--- a/go.mod
+++ b/go.mod
@@ -36,10 +36,10 @@
 	go.opentelemetry.io/otel/sdk v1.45.0
 	go.opentelemetry.io/otel/trace v1.45.0
 	go.yaml.in/yaml/v2 v2.4.4
-	golang.org/x/crypto v0.57.0
-	golang.org/x/net v0.59.0
+	golang.org/x/crypto v0.58.0
+	golang.org/x/net v0.60.0
 	golang.org/x/oauth2 v0.36.0
-	golang.org/x/sync v0.23.0
+	golang.org/x/sync v0.24.0
 	google.golang.org/api v0.264.0
 )
 
@@ -96,7 +96,7 @@
 	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.21.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 // indirect
 	go.opentelemetry.io/otel/exporters/prometheus v0.64.0 // indirect
@@ -108,8 +108,8 @@
 	go.opentelemetry.io/otel/sdk/metric v1.45.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.11.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
-	golang.org/x/sys v0.48.0 // indirect
-	golang.org/x/text v0.42.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
+	golang.org/x/text v0.43.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
 	google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d // indirect
@@ -117,3 +117,15 @@
 	google.golang.org/grpc v1.83.2 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 )
+
+replace github.com/go-jose/go-jose/v4 => github.com/go-jose/go-jose/v4 v4.1.6
+
+replace github.com/klauspost/compress => github.com/klauspost/compress v1.18.7
+
+replace go.opentelemetry.io/otel/exporters/otlp/otlptrace => go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0
+
+replace go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc => go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0
+
+replace go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp => go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.45.0
+
+replace golang.org/x/net => golang.org/x/net v0.62.0
--- a/go.sum
+++ b/go.sum
@@ -96,8 +96,8 @@
 github.com/envoyproxy/protoc-gen-validate v1.3.3/go.mod h1:TsndJ/ngyIdQRhMcVVGDDHINPLWB7C82oDArY51KfB0=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
-github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-jose/go-jose/v4 v4.1.6 h1:sNRkftxFJxwsILiQukqp5z83QBSmntVwmgRY7AqBDO4=
+github.com/go-jose/go-jose/v4 v4.1.6/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
 github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
@@ -138,8 +138,8 @@
 github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
 github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRtuthU=
 github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXwkPPMeUgOK1k=
-github.com/klauspost/compress v1.18.4 h1:RPhnKRAQ4Fh8zU2FY/6ZFDwTVTxgJ/EMydqSTzE9a2c=
-github.com/klauspost/compress v1.18.4/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
+github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw=
+github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
@@ -218,12 +218,12 @@
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0/go.mod h1:RolT8tWtfHcjajEH5wFIZ4Dgh5jpPdFXYV9pTAk/qjc=
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0 h1:w1K+pCJoPpQifuVpsKamUdn9U0zM3xUziVOqsGksUrY=
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0/go.mod h1:HBy4BjzgVE8139ieRI75oXm3EcDN+6GhD88JT1Kjvxg=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 h1:88Y4s2C8oTui1LGM6bTWkw0ICGcOLCAI5l6zsD1j20k=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0/go.mod h1:Vl1/iaggsuRlrHf/hfPJPvVag77kKyvrLeD10kpMl+A=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 h1:zWWrB1U6nqhS/k6zYB74CjRpuiitRtLLi68VcgmOEto=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0/go.mod h1:2qXPNBX1OVRC0IwOnfo1ljoid+RD0QK3443EaqVlsOU=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 h1:3iZJKlCZufyRzPzlQhUIWVmfltrXuGyfjREgGP3UUjc=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0/go.mod h1:/G+nUPfhq2e+qiXMGxMwumDrP5jtzU+mWN7/sjT2rak=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 h1:QRefszxJmfPdjXUUm3j6iDzY03mTPXMjqErFqQ67vUg=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0/go.mod h1:Tiz03lTBVBrm7eWZBOidzEaYaJa8tjwGUGv6d8mlTyk=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0 h1:fG5MCxGz8+2VtrN/WgqSpJFctVz24gpxj8CxkKmc8Ww=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0/go.mod h1:BmAYTn+3ysbRe+IU2msxmf5Rx3g6DHvex+tWI3LdhYI=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.45.0 h1:QBajQ2SrwQijzHyZbQlPsuIzpl/ll8DY6wPWsajeGcI=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.45.0/go.mod h1:08ZQLjrPLQ6R4kAXvuOvODEer5Yh4CoFvll5qB2BCI8=
 go.opentelemetry.io/otel/exporters/prometheus v0.64.0 h1:g0LRDXMX/G1SEZtK8zl8Chm4K6GBwRkjPKE36LxiTYs=
 go.opentelemetry.io/otel/exporters/prometheus v0.64.0/go.mod h1:UrgcjnarfdlBDP3GjDIJWe6HTprwSazNjwsI+Ru6hro=
 go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.21.0 h1:2lpf4hnrasYIsUyEXwnTZq5lsxrMm4T2Bwb06IctAZQ=
@@ -257,21 +257,21 @@
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
-golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
-golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
-golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
-golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY=
+golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
-golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
-golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
+golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
-golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
-golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
-golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
 golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
 golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
diff -Nur /work/src-orig/docker-registry/vendor/github.com/go-jose/go-jose/v4/asymmetric.go /work/src/docker-registry/vendor/github.com/go-jose/go-jose/v4/asymmetric.go
--- a/vendor/github.com/go-jose/go-jose/v4/asymmetric.go	2026-10-28 10:49:46.339005795 +0000
+++ b/vendor/github.com/go-jose/go-jose/v4/asymmetric.go	2026-10-28 10:50:32.878773202 +0000
@@ -21,6 +21,7 @@
 	"crypto/aes"
 	"crypto/ecdsa"
 	"crypto/ed25519"
+	"crypto/elliptic"
 	"crypto/rand"
 	"crypto/rsa"
 	"crypto/sha1"
@@ -195,11 +196,11 @@
 func (ctx rsaEncrypterVerifier) encrypt(cek []byte, alg KeyAlgorithm) ([]byte, error) {
 	switch alg {
 	case RSA1_5:
-		return rsa.EncryptPKCS1v15(RandReader, ctx.publicKey, cek)
+		return rsa.EncryptPKCS1v15(randReader, ctx.publicKey, cek)
 	case RSA_OAEP:
-		return rsa.EncryptOAEP(sha1.New(), RandReader, ctx.publicKey, cek, []byte{})
+		return rsa.EncryptOAEP(sha1.New(), randReader, ctx.publicKey, cek, []byte{})
 	case RSA_OAEP_256:
-		return rsa.EncryptOAEP(sha256.New(), RandReader, ctx.publicKey, cek, []byte{})
+		return rsa.EncryptOAEP(sha256.New(), randReader, ctx.publicKey, cek, []byte{})
 	}
 
 	return nil, ErrUnsupportedAlgorithm
@@ -288,9 +289,9 @@
 		// TODO(https://github.com/go-jose/go-jose/issues/40): As of go1.20, the
 		// random parameter is legacy and ignored, and it can be nil.
 		// https://cs.opensource.google/go/go/+/refs/tags/go1.20:src/crypto/rsa/pkcs1v15.go;l=263;bpv=0;bpt=1
-		out, err = rsa.SignPKCS1v15(RandReader, ctx.privateKey, hash, hashed)
+		out, err = rsa.SignPKCS1v15(randReader, ctx.privateKey, hash, hashed)
 	case PS256, PS384, PS512:
-		out, err = rsa.SignPSS(RandReader, ctx.privateKey, hash, hashed, &rsa.PSSOptions{
+		out, err = rsa.SignPSS(randReader, ctx.privateKey, hash, hashed, &rsa.PSSOptions{
 			SaltLength: rsa.PSSSaltLengthEqualsHash,
 		})
 	}
@@ -391,7 +392,7 @@
 
 // Get a content encryption key for ECDH-ES
 func (ctx ecKeyGenerator) genKey() ([]byte, rawHeader, error) {
-	priv, err := ecdsa.GenerateKey(ctx.publicKey.Curve, RandReader)
+	priv, err := ecdsa.GenerateKey(ctx.publicKey.Curve, randReader)
 	if err != nil {
 		return nil, rawHeader{}, err
 	}
@@ -483,7 +484,7 @@
 		return Signature{}, ErrUnsupportedAlgorithm
 	}
 
-	sig, err := ctx.privateKey.Sign(RandReader, payload, crypto.Hash(0))
+	sig, err := ctx.privateKey.Sign(randReader, payload, crypto.Hash(0))
 	if err != nil {
 		return Signature{}, err
 	}
@@ -533,7 +534,7 @@
 	_, _ = hasher.Write(payload)
 	hashed := hasher.Sum(nil)
 
-	r, s, err := ecdsa.Sign(RandReader, ctx.privateKey, hashed)
+	r, s, err := ecdsa.Sign(randReader, ctx.privateKey, hashed)
 	if err != nil {
 		return Signature{}, err
 	}
@@ -571,12 +572,21 @@
 	case ES256:
 		keySize = 32
 		hash = crypto.SHA256
+		if ctx.publicKey.Curve != elliptic.P256() {
+			return fmt.Errorf("go-jose/go-jose: signature uses different algorithm than public key")
+		}
 	case ES384:
 		keySize = 48
 		hash = crypto.SHA384
+		if ctx.publicKey.Curve != elliptic.P384() {
+			return fmt.Errorf("go-jose/go-jose: signature uses different algorithm than public key")
+		}
 	case ES512:
 		keySize = 66
 		hash = crypto.SHA512
+		if ctx.publicKey.Curve != elliptic.P521() {
+			return fmt.Errorf("go-jose/go-jose: signature uses different algorithm than public key")
+		}
 	default:
 		return ErrUnsupportedAlgorithm
 	}
diff -Nur /work/src-orig/docker-registry/vendor/github.com/go-jose/go-jose/v4/cipher/cbc_hmac.go /work/src/docker-registry/vendor/github.com/go-jose/go-jose/v4/cipher/cbc_hmac.go
--- a/vendor/github.com/go-jose/go-jose/v4/cipher/cbc_hmac.go	2026-10-28 10:49:46.339005795 +0000
+++ b/vendor/github.com/go-jose/go-jose/v4/cipher/cbc_hmac.go	2026-10-28 10:50:32.878773202 +0000
@@ -51,6 +51,8 @@
 		hash = sha512.New384
 	case 32:
 		hash = sha512.New
+	default:
+		return nil, errors.New("go-jose/go-jose: invalid key size for CBC-HMAC")
 	}
 
 	return &cbcAEAD{
@@ -176,7 +178,9 @@
 
 // Remove padding
 func unpadBuffer(buffer []byte, blockSize int) ([]byte, error) {
-	if len(buffer)%blockSize != 0 {
+	// A padded buffer can't be empty because an empty input is padded with
+	// `blockSize` bytes, resulting in a non-empty ciphertext.
+	if len(buffer) == 0 || len(buffer)%blockSize != 0 {
 		return nil, errors.New("go-jose/go-jose: invalid padding")
 	}
 
diff -Nur /work/src-orig/docker-registry/vendor/github.com/go-jose/go-jose/v4/crypter.go /work/src/docker-registry/vendor/github.com/go-jose/go-jose/v4/crypter.go
--- a/vendor/github.com/go-jose/go-jose/v4/crypter.go	2026-10-28 10:49:46.339005795 +0000
+++ b/vendor/github.com/go-jose/go-jose/v4/crypter.go	2026-10-28 10:50:32.878773202 +0000
@@ -258,6 +258,10 @@
 	}
 
 	recipientInfo, err = makeJWERecipient(recipient.Algorithm, recipient.Key)
+	if err != nil {
+		return err
+	}
+
 	if recipient.KeyID != "" {
 		recipientInfo.keyID = recipient.KeyID
 	}
@@ -270,10 +274,8 @@
 		}
 	}
 
-	if err == nil {
-		ctx.recipients = append(ctx.recipients, recipientInfo)
-	}
-	return err
+	ctx.recipients = append(ctx.recipients, recipientInfo)
+	return nil
 }
 
 func makeJWERecipient(alg KeyAlgorithm, encryptionKey interface{}) (recipientKeyInfo, error) {
@@ -426,6 +428,13 @@
 	}
 }
 
+func validateContentEncryptionKeySize(cek []byte, cipher contentCipher) error {
+	if len(cek) != cipher.keySize() {
+		return ErrInvalidKeySize
+	}
+	return nil
+}
+
 // Decrypt and validate the object and return the plaintext. This
 // function does not support multi-recipient. If you desire multi-recipient
 // decryption use DecryptMulti instead.
@@ -490,21 +499,23 @@
 	recipientHeaders := obj.mergedHeaders(&recipient)
 
 	cek, err := decrypter.decryptKey(recipientHeaders, &recipient, generator)
-	if err == nil {
-		// Found a valid CEK -- let's try to decrypt.
-		plaintext, err = cipher.decrypt(cek, authData, parts)
+	if err != nil {
+		return nil, ErrCryptoFailure
+	}
+	err = validateContentEncryptionKeySize(cek, cipher)
+	if err != nil {
+		return nil, ErrCryptoFailure
 	}
 
-	if plaintext == nil {
+	// Found a valid CEK -- let's try to decrypt.
+	plaintext, err = cipher.decrypt(cek, authData, parts)
+	if err != nil {
 		return nil, ErrCryptoFailure
 	}
 
-	// The "zip" header parameter may only be present in the protected header.
-	if comp := obj.protected.getCompression(); comp != "" {
-		plaintext, err = decompress(comp, plaintext)
-		if err != nil {
-			return nil, fmt.Errorf("go-jose/go-jose: failed to decompress plaintext: %v", err)
-		}
+	plaintext, err = obj.decompress(plaintext)
+	if err != nil {
+		return nil, err
 	}
 
 	return plaintext, nil
@@ -559,31 +570,42 @@
 	var plaintext []byte
 	var headers rawHeader
 
+	if len(obj.recipients) == 0 {
+		return -1, Header{}, nil, errors.New("go-jose/go-jose: no recipients")
+	}
+
+	// Loop sets `err` in the function scope; don't shadow it.
 	for i, recipient := range obj.recipients {
 		recipientHeaders := obj.mergedHeaders(&recipient)
 
-		cek, err := decrypter.decryptKey(recipientHeaders, &recipient, generator)
-		if err == nil {
-			// Found a valid CEK -- let's try to decrypt.
-			plaintext, err = cipher.decrypt(cek, authData, parts)
-			if err == nil {
-				index = i
-				headers = recipientHeaders
-				break
-			}
+		var cek []byte
+		cek, err = decrypter.decryptKey(recipientHeaders, &recipient, generator)
+		if err != nil {
+			continue
 		}
+		err = validateContentEncryptionKeySize(cek, cipher)
+		if err != nil {
+			continue
+		}
+
+		// Found a valid CEK -- let's try to decrypt.
+		plaintext, err = cipher.decrypt(cek, authData, parts)
+		if err != nil {
+			continue
+		}
+
+		index = i
+		headers = recipientHeaders
+		break
 	}
 
-	if plaintext == nil {
+	if err != nil {
 		return -1, Header{}, nil, ErrCryptoFailure
 	}
 
-	// The "zip" header parameter may only be present in the protected header.
-	if comp := obj.protected.getCompression(); comp != "" {
-		plaintext, err = decompress(comp, plaintext)
-		if err != nil {
-			return -1, Header{}, nil, fmt.Errorf("go-jose/go-jose: failed to decompress plaintext: %v", err)
-		}
+	plaintext, err = obj.decompress(plaintext)
+	if err != nil {
+		return -1, Header{}, nil, err
 	}
 
 	sanitized, err := headers.sanitized()
@@ -593,3 +615,22 @@
 
 	return index, sanitized, plaintext, err
 }
+
+// decompress decompresses plaintext using the protected "zip" header, if present.
+// It returns plaintext unchanged when there is no protected header or "zip" value.
+func (obj JSONWebEncryption) decompress(plaintext []byte) ([]byte, error) {
+	if obj.protected == nil {
+		return plaintext, nil
+	}
+
+	comp := obj.protected.getCompression()
+	if comp == "" {
+		return plaintext, nil
+	}
+
+	plaintext, err := decompress(comp, plaintext)
+	if err != nil {
+		return nil, fmt.Errorf("go-jose/go-jose: failed to decompress plaintext: %v", err)
+	}
+	return plaintext, nil
+}
diff -Nur /work/src-orig/docker-registry/vendor/github.com/go-jose/go-jose/v4/json/scanner.go /work/src/docker-registry/vendor/github.com/go-jose/go-jose/v4/json/scanner.go
--- a/vendor/github.com/go-jose/go-jose/v4/json/scanner.go	2026-10-28 10:49:46.339005795 +0000
+++ b/vendor/github.com/go-jose/go-jose/v4/json/scanner.go	2026-10-28 10:50:32.878773202 +0000
@@ -140,6 +140,10 @@
 	parseArrayValue         // parsing array value
 )
 
+// This limits the max nesting depth to prevent stack overflow.
+// This is permitted by https://tools.ietf.org/html/rfc7159#section-9
+const maxNestingDepth = 10000
+
 // reset prepares the scanner for use.
 // It must be called before calling s.step.
 func (s *scanner) reset() {
@@ -170,8 +174,13 @@
 }
 
 // pushParseState pushes a new parse state p onto the parse stack.
-func (s *scanner) pushParseState(p int) {
-	s.parseState = append(s.parseState, p)
+// an error state is returned if maxNestingDepth was exceeded, otherwise successState is returned.
+func (s *scanner) pushParseState(c byte, newParseState int, successState int) int {
+	s.parseState = append(s.parseState, newParseState)
+	if len(s.parseState) <= maxNestingDepth {
+		return successState
+	}
+	return s.error(c, "exceeded max depth")
 }
 
 // popParseState pops a parse state (already obtained) off the stack
@@ -211,12 +220,10 @@
 	switch c {
 	case '{':
 		s.step = stateBeginStringOrEmpty
-		s.pushParseState(parseObjectKey)
-		return scanBeginObject
+		return s.pushParseState(c, parseObjectKey, scanBeginObject)
 	case '[':
 		s.step = stateBeginValueOrEmpty
-		s.pushParseState(parseArrayValue)
-		return scanBeginArray
+		return s.pushParseState(c, parseArrayValue, scanBeginArray)
 	case '"':
 		s.step = stateInString
 		return scanBeginLiteral
diff -Nur /work/src-orig/docker-registry/vendor/github.com/go-jose/go-jose/v4/jwe.go /work/src/docker-registry/vendor/github.com/go-jose/go-jose/v4/jwe.go
--- a/vendor/github.com/go-jose/go-jose/v4/jwe.go	2026-10-28 10:49:46.339005795 +0000
+++ b/vendor/github.com/go-jose/go-jose/v4/jwe.go	2026-10-28 10:50:32.878773202 +0000
@@ -153,6 +153,10 @@
 	keyEncryptionAlgorithms []KeyAlgorithm,
 	contentEncryption []ContentEncryption,
 ) (*JSONWebEncryption, error) {
+	if len(input) == 0 {
+		return nil, errEmptyInput
+	}
+
 	var parsed rawJSONWebEncryption
 	err := json.Unmarshal([]byte(input), &parsed)
 	if err != nil {
@@ -198,15 +202,6 @@
 		}
 	}
 
-	// Note: this must be called _after_ we parse the protected header,
-	// otherwise fields from the protected header will not get picked up.
-	var err error
-	mergedHeaders := obj.mergedHeaders(nil)
-	obj.Header, err = mergedHeaders.sanitized()
-	if err != nil {
-		return nil, fmt.Errorf("go-jose/go-jose: cannot sanitize merged headers: %v (%v)", err, mergedHeaders)
-	}
-
 	if len(parsed.Recipients) == 0 {
 		obj.recipients = []recipientInfo{
 			{
@@ -260,6 +255,15 @@
 		}
 	}
 
+	// Note: this must be called _after_ we parse the protected header,
+	// otherwise fields from the protected header will not get picked up.
+	mergedHeaders := obj.mergedHeaders(nil)
+	var err error
+	obj.Header, err = mergedHeaders.sanitized()
+	if err != nil {
+		return nil, fmt.Errorf("go-jose/go-jose: cannot sanitize merged headers: %w", err)
+	}
+
 	obj.iv = parsed.Iv.bytes()
 	obj.ciphertext = parsed.Ciphertext.bytes()
 	obj.tag = parsed.Tag.bytes()
@@ -291,6 +295,10 @@
 	var parts [5]string
 	var ok bool
 
+	if len(input) == 0 {
+		return nil, errEmptyInput
+	}
+
 	for i := range 4 {
 		parts[i], input, ok = strings.Cut(input, ".")
 		if !ok {
diff -Nur /work/src-orig/docker-registry/vendor/github.com/go-jose/go-jose/v4/jwk.go /work/src/docker-registry/vendor/github.com/go-jose/go-jose/v4/jwk.go
--- a/vendor/github.com/go-jose/go-jose/v4/jwk.go	2026-10-28 10:49:46.343005775 +0000
+++ b/vendor/github.com/go-jose/go-jose/v4/jwk.go	2026-10-28 10:50:32.878773202 +0000
@@ -107,7 +107,7 @@
 
 	switch key := k.Key.(type) {
 	case ed25519.PublicKey:
-		raw = fromEdPublicKey(key)
+		raw, err = fromEdPublicKey(key)
 	case *ecdsa.PublicKey:
 		raw, err = fromEcPublicKey(key)
 	case *rsa.PublicKey:
@@ -177,13 +177,29 @@
 // UnmarshalJSON reads a key from its JSON representation.
 //
 // Returns ErrUnsupportedKeyType for unrecognized or unsupported "kty" header values.
-func (k *JSONWebKey) UnmarshalJSON(data []byte) (err error) {
+//
+// Directly unmarshaling a JWK is not safe for untrusted input.
+func (k *JSONWebKey) UnmarshalJSON(data []byte) error {
+	return k.unmarshalJSON(data, true)
+}
+
+// unmarshalJSON reads a key from its JSON representation.
+//
+// If allowPrivate is false, a JWK with private key material is rejected and the
+// function is safe for use against untrusted input.
+func (k *JSONWebKey) unmarshalJSON(data []byte, allowPrivate bool) (err error) {
 	var raw rawJSONWebKey
 	err = json.Unmarshal(data, &raw)
 	if err != nil {
 		return err
 	}
 
+	if !allowPrivate &&
+		(raw.K != nil || raw.D != nil || raw.P != nil || raw.Q != nil ||
+			raw.Dp != nil || raw.Dq != nil || raw.Qi != nil) {
+		return errors.New("go-jose/go-jose: JWK contains private parameters")
+	}
+
 	certs, err := parseCertificateChain(raw.X5c)
 	if err != nil {
 		return fmt.Errorf("go-jose/go-jose: failed to unmarshal x5c field: %s", err)
@@ -207,21 +223,29 @@
 	case "EC":
 		if raw.D != nil {
 			key, err = raw.ecPrivateKey()
-			if err == nil {
-				keyPub = key.(*ecdsa.PrivateKey).Public()
+			if err != nil {
+				return err
 			}
+			keyPub = key.(*ecdsa.PrivateKey).Public()
 		} else {
 			key, err = raw.ecPublicKey()
+			if err != nil {
+				return err
+			}
 			keyPub = key
 		}
 	case "RSA":
 		if raw.D != nil {
 			key, err = raw.rsaPrivateKey()
-			if err == nil {
-				keyPub = key.(*rsa.PrivateKey).Public()
+			if err != nil {
+				return err
 			}
+			keyPub = key.(*rsa.PrivateKey).Public()
 		} else {
 			key, err = raw.rsaPublicKey()
+			if err != nil {
+				return err
+			}
 			keyPub = key
 		}
 	case "oct":
@@ -229,25 +253,28 @@
 			return errors.New("go-jose/go-jose: invalid JWK, found 'oct' (symmetric) key with cert chain")
 		}
 		key, err = raw.symmetricKey()
+		if err != nil {
+			return err
+		}
 	case "OKP":
 		if raw.Crv == "Ed25519" {
 			if raw.D != nil {
 				key, err = raw.edPrivateKey()
-				if err == nil {
-					keyPub = key.(ed25519.PrivateKey).Public()
+				if err != nil {
+					return err
 				}
+				keyPub = key.(ed25519.PrivateKey).Public()
 			} else {
 				key, err = raw.edPublicKey()
+				if err != nil {
+					return err
+				}
 				keyPub = key
 			}
 		}
 	case "":
 		// kty MUST be present
-		err = fmt.Errorf("go-jose/go-jose: missing json web key type")
-	}
-
-	if err != nil {
-		return
+		return fmt.Errorf("go-jose/go-jose: missing json web key type")
 	}
 
 	if key == nil {
@@ -388,11 +415,12 @@
 
 func edThumbprintInput(ed ed25519.PublicKey) (string, error) {
 	crv := "Ed25519"
-	if len(ed) > 32 {
-		return "", errors.New("go-jose/go-jose: invalid elliptic key (too large)")
+	err := validateEd25519PublicKey(ed)
+	if err != nil {
+		return "", err
 	}
 	return fmt.Sprintf(edThumbprintTemplate, crv,
-		newFixedSizeBuffer(ed, 32).base64()), nil
+		newFixedSizeBuffer(ed, ed25519.PublicKeySize).base64()), nil
 }
 
 // Thumbprint computes the JWK Thumbprint of a key using the
@@ -493,23 +521,39 @@
 	return true
 }
 
+// MaxRSAModulusBits is the largest RSA modulus size, in bits, that will be
+// accepted when parsing a JWK. Applications that need larger keys can raise
+// this limit.
+//
+// If modifying MaxRSAModulusBits, do it before any parsing occurs.
+var MaxRSAModulusBits = 4096
+
 func (key rawJSONWebKey) rsaPublicKey() (*rsa.PublicKey, error) {
 	if key.N == nil || key.E == nil {
 		return nil, fmt.Errorf("go-jose/go-jose: invalid RSA key, missing n/e values")
 	}
 
+	n := key.N.bigInt()
+	if n.BitLen() > MaxRSAModulusBits {
+		return nil, fmt.Errorf("go-jose/go-jose: invalid RSA key, modulus too large")
+	}
+
 	return &rsa.PublicKey{
-		N: key.N.bigInt(),
+		N: n,
 		E: key.E.toInt(),
 	}, nil
 }
 
-func fromEdPublicKey(pub ed25519.PublicKey) *rawJSONWebKey {
+func fromEdPublicKey(pub ed25519.PublicKey) (*rawJSONWebKey, error) {
+	err := validateEd25519PublicKey(pub)
+	if err != nil {
+		return nil, err
+	}
 	return &rawJSONWebKey{
 		Kty: "OKP",
 		Crv: "Ed25519",
 		X:   newBuffer(pub),
-	}
+	}, nil
 }
 
 func fromRsaPublicKey(pub *rsa.PublicKey) *rawJSONWebKey {
@@ -604,21 +648,36 @@
 		return nil, fmt.Errorf("go-jose/go-jose: invalid Ed25519 private key, missing %s value(s)", strings.Join(missing, ", "))
 	}
 
-	privateKey := make([]byte, ed25519.PrivateKeySize)
-	copy(privateKey[0:32], key.D.bytes())
-	copy(privateKey[32:], key.X.bytes())
-	rv := ed25519.PrivateKey(privateKey)
-	return rv, nil
+	publicKey := key.X.bytes()
+	err := validateEd25519PublicKey(publicKey)
+	if err != nil {
+		return nil, err
+	}
+
+	seed := key.D.bytes()
+	if len(seed) != ed25519.SeedSize {
+		return nil, fmt.Errorf("go-jose/go-jose: invalid Ed25519 private key, wrong length for d")
+	}
+
+	privateKey := ed25519.NewKeyFromSeed(seed)
+	derivedPublicKey := privateKey.Public().(ed25519.PublicKey)
+	if !bytes.Equal(derivedPublicKey, publicKey) {
+		return nil, errors.New("go-jose/go-jose: invalid Ed25519 private key, x does not match d")
+	}
+
+	return privateKey, nil
 }
 
 func (key rawJSONWebKey) edPublicKey() (ed25519.PublicKey, error) {
 	if key.X == nil {
 		return nil, fmt.Errorf("go-jose/go-jose: invalid Ed key, missing x value")
 	}
-	publicKey := make([]byte, ed25519.PublicKeySize)
-	copy(publicKey[0:32], key.X.bytes())
-	rv := ed25519.PublicKey(publicKey)
-	return rv, nil
+	publicKey := key.X.bytes()
+	err := validateEd25519PublicKey(publicKey)
+	if err != nil {
+		return nil, err
+	}
+	return ed25519.PublicKey(bytes.Clone(publicKey)), nil
 }
 
 func (key rawJSONWebKey) rsaPrivateKey() (*rsa.PrivateKey, error) {
@@ -642,16 +701,23 @@
 		return nil, fmt.Errorf("go-jose/go-jose: invalid RSA private key, missing %s value(s)", strings.Join(missing, ", "))
 	}
 
+	n := key.N.bigInt()
+	if n.BitLen() > MaxRSAModulusBits {
+		return nil, fmt.Errorf("go-jose/go-jose: invalid RSA key, modulus too large")
+	}
+
+	p, q := key.P.bigInt(), key.Q.bigInt()
+	if p.BitLen()+q.BitLen() > n.BitLen()+1 || new(big.Int).Mul(p, q).Cmp(n) != 0 {
+		return nil, errors.New("go-jose/go-jose: invalid RSA private key, p * q != n")
+	}
+
 	rv := &rsa.PrivateKey{
 		PublicKey: rsa.PublicKey{
-			N: key.N.bigInt(),
+			N: n,
 			E: key.E.toInt(),
 		},
-		D: key.D.bigInt(),
-		Primes: []*big.Int{
-			key.P.bigInt(),
-			key.Q.bigInt(),
-		},
+		D:      key.D.bigInt(),
+		Primes: []*big.Int{p, q},
 	}
 
 	if key.Dp != nil {
@@ -669,9 +735,17 @@
 }
 
 func fromEdPrivateKey(ed ed25519.PrivateKey) (*rawJSONWebKey, error) {
-	raw := fromEdPublicKey(ed25519.PublicKey(ed[32:]))
+	if len(ed) != ed25519.PrivateKeySize {
+		return nil, errors.New("go-jose/go-jose: invalid Ed25519 private key length")
+	}
 
-	raw.D = newBuffer(ed[0:32])
+	publicKey := ed.Public().(ed25519.PublicKey)
+	raw, err := fromEdPublicKey(publicKey)
+	if err != nil {
+		return nil, err
+	}
+
+	raw.D = newBuffer(ed.Seed())
 	return raw, nil
 }
 
@@ -810,7 +884,7 @@
 	ErrJWKSKidNotFound = errors.New("go-jose/go-jose: JWK with matching kid not found in JWK Set")
 )
 
-func tryJWKS(key interface{}, headers ...Header) (interface{}, error) {
+func tryJWKS(key interface{}, header Header) (interface{}, error) {
 	var jwks JSONWebKeySet
 
 	switch jwksType := key.(type) {
@@ -823,16 +897,8 @@
 		return key, nil
 	}
 
-	// Determine the KID to search for from the headers.
-	var kid string
-	for _, header := range headers {
-		if header.KeyID != "" {
-			kid = header.KeyID
-			break
-		}
-	}
-
-	// If no KID is specified in the headers, reject.
+	// If no KID is specified in the header, reject.
+	kid := header.KeyID
 	if kid == "" {
 		return nil, ErrJWKSKidNotFound
 	}
@@ -846,3 +912,107 @@
 
 	return keys[0].Key, nil
 }
+
+// weakEd25519PublicKeys contains the low-order Ed25519 encodings accepted by
+// Go's verifier that must not be accepted as JOSE verification keys.
+var weakEd25519PublicKeys = map[[ed25519.PublicKeySize]byte]struct{}{
+	{
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	}: {},
+	{
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80,
+	}: {},
+	{
+		0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	}: {},
+	{
+		0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80,
+	}: {},
+	{
+		0x26, 0xe8, 0x95, 0x8f, 0xc2, 0xb2, 0x27, 0xb0,
+		0x45, 0xc3, 0xf4, 0x89, 0xf2, 0xef, 0x98, 0xf0,
+		0xd5, 0xdf, 0xac, 0x05, 0xd3, 0xc6, 0x33, 0x39,
+		0xb1, 0x38, 0x02, 0x88, 0x6d, 0x53, 0xfc, 0x05,
+	}: {},
+	{
+		0x26, 0xe8, 0x95, 0x8f, 0xc2, 0xb2, 0x27, 0xb0,
+		0x45, 0xc3, 0xf4, 0x89, 0xf2, 0xef, 0x98, 0xf0,
+		0xd5, 0xdf, 0xac, 0x05, 0xd3, 0xc6, 0x33, 0x39,
+		0xb1, 0x38, 0x02, 0x88, 0x6d, 0x53, 0xfc, 0x85,
+	}: {},
+	{
+		0xc7, 0x17, 0x6a, 0x70, 0x3d, 0x4d, 0xd8, 0x4f,
+		0xba, 0x3c, 0x0b, 0x76, 0x0d, 0x10, 0x67, 0x0f,
+		0x2a, 0x20, 0x53, 0xfa, 0x2c, 0x39, 0xcc, 0xc6,
+		0x4e, 0xc7, 0xfd, 0x77, 0x92, 0xac, 0x03, 0x7a,
+	}: {},
+	{
+		0xc7, 0x17, 0x6a, 0x70, 0x3d, 0x4d, 0xd8, 0x4f,
+		0xba, 0x3c, 0x0b, 0x76, 0x0d, 0x10, 0x67, 0x0f,
+		0x2a, 0x20, 0x53, 0xfa, 0x2c, 0x39, 0xcc, 0xc6,
+		0x4e, 0xc7, 0xfd, 0x77, 0x92, 0xac, 0x03, 0xfa,
+	}: {},
+	{
+		0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f,
+	}: {},
+	{
+		0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	}: {},
+	{
+		0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f,
+	}: {},
+	{
+		0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	}: {},
+	{
+		0xee, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f,
+	}: {},
+	{
+		0xee, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	}: {},
+}
+
+func validateEd25519PublicKey(publicKey ed25519.PublicKey) error {
+	if len(publicKey) != ed25519.PublicKeySize {
+		return fmt.Errorf("go-jose/go-jose: invalid Ed25519 public key, wrong length for x")
+	}
+
+	var encoded [ed25519.PublicKeySize]byte
+	copy(encoded[:], publicKey)
+	_, ok := weakEd25519PublicKeys[encoded]
+	if ok {
+		return errors.New("go-jose/go-jose: invalid Ed25519 public key, low-order point")
+	}
+
+	return nil
+}
diff -Nur /work/src-orig/docker-registry/vendor/github.com/go-jose/go-jose/v4/jws.go /work/src/docker-registry/vendor/github.com/go-jose/go-jose/v4/jws.go
--- a/vendor/github.com/go-jose/go-jose/v4/jws.go	2026-10-28 10:49:46.343005775 +0000
+++ b/vendor/github.com/go-jose/go-jose/v4/jws.go	2026-10-28 10:50:32.878773202 +0000
@@ -22,6 +22,7 @@
 	"errors"
 	"fmt"
 	"strings"
+	"unicode"
 
 	"github.com/go-jose/go-jose/v4/json"
 )
@@ -89,12 +90,12 @@
 	signature string,
 	signatureAlgorithms []SignatureAlgorithm,
 ) (*JSONWebSignature, error) {
-	signature = stripWhitespace(signature)
-	if strings.HasPrefix(signature, "{") {
+	trimmed := strings.TrimLeftFunc(signature, unicode.IsSpace)
+	if strings.HasPrefix(trimmed, "{") {
 		return ParseSignedJSON(signature, signatureAlgorithms)
 	}
 
-	return parseSignedCompact(signature, nil, signatureAlgorithms)
+	return parseSignedCompact(stripWhitespace(signature), nil, signatureAlgorithms)
 }
 
 // ParseSignedCompact parses a message in JWS Compact Serialization. Validation fails if the JWS is
@@ -186,6 +187,10 @@
 	input string,
 	signatureAlgorithms []SignatureAlgorithm,
 ) (*JSONWebSignature, error) {
+	if len(input) == 0 {
+		return nil, errEmptyInput
+	}
+
 	var parsed rawJSONWebSignature
 	err := json.Unmarshal([]byte(input), &parsed)
 	if err != nil {
@@ -270,17 +275,18 @@
 			Signature: parsed.Signature,
 		}
 
+		mergedHeaders := signature.mergedHeaders()
+		alg := mergedHeaders.getSignatureAlgorithm()
+		if !containsSignatureAlgorithm(signatureAlgorithms, alg) {
+			return nil, newErrUnexpectedSignatureAlgorithm(alg, signatureAlgorithms)
+		}
+
 		var err error
-		signature.Header, err = signature.mergedHeaders().sanitized()
+		signature.Header, err = mergedHeaders.sanitized()
 		if err != nil {
 			return nil, err
 		}
 
-		alg := SignatureAlgorithm(signature.Header.Algorithm)
-		if !containsSignatureAlgorithm(signatureAlgorithms, alg) {
-			return nil, newErrUnexpectedSignatureAlgorithm(alg, signatureAlgorithms)
-		}
-
 		if signature.header != nil {
 			signature.Unprotected, err = signature.header.sanitized()
 			if err != nil {
@@ -318,17 +324,20 @@
 			return nil, ErrUnprotectedNonce
 		}
 
-		var err error
-		obj.Signatures[i].Header, err = obj.Signatures[i].mergedHeaders().sanitized()
-		if err != nil {
-			return nil, err
-		}
+		obj.Signatures[i].header = sig.Header
 
-		alg := SignatureAlgorithm(obj.Signatures[i].Header.Algorithm)
+		mergedHeaders := obj.Signatures[i].mergedHeaders()
+		alg := mergedHeaders.getSignatureAlgorithm()
 		if !containsSignatureAlgorithm(signatureAlgorithms, alg) {
 			return nil, newErrUnexpectedSignatureAlgorithm(alg, signatureAlgorithms)
 		}
 
+		var err error
+		obj.Signatures[i].Header, err = mergedHeaders.sanitized()
+		if err != nil {
+			return nil, err
+		}
+
 		if obj.Signatures[i].header != nil {
 			obj.Signatures[i].Unprotected, err = obj.Signatures[i].header.sanitized()
 			if err != nil {
@@ -354,7 +363,6 @@
 		// Copy value of sig
 		original := sig
 
-		obj.Signatures[i].header = sig.Header
 		obj.Signatures[i].original = &original
 	}
 
@@ -369,6 +377,10 @@
 	payload []byte,
 	signatureAlgorithms []SignatureAlgorithm,
 ) (*JSONWebSignature, error) {
+	if len(input) == 0 {
+		return nil, errEmptyInput
+	}
+
 	protected, s, ok := strings.Cut(input, tokenDelim)
 	if !ok { // no period found
 		return nil, fmt.Errorf("go-jose/go-jose: compact JWS format must have three parts")
diff -Nur /work/src-orig/docker-registry/vendor/github.com/go-jose/go-jose/v4/jwt/claims.go /work/src/docker-registry/vendor/github.com/go-jose/go-jose/v4/jwt/claims.go
--- a/vendor/github.com/go-jose/go-jose/v4/jwt/claims.go	2026-10-28 10:49:46.343005775 +0000
+++ b/vendor/github.com/go-jose/go-jose/v4/jwt/claims.go	2026-10-28 10:50:32.882773182 +0000
@@ -24,6 +24,11 @@
 	"github.com/go-jose/go-jose/v4/json"
 )
 
+// maxNumericDate bounds an accepted NumericDate (in seconds). It is far past
+// any real timestamp but safely below where an int64 conversion or time.Unix
+// would overflow and wrap Time() to a bogus instant.
+const maxNumericDate = 1 << 62
+
 // Claims represents public claim values (as specified in RFC 7519).
 type Claims struct {
 	Issuer    string       `json:"iss,omitempty"`
@@ -69,6 +74,16 @@
 		return ErrUnmarshalNumericDate
 	}
 
+	// Reject values large enough to overflow either the int64 conversion below
+	// or time.Unix in Time(). time.Unix adds a ~62e9-second offset internally,
+	// so a value near the int64 limit wraps and compares as a time in the
+	// past; for "nbf" that lets a not-yet-valid token pass the not-before
+	// check instead of being rejected. maxNumericDate (2^62 seconds) is far
+	// beyond any real timestamp yet safely below both overflow points.
+	if f >= maxNumericDate || f <= -maxNumericDate {
+		return ErrUnmarshalNumericDate
+	}
+
 	*n = NumericDate(f)
 	return nil
 }
diff -Nur /work/src-orig/docker-registry/vendor/github.com/go-jose/go-jose/v4/jwt/errors.go /work/src/docker-registry/vendor/github.com/go-jose/go-jose/v4/jwt/errors.go
--- a/vendor/github.com/go-jose/go-jose/v4/jwt/errors.go	2026-10-28 10:49:46.343005775 +0000
+++ b/vendor/github.com/go-jose/go-jose/v4/jwt/errors.go	2026-10-28 10:50:32.882773182 +0000
@@ -47,7 +47,7 @@
 var ErrExpired = errors.New("go-jose/go-jose/jwt: validation failed, token is expired (exp)")
 
 // ErrIssuedInTheFuture indicates that the iat field is in the future.
-var ErrIssuedInTheFuture = errors.New("go-jose/go-jose/jwt: validation field, token issued in the future (iat)")
+var ErrIssuedInTheFuture = errors.New("go-jose/go-jose/jwt: validation failed, token issued in the future (iat)")
 
 // ErrInvalidContentType indicates that token requires JWT cty header.
 var ErrInvalidContentType = errors.New("go-jose/go-jose/jwt: expected content type to be JWT (cty header)")
diff -Nur /work/src-orig/docker-registry/vendor/github.com/go-jose/go-jose/v4/opaque.go /work/src/docker-registry/vendor/github.com/go-jose/go-jose/v4/opaque.go
--- a/vendor/github.com/go-jose/go-jose/v4/opaque.go	2026-10-28 10:49:46.343005775 +0000
+++ b/vendor/github.com/go-jose/go-jose/v4/opaque.go	2026-10-28 10:50:32.878773202 +0000
@@ -46,6 +46,11 @@
 		return recipientSigInfo{}, ErrUnsupportedAlgorithm
 	}
 
+	pk := signer.Public()
+	if pk != nil && !pk.IsPublic() {
+		return recipientSigInfo{}, ErrNotPublic
+	}
+
 	return recipientSigInfo{
 		sigAlg:    alg,
 		publicKey: signer.Public,
diff -Nur /work/src-orig/docker-registry/vendor/github.com/go-jose/go-jose/v4/shared.go /work/src/docker-registry/vendor/github.com/go-jose/go-jose/v4/shared.go
--- a/vendor/github.com/go-jose/go-jose/v4/shared.go	2026-10-28 10:49:46.343005775 +0000
+++ b/vendor/github.com/go-jose/go-jose/v4/shared.go	2026-10-28 10:50:32.878773202 +0000
@@ -80,6 +80,12 @@
 
 	// ErrUnsupportedCriticalHeader is returned when a header is marked critical but not supported by go-jose.
 	ErrUnsupportedCriticalHeader = errors.New("go-jose/go-jose: unsupported critical header")
+
+	// errEmptyInput is returned when go-jose was asked to parse an empty string.
+	errEmptyInput = errors.New("go-jose/go-jose: empty input")
+
+	// ErrNotPublic indicates a private key was passed where a public key was expected
+	ErrNotPublic = errors.New("go-jose/go-jose: public key was unexpectedly not public")
 )
 
 // Key management algorithms
@@ -291,9 +297,10 @@
 	if v == nil {
 		return nil, nil
 	}
-	var epk *JSONWebKey
-	err := json.Unmarshal(*v, &epk)
-	if err != nil {
+	// RFC 7518 Section 4.6.1.1: the "epk" header is the ephemeral public key
+	// of the originator. Reject private key material before parsing it.
+	epk := new(JSONWebKey)
+	if err := epk.unmarshalJSON(*v, false); err != nil {
 		return nil, err
 	}
 	return epk, nil
@@ -319,20 +326,6 @@
 	return parsed.getByteBuffer(headerTag)
 }
 
-// getJWK extracts parsed "jwk" from the raw JSON.
-func (parsed rawHeader) getJWK() (*JSONWebKey, error) {
-	v := parsed[headerJWK]
-	if v == nil {
-		return nil, nil
-	}
-	var jwk *JSONWebKey
-	err := json.Unmarshal(*v, &jwk)
-	if err != nil {
-		return nil, err
-	}
-	return jwk, nil
-}
-
 // getCritical extracts parsed "crit" from the raw JSON. If omitted, it
 // returns an empty slice.
 func (parsed rawHeader) getCritical() ([]string, error) {
@@ -418,10 +411,14 @@
 		}
 		switch k {
 		case headerJWK:
-			var jwk *JSONWebKey
-			err = json.Unmarshal(*v, &jwk)
+			// RFC 7515 Section 4.1.3 and RFC 7516 Section 4.1.5: the "jwk"
+			// header is the public key that corresponds to the key used to
+			// sign the JWS or encrypt the JWE. Reject private key material
+			// before parsing it.
+			jwk := new(JSONWebKey)
+			err = jwk.unmarshalJSON(*v, false)
 			if err != nil {
-				err = fmt.Errorf("failed to unmarshal JWK: %v: %#v", err, string(*v))
+				err = fmt.Errorf("failed to unmarshal JWK: %w", err)
 				return
 			}
 			h.JSONWebKey = jwk
diff -Nur /work/src-orig/docker-registry/vendor/github.com/go-jose/go-jose/v4/signing.go /work/src/docker-registry/vendor/github.com/go-jose/go-jose/v4/signing.go
--- a/vendor/github.com/go-jose/go-jose/v4/signing.go	2026-10-28 10:49:46.343005775 +0000
+++ b/vendor/github.com/go-jose/go-jose/v4/signing.go	2026-10-28 10:50:32.878773202 +0000
@@ -130,6 +130,8 @@
 	verifyPayload(payload []byte, signature []byte, alg SignatureAlgorithm) error
 }
 
+var errInvalidVerificationKey = errors.New("go-jose/go-jose: invalid verification key")
+
 type genericSigner struct {
 	recipients   []recipientSigInfo
 	nonceSource  NonceSource
@@ -138,11 +140,21 @@
 }
 
 type recipientSigInfo struct {
-	sigAlg    SignatureAlgorithm
+	sigAlg SignatureAlgorithm
+	// publicKey returns a synthetic JSONWebKey for the signer.
+	// For opaque signers, it calls OpaqueSigner.Public().
 	publicKey func() *JSONWebKey
 	signer    payloadSigner
 }
 
+// getPublicKey gets the public key, with a nil check on the func.
+func (r recipientSigInfo) getPublicKey() *JSONWebKey {
+	if r.publicKey == nil {
+		return nil
+	}
+	return r.publicKey()
+}
+
 func staticPublicKey(jwk *JSONWebKey) func() *JSONWebKey {
 	return func() *JSONWebKey {
 		return jwk
@@ -178,14 +190,23 @@
 func newVerifier(verificationKey interface{}) (payloadVerifier, error) {
 	switch verificationKey := verificationKey.(type) {
 	case ed25519.PublicKey:
+		if len(verificationKey) == 0 {
+			return nil, errInvalidVerificationKey
+		}
 		return &edEncrypterVerifier{
 			publicKey: verificationKey,
 		}, nil
 	case *rsa.PublicKey:
+		if verificationKey == nil {
+			return nil, errInvalidVerificationKey
+		}
 		return &rsaEncrypterVerifier{
 			publicKey: verificationKey,
 		}, nil
 	case *ecdsa.PublicKey:
+		if verificationKey == nil {
+			return nil, errInvalidVerificationKey
+		}
 		return &ecEncrypterVerifier{
 			publicKey: verificationKey,
 		}, nil
@@ -196,6 +217,9 @@
 	case JSONWebKey:
 		return newVerifier(verificationKey.Key)
 	case *JSONWebKey:
+		if verificationKey == nil {
+			return nil, errInvalidVerificationKey
+		}
 		return newVerifier(verificationKey.Key)
 	case OpaqueVerifier:
 		return &opaqueVerifier{verifier: verificationKey}, nil
@@ -240,18 +264,18 @@
 	if err != nil {
 		return recipientSigInfo{}, err
 	}
-	if recipient.publicKey != nil && recipient.publicKey() != nil {
+	if recipientPubKey := recipient.getPublicKey(); recipientPubKey != nil {
+		// This should be impossible, but let's check anyway.
+		if !recipientPubKey.IsPublic() {
+			return recipientSigInfo{}, ErrNotPublic
+		}
+
 		// recipient.publicKey is a JWK synthesized for embedding when recipientSigInfo
 		// was created for the inner key (such as a RSA or ECDSA public key). It contains
 		// the pub key for embedding, but doesn't have extra params like key id.
 		publicKey := signingKey
-		publicKey.Key = recipient.publicKey().Key
+		publicKey.Key = recipientPubKey.Key
 		recipient.publicKey = staticPublicKey(&publicKey)
-
-		// This should be impossible, but let's check anyway.
-		if !recipient.publicKey().IsPublic() {
-			return recipientSigInfo{}, errors.New("go-jose/go-jose: public key was unexpectedly not public")
-		}
 	}
 	return recipient, nil
 }
@@ -266,7 +290,7 @@
 			headerAlgorithm: string(recipient.sigAlg),
 		}
 
-		if recipient.publicKey != nil && recipient.publicKey() != nil {
+		if recipientPubKey := recipient.getPublicKey(); recipientPubKey != nil {
 			// We want to embed the JWK or set the kid header, but not both. Having a protected
 			// header that contains an embedded JWK while also simultaneously containing the kid
 			// header is confusing, and at least in ACME the two are considered to be mutually
@@ -274,11 +298,11 @@
 			// result of the JOSE spec. We've decided that this library will only include one or
 			// the other to avoid this confusion.
 			//
-			// See https://github.com/go-jose/go-jose/issues/157 for more context.
+			// See https://github.com/square/go-jose/issues/157 for more context.
 			if ctx.embedJWK {
-				protected[headerJWK] = recipient.publicKey()
+				protected[headerJWK] = recipientPubKey
 			} else {
-				keyID := recipient.publicKey().KeyID
+				keyID := recipientPubKey.KeyID
 				if keyID != "" {
 					protected[headerKeyID] = keyID
 				}
@@ -390,7 +414,13 @@
 // The verificationKey argument must have one of the types allowed for the
 // verificationKey argument of JSONWebSignature.Verify().
 func (obj JSONWebSignature) DetachedVerify(payload []byte, verificationKey interface{}) error {
-	key, err := tryJWKS(verificationKey, obj.headers()...)
+	if len(obj.Signatures) > 1 {
+		return errors.New("go-jose/go-jose: too many signatures in payload; expecting only one")
+	}
+
+	signature := obj.Signatures[0]
+
+	key, err := tryJWKS(verificationKey, signature.Header)
 	if err != nil {
 		return err
 	}
@@ -399,12 +429,6 @@
 		return err
 	}
 
-	if len(obj.Signatures) > 1 {
-		return errors.New("go-jose/go-jose: too many signatures in payload; expecting only one")
-	}
-
-	signature := obj.Signatures[0]
-
 	if signature.header != nil {
 		// Per https://www.rfc-editor.org/rfc/rfc7515.html#section-4.1.11,
 		// 4.1.11. "crit" (Critical) Header Parameter
@@ -432,11 +456,11 @@
 	headers := signature.mergedHeaders()
 	alg := headers.getSignatureAlgorithm()
 	err = verifier.verifyPayload(input, signature.Signature, alg)
-	if err == nil {
-		return nil
+	if err != nil {
+		return ErrCryptoFailure
 	}
 
-	return ErrCryptoFailure
+	return nil
 }
 
 // VerifyMulti validates (one of the multiple) signatures on the object and
@@ -467,16 +491,6 @@
 // The verificationKey argument must have one of the types allowed for the
 // verificationKey argument of JSONWebSignature.Verify().
 func (obj JSONWebSignature) DetachedVerifyMulti(payload []byte, verificationKey interface{}) (int, Signature, error) {
-	key, err := tryJWKS(verificationKey, obj.headers()...)
-	if err != nil {
-		return -1, Signature{}, err
-	}
-	verifier, err := newVerifier(key)
-	if err != nil {
-		return -1, Signature{}, err
-	}
-
-outer:
 	for i, signature := range obj.Signatures {
 		if signature.header != nil {
 			// Per https://www.rfc-editor.org/rfc/rfc7515.html#section-4.1.11,
@@ -484,20 +498,31 @@
 			// "When used, this Header Parameter MUST be integrity
 			// protected; therefore, it MUST occur only within the JWS
 			// Protected Header."
-			err = signature.header.checkNoCritical()
+			err := signature.header.checkNoCritical()
 			if err != nil {
-				continue outer
+				continue
 			}
 		}
 
 		if signature.protected != nil {
 			// Check for only supported critical headers
-			err = signature.protected.checkSupportedCritical(supportedCritical)
+			err := signature.protected.checkSupportedCritical(supportedCritical)
 			if err != nil {
-				continue outer
+				continue
 			}
 		}
 
+		// If the verification key is a JWK Set, pick a key based on this signature's
+		// "kid" header. If no match, skip this signature.
+		key, err := tryJWKS(verificationKey, signature.Header)
+		if err != nil {
+			continue
+		}
+		verifier, err := newVerifier(key)
+		if err != nil {
+			continue
+		}
+
 		input, err := obj.computeAuthData(payload, &signature)
 		if err != nil {
 			continue
@@ -506,18 +531,12 @@
 		headers := signature.mergedHeaders()
 		alg := headers.getSignatureAlgorithm()
 		err = verifier.verifyPayload(input, signature.Signature, alg)
-		if err == nil {
-			return i, signature, nil
+		if err != nil {
+			continue
 		}
+
+		return i, signature, nil
 	}
 
 	return -1, Signature{}, ErrCryptoFailure
 }
-
-func (obj JSONWebSignature) headers() []Header {
-	headers := make([]Header, len(obj.Signatures))
-	for i, sig := range obj.Signatures {
-		headers[i] = sig.Header
-	}
-	return headers
-}
diff -Nur /work/src-orig/docker-registry/vendor/github.com/go-jose/go-jose/v4/symmetric.go /work/src/docker-registry/vendor/github.com/go-jose/go-jose/v4/symmetric.go
--- a/vendor/github.com/go-jose/go-jose/v4/symmetric.go	2026-10-28 10:49:46.343005775 +0000
+++ b/vendor/github.com/go-jose/go-jose/v4/symmetric.go	2026-10-28 10:50:32.878773202 +0000
@@ -34,8 +34,8 @@
 	josecipher "github.com/go-jose/go-jose/v4/cipher"
 )
 
-// RandReader is a cryptographically secure random number generator (stubbed out in tests).
-var RandReader = rand.Reader
+// randReader is a cryptographically secure random number generator (stubbed out in tests).
+var randReader = rand.Reader
 
 const (
 	// RFC7518 recommends a minimum of 1,000 iterations:
@@ -153,7 +153,7 @@
 // getRandomSalt generates a new salt of the given size.
 func getRandomSalt(size int) ([]byte, error) {
 	salt := make([]byte, size)
-	_, err := io.ReadFull(RandReader, salt)
+	_, err := io.ReadFull(randReader, salt)
 	if err != nil {
 		return nil, err
 	}
@@ -198,7 +198,7 @@
 // Generate a random key for the given content cipher
 func (ctx randomKeyGenerator) genKey() ([]byte, rawHeader, error) {
 	key := make([]byte, ctx.size)
-	_, err := io.ReadFull(RandReader, key)
+	_, err := io.ReadFull(randReader, key)
 	if err != nil {
 		return nil, rawHeader{}, err
 	}
@@ -238,7 +238,7 @@
 
 	// Initialize a new nonce
 	iv := make([]byte, aead.NonceSize())
-	_, err = io.ReadFull(RandReader, iv)
+	_, err = io.ReadFull(randReader, iv)
 	if err != nil {
 		return nil, err
 	}
diff -Nur /work/src-orig/docker-registry/vendor/github.com/go-jose/go-jose/v4/tests.Containerfile /work/src/docker-registry/vendor/github.com/go-jose/go-jose/v4/tests.Containerfile
--- a/vendor/github.com/go-jose/go-jose/v4/tests.Containerfile	1970-01-01 00:00:00.000000000 +0000
+++ b/vendor/github.com/go-jose/go-jose/v4/tests.Containerfile	2026-10-28 10:50:32.878773202 +0000
@@ -0,0 +1,13 @@
+# This containerfile can be used to run the go-jose tests and cli
+
+FROM golang:1.27-trixie
+ENV GOTOOLCHAIN=local
+
+COPY . /src
+WORKDIR /src
+
+# Install the jose-util cli, which will also build the library
+RUN go build -o /usr/local/bin/jose-util ./jose-util
+
+# By default, run the tests
+CMD ["go", "test", "./..."]
diff -Nur /work/src-orig/docker-registry/vendor/github.com/go-jose/go-jose/v4/threat_model.md /work/src/docker-registry/vendor/github.com/go-jose/go-jose/v4/threat_model.md
--- a/vendor/github.com/go-jose/go-jose/v4/threat_model.md	1970-01-01 00:00:00.000000000 +0000
+++ b/vendor/github.com/go-jose/go-jose/v4/threat_model.md	2026-10-28 10:50:32.878773202 +0000
@@ -0,0 +1,25 @@
+# Threat model
+
+## What this project does and where untrusted input enters
+go-jose is a Go implementation of JOSE family of algorithms.
+
+It is a library which will parse attacker-controlled data in network-reachable
+services.
+
+## Components that matter most / least
+The primary attack surface of interest is parsing and validating JWS, JWE, JWK,
+etc when this library is used to implement authentication and authorization.
+
+## How to exercise it
+Testing is primarily done by Golang unit tests, which can be run with the
+tests.Container file's default CMD.
+
+## How you rate severity
+Any authentication bypass enabled by a go-jose issue is a high+ severity.
+
+Denial-of-service attacks are of interest when the functions may be used in a protocol like OIDC, ACME, etc
+which could have a server processing attacker-controlled data.
+
+## Anything to leave alone
+Any bug which only affects the jose-util CLI tool, but it can be used to exercise the library.
+
diff -Nur /work/src-orig/docker-registry/vendor/github.com/klauspost/compress/.gitattributes /work/src/docker-registry/vendor/github.com/klauspost/compress/.gitattributes
--- a/vendor/github.com/klauspost/compress/.gitattributes	2026-10-28 10:49:46.383005576 +0000
+++ b/vendor/github.com/klauspost/compress/.gitattributes	2026-10-28 10:50:33.874768275 +0000
@@ -1,2 +1,3 @@
 * -text
 *.bin -text -diff
+*.md text eol=lf
diff -Nur /work/src-orig/docker-registry/vendor/github.com/klauspost/compress/.goreleaser.yml /work/src/docker-registry/vendor/github.com/klauspost/compress/.goreleaser.yml
--- a/vendor/github.com/klauspost/compress/.goreleaser.yml	2026-10-28 10:49:46.383005576 +0000
+++ b/vendor/github.com/klauspost/compress/.goreleaser.yml	2026-10-28 10:50:33.874768275 +0000
@@ -31,6 +31,9 @@
       - mips64le
     goarm:
       - 7
+    ignore:
+      - goos: windows
+        goarch: arm
   -
     id: "s2d"
     binary: s2d
@@ -57,6 +60,9 @@
       - mips64le
     goarm:
       - 7
+    ignore:
+      - goos: windows
+        goarch: arm
   -
     id: "s2sx"
     binary: s2sx
@@ -84,6 +90,9 @@
       - mips64le
     goarm:
       - 7
+    ignore:
+      - goos: windows
+        goarch: arm
 
 archives:
   -
@@ -91,7 +100,7 @@
     name_template: "s2-{{ .Os }}_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}"
     format_overrides:
       - goos: windows
-        format: zip
+        formats: ['zip']
     files:
       - unpack/*
       - s2/LICENSE
diff -Nur /work/src-orig/docker-registry/vendor/github.com/klauspost/compress/README.md /work/src/docker-registry/vendor/github.com/klauspost/compress/README.md
--- a/vendor/github.com/klauspost/compress/README.md	2026-10-28 10:49:46.383005576 +0000
+++ b/vendor/github.com/klauspost/compress/README.md	2026-10-28 10:50:33.874768275 +0000
@@ -1,693 +1,700 @@
-# compress
-
-This package provides various compression algorithms.
-
-* [zstandard](https://github.com/klauspost/compress/tree/master/zstd#zstd) compression and decompression in pure Go.
-* [S2](https://github.com/klauspost/compress/tree/master/s2#s2-compression) is a high performance replacement for Snappy.
-* Optimized [deflate](https://godoc.org/github.com/klauspost/compress/flate) packages which can be used as a dropin replacement for [gzip](https://godoc.org/github.com/klauspost/compress/gzip), [zip](https://godoc.org/github.com/klauspost/compress/zip) and [zlib](https://godoc.org/github.com/klauspost/compress/zlib).
-* [snappy](https://github.com/klauspost/compress/tree/master/snappy) is a drop-in replacement for `github.com/golang/snappy` offering better compression and concurrent streams.
-* [huff0](https://github.com/klauspost/compress/tree/master/huff0) and [FSE](https://github.com/klauspost/compress/tree/master/fse) implementations for raw entropy encoding.
-* [gzhttp](https://github.com/klauspost/compress/tree/master/gzhttp) Provides client and server wrappers for handling gzipped/zstd HTTP requests efficiently.
-* [pgzip](https://github.com/klauspost/pgzip) is a separate package that provides a very fast parallel gzip implementation.
-
-[![Go Reference](https://pkg.go.dev/badge/klauspost/compress.svg)](https://pkg.go.dev/github.com/klauspost/compress?tab=subdirectories)
-[![Go](https://github.com/klauspost/compress/actions/workflows/go.yml/badge.svg)](https://github.com/klauspost/compress/actions/workflows/go.yml)
-[![Sourcegraph Badge](https://sourcegraph.com/github.com/klauspost/compress/-/badge.svg)](https://sourcegraph.com/github.com/klauspost/compress?badge)
-
-# package usage
-
-Use `go get github.com/klauspost/compress@latest` to add it to your project.
-
-This package will support the current Go version and 2 versions back.
-
-* Use the `nounsafe` tag to disable all use of the "unsafe" package.
-* Use the `noasm` tag to disable all assembly across packages.
-
-Use the links above for more information on each.
-
-# changelog
-* Jan 16th, 2026 [1.18.3](https://github.com/klauspost/compress/releases/tag/v1.18.3)
-	* Downstream CVE-2025-61728. See [golang/go#77102](https://github.com/golang/go/issues/77102).
-
-* Dec 1st, 2025 - [1.18.2](https://github.com/klauspost/compress/releases/tag/v1.18.2)
-	* flate: Fix invalid encoding on level 9 with single value input in https://github.com/klauspost/compress/pull/1115
-	* flate: reduce stateless allocations by @RXamzin in https://github.com/klauspost/compress/pull/1106
-
-* Oct 20, 2025 - [1.18.1](https://github.com/klauspost/compress/releases/tag/v1.18.1) - RETRACTED
-  * zstd: Add simple zstd EncodeTo/DecodeTo functions  https://github.com/klauspost/compress/pull/1079
-  * zstd: Fix incorrect buffer size in dictionary encodes https://github.com/klauspost/compress/pull/1059
-  * s2: check for cap, not len of buffer in EncodeBetter/Best by @vdarulis in https://github.com/klauspost/compress/pull/1080
-  * zlib: Avoiding extra allocation in zlib.reader.Reset by @travelpolicy in https://github.com/klauspost/compress/pull/1086
-  * gzhttp: remove redundant err check in zstdReader by @ryanfowler in https://github.com/klauspost/compress/pull/1090
-  * flate: Faster load+store https://github.com/klauspost/compress/pull/1104
-  * flate: Simplify matchlen https://github.com/klauspost/compress/pull/1101
-  * flate: Use exact sizes for huffman tables https://github.com/klauspost/compress/pull/1103
-
-* Feb 19th, 2025 - [1.18.0](https://github.com/klauspost/compress/releases/tag/v1.18.0)
-  * Add unsafe little endian loaders https://github.com/klauspost/compress/pull/1036
-  * fix: check `r.err != nil` but return a nil value error `err` by @alingse in https://github.com/klauspost/compress/pull/1028
-  * flate: Simplify L4-6 loading https://github.com/klauspost/compress/pull/1043
-  * flate: Simplify matchlen (remove asm) https://github.com/klauspost/compress/pull/1045
-  * s2: Improve small block compression speed w/o asm https://github.com/klauspost/compress/pull/1048
-  * flate: Fix matchlen L5+L6 https://github.com/klauspost/compress/pull/1049
-  * flate: Cleanup & reduce casts https://github.com/klauspost/compress/pull/1050
-
-<details>
-	<summary>See changes to v1.17.x</summary>
-
-* Oct 11th, 2024 - [1.17.11](https://github.com/klauspost/compress/releases/tag/v1.17.11)
-  * zstd: Fix extra CRC written with multiple Close calls https://github.com/klauspost/compress/pull/1017
-  * s2: Don't use stack for index tables https://github.com/klauspost/compress/pull/1014
-  * gzhttp: No content-type on no body response code by @juliens in https://github.com/klauspost/compress/pull/1011
-  * gzhttp: Do not set the content-type when response has no body by @kevinpollet in https://github.com/klauspost/compress/pull/1013
-
-* Sep 23rd, 2024 - [1.17.10](https://github.com/klauspost/compress/releases/tag/v1.17.10)
-	* gzhttp: Add TransportAlwaysDecompress option. https://github.com/klauspost/compress/pull/978
-	* gzhttp: Add supported decompress request body by @mirecl in https://github.com/klauspost/compress/pull/1002
-	* s2: Add EncodeBuffer buffer recycling callback https://github.com/klauspost/compress/pull/982
-	* zstd: Improve memory usage on small streaming encodes https://github.com/klauspost/compress/pull/1007
-	* flate: read data written with partial flush by @vajexal in https://github.com/klauspost/compress/pull/996
-
-* Jun 12th, 2024 - [1.17.9](https://github.com/klauspost/compress/releases/tag/v1.17.9)
-	* s2: Reduce ReadFrom temporary allocations https://github.com/klauspost/compress/pull/949
-	* flate, zstd: Shave some bytes off amd64 matchLen by @greatroar in https://github.com/klauspost/compress/pull/963
-	* Upgrade zip/zlib to 1.22.4 upstream https://github.com/klauspost/compress/pull/970 https://github.com/klauspost/compress/pull/971
-	* zstd: BuildDict fails with RLE table https://github.com/klauspost/compress/pull/951
-
-* Apr 9th, 2024 - [1.17.8](https://github.com/klauspost/compress/releases/tag/v1.17.8)
-	* zstd: Reject blocks where reserved values are not 0 https://github.com/klauspost/compress/pull/885
-	* zstd: Add RLE detection+encoding https://github.com/klauspost/compress/pull/938
-
-* Feb 21st, 2024 - [1.17.7](https://github.com/klauspost/compress/releases/tag/v1.17.7)
-	* s2: Add AsyncFlush method: Complete the block without flushing by @Jille in https://github.com/klauspost/compress/pull/927
-	* s2: Fix literal+repeat exceeds dst crash https://github.com/klauspost/compress/pull/930
-  
-* Feb 5th, 2024 - [1.17.6](https://github.com/klauspost/compress/releases/tag/v1.17.6)
-	* zstd: Fix incorrect repeat coding in best mode https://github.com/klauspost/compress/pull/923
-	* s2: Fix DecodeConcurrent deadlock on errors https://github.com/klauspost/compress/pull/925
-  
-* Jan 26th, 2024 - [v1.17.5](https://github.com/klauspost/compress/releases/tag/v1.17.5)
-	* flate: Fix reset with dictionary on custom window encodes https://github.com/klauspost/compress/pull/912
-	* zstd: Add Frame header encoding and stripping https://github.com/klauspost/compress/pull/908
-	* zstd: Limit better/best default window to 8MB https://github.com/klauspost/compress/pull/913
-	* zstd: Speed improvements by @greatroar in https://github.com/klauspost/compress/pull/896 https://github.com/klauspost/compress/pull/910
-	* s2: Fix callbacks for skippable blocks and disallow 0xfe (Padding) by @Jille in https://github.com/klauspost/compress/pull/916 https://github.com/klauspost/compress/pull/917
-https://github.com/klauspost/compress/pull/919 https://github.com/klauspost/compress/pull/918
-
-* Dec 1st, 2023 - [v1.17.4](https://github.com/klauspost/compress/releases/tag/v1.17.4)
-	* huff0: Speed up symbol counting by @greatroar in https://github.com/klauspost/compress/pull/887
-	* huff0: Remove byteReader by @greatroar in https://github.com/klauspost/compress/pull/886
-	* gzhttp: Allow overriding decompression on transport https://github.com/klauspost/compress/pull/892
-	* gzhttp: Clamp compression level https://github.com/klauspost/compress/pull/890
-	* gzip: Error out if reserved bits are set https://github.com/klauspost/compress/pull/891
-
-* Nov 15th, 2023 - [v1.17.3](https://github.com/klauspost/compress/releases/tag/v1.17.3)
-	* fse: Fix max header size https://github.com/klauspost/compress/pull/881
-	* zstd: Improve better/best compression https://github.com/klauspost/compress/pull/877
-	* gzhttp: Fix missing content type on Close https://github.com/klauspost/compress/pull/883
-
-* Oct 22nd, 2023 - [v1.17.2](https://github.com/klauspost/compress/releases/tag/v1.17.2)
-	* zstd: Fix rare *CORRUPTION* output in "best" mode. See https://github.com/klauspost/compress/pull/876
-
-* Oct 14th, 2023 - [v1.17.1](https://github.com/klauspost/compress/releases/tag/v1.17.1)
-	* s2: Fix S2 "best" dictionary wrong encoding https://github.com/klauspost/compress/pull/871
-	* flate: Reduce allocations in decompressor and minor code improvements by @fakefloordiv in https://github.com/klauspost/compress/pull/869
-	* s2: Fix EstimateBlockSize on 6&7 length input https://github.com/klauspost/compress/pull/867
-
-* Sept 19th, 2023 - [v1.17.0](https://github.com/klauspost/compress/releases/tag/v1.17.0)
-	* Add experimental dictionary builder  https://github.com/klauspost/compress/pull/853
-	* Add xerial snappy read/writer https://github.com/klauspost/compress/pull/838
-	* flate: Add limited window compression https://github.com/klauspost/compress/pull/843
-	* s2: Do 2 overlapping match checks https://github.com/klauspost/compress/pull/839
-	* flate: Add amd64 assembly matchlen https://github.com/klauspost/compress/pull/837
-	* gzip: Copy bufio.Reader on Reset by @thatguystone in https://github.com/klauspost/compress/pull/860
-   
-</details>
-<details>
-	<summary>See changes to v1.16.x</summary>
-
-   
-* July 1st, 2023 - [v1.16.7](https://github.com/klauspost/compress/releases/tag/v1.16.7)
-	* zstd: Fix default level first dictionary encode https://github.com/klauspost/compress/pull/829
-	* s2: add GetBufferCapacity() method by @GiedriusS in https://github.com/klauspost/compress/pull/832
-
-* June 13, 2023 - [v1.16.6](https://github.com/klauspost/compress/releases/tag/v1.16.6)
-	* zstd: correctly ignore WithEncoderPadding(1) by @ianlancetaylor in https://github.com/klauspost/compress/pull/806
-	* zstd: Add amd64 match length assembly https://github.com/klauspost/compress/pull/824
-	* gzhttp: Handle informational headers by @rtribotte in https://github.com/klauspost/compress/pull/815
-	* s2: Improve Better compression slightly https://github.com/klauspost/compress/pull/663
-
-* Apr 16, 2023 - [v1.16.5](https://github.com/klauspost/compress/releases/tag/v1.16.5)
-	* zstd: readByte needs to use io.ReadFull by @jnoxon in https://github.com/klauspost/compress/pull/802
-	* gzip: Fix WriterTo after initial read https://github.com/klauspost/compress/pull/804
-
-* Apr 5, 2023 - [v1.16.4](https://github.com/klauspost/compress/releases/tag/v1.16.4)
-	* zstd: Improve zstd best efficiency by @greatroar and @klauspost in https://github.com/klauspost/compress/pull/784
-	* zstd: Respect WithAllLitEntropyCompression https://github.com/klauspost/compress/pull/792
-	* zstd: Fix amd64 not always detecting corrupt data https://github.com/klauspost/compress/pull/785
-	* zstd: Various minor improvements by @greatroar in https://github.com/klauspost/compress/pull/788 https://github.com/klauspost/compress/pull/794 https://github.com/klauspost/compress/pull/795
-	* s2: Fix huge block overflow https://github.com/klauspost/compress/pull/779
-	* s2: Allow CustomEncoder fallback https://github.com/klauspost/compress/pull/780
-	* gzhttp: Support ResponseWriter Unwrap() in gzhttp handler by @jgimenez in https://github.com/klauspost/compress/pull/799
-
-* Mar 13, 2023 - [v1.16.1](https://github.com/klauspost/compress/releases/tag/v1.16.1)
-	* zstd: Speed up + improve best encoder by @greatroar in https://github.com/klauspost/compress/pull/776
-	* gzhttp: Add optional [BREACH mitigation](https://github.com/klauspost/compress/tree/master/gzhttp#breach-mitigation). https://github.com/klauspost/compress/pull/762 https://github.com/klauspost/compress/pull/768 https://github.com/klauspost/compress/pull/769 https://github.com/klauspost/compress/pull/770 https://github.com/klauspost/compress/pull/767
-	* s2: Add Intel LZ4s converter https://github.com/klauspost/compress/pull/766
-	* zstd: Minor bug fixes https://github.com/klauspost/compress/pull/771 https://github.com/klauspost/compress/pull/772 https://github.com/klauspost/compress/pull/773
-	* huff0: Speed up compress1xDo by @greatroar in https://github.com/klauspost/compress/pull/774
-
-* Feb 26, 2023 - [v1.16.0](https://github.com/klauspost/compress/releases/tag/v1.16.0)
-	* s2: Add [Dictionary](https://github.com/klauspost/compress/tree/master/s2#dictionaries) support.  https://github.com/klauspost/compress/pull/685
-	* s2: Add Compression Size Estimate.  https://github.com/klauspost/compress/pull/752
-	* s2: Add support for custom stream encoder. https://github.com/klauspost/compress/pull/755
-	* s2: Add LZ4 block converter. https://github.com/klauspost/compress/pull/748
-	* s2: Support io.ReaderAt in ReadSeeker. https://github.com/klauspost/compress/pull/747
-	* s2c/s2sx: Use concurrent decoding. https://github.com/klauspost/compress/pull/746
-</details>
-
-<details>
-	<summary>See changes to v1.15.x</summary>
-	
-* Jan 21st, 2023 (v1.15.15)
-	* deflate: Improve level 7-9 https://github.com/klauspost/compress/pull/739
-	* zstd: Add delta encoding support by @greatroar in https://github.com/klauspost/compress/pull/728
-	* zstd: Various speed improvements by @greatroar https://github.com/klauspost/compress/pull/741 https://github.com/klauspost/compress/pull/734 https://github.com/klauspost/compress/pull/736 https://github.com/klauspost/compress/pull/744 https://github.com/klauspost/compress/pull/743 https://github.com/klauspost/compress/pull/745
-	* gzhttp: Add SuffixETag() and DropETag() options to prevent ETag collisions on compressed responses by @willbicks in https://github.com/klauspost/compress/pull/740
-
-* Jan 3rd, 2023 (v1.15.14)
-
-	* flate: Improve speed in big stateless blocks https://github.com/klauspost/compress/pull/718
-	* zstd: Minor speed tweaks by @greatroar in https://github.com/klauspost/compress/pull/716 https://github.com/klauspost/compress/pull/720
-	* export NoGzipResponseWriter for custom ResponseWriter wrappers by @harshavardhana in https://github.com/klauspost/compress/pull/722
-	* s2: Add example for indexing and existing stream https://github.com/klauspost/compress/pull/723
-
-* Dec 11, 2022 (v1.15.13)
-	* zstd: Add [MaxEncodedSize](https://pkg.go.dev/github.com/klauspost/compress@v1.15.13/zstd#Encoder.MaxEncodedSize) to encoder  https://github.com/klauspost/compress/pull/691
-	* zstd: Various tweaks and improvements https://github.com/klauspost/compress/pull/693 https://github.com/klauspost/compress/pull/695 https://github.com/klauspost/compress/pull/696 https://github.com/klauspost/compress/pull/701 https://github.com/klauspost/compress/pull/702 https://github.com/klauspost/compress/pull/703 https://github.com/klauspost/compress/pull/704 https://github.com/klauspost/compress/pull/705 https://github.com/klauspost/compress/pull/706 https://github.com/klauspost/compress/pull/707 https://github.com/klauspost/compress/pull/708
-
-* Oct 26, 2022 (v1.15.12)
-
-	* zstd: Tweak decoder allocs. https://github.com/klauspost/compress/pull/680
-	* gzhttp: Always delete `HeaderNoCompression` https://github.com/klauspost/compress/pull/683
-
-* Sept 26, 2022 (v1.15.11)
-
-	* flate: Improve level 1-3 compression  https://github.com/klauspost/compress/pull/678
-	* zstd: Improve "best" compression by @nightwolfz in https://github.com/klauspost/compress/pull/677
-	* zstd: Fix+reduce decompression allocations https://github.com/klauspost/compress/pull/668
-	* zstd: Fix non-effective noescape tag https://github.com/klauspost/compress/pull/667
-
-* Sept 16, 2022 (v1.15.10)
-
-	* zstd: Add [WithDecodeAllCapLimit](https://pkg.go.dev/github.com/klauspost/compress@v1.15.10/zstd#WithDecodeAllCapLimit) https://github.com/klauspost/compress/pull/649
-	* Add Go 1.19 - deprecate Go 1.16  https://github.com/klauspost/compress/pull/651
-	* flate: Improve level 5+6 compression https://github.com/klauspost/compress/pull/656
-	* zstd: Improve "better" compression  https://github.com/klauspost/compress/pull/657
-	* s2: Improve "best" compression https://github.com/klauspost/compress/pull/658
-	* s2: Improve "better" compression. https://github.com/klauspost/compress/pull/635
-	* s2: Slightly faster non-assembly decompression https://github.com/klauspost/compress/pull/646
-	* Use arrays for constant size copies https://github.com/klauspost/compress/pull/659
-
-* July 21, 2022 (v1.15.9)
-
-	* zstd: Fix decoder crash on amd64 (no BMI) on invalid input https://github.com/klauspost/compress/pull/645
-	* zstd: Disable decoder extended memory copies (amd64) due to possible crashes https://github.com/klauspost/compress/pull/644
-	* zstd: Allow single segments up to "max decoded size" https://github.com/klauspost/compress/pull/643
-
-* July 13, 2022 (v1.15.8)
-
-	* gzip: fix stack exhaustion bug in Reader.Read https://github.com/klauspost/compress/pull/641
-	* s2: Add Index header trim/restore https://github.com/klauspost/compress/pull/638
-	* zstd: Optimize seqdeq amd64 asm by @greatroar in https://github.com/klauspost/compress/pull/636
-	* zstd: Improve decoder memcopy https://github.com/klauspost/compress/pull/637
-	* huff0: Pass a single bitReader pointer to asm by @greatroar in https://github.com/klauspost/compress/pull/634
-	* zstd: Branchless getBits for amd64 w/o BMI2 by @greatroar in https://github.com/klauspost/compress/pull/640
-	* gzhttp: Remove header before writing https://github.com/klauspost/compress/pull/639
-
-* June 29, 2022 (v1.15.7)
-
-	* s2: Fix absolute forward seeks  https://github.com/klauspost/compress/pull/633
-	* zip: Merge upstream  https://github.com/klauspost/compress/pull/631
-	* zip: Re-add zip64 fix https://github.com/klauspost/compress/pull/624
-	* zstd: translate fseDecoder.buildDtable into asm by @WojciechMula in https://github.com/klauspost/compress/pull/598
-	* flate: Faster histograms  https://github.com/klauspost/compress/pull/620
-	* deflate: Use compound hcode  https://github.com/klauspost/compress/pull/622
-
-* June 3, 2022 (v1.15.6)
-	* s2: Improve coding for long, close matches https://github.com/klauspost/compress/pull/613
-	* s2c: Add Snappy/S2 stream recompression https://github.com/klauspost/compress/pull/611
-	* zstd: Always use configured block size https://github.com/klauspost/compress/pull/605
-	* zstd: Fix incorrect hash table placement for dict encoding in default https://github.com/klauspost/compress/pull/606
-	* zstd: Apply default config to ZipDecompressor without options https://github.com/klauspost/compress/pull/608
-	* gzhttp: Exclude more common archive formats https://github.com/klauspost/compress/pull/612
-	* s2: Add ReaderIgnoreCRC https://github.com/klauspost/compress/pull/609
-	* s2: Remove sanity load on index creation https://github.com/klauspost/compress/pull/607
-	* snappy: Use dedicated function for scoring https://github.com/klauspost/compress/pull/614
-	* s2c+s2d: Use official snappy framed extension https://github.com/klauspost/compress/pull/610
-
-* May 25, 2022 (v1.15.5)
-	* s2: Add concurrent stream decompression https://github.com/klauspost/compress/pull/602
-	* s2: Fix final emit oob read crash on amd64 https://github.com/klauspost/compress/pull/601
-	* huff0: asm implementation of Decompress1X by @WojciechMula https://github.com/klauspost/compress/pull/596
-	* zstd: Use 1 less goroutine for stream decoding https://github.com/klauspost/compress/pull/588
-	* zstd: Copy literal in 16 byte blocks when possible https://github.com/klauspost/compress/pull/592
-	* zstd: Speed up when WithDecoderLowmem(false) https://github.com/klauspost/compress/pull/599
-	* zstd: faster next state update in BMI2 version of decode by @WojciechMula in https://github.com/klauspost/compress/pull/593
-	* huff0: Do not check max size when reading table. https://github.com/klauspost/compress/pull/586
-	* flate: Inplace hashing for level 7-9 https://github.com/klauspost/compress/pull/590
-
-
-* May 11, 2022 (v1.15.4)
-	* huff0: decompress directly into output by @WojciechMula in [#577](https://github.com/klauspost/compress/pull/577)
-	* inflate: Keep dict on stack [#581](https://github.com/klauspost/compress/pull/581)
-	* zstd: Faster decoding memcopy in asm [#583](https://github.com/klauspost/compress/pull/583)
-	* zstd: Fix ignored crc [#580](https://github.com/klauspost/compress/pull/580)
-
-* May 5, 2022 (v1.15.3)
-	* zstd: Allow to ignore checksum checking by @WojciechMula [#572](https://github.com/klauspost/compress/pull/572)
-	* s2: Fix incorrect seek for io.SeekEnd in [#575](https://github.com/klauspost/compress/pull/575)
-
-* Apr 26, 2022 (v1.15.2)
-	* zstd: Add x86-64 assembly for decompression on streams and blocks. Contributed by [@WojciechMula](https://github.com/WojciechMula). Typically 2x faster.  [#528](https://github.com/klauspost/compress/pull/528) [#531](https://github.com/klauspost/compress/pull/531) [#545](https://github.com/klauspost/compress/pull/545) [#537](https://github.com/klauspost/compress/pull/537)
-	* zstd: Add options to ZipDecompressor and fixes [#539](https://github.com/klauspost/compress/pull/539)
-	* s2: Use sorted search for index [#555](https://github.com/klauspost/compress/pull/555)
-	* Minimum version is Go 1.16, added CI test on 1.18.
-
-* Mar 11, 2022 (v1.15.1)
-	* huff0: Add x86 assembly of Decode4X by @WojciechMula in [#512](https://github.com/klauspost/compress/pull/512)
-	* zstd: Reuse zip decoders in [#514](https://github.com/klauspost/compress/pull/514)
-	* zstd: Detect extra block data and report as corrupted in [#520](https://github.com/klauspost/compress/pull/520)
-	* zstd: Handle zero sized frame content size stricter in [#521](https://github.com/klauspost/compress/pull/521)
-	* zstd: Add stricter block size checks in [#523](https://github.com/klauspost/compress/pull/523)
-
-* Mar 3, 2022 (v1.15.0)
-	* zstd: Refactor decoder [#498](https://github.com/klauspost/compress/pull/498)
-	* zstd: Add stream encoding without goroutines [#505](https://github.com/klauspost/compress/pull/505)
-	* huff0: Prevent single blocks exceeding 16 bits by @klauspost in[#507](https://github.com/klauspost/compress/pull/507)
-	* flate: Inline literal emission [#509](https://github.com/klauspost/compress/pull/509)
-	* gzhttp: Add zstd to transport [#400](https://github.com/klauspost/compress/pull/400)
-	* gzhttp: Make content-type optional [#510](https://github.com/klauspost/compress/pull/510)
-
-Both compression and decompression now supports "synchronous" stream operations. This means that whenever "concurrency" is set to 1, they will operate without spawning goroutines.
-
-Stream decompression is now faster on asynchronous, since the goroutine allocation much more effectively splits the workload. On typical streams this will typically use 2 cores fully for decompression. When a stream has finished decoding no goroutines will be left over, so decoders can now safely be pooled and still be garbage collected.
-
-While the release has been extensively tested, it is recommended to testing when upgrading.
-
-</details>
-
-<details>
-	<summary>See changes to v1.14.x</summary>
-	
-* Feb 22, 2022 (v1.14.4)
-	* flate: Fix rare huffman only (-2) corruption. [#503](https://github.com/klauspost/compress/pull/503)
-	* zip: Update deprecated CreateHeaderRaw to correctly call CreateRaw by @saracen in [#502](https://github.com/klauspost/compress/pull/502)
-	* zip: don't read data descriptor early by @saracen in [#501](https://github.com/klauspost/compress/pull/501)  #501
-	* huff0: Use static decompression buffer up to 30% faster [#499](https://github.com/klauspost/compress/pull/499) [#500](https://github.com/klauspost/compress/pull/500)
-
-* Feb 17, 2022 (v1.14.3)
-	* flate: Improve fastest levels compression speed ~10% more throughput. [#482](https://github.com/klauspost/compress/pull/482) [#489](https://github.com/klauspost/compress/pull/489) [#490](https://github.com/klauspost/compress/pull/490) [#491](https://github.com/klauspost/compress/pull/491) [#494](https://github.com/klauspost/compress/pull/494)  [#478](https://github.com/klauspost/compress/pull/478)
-	* flate: Faster decompression speed, ~5-10%. [#483](https://github.com/klauspost/compress/pull/483)
-	* s2: Faster compression with Go v1.18 and amd64 microarch level 3+. [#484](https://github.com/klauspost/compress/pull/484) [#486](https://github.com/klauspost/compress/pull/486)
-
-* Jan 25, 2022 (v1.14.2)
-	* zstd: improve header decoder by @dsnet  [#476](https://github.com/klauspost/compress/pull/476)
-	* zstd: Add bigger default blocks  [#469](https://github.com/klauspost/compress/pull/469)
-	* zstd: Remove unused decompression buffer [#470](https://github.com/klauspost/compress/pull/470)
-	* zstd: Fix logically dead code by @ningmingxiao [#472](https://github.com/klauspost/compress/pull/472)
-	* flate: Improve level 7-9 [#471](https://github.com/klauspost/compress/pull/471) [#473](https://github.com/klauspost/compress/pull/473)
-	* zstd: Add noasm tag for xxhash [#475](https://github.com/klauspost/compress/pull/475)
-
-* Jan 11, 2022 (v1.14.1)
-	* s2: Add stream index in [#462](https://github.com/klauspost/compress/pull/462)
-	* flate: Speed and efficiency improvements in [#439](https://github.com/klauspost/compress/pull/439) [#461](https://github.com/klauspost/compress/pull/461) [#455](https://github.com/klauspost/compress/pull/455) [#452](https://github.com/klauspost/compress/pull/452) [#458](https://github.com/klauspost/compress/pull/458)
-	* zstd: Performance improvement in [#420]( https://github.com/klauspost/compress/pull/420) [#456](https://github.com/klauspost/compress/pull/456) [#437](https://github.com/klauspost/compress/pull/437) [#467](https://github.com/klauspost/compress/pull/467) [#468](https://github.com/klauspost/compress/pull/468)
-	* zstd: add arm64 xxhash assembly in [#464](https://github.com/klauspost/compress/pull/464)
-	* Add garbled for binaries for s2 in [#445](https://github.com/klauspost/compress/pull/445)
-</details>
-
-<details>
-	<summary>See changes to v1.13.x</summary>
-	
-* Aug 30, 2021 (v1.13.5)
-	* gz/zlib/flate: Alias stdlib errors [#425](https://github.com/klauspost/compress/pull/425)
-	* s2: Add block support to commandline tools [#413](https://github.com/klauspost/compress/pull/413)
-	* zstd: pooledZipWriter should return Writers to the same pool [#426](https://github.com/klauspost/compress/pull/426)
-	* Removed golang/snappy as external dependency for tests [#421](https://github.com/klauspost/compress/pull/421)
-
-* Aug 12, 2021 (v1.13.4)
-	* Add [snappy replacement package](https://github.com/klauspost/compress/tree/master/snappy).
-	* zstd: Fix incorrect encoding in "best" mode [#415](https://github.com/klauspost/compress/pull/415)
-
-* Aug 3, 2021 (v1.13.3) 
-	* zstd: Improve Best compression [#404](https://github.com/klauspost/compress/pull/404)
-	* zstd: Fix WriteTo error forwarding [#411](https://github.com/klauspost/compress/pull/411)
-	* gzhttp: Return http.HandlerFunc instead of http.Handler. Unlikely breaking change. [#406](https://github.com/klauspost/compress/pull/406)
-	* s2sx: Fix max size error [#399](https://github.com/klauspost/compress/pull/399)
-	* zstd: Add optional stream content size on reset [#401](https://github.com/klauspost/compress/pull/401)
-	* zstd: use SpeedBestCompression for level >= 10 [#410](https://github.com/klauspost/compress/pull/410)
-
-* Jun 14, 2021 (v1.13.1)
-	* s2: Add full Snappy output support  [#396](https://github.com/klauspost/compress/pull/396)
-	* zstd: Add configurable [Decoder window](https://pkg.go.dev/github.com/klauspost/compress/zstd#WithDecoderMaxWindow) size [#394](https://github.com/klauspost/compress/pull/394)
-	* gzhttp: Add header to skip compression  [#389](https://github.com/klauspost/compress/pull/389)
-	* s2: Improve speed with bigger output margin  [#395](https://github.com/klauspost/compress/pull/395)
-
-* Jun 3, 2021 (v1.13.0)
-	* Added [gzhttp](https://github.com/klauspost/compress/tree/master/gzhttp#gzip-handler) which allows wrapping HTTP servers and clients with GZIP compressors.
-	* zstd: Detect short invalid signatures [#382](https://github.com/klauspost/compress/pull/382)
-	* zstd: Spawn decoder goroutine only if needed. [#380](https://github.com/klauspost/compress/pull/380)
-</details>
-
-
-<details>
-	<summary>See changes to v1.12.x</summary>
-	
-* May 25, 2021 (v1.12.3)
-	* deflate: Better/faster Huffman encoding [#374](https://github.com/klauspost/compress/pull/374)
-	* deflate: Allocate less for history. [#375](https://github.com/klauspost/compress/pull/375)
-	* zstd: Forward read errors [#373](https://github.com/klauspost/compress/pull/373) 
-
-* Apr 27, 2021 (v1.12.2)
-	* zstd: Improve better/best compression [#360](https://github.com/klauspost/compress/pull/360) [#364](https://github.com/klauspost/compress/pull/364) [#365](https://github.com/klauspost/compress/pull/365)
-	* zstd: Add helpers to compress/decompress zstd inside zip files [#363](https://github.com/klauspost/compress/pull/363)
-	* deflate: Improve level 5+6 compression [#367](https://github.com/klauspost/compress/pull/367)
-	* s2: Improve better/best compression [#358](https://github.com/klauspost/compress/pull/358) [#359](https://github.com/klauspost/compress/pull/358)
-	* s2: Load after checking src limit on amd64. [#362](https://github.com/klauspost/compress/pull/362)
-	* s2sx: Limit max executable size [#368](https://github.com/klauspost/compress/pull/368) 
-
-* Apr 14, 2021 (v1.12.1)
-	* snappy package removed. Upstream added as dependency.
-	* s2: Better compression in "best" mode [#353](https://github.com/klauspost/compress/pull/353)
-	* s2sx: Add stdin input and detect pre-compressed from signature [#352](https://github.com/klauspost/compress/pull/352)
-	* s2c/s2d: Add http as possible input [#348](https://github.com/klauspost/compress/pull/348)
-	* s2c/s2d/s2sx: Always truncate when writing files [#352](https://github.com/klauspost/compress/pull/352)
-	* zstd: Reduce memory usage further when using [WithLowerEncoderMem](https://pkg.go.dev/github.com/klauspost/compress/zstd#WithLowerEncoderMem) [#346](https://github.com/klauspost/compress/pull/346)
-	* s2: Fix potential problem with amd64 assembly and profilers [#349](https://github.com/klauspost/compress/pull/349)
-</details>
-
-<details>
-	<summary>See changes to v1.11.x</summary>
-	
-* Mar 26, 2021 (v1.11.13)
-	* zstd: Big speedup on small dictionary encodes [#344](https://github.com/klauspost/compress/pull/344) [#345](https://github.com/klauspost/compress/pull/345)
-	* zstd: Add [WithLowerEncoderMem](https://pkg.go.dev/github.com/klauspost/compress/zstd#WithLowerEncoderMem) encoder option [#336](https://github.com/klauspost/compress/pull/336)
-	* deflate: Improve entropy compression [#338](https://github.com/klauspost/compress/pull/338)
-	* s2: Clean up and minor performance improvement in best [#341](https://github.com/klauspost/compress/pull/341)
-
-* Mar 5, 2021 (v1.11.12)
-	* s2: Add `s2sx` binary that creates [self extracting archives](https://github.com/klauspost/compress/tree/master/s2#s2sx-self-extracting-archives).
-	* s2: Speed up decompression on non-assembly platforms [#328](https://github.com/klauspost/compress/pull/328)
-
-* Mar 1, 2021 (v1.11.9)
-	* s2: Add ARM64 decompression assembly. Around 2x output speed. [#324](https://github.com/klauspost/compress/pull/324)
-	* s2: Improve "better" speed and efficiency. [#325](https://github.com/klauspost/compress/pull/325)
-	* s2: Fix binaries.
-
-* Feb 25, 2021 (v1.11.8)
-	* s2: Fixed occasional out-of-bounds write on amd64. Upgrade recommended.
-	* s2: Add AMD64 assembly for better mode. 25-50% faster. [#315](https://github.com/klauspost/compress/pull/315)
-	* s2: Less upfront decoder allocation. [#322](https://github.com/klauspost/compress/pull/322)
-	* zstd: Faster "compression" of incompressible data. [#314](https://github.com/klauspost/compress/pull/314)
-	* zip: Fix zip64 headers. [#313](https://github.com/klauspost/compress/pull/313)
-  
-* Jan 14, 2021 (v1.11.7)
-	* Use Bytes() interface to get bytes across packages. [#309](https://github.com/klauspost/compress/pull/309)
-	* s2: Add 'best' compression option.  [#310](https://github.com/klauspost/compress/pull/310)
-	* s2: Add ReaderMaxBlockSize, changes `s2.NewReader` signature to include varargs. [#311](https://github.com/klauspost/compress/pull/311)
-	* s2: Fix crash on small better buffers. [#308](https://github.com/klauspost/compress/pull/308)
-	* s2: Clean up decoder. [#312](https://github.com/klauspost/compress/pull/312)
-
-* Jan 7, 2021 (v1.11.6)
-	* zstd: Make decoder allocations smaller [#306](https://github.com/klauspost/compress/pull/306)
-	* zstd: Free Decoder resources when Reset is called with a nil io.Reader  [#305](https://github.com/klauspost/compress/pull/305)
-
-* Dec 20, 2020 (v1.11.4)
-	* zstd: Add Best compression mode [#304](https://github.com/klauspost/compress/pull/304)
-	* Add header decoder [#299](https://github.com/klauspost/compress/pull/299)
-	* s2: Add uncompressed stream option [#297](https://github.com/klauspost/compress/pull/297)
-	* Simplify/speed up small blocks with known max size. [#300](https://github.com/klauspost/compress/pull/300)
-	* zstd: Always reset literal dict encoder [#303](https://github.com/klauspost/compress/pull/303)
-
-* Nov 15, 2020 (v1.11.3)
-	* inflate: 10-15% faster decompression  [#293](https://github.com/klauspost/compress/pull/293)
-	* zstd: Tweak DecodeAll default allocation [#295](https://github.com/klauspost/compress/pull/295)
-
-* Oct 11, 2020 (v1.11.2)
-	* s2: Fix out of bounds read in "better" block compression [#291](https://github.com/klauspost/compress/pull/291)
-
-* Oct 1, 2020 (v1.11.1)
-	* zstd: Set allLitEntropy true in default configuration [#286](https://github.com/klauspost/compress/pull/286)
-
-* Sept 8, 2020 (v1.11.0)
-	* zstd: Add experimental compression [dictionaries](https://github.com/klauspost/compress/tree/master/zstd#dictionaries) [#281](https://github.com/klauspost/compress/pull/281)
-	* zstd: Fix mixed Write and ReadFrom calls [#282](https://github.com/klauspost/compress/pull/282)
-	* inflate/gz: Limit variable shifts, ~5% faster decompression [#274](https://github.com/klauspost/compress/pull/274)
-</details>
-
-<details>
-	<summary>See changes to v1.10.x</summary>
- 
-* July 8, 2020 (v1.10.11) 
-	* zstd: Fix extra block when compressing with ReadFrom. [#278](https://github.com/klauspost/compress/pull/278)
-	* huff0: Also populate compression table when reading decoding table. [#275](https://github.com/klauspost/compress/pull/275)
-	
-* June 23, 2020 (v1.10.10) 
-	* zstd: Skip entropy compression in fastest mode when no matches. [#270](https://github.com/klauspost/compress/pull/270)
-	
-* June 16, 2020 (v1.10.9): 
-	* zstd: API change for specifying dictionaries. See [#268](https://github.com/klauspost/compress/pull/268)
-	* zip: update CreateHeaderRaw to handle zip64 fields. [#266](https://github.com/klauspost/compress/pull/266)
-	* Fuzzit tests removed. The service has been purchased and is no longer available.
-	
-* June 5, 2020 (v1.10.8): 
-	* 1.15x faster zstd block decompression. [#265](https://github.com/klauspost/compress/pull/265)
-	
-* June 1, 2020 (v1.10.7): 
-	* Added zstd decompression [dictionary support](https://github.com/klauspost/compress/tree/master/zstd#dictionaries)
-	* Increase zstd decompression speed up to 1.19x.  [#259](https://github.com/klauspost/compress/pull/259)
-	* Remove internal reset call in zstd compression and reduce allocations. [#263](https://github.com/klauspost/compress/pull/263)
-	
-* May 21, 2020: (v1.10.6) 
-	* zstd: Reduce allocations while decoding. [#258](https://github.com/klauspost/compress/pull/258), [#252](https://github.com/klauspost/compress/pull/252)
-	* zstd: Stricter decompression checks.
-	
-* April 12, 2020: (v1.10.5)
-	* s2-commands: Flush output when receiving SIGINT. [#239](https://github.com/klauspost/compress/pull/239)
-	
-* Apr 8, 2020: (v1.10.4) 
-	* zstd: Minor/special case optimizations. [#251](https://github.com/klauspost/compress/pull/251),  [#250](https://github.com/klauspost/compress/pull/250),  [#249](https://github.com/klauspost/compress/pull/249),  [#247](https://github.com/klauspost/compress/pull/247)
-* Mar 11, 2020: (v1.10.3) 
-	* s2: Use S2 encoder in pure Go mode for Snappy output as well. [#245](https://github.com/klauspost/compress/pull/245)
-	* s2: Fix pure Go block encoder. [#244](https://github.com/klauspost/compress/pull/244)
-	* zstd: Added "better compression" mode. [#240](https://github.com/klauspost/compress/pull/240)
-	* zstd: Improve speed of fastest compression mode by 5-10% [#241](https://github.com/klauspost/compress/pull/241)
-	* zstd: Skip creating encoders when not needed. [#238](https://github.com/klauspost/compress/pull/238)
-	
-* Feb 27, 2020: (v1.10.2) 
-	* Close to 50% speedup in inflate (gzip/zip decompression). [#236](https://github.com/klauspost/compress/pull/236) [#234](https://github.com/klauspost/compress/pull/234) [#232](https://github.com/klauspost/compress/pull/232)
-	* Reduce deflate level 1-6 memory usage up to 59%. [#227](https://github.com/klauspost/compress/pull/227)
-	
-* Feb 18, 2020: (v1.10.1)
-	* Fix zstd crash when resetting multiple times without sending data. [#226](https://github.com/klauspost/compress/pull/226)
-	* deflate: Fix dictionary use on level 1-6. [#224](https://github.com/klauspost/compress/pull/224)
-	* Remove deflate writer reference when closing. [#224](https://github.com/klauspost/compress/pull/224)
-	
-* Feb 4, 2020: (v1.10.0) 
-	* Add optional dictionary to [stateless deflate](https://pkg.go.dev/github.com/klauspost/compress/flate?tab=doc#StatelessDeflate). Breaking change, send `nil` for previous behaviour. [#216](https://github.com/klauspost/compress/pull/216)
-	* Fix buffer overflow on repeated small block deflate.  [#218](https://github.com/klauspost/compress/pull/218)
-	* Allow copying content from an existing ZIP file without decompressing+compressing. [#214](https://github.com/klauspost/compress/pull/214)
-	* Added [S2](https://github.com/klauspost/compress/tree/master/s2#s2-compression) AMD64 assembler and various optimizations. Stream speed >10GB/s.  [#186](https://github.com/klauspost/compress/pull/186)
-
-</details>
-
-<details>
-	<summary>See changes prior to v1.10.0</summary>
-
-* Jan 20,2020 (v1.9.8) Optimize gzip/deflate with better size estimates and faster table generation. [#207](https://github.com/klauspost/compress/pull/207) by [luyu6056](https://github.com/luyu6056),  [#206](https://github.com/klauspost/compress/pull/206).
-* Jan 11, 2020: S2 Encode/Decode will use provided buffer if capacity is big enough. [#204](https://github.com/klauspost/compress/pull/204) 
-* Jan 5, 2020: (v1.9.7) Fix another zstd regression in v1.9.5 - v1.9.6 removed.
-* Jan 4, 2020: (v1.9.6) Regression in v1.9.5 fixed causing corrupt zstd encodes in rare cases.
-* Jan 4, 2020: Faster IO in [s2c + s2d commandline tools](https://github.com/klauspost/compress/tree/master/s2#commandline-tools) compression/decompression. [#192](https://github.com/klauspost/compress/pull/192)
-* Dec 29, 2019: Removed v1.9.5 since fuzz tests showed a compatibility problem with the reference zstandard decoder.
-* Dec 29, 2019: (v1.9.5) zstd: 10-20% faster block compression. [#199](https://github.com/klauspost/compress/pull/199)
-* Dec 29, 2019: [zip](https://godoc.org/github.com/klauspost/compress/zip) package updated with latest Go features
-* Dec 29, 2019: zstd: Single segment flag condintions tweaked. [#197](https://github.com/klauspost/compress/pull/197)
-* Dec 18, 2019: s2: Faster compression when ReadFrom is used. [#198](https://github.com/klauspost/compress/pull/198)
-* Dec 10, 2019: s2: Fix repeat length output when just above at 16MB limit.
-* Dec 10, 2019: zstd: Add function to get decoder as io.ReadCloser. [#191](https://github.com/klauspost/compress/pull/191)
-* Dec 3, 2019: (v1.9.4) S2: limit max repeat length. [#188](https://github.com/klauspost/compress/pull/188)
-* Dec 3, 2019: Add [WithNoEntropyCompression](https://godoc.org/github.com/klauspost/compress/zstd#WithNoEntropyCompression) to zstd [#187](https://github.com/klauspost/compress/pull/187)
-* Dec 3, 2019: Reduce memory use for tests. Check for leaked goroutines.
-* Nov 28, 2019 (v1.9.3) Less allocations in stateless deflate.
-* Nov 28, 2019: 5-20% Faster huff0 decode. Impacts zstd as well. [#184](https://github.com/klauspost/compress/pull/184)
-* Nov 12, 2019 (v1.9.2) Added [Stateless Compression](#stateless-compression) for gzip/deflate.
-* Nov 12, 2019: Fixed zstd decompression of large single blocks. [#180](https://github.com/klauspost/compress/pull/180)
-* Nov 11, 2019: Set default  [s2c](https://github.com/klauspost/compress/tree/master/s2#commandline-tools) block size to 4MB.
-* Nov 11, 2019: Reduce inflate memory use by 1KB.
-* Nov 10, 2019: Less allocations in deflate bit writer.
-* Nov 10, 2019: Fix inconsistent error returned by zstd decoder.
-* Oct 28, 2019 (v1.9.1) ztsd: Fix crash when compressing blocks. [#174](https://github.com/klauspost/compress/pull/174)
-* Oct 24, 2019 (v1.9.0) zstd: Fix rare data corruption [#173](https://github.com/klauspost/compress/pull/173)
-* Oct 24, 2019 zstd: Fix huff0 out of buffer write [#171](https://github.com/klauspost/compress/pull/171) and always return errors [#172](https://github.com/klauspost/compress/pull/172) 
-* Oct 10, 2019: Big deflate rewrite, 30-40% faster with better compression [#105](https://github.com/klauspost/compress/pull/105)
-
-</details>
-
-<details>
-	<summary>See changes prior to v1.9.0</summary>
-
-* Oct 10, 2019: (v1.8.6) zstd: Allow partial reads to get flushed data. [#169](https://github.com/klauspost/compress/pull/169)
-* Oct 3, 2019: Fix inconsistent results on broken zstd streams.
-* Sep 25, 2019: Added `-rm` (remove source files) and `-q` (no output except errors) to `s2c` and `s2d` [commands](https://github.com/klauspost/compress/tree/master/s2#commandline-tools)
-* Sep 16, 2019: (v1.8.4) Add `s2c` and `s2d` [commandline tools](https://github.com/klauspost/compress/tree/master/s2#commandline-tools).
-* Sep 10, 2019: (v1.8.3) Fix s2 decoder [Skip](https://godoc.org/github.com/klauspost/compress/s2#Reader.Skip).
-* Sep 7, 2019: zstd: Added [WithWindowSize](https://godoc.org/github.com/klauspost/compress/zstd#WithWindowSize), contributed by [ianwilkes](https://github.com/ianwilkes).
-* Sep 5, 2019: (v1.8.2) Add [WithZeroFrames](https://godoc.org/github.com/klauspost/compress/zstd#WithZeroFrames) which adds full zero payload block encoding option.
-* Sep 5, 2019: Lazy initialization of zstandard predefined en/decoder tables.
-* Aug 26, 2019: (v1.8.1) S2: 1-2% compression increase in "better" compression mode.
-* Aug 26, 2019: zstd: Check maximum size of Huffman 1X compressed literals while decoding.
-* Aug 24, 2019: (v1.8.0) Added [S2 compression](https://github.com/klauspost/compress/tree/master/s2#s2-compression), a high performance replacement for Snappy. 
-* Aug 21, 2019: (v1.7.6) Fixed minor issues found by fuzzer. One could lead to zstd not decompressing.
-* Aug 18, 2019: Add [fuzzit](https://fuzzit.dev/) continuous fuzzing.
-* Aug 14, 2019: zstd: Skip incompressible data 2x faster.  [#147](https://github.com/klauspost/compress/pull/147)
-* Aug 4, 2019 (v1.7.5): Better literal compression. [#146](https://github.com/klauspost/compress/pull/146)
-* Aug 4, 2019: Faster zstd compression. [#143](https://github.com/klauspost/compress/pull/143) [#144](https://github.com/klauspost/compress/pull/144)
-* Aug 4, 2019: Faster zstd decompression. [#145](https://github.com/klauspost/compress/pull/145) [#143](https://github.com/klauspost/compress/pull/143) [#142](https://github.com/klauspost/compress/pull/142)
-* July 15, 2019 (v1.7.4): Fix double EOF block in rare cases on zstd encoder.
-* July 15, 2019 (v1.7.3): Minor speedup/compression increase in default zstd encoder.
-* July 14, 2019: zstd decoder: Fix decompression error on multiple uses with mixed content.
-* July 7, 2019 (v1.7.2): Snappy update, zstd decoder potential race fix.
-* June 17, 2019: zstd decompression bugfix.
-* June 17, 2019: fix 32 bit builds.
-* June 17, 2019: Easier use in modules (less dependencies).
-* June 9, 2019: New stronger "default" [zstd](https://github.com/klauspost/compress/tree/master/zstd#zstd) compression mode. Matches zstd default compression ratio.
-* June 5, 2019: 20-40% throughput in [zstandard](https://github.com/klauspost/compress/tree/master/zstd#zstd) compression and better compression.
-* June 5, 2019: deflate/gzip compression: Reduce memory usage of lower compression levels.
-* June 2, 2019: Added [zstandard](https://github.com/klauspost/compress/tree/master/zstd#zstd) compression!
-* May 25, 2019: deflate/gzip: 10% faster bit writer, mostly visible in lower levels.
-* Apr 22, 2019: [zstd](https://github.com/klauspost/compress/tree/master/zstd#zstd) decompression added.
-* Aug 1, 2018: Added [huff0 README](https://github.com/klauspost/compress/tree/master/huff0#huff0-entropy-compression).
-* Jul 8, 2018: Added [Performance Update 2018](#performance-update-2018) below.
-* Jun 23, 2018: Merged [Go 1.11 inflate optimizations](https://go-review.googlesource.com/c/go/+/102235). Go 1.9 is now required. Backwards compatible version tagged with [v1.3.0](https://github.com/klauspost/compress/releases/tag/v1.3.0).
-* Apr 2, 2018: Added [huff0](https://godoc.org/github.com/klauspost/compress/huff0) en/decoder. Experimental for now, API may change.
-* Mar 4, 2018: Added [FSE Entropy](https://godoc.org/github.com/klauspost/compress/fse) en/decoder. Experimental for now, API may change.
-* Nov 3, 2017: Add compression [Estimate](https://godoc.org/github.com/klauspost/compress#Estimate) function.
-* May 28, 2017: Reduce allocations when resetting decoder.
-* Apr 02, 2017: Change back to official crc32, since changes were merged in Go 1.7.
-* Jan 14, 2017: Reduce stack pressure due to array copies. See [Issue #18625](https://github.com/golang/go/issues/18625).
-* Oct 25, 2016: Level 2-4 have been rewritten and now offers significantly better performance than before.
-* Oct 20, 2016: Port zlib changes from Go 1.7 to fix zlib writer issue. Please update.
-* Oct 16, 2016: Go 1.7 changes merged. Apples to apples this package is a few percent faster, but has a significantly better balance between speed and compression per level. 
-* Mar 24, 2016: Always attempt Huffman encoding on level 4-7. This improves base 64 encoded data compression.
-* Mar 24, 2016: Small speedup for level 1-3.
-* Feb 19, 2016: Faster bit writer, level -2 is 15% faster, level 1 is 4% faster.
-* Feb 19, 2016: Handle small payloads faster in level 1-3.
-* Feb 19, 2016: Added faster level 2 + 3 compression modes.
-* Feb 19, 2016: [Rebalanced compression levels](https://blog.klauspost.com/rebalancing-deflate-compression-levels/), so there is a more even progression in terms of compression. New default level is 5.
-* Feb 14, 2016: Snappy: Merge upstream changes. 
-* Feb 14, 2016: Snappy: Fix aggressive skipping.
-* Feb 14, 2016: Snappy: Update benchmark.
-* Feb 13, 2016: Deflate: Fixed assembler problem that could lead to sub-optimal compression.
-* Feb 12, 2016: Snappy: Added AMD64 SSE 4.2 optimizations to matching, which makes easy to compress material run faster. Typical speedup is around 25%.
-* Feb 9, 2016: Added Snappy package fork. This version is 5-7% faster, much more on hard to compress content.
-* Jan 30, 2016: Optimize level 1 to 3 by not considering static dictionary or storing uncompressed. ~4-5% speedup.
-* Jan 16, 2016: Optimization on deflate level 1,2,3 compression.
-* Jan 8 2016: Merge [CL 18317](https://go-review.googlesource.com/#/c/18317): fix reading, writing of zip64 archives.
-* Dec 8 2015: Make level 1 and -2 deterministic even if write size differs.
-* Dec 8 2015: Split encoding functions, so hashing and matching can potentially be inlined. 1-3% faster on AMD64. 5% faster on other platforms.
-* Dec 8 2015: Fixed rare [one byte out-of bounds read](https://github.com/klauspost/compress/issues/20). Please update!
-* Nov 23 2015: Optimization on token writer. ~2-4% faster. Contributed by [@dsnet](https://github.com/dsnet).
-* Nov 20 2015: Small optimization to bit writer on 64 bit systems.
-* Nov 17 2015: Fixed out-of-bound errors if the underlying Writer returned an error. See [#15](https://github.com/klauspost/compress/issues/15).
-* Nov 12 2015: Added [io.WriterTo](https://golang.org/pkg/io/#WriterTo) support to gzip/inflate.
-* Nov 11 2015: Merged [CL 16669](https://go-review.googlesource.com/#/c/16669/4): archive/zip: enable overriding (de)compressors per file
-* Oct 15 2015: Added skipping on uncompressible data. Random data speed up >5x.
-
-</details>
-
-# deflate usage
-
-The packages are drop-in replacements for standard library [deflate](https://godoc.org/github.com/klauspost/compress/flate), [gzip](https://godoc.org/github.com/klauspost/compress/gzip), [zip](https://godoc.org/github.com/klauspost/compress/zip), and [zlib](https://godoc.org/github.com/klauspost/compress/zlib). Simply replace the import path to use them:
-
-Typical speed is about 2x of the standard library packages.
-
-| old import       | new import                            | Documentation                                                           |
-|------------------|---------------------------------------|-------------------------------------------------------------------------|
-| `compress/gzip`  | `github.com/klauspost/compress/gzip`  | [gzip](https://pkg.go.dev/github.com/klauspost/compress/gzip?tab=doc)   |
-| `compress/zlib`  | `github.com/klauspost/compress/zlib`  | [zlib](https://pkg.go.dev/github.com/klauspost/compress/zlib?tab=doc)   |
-| `archive/zip`    | `github.com/klauspost/compress/zip`   | [zip](https://pkg.go.dev/github.com/klauspost/compress/zip?tab=doc)     |
-| `compress/flate` | `github.com/klauspost/compress/flate` | [flate](https://pkg.go.dev/github.com/klauspost/compress/flate?tab=doc) |
-
-You may also be interested in [pgzip](https://github.com/klauspost/pgzip), which is a drop-in replacement for gzip, which support multithreaded compression on big files and the optimized [crc32](https://github.com/klauspost/crc32) package used by these packages.
-
-The packages implement the same API as the standard library, so you can use the original godoc documentation: [gzip](http://golang.org/pkg/compress/gzip/), [zip](http://golang.org/pkg/archive/zip/), [zlib](http://golang.org/pkg/compress/zlib/), [flate](http://golang.org/pkg/compress/flate/).
-
-Currently there is only minor speedup on decompression (mostly CRC32 calculation).
-
-Memory usage is typically 1MB for a Writer. stdlib is in the same range. 
-If you expect to have a lot of concurrently allocated Writers consider using 
-the stateless compression described below.
-
-For compression performance, see: [this spreadsheet](https://docs.google.com/spreadsheets/d/1nuNE2nPfuINCZJRMt6wFWhKpToF95I47XjSsc-1rbPQ/edit?usp=sharing).
-
-To disable all assembly add `-tags=noasm`. This works across all packages.
-
-# Stateless compression
-
-This package offers stateless compression as a special option for gzip/deflate. 
-It will do compression but without maintaining any state between Write calls.
-
-This means there will be no memory kept between Write calls, but compression and speed will be suboptimal.
-
-This is only relevant in cases where you expect to run many thousands of compressors concurrently, 
-but with very little activity. This is *not* intended for regular web servers serving individual requests.  
-
-Because of this, the size of actual Write calls will affect output size.
-
-In gzip, specify level `-3` / `gzip.StatelessCompression` to enable.
-
-For direct deflate use, NewStatelessWriter and StatelessDeflate are available. See [documentation](https://godoc.org/github.com/klauspost/compress/flate#NewStatelessWriter)
-
-A `bufio.Writer` can of course be used to control write sizes. For example, to use a 4KB buffer:
-
-```go
-	// replace 'ioutil.Discard' with your output.
-	gzw, err := gzip.NewWriterLevel(ioutil.Discard, gzip.StatelessCompression)
-	if err != nil {
-		return err
-	}
-	defer gzw.Close()
-
-	w := bufio.NewWriterSize(gzw, 4096)
-	defer w.Flush()
-	
-	// Write to 'w' 
-```
-
-This will only use up to 4KB in memory when the writer is idle. 
-
-Compression is almost always worse than the fastest compression level 
-and each write will allocate (a little) memory. 
-
-
-# Other packages
-
-Here are other packages of good quality and pure Go (no cgo wrappers or autoconverted code):
-
-* [github.com/pierrec/lz4](https://github.com/pierrec/lz4) - strong multithreaded LZ4 compression.
-* [github.com/cosnicolaou/pbzip2](https://github.com/cosnicolaou/pbzip2) - multithreaded bzip2 decompression.
-* [github.com/dsnet/compress](https://github.com/dsnet/compress) - brotli decompression, bzip2 writer.
-* [github.com/ronanh/intcomp](https://github.com/ronanh/intcomp) - Integer compression.
-* [github.com/spenczar/fpc](https://github.com/spenczar/fpc) - Float compression.
-* [github.com/minio/zipindex](https://github.com/minio/zipindex) - External ZIP directory index.
-* [github.com/ybirader/pzip](https://github.com/ybirader/pzip) - Fast concurrent zip archiver and extractor.
-
-# license
-
-This code is licensed under the same conditions as the original Go code. See LICENSE file.
-
-
-
-
+# compress
+
+This package provides various compression algorithms.
+
+* [zstandard](https://github.com/klauspost/compress/tree/master/zstd#zstd) compression and decompression in pure Go.
+* [S2](https://github.com/klauspost/compress/tree/master/s2#s2-compression) is a high performance replacement for Snappy.
+* Optimized [deflate](https://godoc.org/github.com/klauspost/compress/flate) packages which can be used as a dropin replacement for [gzip](https://godoc.org/github.com/klauspost/compress/gzip), [zip](https://godoc.org/github.com/klauspost/compress/zip) and [zlib](https://godoc.org/github.com/klauspost/compress/zlib).
+* [snappy](https://github.com/klauspost/compress/tree/master/snappy) is a drop-in replacement for `github.com/golang/snappy` offering better compression and concurrent streams.
+* [huff0](https://github.com/klauspost/compress/tree/master/huff0) and [FSE](https://github.com/klauspost/compress/tree/master/fse) implementations for raw entropy encoding.
+* [gzhttp](https://github.com/klauspost/compress/tree/master/gzhttp) Provides client and server wrappers for handling gzipped/zstd HTTP requests efficiently.
+* [pgzip](https://github.com/klauspost/pgzip) is a separate package that provides a very fast parallel gzip implementation.
+
+[![Go Reference](https://pkg.go.dev/badge/klauspost/compress.svg)](https://pkg.go.dev/github.com/klauspost/compress?tab=subdirectories)
+[![Go](https://github.com/klauspost/compress/actions/workflows/go.yml/badge.svg)](https://github.com/klauspost/compress/actions/workflows/go.yml)
+[![Sourcegraph Badge](https://sourcegraph.com/github.com/klauspost/compress/-/badge.svg)](https://sourcegraph.com/github.com/klauspost/compress?badge)
+
+# package usage
+
+Use `go get github.com/klauspost/compress@latest` to add it to your project.
+
+This package will support the current Go version and 2 versions back.
+
+* Use the `nounsafe` tag to disable all use of the "unsafe" package.
+* Use the `noasm` tag to disable all assembly across packages.
+
+Use the links above for more information on each.
+
+# changelog
+
+* Feb 9th, 2026 [1.18.4](https://github.com/klauspost/compress/releases/tag/v1.18.4)
+	* gzhttp: Add zstandard to server handler wrapper https://github.com/klauspost/compress/pull/1121
+	* zstd: Add ResetWithOptions to encoder/decoder https://github.com/klauspost/compress/pull/1122
+	* gzhttp: preserve qvalue when extra parameters follow in Accept-Encoding by @analytically in https://github.com/klauspost/compress/pull/1116
+
+* Jan 16th, 2026 [1.18.3](https://github.com/klauspost/compress/releases/tag/v1.18.3)
+	* Downstream CVE-2025-61728. See [golang/go#77102](https://github.com/golang/go/issues/77102).
+
+* Dec 1st, 2025 - [1.18.2](https://github.com/klauspost/compress/releases/tag/v1.18.2)
+	* flate: Fix invalid encoding on level 9 with single value input in https://github.com/klauspost/compress/pull/1115
+	* flate: reduce stateless allocations by @RXamzin in https://github.com/klauspost/compress/pull/1106
+
+* Oct 20, 2025 - [1.18.1](https://github.com/klauspost/compress/releases/tag/v1.18.1) - RETRACTED
+  * zstd: Add simple zstd EncodeTo/DecodeTo functions  https://github.com/klauspost/compress/pull/1079
+  * zstd: Fix incorrect buffer size in dictionary encodes https://github.com/klauspost/compress/pull/1059
+  * s2: check for cap, not len of buffer in EncodeBetter/Best by @vdarulis in https://github.com/klauspost/compress/pull/1080
+  * zlib: Avoiding extra allocation in zlib.reader.Reset by @travelpolicy in https://github.com/klauspost/compress/pull/1086
+  * gzhttp: remove redundant err check in zstdReader by @ryanfowler in https://github.com/klauspost/compress/pull/1090
+  * flate: Faster load+store https://github.com/klauspost/compress/pull/1104
+  * flate: Simplify matchlen https://github.com/klauspost/compress/pull/1101
+  * flate: Use exact sizes for huffman tables https://github.com/klauspost/compress/pull/1103
+
+* Feb 19th, 2025 - [1.18.0](https://github.com/klauspost/compress/releases/tag/v1.18.0)
+  * Add unsafe little endian loaders https://github.com/klauspost/compress/pull/1036
+  * fix: check `r.err != nil` but return a nil value error `err` by @alingse in https://github.com/klauspost/compress/pull/1028
+  * flate: Simplify L4-6 loading https://github.com/klauspost/compress/pull/1043
+  * flate: Simplify matchlen (remove asm) https://github.com/klauspost/compress/pull/1045
+  * s2: Improve small block compression speed w/o asm https://github.com/klauspost/compress/pull/1048
+  * flate: Fix matchlen L5+L6 https://github.com/klauspost/compress/pull/1049
+  * flate: Cleanup & reduce casts https://github.com/klauspost/compress/pull/1050
+
+<details>
+	<summary>See changes to v1.17.x</summary>
+
+* Oct 11th, 2024 - [1.17.11](https://github.com/klauspost/compress/releases/tag/v1.17.11)
+  * zstd: Fix extra CRC written with multiple Close calls https://github.com/klauspost/compress/pull/1017
+  * s2: Don't use stack for index tables https://github.com/klauspost/compress/pull/1014
+  * gzhttp: No content-type on no body response code by @juliens in https://github.com/klauspost/compress/pull/1011
+  * gzhttp: Do not set the content-type when response has no body by @kevinpollet in https://github.com/klauspost/compress/pull/1013
+
+* Sep 23rd, 2024 - [1.17.10](https://github.com/klauspost/compress/releases/tag/v1.17.10)
+	* gzhttp: Add TransportAlwaysDecompress option. https://github.com/klauspost/compress/pull/978
+	* gzhttp: Add supported decompress request body by @mirecl in https://github.com/klauspost/compress/pull/1002
+	* s2: Add EncodeBuffer buffer recycling callback https://github.com/klauspost/compress/pull/982
+	* zstd: Improve memory usage on small streaming encodes https://github.com/klauspost/compress/pull/1007
+	* flate: read data written with partial flush by @vajexal in https://github.com/klauspost/compress/pull/996
+
+* Jun 12th, 2024 - [1.17.9](https://github.com/klauspost/compress/releases/tag/v1.17.9)
+	* s2: Reduce ReadFrom temporary allocations https://github.com/klauspost/compress/pull/949
+	* flate, zstd: Shave some bytes off amd64 matchLen by @greatroar in https://github.com/klauspost/compress/pull/963
+	* Upgrade zip/zlib to 1.22.4 upstream https://github.com/klauspost/compress/pull/970 https://github.com/klauspost/compress/pull/971
+	* zstd: BuildDict fails with RLE table https://github.com/klauspost/compress/pull/951
+
+* Apr 9th, 2024 - [1.17.8](https://github.com/klauspost/compress/releases/tag/v1.17.8)
+	* zstd: Reject blocks where reserved values are not 0 https://github.com/klauspost/compress/pull/885
+	* zstd: Add RLE detection+encoding https://github.com/klauspost/compress/pull/938
+
+* Feb 21st, 2024 - [1.17.7](https://github.com/klauspost/compress/releases/tag/v1.17.7)
+	* s2: Add AsyncFlush method: Complete the block without flushing by @Jille in https://github.com/klauspost/compress/pull/927
+	* s2: Fix literal+repeat exceeds dst crash https://github.com/klauspost/compress/pull/930
+  
+* Feb 5th, 2024 - [1.17.6](https://github.com/klauspost/compress/releases/tag/v1.17.6)
+	* zstd: Fix incorrect repeat coding in best mode https://github.com/klauspost/compress/pull/923
+	* s2: Fix DecodeConcurrent deadlock on errors https://github.com/klauspost/compress/pull/925
+  
+* Jan 26th, 2024 - [v1.17.5](https://github.com/klauspost/compress/releases/tag/v1.17.5)
+	* flate: Fix reset with dictionary on custom window encodes https://github.com/klauspost/compress/pull/912
+	* zstd: Add Frame header encoding and stripping https://github.com/klauspost/compress/pull/908
+	* zstd: Limit better/best default window to 8MB https://github.com/klauspost/compress/pull/913
+	* zstd: Speed improvements by @greatroar in https://github.com/klauspost/compress/pull/896 https://github.com/klauspost/compress/pull/910
+	* s2: Fix callbacks for skippable blocks and disallow 0xfe (Padding) by @Jille in https://github.com/klauspost/compress/pull/916 https://github.com/klauspost/compress/pull/917
+https://github.com/klauspost/compress/pull/919 https://github.com/klauspost/compress/pull/918
+
+* Dec 1st, 2023 - [v1.17.4](https://github.com/klauspost/compress/releases/tag/v1.17.4)
+	* huff0: Speed up symbol counting by @greatroar in https://github.com/klauspost/compress/pull/887
+	* huff0: Remove byteReader by @greatroar in https://github.com/klauspost/compress/pull/886
+	* gzhttp: Allow overriding decompression on transport https://github.com/klauspost/compress/pull/892
+	* gzhttp: Clamp compression level https://github.com/klauspost/compress/pull/890
+	* gzip: Error out if reserved bits are set https://github.com/klauspost/compress/pull/891
+
+* Nov 15th, 2023 - [v1.17.3](https://github.com/klauspost/compress/releases/tag/v1.17.3)
+	* fse: Fix max header size https://github.com/klauspost/compress/pull/881
+	* zstd: Improve better/best compression https://github.com/klauspost/compress/pull/877
+	* gzhttp: Fix missing content type on Close https://github.com/klauspost/compress/pull/883
+
+* Oct 22nd, 2023 - [v1.17.2](https://github.com/klauspost/compress/releases/tag/v1.17.2)
+	* zstd: Fix rare *CORRUPTION* output in "best" mode. See https://github.com/klauspost/compress/pull/876
+
+* Oct 14th, 2023 - [v1.17.1](https://github.com/klauspost/compress/releases/tag/v1.17.1)
+	* s2: Fix S2 "best" dictionary wrong encoding https://github.com/klauspost/compress/pull/871
+	* flate: Reduce allocations in decompressor and minor code improvements by @fakefloordiv in https://github.com/klauspost/compress/pull/869
+	* s2: Fix EstimateBlockSize on 6&7 length input https://github.com/klauspost/compress/pull/867
+
+* Sept 19th, 2023 - [v1.17.0](https://github.com/klauspost/compress/releases/tag/v1.17.0)
+	* Add experimental dictionary builder  https://github.com/klauspost/compress/pull/853
+	* Add xerial snappy read/writer https://github.com/klauspost/compress/pull/838
+	* flate: Add limited window compression https://github.com/klauspost/compress/pull/843
+	* s2: Do 2 overlapping match checks https://github.com/klauspost/compress/pull/839
+	* flate: Add amd64 assembly matchlen https://github.com/klauspost/compress/pull/837
+	* gzip: Copy bufio.Reader on Reset by @thatguystone in https://github.com/klauspost/compress/pull/860
+   
+</details>
+<details>
+	<summary>See changes to v1.16.x</summary>
+
+   
+* July 1st, 2023 - [v1.16.7](https://github.com/klauspost/compress/releases/tag/v1.16.7)
+	* zstd: Fix default level first dictionary encode https://github.com/klauspost/compress/pull/829
+	* s2: add GetBufferCapacity() method by @GiedriusS in https://github.com/klauspost/compress/pull/832
+
+* June 13, 2023 - [v1.16.6](https://github.com/klauspost/compress/releases/tag/v1.16.6)
+	* zstd: correctly ignore WithEncoderPadding(1) by @ianlancetaylor in https://github.com/klauspost/compress/pull/806
+	* zstd: Add amd64 match length assembly https://github.com/klauspost/compress/pull/824
+	* gzhttp: Handle informational headers by @rtribotte in https://github.com/klauspost/compress/pull/815
+	* s2: Improve Better compression slightly https://github.com/klauspost/compress/pull/663
+
+* Apr 16, 2023 - [v1.16.5](https://github.com/klauspost/compress/releases/tag/v1.16.5)
+	* zstd: readByte needs to use io.ReadFull by @jnoxon in https://github.com/klauspost/compress/pull/802
+	* gzip: Fix WriterTo after initial read https://github.com/klauspost/compress/pull/804
+
+* Apr 5, 2023 - [v1.16.4](https://github.com/klauspost/compress/releases/tag/v1.16.4)
+	* zstd: Improve zstd best efficiency by @greatroar and @klauspost in https://github.com/klauspost/compress/pull/784
+	* zstd: Respect WithAllLitEntropyCompression https://github.com/klauspost/compress/pull/792
+	* zstd: Fix amd64 not always detecting corrupt data https://github.com/klauspost/compress/pull/785
+	* zstd: Various minor improvements by @greatroar in https://github.com/klauspost/compress/pull/788 https://github.com/klauspost/compress/pull/794 https://github.com/klauspost/compress/pull/795
+	* s2: Fix huge block overflow https://github.com/klauspost/compress/pull/779
+	* s2: Allow CustomEncoder fallback https://github.com/klauspost/compress/pull/780
+	* gzhttp: Support ResponseWriter Unwrap() in gzhttp handler by @jgimenez in https://github.com/klauspost/compress/pull/799
+
+* Mar 13, 2023 - [v1.16.1](https://github.com/klauspost/compress/releases/tag/v1.16.1)
+	* zstd: Speed up + improve best encoder by @greatroar in https://github.com/klauspost/compress/pull/776
+	* gzhttp: Add optional [BREACH mitigation](https://github.com/klauspost/compress/tree/master/gzhttp#breach-mitigation). https://github.com/klauspost/compress/pull/762 https://github.com/klauspost/compress/pull/768 https://github.com/klauspost/compress/pull/769 https://github.com/klauspost/compress/pull/770 https://github.com/klauspost/compress/pull/767
+	* s2: Add Intel LZ4s converter https://github.com/klauspost/compress/pull/766
+	* zstd: Minor bug fixes https://github.com/klauspost/compress/pull/771 https://github.com/klauspost/compress/pull/772 https://github.com/klauspost/compress/pull/773
+	* huff0: Speed up compress1xDo by @greatroar in https://github.com/klauspost/compress/pull/774
+
+* Feb 26, 2023 - [v1.16.0](https://github.com/klauspost/compress/releases/tag/v1.16.0)
+	* s2: Add [Dictionary](https://github.com/klauspost/compress/tree/master/s2#dictionaries) support.  https://github.com/klauspost/compress/pull/685
+	* s2: Add Compression Size Estimate.  https://github.com/klauspost/compress/pull/752
+	* s2: Add support for custom stream encoder. https://github.com/klauspost/compress/pull/755
+	* s2: Add LZ4 block converter. https://github.com/klauspost/compress/pull/748
+	* s2: Support io.ReaderAt in ReadSeeker. https://github.com/klauspost/compress/pull/747
+	* s2c/s2sx: Use concurrent decoding. https://github.com/klauspost/compress/pull/746
+</details>
+
+<details>
+	<summary>See changes to v1.15.x</summary>
+	
+* Jan 21st, 2023 (v1.15.15)
+	* deflate: Improve level 7-9 https://github.com/klauspost/compress/pull/739
+	* zstd: Add delta encoding support by @greatroar in https://github.com/klauspost/compress/pull/728
+	* zstd: Various speed improvements by @greatroar https://github.com/klauspost/compress/pull/741 https://github.com/klauspost/compress/pull/734 https://github.com/klauspost/compress/pull/736 https://github.com/klauspost/compress/pull/744 https://github.com/klauspost/compress/pull/743 https://github.com/klauspost/compress/pull/745
+	* gzhttp: Add SuffixETag() and DropETag() options to prevent ETag collisions on compressed responses by @willbicks in https://github.com/klauspost/compress/pull/740
+
+* Jan 3rd, 2023 (v1.15.14)
+
+	* flate: Improve speed in big stateless blocks https://github.com/klauspost/compress/pull/718
+	* zstd: Minor speed tweaks by @greatroar in https://github.com/klauspost/compress/pull/716 https://github.com/klauspost/compress/pull/720
+	* export NoGzipResponseWriter for custom ResponseWriter wrappers by @harshavardhana in https://github.com/klauspost/compress/pull/722
+	* s2: Add example for indexing and existing stream https://github.com/klauspost/compress/pull/723
+
+* Dec 11, 2022 (v1.15.13)
+	* zstd: Add [MaxEncodedSize](https://pkg.go.dev/github.com/klauspost/compress@v1.15.13/zstd#Encoder.MaxEncodedSize) to encoder  https://github.com/klauspost/compress/pull/691
+	* zstd: Various tweaks and improvements https://github.com/klauspost/compress/pull/693 https://github.com/klauspost/compress/pull/695 https://github.com/klauspost/compress/pull/696 https://github.com/klauspost/compress/pull/701 https://github.com/klauspost/compress/pull/702 https://github.com/klauspost/compress/pull/703 https://github.com/klauspost/compress/pull/704 https://github.com/klauspost/compress/pull/705 https://github.com/klauspost/compress/pull/706 https://github.com/klauspost/compress/pull/707 https://github.com/klauspost/compress/pull/708
+
+* Oct 26, 2022 (v1.15.12)
+
+	* zstd: Tweak decoder allocs. https://github.com/klauspost/compress/pull/680
+	* gzhttp: Always delete `HeaderNoCompression` https://github.com/klauspost/compress/pull/683
+
+* Sept 26, 2022 (v1.15.11)
+
+	* flate: Improve level 1-3 compression  https://github.com/klauspost/compress/pull/678
+	* zstd: Improve "best" compression by @nightwolfz in https://github.com/klauspost/compress/pull/677
+	* zstd: Fix+reduce decompression allocations https://github.com/klauspost/compress/pull/668
+	* zstd: Fix non-effective noescape tag https://github.com/klauspost/compress/pull/667
+
+* Sept 16, 2022 (v1.15.10)
+
+	* zstd: Add [WithDecodeAllCapLimit](https://pkg.go.dev/github.com/klauspost/compress@v1.15.10/zstd#WithDecodeAllCapLimit) https://github.com/klauspost/compress/pull/649
+	* Add Go 1.19 - deprecate Go 1.16  https://github.com/klauspost/compress/pull/651
+	* flate: Improve level 5+6 compression https://github.com/klauspost/compress/pull/656
+	* zstd: Improve "better" compression  https://github.com/klauspost/compress/pull/657
+	* s2: Improve "best" compression https://github.com/klauspost/compress/pull/658
+	* s2: Improve "better" compression. https://github.com/klauspost/compress/pull/635
+	* s2: Slightly faster non-assembly decompression https://github.com/klauspost/compress/pull/646
+	* Use arrays for constant size copies https://github.com/klauspost/compress/pull/659
+
+* July 21, 2022 (v1.15.9)
+
+	* zstd: Fix decoder crash on amd64 (no BMI) on invalid input https://github.com/klauspost/compress/pull/645
+	* zstd: Disable decoder extended memory copies (amd64) due to possible crashes https://github.com/klauspost/compress/pull/644
+	* zstd: Allow single segments up to "max decoded size" https://github.com/klauspost/compress/pull/643
+
+* July 13, 2022 (v1.15.8)
+
+	* gzip: fix stack exhaustion bug in Reader.Read https://github.com/klauspost/compress/pull/641
+	* s2: Add Index header trim/restore https://github.com/klauspost/compress/pull/638
+	* zstd: Optimize seqdeq amd64 asm by @greatroar in https://github.com/klauspost/compress/pull/636
+	* zstd: Improve decoder memcopy https://github.com/klauspost/compress/pull/637
+	* huff0: Pass a single bitReader pointer to asm by @greatroar in https://github.com/klauspost/compress/pull/634
+	* zstd: Branchless getBits for amd64 w/o BMI2 by @greatroar in https://github.com/klauspost/compress/pull/640
+	* gzhttp: Remove header before writing https://github.com/klauspost/compress/pull/639
+
+* June 29, 2022 (v1.15.7)
+
+	* s2: Fix absolute forward seeks  https://github.com/klauspost/compress/pull/633
+	* zip: Merge upstream  https://github.com/klauspost/compress/pull/631
+	* zip: Re-add zip64 fix https://github.com/klauspost/compress/pull/624
+	* zstd: translate fseDecoder.buildDtable into asm by @WojciechMula in https://github.com/klauspost/compress/pull/598
+	* flate: Faster histograms  https://github.com/klauspost/compress/pull/620
+	* deflate: Use compound hcode  https://github.com/klauspost/compress/pull/622
+
+* June 3, 2022 (v1.15.6)
+	* s2: Improve coding for long, close matches https://github.com/klauspost/compress/pull/613
+	* s2c: Add Snappy/S2 stream recompression https://github.com/klauspost/compress/pull/611
+	* zstd: Always use configured block size https://github.com/klauspost/compress/pull/605
+	* zstd: Fix incorrect hash table placement for dict encoding in default https://github.com/klauspost/compress/pull/606
+	* zstd: Apply default config to ZipDecompressor without options https://github.com/klauspost/compress/pull/608
+	* gzhttp: Exclude more common archive formats https://github.com/klauspost/compress/pull/612
+	* s2: Add ReaderIgnoreCRC https://github.com/klauspost/compress/pull/609
+	* s2: Remove sanity load on index creation https://github.com/klauspost/compress/pull/607
+	* snappy: Use dedicated function for scoring https://github.com/klauspost/compress/pull/614
+	* s2c+s2d: Use official snappy framed extension https://github.com/klauspost/compress/pull/610
+
+* May 25, 2022 (v1.15.5)
+	* s2: Add concurrent stream decompression https://github.com/klauspost/compress/pull/602
+	* s2: Fix final emit oob read crash on amd64 https://github.com/klauspost/compress/pull/601
+	* huff0: asm implementation of Decompress1X by @WojciechMula https://github.com/klauspost/compress/pull/596
+	* zstd: Use 1 less goroutine for stream decoding https://github.com/klauspost/compress/pull/588
+	* zstd: Copy literal in 16 byte blocks when possible https://github.com/klauspost/compress/pull/592
+	* zstd: Speed up when WithDecoderLowmem(false) https://github.com/klauspost/compress/pull/599
+	* zstd: faster next state update in BMI2 version of decode by @WojciechMula in https://github.com/klauspost/compress/pull/593
+	* huff0: Do not check max size when reading table. https://github.com/klauspost/compress/pull/586
+	* flate: Inplace hashing for level 7-9 https://github.com/klauspost/compress/pull/590
+
+
+* May 11, 2022 (v1.15.4)
+	* huff0: decompress directly into output by @WojciechMula in [#577](https://github.com/klauspost/compress/pull/577)
+	* inflate: Keep dict on stack [#581](https://github.com/klauspost/compress/pull/581)
+	* zstd: Faster decoding memcopy in asm [#583](https://github.com/klauspost/compress/pull/583)
+	* zstd: Fix ignored crc [#580](https://github.com/klauspost/compress/pull/580)
+
+* May 5, 2022 (v1.15.3)
+	* zstd: Allow to ignore checksum checking by @WojciechMula [#572](https://github.com/klauspost/compress/pull/572)
+	* s2: Fix incorrect seek for io.SeekEnd in [#575](https://github.com/klauspost/compress/pull/575)
+
+* Apr 26, 2022 (v1.15.2)
+	* zstd: Add x86-64 assembly for decompression on streams and blocks. Contributed by [@WojciechMula](https://github.com/WojciechMula). Typically 2x faster.  [#528](https://github.com/klauspost/compress/pull/528) [#531](https://github.com/klauspost/compress/pull/531) [#545](https://github.com/klauspost/compress/pull/545) [#537](https://github.com/klauspost/compress/pull/537)
+	* zstd: Add options to ZipDecompressor and fixes [#539](https://github.com/klauspost/compress/pull/539)
+	* s2: Use sorted search for index [#555](https://github.com/klauspost/compress/pull/555)
+	* Minimum version is Go 1.16, added CI test on 1.18.
+
+* Mar 11, 2022 (v1.15.1)
+	* huff0: Add x86 assembly of Decode4X by @WojciechMula in [#512](https://github.com/klauspost/compress/pull/512)
+	* zstd: Reuse zip decoders in [#514](https://github.com/klauspost/compress/pull/514)
+	* zstd: Detect extra block data and report as corrupted in [#520](https://github.com/klauspost/compress/pull/520)
+	* zstd: Handle zero sized frame content size stricter in [#521](https://github.com/klauspost/compress/pull/521)
+	* zstd: Add stricter block size checks in [#523](https://github.com/klauspost/compress/pull/523)
+
+* Mar 3, 2022 (v1.15.0)
+	* zstd: Refactor decoder [#498](https://github.com/klauspost/compress/pull/498)
+	* zstd: Add stream encoding without goroutines [#505](https://github.com/klauspost/compress/pull/505)
+	* huff0: Prevent single blocks exceeding 16 bits by @klauspost in[#507](https://github.com/klauspost/compress/pull/507)
+	* flate: Inline literal emission [#509](https://github.com/klauspost/compress/pull/509)
+	* gzhttp: Add zstd to transport [#400](https://github.com/klauspost/compress/pull/400)
+	* gzhttp: Make content-type optional [#510](https://github.com/klauspost/compress/pull/510)
+
+Both compression and decompression now supports "synchronous" stream operations. This means that whenever "concurrency" is set to 1, they will operate without spawning goroutines.
+
+Stream decompression is now faster on asynchronous, since the goroutine allocation much more effectively splits the workload. On typical streams this will typically use 2 cores fully for decompression. When a stream has finished decoding no goroutines will be left over, so decoders can now safely be pooled and still be garbage collected.
+
+While the release has been extensively tested, it is recommended to testing when upgrading.
+
+</details>
+
+<details>
+	<summary>See changes to v1.14.x</summary>
+	
+* Feb 22, 2022 (v1.14.4)
+	* flate: Fix rare huffman only (-2) corruption. [#503](https://github.com/klauspost/compress/pull/503)
+	* zip: Update deprecated CreateHeaderRaw to correctly call CreateRaw by @saracen in [#502](https://github.com/klauspost/compress/pull/502)
+	* zip: don't read data descriptor early by @saracen in [#501](https://github.com/klauspost/compress/pull/501)  #501
+	* huff0: Use static decompression buffer up to 30% faster [#499](https://github.com/klauspost/compress/pull/499) [#500](https://github.com/klauspost/compress/pull/500)
+
+* Feb 17, 2022 (v1.14.3)
+	* flate: Improve fastest levels compression speed ~10% more throughput. [#482](https://github.com/klauspost/compress/pull/482) [#489](https://github.com/klauspost/compress/pull/489) [#490](https://github.com/klauspost/compress/pull/490) [#491](https://github.com/klauspost/compress/pull/491) [#494](https://github.com/klauspost/compress/pull/494)  [#478](https://github.com/klauspost/compress/pull/478)
+	* flate: Faster decompression speed, ~5-10%. [#483](https://github.com/klauspost/compress/pull/483)
+	* s2: Faster compression with Go v1.18 and amd64 microarch level 3+. [#484](https://github.com/klauspost/compress/pull/484) [#486](https://github.com/klauspost/compress/pull/486)
+
+* Jan 25, 2022 (v1.14.2)
+	* zstd: improve header decoder by @dsnet  [#476](https://github.com/klauspost/compress/pull/476)
+	* zstd: Add bigger default blocks  [#469](https://github.com/klauspost/compress/pull/469)
+	* zstd: Remove unused decompression buffer [#470](https://github.com/klauspost/compress/pull/470)
+	* zstd: Fix logically dead code by @ningmingxiao [#472](https://github.com/klauspost/compress/pull/472)
+	* flate: Improve level 7-9 [#471](https://github.com/klauspost/compress/pull/471) [#473](https://github.com/klauspost/compress/pull/473)
+	* zstd: Add noasm tag for xxhash [#475](https://github.com/klauspost/compress/pull/475)
+
+* Jan 11, 2022 (v1.14.1)
+	* s2: Add stream index in [#462](https://github.com/klauspost/compress/pull/462)
+	* flate: Speed and efficiency improvements in [#439](https://github.com/klauspost/compress/pull/439) [#461](https://github.com/klauspost/compress/pull/461) [#455](https://github.com/klauspost/compress/pull/455) [#452](https://github.com/klauspost/compress/pull/452) [#458](https://github.com/klauspost/compress/pull/458)
+	* zstd: Performance improvement in [#420]( https://github.com/klauspost/compress/pull/420) [#456](https://github.com/klauspost/compress/pull/456) [#437](https://github.com/klauspost/compress/pull/437) [#467](https://github.com/klauspost/compress/pull/467) [#468](https://github.com/klauspost/compress/pull/468)
+	* zstd: add arm64 xxhash assembly in [#464](https://github.com/klauspost/compress/pull/464)
+	* Add garbled for binaries for s2 in [#445](https://github.com/klauspost/compress/pull/445)
+</details>
+
+<details>
+	<summary>See changes to v1.13.x</summary>
+	
+* Aug 30, 2021 (v1.13.5)
+	* gz/zlib/flate: Alias stdlib errors [#425](https://github.com/klauspost/compress/pull/425)
+	* s2: Add block support to commandline tools [#413](https://github.com/klauspost/compress/pull/413)
+	* zstd: pooledZipWriter should return Writers to the same pool [#426](https://github.com/klauspost/compress/pull/426)
+	* Removed golang/snappy as external dependency for tests [#421](https://github.com/klauspost/compress/pull/421)
+
+* Aug 12, 2021 (v1.13.4)
+	* Add [snappy replacement package](https://github.com/klauspost/compress/tree/master/snappy).
+	* zstd: Fix incorrect encoding in "best" mode [#415](https://github.com/klauspost/compress/pull/415)
+
+* Aug 3, 2021 (v1.13.3) 
+	* zstd: Improve Best compression [#404](https://github.com/klauspost/compress/pull/404)
+	* zstd: Fix WriteTo error forwarding [#411](https://github.com/klauspost/compress/pull/411)
+	* gzhttp: Return http.HandlerFunc instead of http.Handler. Unlikely breaking change. [#406](https://github.com/klauspost/compress/pull/406)
+	* s2sx: Fix max size error [#399](https://github.com/klauspost/compress/pull/399)
+	* zstd: Add optional stream content size on reset [#401](https://github.com/klauspost/compress/pull/401)
+	* zstd: use SpeedBestCompression for level >= 10 [#410](https://github.com/klauspost/compress/pull/410)
+
+* Jun 14, 2021 (v1.13.1)
+	* s2: Add full Snappy output support  [#396](https://github.com/klauspost/compress/pull/396)
+	* zstd: Add configurable [Decoder window](https://pkg.go.dev/github.com/klauspost/compress/zstd#WithDecoderMaxWindow) size [#394](https://github.com/klauspost/compress/pull/394)
+	* gzhttp: Add header to skip compression  [#389](https://github.com/klauspost/compress/pull/389)
+	* s2: Improve speed with bigger output margin  [#395](https://github.com/klauspost/compress/pull/395)
+
+* Jun 3, 2021 (v1.13.0)
+	* Added [gzhttp](https://github.com/klauspost/compress/tree/master/gzhttp#gzip-handler) which allows wrapping HTTP servers and clients with GZIP compressors.
+	* zstd: Detect short invalid signatures [#382](https://github.com/klauspost/compress/pull/382)
+	* zstd: Spawn decoder goroutine only if needed. [#380](https://github.com/klauspost/compress/pull/380)
+</details>
+
+
+<details>
+	<summary>See changes to v1.12.x</summary>
+	
+* May 25, 2021 (v1.12.3)
+	* deflate: Better/faster Huffman encoding [#374](https://github.com/klauspost/compress/pull/374)
+	* deflate: Allocate less for history. [#375](https://github.com/klauspost/compress/pull/375)
+	* zstd: Forward read errors [#373](https://github.com/klauspost/compress/pull/373) 
+
+* Apr 27, 2021 (v1.12.2)
+	* zstd: Improve better/best compression [#360](https://github.com/klauspost/compress/pull/360) [#364](https://github.com/klauspost/compress/pull/364) [#365](https://github.com/klauspost/compress/pull/365)
+	* zstd: Add helpers to compress/decompress zstd inside zip files [#363](https://github.com/klauspost/compress/pull/363)
+	* deflate: Improve level 5+6 compression [#367](https://github.com/klauspost/compress/pull/367)
+	* s2: Improve better/best compression [#358](https://github.com/klauspost/compress/pull/358) [#359](https://github.com/klauspost/compress/pull/358)
+	* s2: Load after checking src limit on amd64. [#362](https://github.com/klauspost/compress/pull/362)
+	* s2sx: Limit max executable size [#368](https://github.com/klauspost/compress/pull/368) 
+
+* Apr 14, 2021 (v1.12.1)
+	* snappy package removed. Upstream added as dependency.
+	* s2: Better compression in "best" mode [#353](https://github.com/klauspost/compress/pull/353)
+	* s2sx: Add stdin input and detect pre-compressed from signature [#352](https://github.com/klauspost/compress/pull/352)
+	* s2c/s2d: Add http as possible input [#348](https://github.com/klauspost/compress/pull/348)
+	* s2c/s2d/s2sx: Always truncate when writing files [#352](https://github.com/klauspost/compress/pull/352)
+	* zstd: Reduce memory usage further when using [WithLowerEncoderMem](https://pkg.go.dev/github.com/klauspost/compress/zstd#WithLowerEncoderMem) [#346](https://github.com/klauspost/compress/pull/346)
+	* s2: Fix potential problem with amd64 assembly and profilers [#349](https://github.com/klauspost/compress/pull/349)
+</details>
+
+<details>
+	<summary>See changes to v1.11.x</summary>
+	
+* Mar 26, 2021 (v1.11.13)
+	* zstd: Big speedup on small dictionary encodes [#344](https://github.com/klauspost/compress/pull/344) [#345](https://github.com/klauspost/compress/pull/345)
+	* zstd: Add [WithLowerEncoderMem](https://pkg.go.dev/github.com/klauspost/compress/zstd#WithLowerEncoderMem) encoder option [#336](https://github.com/klauspost/compress/pull/336)
+	* deflate: Improve entropy compression [#338](https://github.com/klauspost/compress/pull/338)
+	* s2: Clean up and minor performance improvement in best [#341](https://github.com/klauspost/compress/pull/341)
+
+* Mar 5, 2021 (v1.11.12)
+	* s2: Add `s2sx` binary that creates [self extracting archives](https://github.com/klauspost/compress/tree/master/s2#s2sx-self-extracting-archives).
+	* s2: Speed up decompression on non-assembly platforms [#328](https://github.com/klauspost/compress/pull/328)
+
+* Mar 1, 2021 (v1.11.9)
+	* s2: Add ARM64 decompression assembly. Around 2x output speed. [#324](https://github.com/klauspost/compress/pull/324)
+	* s2: Improve "better" speed and efficiency. [#325](https://github.com/klauspost/compress/pull/325)
+	* s2: Fix binaries.
+
+* Feb 25, 2021 (v1.11.8)
+	* s2: Fixed occasional out-of-bounds write on amd64. Upgrade recommended.
+	* s2: Add AMD64 assembly for better mode. 25-50% faster. [#315](https://github.com/klauspost/compress/pull/315)
+	* s2: Less upfront decoder allocation. [#322](https://github.com/klauspost/compress/pull/322)
+	* zstd: Faster "compression" of incompressible data. [#314](https://github.com/klauspost/compress/pull/314)
+	* zip: Fix zip64 headers. [#313](https://github.com/klauspost/compress/pull/313)
+  
+* Jan 14, 2021 (v1.11.7)
+	* Use Bytes() interface to get bytes across packages. [#309](https://github.com/klauspost/compress/pull/309)
+	* s2: Add 'best' compression option.  [#310](https://github.com/klauspost/compress/pull/310)
+	* s2: Add ReaderMaxBlockSize, changes `s2.NewReader` signature to include varargs. [#311](https://github.com/klauspost/compress/pull/311)
+	* s2: Fix crash on small better buffers. [#308](https://github.com/klauspost/compress/pull/308)
+	* s2: Clean up decoder. [#312](https://github.com/klauspost/compress/pull/312)
+
+* Jan 7, 2021 (v1.11.6)
+	* zstd: Make decoder allocations smaller [#306](https://github.com/klauspost/compress/pull/306)
+	* zstd: Free Decoder resources when Reset is called with a nil io.Reader  [#305](https://github.com/klauspost/compress/pull/305)
+
+* Dec 20, 2020 (v1.11.4)
+	* zstd: Add Best compression mode [#304](https://github.com/klauspost/compress/pull/304)
+	* Add header decoder [#299](https://github.com/klauspost/compress/pull/299)
+	* s2: Add uncompressed stream option [#297](https://github.com/klauspost/compress/pull/297)
+	* Simplify/speed up small blocks with known max size. [#300](https://github.com/klauspost/compress/pull/300)
+	* zstd: Always reset literal dict encoder [#303](https://github.com/klauspost/compress/pull/303)
+
+* Nov 15, 2020 (v1.11.3)
+	* inflate: 10-15% faster decompression  [#293](https://github.com/klauspost/compress/pull/293)
+	* zstd: Tweak DecodeAll default allocation [#295](https://github.com/klauspost/compress/pull/295)
+
+* Oct 11, 2020 (v1.11.2)
+	* s2: Fix out of bounds read in "better" block compression [#291](https://github.com/klauspost/compress/pull/291)
+
+* Oct 1, 2020 (v1.11.1)
+	* zstd: Set allLitEntropy true in default configuration [#286](https://github.com/klauspost/compress/pull/286)
+
+* Sept 8, 2020 (v1.11.0)
+	* zstd: Add experimental compression [dictionaries](https://github.com/klauspost/compress/tree/master/zstd#dictionaries) [#281](https://github.com/klauspost/compress/pull/281)
+	* zstd: Fix mixed Write and ReadFrom calls [#282](https://github.com/klauspost/compress/pull/282)
+	* inflate/gz: Limit variable shifts, ~5% faster decompression [#274](https://github.com/klauspost/compress/pull/274)
+</details>
+
+<details>
+	<summary>See changes to v1.10.x</summary>
+ 
+* July 8, 2020 (v1.10.11) 
+	* zstd: Fix extra block when compressing with ReadFrom. [#278](https://github.com/klauspost/compress/pull/278)
+	* huff0: Also populate compression table when reading decoding table. [#275](https://github.com/klauspost/compress/pull/275)
+	
+* June 23, 2020 (v1.10.10) 
+	* zstd: Skip entropy compression in fastest mode when no matches. [#270](https://github.com/klauspost/compress/pull/270)
+	
+* June 16, 2020 (v1.10.9): 
+	* zstd: API change for specifying dictionaries. See [#268](https://github.com/klauspost/compress/pull/268)
+	* zip: update CreateHeaderRaw to handle zip64 fields. [#266](https://github.com/klauspost/compress/pull/266)
+	* Fuzzit tests removed. The service has been purchased and is no longer available.
+	
+* June 5, 2020 (v1.10.8): 
+	* 1.15x faster zstd block decompression. [#265](https://github.com/klauspost/compress/pull/265)
+	
+* June 1, 2020 (v1.10.7): 
+	* Added zstd decompression [dictionary support](https://github.com/klauspost/compress/tree/master/zstd#dictionaries)
+	* Increase zstd decompression speed up to 1.19x.  [#259](https://github.com/klauspost/compress/pull/259)
+	* Remove internal reset call in zstd compression and reduce allocations. [#263](https://github.com/klauspost/compress/pull/263)
+	
+* May 21, 2020: (v1.10.6) 
+	* zstd: Reduce allocations while decoding. [#258](https://github.com/klauspost/compress/pull/258), [#252](https://github.com/klauspost/compress/pull/252)
+	* zstd: Stricter decompression checks.
+	
+* April 12, 2020: (v1.10.5)
+	* s2-commands: Flush output when receiving SIGINT. [#239](https://github.com/klauspost/compress/pull/239)
+	
+* Apr 8, 2020: (v1.10.4) 
+	* zstd: Minor/special case optimizations. [#251](https://github.com/klauspost/compress/pull/251),  [#250](https://github.com/klauspost/compress/pull/250),  [#249](https://github.com/klauspost/compress/pull/249),  [#247](https://github.com/klauspost/compress/pull/247)
+* Mar 11, 2020: (v1.10.3) 
+	* s2: Use S2 encoder in pure Go mode for Snappy output as well. [#245](https://github.com/klauspost/compress/pull/245)
+	* s2: Fix pure Go block encoder. [#244](https://github.com/klauspost/compress/pull/244)
+	* zstd: Added "better compression" mode. [#240](https://github.com/klauspost/compress/pull/240)
+	* zstd: Improve speed of fastest compression mode by 5-10% [#241](https://github.com/klauspost/compress/pull/241)
+	* zstd: Skip creating encoders when not needed. [#238](https://github.com/klauspost/compress/pull/238)
+	
+* Feb 27, 2020: (v1.10.2) 
+	* Close to 50% speedup in inflate (gzip/zip decompression). [#236](https://github.com/klauspost/compress/pull/236) [#234](https://github.com/klauspost/compress/pull/234) [#232](https://github.com/klauspost/compress/pull/232)
+	* Reduce deflate level 1-6 memory usage up to 59%. [#227](https://github.com/klauspost/compress/pull/227)
+	
+* Feb 18, 2020: (v1.10.1)
+	* Fix zstd crash when resetting multiple times without sending data. [#226](https://github.com/klauspost/compress/pull/226)
+	* deflate: Fix dictionary use on level 1-6. [#224](https://github.com/klauspost/compress/pull/224)
+	* Remove deflate writer reference when closing. [#224](https://github.com/klauspost/compress/pull/224)
+	
+* Feb 4, 2020: (v1.10.0) 
+	* Add optional dictionary to [stateless deflate](https://pkg.go.dev/github.com/klauspost/compress/flate?tab=doc#StatelessDeflate). Breaking change, send `nil` for previous behaviour. [#216](https://github.com/klauspost/compress/pull/216)
+	* Fix buffer overflow on repeated small block deflate.  [#218](https://github.com/klauspost/compress/pull/218)
+	* Allow copying content from an existing ZIP file without decompressing+compressing. [#214](https://github.com/klauspost/compress/pull/214)
+	* Added [S2](https://github.com/klauspost/compress/tree/master/s2#s2-compression) AMD64 assembler and various optimizations. Stream speed >10GB/s.  [#186](https://github.com/klauspost/compress/pull/186)
+
+</details>
+
+<details>
+	<summary>See changes prior to v1.10.0</summary>
+
+* Jan 20,2020 (v1.9.8) Optimize gzip/deflate with better size estimates and faster table generation. [#207](https://github.com/klauspost/compress/pull/207) by [luyu6056](https://github.com/luyu6056),  [#206](https://github.com/klauspost/compress/pull/206).
+* Jan 11, 2020: S2 Encode/Decode will use provided buffer if capacity is big enough. [#204](https://github.com/klauspost/compress/pull/204) 
+* Jan 5, 2020: (v1.9.7) Fix another zstd regression in v1.9.5 - v1.9.6 removed.
+* Jan 4, 2020: (v1.9.6) Regression in v1.9.5 fixed causing corrupt zstd encodes in rare cases.
+* Jan 4, 2020: Faster IO in [s2c + s2d commandline tools](https://github.com/klauspost/compress/tree/master/s2#commandline-tools) compression/decompression. [#192](https://github.com/klauspost/compress/pull/192)
+* Dec 29, 2019: Removed v1.9.5 since fuzz tests showed a compatibility problem with the reference zstandard decoder.
+* Dec 29, 2019: (v1.9.5) zstd: 10-20% faster block compression. [#199](https://github.com/klauspost/compress/pull/199)
+* Dec 29, 2019: [zip](https://godoc.org/github.com/klauspost/compress/zip) package updated with latest Go features
+* Dec 29, 2019: zstd: Single segment flag condintions tweaked. [#197](https://github.com/klauspost/compress/pull/197)
+* Dec 18, 2019: s2: Faster compression when ReadFrom is used. [#198](https://github.com/klauspost/compress/pull/198)
+* Dec 10, 2019: s2: Fix repeat length output when just above at 16MB limit.
+* Dec 10, 2019: zstd: Add function to get decoder as io.ReadCloser. [#191](https://github.com/klauspost/compress/pull/191)
+* Dec 3, 2019: (v1.9.4) S2: limit max repeat length. [#188](https://github.com/klauspost/compress/pull/188)
+* Dec 3, 2019: Add [WithNoEntropyCompression](https://godoc.org/github.com/klauspost/compress/zstd#WithNoEntropyCompression) to zstd [#187](https://github.com/klauspost/compress/pull/187)
+* Dec 3, 2019: Reduce memory use for tests. Check for leaked goroutines.
+* Nov 28, 2019 (v1.9.3) Less allocations in stateless deflate.
+* Nov 28, 2019: 5-20% Faster huff0 decode. Impacts zstd as well. [#184](https://github.com/klauspost/compress/pull/184)
+* Nov 12, 2019 (v1.9.2) Added [Stateless Compression](#stateless-compression) for gzip/deflate.
+* Nov 12, 2019: Fixed zstd decompression of large single blocks. [#180](https://github.com/klauspost/compress/pull/180)
+* Nov 11, 2019: Set default  [s2c](https://github.com/klauspost/compress/tree/master/s2#commandline-tools) block size to 4MB.
+* Nov 11, 2019: Reduce inflate memory use by 1KB.
+* Nov 10, 2019: Less allocations in deflate bit writer.
+* Nov 10, 2019: Fix inconsistent error returned by zstd decoder.
+* Oct 28, 2019 (v1.9.1) ztsd: Fix crash when compressing blocks. [#174](https://github.com/klauspost/compress/pull/174)
+* Oct 24, 2019 (v1.9.0) zstd: Fix rare data corruption [#173](https://github.com/klauspost/compress/pull/173)
+* Oct 24, 2019 zstd: Fix huff0 out of buffer write [#171](https://github.com/klauspost/compress/pull/171) and always return errors [#172](https://github.com/klauspost/compress/pull/172) 
+* Oct 10, 2019: Big deflate rewrite, 30-40% faster with better compression [#105](https://github.com/klauspost/compress/pull/105)
+
+</details>
+
+<details>
+	<summary>See changes prior to v1.9.0</summary>
+
+* Oct 10, 2019: (v1.8.6) zstd: Allow partial reads to get flushed data. [#169](https://github.com/klauspost/compress/pull/169)
+* Oct 3, 2019: Fix inconsistent results on broken zstd streams.
+* Sep 25, 2019: Added `-rm` (remove source files) and `-q` (no output except errors) to `s2c` and `s2d` [commands](https://github.com/klauspost/compress/tree/master/s2#commandline-tools)
+* Sep 16, 2019: (v1.8.4) Add `s2c` and `s2d` [commandline tools](https://github.com/klauspost/compress/tree/master/s2#commandline-tools).
+* Sep 10, 2019: (v1.8.3) Fix s2 decoder [Skip](https://godoc.org/github.com/klauspost/compress/s2#Reader.Skip).
+* Sep 7, 2019: zstd: Added [WithWindowSize](https://godoc.org/github.com/klauspost/compress/zstd#WithWindowSize), contributed by [ianwilkes](https://github.com/ianwilkes).
+* Sep 5, 2019: (v1.8.2) Add [WithZeroFrames](https://godoc.org/github.com/klauspost/compress/zstd#WithZeroFrames) which adds full zero payload block encoding option.
+* Sep 5, 2019: Lazy initialization of zstandard predefined en/decoder tables.
+* Aug 26, 2019: (v1.8.1) S2: 1-2% compression increase in "better" compression mode.
+* Aug 26, 2019: zstd: Check maximum size of Huffman 1X compressed literals while decoding.
+* Aug 24, 2019: (v1.8.0) Added [S2 compression](https://github.com/klauspost/compress/tree/master/s2#s2-compression), a high performance replacement for Snappy. 
+* Aug 21, 2019: (v1.7.6) Fixed minor issues found by fuzzer. One could lead to zstd not decompressing.
+* Aug 18, 2019: Add [fuzzit](https://fuzzit.dev/) continuous fuzzing.
+* Aug 14, 2019: zstd: Skip incompressible data 2x faster.  [#147](https://github.com/klauspost/compress/pull/147)
+* Aug 4, 2019 (v1.7.5): Better literal compression. [#146](https://github.com/klauspost/compress/pull/146)
+* Aug 4, 2019: Faster zstd compression. [#143](https://github.com/klauspost/compress/pull/143) [#144](https://github.com/klauspost/compress/pull/144)
+* Aug 4, 2019: Faster zstd decompression. [#145](https://github.com/klauspost/compress/pull/145) [#143](https://github.com/klauspost/compress/pull/143) [#142](https://github.com/klauspost/compress/pull/142)
+* July 15, 2019 (v1.7.4): Fix double EOF block in rare cases on zstd encoder.
+* July 15, 2019 (v1.7.3): Minor speedup/compression increase in default zstd encoder.
+* July 14, 2019: zstd decoder: Fix decompression error on multiple uses with mixed content.
+* July 7, 2019 (v1.7.2): Snappy update, zstd decoder potential race fix.
+* June 17, 2019: zstd decompression bugfix.
+* June 17, 2019: fix 32 bit builds.
+* June 17, 2019: Easier use in modules (less dependencies).
+* June 9, 2019: New stronger "default" [zstd](https://github.com/klauspost/compress/tree/master/zstd#zstd) compression mode. Matches zstd default compression ratio.
+* June 5, 2019: 20-40% throughput in [zstandard](https://github.com/klauspost/compress/tree/master/zstd#zstd) compression and better compression.
+* June 5, 2019: deflate/gzip compression: Reduce memory usage of lower compression levels.
+* June 2, 2019: Added [zstandard](https://github.com/klauspost/compress/tree/master/zstd#zstd) compression!
+* May 25, 2019: deflate/gzip: 10% faster bit writer, mostly visible in lower levels.
+* Apr 22, 2019: [zstd](https://github.com/klauspost/compress/tree/master/zstd#zstd) decompression added.
+* Aug 1, 2018: Added [huff0 README](https://github.com/klauspost/compress/tree/master/huff0#huff0-entropy-compression).
+* Jul 8, 2018: Added [Performance Update 2018](#performance-update-2018) below.
+* Jun 23, 2018: Merged [Go 1.11 inflate optimizations](https://go-review.googlesource.com/c/go/+/102235). Go 1.9 is now required. Backwards compatible version tagged with [v1.3.0](https://github.com/klauspost/compress/releases/tag/v1.3.0).
+* Apr 2, 2018: Added [huff0](https://godoc.org/github.com/klauspost/compress/huff0) en/decoder. Experimental for now, API may change.
+* Mar 4, 2018: Added [FSE Entropy](https://godoc.org/github.com/klauspost/compress/fse) en/decoder. Experimental for now, API may change.
+* Nov 3, 2017: Add compression [Estimate](https://godoc.org/github.com/klauspost/compress#Estimate) function.
+* May 28, 2017: Reduce allocations when resetting decoder.
+* Apr 02, 2017: Change back to official crc32, since changes were merged in Go 1.7.
+* Jan 14, 2017: Reduce stack pressure due to array copies. See [Issue #18625](https://github.com/golang/go/issues/18625).
+* Oct 25, 2016: Level 2-4 have been rewritten and now offers significantly better performance than before.
+* Oct 20, 2016: Port zlib changes from Go 1.7 to fix zlib writer issue. Please update.
+* Oct 16, 2016: Go 1.7 changes merged. Apples to apples this package is a few percent faster, but has a significantly better balance between speed and compression per level. 
+* Mar 24, 2016: Always attempt Huffman encoding on level 4-7. This improves base 64 encoded data compression.
+* Mar 24, 2016: Small speedup for level 1-3.
+* Feb 19, 2016: Faster bit writer, level -2 is 15% faster, level 1 is 4% faster.
+* Feb 19, 2016: Handle small payloads faster in level 1-3.
+* Feb 19, 2016: Added faster level 2 + 3 compression modes.
+* Feb 19, 2016: [Rebalanced compression levels](https://blog.klauspost.com/rebalancing-deflate-compression-levels/), so there is a more even progression in terms of compression. New default level is 5.
+* Feb 14, 2016: Snappy: Merge upstream changes. 
+* Feb 14, 2016: Snappy: Fix aggressive skipping.
+* Feb 14, 2016: Snappy: Update benchmark.
+* Feb 13, 2016: Deflate: Fixed assembler problem that could lead to sub-optimal compression.
+* Feb 12, 2016: Snappy: Added AMD64 SSE 4.2 optimizations to matching, which makes easy to compress material run faster. Typical speedup is around 25%.
+* Feb 9, 2016: Added Snappy package fork. This version is 5-7% faster, much more on hard to compress content.
+* Jan 30, 2016: Optimize level 1 to 3 by not considering static dictionary or storing uncompressed. ~4-5% speedup.
+* Jan 16, 2016: Optimization on deflate level 1,2,3 compression.
+* Jan 8 2016: Merge [CL 18317](https://go-review.googlesource.com/#/c/18317): fix reading, writing of zip64 archives.
+* Dec 8 2015: Make level 1 and -2 deterministic even if write size differs.
+* Dec 8 2015: Split encoding functions, so hashing and matching can potentially be inlined. 1-3% faster on AMD64. 5% faster on other platforms.
+* Dec 8 2015: Fixed rare [one byte out-of bounds read](https://github.com/klauspost/compress/issues/20). Please update!
+* Nov 23 2015: Optimization on token writer. ~2-4% faster. Contributed by [@dsnet](https://github.com/dsnet).
+* Nov 20 2015: Small optimization to bit writer on 64 bit systems.
+* Nov 17 2015: Fixed out-of-bound errors if the underlying Writer returned an error. See [#15](https://github.com/klauspost/compress/issues/15).
+* Nov 12 2015: Added [io.WriterTo](https://golang.org/pkg/io/#WriterTo) support to gzip/inflate.
+* Nov 11 2015: Merged [CL 16669](https://go-review.googlesource.com/#/c/16669/4): archive/zip: enable overriding (de)compressors per file
+* Oct 15 2015: Added skipping on uncompressible data. Random data speed up >5x.
+
+</details>
+
+# deflate usage
+
+The packages are drop-in replacements for standard library [deflate](https://godoc.org/github.com/klauspost/compress/flate), [gzip](https://godoc.org/github.com/klauspost/compress/gzip), [zip](https://godoc.org/github.com/klauspost/compress/zip), and [zlib](https://godoc.org/github.com/klauspost/compress/zlib). Simply replace the import path to use them:
+
+Typical speed is about 2x of the standard library packages.
+
+| old import       | new import                            | Documentation                                                           |
+|------------------|---------------------------------------|-------------------------------------------------------------------------|
+| `compress/gzip`  | `github.com/klauspost/compress/gzip`  | [gzip](https://pkg.go.dev/github.com/klauspost/compress/gzip?tab=doc)   |
+| `compress/zlib`  | `github.com/klauspost/compress/zlib`  | [zlib](https://pkg.go.dev/github.com/klauspost/compress/zlib?tab=doc)   |
+| `archive/zip`    | `github.com/klauspost/compress/zip`   | [zip](https://pkg.go.dev/github.com/klauspost/compress/zip?tab=doc)     |
+| `compress/flate` | `github.com/klauspost/compress/flate` | [flate](https://pkg.go.dev/github.com/klauspost/compress/flate?tab=doc) |
+
+You may also be interested in [pgzip](https://github.com/klauspost/pgzip), which is a drop-in replacement for gzip, which support multithreaded compression on big files and the optimized [crc32](https://github.com/klauspost/crc32) package used by these packages.
+
+The packages implement the same API as the standard library, so you can use the original godoc documentation: [gzip](http://golang.org/pkg/compress/gzip/), [zip](http://golang.org/pkg/archive/zip/), [zlib](http://golang.org/pkg/compress/zlib/), [flate](http://golang.org/pkg/compress/flate/).
+
+Currently there is only minor speedup on decompression (mostly CRC32 calculation).
+
+Memory usage is typically 1MB for a Writer. stdlib is in the same range. 
+If you expect to have a lot of concurrently allocated Writers consider using 
+the stateless compression described below.
+
+For compression performance, see: [this spreadsheet](https://docs.google.com/spreadsheets/d/1nuNE2nPfuINCZJRMt6wFWhKpToF95I47XjSsc-1rbPQ/edit?usp=sharing).
+
+To disable all assembly add `-tags=noasm`. This works across all packages.
+
+# Stateless compression
+
+This package offers stateless compression as a special option for gzip/deflate. 
+It will do compression but without maintaining any state between Write calls.
+
+This means there will be no memory kept between Write calls, but compression and speed will be suboptimal.
+
+This is only relevant in cases where you expect to run many thousands of compressors concurrently, 
+but with very little activity. This is *not* intended for regular web servers serving individual requests.  
+
+Because of this, the size of actual Write calls will affect output size.
+
+In gzip, specify level `-3` / `gzip.StatelessCompression` to enable.
+
+For direct deflate use, NewStatelessWriter and StatelessDeflate are available. See [documentation](https://godoc.org/github.com/klauspost/compress/flate#NewStatelessWriter)
+
+A `bufio.Writer` can of course be used to control write sizes. For example, to use a 4KB buffer:
+
+```go
+	// replace 'ioutil.Discard' with your output.
+	gzw, err := gzip.NewWriterLevel(ioutil.Discard, gzip.StatelessCompression)
+	if err != nil {
+		return err
+	}
+	defer gzw.Close()
+
+	w := bufio.NewWriterSize(gzw, 4096)
+	defer w.Flush()
+	
+	// Write to 'w' 
+```
+
+This will only use up to 4KB in memory when the writer is idle. 
+
+Compression is almost always worse than the fastest compression level 
+and each write will allocate (a little) memory. 
+
+
+# Other packages
+
+Here are other packages of good quality and pure Go (no cgo wrappers or autoconverted code):
+
+* [github.com/pierrec/lz4](https://github.com/pierrec/lz4) - strong multithreaded LZ4 compression.
+* [github.com/cosnicolaou/pbzip2](https://github.com/cosnicolaou/pbzip2) - multithreaded bzip2 decompression.
+* [github.com/dsnet/compress](https://github.com/dsnet/compress) - brotli decompression, bzip2 writer.
+* [github.com/ronanh/intcomp](https://github.com/ronanh/intcomp) - Integer compression.
+* [github.com/spenczar/fpc](https://github.com/spenczar/fpc) - Float compression.
+* [github.com/minio/zipindex](https://github.com/minio/zipindex) - External ZIP directory index.
+* [github.com/ybirader/pzip](https://github.com/ybirader/pzip) - Fast concurrent zip archiver and extractor.
+
+# license
+
+This code is licensed under the same conditions as the original Go code. See LICENSE file.
+
+
+
+
+
diff -Nur /work/src-orig/docker-registry/vendor/github.com/klauspost/compress/fse/README.md /work/src/docker-registry/vendor/github.com/klauspost/compress/fse/README.md
--- a/vendor/github.com/klauspost/compress/fse/README.md	2026-10-28 10:49:46.383005576 +0000
+++ b/vendor/github.com/klauspost/compress/fse/README.md	2026-10-28 10:50:33.874768275 +0000
@@ -1,79 +1,79 @@
-# Finite State Entropy
-
-This package provides Finite State Entropy encoding and decoding.
-            
-Finite State Entropy (also referenced as [tANS](https://en.wikipedia.org/wiki/Asymmetric_numeral_systems#tANS)) 
-encoding provides a fast near-optimal symbol encoding/decoding
-for byte blocks as implemented in [zstandard](https://github.com/facebook/zstd).
-
-This can be used for compressing input with a lot of similar input values to the smallest number of bytes.
-This does not perform any multi-byte [dictionary coding](https://en.wikipedia.org/wiki/Dictionary_coder) as LZ coders,
-but it can be used as a secondary step to compressors (like Snappy) that does not do entropy encoding. 
-
-* [Godoc documentation](https://godoc.org/github.com/klauspost/compress/fse)
-
-## News
-
- * Feb 2018: First implementation released. Consider this beta software for now.
-
-# Usage
-
-This package provides a low level interface that allows to compress single independent blocks. 
-
-Each block is separate, and there is no built in integrity checks. 
-This means that the caller should keep track of block sizes and also do checksums if needed.  
-
-Compressing a block is done via the [`Compress`](https://godoc.org/github.com/klauspost/compress/fse#Compress) function.
-You must provide input and will receive the output and maybe an error.
-
-These error values can be returned:
-
-| Error               | Description                                                                 |
-|---------------------|-----------------------------------------------------------------------------|
-| `<nil>`             | Everything ok, output is returned                                           |
-| `ErrIncompressible` | Returned when input is judged to be too hard to compress                    |
-| `ErrUseRLE`         | Returned from the compressor when the input is a single byte value repeated |
-| `(error)`           | An internal error occurred.                                                 |
-
-As can be seen above there are errors that will be returned even under normal operation so it is important to handle these.
-
-To reduce allocations you can provide a [`Scratch`](https://godoc.org/github.com/klauspost/compress/fse#Scratch) object 
-that can be re-used for successive calls. Both compression and decompression accepts a `Scratch` object, and the same 
-object can be used for both.   
-
-Be aware, that when re-using a `Scratch` object that the *output* buffer is also re-used, so if you are still using this
-you must set the `Out` field in the scratch to nil. The same buffer is used for compression and decompression output.
-
-Decompressing is done by calling the [`Decompress`](https://godoc.org/github.com/klauspost/compress/fse#Decompress) function.
-You must provide the output from the compression stage, at exactly the size you got back. If you receive an error back
-your input was likely corrupted. 
-
-It is important to note that a successful decoding does *not* mean your output matches your original input. 
-There are no integrity checks, so relying on errors from the decompressor does not assure your data is valid.
-
-For more detailed usage, see examples in the [godoc documentation](https://godoc.org/github.com/klauspost/compress/fse#pkg-examples).
-
-# Performance
-
-A lot of factors are affecting speed. Block sizes and compressibility of the material are primary factors.  
-All compression functions are currently only running on the calling goroutine so only one core will be used per block.  
-
-The compressor is significantly faster if symbols are kept as small as possible. The highest byte value of the input
-is used to reduce some of the processing, so if all your input is above byte value 64 for instance, it may be 
-beneficial to transpose all your input values down by 64.   
-
-With moderate block sizes around 64k speed are typically 200MB/s per core for compression and 
-around 300MB/s decompression speed. 
-
-The same hardware typically does Huffman (deflate) encoding at 125MB/s and decompression at 100MB/s. 
-
-# Plans
-
-At one point, more internals will be exposed to facilitate more "expert" usage of the components. 
-
-A streaming interface is also likely to be implemented. Likely compatible with [FSE stream format](https://github.com/Cyan4973/FiniteStateEntropy/blob/dev/programs/fileio.c#L261).  
-
-# Contributing
-
-Contributions are always welcome. Be aware that adding public functions will require good justification and breaking 
+# Finite State Entropy
+
+This package provides Finite State Entropy encoding and decoding.
+            
+Finite State Entropy (also referenced as [tANS](https://en.wikipedia.org/wiki/Asymmetric_numeral_systems#tANS)) 
+encoding provides a fast near-optimal symbol encoding/decoding
+for byte blocks as implemented in [zstandard](https://github.com/facebook/zstd).
+
+This can be used for compressing input with a lot of similar input values to the smallest number of bytes.
+This does not perform any multi-byte [dictionary coding](https://en.wikipedia.org/wiki/Dictionary_coder) as LZ coders,
+but it can be used as a secondary step to compressors (like Snappy) that does not do entropy encoding. 
+
+* [Godoc documentation](https://godoc.org/github.com/klauspost/compress/fse)
+
+## News
+
+ * Feb 2018: First implementation released. Consider this beta software for now.
+
+# Usage
+
+This package provides a low level interface that allows to compress single independent blocks. 
+
+Each block is separate, and there is no built in integrity checks. 
+This means that the caller should keep track of block sizes and also do checksums if needed.  
+
+Compressing a block is done via the [`Compress`](https://godoc.org/github.com/klauspost/compress/fse#Compress) function.
+You must provide input and will receive the output and maybe an error.
+
+These error values can be returned:
+
+| Error               | Description                                                                 |
+|---------------------|-----------------------------------------------------------------------------|
+| `<nil>`             | Everything ok, output is returned                                           |
+| `ErrIncompressible` | Returned when input is judged to be too hard to compress                    |
+| `ErrUseRLE`         | Returned from the compressor when the input is a single byte value repeated |
+| `(error)`           | An internal error occurred.                                                 |
+
+As can be seen above there are errors that will be returned even under normal operation so it is important to handle these.
+
+To reduce allocations you can provide a [`Scratch`](https://godoc.org/github.com/klauspost/compress/fse#Scratch) object 
+that can be re-used for successive calls. Both compression and decompression accepts a `Scratch` object, and the same 
+object can be used for both.   
+
+Be aware, that when re-using a `Scratch` object that the *output* buffer is also re-used, so if you are still using this
+you must set the `Out` field in the scratch to nil. The same buffer is used for compression and decompression output.
+
+Decompressing is done by calling the [`Decompress`](https://godoc.org/github.com/klauspost/compress/fse#Decompress) function.
+You must provide the output from the compression stage, at exactly the size you got back. If you receive an error back
+your input was likely corrupted. 
+
+It is important to note that a successful decoding does *not* mean your output matches your original input. 
+There are no integrity checks, so relying on errors from the decompressor does not assure your data is valid.
+
+For more detailed usage, see examples in the [godoc documentation](https://godoc.org/github.com/klauspost/compress/fse#pkg-examples).
+
+# Performance
+
+A lot of factors are affecting speed. Block sizes and compressibility of the material are primary factors.  
+All compression functions are currently only running on the calling goroutine so only one core will be used per block.  
+
+The compressor is significantly faster if symbols are kept as small as possible. The highest byte value of the input
+is used to reduce some of the processing, so if all your input is above byte value 64 for instance, it may be 
+beneficial to transpose all your input values down by 64.   
+
+With moderate block sizes around 64k speed are typically 200MB/s per core for compression and 
+around 300MB/s decompression speed. 
+
+The same hardware typically does Huffman (deflate) encoding at 125MB/s and decompression at 100MB/s. 
+
+# Plans
+
+At one point, more internals will be exposed to facilitate more "expert" usage of the components. 
+
+A streaming interface is also likely to be implemented. Likely compatible with [FSE stream format](https://github.com/Cyan4973/FiniteStateEntropy/blob/dev/programs/fileio.c#L261).  
+
+# Contributing
+
+Contributions are always welcome. Be aware that adding public functions will require good justification and breaking 
 changes will likely not be accepted. If in doubt open an issue before writing the PR.  
\ No newline at end of file
diff -Nur /work/src-orig/docker-registry/vendor/github.com/klauspost/compress/huff0/README.md /work/src/docker-registry/vendor/github.com/klauspost/compress/huff0/README.md
--- a/vendor/github.com/klauspost/compress/huff0/README.md	2026-10-28 10:49:46.383005576 +0000
+++ b/vendor/github.com/klauspost/compress/huff0/README.md	2026-10-28 10:50:33.874768275 +0000
@@ -1,89 +1,89 @@
-# Huff0 entropy compression
-
-This package provides Huff0 encoding and decoding as used in zstd.
-            
-[Huff0](https://github.com/Cyan4973/FiniteStateEntropy#new-generation-entropy-coders), 
-a Huffman codec designed for modern CPU, featuring OoO (Out of Order) operations on multiple ALU 
-(Arithmetic Logic Unit), achieving extremely fast compression and decompression speeds.
-
-This can be used for compressing input with a lot of similar input values to the smallest number of bytes.
-This does not perform any multi-byte [dictionary coding](https://en.wikipedia.org/wiki/Dictionary_coder) as LZ coders,
-but it can be used as a secondary step to compressors (like Snappy) that does not do entropy encoding. 
-
-* [Godoc documentation](https://godoc.org/github.com/klauspost/compress/huff0)
-
-## News
-
-This is used as part of the [zstandard](https://github.com/klauspost/compress/tree/master/zstd#zstd) compression and decompression package.
-
-This ensures that most functionality is well tested.
-
-# Usage
-
-This package provides a low level interface that allows to compress single independent blocks. 
-
-Each block is separate, and there is no built in integrity checks. 
-This means that the caller should keep track of block sizes and also do checksums if needed.  
-
-Compressing a block is done via the [`Compress1X`](https://godoc.org/github.com/klauspost/compress/huff0#Compress1X) and 
-[`Compress4X`](https://godoc.org/github.com/klauspost/compress/huff0#Compress4X) functions.
-You must provide input and will receive the output and maybe an error.
-
-These error values can be returned:
-
-| Error               | Description                                                                 |
-|---------------------|-----------------------------------------------------------------------------|
-| `<nil>`             | Everything ok, output is returned                                           |
-| `ErrIncompressible` | Returned when input is judged to be too hard to compress                    |
-| `ErrUseRLE`         | Returned from the compressor when the input is a single byte value repeated |
-| `ErrTooBig`         | Returned if the input block exceeds the maximum allowed size (128 Kib)      |
-| `(error)`           | An internal error occurred.                                                 |
-
-
-As can be seen above some of there are errors that will be returned even under normal operation so it is important to handle these.
-
-To reduce allocations you can provide a [`Scratch`](https://godoc.org/github.com/klauspost/compress/huff0#Scratch) object 
-that can be re-used for successive calls. Both compression and decompression accepts a `Scratch` object, and the same 
-object can be used for both.   
-
-Be aware, that when re-using a `Scratch` object that the *output* buffer is also re-used, so if you are still using this
-you must set the `Out` field in the scratch to nil. The same buffer is used for compression and decompression output.
-
-The `Scratch` object will retain state that allows to re-use previous tables for encoding and decoding.  
-
-## Tables and re-use
-
-Huff0 allows for reusing tables from the previous block to save space if that is expected to give better/faster results. 
-
-The Scratch object allows you to set a [`ReusePolicy`](https://godoc.org/github.com/klauspost/compress/huff0#ReusePolicy) 
-that controls this behaviour. See the documentation for details. This can be altered between each block.
-
-Do however note that this information is *not* stored in the output block and it is up to the users of the package to
-record whether [`ReadTable`](https://godoc.org/github.com/klauspost/compress/huff0#ReadTable) should be called,
-based on the boolean reported back from the CompressXX call. 
-
-If you want to store the table separate from the data, you can access them as `OutData` and `OutTable` on the 
-[`Scratch`](https://godoc.org/github.com/klauspost/compress/huff0#Scratch) object.
-
-## Decompressing
-
-The first part of decoding is to initialize the decoding table through [`ReadTable`](https://godoc.org/github.com/klauspost/compress/huff0#ReadTable).
-This will initialize the decoding tables. 
-You can supply the complete block to `ReadTable` and it will return the data part of the block 
-which can be given to the decompressor. 
-
-Decompressing is done by calling the [`Decompress1X`](https://godoc.org/github.com/klauspost/compress/huff0#Scratch.Decompress1X) 
-or [`Decompress4X`](https://godoc.org/github.com/klauspost/compress/huff0#Scratch.Decompress4X) function.
-
-For concurrently decompressing content with a fixed table a stateless [`Decoder`](https://godoc.org/github.com/klauspost/compress/huff0#Decoder) can be requested which will remain correct as long as the scratch is unchanged. The capacity of the provided slice indicates the expected output size.
-
-You must provide the output from the compression stage, at exactly the size you got back. If you receive an error back
-your input was likely corrupted. 
-
-It is important to note that a successful decoding does *not* mean your output matches your original input. 
-There are no integrity checks, so relying on errors from the decompressor does not assure your data is valid.
-
-# Contributing
-
-Contributions are always welcome. Be aware that adding public functions will require good justification and breaking 
-changes will likely not be accepted. If in doubt open an issue before writing the PR.
+# Huff0 entropy compression
+
+This package provides Huff0 encoding and decoding as used in zstd.
+            
+[Huff0](https://github.com/Cyan4973/FiniteStateEntropy#new-generation-entropy-coders), 
+a Huffman codec designed for modern CPU, featuring OoO (Out of Order) operations on multiple ALU 
+(Arithmetic Logic Unit), achieving extremely fast compression and decompression speeds.
+
+This can be used for compressing input with a lot of similar input values to the smallest number of bytes.
+This does not perform any multi-byte [dictionary coding](https://en.wikipedia.org/wiki/Dictionary_coder) as LZ coders,
+but it can be used as a secondary step to compressors (like Snappy) that does not do entropy encoding. 
+
+* [Godoc documentation](https://godoc.org/github.com/klauspost/compress/huff0)
+
+## News
+
+This is used as part of the [zstandard](https://github.com/klauspost/compress/tree/master/zstd#zstd) compression and decompression package.
+
+This ensures that most functionality is well tested.
+
+# Usage
+
+This package provides a low level interface that allows to compress single independent blocks. 
+
+Each block is separate, and there is no built in integrity checks. 
+This means that the caller should keep track of block sizes and also do checksums if needed.  
+
+Compressing a block is done via the [`Compress1X`](https://godoc.org/github.com/klauspost/compress/huff0#Compress1X) and 
+[`Compress4X`](https://godoc.org/github.com/klauspost/compress/huff0#Compress4X) functions.
+You must provide input and will receive the output and maybe an error.
+
+These error values can be returned:
+
+| Error               | Description                                                                 |
+|---------------------|-----------------------------------------------------------------------------|
+| `<nil>`             | Everything ok, output is returned                                           |
+| `ErrIncompressible` | Returned when input is judged to be too hard to compress                    |
+| `ErrUseRLE`         | Returned from the compressor when the input is a single byte value repeated |
+| `ErrTooBig`         | Returned if the input block exceeds the maximum allowed size (128 Kib)      |
+| `(error)`           | An internal error occurred.                                                 |
+
+
+As can be seen above some of there are errors that will be returned even under normal operation so it is important to handle these.
+
+To reduce allocations you can provide a [`Scratch`](https://godoc.org/github.com/klauspost/compress/huff0#Scratch) object 
+that can be re-used for successive calls. Both compression and decompression accepts a `Scratch` object, and the same 
+object can be used for both.   
+
+Be aware, that when re-using a `Scratch` object that the *output* buffer is also re-used, so if you are still using this
+you must set the `Out` field in the scratch to nil. The same buffer is used for compression and decompression output.
+
+The `Scratch` object will retain state that allows to re-use previous tables for encoding and decoding.  
+
+## Tables and re-use
+
+Huff0 allows for reusing tables from the previous block to save space if that is expected to give better/faster results. 
+
+The Scratch object allows you to set a [`ReusePolicy`](https://godoc.org/github.com/klauspost/compress/huff0#ReusePolicy) 
+that controls this behaviour. See the documentation for details. This can be altered between each block.
+
+Do however note that this information is *not* stored in the output block and it is up to the users of the package to
+record whether [`ReadTable`](https://godoc.org/github.com/klauspost/compress/huff0#ReadTable) should be called,
+based on the boolean reported back from the CompressXX call. 
+
+If you want to store the table separate from the data, you can access them as `OutData` and `OutTable` on the 
+[`Scratch`](https://godoc.org/github.com/klauspost/compress/huff0#Scratch) object.
+
+## Decompressing
+
+The first part of decoding is to initialize the decoding table through [`ReadTable`](https://godoc.org/github.com/klauspost/compress/huff0#ReadTable).
+This will initialize the decoding tables. 
+You can supply the complete block to `ReadTable` and it will return the data part of the block 
+which can be given to the decompressor. 
+
+Decompressing is done by calling the [`Decompress1X`](https://godoc.org/github.com/klauspost/compress/huff0#Scratch.Decompress1X) 
+or [`Decompress4X`](https://godoc.org/github.com/klauspost/compress/huff0#Scratch.Decompress4X) function.
+
+For concurrently decompressing content with a fixed table a stateless [`Decoder`](https://godoc.org/github.com/klauspost/compress/huff0#Decoder) can be requested which will remain correct as long as the scratch is unchanged. The capacity of the provided slice indicates the expected output size.
+
+You must provide the output from the compression stage, at exactly the size you got back. If you receive an error back
+your input was likely corrupted. 
+
+It is important to note that a successful decoding does *not* mean your output matches your original input. 
+There are no integrity checks, so relying on errors from the decompressor does not assure your data is valid.
+
+# Contributing
+
+Contributions are always welcome. Be aware that adding public functions will require good justification and breaking 
+changes will likely not be accepted. If in doubt open an issue before writing the PR.
diff -Nur /work/src-orig/docker-registry/vendor/github.com/klauspost/compress/huff0/decompress_amd64.go /work/src/docker-registry/vendor/github.com/klauspost/compress/huff0/decompress_amd64.go
--- a/vendor/github.com/klauspost/compress/huff0/decompress_amd64.go	2026-10-28 10:49:46.383005576 +0000
+++ b/vendor/github.com/klauspost/compress/huff0/decompress_amd64.go	2026-10-28 10:50:33.874768275 +0000
@@ -1,5 +1,4 @@
 //go:build amd64 && !appengine && !noasm && gc
-// +build amd64,!appengine,!noasm,gc
 
 // This file contains the specialisation of Decoder.Decompress4X
 // and Decoder.Decompress1X that use an asm implementation of thir main loops.
diff -Nur /work/src-orig/docker-registry/vendor/github.com/klauspost/compress/huff0/decompress_generic.go /work/src/docker-registry/vendor/github.com/klauspost/compress/huff0/decompress_generic.go
--- a/vendor/github.com/klauspost/compress/huff0/decompress_generic.go	2026-10-28 10:49:46.383005576 +0000
+++ b/vendor/github.com/klauspost/compress/huff0/decompress_generic.go	2026-10-28 10:50:33.874768275 +0000
@@ -1,5 +1,4 @@
 //go:build !amd64 || appengine || !gc || noasm
-// +build !amd64 appengine !gc noasm
 
 // This file contains a generic implementation of Decoder.Decompress4X.
 package huff0
diff -Nur /work/src-orig/docker-registry/vendor/github.com/klauspost/compress/internal/cpuinfo/cpuinfo_amd64.go /work/src/docker-registry/vendor/github.com/klauspost/compress/internal/cpuinfo/cpuinfo_amd64.go
--- a/vendor/github.com/klauspost/compress/internal/cpuinfo/cpuinfo_amd64.go	2026-10-28 10:49:46.383005576 +0000
+++ b/vendor/github.com/klauspost/compress/internal/cpuinfo/cpuinfo_amd64.go	2026-10-28 10:50:33.874768275 +0000
@@ -1,5 +1,4 @@
 //go:build amd64 && !appengine && !noasm && gc
-// +build amd64,!appengine,!noasm,gc
 
 package cpuinfo
 
diff -Nur /work/src-orig/docker-registry/vendor/github.com/klauspost/compress/zstd/blockenc.go /work/src/docker-registry/vendor/github.com/klauspost/compress/zstd/blockenc.go
--- a/vendor/github.com/klauspost/compress/zstd/blockenc.go	2026-10-28 10:49:46.383005576 +0000
+++ b/vendor/github.com/klauspost/compress/zstd/blockenc.go	2026-10-28 10:50:33.878768256 +0000
@@ -78,6 +78,7 @@
 	b.recentOffsets = [3]uint32{1, 4, 8}
 	b.litEnc.Reuse = huff0.ReusePolicyNone
 	b.coders.setPrev(nil, nil, nil)
+	b.dictLitEnc = nil
 }
 
 // reset will reset the block for a new encode, but in the same stream,
diff -Nur /work/src-orig/docker-registry/vendor/github.com/klauspost/compress/zstd/enc_base.go /work/src/docker-registry/vendor/github.com/klauspost/compress/zstd/enc_base.go
--- a/vendor/github.com/klauspost/compress/zstd/enc_base.go	2026-10-28 10:49:46.383005576 +0000
+++ b/vendor/github.com/klauspost/compress/zstd/enc_base.go	2026-10-28 10:50:33.878768256 +0000
@@ -21,7 +21,7 @@
 	crc         *xxhash.Digest
 	tmp         [8]byte
 	blk         *blockEnc
-	lastDictID  uint32
+	lastDict    *dict
 	lowMem      bool
 }
 
diff -Nur /work/src-orig/docker-registry/vendor/github.com/klauspost/compress/zstd/enc_best.go /work/src/docker-registry/vendor/github.com/klauspost/compress/zstd/enc_best.go
--- a/vendor/github.com/klauspost/compress/zstd/enc_best.go	2026-10-28 10:49:46.383005576 +0000
+++ b/vendor/github.com/klauspost/compress/zstd/enc_best.go	2026-10-28 10:50:33.878768256 +0000
@@ -479,10 +479,13 @@
 	if d == nil {
 		return
 	}
+	dictChanged := d != e.lastDict
 	// Init or copy dict table
-	if len(e.dictTable) != len(e.table) || d.id != e.lastDictID {
+	if len(e.dictTable) != len(e.table) || dictChanged {
 		if len(e.dictTable) != len(e.table) {
 			e.dictTable = make([]prevEntry, len(e.table))
+		} else {
+			clear(e.dictTable)
 		}
 		end := int32(len(d.content)) - 8 + e.maxMatchOff
 		for i := e.maxMatchOff; i < end; i += 4 {
@@ -510,13 +513,14 @@
 				offset: i + 3,
 			}
 		}
-		e.lastDictID = d.id
 	}
 
-	// Init or copy dict table
-	if len(e.dictLongTable) != len(e.longTable) || d.id != e.lastDictID {
+	// Init or copy dict long table
+	if len(e.dictLongTable) != len(e.longTable) || dictChanged {
 		if len(e.dictLongTable) != len(e.longTable) {
 			e.dictLongTable = make([]prevEntry, len(e.longTable))
+		} else {
+			clear(e.dictLongTable)
 		}
 		if len(d.content) >= 8 {
 			cv := load6432(d.content, 0)
@@ -538,8 +542,8 @@
 				off++
 			}
 		}
-		e.lastDictID = d.id
 	}
+	e.lastDict = d
 	// Reset table to initial state
 	copy(e.longTable[:], e.dictLongTable)
 
diff -Nur /work/src-orig/docker-registry/vendor/github.com/klauspost/compress/zstd/enc_better.go /work/src/docker-registry/vendor/github.com/klauspost/compress/zstd/enc_better.go
--- a/vendor/github.com/klauspost/compress/zstd/enc_better.go	2026-10-28 10:49:46.387005555 +0000
+++ b/vendor/github.com/klauspost/compress/zstd/enc_better.go	2026-10-28 10:50:33.878768256 +0000
@@ -1102,10 +1102,13 @@
 	if d == nil {
 		return
 	}
+	dictChanged := d != e.lastDict
 	// Init or copy dict table
-	if len(e.dictTable) != len(e.table) || d.id != e.lastDictID {
+	if len(e.dictTable) != len(e.table) || dictChanged {
 		if len(e.dictTable) != len(e.table) {
 			e.dictTable = make([]tableEntry, len(e.table))
+		} else {
+			clear(e.dictTable)
 		}
 		end := int32(len(d.content)) - 8 + e.maxMatchOff
 		for i := e.maxMatchOff; i < end; i += 4 {
@@ -1133,14 +1136,15 @@
 				offset: i + 3,
 			}
 		}
-		e.lastDictID = d.id
 		e.allDirty = true
 	}
 
-	// Init or copy dict table
-	if len(e.dictLongTable) != len(e.longTable) || d.id != e.lastDictID {
+	// Init or copy dict long table
+	if len(e.dictLongTable) != len(e.longTable) || dictChanged {
 		if len(e.dictLongTable) != len(e.longTable) {
 			e.dictLongTable = make([]prevEntry, len(e.longTable))
+		} else {
+			clear(e.dictLongTable)
 		}
 		if len(d.content) >= 8 {
 			cv := load6432(d.content, 0)
@@ -1162,9 +1166,9 @@
 				off++
 			}
 		}
-		e.lastDictID = d.id
 		e.allDirty = true
 	}
+	e.lastDict = d
 
 	// Reset table to initial state
 	{
diff -Nur /work/src-orig/docker-registry/vendor/github.com/klauspost/compress/zstd/enc_dfast.go /work/src/docker-registry/vendor/github.com/klauspost/compress/zstd/enc_dfast.go
--- a/vendor/github.com/klauspost/compress/zstd/enc_dfast.go	2026-10-28 10:49:46.387005555 +0000
+++ b/vendor/github.com/klauspost/compress/zstd/enc_dfast.go	2026-10-28 10:50:33.878768256 +0000
@@ -1040,15 +1040,18 @@
 // ResetDict will reset and set a dictionary if not nil
 func (e *doubleFastEncoderDict) Reset(d *dict, singleBlock bool) {
 	allDirty := e.allDirty
+	dictChanged := d != e.lastDict
 	e.fastEncoderDict.Reset(d, singleBlock)
 	if d == nil {
 		return
 	}
 
 	// Init or copy dict table
-	if len(e.dictLongTable) != len(e.longTable) || d.id != e.lastDictID {
+	if len(e.dictLongTable) != len(e.longTable) || dictChanged {
 		if len(e.dictLongTable) != len(e.longTable) {
 			e.dictLongTable = make([]tableEntry, len(e.longTable))
+		} else {
+			clear(e.dictLongTable)
 		}
 		if len(d.content) >= 8 {
 			cv := load6432(d.content, 0)
@@ -1065,7 +1068,6 @@
 				}
 			}
 		}
-		e.lastDictID = d.id
 		allDirty = true
 	}
 	// Reset table to initial state
diff -Nur /work/src-orig/docker-registry/vendor/github.com/klauspost/compress/zstd/enc_fast.go /work/src/docker-registry/vendor/github.com/klauspost/compress/zstd/enc_fast.go
--- a/vendor/github.com/klauspost/compress/zstd/enc_fast.go	2026-10-28 10:49:46.387005555 +0000
+++ b/vendor/github.com/klauspost/compress/zstd/enc_fast.go	2026-10-28 10:50:33.878768256 +0000
@@ -805,9 +805,11 @@
 	}
 
 	// Init or copy dict table
-	if len(e.dictTable) != len(e.table) || d.id != e.lastDictID {
+	if len(e.dictTable) != len(e.table) || d != e.lastDict {
 		if len(e.dictTable) != len(e.table) {
 			e.dictTable = make([]tableEntry, len(e.table))
+		} else {
+			clear(e.dictTable)
 		}
 		if true {
 			end := e.maxMatchOff + int32(len(d.content)) - 8
@@ -827,7 +829,7 @@
 				}
 			}
 		}
-		e.lastDictID = d.id
+		e.lastDict = d
 		e.allDirty = true
 	}
 
diff -Nur /work/src-orig/docker-registry/vendor/github.com/klauspost/compress/zstd/encoder.go /work/src/docker-registry/vendor/github.com/klauspost/compress/zstd/encoder.go
--- a/vendor/github.com/klauspost/compress/zstd/encoder.go	2026-10-28 10:49:46.387005555 +0000
+++ b/vendor/github.com/klauspost/compress/zstd/encoder.go	2026-10-28 10:50:33.878768256 +0000
@@ -138,11 +138,18 @@
 func (e *Encoder) ResetWithOptions(w io.Writer, opts ...EOption) error {
 	e.o.resetOpt = true
 	defer func() { e.o.resetOpt = false }()
+	hadDict := e.o.dict != nil
 	for _, o := range opts {
 		if err := o(&e.o); err != nil {
 			return err
 		}
 	}
+	hasDict := e.o.dict != nil
+	if hadDict != hasDict {
+		// Dict presence changed — encoder type must be recreated.
+		e.state.encoder = nil
+		e.init = sync.Once{}
+	}
 	e.Reset(w)
 	return nil
 }
@@ -448,6 +455,12 @@
 	if s.encoder == nil {
 		return nil
 	}
+	if s.w == nil {
+		if len(s.filling) == 0 && !s.headerWritten && !s.eofWritten && s.nInput == 0 {
+			return nil
+		}
+		return errors.New("zstd: encoder has no writer")
+	}
 	err := e.nextBlock(true)
 	if err != nil {
 		if errors.Is(s.err, ErrEncoderClosed) {
diff -Nur /work/src-orig/docker-registry/vendor/github.com/klauspost/compress/zstd/encoder_options.go /work/src/docker-registry/vendor/github.com/klauspost/compress/zstd/encoder_options.go
--- a/vendor/github.com/klauspost/compress/zstd/encoder_options.go	2026-10-28 10:49:46.387005555 +0000
+++ b/vendor/github.com/klauspost/compress/zstd/encoder_options.go	2026-10-28 10:50:33.878768256 +0000
@@ -42,6 +42,7 @@
 		level:         SpeedDefault,
 		allLitEntropy: false,
 		lowMem:        false,
+		fullZero:      true,
 	}
 }
 
diff -Nur /work/src-orig/docker-registry/vendor/github.com/klauspost/compress/zstd/fse_decoder_amd64.go /work/src/docker-registry/vendor/github.com/klauspost/compress/zstd/fse_decoder_amd64.go
--- a/vendor/github.com/klauspost/compress/zstd/fse_decoder_amd64.go	2026-10-28 10:49:46.387005555 +0000
+++ b/vendor/github.com/klauspost/compress/zstd/fse_decoder_amd64.go	2026-10-28 10:50:33.878768256 +0000
@@ -1,5 +1,4 @@
 //go:build amd64 && !appengine && !noasm && gc
-// +build amd64,!appengine,!noasm,gc
 
 package zstd
 
diff -Nur /work/src-orig/docker-registry/vendor/github.com/klauspost/compress/zstd/fse_decoder_generic.go /work/src/docker-registry/vendor/github.com/klauspost/compress/zstd/fse_decoder_generic.go
--- a/vendor/github.com/klauspost/compress/zstd/fse_decoder_generic.go	2026-10-28 10:49:46.387005555 +0000
+++ b/vendor/github.com/klauspost/compress/zstd/fse_decoder_generic.go	2026-10-28 10:50:33.878768256 +0000
@@ -1,5 +1,4 @@
 //go:build !amd64 || appengine || !gc || noasm
-// +build !amd64 appengine !gc noasm
 
 package zstd
 
diff -Nur /work/src-orig/docker-registry/vendor/github.com/klauspost/compress/zstd/internal/xxhash/xxhash_other.go /work/src/docker-registry/vendor/github.com/klauspost/compress/zstd/internal/xxhash/xxhash_other.go
--- a/vendor/github.com/klauspost/compress/zstd/internal/xxhash/xxhash_other.go	2026-10-28 10:49:46.387005555 +0000
+++ b/vendor/github.com/klauspost/compress/zstd/internal/xxhash/xxhash_other.go	2026-10-28 10:50:33.878768256 +0000
@@ -1,5 +1,4 @@
 //go:build (!amd64 && !arm64) || appengine || !gc || purego || noasm
-// +build !amd64,!arm64 appengine !gc purego noasm
 
 package xxhash
 
diff -Nur /work/src-orig/docker-registry/vendor/github.com/klauspost/compress/zstd/matchlen_amd64.go /work/src/docker-registry/vendor/github.com/klauspost/compress/zstd/matchlen_amd64.go
--- a/vendor/github.com/klauspost/compress/zstd/matchlen_amd64.go	2026-10-28 10:49:46.387005555 +0000
+++ b/vendor/github.com/klauspost/compress/zstd/matchlen_amd64.go	2026-10-28 10:50:33.878768256 +0000
@@ -1,5 +1,4 @@
 //go:build amd64 && !appengine && !noasm && gc
-// +build amd64,!appengine,!noasm,gc
 
 // Copyright 2019+ Klaus Post. All rights reserved.
 // License information can be found in the LICENSE file.
diff -Nur /work/src-orig/docker-registry/vendor/github.com/klauspost/compress/zstd/matchlen_generic.go /work/src/docker-registry/vendor/github.com/klauspost/compress/zstd/matchlen_generic.go
--- a/vendor/github.com/klauspost/compress/zstd/matchlen_generic.go	2026-10-28 10:49:46.387005555 +0000
+++ b/vendor/github.com/klauspost/compress/zstd/matchlen_generic.go	2026-10-28 10:50:33.878768256 +0000
@@ -1,5 +1,4 @@
 //go:build !amd64 || appengine || !gc || noasm
-// +build !amd64 appengine !gc noasm
 
 // Copyright 2019+ Klaus Post. All rights reserved.
 // License information can be found in the LICENSE file.
diff -Nur /work/src-orig/docker-registry/vendor/github.com/klauspost/compress/zstd/seqdec_amd64.go /work/src/docker-registry/vendor/github.com/klauspost/compress/zstd/seqdec_amd64.go
--- a/vendor/github.com/klauspost/compress/zstd/seqdec_amd64.go	2026-10-28 10:49:46.387005555 +0000
+++ b/vendor/github.com/klauspost/compress/zstd/seqdec_amd64.go	2026-10-28 10:50:33.878768256 +0000
@@ -1,5 +1,4 @@
 //go:build amd64 && !appengine && !noasm && gc
-// +build amd64,!appengine,!noasm,gc
 
 package zstd
 
diff -Nur /work/src-orig/docker-registry/vendor/github.com/klauspost/compress/zstd/seqdec_generic.go /work/src/docker-registry/vendor/github.com/klauspost/compress/zstd/seqdec_generic.go
--- a/vendor/github.com/klauspost/compress/zstd/seqdec_generic.go	2026-10-28 10:49:46.387005555 +0000
+++ b/vendor/github.com/klauspost/compress/zstd/seqdec_generic.go	2026-10-28 10:50:33.878768256 +0000
@@ -1,5 +1,4 @@
 //go:build !amd64 || appengine || !gc || noasm
-// +build !amd64 appengine !gc noasm
 
 package zstd
 
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/clients.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/clients.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/clients.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/clients.go	2026-10-28 10:50:36.566754968 +0000
@@ -1,7 +1,7 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package otlptrace // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace"
+package otlptrace
 
 import (
 	"context"
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/doc.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/doc.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/doc.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/doc.go	2026-10-28 10:50:36.566754968 +0000
@@ -7,4 +7,4 @@
   - [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc],
   - [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp].
 */
-package otlptrace // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace"
+package otlptrace
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/exporter.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/exporter.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/exporter.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/exporter.go	2026-10-28 10:50:36.566754968 +0000
@@ -1,7 +1,7 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package otlptrace // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace"
+package otlptrace
 
 import (
 	"context"
@@ -97,9 +97,9 @@
 func (e *Exporter) MarshalLog() any {
 	return struct {
 		Type   string
-		Client Client
+		Client string
 	}{
 		Type:   "otlptrace",
-		Client: e.client,
+		Client: fmt.Sprintf("%T", e.client),
 	}
 }
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/attribute.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/attribute.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/attribute.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/attribute.go	2026-10-28 10:50:36.566754968 +0000
@@ -3,7 +3,7 @@
 
 // Package tracetransform provides conversion functionality for the otlptrace
 // exporters.
-package tracetransform // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform"
+package tracetransform
 
 import (
 	commonpb "go.opentelemetry.io/proto/otlp/common/v1"
@@ -87,6 +87,22 @@
 		av.Value = &commonpb.AnyValue_StringValue{
 			StringValue: v.AsString(),
 		}
+	case attribute.BYTESLICE:
+		av.Value = &commonpb.AnyValue_BytesValue{
+			BytesValue: v.AsByteSlice(),
+		}
+	case attribute.SLICE:
+		av.Value = &commonpb.AnyValue_ArrayValue{
+			ArrayValue: &commonpb.ArrayValue{
+				Values: values(v.AsSlice()),
+			},
+		}
+	case attribute.MAP:
+		av.Value = &commonpb.AnyValue_KvlistValue{
+			KvlistValue: &commonpb.KeyValueList{
+				Values: KeyValues(v.AsMap()),
+			},
+		}
 	case attribute.STRINGSLICE:
 		av.Value = &commonpb.AnyValue_ArrayValue{
 			ArrayValue: &commonpb.ArrayValue{
@@ -149,3 +165,11 @@
 	}
 	return converted
 }
+
+func values(vals []attribute.Value) []*commonpb.AnyValue {
+	converted := make([]*commonpb.AnyValue, len(vals))
+	for i, v := range vals {
+		converted[i] = Value(v)
+	}
+	return converted
+}
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/instrumentation.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/instrumentation.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/instrumentation.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/instrumentation.go	2026-10-28 10:50:36.566754968 +0000
@@ -1,7 +1,7 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package tracetransform // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform"
+package tracetransform
 
 import (
 	commonpb "go.opentelemetry.io/proto/otlp/common/v1"
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/resource.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/resource.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/resource.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/resource.go	2026-10-28 10:50:36.566754968 +0000
@@ -1,7 +1,7 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package tracetransform // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform"
+package tracetransform
 
 import (
 	resourcepb "go.opentelemetry.io/proto/otlp/resource/v1"
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/span.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/span.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/span.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/span.go	2026-10-28 10:50:36.566754968 +0000
@@ -1,7 +1,7 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package tracetransform // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform"
+package tracetransform
 
 import (
 	"math"
@@ -37,21 +37,22 @@
 		}
 
 		rKey := sd.Resource().Equivalent()
+		scope := sd.InstrumentationScope()
 		k := key{
 			r:  rKey,
-			is: sd.InstrumentationScope(),
+			is: scope,
 		}
 		scopeSpan, iOk := ssm[k]
 		if !iOk {
 			// Either the resource or instrumentation scope were unknown.
 			scopeSpan = &tracepb.ScopeSpans{
-				Scope:     InstrumentationScope(sd.InstrumentationScope()),
+				Scope:     InstrumentationScope(scope),
 				Spans:     []*tracepb.Span{},
-				SchemaUrl: sd.InstrumentationScope().SchemaURL,
+				SchemaUrl: scope.SchemaURL,
 			}
+			ssm[k] = scopeSpan
 		}
 		scopeSpan.Spans = append(scopeSpan.Spans, span(sd))
-		ssm[k] = scopeSpan
 
 		rs, rOk := rsm[rKey]
 		if !rOk {
@@ -90,14 +91,16 @@
 		return nil
 	}
 
-	tid := sd.SpanContext().TraceID()
-	sid := sd.SpanContext().SpanID()
+	spanContext := sd.SpanContext()
+	tid := spanContext.TraceID()
+	sid := spanContext.SpanID()
 
+	sdStatus := sd.Status()
 	s := &tracepb.Span{
 		TraceId:                tid[:],
 		SpanId:                 sid[:],
-		TraceState:             sd.SpanContext().TraceState().String(),
-		Status:                 status(sd.Status().Code, sd.Status().Description),
+		TraceState:             spanContext.TraceState().String(),
+		Status:                 status(sdStatus.Code, sdStatus.Description),
 		StartTimeUnixNano:      uint64(max(0, sd.StartTime().UnixNano())), // nolint:gosec // Overflow checked.
 		EndTimeUnixNano:        uint64(max(0, sd.EndTime().UnixNano())),   // nolint:gosec // Overflow checked.
 		Links:                  links(sd.Links()),
@@ -110,10 +113,11 @@
 		DroppedLinksCount:      clampUint32(sd.DroppedLinks()),
 	}
 
-	if psid := sd.Parent().SpanID(); psid.IsValid() {
+	sdParent := sd.Parent()
+	if psid := sdParent.SpanID(); psid.IsValid() {
 		s.ParentSpanId = psid[:]
 	}
-	s.Flags = buildSpanFlagsWith(sd.SpanContext().TraceFlags(), sd.Parent())
+	s.Flags = buildSpanFlagsWith(spanContext.TraceFlags(), sdParent)
 
 	return s
 }
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/client.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/client.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/client.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/client.go	2026-10-28 10:50:36.626754673 +0000
@@ -1,11 +1,12 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package otlptracegrpc // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc"
+package otlptracegrpc
 
 import (
 	"context"
 	"errors"
+	"fmt"
 	"sync"
 	"time"
 
@@ -16,6 +17,7 @@
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/metadata"
 	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
 
 	"go.opentelemetry.io/otel/exporters/otlp/otlptrace"
 	"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal"
@@ -26,11 +28,12 @@
 )
 
 type client struct {
-	endpoint      string
-	dialOpts      []grpc.DialOption
-	metadata      metadata.MD
-	exportTimeout time.Duration
-	requestFunc   retry.RequestFunc
+	endpoint       string
+	dialOpts       []grpc.DialOption
+	metadata       metadata.MD
+	exportTimeout  time.Duration
+	maxRequestSize int
+	requestFunc    retry.RequestFunc
 
 	// stopCtx is used as a parent context for all exports. Therefore, when it
 	// is canceled with the stopFunc all exports are canceled.
@@ -65,14 +68,15 @@
 	ctx, cancel := context.WithCancel(context.Background()) //nolint:gosec  // cancel called in client shutdown.
 
 	c := &client{
-		endpoint:      cfg.Traces.Endpoint,
-		exportTimeout: cfg.Traces.Timeout,
-		requestFunc:   cfg.RetryConfig.RequestFunc(retryable),
-		dialOpts:      cfg.DialOptions,
-		stopCtx:       ctx,
-		stopFunc:      cancel,
-		conn:          cfg.GRPCConn,
-		instID:        counter.NextExporterID(),
+		endpoint:       cfg.Traces.Endpoint,
+		exportTimeout:  cfg.Traces.Timeout,
+		maxRequestSize: cfg.Traces.MaxRequestSize,
+		requestFunc:    cfg.RetryConfig.RequestFunc(retryable),
+		dialOpts:       cfg.DialOptions,
+		stopCtx:        ctx,
+		stopFunc:       cancel,
+		conn:           cfg.GRPCConn,
+		instID:         counter.NextExporterID(),
 	}
 
 	if len(cfg.Traces.Headers) > 0 {
@@ -205,16 +209,28 @@
 	ctx, cancel := c.exportContext(ctx)
 	defer cancel()
 
-	var code codes.Code
+	pbRequest := &coltracepb.ExportTraceServiceRequest{
+		ResourceSpans: protoSpans,
+	}
+
+	code := codes.Unknown
 	if c.inst != nil {
-		op := c.inst.ExportSpans(ctx, len(protoSpans))
+		var spanCount int
+		for _, rs := range protoSpans {
+			for _, ss := range rs.ScopeSpans {
+				spanCount += len(ss.Spans)
+			}
+		}
+		op := c.inst.ExportSpans(ctx, spanCount)
 		defer func() { op.End(uploadErr, code) }()
 	}
 
+	if maxSize := c.maxRequestSize; maxSize > 0 && proto.Size(pbRequest) > maxSize {
+		return fmt.Errorf("request message too large: exceeded %d bytes", maxSize)
+	}
+
 	return c.requestFunc(ctx, func(iCtx context.Context) error {
-		resp, err := c.tsc.Export(iCtx, &coltracepb.ExportTraceServiceRequest{
-			ResourceSpans: protoSpans,
-		})
+		resp, err := c.tsc.Export(iCtx, pbRequest)
 		if resp != nil && resp.PartialSuccess != nil {
 			msg := resp.PartialSuccess.GetErrorMessage()
 			n := resp.PartialSuccess.GetRejectedSpans()
@@ -312,12 +328,10 @@
 }
 
 // MarshalLog is the marshaling function used by the logging system to represent this Client.
-func (c *client) MarshalLog() any {
+func (*client) MarshalLog() any {
 	return struct {
-		Type     string
-		Endpoint string
+		Type string
 	}{
-		Type:     "otlptracegrpc",
-		Endpoint: c.endpoint,
+		Type: "otlptracegrpc",
 	}
 }
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/doc.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/doc.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/doc.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/doc.go	2026-10-28 10:50:36.626754673 +0000
@@ -62,4 +62,4 @@
 
 [W3C Baggage HTTP Header Content Format]: https://www.w3.org/TR/baggage/#header-content
 */
-package otlptracegrpc // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc"
+package otlptracegrpc
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/exporter.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/exporter.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/exporter.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/exporter.go	2026-10-28 10:50:36.626754673 +0000
@@ -1,7 +1,7 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package otlptracegrpc // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc"
+package otlptracegrpc
 
 import (
 	"context"
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/counter/counter.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/counter/counter.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/counter/counter.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/counter/counter.go	2026-10-28 10:50:36.626754673 +0000
@@ -1,14 +1,14 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/counter/counter.go.tmpl
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/counter/counter.go.tmpl
+
 // Package counter provides a simple counter for generating unique IDs.
 //
 // This package is used to generate unique IDs while allowing testing packages
 // to reset the counter.
-package counter // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/counter"
+package counter
 
 import "sync/atomic"
 
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/envconfig/envconfig.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/envconfig/envconfig.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/envconfig/envconfig.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/envconfig/envconfig.go	2026-10-28 10:50:36.626754673 +0000
@@ -1,12 +1,12 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/otlp/envconfig/envconfig.go.tmpl
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/otlp/envconfig/envconfig.go.tmpl
+
 // Package envconfig provides functionality to parse configuration from
 // environment variables.
-package envconfig // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/envconfig"
+package envconfig
 
 import (
 	"crypto/tls"
@@ -60,7 +60,7 @@
 func WithBool(n string, fn func(bool)) ConfigFn {
 	return func(e *EnvOptionsReader) {
 		if v, ok := e.GetEnvValue(n); ok {
-			b := strings.ToLower(v) == "true"
+			b := strings.EqualFold(v, "true")
 			fn(b)
 		}
 	}
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/gen.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/gen.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/gen.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/gen.go	2026-10-28 10:50:36.626754673 +0000
@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 // Package internal provides internal functionally for the otlptracegrpc package.
-package internal // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal"
+package internal
 
 //go:generate gotmpl --body=../../../../../internal/shared/otlp/partialsuccess.go.tmpl "--data={}" --out=partialsuccess.go
 //go:generate gotmpl --body=../../../../../internal/shared/otlp/partialsuccess_test.go.tmpl "--data={}" --out=partialsuccess_test.go
@@ -27,8 +27,8 @@
 //go:generate gotmpl --body=../../../../../internal/shared/x/x.go.tmpl "--data={ \"pkg\": \"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc\" }" --out=x/x.go
 //go:generate gotmpl --body=../../../../../internal/shared/x/x_test.go.tmpl "--data={}" --out=x/x_test.go
 
-//go:generate gotmpl --body=../../../../../internal/shared/otlp/observ/target.go.tmpl "--data={ \"pkg\": \"observ\", \"pkg_path\": \"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/observ\" }" --out=observ/target.go
+//go:generate gotmpl --body=../../../../../internal/shared/otlp/observ/target.go.tmpl "--data={ \"pkg\": \"observ\" }" --out=observ/target.go
 //go:generate gotmpl --body=../../../../../internal/shared/otlp/observ/target_test.go.tmpl "--data={ \"pkg\": \"observ\" }" --out=observ/target_test.go
 
-//go:generate gotmpl --body=../../../../../internal/shared/counter/counter.go.tmpl "--data={ \"pkg\": \"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/counter\" }" --out=counter/counter.go
+//go:generate gotmpl --body=../../../../../internal/shared/counter/counter.go.tmpl "--data={}" --out=counter/counter.go
 //go:generate gotmpl --body=../../../../../internal/shared/counter/counter_test.go.tmpl "--data={}" --out=counter/counter_test.go
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/observ/doc.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/observ/doc.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/observ/doc.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/observ/doc.go	2026-10-28 10:50:36.626754673 +0000
@@ -3,4 +3,4 @@
 
 // Package observ provides experimental observability instrumentation for the
 // otlptracegrpc exporter.
-package observ // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/observ"
+package observ
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/observ/instrumentation.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/observ/instrumentation.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/observ/instrumentation.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/observ/instrumentation.go	2026-10-28 10:50:36.626754673 +0000
@@ -1,7 +1,7 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package observ // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/observ"
+package observ
 
 import (
 	"context"
@@ -18,8 +18,8 @@
 	"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/x"
 	"go.opentelemetry.io/otel/internal/global"
 	"go.opentelemetry.io/otel/metric"
-	semconv "go.opentelemetry.io/otel/semconv/v1.40.0"
-	"go.opentelemetry.io/otel/semconv/v1.40.0/otelconv"
+	semconv "go.opentelemetry.io/otel/semconv/v1.43.0"
+	"go.opentelemetry.io/otel/semconv/v1.43.0/otelconv"
 )
 
 const (
@@ -72,6 +72,7 @@
 func get[T any](p *sync.Pool) *[]T { return p.Get().(*[]T) }
 
 func put[T any](p *sync.Pool, s *[]T) {
+	clear(*s)     // erase elements to allow GC to collect what they refer to.
 	*s = (*s)[:0] // Reset.
 	p.Put(s)
 }
@@ -339,7 +340,10 @@
 // the provided non-nil err.
 func rejected(n int64, err error) int64 {
 	ps := errPartialPool.Get().(*internal.PartialSuccess)
-	defer errPartialPool.Put(ps)
+	defer func() {
+		*ps = internal.PartialSuccess{} // erase fields to allow GC to collect them.
+		errPartialPool.Put(ps)
+	}()
 	// Check for partial success.
 	if errors.As(err, ps) {
 		// Bound RejectedItems to [0, n]. This should not be needed,
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/observ/target.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/observ/target.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/observ/target.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/observ/target.go	2026-10-28 10:50:36.626754673 +0000
@@ -1,10 +1,10 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/otlp/observ/target.go.tmpl
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package observ // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/observ"
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/otlp/observ/target.go.tmpl
+
+package observ
 
 import (
 	"errors"
@@ -41,11 +41,10 @@
 	const sep = "://"
 
 	// Find scheme. Do not allocate the string by using url.Parse.
-	idx := strings.Index(target, sep)
-	if idx == -1 {
+	scheme, endpoint, found := strings.Cut(target, sep)
+	if !found {
 		return "", -1, fmt.Errorf("invalid target %q: missing scheme", target)
 	}
-	scheme, endpoint := target[:idx], target[idx+len(sep):]
 
 	// Check for unix schemes.
 	if scheme == schemeUnix || scheme == schemeUnixAbstract {
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig/envconfig.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig/envconfig.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig/envconfig.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig/envconfig.go	2026-10-28 10:50:36.626754673 +0000
@@ -1,10 +1,10 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/otlp/otlptrace/otlpconfig/envconfig.go.tmpl
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package otlpconfig // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig"
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/otlp/otlptrace/otlpconfig/envconfig.go.tmpl
+
+package otlpconfig
 
 import (
 	"crypto/tls"
@@ -49,31 +49,37 @@
 	tlsConf := &tls.Config{}
 	DefaultEnvOptionsReader.Apply(
 		envconfig.WithURL("ENDPOINT", func(u *url.URL) {
-			opts = append(opts, withEndpointScheme(u))
-			opts = append(opts, newSplitOption(func(cfg Config) Config {
-				cfg.Traces.Endpoint = u.Host
-				// For OTLP/HTTP endpoint URLs without a per-signal
-				// configuration, the passed endpoint is used as a base URL
-				// and the signals are sent to these paths relative to that.
-				cfg.Traces.URLPath = path.Join(u.Path, DefaultTracesPath)
-				return cfg
-			}, withEndpointForGRPC(u)))
+			opts = append(
+				opts,
+				withEndpointScheme(u),
+				newSplitOption(func(cfg Config) Config {
+					cfg.Traces.Endpoint = u.Host
+					// For OTLP/HTTP endpoint URLs without a per-signal
+					// configuration, the passed endpoint is used as a base URL
+					// and the signals are sent to these paths relative to that.
+					cfg.Traces.URLPath = path.Join(u.Path, DefaultTracesPath)
+					return cfg
+				}, withEndpointForGRPC(u)),
+			)
 		}),
 		envconfig.WithURL("TRACES_ENDPOINT", func(u *url.URL) {
-			opts = append(opts, withEndpointScheme(u))
-			opts = append(opts, newSplitOption(func(cfg Config) Config {
-				cfg.Traces.Endpoint = u.Host
-				// For endpoint URLs for OTLP/HTTP per-signal variables, the
-				// URL MUST be used as-is without any modification. The only
-				// exception is that if an URL contains no path part, the root
-				// path / MUST be used.
-				path := u.Path
-				if path == "" {
-					path = "/"
-				}
-				cfg.Traces.URLPath = path
-				return cfg
-			}, withEndpointForGRPC(u)))
+			opts = append(
+				opts,
+				withEndpointScheme(u),
+				newSplitOption(func(cfg Config) Config {
+					cfg.Traces.Endpoint = u.Host
+					// For endpoint URLs for OTLP/HTTP per-signal variables, the
+					// URL MUST be used as-is without any modification. The only
+					// exception is that if an URL contains no path part, the root
+					// path / MUST be used.
+					path := u.Path
+					if path == "" {
+						path = "/"
+					}
+					cfg.Traces.URLPath = path
+					return cfg
+				}, withEndpointForGRPC(u)),
+			)
 		}),
 		envconfig.WithCertPool("CERTIFICATE", func(p *x509.CertPool) { tlsConf.RootCAs = p }),
 		envconfig.WithCertPool("TRACES_CERTIFICATE", func(p *x509.CertPool) { tlsConf.RootCAs = p }),
@@ -142,7 +148,7 @@
 }
 
 func withTLSConfig(c *tls.Config, fn func(*tls.Config)) func(e *envconfig.EnvOptionsReader) {
-	return func(e *envconfig.EnvOptionsReader) {
+	return func(*envconfig.EnvOptionsReader) {
 		if c.RootCAs != nil || len(c.Certificates) > 0 {
 			fn(c)
 		}
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig/options.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig/options.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig/options.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig/options.go	2026-10-28 10:50:36.626754673 +0000
@@ -1,11 +1,11 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/otlp/otlptrace/otlpconfig/options.go.tmpl
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/otlp/otlptrace/otlpconfig/options.go.tmpl
+
 // Package otlpconfig provides configuration for the otlptrace exporters.
-package otlpconfig // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig"
+package otlpconfig
 
 import (
 	"crypto/tls"
@@ -31,6 +31,9 @@
 	// DefaultTracesPath is a default URL path for endpoint that
 	// receives spans.
 	DefaultTracesPath string = "/v1/traces"
+	// DefaultMaxRequestSize is the default maximum size of a serialized export
+	// request, before compression.
+	DefaultMaxRequestSize int = 64 * 1024 * 1024
 	// DefaultTimeout is a default max waiting time for the backend to process
 	// each span batch.
 	DefaultTimeout time.Duration = 10 * time.Second
@@ -42,13 +45,14 @@
 	HTTPTransportProxyFunc func(*http.Request) (*url.URL, error)
 
 	SignalConfig struct {
-		Endpoint    string
-		Insecure    bool
-		TLSCfg      *tls.Config
-		Headers     map[string]string
-		Compression Compression
-		Timeout     time.Duration
-		URLPath     string
+		Endpoint       string
+		Insecure       bool
+		TLSCfg         *tls.Config
+		Headers        map[string]string
+		Compression    Compression
+		MaxRequestSize int
+		Timeout        time.Duration
+		URLPath        string
 
 		// gRPC configurations
 		GRPCCredentials credentials.TransportCredentials
@@ -77,10 +81,11 @@
 func NewHTTPConfig(opts ...HTTPOption) Config {
 	cfg := Config{
 		Traces: SignalConfig{
-			Endpoint:    fmt.Sprintf("%s:%d", DefaultCollectorHost, DefaultCollectorHTTPPort),
-			URLPath:     DefaultTracesPath,
-			Compression: NoCompression,
-			Timeout:     DefaultTimeout,
+			Endpoint:       fmt.Sprintf("%s:%d", DefaultCollectorHost, DefaultCollectorHTTPPort),
+			URLPath:        DefaultTracesPath,
+			Compression:    NoCompression,
+			MaxRequestSize: DefaultMaxRequestSize,
+			Timeout:        DefaultTimeout,
 		},
 		RetryConfig: retry.DefaultConfig,
 	}
@@ -94,7 +99,7 @@
 
 // cleanPath returns a path with all spaces trimmed. If urlPath is empty,
 // defaultPath is returned instead.
-func cleanPath(urlPath string, defaultPath string) string {
+func cleanPath(urlPath, defaultPath string) string {
 	tmp := strings.TrimSpace(urlPath)
 	if tmp == "" || tmp == "." {
 		return defaultPath
@@ -111,10 +116,11 @@
 	userAgent := "OTel OTLP Exporter Go/" + otlptrace.Version()
 	cfg := Config{
 		Traces: SignalConfig{
-			Endpoint:    fmt.Sprintf("%s:%d", DefaultCollectorHost, DefaultCollectorGRPCPort),
-			URLPath:     DefaultTracesPath,
-			Compression: NoCompression,
-			Timeout:     DefaultTimeout,
+			Endpoint:       fmt.Sprintf("%s:%d", DefaultCollectorHost, DefaultCollectorGRPCPort),
+			URLPath:        DefaultTracesPath,
+			Compression:    NoCompression,
+			MaxRequestSize: DefaultMaxRequestSize,
+			Timeout:        DefaultTimeout,
 		},
 		RetryConfig: retry.DefaultConfig,
 		DialOptions: []grpc.DialOption{grpc.WithUserAgent(userAgent)},
@@ -128,7 +134,7 @@
 		cfg.DialOptions = append(cfg.DialOptions, grpc.WithDefaultServiceConfig(cfg.ServiceConfig))
 	}
 	// Prioritize GRPCCredentials over Insecure (passing both is an error).
-	if cfg.Traces.GRPCCredentials != nil {
+	if cfg.Traces.GRPCCredentials != nil { //nolint:gocritic // if-else is clearer than switch
 		cfg.DialOptions = append(cfg.DialOptions, grpc.WithTransportCredentials(cfg.Traces.GRPCCredentials))
 	} else if cfg.Traces.Insecure {
 		cfg.DialOptions = append(cfg.DialOptions, grpc.WithTransportCredentials(insecure.NewCredentials()))
@@ -222,7 +228,7 @@
 
 func (splitOption) private() {}
 
-func newSplitOption(httpFn func(cfg Config) Config, grpcFn func(cfg Config) Config) GenericOption {
+func newSplitOption(httpFn, grpcFn func(cfg Config) Config) GenericOption {
 	return &splitOption{httpFn: httpFn, grpcFn: grpcFn}
 }
 
@@ -280,6 +286,11 @@
 
 		cfg.Traces.Endpoint = u.Host
 		cfg.Traces.URLPath = u.Path
+		if cfg.Traces.URLPath == "" {
+			// For HTTP exporters, a URL without a path targets the root path. Set it explicitly so the default signal
+			// path is not appended by cleanPath. (URLPath is ignored by gRPC exporters.)
+			cfg.Traces.URLPath = "/"
+		}
 		cfg.Traces.Insecure = u.Scheme != "https"
 
 		return cfg
@@ -344,6 +355,13 @@
 		return cfg
 	})
 }
+
+func WithMaxRequestSize(size int) GenericOption {
+	return newGenericOption(func(cfg Config) Config {
+		cfg.Traces.MaxRequestSize = size
+		return cfg
+	})
+}
 
 func WithProxy(pf HTTPTransportProxyFunc) GenericOption {
 	return newGenericOption(func(cfg Config) Config {
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig/optiontypes.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig/optiontypes.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig/optiontypes.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig/optiontypes.go	2026-10-28 10:50:36.626754673 +0000
@@ -1,10 +1,10 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/otlp/otlptrace/otlpconfig/optiontypes.go.tmpl
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package otlpconfig // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig"
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/otlp/otlptrace/otlpconfig/optiontypes.go.tmpl
+
+package otlpconfig
 
 const (
 	// DefaultCollectorGRPCPort is the default gRPC port of the collector.
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig/tls.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig/tls.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig/tls.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig/tls.go	2026-10-28 10:50:36.626754673 +0000
@@ -1,10 +1,10 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/otlp/otlptrace/otlpconfig/tls.go.tmpl
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package otlpconfig // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig"
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/otlp/otlptrace/otlpconfig/tls.go.tmpl
+
+package otlpconfig
 
 import (
 	"crypto/tls"
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/partialsuccess.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/partialsuccess.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/partialsuccess.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/partialsuccess.go	2026-10-28 10:50:36.626754673 +0000
@@ -1,10 +1,10 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/otlp/partialsuccess.go
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package internal // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal"
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/otlp/partialsuccess.go
+
+package internal
 
 import "fmt"
 
@@ -41,7 +41,7 @@
 }
 
 // Is supports the errors.Is() interface.
-func (ps PartialSuccess) Is(err error) bool {
+func (PartialSuccess) Is(err error) bool {
 	_, ok := err.(PartialSuccess)
 	return ok
 }
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/retry/retry.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/retry/retry.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/retry/retry.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/retry/retry.go	2026-10-28 10:50:36.626754673 +0000
@@ -1,13 +1,13 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/otlp/retry/retry.go.tmpl
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/otlp/retry/retry.go.tmpl
+
 // Package retry provides request retry functionality that can perform
 // configurable exponential backoff for transient errors and honor any
 // explicit throttle responses received.
-package retry // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/retry"
+package retry
 
 import (
 	"context"
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/version.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/version.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/version.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/version.go	2026-10-28 10:50:36.626754673 +0000
@@ -1,8 +1,8 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package internal // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal"
+package internal
 
 // Version is the current release version of the OpenTelemetry OTLP gRPC trace
 // exporter in use.
-const Version = "1.42.0"
+const Version = "1.45.0"
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/x/observ.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/x/observ.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/x/observ.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/x/observ.go	2026-10-28 10:50:36.626754673 +0000
@@ -1,7 +1,7 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package x // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/x"
+package x
 
 import "strings"
 
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/x/x.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/x/x.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/x/x.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/x/x.go	2026-10-28 10:50:36.626754673 +0000
@@ -1,11 +1,11 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/x/x.go.tmpl
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/x/x.go.tmpl
+
 // Package x documents experimental features for [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc].
-package x // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/x"
+package x
 
 import (
 	"os"
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/options.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/options.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/options.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/options.go	2026-10-28 10:50:36.626754673 +0000
@@ -1,7 +1,7 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package otlptracegrpc // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc"
+package otlptracegrpc
 
 import (
 	"fmt"
@@ -192,6 +192,16 @@
 	return wrappedOption{otlpconfig.WithTimeout(duration)}
 }
 
+// WithMaxRequestSize sets the maximum size, in bytes, of a serialized export
+// request, before compression, that the exporter will send.
+//
+// If size is less than or equal to zero, no request-size limit is applied.
+// Disabling the limit is not recommended because it can lead to excessive
+// resource consumption or abuse.
+func WithMaxRequestSize(size int) Option {
+	return wrappedOption{otlpconfig.WithMaxRequestSize(size)}
+}
+
 // WithRetry sets the retry policy for transient retryable errors that may be
 // returned by the target endpoint when exporting a batch of spans.
 //
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/client.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/client.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/client.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/client.go	2026-10-28 10:50:36.698754317 +0000
@@ -1,7 +1,7 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package otlptracehttp // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp"
+package otlptracehttp
 
 import (
 	"bytes"
@@ -143,9 +143,9 @@
 }
 
 // Stop shuts down the client and interrupt any in-flight request.
-func (d *client) Stop(ctx context.Context) error {
-	d.stopOnce.Do(func() {
-		close(d.stopCh)
+func (c *client) Stop(ctx context.Context) error {
+	c.stopOnce.Do(func() {
+		close(c.stopCh)
 	})
 	select {
 	case <-ctx.Done():
@@ -156,7 +156,7 @@
 }
 
 // UploadTraces sends a batch of spans to the collector.
-func (d *client) UploadTraces(ctx context.Context, protoSpans []*tracepb.ResourceSpans) (uploadErr error) {
+func (c *client) UploadTraces(ctx context.Context, protoSpans []*tracepb.ResourceSpans) (uploadErr error) {
 	pbRequest := &coltracepb.ExportTraceServiceRequest{
 		ResourceSpans: protoSpans,
 	}
@@ -165,30 +165,41 @@
 		return err
 	}
 
-	ctx, cancel := d.contextWithStop(ctx)
+	ctx, cancel := c.contextWithStop(ctx)
 	defer cancel()
 
-	request, err := d.newRequest(rawRequest)
+	if maxSize := c.cfg.MaxRequestSize; maxSize > 0 && len(rawRequest) > maxSize {
+		return fmt.Errorf("request body too large: exceeded %d bytes", maxSize)
+	}
+
+	request, err := c.newRequest(rawRequest)
 	if err != nil {
 		return err
 	}
 
 	var statusCode int
-	if d.inst != nil {
-		op := d.inst.ExportSpans(ctx, len(protoSpans))
+	if c.inst != nil {
+		var spanCount int
+		for _, rs := range protoSpans {
+			for _, ss := range rs.ScopeSpans {
+				spanCount += len(ss.Spans)
+			}
+		}
+		op := c.inst.ExportSpans(ctx, spanCount)
 		defer func() { op.End(uploadErr, statusCode) }()
 	}
 
-	return errors.Join(uploadErr, d.requestFunc(ctx, func(ctx context.Context) error {
+	return errors.Join(uploadErr, c.requestFunc(ctx, func(ctx context.Context) error {
 		select {
 		case <-ctx.Done():
 			return ctx.Err()
 		default:
 		}
 
+		statusCode = 0
 		request.reset(ctx)
 		// nolint:gosec // URL is constructed from validated OTLP endpoint configuration
-		resp, err := d.client.Do(request.Request)
+		resp, err := c.client.Do(request.Request)
 		var urlErr *url.Error
 		if errors.As(err, &urlErr) && urlErr.Temporary() {
 			return newResponseError(http.Header{}, err)
@@ -272,8 +283,8 @@
 	}))
 }
 
-func (d *client) newRequest(body []byte) (request, error) {
-	u := url.URL{Scheme: d.getScheme(), Host: d.cfg.Endpoint, Path: d.cfg.URLPath}
+func (c *client) newRequest(body []byte) (request, error) {
+	u := url.URL{Scheme: c.getScheme(), Host: c.cfg.Endpoint, Path: c.cfg.URLPath}
 	r, err := http.NewRequestWithContext(context.Background(), http.MethodPost, u.String(), http.NoBody)
 	if err != nil {
 		return request{Request: r}, err
@@ -282,13 +293,13 @@
 	userAgent := "OTel OTLP Exporter Go/" + otlptrace.Version()
 	r.Header.Set("User-Agent", userAgent)
 
-	for k, v := range d.cfg.Headers {
+	for k, v := range c.cfg.Headers {
 		r.Header.Set(k, v)
 	}
 	r.Header.Set("Content-Type", contentTypeProto)
 
 	req := request{Request: r}
-	switch Compression(d.cfg.Compression) {
+	switch Compression(c.cfg.Compression) {
 	case NoCompression:
 		r.ContentLength = int64(len(body))
 		req.bodyReader = bodyReader(body)
@@ -299,7 +310,10 @@
 		r.Header.Set("Content-Encoding", "gzip")
 
 		gz := gzPool.Get().(*gzip.Writer)
-		defer gzPool.Put(gz)
+		defer func() {
+			gz.Reset(io.Discard)
+			gzPool.Put(gz)
+		}()
 
 		var b bytes.Buffer
 		gz.Reset(&b)
@@ -320,15 +334,11 @@
 }
 
 // MarshalLog is the marshaling function used by the logging system to represent this Client.
-func (d *client) MarshalLog() any {
+func (*client) MarshalLog() any {
 	return struct {
-		Type     string
-		Endpoint string
-		Insecure bool
+		Type string
 	}{
-		Type:     "otlptracehttp",
-		Endpoint: d.cfg.Endpoint,
-		Insecure: d.cfg.Insecure,
+		Type: "otlptracehttp",
 	}
 }
 
@@ -362,7 +372,7 @@
 
 // retryableError represents a request failure that can be retried.
 type retryableError struct {
-	throttle int64
+	throttle time.Duration
 	err      error
 }
 
@@ -371,16 +381,30 @@
 // if it is not nil.
 func newResponseError(header http.Header, wrapped error) error {
 	var rErr retryableError
-	if s, ok := header["Retry-After"]; ok {
-		if t, err := strconv.ParseInt(s[0], 10, 64); err == nil {
-			rErr.throttle = t
-		}
+	if v := header.Get("Retry-After"); v != "" {
+		rErr.throttle = retryAfterDuration(v)
 	}
 
 	rErr.err = wrapped
 	return rErr
 }
 
+func retryAfterDuration(v string) time.Duration {
+	if t, err := strconv.ParseInt(v, 10, 64); err == nil && t >= 0 {
+		const maxRetryAfterSeconds = int64(1<<63-1) / int64(time.Second)
+		if t > maxRetryAfterSeconds {
+			return time.Duration(1<<63 - 1)
+		}
+		return time.Duration(t) * time.Second
+	}
+
+	if date, err := http.ParseTime(v); err == nil {
+		return max(time.Until(date), 0)
+	}
+
+	return 0
+}
+
 func (e retryableError) Error() string {
 	if e.err != nil {
 		return "retry-able request failure: " + e.err.Error()
@@ -422,17 +446,17 @@
 		return false, 0
 	}
 
-	return true, time.Duration(rErr.throttle)
+	return true, rErr.throttle
 }
 
-func (d *client) getScheme() string {
-	if d.cfg.Insecure {
+func (c *client) getScheme() string {
+	if c.cfg.Insecure {
 		return "http"
 	}
 	return "https"
 }
 
-func (d *client) contextWithStop(ctx context.Context) (context.Context, context.CancelFunc) {
+func (c *client) contextWithStop(ctx context.Context) (context.Context, context.CancelFunc) {
 	// Unify the parent context Done signal with the client's stop
 	// channel.
 	ctx, cancel := context.WithCancel(ctx)
@@ -441,7 +465,7 @@
 		case <-ctx.Done():
 			// Nothing to do, either cancelled or deadline
 			// happened.
-		case <-d.stopCh:
+		case <-c.stopCh:
 			cancel()
 		}
 	}(ctx, cancel)
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/doc.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/doc.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/doc.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/doc.go	2026-10-28 10:50:36.698754317 +0000
@@ -65,4 +65,4 @@
 
 [W3C Baggage HTTP Header Content Format]: https://www.w3.org/TR/baggage/#header-content
 */
-package otlptracehttp // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp"
+package otlptracehttp
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/exporter.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/exporter.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/exporter.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/exporter.go	2026-10-28 10:50:36.698754317 +0000
@@ -1,7 +1,7 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package otlptracehttp // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp"
+package otlptracehttp
 
 import (
 	"context"
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/counter/counter.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/counter/counter.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/counter/counter.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/counter/counter.go	2026-10-28 10:50:36.702754298 +0000
@@ -1,14 +1,14 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/counter/counter.go.tmpl
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/counter/counter.go.tmpl
+
 // Package counter provides a simple counter for generating unique IDs.
 //
 // This package is used to generate unique IDs while allowing testing packages
 // to reset the counter.
-package counter // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/counter"
+package counter
 
 import "sync/atomic"
 
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/envconfig/envconfig.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/envconfig/envconfig.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/envconfig/envconfig.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/envconfig/envconfig.go	2026-10-28 10:50:36.702754298 +0000
@@ -1,12 +1,12 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/otlp/envconfig/envconfig.go.tmpl
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/otlp/envconfig/envconfig.go.tmpl
+
 // Package envconfig provides functionality to parse configuration from
 // environment variables.
-package envconfig // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/envconfig"
+package envconfig
 
 import (
 	"crypto/tls"
@@ -60,7 +60,7 @@
 func WithBool(n string, fn func(bool)) ConfigFn {
 	return func(e *EnvOptionsReader) {
 		if v, ok := e.GetEnvValue(n); ok {
-			b := strings.ToLower(v) == "true"
+			b := strings.EqualFold(v, "true")
 			fn(b)
 		}
 	}
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/gen.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/gen.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/gen.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/gen.go	2026-10-28 10:50:36.702754298 +0000
@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 // Package internal provides internal functionally for the otlptracehttp package.
-package internal // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal"
+package internal
 
 //go:generate gotmpl --body=../../../../../internal/shared/otlp/partialsuccess.go.tmpl "--data={}" --out=partialsuccess.go
 //go:generate gotmpl --body=../../../../../internal/shared/otlp/partialsuccess_test.go.tmpl "--data={}" --out=partialsuccess_test.go
@@ -26,6 +26,6 @@
 
 //go:generate gotmpl --body=../../../../../internal/shared/x/x.go.tmpl "--data={ \"pkg\": \"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp\" }" --out=x/x.go
 
-//go:generate gotmpl --body=../../../../../internal/shared/counter/counter.go.tmpl "--data={ \"pkg\": \"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/counter\" }" --out=counter/counter.go
+//go:generate gotmpl --body=../../../../../internal/shared/counter/counter.go.tmpl "--data={}" --out=counter/counter.go
 //go:generate gotmpl --body=../../../../../internal/shared/counter/counter_test.go.tmpl "--data={}" --out=counter/counter_test.go
 //go:generate gotmpl --body=../../../../../internal/shared/x/x_test.go.tmpl "--data={}" --out=x/x_test.go
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/observ/instrumentation.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/observ/instrumentation.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/observ/instrumentation.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/observ/instrumentation.go	2026-10-28 10:50:36.702754298 +0000
@@ -3,7 +3,7 @@
 
 // Package observ provides experimental observability instrumentation for the
 // otlptracehttp exporter.
-package observ // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/observ"
+package observ
 
 import (
 	"context"
@@ -23,8 +23,8 @@
 	"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/x"
 	"go.opentelemetry.io/otel/internal/global"
 	"go.opentelemetry.io/otel/metric"
-	semconv "go.opentelemetry.io/otel/semconv/v1.40.0"
-	"go.opentelemetry.io/otel/semconv/v1.40.0/otelconv"
+	semconv "go.opentelemetry.io/otel/semconv/v1.43.0"
+	"go.opentelemetry.io/otel/semconv/v1.43.0/otelconv"
 )
 
 const (
@@ -77,6 +77,7 @@
 func get[T any](p *sync.Pool) *[]T { return p.Get().(*[]T) }
 
 func put[T any](p *sync.Pool, s *[]T) {
+	clear(*s)     // erase elements to allow GC to collect what they refer to.
 	*s = (*s)[:0] // Reset.
 	p.Put(s)
 }
@@ -167,7 +168,7 @@
 // to set the "component.name" attribute.
 //
 // The endpoint is the HTTP endpoint the exporter is exporting to. It should be
-// in the format "host:port" or a full URL.
+// in the format "host[:port]".
 func BaseAttrs(id int64, endpoint string) []attribute.KeyValue {
 	host, port, err := parseEndpoint(endpoint)
 	if err != nil || (host == "" && port < 0) {
@@ -345,7 +346,7 @@
 //
 // Otherwise, a new RecordOption is returned with the base attributes of the
 // Instrumentation plus the http.response.status_code attribute set to the
-// provided status, and if err is not nil, the error.type attribute set
+// provided status (if non-zero), and if err is not nil, the error.type attribute set
 // to the type of the error.
 func (i *Instrumentation) recordOption(err error, status int) metric.RecordOption {
 	if err == nil && status == http.StatusOK {
@@ -356,7 +357,9 @@
 	defer put(measureAttrsPool, attrs)
 	*attrs = append(*attrs, i.attrs...)
 
-	*attrs = append(*attrs, semconv.HTTPResponseStatusCode(status))
+	if status != 0 {
+		*attrs = append(*attrs, semconv.HTTPResponseStatusCode(status))
+	}
 	if err != nil {
 		*attrs = append(*attrs, semconv.ErrorType(err))
 	}
@@ -394,7 +397,10 @@
 // the provided non-nil err.
 func rejected(n int64, err error) int64 {
 	ps := errPartialPool.Get().(*internal.PartialSuccess)
-	defer errPartialPool.Put(ps)
+	defer func() {
+		*ps = internal.PartialSuccess{} // erase fields to allow GC to collect them.
+		errPartialPool.Put(ps)
+	}()
 	// Check for partial success.
 	if errors.As(err, ps) {
 		// Bound RejectedItems to [0, n]. This should not be needed,
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig/envconfig.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig/envconfig.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig/envconfig.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig/envconfig.go	2026-10-28 10:50:36.702754298 +0000
@@ -1,10 +1,10 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/otlp/otlptrace/otlpconfig/envconfig.go.tmpl
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package otlpconfig // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig"
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/otlp/otlptrace/otlpconfig/envconfig.go.tmpl
+
+package otlpconfig
 
 import (
 	"crypto/tls"
@@ -49,31 +49,37 @@
 	tlsConf := &tls.Config{}
 	DefaultEnvOptionsReader.Apply(
 		envconfig.WithURL("ENDPOINT", func(u *url.URL) {
-			opts = append(opts, withEndpointScheme(u))
-			opts = append(opts, newSplitOption(func(cfg Config) Config {
-				cfg.Traces.Endpoint = u.Host
-				// For OTLP/HTTP endpoint URLs without a per-signal
-				// configuration, the passed endpoint is used as a base URL
-				// and the signals are sent to these paths relative to that.
-				cfg.Traces.URLPath = path.Join(u.Path, DefaultTracesPath)
-				return cfg
-			}, withEndpointForGRPC(u)))
+			opts = append(
+				opts,
+				withEndpointScheme(u),
+				newSplitOption(func(cfg Config) Config {
+					cfg.Traces.Endpoint = u.Host
+					// For OTLP/HTTP endpoint URLs without a per-signal
+					// configuration, the passed endpoint is used as a base URL
+					// and the signals are sent to these paths relative to that.
+					cfg.Traces.URLPath = path.Join(u.Path, DefaultTracesPath)
+					return cfg
+				}, withEndpointForGRPC(u)),
+			)
 		}),
 		envconfig.WithURL("TRACES_ENDPOINT", func(u *url.URL) {
-			opts = append(opts, withEndpointScheme(u))
-			opts = append(opts, newSplitOption(func(cfg Config) Config {
-				cfg.Traces.Endpoint = u.Host
-				// For endpoint URLs for OTLP/HTTP per-signal variables, the
-				// URL MUST be used as-is without any modification. The only
-				// exception is that if an URL contains no path part, the root
-				// path / MUST be used.
-				path := u.Path
-				if path == "" {
-					path = "/"
-				}
-				cfg.Traces.URLPath = path
-				return cfg
-			}, withEndpointForGRPC(u)))
+			opts = append(
+				opts,
+				withEndpointScheme(u),
+				newSplitOption(func(cfg Config) Config {
+					cfg.Traces.Endpoint = u.Host
+					// For endpoint URLs for OTLP/HTTP per-signal variables, the
+					// URL MUST be used as-is without any modification. The only
+					// exception is that if an URL contains no path part, the root
+					// path / MUST be used.
+					path := u.Path
+					if path == "" {
+						path = "/"
+					}
+					cfg.Traces.URLPath = path
+					return cfg
+				}, withEndpointForGRPC(u)),
+			)
 		}),
 		envconfig.WithCertPool("CERTIFICATE", func(p *x509.CertPool) { tlsConf.RootCAs = p }),
 		envconfig.WithCertPool("TRACES_CERTIFICATE", func(p *x509.CertPool) { tlsConf.RootCAs = p }),
@@ -142,7 +148,7 @@
 }
 
 func withTLSConfig(c *tls.Config, fn func(*tls.Config)) func(e *envconfig.EnvOptionsReader) {
-	return func(e *envconfig.EnvOptionsReader) {
+	return func(*envconfig.EnvOptionsReader) {
 		if c.RootCAs != nil || len(c.Certificates) > 0 {
 			fn(c)
 		}
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig/options.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig/options.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig/options.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig/options.go	2026-10-28 10:50:36.702754298 +0000
@@ -1,11 +1,11 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/otlp/otlptrace/otlpconfig/options.go.tmpl
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/otlp/otlptrace/otlpconfig/options.go.tmpl
+
 // Package otlpconfig provides configuration for the otlptrace exporters.
-package otlpconfig // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig"
+package otlpconfig
 
 import (
 	"crypto/tls"
@@ -31,6 +31,9 @@
 	// DefaultTracesPath is a default URL path for endpoint that
 	// receives spans.
 	DefaultTracesPath string = "/v1/traces"
+	// DefaultMaxRequestSize is the default maximum size of a serialized export
+	// request, before compression.
+	DefaultMaxRequestSize int = 64 * 1024 * 1024
 	// DefaultTimeout is a default max waiting time for the backend to process
 	// each span batch.
 	DefaultTimeout time.Duration = 10 * time.Second
@@ -42,13 +45,14 @@
 	HTTPTransportProxyFunc func(*http.Request) (*url.URL, error)
 
 	SignalConfig struct {
-		Endpoint    string
-		Insecure    bool
-		TLSCfg      *tls.Config
-		Headers     map[string]string
-		Compression Compression
-		Timeout     time.Duration
-		URLPath     string
+		Endpoint       string
+		Insecure       bool
+		TLSCfg         *tls.Config
+		Headers        map[string]string
+		Compression    Compression
+		MaxRequestSize int
+		Timeout        time.Duration
+		URLPath        string
 
 		// gRPC configurations
 		GRPCCredentials credentials.TransportCredentials
@@ -77,10 +81,11 @@
 func NewHTTPConfig(opts ...HTTPOption) Config {
 	cfg := Config{
 		Traces: SignalConfig{
-			Endpoint:    fmt.Sprintf("%s:%d", DefaultCollectorHost, DefaultCollectorHTTPPort),
-			URLPath:     DefaultTracesPath,
-			Compression: NoCompression,
-			Timeout:     DefaultTimeout,
+			Endpoint:       fmt.Sprintf("%s:%d", DefaultCollectorHost, DefaultCollectorHTTPPort),
+			URLPath:        DefaultTracesPath,
+			Compression:    NoCompression,
+			MaxRequestSize: DefaultMaxRequestSize,
+			Timeout:        DefaultTimeout,
 		},
 		RetryConfig: retry.DefaultConfig,
 	}
@@ -94,7 +99,7 @@
 
 // cleanPath returns a path with all spaces trimmed. If urlPath is empty,
 // defaultPath is returned instead.
-func cleanPath(urlPath string, defaultPath string) string {
+func cleanPath(urlPath, defaultPath string) string {
 	tmp := strings.TrimSpace(urlPath)
 	if tmp == "" || tmp == "." {
 		return defaultPath
@@ -111,10 +116,11 @@
 	userAgent := "OTel OTLP Exporter Go/" + otlptrace.Version()
 	cfg := Config{
 		Traces: SignalConfig{
-			Endpoint:    fmt.Sprintf("%s:%d", DefaultCollectorHost, DefaultCollectorGRPCPort),
-			URLPath:     DefaultTracesPath,
-			Compression: NoCompression,
-			Timeout:     DefaultTimeout,
+			Endpoint:       fmt.Sprintf("%s:%d", DefaultCollectorHost, DefaultCollectorGRPCPort),
+			URLPath:        DefaultTracesPath,
+			Compression:    NoCompression,
+			MaxRequestSize: DefaultMaxRequestSize,
+			Timeout:        DefaultTimeout,
 		},
 		RetryConfig: retry.DefaultConfig,
 		DialOptions: []grpc.DialOption{grpc.WithUserAgent(userAgent)},
@@ -128,7 +134,7 @@
 		cfg.DialOptions = append(cfg.DialOptions, grpc.WithDefaultServiceConfig(cfg.ServiceConfig))
 	}
 	// Prioritize GRPCCredentials over Insecure (passing both is an error).
-	if cfg.Traces.GRPCCredentials != nil {
+	if cfg.Traces.GRPCCredentials != nil { //nolint:gocritic // if-else is clearer than switch
 		cfg.DialOptions = append(cfg.DialOptions, grpc.WithTransportCredentials(cfg.Traces.GRPCCredentials))
 	} else if cfg.Traces.Insecure {
 		cfg.DialOptions = append(cfg.DialOptions, grpc.WithTransportCredentials(insecure.NewCredentials()))
@@ -222,7 +228,7 @@
 
 func (splitOption) private() {}
 
-func newSplitOption(httpFn func(cfg Config) Config, grpcFn func(cfg Config) Config) GenericOption {
+func newSplitOption(httpFn, grpcFn func(cfg Config) Config) GenericOption {
 	return &splitOption{httpFn: httpFn, grpcFn: grpcFn}
 }
 
@@ -280,6 +286,11 @@
 
 		cfg.Traces.Endpoint = u.Host
 		cfg.Traces.URLPath = u.Path
+		if cfg.Traces.URLPath == "" {
+			// For HTTP exporters, a URL without a path targets the root path. Set it explicitly so the default signal
+			// path is not appended by cleanPath. (URLPath is ignored by gRPC exporters.)
+			cfg.Traces.URLPath = "/"
+		}
 		cfg.Traces.Insecure = u.Scheme != "https"
 
 		return cfg
@@ -344,6 +355,13 @@
 		return cfg
 	})
 }
+
+func WithMaxRequestSize(size int) GenericOption {
+	return newGenericOption(func(cfg Config) Config {
+		cfg.Traces.MaxRequestSize = size
+		return cfg
+	})
+}
 
 func WithProxy(pf HTTPTransportProxyFunc) GenericOption {
 	return newGenericOption(func(cfg Config) Config {
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig/optiontypes.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig/optiontypes.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig/optiontypes.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig/optiontypes.go	2026-10-28 10:50:36.702754298 +0000
@@ -1,10 +1,10 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/otlp/otlptrace/otlpconfig/optiontypes.go.tmpl
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package otlpconfig // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig"
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/otlp/otlptrace/otlpconfig/optiontypes.go.tmpl
+
+package otlpconfig
 
 const (
 	// DefaultCollectorGRPCPort is the default gRPC port of the collector.
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig/tls.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig/tls.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig/tls.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig/tls.go	2026-10-28 10:50:36.702754298 +0000
@@ -1,10 +1,10 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/otlp/otlptrace/otlpconfig/tls.go.tmpl
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package otlpconfig // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig"
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/otlp/otlptrace/otlpconfig/tls.go.tmpl
+
+package otlpconfig
 
 import (
 	"crypto/tls"
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/partialsuccess.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/partialsuccess.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/partialsuccess.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/partialsuccess.go	2026-10-28 10:50:36.702754298 +0000
@@ -1,10 +1,10 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/otlp/partialsuccess.go
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package internal // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal"
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/otlp/partialsuccess.go
+
+package internal
 
 import "fmt"
 
@@ -41,7 +41,7 @@
 }
 
 // Is supports the errors.Is() interface.
-func (ps PartialSuccess) Is(err error) bool {
+func (PartialSuccess) Is(err error) bool {
 	_, ok := err.(PartialSuccess)
 	return ok
 }
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/retry/retry.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/retry/retry.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/retry/retry.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/retry/retry.go	2026-10-28 10:50:36.702754298 +0000
@@ -1,13 +1,13 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/otlp/retry/retry.go.tmpl
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/otlp/retry/retry.go.tmpl
+
 // Package retry provides request retry functionality that can perform
 // configurable exponential backoff for transient errors and honor any
 // explicit throttle responses received.
-package retry // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/retry"
+package retry
 
 import (
 	"context"
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/version.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/version.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/version.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/version.go	2026-10-28 10:50:36.702754298 +0000
@@ -1,8 +1,8 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package internal // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal"
+package internal
 
 // Version is the current release version of the OpenTelemetry OTLP HTTP trace
 // exporter in use.
-const Version = "1.43.0"
+const Version = "1.45.0"
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/x/observ.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/x/observ.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/x/observ.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/x/observ.go	2026-10-28 10:50:36.702754298 +0000
@@ -1,7 +1,7 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package x // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/x"
+package x
 
 import "strings"
 
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/x/x.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/x/x.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/x/x.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/x/x.go	2026-10-28 10:50:36.702754298 +0000
@@ -1,11 +1,11 @@
-// Code generated by gotmpl. DO NOT MODIFY.
-// source: internal/shared/x/x.go.tmpl
-
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
+// DO NOT MODIFY. Generated by gotmpl.
+// source: internal/shared/x/x.go.tmpl
+
 // Package x documents experimental features for [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp].
-package x // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/x"
+package x
 
 import (
 	"os"
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/options.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/options.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/options.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/options.go	2026-10-28 10:50:36.698754317 +0000
@@ -1,7 +1,7 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package otlptracehttp // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp"
+package otlptracehttp
 
 import (
 	"crypto/tls"
@@ -93,6 +93,11 @@
 //
 // If an invalid URL is provided, the default value will be kept.
 //
+// The path of the provided URL is used as-is; with one exception: if the URL has
+// no path, it is normalized to the root path ("/"). The default traces path
+// ("/v1/traces") is not appended automatically. Use WithEndpoint if you want
+// that behavior, or pass a URL that includes that path.
+//
 // By default, if an environment variable is not set, and this option is not
 // passed, "localhost:4318" will be used.
 //
@@ -138,6 +143,16 @@
 	return wrappedOption{otlpconfig.WithTimeout(duration)}
 }
 
+// WithMaxRequestSize sets the maximum size, in bytes, of a serialized export
+// request, before compression, that the exporter will send.
+//
+// If size is less than or equal to zero, no request-size limit is applied.
+// Disabling the limit is not recommended because it can lead to excessive
+// resource consumption or abuse.
+func WithMaxRequestSize(size int) Option {
+	return wrappedOption{otlpconfig.WithMaxRequestSize(size)}
+}
+
 // WithRetry configures the retry policy for transient errors that may occurs
 // when exporting traces. An exponential back-off algorithm is used to ensure
 // endpoints are not overwhelmed with retries. If unset, the default retry
diff -Nur /work/src-orig/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/version.go /work/src/docker-registry/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/version.go
--- a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/version.go	2026-10-28 10:49:46.675004108 +0000
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/version.go	2026-10-28 10:50:36.566754968 +0000
@@ -1,9 +1,9 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-package otlptrace // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace"
+package otlptrace
 
 // Version is the current release version of the OpenTelemetry OTLP trace exporter in use.
 func Version() string {
-	return "1.43.0"
+	return "1.45.0"
 }
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/crypto/acme/acme.go /work/src/docker-registry/vendor/golang.org/x/crypto/acme/acme.go
--- a/vendor/golang.org/x/crypto/acme/acme.go	2026-10-28 10:49:46.719003886 +0000
+++ b/vendor/golang.org/x/crypto/acme/acme.go	2026-10-28 10:50:37.558750071 +0000
@@ -185,10 +185,11 @@
 		Nonce     string `json:"newNonce"`
 		KeyChange string `json:"keyChange"`
 		Meta      struct {
-			Terms        string   `json:"termsOfService"`
-			Website      string   `json:"website"`
-			CAA          []string `json:"caaIdentities"`
-			ExternalAcct bool     `json:"externalAccountRequired"`
+			Terms        string                 `json:"termsOfService"`
+			Website      string                 `json:"website"`
+			CAA          []string               `json:"caaIdentities"`
+			ExternalAcct bool                   `json:"externalAccountRequired"`
+			Profiles     map[ProfileName]string `json:"profiles"`
 		}
 	}
 	if err := json.NewDecoder(res.Body).Decode(&v); err != nil {
@@ -208,6 +209,7 @@
 		Website:                 v.Meta.Website,
 		CAA:                     v.Meta.CAA,
 		ExternalAccountRequired: v.Meta.ExternalAcct,
+		Profiles:                v.Meta.Profiles,
 	}
 	return *c.dir, nil
 }
@@ -221,7 +223,7 @@
 
 // CreateCert was part of the old version of ACME. It is incompatible with RFC 8555.
 //
-// Deprecated: this was for the pre-RFC 8555 version of ACME. Callers should use CreateOrderCert.
+// Deprecated: this was for the pre-RFC 8555 version of ACME. Callers should use CreateCertFromOrder.
 func (c *Client) CreateCert(ctx context.Context, csr []byte, exp time.Duration, bundle bool) (der [][]byte, certURL string, err error) {
 	return nil, "", errPreRFC
 }
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/crypto/acme/autocert/autocert.go /work/src/docker-registry/vendor/golang.org/x/crypto/acme/autocert/autocert.go
--- a/vendor/golang.org/x/crypto/acme/autocert/autocert.go	2026-10-28 10:49:46.719003886 +0000
+++ b/vendor/golang.org/x/crypto/acme/autocert/autocert.go	2026-10-28 10:50:37.558750071 +0000
@@ -671,7 +671,7 @@
 	if err != nil {
 		return nil, nil, err
 	}
-	chain, _, err := client.CreateOrderCert(ctx, o.FinalizeURL, csr, true)
+	chain, _, err := client.CreateCertFromOrder(ctx, o, csr, true)
 	if err != nil {
 		return nil, nil, err
 	}
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/crypto/acme/rfc8555.go /work/src/docker-registry/vendor/golang.org/x/crypto/acme/rfc8555.go
--- a/vendor/golang.org/x/crypto/acme/rfc8555.go	2026-10-28 10:49:46.719003886 +0000
+++ b/vendor/golang.org/x/crypto/acme/rfc8555.go	2026-10-28 10:50:37.558750071 +0000
@@ -14,6 +14,8 @@
 	"fmt"
 	"io"
 	"net/http"
+	"slices"
+	"strings"
 	"time"
 )
 
@@ -197,7 +199,7 @@
 // identify those with StatusPending status and fulfill a challenge using Accept.
 // Once all authorizations are satisfied, the caller will typically want to poll
 // order status using WaitOrder until it's in StatusReady state.
-// To finalize the order and obtain a certificate, the caller submits a CSR with CreateOrderCert.
+// To finalize the order and obtain a certificate, the caller submits a CSR with CreateCertFromOrder.
 func (c *Client) AuthorizeOrder(ctx context.Context, id []AuthzID, opt ...OrderOption) (*Order, error) {
 	dir, err := c.Discover(ctx)
 	if err != nil {
@@ -208,6 +210,7 @@
 		Identifiers []wireAuthzID `json:"identifiers"`
 		NotBefore   string        `json:"notBefore,omitempty"`
 		NotAfter    string        `json:"notAfter,omitempty"`
+		Profile     string        `json:"profile,omitempty"`
 	}{}
 	for _, v := range id {
 		req.Identifiers = append(req.Identifiers, wireAuthzID{
@@ -221,6 +224,19 @@
 			req.NotBefore = time.Time(o).Format(time.RFC3339)
 		case orderNotAfterOpt:
 			req.NotAfter = time.Time(o).Format(time.RFC3339)
+		case orderProfileOpt:
+			if len(dir.Profiles) == 0 {
+				return nil, errCADoesNotSupportProfiles
+			}
+			profileName := o.profileName()
+			if _, ok := dir.Profiles[profileName]; !ok {
+				return nil, fmt.Errorf(
+					"%w %s (supported profiles: %s)",
+					errProfileNotInSetOfSupportedProfiles,
+					profileName,
+					strings.Join(profileNames(dir.Profiles), ", "))
+			}
+			req.Profile = string(profileName)
 		default:
 			// Package's fault if we let this happen.
 			panic(fmt.Sprintf("unsupported order option type %T", o))
@@ -235,6 +251,15 @@
 	return responseOrder(res)
 }
 
+func profileNames(profiles map[ProfileName]string) []string {
+	names := make([]string, 0, len(profiles))
+	for name := range profiles {
+		names = append(names, string(name))
+	}
+	slices.Sort(names)
+	return names
+}
+
 // GetOrder retrieves an order identified by the given URL.
 // For orders created with AuthorizeOrder, the url value is Order.URI.
 //
@@ -250,7 +275,11 @@
 		return nil, err
 	}
 	defer res.Body.Close()
-	return responseOrder(res)
+	o, err := responseOrder(res)
+	if err == nil && o.URI == "" {
+		o.URI = url
+	}
+	return o, err
 }
 
 // WaitOrder polls an order from the given URL until it is in one of the final states,
@@ -271,6 +300,9 @@
 		}
 		o, err := responseOrder(res)
 		res.Body.Close()
+		if err == nil && o.URI == "" {
+			o.URI = url
+		}
 		switch {
 		case err != nil:
 			// Skip and retry.
@@ -308,6 +340,7 @@
 		Authorizations []string
 		Finalize       string
 		Certificate    string
+		Profile        string
 	}
 	if err := json.NewDecoder(res.Body).Decode(&v); err != nil {
 		return nil, fmt.Errorf("acme: error reading order: %v", err)
@@ -321,6 +354,7 @@
 		AuthzURLs:   v.Authorizations,
 		FinalizeURL: v.Finalize,
 		CertURL:     v.Certificate,
+		Profile:     ProfileName(v.Profile),
 	}
 	for _, id := range v.Identifiers {
 		o.Identifiers = append(o.Identifiers, AuthzID{Type: id.Type, Value: id.Value})
@@ -338,11 +372,43 @@
 // certificate chain. Otherwise, only a leaf certificate is returned.
 // The returned URL can be used to re-fetch the certificate using FetchCert.
 //
-// This method is only supported by CAs implementing RFC 8555. See CreateCert for pre-RFC CAs.
+// This method is only supported by CAs implementing RFC 8555 that return a
+// Location header for order finalization responses. Most users should prefer
+// CreateCertFromOrder, an alternative that has better interoperation with RFC 8555
+// compliant CAs. See CreateCert for pre-RFC CAs.
 //
 // CreateOrderCert returns an error if the CA's response is unreasonably large.
 // Callers are encouraged to parse the returned value to ensure the certificate is valid and has the expected features.
 func (c *Client) CreateOrderCert(ctx context.Context, url string, csr []byte, bundle bool) (der [][]byte, certURL string, err error) {
+	return c.createOrderCert(ctx, url, "", csr, bundle)
+}
+
+// CreateCertFromOrder submits the CSR (Certificate Signing Request) to a CA for
+// the specified Order created with AuthorizeOrder.
+//
+// If the bundle argument is true, the returned value also contain the CA (issuer)
+// certificate chain. Otherwise, only a leaf certificate is returned.
+// The returned URL can be used to re-fetch the certificate using FetchCert.
+//
+// This method is only supported by CAs implementing RFC 8555.
+// See CreateCert for pre-RFC CAs.
+//
+// CreateCertFromOrder returns an error if the CA's response is unreasonably large.
+// Callers are encouraged to parse the returned value to ensure the certificate is valid and has the expected features.
+func (c *Client) CreateCertFromOrder(ctx context.Context, order *Order, csr []byte, bundle bool) (der [][]byte, certURL string, err error) {
+	if order == nil {
+		return nil, "", errors.New("acme: nil order")
+	}
+	if order.URI == "" {
+		return nil, "", errors.New("acme: order URI is empty")
+	}
+	if order.FinalizeURL == "" {
+		return nil, "", errors.New("acme: order finalize URL is empty")
+	}
+	return c.createOrderCert(ctx, order.FinalizeURL, order.URI, csr, bundle)
+}
+
+func (c *Client) createOrderCert(ctx context.Context, finalizeURL, orderURL string, csr []byte, bundle bool) (der [][]byte, certURL string, err error) {
 	if _, err := c.Discover(ctx); err != nil { // required by c.accountKID
 		return nil, "", err
 	}
@@ -353,7 +419,7 @@
 	}{
 		CSR: base64.RawURLEncoding.EncodeToString(csr),
 	}
-	res, err := c.post(ctx, nil, url, req, wantStatus(http.StatusOK))
+	res, err := c.post(ctx, nil, finalizeURL, req, wantStatus(http.StatusOK))
 	if err != nil {
 		return nil, "", err
 	}
@@ -365,7 +431,10 @@
 
 	// Wait for CA to issue the cert if they haven't.
 	if o.Status != StatusValid {
-		o, err = c.WaitOrder(ctx, o.URI)
+		if orderURL == "" {
+			orderURL = o.URI
+		}
+		o, err = c.WaitOrder(ctx, orderURL)
 	}
 	if err != nil {
 		return nil, "", err
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/crypto/acme/types.go /work/src/docker-registry/vendor/golang.org/x/crypto/acme/types.go
--- a/vendor/golang.org/x/crypto/acme/types.go	2026-10-28 10:49:46.719003886 +0000
+++ b/vendor/golang.org/x/crypto/acme/types.go	2026-10-28 10:50:37.558750071 +0000
@@ -60,6 +60,15 @@
 	// errPreAuthorizationNotSupported indicates that the server does not
 	// support pre-authorization of identifiers.
 	errPreAuthorizationNotSupported = errors.New("acme: pre-authorization is not supported")
+
+	// errCADoesNotSupportProfiles indicates that [WithOrderIssuanceProfile] was
+	// included with a CA that does not advertise support for profiles in
+	// their directory.
+	errCADoesNotSupportProfiles = errors.New("acme: certificate authority does not support profiles")
+
+	// errProfileNotInSetOfSupportedProfiles indicates that the profile
+	// specified with [WithOrderIssuanceProfile] is not one supported by the CA
+	errProfileNotInSetOfSupportedProfiles = errors.New("acme: certificate authority does not advertise a profile with name")
 )
 
 // A Subproblem describes an ACME subproblem as reported in an Error.
@@ -316,6 +325,14 @@
 	// ExternalAccountRequired indicates that the CA requires for all account-related
 	// requests to include external account binding information.
 	ExternalAccountRequired bool
+
+	// Profiles is a map of profile identifiers to URLs containing the description of the
+	// profile. The identifiers can be used with [WithOrderIssuanceProfile] to
+	// request issuance with a specific profile. If the map is empty, the
+	// CA does not support issuance profiles. Per the draft, "CAs MAY use data
+	// URIs to provide an in-line text description if they do not wish to host
+	// external documentation pages" (e.g., `data://` URLs).
+	Profiles map[ProfileName]string
 }
 
 // Order represents a client's request for a certificate.
@@ -330,7 +347,7 @@
 	// Possible values are StatusPending, StatusReady, StatusProcessing, StatusValid and StatusInvalid.
 	// Pending means the CA does not believe that the client has fulfilled the requirements.
 	// Ready indicates that the client has fulfilled all the requirements and can submit a CSR
-	// to obtain a certificate. This is done with Client's CreateOrderCert.
+	// to obtain a certificate. This is done with Client's CreateCertFromOrder.
 	// Processing means the certificate is being issued.
 	// Valid indicates the CA has issued the certificate. It can be downloaded
 	// from the Order's CertURL. This is done with Client's FetchCert.
@@ -374,6 +391,9 @@
 
 	// The error that occurred while processing the order as received from a CA, if any.
 	Error *Error
+
+	// Profile is the optional issuance profile used for this order.
+	Profile ProfileName
 }
 
 // OrderOption allows customizing Client.AuthorizeOrder call.
@@ -391,6 +411,18 @@
 	return orderNotAfterOpt(t)
 }
 
+// WithOrderIssuanceProfile sets the order's profile field. It should be used
+// with a profile present in the CA's [Directory.Profiles]. Specifying
+// the profile name here will add it to the order request. If specified when a
+// CA doesn't advertise support for profiles, an error will be returned prior
+// to sending the request. If a name is not in the directory, an error will be
+// returned prior to sending the request.
+// See also:
+// * https://datatracker.ietf.org/doc/draft-ietf-acme-profiles/
+func WithOrderIssuanceProfile(name ProfileName) OrderOption {
+	return orderProfileOpt(name)
+}
+
 type orderNotBeforeOpt time.Time
 
 func (orderNotBeforeOpt) privateOrderOpt() {}
@@ -399,6 +431,12 @@
 
 func (orderNotAfterOpt) privateOrderOpt() {}
 
+type orderProfileOpt string
+
+func (orderProfileOpt) privateOrderOpt() {}
+
+func (o orderProfileOpt) profileName() ProfileName { return ProfileName(o) }
+
 // Authorization encodes an authorization response.
 type Authorization struct {
 	// URI uniquely identifies a authorization.
@@ -635,3 +673,5 @@
 type certOptTemplate x509.Certificate
 
 func (*certOptTemplate) privateCertOpt() {}
+
+type ProfileName string
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/crypto/chacha20/chacha_loong64.go /work/src/docker-registry/vendor/golang.org/x/crypto/chacha20/chacha_loong64.go
--- a/vendor/golang.org/x/crypto/chacha20/chacha_loong64.go	1970-01-01 00:00:00.000000000 +0000
+++ b/vendor/golang.org/x/crypto/chacha20/chacha_loong64.go	2026-10-28 10:50:37.558750071 +0000
@@ -0,0 +1,22 @@
+// Copyright 2026 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build gc && !purego
+
+package chacha20
+
+import "golang.org/x/sys/cpu"
+
+const bufSize = 256
+
+//go:noescape
+func xorKeyStreamVX(dst, src []byte, key *[8]uint32, nonce *[3]uint32, counter *uint32)
+
+func (c *Cipher) xorKeyStreamBlocks(dst, src []byte) {
+	if cpu.Loong64.HasLSX {
+		xorKeyStreamVX(dst, src, &c.key, &c.nonce, &c.counter)
+	} else {
+		c.xorKeyStreamBlocksGeneric(dst, src)
+	}
+}
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/crypto/chacha20/chacha_loong64.s /work/src/docker-registry/vendor/golang.org/x/crypto/chacha20/chacha_loong64.s
--- a/vendor/golang.org/x/crypto/chacha20/chacha_loong64.s	1970-01-01 00:00:00.000000000 +0000
+++ b/vendor/golang.org/x/crypto/chacha20/chacha_loong64.s	2026-10-28 10:50:37.558750071 +0000
@@ -0,0 +1,342 @@
+// Copyright 2026 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// derived from chacha_arm64.s
+
+//go:build gc && !purego
+
+#include "textflag.h"
+
+DATA	·constants+0x00(SB)/4, $0x61707865
+DATA	·constants+0x04(SB)/4, $0x3320646e
+DATA	·constants+0x08(SB)/4, $0x79622d32
+DATA	·constants+0x0c(SB)/4, $0x6b206574
+GLOBL	·constants(SB), NOPTR|RODATA, $32
+
+DATA	·incRotMatrix+0x00(SB)/4, $0x00000000
+DATA	·incRotMatrix+0x04(SB)/4, $0x00000001
+DATA	·incRotMatrix+0x08(SB)/4, $0x00000002
+DATA	·incRotMatrix+0x0c(SB)/4, $0x00000003
+GLOBL	·incRotMatrix(SB), NOPTR|RODATA, $32
+
+#define NUM_ROUNDS 10
+
+// func xorKeyStreamVX(dst, src []byte, key *[8]uint32, nonce *[3]uint32, counter *uint32)
+TEXT ·xorKeyStreamVX(SB), NOSPLIT, $0
+	MOVV	dst+0(FP), R4
+	MOVV	src+24(FP), R5
+	MOVV	src_len+32(FP), R6
+	MOVV	key+48(FP), R7
+	MOVV	nonce+56(FP), R8
+	MOVV	counter+64(FP), R9
+
+	MOVV	$·constants(SB), R10
+	MOVV	$·incRotMatrix(SB), R11
+
+	MOVW	(R9), R12
+
+loop:
+	MOVV	$NUM_ROUNDS, R15
+	// load 4-32bit data from incRotMatrix added to counter
+	VMOVQ	(R11), V30
+
+	// load contants
+	VMOVQ	(R10), V0.W4
+	VMOVQ	4(R10), V1.W4
+	VMOVQ	8(R10), V2.W4
+	VMOVQ	12(R10), V3.W4
+
+	// load keys
+	VMOVQ	(R7), V4.W4
+	VMOVQ	4(R7), V5.W4
+	VMOVQ	8(R7), V6.W4
+	VMOVQ	12(R7), V7.W4
+	VMOVQ	16(R7), V8.W4
+	VMOVQ	20(R7), V9.W4
+	VMOVQ	24(R7), V10.W4
+	VMOVQ	28(R7), V11.W4
+
+	// load counter + nonce
+	VMOVQ	(R9), V12.W4
+
+	VMOVQ	(R8), V13.W4
+	VMOVQ	4(R8), V14.W4
+	VMOVQ	8(R8), V15.W4
+
+	// update counter
+	VADDW	V30, V12, V12
+
+chacha:
+	// V0..V3 += V4..V7
+	// V12..V15 <<<= ((V12..V15 XOR V0..V3), 16)
+	VADDW	V0, V4, V0
+	VADDW	V1, V5, V1
+	VADDW	V2, V6, V2
+	VADDW	V3, V7, V3
+	VXORV	V12, V0, V12
+	VXORV	V13, V1, V13
+	VXORV	V14, V2, V14
+	VXORV	V15, V3, V15
+	VROTRW	$16, V12, V12
+	VROTRW	$16, V13, V13
+	VROTRW	$16, V14, V14
+	VROTRW	$16, V15, V15
+
+	// V8..V11 += V12..V15
+	// V4..V7 <<<= ((V4..V7 XOR V8..V11), 12)
+	VADDW	V8, V12, V8
+	VADDW	V9, V13, V9
+	VADDW	V10, V14, V10
+	VADDW	V11, V15, V11
+	VXORV	V4, V8, V4
+	VXORV	V5, V9, V5
+	VXORV	V6, V10, V6
+	VXORV	V7, V11, V7
+	VROTRW	$20, V4, V4
+	VROTRW	$20, V5, V5
+	VROTRW	$20, V6, V6
+	VROTRW	$20, V7, V7
+
+	// V0..V3 += V4..V7
+	// V12..V15 <<<= ((V12..V15 XOR V0..V3), 8)
+	VADDW	V0, V4, V0
+	VADDW	V1, V5, V1
+	VADDW	V2, V6, V2
+	VADDW	V3, V7, V3
+	VXORV	V12, V0, V12
+	VXORV	V13, V1, V13
+	VXORV	V14, V2, V14
+	VXORV	V15, V3, V15
+	VROTRW	$24, V12, V12
+	VROTRW	$24, V13, V13
+	VROTRW	$24, V14, V14
+	VROTRW	$24, V15, V15
+
+	// V8..V11 += V12..V15
+	// V4..V7 <<<= ((V4..V7 XOR V8..V11), 7)
+	VADDW	V12, V8, V8
+	VADDW	V13, V9, V9
+	VADDW	V14, V10, V10
+	VADDW	V15, V11, V11
+	VXORV	V4, V8, V4
+	VXORV	V5, V9, V5
+	VXORV	V6, V10, V6
+	VXORV	V7, V11, V7
+	VROTRW	$25, V4, V4
+	VROTRW	$25, V5, V5
+	VROTRW	$25, V6, V6
+	VROTRW	$25, V7, V7
+
+	// V0..V3 += V5..V7, V4
+	// V15,V12-V14 <<<= ((V15,V12-V14 XOR V0..V3), 16)
+	VADDW	V0, V5, V0
+	VADDW	V1, V6, V1
+	VADDW	V2, V7, V2
+	VADDW	V3, V4, V3
+	VXORV	V15, V0, V15
+	VXORV	V12, V1, V12
+	VXORV	V13, V2, V13
+	VXORV	V14, V3, V14
+	VROTRW	$16, V15, V15
+	VROTRW	$16, V12, V12
+	VROTRW	$16, V13, V13
+	VROTRW	$16, V14, V14
+
+	// V10,V11,V8,V9 += V15,V12,V13,V14
+	// V5,V6,V7,V4 <<<= ((V5,V6,V7,V4 XOR V10,V11,V8,V9), 12)
+	VADDW	V10, V15, V10
+	VADDW	V11, V12, V11
+	VADDW	V8, V13, V8
+	VADDW	V9, V14, V9
+	VXORV	V5, V10, V5
+	VXORV	V6, V11, V6
+	VXORV	V7, V8, V7
+	VXORV	V4, V9, V4
+	VROTRW	$20, V5, V5
+	VROTRW	$20, V6, V6
+	VROTRW	$20, V7, V7
+	VROTRW	$20, V4, V4
+
+	// V0..V3 += V5..V7, V4
+	// V15,V12-V14 <<<= ((V15,V12-V14 XOR V0..V3), 8)
+	VADDW	V5, V0, V0
+	VADDW	V6, V1, V1
+	VADDW	V7, V2, V2
+	VADDW	V4, V3, V3
+	VXORV	V15, V0, V15
+	VXORV	V12, V1, V12
+	VXORV	V13, V2, V13
+	VXORV	V14, V3, V14
+	VROTRW	$24, V15, V15
+	VROTRW	$24, V12, V12
+	VROTRW	$24, V13, V13
+	VROTRW	$24, V14, V14
+
+	// V10,V11,V8,V9 += V15,V12,V13,V14
+	// V5,V6,V7,V4 <<<= ((V5,V6,V7,V4 XOR V10,V11,V8,V9), 7)
+	VADDW	V15, V10, V10
+	VADDW	V12, V11, V11
+	VADDW	V13, V8, V8
+	VADDW	V14, V9, V9
+	VXORV	V5, V10, V5
+	VXORV	V6, V11, V6
+	VXORV	V7, V8, V7
+	VXORV	V4, V9, V4
+	VROTRW	$25, V5, V5
+	VROTRW	$25, V6, V6
+	VROTRW	$25, V7, V7
+	VROTRW	$25, V4, V4
+
+	SUBV	$1, R15
+	BNE	R15, R0, chacha
+
+	// load origin contants
+	VMOVQ	(R10), V16.W4
+	VMOVQ	4(R10), V17.W4
+	VMOVQ	8(R10), V18.W4
+	VMOVQ	12(R10), V19.W4
+
+	// load origin keys
+	VMOVQ	(R7), V20.W4
+	VMOVQ	4(R7), V21.W4
+	VMOVQ	8(R7), V22.W4
+	VMOVQ	12(R7), V23.W4
+	VMOVQ	16(R7), V24.W4
+	VMOVQ	20(R7), V25.W4
+	VMOVQ	24(R7), V26.W4
+	VMOVQ	28(R7), V27.W4
+
+	// add back the initial state to generate the key stream
+	VADDW	V30, V12, V12	// update counter in advance to prevent V30 from being overwritten
+	VADDW	V16, V0, V0
+	VADDW	V17, V1, V1
+	VADDW	V18, V2, V2
+	VADDW	V19, V3, V3
+
+	// load origin counter + nonce
+	VMOVQ	(R9), V28.W4
+	VMOVQ	(R8), V29.W4
+	VMOVQ	4(R8), V30.W4
+	VMOVQ	8(R8), V31.W4
+
+	VADDW	V20, V4, V4
+	VADDW	V21, V5, V5
+	VADDW	V22, V6, V6
+	VADDW	V23, V7, V7
+	VADDW	V24, V8, V8
+	VADDW	V25, V9, V9
+	VADDW	V26, V10, V10
+	VADDW	V27, V11, V11
+	VADDW	V28, V12, V12
+	VADDW	V29, V13, V13
+	VADDW	V30, V14, V14
+	VADDW	V31, V15, V15
+
+	// shuffle
+	VILVLW	V0, V1, V16
+	VILVHW	V0, V1, V17
+	VILVLW	V2, V3, V18
+	VILVHW	V2, V3, V19
+	VILVLW	V4, V5 ,V20
+	VILVHW	V4, V5, V21
+	VILVLW	V6, V7, V22
+	VILVHW	V6, V7, V23
+	VILVLW	V8, V9, V24
+	VILVHW	V8, V9, V25
+	VILVLW	V10, V11, V26
+	VILVHW	V10, V11, V27
+	VILVLW	V12, V13, V28
+	VILVHW	V12, V13, V29
+	VILVLW	V14, V15, V30
+	VILVHW	V14, V15, V31
+	VILVLV	V16, V18, V0
+	VILVHV	V16, V18, V4
+	VILVLV	V17, V19, V8
+	VILVHV	V17, V19, V12
+
+	// load src data from R5
+	VMOVQ	0(R5), V16
+	VMOVQ	16(R5), V17
+	VMOVQ	32(R5), V18
+	VMOVQ	48(R5), V19
+
+	VILVLV	V20, V22, V1
+	VILVHV	V20, V22, V5
+	VILVLV	V21, V23, V9
+	VILVHV	V21, V23, V13
+
+	VMOVQ	64(R5), V20
+	VMOVQ	80(R5), V21
+	VMOVQ	96(R5), V22
+	VMOVQ	112(R5), V23
+
+	VILVLV	V24, V26, V2
+	VILVHV	V24, V26, V6
+	VILVLV	V25, V27, V10
+	VILVHV	V25, V27, V14
+
+	VMOVQ	128(R5), V24
+	VMOVQ	144(R5), V25
+	VMOVQ	160(R5), V26
+	VMOVQ	176(R5), V27
+
+	VILVLV	V28, V30, V3
+	VILVHV	V28, V30, V7
+	VILVLV	V29, V31, V11
+	VILVHV	V29, V31, V15
+
+	VMOVQ	192(R5), V28
+	VMOVQ	208(R5), V29
+	VMOVQ	224(R5), V30
+	VMOVQ	240(R5), V31
+
+	VXORV	V0, V16, V16
+	VXORV	V1, V17, V17
+	VXORV	V2, V18, V18
+	VXORV	V3, V19, V19
+
+	VMOVQ	V16, 0(R4)
+	VMOVQ	V17, 16(R4)
+	VMOVQ	V18, 32(R4)
+	VMOVQ	V19, 48(R4)
+
+	VXORV	V4, V20, V20
+	VXORV	V5, V21, V21
+	VXORV	V6, V22, V22
+	VXORV	V7, V23, V23
+
+	VMOVQ	V20, 64(R4)
+	VMOVQ	V21, 80(R4)
+	VMOVQ	V22, 96(R4)
+	VMOVQ	V23, 112(R4)
+
+	VXORV	V8, V24, V24
+	VXORV	V9, V25, V25
+	VXORV	V10, V26, V26
+	VXORV	V11, V27, V27
+
+	VMOVQ	V24, 128(R4)
+	VMOVQ	V25, 144(R4)
+	VMOVQ	V26, 160(R4)
+	VMOVQ	V27, 176(R4)
+
+	VXORV	V12, V28, V28
+	VXORV	V13, V29, V29
+	VXORV	V14, V30, V30
+	VXORV	V15, V31, V31
+
+	VMOVQ	V28, 192(R4)
+	VMOVQ	V29, 208(R4)
+	VMOVQ	V30, 224(R4)
+	VMOVQ	V31, 240(R4)
+
+	ADD	$4, R12, R12
+	MOVW	R12, (R9) // update counter
+
+	ADDV	$256, R4, R4
+	ADDV	$256, R5, R5
+	SUBV    $256, R6, R6
+	BNE     R6, R0, loop
+
+	RET
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/crypto/chacha20/chacha_noasm.go /work/src/docker-registry/vendor/golang.org/x/crypto/chacha20/chacha_noasm.go
--- a/vendor/golang.org/x/crypto/chacha20/chacha_noasm.go	2026-10-28 10:49:46.723003866 +0000
+++ b/vendor/golang.org/x/crypto/chacha20/chacha_noasm.go	2026-10-28 10:50:37.558750071 +0000
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build (!arm64 && !s390x && !ppc64 && !ppc64le) || !gc || purego
+//go:build (!arm64 && !loong64 && !s390x && !ppc64 && !ppc64le) || !gc || purego
 
 package chacha20
 
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/net/http2/flow.go /work/src/docker-registry/vendor/golang.org/x/net/http2/flow.go
--- a/vendor/golang.org/x/net/http2/flow.go	2026-10-28 10:49:46.723003866 +0000
+++ b/vendor/golang.org/x/net/http2/flow.go	2026-10-28 10:50:37.622749756 +0000
@@ -10,6 +10,9 @@
 // flow control window update.
 const inflowMinRefresh = 4 << 10
 
+// maxFlowWindow is the maximum size of a flow control window.
+const maxFlowWindow = (1 << 31) - 1
+
 // inflow accounts for an inbound flow control window.
 // It tracks both the latest window sent to the peer (used for enforcement)
 // and the accumulated unsent window.
@@ -74,47 +77,99 @@
 	return true
 }
 
-// outflow is the outbound flow control window's size.
+// connOutflow is connection-level outbound flow control.
+type connOutflow struct {
+	initial int32 // SETTINGS_INITIAL_WINDOW_SIZE, changes with settings updates
+	n       int32 // connection-level flow control window
+	flowErr bool  // set when a flow control error is encountered
+}
+
+func (f *connOutflow) init() {
+	f.initial = initialWindowSize // initial stream window size
+	f.n = initialWindowSize       // current connection window size
+}
+
+func (f *connOutflow) changeInitialWindowSize(size int64) bool {
+	if size > maxFlowWindow {
+		f.flowErr = true
+		return false
+	}
+	f.initial = int32(size)
+	return true
+}
+
+func (f *connOutflow) add(n int32) bool {
+	sum := int64(f.n) + int64(n)
+	if sum > maxFlowWindow {
+		f.flowErr = true
+		return false
+	}
+	f.n += n
+	return true
+}
+
+// outflow is the stream-level outbound flow control window's size.
 type outflow struct {
 	_ incomparable
 
-	// n is the number of DATA bytes we're allowed to send.
-	// An outflow is kept both on a conn and a per-stream.
-	n int32
+	// delta is the difference between the stream's flow control window and
+	// the connection's initial window size (conn.initial).
+	//
+	// Another view is that delta is the number of flow control bytes provided to this
+	// stream in WINDOW_UPDATE frames, less the number of bytes sent on the stream.
+	delta int32
 
 	// conn points to the shared connection-level outflow that is
-	// shared by all streams on that conn. It is nil for the outflow
-	// that's on the conn directly.
-	conn *outflow
+	// shared by all streams on that conn.
+	conn *connOutflow
 }
 
-func (f *outflow) setConnFlow(cf *outflow) { f.conn = cf }
-
-func (f *outflow) available() int32 {
-	n := f.n
-	if f.conn != nil && f.conn.n < n {
-		n = f.conn.n
+func (f *outflow) available() (int32, bool) {
+	if f.conn == nil {
+		return maxFlowWindow, true // only happens in tests
 	}
-	return n
+	if f.conn.flowErr {
+		// Block all sending once any stream observes a flow control error.
+		return 0, false
+	}
+	n := int64(f.conn.initial) + int64(f.delta)
+	if n > maxFlowWindow {
+		f.conn.flowErr = true
+		return 0, false
+	}
+	return min(int32(n), f.conn.n), true
 }
 
 func (f *outflow) take(n int32) {
-	if n > f.available() {
-		panic("internal error: took too much")
+	if f.conn == nil {
+		return // only happens in tests
 	}
-	f.n -= n
-	if f.conn != nil {
-		f.conn.n -= n
+	avail, _ := f.available()
+	if n > avail {
+		panic("internal error: took too much")
 	}
+	f.delta -= n
+	f.conn.n -= n
 }
 
 // add adds n bytes (positive or negative) to the flow control window.
 // It returns false if the sum would exceed 2^31-1.
 func (f *outflow) add(n int32) bool {
-	sum := f.n + n
-	if (sum > n) == (f.n > 0) {
-		f.n = sum
-		return true
+	if f.conn == nil {
+		return true // only happens in tests
+	}
+	avail := int64(f.conn.initial) + int64(f.delta)
+	if avail > maxFlowWindow {
+		// An earlier change to the initial window pushed this stream over the limit.
+		// This is a connection-level flow control error.
+		f.conn.flowErr = true
+		return false
 	}
-	return false
+	if avail+int64(n) > maxFlowWindow {
+		// This update would push the stream over the limit.
+		// This is a stream-level flow control error.
+		return false
+	}
+	f.delta += n
+	return true
 }
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/net/http2/frame.go /work/src/docker-registry/vendor/golang.org/x/net/http2/frame.go
--- a/vendor/golang.org/x/net/http2/frame.go	2026-10-28 10:49:46.723003866 +0000
+++ b/vendor/golang.org/x/net/http2/frame.go	2026-10-28 10:50:37.622749756 +0000
@@ -1711,7 +1711,8 @@
 	mh := &MetaHeadersFrame{
 		HeadersFrame: hf,
 	}
-	var remainSize = fr.maxHeaderListSize()
+	var headersRemainSize = fr.maxHeaderListSize()
+	var trailersRemainSize = fr.maxHeaderListSize()
 	var sawRegular bool
 
 	var invalid error // pseudo header field errors
@@ -1743,14 +1744,29 @@
 			return
 		}
 
-		size := hf.Size()
-		if size > remainSize {
+		var remainSize *uint32
+		var size uint32
+		if hf.Name == "trailer" {
+			remainSize = &trailersRemainSize
+			fieldCount := strings.Count(hf.Value, ",") + 1
+			// Rather than actually constructing hpack.HeaderField for each
+			// trailer field and cumulatively adding its Size, just do the math
+			// manually to avoid unnecessary work. This does make it so
+			// whitespaces after comma are counted against the budget, but that
+			// should be innocuous.
+			size = uint32(len(hf.Value)-fieldCount+1) + uint32(fieldCount)*hpack.HeaderField{}.Size()
+		} else {
+			remainSize = &headersRemainSize
+			size = hf.Size()
+		}
+		if size > *remainSize {
 			hdec.SetEmitEnabled(false)
 			mh.Truncated = true
-			remainSize = 0
+			headersRemainSize = 0
+			trailersRemainSize = 0
 			return
 		}
-		remainSize -= size
+		*remainSize -= size
 
 		mh.Fields = append(mh.Fields, hf)
 	})
@@ -1766,10 +1782,10 @@
 		// skip parsing the fragment and close the connection.
 		//
 		// "Too much" is either any CONTINUATION frame after we've already
-		// exceeded the max header list size (in which case remainSize is 0),
-		// or a frame whose encoded size is more than twice the remaining
-		// header list bytes we're willing to accept.
-		if int64(len(frag)) > int64(2*remainSize) {
+		// exceeded the max header list size (if so, both budgets are 0), or a
+		// frame whose encoded size is more than twice the remaining header
+		// list bytes we're willing to accept.
+		if int64(len(frag)) > 2*int64(headersRemainSize+trailersRemainSize) {
 			if VerboseLogs {
 				log.Printf("http2: header list too large")
 			}
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/net/http2/server.go /work/src/docker-registry/vendor/golang.org/x/net/http2/server.go
--- a/vendor/golang.org/x/net/http2/server.go	2026-10-28 10:49:46.727003846 +0000
+++ b/vendor/golang.org/x/net/http2/server.go	2026-10-28 10:50:37.622749756 +0000
@@ -280,7 +280,6 @@
 		doneServing:                 make(chan struct{}),
 		clientMaxStreams:            math.MaxUint32, // Section 6.5.2: "Initially, there is no limit to this value"
 		advMaxStreams:               conf.MaxConcurrentStreams,
-		initialStreamSendWindowSize: initialWindowSize,
 		initialStreamRecvWindowSize: conf.MaxUploadBufferPerStream,
 		maxFrameSize:                initialMaxFrameSize,
 		pingTimeout:                 conf.PingTimeout,
@@ -320,7 +319,7 @@
 	// These start at the RFC-specified defaults. If there is a higher
 	// configured value for inflow, that will be updated when we send a
 	// WINDOW_UPDATE shortly after sending SETTINGS.
-	sc.flow.add(initialWindowSize)
+	sc.flow.init()
 	sc.inflow.init(initialWindowSize)
 	sc.hpackEncoder = hpack.NewEncoder(&sc.headerWriteBuf)
 	sc.hpackEncoder.SetMaxDynamicTableSizeLimit(conf.MaxEncoderHeaderTableSize)
@@ -427,7 +426,7 @@
 	wroteFrameCh     chan frameWriteResult  // from writeFrameAsync -> serve, tickles more frame writes
 	bodyReadCh       chan bodyReadMsg       // from handlers -> serve
 	serveMsgCh       chan interface{}       // misc messages & code to send to / run on the serve loop
-	flow             outflow                // conn-wide (not stream-specific) outbound flow control
+	flow             connOutflow            // conn-wide (not stream-specific) outbound flow control
 	inflow           inflow                 // conn-wide inbound flow control
 	tlsState         *tls.ConnectionState   // shared by all handlers, like net/http
 	remoteAddrStr    string
@@ -441,6 +440,9 @@
 	sawFirstSettings            bool // got the initial SETTINGS frame after the preface
 	needToSendSettingsAck       bool
 	unackedSettings             int    // how many SETTINGS have we sent without ACKs?
+	pendingEncoderTableSize     bool   // peer changed SETTINGS_HEADER_TABLE_SIZE; apply to hpackEncoder before the next frame write
+	encoderTableSizeMin         uint32 // smallest SETTINGS_HEADER_TABLE_SIZE since the last apply
+	encoderTableSize            uint32 // latest SETTINGS_HEADER_TABLE_SIZE
 	queuedControlFrames         int    // control frames in the writeSched queue
 	clientMaxStreams            uint32 // SETTINGS_MAX_CONCURRENT_STREAMS from client (our PUSH_PROMISE limit)
 	advMaxStreams               uint32 // our SETTINGS_MAX_CONCURRENT_STREAMS advertised the client
@@ -451,7 +453,6 @@
 	maxPushPromiseID            uint32 // ID of the last push promise (even), or 0 if there have been no pushes
 	streams                     map[uint32]*stream
 	unstartedHandlers           []unstartedHandler
-	initialStreamSendWindowSize int32
 	initialStreamRecvWindowSize int32
 	maxFrameSize                int32
 	peerMaxHeaderListSize       uint32            // zero means unknown (default)
@@ -521,7 +522,8 @@
 	// immutable:
 	sc        *serverConn
 	id        uint32
-	body      *pipe       // non-nil if expecting DATA frames
+	body      *pipe // non-nil if expecting DATA frames
+	reqBody   *requestBody
 	cw        closeWaiter // closed wait stream transitions to closed state
 	ctx       context.Context
 	cancelCtx func()
@@ -1172,6 +1174,16 @@
 
 	sc.writingFrame = true
 	sc.needsFrameFlush = true
+	if sc.pendingEncoderTableSize {
+		// hpackEncoder may be in use by writeFrameAsync, so SETTINGS
+		// changes to it are deferred until no frame is being written.
+		// Replaying the smallest size before the latest one keeps the
+		// encoder's view identical to having applied every change
+		// (RFC 7541, Section 4.2).
+		sc.pendingEncoderTableSize = false
+		sc.hpackEncoder.SetMaxDynamicTableSize(sc.encoderTableSizeMin)
+		sc.hpackEncoder.SetMaxDynamicTableSize(sc.encoderTableSize)
+	}
 	if wr.write.staysWithinBuffer(sc.bw.Available()) {
 		sc.writingFrameAsync = false
 		err := wr.write.writeFrame(sc)
@@ -1271,6 +1283,11 @@
 	}
 	sc.inFrameScheduleLoop = true
 	for !sc.writingFrameAsync {
+		if sc.flow.flowErr && (!sc.inGoAway || sc.goAwayCode == ErrCodeNo) {
+			sc.inGoAway = true
+			sc.needToSendGoAway = true
+			sc.goAwayCode = ErrCodeFlowControl
+		}
 		if sc.needToSendGoAway {
 			sc.needToSendGoAway = false
 			sc.startFrameWrite(FrameWriteRequest{
@@ -1294,6 +1311,9 @@
 				sc.startFrameWrite(wr)
 				continue
 			}
+			if sc.flow.flowErr {
+				continue
+			}
 		}
 		if sc.needsFrameFlush {
 			sc.startFrameWrite(FrameWriteRequest{write: flushFrameWriter{}})
@@ -1526,6 +1546,10 @@
 			return nil
 		}
 		if !st.flow.add(int32(f.Increment)) {
+			if st.flow.conn.flowErr {
+				// This is a lazily-detected connection-level flow control error.
+				return sc.countError("bad_flow", ConnectionError(ErrCodeFlowControl))
+			}
 			return sc.countError("bad_flow", streamError(f.StreamID, ErrCodeFlowControl))
 		}
 	default: // connection-level flow control
@@ -1584,10 +1608,6 @@
 		}
 	}
 	if p := st.body; p != nil {
-		// Return any buffered unread bytes worth of conn-level flow control.
-		// See golang.org/issue/16481
-		sc.sendWindowUpdate(nil, p.Len())
-
 		p.CloseWithError(err)
 	}
 	if e, ok := err.(StreamError); ok {
@@ -1641,7 +1661,12 @@
 	}
 	switch s.ID {
 	case SettingHeaderTableSize:
-		sc.hpackEncoder.SetMaxDynamicTableSize(s.Val)
+		// Applied by startFrameWrite; see comment there.
+		if !sc.pendingEncoderTableSize || s.Val < sc.encoderTableSizeMin {
+			sc.encoderTableSizeMin = s.Val
+		}
+		sc.encoderTableSize = s.Val
+		sc.pendingEncoderTableSize = true
 	case SettingEnablePush:
 		sc.pushEnabled = s.Val != 0
 	case SettingMaxConcurrentStreams:
@@ -1672,28 +1697,14 @@
 
 func (sc *serverConn) processSettingInitialWindowSize(val uint32) error {
 	sc.serveG.check()
-	// Note: val already validated to be within range by
-	// processSetting's Valid call.
-
-	// "A SETTINGS frame can alter the initial flow control window
-	// size for all current streams. When the value of
-	// SETTINGS_INITIAL_WINDOW_SIZE changes, a receiver MUST
-	// adjust the size of all stream flow control windows that it
-	// maintains by the difference between the new value and the
-	// old value."
-	old := sc.initialStreamSendWindowSize
-	sc.initialStreamSendWindowSize = int32(val)
-	growth := int32(val) - old // may be negative
-	for _, st := range sc.streams {
-		if !st.flow.add(growth) {
-			// 6.9.2 Initial Flow Control Window Size
-			// "An endpoint MUST treat a change to
-			// SETTINGS_INITIAL_WINDOW_SIZE that causes any flow
-			// control window to exceed the maximum size as a
-			// connection error (Section 5.4.1) of type
-			// FLOW_CONTROL_ERROR."
-			return sc.countError("setting_win_size", ConnectionError(ErrCodeFlowControl))
-		}
+	if !sc.flow.changeInitialWindowSize(int64(val)) {
+		// 6.9.2 Initial Flow Control Window Size
+		// "An endpoint MUST treat a change to
+		// SETTINGS_INITIAL_WINDOW_SIZE that causes any flow
+		// control window to exceed the maximum size as a
+		// connection error (Section 5.4.1) of type
+		// FLOW_CONTROL_ERROR."
+		return sc.countError("setting_win_size", ConnectionError(ErrCodeFlowControl))
 	}
 	return nil
 }
@@ -1966,7 +1977,7 @@
 	if st.reqTrailer != nil {
 		st.trailer = make(http.Header)
 	}
-	st.body = req.Body.(*requestBody).pipe // may be nil
+	st.body = st.reqBody.pipe // may be nil
 	st.declBodyBytes = req.ContentLength
 
 	handler := sc.handler.ServeHTTP
@@ -1989,7 +2000,7 @@
 		st.readDeadline = time.AfterFunc(sc.hs.ReadTimeout, st.onReadTimeout)
 	}
 
-	return sc.scheduleHandler(id, rw, req, handler)
+	return sc.scheduleHandler(st, rw, req, handler)
 }
 
 func (sc *serverConn) upgradeRequest(req *http.Request) {
@@ -2102,7 +2113,6 @@
 	}
 	st.cw.Init()
 	st.flow.conn = &sc.flow // link to conn-level counter
-	st.flow.add(sc.initialStreamSendWindowSize)
 	st.inflow.init(sc.initialStreamRecvWindowSize)
 	if sc.hs.WriteTimeout > 0 {
 		st.writeDeadline = time.AfterFunc(sc.hs.WriteTimeout, st.onWriteTimeout)
@@ -2184,7 +2194,7 @@
 		} else {
 			req.ContentLength = -1
 		}
-		req.Body.(*requestBody).pipe = &pipe{
+		st.reqBody.pipe = &pipe{
 			b: &dataBuffer{expected: req.ContentLength},
 		}
 	}
@@ -2204,7 +2214,7 @@
 		return nil, nil, sc.countError(res.InvalidReason, streamError(st.id, ErrCodeProtocol))
 	}
 
-	body := &requestBody{
+	st.reqBody = &requestBody{
 		conn:          sc,
 		stream:        st,
 		needsContinue: res.NeedsContinue,
@@ -2220,7 +2230,7 @@
 		ProtoMinor: 0,
 		TLS:        tlsState,
 		Host:       rp.Authority,
-		Body:       body,
+		Body:       st.reqBody,
 		Trailer:    res.Trailer,
 	}).WithContext(st.ctx)
 	rw := sc.newResponseWriter(st, req)
@@ -2244,11 +2254,12 @@
 	rw       *responseWriter
 	req      *http.Request
 	handler  func(http.ResponseWriter, *http.Request)
+	body     *pipe
 }
 
 // scheduleHandler starts a handler goroutine,
 // or schedules one to start as soon as an existing handler finishes.
-func (sc *serverConn) scheduleHandler(streamID uint32, rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) error {
+func (sc *serverConn) scheduleHandler(st *stream, rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) error {
 	sc.serveG.check()
 	maxHandlers := sc.advMaxStreams
 	if sc.curHandlers < maxHandlers {
@@ -2260,10 +2271,11 @@
 		return sc.countError("too_many_early_resets", ConnectionError(ErrCodeEnhanceYourCalm))
 	}
 	sc.unstartedHandlers = append(sc.unstartedHandlers, unstartedHandler{
-		streamID: streamID,
+		streamID: st.id,
 		rw:       rw,
 		req:      req,
 		handler:  handler,
+		body:     st.body,
 	})
 	return nil
 }
@@ -2277,6 +2289,10 @@
 		u := sc.unstartedHandlers[i]
 		if sc.streams[u.streamID] == nil {
 			// This stream was reset before its goroutine had a chance to start.
+			if u.body != nil {
+				u.body.BreakWithError(errClosedBody)
+				sc.sendWindowUpdate(nil, u.body.Len())
+			}
 			continue
 		}
 		if sc.curHandlers >= maxHandlers {
@@ -2298,6 +2314,12 @@
 	didPanic := true
 	defer func() {
 		rw.rws.stream.cancelCtx()
+		if b := rw.rws.stream.reqBody; b != nil {
+			// Closing the body refunds flow control credit for any unconsumed data.
+			// (reqBody is nil for Upgrade: h2c requests, but those do not use flow
+			// control for the request body.)
+			b.Close()
+		}
 		if req.MultipartForm != nil {
 			req.MultipartForm.RemoveAll()
 		}
@@ -2396,7 +2418,7 @@
 func (sc *serverConn) noteBodyRead(st *stream, n int) {
 	sc.serveG.check()
 	sc.sendWindowUpdate(nil, n) // conn-level
-	if st.state != stateHalfClosedRemote && st.state != stateClosed {
+	if st != nil && st.state != stateHalfClosedRemote && st.state != stateClosed {
 		// Don't send this WINDOW_UPDATE if the stream is closed
 		// remotely.
 		sc.sendWindowUpdate(st, n)
@@ -2444,6 +2466,9 @@
 	b.closeOnce.Do(func() {
 		if b.pipe != nil {
 			b.pipe.BreakWithError(errClosedBody)
+			if unread := b.pipe.Len(); unread > 0 {
+				b.conn.noteBodyReadFromHandler(nil, unread, errClosedBody)
+			}
 		}
 	})
 	return nil
@@ -2461,9 +2486,6 @@
 	if err == io.EOF {
 		b.sawEOF = true
 	}
-	if b.conn == nil {
-		return
-	}
 	b.conn.noteBodyReadFromHandler(b.stream, n, err)
 	return
 }
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/net/http2/transport.go /work/src/docker-registry/vendor/golang.org/x/net/http2/transport.go
--- a/vendor/golang.org/x/net/http2/transport.go	2026-10-28 10:49:46.727003846 +0000
+++ b/vendor/golang.org/x/net/http2/transport.go	2026-10-28 10:50:37.622749756 +0000
@@ -27,6 +27,7 @@
 	"net/http"
 	"net/http/httptrace"
 	"net/textproto"
+	"slices"
 	"strconv"
 	"sync"
 	"sync/atomic"
@@ -203,7 +204,7 @@
 
 	mu               sync.Mutex // guards following
 	cond             *sync.Cond // hold mu; broadcast on flow/closed changes
-	flow             outflow    // our conn-level flow control quota (cs.outflow is per stream)
+	flow             connOutflow // our conn-level flow control quota (cs.outflow is per stream)
 	inflow           inflow     // peer's conn-level flow control
 	doNotReuse       bool       // whether conn is marked to not be reused for any future requests
 	closing          bool
@@ -227,7 +228,6 @@
 	maxConcurrentStreams        uint32
 	peerMaxHeaderListSize       uint64
 	peerMaxHeaderTableSize      uint32
-	initialWindowSize           uint32
 	initialStreamRecvWindowSize int32
 	readIdleTimeout             time.Duration
 	pingTimeout                 time.Duration
@@ -472,7 +472,6 @@
 		readerDone:                  make(chan struct{}),
 		nextStreamID:                1,
 		maxFrameSize:                16 << 10, // spec default
-		initialWindowSize:           65535,    // spec default
 		initialStreamRecvWindowSize: conf.MaxUploadBufferPerStream,
 		maxConcurrentStreams:        initialMaxConcurrentStreams, // "infinite", per spec. Use a smaller value until we have received server settings.
 		strictMaxConcurrentStreams:  conf.StrictMaxConcurrentRequests,
@@ -497,7 +496,7 @@
 	}
 
 	cc.cond = sync.NewCond(&cc.mu)
-	cc.flow.add(int32(initialWindowSize))
+	cc.flow.init()
 
 	// TODO: adjust this writer size to account for frame size +
 	// MTU + crypto/tls record padding.
@@ -876,6 +875,33 @@
 	return nil
 }
 
+func (cc *ClientConn) goAwayAndClose(code ErrCode) {
+	cc.mu.Lock()
+	closed := cc.closed
+	cc.closing = true
+	cc.closed = true
+	cc.mu.Unlock()
+	if closed {
+		return
+	}
+	if f := cc.fr.countError; f != nil {
+		f(fmt.Sprintf("conn_close_error_%s", code.stringToken()))
+	}
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		cc.wmu.Lock()
+		cc.fr.WriteGoAway(0, code, nil)
+		cc.bw.Flush()
+		cc.wmu.Unlock()
+	}()
+	select {
+	case <-done:
+	case <-time.After(250 * time.Millisecond):
+	}
+	cc.closeForError(fmt.Errorf("http2: closing connection with %v", code))
+}
+
 // closes the client connection immediately. In-flight requests are interrupted.
 // err is sent to streams.
 func (cc *ClientConn) closeForError(err error) {
@@ -1319,7 +1345,9 @@
 	}
 	if err != nil {
 		cs.abortStream(err) // possibly redundant, but harmless
-		if cs.sentHeaders {
+		if ce, ok := err.(ConnectionError); ok {
+			cc.goAwayAndClose(ErrCode(ce))
+		} else if cs.sentHeaders {
 			if se, ok := err.(StreamError); ok {
 				if se.Cause != errFromPeer {
 					cc.writeStreamReset(cs.ID, se.Code, false, err)
@@ -1648,8 +1676,12 @@
 			return 0, errRequestCanceled
 		default:
 		}
-		if a := cs.flow.available(); a > 0 {
-			take := a
+		avail, ok := cs.flow.available()
+		if !ok {
+			return 0, ConnectionError(ErrCodeFlowControl)
+		}
+		if avail > 0 {
+			take := avail
 			if int(take) > maxBytes {
 
 				take = int32(maxBytes) // can't truncate int; take is int32
@@ -1710,8 +1742,7 @@
 
 // requires cc.mu be held.
 func (cc *ClientConn) addStreamLocked(cs *clientStream) {
-	cs.flow.add(int32(cc.initialWindowSize))
-	cs.flow.setConnFlow(&cc.flow)
+	cs.flow.conn = &cc.flow
 	cs.inflow.init(cc.initialStreamRecvWindowSize)
 	cs.ID = cc.nextStreamID
 	cc.nextStreamID += 2
@@ -2095,18 +2126,42 @@
 		return nil, nil
 	}
 
+	// Delete various headers that might mess up framing for HTTP/1. This is
+	// not a problem for HTTP/2, but someone might use HTTP/2 transport as a
+	// reverse proxy which forwards the response to an HTTP/1 client. Our
+	// HTTP/1 client transport will properly reject improper headers such as
+	// multiple conflicting Content-Length headers, but other implementations
+	// might not.
+	// TODO: just reject such responses? We deleted them for compatibility
+	// since this was done in a security fix (go.dev/issue/81115). However,
+	// rejecting them seems entirely reasonable and relatively safe.
+
+	// Connection-specific header fields must not appear in an HTTP/2 message,
+	// and any message containing them is malformed. RFC 9113, Section 8.2.2.
+	for _, k := range connHeaders {
+		delete(res.Header, k)
+	}
 	res.ContentLength = -1
-	if clens := res.Header["Content-Length"]; len(clens) == 1 {
-		if cl, err := strconv.ParseUint(clens[0], 10, 63); err == nil {
-			res.ContentLength = int64(cl)
+	if clens, ok := res.Header["Content-Length"]; ok {
+		// Repeated Content-Length values may be collapsed into one only if
+		// they are identical per RFC 9110 Section 8.6.
+		// No need to trim whitespace, HTTP/2 header values must not have
+		// extraneous whitespace per RFC 9113 Section 8.2.1.
+		// Non-canonical headers are already rejected by our framer at this
+		// point.
+		conflicting := slices.ContainsFunc(clens[1:], func(clen string) bool {
+			return clen != clens[0]
+		})
+		cl, err := strconv.ParseUint(clens[0], 10, 63)
+		if conflicting || err != nil {
+			delete(res.Header, "Content-Length")
 		} else {
-			// TODO: care? unlike http/1, it won't mess up our framing, so it's
-			// more safe smuggling-wise to ignore.
+			res.Header["Content-Length"] = clens[:1]
+			res.ContentLength = int64(cl)
 		}
-	} else if len(clens) > 1 {
-		// TODO: care? unlike http/1, it won't mess up our framing, so it's
-		// more safe smuggling-wise to ignore.
-	} else if f.StreamEnded() && !cs.isHead {
+	}
+
+	if res.ContentLength < 0 && f.StreamEnded() && !cs.isHead {
 		res.ContentLength = 0
 	}
 
@@ -2417,6 +2472,10 @@
 func (rl *clientConnReadLoop) streamByID(id uint32, headerOrData bool) *clientStream {
 	rl.cc.mu.Lock()
 	defer rl.cc.mu.Unlock()
+	return rl.streamByIDLocked(id, headerOrData)
+}
+
+func (rl *clientConnReadLoop) streamByIDLocked(id uint32, headerOrData bool) *clientStream {
 	if headerOrData {
 		// Work around an unfortunate gRPC behavior.
 		// See comment on ClientConn.rstStreamPingsBlocked for details.
@@ -2499,24 +2558,10 @@
 		case SettingMaxHeaderListSize:
 			cc.peerMaxHeaderListSize = uint64(s.Val)
 		case SettingInitialWindowSize:
-			// Values above the maximum flow-control
-			// window size of 2^31-1 MUST be treated as a
-			// connection error (Section 5.4.1) of type
-			// FLOW_CONTROL_ERROR.
-			if s.Val > math.MaxInt32 {
+			if !cc.flow.changeInitialWindowSize(int64(s.Val)) {
 				return ConnectionError(ErrCodeFlowControl)
 			}
-
-			// Adjust flow control of currently-open
-			// frames by the difference of the old initial
-			// window size and this one.
-			delta := int32(s.Val) - int32(cc.initialWindowSize)
-			for _, cs := range cc.streams {
-				cs.flow.add(delta)
-			}
 			cc.cond.Broadcast()
-
-			cc.initialWindowSize = s.Val
 		case SettingHeaderTableSize:
 			cc.henc.SetMaxDynamicTableSize(s.Val)
 			cc.peerMaxHeaderTableSize = s.Val
@@ -2558,29 +2603,30 @@
 
 func (rl *clientConnReadLoop) processWindowUpdate(f *WindowUpdateFrame) error {
 	cc := rl.cc
-	cs := rl.streamByID(f.StreamID, notHeaderOrDataFrame)
-	if f.StreamID != 0 && cs == nil {
-		return nil
-	}
-
 	cc.mu.Lock()
 	defer cc.mu.Unlock()
-
-	fl := &cc.flow
-	if cs != nil {
-		fl = &cs.flow
-	}
-	if !fl.add(int32(f.Increment)) {
-		// For stream, the sender sends RST_STREAM with an error code of FLOW_CONTROL_ERROR
-		if cs != nil {
+	if f.StreamID == 0 {
+		if !cc.flow.add(int32(f.Increment)) {
+			return ConnectionError(ErrCodeFlowControl)
+		}
+	} else {
+		cs := rl.streamByIDLocked(f.StreamID, notHeaderOrDataFrame)
+		if cs == nil {
+			return nil
+		}
+		if !cs.flow.add(int32(f.Increment)) {
+			if cs.flow.conn.flowErr {
+				// This is a lazily-detected connection-level flow control error.
+				return ConnectionError(ErrCodeFlowControl)
+			}
+			// For stream, the sender sends RST_STREAM with
+			// an error code of FLOW_CONTROL_ERROR.
 			rl.endStreamErrorLocked(cs, StreamError{
 				StreamID: f.StreamID,
 				Code:     ErrCodeFlowControl,
 			})
 			return nil
 		}
-
-		return ConnectionError(ErrCodeFlowControl)
 	}
 	cc.cond.Broadcast()
 	return nil
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/net/http2/transport_wrap.go /work/src/docker-registry/vendor/golang.org/x/net/http2/transport_wrap.go
--- a/vendor/golang.org/x/net/http2/transport_wrap.go	2026-10-28 10:49:46.727003846 +0000
+++ b/vendor/golang.org/x/net/http2/transport_wrap.go	2026-10-28 10:50:37.622749756 +0000
@@ -119,33 +119,27 @@
 
 // DialFromContext dials a new connection using the http2.Transport's DialTLS/DialTLSContext.
 func (t transportConfig) DialFromContext(ctx context.Context, network, address string) (net.Conn, error) {
-	if ctx.Value(http2TransportContextKey{}) == nil {
+	dial, _ := ctx.Value(http2TransportContextKey{}).(*transportRoundTripState)
+	if dial == nil {
 		// We're being called from a RoundTrip that did not start with an http2.Transport.
 		// Use the http.Transport's dialer.
 		return nil, errors.ErrUnsupported
 	}
-
-	tlsConf := t.t.TLSClientConfig
-	if tlsConf == nil {
-		tlsConf = &tls.Config{}
-	} else {
-		tlsConf = tlsConf.Clone()
-	}
-	if !slices.Contains(tlsConf.NextProtos, "h2") {
-		tlsConf.NextProtos = append([]string{"h2"}, tlsConf.NextProtos...)
-	}
-	if tlsConf.ServerName == "" {
-		host, _, err := net.SplitHostPort(address)
-		if err == nil {
-			tlsConf.ServerName = host
-		}
-	}
-	return t.t.dialTLS(ctx, network, address, tlsConf)
+	return t.t.dialForRoundTrip(ctx, dial, network, address)
 }
 
 type transportInternal struct {
 	initOnce sync.Once
 	lazyt1   *http.Transport
+
+	dialMu sync.Mutex
+	dials  map[string]*transportDialState
+}
+
+type transportDialState struct {
+	dialc   chan struct{} // close when dial returns
+	dialErr error         // dial result, set before dialc is closed
+	rtdonec chan struct{} // closed when RoundTrip initiating the dial returns
 }
 
 func (t *Transport) init() *http.Transport {
@@ -167,6 +161,52 @@
 	}
 }
 
+// transportRoundTripState is the state of the dial for an http2.Transport.RoundTrip.
+type transportRoundTripState struct {
+	mu       sync.Mutex
+	rtdone   bool          // set when RoundTrip returns
+	rtdonec  chan struct{} // closed when RoundTrip returns
+	gotconnc chan struct{} // closed when GotConn hook is called
+}
+
+// startDial is called when a dial starts.
+//
+// It returns done=true if the RoundTrip has already returned,
+// in which case we should skip dialing.
+func (dial *transportRoundTripState) startDial() (gotconnc chan struct{}, done bool) {
+	dial.mu.Lock()
+	defer dial.mu.Unlock()
+	if dial.rtdone {
+		return nil, true
+	}
+	if dial.rtdonec == nil {
+		dial.rtdonec = make(chan struct{})
+	}
+	dial.gotconnc = make(chan struct{})
+	return dial.gotconnc, false
+}
+
+// gotConn is called when RoundTrip gets a connection.
+// This may happen multiple times per RoundTrip, if a request is retried.
+func (dial *transportRoundTripState) gotConn() {
+	dial.mu.Lock()
+	defer dial.mu.Unlock()
+	if dial.gotconnc != nil {
+		close(dial.gotconnc)
+		dial.gotconnc = nil
+	}
+}
+
+// roundTripDone is called when RoundTrip returns.
+func (dial *transportRoundTripState) roundTripDone() {
+	dial.mu.Lock()
+	defer dial.mu.Unlock()
+	dial.rtdone = true
+	if dial.rtdonec != nil {
+		close(dial.rtdonec)
+	}
+}
+
 func (t *Transport) roundTripOpt(req *http.Request, opt RoundTripOpt) (*http.Response, error) {
 	t1 := t.init()
 
@@ -186,12 +226,146 @@
 	// Both http.Transport and http2.Transport allow the user to provide a custom
 	// dial function, and historically you only get the dial function from the
 	// Transport you're calling RoundTrip on.
-	ctx := context.WithValue(req.Context(), http2TransportContextKey{}, t)
+	//
+	// In addition, http2.Transport coalesces dials, which http.Transport historically
+	// has not.
+	dial := &transportRoundTripState{}
+	defer dial.roundTripDone()
+	ctx := context.WithValue(req.Context(), http2TransportContextKey{}, dial)
+	ctx = httptrace.WithClientTrace(ctx, &httptrace.ClientTrace{
+		GotConn: func(httptrace.GotConnInfo) {
+			// Tell dialForRoundTrip that we have received a connection.
+			dial.gotConn()
+		},
+	})
 	req = req.WithContext(ctx)
-
 	return t1.RoundTrip(req)
 }
 
+var errCoalescedDialAbandoned = errors.New("http2: abandoned coalesced dial")
+
+const coalescedDialRetryTimeout = 50 * time.Millisecond
+
+// dialForRoundTrip is called (indirectly) by net/http when dialing a new connection
+// for a request call which originated as an http2.Transport.RoundTrip call.
+//
+// It uses the http2.Transport's Dial hooks and coalesces dials.
+func (t *Transport) dialForRoundTrip(ctx context.Context, dial *transportRoundTripState, network, address string) (net.Conn, error) {
+	gotconnc, rtdone := dial.startDial()
+	if rtdone {
+		// RoundTrip returned, no need for this dial to proceed.
+		return nil, errCoalescedDialAbandoned
+	}
+
+	var state *transportDialState
+	for {
+		// The first dial to an address registers itself with t.dials.
+		// When the dial finishes, it records the outcome and removes itself from t.dials
+		// so future dials will start a new round of coalescing.
+		//
+		// Subsequent dials observe that a dial is in progress, and skip dialing.
+		t.dialMu.Lock()
+		if t.dials == nil {
+			t.dials = make(map[string]*transportDialState)
+		}
+		leader := t.dials[address]
+		if leader == nil {
+			// No entry in t.dials to coalesce with. Add ourselves as leader.
+			state = &transportDialState{
+				dialc:   make(chan struct{}),
+				rtdonec: dial.rtdonec,
+			}
+			t.dials[address] = state
+		}
+		t.dialMu.Unlock()
+		if leader == nil {
+			// We are the leader, so we should dial for real.
+			break
+		}
+
+		// Coalesce with a previous dial.
+		var (
+			done          = false
+			leaderdialc   = leader.dialc
+			leaderrtdonec = leader.rtdonec
+			timerc        <-chan time.Time
+		)
+		for !done {
+			if leaderdialc == nil && leaderrtdonec == nil && timerc == nil {
+				// The leader finished dialing, and its RoundTrip finished.
+				//
+				// There are several possibilities, which reduce to:
+				//   - The RoundTrip we are dialing for is about to receive
+				//     a connection (possibly the one the leader just dialed),
+				//     but we haven't observed it yet.
+				//   - There's something wrong with the leader's connection,
+				//     such as a TLS handshake failure.
+				//
+				// We have no good way to distinguish between these cases.
+				//
+				// Wait a short time for the leader's connection (or some
+				// other usable connection) to be delivered to our RoundTrip.
+				// If it is not, start a dial of our own.
+				timerc = time.After(coalescedDialRetryTimeout)
+			}
+			select {
+			case <-leaderdialc:
+				// The leader's dial completed.
+				if leader.dialErr != nil {
+					return nil, leader.dialErr
+				}
+				leaderdialc = nil
+			case <-leaderrtdonec:
+				// The leader's RoundTrip completed.
+				leaderrtdonec = nil
+			case <-timerc:
+				// The leader's dial and RoundTrip completed, and some time
+				// has passed. Assume we're not getting a connection and
+				// restart the dial process.
+				done = true
+			case <-dial.rtdonec:
+				// Our RoundTrip returned.
+				return nil, errCoalescedDialAbandoned
+			case <-gotconnc:
+				// Our RoundTrip got a connection.
+				return nil, errCoalescedDialAbandoned
+			case <-ctx.Done():
+				// net/http abandoned the dial.
+				return nil, ctx.Err()
+			}
+		}
+	}
+
+	// Dial for real.
+	tlsConf := t.TLSClientConfig
+	if tlsConf == nil {
+		tlsConf = &tls.Config{}
+	} else {
+		tlsConf = tlsConf.Clone()
+	}
+	if !slices.Contains(tlsConf.NextProtos, "h2") {
+		tlsConf.NextProtos = append([]string{"h2"}, tlsConf.NextProtos...)
+	}
+	if tlsConf.ServerName == "" {
+		host, _, err := net.SplitHostPort(address)
+		if err == nil {
+			tlsConf.ServerName = host
+		}
+	}
+	nc, err := t.dialTLS(ctx, network, address, tlsConf)
+
+	// Remove this dial from t.dials, so future dial attempts will not coalesce with it.
+	t.dialMu.Lock()
+	delete(t.dials, address)
+	t.dialMu.Unlock()
+
+	// Notify any dial coalesced with this one that we are done.
+	state.dialErr = err
+	close(state.dialc)
+
+	return nc, err
+}
+
 func (t *Transport) closeIdleConnections() {
 	t1 := t.init()
 	t1.CloseIdleConnections()
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/net/http2/writesched.go /work/src/docker-registry/vendor/golang.org/x/net/http2/writesched.go
--- a/vendor/golang.org/x/net/http2/writesched.go	2026-10-28 10:49:46.727003846 +0000
+++ b/vendor/golang.org/x/net/http2/writesched.go	2026-10-28 10:50:37.622749756 +0000
@@ -79,10 +79,11 @@
 	}
 
 	// Might need to split after applying limits.
-	allowed := wr.stream.flow.available()
-	if n < allowed {
-		allowed = n
+	avail, ok := wr.stream.flow.available()
+	if !ok {
+		return empty, empty, 0
 	}
+	allowed := min(n, avail)
 	if wr.stream.sc.maxFrameSize < allowed {
 		allowed = wr.stream.sc.maxFrameSize
 	}
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/net/internal/httpcommon/gzip.go /work/src/docker-registry/vendor/golang.org/x/net/internal/httpcommon/gzip.go
--- a/vendor/golang.org/x/net/internal/httpcommon/gzip.go	1970-01-01 00:00:00.000000000 +0000
+++ b/vendor/golang.org/x/net/internal/httpcommon/gzip.go	2026-10-28 10:50:37.626749737 +0000
@@ -0,0 +1,132 @@
+// Copyright 2026 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package httpcommon
+
+import (
+	"compress/flate"
+	"compress/gzip"
+	"errors"
+	"io"
+	"io/fs"
+	"sync"
+)
+
+var errConcurrentRead = errors.New("http: concurrent read on response body")
+
+// incomparable is a zero-width, non-comparable type. Adding it to a struct
+// makes that struct also non-comparable, and generally doesn't add
+// any size (as long as it's first).
+type incomparable [0]func()
+
+// GzipReader wraps a response body so it can lazily
+// get gzip.Reader from the pool on the first call to Read.
+// After Close is called it puts gzip.Reader to the pool immediately
+// if there is no Read in progress or later when Read completes.
+type GzipReader struct {
+	_    incomparable
+	Body io.ReadCloser // underlying Response.Body
+	mu   sync.Mutex    // guards zr and zerr
+	zr   *gzip.Reader  // stores gzip reader from the pool between reads
+	zerr error         // sticky gzip reader init error or sentinel value to detect concurrent read and read after close
+}
+
+type eofReader struct{}
+
+func (eofReader) Read([]byte) (int, error) { return 0, io.EOF }
+func (eofReader) ReadByte() (byte, error)  { return 0, io.EOF }
+
+var gzipPool = sync.Pool{New: func() any { return new(gzip.Reader) }}
+
+// gzipPoolGet gets a gzip.Reader from the pool and resets it to read from r.
+func gzipPoolGet(r io.Reader) (*gzip.Reader, error) {
+	zr := gzipPool.Get().(*gzip.Reader)
+	if err := zr.Reset(r); err != nil {
+		gzipPoolPut(zr)
+		return nil, err
+	}
+	return zr, nil
+}
+
+// gzipPoolPut puts a gzip.Reader back into the pool.
+func gzipPoolPut(zr *gzip.Reader) {
+	// Reset will allocate bufio.Reader if we pass it anything
+	// other than a flate.Reader, so ensure that it's getting one.
+	var r flate.Reader = eofReader{}
+	zr.Reset(r)
+	gzipPool.Put(zr)
+}
+
+// acquire returns a gzip.Reader for reading response body.
+// The reader must be released after use.
+func (gz *GzipReader) acquire() (*gzip.Reader, error) {
+	gz.mu.Lock()
+	defer gz.mu.Unlock()
+	if gz.zerr != nil {
+		return nil, gz.zerr
+	}
+	if gz.zr == nil {
+		// gzipPoolGet might block indefinitely since it reads the gzip header.
+		// Therefore, drop mu temporarily when using gzipPoolGet.
+		// We set zerr to errConcurrentRead to prevent concurrent read
+		// even when mu is temporarily dropped.
+		gz.zerr = errConcurrentRead
+		gz.mu.Unlock()
+		zr, err := gzipPoolGet(gz.Body)
+		gz.mu.Lock()
+		// Guard against Close being called while gzipPoolGet is running.
+		if gz.zerr != errConcurrentRead {
+			if zr != nil {
+				gzipPoolPut(zr)
+			}
+			return nil, gz.zerr
+		}
+		gz.zr, gz.zerr = zr, err
+		if gz.zerr != nil {
+			return nil, gz.zerr
+		}
+	}
+	ret := gz.zr
+	gz.zr, gz.zerr = nil, errConcurrentRead
+	return ret, nil
+}
+
+// release returns the gzip.Reader to the pool if Close was called during Read.
+func (gz *GzipReader) release(zr *gzip.Reader) {
+	gz.mu.Lock()
+	defer gz.mu.Unlock()
+	if gz.zerr == errConcurrentRead {
+		gz.zr, gz.zerr = zr, nil
+	} else { // fs.ErrClosed
+		gzipPoolPut(zr)
+	}
+}
+
+// close returns the gzip.Reader to the pool immediately or
+// signals release to do so after Read completes.
+func (gz *GzipReader) close() {
+	gz.mu.Lock()
+	defer gz.mu.Unlock()
+	if gz.zerr == nil && gz.zr != nil {
+		gzipPoolPut(gz.zr)
+		gz.zr = nil
+	}
+	gz.zerr = fs.ErrClosed
+}
+
+func (gz *GzipReader) Read(p []byte) (n int, err error) {
+	zr, err := gz.acquire()
+	if err != nil {
+		return 0, err
+	}
+	defer gz.release(zr)
+
+	return zr.Read(p)
+}
+
+func (gz *GzipReader) Close() error {
+	gz.close()
+
+	return gz.Body.Close()
+}
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/cpu/cpu.go /work/src/docker-registry/vendor/golang.org/x/sys/cpu/cpu.go
--- a/vendor/golang.org/x/sys/cpu/cpu.go	2026-10-28 10:49:46.735003806 +0000
+++ b/vendor/golang.org/x/sys/cpu/cpu.go	2026-10-28 10:50:37.866748551 +0000
@@ -61,7 +61,11 @@
 	HasBMI2             bool // Bit manipulation instruction set 2
 	HasCX16             bool // Compare and exchange 16 Bytes
 	HasERMS             bool // Enhanced REP for MOVSB and STOSB
+	HasF16C             bool // 16-bit floating-point conversion instructions
 	HasFMA              bool // Fused-multiply-add instructions
+	HasLAHF             bool // LAHF/SAHF available in 64-bit mode
+	HasLZCNT            bool // Leading zeros count instruction
+	HasMOVBE            bool // Move data after byte swap
 	HasOSXSAVE          bool // OS supports XSAVE/XRESTOR for saving/restoring XMM registers.
 	HasPCLMULQDQ        bool // PCLMULQDQ instruction - most often used for AES-GCM
 	HasPOPCNT           bool // Hamming weight instruction POPCNT.
@@ -75,6 +79,7 @@
 	HasAVXIFMA          bool // Advanced vector extension Integer Fused Multiply Add
 	HasAVXVNNI          bool // Advanced vector extension Vector Neural Network Instructions
 	HasAVXVNNIInt8      bool // Advanced vector extension Vector Neural Network Int8 instructions
+	HasXSAVE            bool // XSAVE/XRSTOR/XSETBV/XGETBV instructions (hardware support; see also HasOSXSAVE)
 	_                   CacheLinePad
 }
 
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/cpu/cpu_x86.go /work/src/docker-registry/vendor/golang.org/x/sys/cpu/cpu_x86.go
--- a/vendor/golang.org/x/sys/cpu/cpu_x86.go	2026-10-28 10:49:46.735003806 +0000
+++ b/vendor/golang.org/x/sys/cpu/cpu_x86.go	2026-10-28 10:50:37.870748533 +0000
@@ -43,7 +43,11 @@
 		{Name: "bmi2", Feature: &X86.HasBMI2},
 		{Name: "cx16", Feature: &X86.HasCX16},
 		{Name: "erms", Feature: &X86.HasERMS},
+		{Name: "f16c", Feature: &X86.HasF16C},
 		{Name: "fma", Feature: &X86.HasFMA},
+		{Name: "lahf", Feature: &X86.HasLAHF},
+		{Name: "lzcnt", Feature: &X86.HasLZCNT},
+		{Name: "movbe", Feature: &X86.HasMOVBE},
 		{Name: "osxsave", Feature: &X86.HasOSXSAVE},
 		{Name: "pclmulqdq", Feature: &X86.HasPCLMULQDQ},
 		{Name: "popcnt", Feature: &X86.HasPOPCNT},
@@ -56,6 +60,7 @@
 		{Name: "avxifma", Feature: &X86.HasAVXIFMA},
 		{Name: "avxvnni", Feature: &X86.HasAVXVNNI},
 		{Name: "avxvnniint8", Feature: &X86.HasAVXVNNIInt8},
+		{Name: "xsave", Feature: &X86.HasXSAVE},
 
 		// These capabilities should always be enabled on amd64:
 		{Name: "sse2", Feature: &X86.HasSSE2, Required: runtime.GOARCH == "amd64"},
@@ -83,10 +88,13 @@
 		cpuid_AVX512VPOPCNTDQ = 1 << 14
 		cpuid_SSE41           = 1 << 19
 		cpuid_SSE42           = 1 << 20
+		cpuid_MOVBE           = 1 << 22
 		cpuid_POPCNT          = 1 << 23
 		cpuid_AES             = 1 << 25
+		cpuid_XSAVE           = 1 << 26
 		cpuid_OSXSAVE         = 1 << 27
 		cpuid_AVX             = 1 << 28
+		cpuid_F16C            = 1 << 29
 
 		// "Extended Feature Flag" bits returned in EBX for CPUID EAX=0x7 ECX=0x0
 		cpuid_BMI1     = 1 << 3
@@ -110,6 +118,9 @@
 
 		// edx bits
 		cpuid_FSRM = 1 << 4
+		// ecx bits for CPUID 0x80000001
+		cpuid_LAHF  = 1 << 0
+		cpuid_LZCNT = 1 << 5
 		// edx bits for CPUID 0x80000001
 		cpuid_RDTSCP = 1 << 27
 	)
@@ -158,9 +169,21 @@
 	X86.HasSSE42 = isSet(ecx1, cpuid_SSE42)
 	X86.HasPOPCNT = isSet(ecx1, cpuid_POPCNT)
 	X86.HasAES = isSet(ecx1, cpuid_AES)
+	X86.HasXSAVE = isSet(ecx1, cpuid_XSAVE)
 	X86.HasOSXSAVE = isSet(ecx1, cpuid_OSXSAVE)
+	X86.HasF16C = isSet(ecx1, cpuid_F16C)
+	X86.HasMOVBE = isSet(ecx1, cpuid_MOVBE)
 	X86.HasRDRAND = isSet(ecx1, cpuid_RDRAND)
 
+	// Extended processor info and feature bits, under the separate extended
+	// (0x8000_0000-prefixed) leaf hierarchy, so maxID (the basic leaf count)
+	// doesn't gate it.
+	if maxExtID, _, _, _ := cpuid(0x80000000, 0); maxExtID >= 0x80000001 {
+		_, _, ecxExt1, _ := cpuid(0x80000001, 0)
+		X86.HasLAHF = isSet(ecxExt1, cpuid_LAHF)
+		X86.HasLZCNT = isSet(ecxExt1, cpuid_LZCNT)
+	}
+
 	var osSupportsAVX, osSupportsAVX512 bool
 	// For XGETBV, OSXSAVE bit is required and sufficient.
 	if X86.HasOSXSAVE {
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/asm_linux_ppc64x.s /work/src/docker-registry/vendor/golang.org/x/sys/unix/asm_linux_ppc64x.s
--- a/vendor/golang.org/x/sys/unix/asm_linux_ppc64x.s	2026-10-28 10:49:46.739003786 +0000
+++ b/vendor/golang.org/x/sys/unix/asm_linux_ppc64x.s	2026-10-28 10:50:37.874748513 +0000
@@ -13,6 +13,16 @@
 // Just jump to package syscall's implementation for all these functions.
 // The runtime may know about them.
 
+TEXT ·Syscall(SB),NOSPLIT,$0-56
+	MOVD	$syscall·Syscall(SB), R31
+	MOVD	R31, CTR
+	JMP	(CTR)
+
+TEXT ·Syscall6(SB),NOSPLIT,$0-80
+	MOVD	$syscall·Syscall6(SB), R31
+	MOVD	R31, CTR
+	JMP	(CTR)
+
 TEXT ·SyscallNoError(SB),NOSPLIT,$0-48
 	BL	runtime·entersyscall(SB)
 	MOVD	a1+8(FP), R3
@@ -28,6 +38,16 @@
 	BL	runtime·exitsyscall(SB)
 	RET
 
+TEXT ·RawSyscall(SB),NOSPLIT,$0-56
+	MOVD	$syscall·RawSyscall(SB), R31
+	MOVD	R31, CTR
+	JMP	(CTR)
+
+TEXT ·RawSyscall6(SB),NOSPLIT,$0-80
+	MOVD	$syscall·RawSyscall6(SB), R31
+	MOVD	R31, CTR
+	JMP	(CTR)
+
 TEXT ·RawSyscallNoError(SB),NOSPLIT,$0-48
 	MOVD	a1+8(FP), R3
 	MOVD	a2+16(FP), R4
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/asm_linux_sparc64.s /work/src/docker-registry/vendor/golang.org/x/sys/unix/asm_linux_sparc64.s
--- a/vendor/golang.org/x/sys/unix/asm_linux_sparc64.s	1970-01-01 00:00:00.000000000 +0000
+++ b/vendor/golang.org/x/sys/unix/asm_linux_sparc64.s	2026-10-28 10:50:37.874748513 +0000
@@ -0,0 +1,48 @@
+// Copyright 2026 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build linux && sparc64 && gc
+
+#include "textflag.h"
+
+//
+// System calls for sparc64, Linux
+//
+
+// Just jump to package syscall's implementation for all these functions.
+// The runtime may know about them.
+
+TEXT ·Syscall(SB), NOSPLIT, $0-56
+	JMP	syscall·Syscall(SB)
+
+TEXT ·Syscall6(SB), NOSPLIT, $0-80
+	JMP	syscall·Syscall6(SB)
+
+TEXT ·SyscallNoError(SB), NOSPLIT, $0-48
+	CALL	runtime·entersyscall(SB)
+	MOVD	trap+0(FP), R1	// syscall entry
+	MOVD	a1+8(FP), R8
+	MOVD	a2+16(FP), R9
+	MOVD	a3+24(FP), R10
+	TA	$0x6d
+	MOVD	R8, r1+32(FP)
+	MOVD	R9, r2+40(FP)
+	CALL	runtime·exitsyscall(SB)
+	RET
+
+TEXT ·RawSyscall(SB), NOSPLIT, $0-56
+	JMP	syscall·RawSyscall(SB)
+
+TEXT ·RawSyscall6(SB), NOSPLIT, $0-80
+	JMP	syscall·RawSyscall6(SB)
+
+TEXT ·RawSyscallNoError(SB), NOSPLIT, $0-48
+	MOVD	trap+0(FP), R1	// syscall entry
+	MOVD	a1+8(FP), R8
+	MOVD	a2+16(FP), R9
+	MOVD	a3+24(FP), R10
+	TA	$0x6d
+	MOVD	R8, r1+32(FP)
+	MOVD	R9, r2+40(FP)
+	RET
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/asm_zos_s390x.s /work/src/docker-registry/vendor/golang.org/x/sys/unix/asm_zos_s390x.s
--- a/vendor/golang.org/x/sys/unix/asm_zos_s390x.s	2026-10-28 10:49:46.739003786 +0000
+++ b/vendor/golang.org/x/sys/unix/asm_zos_s390x.s	2026-10-28 10:50:37.874748513 +0000
@@ -30,21 +30,8 @@
 #define SVC_LOAD   BYTE $0x0A; BYTE $0x08 // SVC 08 LOAD
 #define SVC_DELETE BYTE $0x0A; BYTE $0x09 // SVC 09 DELETE
 
-DATA zosLibVec<>(SB)/8, $0
-GLOBL zosLibVec<>(SB), NOPTR, $8
-
-TEXT ·initZosLibVec(SB), NOSPLIT|NOFRAME, $0-0
-	MOVW PSALAA, R8
-	MOVD LCA64(R8), R8
-	MOVD CAA(R8), R8
-	MOVD EDCHPXV(R8), R8
-	MOVD R8, zosLibVec<>(SB)
-	RET
-
 TEXT ·GetZosLibVec(SB), NOSPLIT|NOFRAME, $0-0
-	MOVD zosLibVec<>(SB), R8
-	MOVD R8, ret+0(FP)
-	RET
+	JMP  runtime·GetZosLibVec(SB)
 
 TEXT ·clearErrno(SB), NOSPLIT, $0-0
 	BL   addrerrno<>(SB)
@@ -160,163 +147,13 @@
 // errno and errno2 is retrieved
 //
 TEXT ·CallLeFuncWithErr(SB), NOSPLIT, $0
-	MOVW PSALAA, R8
-	MOVD LCA64(R8), R8
-	MOVD CAA(R8), R9
-	MOVD g, GOCB(R9)
-
-	// Restore LE stack.
-	MOVD SAVSTACK_ASYNC(R8), R9 // R9-> LE stack frame saving address
-	MOVD 0(R9), R4              // R4-> restore previously saved stack frame pointer
-
-	MOVD parms_base+8(FP), R7 // R7 -> argument array
-	MOVD parms_len+16(FP), R8 // R8 number of arguments
-
-	//  arg 1 ---> R1
-	CMP  R8, $0
-	BEQ  docall
-	SUB  $1, R8
-	MOVD 0(R7), R1
-
-	//  arg 2 ---> R2
-	CMP  R8, $0
-	BEQ  docall
-	SUB  $1, R8
-	ADD  $8, R7
-	MOVD 0(R7), R2
-
-	//  arg 3 --> R3
-	CMP  R8, $0
-	BEQ  docall
-	SUB  $1, R8
-	ADD  $8, R7
-	MOVD 0(R7), R3
-
-	CMP  R8, $0
-	BEQ  docall
-	MOVD $2176+16, R6 // starting LE stack address-8 to store 4th argument
-
-repeat:
-	ADD  $8, R7
-	MOVD 0(R7), R0      // advance arg pointer by 8 byte
-	ADD  $8, R6         // advance LE argument address by 8 byte
-	MOVD R0, (R4)(R6*1) // copy argument from go-slice to le-frame
-	SUB  $1, R8
-	CMP  R8, $0
-	BNE  repeat
-
-docall:
-	MOVD funcdesc+0(FP), R8 // R8-> function descriptor
-	LMG  0(R8), R5, R6
-	MOVD $0, 0(R9)          // R9 address of SAVSTACK_ASYNC
-	LE_CALL                 // balr R7, R6 (return #1)
-	NOPH
-	MOVD R3, ret+32(FP)
-	CMP  R3, $-1            // compare result to -1
-	BNE  done
-
-	// retrieve errno and errno2
-	MOVD  zosLibVec<>(SB), R8
-	ADD   $(__errno), R8
-	LMG   0(R8), R5, R6
-	LE_CALL                   // balr R7, R6 __errno (return #3)
-	NOPH
-	MOVWZ 0(R3), R3
-	MOVD  R3, err+48(FP)
-	MOVD  zosLibVec<>(SB), R8
-	ADD   $(__err2ad), R8
-	LMG   0(R8), R5, R6
-	LE_CALL                   // balr R7, R6 __err2ad (return #2)
-	NOPH
-	MOVW  (R3), R2            // retrieve errno2
-	MOVD  R2, errno2+40(FP)   // store in return area
-
-done:
-	MOVD R4, 0(R9)            // Save stack pointer.
-	RET
-
+        JMP  runtime·CallLeFuncWithErr(SB)
 //
 // Call LE function, if the return is 0
 // errno and errno2 is retrieved
 //
 TEXT ·CallLeFuncWithPtrReturn(SB), NOSPLIT, $0
-	MOVW PSALAA, R8
-	MOVD LCA64(R8), R8
-	MOVD CAA(R8), R9
-	MOVD g, GOCB(R9)
-
-	// Restore LE stack.
-	MOVD SAVSTACK_ASYNC(R8), R9 // R9-> LE stack frame saving address
-	MOVD 0(R9), R4              // R4-> restore previously saved stack frame pointer
-
-	MOVD parms_base+8(FP), R7 // R7 -> argument array
-	MOVD parms_len+16(FP), R8 // R8 number of arguments
-
-	//  arg 1 ---> R1
-	CMP  R8, $0
-	BEQ  docall
-	SUB  $1, R8
-	MOVD 0(R7), R1
-
-	//  arg 2 ---> R2
-	CMP  R8, $0
-	BEQ  docall
-	SUB  $1, R8
-	ADD  $8, R7
-	MOVD 0(R7), R2
-
-	//  arg 3 --> R3
-	CMP  R8, $0
-	BEQ  docall
-	SUB  $1, R8
-	ADD  $8, R7
-	MOVD 0(R7), R3
-
-	CMP  R8, $0
-	BEQ  docall
-	MOVD $2176+16, R6 // starting LE stack address-8 to store 4th argument
-
-repeat:
-	ADD  $8, R7
-	MOVD 0(R7), R0      // advance arg pointer by 8 byte
-	ADD  $8, R6         // advance LE argument address by 8 byte
-	MOVD R0, (R4)(R6*1) // copy argument from go-slice to le-frame
-	SUB  $1, R8
-	CMP  R8, $0
-	BNE  repeat
-
-docall:
-	MOVD funcdesc+0(FP), R8 // R8-> function descriptor
-	LMG  0(R8), R5, R6
-	MOVD $0, 0(R9)          // R9 address of SAVSTACK_ASYNC
-	LE_CALL                 // balr R7, R6 (return #1)
-	NOPH
-	MOVD R3, ret+32(FP)
-	CMP  R3, $0             // compare result to 0
-	BNE  done
-
-	// retrieve errno and errno2
-	MOVD  zosLibVec<>(SB), R8
-	ADD   $(__errno), R8
-	LMG   0(R8), R5, R6
-	LE_CALL                   // balr R7, R6 __errno (return #3)
-	NOPH
-	MOVWZ 0(R3), R3
-	MOVD  R3, err+48(FP)
-	MOVD  zosLibVec<>(SB), R8
-	ADD   $(__err2ad), R8
-	LMG   0(R8), R5, R6
-	LE_CALL                   // balr R7, R6 __err2ad (return #2)
-	NOPH
-	MOVW  (R3), R2            // retrieve errno2
-	MOVD  R2, errno2+40(FP)   // store in return area
-	XOR   R2, R2
-	MOVWZ R2, (R3)            // clear errno2
-
-done:
-	MOVD R4, 0(R9)            // Save stack pointer.
-	RET
-
+        JMP runtime·CallLeFuncWithPtrReturn(SB)
 //
 // function to test if a pointer can be safely dereferenced (content read)
 // return 0 for succces
@@ -360,23 +197,4 @@
 //
 // func safeload(ptr uintptr) ( value uintptr, error uintptr)
 TEXT ·safeload(SB), NOSPLIT, $0-24
-	MOVD ptr+0(FP), R10                                                    // test pointer in R10
-	MOVD $0x0, R6
-	BYTE $0xE3; BYTE $0x20; BYTE $0x04; BYTE $0xB8; BYTE $0x00; BYTE $0x17 // llgt  2,1208
-	BYTE $0xB9; BYTE $0x17; BYTE $0x00; BYTE $0x22                         // llgtr 2,2
-	BYTE $0xA5; BYTE $0x26; BYTE $0x7F; BYTE $0xFF                         // nilh  2,32767
-	BYTE $0xE3; BYTE $0x22; BYTE $0x00; BYTE $0x58; BYTE $0x00; BYTE $0x04 // lg    2,88(2)
-	BYTE $0xE3; BYTE $0x22; BYTE $0x00; BYTE $0x08; BYTE $0x00; BYTE $0x04 // lg    2,8(2)
-	BYTE $0x41; BYTE $0x22; BYTE $0x03; BYTE $0x68                         // la    2,872(2)
-	BYTE $0xB9; BYTE $0x82; BYTE $0x00; BYTE $0x33                         // xgr   3,3
-	BYTE $0xA7; BYTE $0x55; BYTE $0x00; BYTE $0x04                         // bras  5,lbl1
-	BYTE $0xA7; BYTE $0x39; BYTE $0x00; BYTE $0x01                         // lghi  3,1
-	BYTE $0xB9; BYTE $0x02; BYTE $0x00; BYTE $0x33                         // lbl1     ltgr  3,3
-	BYTE $0xA7; BYTE $0x74; BYTE $0x00; BYTE $0x08                         // brc   b'0111',lbl2
-	BYTE $0xE3; BYTE $0x52; BYTE $0x00; BYTE $0x00; BYTE $0x00; BYTE $0x24 // stg 5,0(2)
-	BYTE $0xE3; BYTE $0x6A; BYTE $0x00; BYTE $0x00; BYTE $0x00; BYTE $0x04 // lg    6,0(10)
-	BYTE $0xB9; BYTE $0x82; BYTE $0x00; BYTE $0x99                         // lbl2     xgr   9,9
-	BYTE $0xE3; BYTE $0x92; BYTE $0x00; BYTE $0x00; BYTE $0x00; BYTE $0x24 // stg   9,0(2)
-	MOVD R6, value+8(FP)                                                   // result in R6
-	MOVD R3, error+16(FP)                                                  // error in R3
-	RET
+        JMP  runtime·ZosSafeLoad(SB)
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/bpxsvc_zos.s /work/src/docker-registry/vendor/golang.org/x/sys/unix/bpxsvc_zos.s
--- a/vendor/golang.org/x/sys/unix/bpxsvc_zos.s	2026-10-28 10:49:46.739003786 +0000
+++ b/vendor/golang.org/x/sys/unix/bpxsvc_zos.s	2026-10-28 10:50:37.874748513 +0000
@@ -20,15 +20,15 @@
 	MOVD  plist_base+0(FP), R1  // r1 points to plist
 	MOVD  bpx_offset+24(FP), R2 // r2 offset to BPX vector table
 	MOVD  R14, R7               // save r14
-	MOVD  R15, R8               // save r15
-	MOVWZ 16(R0), R9
-	MOVWZ 544(R9), R9
-	MOVWZ 24(R9), R9            // call vector in r9
-	ADD   R2, R9                // add offset to vector table
-	MOVWZ (R9), R9              // r9 points to entry point
-	BYTE  $0x0D                 // BL R14,R9 --> basr r14,r9
-	BYTE  $0xE9                 // clobbers 0,1,14,15
-	MOVD  R8, R15               // restore 15
+	MOVD  R15, R9               // save r15
+	MOVWZ 16(R0), R15
+	MOVWZ 544(R15), R15
+	MOVWZ 24(R15), R15          // call vector in r15
+	ADD   R2, R15               // add offset to vector table
+	MOVWZ (R15), R15            // r15 points to entry point
+	BYTE  $0x0D                 // BL R14,R15 --> basr r14,r15
+	BYTE  $0xEF                 // clobbers 0,1,14,15
+	MOVD  R9, R15               // restore 15
 	JMP   R7                    // return via saved return address
 
 //   func A2e(arr [] byte)
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/fcntl_darwin.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/fcntl_darwin.go
--- a/vendor/golang.org/x/sys/unix/fcntl_darwin.go	2026-10-28 10:49:46.739003786 +0000
+++ b/vendor/golang.org/x/sys/unix/fcntl_darwin.go	2026-10-28 10:50:37.874748513 +0000
@@ -13,12 +13,12 @@
 
 // FcntlFlock performs a fcntl syscall for the F_GETLK, F_SETLK or F_SETLKW command.
 func FcntlFlock(fd uintptr, cmd int, lk *Flock_t) error {
-	_, err := fcntl(int(fd), cmd, int(uintptr(unsafe.Pointer(lk))))
+	_, err := fcntlPtr(int(fd), cmd, unsafe.Pointer(lk))
 	return err
 }
 
 // FcntlFstore performs a fcntl syscall for the F_PREALLOCATE command.
 func FcntlFstore(fd uintptr, cmd int, fstore *Fstore_t) error {
-	_, err := fcntl(int(fd), cmd, int(uintptr(unsafe.Pointer(fstore))))
+	_, err := fcntlPtr(int(fd), cmd, unsafe.Pointer(fstore))
 	return err
 }
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/mkerrors.sh /work/src/docker-registry/vendor/golang.org/x/sys/unix/mkerrors.sh
--- a/vendor/golang.org/x/sys/unix/mkerrors.sh	2026-10-28 10:49:46.739003786 +0000
+++ b/vendor/golang.org/x/sys/unix/mkerrors.sh	2026-10-28 10:50:37.874748513 +0000
@@ -579,7 +579,7 @@
 		$2 ~ /^DIOC/ ||
 		$2 ~ /^RUSAGE_(SELF|CHILDREN|THREAD)/ ||
 		$2 ~ /^RLIMIT_(AS|CORE|CPU|DATA|FSIZE|LOCKS|MEMLOCK|MSGQUEUE|NICE|NOFILE|NPROC|RSS|RTPRIO|RTTIME|SIGPENDING|STACK)|RLIM_INFINITY/ ||
-		$2 ~ /^PRIO_(PROCESS|PGRP|USER)/ ||
+		$2 ~ /^PRIO_(PROCESS|PGRP|USER|DARWIN_(THREAD|PROCESS|BG|NONUI))/ ||
 		$2 ~ /^CLONE_[A-Z_]+/ ||
 		$2 !~ /^(BPF_TIMEVAL|BPF_FIB_LOOKUP_[A-Z]+|BPF_F_LINK)$/ &&
 		$2 ~ /^(BPF|DLT)_/ ||
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/ptrace_zos.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/ptrace_zos.go
--- a/vendor/golang.org/x/sys/unix/ptrace_zos.go	1970-01-01 00:00:00.000000000 +0000
+++ b/vendor/golang.org/x/sys/unix/ptrace_zos.go	2026-10-28 10:50:37.878748493 +0000
@@ -0,0 +1,537 @@
+// Copyright 2026 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build zos
+
+package unix
+
+import "unsafe"
+
+// z/OS ptrace implementation notes:
+//
+// This file provides ptrace wrappers for z/OS that match the Linux API as closely
+// as possible. However, there are fundamental differences in how z/OS implements
+// process tracing compared to Linux:
+//
+// 1. SYSTEM CALL INTERFACE:
+//    - z/OS uses BPX4PTR (5 parameters) vs Linux ptrace syscall (4 parameters)
+//    - The 5th parameter (buffer) is used for block operations
+//
+// 2. MEMORY OPERATIONS:
+//    - z/OS: PT_READ_BLOCK/PT_WRITE_BLOCK for efficient block transfers
+//    - Linux: PTRACE_PEEKTEXT/POKETEXT for word-by-word access
+//
+// 3. REGISTER OPERATIONS:
+//    - z/OS: PT_READ_GPR/PT_WRITE_GPR with register number for 64-bit values
+//    - Linux: PTRACE_GETREGSET/SETREGSET with iovec structure
+//
+// 4. SINGLE-STEPPING:
+//    - z/OS: No native single-step; requires temporary breakpoints or PER
+//    - Linux: PTRACE_SINGLESTEP natively supported
+//      a) Read instruction at current PSW
+//      b) Calculate next instruction address (handle branches)
+//      c) Set temporary breakpoint (SVC 144 = 0x0A90) at next address
+//      d) Continue execution until breakpoint hit
+//      e) Restore original instruction and adjust PSW
+//
+// 5. SYSCALL TRACING:
+//    - z/OS: No PTRACE_SYSCALL equivalent; requires breakpoint-based approach
+//    - Linux: PTRACE_SYSCALL stops at syscall entry/exit
+//      a) Identify BPX syscall vector location
+//      b) Set breakpoints at syscall entry points
+//      c) Detect BASR instructions calling into syscall vector
+//      d) Parse arguments from registers before/after syscall
+//
+// 6. LIMITATIONS:
+//    - PtraceSetOptions: No equivalent (returns ENOSYS)
+//    - PtraceGetEventMsg: No equivalent (returns ENOSYS)
+//    - PtraceSingleStep: Requires complex implementation (returns ENOSYS)
+//    - PtraceInterrupt: No equivalent (returns ENOSYS)
+//    - PtracePokeUser: No PT_WRITE_U (returns ENOSYS)
+//
+// For reference implementations of single-stepping and syscall tracing on z/OS,
+
+// ptrace is the basic wrapper for BPX4PTR on z/OS.
+// Note: z/OS ptrace (BPX4PTR) takes 5 parameters vs 4 on Linux/Darwin.
+// The 5th parameter (buffer) is used for operations like PT_READ_BLOCK/PT_WRITE_BLOCK.
+//
+// data is an integer-valued argument (signal number, register index, byte count,
+// or a target-process address). It is not a Go-managed pointer. We must not pass
+// it to Bpx4ptr as unsafe.Pointer(data) because the garbage collector would treat
+// that integer as a pointer and may crash trying to follow it.
+//
+// Instead we inline the parms array that Bpx4ptr would construct, placing &data
+// at parms[3]. BPX4PTR dereferences parms[3] to obtain the data value, so it
+// receives data unchanged while the GC only ever sees a valid stack pointer.
+func ptrace(request int, pid int, addr uintptr, data uintptr) (err error) {
+	req32 := int32(request)
+	pid32 := int32(pid)
+	var rv, rc, rn int32
+	var buffer unsafe.Pointer
+	parms := [8]unsafe.Pointer{
+		unsafe.Pointer(&req32),
+		unsafe.Pointer(&pid32),
+		unsafe.Pointer(&addr),
+		unsafe.Pointer(&data), // &data, not unsafe.Pointer(data)
+		unsafe.Pointer(&buffer),
+		unsafe.Pointer(&rv),
+		unsafe.Pointer(&rc),
+		unsafe.Pointer(&rn),
+	}
+	bpxcall(parms[:], BPX4PTR)
+	if rv != 0 {
+		err = errnoErr2(Errno(rc), uintptr(rn))
+	}
+	return
+}
+
+// ptracePtr is a variant that accepts unsafe.Pointer for the data parameter.
+// addr is a target-process address (a raw integer), not a Go-managed pointer.
+// We must not pass it to Bpx4ptr as unsafe.Pointer(addr); instead we inline the
+// parms array and place &addr at parms[2], exactly as ptrace() does for data.
+func ptracePtr(request int, pid int, addr uintptr, data unsafe.Pointer) (err error) {
+	req32 := int32(request)
+	pid32 := int32(pid)
+	var rv, rc, rn int32
+	var buffer unsafe.Pointer
+	parms := [8]unsafe.Pointer{
+		unsafe.Pointer(&req32),
+		unsafe.Pointer(&pid32),
+		unsafe.Pointer(&addr), // &addr, not unsafe.Pointer(addr)
+		unsafe.Pointer(&data),
+		unsafe.Pointer(&buffer),
+		unsafe.Pointer(&rv),
+		unsafe.Pointer(&rc),
+		unsafe.Pointer(&rn),
+	}
+	bpxcall(parms[:], BPX4PTR)
+	if rv != 0 {
+		err = errnoErr2(Errno(rc), uintptr(rn))
+	}
+	return
+}
+
+// ptracePtrWithBuffer is used for operations that require the buffer parameter.
+// addr is a target-process address; same &addr treatment as ptracePtr.
+func ptracePtrWithBuffer(request int, pid int, addr uintptr, data unsafe.Pointer, buffer unsafe.Pointer) (err error) {
+	req32 := int32(request)
+	pid32 := int32(pid)
+	var rv, rc, rn int32
+	parms := [8]unsafe.Pointer{
+		unsafe.Pointer(&req32),
+		unsafe.Pointer(&pid32),
+		unsafe.Pointer(&addr), // &addr, not unsafe.Pointer(addr)
+		unsafe.Pointer(&data),
+		unsafe.Pointer(&buffer),
+		unsafe.Pointer(&rv),
+		unsafe.Pointer(&rc),
+		unsafe.Pointer(&rn),
+	}
+	bpxcall(parms[:], BPX4PTR)
+	if rv != 0 {
+		err = errnoErr2(Errno(rc), uintptr(rn))
+	}
+	return
+}
+
+// High-level convenience functions matching the Linux/Darwin API
+
+func PtraceAttach(pid int) (err error) {
+	return ptrace(PT_ATTACH, pid, 0, 0)
+}
+
+func PtraceDetach(pid int) (err error) {
+	return ptrace(PT_DETACH, pid, 0, 0)
+}
+
+func PtraceCont(pid int, signal int) (err error) {
+	// PT_CONTINUE can be interrupted by signals (EINTR), retry if needed
+	for {
+		err = ptrace(PT_CONTINUE, pid, 0, uintptr(signal))
+		if err != EINTR {
+			break
+		}
+	}
+	return err
+}
+
+func PtraceKill(pid int) (err error) {
+	return ptrace(PT_KILL, pid, 0, 0)
+}
+
+// ptracePeek implements the peek operations using PT_READ_BLOCK.
+// On z/OS, PT_READ_BLOCK can read arbitrary-length data efficiently.
+// Unlike Linux which reads word-by-word, z/OS can read blocks directly.
+func ptracePeek(req int, pid int, addr uintptr, out []byte) (count int, err error) {
+	if len(out) == 0 {
+		return 0, nil
+	}
+
+	// z/OS PT_READ_BLOCK can read blocks directly without word-by-word alignment
+	// The buffer parameter points to the output buffer
+	buffer := unsafe.Pointer(&out[0])
+	err = ptracePtrWithBuffer(req, pid, addr, unsafe.Pointer(uintptr(len(out))), buffer)
+	if err != nil {
+		return 0, err
+	}
+	return len(out), nil
+}
+
+// PtracePeekText reads from the traced process's text segment.
+func PtracePeekText(pid int, addr uintptr, out []byte) (count int, err error) {
+	return ptracePeek(PT_READ_BLOCK, pid, addr, out)
+}
+
+// PtracePeekData reads from the traced process's data segment.
+func PtracePeekData(pid int, addr uintptr, out []byte) (count int, err error) {
+	return ptracePeek(PT_READ_BLOCK, pid, addr, out)
+}
+
+// PtracePeekUser reads from the traced process's user area.
+// On z/OS, PT_READ_U reads a 32-bit word from the user area at the specified offset.
+// To match Linux behavior, we implement word-by-word reading for arbitrary lengths.
+func PtracePeekUser(pid int, addr uintptr, out []byte) (count int, err error) {
+	if len(out) == 0 {
+		return 0, nil
+	}
+
+	// PT_READ_U reads 32-bit words from user area
+	// We need to read word-by-word to handle arbitrary lengths
+	n := 0
+	for n < len(out) {
+		var data uint32
+		err = ptracePtr(PT_READ_U, pid, addr+uintptr(n), unsafe.Pointer(&data))
+		if err != nil {
+			return n, err
+		}
+
+		// Copy up to 4 bytes to output
+		remaining := len(out) - n
+		if remaining >= 4 {
+			out[n] = byte(data >> 24)
+			out[n+1] = byte(data >> 16)
+			out[n+2] = byte(data >> 8)
+			out[n+3] = byte(data)
+			n += 4
+		} else {
+			// Handle partial word at the end
+			for i := 0; i < remaining; i++ {
+				out[n+i] = byte(data >> (24 - i*8))
+			}
+			n += remaining
+		}
+	}
+	return n, nil
+}
+
+// ptracePoke implements the poke operations using PT_WRITE_BLOCK.
+func ptracePoke(pokeReq int, peekReq int, pid int, addr uintptr, data []byte) (count int, err error) {
+	if len(data) == 0 {
+		return 0, nil
+	}
+
+	// z/OS PT_WRITE_BLOCK can write blocks directly
+	buffer := unsafe.Pointer(&data[0])
+	err = ptracePtrWithBuffer(pokeReq, pid, addr, unsafe.Pointer(uintptr(len(data))), buffer)
+	if err != nil {
+		return 0, err
+	}
+	return len(data), nil
+}
+
+// PtracePokeText writes to the traced process's text segment.
+func PtracePokeText(pid int, addr uintptr, data []byte) (count int, err error) {
+	return ptracePoke(PT_WRITE_BLOCK, PT_READ_BLOCK, pid, addr, data)
+}
+
+// PtracePokeData writes to the traced process's data segment.
+func PtracePokeData(pid int, addr uintptr, data []byte) (count int, err error) {
+	return ptracePoke(PT_WRITE_BLOCK, PT_READ_BLOCK, pid, addr, data)
+}
+
+// PtracePokeUser writes to the traced process's user area.
+// Note: z/OS does not have a direct PT_WRITE_U equivalent.
+// This function returns ENOSYS to indicate it's not supported.
+// DIFFERENCE FROM LINUX: Linux supports PTRACE_POKEUSR, z/OS does not.
+func PtracePokeUser(pid int, addr uintptr, data []byte) (count int, err error) {
+	// z/OS doesn't have PT_WRITE_U
+	return 0, ENOSYS
+}
+
+// PtraceGetRegs retrieves the general purpose registers from the traced process.
+// On z/OS, PT_READ_GPR can read individual registers as 64-bit values when called
+// with a register number, or read all registers when called with a buffer.
+// This function reads each register individually to ensure full 64-bit values.
+// DIFFERENCE FROM LINUX: Linux uses PTRACE_GETREGSET with iovec, z/OS uses PT_READ_GPR.
+func PtraceGetRegs(pid int, regsout *PtraceRegs) (err error) {
+	// Use PT_REGHSET to enable reading high GPRs for AMODE 64 programs
+	rv, rc, rn := Bpx4ptr(int32(PT_REGHSET), int32(pid), nil, nil, nil)
+	_ = rv
+	_ = rc
+	_ = rn
+
+	// Use PT_BLOCKREQ to read GPRs and PSW in one call
+	// dbx uses 3 requests: PT_READ_GPR, PT_READ_U, PT_READ_GPRH
+	// PT_READ_U is required for ptrace to populate PSW in GPR block
+	//
+	// IMPORTANT: z/OS ptrace always returns 64-bit ESA/390 format PSW in the Psw field.
+	// The 128-bit Pswg field is never populated, even with PSWG_Req bit set.
+	// We convert ESA/390 to z/Architecture format in software (matching DBX behavior).
+	const (
+		numRequests = 3
+		reqSize     = int(unsafe.Sizeof(PtraceBlkReqReq{}))
+		gprSize     = int(unsafe.Sizeof(PtraceBlkGpr{}))
+		uareaSize   = int(unsafe.Sizeof(PtraceBlkUar{})) + 6*int(unsafe.Sizeof(PtraceBlkUarOcw{}))
+		totalSize   = int(unsafe.Sizeof(PtraceBlkReq{})) + numRequests*reqSize + gprSize*2 + uareaSize
+	)
+
+	// Allocate buffer for block request
+	buf := make([]byte, totalSize)
+
+	// Setup block request header
+	blkReq := (*PtraceBlkReq)(unsafe.Pointer(&buf[0]))
+	blkReq.Numreq = numRequests
+
+	// Setup request array
+	reqOffset := int(unsafe.Sizeof(PtraceBlkReq{}))
+	reqs := (*[3]PtraceBlkReqReq)(unsafe.Pointer(&buf[reqOffset]))
+
+	// Setup GPR block (lower 32 bits)
+	gprOffset := reqOffset + numRequests*reqSize
+	gprBlock := (*PtraceBlkGpr)(unsafe.Pointer(&buf[gprOffset]))
+
+	// Setup user area block (required for PSW)
+	uareaOffset := gprOffset + gprSize
+	uareaBlock := (*PtraceBlkUar)(unsafe.Pointer(&buf[uareaOffset]))
+	uareaBlock.Num = 6 // Number of control info entries
+
+	// Setup user area offset/control words
+	uareaOcw := (*[6]PtraceBlkUarOcw)(unsafe.Pointer(&buf[uareaOffset+int(unsafe.Sizeof(PtraceBlkUar{}))]))
+	uareaOcw[0].Ofs = 1025 // program interrupt code
+	uareaOcw[1].Ofs = 1026 // abend completion code
+	uareaOcw[2].Ofs = 1027 // abend reason code
+	uareaOcw[3].Ofs = 1028 // signal code
+	uareaOcw[4].Ofs = 1029 // instruction length code
+	uareaOcw[5].Ofs = 1030 // process flags
+
+	// Setup high GPR block (upper 32 bits)
+	gprHighOffset := uareaOffset + uareaSize
+	gprHighBlock := (*PtraceBlkGpr)(unsafe.Pointer(&buf[gprHighOffset]))
+
+	// Configure requests (order matters: GPR, U, GPRH)
+	// reqdata contains OFFSET from buffer start, not absolute address
+	// dbx: brr[0].reqdata=(unsigned long)brg; where brg is the offset
+	reqs[0].Reqtype = PT_READ_GPR
+	reqs[0].Reqdata = uint32(gprOffset)
+	reqs[1].Reqtype = PT_READ_U
+	reqs[1].Reqdata = uint32(uareaOffset)
+	reqs[2].Reqtype = PT_READ_GPRH
+	reqs[2].Reqdata = uint32(gprHighOffset)
+
+	// Execute block request
+	rvBlk, rcBlk, rnBlk := Bpx4ptr(int32(PT_BLOCKREQ), int32(pid),
+		unsafe.Pointer(&buf[0]), unsafe.Pointer(uintptr(totalSize)), nil)
+	if rvBlk == -1 {
+		return errnoErr2(Errno(rcBlk), uintptr(rnBlk))
+	}
+
+	// Extract GPRs (combine low and high 32 bits)
+	for i := 0; i < 16; i++ {
+		low := uint64(gprBlock.Gpr[i])
+		high := uint64(gprHighBlock.Gpr[i]) << 32
+		regsout.Gprs[i] = high | low
+	}
+
+	// Extract PSW from GPR block structure
+	// z/OS ptrace ALWAYS returns 8-byte ESA/390 format PSW at offset 144.
+	// The 16-byte PSWG field at offset 152 is NEVER populated (always zero).
+	// We must convert ESA/390 format to z/Architecture format in software (like DBX does).
+	//
+	// ESA/390 PSW format (8 bytes):
+	//   Word 1 (bytes 0-3): Mask with bit 12 = 1 (ECMODE31BIT)
+	//   Word 2 (bytes 4-7): Address with bit 0 = AMODE bit (1=31-bit, 0=64-bit)
+	//
+	// z/Architecture PSW format (16 bytes):
+	//   Mask (bytes 0-7): Extended mask with bit 12 = 0, bits 31-32 = EA+BA (AMODE)
+	//   Addr (bytes 8-15): Full 64-bit instruction address
+
+	// Read ESA/390 PSW as two 32-bit words
+	pswWord1 := uint32(gprBlock.Psw[0])<<24 | uint32(gprBlock.Psw[1])<<16 |
+		uint32(gprBlock.Psw[2])<<8 | uint32(gprBlock.Psw[3])
+	pswWord2 := uint32(gprBlock.Psw[4])<<24 | uint32(gprBlock.Psw[5])<<16 |
+		uint32(gprBlock.Psw[6])<<8 | uint32(gprBlock.Psw[7])
+
+	// Convert ESA/390 to z/Architecture format (matching DBX psw_ESA390_to_zArchitecture)
+	const ECMODE31BIT = uint64(0x0000000000080000)
+	const AMODE31BIT = uint64(0x0000000080000000)
+	const ADDR_MASK_31 = uint64(0x000000007FFFFFFF)
+
+	// Extract AMODE bit from address word (bit 0 of word 2)
+	amode31 := uint64(pswWord2) & AMODE31BIT
+
+	// Mask off AMODE bit from address
+	addr := uint64(pswWord2) & ADDR_MASK_31
+
+	// Convert mask: clear ECMODE31BIT, shift left 32 bits, add AMODE bit
+	mask := uint64(pswWord1) & ^ECMODE31BIT
+	mask = (mask << 32) | amode31
+
+	regsout.Psw.Mask = mask
+	regsout.Psw.Addr = addr
+
+	// Note: Access registers (Acrs), floating point registers (Fp_regs),
+	// PER info (Per_info), and other fields would require additional
+	// PT_READ_* calls. For now, we focus on GPRs and PSW which are
+	// the most commonly used registers for debugging.
+
+	return nil
+}
+
+// ptraceWritePSW writes only the PSW address register.
+// This is a lower-level function used internally for single-stepping.
+// Based on ztrace's write_psw function.
+func ptraceWritePSW(pid int, pswAddr uint32) error {
+	const PTRACE_REG_PSWA = 41
+	rv, rc, rn := Bpx4ptr(int32(PT_WRITE_GPR), int32(pid),
+		unsafe.Pointer(uintptr(PTRACE_REG_PSWA)),
+		unsafe.Pointer(uintptr(pswAddr)),
+		nil)
+	if rv == -1 {
+		return errnoErr2(Errno(rc), uintptr(rn))
+	}
+	return nil
+}
+
+// PtraceSetRegs sets the general purpose registers in the traced process.
+// Uses PT_BLOCKREQ to write GPRs and PSW in a single call, matching dbx implementation.
+// DIFFERENCE FROM LINUX: Linux uses PTRACE_SETREGSET with iovec, z/OS uses PT_BLOCKREQ.
+// NOTE: The process must be in a stopped state for register writes to succeed.
+func PtraceSetRegs(pid int, regs *PtraceRegs) (err error) {
+	// Use PT_REGHSET to enable writing high GPRs for AMODE 64 programs
+	rv, rc, rn := Bpx4ptr(int32(PT_REGHSET), int32(pid), nil, nil, nil)
+	_ = rv
+	_ = rc
+	_ = rn
+
+	// Use PT_BLOCKREQ to write GPRs and PSW in one call
+	const (
+		numRequests = 2
+		reqSize     = int(unsafe.Sizeof(PtraceBlkReqReq{}))
+		gprSize     = int(unsafe.Sizeof(PtraceBlkGpr{}))
+		totalSize   = int(unsafe.Sizeof(PtraceBlkReq{})) + numRequests*reqSize + gprSize*2
+	)
+
+	// Allocate buffer for block request
+	buf := make([]byte, totalSize)
+
+	// Setup block request header
+	blkReq := (*PtraceBlkReq)(unsafe.Pointer(&buf[0]))
+	blkReq.Numreq = numRequests
+
+	// Setup request array
+	reqOffset := int(unsafe.Sizeof(PtraceBlkReq{}))
+	reqs := (*[2]PtraceBlkReqReq)(unsafe.Pointer(&buf[reqOffset]))
+
+	// Setup GPR block (lower 32 bits)
+	gprOffset := reqOffset + numRequests*reqSize
+	gprBlock := (*PtraceBlkGpr)(unsafe.Pointer(&buf[gprOffset]))
+
+	// Setup high GPR block (upper 32 bits)
+	gprHighOffset := gprOffset + gprSize
+	gprHighBlock := (*PtraceBlkGpr)(unsafe.Pointer(&buf[gprHighOffset]))
+
+	// Mark all GPRs as modified (set all 16 bits)
+	gprBlock.Writebitflags = 0xFFFF
+	gprHighBlock.Writebitflags = 0xFFFF
+
+	// Split 64-bit GPRs into low and high 32 bits
+	for i := 0; i < 16; i++ {
+		gprBlock.Gpr[i] = uint32(regs.Gprs[i] & 0xFFFFFFFF)
+		gprHighBlock.Gpr[i] = uint32(regs.Gprs[i] >> 32)
+	}
+
+	// Pack PSW for 31-bit targets (current z/OS)
+	// Upper 32 bits = mask, lower 32 bits = address
+	gprBlock.Wpsw = 1 // Mark PSW as modified
+	// Write PSW in old format (8 bytes at offset 144)
+	// Word 1 (mask) at bytes 0-3, Word 2 (addr) at bytes 4-7
+	pswMask := uint32(regs.Psw.Mask)
+	pswAddr := uint32(regs.Psw.Addr)
+	gprBlock.Psw[0] = byte(pswMask >> 24)
+	gprBlock.Psw[1] = byte(pswMask >> 16)
+	gprBlock.Psw[2] = byte(pswMask >> 8)
+	gprBlock.Psw[3] = byte(pswMask)
+	gprBlock.Psw[4] = byte(pswAddr >> 24)
+	gprBlock.Psw[5] = byte(pswAddr >> 16)
+	gprBlock.Psw[6] = byte(pswAddr >> 8)
+	gprBlock.Psw[7] = byte(pswAddr)
+
+	// Clear extended PSWG (not used for 31-bit targets)
+	for i := 0; i < 16; i++ {
+		gprBlock.Pswg[i] = 0
+	}
+
+	// Configure requests
+	// reqdata contains OFFSET from buffer start, not absolute address
+	reqs[0].Reqtype = PT_WRITE_GPR
+	reqs[0].Reqdata = uint32(gprOffset)
+	reqs[1].Reqtype = PT_WRITE_GPRH
+	reqs[1].Reqdata = uint32(gprHighOffset)
+
+	// Execute block request
+	rvBlk, rcBlk, rnBlk := Bpx4ptr(int32(PT_BLOCKREQ), int32(pid),
+		unsafe.Pointer(&buf[0]), unsafe.Pointer(uintptr(totalSize)), nil)
+	if rvBlk == -1 {
+		return errnoErr2(Errno(rcBlk), uintptr(rnBlk))
+	}
+
+	return nil
+}
+
+// PtraceSetOptions sets ptrace options.
+// DIFFERENCE FROM LINUX: z/OS doesn't have PTRACE_SETOPTIONS equivalent.
+// Returns ENOSYS to indicate this is not supported on z/OS.
+func PtraceSetOptions(pid int, options int) (err error) {
+	return ENOSYS
+}
+
+// PtraceGetEventMsg retrieves a message about the ptrace event.
+// DIFFERENCE FROM LINUX: z/OS doesn't have PTRACE_GETEVENTMSG equivalent.
+// Returns ENOSYS to indicate this is not supported on z/OS.
+func PtraceGetEventMsg(pid int) (msg uint, err error) {
+	return 0, ENOSYS
+}
+
+// PtraceSyscall continues execution and stops at the next syscall entry/exit.
+// DIFFERENCE FROM LINUX: z/OS doesn't have PTRACE_SYSCALL equivalent.
+// This function falls back to PT_CONTINUE and will NOT stop at syscalls.
+//
+// To trace syscalls on z/OS, applications must:
+// 1. Set breakpoints at BPX syscall entry points (requires knowledge of syscall vector)
+// 2. Detect BASR instructions that call into the BPX syscall vector
+// 3. Use PT_LDINFO to identify loaded modules and their entry points
+func PtraceSyscall(pid int, signal int) (err error) {
+	// z/OS doesn't have a direct PTRACE_SYSCALL equivalent
+	// Use PT_CONTINUE as a fallback (won't stop at syscalls)
+	return ptrace(PT_CONTINUE, pid, 0, uintptr(signal))
+}
+
+// Note: PtraceSingleStep is implemented in ptrace_zos_singlestep.go
+// with full two-breakpoint emulation for branch instructions.
+
+// PtraceInterrupt interrupts the traced process.
+// DIFFERENCE FROM LINUX: z/OS doesn't have PTRACE_INTERRUPT equivalent.
+// Returns ENOSYS to indicate this is not supported on z/OS.
+func PtraceInterrupt(pid int) (err error) {
+	return ENOSYS
+}
+
+// PtraceSeize attaches to a process without stopping it.
+// DIFFERENCE FROM LINUX: z/OS doesn't have PTRACE_SEIZE equivalent.
+// Uses PT_ATTACH as a fallback, which will stop the process.
+func PtraceSeize(pid int) (err error) {
+	// z/OS doesn't have PTRACE_SEIZE, use PT_ATTACH
+	// Note: This WILL stop the process, unlike Linux PTRACE_SEIZE
+	return ptrace(PT_ATTACH, pid, 0, 0)
+}
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/ptrace_zos_singlestep.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/ptrace_zos_singlestep.go
--- a/vendor/golang.org/x/sys/unix/ptrace_zos_singlestep.go	1970-01-01 00:00:00.000000000 +0000
+++ b/vendor/golang.org/x/sys/unix/ptrace_zos_singlestep.go	2026-10-28 10:50:37.878748493 +0000
@@ -0,0 +1,425 @@
+// Copyright 2024 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build zos
+
+package unix
+
+import (
+	"sync"
+)
+
+// Single-stepping emulation for z/OS
+//
+// z/OS does not have native single-step support like Linux's PTRACE_SINGLESTEP.
+// Instead, single-stepping must be emulated using temporary breakpoints.
+//
+// This file provides a complete implementation of single-step emulation using
+// temporary breakpoints at both the sequential next instruction and branch target.
+
+const (
+	// NO_BRANCH_DEST indicates the instruction is not a branch or cannot branch
+	NO_BRANCH_DEST = 0xFFFFFFFF
+
+	// SVC_144 is the breakpoint instruction (SVC 144 = 0x0A90)
+	SVC_144 = 0x0A90
+
+	// Maximum number of temporary breakpoints (one for next PC, one for branch dest)
+	MAX_TEMP_BREAKPOINTS = 2
+
+	// S/390 branch instruction opcodes
+	// RR format (Register-Register)
+	opBCR   = 0x07 // Branch on Condition Register
+	opBALR  = 0x05 // Branch and Link Register
+	opBASR  = 0x0D // Branch and Save Register
+	opBASSM = 0x0C // Branch and Save and Set Mode
+	opBSM   = 0x0B // Branch and Set Mode
+	opBCTR  = 0x06 // Branch on Count Register
+
+	// RX format (Register-Index-Storage)
+	opBC  = 0x47 // Branch on Condition
+	opBAL = 0x45 // Branch and Link
+	opBCT = 0x46 // Branch on Count
+	opBAS = 0x4D // Branch and Save
+
+	// RS format (Register-Storage)
+	opBXH  = 0x86 // Branch on Index High
+	opBXLE = 0x87 // Branch on Index Low or Equal
+
+	// Extended branch opcodes
+	opBA7 = 0xA7 // A7x series (BRC, BRAS, BRCT, BRCTG)
+	opBC0 = 0xC0 // C0x series (BRASL, BRCL)
+	opBEC = 0xEC // ECxx series (RIEc format: compare-and-branch)
+)
+
+// tempBreakpoint represents a temporary breakpoint for single-stepping
+type tempBreakpoint struct {
+	address      uint64
+	originalInsn [8]byte // Save up to 8 bytes (full instruction)
+	active       bool
+}
+
+// singleStepState manages temporary breakpoints for a process
+type singleStepState struct {
+	mu          sync.Mutex
+	breakpoints [MAX_TEMP_BREAKPOINTS]tempBreakpoint
+}
+
+var (
+	// Global map of process states (pid -> state)
+	processStates   = make(map[int]*singleStepState)
+	processStatesMu sync.Mutex
+)
+
+// getProcessState returns or creates the single-step state for a process
+func getProcessState(pid int) *singleStepState {
+	processStatesMu.Lock()
+	defer processStatesMu.Unlock()
+
+	state, exists := processStates[pid]
+	if !exists {
+		state = &singleStepState{}
+		processStates[pid] = state
+	}
+	return state
+}
+
+// cleanupProcessState removes the state for a process (call on detach)
+func cleanupProcessState(pid int) {
+	processStatesMu.Lock()
+	defer processStatesMu.Unlock()
+	delete(processStates, pid)
+}
+
+// GetInstructionLength returns the length of an S/390 instruction in bytes.
+func GetInstructionLength(firstByte byte) int {
+	switch (firstByte >> 6) & 0x03 {
+	case 0x00:
+		return 2
+	case 0x01, 0x02:
+		return 4
+	case 0x03:
+		return 6
+	default:
+		return 2
+	}
+}
+
+// GetNextInstructionAddr returns the address of the next sequential instruction.
+func GetNextInstructionAddr(pc uint64, instruction []byte) uint64 {
+	if len(instruction) < 1 {
+		return pc + 2
+	}
+	insnLen := GetInstructionLength(instruction[0])
+	return pc + uint64(insnLen)
+}
+
+// CalculateBranchDest calculates the destination address for branch instructions.
+func CalculateBranchDest(pid int, pc uint64, instruction []byte) uint64 {
+	if len(instruction) < 6 {
+		return NO_BRANCH_DEST
+	}
+
+	inst0_15 := uint16(instruction[0])<<8 | uint16(instruction[1])
+	inst16_31 := uint16(instruction[2])<<8 | uint16(instruction[3])
+	inst32_47 := uint16(instruction[4])<<8 | uint16(instruction[5])
+	opcode := instruction[0]
+
+	var dest uint64 = NO_BRANCH_DEST
+
+	// RR format branches
+	if opcode == opBCR || opcode == opBALR || opcode == opBASR ||
+		opcode == opBASSM || opcode == opBSM || opcode == opBCTR {
+
+		r2 := int(inst0_15 & 0x0F)
+
+		if opcode == opBCR {
+			mask := int((inst0_15 >> 4) & 0x0F)
+			if mask == 0 || r2 == 0 {
+				return NO_BRANCH_DEST
+			}
+		} else {
+			if r2 == 0 {
+				return NO_BRANCH_DEST
+			}
+		}
+
+		var regs PtraceRegs
+		if err := PtraceGetRegs(pid, &regs); err == nil {
+			if r2 >= 0 && r2 < 16 {
+				regVal := regs.Gprs[r2]
+				dest = regVal
+			}
+		}
+	} else if opcode == opBC || opcode == opBAL || opcode == opBCT || opcode == opBAS {
+		// RX format branches
+		if opcode == opBC {
+			mask := int((inst0_15 >> 4) & 0x0F)
+			if mask == 0 {
+				return NO_BRANCH_DEST
+			}
+		}
+
+		index := int(inst0_15 & 0x0F)
+		base := int((inst16_31 >> 12) & 0x0F)
+		displacement := uint32(inst16_31 & 0x0FFF)
+
+		var baseVal, indexVal uint64
+		var regs PtraceRegs
+		if err := PtraceGetRegs(pid, &regs); err == nil {
+			if base != 0 && base < 16 {
+				baseVal = regs.Gprs[base]
+			}
+			if index != 0 && index < 16 {
+				indexVal = regs.Gprs[index]
+			}
+		}
+
+		if base == 0 && index == 0 {
+			dest = pc + uint64(displacement)
+		} else {
+			dest = baseVal + indexVal + uint64(displacement)
+		}
+	} else if opcode == opBXH || opcode == opBXLE {
+		// RS format branches
+		base := int((inst16_31 >> 12) & 0x0F)
+		displacement := uint32(inst16_31 & 0x0FFF)
+
+		var baseVal uint64
+		var regs PtraceRegs
+		if err := PtraceGetRegs(pid, &regs); err == nil {
+			if base != 0 && base < 16 {
+				baseVal = regs.Gprs[base]
+			}
+		}
+
+		dest = baseVal + uint64(displacement)
+	} else if opcode == opBA7 {
+		// RI format branches
+		subOp := int(inst0_15 & 0x0F)
+
+		if subOp < 4 || subOp > 7 {
+			return NO_BRANCH_DEST
+		}
+
+		if subOp == 0x04 {
+			mask := int((inst0_15 >> 4) & 0x0F)
+			if mask == 0 {
+				return NO_BRANCH_DEST
+			}
+		}
+
+		relDispl := int16(inst16_31)
+		dest = uint64(int64(pc) + int64(relDispl)*2)
+	} else if opcode == opBC0 {
+		// RIL format branches
+		subOp := int(inst0_15 & 0x0F)
+
+		if subOp == 0x04 || subOp == 0x05 {
+			if subOp == 0x04 {
+				mask := int((inst0_15 >> 4) & 0x0F)
+				if mask == 0 {
+					return NO_BRANCH_DEST
+				}
+			}
+
+			inst16_47 := (uint32(inst16_31) << 16) | uint32(inst32_47)
+			relDispl4 := int32(inst16_47)
+			dest = uint64(int64(pc) + int64(relDispl4)*2)
+		}
+	} else if opcode == opBEC {
+		// RIEc format compare-and-branch
+		subOp := instruction[4]
+
+		isCompareBranch := (subOp >= 0x64 && subOp <= 0x67) ||
+			(subOp >= 0x76 && subOp <= 0x77) ||
+			(subOp >= 0x7C && subOp <= 0x7F)
+
+		if isCompareBranch {
+			ri4 := int16(inst16_31)
+			dest = uint64(int64(pc) + int64(ri4)*2)
+		}
+	}
+
+	if dest < 0x2000 {
+		return NO_BRANCH_DEST
+	}
+
+	return dest
+}
+
+// setTempBreakpoint sets a temporary breakpoint at the specified address
+func (s *singleStepState) setTempBreakpoint(pid int, addr uint64) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	// Find free slot
+	slot := -1
+	for i := 0; i < MAX_TEMP_BREAKPOINTS; i++ {
+		if !s.breakpoints[i].active {
+			slot = i
+			break
+		}
+	}
+
+	if slot == -1 {
+		return ENOMEM // All slots in use
+	}
+
+	// Read original instruction (up to 8 bytes for safety)
+	_, err := PtracePeekText(pid, uintptr(addr), s.breakpoints[slot].originalInsn[:])
+	if err != nil {
+		return err
+	}
+
+	// Write SVC 144 (0x0A90) as breakpoint
+	svc144 := []byte{0x0A, 0x90}
+	_, err = PtracePokeText(pid, uintptr(addr), svc144)
+	if err != nil {
+		return err
+	}
+
+	s.breakpoints[slot].address = addr
+	s.breakpoints[slot].active = true
+
+	return nil
+}
+
+// removeTempBreakpoints removes all active temporary breakpoints
+func (s *singleStepState) removeTempBreakpoints(pid int) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	var lastErr error
+	for i := 0; i < MAX_TEMP_BREAKPOINTS; i++ {
+		if !s.breakpoints[i].active {
+			continue
+		}
+
+		// Restore original instruction (first 2 bytes are enough for SVC 144)
+		_, err := PtracePokeText(pid, uintptr(s.breakpoints[i].address), s.breakpoints[i].originalInsn[:2])
+		if err != nil {
+			lastErr = err
+		}
+
+		s.breakpoints[i].active = false
+	}
+
+	return lastErr
+}
+
+// isTempBreakpoint checks if an address is a temporary breakpoint
+func (s *singleStepState) isTempBreakpoint(addr uint64) bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	for i := 0; i < MAX_TEMP_BREAKPOINTS; i++ {
+		if s.breakpoints[i].active && s.breakpoints[i].address == addr {
+			return true
+		}
+	}
+	return false
+}
+
+// PtraceSingleStep executes a single instruction using temporary breakpoints.
+//
+// This function:
+// 1. Reads the current instruction at PSW
+// 2. Calculates the next instruction address (sequential)
+// 3. If branch instruction, calculates branch destination
+// 4. Sets temporary breakpoints at both addresses
+// 5. Continues execution until breakpoint hit
+// 6. Restores original instructions and adjusts PSW
+//
+// Returns nil on success, error on failure.
+func PtraceSingleStep(pid int) error {
+	state := getProcessState(pid)
+
+	// 1. Get current PSW
+	var regs PtraceRegs
+	if err := PtraceGetRegs(pid, &regs); err != nil {
+		return err
+	}
+	pc := regs.Psw.Addr
+
+	// 2. Read instruction at PC
+	insn := make([]byte, 8)
+	if _, err := PtracePeekText(pid, uintptr(pc), insn); err != nil {
+		return err
+	}
+
+	// 3. Calculate next instruction addresses
+	nextPC := GetNextInstructionAddr(pc, insn)
+	branchDest := CalculateBranchDest(pid, pc, insn)
+
+	// 4. Set temporary breakpoints
+	if err := state.setTempBreakpoint(pid, nextPC); err != nil {
+		return err
+	}
+
+	// If branch instruction, set breakpoint at branch destination too
+	if branchDest != NO_BRANCH_DEST && branchDest != nextPC {
+		if err := state.setTempBreakpoint(pid, branchDest); err != nil {
+			state.removeTempBreakpoints(pid) // Cleanup first breakpoint
+			return err
+		}
+	}
+
+	// 5. Continue execution
+	if err := PtraceCont(pid, 0); err != nil {
+		state.removeTempBreakpoints(pid)
+		return err
+	}
+
+	// 6. Wait for breakpoint hit (retry on EINTR)
+	var status WaitStatus
+	for {
+		_, err := Wait4(pid, &status, 0, nil)
+		if err == EINTR {
+			continue // Retry on interrupted system call
+		}
+		if err != nil {
+			state.removeTempBreakpoints(pid)
+			return err
+		}
+		break
+	}
+
+	// Check if process stopped (should be at breakpoint)
+	if !status.Stopped() {
+		state.removeTempBreakpoints(pid)
+		return ECHILD // Process exited or error
+	}
+
+	// 7. Get current PSW (should be at breakpoint + 2)
+	if err := PtraceGetRegs(pid, &regs); err != nil {
+		state.removeTempBreakpoints(pid)
+		return err
+	}
+
+	// 8. Remove temporary breakpoints
+	if err := state.removeTempBreakpoints(pid); err != nil {
+		return err
+	}
+
+	// 9. Back up PSW by 2 bytes (to point at original instruction, not SVC 144)
+	// Use direct PSW write like ztrace does, not full register set
+	hitAddr := regs.Psw.Addr
+	if state.isTempBreakpoint(hitAddr - 2) {
+		if err := ptraceWritePSW(pid, uint32(hitAddr-2)); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// PtraceDetachWithCleanup detaches from a process and cleans up single-step state.
+// Use this instead of PtraceDetach when using PtraceSingleStep.
+func PtraceDetachWithCleanup(pid int) error {
+	state := getProcessState(pid)
+	state.removeTempBreakpoints(pid)
+	cleanupProcessState(pid)
+	return PtraceDetach(pid)
+}
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/syscall_darwin.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/syscall_darwin.go
--- a/vendor/golang.org/x/sys/unix/syscall_darwin.go	2026-10-28 10:49:46.739003786 +0000
+++ b/vendor/golang.org/x/sys/unix/syscall_darwin.go	2026-10-28 10:50:37.878748493 +0000
@@ -369,6 +369,7 @@
  */
 
 //sys	fcntl(fd int, cmd int, arg int) (val int, err error)
+//sys	fcntlPtr(fd int, cmd int, arg unsafe.Pointer) (val int, err error) = SYS_FCNTL
 
 //sys	kill(pid int, signum int, posix int) (err error)
 
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/syscall_freebsd.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/syscall_freebsd.go
--- a/vendor/golang.org/x/sys/unix/syscall_freebsd.go	2026-10-28 10:49:46.739003786 +0000
+++ b/vendor/golang.org/x/sys/unix/syscall_freebsd.go	2026-10-28 10:50:37.878748493 +0000
@@ -369,6 +369,15 @@
 //sys	ExtattrSetLink(link string, attrnamespace int, attrname string, data uintptr, nbytes int) (ret int, err error)
 //sys	ExtattrDeleteLink(link string, attrnamespace int, attrname string) (err error)
 //sys	ExtattrListLink(link string, attrnamespace int, data uintptr, nbytes int) (ret int, err error)
+//sys	extattrGetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error)
+//sys	extattrSetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error)
+//sys	extattrListFd(fd int, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error)
+//sys	extattrGetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error)
+//sys	extattrSetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error)
+//sys	extattrListFile(file string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error)
+//sys	extattrGetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error)
+//sys	extattrSetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error)
+//sys	extattrListLink(link string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error)
 //sys	Fadvise(fd int, offset int64, length int64, advice int) (err error) = SYS_POSIX_FADVISE
 //sys	Faccessat(dirfd int, path string, mode uint32, flags int) (err error)
 //sys	Fchdir(fd int) (err error)
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/syscall_linux.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/syscall_linux.go
--- a/vendor/golang.org/x/sys/unix/syscall_linux.go	2026-10-28 10:49:46.739003786 +0000
+++ b/vendor/golang.org/x/sys/unix/syscall_linux.go	2026-10-28 10:50:37.878748493 +0000
@@ -1991,7 +1991,24 @@
 	return fsconfig(fd, FSCONFIG_CMD_RECONFIGURE, nil, nil, 0)
 }
 
-//sys	Getdents(fd int, buf []byte) (n int, err error) = SYS_GETDENTS64
+//sys	getdents(fd int, buf []byte) (n int, err error) = SYS_GETDENTS64
+
+// Getdents reads directory entries from fd into buf.
+func Getdents(fd int, buf []byte) (n int, err error) {
+	// getdents64 stores d_ino with a 64-bit write, which faults on
+	// strict-alignment targets unless buf is 8-aligned.
+	if len(buf) > 0 {
+		if off := int(-uintptr(unsafe.Pointer(&buf[0])) & 7); off > 0 && off < len(buf) {
+			n, err = getdents(fd, buf[off:])
+			if n > 0 {
+				copy(buf, buf[off:off+n])
+			}
+			return n, err
+		}
+	}
+	return getdents(fd, buf)
+}
+
 //sysnb	Getpgid(pid int) (pgid int, err error)
 
 func Getpgrp() (pid int) {
@@ -2033,6 +2050,7 @@
 //sysnb	Kill(pid int, sig syscall.Signal) (err error)
 //sys	Klogctl(typ int, buf []byte) (n int, err error) = SYS_SYSLOG
 //sys	Lgetxattr(path string, attr string, dest []byte) (sz int, err error)
+//sys	Listns(req *NsIdReq, nsIds []uint64, flags uint) (n int, err error)
 //sys	Listxattr(path string, dest []byte) (sz int, err error)
 //sys	Llistxattr(path string, dest []byte) (sz int, err error)
 //sys	Lremovexattr(path string, attr string) (err error)
@@ -2046,6 +2064,7 @@
 //sys	PerfEventOpen(attr *PerfEventAttr, pid int, cpu int, groupFd int, flags int) (fd int, err error)
 //sys	PivotRoot(newroot string, putold string) (err error) = SYS_PIVOT_ROOT
 //sys	Prctl(option int, arg2 uintptr, arg3 uintptr, arg4 uintptr, arg5 uintptr) (err error)
+//sys	PrctlArg5Ptr(option int, arg2 uintptr, arg3 uintptr, arg4 uintptr, arg5 unsafe.Pointer) (err error) = SYS_PRCTL
 //sys	pselect6(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timespec, sigmask *sigset_argpack) (n int, err error)
 //sys	read(fd int, p []byte) (n int, err error)
 //sys	Removexattr(path string, attr string) (err error)
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/syscall_linux_sparc64.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/syscall_linux_sparc64.go
--- a/vendor/golang.org/x/sys/unix/syscall_linux_sparc64.go	2026-10-28 10:49:46.743003766 +0000
+++ b/vendor/golang.org/x/sys/unix/syscall_linux_sparc64.go	2026-10-28 10:50:37.878748493 +0000
@@ -8,7 +8,7 @@
 
 //sys	Fadvise(fd int, offset int64, length int64, advice int) (err error) = SYS_FADVISE64
 //sys	Fchown(fd int, uid int, gid int) (err error)
-//sys	Fstat(fd int, stat *Stat_t) (err error)
+//sys	Fstat(fd int, stat *Stat_t) (err error) = SYS_FSTAT64
 //sys	Fstatat(dirfd int, path string, stat *Stat_t, flags int) (err error) = SYS_FSTATAT64
 //sys	Fstatfs(fd int, buf *Statfs_t) (err error)
 //sys	Ftruncate(fd int, length int64) (err error)
@@ -19,7 +19,7 @@
 //sysnb	Getuid() (uid int)
 //sys	Lchown(path string, uid int, gid int) (err error)
 //sys	Listen(s int, n int) (err error)
-//sys	Lstat(path string, stat *Stat_t) (err error)
+//sys	Lstat(path string, stat *Stat_t) (err error) = SYS_LSTAT64
 //sys	Pause() (err error)
 //sys	pread(fd int, p []byte, offset int64) (n int, err error) = SYS_PREAD64
 //sys	pwrite(fd int, p []byte, offset int64) (n int, err error) = SYS_PWRITE64
@@ -31,7 +31,7 @@
 //sys	setfsuid(uid int) (prev int, err error)
 //sys	Shutdown(fd int, how int) (err error)
 //sys	Splice(rfd int, roff *int64, wfd int, woff *int64, len int, flags int) (n int64, err error)
-//sys	Stat(path string, stat *Stat_t) (err error)
+//sys	Stat(path string, stat *Stat_t) (err error) = SYS_STAT64
 //sys	Statfs(path string, buf *Statfs_t) (err error)
 //sys	SyncFileRange(fd int, off int64, n int64, flags int) (err error)
 //sys	Truncate(path string, length int64) (err error)
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/syscall_netbsd.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/syscall_netbsd.go
--- a/vendor/golang.org/x/sys/unix/syscall_netbsd.go	2026-10-28 10:49:46.743003766 +0000
+++ b/vendor/golang.org/x/sys/unix/syscall_netbsd.go	2026-10-28 10:50:37.878748493 +0000
@@ -293,6 +293,15 @@
 //sys	ExtattrSetLink(link string, attrnamespace int, attrname string, data uintptr, nbytes int) (ret int, err error)
 //sys	ExtattrDeleteLink(link string, attrnamespace int, attrname string) (err error)
 //sys	ExtattrListLink(link string, attrnamespace int, data uintptr, nbytes int) (ret int, err error)
+//sys	extattrGetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error)
+//sys	extattrSetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error)
+//sys	extattrListFd(fd int, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error)
+//sys	extattrGetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error)
+//sys	extattrSetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error)
+//sys	extattrListFile(file string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error)
+//sys	extattrGetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error)
+//sys	extattrSetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error)
+//sys	extattrListLink(link string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error)
 //sys	Faccessat(dirfd int, path string, mode uint32, flags int) (err error)
 //sys	Fadvise(fd int, offset int64, length int64, advice int) (err error) = SYS_POSIX_FADVISE
 //sys	Fchdir(fd int) (err error)
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/syscall_unix_gc.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/syscall_unix_gc.go
--- a/vendor/golang.org/x/sys/unix/syscall_unix_gc.go	2026-10-28 10:49:46.743003766 +0000
+++ b/vendor/golang.org/x/sys/unix/syscall_unix_gc.go	2026-10-28 10:50:37.878748493 +0000
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build (darwin || dragonfly || freebsd || (linux && !ppc64 && !ppc64le) || netbsd || openbsd || solaris) && gc
+//go:build (darwin || dragonfly || freebsd || linux || netbsd || openbsd || solaris) && gc
 
 package unix
 
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/syscall_unix_gc_ppc64x.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/syscall_unix_gc_ppc64x.go
--- a/vendor/golang.org/x/sys/unix/syscall_unix_gc_ppc64x.go	2026-10-28 10:49:46.743003766 +0000
+++ b/vendor/golang.org/x/sys/unix/syscall_unix_gc_ppc64x.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,22 +0,0 @@
-// Copyright 2018 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build linux && (ppc64le || ppc64) && gc
-
-package unix
-
-import "syscall"
-
-func Syscall(trap, a1, a2, a3 uintptr) (r1, r2 uintptr, err syscall.Errno) {
-	return syscall.Syscall(trap, a1, a2, a3)
-}
-func Syscall6(trap, a1, a2, a3, a4, a5, a6 uintptr) (r1, r2 uintptr, err syscall.Errno) {
-	return syscall.Syscall6(trap, a1, a2, a3, a4, a5, a6)
-}
-func RawSyscall(trap, a1, a2, a3 uintptr) (r1, r2 uintptr, err syscall.Errno) {
-	return syscall.RawSyscall(trap, a1, a2, a3)
-}
-func RawSyscall6(trap, a1, a2, a3, a4, a5, a6 uintptr) (r1, r2 uintptr, err syscall.Errno) {
-	return syscall.RawSyscall6(trap, a1, a2, a3, a4, a5, a6)
-}
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/syscall_zos_s390x.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/syscall_zos_s390x.go
--- a/vendor/golang.org/x/sys/unix/syscall_zos_s390x.go	2026-10-28 10:49:46.743003766 +0000
+++ b/vendor/golang.org/x/sys/unix/syscall_zos_s390x.go	2026-10-28 10:50:37.878748493 +0000
@@ -28,13 +28,9 @@
 )
 
 //go:noescape
-func initZosLibVec()
-
-//go:noescape
 func GetZosLibVec() uintptr
 
 func init() {
-	initZosLibVec()
 	r0, _, _ := CallLeFuncWithPtrReturn(GetZosLibVec()+SYS_____GETENV_A<<4, uintptr(unsafe.Pointer(&([]byte("__ZOS_XSYSTRACE\x00"))[0])))
 	if r0 != 0 {
 		n, _, _ := CallLeFuncWithPtrReturn(GetZosLibVec()+SYS___ATOI_A<<4, r0)
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/xattr_bsd.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/xattr_bsd.go
--- a/vendor/golang.org/x/sys/unix/xattr_bsd.go	2026-10-28 10:49:46.743003766 +0000
+++ b/vendor/golang.org/x/sys/unix/xattr_bsd.go	2026-10-28 10:50:37.882748472 +0000
@@ -56,7 +56,7 @@
 		return -1, err
 	}
 
-	return ExtattrGetFile(file, nsid, a, uintptr(d), destsize)
+	return extattrGetFile(file, nsid, a, d, destsize)
 }
 
 func Fgetxattr(fd int, attr string, dest []byte) (sz int, err error) {
@@ -68,7 +68,7 @@
 		return -1, err
 	}
 
-	return ExtattrGetFd(fd, nsid, a, uintptr(d), destsize)
+	return extattrGetFd(fd, nsid, a, d, destsize)
 }
 
 func Lgetxattr(link string, attr string, dest []byte) (sz int, err error) {
@@ -80,7 +80,7 @@
 		return -1, err
 	}
 
-	return ExtattrGetLink(link, nsid, a, uintptr(d), destsize)
+	return extattrGetLink(link, nsid, a, d, destsize)
 }
 
 // flags are unused on FreeBSD
@@ -97,7 +97,7 @@
 		return
 	}
 
-	_, err = ExtattrSetFd(fd, nsid, a, uintptr(d), datasiz)
+	_, err = extattrSetFd(fd, nsid, a, d, datasiz)
 	return
 }
 
@@ -113,7 +113,7 @@
 		return
 	}
 
-	_, err = ExtattrSetFile(file, nsid, a, uintptr(d), datasiz)
+	_, err = extattrSetFile(file, nsid, a, d, datasiz)
 	return
 }
 
@@ -129,7 +129,7 @@
 		return
 	}
 
-	_, err = ExtattrSetLink(link, nsid, a, uintptr(d), datasiz)
+	_, err = extattrSetLink(link, nsid, a, d, datasiz)
 	return
 }
 
@@ -199,9 +199,9 @@
 	d := initxattrdest(dest, 0)
 	destsiz := len(dest)
 
-	s, e := ExtattrListFile(file, nsid, uintptr(d), destsiz)
+	s, e := extattrListFile(file, nsid, d, destsiz)
 	if e != nil {
-		return 0, err
+		return 0, e
 	}
 
 	return s, nil
@@ -235,9 +235,9 @@
 	d := initxattrdest(dest, 0)
 	destsiz := len(dest)
 
-	s, e := ExtattrListFd(fd, nsid, uintptr(d), destsiz)
+	s, e := extattrListFd(fd, nsid, d, destsiz)
 	if e != nil {
-		return 0, err
+		return 0, e
 	}
 
 	return s, nil
@@ -271,9 +271,9 @@
 	d := initxattrdest(dest, 0)
 	destsiz := len(dest)
 
-	s, e := ExtattrListLink(link, nsid, uintptr(d), destsiz)
+	s, e := extattrListLink(link, nsid, d, destsiz)
 	if e != nil {
-		return 0, err
+		return 0, e
 	}
 
 	return s, nil
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/zerrors_darwin_amd64.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/zerrors_darwin_amd64.go
--- a/vendor/golang.org/x/sys/unix/zerrors_darwin_amd64.go	2026-10-28 10:49:46.743003766 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_darwin_amd64.go	2026-10-28 10:50:37.882748472 +0000
@@ -1128,6 +1128,7 @@
 	O_DSYNC                                 = 0x400000
 	O_EVTONLY                               = 0x8000
 	O_EXCL                                  = 0x800
+	O_EXEC                                  = 0x40000000
 	O_EXLOCK                                = 0x20
 	O_FSYNC                                 = 0x80
 	O_NDELAY                                = 0x4
@@ -1138,6 +1139,7 @@
 	O_POPUP                                 = 0x80000000
 	O_RDONLY                                = 0x0
 	O_RDWR                                  = 0x2
+	O_SEARCH                                = 0x40100000
 	O_SHLOCK                                = 0x10
 	O_SYMLINK                               = 0x200000
 	O_SYNC                                  = 0x80
@@ -1147,6 +1149,10 @@
 	PARMRK                                  = 0x8
 	PARODD                                  = 0x2000
 	PENDIN                                  = 0x20000000
+	PRIO_DARWIN_BG                          = 0x1000
+	PRIO_DARWIN_NONUI                       = 0x1001
+	PRIO_DARWIN_PROCESS                     = 0x4
+	PRIO_DARWIN_THREAD                      = 0x3
 	PRIO_PGRP                               = 0x1
 	PRIO_PROCESS                            = 0x0
 	PRIO_USER                               = 0x2
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/zerrors_darwin_arm64.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/zerrors_darwin_arm64.go
--- a/vendor/golang.org/x/sys/unix/zerrors_darwin_arm64.go	2026-10-28 10:49:46.743003766 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_darwin_arm64.go	2026-10-28 10:50:37.882748472 +0000
@@ -1128,6 +1128,7 @@
 	O_DSYNC                                 = 0x400000
 	O_EVTONLY                               = 0x8000
 	O_EXCL                                  = 0x800
+	O_EXEC                                  = 0x40000000
 	O_EXLOCK                                = 0x20
 	O_FSYNC                                 = 0x80
 	O_NDELAY                                = 0x4
@@ -1138,6 +1139,7 @@
 	O_POPUP                                 = 0x80000000
 	O_RDONLY                                = 0x0
 	O_RDWR                                  = 0x2
+	O_SEARCH                                = 0x40100000
 	O_SHLOCK                                = 0x10
 	O_SYMLINK                               = 0x200000
 	O_SYNC                                  = 0x80
@@ -1147,6 +1149,10 @@
 	PARMRK                                  = 0x8
 	PARODD                                  = 0x2000
 	PENDIN                                  = 0x20000000
+	PRIO_DARWIN_BG                          = 0x1000
+	PRIO_DARWIN_NONUI                       = 0x1001
+	PRIO_DARWIN_PROCESS                     = 0x4
+	PRIO_DARWIN_THREAD                      = 0x3
 	PRIO_PGRP                               = 0x1
 	PRIO_PROCESS                            = 0x0
 	PRIO_USER                               = 0x2
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/zerrors_linux.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/zerrors_linux.go
--- a/vendor/golang.org/x/sys/unix/zerrors_linux.go	2026-10-28 10:49:46.751003726 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux.go	2026-10-28 10:50:37.882748472 +0000
@@ -752,10 +752,12 @@
 	CLONE_ARGS_SIZE_VER0                        = 0x40
 	CLONE_ARGS_SIZE_VER1                        = 0x50
 	CLONE_ARGS_SIZE_VER2                        = 0x58
+	CLONE_AUTOREAP                              = 0x400000000
 	CLONE_CHILD_CLEARTID                        = 0x200000
 	CLONE_CHILD_SETTID                          = 0x1000000
 	CLONE_CLEAR_SIGHAND                         = 0x100000000
 	CLONE_DETACHED                              = 0x400000
+	CLONE_EMPTY_MNTNS                           = 0x2000000000
 	CLONE_FILES                                 = 0x400
 	CLONE_FS                                    = 0x200
 	CLONE_INTO_CGROUP                           = 0x200000000
@@ -768,9 +770,11 @@
 	CLONE_NEWTIME                               = 0x80
 	CLONE_NEWUSER                               = 0x10000000
 	CLONE_NEWUTS                                = 0x4000000
+	CLONE_NNP                                   = 0x800000000
 	CLONE_PARENT                                = 0x8000
 	CLONE_PARENT_SETTID                         = 0x100000
 	CLONE_PIDFD                                 = 0x1000
+	CLONE_PIDFD_AUTOKILL                        = 0x1000000000
 	CLONE_PTRACE                                = 0x2000
 	CLONE_SETTLS                                = 0x80000
 	CLONE_SIGHAND                               = 0x800
@@ -803,12 +807,15 @@
 	DEVLINK_GENL_MCGRP_CONFIG_NAME              = "config"
 	DEVLINK_GENL_NAME                           = "devlink"
 	DEVLINK_GENL_VERSION                        = 0x1
+	DEVLINK_INDEX_BUS_NAME                      = "devlink_index"
 	DEVLINK_PORT_FN_CAP_IPSEC_CRYPTO            = 0x4
 	DEVLINK_PORT_FN_CAP_IPSEC_PACKET            = 0x8
 	DEVLINK_PORT_FN_CAP_MIGRATABLE              = 0x2
 	DEVLINK_PORT_FN_CAP_ROCE                    = 0x1
 	DEVLINK_RATE_TCS_MAX                        = 0x8
 	DEVLINK_RATE_TC_INDEX_MAX                   = 0x7
+	DEVLINK_RESOURCE_SCOPE_DEV                  = 0x1
+	DEVLINK_RESOURCE_SCOPE_PORT                 = 0x2
 	DEVLINK_SB_THRESHOLD_TO_ALPHA_MAX           = 0x14
 	DEVLINK_SUPPORTED_FLASH_OVERWRITE_SECTIONS  = 0x3
 	DEVMEM_MAGIC                                = 0x454d444d
@@ -1127,6 +1134,7 @@
 	ETHTOOL_SWOL                                = 0x6
 	ETHTOOL_TEST                                = 0x1a
 	ETH_P_1588                                  = 0x88f7
+	ETH_P_8021AC                                = 0x8870
 	ETH_P_8021AD                                = 0x88a8
 	ETH_P_8021AH                                = 0x88e7
 	ETH_P_8021Q                                 = 0x8100
@@ -1170,6 +1178,7 @@
 	ETH_P_ETHERCAT                              = 0x88a4
 	ETH_P_FCOE                                  = 0x8906
 	ETH_P_FIP                                   = 0x8914
+	ETH_P_GRE_OSI                               = 0xfe
 	ETH_P_HDLC                                  = 0x19
 	ETH_P_HSR                                   = 0x892f
 	ETH_P_IBOE                                  = 0x8915
@@ -1198,6 +1207,7 @@
 	ETH_P_MXLGSW                                = 0x88c3
 	ETH_P_NCSI                                  = 0x88f8
 	ETH_P_NSH                                   = 0x894f
+	ETH_P_NXP_NETC                              = 0xfd3a
 	ETH_P_PAE                                   = 0x888e
 	ETH_P_PAUSE                                 = 0x8808
 	ETH_P_PHONET                                = 0xf5
@@ -1359,6 +1369,7 @@
 	FAN_UNLIMITED_MARKS                         = 0x20
 	FAN_UNLIMITED_QUEUE                         = 0x10
 	FD_CLOEXEC                                  = 0x1
+	FD_NSFS_ROOT                                = -0x2713
 	FD_PIDFS_ROOT                               = -0x2712
 	FD_SETSIZE                                  = 0x400
 	FF0                                         = 0x0
@@ -1427,6 +1438,8 @@
 	FS_POLICY_FLAGS_PAD_8                       = 0x1
 	FS_POLICY_FLAGS_PAD_MASK                    = 0x3
 	FS_POLICY_FLAGS_VALID                       = 0x7
+	FS_SHUTDOWN_FLAGS_LOGFLUSH                  = 0x1
+	FS_SHUTDOWN_FLAGS_NOLOGFLUSH                = 0x2
 	FS_VERITY_FL                                = 0x100000
 	FS_VERITY_HASH_ALG_SHA256                   = 0x1
 	FS_VERITY_HASH_ALG_SHA512                   = 0x2
@@ -1441,6 +1454,7 @@
 	F_DUPFD_CLOEXEC                             = 0x406
 	F_DUPFD_QUERY                               = 0x403
 	F_EXLCK                                     = 0x4
+	F_GETDELEG                                  = 0x40f
 	F_GETFD                                     = 0x1
 	F_GETFL                                     = 0x3
 	F_GETLEASE                                  = 0x401
@@ -1462,6 +1476,7 @@
 	F_SEAL_SEAL                                 = 0x1
 	F_SEAL_SHRINK                               = 0x2
 	F_SEAL_WRITE                                = 0x8
+	F_SETDELEG                                  = 0x410
 	F_SETFD                                     = 0x2
 	F_SETFL                                     = 0x4
 	F_SETLEASE                                  = 0x400
@@ -1632,6 +1647,7 @@
 	IN_UNMOUNT                                  = 0x2000
 	IOCTL_MEI_CONNECT_CLIENT                    = 0xc0104801
 	IOCTL_MEI_CONNECT_CLIENT_VTAG               = 0xc0144804
+	IPPROTO_AGGFRAG                             = 0x90
 	IPPROTO_AH                                  = 0x33
 	IPPROTO_BEETPH                              = 0x5e
 	IPPROTO_COMP                                = 0x6c
@@ -1913,10 +1929,14 @@
 	LANDLOCK_ACCESS_FS_REFER                    = 0x2000
 	LANDLOCK_ACCESS_FS_REMOVE_DIR               = 0x10
 	LANDLOCK_ACCESS_FS_REMOVE_FILE              = 0x20
+	LANDLOCK_ACCESS_FS_RESOLVE_UNIX             = 0x10000
 	LANDLOCK_ACCESS_FS_TRUNCATE                 = 0x4000
 	LANDLOCK_ACCESS_FS_WRITE_FILE               = 0x2
 	LANDLOCK_ACCESS_NET_BIND_TCP                = 0x1
+	LANDLOCK_ACCESS_NET_BIND_UDP                = 0x4
+	LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP        = 0x8
 	LANDLOCK_ACCESS_NET_CONNECT_TCP             = 0x2
+	LANDLOCK_ADD_RULE_QUIET                     = 0x1
 	LANDLOCK_CREATE_RULESET_ERRATA              = 0x2
 	LANDLOCK_CREATE_RULESET_VERSION             = 0x1
 	LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON      = 0x2
@@ -3408,6 +3428,7 @@
 	SCHED_FLAG_UTIL_CLAMP                       = 0x60
 	SCHED_FLAG_UTIL_CLAMP_MAX                   = 0x40
 	SCHED_FLAG_UTIL_CLAMP_MIN                   = 0x20
+	SCHED_GETATTR_FLAG_DL_DYNAMIC               = 0x1
 	SCHED_IDLE                                  = 0x5
 	SCHED_NORMAL                                = 0x0
 	SCHED_RESET_ON_FORK                         = 0x40000000
@@ -3790,6 +3811,14 @@
 	TCPOPT_TIMESTAMP                            = 0x8
 	TCPOPT_TSTAMP_HDR                           = 0x101080a
 	TCPOPT_WINDOW                               = 0x3
+	TCP_ACCECN_ACE_FAIL_RECV                    = 0x2
+	TCP_ACCECN_ACE_FAIL_SEND                    = 0x1
+	TCP_ACCECN_OPT_COUNTER_SEEN                 = 0x2
+	TCP_ACCECN_OPT_EMPTY_SEEN                   = 0x1
+	TCP_ACCECN_OPT_FAIL_RECV                    = 0x8
+	TCP_ACCECN_OPT_FAIL_SEEN                    = 0x3
+	TCP_ACCECN_OPT_FAIL_SEND                    = 0x4
+	TCP_ACCECN_OPT_NOT_SEEN                     = 0x0
 	TCP_AO_KEYF_EXCLUDE_OPT                     = 0x2
 	TCP_AO_KEYF_IFINDEX                         = 0x1
 	TCP_AO_MAXKEYLEN                            = 0x50
@@ -3804,6 +3833,7 @@
 	TCP_COOKIE_TRANSACTIONS                     = 0xf
 	TCP_CORK                                    = 0x3
 	TCP_DEFER_ACCEPT                            = 0x9
+	TCP_DELACK_MAX_US                           = 0x2e
 	TCP_FASTOPEN                                = 0x17
 	TCP_FASTOPEN_CONNECT                        = 0x1e
 	TCP_FASTOPEN_KEY                            = 0x21
@@ -3836,6 +3866,8 @@
 	TCP_REPAIR_OPTIONS                          = 0x16
 	TCP_REPAIR_QUEUE                            = 0x14
 	TCP_REPAIR_WINDOW                           = 0x1d
+	TCP_RTO_MAX_MS                              = 0x2c
+	TCP_RTO_MIN_US                              = 0x2d
 	TCP_SAVED_SYN                               = 0x1c
 	TCP_SAVE_SYN                                = 0x1b
 	TCP_SYNCNT                                  = 0x7
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/zerrors_linux_386.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/zerrors_linux_386.go
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_386.go	2026-10-28 10:49:46.751003726 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_386.go	2026-10-28 10:50:37.882748472 +0000
@@ -600,6 +600,7 @@
 	EDQUOT          = syscall.Errno(0x7a)
 	EFSBADCRC       = syscall.Errno(0x4a)
 	EFSCORRUPTED    = syscall.Errno(0x75)
+	EFTYPE          = syscall.Errno(0x86)
 	EHOSTDOWN       = syscall.Errno(0x70)
 	EHOSTUNREACH    = syscall.Errno(0x71)
 	EHWPOISON       = syscall.Errno(0x85)
@@ -840,6 +841,7 @@
 	{131, "ENOTRECOVERABLE", "state not recoverable"},
 	{132, "ERFKILL", "operation not possible due to RF-kill"},
 	{133, "EHWPOISON", "memory page has hardware error"},
+	{134, "EFTYPE", "unknown error 134"},
 }
 
 // Signal table
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/zerrors_linux_amd64.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/zerrors_linux_amd64.go
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_amd64.go	2026-10-28 10:49:46.751003726 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_amd64.go	2026-10-28 10:50:37.882748472 +0000
@@ -600,6 +600,7 @@
 	EDQUOT          = syscall.Errno(0x7a)
 	EFSBADCRC       = syscall.Errno(0x4a)
 	EFSCORRUPTED    = syscall.Errno(0x75)
+	EFTYPE          = syscall.Errno(0x86)
 	EHOSTDOWN       = syscall.Errno(0x70)
 	EHOSTUNREACH    = syscall.Errno(0x71)
 	EHWPOISON       = syscall.Errno(0x85)
@@ -840,6 +841,7 @@
 	{131, "ENOTRECOVERABLE", "state not recoverable"},
 	{132, "ERFKILL", "operation not possible due to RF-kill"},
 	{133, "EHWPOISON", "memory page has hardware error"},
+	{134, "EFTYPE", "unknown error 134"},
 }
 
 // Signal table
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/zerrors_linux_arm.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/zerrors_linux_arm.go
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_arm.go	2026-10-28 10:49:46.751003726 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_arm.go	2026-10-28 10:50:37.882748472 +0000
@@ -605,6 +605,7 @@
 	EDQUOT          = syscall.Errno(0x7a)
 	EFSBADCRC       = syscall.Errno(0x4a)
 	EFSCORRUPTED    = syscall.Errno(0x75)
+	EFTYPE          = syscall.Errno(0x86)
 	EHOSTDOWN       = syscall.Errno(0x70)
 	EHOSTUNREACH    = syscall.Errno(0x71)
 	EHWPOISON       = syscall.Errno(0x85)
@@ -845,6 +846,7 @@
 	{131, "ENOTRECOVERABLE", "state not recoverable"},
 	{132, "ERFKILL", "operation not possible due to RF-kill"},
 	{133, "EHWPOISON", "memory page has hardware error"},
+	{134, "EFTYPE", "unknown error 134"},
 }
 
 // Signal table
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/zerrors_linux_arm64.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/zerrors_linux_arm64.go
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_arm64.go	2026-10-28 10:49:46.751003726 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_arm64.go	2026-10-28 10:50:37.882748472 +0000
@@ -602,6 +602,7 @@
 	EDQUOT          = syscall.Errno(0x7a)
 	EFSBADCRC       = syscall.Errno(0x4a)
 	EFSCORRUPTED    = syscall.Errno(0x75)
+	EFTYPE          = syscall.Errno(0x86)
 	EHOSTDOWN       = syscall.Errno(0x70)
 	EHOSTUNREACH    = syscall.Errno(0x71)
 	EHWPOISON       = syscall.Errno(0x85)
@@ -842,6 +843,7 @@
 	{131, "ENOTRECOVERABLE", "state not recoverable"},
 	{132, "ERFKILL", "operation not possible due to RF-kill"},
 	{133, "EHWPOISON", "memory page has hardware error"},
+	{134, "EFTYPE", "unknown error 134"},
 }
 
 // Signal table
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/zerrors_linux_loong64.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/zerrors_linux_loong64.go
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_loong64.go	2026-10-28 10:49:46.751003726 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_loong64.go	2026-10-28 10:50:37.882748472 +0000
@@ -592,6 +592,7 @@
 	EDQUOT          = syscall.Errno(0x7a)
 	EFSBADCRC       = syscall.Errno(0x4a)
 	EFSCORRUPTED    = syscall.Errno(0x75)
+	EFTYPE          = syscall.Errno(0x86)
 	EHOSTDOWN       = syscall.Errno(0x70)
 	EHOSTUNREACH    = syscall.Errno(0x71)
 	EHWPOISON       = syscall.Errno(0x85)
@@ -832,6 +833,7 @@
 	{131, "ENOTRECOVERABLE", "state not recoverable"},
 	{132, "ERFKILL", "operation not possible due to RF-kill"},
 	{133, "EHWPOISON", "memory page has hardware error"},
+	{134, "EFTYPE", "unknown error 134"},
 }
 
 // Signal table
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/zerrors_linux_mips.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/zerrors_linux_mips.go
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_mips.go	2026-10-28 10:49:46.751003726 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_mips.go	2026-10-28 10:50:37.882748472 +0000
@@ -601,6 +601,7 @@
 	EDQUOT          = syscall.Errno(0x46d)
 	EFSBADCRC       = syscall.Errno(0x4d)
 	EFSCORRUPTED    = syscall.Errno(0x87)
+	EFTYPE          = syscall.Errno(0xa9)
 	EHOSTDOWN       = syscall.Errno(0x93)
 	EHOSTUNREACH    = syscall.Errno(0x94)
 	EHWPOISON       = syscall.Errno(0xa8)
@@ -845,6 +846,7 @@
 	{166, "ENOTRECOVERABLE", "state not recoverable"},
 	{167, "ERFKILL", "operation not possible due to RF-kill"},
 	{168, "EHWPOISON", "memory page has hardware error"},
+	{169, "EFTYPE", "unknown error 169"},
 	{1133, "EDQUOT", "disk quota exceeded"},
 }
 
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/zerrors_linux_mips64.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/zerrors_linux_mips64.go
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_mips64.go	2026-10-28 10:49:46.751003726 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_mips64.go	2026-10-28 10:50:37.882748472 +0000
@@ -601,6 +601,7 @@
 	EDQUOT          = syscall.Errno(0x46d)
 	EFSBADCRC       = syscall.Errno(0x4d)
 	EFSCORRUPTED    = syscall.Errno(0x87)
+	EFTYPE          = syscall.Errno(0xa9)
 	EHOSTDOWN       = syscall.Errno(0x93)
 	EHOSTUNREACH    = syscall.Errno(0x94)
 	EHWPOISON       = syscall.Errno(0xa8)
@@ -845,6 +846,7 @@
 	{166, "ENOTRECOVERABLE", "state not recoverable"},
 	{167, "ERFKILL", "operation not possible due to RF-kill"},
 	{168, "EHWPOISON", "memory page has hardware error"},
+	{169, "EFTYPE", "unknown error 169"},
 	{1133, "EDQUOT", "disk quota exceeded"},
 }
 
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.go
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.go	2026-10-28 10:49:46.751003726 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.go	2026-10-28 10:50:37.882748472 +0000
@@ -601,6 +601,7 @@
 	EDQUOT          = syscall.Errno(0x46d)
 	EFSBADCRC       = syscall.Errno(0x4d)
 	EFSCORRUPTED    = syscall.Errno(0x87)
+	EFTYPE          = syscall.Errno(0xa9)
 	EHOSTDOWN       = syscall.Errno(0x93)
 	EHOSTUNREACH    = syscall.Errno(0x94)
 	EHWPOISON       = syscall.Errno(0xa8)
@@ -845,6 +846,7 @@
 	{166, "ENOTRECOVERABLE", "state not recoverable"},
 	{167, "ERFKILL", "operation not possible due to RF-kill"},
 	{168, "EHWPOISON", "memory page has hardware error"},
+	{169, "EFTYPE", "unknown error 169"},
 	{1133, "EDQUOT", "disk quota exceeded"},
 }
 
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.go
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.go	2026-10-28 10:49:46.751003726 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.go	2026-10-28 10:50:37.882748472 +0000
@@ -601,6 +601,7 @@
 	EDQUOT          = syscall.Errno(0x46d)
 	EFSBADCRC       = syscall.Errno(0x4d)
 	EFSCORRUPTED    = syscall.Errno(0x87)
+	EFTYPE          = syscall.Errno(0xa9)
 	EHOSTDOWN       = syscall.Errno(0x93)
 	EHOSTUNREACH    = syscall.Errno(0x94)
 	EHWPOISON       = syscall.Errno(0xa8)
@@ -845,6 +846,7 @@
 	{166, "ENOTRECOVERABLE", "state not recoverable"},
 	{167, "ERFKILL", "operation not possible due to RF-kill"},
 	{168, "EHWPOISON", "memory page has hardware error"},
+	{169, "EFTYPE", "unknown error 169"},
 	{1133, "EDQUOT", "disk quota exceeded"},
 }
 
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/zerrors_linux_ppc.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/zerrors_linux_ppc.go
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_ppc.go	2026-10-28 10:49:46.751003726 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_ppc.go	2026-10-28 10:50:37.882748472 +0000
@@ -657,6 +657,7 @@
 	EDQUOT          = syscall.Errno(0x7a)
 	EFSBADCRC       = syscall.Errno(0x4a)
 	EFSCORRUPTED    = syscall.Errno(0x75)
+	EFTYPE          = syscall.Errno(0x86)
 	EHOSTDOWN       = syscall.Errno(0x70)
 	EHOSTUNREACH    = syscall.Errno(0x71)
 	EHWPOISON       = syscall.Errno(0x85)
@@ -898,6 +899,7 @@
 	{131, "ENOTRECOVERABLE", "state not recoverable"},
 	{132, "ERFKILL", "operation not possible due to RF-kill"},
 	{133, "EHWPOISON", "memory page has hardware error"},
+	{134, "EFTYPE", "unknown error 134"},
 }
 
 // Signal table
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.go
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.go	2026-10-28 10:49:46.751003726 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.go	2026-10-28 10:50:37.882748472 +0000
@@ -661,6 +661,7 @@
 	EDQUOT          = syscall.Errno(0x7a)
 	EFSBADCRC       = syscall.Errno(0x4a)
 	EFSCORRUPTED    = syscall.Errno(0x75)
+	EFTYPE          = syscall.Errno(0x86)
 	EHOSTDOWN       = syscall.Errno(0x70)
 	EHOSTUNREACH    = syscall.Errno(0x71)
 	EHWPOISON       = syscall.Errno(0x85)
@@ -902,6 +903,7 @@
 	{131, "ENOTRECOVERABLE", "state not recoverable"},
 	{132, "ERFKILL", "operation not possible due to RF-kill"},
 	{133, "EHWPOISON", "memory page has hardware error"},
+	{134, "EFTYPE", "unknown error 134"},
 }
 
 // Signal table
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.go
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.go	2026-10-28 10:49:46.751003726 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.go	2026-10-28 10:50:37.882748472 +0000
@@ -661,6 +661,7 @@
 	EDQUOT          = syscall.Errno(0x7a)
 	EFSBADCRC       = syscall.Errno(0x4a)
 	EFSCORRUPTED    = syscall.Errno(0x75)
+	EFTYPE          = syscall.Errno(0x86)
 	EHOSTDOWN       = syscall.Errno(0x70)
 	EHOSTUNREACH    = syscall.Errno(0x71)
 	EHWPOISON       = syscall.Errno(0x85)
@@ -902,6 +903,7 @@
 	{131, "ENOTRECOVERABLE", "state not recoverable"},
 	{132, "ERFKILL", "operation not possible due to RF-kill"},
 	{133, "EHWPOISON", "memory page has hardware error"},
+	{134, "EFTYPE", "unknown error 134"},
 }
 
 // Signal table
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go	2026-10-28 10:49:46.751003726 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go	2026-10-28 10:50:37.882748472 +0000
@@ -602,6 +602,7 @@
 	EDQUOT          = syscall.Errno(0x7a)
 	EFSBADCRC       = syscall.Errno(0x4a)
 	EFSCORRUPTED    = syscall.Errno(0x75)
+	EFTYPE          = syscall.Errno(0x86)
 	EHOSTDOWN       = syscall.Errno(0x70)
 	EHOSTUNREACH    = syscall.Errno(0x71)
 	EHWPOISON       = syscall.Errno(0x85)
@@ -842,6 +843,7 @@
 	{131, "ENOTRECOVERABLE", "state not recoverable"},
 	{132, "ERFKILL", "operation not possible due to RF-kill"},
 	{133, "EHWPOISON", "memory page has hardware error"},
+	{134, "EFTYPE", "unknown error 134"},
 }
 
 // Signal table
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/zerrors_linux_s390x.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/zerrors_linux_s390x.go
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_s390x.go	2026-10-28 10:49:46.751003726 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_s390x.go	2026-10-28 10:50:37.882748472 +0000
@@ -661,6 +661,7 @@
 	EDQUOT          = syscall.Errno(0x7a)
 	EFSBADCRC       = syscall.Errno(0x4a)
 	EFSCORRUPTED    = syscall.Errno(0x75)
+	EFTYPE          = syscall.Errno(0x86)
 	EHOSTDOWN       = syscall.Errno(0x70)
 	EHOSTUNREACH    = syscall.Errno(0x71)
 	EHWPOISON       = syscall.Errno(0x85)
@@ -901,6 +902,7 @@
 	{131, "ENOTRECOVERABLE", "state not recoverable"},
 	{132, "ERFKILL", "operation not possible due to RF-kill"},
 	{133, "EHWPOISON", "memory page has hardware error"},
+	{134, "EFTYPE", "unknown error 134"},
 }
 
 // Signal table
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.go
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.go	2026-10-28 10:49:46.751003726 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.go	2026-10-28 10:50:37.882748472 +0000
@@ -704,6 +704,7 @@
 	EDQUOT          = syscall.Errno(0x45)
 	EFSBADCRC       = syscall.Errno(0x4c)
 	EFSCORRUPTED    = syscall.Errno(0x75)
+	EFTYPE          = syscall.Errno(0x88)
 	EHOSTDOWN       = syscall.Errno(0x40)
 	EHOSTUNREACH    = syscall.Errno(0x41)
 	EHWPOISON       = syscall.Errno(0x87)
@@ -950,6 +951,7 @@
 	{133, "ENOTRECOVERABLE", "state not recoverable"},
 	{134, "ERFKILL", "operation not possible due to RF-kill"},
 	{135, "EHWPOISON", "memory page has hardware error"},
+	{136, "EFTYPE", "unknown error 136"},
 }
 
 // Signal table
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.go	2026-10-28 10:49:46.755003706 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.go	2026-10-28 10:50:37.886748453 +0000
@@ -702,6 +702,17 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func fcntlPtr(fd int, cmd int, arg unsafe.Pointer) (val int, err error) {
+	r0, _, e1 := syscall_syscall(libc_fcntl_trampoline_addr, uintptr(fd), uintptr(cmd), uintptr(arg))
+	val = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func kill(pid int, signum int, posix int) (err error) {
 	_, _, e1 := syscall_syscall(libc_kill_trampoline_addr, uintptr(pid), uintptr(signum), uintptr(posix))
 	if e1 != 0 {
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.go	2026-10-28 10:49:46.755003706 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.go	2026-10-28 10:50:37.886748453 +0000
@@ -702,6 +702,17 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func fcntlPtr(fd int, cmd int, arg unsafe.Pointer) (val int, err error) {
+	r0, _, e1 := syscall_syscall(libc_fcntl_trampoline_addr, uintptr(fd), uintptr(cmd), uintptr(arg))
+	val = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func kill(pid int, signum int, posix int) (err error) {
 	_, _, e1 := syscall_syscall(libc_kill_trampoline_addr, uintptr(pid), uintptr(signum), uintptr(posix))
 	if e1 != 0 {
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/zsyscall_freebsd_386.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/zsyscall_freebsd_386.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_386.go	2026-10-28 10:49:46.755003706 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_386.go	2026-10-28 10:50:37.886748453 +0000
@@ -825,6 +825,165 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func extattrGetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFd(fd int, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FD, uintptr(fd), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFile(file string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListLink(link string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall6(SYS_POSIX_FADVISE, uintptr(fd), uintptr(offset), uintptr(offset>>32), uintptr(length), uintptr(length>>32), uintptr(advice))
 	if e1 != 0 {
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/zsyscall_freebsd_amd64.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/zsyscall_freebsd_amd64.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_amd64.go	2026-10-28 10:49:46.755003706 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_amd64.go	2026-10-28 10:50:37.886748453 +0000
@@ -825,6 +825,165 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func extattrGetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFd(fd int, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FD, uintptr(fd), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFile(file string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListLink(link string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall6(SYS_POSIX_FADVISE, uintptr(fd), uintptr(offset), uintptr(length), uintptr(advice), 0, 0)
 	if e1 != 0 {
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm.go	2026-10-28 10:49:46.755003706 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm.go	2026-10-28 10:50:37.886748453 +0000
@@ -825,6 +825,165 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func extattrGetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFd(fd int, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FD, uintptr(fd), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFile(file string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListLink(link string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall9(SYS_POSIX_FADVISE, uintptr(fd), 0, uintptr(offset), uintptr(offset>>32), uintptr(length), uintptr(length>>32), uintptr(advice), 0, 0)
 	if e1 != 0 {
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm64.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm64.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm64.go	2026-10-28 10:49:46.755003706 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm64.go	2026-10-28 10:50:37.886748453 +0000
@@ -825,6 +825,165 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func extattrGetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFd(fd int, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FD, uintptr(fd), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFile(file string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListLink(link string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall6(SYS_POSIX_FADVISE, uintptr(fd), uintptr(offset), uintptr(length), uintptr(advice), 0, 0)
 	if e1 != 0 {
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/zsyscall_freebsd_riscv64.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/zsyscall_freebsd_riscv64.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_riscv64.go	2026-10-28 10:49:46.755003706 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_riscv64.go	2026-10-28 10:50:37.886748453 +0000
@@ -825,6 +825,165 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func extattrGetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFd(fd int, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FD, uintptr(fd), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFile(file string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListLink(link string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall6(SYS_POSIX_FADVISE, uintptr(fd), uintptr(offset), uintptr(length), uintptr(advice), 0, 0)
 	if e1 != 0 {
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/zsyscall_linux.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/zsyscall_linux.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux.go	2026-10-28 10:49:46.755003706 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux.go	2026-10-28 10:50:37.886748453 +0000
@@ -943,7 +943,7 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Getdents(fd int, buf []byte) (n int, err error) {
+func getdents(fd int, buf []byte) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(buf) > 0 {
 		_p0 = unsafe.Pointer(&buf[0])
@@ -1167,6 +1167,23 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func Listns(req *NsIdReq, nsIds []uint64, flags uint) (n int, err error) {
+	var _p0 unsafe.Pointer
+	if len(nsIds) > 0 {
+		_p0 = unsafe.Pointer(&nsIds[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := Syscall6(SYS_LISTNS, uintptr(unsafe.Pointer(req)), uintptr(_p0), uintptr(len(nsIds)), uintptr(flags), 0, 0)
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Listxattr(path string, dest []byte) (sz int, err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
@@ -1384,6 +1401,16 @@
 	_, _, e1 := Syscall6(SYS_PRCTL, uintptr(option), uintptr(arg2), uintptr(arg3), uintptr(arg4), uintptr(arg5), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func PrctlArg5Ptr(option int, arg2 uintptr, arg3 uintptr, arg4 uintptr, arg5 unsafe.Pointer) (err error) {
+	_, _, e1 := Syscall6(SYS_PRCTL, uintptr(option), uintptr(arg2), uintptr(arg3), uintptr(arg4), uintptr(arg5), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
 	}
 	return
 }
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/zsyscall_linux_sparc64.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/zsyscall_linux_sparc64.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux_sparc64.go	2026-10-28 10:49:46.755003706 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux_sparc64.go	2026-10-28 10:50:37.886748453 +0000
@@ -66,7 +66,7 @@
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fstat(fd int, stat *Stat_t) (err error) {
-	_, _, e1 := Syscall(SYS_FSTAT, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := Syscall(SYS_FSTAT64, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
@@ -183,7 +183,7 @@
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_LSTAT, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := Syscall(SYS_LSTAT64, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
@@ -338,7 +338,7 @@
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_STAT, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := Syscall(SYS_STAT64, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/zsyscall_netbsd_386.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/zsyscall_netbsd_386.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_386.go	2026-10-28 10:49:46.755003706 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_386.go	2026-10-28 10:50:37.886748453 +0000
@@ -802,6 +802,165 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func extattrGetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFd(fd int, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FD, uintptr(fd), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFile(file string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListLink(link string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Faccessat(dirfd int, path string, mode uint32, flags int) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/zsyscall_netbsd_amd64.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/zsyscall_netbsd_amd64.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_amd64.go	2026-10-28 10:49:46.755003706 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_amd64.go	2026-10-28 10:50:37.886748453 +0000
@@ -802,6 +802,165 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func extattrGetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFd(fd int, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FD, uintptr(fd), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFile(file string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListLink(link string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Faccessat(dirfd int, path string, mode uint32, flags int) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm.go	2026-10-28 10:49:46.755003706 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm.go	2026-10-28 10:50:37.886748453 +0000
@@ -802,6 +802,165 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func extattrGetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFd(fd int, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FD, uintptr(fd), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFile(file string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListLink(link string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Faccessat(dirfd int, path string, mode uint32, flags int) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm64.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm64.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm64.go	2026-10-28 10:49:46.755003706 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm64.go	2026-10-28 10:50:37.886748453 +0000
@@ -802,6 +802,165 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func extattrGetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFd(fd int, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFd(fd int, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FD, uintptr(fd), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetFile(file string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListFile(file string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrGetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrSetLink(link string, attrnamespace int, attrname string, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func extattrListLink(link string, attrnamespace int, data unsafe.Pointer, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Faccessat(dirfd int, path string, mode uint32, flags int) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/zsysnum_zos_s390x.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/zsysnum_zos_s390x.go
--- a/vendor/golang.org/x/sys/unix/zsysnum_zos_s390x.go	2026-10-28 10:49:46.763003666 +0000
+++ b/vendor/golang.org/x/sys/unix/zsysnum_zos_s390x.go	2026-10-28 10:50:37.890748434 +0000
@@ -2848,5 +2848,18 @@
 	SYS_____CHATTRAT64_A                = 0xE39 // 3641
 	SYS_MADVISE                         = 0xE3A // 3642
 	SYS___AUTHENTICATE                  = 0xE3B // 3643
+	SYS_GETPWENT_R                      = 0xE3C // 3644
+	SYS___GETPWENT_R_A                  = 0xE3D // 3645
+	SYS_STRNLEN                         = 0xE3E // 3646
+	SYS_STPCPY                          = 0xE3F // 3647
+	SYS_STPNCPY                         = 0xE40 // 3648
+	SYS_STRSIGNAL                       = 0xE41 // 3649
+	SYS_WCPCPY                          = 0xE42 // 3650
+	SYS_WCPNCPY                         = 0xE43 // 3651
+	SYS_WCSNLEN                         = 0xE44 // 3652
+	SYS___STRSIGNAL_A                   = 0xE45 // 3653
+	SYS_FDOPENDIR                       = 0xE46 // 3654
+	SYS_FDCLOSEDIR                      = 0xE47 // 3655
+	SYS_SYSCALL                         = 0xE48 // 3656
 
 )
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/ztypes_linux.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/ztypes_linux.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux.go	2026-10-28 10:49:46.763003666 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux.go	2026-10-28 10:50:37.890748434 +0000
@@ -933,6 +933,29 @@
 
 const SizeofOpenHow = 0x18
 
+type NsIdReq struct {
+	Size       uint32
+	Spare      uint32
+	Ns_id      uint64
+	Ns_type    uint32
+	Spare2     uint32
+	User_ns_id uint64
+}
+
+const (
+	NS_ID_REQ_SIZE_VER0 = 0x20
+	LISTNS_CURRENT_USER = 0xffffffffffffffff
+
+	TIME_NS   = 0x80
+	MNT_NS    = 0x20000
+	CGROUP_NS = 0x2000000
+	UTS_NS    = 0x4000000
+	IPC_NS    = 0x8000000
+	USER_NS   = 0x10000000
+	PID_NS    = 0x20000000
+	NET_NS    = 0x40000000
+)
+
 const (
 	RESOLVE_BENEATH       = 0x8
 	RESOLVE_IN_ROOT       = 0x10
@@ -3579,7 +3602,7 @@
 	DEVLINK_ATTR_LINECARD_SUPPORTED_TYPES              = 0xae
 	DEVLINK_ATTR_NESTED_DEVLINK                        = 0xaf
 	DEVLINK_ATTR_SELFTESTS                             = 0xb0
-	DEVLINK_ATTR_MAX                                   = 0xb7
+	DEVLINK_ATTR_MAX                                   = 0xb9
 	DEVLINK_DPIPE_FIELD_MAPPING_TYPE_NONE              = 0x0
 	DEVLINK_DPIPE_FIELD_MAPPING_TYPE_IFINDEX           = 0x1
 	DEVLINK_DPIPE_MATCH_TYPE_FIELD_EXACT               = 0x0
@@ -4101,7 +4124,7 @@
 	ETHTOOL_A_COALESCE_RATE_SAMPLE_INTERVAL   = 0x17
 	ETHTOOL_A_COALESCE_USE_CQE_MODE_TX        = 0x18
 	ETHTOOL_A_COALESCE_USE_CQE_MODE_RX        = 0x19
-	ETHTOOL_A_COALESCE_MAX                    = 0x1e
+	ETHTOOL_A_COALESCE_MAX                    = 0x20
 	ETHTOOL_A_PAUSE_UNSPEC                    = 0x0
 	ETHTOOL_A_PAUSE_HEADER                    = 0x1
 	ETHTOOL_A_PAUSE_AUTONEG                   = 0x2
@@ -4113,7 +4136,7 @@
 	ETHTOOL_A_PAUSE_STAT_PAD                  = 0x1
 	ETHTOOL_A_PAUSE_STAT_TX_FRAMES            = 0x2
 	ETHTOOL_A_PAUSE_STAT_RX_FRAMES            = 0x3
-	ETHTOOL_A_PAUSE_STAT_MAX                  = 0x3
+	ETHTOOL_A_PAUSE_STAT_MAX                  = 0x4
 	ETHTOOL_A_EEE_UNSPEC                      = 0x0
 	ETHTOOL_A_EEE_HEADER                      = 0x1
 	ETHTOOL_A_EEE_MODES_OURS                  = 0x2
@@ -4537,9 +4560,12 @@
 )
 
 type LandlockRulesetAttr struct {
-	Access_fs  uint64
-	Access_net uint64
-	Scoped     uint64
+	Handled_access_fs  uint64
+	Handled_access_net uint64
+	Scoped             uint64
+	Quiet_access_fs    uint64
+	Quiet_access_net   uint64
+	Quiet_scoped       uint64
 }
 
 type LandlockPathBeneathAttr struct {
@@ -4569,28 +4595,31 @@
 	PIDFD_COREDUMP_USER        = 0x4
 	PIDFD_COREDUMP_ROOT        = 0x8
 	PIDFD_INFO_SIZE_VER0       = 0x40
-	PIDFD_GET_INFO             = 0xc048ff0b
+	PIDFD_GET_INFO             = 0xc058ff0b
 )
 
-const SizeofPidfdInfo = 0x48
+const SizeofPidfdInfo = 0x58
 
 type PidfdInfo struct {
-	Mask          uint64
-	Cgroupid      uint64
-	Pid           uint32
-	Tgid          uint32
-	Ppid          uint32
-	Ruid          uint32
-	Rgid          uint32
-	Euid          uint32
-	Egid          uint32
-	Suid          uint32
-	Sgid          uint32
-	Fsuid         uint32
-	Fsgid         uint32
-	Exit_code     int32
-	Coredump_mask uint32
-	_             uint32
+	Mask            uint64
+	Cgroupid        uint64
+	Pid             uint32
+	Tgid            uint32
+	Ppid            uint32
+	Ruid            uint32
+	Rgid            uint32
+	Euid            uint32
+	Egid            uint32
+	Suid            uint32
+	Sgid            uint32
+	Fsuid           uint32
+	Fsgid           uint32
+	Exit_code       int32
+	Coredump_mask   uint32
+	Coredump_signal uint32
+	Coredump_code   uint32
+	Coredump_pad    uint32
+	Supported_mask  uint64
 }
 
 const (
@@ -4932,7 +4961,7 @@
 	NL80211_ATTR_MAC_HINT                                   = 0xc8
 	NL80211_ATTR_MAC_MASK                                   = 0xd7
 	NL80211_ATTR_MAX_AP_ASSOC_STA                           = 0xca
-	NL80211_ATTR_MAX                                        = 0x15c
+	NL80211_ATTR_MAX                                        = 0x16e
 	NL80211_ATTR_MAX_CRIT_PROT_DURATION                     = 0xb4
 	NL80211_ATTR_MAX_CSA_COUNTERS                           = 0xce
 	NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS                     = 0x143
@@ -5147,12 +5176,12 @@
 	NL80211_ATTR_WOWLAN_TRIGGERS                            = 0x75
 	NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED                  = 0x76
 	NL80211_ATTR_WPA_VERSIONS                               = 0x4b
-	NL80211_AUTHTYPE_AUTOMATIC                              = 0x9
+	NL80211_AUTHTYPE_AUTOMATIC                              = 0xa
 	NL80211_AUTHTYPE_FILS_PK                                = 0x7
 	NL80211_AUTHTYPE_FILS_SK                                = 0x5
 	NL80211_AUTHTYPE_FILS_SK_PFS                            = 0x6
 	NL80211_AUTHTYPE_FT                                     = 0x2
-	NL80211_AUTHTYPE_MAX                                    = 0x8
+	NL80211_AUTHTYPE_MAX                                    = 0x9
 	NL80211_AUTHTYPE_NETWORK_EAP                            = 0x3
 	NL80211_AUTHTYPE_OPEN_SYSTEM                            = 0x0
 	NL80211_AUTHTYPE_SAE                                    = 0x4
@@ -5320,7 +5349,7 @@
 	NL80211_CMD_LEAVE_MESH                                  = 0x45
 	NL80211_CMD_LEAVE_OCB                                   = 0x6d
 	NL80211_CMD_LINKS_REMOVED                               = 0x9a
-	NL80211_CMD_MAX                                         = 0x9f
+	NL80211_CMD_MAX                                         = 0xa7
 	NL80211_CMD_MICHAEL_MIC_FAILURE                         = 0x29
 	NL80211_CMD_MODIFY_LINK_STA                             = 0x97
 	NL80211_CMD_NAN_MATCH                                   = 0x78
@@ -5566,7 +5595,7 @@
 	NL80211_FREQUENCY_ATTR_GO_CONCURRENT                    = 0xf
 	NL80211_FREQUENCY_ATTR_INDOOR_ONLY                      = 0xe
 	NL80211_FREQUENCY_ATTR_IR_CONCURRENT                    = 0xf
-	NL80211_FREQUENCY_ATTR_MAX                              = 0x27
+	NL80211_FREQUENCY_ATTR_MAX                              = 0x29
 	NL80211_FREQUENCY_ATTR_MAX_TX_POWER                     = 0x6
 	NL80211_FREQUENCY_ATTR_NO_10MHZ                         = 0x11
 	NL80211_FREQUENCY_ATTR_NO_160MHZ                        = 0xc
@@ -5639,7 +5668,7 @@
 	NL80211_IFTYPE_AKM_ATTR_SUITES                          = 0x2
 	NL80211_IFTYPE_AP                                       = 0x3
 	NL80211_IFTYPE_AP_VLAN                                  = 0x4
-	NL80211_IFTYPE_MAX                                      = 0xc
+	NL80211_IFTYPE_MAX                                      = 0xe
 	NL80211_IFTYPE_MESH_POINT                               = 0x7
 	NL80211_IFTYPE_MONITOR                                  = 0x6
 	NL80211_IFTYPE_NAN                                      = 0xc
@@ -5664,7 +5693,7 @@
 	NL80211_KEY_DEFAULT_TYPES                               = 0x8
 	NL80211_KEY_DEFAULT_TYPE_UNICAST                        = 0x1
 	NL80211_KEY_IDX                                         = 0x2
-	NL80211_KEY_MAX                                         = 0xa
+	NL80211_KEY_MAX                                         = 0xb
 	NL80211_KEY_MODE                                        = 0x9
 	NL80211_KEY_NO_TX                                       = 0x1
 	NL80211_KEY_RX_TX                                       = 0x0
@@ -5822,7 +5851,7 @@
 	NL80211_PMKSA_CANDIDATE_BSSID                           = 0x2
 	NL80211_PMKSA_CANDIDATE_INDEX                           = 0x1
 	NL80211_PMKSA_CANDIDATE_PREAUTH                         = 0x3
-	NL80211_PMSR_ATTR_MAX                                   = 0x5
+	NL80211_PMSR_ATTR_MAX                                   = 0x7
 	NL80211_PMSR_ATTR_MAX_PEERS                             = 0x1
 	NL80211_PMSR_ATTR_PEERS                                 = 0x5
 	NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR                    = 0x3
@@ -5831,7 +5860,7 @@
 	NL80211_PMSR_FTM_CAPA_ATTR_ASAP                         = 0x1
 	NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS                   = 0x6
 	NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT          = 0x7
-	NL80211_PMSR_FTM_CAPA_ATTR_MAX                          = 0x12
+	NL80211_PMSR_FTM_CAPA_ATTR_MAX                          = 0x1f
 	NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST           = 0x8
 	NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP                     = 0x2
 	NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED            = 0xa
@@ -5853,7 +5882,7 @@
 	NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD                  = 0x4
 	NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST                = 0x6
 	NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK                  = 0xc
-	NL80211_PMSR_FTM_REQ_ATTR_MAX                           = 0xe
+	NL80211_PMSR_FTM_REQ_ATTR_MAX                           = 0x17
 	NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED             = 0xb
 	NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP                = 0x3
 	NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES              = 0x7
@@ -5871,7 +5900,7 @@
 	NL80211_PMSR_FTM_RESP_ATTR_FAIL_REASON                  = 0x1
 	NL80211_PMSR_FTM_RESP_ATTR_FTMS_PER_BURST               = 0x8
 	NL80211_PMSR_FTM_RESP_ATTR_LCI                          = 0x13
-	NL80211_PMSR_FTM_RESP_ATTR_MAX                          = 0x16
+	NL80211_PMSR_FTM_RESP_ATTR_MAX                          = 0x21
 	NL80211_PMSR_FTM_RESP_ATTR_NUM_BURSTS_EXP               = 0x6
 	NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_ATTEMPTS            = 0x3
 	NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_SUCCESSES           = 0x4
@@ -5885,7 +5914,7 @@
 	NL80211_PMSR_FTM_RESP_ATTR_TX_RATE                      = 0xb
 	NL80211_PMSR_PEER_ATTR_ADDR                             = 0x1
 	NL80211_PMSR_PEER_ATTR_CHAN                             = 0x2
-	NL80211_PMSR_PEER_ATTR_MAX                              = 0x4
+	NL80211_PMSR_PEER_ATTR_MAX                              = 0x5
 	NL80211_PMSR_PEER_ATTR_REQ                              = 0x3
 	NL80211_PMSR_PEER_ATTR_RESP                             = 0x4
 	NL80211_PMSR_REQ_ATTR_DATA                              = 0x1
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/ztypes_linux_386.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/ztypes_linux_386.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_386.go	2026-10-28 10:49:46.763003666 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_386.go	2026-10-28 10:50:37.890748434 +0000
@@ -163,6 +163,11 @@
 	Flags      int32
 }
 
+type Mmsghdr struct {
+	Hdr Msghdr
+	Len uint32
+}
+
 type Cmsghdr struct {
 	Len   uint32
 	Level int32
@@ -178,6 +183,7 @@
 	SizeofSockaddrNFCLLCP = 0x58
 	SizeofIovec           = 0x8
 	SizeofMsghdr          = 0x1c
+	SizeofMmsghdr         = 0x20
 	SizeofCmsghdr         = 0xc
 )
 
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/ztypes_linux_amd64.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/ztypes_linux_amd64.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_amd64.go	2026-10-28 10:49:46.763003666 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_amd64.go	2026-10-28 10:50:37.890748434 +0000
@@ -166,6 +166,12 @@
 	_          [4]byte
 }
 
+type Mmsghdr struct {
+	Hdr Msghdr
+	Len uint32
+	_   [4]byte
+}
+
 type Cmsghdr struct {
 	Len   uint64
 	Level int32
@@ -181,6 +187,7 @@
 	SizeofSockaddrNFCLLCP = 0x60
 	SizeofIovec           = 0x10
 	SizeofMsghdr          = 0x38
+	SizeofMmsghdr         = 0x40
 	SizeofCmsghdr         = 0x10
 )
 
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/ztypes_linux_arm.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/ztypes_linux_arm.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_arm.go	2026-10-28 10:49:46.763003666 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_arm.go	2026-10-28 10:50:37.890748434 +0000
@@ -169,6 +169,11 @@
 	Flags      int32
 }
 
+type Mmsghdr struct {
+	Hdr Msghdr
+	Len uint32
+}
+
 type Cmsghdr struct {
 	Len   uint32
 	Level int32
@@ -184,6 +189,7 @@
 	SizeofSockaddrNFCLLCP = 0x58
 	SizeofIovec           = 0x8
 	SizeofMsghdr          = 0x1c
+	SizeofMmsghdr         = 0x20
 	SizeofCmsghdr         = 0xc
 )
 
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/ztypes_linux_arm64.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/ztypes_linux_arm64.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_arm64.go	2026-10-28 10:49:46.763003666 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_arm64.go	2026-10-28 10:50:37.890748434 +0000
@@ -167,6 +167,12 @@
 	_          [4]byte
 }
 
+type Mmsghdr struct {
+	Hdr Msghdr
+	Len uint32
+	_   [4]byte
+}
+
 type Cmsghdr struct {
 	Len   uint64
 	Level int32
@@ -182,6 +188,7 @@
 	SizeofSockaddrNFCLLCP = 0x60
 	SizeofIovec           = 0x10
 	SizeofMsghdr          = 0x38
+	SizeofMmsghdr         = 0x40
 	SizeofCmsghdr         = 0x10
 )
 
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/ztypes_linux_loong64.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/ztypes_linux_loong64.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_loong64.go	2026-10-28 10:49:46.763003666 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_loong64.go	2026-10-28 10:50:37.890748434 +0000
@@ -167,6 +167,12 @@
 	_          [4]byte
 }
 
+type Mmsghdr struct {
+	Hdr Msghdr
+	Len uint32
+	_   [4]byte
+}
+
 type Cmsghdr struct {
 	Len   uint64
 	Level int32
@@ -182,6 +188,7 @@
 	SizeofSockaddrNFCLLCP = 0x60
 	SizeofIovec           = 0x10
 	SizeofMsghdr          = 0x38
+	SizeofMmsghdr         = 0x40
 	SizeofCmsghdr         = 0x10
 )
 
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/ztypes_linux_mips.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/ztypes_linux_mips.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_mips.go	2026-10-28 10:49:46.763003666 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_mips.go	2026-10-28 10:50:37.890748434 +0000
@@ -168,6 +168,11 @@
 	Flags      int32
 }
 
+type Mmsghdr struct {
+	Hdr Msghdr
+	Len uint32
+}
+
 type Cmsghdr struct {
 	Len   uint32
 	Level int32
@@ -183,6 +188,7 @@
 	SizeofSockaddrNFCLLCP = 0x58
 	SizeofIovec           = 0x8
 	SizeofMsghdr          = 0x1c
+	SizeofMmsghdr         = 0x20
 	SizeofCmsghdr         = 0xc
 )
 
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/ztypes_linux_mips64.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/ztypes_linux_mips64.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_mips64.go	2026-10-28 10:49:46.763003666 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_mips64.go	2026-10-28 10:50:37.890748434 +0000
@@ -167,6 +167,12 @@
 	_          [4]byte
 }
 
+type Mmsghdr struct {
+	Hdr Msghdr
+	Len uint32
+	_   [4]byte
+}
+
 type Cmsghdr struct {
 	Len   uint64
 	Level int32
@@ -182,6 +188,7 @@
 	SizeofSockaddrNFCLLCP = 0x60
 	SizeofIovec           = 0x10
 	SizeofMsghdr          = 0x38
+	SizeofMmsghdr         = 0x40
 	SizeofCmsghdr         = 0x10
 )
 
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.go	2026-10-28 10:49:46.763003666 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.go	2026-10-28 10:50:37.890748434 +0000
@@ -167,6 +167,12 @@
 	_          [4]byte
 }
 
+type Mmsghdr struct {
+	Hdr Msghdr
+	Len uint32
+	_   [4]byte
+}
+
 type Cmsghdr struct {
 	Len   uint64
 	Level int32
@@ -182,6 +188,7 @@
 	SizeofSockaddrNFCLLCP = 0x60
 	SizeofIovec           = 0x10
 	SizeofMsghdr          = 0x38
+	SizeofMmsghdr         = 0x40
 	SizeofCmsghdr         = 0x10
 )
 
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.go	2026-10-28 10:49:46.763003666 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.go	2026-10-28 10:50:37.890748434 +0000
@@ -168,6 +168,11 @@
 	Flags      int32
 }
 
+type Mmsghdr struct {
+	Hdr Msghdr
+	Len uint32
+}
+
 type Cmsghdr struct {
 	Len   uint32
 	Level int32
@@ -183,6 +188,7 @@
 	SizeofSockaddrNFCLLCP = 0x58
 	SizeofIovec           = 0x8
 	SizeofMsghdr          = 0x1c
+	SizeofMmsghdr         = 0x20
 	SizeofCmsghdr         = 0xc
 )
 
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/ztypes_linux_ppc.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/ztypes_linux_ppc.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_ppc.go	2026-10-28 10:49:46.763003666 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_ppc.go	2026-10-28 10:50:37.890748434 +0000
@@ -169,6 +169,11 @@
 	Flags      int32
 }
 
+type Mmsghdr struct {
+	Hdr Msghdr
+	Len uint32
+}
+
 type Cmsghdr struct {
 	Len   uint32
 	Level int32
@@ -184,6 +189,7 @@
 	SizeofSockaddrNFCLLCP = 0x58
 	SizeofIovec           = 0x8
 	SizeofMsghdr          = 0x1c
+	SizeofMmsghdr         = 0x20
 	SizeofCmsghdr         = 0xc
 )
 
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.go	2026-10-28 10:49:46.763003666 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.go	2026-10-28 10:50:37.890748434 +0000
@@ -168,6 +168,12 @@
 	_          [4]byte
 }
 
+type Mmsghdr struct {
+	Hdr Msghdr
+	Len uint32
+	_   [4]byte
+}
+
 type Cmsghdr struct {
 	Len   uint64
 	Level int32
@@ -183,6 +189,7 @@
 	SizeofSockaddrNFCLLCP = 0x60
 	SizeofIovec           = 0x10
 	SizeofMsghdr          = 0x38
+	SizeofMmsghdr         = 0x40
 	SizeofCmsghdr         = 0x10
 )
 
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.go	2026-10-28 10:49:46.763003666 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.go	2026-10-28 10:50:37.890748434 +0000
@@ -168,6 +168,12 @@
 	_          [4]byte
 }
 
+type Mmsghdr struct {
+	Hdr Msghdr
+	Len uint32
+	_   [4]byte
+}
+
 type Cmsghdr struct {
 	Len   uint64
 	Level int32
@@ -183,6 +189,7 @@
 	SizeofSockaddrNFCLLCP = 0x60
 	SizeofIovec           = 0x10
 	SizeofMsghdr          = 0x38
+	SizeofMmsghdr         = 0x40
 	SizeofCmsghdr         = 0x10
 )
 
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go	2026-10-28 10:49:46.763003666 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go	2026-10-28 10:50:37.890748434 +0000
@@ -167,6 +167,12 @@
 	_          [4]byte
 }
 
+type Mmsghdr struct {
+	Hdr Msghdr
+	Len uint32
+	_   [4]byte
+}
+
 type Cmsghdr struct {
 	Len   uint64
 	Level int32
@@ -182,6 +188,7 @@
 	SizeofSockaddrNFCLLCP = 0x60
 	SizeofIovec           = 0x10
 	SizeofMsghdr          = 0x38
+	SizeofMmsghdr         = 0x40
 	SizeofCmsghdr         = 0x10
 )
 
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/ztypes_linux_s390x.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/ztypes_linux_s390x.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_s390x.go	2026-10-28 10:49:46.763003666 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_s390x.go	2026-10-28 10:50:37.890748434 +0000
@@ -166,6 +166,12 @@
 	_          [4]byte
 }
 
+type Mmsghdr struct {
+	Hdr Msghdr
+	Len uint32
+	_   [4]byte
+}
+
 type Cmsghdr struct {
 	Len   uint64
 	Level int32
@@ -181,6 +187,7 @@
 	SizeofSockaddrNFCLLCP = 0x60
 	SizeofIovec           = 0x10
 	SizeofMsghdr          = 0x38
+	SizeofMmsghdr         = 0x40
 	SizeofCmsghdr         = 0x10
 )
 
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.go	2026-10-28 10:49:46.767003646 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.go	2026-10-28 10:50:37.894748414 +0000
@@ -84,22 +84,20 @@
 
 type Stat_t struct {
 	Dev     uint64
-	_       uint16
 	Ino     uint64
+	Nlink   uint64
 	Mode    uint32
-	Nlink   uint32
 	Uid     uint32
 	Gid     uint32
+	_       uint32
 	Rdev    uint64
-	_       uint16
 	Size    int64
 	Blksize int64
 	Blocks  int64
 	Atim    Timespec
 	Mtim    Timespec
 	Ctim    Timespec
-	_       uint64
-	_       uint64
+	_       [3]int64
 }
 
 type Dirent struct {
@@ -170,6 +168,12 @@
 	_          [4]byte
 }
 
+type Mmsghdr struct {
+	Hdr Msghdr
+	Len uint32
+	_   [4]byte
+}
+
 type Cmsghdr struct {
 	Len   uint64
 	Level int32
@@ -185,6 +189,7 @@
 	SizeofSockaddrNFCLLCP = 0x60
 	SizeofIovec           = 0x10
 	SizeofMsghdr          = 0x38
+	SizeofMmsghdr         = 0x40
 	SizeofCmsghdr         = 0x10
 )
 
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/unix/ztypes_zos_s390x.go /work/src/docker-registry/vendor/golang.org/x/sys/unix/ztypes_zos_s390x.go
--- a/vendor/golang.org/x/sys/unix/ztypes_zos_s390x.go	2026-10-28 10:49:46.767003646 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_zos_s390x.go	2026-10-28 10:50:37.894748414 +0000
@@ -209,6 +209,84 @@
 	Total_retrans  uint32
 }
 
+// Ptrace structures for z/OS
+
+type PtraceRegs struct {
+	Psw                      PtracePsw
+	Gprs                     [16]uint64
+	Acrs                     [16]uint32
+	Orig_gpr2                uint64
+	Fp_regs                  PtraceFpregs
+	Per_info                 PtracePer
+	Ieee_instruction_pointer uint64
+}
+
+type PtracePsw struct {
+	Mask uint64
+	Addr uint64
+}
+
+type PtraceFpregs struct {
+	Fpc  uint32
+	Fprs [16]float64
+}
+
+type PtracePer struct {
+	Control_regs  [3]uint64
+	_             [8]byte
+	Starting_addr uint64
+	Ending_addr   uint64
+	Perc_atmid    uint16
+	Address       uint64
+	Access_id     uint8
+	_             [7]byte
+}
+
+// PT_BLOCKREQ structures for block ptrace requests
+// Layout matches BPXYPTRC HLASM macro (PtBR_GPR + PtBR_GPR_EXT):
+//
+//	Offset 0-1:    Writebitflags (PtBR_GPR_CntlGPR, 2 bytes)
+//	Offset 2-3:    Wpsw (PtBR_GPR_CntlMisc, 2 bytes with WPSW bit flag)
+//	Offset 4-15:   Reserved (12 bytes)
+//	Offset 16-79:  Gpr (64 bytes, 16 GPRs)
+//	Offset 80-143: Ctl (64 bytes, 16 CRs)
+//	Offset 144-151: Psw old format (8 bytes, PtBR_GPR_PSW)
+//	Offset 152-167: Pswg extended (16 bytes, PtBR_GPR_PSWG for 64-bit)
+//	Total: 168 bytes (base 152 + extended 16)
+type PtraceBlkGpr struct {
+	Writebitflags uint16     // 2 bytes at offset 0 (PtBR_GPR_CntlGPR)
+	Wpsw          uint16     // 2 bytes at offset 2 (PtBR_GPR_CntlMisc with WPSW flag)
+	_             [12]byte   // 12 bytes reserved (offset 4-15)
+	Gpr           [16]uint32 // 64 bytes at offset 16 (GPRs)
+	Ctl           [16]uint32 // 64 bytes at offset 80 (CRs)
+	Psw           [8]byte    // 8 bytes at offset 144 (old PSW format)
+	Pswg          [16]byte   // 16 bytes at offset 152 (extended PSWG)
+	// Total: 2+2+12+64+64+8+16 = 168 bytes
+}
+
+type PtraceBlkReqReq struct {
+	Reqtype int32
+	Reqstat int32
+	Reqdata uint32
+	_       [4]byte
+}
+
+type PtraceBlkReq struct {
+	Numreq int32
+	_      [12]byte
+}
+
+// PT_READ_U structures for reading user area (control info)
+type PtraceBlkUarOcw struct {
+	Ofs uint32 // Control information offset
+	Ctl uint32 // Control information
+}
+
+type PtraceBlkUar struct {
+	Num uint32 // Number of entries
+	_   [4]byte
+}
+
 type _Gid_t uint32
 
 type rusage_zos struct {
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/sys/windows/types_windows_arm.go /work/src/docker-registry/vendor/golang.org/x/sys/windows/types_windows_arm.go
--- a/vendor/golang.org/x/sys/windows/types_windows_arm.go	2026-10-28 10:49:46.767003646 +0000
+++ b/vendor/golang.org/x/sys/windows/types_windows_arm.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,35 +0,0 @@
-// Copyright 2018 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package windows
-
-type WSAData struct {
-	Version      uint16
-	HighVersion  uint16
-	Description  [WSADESCRIPTION_LEN + 1]byte
-	SystemStatus [WSASYS_STATUS_LEN + 1]byte
-	MaxSockets   uint16
-	MaxUdpDg     uint16
-	VendorInfo   *byte
-}
-
-type Servent struct {
-	Name    *byte
-	Aliases **byte
-	Port    uint16
-	Proto   *byte
-}
-
-type JOBOBJECT_BASIC_LIMIT_INFORMATION struct {
-	PerProcessUserTimeLimit int64
-	PerJobUserTimeLimit     int64
-	LimitFlags              uint32
-	MinimumWorkingSetSize   uintptr
-	MaximumWorkingSetSize   uintptr
-	ActiveProcessLimit      uint32
-	Affinity                uintptr
-	PriorityClass           uint32
-	SchedulingClass         uint32
-	_                       uint32 // pad to 8 byte boundary
-}
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/text/secure/bidirule/bidirule.go /work/src/docker-registry/vendor/golang.org/x/text/secure/bidirule/bidirule.go
--- a/vendor/golang.org/x/text/secure/bidirule/bidirule.go	2026-10-28 10:49:46.771003626 +0000
+++ b/vendor/golang.org/x/text/secure/bidirule/bidirule.go	2026-10-28 10:50:37.958748098 +0000
@@ -10,6 +10,7 @@
 
 import (
 	"errors"
+	"sync"
 	"unicode/utf8"
 
 	"golang.org/x/text/transform"
@@ -246,8 +247,9 @@
 // Precomputing the ASCII values decreases running time for the ASCII fast path
 // by about 30%.
 var asciiTable [128]bidi.Properties
+var asciiTableOnce sync.Once
 
-func init() {
+func initASCIITable() {
 	for i := range asciiTable {
 		p, _ := bidi.LookupRune(rune(i))
 		asciiTable[i] = p
@@ -255,6 +257,8 @@
 }
 
 func (t *Transformer) advance(s []byte) (n int, ok bool) {
+	asciiTableOnce.Do(initASCIITable)
+
 	var e bidi.Properties
 	var sz int
 	for n < len(s) {
@@ -297,6 +301,8 @@
 }
 
 func (t *Transformer) advanceString(s string) (n int, ok bool) {
+	asciiTableOnce.Do(initASCIITable)
+
 	var e bidi.Properties
 	var sz int
 	for n < len(s) {
diff -Nur /work/src-orig/docker-registry/vendor/golang.org/x/text/unicode/bidi/core.go /work/src/docker-registry/vendor/golang.org/x/text/unicode/bidi/core.go
--- a/vendor/golang.org/x/text/unicode/bidi/core.go	2026-10-28 10:49:46.771003626 +0000
+++ b/vendor/golang.org/x/text/unicode/bidi/core.go	2026-10-28 10:50:37.958748098 +0000
@@ -208,27 +208,23 @@
 		p.matchingIsolateInitiator[i] = -1
 	}
 
+	var open []int
 	for i := range p.matchingPDI {
 		p.matchingPDI[i] = -1
 
-		if t := p.resultTypes[i]; t.in(LRI, RLI, FSI) {
-			depthCounter := 1
-			for j := i + 1; j < p.Len(); j++ {
-				if u := p.resultTypes[j]; u.in(LRI, RLI, FSI) {
-					depthCounter++
-				} else if u == PDI {
-					if depthCounter--; depthCounter == 0 {
-						p.matchingPDI[i] = j
-						p.matchingIsolateInitiator[j] = i
-						break
-					}
-				}
-			}
-			if p.matchingPDI[i] == -1 {
-				p.matchingPDI[i] = p.Len()
-			}
+		switch t := p.resultTypes[i]; {
+		case t.in(LRI, RLI, FSI):
+			open = append(open, i)
+		case t == PDI && len(open) > 0:
+			j := open[len(open)-1]
+			open = open[:len(open)-1]
+			p.matchingPDI[j] = i
+			p.matchingIsolateInitiator[i] = j
 		}
 	}
+	for _, i := range open {
+		p.matchingPDI[i] = p.Len()
+	}
 }
 
 // determineParagraphEmbeddingLevel reports the resolved paragraph direction of
@@ -496,16 +492,13 @@
 
 	// Rule W2.
 	// EN does not change at the start of the run, because sos != AL.
+	lastStrong := unknownClass
 	for i, t := range s.types {
-		if t == EN {
-			for j := i - 1; j >= 0; j-- {
-				if t := s.types[j]; t.in(L, R, AL) {
-					if t == AL {
-						s.types[i] = AN
-					}
-					break
-				}
-			}
+		switch {
+		case t.in(L, R, AL):
+			lastStrong = t
+		case t == EN && lastStrong == AL:
+			s.types[i] = AN
 		}
 	}
 
@@ -543,29 +536,30 @@
 	}
 
 	// Rule W5.
-	for i, t := range s.types {
-		if t == ET {
-			// locate end of sequence
-			runStart := i
-			runEnd := s.findRunLimit(runStart, ET)
-
-			// check values at ends of sequence
-			t := s.sos
-			if runStart > 0 {
-				t = s.types[runStart-1]
+	for i := 0; i < len(s.types); i++ {
+		if s.types[i] != ET {
+			continue
+		}
+		// locate end of sequence
+		runStart := i
+		runEnd := s.findRunLimit(runStart, ET)
+
+		// check values at ends of sequence
+		t := s.sos
+		if runStart > 0 {
+			t = s.types[runStart-1]
+		}
+		if t != EN {
+			t = s.eos
+			if runEnd < len(s.types) {
+				t = s.types[runEnd]
 			}
-			if t != EN {
-				t = s.eos
-				if runEnd < len(s.types) {
-					t = s.types[runEnd]
-				}
-			}
-			if t == EN {
-				setTypes(s.types[runStart:runEnd], EN)
-			}
-			// continue at end of sequence
-			i = runEnd
 		}
+		if t == EN {
+			setTypes(s.types[runStart:runEnd], EN)
+		}
+		// continue at end of sequence
+		i = runEnd
 	}
 
 	// Rule W6.
@@ -576,20 +570,13 @@
 	}
 
 	// Rule W7.
+	prevStrongType := s.sos
 	for i, t := range s.types {
-		if t == EN {
-			// set default if we reach start of run
-			prevStrongType := s.sos
-			for j := i - 1; j >= 0; j-- {
-				t = s.types[j]
-				if t == L || t == R { // AL's have been changed to R
-					prevStrongType = t
-					break
-				}
-			}
-			if prevStrongType == L {
-				s.types[i] = L
-			}
+		switch {
+		case t == L || t == R: // AL's have been changed to R
+			prevStrongType = t
+		case t == EN && prevStrongType == L:
+			s.types[i] = L
 		}
 	}
 }
diff -Nur /work/src-orig/docker-registry/vendor/modules.txt /work/src/docker-registry/vendor/modules.txt
--- a/vendor/modules.txt	2026-10-28 10:49:46.867003143 +0000
+++ b/vendor/modules.txt	2026-10-28 10:50:38.490745472 +0000
@@ -291,7 +291,7 @@
 # github.com/felixge/httpsnoop v1.0.4
 ## explicit; go 1.13
 github.com/felixge/httpsnoop
-# github.com/go-jose/go-jose/v4 v4.1.4
+# github.com/go-jose/go-jose/v4 v4.1.4 => github.com/go-jose/go-jose/v4 v4.1.6
 ## explicit; go 1.24.0
 github.com/go-jose/go-jose/v4
 github.com/go-jose/go-jose/v4/cipher
@@ -372,8 +372,8 @@
 # github.com/jmespath/go-jmespath v0.4.0
 ## explicit; go 1.14
 github.com/jmespath/go-jmespath
-# github.com/klauspost/compress v1.18.4
-## explicit; go 1.23
+# github.com/klauspost/compress v1.18.4 => github.com/klauspost/compress v1.18.7
+## explicit; go 1.24
 github.com/klauspost/compress
 github.com/klauspost/compress/fse
 github.com/klauspost/compress/huff0
@@ -566,11 +566,11 @@
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp/internal/oconf
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp/internal/retry
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp/internal/transform
-# go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0
+# go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 => go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0
 ## explicit; go 1.25.0
 go.opentelemetry.io/otel/exporters/otlp/otlptrace
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform
-# go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0
+# go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 => go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0
 ## explicit; go 1.25.0
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal
@@ -580,7 +580,7 @@
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/retry
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/x
-# go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0
+# go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 => go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.45.0
 ## explicit; go 1.25.0
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal
@@ -679,7 +679,7 @@
 # go.yaml.in/yaml/v3 v3.0.5
 ## explicit; go 1.16
 go.yaml.in/yaml/v3
-# golang.org/x/crypto v0.57.0
+# golang.org/x/crypto v0.58.0
 ## explicit; go 1.26.0
 golang.org/x/crypto/acme
 golang.org/x/crypto/acme/autocert
@@ -694,7 +694,7 @@
 golang.org/x/crypto/internal/poly1305
 golang.org/x/crypto/pkcs12
 golang.org/x/crypto/pkcs12/internal/rc2
-# golang.org/x/net v0.59.0
+# golang.org/x/net v0.60.0 => golang.org/x/net v0.62.0
 ## explicit; go 1.26.0
 golang.org/x/net/http/httpguts
 golang.org/x/net/http2
@@ -717,17 +717,17 @@
 golang.org/x/oauth2/internal
 golang.org/x/oauth2/jws
 golang.org/x/oauth2/jwt
-# golang.org/x/sync v0.23.0
+# golang.org/x/sync v0.24.0
 ## explicit; go 1.26.0
 golang.org/x/sync/errgroup
 golang.org/x/sync/semaphore
-# golang.org/x/sys v0.48.0
+# golang.org/x/sys v0.49.0
 ## explicit; go 1.26.0
 golang.org/x/sys/cpu
 golang.org/x/sys/unix
 golang.org/x/sys/windows
 golang.org/x/sys/windows/registry
-# golang.org/x/text v0.42.0
+# golang.org/x/text v0.43.0
 ## explicit; go 1.26.0
 golang.org/x/text/secure/bidirule
 golang.org/x/text/transform
@@ -978,3 +978,9 @@
 google.golang.org/protobuf/types/known/structpb
 google.golang.org/protobuf/types/known/timestamppb
 google.golang.org/protobuf/types/known/wrapperspb
+# github.com/go-jose/go-jose/v4 => github.com/go-jose/go-jose/v4 v4.1.6
+# github.com/klauspost/compress => github.com/klauspost/compress v1.18.7
+# go.opentelemetry.io/otel/exporters/otlp/otlptrace => go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0
+# go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc => go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0
+# go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp => go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.45.0
+# golang.org/x/net => golang.org/x/net v0.62.0
