)),
 				attribute.String("url.scheme", urlScheme),
 			)...,
@@ -1169,6 +1206,9 @@ func (m ServerActiveRequests) Add(
 
 // AddSet adds incr to the existing count for set.
 func (m ServerActiveRequests) AddSet(ctx context.Context, incr int64, set attribute.Set) {
+	if !m.Int64UpDownCounter.Enabled(ctx) {
+		return
+	}
 	if set.Len() == 0 {
 		m.Int64UpDownCounter.Add(ctx, incr)
 		return
@@ -1264,13 +1304,12 @@ func (ServerRequestBodySize) Description() string {
 //
 // All additional attrs passed are included in the recorded value.
 //
-// [URI scheme]: https://www.rfc-editor.org/rfc/rfc3986#section-3.1
-//
 // The size of the request payload body in bytes. This is the number of bytes
 // transferred excluding headers and is often, but not always, present as the
 // [Content-Length] header. For requests using transport encoding, this should be
 // the compressed size.
 //
+// [URI scheme]: https://www.rfc-editor.org/rfc/rfc3986#section-3.1
 // [Content-Length]: https://www.rfc-editor.org/rfc/rfc9110.html#field.content-length
 func (m ServerRequestBodySize) Record(
 	ctx context.Context,
@@ -1279,6 +1318,9 @@ func (m ServerRequestBodySize) Record(
 	urlScheme string,
 	attrs ...attribute.KeyValue,
 ) {
+	if !m.Int64Histogram.Enabled(ctx) {
+		return
+	}
 	if len(attrs) == 0 {
 		m.Int64Histogram.Record(ctx, val, metric.WithAttributes(
 			attribute.String("http.request.method", string(requestMethod)),
@@ -1297,7 +1339,7 @@ func (m ServerRequestBodySize) Record(
 		*o,
 		metric.WithAttributes(
 			append(
-				attrs,
+				attrs[:len(attrs):len(attrs)],
 				attribute.String("http.request.method", string(requestMethod)),
 				attribute.String("url.scheme", urlScheme),
 			)...,
@@ -1316,6 +1358,9 @@ func (m ServerRequestBodySize) Record(
 //
 // [Content-Length]: https://www.rfc-editor.org/rfc/rfc9110.html#field.content-length
 func (m ServerRequestBodySize) RecordSet(ctx context.Context, val int64, set attribute.Set) {
+	if !m.Int64Histogram.Enabled(ctx) {
+		return
+	}
 	if set.Len() == 0 {
 		m.Int64Histogram.Record(ctx, val)
 		return
@@ -1466,6 +1511,9 @@ func (m ServerRequestDuration) Record(
 	urlScheme string,
 	attrs ...attribute.KeyValue,
 ) {
+	if !m.Float64Histogram.Enabled(ctx) {
+		return
+	}
 	if len(attrs) == 0 {
 		m.Float64Histogram.Record(ctx, val, metric.WithAttributes(
 			attribute.String("http.request.method", string(requestMethod)),
@@ -1484,7 +1532,7 @@ func (m ServerRequestDuration) Record(
 		*o,
 		metric.WithAttributes(
 			append(
-				attrs,
+				attrs[:len(attrs):len(attrs)],
 				attribute.String("http.request.method", string(requestMethod)),
 				attribute.String("url.scheme", urlScheme),
 			)...,
@@ -1496,6 +1544,9 @@ func (m ServerRequestDuration) Record(
 
 // RecordSet records val to the current distribution for set.
 func (m ServerRequestDuration) RecordSet(ctx context.Context, val float64, set attribute.Set) {
+	if !m.Float64Histogram.Enabled(ctx) {
+		return
+	}
 	if set.Len() == 0 {
 		m.Float64Histogram.Record(ctx, val)
 		return
@@ -1638,13 +1689,12 @@ func (ServerResponseBodySize) Description() string {
 //
 // All additional attrs passed are included in the recorded value.
 //
-// [URI scheme]: https://www.rfc-editor.org/rfc/rfc3986#section-3.1
-//
 // The size of the response payload body in bytes. This is the number of bytes
 // transferred excluding headers and is often, but not always, present as the
 // [Content-Length] header. For requests using transport encoding, this should be
 // the compressed size.
 //
+// [URI scheme]: https://www.rfc-editor.org/rfc/rfc3986#section-3.1
 // [Content-Length]: https://www.rfc-editor.org/rfc/rfc9110.html#field.content-length
 func (m ServerResponseBodySize) Record(
 	ctx context.Context,
@@ -1653,6 +1703,9 @@ func (m ServerResponseBodySize) Record(
 	urlScheme string,
 	attrs ...attribute.KeyValue,
 ) {
+	if !m.Int64Histogram.Enabled(ctx) {
+		return
+	}
 	if len(attrs) == 0 {
 		m.Int64Histogram.Record(ctx, val, metric.WithAttributes(
 			attribute.String("http.request.method", string(requestMethod)),
@@ -1671,7 +1724,7 @@ func (m ServerResponseBodySize) Record(
 		*o,
 		metric.WithAttributes(
 			append(
-				attrs,
+				attrs[:len(attrs):len(attrs)],
 				attribute.String("http.request.method", string(requestMethod)),
 				attribute.String("url.scheme", urlScheme),
 			)...,
@@ -1690,6 +1743,9 @@ func (m ServerResponseBodySize) Record(
 //
 // [Content-Length]: https://www.rfc-editor.org/rfc/rfc9110.html#field.content-length
 func (m ServerResponseBodySize) RecordSet(ctx context.Context, val int64, set attribute.Set) {
+	if !m.Int64Histogram.Enabled(ctx) {
+		return
+	}
 	if set.Len() == 0 {
 		m.Int64Histogram.Record(ctx, val)
 		return
diff --git a/vendor/go.opentelemetry.io/otel/semconv/v1.41.0/MIGRATION.md b/vendor/go.opentelemetry.io/otel/semconv/v1.41.0/MIGRATION.md
new file mode 100644
index 000000000..ba52cadf7
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/semconv/v1.41.0/MIGRATION.md
@@ -0,0 +1,17 @@
+<!-- Generated. DO NOT MODIFY. -->
+# Migration from v1.40.0 to v1.41.0
+
+The `go.opentelemetry.io/otel/semconv/v1.41.0` package should be a drop-in replacement for `go.opentelemetry.io/otel/semconv/v1.40.0` with the following exceptions.
+
+## Removed
+
+The following declarations have been removed.
+Refer to the [OpenTelemetry Semantic Conventions documentation] for deprecation instructions.
+
+If the type is not listed in the documentation as deprecated, it has been removed in this version due to lack of applicability or use.
+If you use any of these non-deprecated declarations in your Go application, please [open an issue] describing your use-case.
+
+- `DeploymentEnvironmentName`
+
+[OpenTelemetry Semantic Conventions documentation]: https://github.com/open-telemetry/semantic-conventions
+[open an issue]: https://github.com/open-telemetry/opentelemetry-go/issues/new?template=Blank+issue
diff --git a/vendor/go.opentelemetry.io/otel/semconv/v1.41.0/README.md b/vendor/go.opentelemetry.io/otel/semconv/v1.41.0/README.md
new file mode 100644
index 000000000..8353bb715
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/semconv/v1.41.0/README.md
@@ -0,0 +1,3 @@
+# Semconv v1.41.0
+
+[![PkgGoDev](https://pkg.go.dev/badge/go.opentelemetry.io/otel/semconv/v1.41.0)](https://pkg.go.dev/go.opentelemetry.io/otel/semconv/v1.41.0)
diff --git a/vendor/go.opentelemetry.io/otel/semconv/v1.39.0/attribute_group.go b/vendor/go.opentelemetry.io/otel/semconv/v1.41.0/attribute_group.go
similarity index 92%
rename from vendor/go.opentelemetry.io/otel/semconv/v1.39.0/attribute_group.go
rename to vendor/go.opentelemetry.io/otel/semconv/v1.41.0/attribute_group.go
index 080365fc1..7cee08680 100644
--- a/vendor/go.opentelemetry.io/otel/semconv/v1.39.0/attribute_group.go
+++ b/vendor/go.opentelemetry.io/otel/semconv/v1.41.0/attribute_group.go
@@ -3,7 +3,7 @@
 
 // Code generated from semantic convention specification. DO NOT EDIT.
 
-package semconv // import "go.opentelemetry.io/otel/semconv/v1.39.0"
+package semconv // import "go.opentelemetry.io/otel/semconv/v1.41.0"
 
 import "go.opentelemetry.io/otel/attribute"
 
@@ -950,7 +950,7 @@ const (
 	// of the [AWS Lambda EvenSource Mapping]. An event source is mapped to a lambda
 	// function. It's contents are read by Lambda and used to trigger a function.
 	// This isn't available in the lambda execution context or the lambda runtime
-	// environtment. This is going to be populated by the AWS SDK for each language
+	// environment. This is going to be populated by the AWS SDK for each language
 	// when that UUID is present. Some of these operations are
 	// Create/Delete/Get/List/Update EventSourceMapping.
 	//
@@ -1186,7 +1186,7 @@ const (
 
 	// AWSSecretsmanagerSecretARNKey is the attribute Key conforming to the
 	// "aws.secretsmanager.secret.arn" semantic conventions. It represents the ARN
-	// of the Secret stored in the Secrets Mangger.
+	// of the Secret stored in the Secrets Manager.
 	//
 	// Type: string
 	// RequirementLevel: Recommended
@@ -1515,7 +1515,7 @@ func AWSLambdaInvokedARN(val string) attribute.KeyValue {
 // of the [AWS Lambda EvenSource Mapping]. An event source is mapped to a lambda
 // function. It's contents are read by Lambda and used to trigger a function.
 // This isn't available in the lambda execution context or the lambda runtime
-// environtment. This is going to be populated by the AWS SDK for each language
+// environment. This is going to be populated by the AWS SDK for each language
 // when that UUID is present. Some of these operations are
 // Create/Delete/Get/List/Update EventSourceMapping.
 //
@@ -1609,7 +1609,7 @@ func AWSS3UploadID(val string) attribute.KeyValue {
 
 // AWSSecretsmanagerSecretARN returns an attribute KeyValue conforming to the
 // "aws.secretsmanager.secret.arn" semantic conventions. It represents the ARN of
-// the Secret stored in the Secrets Mangger.
+// the Secret stored in the Secrets Manager.
 func AWSSecretsmanagerSecretARN(val string) attribute.KeyValue {
 	return AWSSecretsmanagerSecretARNKey.String(val)
 }
@@ -2196,6 +2196,11 @@ const (
 	// Stability: Development
 	//
 	// Examples: "12097"
+	// Note: For a given pipeline run and task, the `cicd.pipeline.task.run.id` MUST
+	// be unique within that run. For the same task across different runs of the
+	// same pipeline, the `cicd.pipeline.task.run.id` MAY remain the same, enabling
+	// correlation of `cicd.pipeline.task.run.result` values across multiple
+	// pipeline runs.
 	CICDPipelineTaskRunIDKey = attribute.Key("cicd.pipeline.task.run.id")
 
 	// CICDPipelineTaskRunResultKey is the attribute Key conforming to the
@@ -3431,7 +3436,7 @@ const (
 	//
 	// Type: string
 	// RequirementLevel: Recommended
-	// Stability: Alpha
+	// Stability: Release_Candidate
 	//
 	// Examples: "a3bf90e006b2"
 	//
@@ -3467,7 +3472,7 @@ const (
 	//
 	// Type: string
 	// RequirementLevel: Recommended
-	// Stability: Alpha
+	// Stability: Release_Candidate
 	//
 	// Examples: "gcr.io/opentelemetry/operator"
 	ContainerImageNameKey = attribute.Key("container.image.name")
@@ -3478,7 +3483,7 @@ const (
 	//
 	// Type: string[]
 	// RequirementLevel: Recommended
-	// Stability: Alpha
+	// Stability: Release_Candidate
 	//
 	// Examples:
 	// "example@sha256:afcc7f1ac1b49db317a7196c902e61c6c3c4607d63599ee1a82d702d249a0ccb",
@@ -3497,7 +3502,7 @@ const (
 	//
 	// Type: string[]
 	// RequirementLevel: Recommended
-	// Stability: Alpha
+	// Stability: Release_Candidate
 	//
 	// Examples: "v1.27.1", "3.5.7-0"
 	//
@@ -3518,7 +3523,7 @@ const (
 	// ContainerRuntimeDescriptionKey is the attribute Key conforming to the
 	// "container.runtime.description" semantic conventions. It represents a
 	// description about the runtime which could include, for example details about
-	// the CRI/API version being used or other customisations.
+	// the CRI/API version being used or other customizations.
 	//
 	// Type: string
 	// RequirementLevel: Recommended
@@ -3649,7 +3654,7 @@ func ContainerName(val string) attribute.KeyValue {
 // ContainerRuntimeDescription returns an attribute KeyValue conforming to the
 // "container.runtime.description" semantic conventions. It represents a
 // description about the runtime which could include, for example details about
-// the CRI/API version being used or other customisations.
+// the CRI/API version being used or other customizations.
 func ContainerRuntimeDescription(val string) attribute.KeyValue {
 	return ContainerRuntimeDescriptionKey.String(val)
 }
@@ -3856,6 +3861,12 @@ const (
 	// [Generating query summary]
 	// section.
 	//
+	// For batch operations, if the individual operations are known to have the same
+	// query summary
+	// then that query summary SHOULD be used prepended by `BATCH `,
+	// otherwise `db.query.summary` SHOULD be `BATCH` or some other database
+	// system specific term if more applicable.
+	//
 	// [Generating query summary]: /docs/db/database-spans.md#generating-a-summary-of-the-query
 	DBQuerySummaryKey = attribute.Key("db.query.summary")
 
@@ -4254,9 +4265,9 @@ const (
 	// "deployment.environment.name" semantic conventions. It represents the name of
 	// the [deployment environment] (aka deployment tier).
 	//
-	// Type: string
+	// Type: Enum
 	// RequirementLevel: Recommended
-	// Stability: Development
+	// Stability: Stable
 	//
 	// Examples: "staging", "production"
 	// Note: `deployment.environment.name` does not affect the uniqueness
@@ -4306,15 +4317,6 @@ const (
 	DeploymentStatusKey = attribute.Key("deployment.status")
 )
 
-// DeploymentEnvironmentName returns an attribute KeyValue conforming to the
-// "deployment.environment.name" semantic conventions. It represents the name of
-// the [deployment environment] (aka deployment tier).
-//
-// [deployment environment]: https://wikipedia.org/wiki/Deployment_environment
-func DeploymentEnvironmentName(val string) attribute.KeyValue {
-	return DeploymentEnvironmentNameKey.String(val)
-}
-
 // DeploymentID returns an attribute KeyValue conforming to the "deployment.id"
 // semantic conventions. It represents the id of the deployment.
 func DeploymentID(val string) attribute.KeyValue {
@@ -4328,6 +4330,22 @@ func DeploymentName(val string) attribute.KeyValue {
 	return DeploymentNameKey.String(val)
 }
 
+// Enum values for deployment.environment.name
+var (
+	// Production environment
+	// Stability: stable
+	DeploymentEnvironmentNameProduction = DeploymentEnvironmentNameKey.String("production")
+	// Staging environment
+	// Stability: stable
+	DeploymentEnvironmentNameStaging = DeploymentEnvironmentNameKey.String("staging")
+	// Testing environment
+	// Stability: stable
+	DeploymentEnvironmentNameTest = DeploymentEnvironmentNameKey.String("test")
+	// Development environment
+	// Stability: stable
+	DeploymentEnvironmentNameDevelopment = DeploymentEnvironmentNameKey.String("development")
+)
+
 // Enum values for deployment.status
 var (
 	// failed
@@ -4623,27 +4641,6 @@ func EnduserPseudoID(val string) attribute.KeyValue {
 
 // Namespace: error
 const (
-	// ErrorMessageKey is the attribute Key conforming to the "error.message"
-	// semantic conventions. It represents a message providing more detail about an
-	// error in human-readable form.
-	//
-	// Type: string
-	// RequirementLevel: Recommended
-	// Stability: Development
-	//
-	// Examples: "Unexpected input type: string", "The user has exceeded their
-	// storage quota"
-	// Note: `error.message` should provide additional context and detail about an
-	// error.
-	// It is NOT RECOMMENDED to duplicate the value of `error.type` in
-	// `error.message`.
-	// It is also NOT RECOMMENDED to duplicate the value of `exception.message` in
-	// `error.message`.
-	//
-	// `error.message` is NOT RECOMMENDED for metrics or spans due to its unbounded
-	// cardinality and overlap with span status.
-	ErrorMessageKey = attribute.Key("error.message")
-
 	// ErrorTypeKey is the attribute Key conforming to the "error.type" semantic
 	// conventions. It represents the describes a class of error the operation ended
 	// with.
@@ -4660,6 +4657,12 @@ const (
 	// When `error.type` is set to a type (e.g., an exception type), its
 	// canonical class name identifying the type within the artifact SHOULD be used.
 	//
+	// If the recorded error type is a wrapper that is not meaningful for
+	// failure classification, instrumentation MAY use the type of the inner
+	// error instead. For example, in Go, errors created with `fmt.Errorf`
+	// using `%w` MAY be unwrapped when the wrapper type does not help
+	// classify the failure.
+	//
 	// Instrumentations SHOULD document the list of errors they report.
 	//
 	// The cardinality of `error.type` within one instrumentation library SHOULD be
@@ -4683,13 +4686,6 @@ const (
 	ErrorTypeKey = attribute.Key("error.type")
 )
 
-// ErrorMessage returns an attribute KeyValue conforming to the "error.message"
-// semantic conventions. It represents a message providing more detail about an
-// error in human-readable form.
-func ErrorMessage(val string) attribute.KeyValue {
-	return ErrorMessageKey.String(val)
-}
-
 // Enum values for error.type
 var (
 	// A fallback error value to be used when the instrumentation doesn't define a
@@ -4710,6 +4706,9 @@ const (
 	// Stability: Stable
 	//
 	// Examples: "Division by zero", "Can't convert 'int' object to str implicitly"
+	// Note: > [!WARNING]
+	//
+	// > This attribute may contain sensitive information.
 	ExceptionMessageKey = attribute.Key("exception.message")
 
 	// ExceptionStacktraceKey is the attribute Key conforming to the
@@ -4737,6 +4736,11 @@ const (
 	// Stability: Stable
 	//
 	// Examples: "java.net.ConnectException", "OSError"
+	// Note: If the recorded exception type is a wrapper that is not meaningful for
+	// failure classification, instrumentation MAY use the type of the inner
+	// exception instead. For example, in Go, errors created with `fmt.Errorf`
+	// using `%w` MAY be unwrapped when the wrapper type does not help
+	// classify the failure.
 	ExceptionTypeKey = attribute.Key("exception.type")
 )
 
@@ -5165,6 +5169,19 @@ const (
 	// Examples: "5157782b-2203-4c80-a857-dbbd5e7761db"
 	FeatureFlagContextIDKey = attribute.Key("feature_flag.context.id")
 
+	// FeatureFlagErrorMessageKey is the attribute Key conforming to the
+	// "feature_flag.error.message" semantic conventions. It represents a message
+	// providing more detail about an error that occurred during feature flag
+	// evaluation in human-readable form.
+	//
+	// Type: string
+	// RequirementLevel: Recommended
+	// Stability: Release_Candidate
+	//
+	// Examples: "Unexpected input type: string", "The user has exceeded their
+	// storage quota"
+	FeatureFlagErrorMessageKey = attribute.Key("feature_flag.error.message")
+
 	// FeatureFlagKeyKey is the attribute Key conforming to the "feature_flag.key"
 	// semantic conventions. It represents the lookup key of the feature flag.
 	//
@@ -5266,6 +5283,14 @@ func FeatureFlagContextID(val string) attribute.KeyValue {
 	return FeatureFlagContextIDKey.String(val)
 }
 
+// FeatureFlagErrorMessage returns an attribute KeyValue conforming to the
+// "feature_flag.error.message" semantic conventions. It represents a message
+// providing more detail about an error that occurred during feature flag
+// evaluation in human-readable form.
+func FeatureFlagErrorMessage(val string) attribute.KeyValue {
+	return FeatureFlagErrorMessageKey.String(val)
+}
+
 // FeatureFlagKey returns an attribute KeyValue conforming to the
 // "feature_flag.key" semantic conventions. It represents the lookup key of the
 // feature flag.
@@ -5980,6 +6005,41 @@ const (
 	//
 	// [default internal DNS name]: https://cloud.google.com/compute/docs/internal-dns#instance-fully-qualified-domain-names
 	GCPGCEInstanceNameKey = attribute.Key("gcp.gce.instance.name")
+
+	// GCPGCEInstanceGroupManagerNameKey is the attribute Key conforming to the
+	// "gcp.gce.instance_group_manager.name" semantic conventions. It represents the
+	// name of the Instance Group Manager (IGM) that manages this VM, if any.
+	//
+	// Type: string
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: "web-igm", "my-managed-group"
+	GCPGCEInstanceGroupManagerNameKey = attribute.Key("gcp.gce.instance_group_manager.name")
+
+	// GCPGCEInstanceGroupManagerRegionKey is the attribute Key conforming to the
+	// "gcp.gce.instance_group_manager.region" semantic conventions. It represents
+	// the region of a **regional** Instance Group Manager (e.g., `us-central1`).
+	// Set this **only** when the IGM is regional.
+	//
+	// Type: string
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: "us-central1", "europe-west1"
+	GCPGCEInstanceGroupManagerRegionKey = attribute.Key("gcp.gce.instance_group_manager.region")
+
+	// GCPGCEInstanceGroupManagerZoneKey is the attribute Key conforming to the
+	// "gcp.gce.instance_group_manager.zone" semantic conventions. It represents the
+	// zone of a **zonal** Instance Group Manager (e.g., `us-central1-a`). Set this
+	// **only** when the IGM is zonal.
+	//
+	// Type: string
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: "us-central1-a", "europe-west1-b"
+	GCPGCEInstanceGroupManagerZoneKey = attribute.Key("gcp.gce.instance_group_manager.zone")
 )
 
 // GCPAppHubApplicationContainer returns an attribute KeyValue conforming to the
@@ -6103,6 +6163,29 @@ func GCPGCEInstanceName(val string) attribute.KeyValue {
 	return GCPGCEInstanceNameKey.String(val)
 }
 
+// GCPGCEInstanceGroupManagerName returns an attribute KeyValue conforming to the
+// "gcp.gce.instance_group_manager.name" semantic conventions. It represents the
+// name of the Instance Group Manager (IGM) that manages this VM, if any.
+func GCPGCEInstanceGroupManagerName(val string) attribute.KeyValue {
+	return GCPGCEInstanceGroupManagerNameKey.String(val)
+}
+
+// GCPGCEInstanceGroupManagerRegion returns an attribute KeyValue conforming to
+// the "gcp.gce.instance_group_manager.region" semantic conventions. It
+// represents the region of a **regional** Instance Group Manager (e.g.,
+// `us-central1`). Set this **only** when the IGM is regional.
+func GCPGCEInstanceGroupManagerRegion(val string) attribute.KeyValue {
+	return GCPGCEInstanceGroupManagerRegionKey.String(val)
+}
+
+// GCPGCEInstanceGroupManagerZone returns an attribute KeyValue conforming to the
+// "gcp.gce.instance_group_manager.zone" semantic conventions. It represents the
+// zone of a **zonal** Instance Group Manager (e.g., `us-central1-a`). Set this
+// **only** when the IGM is zonal.
+func GCPGCEInstanceGroupManagerZone(val string) attribute.KeyValue {
+	return GCPGCEInstanceGroupManagerZoneKey.String(val)
+}
+
 // Enum values for gcp.apphub.service.criticality_type
 var (
 	// Mission critical service.
@@ -6265,6 +6348,17 @@ const (
 	// Examples: "Math Tutor", "Fiction Writer"
 	GenAIAgentNameKey = attribute.Key("gen_ai.agent.name")
 
+	// GenAIAgentVersionKey is the attribute Key conforming to the
+	// "gen_ai.agent.version" semantic conventions. It represents the version of the
+	// GenAI agent.
+	//
+	// Type: string
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: "1.0.0", "2025-05-01"
+	GenAIAgentVersionKey = attribute.Key("gen_ai.agent.version")
+
 	// GenAIConversationIDKey is the attribute Key conforming to the
 	// "gen_ai.conversation.id" semantic conventions. It represents the unique
 	// identifier for a conversation (session, thread), used to store and correlate
@@ -6596,6 +6690,17 @@ const (
 	// Examples: "forest", "lived"
 	GenAIRequestStopSequencesKey = attribute.Key("gen_ai.request.stop_sequences")
 
+	// GenAIRequestStreamKey is the attribute Key conforming to the
+	// "gen_ai.request.stream" semantic conventions. It represents the indicates
+	// whether the GenAI request was made in streaming mode.
+	//
+	// Type: boolean
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples:
+	GenAIRequestStreamKey = attribute.Key("gen_ai.request.stream")
+
 	// GenAIRequestTemperatureKey is the attribute Key conforming to the
 	// "gen_ai.request.temperature" semantic conventions. It represents the
 	// temperature setting for the GenAI request.
@@ -6663,6 +6768,57 @@ const (
 	// Examples: "gpt-4-0613"
 	GenAIResponseModelKey = attribute.Key("gen_ai.response.model")
 
+	// GenAIResponseTimeToFirstChunkKey is the attribute Key conforming to the
+	// "gen_ai.response.time_to_first_chunk" semantic conventions. It represents the
+	// time to first chunk in a streaming response, measured from request issuance,
+	// in seconds. The value is measured from when the client issues the generation
+	// request to when the first chunk is received in the response stream.
+	//
+	// Type: double
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: 0.5, 1.2
+	GenAIResponseTimeToFirstChunkKey = attribute.Key("gen_ai.response.time_to_first_chunk")
+
+	// GenAIRetrievalDocumentsKey is the attribute Key conforming to the
+	// "gen_ai.retrieval.documents" semantic conventions. It represents the
+	// documents retrieved.
+	//
+	// Type: any
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: "[\n {\n "id": "doc_123",\n "score": 0.95\n },\n {\n "id":
+	// "doc_456",\n "score": 0.87\n },\n {\n "id": "doc_789",\n "score": 0.82\n
+	// }\n]\n"
+	// Note: Instrumentations MUST follow [Retrieval documents JSON schema].
+	// When the attribute is recorded on events, it MUST be recorded in structured
+	// form. When recorded on spans, it MAY be recorded as a JSON string if
+	// structured
+	// format is not supported and SHOULD be recorded in structured form otherwise.
+	//
+	// Each document object SHOULD contain at least the following properties:
+	// `id` (string): A unique identifier for the document, `score` (double): The
+	// relevance score of the document
+	//
+	// [Retrieval documents JSON schema]: /docs/gen-ai/gen-ai-retrieval-documents.json
+	GenAIRetrievalDocumentsKey = attribute.Key("gen_ai.retrieval.documents")
+
+	// GenAIRetrievalQueryTextKey is the attribute Key conforming to the
+	// "gen_ai.retrieval.query.text" semantic conventions. It represents the query
+	// text used for retrieval.
+	//
+	// Type: string
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: "What is the capital of France?", "weather in Paris"
+	// Note: > [!Warning]
+	//
+	// > This attribute may contain sensitive information.
+	GenAIRetrievalQueryTextKey = attribute.Key("gen_ai.retrieval.query.text")
+
 	// GenAISystemInstructionsKey is the attribute Key conforming to the
 	// "gen_ai.system_instructions" semantic conventions. It represents the system
 	// message or instructions provided to the GenAI model separately from the chat
@@ -6766,7 +6922,7 @@ const (
 
 	// GenAIToolDefinitionsKey is the attribute Key conforming to the
 	// "gen_ai.tool.definitions" semantic conventions. It represents the list of
-	// source system tool definitions available to the GenAI agent or model.
+	// tool definitions available to the GenAI agent or model.
 	//
 	// Type: any
 	// RequirementLevel: Recommended
@@ -6778,19 +6934,18 @@ const (
 	// "description": "The city and state, e.g. San Francisco, CA"\n },\n "unit":
 	// {\n "type": "string",\n "enum": [\n "celsius",\n "fahrenheit"\n ]\n }\n },\n
 	// "required": [\n "location",\n "unit"\n ]\n }\n }\n]\n"
-	// Note: The value of this attribute matches source system tool definition
-	// format.
+	// Note: Instrumentations MUST follow [Tool Definitions JSON Schema].
 	//
-	// It's expected to be an array of objects where each object represents a tool
-	// definition. In case a serialized string is available
-	// to the instrumentation, the instrumentation SHOULD do the best effort to
-	// deserialize it to an array. When recorded on spans, it MAY be recorded as a
-	// JSON string if structured format is not supported and SHOULD be recorded in
-	// structured form otherwise.
+	// When the attribute is recorded on events, it MUST be recorded in structured
+	// form. When recorded on spans, it MAY be recorded as a JSON string if
+	// structured
+	// format is not supported and SHOULD be recorded in structured form otherwise.
 	//
 	// Since this attribute could be large, it's NOT RECOMMENDED to populate
-	// it by default. Instrumentations MAY provide a way to enable
-	// populating this attribute.
+	// non-required properties by default. Instrumentations MAY provide a way
+	// to enable populating optional properties.
+	//
+	// [Tool Definitions JSON Schema]: /docs/gen-ai/gen-ai-tool-definitions.json
 	GenAIToolDefinitionsKey = attribute.Key("gen_ai.tool.definitions")
 
 	// GenAIToolDescriptionKey is the attribute Key conforming to the
@@ -6837,6 +6992,30 @@ const (
 	// updates.
 	GenAIToolTypeKey = attribute.Key("gen_ai.tool.type")
 
+	// GenAIUsageCacheCreationInputTokensKey is the attribute Key conforming to the
+	// "gen_ai.usage.cache_creation.input_tokens" semantic conventions. It
+	// represents the number of input tokens written to a provider-managed cache.
+	//
+	// Type: int
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: 25
+	// Note: The value SHOULD be included in `gen_ai.usage.input_tokens`.
+	GenAIUsageCacheCreationInputTokensKey = attribute.Key("gen_ai.usage.cache_creation.input_tokens")
+
+	// GenAIUsageCacheReadInputTokensKey is the attribute Key conforming to the
+	// "gen_ai.usage.cache_read.input_tokens" semantic conventions. It represents
+	// the number of input tokens served from a provider-managed cache.
+	//
+	// Type: int
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: 50
+	// Note: The value SHOULD be included in `gen_ai.usage.input_tokens`.
+	GenAIUsageCacheReadInputTokensKey = attribute.Key("gen_ai.usage.cache_read.input_tokens")
+
 	// GenAIUsageInputTokensKey is the attribute Key conforming to the
 	// "gen_ai.usage.input_tokens" semantic conventions. It represents the number of
 	// tokens used in the GenAI input (prompt).
@@ -6846,6 +7025,12 @@ const (
 	// Stability: Development
 	//
 	// Examples: 100
+	// Note: This value SHOULD include all types of input tokens, including cached
+	// tokens.
+	// Instrumentations SHOULD make a best effort to populate this value, using a
+	// total
+	// provided by the provider when available or, depending on the provider API,
+	// by summing different token types parsed from the provider output.
 	GenAIUsageInputTokensKey = attribute.Key("gen_ai.usage.input_tokens")
 
 	// GenAIUsageOutputTokensKey is the attribute Key conforming to the
@@ -6858,6 +7043,32 @@ const (
 	//
 	// Examples: 180
 	GenAIUsageOutputTokensKey = attribute.Key("gen_ai.usage.output_tokens")
+
+	// GenAIUsageReasoningOutputTokensKey is the attribute Key conforming to the
+	// "gen_ai.usage.reasoning.output_tokens" semantic conventions. It represents
+	// the number of output tokens used for reasoning (e.g. chain-of-thought,
+	// extended thinking).
+	//
+	// Type: int
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: 50
+	// Note: The value SHOULD be included in `gen_ai.usage.output_tokens`.
+	GenAIUsageReasoningOutputTokensKey = attribute.Key("gen_ai.usage.reasoning.output_tokens")
+
+	// GenAIWorkflowNameKey is the attribute Key conforming to the
+	// "gen_ai.workflow.name" semantic conventions. It represents the human-readable
+	// name of the GenAI workflow provided by the application.
+	//
+	// Type: string
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: "multi_agent_rag", "customer_support_pipeline"
+	// Note: This attribute can be populated in different frameworks eg: name of the
+	// first chain in LangChain OR name of the crew in CrewAI.
+	GenAIWorkflowNameKey = attribute.Key("gen_ai.workflow.name")
 )
 
 // GenAIAgentDescription returns an attribute KeyValue conforming to the
@@ -6880,6 +7091,13 @@ func GenAIAgentName(val string) attribute.KeyValue {
 	return GenAIAgentNameKey.String(val)
 }
 
+// GenAIAgentVersion returns an attribute KeyValue conforming to the
+// "gen_ai.agent.version" semantic conventions. It represents the version of the
+// GenAI agent.
+func GenAIAgentVersion(val string) attribute.KeyValue {
+	return GenAIAgentVersionKey.String(val)
+}
+
 // GenAIConversationID returns an attribute KeyValue conforming to the
 // "gen_ai.conversation.id" semantic conventions. It represents the unique
 // identifier for a conversation (session, thread), used to store and correlate
@@ -6993,6 +7211,13 @@ func GenAIRequestStopSequences(val ...string) attribute.KeyValue {
 	return GenAIRequestStopSequencesKey.StringSlice(val)
 }
 
+// GenAIRequestStream returns an attribute KeyValue conforming to the
+// "gen_ai.request.stream" semantic conventions. It represents the indicates
+// whether the GenAI request was made in streaming mode.
+func GenAIRequestStream(val bool) attribute.KeyValue {
+	return GenAIRequestStreamKey.Bool(val)
+}
+
 // GenAIRequestTemperature returns an attribute KeyValue conforming to the
 // "gen_ai.request.temperature" semantic conventions. It represents the
 // temperature setting for the GenAI request.
@@ -7036,6 +7261,22 @@ func GenAIResponseModel(val string) attribute.KeyValue {
 	return GenAIResponseModelKey.String(val)
 }
 
+// GenAIResponseTimeToFirstChunk returns an attribute KeyValue conforming to the
+// "gen_ai.response.time_to_first_chunk" semantic conventions. It represents the
+// time to first chunk in a streaming response, measured from request issuance,
+// in seconds. The value is measured from when the client issues the generation
+// request to when the first chunk is received in the response stream.
+func GenAIResponseTimeToFirstChunk(val float64) attribute.KeyValue {
+	return GenAIResponseTimeToFirstChunkKey.Float64(val)
+}
+
+// GenAIRetrievalQueryText returns an attribute KeyValue conforming to the
+// "gen_ai.retrieval.query.text" semantic conventions. It represents the query
+// text used for retrieval.
+func GenAIRetrievalQueryText(val string) attribute.KeyValue {
+	return GenAIRetrievalQueryTextKey.String(val)
+}
+
 // GenAIToolCallID returns an attribute KeyValue conforming to the
 // "gen_ai.tool.call.id" semantic conventions. It represents the tool call
 // identifier.
@@ -7064,6 +7305,20 @@ func GenAIToolType(val string) attribute.KeyValue {
 	return GenAIToolTypeKey.String(val)
 }
 
+// GenAIUsageCacheCreationInputTokens returns an attribute KeyValue conforming to
+// the "gen_ai.usage.cache_creation.input_tokens" semantic conventions. It
+// represents the number of input tokens written to a provider-managed cache.
+func GenAIUsageCacheCreationInputTokens(val int) attribute.KeyValue {
+	return GenAIUsageCacheCreationInputTokensKey.Int(val)
+}
+
+// GenAIUsageCacheReadInputTokens returns an attribute KeyValue conforming to the
+// "gen_ai.usage.cache_read.input_tokens" semantic conventions. It represents the
+// number of input tokens served from a provider-managed cache.
+func GenAIUsageCacheReadInputTokens(val int) attribute.KeyValue {
+	return GenAIUsageCacheReadInputTokensKey.Int(val)
+}
+
 // GenAIUsageInputTokens returns an attribute KeyValue conforming to the
 // "gen_ai.usage.input_tokens" semantic conventions. It represents the number of
 // tokens used in the GenAI input (prompt).
@@ -7078,6 +7333,21 @@ func GenAIUsageOutputTokens(val int) attribute.KeyValue {
 	return GenAIUsageOutputTokensKey.Int(val)
 }
 
+// GenAIUsageReasoningOutputTokens returns an attribute KeyValue conforming to
+// the "gen_ai.usage.reasoning.output_tokens" semantic conventions. It represents
+// the number of output tokens used for reasoning (e.g. chain-of-thought,
+// extended thinking).
+func GenAIUsageReasoningOutputTokens(val int) attribute.KeyValue {
+	return GenAIUsageReasoningOutputTokensKey.Int(val)
+}
+
+// GenAIWorkflowName returns an attribute KeyValue conforming to the
+// "gen_ai.workflow.name" semantic conventions. It represents the human-readable
+// name of the GenAI workflow provided by the application.
+func GenAIWorkflowName(val string) attribute.KeyValue {
+	return GenAIWorkflowNameKey.String(val)
+}
+
 // Enum values for gen_ai.operation.name
 var (
 	// Chat completion operation such as [OpenAI Chat API]
@@ -7100,6 +7370,11 @@ var (
 	//
 	// [OpenAI Create embeddings API]: https://platform.openai.com/docs/api-reference/embeddings/create
 	GenAIOperationNameEmbeddings = GenAIOperationNameKey.String("embeddings")
+	// Retrieval operation such as [OpenAI Search Vector Store API]
+	// Stability: development
+	//
+	// [OpenAI Search Vector Store API]: https://platform.openai.com/docs/api-reference/vector-stores/search
+	GenAIOperationNameRetrieval = GenAIOperationNameKey.String("retrieval")
 	// Create GenAI agent
 	// Stability: development
 	GenAIOperationNameCreateAgent = GenAIOperationNameKey.String("create_agent")
@@ -7109,6 +7384,9 @@ var (
 	// Execute a tool
 	// Stability: development
 	GenAIOperationNameExecuteTool = GenAIOperationNameKey.String("execute_tool")
+	// Invoke GenAI workflow
+	// Stability: development
+	GenAIOperationNameInvokeWorkflow = GenAIOperationNameKey.String("invoke_workflow")
 )
 
 // Enum values for gen_ai.output.type
@@ -7163,7 +7441,7 @@ var (
 	// [Azure OpenAI]
 	// Stability: development
 	//
-	// [Azure OpenAI]: https://azure.microsoft.com/products/ai-services/openai-service/
+	// [Azure OpenAI]: https://learn.microsoft.com/en-us/azure/ai-services/openai/overview
 	GenAIProviderNameAzureAIOpenAI = GenAIProviderNameKey.String("azure.ai.openai")
 	// [IBM Watsonx AI]
 	// Stability: development
@@ -7379,6 +7657,44 @@ var (
 
 // Namespace: go
 const (
+	// GoCPUDetailedStateKey is the attribute Key conforming to the
+	// "go.cpu.detailed_state" semantic conventions. It represents the detailed
+	// state of the CPU.
+	//
+	// Type: string
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: "gc/pause", "gc/mark/assist"
+	// Note: Value SHOULD match the specific CPU class reported by the Go runtime
+	// under `/cpu/classes/...`. The list of possible values is subject to change
+	// with the Go version used.
+	GoCPUDetailedStateKey = attribute.Key("go.cpu.detailed_state")
+
+	// GoCPUStateKey is the attribute Key conforming to the "go.cpu.state" semantic
+	// conventions. It represents the state of the CPU.
+	//
+	// Type: Enum
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: "user", "gc"
+	GoCPUStateKey = attribute.Key("go.cpu.state")
+
+	// GoMemoryDetailedTypeKey is the attribute Key conforming to the
+	// "go.memory.detailed_type" semantic conventions. It represents the detailed
+	// type of memory.
+	//
+	// Type: string
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: "heap/objects", "heap/free"
+	// Note: Value SHOULD match the specific memory class reported by the Go runtime
+	// under `/memory/classes/...`. The list of possible values is subject to change
+	// with the Go version used.
+	GoMemoryDetailedTypeKey = attribute.Key("go.memory.detailed_type")
+
 	// GoMemoryTypeKey is the attribute Key conforming to the "go.memory.type"
 	// semantic conventions. It represents the type of memory.
 	//
@@ -7390,6 +7706,36 @@ const (
 	GoMemoryTypeKey = attribute.Key("go.memory.type")
 )
 
+// GoCPUDetailedState returns an attribute KeyValue conforming to the
+// "go.cpu.detailed_state" semantic conventions. It represents the detailed state
+// of the CPU.
+func GoCPUDetailedState(val string) attribute.KeyValue {
+	return GoCPUDetailedStateKey.String(val)
+}
+
+// GoMemoryDetailedType returns an attribute KeyValue conforming to the
+// "go.memory.detailed_type" semantic conventions. It represents the detailed
+// type of memory.
+func GoMemoryDetailedType(val string) attribute.KeyValue {
+	return GoMemoryDetailedTypeKey.String(val)
+}
+
+// Enum values for go.cpu.state
+var (
+	// CPU time spent running user Go code.
+	// Stability: development
+	GoCPUStateUser = GoCPUStateKey.String("user")
+	// CPU time spent performing garbage collection tasks.
+	// Stability: development
+	GoCPUStateGC = GoCPUStateKey.String("gc")
+	// CPU time spent returning unused memory to the underlying platform.
+	// Stability: development
+	GoCPUStateScavenge = GoCPUStateKey.String("scavenge")
+	// Available CPU time not spent executing any Go or Go runtime code.
+	// Stability: development
+	GoCPUStateIdle = GoCPUStateKey.String("idle")
+)
+
 // Enum values for go.memory.type
 var (
 	// Memory allocated from the heap that is reserved for stack space, whether or
@@ -7412,7 +7758,8 @@ const (
 	// Stability: Development
 	//
 	// Examples: query findBookById { bookById(id: ?) { name } }
-	// Note: The value may be sanitized to exclude sensitive information.
+	// Note: If instrumentation can reliably identify and redact sensitive
+	// information it SHOULD do it.
 	GraphQLDocumentKey = attribute.Key("graphql.document")
 
 	// GraphQLOperationNameKey is the attribute Key conforming to the
@@ -7889,9 +8236,18 @@ const (
 	// the list of known HTTP methods. If this override is done via environment
 	// variable, then the environment variable MUST be named
 	// OTEL_INSTRUMENTATION_HTTP_KNOWN_METHODS and support a comma-separated list of
-	// case-sensitive known HTTP methods
-	// (this list MUST be a full override of the default known method, it is not a
-	// list of known methods in addition to the defaults).
+	// case-sensitive known HTTP methods.
+	//
+	//
+	// If this override is done via declarative configuration, then the list MUST be
+	// configurable via the `known_methods` property
+	// (an array of case-sensitive strings with minimum items 0) under
+	// `.instrumentation/development.general.http.client` and/or
+	// `.instrumentation/development.general.http.server`.
+	//
+	// In either case, this list MUST be a full override of the default known
+	// methods,
+	// it is not a list of known methods in addition to the defaults.
 	//
 	// HTTP method names are case-sensitive and `http.request.method` attribute
 	// value MUST match a known HTTP method name exactly.
@@ -8154,7 +8510,7 @@ var (
 const (
 	// HwBatteryCapacityKey is the attribute Key conforming to the
 	// "hw.battery.capacity" semantic conventions. It represents the design capacity
-	// in Watts-hours or Amper-hours.
+	// in Watts-hours or Ampere-hours.
 	//
 	// Type: string
 	// RequirementLevel: Recommended
@@ -8456,7 +8812,7 @@ const (
 
 // HwBatteryCapacity returns an attribute KeyValue conforming to the
 // "hw.battery.capacity" semantic conventions. It represents the design capacity
-// in Watts-hours or Amper-hours.
+// in Watts-hours or Ampere-hours.
 func HwBatteryCapacity(val string) attribute.KeyValue {
 	return HwBatteryCapacityKey.String(val)
 }
@@ -8845,7 +9201,7 @@ const (
 	//
 	// Type: string
 	// RequirementLevel: Recommended
-	// Stability: Alpha
+	// Stability: Release_Candidate
 	//
 	// Examples: "opentelemetry-cluster"
 	K8SClusterNameKey = attribute.Key("k8s.cluster.name")
@@ -8856,7 +9212,7 @@ const (
 	//
 	// Type: string
 	// RequirementLevel: Recommended
-	// Stability: Alpha
+	// Stability: Release_Candidate
 	//
 	// Examples: "218fc5a9-a5f1-4b54-aa05-46717d0ab26d"
 	// Note: K8s doesn't have support for obtaining a cluster ID. If this is ever
@@ -8892,7 +9248,7 @@ const (
 	//
 	// Type: string
 	// RequirementLevel: Recommended
-	// Stability: Alpha
+	// Stability: Release_Candidate
 	//
 	// Examples: "redis"
 	K8SContainerNameKey = attribute.Key("k8s.container.name")
@@ -8904,7 +9260,7 @@ const (
 	//
 	// Type: int
 	// RequirementLevel: Recommended
-	// Stability: Alpha
+	// Stability: Release_Candidate
 	//
 	// Examples:
 	K8SContainerRestartCountKey = attribute.Key("k8s.container.restart_count")
@@ -8955,7 +9311,7 @@ const (
 	//
 	// Type: string
 	// RequirementLevel: Recommended
-	// Stability: Alpha
+	// Stability: Release_Candidate
 	//
 	// Examples: "opentelemetry"
 	K8SCronJobNameKey = attribute.Key("k8s.cronjob.name")
@@ -8965,7 +9321,7 @@ const (
 	//
 	// Type: string
 	// RequirementLevel: Recommended
-	// Stability: Alpha
+	// Stability: Release_Candidate
 	//
 	// Examples: "275ecb36-5aa8-4c2a-9c47-d8bb681b9aff"
 	K8SCronJobUIDKey = attribute.Key("k8s.cronjob.uid")
@@ -8976,7 +9332,7 @@ const (
 	//
 	// Type: string
 	// RequirementLevel: Recommended
-	// Stability: Alpha
+	// Stability: Release_Candidate
 	//
 	// Examples: "opentelemetry"
 	K8SDaemonSetNameKey = attribute.Key("k8s.daemonset.name")
@@ -8986,7 +9342,7 @@ const (
 	//
 	// Type: string
 	// RequirementLevel: Recommended
-	// Stability: Alpha
+	// Stability: Release_Candidate
 	//
 	// Examples: "275ecb36-5aa8-4c2a-9c47-d8bb681b9aff"
 	K8SDaemonSetUIDKey = attribute.Key("k8s.daemonset.uid")
@@ -8997,7 +9353,7 @@ const (
 	//
 	// Type: string
 	// RequirementLevel: Recommended
-	// Stability: Alpha
+	// Stability: Release_Candidate
 	//
 	// Examples: "opentelemetry"
 	K8SDeploymentNameKey = attribute.Key("k8s.deployment.name")
@@ -9008,7 +9364,7 @@ const (
 	//
 	// Type: string
 	// RequirementLevel: Recommended
-	// Stability: Alpha
+	// Stability: Release_Candidate
 	//
 	// Examples: "275ecb36-5aa8-4c2a-9c47-d8bb681b9aff"
 	K8SDeploymentUIDKey = attribute.Key("k8s.deployment.uid")
@@ -9098,7 +9454,7 @@ const (
 	//
 	// Type: string
 	// RequirementLevel: Recommended
-	// Stability: Alpha
+	// Stability: Release_Candidate
 	//
 	// Examples: "opentelemetry"
 	K8SJobNameKey = attribute.Key("k8s.job.name")
@@ -9108,7 +9464,7 @@ const (
 	//
 	// Type: string
 	// RequirementLevel: Recommended
-	// Stability: Alpha
+	// Stability: Release_Candidate
 	//
 	// Examples: "275ecb36-5aa8-4c2a-9c47-d8bb681b9aff"
 	K8SJobUIDKey = attribute.Key("k8s.job.uid")
@@ -9119,7 +9475,7 @@ const (
 	//
 	// Type: string
 	// RequirementLevel: Recommended
-	// Stability: Alpha
+	// Stability: Release_Candidate
 	//
 	// Examples: "default"
 	K8SNamespaceNameKey = attribute.Key("k8s.namespace.name")
@@ -9184,27 +9540,128 @@ const (
 	//
 	// Type: string
 	// RequirementLevel: Recommended
-	// Stability: Alpha
+	// Stability: Release_Candidate
 	//
 	// Examples: "node-1"
 	K8SNodeNameKey = attribute.Key("k8s.node.name")
 
+	// K8SNodeSystemContainerNameKey is the attribute Key conforming to the
+	// "k8s.node.system_container.name" semantic conventions. It represents the name
+	// of the system container running on the K8s Node.
+	//
+	// Type: string
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: "kubelet", "runtime", "pods", "misc"
+	K8SNodeSystemContainerNameKey = attribute.Key("k8s.node.system_container.name")
+
 	// K8SNodeUIDKey is the attribute Key conforming to the "k8s.node.uid" semantic
 	// conventions. It represents the UID of the Node.
 	//
 	// Type: string
 	// RequirementLevel: Recommended
-	// Stability: Alpha
+	// Stability: Release_Candidate
 	//
 	// Examples: "1eb3a0c6-0477-4080-a9cb-0cb7db65c6a2"
 	K8SNodeUIDKey = attribute.Key("k8s.node.uid")
 
+	// K8SPersistentvolumeNameKey is the attribute Key conforming to the
+	// "k8s.persistentvolume.name" semantic conventions. It represents the name of
+	// the PersistentVolume.
+	//
+	// Type: string
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: "pv-data-01"
+	K8SPersistentvolumeNameKey = attribute.Key("k8s.persistentvolume.name")
+
+	// K8SPersistentvolumeReclaimPolicyKey is the attribute Key conforming to the
+	// "k8s.persistentvolume.reclaim_policy" semantic conventions. It represents the
+	// reclaim policy of the PersistentVolume.
+	//
+	// Type: Enum
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: "Delete", "Retain", "Recycle"
+	// Note: This attribute aligns with the `persistentVolumeReclaimPolicy` field of
+	// the
+	// [K8s PersistentVolumeSpec].
+	//
+	// [K8s PersistentVolumeSpec]: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-v1/#PersistentVolumeSpec
+	K8SPersistentvolumeReclaimPolicyKey = attribute.Key("k8s.persistentvolume.reclaim_policy")
+
+	// K8SPersistentvolumeStatusPhaseKey is the attribute Key conforming to the
+	// "k8s.persistentvolume.status.phase" semantic conventions. It represents the
+	// phase of the PersistentVolume.
+	//
+	// Type: Enum
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: "Pending", "Available", "Bound", "Released", "Failed"
+	// Note: This attribute aligns with the `phase` field of the
+	// [K8s PersistentVolumeStatus].
+	//
+	// [K8s PersistentVolumeStatus]: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-v1/#PersistentVolumeStatus
+	K8SPersistentvolumeStatusPhaseKey = attribute.Key("k8s.persistentvolume.status.phase")
+
+	// K8SPersistentvolumeUIDKey is the attribute Key conforming to the
+	// "k8s.persistentvolume.uid" semantic conventions. It represents the UID of the
+	// PersistentVolume.
+	//
+	// Type: string
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: "275ecb36-5aa8-4c2a-9c47-d8bb681b9aff"
+	K8SPersistentvolumeUIDKey = attribute.Key("k8s.persistentvolume.uid")
+
+	// K8SPersistentvolumeclaimNameKey is the attribute Key conforming to the
+	// "k8s.persistentvolumeclaim.name" semantic conventions. It represents the name
+	// of the PersistentVolumeClaim.
+	//
+	// Type: string
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: "pvc-data-01"
+	K8SPersistentvolumeclaimNameKey = attribute.Key("k8s.persistentvolumeclaim.name")
+
+	// K8SPersistentvolumeclaimStatusPhaseKey is the attribute Key conforming to the
+	// "k8s.persistentvolumeclaim.status.phase" semantic conventions. It represents
+	// the phase of the PersistentVolumeClaim.
+	//
+	// Type: Enum
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: "Pending", "Bound", "Lost"
+	// Note: This attribute aligns with the `phase` field of the
+	// [K8s PersistentVolumeClaimStatus].
+	//
+	// [K8s PersistentVolumeClaimStatus]: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#PersistentVolumeClaimStatus
+	K8SPersistentvolumeclaimStatusPhaseKey = attribute.Key("k8s.persistentvolumeclaim.status.phase")
+
+	// K8SPersistentvolumeclaimUIDKey is the attribute Key conforming to the
+	// "k8s.persistentvolumeclaim.uid" semantic conventions. It represents the UID
+	// of the PersistentVolumeClaim.
+	//
+	// Type: string
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: "275ecb36-5aa8-4c2a-9c47-d8bb681b9aff"
+	K8SPersistentvolumeclaimUIDKey = attribute.Key("k8s.persistentvolumeclaim.uid")
+
 	// K8SPodHostnameKey is the attribute Key conforming to the "k8s.pod.hostname"
 	// semantic conventions. It represents the specifies the hostname of the Pod.
 	//
 	// Type: string
 	// RequirementLevel: Recommended
-	// Stability: Alpha
+	// Stability: Release_Candidate
 	//
 	// Examples: "collector-gateway"
 	// Note: The K8s Pod spec has an optional hostname field, which can be used to
@@ -9224,7 +9681,7 @@ const (
 	//
 	// Type: string
 	// RequirementLevel: Recommended
-	// Stability: Alpha
+	// Stability: Release_Candidate
 	//
 	// Examples: "172.18.0.2"
 	// Note: This attribute aligns with the `podIP` field of the
@@ -9238,7 +9695,7 @@ const (
 	//
 	// Type: string
 	// RequirementLevel: Recommended
-	// Stability: Alpha
+	// Stability: Release_Candidate
 	//
 	// Examples: "opentelemetry-pod-autoconf"
 	K8SPodNameKey = attribute.Key("k8s.pod.name")
@@ -9249,7 +9706,7 @@ const (
 	//
 	// Type: string
 	// RequirementLevel: Recommended
-	// Stability: Alpha
+	// Stability: Release_Candidate
 	//
 	// Examples: "2025-12-04T08:41:03Z"
 	// Note: Date and time at which the object was acknowledged by the Kubelet.
@@ -9293,7 +9750,7 @@ const (
 	//
 	// Type: string
 	// RequirementLevel: Recommended
-	// Stability: Alpha
+	// Stability: Release_Candidate
 	//
 	// Examples: "275ecb36-5aa8-4c2a-9c47-d8bb681b9aff"
 	K8SPodUIDKey = attribute.Key("k8s.pod.uid")
@@ -9304,7 +9761,7 @@ const (
 	//
 	// Type: string
 	// RequirementLevel: Recommended
-	// Stability: Alpha
+	// Stability: Release_Candidate
 	//
 	// Examples: "opentelemetry"
 	K8SReplicaSetNameKey = attribute.Key("k8s.replicaset.name")
@@ -9315,7 +9772,7 @@ const (
 	//
 	// Type: string
 	// RequirementLevel: Recommended
-	// Stability: Alpha
+	// Stability: Release_Candidate
 	//
 	// Examples: "275ecb36-5aa8-4c2a-9c47-d8bb681b9aff"
 	K8SReplicaSetUIDKey = attribute.Key("k8s.replicaset.uid")
@@ -9383,13 +9840,152 @@ const (
 	// Examples: "275ecb36-5aa8-4c2a-9c47-d8bb681b9aff"
 	K8SResourceQuotaUIDKey = attribute.Key("k8s.resourcequota.uid")
 
+	// K8SServiceEndpointAddressTypeKey is the attribute Key conforming to the
+	// "k8s.service.endpoint.address_type" semantic conventions. It represents the
+	// address type of the service endpoint.
+	//
+	// Type: Enum
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: "IPv4", "IPv6"
+	// Note: The network address family or type of the endpoint.
+	// This attribute aligns with the `addressType` field of the
+	// [K8s EndpointSlice].
+	// It is used to differentiate metrics when a Service is backed by multiple
+	// address types
+	// (e.g., in dual-stack clusters).
+	//
+	// [K8s EndpointSlice]: https://kubernetes.io/docs/reference/kubernetes-api/service-resources/endpoint-slice-v1/
+	K8SServiceEndpointAddressTypeKey = attribute.Key("k8s.service.endpoint.address_type")
+
+	// K8SServiceEndpointConditionKey is the attribute Key conforming to the
+	// "k8s.service.endpoint.condition" semantic conventions. It represents the
+	// condition of the service endpoint.
+	//
+	// Type: Enum
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: "ready", "serving", "terminating"
+	// Note: The current operational condition of the service endpoint.
+	// An endpoint can have multiple conditions set at once (e.g., both `serving`
+	// and `terminating` during rollout).
+	// This attribute aligns with the condition fields in the [K8s EndpointSlice].
+	//
+	// [K8s EndpointSlice]: https://kubernetes.io/docs/reference/kubernetes-api/service-resources/endpoint-slice-v1/
+	K8SServiceEndpointConditionKey = attribute.Key("k8s.service.endpoint.condition")
+
+	// K8SServiceEndpointZoneKey is the attribute Key conforming to the
+	// "k8s.service.endpoint.zone" semantic conventions. It represents the zone of
+	// the service endpoint.
+	//
+	// Type: string
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: "us-east-1a", "us-west-2b", "zone-a", ""
+	// Note: The zone where the endpoint is located, typically corresponding to a
+	// failure domain.
+	// This attribute aligns with the `zone` field of endpoints in the
+	// [K8s EndpointSlice].
+	// It enables zone-aware monitoring of service endpoint distribution and
+	// supports
+	// features like [Topology Aware Routing].
+	//
+	// If the zone is not populated (e.g., nodes without the
+	// `topology.kubernetes.io/zone` label),
+	// the attribute value will be an empty string.
+	//
+	// [K8s EndpointSlice]: https://kubernetes.io/docs/reference/kubernetes-api/service-resources/endpoint-slice-v1/
+	// [Topology Aware Routing]: https://kubernetes.io/docs/concepts/services-networking/topology-aware-routing/
+	K8SServiceEndpointZoneKey = attribute.Key("k8s.service.endpoint.zone")
+
+	// K8SServiceNameKey is the attribute Key conforming to the "k8s.service.name"
+	// semantic conventions. It represents the name of the Service.
+	//
+	// Type: string
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: "my-service"
+	K8SServiceNameKey = attribute.Key("k8s.service.name")
+
+	// K8SServicePublishNotReadyAddressesKey is the attribute Key conforming to the
+	// "k8s.service.publish_not_ready_addresses" semantic conventions. It represents
+	// the whether the Service publishes not-ready endpoints.
+	//
+	// Type: boolean
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: true, false
+	// Note: Whether the Service is configured to publish endpoints before the pods
+	// are ready.
+	// This attribute is typically used to indicate that a Service (such as a
+	// headless
+	// Service for a StatefulSet) allows peer discovery before pods pass their
+	// readiness probes.
+	// It aligns with the `publishNotReadyAddresses` field of the
+	// [K8s ServiceSpec].
+	//
+	// [K8s ServiceSpec]: https://kubernetes.io/docs/reference/kubernetes-api/service-resources/service-v1/#ServiceSpec
+	K8SServicePublishNotReadyAddressesKey = attribute.Key("k8s.service.publish_not_ready_addresses")
+
+	// K8SServiceTrafficDistributionKey is the attribute Key conforming to the
+	// "k8s.service.traffic_distribution" semantic conventions. It represents the
+	// traffic distribution policy for the Service.
+	//
+	// Type: string
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: "PreferSameZone", "PreferSameNode"
+	// Note: Specifies how traffic is distributed to endpoints for this Service.
+	// This attribute aligns with the `trafficDistribution` field of the
+	// [K8s ServiceSpec].
+	// Known values include `PreferSameZone` (prefer endpoints in the same zone as
+	// the client) and
+	// `PreferSameNode` (prefer endpoints on the same node, fallback to same zone,
+	// then cluster-wide).
+	// If this field is not set on the Service, the attribute SHOULD NOT be emitted.
+	// When not set, Kubernetes distributes traffic evenly across all endpoints
+	// cluster-wide.
+	//
+	// [K8s ServiceSpec]: https://kubernetes.io/docs/reference/networking/virtual-ips/#traffic-distribution
+	K8SServiceTrafficDistributionKey = attribute.Key("k8s.service.traffic_distribution")
+
+	// K8SServiceTypeKey is the attribute Key conforming to the "k8s.service.type"
+	// semantic conventions. It represents the type of the Kubernetes Service.
+	//
+	// Type: Enum
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: "ClusterIP", "NodePort", "LoadBalancer"
+	// Note: This attribute aligns with the `type` field of the
+	// [K8s ServiceSpec].
+	//
+	// [K8s ServiceSpec]: https://kubernetes.io/docs/reference/kubernetes-api/service-resources/service-v1/#ServiceSpec
+	K8SServiceTypeKey = attribute.Key("k8s.service.type")
+
+	// K8SServiceUIDKey is the attribute Key conforming to the "k8s.service.uid"
+	// semantic conventions. It represents the UID of the Service.
+	//
+	// Type: string
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: "275ecb36-5aa8-4c2a-9c47-d8bb681b9aff"
+	K8SServiceUIDKey = attribute.Key("k8s.service.uid")
+
 	// K8SStatefulSetNameKey is the attribute Key conforming to the
 	// "k8s.statefulset.name" semantic conventions. It represents the name of the
 	// StatefulSet.
 	//
 	// Type: string
 	// RequirementLevel: Recommended
-	// Stability: Alpha
+	// Stability: Release_Candidate
 	//
 	// Examples: "opentelemetry"
 	K8SStatefulSetNameKey = attribute.Key("k8s.statefulset.name")
@@ -9400,7 +9996,7 @@ const (
 	//
 	// Type: string
 	// RequirementLevel: Recommended
-	// Stability: Alpha
+	// Stability: Release_Candidate
 	//
 	// Examples: "275ecb36-5aa8-4c2a-9c47-d8bb681b9aff"
 	K8SStatefulSetUIDKey = attribute.Key("k8s.statefulset.uid")
@@ -9685,12 +10281,80 @@ func K8SNodeName(val string) attribute.KeyValue {
 	return K8SNodeNameKey.String(val)
 }
 
+// K8SNodeSystemContainerName returns an attribute KeyValue conforming to the
+// "k8s.node.system_container.name" semantic conventions. It represents the name
+// of the system container running on the K8s Node.
+func K8SNodeSystemContainerName(val string) attribute.KeyValue {
+	return K8SNodeSystemContainerNameKey.String(val)
+}
+
 // K8SNodeUID returns an attribute KeyValue conforming to the "k8s.node.uid"
 // semantic conventions. It represents the UID of the Node.
 func K8SNodeUID(val string) attribute.KeyValue {
 	return K8SNodeUIDKey.String(val)
 }
 
+// K8SPersistentvolumeAnnotation returns an attribute KeyValue conforming to the
+// "k8s.persistentvolume.annotation" semantic conventions. It represents the
+// annotation placed on the PersistentVolume, the `<key>` being the annotation
+// name, the value being the annotation value, even if the value is empty.
+func K8SPersistentvolumeAnnotation(key string, val string) attribute.KeyValue {
+	return attribute.String("k8s.persistentvolume.annotation."+key, val)
+}
+
+// K8SPersistentvolumeLabel returns an attribute KeyValue conforming to the
+// "k8s.persistentvolume.label" semantic conventions. It represents the label
+// placed on the PersistentVolume, the `<key>` being the label name, the value
+// being the label value, even if the value is empty.
+func K8SPersistentvolumeLabel(key string, val string) attribute.KeyValue {
+	return attribute.String("k8s.persistentvolume.label."+key, val)
+}
+
+// K8SPersistentvolumeName returns an attribute KeyValue conforming to the
+// "k8s.persistentvolume.name" semantic conventions. It represents the name of
+// the PersistentVolume.
+func K8SPersistentvolumeName(val string) attribute.KeyValue {
+	return K8SPersistentvolumeNameKey.String(val)
+}
+
+// K8SPersistentvolumeUID returns an attribute KeyValue conforming to the
+// "k8s.persistentvolume.uid" semantic conventions. It represents the UID of the
+// PersistentVolume.
+func K8SPersistentvolumeUID(val string) attribute.KeyValue {
+	return K8SPersistentvolumeUIDKey.String(val)
+}
+
+// K8SPersistentvolumeclaimAnnotation returns an attribute KeyValue conforming to
+// the "k8s.persistentvolumeclaim.annotation" semantic conventions. It represents
+// the annotation placed on the PersistentVolumeClaim, the `<key>` being the
+// annotation name, the value being the annotation value, even if the value is
+// empty.
+func K8SPersistentvolumeclaimAnnotation(key string, val string) attribute.KeyValue {
+	return attribute.String("k8s.persistentvolumeclaim.annotation."+key, val)
+}
+
+// K8SPersistentvolumeclaimLabel returns an attribute KeyValue conforming to the
+// "k8s.persistentvolumeclaim.label" semantic conventions. It represents the
+// label placed on the PersistentVolumeClaim, the `<key>` being the label name,
+// the value being the label value, even if the value is empty.
+func K8SPersistentvolumeclaimLabel(key string, val string) attribute.KeyValue {
+	return attribute.String("k8s.persistentvolumeclaim.label."+key, val)
+}
+
+// K8SPersistentvolumeclaimName returns an attribute KeyValue conforming to the
+// "k8s.persistentvolumeclaim.name" semantic conventions. It represents the name
+// of the PersistentVolumeClaim.
+func K8SPersistentvolumeclaimName(val string) attribute.KeyValue {
+	return K8SPersistentvolumeclaimNameKey.String(val)
+}
+
+// K8SPersistentvolumeclaimUID returns an attribute KeyValue conforming to the
+// "k8s.persistentvolumeclaim.uid" semantic conventions. It represents the UID of
+// the PersistentVolumeClaim.
+func K8SPersistentvolumeclaimUID(val string) attribute.KeyValue {
+	return K8SPersistentvolumeclaimUIDKey.String(val)
+}
+
 // K8SPodAnnotation returns an attribute KeyValue conforming to the
 // "k8s.pod.annotation" semantic conventions. It represents the annotation placed
 // on the Pod, the `<key>` being the annotation name, the value being the
@@ -9803,6 +10467,64 @@ func K8SResourceQuotaUID(val string) attribute.KeyValue {
 	return K8SResourceQuotaUIDKey.String(val)
 }
 
+// K8SServiceAnnotation returns an attribute KeyValue conforming to the
+// "k8s.service.annotation" semantic conventions. It represents the annotation
+// placed on the Service, the `<key>` being the annotation name, the value being
+// the annotation value, even if the value is empty.
+func K8SServiceAnnotation(key string, val string) attribute.KeyValue {
+	return attribute.String("k8s.service.annotation."+key, val)
+}
+
+// K8SServiceEndpointZone returns an attribute KeyValue conforming to the
+// "k8s.service.endpoint.zone" semantic conventions. It represents the zone of
+// the service endpoint.
+func K8SServiceEndpointZone(val string) attribute.KeyValue {
+	return K8SServiceEndpointZoneKey.String(val)
+}
+
+// K8SServiceLabel returns an attribute KeyValue conforming to the
+// "k8s.service.label" semantic conventions. It represents the label placed on
+// the Service, the `<key>` being the label name, the value being the label
+// value, even if the value is empty.
+func K8SServiceLabel(key string, val string) attribute.KeyValue {
+	return attribute.String("k8s.service.label."+key, val)
+}
+
+// K8SServiceName returns an attribute KeyValue conforming to the
+// "k8s.service.name" semantic conventions. It represents the name of the
+// Service.
+func K8SServiceName(val string) attribute.KeyValue {
+	return K8SServiceNameKey.String(val)
+}
+
+// K8SServicePublishNotReadyAddresses returns an attribute KeyValue conforming to
+// the "k8s.service.publish_not_ready_addresses" semantic conventions. It
+// represents the whether the Service publishes not-ready endpoints.
+func K8SServicePublishNotReadyAddresses(val bool) attribute.KeyValue {
+	return K8SServicePublishNotReadyAddressesKey.Bool(val)
+}
+
+// K8SServiceSelector returns an attribute KeyValue conforming to the
+// "k8s.service.selector" semantic conventions. It represents the selector
+// key-value pair placed on the Service, the `<key>` being the selector key, the
+// value being the selector value.
+func K8SServiceSelector(key string, val string) attribute.KeyValue {
+	return attribute.String("k8s.service.selector."+key, val)
+}
+
+// K8SServiceTrafficDistribution returns an attribute KeyValue conforming to the
+// "k8s.service.traffic_distribution" semantic conventions. It represents the
+// traffic distribution policy for the Service.
+func K8SServiceTrafficDistribution(val string) attribute.KeyValue {
+	return K8SServiceTrafficDistributionKey.String(val)
+}
+
+// K8SServiceUID returns an attribute KeyValue conforming to the
+// "k8s.service.uid" semantic conventions. It represents the UID of the Service.
+func K8SServiceUID(val string) attribute.KeyValue {
+	return K8SServiceUIDKey.String(val)
+}
+
 // K8SStatefulSetAnnotation returns an attribute KeyValue conforming to the
 // "k8s.statefulset.annotation" semantic conventions. It represents the
 // annotation placed on the StatefulSet, the `<key>` being the annotation name,
@@ -9940,6 +10662,51 @@ var (
 	K8SNodeConditionTypeNetworkUnavailable = K8SNodeConditionTypeKey.String("NetworkUnavailable")
 )
 
+// Enum values for k8s.persistentvolume.reclaim_policy
+var (
+	// The volume will be deleted when released from its claim.
+	// Stability: development
+	K8SPersistentvolumeReclaimPolicyDelete = K8SPersistentvolumeReclaimPolicyKey.String("Delete")
+	// The volume will be recycled (basic scrub) when released from its claim.
+	// Stability: development
+	K8SPersistentvolumeReclaimPolicyRecycle = K8SPersistentvolumeReclaimPolicyKey.String("Recycle")
+	// The volume will be retained when released from its claim.
+	// Stability: development
+	K8SPersistentvolumeReclaimPolicyRetain = K8SPersistentvolumeReclaimPolicyKey.String("Retain")
+)
+
+// Enum values for k8s.persistentvolume.status.phase
+var (
+	// The volume is available and not yet bound to a claim.
+	// Stability: development
+	K8SPersistentvolumeStatusPhaseAvailable = K8SPersistentvolumeStatusPhaseKey.String("Available")
+	// The volume is bound to a claim.
+	// Stability: development
+	K8SPersistentvolumeStatusPhaseBound = K8SPersistentvolumeStatusPhaseKey.String("Bound")
+	// The volume has failed its automatic reclamation.
+	// Stability: development
+	K8SPersistentvolumeStatusPhaseFailed = K8SPersistentvolumeStatusPhaseKey.String("Failed")
+	// The volume is being provisioned.
+	// Stability: development
+	K8SPersistentvolumeStatusPhasePending = K8SPersistentvolumeStatusPhaseKey.String("Pending")
+	// The claim has been deleted but the volume is not yet available.
+	// Stability: development
+	K8SPersistentvolumeStatusPhaseReleased = K8SPersistentvolumeStatusPhaseKey.String("Released")
+)
+
+// Enum values for k8s.persistentvolumeclaim.status.phase
+var (
+	// The claim is bound to a volume.
+	// Stability: development
+	K8SPersistentvolumeclaimStatusPhaseBound = K8SPersistentvolumeclaimStatusPhaseKey.String("Bound")
+	// The claim has lost its underlying volume (the volume does not exist anymore).
+	// Stability: development
+	K8SPersistentvolumeclaimStatusPhaseLost = K8SPersistentvolumeclaimStatusPhaseKey.String("Lost")
+	// The claim has not yet been bound to a volume.
+	// Stability: development
+	K8SPersistentvolumeclaimStatusPhasePending = K8SPersistentvolumeclaimStatusPhaseKey.String("Pending")
+)
+
 // Enum values for k8s.pod.status.phase
 var (
 	// The pod has been accepted by the system, but one or more of the containers
@@ -9995,6 +10762,48 @@ var (
 	K8SPodStatusReasonUnexpectedAdmissionError = K8SPodStatusReasonKey.String("UnexpectedAdmissionError")
 )
 
+// Enum values for k8s.service.endpoint.address_type
+var (
+	// IPv4 address type
+	// Stability: development
+	K8SServiceEndpointAddressTypeIPv4 = K8SServiceEndpointAddressTypeKey.String("IPv4")
+	// IPv6 address type
+	// Stability: development
+	K8SServiceEndpointAddressTypeIPv6 = K8SServiceEndpointAddressTypeKey.String("IPv6")
+	// FQDN address type
+	// Stability: development
+	K8SServiceEndpointAddressTypeFqdn = K8SServiceEndpointAddressTypeKey.String("FQDN")
+)
+
+// Enum values for k8s.service.endpoint.condition
+var (
+	// The endpoint is ready to receive new connections.
+	// Stability: development
+	K8SServiceEndpointConditionReady = K8SServiceEndpointConditionKey.String("ready")
+	// The endpoint is currently handling traffic.
+	// Stability: development
+	K8SServiceEndpointConditionServing = K8SServiceEndpointConditionKey.String("serving")
+	// The endpoint is in the process of shutting down.
+	// Stability: development
+	K8SServiceEndpointConditionTerminating = K8SServiceEndpointConditionKey.String("terminating")
+)
+
+// Enum values for k8s.service.type
+var (
+	// ClusterIP service type
+	// Stability: development
+	K8SServiceTypeClusterIP = K8SServiceTypeKey.String("ClusterIP")
+	// NodePort service type
+	// Stability: development
+	K8SServiceTypeNodePort = K8SServiceTypeKey.String("NodePort")
+	// LoadBalancer service type
+	// Stability: development
+	K8SServiceTypeLoadBalancer = K8SServiceTypeKey.String("LoadBalancer")
+	// ExternalName service type
+	// Stability: development
+	K8SServiceTypeExternalName = K8SServiceTypeKey.String("ExternalName")
+)
+
 // Enum values for k8s.volume.type
 var (
 	// A [persistentVolumeClaim] volume
@@ -11770,6 +12579,16 @@ func OncRPCVersion(val int) attribute.KeyValue {
 
 // Namespace: openai
 const (
+	// OpenAIAPITypeKey is the attribute Key conforming to the "openai.api.type"
+	// semantic conventions. It represents the type of OpenAI API being used.
+	//
+	// Type: Enum
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples:
+	OpenAIAPITypeKey = attribute.Key("openai.api.type")
+
 	// OpenAIRequestServiceTierKey is the attribute Key conforming to the
 	// "openai.request.service_tier" semantic conventions. It represents the service
 	// tier requested. May be a specific tier, default, or auto.
@@ -11818,6 +12637,20 @@ func OpenAIResponseSystemFingerprint(val string) attribute.KeyValue {
 	return OpenAIResponseSystemFingerprintKey.String(val)
 }
 
+// Enum values for openai.api.type
+var (
+	// The OpenAI [Chat Completions API].
+	// Stability: development
+	//
+	// [Chat Completions API]: https://developers.openai.com/api/reference/chat-completions/overview
+	OpenAIAPITypeChatCompletions = OpenAIAPITypeKey.String("chat_completions")
+	// The OpenAI [Responses API].
+	// Stability: development
+	//
+	// [Responses API]: https://developers.openai.com/api/reference/responses/overview
+	OpenAIAPITypeResponses = OpenAIAPITypeKey.String("responses")
+)
+
 // Enum values for openai.request.service_tier
 var (
 	// The system will utilize scale tier credits until they are exhausted.
@@ -11892,6 +12725,158 @@ var (
 	OpenTracingRefTypeFollowsFrom = OpenTracingRefTypeKey.String("follows_from")
 )
 
+// Namespace: oracle
+const (
+	// OracleDBDomainKey is the attribute Key conforming to the "oracle.db.domain"
+	// semantic conventions. It represents the database domain associated with the
+	// connection.
+	//
+	// Type: string
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: "example.com", "corp.internal", "prod.db.local"
+	// Note: This attribute SHOULD be set to the value of the `DB_DOMAIN`
+	// initialization parameter,
+	// as exposed in `v$parameter`. `DB_DOMAIN` defines the domain portion of the
+	// global
+	// database name and SHOULD be configured when a database is, or may become,
+	// part of a
+	// distributed environment. Its value consists of one or more valid identifiers
+	// (alphanumeric ASCII characters) separated by periods.
+	OracleDBDomainKey = attribute.Key("oracle.db.domain")
+
+	// OracleDBInstanceNameKey is the attribute Key conforming to the
+	// "oracle.db.instance.name" semantic conventions. It represents the instance
+	// name associated with the connection in an Oracle Real Application Clusters
+	// environment.
+	//
+	// Type: string
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: "ORCL1", "ORCL2", "ORCL3"
+	// Note: There can be multiple instances associated with a single database
+	// service. It indicates the
+	// unique instance name to which the connection is currently bound. For non-RAC
+	// databases, this value
+	// defaults to the `oracle.db.name`.
+	OracleDBInstanceNameKey = attribute.Key("oracle.db.instance.name")
+
+	// OracleDBNameKey is the attribute Key conforming to the "oracle.db.name"
+	// semantic conventions. It represents the database name associated with the
+	// connection.
+	//
+	// Type: string
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: "ORCL1", "FREE"
+	// Note: This attribute SHOULD be set to the value of the parameter `DB_NAME`
+	// exposed in `v$parameter`.
+	OracleDBNameKey = attribute.Key("oracle.db.name")
+
+	// OracleDBPdbKey is the attribute Key conforming to the "oracle.db.pdb"
+	// semantic conventions. It represents the pluggable database (PDB) name
+	// associated with the connection.
+	//
+	// Type: string
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: "PDB1", "FREEPDB"
+	// Note: This attribute SHOULD reflect the PDB that the session is currently
+	// connected to.
+	// If instrumentation cannot reliably obtain the active PDB name for each
+	// operation
+	// without issuing an additional query (such as `SELECT SYS_CONTEXT`), it is
+	// RECOMMENDED to fall back to the PDB name specified at connection
+	// establishment.
+	OracleDBPdbKey = attribute.Key("oracle.db.pdb")
+
+	// OracleDBServiceKey is the attribute Key conforming to the "oracle.db.service"
+	// semantic conventions. It represents the service name currently associated
+	// with the database connection.
+	//
+	// Type: string
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: "order-processing-service", "db_low.adb.oraclecloud.com",
+	// "db_high.adb.oraclecloud.com"
+	// Note: The effective service name for a connection can change during its
+	// lifetime,
+	// for example after executing sql, `ALTER SESSION`. If an instrumentation
+	// cannot reliably
+	// obtain the current service name for each operation without issuing an
+	// additional
+	// query (such as `SELECT SYS_CONTEXT`), it is RECOMMENDED to fall back to the
+	// service name originally provided at connection establishment.
+	OracleDBServiceKey = attribute.Key("oracle.db.service")
+)
+
+// OracleDBDomain returns an attribute KeyValue conforming to the
+// "oracle.db.domain" semantic conventions. It represents the database domain
+// associated with the connection.
+func OracleDBDomain(val string) attribute.KeyValue {
+	return OracleDBDomainKey.String(val)
+}
+
+// OracleDBInstanceName returns an attribute KeyValue conforming to the
+// "oracle.db.instance.name" semantic conventions. It represents the instance
+// name associated with the connection in an Oracle Real Application Clusters
+// environment.
+func OracleDBInstanceName(val string) attribute.KeyValue {
+	return OracleDBInstanceNameKey.String(val)
+}
+
+// OracleDBName returns an attribute KeyValue conforming to the "oracle.db.name"
+// semantic conventions. It represents the database name associated with the
+// connection.
+func OracleDBName(val string) attribute.KeyValue {
+	return OracleDBNameKey.String(val)
+}
+
+// OracleDBPdb returns an attribute KeyValue conforming to the "oracle.db.pdb"
+// semantic conventions. It represents the pluggable database (PDB) name
+// associated with the connection.
+func OracleDBPdb(val string) attribute.KeyValue {
+	return OracleDBPdbKey.String(val)
+}
+
+// OracleDBService returns an attribute KeyValue conforming to the
+// "oracle.db.service" semantic conventions. It represents the service name
+// currently associated with the database connection.
+func OracleDBService(val string) attribute.KeyValue {
+	return OracleDBServiceKey.String(val)
+}
+
+// Namespace: oracle_cloud
+const (
+	// OracleCloudRealmKey is the attribute Key conforming to the
+	// "oracle_cloud.realm" semantic conventions. It represents the OCI realm
+	// identifier that indicates the isolated partition in which the tenancy and its
+	// resources reside.
+	//
+	// Type: string
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: "oc1", "oc2"
+	// Note: See [OCI documentation on realms]
+	//
+	// [OCI documentation on realms]: https://docs.oracle.com/iaas/Content/General/Concepts/regions.htm
+	OracleCloudRealmKey = attribute.Key("oracle_cloud.realm")
+)
+
+// OracleCloudRealm returns an attribute KeyValue conforming to the
+// "oracle_cloud.realm" semantic conventions. It represents the OCI realm
+// identifier that indicates the isolated partition in which the tenancy and its
+// resources reside.
+func OracleCloudRealm(val string) attribute.KeyValue {
+	return OracleCloudRealmKey.String(val)
+}
+
 // Namespace: os
 const (
 	// OSBuildIDKey is the attribute Key conforming to the "os.build_id" semantic
@@ -12073,7 +13058,7 @@ const (
 	//
 	// Type: string
 	// RequirementLevel: Recommended
-	// Stability: Development
+	// Stability: Stable
 	//
 	// Examples: "browser.mouse.click", "device.app.lifecycle"
 	// Note: This attribute SHOULD be used by non-OTLP exporters when destination
@@ -12423,6 +13408,33 @@ const (
 	//
 	// Examples: "/bazinga/"
 	PprofProfileKeepFramesKey = attribute.Key("pprof.profile.keep_frames")
+
+	// PprofScopeDefaultSampleTypeKey is the attribute Key conforming to the
+	// "pprof.scope.default_sample_type" semantic conventions. It represents the
+	// records the pprof's default_sample_type in the original profile. Not set if
+	// the default sample type was missing.
+	//
+	// Type: string
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: "cpu"
+	// Note: This attribute, if present, MUST be set at the scope level
+	// (resource_profiles[].scope_profiles[].scope.attributes[]).
+	PprofScopeDefaultSampleTypeKey = attribute.Key("pprof.scope.default_sample_type")
+
+	// PprofScopeSampleTypeOrderKey is the attribute Key conforming to the
+	// "pprof.scope.sample_type_order" semantic conventions. It represents the
+	// records the indexes of the sample types in the original profile.
+	//
+	// Type: int[]
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: 3, 0, 1, 2
+	// Note: This attribute, if present, MUST be set at the scope level
+	// (resource_profiles[].scope_profiles[].scope.attributes[]).
+	PprofScopeSampleTypeOrderKey = attribute.Key("pprof.scope.sample_type_order")
 )
 
 // PprofLocationIsFolded returns an attribute KeyValue conforming to the
@@ -12494,6 +13506,21 @@ func PprofProfileKeepFrames(val string) attribute.KeyValue {
 	return PprofProfileKeepFramesKey.String(val)
 }
 
+// PprofScopeDefaultSampleType returns an attribute KeyValue conforming to the
+// "pprof.scope.default_sample_type" semantic conventions. It represents the
+// records the pprof's default_sample_type in the original profile. Not set if
+// the default sample type was missing.
+func PprofScopeDefaultSampleType(val string) attribute.KeyValue {
+	return PprofScopeDefaultSampleTypeKey.String(val)
+}
+
+// PprofScopeSampleTypeOrder returns an attribute KeyValue conforming to the
+// "pprof.scope.sample_type_order" semantic conventions. It represents the
+// records the indexes of the sample types in the original profile.
+func PprofScopeSampleTypeOrder(val ...int) attribute.KeyValue {
+	return PprofScopeSampleTypeOrderKey.IntSlice(val)
+}
+
 // Namespace: process
 const (
 	// ProcessArgsCountKey is the attribute Key conforming to the
@@ -12602,14 +13629,27 @@ const (
 
 	// ProcessExecutableBuildIDHtlhashKey is the attribute Key conforming to the
 	// "process.executable.build_id.htlhash" semantic conventions. It represents the
-	// profiling specific build ID for executables. See the OTel specification for
-	// Profiles for more information.
+	// deterministic build ID for executables.
 	//
 	// Type: string
 	// RequirementLevel: Recommended
 	// Stability: Development
 	//
 	// Examples: "600DCAFE4A110000F2BF38C493F5FB92"
+	// Note: GNU and Go build IDs may be stripped or unavailable in some
+	// environments
+	// (e.g., Alpine Linux, Docker images). This attribute provides a deterministic
+	// build ID computed by hashing the first and last 4096 bytes of the file
+	// along with its length:
+	//
+	// ```
+	// Input   ← Concat(File[:4096], File[-4096:], BigEndianUInt64(Len(File)))
+	// Digest  ← SHA256(Input)
+	// BuildID ← Digest[:16]
+	// ```
+	//
+	// The result is the first 16 bytes (128 bits) of the SHA256 digest,
+	// represented as a hex string.
 	ProcessExecutableBuildIDHtlhashKey = attribute.Key("process.executable.build_id.htlhash")
 
 	// ProcessExecutableNameKey is the attribute Key conforming to the
@@ -12965,8 +14005,7 @@ func ProcessExecutableBuildIDGo(val string) attribute.KeyValue {
 
 // ProcessExecutableBuildIDHtlhash returns an attribute KeyValue conforming to
 // the "process.executable.build_id.htlhash" semantic conventions. It represents
-// the profiling specific build ID for executables. See the OTel specification
-// for Profiles for more information.
+// the deterministic build ID for executables.
 func ProcessExecutableBuildIDHtlhash(val string) attribute.KeyValue {
 	return ProcessExecutableBuildIDHtlhashKey.String(val)
 }
@@ -13258,59 +14297,13 @@ var (
 
 // Namespace: rpc
 const (
-	// RPCMessageCompressedSizeKey is the attribute Key conforming to the
-	// "rpc.message.compressed_size" semantic conventions. It represents the
-	// compressed size of the message in bytes.
-	//
-	// Type: int
-	// RequirementLevel: Recommended
-	// Stability: Development
-	//
-	// Examples:
-	RPCMessageCompressedSizeKey = attribute.Key("rpc.message.compressed_size")
-
-	// RPCMessageIDKey is the attribute Key conforming to the "rpc.message.id"
-	// semantic conventions. It MUST be calculated as two different counters
-	// starting from `1` one for sent messages and one for received message..
-	//
-	// Type: int
-	// RequirementLevel: Recommended
-	// Stability: Development
-	//
-	// Examples:
-	// Note: This way we guarantee that the values will be consistent between
-	// different implementations.
-	RPCMessageIDKey = attribute.Key("rpc.message.id")
-
-	// RPCMessageTypeKey is the attribute Key conforming to the "rpc.message.type"
-	// semantic conventions. It represents the whether this is a received or sent
-	// message.
-	//
-	// Type: Enum
-	// RequirementLevel: Recommended
-	// Stability: Development
-	//
-	// Examples:
-	RPCMessageTypeKey = attribute.Key("rpc.message.type")
-
-	// RPCMessageUncompressedSizeKey is the attribute Key conforming to the
-	// "rpc.message.uncompressed_size" semantic conventions. It represents the
-	// uncompressed size of the message in bytes.
-	//
-	// Type: int
-	// RequirementLevel: Recommended
-	// Stability: Development
-	//
-	// Examples:
-	RPCMessageUncompressedSizeKey = attribute.Key("rpc.message.uncompressed_size")
-
 	// RPCMethodKey is the attribute Key conforming to the "rpc.method" semantic
 	// conventions. It represents the fully-qualified logical name of the method
 	// from the RPC interface perspective.
 	//
 	// Type: string
 	// RequirementLevel: Recommended
-	// Stability: Development
+	// Stability: Release_Candidate
 	//
 	// Examples: "com.example.ExampleService/exampleMethod", "EchoService/Echo",
 	// "_OTHER"
@@ -13345,7 +14338,7 @@ const (
 	//
 	// Type: string
 	// RequirementLevel: Recommended
-	// Stability: Development
+	// Stability: Release_Candidate
 	//
 	// Examples: "com.myservice.EchoService/catchAll",
 	// "com.myservice.EchoService/unknownMethod", "InvalidMethod"
@@ -13357,7 +14350,7 @@ const (
 	//
 	// Type: string
 	// RequirementLevel: Recommended
-	// Stability: Development
+	// Stability: Release_Candidate
 	//
 	// Examples: "OK", "DEADLINE_EXCEEDED", "-32602"
 	// Note: Usually it represents an error code, but may also represent partial
@@ -13373,7 +14366,7 @@ const (
 	//
 	// Type: Enum
 	// RequirementLevel: Recommended
-	// Stability: Development
+	// Stability: Release_Candidate
 	//
 	// Examples:
 	// Note: The client and server RPC systems may differ for the same RPC
@@ -13383,27 +14376,6 @@ const (
 	RPCSystemNameKey = attribute.Key("rpc.system.name")
 )
 
-// RPCMessageCompressedSize returns an attribute KeyValue conforming to the
-// "rpc.message.compressed_size" semantic conventions. It represents the
-// compressed size of the message in bytes.
-func RPCMessageCompressedSize(val int) attribute.KeyValue {
-	return RPCMessageCompressedSizeKey.Int(val)
-}
-
-// RPCMessageID returns an attribute KeyValue conforming to the "rpc.message.id"
-// semantic conventions. It MUST be calculated as two different counters starting
-// from `1` one for sent messages and one for received message..
-func RPCMessageID(val int) attribute.KeyValue {
-	return RPCMessageIDKey.Int(val)
-}
-
-// RPCMessageUncompressedSize returns an attribute KeyValue conforming to the
-// "rpc.message.uncompressed_size" semantic conventions. It represents the
-// uncompressed size of the message in bytes.
-func RPCMessageUncompressedSize(val int) attribute.KeyValue {
-	return RPCMessageUncompressedSizeKey.Int(val)
-}
-
 // RPCMethod returns an attribute KeyValue conforming to the "rpc.method"
 // semantic conventions. It represents the fully-qualified logical name of the
 // method from the RPC interface perspective.
@@ -13441,25 +14413,15 @@ func RPCResponseStatusCode(val string) attribute.KeyValue {
 	return RPCResponseStatusCodeKey.String(val)
 }
 
-// Enum values for rpc.message.type
-var (
-	// sent
-	// Stability: development
-	RPCMessageTypeSent = RPCMessageTypeKey.String("SENT")
-	// received
-	// Stability: development
-	RPCMessageTypeReceived = RPCMessageTypeKey.String("RECEIVED")
-)
-
 // Enum values for rpc.system.name
 var (
 	// [gRPC]
-	// Stability: development
+	// Stability: release_candidate
 	//
 	// [gRPC]: https://grpc.io/
 	RPCSystemNameGRPC = RPCSystemNameKey.String("grpc")
 	// [Apache Dubbo]
-	// Stability: development
+	// Stability: release_candidate
 	//
 	// [Apache Dubbo]: https://dubbo.apache.org/
 	RPCSystemNameDubbo = RPCSystemNameKey.String("dubbo")
@@ -13674,13 +14636,28 @@ func ServerPort(val int) attribute.KeyValue {
 
 // Namespace: service
 const (
+	// ServiceCriticalityKey is the attribute Key conforming to the
+	// "service.criticality" semantic conventions. It represents the operational
+	// criticality of the service.
+	//
+	// Type: Enum
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: "critical", "high", "medium", "low"
+	// Note: Application developers are encouraged to set `service.criticality` to
+	// express the operational importance of their services. Telemetry consumers MAY
+	// use this attribute to optimize telemetry collection or improve user
+	// experience.
+	ServiceCriticalityKey = attribute.Key("service.criticality")
+
 	// ServiceInstanceIDKey is the attribute Key conforming to the
 	// "service.instance.id" semantic conventions. It represents the string ID of
 	// the service instance.
 	//
 	// Type: string
 	// RequirementLevel: Recommended
-	// Stability: Development
+	// Stability: Stable
 	//
 	// Examples: "627cc493-f310-47de-96bd-71410b7dec09"
 	// Note: MUST be unique for each instance of the same
@@ -13741,9 +14718,11 @@ const (
 	// Examples: "shoppingcart"
 	// Note: MUST be the same for all instances of horizontally scaled services. If
 	// the value was not specified, SDKs MUST fallback to `unknown_service:`
-	// concatenated with [`process.executable.name`], e.g. `unknown_service:bash`.
-	// If `process.executable.name` is not available, the value MUST be set to
+	// concatenated with the process executable name, e.g. `unknown_service:bash`.
+	// If the process executable name is not available, the value MUST be set to
 	// `unknown_service`.
+	// The process executable name is the name of the process executable, the same
+	// value as described by the [`process.executable.name`] resource attribute.
 	//
 	// [`process.executable.name`]: process.md
 	ServiceNameKey = attribute.Key("service.name")
@@ -13754,7 +14733,7 @@ const (
 	//
 	// Type: string
 	// RequirementLevel: Recommended
-	// Stability: Development
+	// Stability: Stable
 	//
 	// Examples: "Shop"
 	// Note: A string value having a meaning that helps to distinguish a group of
@@ -13856,6 +14835,29 @@ func ServiceVersion(val string) attribute.KeyValue {
 	return ServiceVersionKey.String(val)
 }
 
+// Enum values for service.criticality
+var (
+	// Service is business-critical; downtime directly impacts revenue, user
+	// experience, or core functionality.
+	//
+	// Stability: development
+	ServiceCriticalityCritical = ServiceCriticalityKey.String("critical")
+	// Service is important but has degradation tolerance or fallback mechanisms.
+	//
+	// Stability: development
+	ServiceCriticalityHigh = ServiceCriticalityKey.String("high")
+	// Service provides supplementary functionality; degradation has limited user
+	// impact.
+	//
+	// Stability: development
+	ServiceCriticalityMedium = ServiceCriticalityKey.String("medium")
+	// Service is non-essential to core operations; used for background tasks or
+	// internal tools.
+	//
+	// Stability: development
+	ServiceCriticalityLow = ServiceCriticalityKey.String("low")
+)
+
 // Namespace: session
 const (
 	// SessionIDKey is the attribute Key conforming to the "session.id" semantic
@@ -14044,6 +15046,17 @@ const (
 	// Examples: "ext4"
 	SystemFilesystemTypeKey = attribute.Key("system.filesystem.type")
 
+	// SystemMemoryLinuxHugepagesStateKey is the attribute Key conforming to the
+	// "system.memory.linux.hugepages.state" semantic conventions. It represents the
+	// Linux HugePages memory state.
+	//
+	// Type: Enum
+	// RequirementLevel: Recommended
+	// Stability: Development
+	//
+	// Examples: "free", "used"
+	SystemMemoryLinuxHugepagesStateKey = attribute.Key("system.memory.linux.hugepages.state")
+
 	// SystemMemoryLinuxSlabStateKey is the attribute Key conforming to the
 	// "system.memory.linux.slab.state" semantic conventions. It represents the
 	// Linux Slab memory state.
@@ -14154,6 +15167,16 @@ var (
 	SystemFilesystemTypeExt4 = SystemFilesystemTypeKey.String("ext4")
 )
 
+// Enum values for system.memory.linux.hugepages.state
+var (
+	// free
+	// Stability: development
+	SystemMemoryLinuxHugepagesStateFree = SystemMemoryLinuxHugepagesStateKey.String("free")
+	// used
+	// Stability: development
+	SystemMemoryLinuxHugepagesStateUsed = SystemMemoryLinuxHugepagesStateKey.String("used")
+)
+
 // Enum values for system.memory.linux.slab.state
 var (
 	// reclaimable
@@ -14218,7 +15241,7 @@ const (
 	//
 	// Type: string
 	// RequirementLevel: Recommended
-	// Stability: Development
+	// Stability: Stable
 	//
 	// Examples: "parts-unlimited-java"
 	// Note: Official auto instrumentation agents and distributions SHOULD set the
@@ -14233,7 +15256,7 @@ const (
 	//
 	// Type: string
 	// RequirementLevel: Recommended
-	// Stability: Development
+	// Stability: Stable
 	//
 	// Examples: "1.2.3"
 	TelemetryDistroVersionKey = attribute.Key("telemetry.distro.version")
@@ -15175,6 +16198,18 @@ const (
 	//
 	// This list is subject to change over time.
 	//
+	// Matching of query parameter keys against the sensitive list SHOULD be
+	// case-sensitive.
+	//
+	//
+	// Instrumentation MAY provide a way to override this list via declarative
+	// configuration.
+	// If so, it SHOULD use the `sensitive_query_parameters` property
+	// (an array of case-sensitive strings with minimum items 0) under
+	// `.instrumentation/development.general.sanitization.url`.
+	// This list is a full override of the default sensitive query parameter keys,
+	// it is not a list of keys in addition to the defaults.
+	//
 	// When a query string value is redacted, the query string key SHOULD still be
 	// preserved, e.g.
 	// `https://www.example.com/path?color=blue&sig=REDACTED`.
@@ -15250,6 +16285,17 @@ const (
 	//
 	// This list is subject to change over time.
 	//
+	// Matching of query parameter keys against the sensitive list SHOULD be
+	// case-sensitive.
+	//
+	// Instrumentation MAY provide a way to override this list via declarative
+	// configuration.
+	// If so, it SHOULD use the `sensitive_query_parameters` property
+	// (an array of case-sensitive strings with minimum items 0) under
+	// `.instrumentation/development.general.sanitization.url`.
+	// This list is a full override of the default sensitive query parameter keys,
+	// it is not a list of keys in addition to the defaults.
+	//
 	// When a query string value is redacted, the query string key SHOULD still be
 	// preserved, e.g.
 	// `q=OpenTelemetry&sig=REDACTED`.
diff --git a/vendor/go.opentelemetry.io/otel/semconv/v1.39.0/doc.go b/vendor/go.opentelemetry.io/otel/semconv/v1.41.0/doc.go
similarity index 68%
rename from vendor/go.opentelemetry.io/otel/semconv/v1.39.0/doc.go
rename to vendor/go.opentelemetry.io/otel/semconv/v1.41.0/doc.go
index 852362ef7..a45d424d8 100644
--- a/vendor/go.opentelemetry.io/otel/semconv/v1.39.0/doc.go
+++ b/vendor/go.opentelemetry.io/otel/semconv/v1.41.0/doc.go
@@ -1,9 +1,11 @@
+// Code generated from semantic convention specification. DO NOT EDIT.
+
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
 // Package semconv implements OpenTelemetry semantic conventions.
 //
 // OpenTelemetry semantic conventions are agreed standardized naming
-// patterns for OpenTelemetry things. This package represents the v1.39.0
+// patterns for OpenTelemetry things. This package represents the v1.41.0
 // version of the OpenTelemetry semantic conventions.
-package semconv // import "go.opentelemetry.io/otel/semconv/v1.39.0"
+package semconv // import "go.opentelemetry.io/otel/semconv/v1.41.0"
diff --git a/vendor/go.opentelemetry.io/otel/semconv/v1.41.0/error_type.go b/vendor/go.opentelemetry.io/otel/semconv/v1.41.0/error_type.go
new file mode 100644
index 000000000..0b13f0de8
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/semconv/v1.41.0/error_type.go
@@ -0,0 +1,83 @@
+// Code generated from semantic convention specification. DO NOT EDIT.
+
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+package semconv // import "go.opentelemetry.io/otel/semconv/v1.41.0"
+
+import (
+	"errors"
+	"fmt"
+	"reflect"
+
+	"go.opentelemetry.io/otel/attribute"
+)
+
+// ErrorType returns an [attribute.KeyValue] identifying the error type of err.
+//
+// If err is nil, the returned attribute has the default value
+// [ErrorTypeOther].
+//
+// If err or one of the errors in its chain has the method
+//
+//	ErrorType() string
+//
+// the returned attribute has that method's return value. If multiple errors in
+// the chain implement this method, the value from the first match found by
+// [errors.As] is used. Otherwise, the returned attribute has a value derived
+// from the concrete type of err after unwrapping any wrappers created with
+// [fmt.Errorf].
+//
+// The key of the returned attribute is [ErrorTypeKey].
+func ErrorType(err error) attribute.KeyValue {
+	if err == nil {
+		return ErrorTypeOther
+	}
+
+	return ErrorTypeKey.String(errorType(err))
+}
+
+func errorType(err error) string {
+	var s string
+	if et, ok := err.(interface{ ErrorType() string }); ok {
+		// Fast path: check the top-level error first.
+		s = et.ErrorType()
+	} else {
+		// Fallback: search the error chain for an ErrorType method.
+		var et interface{ ErrorType() string }
+		if errors.As(err, &et) {
+			// Prioritize the ErrorType method if available.
+			s = et.ErrorType()
+		}
+	}
+	if s == "" {
+		// Fallback to reflection if the ErrorType method is not supported or
+		// returns an empty value.
+
+		t := reflect.TypeOf(unwrapFmtWrapped(err))
+		pkg, name := t.PkgPath(), t.Name()
+		if pkg != "" && name != "" {
+			s = pkg + "." + name
+		} else {
+			// The type has no package path or name (predeclared, not-defined,
+			// or alias for a not-defined type).
+			//
+			// This is not guaranteed to be unique, but is a best effort.
+			s = t.String()
+		}
+	}
+	return s
+}
+
+var fmtWrapErrorType = reflect.TypeOf(fmt.Errorf("wrapped: %w", errors.New("err")))
+
+func unwrapFmtWrapped(err error) error {
+	for reflect.TypeOf(err) == fmtWrapErrorType {
+		u := errors.Unwrap(err)
+		if u == nil {
+			return err // When the wrapped error is nil, use the concrete type of the wrapper.
+		}
+		err = u
+	}
+	return err
+}
diff --git a/vendor/go.opentelemetry.io/otel/semconv/v1.39.0/exception.go b/vendor/go.opentelemetry.io/otel/semconv/v1.41.0/exception.go
similarity index 59%
rename from vendor/go.opentelemetry.io/otel/semconv/v1.39.0/exception.go
rename to vendor/go.opentelemetry.io/otel/semconv/v1.41.0/exception.go
index 7b688ecc3..5f0151aff 100644
--- a/vendor/go.opentelemetry.io/otel/semconv/v1.39.0/exception.go
+++ b/vendor/go.opentelemetry.io/otel/semconv/v1.41.0/exception.go
@@ -1,7 +1,9 @@
+// Code generated from semantic convention specification. DO NOT EDIT.
+
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package semconv // import "go.opentelemetry.io/otel/semconv/v1.39.0"
+package semconv // import "go.opentelemetry.io/otel/semconv/v1.41.0"
 
 const (
 	// ExceptionEventName is the name of the Span event representing an exception.
diff --git a/vendor/go.opentelemetry.io/otel/semconv/v1.39.0/schema.go b/vendor/go.opentelemetry.io/otel/semconv/v1.41.0/schema.go
similarity index 61%
rename from vendor/go.opentelemetry.io/otel/semconv/v1.39.0/schema.go
rename to vendor/go.opentelemetry.io/otel/semconv/v1.41.0/schema.go
index e1a199d89..24948a48f 100644
--- a/vendor/go.opentelemetry.io/otel/semconv/v1.39.0/schema.go
+++ b/vendor/go.opentelemetry.io/otel/semconv/v1.41.0/schema.go
@@ -1,9 +1,11 @@
+// Code generated from semantic convention specification. DO NOT EDIT.
+
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package semconv // import "go.opentelemetry.io/otel/semconv/v1.39.0"
+package semconv // import "go.opentelemetry.io/otel/semconv/v1.41.0"
 
 // SchemaURL is the schema URL that matches the version of the semantic conventions
 // that this package defines. Semconv packages starting from v1.4.0 must declare
 // non-empty schema URL in the form https://opentelemetry.io/schemas/<version>
-const SchemaURL = "https://opentelemetry.io/schemas/1.39.0"
+const SchemaURL = "https://opentelemetry.io/schemas/1.41.0"
diff --git a/vendor/go.opentelemetry.io/otel/trace/auto.go b/vendor/go.opentelemetry.io/otel/trace/auto.go
index 9316fd0ac..a75cf047d 100644
--- a/vendor/go.opentelemetry.io/otel/trace/auto.go
+++ b/vendor/go.opentelemetry.io/otel/trace/auto.go
@@ -20,7 +20,7 @@ import (
 
 	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/codes"
-	semconv "go.opentelemetry.io/otel/semconv/v1.40.0"
+	semconv "go.opentelemetry.io/otel/semconv/v1.41.0"
 	"go.opentelemetry.io/otel/trace/embedded"
 	"go.opentelemetry.io/otel/trace/internal/telemetry"
 )
@@ -314,6 +314,14 @@ func convAttrValue(value attribute.Value) telemetry.Value {
 	case attribute.STRING:
 		v := truncate(maxSpan.AttrValueLen, value.AsString())
 		return telemetry.StringValue(v)
+	case attribute.BYTESLICE:
+		// len(v.AsString()) is identical to len(v.AsByteSlice()) but
+		// avoids allocating the full slice before truncation.
+		s := value.AsString()
+		if maxSpan.AttrValueLen >= 0 && len(s) > maxSpan.AttrValueLen {
+			return telemetry.BytesValue([]byte(s[:maxSpan.AttrValueLen]))
+		}
+		return telemetry.BytesValue([]byte(s))
 	case attribute.BOOLSLICE:
 		slice := value.AsBoolSlice()
 		out := make([]telemetry.Value, 0, len(slice))
@@ -343,6 +351,13 @@ func convAttrValue(value attribute.Value) telemetry.Value {
 			out = append(out, telemetry.StringValue(v))
 		}
 		return telemetry.SliceValue(out...)
+	case attribute.SLICE:
+		slice := value.AsSlice()
+		out := make([]telemetry.Value, 0, len(slice))
+		for _, v := range slice {
+			out = append(out, convAttrValue(v))
+		}
+		return telemetry.SliceValue(out...)
 	}
 	return telemetry.Value{}
 }
@@ -463,7 +478,8 @@ func (s *autoSpan) RecordError(err error, opts ...EventOption) {
 	cfg := NewEventConfig(opts...)
 
 	attrs := cfg.Attributes()
-	attrs = append(attrs,
+	attrs = append(
+		attrs,
 		semconv.ExceptionType(typeStr(err)),
 		semconv.ExceptionMessage(err.Error()),
 	)
diff --git a/vendor/go.opentelemetry.io/otel/trace/config.go b/vendor/go.opentelemetry.io/otel/trace/config.go
index d9ecef1ca..4cedba5ac 100644
--- a/vendor/go.opentelemetry.io/otel/trace/config.go
+++ b/vendor/go.opentelemetry.io/otel/trace/config.go
@@ -34,10 +34,17 @@ func (t *TracerConfig) SchemaURL() string {
 	return t.schemaURL
 }
 
+type experimentalOption interface {
+	Experimental()
+}
+
 // NewTracerConfig applies all the options to a returned TracerConfig.
 func NewTracerConfig(options ...TracerOption) TracerConfig {
 	var config TracerConfig
 	for _, option := range options {
+		if _, ok := option.(experimentalOption); ok {
+			continue
+		}
 		config = option.apply(config)
 	}
 	return config
@@ -103,6 +110,9 @@ func (cfg *SpanConfig) SpanKind() SpanKind {
 func NewSpanStartConfig(options ...SpanStartOption) SpanConfig {
 	var c SpanConfig
 	for _, option := range options {
+		if _, ok := option.(experimentalOption); ok {
+			continue
+		}
 		c = option.applySpanStart(c)
 	}
 	return c
@@ -115,6 +125,9 @@ func NewSpanStartConfig(options ...SpanStartOption) SpanConfig {
 func NewSpanEndConfig(options ...SpanEndOption) SpanConfig {
 	var c SpanConfig
 	for _, option := range options {
+		if _, ok := option.(experimentalOption); ok {
+			continue
+		}
 		c = option.applySpanEnd(c)
 	}
 	return c
@@ -167,6 +180,9 @@ func (cfg *EventConfig) StackTrace() bool {
 func NewEventConfig(options ...EventOption) EventConfig {
 	var c EventConfig
 	for _, option := range options {
+		if _, ok := option.(experimentalOption); ok {
+			continue
+		}
 		c = option.applyEvent(c)
 	}
 	if c.timestamp.IsZero() {
diff --git a/vendor/go.opentelemetry.io/otel/trace/internal/telemetry/span.go b/vendor/go.opentelemetry.io/otel/trace/internal/telemetry/span.go
index e7ca62c66..61c7819a2 100644
--- a/vendor/go.opentelemetry.io/otel/trace/internal/telemetry/span.go
+++ b/vendor/go.opentelemetry.io/otel/trace/internal/telemetry/span.go
@@ -314,9 +314,9 @@ type SpanEvent struct {
 }
 
 // MarshalJSON encodes e into OTLP formatted JSON.
-func (e SpanEvent) MarshalJSON() ([]byte, error) {
-	t := e.Time.UnixNano()
-	if e.Time.IsZero() || t < 0 {
+func (se SpanEvent) MarshalJSON() ([]byte, error) {
+	t := se.Time.UnixNano()
+	if se.Time.IsZero() || t < 0 {
 		t = 0
 	}
 
@@ -325,7 +325,7 @@ func (e SpanEvent) MarshalJSON() ([]byte, error) {
 		Alias
 		Time uint64 `json:"timeUnixNano,omitempty"`
 	}{
-		Alias: Alias(e),
+		Alias: Alias(se),
 		Time:  uint64(t), // nolint: gosec  // >0 checked above
 	})
 }
diff --git a/vendor/go.opentelemetry.io/otel/version.go b/vendor/go.opentelemetry.io/otel/version.go
index 1db4f47e4..72746acfd 100644
--- a/vendor/go.opentelemetry.io/otel/version.go
+++ b/vendor/go.opentelemetry.io/otel/version.go
@@ -5,5 +5,5 @@ package otel // import "go.opentelemetry.io/otel"
 
 // Version is the current release version of OpenTelemetry in use.
 func Version() string {
-	return "1.43.0"
+	return "1.44.0"
 }
diff --git a/vendor/go.opentelemetry.io/otel/versions.yaml b/vendor/go.opentelemetry.io/otel/versions.yaml
index bcc6ee78a..d6dbf803e 100644
--- a/vendor/go.opentelemetry.io/otel/versions.yaml
+++ b/vendor/go.opentelemetry.io/otel/versions.yaml
@@ -3,7 +3,7 @@
 
 module-sets:
   stable-v1:
-    version: v1.43.0
+    version: v1.44.0
     modules:
       - go.opentelemetry.io/otel
       - go.opentelemetry.io/otel/bridge/opencensus
@@ -22,11 +22,12 @@ module-sets:
       - go.opentelemetry.io/otel/sdk/metric
       - go.opentelemetry.io/otel/trace
   experimental-metrics:
-    version: v0.65.0
+    version: v0.66.0
     modules:
       - go.opentelemetry.io/otel/exporters/prometheus
+      - go.opentelemetry.io/otel/metric/x
   experimental-logs:
-    version: v0.19.0
+    version: v0.20.0
     modules:
       - go.opentelemetry.io/otel/log
       - go.opentelemetry.io/otel/log/logtest
@@ -36,7 +37,7 @@ module-sets:
       - go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp
       - go.opentelemetry.io/otel/exporters/stdout/stdoutlog
   experimental-schema:
-    version: v0.0.16
+    version: v0.0.17
     modules:
       - go.opentelemetry.io/otel/schema
 excluded-modules:
@@ -55,6 +56,9 @@ modules:
   go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc:
     version-refs:
       - ./internal/version.go
+  go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp:
+    version-refs:
+      - ./internal/version.go
   go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc:
     version-refs:
       - ./internal/version.go
diff --git a/vendor/google.golang.org/genproto/googleapis/api/annotations/client.pb.go b/vendor/google.golang.org/genproto/googleapis/api/annotations/client.pb.go
index f84048172..382a9f007 100644
--- a/vendor/google.golang.org/genproto/googleapis/api/annotations/client.pb.go
+++ b/vendor/google.golang.org/genproto/googleapis/api/annotations/client.pb.go
@@ -1,4 +1,4 @@
-// Copyright 2025 Google LLC
+// Copyright 2026 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -167,6 +167,63 @@ func (ClientLibraryDestination) EnumDescriptor() ([]byte, []int) {
 	return file_google_api_client_proto_rawDescGZIP(), []int{1}
 }
 
+// The behavior to take when the flow control limit is exceeded.
+type FlowControlLimitExceededBehaviorProto int32
+
+const (
+	// Default behavior, system-defined.
+	FlowControlLimitExceededBehaviorProto_UNSET_BEHAVIOR FlowControlLimitExceededBehaviorProto = 0
+	// Stop operation, raise error.
+	FlowControlLimitExceededBehaviorProto_THROW_EXCEPTION FlowControlLimitExceededBehaviorProto = 1
+	// Pause operation until limit clears.
+	FlowControlLimitExceededBehaviorProto_BLOCK FlowControlLimitExceededBehaviorProto = 2
+	// Continue operation, disregard limit.
+	FlowControlLimitExceededBehaviorProto_IGNORE FlowControlLimitExceededBehaviorProto = 3
+)
+
+// Enum value maps for FlowControlLimitExceededBehaviorProto.
+var (
+	FlowControlLimitExceededBehaviorProto_name = map[int32]string{
+		0: "UNSET_BEHAVIOR",
+		1: "THROW_EXCEPTION",
+		2: "BLOCK",
+		3: "IGNORE",
+	}
+	FlowControlLimitExceededBehaviorProto_value = map[string]int32{
+		"UNSET_BEHAVIOR":  0,
+		"THROW_EXCEPTION": 1,
+		"BLOCK":           2,
+		"IGNORE":          3,
+	}
+)
+
+func (x FlowControlLimitExceededBehaviorProto) Enum() *FlowControlLimitExceededBehaviorProto {
+	p := new(FlowControlLimitExceededBehaviorProto)
+	*p = x
+	return p
+}
+
+func (x FlowControlLimitExceededBehaviorProto) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (FlowControlLimitExceededBehaviorProto) Descriptor() protoreflect.EnumDescriptor {
+	return file_google_api_client_proto_enumTypes[2].Descriptor()
+}
+
+func (FlowControlLimitExceededBehaviorProto) Type() protoreflect.EnumType {
+	return &file_google_api_client_proto_enumTypes[2]
+}
+
+func (x FlowControlLimitExceededBehaviorProto) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use FlowControlLimitExceededBehaviorProto.Descriptor instead.
+func (FlowControlLimitExceededBehaviorProto) EnumDescriptor() ([]byte, []int) {
+	return file_google_api_client_proto_rawDescGZIP(), []int{2}
+}
+
 // Required information for every language.
 type CommonLanguageSettings struct {
 	state         protoimpl.MessageState
@@ -181,6 +238,8 @@ type CommonLanguageSettings struct {
 	// The destination where API teams want this client library to be published.
 	Destinations []ClientLibraryDestination `protobuf:"varint,2,rep,packed,name=destinations,proto3,enum=google.api.ClientLibraryDestination" json:"destinations,omitempty"`
 	// Configuration for which RPCs should be generated in the GAPIC client.
+	//
+	// Note: This field should not be used in most cases.
 	SelectiveGapicGeneration *SelectiveGapicGeneration `protobuf:"bytes,3,opt,name=selective_gapic_generation,json=selectiveGapicGeneration,proto3" json:"selective_gapic_generation,omitempty"`
 }
 
@@ -547,8 +606,9 @@ type JavaSettings struct {
 	// Example of a YAML configuration::
 	//
 	//	publishing:
-	//	  java_settings:
-	//	    library_package: com.google.cloud.pubsub.v1
+	//	  library_settings:
+	//	    java_settings:
+	//	      library_package: com.google.cloud.pubsub.v1
 	LibraryPackage string `protobuf:"bytes,1,opt,name=library_package,json=libraryPackage,proto3" json:"library_package,omitempty"`
 	// Configure the Java class name to use instead of the service's for its
 	// corresponding generated GAPIC client. Keys are fully-qualified
@@ -679,6 +739,19 @@ type PhpSettings struct {
 
 	// Some settings.
 	Common *CommonLanguageSettings `protobuf:"bytes,1,opt,name=common,proto3" json:"common,omitempty"`
+	// The package name to use in Php. Clobbers the php_namespace option
+	// set in the protobuf. This should be used **only** by APIs
+	// who have already set the language_settings.php.package_name" field
+	// in gapic.yaml. API teams should use the protobuf php_namespace option
+	// where possible.
+	//
+	// Example of a YAML configuration::
+	//
+	//	publishing:
+	//	  library_settings:
+	//	    php_settings:
+	//	      library_package: Google\Cloud\PubSub\V1
+	LibraryPackage string `protobuf:"bytes,2,opt,name=library_package,json=libraryPackage,proto3" json:"library_package,omitempty"`
 }
 
 func (x *PhpSettings) Reset() {
@@ -720,6 +793,13 @@ func (x *PhpSettings) GetCommon() *CommonLanguageSettings {
 	return nil
 }
 
+func (x *PhpSettings) GetLibraryPackage() string {
+	if x != nil {
+		return x.LibraryPackage
+	}
+	return ""
+}
+
 // Settings for Python client libraries.
 type PythonSettings struct {
 	state         protoimpl.MessageState
@@ -997,11 +1077,12 @@ type GoSettings struct {
 	// service names and values are the name to be used for the service client
 	// and call options.
 	//
-	// publishing:
+	// Example:
 	//
-	//	go_settings:
-	//	  renamed_services:
-	//	    Publisher: TopicAdmin
+	//	publishing:
+	//	  go_settings:
+	//	    renamed_services:
+	//	      Publisher: TopicAdmin
 	RenamedServices map[string]string `protobuf:"bytes,2,rep,name=renamed_services,json=renamedServices,proto3" json:"renamed_services,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
 }
 
@@ -1094,6 +1175,18 @@ type MethodSettings struct {
 	//	    auto_populated_fields:
 	//	    - request_id
 	AutoPopulatedFields []string `protobuf:"bytes,3,rep,name=auto_populated_fields,json=autoPopulatedFields,proto3" json:"auto_populated_fields,omitempty"`
+	// Batching configuration for an API method in client libraries.
+	//
+	// Example of a YAML configuration:
+	//
+	//	publishing:
+	//	  method_settings:
+	//	  - selector: google.example.v1.ExampleService.BatchCreateExample
+	//	    batching:
+	//	      element_count_threshold: 1000
+	//	      request_byte_threshold: 100000000
+	//	      delay_threshold_millis: 10
+	Batching *BatchingConfigProto `protobuf:"bytes,4,opt,name=batching,proto3" json:"batching,omitempty"`
 }
 
 func (x *MethodSettings) Reset() {
@@ -1149,8 +1242,17 @@ func (x *MethodSettings) GetAutoPopulatedFields() []string {
 	return nil
 }
 
+func (x *MethodSettings) GetBatching() *BatchingConfigProto {
+	if x != nil {
+		return x.Batching
+	}
+	return nil
+}
+
 // This message is used to configure the generation of a subset of the RPCs in
 // a service for client libraries.
+//
+// Note: This feature should not be used in most cases.
 type SelectiveGapicGeneration struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -1214,6 +1316,257 @@ func (x *SelectiveGapicGeneration) GetGenerateOmittedAsInternal() bool {
 	return false
 }
 
+// `BatchingConfigProto` defines the batching configuration for an API method.
+type BatchingConfigProto struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The thresholds which trigger a batched request to be sent.
+	Thresholds *BatchingSettingsProto `protobuf:"bytes,1,opt,name=thresholds,proto3" json:"thresholds,omitempty"`
+	// The request and response fields used in batching.
+	BatchDescriptor *BatchingDescriptorProto `protobuf:"bytes,2,opt,name=batch_descriptor,json=batchDescriptor,proto3" json:"batch_descriptor,omitempty"`
+}
+
+func (x *BatchingConfigProto) Reset() {
+	*x = BatchingConfigProto{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_google_api_client_proto_msgTypes[13]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BatchingConfigProto) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BatchingConfigProto) ProtoMessage() {}
+
+func (x *BatchingConfigProto) ProtoReflect() protoreflect.Message {
+	mi := &file_google_api_client_proto_msgTypes[13]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BatchingConfigProto.ProtoReflect.Descriptor instead.
+func (*BatchingConfigProto) Descriptor() ([]byte, []int) {
+	return file_google_api_client_proto_rawDescGZIP(), []int{13}
+}
+
+func (x *BatchingConfigProto) GetThresholds() *BatchingSettingsProto {
+	if x != nil {
+		return x.Thresholds
+	}
+	return nil
+}
+
+func (x *BatchingConfigProto) GetBatchDescriptor() *BatchingDescriptorProto {
+	if x != nil {
+		return x.BatchDescriptor
+	}
+	return nil
+}
+
+// `BatchingSettingsProto` specifies a set of batching thresholds, each of
+// which acts as a trigger to send a batch of messages as a request. At least
+// one threshold must be positive nonzero.
+type BatchingSettingsProto struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The number of elements of a field collected into a batch which, if
+	// exceeded, causes the batch to be sent.
+	ElementCountThreshold int32 `protobuf:"varint,1,opt,name=element_count_threshold,json=elementCountThreshold,proto3" json:"element_count_threshold,omitempty"`
+	// The aggregated size of the batched field which, if exceeded, causes the
+	// batch to be sent. This size is computed by aggregating the sizes of the
+	// request field to be batched, not of the entire request message.
+	RequestByteThreshold int64 `protobuf:"varint,2,opt,name=request_byte_threshold,json=requestByteThreshold,proto3" json:"request_byte_threshold,omitempty"`
+	// The duration after which a batch should be sent, starting from the addition
+	// of the first message to that batch.
+	DelayThreshold *durationpb.Duration `protobuf:"bytes,3,opt,name=delay_threshold,json=delayThreshold,proto3" json:"delay_threshold,omitempty"`
+	// The maximum number of elements collected in a batch that could be accepted
+	// by server.
+	ElementCountLimit int32 `protobuf:"varint,4,opt,name=element_count_limit,json=elementCountLimit,proto3" json:"element_count_limit,omitempty"`
+	// The maximum size of the request that could be accepted by server.
+	RequestByteLimit int32 `protobuf:"varint,5,opt,name=request_byte_limit,json=requestByteLimit,proto3" json:"request_byte_limit,omitempty"`
+	// The maximum number of elements allowed by flow control.
+	FlowControlElementLimit int32 `protobuf:"varint,6,opt,name=flow_control_element_limit,json=flowControlElementLimit,proto3" json:"flow_control_element_limit,omitempty"`
+	// The maximum size of data allowed by flow control.
+	FlowControlByteLimit int32 `protobuf:"varint,7,opt,name=flow_control_byte_limit,json=flowControlByteLimit,proto3" json:"flow_control_byte_limit,omitempty"`
+	// The behavior to take when the flow control limit is exceeded.
+	FlowControlLimitExceededBehavior FlowControlLimitExceededBehaviorProto `protobuf:"varint,8,opt,name=flow_control_limit_exceeded_behavior,json=flowControlLimitExceededBehavior,proto3,enum=google.api.FlowControlLimitExceededBehaviorProto" json:"flow_control_limit_exceeded_behavior,omitempty"`
+}
+
+func (x *BatchingSettingsProto) Reset() {
+	*x = BatchingSettingsProto{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_google_api_client_proto_msgTypes[14]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BatchingSettingsProto) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BatchingSettingsProto) ProtoMessage() {}
+
+func (x *BatchingSettingsProto) ProtoReflect() protoreflect.Message {
+	mi := &file_google_api_client_proto_msgTypes[14]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BatchingSettingsProto.ProtoReflect.Descriptor instead.
+func (*BatchingSettingsProto) Descriptor() ([]byte, []int) {
+	return file_google_api_client_proto_rawDescGZIP(), []int{14}
+}
+
+func (x *BatchingSettingsProto) GetElementCountThreshold() int32 {
+	if x != nil {
+		return x.ElementCountThreshold
+	}
+	return 0
+}
+
+func (x *BatchingSettingsProto) GetRequestByteThreshold() int64 {
+	if x != nil {
+		return x.RequestByteThreshold
+	}
+	return 0
+}
+
+func (x *BatchingSettingsProto) GetDelayThreshold() *durationpb.Duration {
+	if x != nil {
+		return x.DelayThreshold
+	}
+	return nil
+}
+
+func (x *BatchingSettingsProto) GetElementCountLimit() int32 {
+	if x != nil {
+		return x.ElementCountLimit
+	}
+	return 0
+}
+
+func (x *BatchingSettingsProto) GetRequestByteLimit() int32 {
+	if x != nil {
+		return x.RequestByteLimit
+	}
+	return 0
+}
+
+func (x *BatchingSettingsProto) GetFlowControlElementLimit() int32 {
+	if x != nil {
+		return x.FlowControlElementLimit
+	}
+	return 0
+}
+
+func (x *BatchingSettingsProto) GetFlowControlByteLimit() int32 {
+	if x != nil {
+		return x.FlowControlByteLimit
+	}
+	return 0
+}
+
+func (x *BatchingSettingsProto) GetFlowControlLimitExceededBehavior() FlowControlLimitExceededBehaviorProto {
+	if x != nil {
+		return x.FlowControlLimitExceededBehavior
+	}
+	return FlowControlLimitExceededBehaviorProto_UNSET_BEHAVIOR
+}
+
+// `BatchingDescriptorProto` specifies the fields of the request message to be
+// used for batching, and, optionally, the fields of the response message to be
+// used for demultiplexing.
+type BatchingDescriptorProto struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The repeated field in the request message to be aggregated by batching.
+	BatchedField string `protobuf:"bytes,1,opt,name=batched_field,json=batchedField,proto3" json:"batched_field,omitempty"`
+	// A list of the fields in the request message. Two requests will be batched
+	// together only if the values of every field specified in
+	// `request_discriminator_fields` is equal between the two requests.
+	DiscriminatorFields []string `protobuf:"bytes,2,rep,name=discriminator_fields,json=discriminatorFields,proto3" json:"discriminator_fields,omitempty"`
+	// Optional. When present, indicates the field in the response message to be
+	// used to demultiplex the response into multiple response messages, in
+	// correspondence with the multiple request messages originally batched
+	// together.
+	SubresponseField string `protobuf:"bytes,3,opt,name=subresponse_field,json=subresponseField,proto3" json:"subresponse_field,omitempty"`
+}
+
+func (x *BatchingDescriptorProto) Reset() {
+	*x = BatchingDescriptorProto{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_google_api_client_proto_msgTypes[15]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BatchingDescriptorProto) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BatchingDescriptorProto) ProtoMessage() {}
+
+func (x *BatchingDescriptorProto) ProtoReflect() protoreflect.Message {
+	mi := &file_google_api_client_proto_msgTypes[15]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BatchingDescriptorProto.ProtoReflect.Descriptor instead.
+func (*BatchingDescriptorProto) Descriptor() ([]byte, []int) {
+	return file_google_api_client_proto_rawDescGZIP(), []int{15}
+}
+
+func (x *BatchingDescriptorProto) GetBatchedField() string {
+	if x != nil {
+		return x.BatchedField
+	}
+	return ""
+}
+
+func (x *BatchingDescriptorProto) GetDiscriminatorFields() []string {
+	if x != nil {
+		return x.DiscriminatorFields
+	}
+	return nil
+}
+
+func (x *BatchingDescriptorProto) GetSubresponseField() string {
+	if x != nil {
+		return x.SubresponseField
+	}
+	return ""
+}
+
 // Experimental features to be included during client library generation.
 // These fields will be deprecated once the feature graduates and is enabled
 // by default.
@@ -1242,7 +1595,7 @@ type PythonSettings_ExperimentalFeatures struct {
 func (x *PythonSettings_ExperimentalFeatures) Reset() {
 	*x = PythonSettings_ExperimentalFeatures{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_google_api_client_proto_msgTypes[14]
+		mi := &file_google_api_client_proto_msgTypes[17]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1255,7 +1608,7 @@ func (x *PythonSettings_ExperimentalFeatures) String() string {
 func (*PythonSettings_ExperimentalFeatures) ProtoMessage() {}
 
 func (x *PythonSettings_ExperimentalFeatures) ProtoReflect() protoreflect.Message {
-	mi := &file_google_api_client_proto_msgTypes[14]
+	mi := &file_google_api_client_proto_msgTypes[17]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1320,7 +1673,7 @@ type MethodSettings_LongRunning struct {
 func (x *MethodSettings_LongRunning) Reset() {
 	*x = MethodSettings_LongRunning{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_google_api_client_proto_msgTypes[18]
+		mi := &file_google_api_client_proto_msgTypes[21]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1333,7 +1686,7 @@ func (x *MethodSettings_LongRunning) String() string {
 func (*MethodSettings_LongRunning) ProtoMessage() {}
 
 func (x *MethodSettings_LongRunning) ProtoReflect() protoreflect.Message {
-	mi := &file_google_api_client_proto_msgTypes[18]
+	mi := &file_google_api_client_proto_msgTypes[21]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1640,173 +1993,241 @@ var file_google_api_client_proto_rawDesc = []byte{
 	0x6d, 0x6d, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x67, 0x6f, 0x6f,
 	0x67, 0x6c, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x4c, 0x61,
 	0x6e, 0x67, 0x75, 0x61, 0x67, 0x65, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x06,
-	0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x22, 0x49, 0x0a, 0x0b, 0x50, 0x68, 0x70, 0x53, 0x65, 0x74,
+	0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x22, 0x72, 0x0a, 0x0b, 0x50, 0x68, 0x70, 0x53, 0x65, 0x74,
 	0x74, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x3a, 0x0a, 0x06, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x18,
 	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x61,
 	0x70, 0x69, 0x2e, 0x43, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x4c, 0x61, 0x6e, 0x67, 0x75, 0x61, 0x67,
 	0x65, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x06, 0x63, 0x6f, 0x6d, 0x6d, 0x6f,
-	0x6e, 0x22, 0x87, 0x03, 0x0a, 0x0e, 0x50, 0x79, 0x74, 0x68, 0x6f, 0x6e, 0x53, 0x65, 0x74, 0x74,
+	0x6e, 0x12, 0x27, 0x0a, 0x0f, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x5f, 0x70, 0x61, 0x63,
+	0x6b, 0x61, 0x67, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x6c, 0x69, 0x62, 0x72,
+	0x61, 0x72, 0x79, 0x50, 0x61, 0x63, 0x6b, 0x61, 0x67, 0x65, 0x22, 0x87, 0x03, 0x0a, 0x0e, 0x50,
+	0x79, 0x74, 0x68, 0x6f, 0x6e, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x3a, 0x0a,
+	0x06, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e,
+	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x6f, 0x6d, 0x6d, 0x6f,
+	0x6e, 0x4c, 0x61, 0x6e, 0x67, 0x75, 0x61, 0x67, 0x65, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67,
+	0x73, 0x52, 0x06, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x12, 0x64, 0x0a, 0x15, 0x65, 0x78, 0x70,
+	0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x5f, 0x66, 0x65, 0x61, 0x74, 0x75, 0x72,
+	0x65, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x50, 0x79, 0x74, 0x68, 0x6f, 0x6e, 0x53, 0x65, 0x74, 0x74,
+	0x69, 0x6e, 0x67, 0x73, 0x2e, 0x45, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61,
+	0x6c, 0x46, 0x65, 0x61, 0x74, 0x75, 0x72, 0x65, 0x73, 0x52, 0x14, 0x65, 0x78, 0x70, 0x65, 0x72,
+	0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x46, 0x65, 0x61, 0x74, 0x75, 0x72, 0x65, 0x73, 0x1a,
+	0xd2, 0x01, 0x0a, 0x14, 0x45, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c,
+	0x46, 0x65, 0x61, 0x74, 0x75, 0x72, 0x65, 0x73, 0x12, 0x31, 0x0a, 0x15, 0x72, 0x65, 0x73, 0x74,
+	0x5f, 0x61, 0x73, 0x79, 0x6e, 0x63, 0x5f, 0x69, 0x6f, 0x5f, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65,
+	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x12, 0x72, 0x65, 0x73, 0x74, 0x41, 0x73, 0x79,
+	0x6e, 0x63, 0x49, 0x6f, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x45, 0x0a, 0x1f, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x5f, 0x70, 0x79, 0x74, 0x68, 0x6f, 0x6e, 0x69, 0x63,
+	0x5f, 0x74, 0x79, 0x70, 0x65, 0x73, 0x5f, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x1c, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x50, 0x79,
+	0x74, 0x68, 0x6f, 0x6e, 0x69, 0x63, 0x54, 0x79, 0x70, 0x65, 0x73, 0x45, 0x6e, 0x61, 0x62, 0x6c,
+	0x65, 0x64, 0x12, 0x40, 0x0a, 0x1c, 0x75, 0x6e, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x65,
+	0x64, 0x5f, 0x70, 0x61, 0x63, 0x6b, 0x61, 0x67, 0x65, 0x5f, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c,
+	0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x1a, 0x75, 0x6e, 0x76, 0x65, 0x72, 0x73,
+	0x69, 0x6f, 0x6e, 0x65, 0x64, 0x50, 0x61, 0x63, 0x6b, 0x61, 0x67, 0x65, 0x44, 0x69, 0x73, 0x61,
+	0x62, 0x6c, 0x65, 0x64, 0x22, 0x4a, 0x0a, 0x0c, 0x4e, 0x6f, 0x64, 0x65, 0x53, 0x65, 0x74, 0x74,
 	0x69, 0x6e, 0x67, 0x73, 0x12, 0x3a, 0x0a, 0x06, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x18, 0x01,
 	0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x61, 0x70,
 	0x69, 0x2e, 0x43, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x4c, 0x61, 0x6e, 0x67, 0x75, 0x61, 0x67, 0x65,
 	0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x06, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e,
-	0x12, 0x64, 0x0a, 0x15, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c,
-	0x5f, 0x66, 0x65, 0x61, 0x74, 0x75, 0x72, 0x65, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x2f, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x50, 0x79, 0x74,
-	0x68, 0x6f, 0x6e, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x2e, 0x45, 0x78, 0x70, 0x65,
-	0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x46, 0x65, 0x61, 0x74, 0x75, 0x72, 0x65, 0x73,
-	0x52, 0x14, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x46, 0x65,
-	0x61, 0x74, 0x75, 0x72, 0x65, 0x73, 0x1a, 0xd2, 0x01, 0x0a, 0x14, 0x45, 0x78, 0x70, 0x65, 0x72,
-	0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x46, 0x65, 0x61, 0x74, 0x75, 0x72, 0x65, 0x73, 0x12,
-	0x31, 0x0a, 0x15, 0x72, 0x65, 0x73, 0x74, 0x5f, 0x61, 0x73, 0x79, 0x6e, 0x63, 0x5f, 0x69, 0x6f,
-	0x5f, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x12,
-	0x72, 0x65, 0x73, 0x74, 0x41, 0x73, 0x79, 0x6e, 0x63, 0x49, 0x6f, 0x45, 0x6e, 0x61, 0x62, 0x6c,
-	0x65, 0x64, 0x12, 0x45, 0x0a, 0x1f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x5f, 0x70,
-	0x79, 0x74, 0x68, 0x6f, 0x6e, 0x69, 0x63, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x73, 0x5f, 0x65, 0x6e,
-	0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x1c, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x62, 0x75, 0x66, 0x50, 0x79, 0x74, 0x68, 0x6f, 0x6e, 0x69, 0x63, 0x54, 0x79, 0x70,
-	0x65, 0x73, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x40, 0x0a, 0x1c, 0x75, 0x6e, 0x76,
-	0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x64, 0x5f, 0x70, 0x61, 0x63, 0x6b, 0x61, 0x67, 0x65,
-	0x5f, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52,
-	0x1a, 0x75, 0x6e, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x64, 0x50, 0x61, 0x63, 0x6b,
-	0x61, 0x67, 0x65, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x22, 0x4a, 0x0a, 0x0c, 0x4e,
-	0x6f, 0x64, 0x65, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x3a, 0x0a, 0x06, 0x63,
-	0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x67, 0x6f,
-	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x4c,
-	0x61, 0x6e, 0x67, 0x75, 0x61, 0x67, 0x65, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x52,
-	0x06, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x22, 0xae, 0x04, 0x0a, 0x0e, 0x44, 0x6f, 0x74, 0x6e,
-	0x65, 0x74, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x3a, 0x0a, 0x06, 0x63, 0x6f,
-	0x6d, 0x6d, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x67, 0x6f, 0x6f,
-	0x67, 0x6c, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x4c, 0x61,
-	0x6e, 0x67, 0x75, 0x61, 0x67, 0x65, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x06,
-	0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x12, 0x5a, 0x0a, 0x10, 0x72, 0x65, 0x6e, 0x61, 0x6d, 0x65,
-	0x64, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b,
-	0x32, 0x2f, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x6f,
-	0x74, 0x6e, 0x65, 0x74, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x2e, 0x52, 0x65, 0x6e,
-	0x61, 0x6d, 0x65, 0x64, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72,
-	0x79, 0x52, 0x0f, 0x72, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x64, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
-	0x65, 0x73, 0x12, 0x5d, 0x0a, 0x11, 0x72, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x64, 0x5f, 0x72, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x30, 0x2e,
-	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x6f, 0x74, 0x6e, 0x65,
-	0x74, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x2e, 0x52, 0x65, 0x6e, 0x61, 0x6d, 0x65,
-	0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52,
-	0x10, 0x72, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x73, 0x12, 0x2b, 0x0a, 0x11, 0x69, 0x67, 0x6e, 0x6f, 0x72, 0x65, 0x64, 0x5f, 0x72, 0x65, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x10, 0x69, 0x67,
-	0x6e, 0x6f, 0x72, 0x65, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x38,
-	0x0a, 0x18, 0x66, 0x6f, 0x72, 0x63, 0x65, 0x64, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61,
-	0x63, 0x65, 0x5f, 0x61, 0x6c, 0x69, 0x61, 0x73, 0x65, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09,
-	0x52, 0x16, 0x66, 0x6f, 0x72, 0x63, 0x65, 0x64, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63,
-	0x65, 0x41, 0x6c, 0x69, 0x61, 0x73, 0x65, 0x73, 0x12, 0x35, 0x0a, 0x16, 0x68, 0x61, 0x6e, 0x64,
-	0x77, 0x72, 0x69, 0x74, 0x74, 0x65, 0x6e, 0x5f, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72,
-	0x65, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x09, 0x52, 0x15, 0x68, 0x61, 0x6e, 0x64, 0x77, 0x72,
-	0x69, 0x74, 0x74, 0x65, 0x6e, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x73, 0x1a,
-	0x42, 0x0a, 0x14, 0x52, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x64, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
-	0x65, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c,
-	0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a,
-	0x02, 0x38, 0x01, 0x1a, 0x43, 0x0a, 0x15, 0x52, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x64, 0x52, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03,
-	0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14,
-	0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76,
-	0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x4a, 0x0a, 0x0c, 0x52, 0x75, 0x62, 0x79,
-	0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x3a, 0x0a, 0x06, 0x63, 0x6f, 0x6d, 0x6d,
-	0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
-	0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x4c, 0x61, 0x6e, 0x67,
-	0x75, 0x61, 0x67, 0x65, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x06, 0x63, 0x6f,
-	0x6d, 0x6d, 0x6f, 0x6e, 0x22, 0xe4, 0x01, 0x0a, 0x0a, 0x47, 0x6f, 0x53, 0x65, 0x74, 0x74, 0x69,
+	0x22, 0xae, 0x04, 0x0a, 0x0e, 0x44, 0x6f, 0x74, 0x6e, 0x65, 0x74, 0x53, 0x65, 0x74, 0x74, 0x69,
 	0x6e, 0x67, 0x73, 0x12, 0x3a, 0x0a, 0x06, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x18, 0x01, 0x20,
 	0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x61, 0x70, 0x69,
 	0x2e, 0x43, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x4c, 0x61, 0x6e, 0x67, 0x75, 0x61, 0x67, 0x65, 0x53,
 	0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x06, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x12,
-	0x56, 0x0a, 0x10, 0x72, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x64, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x69,
-	0x63, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
-	0x6c, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x47, 0x6f, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67,
-	0x73, 0x2e, 0x52, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x64, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
-	0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0f, 0x72, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x64, 0x53,
-	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x1a, 0x42, 0x0a, 0x14, 0x52, 0x65, 0x6e, 0x61, 0x6d,
-	0x65, 0x64, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12,
-	0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65,
-	0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0xc2, 0x03, 0x0a, 0x0e,
-	0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x1a,
-	0x0a, 0x08, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x08, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x12, 0x49, 0x0a, 0x0c, 0x6c, 0x6f,
-	0x6e, 0x67, 0x5f, 0x72, 0x75, 0x6e, 0x6e, 0x69, 0x6e, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x26, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4d, 0x65,
-	0x74, 0x68, 0x6f, 0x64, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x2e, 0x4c, 0x6f, 0x6e,
-	0x67, 0x52, 0x75, 0x6e, 0x6e, 0x69, 0x6e, 0x67, 0x52, 0x0b, 0x6c, 0x6f, 0x6e, 0x67, 0x52, 0x75,
-	0x6e, 0x6e, 0x69, 0x6e, 0x67, 0x12, 0x32, 0x0a, 0x15, 0x61, 0x75, 0x74, 0x6f, 0x5f, 0x70, 0x6f,
-	0x70, 0x75, 0x6c, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x73, 0x18, 0x03,
-	0x20, 0x03, 0x28, 0x09, 0x52, 0x13, 0x61, 0x75, 0x74, 0x6f, 0x50, 0x6f, 0x70, 0x75, 0x6c, 0x61,
-	0x74, 0x65, 0x64, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x73, 0x1a, 0x94, 0x02, 0x0a, 0x0b, 0x4c, 0x6f,
-	0x6e, 0x67, 0x52, 0x75, 0x6e, 0x6e, 0x69, 0x6e, 0x67, 0x12, 0x47, 0x0a, 0x12, 0x69, 0x6e, 0x69,
-	0x74, 0x69, 0x61, 0x6c, 0x5f, 0x70, 0x6f, 0x6c, 0x6c, 0x5f, 0x64, 0x65, 0x6c, 0x61, 0x79, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x52, 0x10, 0x69, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x6c, 0x50, 0x6f, 0x6c, 0x6c, 0x44, 0x65, 0x6c,
-	0x61, 0x79, 0x12, 0x32, 0x0a, 0x15, 0x70, 0x6f, 0x6c, 0x6c, 0x5f, 0x64, 0x65, 0x6c, 0x61, 0x79,
-	0x5f, 0x6d, 0x75, 0x6c, 0x74, 0x69, 0x70, 0x6c, 0x69, 0x65, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x02, 0x52, 0x13, 0x70, 0x6f, 0x6c, 0x6c, 0x44, 0x65, 0x6c, 0x61, 0x79, 0x4d, 0x75, 0x6c, 0x74,
-	0x69, 0x70, 0x6c, 0x69, 0x65, 0x72, 0x12, 0x3f, 0x0a, 0x0e, 0x6d, 0x61, 0x78, 0x5f, 0x70, 0x6f,
-	0x6c, 0x6c, 0x5f, 0x64, 0x65, 0x6c, 0x61, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19,
-	0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
-	0x2e, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0c, 0x6d, 0x61, 0x78, 0x50, 0x6f,
-	0x6c, 0x6c, 0x44, 0x65, 0x6c, 0x61, 0x79, 0x12, 0x47, 0x0a, 0x12, 0x74, 0x6f, 0x74, 0x61, 0x6c,
-	0x5f, 0x70, 0x6f, 0x6c, 0x6c, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x18, 0x04, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x10,
-	0x74, 0x6f, 0x74, 0x61, 0x6c, 0x50, 0x6f, 0x6c, 0x6c, 0x54, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74,
-	0x22, 0x75, 0x0a, 0x18, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x76, 0x65, 0x47, 0x61, 0x70,
-	0x69, 0x63, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x18, 0x0a, 0x07,
-	0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x6d,
-	0x65, 0x74, 0x68, 0x6f, 0x64, 0x73, 0x12, 0x3f, 0x0a, 0x1c, 0x67, 0x65, 0x6e, 0x65, 0x72, 0x61,
-	0x74, 0x65, 0x5f, 0x6f, 0x6d, 0x69, 0x74, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x73, 0x5f, 0x69, 0x6e,
-	0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x19, 0x67, 0x65,
-	0x6e, 0x65, 0x72, 0x61, 0x74, 0x65, 0x4f, 0x6d, 0x69, 0x74, 0x74, 0x65, 0x64, 0x41, 0x73, 0x49,
-	0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2a, 0xa3, 0x01, 0x0a, 0x19, 0x43, 0x6c, 0x69, 0x65,
-	0x6e, 0x74, 0x4c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x4f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x2b, 0x0a, 0x27, 0x43, 0x4c, 0x49, 0x45, 0x4e, 0x54, 0x5f,
-	0x4c, 0x49, 0x42, 0x52, 0x41, 0x52, 0x59, 0x5f, 0x4f, 0x52, 0x47, 0x41, 0x4e, 0x49, 0x5a, 0x41,
-	0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44,
-	0x10, 0x00, 0x12, 0x09, 0x0a, 0x05, 0x43, 0x4c, 0x4f, 0x55, 0x44, 0x10, 0x01, 0x12, 0x07, 0x0a,
-	0x03, 0x41, 0x44, 0x53, 0x10, 0x02, 0x12, 0x0a, 0x0a, 0x06, 0x50, 0x48, 0x4f, 0x54, 0x4f, 0x53,
-	0x10, 0x03, 0x12, 0x0f, 0x0a, 0x0b, 0x53, 0x54, 0x52, 0x45, 0x45, 0x54, 0x5f, 0x56, 0x49, 0x45,
-	0x57, 0x10, 0x04, 0x12, 0x0c, 0x0a, 0x08, 0x53, 0x48, 0x4f, 0x50, 0x50, 0x49, 0x4e, 0x47, 0x10,
-	0x05, 0x12, 0x07, 0x0a, 0x03, 0x47, 0x45, 0x4f, 0x10, 0x06, 0x12, 0x11, 0x0a, 0x0d, 0x47, 0x45,
-	0x4e, 0x45, 0x52, 0x41, 0x54, 0x49, 0x56, 0x45, 0x5f, 0x41, 0x49, 0x10, 0x07, 0x2a, 0x67, 0x0a,
-	0x18, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x4c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x44, 0x65,
-	0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x2a, 0x0a, 0x26, 0x43, 0x4c, 0x49,
-	0x45, 0x4e, 0x54, 0x5f, 0x4c, 0x49, 0x42, 0x52, 0x41, 0x52, 0x59, 0x5f, 0x44, 0x45, 0x53, 0x54,
-	0x49, 0x4e, 0x41, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46,
-	0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x0a, 0x0a, 0x06, 0x47, 0x49, 0x54, 0x48, 0x55, 0x42, 0x10,
-	0x0a, 0x12, 0x13, 0x0a, 0x0f, 0x50, 0x41, 0x43, 0x4b, 0x41, 0x47, 0x45, 0x5f, 0x4d, 0x41, 0x4e,
-	0x41, 0x47, 0x45, 0x52, 0x10, 0x14, 0x3a, 0x4a, 0x0a, 0x10, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64,
-	0x5f, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x12, 0x1e, 0x2e, 0x67, 0x6f, 0x6f,
-	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4d, 0x65, 0x74,
-	0x68, 0x6f, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x9b, 0x08, 0x20, 0x03, 0x28,
-	0x09, 0x52, 0x0f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75,
-	0x72, 0x65, 0x3a, 0x43, 0x0a, 0x0c, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x68, 0x6f,
-	0x73, 0x74, 0x12, 0x1f, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x4f, 0x70, 0x74, 0x69,
-	0x6f, 0x6e, 0x73, 0x18, 0x99, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65, 0x66, 0x61,
-	0x75, 0x6c, 0x74, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x43, 0x0a, 0x0c, 0x6f, 0x61, 0x75, 0x74, 0x68,
-	0x5f, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x12, 0x1f, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
-	0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x9a, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x0b, 0x6f, 0x61, 0x75, 0x74, 0x68, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x3a, 0x44, 0x0a, 0x0b,
-	0x61, 0x70, 0x69, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x1f, 0x2e, 0x67, 0x6f,
-	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x65,
-	0x72, 0x76, 0x69, 0x63, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0xc1, 0xba, 0xab,
-	0xfa, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x61, 0x70, 0x69, 0x56, 0x65, 0x72, 0x73, 0x69,
-	0x6f, 0x6e, 0x42, 0x69, 0x0a, 0x0e, 0x63, 0x6f, 0x6d, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
-	0x2e, 0x61, 0x70, 0x69, 0x42, 0x0b, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x50, 0x72, 0x6f, 0x74,
-	0x6f, 0x50, 0x01, 0x5a, 0x41, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x67, 0x6f, 0x6c, 0x61,
-	0x6e, 0x67, 0x2e, 0x6f, 0x72, 0x67, 0x2f, 0x67, 0x65, 0x6e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f,
-	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x61, 0x70, 0x69, 0x73, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x61,
-	0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x3b, 0x61, 0x6e, 0x6e, 0x6f, 0x74,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xa2, 0x02, 0x04, 0x47, 0x41, 0x50, 0x49, 0x62, 0x06, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x5a, 0x0a, 0x10, 0x72, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x64, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x6f, 0x74, 0x6e, 0x65, 0x74, 0x53, 0x65, 0x74,
+	0x74, 0x69, 0x6e, 0x67, 0x73, 0x2e, 0x52, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x64, 0x53, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0f, 0x72, 0x65, 0x6e, 0x61,
+	0x6d, 0x65, 0x64, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x12, 0x5d, 0x0a, 0x11, 0x72,
+	0x65, 0x6e, 0x61, 0x6d, 0x65, 0x64, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73,
+	0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x30, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
+	0x61, 0x70, 0x69, 0x2e, 0x44, 0x6f, 0x74, 0x6e, 0x65, 0x74, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e,
+	0x67, 0x73, 0x2e, 0x52, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x10, 0x72, 0x65, 0x6e, 0x61, 0x6d, 0x65,
+	0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x2b, 0x0a, 0x11, 0x69, 0x67,
+	0x6e, 0x6f, 0x72, 0x65, 0x64, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18,
+	0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x10, 0x69, 0x67, 0x6e, 0x6f, 0x72, 0x65, 0x64, 0x52, 0x65,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x38, 0x0a, 0x18, 0x66, 0x6f, 0x72, 0x63, 0x65,
+	0x64, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x61, 0x6c, 0x69, 0x61,
+	0x73, 0x65, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x16, 0x66, 0x6f, 0x72, 0x63, 0x65,
+	0x64, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x41, 0x6c, 0x69, 0x61, 0x73, 0x65,
+	0x73, 0x12, 0x35, 0x0a, 0x16, 0x68, 0x61, 0x6e, 0x64, 0x77, 0x72, 0x69, 0x74, 0x74, 0x65, 0x6e,
+	0x5f, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28,
+	0x09, 0x52, 0x15, 0x68, 0x61, 0x6e, 0x64, 0x77, 0x72, 0x69, 0x74, 0x74, 0x65, 0x6e, 0x53, 0x69,
+	0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x73, 0x1a, 0x42, 0x0a, 0x14, 0x52, 0x65, 0x6e, 0x61,
+	0x6d, 0x65, 0x64, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79,
+	0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b,
+	0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x43, 0x0a, 0x15,
+	0x52, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73,
+	0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38,
+	0x01, 0x22, 0x4a, 0x0a, 0x0c, 0x52, 0x75, 0x62, 0x79, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67,
+	0x73, 0x12, 0x3a, 0x0a, 0x06, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x22, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43,
+	0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x4c, 0x61, 0x6e, 0x67, 0x75, 0x61, 0x67, 0x65, 0x53, 0x65, 0x74,
+	0x74, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x06, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x22, 0xe4, 0x01,
+	0x0a, 0x0a, 0x47, 0x6f, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x3a, 0x0a, 0x06,
+	0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x67,
+	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e,
+	0x4c, 0x61, 0x6e, 0x67, 0x75, 0x61, 0x67, 0x65, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73,
+	0x52, 0x06, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x12, 0x56, 0x0a, 0x10, 0x72, 0x65, 0x6e, 0x61,
+	0x6d, 0x65, 0x64, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x47, 0x6f, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x2e, 0x52, 0x65, 0x6e, 0x61, 0x6d,
+	0x65, 0x64, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52,
+	0x0f, 0x72, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x64, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73,
+	0x1a, 0x42, 0x0a, 0x14, 0x52, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x64, 0x53, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61,
+	0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
+	0x3a, 0x02, 0x38, 0x01, 0x22, 0xff, 0x03, 0x0a, 0x0e, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x53,
+	0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x1a, 0x0a, 0x08, 0x73, 0x65, 0x6c, 0x65, 0x63,
+	0x74, 0x6f, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x73, 0x65, 0x6c, 0x65, 0x63,
+	0x74, 0x6f, 0x72, 0x12, 0x49, 0x0a, 0x0c, 0x6c, 0x6f, 0x6e, 0x67, 0x5f, 0x72, 0x75, 0x6e, 0x6e,
+	0x69, 0x6e, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x53, 0x65, 0x74,
+	0x74, 0x69, 0x6e, 0x67, 0x73, 0x2e, 0x4c, 0x6f, 0x6e, 0x67, 0x52, 0x75, 0x6e, 0x6e, 0x69, 0x6e,
+	0x67, 0x52, 0x0b, 0x6c, 0x6f, 0x6e, 0x67, 0x52, 0x75, 0x6e, 0x6e, 0x69, 0x6e, 0x67, 0x12, 0x32,
+	0x0a, 0x15, 0x61, 0x75, 0x74, 0x6f, 0x5f, 0x70, 0x6f, 0x70, 0x75, 0x6c, 0x61, 0x74, 0x65, 0x64,
+	0x5f, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x13, 0x61,
+	0x75, 0x74, 0x6f, 0x50, 0x6f, 0x70, 0x75, 0x6c, 0x61, 0x74, 0x65, 0x64, 0x46, 0x69, 0x65, 0x6c,
+	0x64, 0x73, 0x12, 0x3b, 0x0a, 0x08, 0x62, 0x61, 0x74, 0x63, 0x68, 0x69, 0x6e, 0x67, 0x18, 0x04,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x42, 0x61, 0x74, 0x63, 0x68, 0x69, 0x6e, 0x67, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x50, 0x72, 0x6f, 0x74, 0x6f, 0x52, 0x08, 0x62, 0x61, 0x74, 0x63, 0x68, 0x69, 0x6e, 0x67, 0x1a,
+	0x94, 0x02, 0x0a, 0x0b, 0x4c, 0x6f, 0x6e, 0x67, 0x52, 0x75, 0x6e, 0x6e, 0x69, 0x6e, 0x67, 0x12,
+	0x47, 0x0a, 0x12, 0x69, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x70, 0x6f, 0x6c, 0x6c, 0x5f,
+	0x64, 0x65, 0x6c, 0x61, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f,
+	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x75,
+	0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x10, 0x69, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x6c, 0x50,
+	0x6f, 0x6c, 0x6c, 0x44, 0x65, 0x6c, 0x61, 0x79, 0x12, 0x32, 0x0a, 0x15, 0x70, 0x6f, 0x6c, 0x6c,
+	0x5f, 0x64, 0x65, 0x6c, 0x61, 0x79, 0x5f, 0x6d, 0x75, 0x6c, 0x74, 0x69, 0x70, 0x6c, 0x69, 0x65,
+	0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x02, 0x52, 0x13, 0x70, 0x6f, 0x6c, 0x6c, 0x44, 0x65, 0x6c,
+	0x61, 0x79, 0x4d, 0x75, 0x6c, 0x74, 0x69, 0x70, 0x6c, 0x69, 0x65, 0x72, 0x12, 0x3f, 0x0a, 0x0e,
+	0x6d, 0x61, 0x78, 0x5f, 0x70, 0x6f, 0x6c, 0x6c, 0x5f, 0x64, 0x65, 0x6c, 0x61, 0x79, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52,
+	0x0c, 0x6d, 0x61, 0x78, 0x50, 0x6f, 0x6c, 0x6c, 0x44, 0x65, 0x6c, 0x61, 0x79, 0x12, 0x47, 0x0a,
+	0x12, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x5f, 0x70, 0x6f, 0x6c, 0x6c, 0x5f, 0x74, 0x69, 0x6d, 0x65,
+	0x6f, 0x75, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x75, 0x72, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x10, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x50, 0x6f, 0x6c, 0x6c, 0x54,
+	0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x22, 0x75, 0x0a, 0x18, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74,
+	0x69, 0x76, 0x65, 0x47, 0x61, 0x70, 0x69, 0x63, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x12, 0x18, 0x0a, 0x07, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x73, 0x18, 0x01, 0x20,
+	0x03, 0x28, 0x09, 0x52, 0x07, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x73, 0x12, 0x3f, 0x0a, 0x1c,
+	0x67, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x65, 0x5f, 0x6f, 0x6d, 0x69, 0x74, 0x74, 0x65, 0x64,
+	0x5f, 0x61, 0x73, 0x5f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x08, 0x52, 0x19, 0x67, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x65, 0x4f, 0x6d, 0x69, 0x74,
+	0x74, 0x65, 0x64, 0x41, 0x73, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x22, 0xa8, 0x01,
+	0x0a, 0x13, 0x42, 0x61, 0x74, 0x63, 0x68, 0x69, 0x6e, 0x67, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x50, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x41, 0x0a, 0x0a, 0x74, 0x68, 0x72, 0x65, 0x73, 0x68, 0x6f,
+	0x6c, 0x64, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x42, 0x61, 0x74, 0x63, 0x68, 0x69, 0x6e, 0x67, 0x53,
+	0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x52, 0x0a, 0x74, 0x68,
+	0x72, 0x65, 0x73, 0x68, 0x6f, 0x6c, 0x64, 0x73, 0x12, 0x4e, 0x0a, 0x10, 0x62, 0x61, 0x74, 0x63,
+	0x68, 0x5f, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x23, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x42, 0x61, 0x74, 0x63, 0x68, 0x69, 0x6e, 0x67, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74,
+	0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x52, 0x0f, 0x62, 0x61, 0x74, 0x63, 0x68, 0x44, 0x65,
+	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x22, 0x9f, 0x04, 0x0a, 0x15, 0x42, 0x61, 0x74,
+	0x63, 0x68, 0x69, 0x6e, 0x67, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x50, 0x72, 0x6f,
+	0x74, 0x6f, 0x12, 0x36, 0x0a, 0x17, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x5f, 0x63, 0x6f,
+	0x75, 0x6e, 0x74, 0x5f, 0x74, 0x68, 0x72, 0x65, 0x73, 0x68, 0x6f, 0x6c, 0x64, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x05, 0x52, 0x15, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x75, 0x6e,
+	0x74, 0x54, 0x68, 0x72, 0x65, 0x73, 0x68, 0x6f, 0x6c, 0x64, 0x12, 0x34, 0x0a, 0x16, 0x72, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x5f, 0x62, 0x79, 0x74, 0x65, 0x5f, 0x74, 0x68, 0x72, 0x65, 0x73,
+	0x68, 0x6f, 0x6c, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x14, 0x72, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x42, 0x79, 0x74, 0x65, 0x54, 0x68, 0x72, 0x65, 0x73, 0x68, 0x6f, 0x6c, 0x64,
+	0x12, 0x42, 0x0a, 0x0f, 0x64, 0x65, 0x6c, 0x61, 0x79, 0x5f, 0x74, 0x68, 0x72, 0x65, 0x73, 0x68,
+	0x6f, 0x6c, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x75, 0x72, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0e, 0x64, 0x65, 0x6c, 0x61, 0x79, 0x54, 0x68, 0x72, 0x65, 0x73,
+	0x68, 0x6f, 0x6c, 0x64, 0x12, 0x2e, 0x0a, 0x13, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x5f,
+	0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x05, 0x52, 0x11, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x4c,
+	0x69, 0x6d, 0x69, 0x74, 0x12, 0x2c, 0x0a, 0x12, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f,
+	0x62, 0x79, 0x74, 0x65, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x05,
+	0x52, 0x10, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x42, 0x79, 0x74, 0x65, 0x4c, 0x69, 0x6d,
+	0x69, 0x74, 0x12, 0x3b, 0x0a, 0x1a, 0x66, 0x6c, 0x6f, 0x77, 0x5f, 0x63, 0x6f, 0x6e, 0x74, 0x72,
+	0x6f, 0x6c, 0x5f, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74,
+	0x18, 0x06, 0x20, 0x01, 0x28, 0x05, 0x52, 0x17, 0x66, 0x6c, 0x6f, 0x77, 0x43, 0x6f, 0x6e, 0x74,
+	0x72, 0x6f, 0x6c, 0x45, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x12,
+	0x35, 0x0a, 0x17, 0x66, 0x6c, 0x6f, 0x77, 0x5f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x5f,
+	0x62, 0x79, 0x74, 0x65, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x18, 0x07, 0x20, 0x01, 0x28, 0x05,
+	0x52, 0x14, 0x66, 0x6c, 0x6f, 0x77, 0x43, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x42, 0x79, 0x74,
+	0x65, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x12, 0x81, 0x01, 0x0a, 0x24, 0x66, 0x6c, 0x6f, 0x77, 0x5f,
+	0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x5f, 0x65, 0x78,
+	0x63, 0x65, 0x65, 0x64, 0x65, 0x64, 0x5f, 0x62, 0x65, 0x68, 0x61, 0x76, 0x69, 0x6f, 0x72, 0x18,
+	0x08, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x31, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x61,
+	0x70, 0x69, 0x2e, 0x46, 0x6c, 0x6f, 0x77, 0x43, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x4c, 0x69,
+	0x6d, 0x69, 0x74, 0x45, 0x78, 0x63, 0x65, 0x65, 0x64, 0x65, 0x64, 0x42, 0x65, 0x68, 0x61, 0x76,
+	0x69, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x52, 0x20, 0x66, 0x6c, 0x6f, 0x77, 0x43, 0x6f,
+	0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x45, 0x78, 0x63, 0x65, 0x65, 0x64,
+	0x65, 0x64, 0x42, 0x65, 0x68, 0x61, 0x76, 0x69, 0x6f, 0x72, 0x22, 0x9e, 0x01, 0x0a, 0x17, 0x42,
+	0x61, 0x74, 0x63, 0x68, 0x69, 0x6e, 0x67, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f,
+	0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x23, 0x0a, 0x0d, 0x62, 0x61, 0x74, 0x63, 0x68, 0x65,
+	0x64, 0x5f, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x62,
+	0x61, 0x74, 0x63, 0x68, 0x65, 0x64, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x12, 0x31, 0x0a, 0x14, 0x64,
+	0x69, 0x73, 0x63, 0x72, 0x69, 0x6d, 0x69, 0x6e, 0x61, 0x74, 0x6f, 0x72, 0x5f, 0x66, 0x69, 0x65,
+	0x6c, 0x64, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x13, 0x64, 0x69, 0x73, 0x63, 0x72,
+	0x69, 0x6d, 0x69, 0x6e, 0x61, 0x74, 0x6f, 0x72, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x73, 0x12, 0x2b,
+	0x0a, 0x11, 0x73, 0x75, 0x62, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x5f, 0x66, 0x69,
+	0x65, 0x6c, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x73, 0x75, 0x62, 0x72, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x2a, 0xa3, 0x01, 0x0a, 0x19,
+	0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x4c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x4f, 0x72, 0x67,
+	0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x2b, 0x0a, 0x27, 0x43, 0x4c, 0x49,
+	0x45, 0x4e, 0x54, 0x5f, 0x4c, 0x49, 0x42, 0x52, 0x41, 0x52, 0x59, 0x5f, 0x4f, 0x52, 0x47, 0x41,
+	0x4e, 0x49, 0x5a, 0x41, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49,
+	0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x09, 0x0a, 0x05, 0x43, 0x4c, 0x4f, 0x55, 0x44, 0x10,
+	0x01, 0x12, 0x07, 0x0a, 0x03, 0x41, 0x44, 0x53, 0x10, 0x02, 0x12, 0x0a, 0x0a, 0x06, 0x50, 0x48,
+	0x4f, 0x54, 0x4f, 0x53, 0x10, 0x03, 0x12, 0x0f, 0x0a, 0x0b, 0x53, 0x54, 0x52, 0x45, 0x45, 0x54,
+	0x5f, 0x56, 0x49, 0x45, 0x57, 0x10, 0x04, 0x12, 0x0c, 0x0a, 0x08, 0x53, 0x48, 0x4f, 0x50, 0x50,
+	0x49, 0x4e, 0x47, 0x10, 0x05, 0x12, 0x07, 0x0a, 0x03, 0x47, 0x45, 0x4f, 0x10, 0x06, 0x12, 0x11,
+	0x0a, 0x0d, 0x47, 0x45, 0x4e, 0x45, 0x52, 0x41, 0x54, 0x49, 0x56, 0x45, 0x5f, 0x41, 0x49, 0x10,
+	0x07, 0x2a, 0x67, 0x0a, 0x18, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x4c, 0x69, 0x62, 0x72, 0x61,
+	0x72, 0x79, 0x44, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x2a, 0x0a,
+	0x26, 0x43, 0x4c, 0x49, 0x45, 0x4e, 0x54, 0x5f, 0x4c, 0x49, 0x42, 0x52, 0x41, 0x52, 0x59, 0x5f,
+	0x44, 0x45, 0x53, 0x54, 0x49, 0x4e, 0x41, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x55, 0x4e, 0x53, 0x50,
+	0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x0a, 0x0a, 0x06, 0x47, 0x49, 0x54,
+	0x48, 0x55, 0x42, 0x10, 0x0a, 0x12, 0x13, 0x0a, 0x0f, 0x50, 0x41, 0x43, 0x4b, 0x41, 0x47, 0x45,
+	0x5f, 0x4d, 0x41, 0x4e, 0x41, 0x47, 0x45, 0x52, 0x10, 0x14, 0x2a, 0x67, 0x0a, 0x25, 0x46, 0x6c,
+	0x6f, 0x77, 0x43, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x45, 0x78,
+	0x63, 0x65, 0x65, 0x64, 0x65, 0x64, 0x42, 0x65, 0x68, 0x61, 0x76, 0x69, 0x6f, 0x72, 0x50, 0x72,
+	0x6f, 0x74, 0x6f, 0x12, 0x12, 0x0a, 0x0e, 0x55, 0x4e, 0x53, 0x45, 0x54, 0x5f, 0x42, 0x45, 0x48,
+	0x41, 0x56, 0x49, 0x4f, 0x52, 0x10, 0x00, 0x12, 0x13, 0x0a, 0x0f, 0x54, 0x48, 0x52, 0x4f, 0x57,
+	0x5f, 0x45, 0x58, 0x43, 0x45, 0x50, 0x54, 0x49, 0x4f, 0x4e, 0x10, 0x01, 0x12, 0x09, 0x0a, 0x05,
+	0x42, 0x4c, 0x4f, 0x43, 0x4b, 0x10, 0x02, 0x12, 0x0a, 0x0a, 0x06, 0x49, 0x47, 0x4e, 0x4f, 0x52,
+	0x45, 0x10, 0x03, 0x3a, 0x4a, 0x0a, 0x10, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x5f, 0x73, 0x69,
+	0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x12, 0x1e, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64,
+	0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x9b, 0x08, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0f,
+	0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x3a,
+	0x43, 0x0a, 0x0c, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x68, 0x6f, 0x73, 0x74, 0x12,
+	0x1f, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
+	0x66, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73,
+	0x18, 0x99, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74,
+	0x48, 0x6f, 0x73, 0x74, 0x3a, 0x43, 0x0a, 0x0c, 0x6f, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x73, 0x63,
+	0x6f, 0x70, 0x65, 0x73, 0x12, 0x1f, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x4f, 0x70,
+	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x9a, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x6f, 0x61,
+	0x75, 0x74, 0x68, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x3a, 0x44, 0x0a, 0x0b, 0x61, 0x70, 0x69,
+	0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x1f, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0xc1, 0xba, 0xab, 0xfa, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0a, 0x61, 0x70, 0x69, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x42,
+	0x69, 0x0a, 0x0e, 0x63, 0x6f, 0x6d, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x61, 0x70,
+	0x69, 0x42, 0x0b, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01,
+	0x5a, 0x41, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x67, 0x6f, 0x6c, 0x61, 0x6e, 0x67, 0x2e,
+	0x6f, 0x72, 0x67, 0x2f, 0x67, 0x65, 0x6e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x67, 0x6f, 0x6f,
+	0x67, 0x6c, 0x65, 0x61, 0x70, 0x69, 0x73, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x61, 0x6e, 0x6e, 0x6f,
+	0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x3b, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0xa2, 0x02, 0x04, 0x47, 0x41, 0x50, 0x49, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x33,
 }
 
 var (
@@ -1821,76 +2242,85 @@ func file_google_api_client_proto_rawDescGZIP() []byte {
 	return file_google_api_client_proto_rawDescData
 }
 
-var file_google_api_client_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
-var file_google_api_client_proto_msgTypes = make([]protoimpl.MessageInfo, 19)
+var file_google_api_client_proto_enumTypes = make([]protoimpl.EnumInfo, 3)
+var file_google_api_client_proto_msgTypes = make([]protoimpl.MessageInfo, 22)
 var file_google_api_client_proto_goTypes = []interface{}{
 	(ClientLibraryOrganization)(0),              // 0: google.api.ClientLibraryOrganization
 	(ClientLibraryDestination)(0),               // 1: google.api.ClientLibraryDestination
-	(*CommonLanguageSettings)(nil),              // 2: google.api.CommonLanguageSettings
-	(*ClientLibrarySettings)(nil),               // 3: google.api.ClientLibrarySettings
-	(*Publishing)(nil),                          // 4: google.api.Publishing
-	(*JavaSettings)(nil),                        // 5: google.api.JavaSettings
-	(*CppSettings)(nil),                         // 6: google.api.CppSettings
-	(*PhpSettings)(nil),                         // 7: google.api.PhpSettings
-	(*PythonSettings)(nil),                      // 8: google.api.PythonSettings
-	(*NodeSettings)(nil),                        // 9: google.api.NodeSettings
-	(*DotnetSettings)(nil),                      // 10: google.api.DotnetSettings
-	(*RubySettings)(nil),                        // 11: google.api.RubySettings
-	(*GoSettings)(nil),                          // 12: google.api.GoSettings
-	(*MethodSettings)(nil),                      // 13: google.api.MethodSettings
-	(*SelectiveGapicGeneration)(nil),            // 14: google.api.SelectiveGapicGeneration
-	nil,                                         // 15: google.api.JavaSettings.ServiceClassNamesEntry
-	(*PythonSettings_ExperimentalFeatures)(nil), // 16: google.api.PythonSettings.ExperimentalFeatures
-	nil,                                 // 17: google.api.DotnetSettings.RenamedServicesEntry
-	nil,                                 // 18: google.api.DotnetSettings.RenamedResourcesEntry
-	nil,                                 // 19: google.api.GoSettings.RenamedServicesEntry
-	(*MethodSettings_LongRunning)(nil),  // 20: google.api.MethodSettings.LongRunning
-	(api.LaunchStage)(0),                // 21: google.api.LaunchStage
-	(*durationpb.Duration)(nil),         // 22: google.protobuf.Duration
-	(*descriptorpb.MethodOptions)(nil),  // 23: google.protobuf.MethodOptions
-	(*descriptorpb.ServiceOptions)(nil), // 24: google.protobuf.ServiceOptions
+	(FlowControlLimitExceededBehaviorProto)(0),  // 2: google.api.FlowControlLimitExceededBehaviorProto
+	(*CommonLanguageSettings)(nil),              // 3: google.api.CommonLanguageSettings
+	(*ClientLibrarySettings)(nil),               // 4: google.api.ClientLibrarySettings
+	(*Publishing)(nil),                          // 5: google.api.Publishing
+	(*JavaSettings)(nil),                        // 6: google.api.JavaSettings
+	(*CppSettings)(nil),                         // 7: google.api.CppSettings
+	(*PhpSettings)(nil),                         // 8: google.api.PhpSettings
+	(*PythonSettings)(nil),                      // 9: google.api.PythonSettings
+	(*NodeSettings)(nil),                        // 10: google.api.NodeSettings
+	(*DotnetSettings)(nil),                      // 11: google.api.DotnetSettings
+	(*RubySettings)(nil),                        // 12: google.api.RubySettings
+	(*GoSettings)(nil),                          // 13: google.api.GoSettings
+	(*MethodSettings)(nil),                      // 14: google.api.MethodSettings
+	(*SelectiveGapicGeneration)(nil),            // 15: google.api.SelectiveGapicGeneration
+	(*BatchingConfigProto)(nil),                 // 16: google.api.BatchingConfigProto
+	(*BatchingSettingsProto)(nil),               // 17: google.api.BatchingSettingsProto
+	(*BatchingDescriptorProto)(nil),             // 18: google.api.BatchingDescriptorProto
+	nil,                                         // 19: google.api.JavaSettings.ServiceClassNamesEntry
+	(*PythonSettings_ExperimentalFeatures)(nil), // 20: google.api.PythonSettings.ExperimentalFeatures
+	nil,                                 // 21: google.api.DotnetSettings.RenamedServicesEntry
+	nil,                                 // 22: google.api.DotnetSettings.RenamedResourcesEntry
+	nil,                                 // 23: google.api.GoSettings.RenamedServicesEntry
+	(*MethodSettings_LongRunning)(nil),  // 24: google.api.MethodSettings.LongRunning
+	(api.LaunchStage)(0),                // 25: google.api.LaunchStage
+	(*durationpb.Duration)(nil),         // 26: google.protobuf.Duration
+	(*descriptorpb.MethodOptions)(nil),  // 27: google.protobuf.MethodOptions
+	(*descriptorpb.ServiceOptions)(nil), // 28: google.protobuf.ServiceOptions
 }
 var file_google_api_client_proto_depIdxs = []int32{
 	1,  // 0: google.api.CommonLanguageSettings.destinations:type_name -> google.api.ClientLibraryDestination
-	14, // 1: google.api.CommonLanguageSettings.selective_gapic_generation:type_name -> google.api.SelectiveGapicGeneration
-	21, // 2: google.api.ClientLibrarySettings.launch_stage:type_name -> google.api.LaunchStage
-	5,  // 3: google.api.ClientLibrarySettings.java_settings:type_name -> google.api.JavaSettings
-	6,  // 4: google.api.ClientLibrarySettings.cpp_settings:type_name -> google.api.CppSettings
-	7,  // 5: google.api.ClientLibrarySettings.php_settings:type_name -> google.api.PhpSettings
-	8,  // 6: google.api.ClientLibrarySettings.python_settings:type_name -> google.api.PythonSettings
-	9,  // 7: google.api.ClientLibrarySettings.node_settings:type_name -> google.api.NodeSettings
-	10, // 8: google.api.ClientLibrarySettings.dotnet_settings:type_name -> google.api.DotnetSettings
-	11, // 9: google.api.ClientLibrarySettings.ruby_settings:type_name -> google.api.RubySettings
-	12, // 10: google.api.ClientLibrarySettings.go_settings:type_name -> google.api.GoSettings
-	13, // 11: google.api.Publishing.method_settings:type_name -> google.api.MethodSettings
+	15, // 1: google.api.CommonLanguageSettings.selective_gapic_generation:type_name -> google.api.SelectiveGapicGeneration
+	25, // 2: google.api.ClientLibrarySettings.launch_stage:type_name -> google.api.LaunchStage
+	6,  // 3: google.api.ClientLibrarySettings.java_settings:type_name -> google.api.JavaSettings
+	7,  // 4: google.api.ClientLibrarySettings.cpp_settings:type_name -> google.api.CppSettings
+	8,  // 5: google.api.ClientLibrarySettings.php_settings:type_name -> google.api.PhpSettings
+	9,  // 6: google.api.ClientLibrarySettings.python_settings:type_name -> google.api.PythonSettings
+	10, // 7: google.api.ClientLibrarySettings.node_settings:type_name -> google.api.NodeSettings
+	11, // 8: google.api.ClientLibrarySettings.dotnet_settings:type_name -> google.api.DotnetSettings
+	12, // 9: google.api.ClientLibrarySettings.ruby_settings:type_name -> google.api.RubySettings
+	13, // 10: google.api.ClientLibrarySettings.go_settings:type_name -> google.api.GoSettings
+	14, // 11: google.api.Publishing.method_settings:type_name -> google.api.MethodSettings
 	0,  // 12: google.api.Publishing.organization:type_name -> google.api.ClientLibraryOrganization
-	3,  // 13: google.api.Publishing.library_settings:type_name -> google.api.ClientLibrarySettings
-	15, // 14: google.api.JavaSettings.service_class_names:type_name -> google.api.JavaSettings.ServiceClassNamesEntry
-	2,  // 15: google.api.JavaSettings.common:type_name -> google.api.CommonLanguageSettings
-	2,  // 16: google.api.CppSettings.common:type_name -> google.api.CommonLanguageSettings
-	2,  // 17: google.api.PhpSettings.common:type_name -> google.api.CommonLanguageSettings
-	2,  // 18: google.api.PythonSettings.common:type_name -> google.api.CommonLanguageSettings
-	16, // 19: google.api.PythonSettings.experimental_features:type_name -> google.api.PythonSettings.ExperimentalFeatures
-	2,  // 20: google.api.NodeSettings.common:type_name -> google.api.CommonLanguageSettings
-	2,  // 21: google.api.DotnetSettings.common:type_name -> google.api.CommonLanguageSettings
-	17, // 22: google.api.DotnetSettings.renamed_services:type_name -> google.api.DotnetSettings.RenamedServicesEntry
-	18, // 23: google.api.DotnetSettings.renamed_resources:type_name -> google.api.DotnetSettings.RenamedResourcesEntry
-	2,  // 24: google.api.RubySettings.common:type_name -> google.api.CommonLanguageSettings
-	2,  // 25: google.api.GoSettings.common:type_name -> google.api.CommonLanguageSettings
-	19, // 26: google.api.GoSettings.renamed_services:type_name -> google.api.GoSettings.RenamedServicesEntry
-	20, // 27: google.api.MethodSettings.long_running:type_name -> google.api.MethodSettings.LongRunning
-	22, // 28: google.api.MethodSettings.LongRunning.initial_poll_delay:type_name -> google.protobuf.Duration
-	22, // 29: google.api.MethodSettings.LongRunning.max_poll_delay:type_name -> google.protobuf.Duration
-	22, // 30: google.api.MethodSettings.LongRunning.total_poll_timeout:type_name -> google.protobuf.Duration
-	23, // 31: google.api.method_signature:extendee -> google.protobuf.MethodOptions
-	24, // 32: google.api.default_host:extendee -> google.protobuf.ServiceOptions
-	24, // 33: google.api.oauth_scopes:extendee -> google.protobuf.ServiceOptions
-	24, // 34: google.api.api_version:extendee -> google.protobuf.ServiceOptions
-	35, // [35:35] is the sub-list for method output_type
-	35, // [35:35] is the sub-list for method input_type
-	35, // [35:35] is the sub-list for extension type_name
-	31, // [31:35] is the sub-list for extension extendee
-	0,  // [0:31] is the sub-list for field type_name
+	4,  // 13: google.api.Publishing.library_settings:type_name -> google.api.ClientLibrarySettings
+	19, // 14: google.api.JavaSettings.service_class_names:type_name -> google.api.JavaSettings.ServiceClassNamesEntry
+	3,  // 15: google.api.JavaSettings.common:type_name -> google.api.CommonLanguageSettings
+	3,  // 16: google.api.CppSettings.common:type_name -> google.api.CommonLanguageSettings
+	3,  // 17: google.api.PhpSettings.common:type_name -> google.api.CommonLanguageSettings
+	3,  // 18: google.api.PythonSettings.common:type_name -> google.api.CommonLanguageSettings
+	20, // 19: google.api.PythonSettings.experimental_features:type_name -> google.api.PythonSettings.ExperimentalFeatures
+	3,  // 20: google.api.NodeSettings.common:type_name -> google.api.CommonLanguageSettings
+	3,  // 21: google.api.DotnetSettings.common:type_name -> google.api.CommonLanguageSettings
+	21, // 22: google.api.DotnetSettings.renamed_services:type_name -> google.api.DotnetSettings.RenamedServicesEntry
+	22, // 23: google.api.DotnetSettings.renamed_resources:type_name -> google.api.DotnetSettings.RenamedResourcesEntry
+	3,  // 24: google.api.RubySettings.common:type_name -> google.api.CommonLanguageSettings
+	3,  // 25: google.api.GoSettings.common:type_name -> google.api.CommonLanguageSettings
+	23, // 26: google.api.GoSettings.renamed_services:type_name -> google.api.GoSettings.RenamedServicesEntry
+	24, // 27: google.api.MethodSettings.long_running:type_name -> google.api.MethodSettings.LongRunning
+	16, // 28: google.api.MethodSettings.batching:type_name -> google.api.BatchingConfigProto
+	17, // 29: google.api.BatchingConfigProto.thresholds:type_name -> google.api.BatchingSettingsProto
+	18, // 30: google.api.BatchingConfigProto.batch_descriptor:type_name -> google.api.BatchingDescriptorProto
+	26, // 31: google.api.BatchingSettingsProto.delay_threshold:type_name -> google.protobuf.Duration
+	2,  // 32: google.api.BatchingSettingsProto.flow_control_limit_exceeded_behavior:type_name -> google.api.FlowControlLimitExceededBehaviorProto
+	26, // 33: google.api.MethodSettings.LongRunning.initial_poll_delay:type_name -> google.protobuf.Duration
+	26, // 34: google.api.MethodSettings.LongRunning.max_poll_delay:type_name -> google.protobuf.Duration
+	26, // 35: google.api.MethodSettings.LongRunning.total_poll_timeout:type_name -> google.protobuf.Duration
+	27, // 36: google.api.method_signature:extendee -> google.protobuf.MethodOptions
+	28, // 37: google.api.default_host:extendee -> google.protobuf.ServiceOptions
+	28, // 38: google.api.oauth_scopes:extendee -> google.protobuf.ServiceOptions
+	28, // 39: google.api.api_version:extendee -> google.protobuf.ServiceOptions
+	40, // [40:40] is the sub-list for method output_type
+	40, // [40:40] is the sub-list for method input_type
+	40, // [40:40] is the sub-list for extension type_name
+	36, // [36:40] is the sub-list for extension extendee
+	0,  // [0:36] is the sub-list for field type_name
 }
 
 func init() { file_google_api_client_proto_init() }
@@ -2055,7 +2485,43 @@ func file_google_api_client_proto_init() {
 				return nil
 			}
 		}
+		file_google_api_client_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BatchingConfigProto); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
 		file_google_api_client_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BatchingSettingsProto); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_google_api_client_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BatchingDescriptorProto); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_google_api_client_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*PythonSettings_ExperimentalFeatures); i {
 			case 0:
 				return &v.state
@@ -2067,7 +2533,7 @@ func file_google_api_client_proto_init() {
 				return nil
 			}
 		}
-		file_google_api_client_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
+		file_google_api_client_proto_msgTypes[21].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*MethodSettings_LongRunning); i {
 			case 0:
 				return &v.state
@@ -2085,8 +2551,8 @@ func file_google_api_client_proto_init() {
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_google_api_client_proto_rawDesc,
-			NumEnums:      2,
-			NumMessages:   19,
+			NumEnums:      3,
+			NumMessages:   22,
 			NumExtensions: 4,
 			NumServices:   0,
 		},
diff --git a/vendor/google.golang.org/genproto/googleapis/api/annotations/field_behavior.pb.go b/vendor/google.golang.org/genproto/googleapis/api/annotations/field_behavior.pb.go
index 5d583b866..fc6d27b4a 100644
--- a/vendor/google.golang.org/genproto/googleapis/api/annotations/field_behavior.pb.go
+++ b/vendor/google.golang.org/genproto/googleapis/api/annotations/field_behavior.pb.go
@@ -1,4 +1,4 @@
-// Copyright 2025 Google LLC
+// Copyright 2026 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vendor/google.golang.org/genproto/googleapis/api/annotations/field_info.pb.go b/vendor/google.golang.org/genproto/googleapis/api/annotations/field_info.pb.go
index 53e9dd1e9..b660d02c1 100644
--- a/vendor/google.golang.org/genproto/googleapis/api/annotations/field_info.pb.go
+++ b/vendor/google.golang.org/genproto/googleapis/api/annotations/field_info.pb.go
@@ -1,4 +1,4 @@
-// Copyright 2025 Google LLC
+// Copyright 2026 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vendor/google.golang.org/genproto/googleapis/api/annotations/http.pb.go b/vendor/google.golang.org/genproto/googleapis/api/annotations/http.pb.go
index d30fcee4c..998205e18 100644
--- a/vendor/google.golang.org/genproto/googleapis/api/annotations/http.pb.go
+++ b/vendor/google.golang.org/genproto/googleapis/api/annotations/http.pb.go
@@ -1,4 +1,4 @@
-// Copyright 2025 Google LLC
+// Copyright 2026 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vendor/google.golang.org/genproto/googleapis/api/annotations/resource.pb.go b/vendor/google.golang.org/genproto/googleapis/api/annotations/resource.pb.go
index 175974a86..ad2a3fbf8 100644
--- a/vendor/google.golang.org/genproto/googleapis/api/annotations/resource.pb.go
+++ b/vendor/google.golang.org/genproto/googleapis/api/annotations/resource.pb.go
@@ -1,4 +1,4 @@
-// Copyright 2025 Google LLC
+// Copyright 2026 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vendor/google.golang.org/genproto/googleapis/api/annotations/routing.pb.go b/vendor/google.golang.org/genproto/googleapis/api/annotations/routing.pb.go
index b8c4aa71f..9a83b9636 100644
--- a/vendor/google.golang.org/genproto/googleapis/api/annotations/routing.pb.go
+++ b/vendor/google.golang.org/genproto/googleapis/api/annotations/routing.pb.go
@@ -1,4 +1,4 @@
-// Copyright 2025 Google LLC
+// Copyright 2026 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -66,9 +66,13 @@ const (
 //	  app_profile_id: profiles/prof_qux
 //	}
 //
-// The routing header consists of one or multiple key-value pairs. Every key
-// and value must be percent-encoded, and joined together in the format of
-// `key1=value1&key2=value2`.
+// The routing header consists of one or multiple key-value pairs. The order of
+// the key-value pairs is undefined, the order of the `routing_parameters` in
+// the `RoutingRule` only matters for the evaluation order of the path
+// templates when `field` is the same. See the examples below for more details.
+//
+// Every key and value in the routing header must be percent-encoded,
+// and joined together in the following format: `key1=value1&key2=value2`.
 // The examples below skip the percent-encoding for readability.
 //
 // # Example 1
diff --git a/vendor/google.golang.org/genproto/googleapis/api/httpbody/httpbody.pb.go b/vendor/google.golang.org/genproto/googleapis/api/httpbody/httpbody.pb.go
index d083dde3e..902ae4498 100644
--- a/vendor/google.golang.org/genproto/googleapis/api/httpbody/httpbody.pb.go
+++ b/vendor/google.golang.org/genproto/googleapis/api/httpbody/httpbody.pb.go
@@ -1,4 +1,4 @@
-// Copyright 2025 Google LLC
+// Copyright 2026 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vendor/google.golang.org/genproto/googleapis/api/launch_stage.pb.go b/vendor/google.golang.org/genproto/googleapis/api/launch_stage.pb.go
index a69c1d473..2cbb7b43b 100644
--- a/vendor/google.golang.org/genproto/googleapis/api/launch_stage.pb.go
+++ b/vendor/google.golang.org/genproto/googleapis/api/launch_stage.pb.go
@@ -1,4 +1,4 @@
-// Copyright 2025 Google LLC
+// Copyright 2026 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vendor/google.golang.org/genproto/googleapis/rpc/status/status.pb.go b/vendor/google.golang.org/genproto/googleapis/rpc/status/status.pb.go
index 06a3f7106..f25a7bcc7 100644
--- a/vendor/google.golang.org/genproto/googleapis/rpc/status/status.pb.go
+++ b/vendor/google.golang.org/genproto/googleapis/rpc/status/status.pb.go
@@ -1,4 +1,4 @@
-// Copyright 2025 Google LLC
+// Copyright 2026 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -127,14 +127,13 @@ var file_google_rpc_status_proto_rawDesc = []byte{
 	0x07, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x12, 0x2e, 0x0a, 0x07, 0x64, 0x65, 0x74, 0x61,
 	0x69, 0x6c, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
 	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x52,
-	0x07, 0x64, 0x65, 0x74, 0x61, 0x69, 0x6c, 0x73, 0x42, 0x61, 0x0a, 0x0e, 0x63, 0x6f, 0x6d, 0x2e,
+	0x07, 0x64, 0x65, 0x74, 0x61, 0x69, 0x6c, 0x73, 0x42, 0x5e, 0x0a, 0x0e, 0x63, 0x6f, 0x6d, 0x2e,
 	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x72, 0x70, 0x63, 0x42, 0x0b, 0x53, 0x74, 0x61, 0x74,
 	0x75, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x37, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
 	0x65, 0x2e, 0x67, 0x6f, 0x6c, 0x61, 0x6e, 0x67, 0x2e, 0x6f, 0x72, 0x67, 0x2f, 0x67, 0x65, 0x6e,
 	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x61, 0x70, 0x69, 0x73,
 	0x2f, 0x72, 0x70, 0x63, 0x2f, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x3b, 0x73, 0x74, 0x61, 0x74,
-	0x75, 0x73, 0xf8, 0x01, 0x01, 0xa2, 0x02, 0x03, 0x52, 0x50, 0x43, 0x62, 0x06, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x33,
+	0x75, 0x73, 0xa2, 0x02, 0x03, 0x52, 0x50, 0x43, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
diff --git a/vendor/k8s.io/klog/v2/README.md b/vendor/k8s.io/klog/v2/README.md
index d45cbe172..a680beb40 100644
--- a/vendor/k8s.io/klog/v2/README.md
+++ b/vendor/k8s.io/klog/v2/README.md
@@ -48,8 +48,6 @@ How to use klog
 - For more logging conventions (See [Logging Conventions](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-instrumentation/logging.md))
 - See our documentation on [pkg.go.dev/k8s.io](https://pkg.go.dev/k8s.io/klog).
 
-**NOTE**: please use the newer go versions that support semantic import versioning in modules, ideally go 1.11.4 or greater.
-
 ### Coexisting with klog/v2
 
 See [this example](examples/coexist_klog_v1_and_v2/) to see how to coexist with both klog/v1 and klog/v2.
diff --git a/vendor/k8s.io/klog/v2/internal/serialize/keyvalues.go b/vendor/k8s.io/klog/v2/internal/serialize/keyvalues.go
index d1a4751c9..73f91ea50 100644
--- a/vendor/k8s.io/klog/v2/internal/serialize/keyvalues.go
+++ b/vendor/k8s.io/klog/v2/internal/serialize/keyvalues.go
@@ -20,7 +20,9 @@ import (
 	"bytes"
 	"encoding/json"
 	"fmt"
+	"slices"
 	"strconv"
+	"strings"
 
 	"github.com/go-logr/logr"
 )
@@ -51,139 +53,157 @@ func WithValues(oldKV, newKV []interface{}) []interface{} {
 	return kv
 }
 
-// MergeKVs deduplicates elements provided in two key/value slices.
-//
-// Keys in each slice are expected to be unique, so duplicates can only occur
-// when the first and second slice contain the same key. When that happens, the
-// key/value pair from the second slice is used. The first slice must be well-formed
-// (= even key/value pairs). The second one may have a missing value, in which
-// case the special "missing value" is added to the result.
-func MergeKVs(first, second []interface{}) []interface{} {
-	maxLength := len(first) + (len(second)+1)/2*2
-	if maxLength == 0 {
-		// Nothing to do at all.
-		return nil
-	}
-
-	if len(first) == 0 && len(second)%2 == 0 {
-		// Nothing to be overridden, second slice is well-formed
-		// and can be used directly.
-		return second
-	}
-
-	// Determine which keys are in the second slice so that we can skip
-	// them when iterating over the first one. The code intentionally
-	// favors performance over completeness: we assume that keys are string
-	// constants and thus compare equal when the string values are equal. A
-	// string constant being overridden by, for example, a fmt.Stringer is
-	// not handled.
-	overrides := map[interface{}]bool{}
-	for i := 0; i < len(second); i += 2 {
-		overrides[second[i]] = true
-	}
-	merged := make([]interface{}, 0, maxLength)
-	for i := 0; i+1 < len(first); i += 2 {
-		key := first[i]
-		if overrides[key] {
-			continue
-		}
-		merged = append(merged, key, first[i+1])
-	}
-	merged = append(merged, second...)
-	if len(merged)%2 != 0 {
-		merged = append(merged, missingValue)
-	}
-	return merged
-}
-
 type Formatter struct {
 	AnyToStringHook AnyToStringFunc
 }
 
 type AnyToStringFunc func(v interface{}) string
 
-// MergeKVsInto is a variant of MergeKVs which directly formats the key/value
-// pairs into a buffer.
-func (f Formatter) MergeAndFormatKVs(b *bytes.Buffer, first, second []interface{}) {
-	if len(first) == 0 && len(second) == 0 {
-		// Nothing to do at all.
-		return
-	}
+const missingValue = "(MISSING)"
 
-	if len(first) == 0 && len(second)%2 == 0 {
-		// Nothing to be overridden, second slice is well-formed
-		// and can be used directly.
-		for i := 0; i < len(second); i += 2 {
-			f.KVFormat(b, second[i], second[i+1])
-		}
-		return
-	}
+func FormatKVs(b *bytes.Buffer, kvs ...[]interface{}) {
+	Formatter{}.FormatKVs(b, kvs...)
+}
 
-	// Determine which keys are in the second slice so that we can skip
-	// them when iterating over the first one. The code intentionally
-	// favors performance over completeness: we assume that keys are string
-	// constants and thus compare equal when the string values are equal. A
-	// string constant being overridden by, for example, a fmt.Stringer is
-	// not handled.
-	overrides := map[interface{}]bool{}
-	for i := 0; i < len(second); i += 2 {
-		overrides[second[i]] = true
-	}
-	for i := 0; i < len(first); i += 2 {
-		key := first[i]
-		if overrides[key] {
-			continue
+// FormatKVs formats all key/value pairs such that the output contains no
+// duplicates ("last one wins").
+func (f Formatter) FormatKVs(b *bytes.Buffer, kvs ...[]interface{}) {
+	// De-duplication is done by optimistically formatting all key value
+	// pairs and then cutting out the output of those key/value pairs which
+	// got overwritten later.
+	//
+	// In the common case of no duplicates, the only overhead is tracking
+	// previous keys. This uses a slice with a simple linear search because
+	// the number of entries is typically so low that allocating a map or
+	// keeping a sorted slice with binary search aren't justified.
+	//
+	// Using a fixed size here makes the Go compiler use the stack as
+	// initial backing store for the slice, which is crucial for
+	// performance.
+	existing := make([]obsoleteKV, 0, 32)
+	obsolete := make([]interval, 0, 32) // Sorted by start index.
+	for _, keysAndValues := range kvs {
+		for i := 0; i < len(keysAndValues); i += 2 {
+			var v interface{}
+			k := keysAndValues[i]
+			if i+1 < len(keysAndValues) {
+				v = keysAndValues[i+1]
+			} else {
+				v = missingValue
+			}
+			var e obsoleteKV
+			e.start = b.Len()
+			e.key = f.KVFormat(b, k, v)
+			e.end = b.Len()
+			i := findObsoleteEntry(existing, e.key)
+			if i >= 0 {
+				data := b.Bytes()
+				if bytes.Compare(data[existing[i].start:existing[i].end], data[e.start:e.end]) == 0 {
+					// The new entry gets obsoleted because it's identical.
+					// This has the advantage that key/value pairs from
+					// a WithValues call always come first, even if the same
+					// pair gets added again later. This makes different log
+					// entries more consistent.
+					//
+					// The new entry has a higher start index and thus can be appended.
+					obsolete = append(obsolete, e.interval)
+				} else {
+					// The old entry gets obsoleted because it's value is different.
+					//
+					// Sort order is not guaranteed, we have to insert at the right place.
+					index, _ := slices.BinarySearchFunc(obsolete, existing[i].interval, func(a, b interval) int { return a.start - b.start })
+					obsolete = slices.Insert(obsolete, index, existing[i].interval)
+					existing[i].interval = e.interval
+				}
+			} else {
+				// Instead of appending at the end and doing a
+				// linear search in findEntry, we could keep
+				// the slice sorted by key and do a binary search.
+				//
+				// Above:
+				//    i, ok := slices.BinarySearchFunc(existing, e, func(a, b entry) int { return strings.Compare(a.key, b.key) })
+				// Here:
+				//    existing = slices.Insert(existing, i, e)
+				//
+				// But that adds a dependency on the slices package
+				// and made performance slightly worse, presumably
+				// because the cost of shifting entries around
+				// did not pay of with faster lookups.
+				existing = append(existing, e)
+			}
 		}
-		f.KVFormat(b, key, first[i+1])
 	}
-	// Round down.
-	l := len(second)
-	l = l / 2 * 2
-	for i := 1; i < l; i += 2 {
-		f.KVFormat(b, second[i-1], second[i])
-	}
-	if len(second)%2 == 1 {
-		f.KVFormat(b, second[len(second)-1], missingValue)
-	}
-}
 
-func MergeAndFormatKVs(b *bytes.Buffer, first, second []interface{}) {
-	Formatter{}.MergeAndFormatKVs(b, first, second)
-}
+	// If we need to remove some obsolete key/value pairs then move the memory.
+	if len(obsolete) > 0 {
+		// Potentially the next remaining output (might itself be obsolete).
+		from := obsolete[0].end
+		// Next obsolete entry.
+		nextObsolete := 1
+		// This is the source buffer, before truncation.
+		all := b.Bytes()
+		b.Truncate(obsolete[0].start)
 
-const missingValue = "(MISSING)"
+		for nextObsolete < len(obsolete) {
+			if from == obsolete[nextObsolete].start {
+				// Skip also the next obsolete key/value.
+				from = obsolete[nextObsolete].end
+				nextObsolete++
+				continue
+			}
 
-// KVListFormat serializes all key/value pairs into the provided buffer.
-// A space gets inserted before the first pair and between each pair.
-func (f Formatter) KVListFormat(b *bytes.Buffer, keysAndValues ...interface{}) {
-	for i := 0; i < len(keysAndValues); i += 2 {
-		var v interface{}
-		k := keysAndValues[i]
-		if i+1 < len(keysAndValues) {
-			v = keysAndValues[i+1]
-		} else {
-			v = missingValue
+			// Preserve some output. Write uses copy, which
+			// explicitly allows source and destination to overlap.
+			// That could happen here.
+			valid := all[from:obsolete[nextObsolete].start]
+			b.Write(valid)
+			from = obsolete[nextObsolete].end
+			nextObsolete++
 		}
-		f.KVFormat(b, k, v)
+		// Copy end of buffer.
+		valid := all[from:]
+		b.Write(valid)
 	}
 }
 
-func KVListFormat(b *bytes.Buffer, keysAndValues ...interface{}) {
-	Formatter{}.KVListFormat(b, keysAndValues...)
+type obsoleteKV struct {
+	key string
+	interval
+}
+
+// interval includes the start and excludes the end.
+type interval struct {
+	start int
+	end   int
 }
 
-func KVFormat(b *bytes.Buffer, k, v interface{}) {
-	Formatter{}.KVFormat(b, k, v)
+func findObsoleteEntry(entries []obsoleteKV, key string) int {
+	for i, entry := range entries {
+		if entry.key == key {
+			return i
+		}
+	}
+	return -1
 }
 
 // formatAny is the fallback formatter for a value. It supports a hook (for
 // example, for YAML encoding) and itself uses JSON encoding.
 func (f Formatter) formatAny(b *bytes.Buffer, v interface{}) {
-	b.WriteRune('=')
 	if f.AnyToStringHook != nil {
-		b.WriteString(f.AnyToStringHook(v))
+		str := f.AnyToStringHook(v)
+		if strings.Contains(str, "\n") {
+			// If it's multi-line, then pass it through writeStringValue to get start/end delimiters,
+			// which separates it better from any following key/value pair.
+			writeStringValue(b, str)
+			return
+		}
+		// Otherwise put it directly after the separator, on the same lime,
+		// The assumption is that the hook returns something where start/end are obvious.
+		b.WriteRune('=')
+		b.WriteString(str)
 		return
 	}
+	b.WriteRune('=')
 	formatAsJSON(b, v)
 }
 
diff --git a/vendor/k8s.io/klog/v2/internal/serialize/keyvalues_no_slog.go b/vendor/k8s.io/klog/v2/internal/serialize/keyvalues_no_slog.go
index d9c7d1546..b8c7e443d 100644
--- a/vendor/k8s.io/klog/v2/internal/serialize/keyvalues_no_slog.go
+++ b/vendor/k8s.io/klog/v2/internal/serialize/keyvalues_no_slog.go
@@ -28,7 +28,7 @@ import (
 
 // KVFormat serializes one key/value pair into the provided buffer.
 // A space gets inserted before the pair.
-func (f Formatter) KVFormat(b *bytes.Buffer, k, v interface{}) {
+func (f Formatter) KVFormat(b *bytes.Buffer, k, v interface{}) string {
 	// This is the version without slog support. Must be kept in sync with
 	// the version in keyvalues_slog.go.
 
@@ -37,13 +37,15 @@ func (f Formatter) KVFormat(b *bytes.Buffer, k, v interface{}) {
 	// https://github.com/kubernetes/community/blob/master/contributors/devel/sig-instrumentation/migration-to-structured-logging.md#name-arguments
 	// for the sake of performance. Keys with spaces,
 	// special characters, etc. will break parsing.
+	var key string
 	if sK, ok := k.(string); ok {
 		// Avoid one allocation when the key is a string, which
 		// normally it should be.
-		b.WriteString(sK)
+		key = sK
 	} else {
-		b.WriteString(fmt.Sprintf("%s", k))
+		key = fmt.Sprintf("%s", k)
 	}
+	b.WriteString(key)
 
 	// The type checks are sorted so that more frequently used ones
 	// come first because that is then faster in the common
@@ -94,4 +96,6 @@ func (f Formatter) KVFormat(b *bytes.Buffer, k, v interface{}) {
 	default:
 		f.formatAny(b, v)
 	}
+
+	return key
 }
diff --git a/vendor/k8s.io/klog/v2/internal/serialize/keyvalues_slog.go b/vendor/k8s.io/klog/v2/internal/serialize/keyvalues_slog.go
index 89acf9772..8e0084364 100644
--- a/vendor/k8s.io/klog/v2/internal/serialize/keyvalues_slog.go
+++ b/vendor/k8s.io/klog/v2/internal/serialize/keyvalues_slog.go
@@ -29,8 +29,8 @@ import (
 )
 
 // KVFormat serializes one key/value pair into the provided buffer.
-// A space gets inserted before the pair.
-func (f Formatter) KVFormat(b *bytes.Buffer, k, v interface{}) {
+// A space gets inserted before the pair. It returns the key.
+func (f Formatter) KVFormat(b *bytes.Buffer, k, v interface{}) string {
 	// This is the version without slog support. Must be kept in sync with
 	// the version in keyvalues_slog.go.
 
@@ -39,13 +39,15 @@ func (f Formatter) KVFormat(b *bytes.Buffer, k, v interface{}) {
 	// https://github.com/kubernetes/community/blob/master/contributors/devel/sig-instrumentation/migration-to-structured-logging.md#name-arguments
 	// for the sake of performance. Keys with spaces,
 	// special characters, etc. will break parsing.
+	var key string
 	if sK, ok := k.(string); ok {
 		// Avoid one allocation when the key is a string, which
 		// normally it should be.
-		b.WriteString(sK)
+		key = sK
 	} else {
-		b.WriteString(fmt.Sprintf("%s", k))
+		key = fmt.Sprintf("%s", k)
 	}
+	b.WriteString(key)
 
 	// The type checks are sorted so that more frequently used ones
 	// come first because that is then faster in the common
@@ -112,6 +114,8 @@ func (f Formatter) KVFormat(b *bytes.Buffer, k, v interface{}) {
 	default:
 		f.formatAny(b, v)
 	}
+
+	return key
 }
 
 // generateJSON has the same preference for plain strings as KVFormat.
diff --git a/vendor/k8s.io/klog/v2/klog.go b/vendor/k8s.io/klog/v2/klog.go
index 47ec9466a..319ffbe24 100644
--- a/vendor/k8s.io/klog/v2/klog.go
+++ b/vendor/k8s.io/klog/v2/klog.go
@@ -58,15 +58,30 @@
 //
 //		-logtostderr=true
 //			Logs are written to standard error instead of to files.
-//	             This shortcuts most of the usual output routing:
-//	             -alsologtostderr, -stderrthreshold and -log_dir have no
-//	             effect and output redirection at runtime with SetOutput is
-//	             ignored.
+//	             By default, all logs are written regardless of severity
+//	             (legacy behavior). To filter logs by severity when
+//	             -logtostderr=true, set -legacy_stderr_threshold_behavior=false
+//	             and use -stderrthreshold.
+//              With -legacy_stderr_threshold_behavior=true,
+//              -stderrthreshold has no effect.
+//
+//	             The following flags always have no effect:
+//	             -alsologtostderr, -alsologtostderrthreshold, and -log_dir.
+//	             Output redirection at runtime with SetOutput is also ignored.
 //		-alsologtostderr=false
 //			Logs are written to standard error as well as to files.
+//		-alsologtostderrthreshold=INFO
+//			Log events at or above this severity are logged to standard
+//			error when -alsologtostderr=true (no effect when -logtostderr=true).
+//			Default is INFO to maintain backward compatibility.
 //		-stderrthreshold=ERROR
 //			Log events at or above this severity are logged to standard
-//			error as well as to files.
+//			error as well as to files. When -logtostderr=true, this flag
+//			has no effect unless -legacy_stderr_threshold_behavior=false.
+//		-legacy_stderr_threshold_behavior=true
+//			If true, -stderrthreshold is ignored when -logtostderr=true
+//			(legacy behavior). If false, -stderrthreshold is honored even
+//			when -logtostderr=true, allowing severity-based filtering.
 //		-log_dir=""
 //			Log files will be written to this directory instead of the
 //			default temporary directory.
@@ -156,7 +171,7 @@ func (s *severityValue) Set(value string) error {
 		}
 		threshold = severity.Severity(v)
 	}
-	logging.stderrThreshold.set(threshold)
+	s.set(threshold)
 	return nil
 }
 
@@ -409,6 +424,15 @@ var commandLine flag.FlagSet
 
 // init sets up the defaults and creates command line flags.
 func init() {
+	// Initialize severity thresholds
+	logging.stderrThreshold = severityValue{
+		Severity: severity.ErrorLog, // Default stderrThreshold is ERROR.
+	}
+	logging.alsologtostderrthreshold = severityValue{
+		Severity: severity.InfoLog, // Default alsologtostderrthreshold is INFO (to maintain backward compatibility).
+	}
+	logging.setVState(0, nil, false)
+
 	commandLine.StringVar(&logging.logDir, "log_dir", "", "If non-empty, write log files in this directory (no effect when -logtostderr=true)")
 	commandLine.StringVar(&logging.logFile, "log_file", "", "If non-empty, use this log file (no effect when -logtostderr=true)")
 	commandLine.Uint64Var(&logging.logFileMaxSizeMB, "log_file_max_size", 1800,
@@ -416,16 +440,14 @@ func init() {
 			"If the value is 0, the maximum file size is unlimited.")
 	commandLine.BoolVar(&logging.toStderr, "logtostderr", true, "log to standard error instead of files")
 	commandLine.BoolVar(&logging.alsoToStderr, "alsologtostderr", false, "log to standard error as well as files (no effect when -logtostderr=true)")
-	logging.setVState(0, nil, false)
+	commandLine.BoolVar(&logging.legacyStderrThresholdBehavior, "legacy_stderr_threshold_behavior", true, "If true, stderrthreshold is ignored when logtostderr=true (legacy behavior). If false, stderrthreshold is honored even when logtostderr=true")
 	commandLine.Var(&logging.verbosity, "v", "number for the log level verbosity")
 	commandLine.BoolVar(&logging.addDirHeader, "add_dir_header", false, "If true, adds the file directory to the header of the log messages")
 	commandLine.BoolVar(&logging.skipHeaders, "skip_headers", false, "If true, avoid header prefixes in the log messages")
 	commandLine.BoolVar(&logging.oneOutput, "one_output", false, "If true, only write logs to their native severity level (vs also writing to each lower severity level; no effect when -logtostderr=true)")
 	commandLine.BoolVar(&logging.skipLogHeaders, "skip_log_headers", false, "If true, avoid headers when opening log files (no effect when -logtostderr=true)")
-	logging.stderrThreshold = severityValue{
-		Severity: severity.ErrorLog, // Default stderrThreshold is ERROR.
-	}
-	commandLine.Var(&logging.stderrThreshold, "stderrthreshold", "logs at or above this threshold go to stderr when writing to files and stderr (no effect when -logtostderr=true or -alsologtostderr=true)")
+	commandLine.Var(&logging.stderrThreshold, "stderrthreshold", "logs at or above this threshold go to stderr when writing to files and stderr (no effect when -logtostderr=true or -alsologtostderr=true unless -legacy_stderr_threshold_behavior=false)")
+	commandLine.Var(&logging.alsologtostderrthreshold, "alsologtostderrthreshold", "logs at or above this threshold go to stderr when -alsologtostderr=true (no effect when -logtostderr=true)")
 	commandLine.Var(&logging.vmodule, "vmodule", "comma-separated list of pattern=N settings for file-filtered logging")
 	commandLine.Var(&logging.traceLocation, "log_backtrace_at", "when logging hits line file:N, emit a stack trace")
 
@@ -470,11 +492,13 @@ type settings struct {
 	// Boolean flags. Not handled atomically because the flag.Value interface
 	// does not let us avoid the =true, and that shorthand is necessary for
 	// compatibility. TODO: does this matter enough to fix? Seems unlikely.
-	toStderr     bool // The -logtostderr flag.
-	alsoToStderr bool // The -alsologtostderr flag.
+	toStderr                      bool // The -logtostderr flag.
+	alsoToStderr                  bool // The -alsologtostderr flag.
+	legacyStderrThresholdBehavior bool // The -legacy_stderr_threshold_behavior flag.
 
 	// Level flag. Handled atomically.
-	stderrThreshold severityValue // The -stderrthreshold flag.
+	stderrThreshold          severityValue // The -stderrthreshold flag.
+	alsologtostderrthreshold severityValue // The -alsologtostderrthreshold flag.
 
 	// Access to all of the following fields must be protected via a mutex.
 
@@ -809,16 +833,21 @@ func (l *loggingT) infoS(logger *logWriter, filter LogFilter, depth int, msg str
 // printS is called from infoS and errorS if logger is not specified.
 // set log severity by s
 func (l *loggingT) printS(err error, s severity.Severity, depth int, msg string, keysAndValues ...interface{}) {
-	// Only create a new buffer if we don't have one cached.
-	b := buffer.GetBuffer()
 	// The message is always quoted, even if it contains line breaks.
 	// If developers want multi-line output, they should use a small, fixed
 	// message and put the multi-line output into a value.
-	b.WriteString(strconv.Quote(msg))
+	qMsg := make([]byte, 0, 1024)
+	qMsg = strconv.AppendQuote(qMsg, msg)
+
+	// Only create a new buffer if we don't have one cached.
+	b := buffer.GetBuffer()
+	b.Write(qMsg)
+
+	var errKV []interface{}
 	if err != nil {
-		serialize.KVListFormat(&b.Buffer, "err", err)
+		errKV = []interface{}{"err", err}
 	}
-	serialize.KVListFormat(&b.Buffer, keysAndValues...)
+	serialize.FormatKVs(&b.Buffer, errKV, keysAndValues)
 	l.printDepth(s, nil, nil, depth+1, &b.Buffer)
 	// Make the buffer available for reuse.
 	buffer.PutBuffer(b)
@@ -885,9 +914,25 @@ func (l *loggingT) output(s severity.Severity, logger *logWriter, buf *buffer.Bu
 			}
 		}
 	} else if l.toStderr {
-		os.Stderr.Write(data)
+		// When logging to stderr only, check if we should filter by severity.
+		// This is controlled by the legacy_stderr_threshold_behavior flag.
+		if l.legacyStderrThresholdBehavior {
+			// Legacy behavior: always write to stderr, ignore stderrthreshold
+			os.Stderr.Write(data)
+		} else {
+			// New behavior: honor stderrthreshold even when logtostderr=true
+			if s >= l.stderrThreshold.get() {
+				os.Stderr.Write(data)
+			}
+		}
 	} else {
-		if alsoToStderr || l.alsoToStderr || s >= l.stderrThreshold.get() {
+		// Write to stderr if any of these conditions are met:
+		// - alsoToStderr is set (legacy behavior)
+		// - alsologtostderr is set and severity meets alsologtostderrthreshold
+		// - alsologtostderr is not set and severity meets stderrThreshold
+		if alsoToStderr ||
+			(l.alsoToStderr && s >= l.alsologtostderrthreshold.get()) ||
+			(!l.alsoToStderr && s >= l.stderrThreshold.get()) {
 			os.Stderr.Write(data)
 		}
 
diff --git a/vendor/k8s.io/klog/v2/klogr.go b/vendor/k8s.io/klog/v2/klogr.go
index efec96fd4..6204c7bb4 100644
--- a/vendor/k8s.io/klog/v2/klogr.go
+++ b/vendor/k8s.io/klog/v2/klogr.go
@@ -53,7 +53,7 @@ func (l *klogger) Init(info logr.RuntimeInfo) {
 }
 
 func (l *klogger) Info(level int, msg string, kvList ...interface{}) {
-	merged := serialize.MergeKVs(l.values, kvList)
+	merged := serialize.WithValues(l.values, kvList)
 	// Skip this function.
 	VDepth(l.callDepth+1, Level(level)).InfoSDepth(l.callDepth+1, msg, merged...)
 }
@@ -63,7 +63,7 @@ func (l *klogger) Enabled(level int) bool {
 }
 
 func (l *klogger) Error(err error, msg string, kvList ...interface{}) {
-	merged := serialize.MergeKVs(l.values, kvList)
+	merged := serialize.WithValues(l.values, kvList)
 	ErrorSDepth(l.callDepth+1, err, msg, merged...)
 }
 
diff --git a/vendor/k8s.io/klog/v2/klogr_slog.go b/vendor/k8s.io/klog/v2/klogr_slog.go
index c77d7baaf..901e28dd3 100644
--- a/vendor/k8s.io/klog/v2/klogr_slog.go
+++ b/vendor/k8s.io/klog/v2/klogr_slog.go
@@ -63,12 +63,17 @@ func slogOutput(file string, line int, now time.Time, err error, s severity.Seve
 	}
 
 	// See printS.
+	qMsg := make([]byte, 0, 1024)
+	qMsg = strconv.AppendQuote(qMsg, msg)
+
 	b := buffer.GetBuffer()
-	b.WriteString(strconv.Quote(msg))
+	b.Write(qMsg)
+
+	var errKV []interface{}
 	if err != nil {
-		serialize.KVListFormat(&b.Buffer, "err", err)
+		errKV = []interface{}{"err", err}
 	}
-	serialize.KVListFormat(&b.Buffer, kvList...)
+	serialize.FormatKVs(&b.Buffer, errKV, kvList)
 
 	// See print + header.
 	buf := logging.formatHeader(s, file, line, now)
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 0c3a77d7a..8f7ff833b 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -448,8 +448,8 @@ github.com/google/go-querystring/query
 # github.com/google/uuid v1.6.0
 ## explicit
 github.com/google/uuid
-# github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7
-## explicit; go 1.24.0
+# github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0
+## explicit; go 1.25.0
 github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule
 github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options
 github.com/grpc-ecosystem/grpc-gateway/v2/runtime
@@ -508,7 +508,7 @@ github.com/knqyf263/go-rpmdb/pkg/bdb
 github.com/knqyf263/go-rpmdb/pkg/db
 github.com/knqyf263/go-rpmdb/pkg/ndb
 github.com/knqyf263/go-rpmdb/pkg/sqlite3
-# github.com/letsencrypt/boulder v0.20260223.0
+# github.com/letsencrypt/boulder v0.20260309.0
 ## explicit; go 1.25.0
 github.com/letsencrypt/boulder/core
 github.com/letsencrypt/boulder/core/proto
@@ -661,8 +661,8 @@ github.com/rivo/uniseg
 ## explicit
 github.com/sassoftware/relic/lib/pkcs7
 github.com/sassoftware/relic/lib/x509tools
-# github.com/secure-systems-lab/go-securesystemslib v0.10.0
-## explicit; go 1.24.0
+# github.com/secure-systems-lab/go-securesystemslib v0.11.0
+## explicit; go 1.25.0
 github.com/secure-systems-lab/go-securesystemslib/cjson
 github.com/secure-systems-lab/go-securesystemslib/dsse
 github.com/secure-systems-lab/go-securesystemslib/encrypted
@@ -698,8 +698,8 @@ github.com/sigstore/cosign/v3/pkg/oci/signed
 github.com/sigstore/cosign/v3/pkg/oci/static
 github.com/sigstore/cosign/v3/pkg/signature
 github.com/sigstore/cosign/v3/pkg/types
-# github.com/sigstore/protobuf-specs v0.5.0
-## explicit; go 1.22.0
+# github.com/sigstore/protobuf-specs v0.5.1
+## explicit; go 1.23
 github.com/sigstore/protobuf-specs/gen/pb-go/bundle/v1
 github.com/sigstore/protobuf-specs/gen/pb-go/common/v1
 github.com/sigstore/protobuf-specs/gen/pb-go/dsse
@@ -738,8 +738,8 @@ github.com/sigstore/rekor/pkg/types/rekord
 github.com/sigstore/rekor/pkg/types/rekord/v0.0.1
 github.com/sigstore/rekor/pkg/util
 github.com/sigstore/rekor/pkg/verify
-# github.com/sigstore/rekor-tiles/v2 v2.2.1
-## explicit; go 1.25.5
+# github.com/sigstore/rekor-tiles/v2 v2.3.0
+## explicit; go 1.25.8
 github.com/sigstore/rekor-tiles/v2/internal/safeint
 github.com/sigstore/rekor-tiles/v2/pkg/client
 github.com/sigstore/rekor-tiles/v2/pkg/client/write
@@ -747,7 +747,7 @@ github.com/sigstore/rekor-tiles/v2/pkg/generated/protobuf
 github.com/sigstore/rekor-tiles/v2/pkg/note
 github.com/sigstore/rekor-tiles/v2/pkg/types/verifier
 github.com/sigstore/rekor-tiles/v2/pkg/verify
-# github.com/sigstore/sigstore v1.10.6
+# github.com/sigstore/sigstore v1.10.8
 ## explicit; go 1.25.0
 github.com/sigstore/sigstore/pkg/cryptoutils
 github.com/sigstore/sigstore/pkg/cryptoutils/goodkey
@@ -835,8 +835,8 @@ github.com/theupdateframework/go-tuf/pkg/targets
 github.com/theupdateframework/go-tuf/sign
 github.com/theupdateframework/go-tuf/util
 github.com/theupdateframework/go-tuf/verify
-# github.com/theupdateframework/go-tuf/v2 v2.4.1
-## explicit; go 1.25.5
+# github.com/theupdateframework/go-tuf/v2 v2.4.2-0.20260407074541-7e8f69f906ef
+## explicit; go 1.25.0
 github.com/theupdateframework/go-tuf/v2/metadata
 github.com/theupdateframework/go-tuf/v2/metadata/config
 github.com/theupdateframework/go-tuf/v2/metadata/fetcher
@@ -845,7 +845,7 @@ github.com/theupdateframework/go-tuf/v2/metadata/updater
 # github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399
 ## explicit
 github.com/titanous/rocacheck
-# github.com/transparency-dev/formats v0.0.0-20251017110053-404c0d5b696c
+# github.com/transparency-dev/formats v0.1.0
 ## explicit; go 1.24.0
 github.com/transparency-dev/formats/log
 # github.com/transparency-dev/merkle v0.0.2
@@ -864,6 +864,9 @@ github.com/vishvananda/netns
 # github.com/x448/float16 v0.8.4
 ## explicit; go 1.11
 github.com/x448/float16
+# github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78
+## explicit; go 1.17
+github.com/youmark/pkcs8
 # gitlab.com/gitlab-org/api/client-go v1.46.0
 ## explicit; go 1.24.0
 gitlab.com/gitlab-org/api/client-go
@@ -878,12 +881,12 @@ go.opencensus.io/trace/tracestate
 ## explicit; go 1.24.0
 go.opentelemetry.io/auto/sdk
 go.opentelemetry.io/auto/sdk/internal/telemetry
-# go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0
-## explicit; go 1.24.0
+# go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0
+## explicit; go 1.25.0
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/internal/request
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/internal/semconv
-# go.opentelemetry.io/otel v1.43.0
+# go.opentelemetry.io/otel v1.44.0
 ## explicit; go 1.25.0
 go.opentelemetry.io/otel
 go.opentelemetry.io/otel/attribute
@@ -896,15 +899,15 @@ go.opentelemetry.io/otel/internal/errorhandler
 go.opentelemetry.io/otel/internal/global
 go.opentelemetry.io/otel/propagation
 go.opentelemetry.io/otel/semconv/v1.37.0
-go.opentelemetry.io/otel/semconv/v1.39.0
-go.opentelemetry.io/otel/semconv/v1.39.0/httpconv
 go.opentelemetry.io/otel/semconv/v1.40.0
-# go.opentelemetry.io/otel/metric v1.43.0
+go.opentelemetry.io/otel/semconv/v1.40.0/httpconv
+go.opentelemetry.io/otel/semconv/v1.41.0
+# go.opentelemetry.io/otel/metric v1.44.0
 ## explicit; go 1.25.0
 go.opentelemetry.io/otel/metric
 go.opentelemetry.io/otel/metric/embedded
 go.opentelemetry.io/otel/metric/noop
-# go.opentelemetry.io/otel/trace v1.43.0
+# go.opentelemetry.io/otel/trace v1.44.0
 ## explicit; go 1.25.0
 go.opentelemetry.io/otel/trace
 go.opentelemetry.io/otel/trace/embedded
@@ -924,7 +927,7 @@ go.uber.org/zap/internal/exit
 go.uber.org/zap/internal/pool
 go.uber.org/zap/internal/stacktrace
 go.uber.org/zap/zapcore
-# go.yaml.in/yaml/v2 v2.4.3
+# go.yaml.in/yaml/v2 v2.4.4
 ## explicit; go 1.15
 go.yaml.in/yaml/v2
 # go.yaml.in/yaml/v3 v3.0.4
@@ -1004,12 +1007,12 @@ golang.org/x/time/rate
 ## explicit; go 1.18
 golang.org/x/xerrors
 golang.org/x/xerrors/internal
-# google.golang.org/genproto/googleapis/api v0.0.0-20260316180232-0b37fe3546d5
+# google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478
 ## explicit; go 1.25.0
 google.golang.org/genproto/googleapis/api
 google.golang.org/genproto/googleapis/api/annotations
 google.golang.org/genproto/googleapis/api/httpbody
-# google.golang.org/genproto/googleapis/rpc v0.0.0-20260316180232-0b37fe3546d5
+# google.golang.org/genproto/googleapis/rpc v0.0.0-20260523011958-0a33c5d7ca68
 ## explicit; go 1.25.0
 google.golang.org/genproto/googleapis/rpc/status
 # google.golang.org/grpc v1.81.1
@@ -1529,8 +1532,8 @@ k8s.io/client-go/util/workqueue
 ## explicit; go 1.19
 k8s.io/cri-api/pkg/apis/runtime/v1
 k8s.io/cri-api/pkg/apis/runtime/v1alpha2
-# k8s.io/klog/v2 v2.130.1
-## explicit; go 1.18
+# k8s.io/klog/v2 v2.140.0
+## explicit; go 1.21
 k8s.io/klog/v2
 k8s.io/klog/v2/internal/buffer
 k8s.io/klog/v2/internal/clock