--- a/go.mod
+++ b/go.mod
@@ -185,3 +185,7 @@
 	k8s.io/legacy-cloud-providers => k8s.io/legacy-cloud-providers v0.34.1
 	k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.34.1
 )
+
+replace golang.org/x/crypto => golang.org/x/crypto v0.56.0
+
+replace golang.org/x/net => golang.org/x/net v0.60.0
--- a/go.sum
+++ b/go.sum
@@ -483,29 +483,8 @@
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190611184440-5c40567a22f8/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw=
-golang.org/x/crypto v0.11.0/go.mod h1:xgJhtzW8F9jGdVFWZESrid1U1bjeNy4zgy5cRr/CIio=
-golang.org/x/crypto v0.12.0/go.mod h1:NF0Gs7EO5K4qLn+Ylc+fih8BSTeIjAP05siRnAh98yw=
-golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
-golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
-golang.org/x/crypto v0.16.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
-golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg=
-golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
-golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
-golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
-golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
-golang.org/x/crypto v0.24.0/go.mod h1:Z1PMYSOR5nyMcyAVAIQSKCDwalqy85Aqn1x3Ws4L5DM=
-golang.org/x/crypto v0.25.0/go.mod h1:T+wALwcMOSE0kXgUAnPAHqTLW+XHgcELELW8VaDgm/M=
-golang.org/x/crypto v0.26.0/go.mod h1:GY7jblb9wI+FOo5y8/S2oY4zWP07AkOJ4+jxCqdqn54=
-golang.org/x/crypto v0.28.0/go.mod h1:rmgy+3RHxRZMyY0jjAJShp2zgEdOqj2AO7U0pYmeQ7U=
-golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
-golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
-golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=
+golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY=
 golang.org/x/exp v0.0.0-20250911091902-df9299821621 h1:2id6c1/gto0kaHYyrixvknJ8tUK/Qs5IsmBtrc+FtgU=
@@ -530,54 +509,25 @@
 golang.org/x/mod v0.19.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.20.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.21.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
+golang.org/x/mod v0.25.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
+golang.org/x/mod v0.26.0/go.mod h1:/j6NAhSk8iQ723BGAUyoAcn7SlD7s15Dp9Nd/SfeaFQ=
+golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
+golang.org/x/mod v0.28.0/go.mod h1:yfB/L0NOf/kmEbXjzCPOx1iK1fRutOydrCMsqRhEBxI=
+golang.org/x/mod v0.29.0/go.mod h1:NyhrlYXJ2H4eJiRy/WDBO6HMqZQ6q9nk4JzS3NuCK+w=
+golang.org/x/mod v0.30.0/go.mod h1:lAsf5O2EvJeSFMiBxXDki7sCgAxEUcZHXoXMKT4GJKc=
+golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg=
+golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU=
+golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
+golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=
+golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
+golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ=
+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
+golang.org/x/mod v0.39.0/go.mod h1:bvIbwjQ0HUFFf5AKukeeYQG4ZBUG9yxQbR9aEweIwYY=
 golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
 golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
-golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
-golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20220425223048-2871e0cb64e4/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
-golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
-golang.org/x/net v0.3.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE=
-golang.org/x/net v0.5.0/go.mod h1:DivGGAXEgPSlEBzxGzZI+ZLohi+xUj054jfeKui00ws=
-golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
-golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.12.0/go.mod h1:zEVYFnQC7m/vmpQFELhcD1EWkZlX69l4oqgmer6hfKA=
-golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI=
-golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
-golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
-golang.org/x/net v0.19.0/go.mod h1:CfAk/cbD4CthTvqiEl8NpboMuiuOYsAr/7NOjZJtv1U=
-golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
-golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
-golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
-golang.org/x/net v0.24.0/go.mod h1:2Q7sJY5mzlzWjKtYUEXSlBWCdyaioyXzRB2RtU8KVE8=
-golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE=
-golang.org/x/net v0.27.0/go.mod h1:dDi0PyhWNoiUOrAS8uXv/vnScO4wnHQO4mj9fn/RytE=
-golang.org/x/net v0.28.0/go.mod h1:yqtgsTWOOnlGLG9GFRrK3++bGOUEkNBoHZc8MEDWPNg=
-golang.org/x/net v0.30.0/go.mod h1:2wGyMJ5iFasEhkwi13ChkO/t1ECNC4X4eBKkVFyYFlU=
-golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
-golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=
-golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.27.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
@@ -599,31 +549,34 @@
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
 golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190616124812-15dcb6c0061f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220310020820-b874c991c1a5/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220319134239-a9b59b0215f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220422013727-9388b58f7150/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -637,7 +590,6 @@
 golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
@@ -649,40 +601,47 @@
 golang.org/x/sys v0.24.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.26.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.37.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
 golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
 golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/telemetry v0.0.0-20240521205824-bda55230c457/go.mod h1:pRgIJT+bRLFKnoM1ldnzKoxTIn14Yxz928LQRYYgIN0=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
-golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA=
-golang.org/x/term v0.4.0/go.mod h1:9P2UbLfCdcvo3p/nzKvsmas4TnlujnuoV9hGgYzW1lQ=
-golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
-golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
-golang.org/x/term v0.10.0/go.mod h1:lpqdcUyK/oCiQxvxVrppt5ggO2KCZ5QblwqPnfZ6d5o=
-golang.org/x/term v0.11.0/go.mod h1:zC9APTIj3jG3FdV/Ons+XE1riIZXG4aZ4GTHiPZJPIU=
-golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
-golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
-golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
-golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY=
-golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
-golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58=
-golang.org/x/term v0.19.0/go.mod h1:2CuTdWZ7KHSQwUzKva0cbMg6q2DMI3Mmxp+gKJbskEk=
-golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
-golang.org/x/term v0.21.0/go.mod h1:ooXLefLobQVslOqselCNF4SxFAaoS6KujMbsGzSDmX0=
-golang.org/x/term v0.22.0/go.mod h1:F3qCibpT5AMpCRfhfT53vVJwhLtIVHhB9XDjfFvnMI4=
-golang.org/x/term v0.23.0/go.mod h1:DgV24QBUrK6jhZXl+20l6UWznPlwAHm1Q1mGHtydmSk=
-golang.org/x/term v0.25.0/go.mod h1:RPyXicDX+6vLxogjjRxjgD2TKtmAO6NZBsBRfrOLu7M=
+golang.org/x/telemetry v0.0.0-20250710130107-8d8967aff50b/go.mod h1:4ZwOYna0/zsOKwuR5X/m0QFOJpSZvAxFfkQT+Erd9D4=
+golang.org/x/telemetry v0.0.0-20250807160809-1a19826ec488/go.mod h1:fGb/2+tgXXjhjHsTNdVEEMZNWA0quBnfrO+AfoDSAKw=
+golang.org/x/telemetry v0.0.0-20250908211612-aef8a434d053/go.mod h1:+nZKN+XVh4LCiA9DV3ywrzN4gumyCnKjau3NGb9SGoE=
+golang.org/x/telemetry v0.0.0-20251008203120-078029d740a8/go.mod h1:Pi4ztBfryZoJEkyFTI5/Ocsu2jXyDr6iSdgJiYE/uwE=
+golang.org/x/telemetry v0.0.0-20251111182119-bc8e575c7b54/go.mod h1:hKdjCMrbv9skySur+Nek8Hd0uJ0GuxJIoIX2payrIdQ=
+golang.org/x/telemetry v0.0.0-20251203150158-8fff8a5912fc/go.mod h1:hKdjCMrbv9skySur+Nek8Hd0uJ0GuxJIoIX2payrIdQ=
+golang.org/x/telemetry v0.0.0-20260109210033-bd525da824e2/go.mod h1:b7fPSJ0pKZ3ccUh8gnTONJxhn3c/PS6tyzQvyqw4iA8=
+golang.org/x/telemetry v0.0.0-20260209163413-e7419c687ee4/go.mod h1:g5NllXBEermZrmR51cJDQxmJUHUOfRAaNyWBM+R+548=
+golang.org/x/telemetry v0.0.0-20260311193753-579e4da9a98c/go.mod h1:TpUTTEp9frx7rTdLpC9gFG9kdI7zVLFTFFlqaH2Cncw=
+golang.org/x/telemetry v0.0.0-20260409153401-be6f6cb8b1fa/go.mod h1:kHjTxDEnAu6/Nl9lDkzjWpR+bmKfxeiRuSDlsMb70gE=
+golang.org/x/telemetry v0.0.0-20260508192327-42602be52be6/go.mod h1:Eqhaxk/wZsWEH8CRxLwj6xzEJbz7k1EFGqx7nyCoabE=
+golang.org/x/telemetry v0.0.0-20260625142307-59b4966ccb57/go.mod h1:3AWMyWHS+caVoiEXpiq6+tzKA40J4vQT3MYr80ZtQpc=
+golang.org/x/telemetry v0.0.0-20260708182218-49f421fb7959/go.mod h1:LV7u5Oco+Z/g6XI7PqN+EUUUGGkEcmB1uj2ceI0fOVg=
+golang.org/x/telemetry v0.0.0-20260811182544-a038080d80e5/go.mod h1:LVehoXe41cL5SCVQilsV7Gg6BNG+Js6P9PhSbYTIUkQ=
 golang.org/x/term v0.30.0/go.mod h1:NYYFdzHoI5wRh/h5tDMdMqCqPJZEuNqVR5xJLd/n67g=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc=
 golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
 golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
@@ -699,6 +658,8 @@
 golang.org/x/text v0.17.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
 golang.org/x/text v0.19.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
 golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
 golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
 golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
 golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -737,6 +698,21 @@
 golang.org/x/tools v0.23.0/go.mod h1:pnu6ufv6vQkll6szChhK3C3L/ruaIv5eBeztNG8wtsI=
 golang.org/x/tools v0.24.0/go.mod h1:YhNqVBIfWHdzvTLs0d8LCuMhkKUgSUKldakyV7W/WDQ=
 golang.org/x/tools v0.26.0/go.mod h1:TPVVj70c7JJ3WCazhD8OdXcZg/og+b9+tH/KxylGwH0=
+golang.org/x/tools v0.34.0/go.mod h1:pAP9OwEaY1CAW3HOmg3hLZC5Z0CCmzjAF2UQMSqNARg=
+golang.org/x/tools v0.35.0/go.mod h1:NKdj5HkL/73byiZSJjqJgKn3ep7KjFkBOkR/Hps3VPw=
+golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
+golang.org/x/tools v0.37.0/go.mod h1:MBN5QPQtLMHVdvsbtarmTNukZDdgwdwlO5qGacAzF0w=
+golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs=
+golang.org/x/tools v0.39.0/go.mod h1:JnefbkDPyD8UU2kI5fuf8ZX4/yUeh9W877ZeBONxUqQ=
+golang.org/x/tools v0.40.0/go.mod h1:Ik/tzLRlbscWpqqMRjyWYDisX8bG13FrdXp3o4Sr9lc=
+golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg=
+golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=
+golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
+golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
+golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0=
+golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
+golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk=
+golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
 golang.org/x/tools v0.51.0 h1:k4Xc/1Om9jwkBJBo4NVLMSARBoWtK10mx+W5BnXCeAI=
 golang.org/x/tools v0.51.0/go.mod h1:9eEncMayCV6zRMGhR5eZEC2iBx98qWcF1HZ9Z7wJOoA=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
diff -Nur /work/src-orig/azurefile-csi-driver/vendor/golang.org/x/crypto/chacha20/chacha_loong64.go /work/src/azurefile-csi-driver/vendor/golang.org/x/crypto/chacha20/chacha_loong64.go
--- a/vendor/golang.org/x/crypto/chacha20/chacha_loong64.go	2026-10-22 12:25:12.270826596 +0000
+++ b/vendor/golang.org/x/crypto/chacha20/chacha_loong64.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,22 +0,0 @@
-// Copyright 2026 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build gc && !purego
-
-package chacha20
-
-import "golang.org/x/sys/cpu"
-
-const bufSize = 256
-
-//go:noescape
-func xorKeyStreamVX(dst, src []byte, key *[8]uint32, nonce *[3]uint32, counter *uint32)
-
-func (c *Cipher) xorKeyStreamBlocks(dst, src []byte) {
-	if cpu.Loong64.HasLSX {
-		xorKeyStreamVX(dst, src, &c.key, &c.nonce, &c.counter)
-	} else {
-		c.xorKeyStreamBlocksGeneric(dst, src)
-	}
-}
diff -Nur /work/src-orig/azurefile-csi-driver/vendor/golang.org/x/crypto/chacha20/chacha_loong64.s /work/src/azurefile-csi-driver/vendor/golang.org/x/crypto/chacha20/chacha_loong64.s
--- a/vendor/golang.org/x/crypto/chacha20/chacha_loong64.s	2026-10-22 12:25:12.270826596 +0000
+++ b/vendor/golang.org/x/crypto/chacha20/chacha_loong64.s	1970-01-01 00:00:00.000000000 +0000
@@ -1,342 +0,0 @@
-// Copyright 2026 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// derived from chacha_arm64.s
-
-//go:build gc && !purego
-
-#include "textflag.h"
-
-DATA	·constants+0x00(SB)/4, $0x61707865
-DATA	·constants+0x04(SB)/4, $0x3320646e
-DATA	·constants+0x08(SB)/4, $0x79622d32
-DATA	·constants+0x0c(SB)/4, $0x6b206574
-GLOBL	·constants(SB), NOPTR|RODATA, $32
-
-DATA	·incRotMatrix+0x00(SB)/4, $0x00000000
-DATA	·incRotMatrix+0x04(SB)/4, $0x00000001
-DATA	·incRotMatrix+0x08(SB)/4, $0x00000002
-DATA	·incRotMatrix+0x0c(SB)/4, $0x00000003
-GLOBL	·incRotMatrix(SB), NOPTR|RODATA, $32
-
-#define NUM_ROUNDS 10
-
-// func xorKeyStreamVX(dst, src []byte, key *[8]uint32, nonce *[3]uint32, counter *uint32)
-TEXT ·xorKeyStreamVX(SB), NOSPLIT, $0
-	MOVV	dst+0(FP), R4
-	MOVV	src+24(FP), R5
-	MOVV	src_len+32(FP), R6
-	MOVV	key+48(FP), R7
-	MOVV	nonce+56(FP), R8
-	MOVV	counter+64(FP), R9
-
-	MOVV	$·constants(SB), R10
-	MOVV	$·incRotMatrix(SB), R11
-
-	MOVW	(R9), R12
-
-loop:
-	MOVV	$NUM_ROUNDS, R15
-	// load 4-32bit data from incRotMatrix added to counter
-	VMOVQ	(R11), V30
-
-	// load contants
-	VMOVQ	(R10), V0.W4
-	VMOVQ	4(R10), V1.W4
-	VMOVQ	8(R10), V2.W4
-	VMOVQ	12(R10), V3.W4
-
-	// load keys
-	VMOVQ	(R7), V4.W4
-	VMOVQ	4(R7), V5.W4
-	VMOVQ	8(R7), V6.W4
-	VMOVQ	12(R7), V7.W4
-	VMOVQ	16(R7), V8.W4
-	VMOVQ	20(R7), V9.W4
-	VMOVQ	24(R7), V10.W4
-	VMOVQ	28(R7), V11.W4
-
-	// load counter + nonce
-	VMOVQ	(R9), V12.W4
-
-	VMOVQ	(R8), V13.W4
-	VMOVQ	4(R8), V14.W4
-	VMOVQ	8(R8), V15.W4
-
-	// update counter
-	VADDW	V30, V12, V12
-
-chacha:
-	// V0..V3 += V4..V7
-	// V12..V15 <<<= ((V12..V15 XOR V0..V3), 16)
-	VADDW	V0, V4, V0
-	VADDW	V1, V5, V1
-	VADDW	V2, V6, V2
-	VADDW	V3, V7, V3
-	VXORV	V12, V0, V12
-	VXORV	V13, V1, V13
-	VXORV	V14, V2, V14
-	VXORV	V15, V3, V15
-	VROTRW	$16, V12, V12
-	VROTRW	$16, V13, V13
-	VROTRW	$16, V14, V14
-	VROTRW	$16, V15, V15
-
-	// V8..V11 += V12..V15
-	// V4..V7 <<<= ((V4..V7 XOR V8..V11), 12)
-	VADDW	V8, V12, V8
-	VADDW	V9, V13, V9
-	VADDW	V10, V14, V10
-	VADDW	V11, V15, V11
-	VXORV	V4, V8, V4
-	VXORV	V5, V9, V5
-	VXORV	V6, V10, V6
-	VXORV	V7, V11, V7
-	VROTRW	$20, V4, V4
-	VROTRW	$20, V5, V5
-	VROTRW	$20, V6, V6
-	VROTRW	$20, V7, V7
-
-	// V0..V3 += V4..V7
-	// V12..V15 <<<= ((V12..V15 XOR V0..V3), 8)
-	VADDW	V0, V4, V0
-	VADDW	V1, V5, V1
-	VADDW	V2, V6, V2
-	VADDW	V3, V7, V3
-	VXORV	V12, V0, V12
-	VXORV	V13, V1, V13
-	VXORV	V14, V2, V14
-	VXORV	V15, V3, V15
-	VROTRW	$24, V12, V12
-	VROTRW	$24, V13, V13
-	VROTRW	$24, V14, V14
-	VROTRW	$24, V15, V15
-
-	// V8..V11 += V12..V15
-	// V4..V7 <<<= ((V4..V7 XOR V8..V11), 7)
-	VADDW	V12, V8, V8
-	VADDW	V13, V9, V9
-	VADDW	V14, V10, V10
-	VADDW	V15, V11, V11
-	VXORV	V4, V8, V4
-	VXORV	V5, V9, V5
-	VXORV	V6, V10, V6
-	VXORV	V7, V11, V7
-	VROTRW	$25, V4, V4
-	VROTRW	$25, V5, V5
-	VROTRW	$25, V6, V6
-	VROTRW	$25, V7, V7
-
-	// V0..V3 += V5..V7, V4
-	// V15,V12-V14 <<<= ((V15,V12-V14 XOR V0..V3), 16)
-	VADDW	V0, V5, V0
-	VADDW	V1, V6, V1
-	VADDW	V2, V7, V2
-	VADDW	V3, V4, V3
-	VXORV	V15, V0, V15
-	VXORV	V12, V1, V12
-	VXORV	V13, V2, V13
-	VXORV	V14, V3, V14
-	VROTRW	$16, V15, V15
-	VROTRW	$16, V12, V12
-	VROTRW	$16, V13, V13
-	VROTRW	$16, V14, V14
-
-	// V10,V11,V8,V9 += V15,V12,V13,V14
-	// V5,V6,V7,V4 <<<= ((V5,V6,V7,V4 XOR V10,V11,V8,V9), 12)
-	VADDW	V10, V15, V10
-	VADDW	V11, V12, V11
-	VADDW	V8, V13, V8
-	VADDW	V9, V14, V9
-	VXORV	V5, V10, V5
-	VXORV	V6, V11, V6
-	VXORV	V7, V8, V7
-	VXORV	V4, V9, V4
-	VROTRW	$20, V5, V5
-	VROTRW	$20, V6, V6
-	VROTRW	$20, V7, V7
-	VROTRW	$20, V4, V4
-
-	// V0..V3 += V5..V7, V4
-	// V15,V12-V14 <<<= ((V15,V12-V14 XOR V0..V3), 8)
-	VADDW	V5, V0, V0
-	VADDW	V6, V1, V1
-	VADDW	V7, V2, V2
-	VADDW	V4, V3, V3
-	VXORV	V15, V0, V15
-	VXORV	V12, V1, V12
-	VXORV	V13, V2, V13
-	VXORV	V14, V3, V14
-	VROTRW	$24, V15, V15
-	VROTRW	$24, V12, V12
-	VROTRW	$24, V13, V13
-	VROTRW	$24, V14, V14
-
-	// V10,V11,V8,V9 += V15,V12,V13,V14
-	// V5,V6,V7,V4 <<<= ((V5,V6,V7,V4 XOR V10,V11,V8,V9), 7)
-	VADDW	V15, V10, V10
-	VADDW	V12, V11, V11
-	VADDW	V13, V8, V8
-	VADDW	V14, V9, V9
-	VXORV	V5, V10, V5
-	VXORV	V6, V11, V6
-	VXORV	V7, V8, V7
-	VXORV	V4, V9, V4
-	VROTRW	$25, V5, V5
-	VROTRW	$25, V6, V6
-	VROTRW	$25, V7, V7
-	VROTRW	$25, V4, V4
-
-	SUBV	$1, R15
-	BNE	R15, R0, chacha
-
-	// load origin contants
-	VMOVQ	(R10), V16.W4
-	VMOVQ	4(R10), V17.W4
-	VMOVQ	8(R10), V18.W4
-	VMOVQ	12(R10), V19.W4
-
-	// load origin keys
-	VMOVQ	(R7), V20.W4
-	VMOVQ	4(R7), V21.W4
-	VMOVQ	8(R7), V22.W4
-	VMOVQ	12(R7), V23.W4
-	VMOVQ	16(R7), V24.W4
-	VMOVQ	20(R7), V25.W4
-	VMOVQ	24(R7), V26.W4
-	VMOVQ	28(R7), V27.W4
-
-	// add back the initial state to generate the key stream
-	VADDW	V30, V12, V12	// update counter in advance to prevent V30 from being overwritten
-	VADDW	V16, V0, V0
-	VADDW	V17, V1, V1
-	VADDW	V18, V2, V2
-	VADDW	V19, V3, V3
-
-	// load origin counter + nonce
-	VMOVQ	(R9), V28.W4
-	VMOVQ	(R8), V29.W4
-	VMOVQ	4(R8), V30.W4
-	VMOVQ	8(R8), V31.W4
-
-	VADDW	V20, V4, V4
-	VADDW	V21, V5, V5
-	VADDW	V22, V6, V6
-	VADDW	V23, V7, V7
-	VADDW	V24, V8, V8
-	VADDW	V25, V9, V9
-	VADDW	V26, V10, V10
-	VADDW	V27, V11, V11
-	VADDW	V28, V12, V12
-	VADDW	V29, V13, V13
-	VADDW	V30, V14, V14
-	VADDW	V31, V15, V15
-
-	// shuffle
-	VILVLW	V0, V1, V16
-	VILVHW	V0, V1, V17
-	VILVLW	V2, V3, V18
-	VILVHW	V2, V3, V19
-	VILVLW	V4, V5 ,V20
-	VILVHW	V4, V5, V21
-	VILVLW	V6, V7, V22
-	VILVHW	V6, V7, V23
-	VILVLW	V8, V9, V24
-	VILVHW	V8, V9, V25
-	VILVLW	V10, V11, V26
-	VILVHW	V10, V11, V27
-	VILVLW	V12, V13, V28
-	VILVHW	V12, V13, V29
-	VILVLW	V14, V15, V30
-	VILVHW	V14, V15, V31
-	VILVLV	V16, V18, V0
-	VILVHV	V16, V18, V4
-	VILVLV	V17, V19, V8
-	VILVHV	V17, V19, V12
-
-	// load src data from R5
-	VMOVQ	0(R5), V16
-	VMOVQ	16(R5), V17
-	VMOVQ	32(R5), V18
-	VMOVQ	48(R5), V19
-
-	VILVLV	V20, V22, V1
-	VILVHV	V20, V22, V5
-	VILVLV	V21, V23, V9
-	VILVHV	V21, V23, V13
-
-	VMOVQ	64(R5), V20
-	VMOVQ	80(R5), V21
-	VMOVQ	96(R5), V22
-	VMOVQ	112(R5), V23
-
-	VILVLV	V24, V26, V2
-	VILVHV	V24, V26, V6
-	VILVLV	V25, V27, V10
-	VILVHV	V25, V27, V14
-
-	VMOVQ	128(R5), V24
-	VMOVQ	144(R5), V25
-	VMOVQ	160(R5), V26
-	VMOVQ	176(R5), V27
-
-	VILVLV	V28, V30, V3
-	VILVHV	V28, V30, V7
-	VILVLV	V29, V31, V11
-	VILVHV	V29, V31, V15
-
-	VMOVQ	192(R5), V28
-	VMOVQ	208(R5), V29
-	VMOVQ	224(R5), V30
-	VMOVQ	240(R5), V31
-
-	VXORV	V0, V16, V16
-	VXORV	V1, V17, V17
-	VXORV	V2, V18, V18
-	VXORV	V3, V19, V19
-
-	VMOVQ	V16, 0(R4)
-	VMOVQ	V17, 16(R4)
-	VMOVQ	V18, 32(R4)
-	VMOVQ	V19, 48(R4)
-
-	VXORV	V4, V20, V20
-	VXORV	V5, V21, V21
-	VXORV	V6, V22, V22
-	VXORV	V7, V23, V23
-
-	VMOVQ	V20, 64(R4)
-	VMOVQ	V21, 80(R4)
-	VMOVQ	V22, 96(R4)
-	VMOVQ	V23, 112(R4)
-
-	VXORV	V8, V24, V24
-	VXORV	V9, V25, V25
-	VXORV	V10, V26, V26
-	VXORV	V11, V27, V27
-
-	VMOVQ	V24, 128(R4)
-	VMOVQ	V25, 144(R4)
-	VMOVQ	V26, 160(R4)
-	VMOVQ	V27, 176(R4)
-
-	VXORV	V12, V28, V28
-	VXORV	V13, V29, V29
-	VXORV	V14, V30, V30
-	VXORV	V15, V31, V31
-
-	VMOVQ	V28, 192(R4)
-	VMOVQ	V29, 208(R4)
-	VMOVQ	V30, 224(R4)
-	VMOVQ	V31, 240(R4)
-
-	ADD	$4, R12, R12
-	MOVW	R12, (R9) // update counter
-
-	ADDV	$256, R4, R4
-	ADDV	$256, R5, R5
-	SUBV    $256, R6, R6
-	BNE     R6, R0, loop
-
-	RET
diff -Nur /work/src-orig/azurefile-csi-driver/vendor/golang.org/x/crypto/chacha20/chacha_noasm.go /work/src/azurefile-csi-driver/vendor/golang.org/x/crypto/chacha20/chacha_noasm.go
--- a/vendor/golang.org/x/crypto/chacha20/chacha_noasm.go	2026-10-22 12:25:12.270826596 +0000
+++ b/vendor/golang.org/x/crypto/chacha20/chacha_noasm.go	2026-10-22 12:26:11.102597645 +0000
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build (!arm64 && !loong64 && !s390x && !ppc64 && !ppc64le) || !gc || purego
+//go:build (!arm64 && !s390x && !ppc64 && !ppc64le) || !gc || purego
 
 package chacha20
 
diff -Nur /work/src-orig/azurefile-csi-driver/vendor/golang.org/x/crypto/ssh/certs.go /work/src/azurefile-csi-driver/vendor/golang.org/x/crypto/ssh/certs.go
--- a/vendor/golang.org/x/crypto/ssh/certs.go	2026-10-22 12:25:12.274826580 +0000
+++ b/vendor/golang.org/x/crypto/ssh/certs.go	2026-10-22 12:26:11.110597614 +0000
@@ -35,15 +35,6 @@
 	CertAlgoED25519v01     = "ssh-ed25519-cert-v01@openssh.com"
 	CertAlgoSKED25519v01   = "sk-ssh-ed25519-cert-v01@openssh.com"
 
-	// CertAlgoMLDSA44v01Go, CertAlgoMLDSA65v01Go and CertAlgoMLDSA87v01Go
-	// are certificate algorithms based on ML-DSA. No specification defines
-	// them, so these are vendor names as per RFC 4251, Section 4.2. The
-	// format is that of [SSH-CERTS], with the public key encoded as in
-	// [SSH-MLDSA], Section 4.
-	CertAlgoMLDSA44v01Go = "ssh-mldsa-44-cert-v01@golang.org"
-	CertAlgoMLDSA65v01Go = "ssh-mldsa-65-cert-v01@golang.org"
-	CertAlgoMLDSA87v01Go = "ssh-mldsa-87-cert-v01@golang.org"
-
 	// CertAlgoRSASHA256v01 and CertAlgoRSASHA512v01 can't appear as a
 	// Certificate.Type (or PublicKey.Type), but only in
 	// ClientConfig.HostKeyAlgorithms.
@@ -534,9 +525,6 @@
 	CertAlgoSKECDSA256v01:  KeyAlgoSKECDSA256,
 	CertAlgoED25519v01:     KeyAlgoED25519,
 	CertAlgoSKED25519v01:   KeyAlgoSKED25519,
-	CertAlgoMLDSA44v01Go:   KeyAlgoMLDSA44,
-	CertAlgoMLDSA65v01Go:   KeyAlgoMLDSA65,
-	CertAlgoMLDSA87v01Go:   KeyAlgoMLDSA87,
 }
 
 // underlyingAlgo returns the signature algorithm associated with algo (which is
diff -Nur /work/src-orig/azurefile-csi-driver/vendor/golang.org/x/crypto/ssh/cipher.go /work/src/azurefile-csi-driver/vendor/golang.org/x/crypto/ssh/cipher.go
--- a/vendor/golang.org/x/crypto/ssh/cipher.go	2026-10-22 12:25:12.274826580 +0000
+++ b/vendor/golang.org/x/crypto/ssh/cipher.go	2026-10-22 12:26:11.110597614 +0000
@@ -414,34 +414,10 @@
 	return plain, nil
 }
 
-// cbcCipher implements the CBC ciphers defined in RFC 4253 section 6.1, in
-// MAC-then-encrypt mode and, for the *-etm@openssh.com MACs, in the
-// encrypt-then-MAC mode defined in [PROTOCOL], section 1.5.
-//
-//	0               4                prefixLen                   macStart
-//	|               |                |                           |
-//	+---------------+----------------+---------+-----------------+-----------+
-//	| packet_length | padding_length | payload | random padding  |    mac    |
-//	+---------------+----------------+---------+-----------------+-----------+
-//	                |<--------- length = packet_length --------->|< macSize >|
-//	                                           |< paddingLength >|
-//	|<-------------------------- entirePacketSize -------------------------->|
-//
-//	MAC-then-encrypt (encStart = 0)
-//	|<----------------------- encLength ------------------------>|
-//	|<-------------- MAC'd (seqNum || plaintext) --------------->|
-//
-//	encrypt-then-MAC (encStart = 4)
-//	                |<--------------- encLength ---------------->|
-//	|<-------------- MAC'd (seqNum || ciphertext) -------------->|
-//
-// encLength is always a multiple of effectiveBlockSize, and in ETM mode the
-// packet_length field is not part of it. The padding is only trustworthy once
-// the MAC has been verified.
+// cbcCipher implements aes128-cbc cipher defined in RFC 4253 section 6.1
 type cbcCipher struct {
 	mac       hash.Hash
 	macSize   uint32
-	etm       bool
 	decrypter cipher.BlockMode
 	encrypter cipher.BlockMode
 
@@ -455,20 +431,16 @@
 	oracleCamouflage uint32
 }
 
-func newCBCCipher(c cipher.Block, _, iv, macKey []byte, algs DirectionAlgorithms) (packetCipher, error) {
-	macMode := macModes[algs.MAC]
-	if macMode == nil {
-		return nil, fmt.Errorf("ssh: unsupported MAC %v", algs.MAC)
-	}
-	mac := macMode.new(macKey)
+func newCBCCipher(c cipher.Block, key, iv, macKey []byte, algs DirectionAlgorithms) (packetCipher, error) {
 	cbc := &cbcCipher{
-		mac:        mac,
-		macSize:    uint32(mac.Size()),
-		etm:        macMode.etm,
+		mac:        macModes[algs.MAC].new(macKey),
 		decrypter:  cipher.NewCBCDecrypter(c, iv),
 		encrypter:  cipher.NewCBCEncrypter(c, iv),
 		packetData: make([]byte, 1024),
 	}
+	if cbc.mac != nil {
+		cbc.macSize = uint32(cbc.mac.Size())
+	}
 
 	return cbc, nil
 }
@@ -501,6 +473,13 @@
 	return cbc, nil
 }
 
+func maxUInt32(a, b int) uint32 {
+	if a > b {
+		return uint32(a)
+	}
+	return uint32(b)
+}
+
 const (
 	cbcMinPacketSizeMultiple = 8
 	cbcMinPacketSize         = 16
@@ -514,38 +493,25 @@
 
 func (c *cbcCipher) readCipherPacket(seqNum uint32, r io.Reader) ([]byte, error) {
 	p, err := c.readCipherPacketLeaky(seqNum, r)
-	if _, ok := err.(cbcError); ok {
-		// Verification error: read a fixed amount of
-		// data, to make distinguishing between
-		// failing MAC and failing length check more
-		// difficult.
-		io.CopyN(io.Discard, r, int64(c.oracleCamouflage))
+	if err != nil {
+		if _, ok := err.(cbcError); ok {
+			// Verification error: read a fixed amount of
+			// data, to make distinguishing between
+			// failing MAC and failing length check more
+			// difficult.
+			io.CopyN(io.Discard, r, int64(c.oracleCamouflage))
+		}
 	}
 	return p, err
 }
 
 func (c *cbcCipher) readCipherPacketLeaky(seqNum uint32, r io.Reader) ([]byte, error) {
 	blockSize := c.decrypter.BlockSize()
-	// The encrypted portion of a packet is a multiple of the cipher block size
-	// or 8, whichever is larger.
-	effectiveBlockSize := uint32(max(cbcMinPacketSizeMultiple, blockSize))
-	encStart := uint32(0)
-	// A packet is at least 16 bytes, or the cipher block size if larger. This does
-	// not apply to EtM (but the encrypted length still can't be zero).
-	minEncLength := uint32(max(cbcMinPacketSize, blockSize))
-	// For EtM MACs the packet length is transmitted in the clear and is not part
-	// of the encrypted data, which starts after it.
-	if c.etm {
-		encStart = 4
-		minEncLength = effectiveBlockSize
-	}
 
 	// Read the header, which will include some of the subsequent data in the
-	// case of block ciphers - this is copied back to the payload later. The
-	// rounding up to the block size covers at least prefixLen bytes, so the
-	// padding length is always within firstBlock.
-	headerEncLength := prefixLen - encStart
-	firstBlockLength := encStart + (headerEncLength+uint32(blockSize)-1)/uint32(blockSize)*uint32(blockSize)
+	// case of block ciphers - this is copied back to the payload later.
+	// How many bytes of payload/padding will be read with this first read.
+	firstBlockLength := uint32((prefixLen + blockSize - 1) / blockSize * blockSize)
 	firstBlock := c.packetData[:firstBlockLength]
 	if _, err := io.ReadFull(r, firstBlock); err != nil {
 		return nil, err
@@ -553,49 +519,30 @@
 
 	c.oracleCamouflage = maxPacket + 4 + c.macSize - firstBlockLength
 
-	c.mac.Reset()
-	binary.BigEndian.PutUint32(c.seqNumBytes[:], seqNum)
-	c.mac.Write(c.seqNumBytes[:])
-
-	var length uint32
-	if c.etm {
-		// For EtM MACs the MAC is computed over the cleartext packet length
-		// followed by the ciphertext, so it is updated before decrypting.
-		length = binary.BigEndian.Uint32(firstBlock[:encStart])
-		c.mac.Write(firstBlock[:encStart])
-		c.mac.Write(firstBlock[encStart:])
-		c.decrypter.CryptBlocks(firstBlock[encStart:], firstBlock[encStart:])
-	} else {
-		c.decrypter.CryptBlocks(firstBlock, firstBlock)
-		length = binary.BigEndian.Uint32(firstBlock[:4])
-	}
-
+	c.decrypter.CryptBlocks(firstBlock, firstBlock)
+	length := binary.BigEndian.Uint32(firstBlock[:4])
 	if length > maxPacket {
 		return nil, cbcError("ssh: packet too large")
 	}
-	// Length of the encrypted portion of the packet, which includes the packet
-	// length field only for non-EtM MACs.
-	encLength := 4 + length - encStart
-	if encLength < minEncLength {
+	if length+4 < maxUInt32(cbcMinPacketSize, blockSize) {
+		// The minimum size of a packet is 16 (or the cipher block size, whichever
+		// is larger) bytes.
 		return nil, cbcError("ssh: packet too small")
 	}
-	if encLength%effectiveBlockSize != 0 {
+	// The length of the packet (including the length field but not the MAC) must
+	// be a multiple of the block size or 8, whichever is larger.
+	if (length+4)%maxUInt32(cbcMinPacketSizeMultiple, blockSize) != 0 {
 		return nil, cbcError("ssh: invalid packet length multiple")
 	}
 
-	// The padding length is part of the encrypted data. For EtM MACs it is not
-	// acted upon before the MAC is verified, otherwise the CBC padding would
-	// still be usable as an oracle, which is what EtM prevents.
 	paddingLength := uint32(firstBlock[4])
-	if !c.etm {
-		if paddingLength < cbcMinPaddingSize || length <= paddingLength+1 {
-			return nil, cbcError("ssh: invalid packet length")
-		}
+	if paddingLength < cbcMinPaddingSize || length <= paddingLength+1 {
+		return nil, cbcError("ssh: invalid packet length")
 	}
 
-	// Positions within the c.packetData buffer: the MAC follows the encrypted
-	// data.
-	macStart := encStart + encLength
+	// Positions within the c.packetData buffer:
+	macStart := 4 + length
+	paddingStart := macStart - paddingLength
 
 	// Entire packet size, starting before length, ending at end of mac.
 	entirePacketSize := macStart + c.macSize
@@ -617,58 +564,42 @@
 	c.oracleCamouflage -= uint32(n)
 
 	remainingCrypted := c.packetData[firstBlockLength:macStart]
-	if c.etm {
-		c.mac.Write(remainingCrypted)
-	}
 	c.decrypter.CryptBlocks(remainingCrypted, remainingCrypted)
 
-	if !c.etm {
+	mac := c.packetData[macStart:]
+	if c.mac != nil {
+		c.mac.Reset()
+		binary.BigEndian.PutUint32(c.seqNumBytes[:], seqNum)
+		c.mac.Write(c.seqNumBytes[:])
 		c.mac.Write(c.packetData[:macStart])
-	}
-	c.macResult = c.mac.Sum(c.macResult[:0])
-	if subtle.ConstantTimeCompare(c.macResult, c.packetData[macStart:]) != 1 {
-		return nil, cbcError("ssh: MAC failure")
-	}
-
-	if c.etm {
-		if paddingLength < cbcMinPaddingSize || length <= paddingLength+1 {
-			return nil, cbcError("ssh: invalid packet length")
+		c.macResult = c.mac.Sum(c.macResult[:0])
+		if subtle.ConstantTimeCompare(c.macResult, mac) != 1 {
+			return nil, cbcError("ssh: MAC failure")
 		}
 	}
 
-	return c.packetData[prefixLen : macStart-paddingLength], nil
+	return c.packetData[prefixLen:paddingStart], nil
 }
 
-func (c *cbcCipher) writeCipherPacket(seqNum uint32, w io.Writer, rand io.Reader, payload []byte) error {
-	blockSize := c.encrypter.BlockSize()
-	// The encrypted portion of a packet is a multiple of the cipher block size
-	// or 8, whichever is larger.
-	effectiveBlockSize := uint32(max(cbcMinPacketSizeMultiple, blockSize))
-	// For EtM MACs the packet length is transmitted in the clear and is not part
-	// of the encrypted data, which starts after it.
-	encStart := uint32(0)
-	if c.etm {
-		encStart = 4
-	}
-	// Length of the encrypted portion of the packet (header, payload, padding),
-	// enforcing the minimum padding and the minimum packet size of RFC 4253,
-	// Section 6: 16 bytes, or the cipher block size if larger, excluding the
-	// MAC.
-	encLength := uint32(max(prefixLen-int(encStart)+len(payload)+cbcMinPaddingSize, cbcMinPacketSize-int(encStart)))
+func (c *cbcCipher) writeCipherPacket(seqNum uint32, w io.Writer, rand io.Reader, packet []byte) error {
+	effectiveBlockSize := maxUInt32(cbcMinPacketSizeMultiple, c.encrypter.BlockSize())
+
+	// Length of encrypted portion of the packet (header, payload, padding).
+	// Enforce minimum padding and packet size.
+	encLength := maxUInt32(prefixLen+len(packet)+cbcMinPaddingSize, cbcMinPacketSize)
 	// Enforce block size.
 	encLength = (encLength + effectiveBlockSize - 1) / effectiveBlockSize * effectiveBlockSize
-	// The packet length field covers the whole packet except the field itself.
-	length := encStart + encLength - 4
-	paddingLength := int(length) - (1 + len(payload))
+
+	length := encLength - 4
+	paddingLength := int(length) - (1 + len(packet))
 
 	// Overall buffer contains: header, payload, padding, mac.
 	// Space for the MAC is reserved in the capacity but not the slice length.
-	macStart := encStart + encLength
-	entirePacketSize := macStart + c.macSize
-	if uint32(cap(c.packetData)) < entirePacketSize {
-		c.packetData = make([]byte, macStart, entirePacketSize)
+	bufferSize := encLength + c.macSize
+	if uint32(cap(c.packetData)) < bufferSize {
+		c.packetData = make([]byte, encLength, bufferSize)
 	} else {
-		c.packetData = c.packetData[:macStart]
+		c.packetData = c.packetData[:encLength]
 	}
 
 	p := c.packetData
@@ -680,29 +611,24 @@
 
 	// Payload.
 	p = p[1:]
-	copy(p, payload)
+	copy(p, packet)
 
 	// Padding.
-	p = p[len(payload):]
+	p = p[len(packet):]
 	if _, err := io.ReadFull(rand, p); err != nil {
 		return err
 	}
 
-	c.mac.Reset()
-	binary.BigEndian.PutUint32(c.seqNumBytes[:], seqNum)
-	c.mac.Write(c.seqNumBytes[:])
-	if c.etm {
-		// For EtM MACs the MAC is computed over the cleartext packet length
-		// followed by the ciphertext.
-		c.mac.Write(c.packetData[:encStart])
-		c.encrypter.CryptBlocks(c.packetData[encStart:], c.packetData[encStart:])
-		c.mac.Write(c.packetData[encStart:])
-	} else {
+	if c.mac != nil {
+		c.mac.Reset()
+		binary.BigEndian.PutUint32(c.seqNumBytes[:], seqNum)
+		c.mac.Write(c.seqNumBytes[:])
 		c.mac.Write(c.packetData)
-		c.encrypter.CryptBlocks(c.packetData, c.packetData)
+		// The MAC is now appended into the capacity reserved for it earlier.
+		c.packetData = c.mac.Sum(c.packetData)
 	}
-	// The MAC is now appended into the capacity reserved for it earlier.
-	c.packetData = c.mac.Sum(c.packetData)
+
+	c.encrypter.CryptBlocks(c.packetData[:encLength], c.packetData[:encLength])
 
 	if _, err := w.Write(c.packetData); err != nil {
 		return err
diff -Nur /work/src-orig/azurefile-csi-driver/vendor/golang.org/x/crypto/ssh/common.go /work/src/azurefile-csi-driver/vendor/golang.org/x/crypto/ssh/common.go
--- a/vendor/golang.org/x/crypto/ssh/common.go	2026-10-22 12:25:12.274826580 +0000
+++ b/vendor/golang.org/x/crypto/ssh/common.go	2026-10-22 12:26:11.110597614 +0000
@@ -258,11 +258,6 @@
 }
 
 func init() {
-	supportedHostKeyAlgos = slices.Concat(supportedHostKeyAlgos, mldsaCertAlgos, mldsaKeyAlgos)
-	defaultHostKeyAlgos = slices.Concat(defaultHostKeyAlgos, mldsaCertAlgos, mldsaKeyAlgos)
-	supportedPubKeyAuthAlgos = slices.Concat(supportedPubKeyAuthAlgos, mldsaKeyAlgos)
-	defaultPubKeyAuthAlgos = slices.Concat(defaultPubKeyAuthAlgos, mldsaKeyAlgos)
-
 	if fips140.Enabled() {
 		defaultHostKeyAlgos = slices.DeleteFunc(defaultHostKeyAlgos, func(algo string) bool {
 			_, err := hashFunc(underlyingAlgo(algo))
@@ -286,10 +281,6 @@
 	case KeyAlgoED25519:
 		// KeyAlgoED25519 doesn't pre-hash.
 		return 0, nil
-	case KeyAlgoMLDSA44, KeyAlgoMLDSA65, KeyAlgoMLDSA87:
-		// ML-DSA doesn't pre-hash. This case is not build tagged, availability
-		// is decided by mldsaKeyAlgos.
-		return 0, nil
 	case KeyAlgoRSA, InsecureKeyAlgoDSA:
 		if fips140.Enabled() {
 			return 0, fmt.Errorf("ssh: hash algorithm for format %q not allowed in FIPS 140 mode", format)
@@ -363,13 +354,7 @@
 		CertAlgoECDSA521v01,
 		CertAlgoSKECDSA256v01,
 		CertAlgoED25519v01,
-		CertAlgoSKED25519v01,
-		KeyAlgoMLDSA44,
-		KeyAlgoMLDSA65,
-		KeyAlgoMLDSA87,
-		CertAlgoMLDSA44v01Go,
-		CertAlgoMLDSA65v01Go,
-		CertAlgoMLDSA87v01Go:
+		CertAlgoSKED25519v01:
 		return sigAlgo
 	default:
 		return ""
diff -Nur /work/src-orig/azurefile-csi-driver/vendor/golang.org/x/crypto/ssh/doc.go /work/src/azurefile-csi-driver/vendor/golang.org/x/crypto/ssh/doc.go
--- a/vendor/golang.org/x/crypto/ssh/doc.go	2026-10-22 12:25:12.274826580 +0000
+++ b/vendor/golang.org/x/crypto/ssh/doc.go	2026-10-22 12:26:11.110597614 +0000
@@ -17,7 +17,6 @@
 	[PROTOCOL.certkeys]: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/PROTOCOL.certkeys?rev=HEAD
 	[SSH-PARAMETERS]:    http://www.iana.org/assignments/ssh-parameters/ssh-parameters.xml#ssh-parameters-1
 	[SSH-CERTS]:	https://datatracker.ietf.org/doc/html/draft-miller-ssh-cert-01
-	[SSH-MLDSA]:	https://datatracker.ietf.org/doc/html/draft-sfluhrer-ssh-mldsa-08
 	[FIPS 140-3 mode]: https://go.dev/doc/security/fips140
 
 This package does not fall under the stability promise of the Go language itself,
diff -Nur /work/src-orig/azurefile-csi-driver/vendor/golang.org/x/crypto/ssh/keys.go /work/src/azurefile-csi-driver/vendor/golang.org/x/crypto/ssh/keys.go
--- a/vendor/golang.org/x/crypto/ssh/keys.go	2026-10-22 12:25:12.274826580 +0000
+++ b/vendor/golang.org/x/crypto/ssh/keys.go	2026-10-22 12:26:11.110597614 +0000
@@ -51,12 +51,6 @@
 	KeyAlgoED25519     = "ssh-ed25519"
 	KeyAlgoSKED25519   = "sk-ssh-ed25519@openssh.com"
 
-	// KeyAlgoMLDSA44, KeyAlgoMLDSA65 and KeyAlgoMLDSA87 are the ML-DSA
-	// algorithms of [SSH-MLDSA].
-	KeyAlgoMLDSA44 = "ssh-mldsa-44"
-	KeyAlgoMLDSA65 = "ssh-mldsa-65"
-	KeyAlgoMLDSA87 = "ssh-mldsa-87"
-
 	// KeyAlgoRSASHA256 and KeyAlgoRSASHA512 are only public key algorithms, not
 	// public key formats, so they can't appear as a PublicKey.Type. The
 	// corresponding PublicKey.Type is KeyAlgoRSA. See RFC 8332, Section 2.
@@ -89,10 +83,7 @@
 		return parseED25519(in)
 	case KeyAlgoSKED25519:
 		return parseSKEd25519(in)
-	case KeyAlgoMLDSA44, KeyAlgoMLDSA65, KeyAlgoMLDSA87:
-		return parseMLDSA(in, algo)
-	case CertAlgoRSAv01, InsecureCertAlgoDSAv01, CertAlgoECDSA256v01, CertAlgoECDSA384v01, CertAlgoECDSA521v01, CertAlgoSKECDSA256v01, CertAlgoED25519v01, CertAlgoSKED25519v01,
-		CertAlgoMLDSA44v01Go, CertAlgoMLDSA65v01Go, CertAlgoMLDSA87v01Go:
+	case CertAlgoRSAv01, InsecureCertAlgoDSAv01, CertAlgoECDSA256v01, CertAlgoECDSA384v01, CertAlgoECDSA521v01, CertAlgoSKECDSA256v01, CertAlgoED25519v01, CertAlgoSKED25519v01:
 		cert, err := parseCert(in, certKeyAlgoNames[algo])
 		if err != nil {
 			return nil, nil, err
@@ -107,30 +98,11 @@
 	return nil, nil, fmt.Errorf("ssh: unknown key algorithm: %v", algo)
 }
 
-// trimSpace removes leading and trailing ASCII space and tab.
-func trimSpace(in []byte) []byte {
-	return bytes.Trim(in, " \t")
-}
-
-// asciiFields splits in around each run of ASCII space and tab.
-func asciiFields(in []byte) [][]byte {
-	return bytes.FieldsFunc(in, func(r rune) bool {
-		return r == ' ' || r == '\t'
-	})
-}
-
-// dropCR removes a single trailing carriage return, so that an entry written
-// with CRLF line endings is read like one written with LF endings. A carriage
-// return anywhere else belongs to the field that holds it.
-func dropCR(in []byte) []byte {
-	return bytes.TrimSuffix(in, []byte("\r"))
-}
-
 // parseAuthorizedKey parses a public key in OpenSSH authorized_keys format
 // (see sshd(8) manual page) once the options and key type fields have been
 // removed.
 func parseAuthorizedKey(in []byte) (out PublicKey, comment string, err error) {
-	in = trimSpace(in)
+	in = bytes.TrimSpace(in)
 
 	i := bytes.IndexAny(in, " \t")
 	if i == -1 {
@@ -148,7 +120,7 @@
 	if err != nil {
 		return nil, "", err
 	}
-	comment = string(trimSpace(in[i:]))
+	comment = string(bytes.TrimSpace(in[i:]))
 	return out, comment, nil
 }
 
@@ -177,9 +149,12 @@
 			rest = nil
 		}
 
-		in = dropCR(in)
+		end = bytes.IndexByte(in, '\r')
+		if end != -1 {
+			in = in[:end]
+		}
 
-		in = trimSpace(in)
+		in = bytes.TrimSpace(in)
 		if len(in) == 0 || in[0] == '#' {
 			in = rest
 			continue
@@ -193,10 +168,8 @@
 
 		// Strip out the beginning of the known_host key.
 		// This is either an optional marker or a (set of) hostname(s).
-		// The comment is not delimited, so there is no upper bound on the
-		// number of fields.
-		keyFields := asciiFields(in)
-		if len(keyFields) < 3 {
+		keyFields := bytes.Fields(in)
+		if len(keyFields) < 3 || len(keyFields) > 5 {
 			return "", nil, nil, "", nil, errors.New("ssh: invalid entry in known_hosts data")
 		}
 
@@ -242,9 +215,12 @@
 			rest = nil
 		}
 
-		in = dropCR(in)
+		end = bytes.IndexByte(in, '\r')
+		if end != -1 {
+			in = in[:end]
+		}
 
-		in = trimSpace(in)
+		in = bytes.TrimSpace(in)
 		if len(in) == 0 || in[0] == '#' {
 			in = rest
 			continue
@@ -358,8 +334,7 @@
 }
 
 // MarshalPrivateKey returns a PEM block with the private key serialized in the
-// OpenSSH format. ML-DSA keys are not supported, since no OpenSSH format is
-// defined for them: use [x509.MarshalPKCS8PrivateKey] instead.
+// OpenSSH format.
 func MarshalPrivateKey(key crypto.PrivateKey, comment string) (*pem.Block, error) {
 	return marshalOpenSSHPrivateKey(key, comment, unencryptedOpenSSHMarshaler)
 }
@@ -1198,9 +1173,9 @@
 }
 
 // NewSignerFromKey takes an *rsa.PrivateKey, *dsa.PrivateKey,
-// *ecdsa.PrivateKey, *mldsa.PrivateKey, or any other crypto.Signer and returns
-// a corresponding Signer instance. ECDSA keys must use P-256, P-384 or P-521.
-// DSA keys must use parameter size L1024N160.
+// *ecdsa.PrivateKey or any other crypto.Signer and returns a
+// corresponding Signer instance. ECDSA keys must use P-256, P-384 or
+// P-521. DSA keys must use parameter size L1024N160.
 func NewSignerFromKey(key interface{}) (Signer, error) {
 	switch key := key.(type) {
 	case crypto.Signer:
@@ -1310,8 +1285,8 @@
 }
 
 // NewPublicKey takes an *rsa.PublicKey, *dsa.PublicKey, *ecdsa.PublicKey,
-// ed25519.PublicKey, or an *mldsa.PublicKey, and returns a corresponding
-// PublicKey instance. ECDSA keys must use P-256, P-384 or P-521.
+// or ed25519.PublicKey returns a corresponding PublicKey instance.
+// ECDSA keys must use P-256, P-384 or P-521.
 func NewPublicKey(key interface{}) (PublicKey, error) {
 	switch key := key.(type) {
 	case *rsa.PublicKey:
@@ -1329,13 +1304,7 @@
 		}
 		return ed25519PublicKey(key), nil
 	default:
-		pub, err := newMLDSAPublicKey(key)
-		if errors.Is(err, errNotMLDSAKey) {
-			return nil, fmt.Errorf("ssh: unsupported key type %T", key)
-		} else if err != nil {
-			return nil, err
-		}
-		return pub, nil
+		return nil, fmt.Errorf("ssh: unsupported key type %T", key)
 	}
 }
 
diff -Nur /work/src-orig/azurefile-csi-driver/vendor/golang.org/x/crypto/ssh/mldsa.go /work/src/azurefile-csi-driver/vendor/golang.org/x/crypto/ssh/mldsa.go
--- a/vendor/golang.org/x/crypto/ssh/mldsa.go	2026-10-22 12:25:12.274826580 +0000
+++ b/vendor/golang.org/x/crypto/ssh/mldsa.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,133 +0,0 @@
-// Copyright 2026 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build go1.27 && !fips140v1.0
-
-package ssh
-
-import (
-	"crypto"
-	"crypto/mldsa"
-	"errors"
-	"fmt"
-)
-
-// mldsaKeyAlgos are the ML-DSA public key algorithms implemented by this
-// package.
-var mldsaKeyAlgos = []string{
-	KeyAlgoMLDSA44,
-	KeyAlgoMLDSA65,
-	KeyAlgoMLDSA87,
-}
-
-// mldsaCertAlgos are the certificate algorithms for the keys in mldsaKeyAlgos.
-var mldsaCertAlgos = []string{
-	CertAlgoMLDSA44v01Go,
-	CertAlgoMLDSA65v01Go,
-	CertAlgoMLDSA87v01Go,
-}
-
-var errNotMLDSAKey = errors.New("ssh: not an ML-DSA key")
-
-// mldsaParameters returns the ML-DSA parameter set for the given public key
-// algorithm name.
-func mldsaParameters(algo string) (mldsa.Parameters, error) {
-	switch algo {
-	case KeyAlgoMLDSA44:
-		return mldsa.MLDSA44(), nil
-	case KeyAlgoMLDSA65:
-		return mldsa.MLDSA65(), nil
-	case KeyAlgoMLDSA87:
-		return mldsa.MLDSA87(), nil
-	default:
-		return mldsa.Parameters{}, fmt.Errorf("ssh: not an ML-DSA algorithm: %q", algo)
-	}
-}
-
-// mldsaKeyAlgo returns the public key algorithm name for the given ML-DSA
-// parameter set.
-func mldsaKeyAlgo(params mldsa.Parameters) string {
-	switch params {
-	case mldsa.MLDSA44():
-		return KeyAlgoMLDSA44
-	case mldsa.MLDSA65():
-		return KeyAlgoMLDSA65
-	case mldsa.MLDSA87():
-		return KeyAlgoMLDSA87
-	default:
-		panic("ssh: internal error: unknown ML-DSA parameter set: " + params.String())
-	}
-}
-
-// mldsaPublicKey implements PublicKey for the ML-DSA algorithms of [SSH-MLDSA].
-type mldsaPublicKey struct {
-	key *mldsa.PublicKey
-}
-
-func (k *mldsaPublicKey) Type() string {
-	return mldsaKeyAlgo(k.key.Parameters())
-}
-
-func parseMLDSA(in []byte, algo string) (out PublicKey, rest []byte, err error) {
-	params, err := mldsaParameters(algo)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	var w struct {
-		KeyBytes []byte
-		Rest     []byte `ssh:"rest"`
-	}
-
-	if err := Unmarshal(in, &w); err != nil {
-		return nil, nil, err
-	}
-
-	key, err := mldsa.NewPublicKey(params, w.KeyBytes)
-	if err != nil {
-		return nil, nil, fmt.Errorf("ssh: invalid %s public key: %v", params, err)
-	}
-
-	return &mldsaPublicKey{key: key}, w.Rest, nil
-}
-
-func (k *mldsaPublicKey) Marshal() []byte {
-	w := struct {
-		Name     string
-		KeyBytes []byte
-	}{
-		k.Type(),
-		k.key.Bytes(),
-	}
-	return Marshal(&w)
-}
-
-func (k *mldsaPublicKey) Verify(b []byte, sig *Signature) error {
-	if sig.Format != k.Type() {
-		return fmt.Errorf("ssh: signature type %s for key type %s", sig.Format, k.Type())
-	}
-	// nil options select pure ML-DSA with an empty context, as required by
-	// [SSH-MLDSA], Sections 6 and 8.
-	if err := mldsa.Verify(k.key, b, sig.Blob, nil); err != nil {
-		return errors.New("ssh: signature did not verify")
-	}
-
-	return nil
-}
-
-func (k *mldsaPublicKey) CryptoPublicKey() crypto.PublicKey {
-	return k.key
-}
-
-// newMLDSAPublicKey returns a PublicKey wrapping key.
-func newMLDSAPublicKey(key crypto.PublicKey) (PublicKey, error) {
-	k, ok := key.(*mldsa.PublicKey)
-	if !ok {
-		return nil, errNotMLDSAKey
-	}
-	if k == nil || *k == (mldsa.PublicKey{}) {
-		return nil, errors.New("ssh: invalid ML-DSA public key")
-	}
-	return &mldsaPublicKey{key: k}, nil
-}
diff -Nur /work/src-orig/azurefile-csi-driver/vendor/golang.org/x/crypto/ssh/mldsa_unsupported.go /work/src/azurefile-csi-driver/vendor/golang.org/x/crypto/ssh/mldsa_unsupported.go
--- a/vendor/golang.org/x/crypto/ssh/mldsa_unsupported.go	2026-10-22 12:25:12.274826580 +0000
+++ b/vendor/golang.org/x/crypto/ssh/mldsa_unsupported.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,29 +0,0 @@
-// Copyright 2026 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build !go1.27 || fips140v1.0
-
-package ssh
-
-import (
-	"crypto"
-	"errors"
-	"fmt"
-)
-
-var mldsaKeyAlgos, mldsaCertAlgos []string
-
-var errMLDSAUnsupported = fmt.Errorf("ssh: ML-DSA is not available in this build: %w",
-	errors.ErrUnsupported)
-
-var errNotMLDSAKey = errors.New("ssh: not an ML-DSA key")
-
-func parseMLDSA(in []byte, algo string) (out PublicKey, rest []byte, err error) {
-	return nil, nil, errMLDSAUnsupported
-}
-
-func newMLDSAPublicKey(key crypto.PublicKey) (PublicKey, error) {
-	// In this version of Go, *mldsa.PublicKey does not exist.
-	return nil, errNotMLDSAKey
-}
diff -Nur /work/src-orig/azurefile-csi-driver/vendor/modules.txt /work/src/azurefile-csi-driver/vendor/modules.txt
--- a/vendor/modules.txt	2026-10-22 12:25:12.630825210 +0000
+++ b/vendor/modules.txt	2026-10-22 12:26:14.346585006 +0000
@@ -557,7 +557,7 @@
 # go.yaml.in/yaml/v3 v3.0.5
 ## explicit; go 1.16
 go.yaml.in/yaml/v3
-# golang.org/x/crypto v0.58.0
+# golang.org/x/crypto v0.58.0 => golang.org/x/crypto v0.56.0
 ## explicit; go 1.26.0
 golang.org/x/crypto/blowfish
 golang.org/x/crypto/chacha20
@@ -576,7 +576,7 @@
 # golang.org/x/mod v0.41.0
 ## explicit; go 1.26.0
 golang.org/x/mod/semver
-# golang.org/x/net v0.61.0
+# golang.org/x/net v0.61.0 => golang.org/x/net v0.60.0
 ## explicit; go 1.26.0
 golang.org/x/net/context
 golang.org/x/net/html
@@ -1666,3 +1666,5 @@
 # k8s.io/kubelet => k8s.io/kubelet v0.32.2
 # k8s.io/legacy-cloud-providers => k8s.io/legacy-cloud-providers v0.34.1
 # k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.34.1
+# golang.org/x/crypto => golang.org/x/crypto v0.56.0
+# golang.org/x/net => golang.org/x/net v0.60.0
