Enable quicker shutdown

Reduces default grace period from 30s to 5s for removing functions. The healthcheck_interval env-var can be used to override the value and set it higher. Signed-off-by: Alex Ellis (OpenFaaS Ltd) <alexellis2@gmail.com>
2025-06-18 20:16:36 +00:00 · 2023-06-27 12:24:07 +01:00
709 changed files with 13766 additions and 31526 deletions
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@ -18,7 +18,7 @@ jobs:
      - name: Install Go
        uses: actions/setup-go@v2
        with:
-          go-version: 1.21.x
+          go-version: 1.19.x

      - name: test
        run: make test
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@ -15,7 +15,7 @@ jobs:
      - name: Install Go
        uses: actions/setup-go@v2
        with:
-          go-version: 1.21.x
+          go-version: 1.19.x
      - name: Make publish
        run: make publish
      - name: Upload release binaries
--- a/14
+++ b/14
@ -20,15 +20,11 @@ local:
 test:
 	CGO_ENABLED=0 GOOS=linux go test -mod=vendor -ldflags $(LDFLAGS) ./...

-.PHONY: dist-local
-dist-local:
-	CGO_ENABLED=0 GOOS=linux go build -mod=vendor -ldflags $(LDFLAGS) -o bin/faasd
-
 .PHONY: dist
 dist:
-	CGO_ENABLED=0 GOOS=linux go build -mod=vendor -ldflags $(LDFLAGS) -o bin/faasd
-	CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=7 go build -mod=vendor -ldflags $(LDFLAGS) -o bin/faasd-armhf
-	CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -mod=vendor -ldflags $(LDFLAGS) -o bin/faasd-arm64
+	CGO_ENABLED=0 GOOS=linux go build -mod=vendor -ldflags $(LDFLAGS) -a -installsuffix cgo -o bin/faasd
+	CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=7 go build -mod=vendor -ldflags $(LDFLAGS) -a -installsuffix cgo -o bin/faasd-armhf
+	CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -mod=vendor -ldflags $(LDFLAGS) -a -installsuffix cgo -o bin/faasd-arm64

 .PHONY: hashgen
 hashgen:
@ -74,7 +70,3 @@ test-e2e:
 verify-compose:
 	@echo Verifying docker-compose.yaml images in remote registries && \
 	arkade chart verify --verbose=$(VERBOSE) -f ./docker-compose.yaml
-
-upgrade-compose:
-	@echo Checking for newer images in remote registries && \
-	arkade chart upgrade -f ./docker-compose.yaml --write
--- a/cmd/install.go
+++ b/cmd/install.go
@ -97,7 +97,7 @@ func runInstall(_ *cobra.Command, _ []string) error {
  sudo journalctl -u faasd --lines 100 -f

 Login with:
-  sudo -E cat /var/lib/faasd/secrets/basic-auth-password | faas-cli login -s`)
+  sudo cat /var/lib/faasd/secrets/basic-auth-password | faas-cli login -s`)

 	return nil
 }
--- a/cmd/provider.go
+++ b/cmd/provider.go
@ -32,93 +32,89 @@ func makeProviderCmd() *cobra.Command {

 	command.Flags().String("pull-policy", "Always", `Set to "Always" to force a pull of images upon deployment, or "IfNotPresent" to try to use a cached image.`)

-	command.RunE = runProviderE
+	command.RunE = func(_ *cobra.Command, _ []string) error {
+
+		pullPolicy, flagErr := command.Flags().GetString("pull-policy")
+		if flagErr != nil {
+			return flagErr
+		}
+
+		alwaysPull := false
+		if pullPolicy == "Always" {
+			alwaysPull = true
+		}
+
+		config, providerConfig, err := config.ReadFromEnv(types.OsEnv{})
+		if err != nil {
+			return err
+		}
+
+		log.Printf("faasd-provider starting..\tService Timeout: %s\n", config.WriteTimeout.String())
+		printVersion()
+
+		wd, err := os.Getwd()
+		if err != nil {
+			return err
+		}
+
+		writeHostsErr := ioutil.WriteFile(path.Join(wd, "hosts"),
+			[]byte(`127.0.0.1	localhost`), workingDirectoryPermission)
+
+		if writeHostsErr != nil {
+			return fmt.Errorf("cannot write hosts file: %s", writeHostsErr)
+		}
+
+		writeResolvErr := ioutil.WriteFile(path.Join(wd, "resolv.conf"),
+			[]byte(`nameserver 8.8.8.8`), workingDirectoryPermission)
+
+		if writeResolvErr != nil {
+			return fmt.Errorf("cannot write resolv.conf file: %s", writeResolvErr)
+		}
+
+		cni, err := cninetwork.InitNetwork()
+		if err != nil {
+			return err
+		}
+
+		client, err := containerd.New(providerConfig.Sock)
+		if err != nil {
+			return err
+		}
+
+		defer client.Close()
+
+		invokeResolver := handlers.NewInvokeResolver(client)
+
+		baseUserSecretsPath := path.Join(wd, "secrets")
+		if err := moveSecretsToDefaultNamespaceSecrets(
+			baseUserSecretsPath,
+			faasd.DefaultFunctionNamespace); err != nil {
+			return err
+		}
+
+		bootstrapHandlers := types.FaaSHandlers{
+			FunctionProxy:  proxy.NewHandlerFunc(*config, invokeResolver),
+			DeleteFunction: handlers.MakeDeleteHandler(client, cni),
+			DeployFunction: handlers.MakeDeployHandler(client, cni, baseUserSecretsPath, alwaysPull),
+			FunctionLister: handlers.MakeReadHandler(client),
+			FunctionStatus: handlers.MakeReplicaReaderHandler(client),
+			ScaleFunction:  handlers.MakeReplicaUpdateHandler(client, cni),
+			UpdateFunction: handlers.MakeUpdateHandler(client, cni, baseUserSecretsPath, alwaysPull),
+			Health:         func(w http.ResponseWriter, r *http.Request) {},
+			Info:           handlers.MakeInfoHandler(Version, GitCommit),
+			ListNamespaces: handlers.MakeNamespacesLister(client),
+			Secrets:        handlers.MakeSecretHandler(client.NamespaceService(), baseUserSecretsPath),
+			Logs:           logs.NewLogHandlerFunc(faasdlogs.New(), config.ReadTimeout),
+		}
+
+		log.Printf("Listening on: 0.0.0.0:%d\n", *config.TCPPort)
+		bootstrap.Serve(&bootstrapHandlers, config)
+		return nil
+	}

 	return command
 }

-func runProviderE(cmd *cobra.Command, _ []string) error {
-
-	pullPolicy, flagErr := cmd.Flags().GetString("pull-policy")
-	if flagErr != nil {
-		return flagErr
-	}
-
-	alwaysPull := false
-	if pullPolicy == "Always" {
-		alwaysPull = true
-	}
-
-	config, providerConfig, err := config.ReadFromEnv(types.OsEnv{})
-	if err != nil {
-		return err
-	}
-
-	log.Printf("faasd-provider starting..\tService Timeout: %s\n", config.WriteTimeout.String())
-	printVersion()
-
-	wd, err := os.Getwd()
-	if err != nil {
-		return err
-	}
-
-	writeHostsErr := ioutil.WriteFile(path.Join(wd, "hosts"),
-		[]byte(`127.0.0.1	localhost`), workingDirectoryPermission)
-
-	if writeHostsErr != nil {
-		return fmt.Errorf("cannot write hosts file: %s", writeHostsErr)
-	}
-
-	writeResolvErr := ioutil.WriteFile(path.Join(wd, "resolv.conf"),
-		[]byte(`nameserver 8.8.8.8`), workingDirectoryPermission)
-
-	if writeResolvErr != nil {
-		return fmt.Errorf("cannot write resolv.conf file: %s", writeResolvErr)
-	}
-
-	cni, err := cninetwork.InitNetwork()
-	if err != nil {
-		return err
-	}
-
-	client, err := containerd.New(providerConfig.Sock)
-	if err != nil {
-		return err
-	}
-
-	defer client.Close()
-
-	invokeResolver := handlers.NewInvokeResolver(client)
-
-	baseUserSecretsPath := path.Join(wd, "secrets")
-	if err := moveSecretsToDefaultNamespaceSecrets(
-		baseUserSecretsPath,
-		faasd.DefaultFunctionNamespace); err != nil {
-		return err
-	}
-
-	bootstrapHandlers := types.FaaSHandlers{
-		FunctionProxy:   proxy.NewHandlerFunc(*config, invokeResolver, false),
-		DeleteFunction:  handlers.MakeDeleteHandler(client, cni),
-		DeployFunction:  handlers.MakeDeployHandler(client, cni, baseUserSecretsPath, alwaysPull),
-		FunctionLister:  handlers.MakeReadHandler(client),
-		FunctionStatus:  handlers.MakeReplicaReaderHandler(client),
-		ScaleFunction:   handlers.MakeReplicaUpdateHandler(client, cni),
-		UpdateFunction:  handlers.MakeUpdateHandler(client, cni, baseUserSecretsPath, alwaysPull),
-		Health:          func(w http.ResponseWriter, r *http.Request) {},
-		Info:            handlers.MakeInfoHandler(Version, GitCommit),
-		ListNamespaces:  handlers.MakeNamespacesLister(client),
-		Secrets:         handlers.MakeSecretHandler(client.NamespaceService(), baseUserSecretsPath),
-		Logs:            logs.NewLogHandlerFunc(faasdlogs.New(), config.ReadTimeout),
-		MutateNamespace: handlers.MakeMutateNamespace(client),
-	}
-
-	log.Printf("Listening on: 0.0.0.0:%d\n", *config.TCPPort)
-	bootstrap.Serve(cmd.Context(), &bootstrapHandlers, config)
-	return nil
-
-}
-
 /*
 * Mutiple namespace support was added after release 0.13.0
 * Function will help users to migrate on multiple namespace support of faasd
--- a/cmd/up.go
+++ b/cmd/up.go
@ -92,6 +92,7 @@ func runUp(cmd *cobra.Command, _ []string) error {
 		<-sig

 		log.Printf("Signal received.. shutting down server in %s\n", shutdownTimeout.String())
+
 		err := supervisor.Remove(services)
 		if err != nil {
 			fmt.Println(err)
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@ -2,7 +2,7 @@ version: "3.7"
 services:

  nats:
-    image: docker.io/library/nats-streaming:0.25.6
+    image: docker.io/library/nats-streaming:0.25.3
 # nobody
    user: "65534"
    command:
@ -21,7 +21,7 @@ services:
    #    - "127.0.0.1:8222:8222"

  prometheus:
-    image: docker.io/prom/prometheus:v2.48.1
+    image: docker.io/prom/prometheus:v2.42.0
 # nobody
    user: "65534"
    volumes:
@ -39,7 +39,7 @@ services:
       - "127.0.0.1:9090:9090"

  gateway:
-    image: ghcr.io/openfaas/gateway:0.27.3
+    image: ghcr.io/openfaas/gateway:0.26.3
    environment:
      - basic_auth=true
      - functions_provider_url=http://faasd-provider:8081/
@ -69,7 +69,7 @@ services:
       - "8080:8080"

  queue-worker:
-    image: ghcr.io/openfaas/queue-worker:0.14.1
+    image: ghcr.io/openfaas/queue-worker:0.13.3
    environment:
      - faas_nats_address=nats
      - faas_nats_port=4222
--- a/docs/DEV.md
+++ b/docs/DEV.md
@ -257,7 +257,7 @@ sudo faasd install
 2020/02/17 17:38:06 Writing to: "/var/lib/faasd/secrets/basic-auth-password"
 2020/02/17 17:38:06 Writing to: "/var/lib/faasd/secrets/basic-auth-user"
 Login with:
-  sudo -E cat /var/lib/faasd/secrets/basic-auth-password | faas-cli login -s
+  sudo cat /var/lib/faasd/secrets/basic-auth-password | faas-cli login -s
 ```

 You can now log in either from this machine or a remote machine using the OpenFaaS UI, or CLI.
--- a/go.mod
+++ b/go.mod
@ -1,37 +1,37 @@
 module github.com/openfaas/faasd

-go 1.20
+go 1.19

 require (
-	github.com/alexellis/arkade v0.0.0-20231211105357-97fb24a99b88
+	github.com/alexellis/arkade v0.0.0-20230317160202-4d8f80c5b033
+	github.com/alexellis/go-execute v0.5.0
 	github.com/compose-spec/compose-go v0.0.0-20200528042322-36d8ce368e05
 	github.com/containerd/containerd v1.7.0
 	github.com/containerd/go-cni v1.1.9
 	github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf
-	github.com/docker/cli v24.0.7+incompatible
-	github.com/docker/distribution v2.8.3+incompatible
-	github.com/docker/docker v24.0.7+incompatible // indirect
+	github.com/docker/cli v23.0.1+incompatible
+	github.com/docker/distribution v2.8.2+incompatible
+	github.com/docker/docker v23.0.3+incompatible // indirect
 	github.com/docker/go-units v0.5.0
-	github.com/gorilla/mux v1.8.1
+	github.com/gorilla/mux v1.8.0
 	github.com/morikuni/aec v1.0.0
-	github.com/opencontainers/runtime-spec v1.1.0
-	github.com/openfaas/faas-provider v0.25.0
+	github.com/opencontainers/runtime-spec v1.1.0-rc.1
+	github.com/openfaas/faas-provider v0.21.0
+	github.com/openfaas/faas/gateway v0.0.0-20230317100158-e44448c5dca2
 	github.com/pkg/errors v0.9.1
 	github.com/sethvargo/go-password v0.2.0
-	github.com/spf13/cobra v1.8.0
+	github.com/spf13/cobra v1.6.1
 	github.com/spf13/pflag v1.0.5
 	github.com/vishvananda/netlink v1.2.1-beta.2
 	github.com/vishvananda/netns v0.0.4
-	golang.org/x/sys v0.15.0
-	k8s.io/apimachinery v0.28.4
+	golang.org/x/sys v0.6.0
+	k8s.io/apimachinery v0.26.3
 )

-require github.com/alexellis/go-execute/v2 v2.2.1
-
 require (
 	github.com/AdaLogics/go-fuzz-headers v0.0.0-20230106234847-43070de90fa1 // indirect
 	github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20230306123547-8075edf89bb0 // indirect
-	github.com/Microsoft/go-winio v0.6.1 // indirect
+	github.com/Microsoft/go-winio v0.6.0 // indirect
 	github.com/Microsoft/hcsshim v0.10.0-rc.7 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
@ -41,12 +41,11 @@ require (
 	github.com/containerd/ttrpc v1.2.1 // indirect
 	github.com/containerd/typeurl/v2 v2.1.0 // indirect
 	github.com/containernetworking/cni v1.1.2 // indirect
-	github.com/cyphar/filepath-securejoin v0.2.4 // indirect
-	github.com/distribution/reference v0.5.0 // indirect
-	github.com/docker/docker-credential-helpers v0.8.0 // indirect
+	github.com/cyphar/filepath-securejoin v0.2.3 // indirect
+	github.com/docker/docker-credential-helpers v0.7.0 // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
 	github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
-	github.com/go-logr/logr v1.2.4 // indirect
+	github.com/go-logr/logr v1.2.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
@ -55,37 +54,38 @@ require (
 	github.com/google/uuid v1.3.0 // indirect
 	github.com/imdario/mergo v0.3.14 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/klauspost/compress v1.17.0 // indirect
+	github.com/klauspost/compress v1.16.3 // indirect
 	github.com/mattn/go-shellwords v1.0.12 // indirect
-	github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 // indirect
+	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/moby/locker v1.0.1 // indirect
 	github.com/moby/sys/mountinfo v0.6.2 // indirect
 	github.com/moby/sys/sequential v0.5.0 // indirect
 	github.com/moby/sys/signal v0.7.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.1.0-rc5 // indirect
+	github.com/opencontainers/image-spec v1.1.0-rc2.0.20221005185240-3a7f492d3f1b // indirect
 	github.com/opencontainers/runc v1.1.5 // indirect
 	github.com/opencontainers/selinux v1.11.0 // indirect
-	github.com/prometheus/client_golang v1.17.0 // indirect
-	github.com/prometheus/client_model v0.4.1-0.20230718164431-9a2bf3000d16 // indirect
-	github.com/prometheus/common v0.45.0 // indirect
-	github.com/prometheus/procfs v0.12.0 // indirect
-	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/prometheus/client_golang v1.14.0 // indirect
+	github.com/prometheus/client_model v0.3.0 // indirect
+	github.com/prometheus/common v0.42.0 // indirect
+	github.com/prometheus/procfs v0.9.0 // indirect
+	github.com/rogpeppe/go-internal v1.6.1 // indirect
+	github.com/sirupsen/logrus v1.9.0 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/otel v1.14.0 // indirect
 	go.opentelemetry.io/otel/trace v1.14.0 // indirect
-	golang.org/x/mod v0.14.0 // indirect
-	golang.org/x/net v0.19.0 // indirect
-	golang.org/x/sync v0.5.0 // indirect
-	golang.org/x/text v0.14.0 // indirect
-	golang.org/x/tools v0.16.0 // indirect
-	google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 // indirect
-	google.golang.org/grpc v1.56.3 // indirect
-	google.golang.org/protobuf v1.31.0 // indirect
+	golang.org/x/mod v0.9.0 // indirect
+	golang.org/x/net v0.8.0 // indirect
+	golang.org/x/sync v0.1.0 // indirect
+	golang.org/x/text v0.8.0 // indirect
+	golang.org/x/tools v0.7.0 // indirect
+	google.golang.org/genproto v0.0.0-20230306155012-7f2fa6fef1f4 // indirect
+	google.golang.org/grpc v1.53.0 // indirect
+	google.golang.org/protobuf v1.30.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gotest.tools/v3 v3.0.3 // indirect
--- a/go.sum
+++ b/go.sum
@ -4,14 +4,14 @@ github.com/AdaLogics/go-fuzz-headers v0.0.0-20230106234847-43070de90fa1/go.mod h
 github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20230306123547-8075edf89bb0 h1:59MxjQVfjXsBpLy+dbd2/ELV5ofnUkUZBvWSC85sheA=
 github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20230306123547-8075edf89bb0/go.mod h1:OahwfttHWG6eJ0clwcfBAHoDI6X/LV/15hx/wlMZSrU=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
-github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
+github.com/Microsoft/go-winio v0.6.0 h1:slsWYD/zyx7lCXoZVlvQrj0hPTM1HI4+v1sIda2yDvg=
+github.com/Microsoft/go-winio v0.6.0/go.mod h1:cTAf44im0RAYeL23bpB+fzCyDH2MJiz2BO69KH/soAE=
 github.com/Microsoft/hcsshim v0.10.0-rc.7 h1:HBytQPxcv8Oy4244zbQbe6hnOnx544eL5QPUqhJldz8=
 github.com/Microsoft/hcsshim v0.10.0-rc.7/go.mod h1:ILuwjA+kNW+MrN/w5un7n3mTqkwsFu4Bp05/okFUZlE=
-github.com/alexellis/arkade v0.0.0-20231211105357-97fb24a99b88 h1:ZI2jMgy5xt2y2MKc4I7aC5sVk1TgBff9uhAqdb+VTAU=
-github.com/alexellis/arkade v0.0.0-20231211105357-97fb24a99b88/go.mod h1:HHBBwwB0pxrVnPya1CB7pb7PuvHGMxmrRXVb3maJ3Zs=
-github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
-github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
+github.com/alexellis/arkade v0.0.0-20230317160202-4d8f80c5b033 h1:nq1a5V5MOoiLIKLOpB6HGeoRjdzKFoFQ6S1jMwIPdDY=
+github.com/alexellis/arkade v0.0.0-20230317160202-4d8f80c5b033/go.mod h1:T8i2qJQ5D13uTn+IgGCpC+ylJ3fb+bcnfrLppWcCuSo=
+github.com/alexellis/go-execute v0.5.0 h1:L8kgNlFzNbJov7jrInlaig7i6ZUSz/tYYmqvb8dyD0s=
+github.com/alexellis/go-execute v0.5.0/go.mod h1:AgHTcsCF9wrP0mMVTO8N+lFw1Biy71NybBOk8M+qgy8=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
@ -47,23 +47,20 @@ github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf h1:iW4rZ826su+pq
 github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
 github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
-github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/cyphar/filepath-securejoin v0.2.3 h1:YX6ebbZCZP7VkM3scTTokDgBL2TY741X51MTk3ycuNI=
 github.com/cyphar/filepath-securejoin v0.2.3/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
-github.com/cyphar/filepath-securejoin v0.2.4 h1:Ugdm7cg7i6ZK6x3xDF1oEu1nfkyfH53EtKeQYTC3kyg=
-github.com/cyphar/filepath-securejoin v0.2.4/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/distribution/reference v0.5.0 h1:/FUIFXtfc/x2gpa5/VGfiGLuOIdYa1t65IKK2OFGvA0=
-github.com/distribution/reference v0.5.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/cli v24.0.7+incompatible h1:wa/nIwYFW7BVTGa7SWPVyyXU9lgORqUb1xfI36MSkFg=
-github.com/docker/cli v24.0.7+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
-github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v24.0.7+incompatible h1:Wo6l37AuwP3JaMnZa226lzVXGA3F9Ig1seQen0cKYlM=
-github.com/docker/docker v24.0.7+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker-credential-helpers v0.8.0 h1:YQFtbBQb4VrpoPxhFuzEBPQ9E16qz5SpHLS+uswaCp8=
-github.com/docker/docker-credential-helpers v0.8.0/go.mod h1:UGFXcuoQ5TxPiB54nHOZ32AWRqQdECoh/Mg0AlEYb40=
+github.com/docker/cli v23.0.1+incompatible h1:LRyWITpGzl2C9e9uGxzisptnxAn1zfZKXy13Ul2Q5oM=
+github.com/docker/cli v23.0.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/distribution v2.8.2+incompatible h1:T3de5rq0dB1j30rp0sA2rER+m322EBzniBPB6ZIzuh8=
+github.com/docker/distribution v2.8.2+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
+github.com/docker/docker v23.0.3+incompatible h1:9GhVsShNWz1hO//9BNg/dpMnZW25KydO4wtVxWAIbho=
+github.com/docker/docker v23.0.3+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker-credential-helpers v0.7.0 h1:xtCHsjxogADNZcdv1pKUHXryefjlVRqWqIhk/uXJp0A=
+github.com/docker/docker-credential-helpers v0.7.0/go.mod h1:rETQfLdHNT3foU5kuNkFR1R1V12OJRRO5lzt2D1b5X0=
 github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
 github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c h1:+pKlWGMw7gf6bQ+oDZB4KHQFypsfjYlq/C4rfL7D3g8=
@ -79,12 +76,11 @@ github.com/frankban/quicktest v1.11.3/go.mod h1:wRf/ReqHper53s+kmmSZizM8NamnL3IM
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ=
-github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.2.3 h1:2DntVwHkVopvECVRSlL5PSo9eG+cAkDCuckLubN+rq0=
+github.com/go-logr/logr v1.2.3/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
-github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/godbus/dbus/v5 v5.0.6/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
@ -97,6 +93,7 @@ github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfb
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
+github.com/golang/protobuf v1.3.5/go.mod h1:6O5/vntMXwX2lRkT1hjjk0nAC1IDOTvTlVgjlRvqsdk=
 github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
 github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
 github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
@ -122,34 +119,35 @@ github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 h1:K6RDEckDVWvDI9JAJYCmNdQXq6neHJOYx3V6jnqNEec=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
 github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
-github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
+github.com/gorilla/mux v1.8.0 h1:i40aqfkR1h2SlN9hojwV5ZA91wcXFOvkdNIeFDP5koI=
+github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/imdario/mergo v0.3.8/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
 github.com/imdario/mergo v0.3.14 h1:fOqeC1+nCuuk6PKQdg9YmosXX7Y7mHX6R/0ZldI9iHo=
 github.com/imdario/mergo v0.3.14/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
+github.com/inconshreveable/mousetrap v1.0.1/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.17.0 h1:Rnbp4K9EjcDuVuHtd0dgA4qNuv9yKDYKK1ulpJwgrqM=
-github.com/klauspost/compress v1.17.0/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
+github.com/klauspost/compress v1.16.3 h1:XuJt9zzcnaz6a16/OU53ZjWp/v7/42WcR5t2a0PcNQY=
+github.com/klauspost/compress v1.16.3/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
 github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/mattn/go-shellwords v1.0.10/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
 github.com/mattn/go-shellwords v1.0.12 h1:M2zGm7EW6UQJvDeQxo4T51eKPurbeFbe8WtebGE2xrk=
 github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
-github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 h1:jWpvCLoY8Z/e3VKvlsiIGKtc+UG6U5vzxaoagmhXfyg=
-github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0/go.mod h1:QUyp042oQthUoa9bqDv0ER0wrtXnBruoNd7aNjkbP+k=
+github.com/matttproud/golang_protobuf_extensions v1.0.4 h1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo=
+github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
 github.com/mitchellh/mapstructure v1.3.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
@ -172,41 +170,44 @@ github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108
 github.com/onsi/ginkgo v1.16.4 h1:29JGrr5oVBm5ulCWet69zQkzWipVXIol6ygQUe/EzNc=
 github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vvnwo0=
 github.com/onsi/ginkgo/v2 v2.1.3/go.mod h1:vw5CSIxN1JObi/U8gcbwft7ZxR2dgaR70JSE3/PpL4c=
-github.com/onsi/ginkgo/v2 v2.9.4 h1:xR7vG4IXt5RWx6FfIjyAtsoMAtnc3C/rFXBBd2AjZwE=
+github.com/onsi/ginkgo/v2 v2.4.0 h1:+Ig9nvqgS5OBSACXNk15PLdp0U9XPYROt9CFzVdFGIs=
 github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
 github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
-github.com/onsi/gomega v1.17.0 h1:9Luw4uT5HTjHTN8+aNcSThgH1vdXnmdJ8xIfZ4wyTRE=
 github.com/onsi/gomega v1.17.0/go.mod h1:HnhC7FXeEQY45zxNK3PPoIUhzk/80Xly9PcubAlGdZY=
+github.com/onsi/gomega v1.23.0 h1:/oxKu9c2HVap+F3PfKort2Hw5DEU+HGlW8n+tguWsys=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/opencontainers/image-spec v1.1.0-rc5 h1:Ygwkfw9bpDvs+c9E34SdgGOj41dX/cbdlwvlWt0pnFI=
-github.com/opencontainers/image-spec v1.1.0-rc5/go.mod h1:X4pATf0uXsnn3g5aiGIsVnJBR4mxhKzfwmvK/B2NTm8=
+github.com/opencontainers/image-spec v1.1.0-rc2.0.20221005185240-3a7f492d3f1b h1:YWuSjZCQAPM8UUBLkYUk1e+rZcvWHJmFb6i6rM44Xs8=
+github.com/opencontainers/image-spec v1.1.0-rc2.0.20221005185240-3a7f492d3f1b/go.mod h1:3OVijpioIKYWTqjiG0zfF6wvoJ4fAXGbjdZuI2NgsRQ=
 github.com/opencontainers/runc v1.1.5 h1:L44KXEpKmfWDcS02aeGm8QNTFXTo2D+8MYGDIJ/GDEs=
 github.com/opencontainers/runc v1.1.5/go.mod h1:1J5XiS+vdZ3wCyZybsuxXZWGrgSr8fFJHLXuG2PsnNg=
 github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
-github.com/opencontainers/runtime-spec v1.1.0 h1:HHUyrt9mwHUjtasSbXSMvs4cyFxh+Bll4AjJ9odEGpg=
-github.com/opencontainers/runtime-spec v1.1.0/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
+github.com/opencontainers/runtime-spec v1.1.0-rc.1 h1:wHa9jroFfKGQqFHj0I1fMRKLl0pfj+ynAqBxo3v6u9w=
+github.com/opencontainers/runtime-spec v1.1.0-rc.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opencontainers/selinux v1.10.0/go.mod h1:2i0OySw99QjzBBQByd1Gr9gSjvuho1lHsJxIJ3gGbJI=
 github.com/opencontainers/selinux v1.11.0 h1:+5Zbo97w3Lbmb3PeqQtpmTkMwsW5nRI3YaLpt7tQ7oU=
 github.com/opencontainers/selinux v1.11.0/go.mod h1:E5dMC3VPuVvVHDYmi78qvhJp8+M586T4DlDRYpFkyec=
-github.com/openfaas/faas-provider v0.25.0 h1:2R1QT22eemeBZV++DsiZOG+h4qKlQRnF9DAP21lyqG0=
-github.com/openfaas/faas-provider v0.25.0/go.mod h1:NsETIfEndZn4mn/w/XnBTcDTwKqULCziphLp7KgeRcA=
+github.com/openfaas/faas-provider v0.21.0 h1:rnTy1Gpx+0YvqriQD8miQ2DfpOJXYZbV3VMqe8ri5lc=
+github.com/openfaas/faas-provider v0.21.0/go.mod h1:Farrp+9Med8LeK3aoYpqplMP8f5ebTILbCSLg2LPLZk=
+github.com/openfaas/faas/gateway v0.0.0-20230317100158-e44448c5dca2 h1:mSQlNX+etC2pd+yxZrkOj91vO0Vma75XHjI8+mKdS+A=
+github.com/openfaas/faas/gateway v0.0.0-20230317100158-e44448c5dca2/go.mod h1:iQNG+Up27CXDLHgIr9mcifTzaPD2mYOFTZW8MHxib7M=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_golang v1.17.0 h1:rl2sfwZMtSthVU752MqfjQozy7blglC+1SOtjMAMh+Q=
-github.com/prometheus/client_golang v1.17.0/go.mod h1:VeL+gMmOAxkS2IqfCq0ZmHSL+LjWfWDUmp1mBz9JgUY=
+github.com/prometheus/client_golang v1.14.0 h1:nJdhIvne2eSX/XRAFV9PcvFFRbrjbcTUj0VP62TMhnw=
+github.com/prometheus/client_golang v1.14.0/go.mod h1:8vpkKitgIVNcqrRBWh1C4TIUQgYNtG/XQE4E/Zae36Y=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/client_model v0.4.1-0.20230718164431-9a2bf3000d16 h1:v7DLqVdK4VrYkVD5diGdl4sxJurKJEMnODWRJlxV9oM=
-github.com/prometheus/client_model v0.4.1-0.20230718164431-9a2bf3000d16/go.mod h1:oMQmHW1/JoDwqLtg57MGgP/Fb1CJEYF2imWWhWtMkYU=
-github.com/prometheus/common v0.45.0 h1:2BGz0eBc2hdMDLnO/8n0jeB3oPrt2D08CekT0lneoxM=
-github.com/prometheus/common v0.45.0/go.mod h1:YJmSTw9BoKxJplESWWxlbyttQR4uaEcGyv9MZjVOJsY=
+github.com/prometheus/client_model v0.3.0 h1:UBgGFHqYdG/TPFD1B1ogZywDqEkwp3fBMvqdiQ7Xew4=
+github.com/prometheus/client_model v0.3.0/go.mod h1:LDGWKZIo7rky3hgvBe+caln+Dr3dPggB5dvjtD7w9+w=
+github.com/prometheus/common v0.42.0 h1:EKsfXEYo4JpWMHH5cg+KOUWeuJSov1Id8zGR8eeI1YM=
+github.com/prometheus/common v0.42.0/go.mod h1:xBwqVerjNdUDjgODMpudtOMwlOwf2SaTr1yjz4b7Zbc=
 github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
-github.com/prometheus/procfs v0.12.0 h1:jluTpSng7V9hY0O2R9DzzJHYb2xULk9VTR1V1R/k6Bo=
-github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3cnaOZAZEfOo=
-github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
+github.com/prometheus/procfs v0.9.0 h1:wzCHvIvM5SxWqYvwgVL7yJY8Lz3PKn49KQtpgMYJfhI=
+github.com/prometheus/procfs v0.9.0/go.mod h1:+pB4zwohETzFnmlpe6yd2lSc+0/46IYZRB/chUwxUZY=
+github.com/rogpeppe/go-internal v1.6.1 h1:/FiVV8dS/e+YqF2JvO3yXRFbBLTIuSDkuC7aBOAvL+k=
+github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/seccomp/libseccomp-golang v0.9.2-0.20220502022130-f33da4d89646/go.mod h1:JA8cRccbGaA1s33RQf7Y1+q9gHmZX1yB/z9WDN1C6fg=
@ -215,10 +216,10 @@ github.com/sethvargo/go-password v0.2.0/go.mod h1:Ym4Mr9JXLBycr02MFuVQ/0JHidNetS
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
 github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
-github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
-github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/spf13/cobra v1.8.0 h1:7aJaZx1B85qltLMc546zn58BxxfZdR/W22ej9CFoEf0=
-github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho=
+github.com/sirupsen/logrus v1.9.0 h1:trlNQbNUG3OdDrDil03MCb1H2o9nJ1x4/5LYw7byDE0=
+github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/spf13/cobra v1.6.1 h1:o94oiPyS4KD1mPy2fmcYYHHfCxLqYjJOhGsCHFZtEzA=
+github.com/spf13/cobra v1.6.1/go.mod h1:IOw/AERYS7UzyrGinqmz6HLUo219MORXGxhbaJUqzrY=
 github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
@ -258,7 +259,7 @@ go.opentelemetry.io/otel v1.14.0 h1:/79Huy8wbf5DnIPhemGB+zEPVwnN6fuQybr/SRXa6hM=
 go.opentelemetry.io/otel v1.14.0/go.mod h1:o4buv+dJzx8rohcUeRmWUZhqupFvzWis188WlggnNeU=
 go.opentelemetry.io/otel/trace v1.14.0 h1:wp2Mmvj41tDsyAJXiWDWpfNsOiIyd38fy85pyKcFq/M=
 go.opentelemetry.io/otel/trace v1.14.0/go.mod h1:8avnQLK+CG77yNLUae4ea2JDQ6iT+gozhnZjy/rw9G8=
-go.uber.org/goleak v1.2.1 h1:NBol2c7O1ZokfZ0LEU9K6Whx/KnwvepVetCUhtKja4A=
+go.uber.org/goleak v1.1.12 h1:gZAh5/EyT/HQwlpkCy6wTpqfH9H8Lz8zbm3dZh+OyzA=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
@ -268,8 +269,8 @@ golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvx
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.14.0 h1:dGoOF9QVLYng8IHTm7BAyWqCqSheQ5pYWGhzW00YJr0=
-golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.9.0 h1:KENHtAZL2y3NLMYZeHY9DW8HW8V+kQyJsY/V9JlKvCs=
+golang.org/x/mod v0.9.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@ -283,17 +284,18 @@ golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwY
 golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
-golang.org/x/net v0.19.0 h1:zTwKpTd2XuCqf8huc7Fo2iSy+4RHPd10s4KzeTnVr1c=
-golang.org/x/net v0.19.0/go.mod h1:CfAk/cbD4CthTvqiEl8NpboMuiuOYsAr/7NOjZJtv1U=
+golang.org/x/net v0.8.0 h1:Zrh2ngAOFYneWTAIAPethzeaQLuHwhuBkuV6ZiRnUaQ=
+golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.5.0 h1:60k92dhOjHxJkrqnwsfl8KuaHbn/5dl0lUPUklKo3qE=
-golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@ -320,14 +322,14 @@ golang.org/x/sys v0.0.0-20211116061358-0a5406a5449c/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
-golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.6.0 h1:MVltZSvRTcU2ljQOhs94SXPftV6DCNnZViHeQps87pQ=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.8.0 h1:57P1ETyNKtuIjB4SRd15iJxuhj8Gc416Y78H3qgMh68=
+golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
@ -338,8 +340,8 @@ golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtn
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.16.0 h1:GO788SKMRunPIBCXiQyo2AaexLstOrVhuAL5YwsckQM=
-golang.org/x/tools v0.16.0/go.mod h1:kYVVN6I1mBNoB1OX+noeBjbRk4IUEPa7JJ+TJMEooJ0=
+golang.org/x/tools v0.7.0 h1:W4OVu8VVOaIO0yzWMNdepAulS7YfoS3Zabrm8DOXXU4=
+golang.org/x/tools v0.7.0/go.mod h1:4pg6aUX35JBAogB10C9AtvVL+qowtN4pT3CGSQex14s=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@ -350,16 +352,16 @@ google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoA
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/genproto v0.0.0-20200224152610-e50cd9704f63/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 h1:KpwkzHKEF7B9Zxg18WzOa7djJ+Ha5DzthMyZYQfEn2A=
-google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1/go.mod h1:nKE/iIaLqn2bQwXBg8f1g2Ylh6r5MN5CmZvuzZCgsCU=
+google.golang.org/genproto v0.0.0-20230306155012-7f2fa6fef1f4 h1:DdoeryqhaXp1LtT/emMP1BRJPHHKFi5akj/nbx/zNTA=
+google.golang.org/genproto v0.0.0-20230306155012-7f2fa6fef1f4/go.mod h1:NWraEVixdDnqcqQ30jipen1STv2r/n24Wb7twVTGR4s=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
 google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
 google.golang.org/grpc v1.27.1/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
-google.golang.org/grpc v1.56.3 h1:8I4C0Yq1EjstUzUJzpcRVbuYA2mODtEmpWiQoN/b2nc=
-google.golang.org/grpc v1.56.3/go.mod h1:I9bI3vqKfayGqPUAwGdOSu7kt6oIJLixfffKrpXqQ9s=
+google.golang.org/grpc v1.53.0 h1:LAv2ds7cmFV/XTS3XG1NneeENYrXGmorPxsBbptIjNc=
+google.golang.org/grpc v1.53.0/go.mod h1:OnIrk0ipVdj4N5d9IUoFUx72/VlD7+jUsHwZgwSMQpw=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@ -372,10 +374,12 @@ google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlba
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
-google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/protobuf v1.30.0 h1:kPPoIgf3TsEvrm0PFe15JQ+570QVxYzEvvHqChK+cng=
+google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
@ -393,5 +397,5 @@ gotest.tools/v3 v3.0.3 h1:4AuOwCGf4lLR9u3YOe2awrHygurzhO/HeQ6laiA6Sx0=
 gotest.tools/v3 v3.0.3/go.mod h1:Z7Lb0S5l+klDB31fvDQX8ss/FlKDxtlFlw3Oa8Ymbl8=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-k8s.io/apimachinery v0.28.4 h1:zOSJe1mc+GxuMnFzD4Z/U1wst50X28ZNsn5bhgIIao8=
-k8s.io/apimachinery v0.28.4/go.mod h1:wI37ncBvfAoswfq626yPTe6Bz1c22L7uaJ8dho83mgg=
+k8s.io/apimachinery v0.26.3 h1:dQx6PNETJ7nODU3XPtrwkfuubs6w7sX0M8n61zHIV/k=
+k8s.io/apimachinery v0.26.3/go.mod h1:ats7nN1LExKHvJ9TmwootT00Yz05MuYqPXEXaVeOy5I=
--- a/pkg/provider/handlers/delete.go
+++ b/pkg/provider/handlers/delete.go
@ -7,13 +7,13 @@ import (
 	"io/ioutil"
 	"log"
 	"net/http"
+	"time"

 	"github.com/containerd/containerd"
 	"github.com/containerd/containerd/namespaces"
 	gocni "github.com/containerd/go-cni"
+	"github.com/openfaas/faas/gateway/requests"

-	"github.com/openfaas/faas-provider/types"
-	"github.com/openfaas/faasd/pkg"
 	cninetwork "github.com/openfaas/faasd/pkg/cninetwork"
 	"github.com/openfaas/faasd/pkg/service"
 )
@ -32,23 +32,18 @@ func MakeDeleteHandler(client *containerd.Client, cni gocni.CNI) func(w http.Res
 		body, _ := ioutil.ReadAll(r.Body)
 		log.Printf("[Delete] request: %s\n", string(body))

-		req := types.DeleteFunctionRequest{}
-		err := json.Unmarshal(body, &req)
-		if err != nil {
+		req := requests.DeleteFunctionRequest{}
+		if err := json.Unmarshal(body, &req); err != nil {
 			log.Printf("[Delete] error parsing input: %s\n", err)
 			http.Error(w, err.Error(), http.StatusBadRequest)

 			return
 		}

-		// namespace moved from the querystring into the body
-		namespace := req.Namespace
-		if namespace == "" {
-			namespace = pkg.DefaultFunctionNamespace
-		}
+		lookupNamespace := getRequestNamespace(readNamespaceFromQuery(r))

 		// Check if namespace exists, and it has the openfaas label
-		valid, err := validNamespace(client.NamespaceService(), namespace)
+		valid, err := validNamespace(client.NamespaceService(), lookupNamespace)
 		if err != nil {
 			http.Error(w, err.Error(), http.StatusBadRequest)
 			return
@ -61,30 +56,43 @@ func MakeDeleteHandler(client *containerd.Client, cni gocni.CNI) func(w http.Res

 		name := req.FunctionName

-		function, err := GetFunction(client, name, namespace)
+		function, err := GetFunction(client, name, lookupNamespace)
 		if err != nil {
-			msg := fmt.Sprintf("service %s not found", name)
+			msg := fmt.Sprintf("function: %s not found", name)
 			log.Printf("[Delete] %s\n", msg)
 			http.Error(w, msg, http.StatusNotFound)
 			return
 		}

-		ctx := namespaces.WithNamespace(context.Background(), namespace)
+		ctx := namespaces.WithNamespace(context.Background(), lookupNamespace)

 		// TODO: this needs to still happen if the task is paused
 		if function.replicas != 0 {
 			err = cninetwork.DeleteCNINetwork(ctx, cni, client, name)
 			if err != nil {
-				log.Printf("[Delete] error removing CNI network for %s, %s\n", name, err)
+				log.Printf("[Delete] error removing CNI network for: %s, %s\n", name, err)
 			}
 		}

-		if err := service.Remove(ctx, client, name); err != nil {
+		killTimeout := getKillTimeout(function.envVars)
+
+		if err := service.Remove(ctx, client, name, killTimeout); err != nil {
 			log.Printf("[Delete] error removing %s, %s\n", name, err)
 			http.Error(w, err.Error(), http.StatusInternalServerError)
 			return
 		}

-		log.Printf("[Delete] deleted %s\n", name)
+		log.Printf("[Delete] deleted: %s\n", name)
 	}
 }
+
+func getKillTimeout(envs map[string]string) time.Duration {
+	killTimeout := time.Second * 5
+	if v, ok := envs["healthcheck_interval"]; ok {
+		dur, err := time.ParseDuration(v)
+		if err == nil {
+			killTimeout = dur
+		}
+	}
+	return killTimeout
+}
--- a/pkg/provider/handlers/invoke_resolver.go
+++ b/pkg/provider/handlers/invoke_resolver.go
@ -24,7 +24,7 @@ func (i *InvokeResolver) Resolve(functionName string) (url.URL, error) {
 	actualFunctionName := functionName
 	log.Printf("Resolve: %q\n", actualFunctionName)

-	namespace := getNamespaceOrDefault(functionName, faasd.DefaultFunctionNamespace)
+	namespace := getNamespace(functionName, faasd.DefaultFunctionNamespace)

 	if strings.Contains(functionName, ".") {
 		actualFunctionName = strings.TrimSuffix(functionName, "."+namespace)
@ -47,7 +47,7 @@ func (i *InvokeResolver) Resolve(functionName string) (url.URL, error) {
 	return *urlRes, nil
 }

-func getNamespaceOrDefault(name, defaultNamespace string) string {
+func getNamespace(name, defaultNamespace string) string {
 	namespace := defaultNamespace
 	if strings.Contains(name, ".") {
 		namespace = name[strings.LastIndexAny(name, ".")+1:]
--- a/pkg/provider/handlers/mutate_namespaces.go
+++ b/pkg/provider/handlers/mutate_namespaces.go
@ -1,285 +0,0 @@
-package handlers
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"log"
-	"net/http"
-	"strings"
-
-	"github.com/containerd/containerd"
-	"github.com/gorilla/mux"
-	"github.com/openfaas/faas-provider/types"
-)
-
-func MakeMutateNamespace(client *containerd.Client) func(w http.ResponseWriter, r *http.Request) {
-	return func(w http.ResponseWriter, r *http.Request) {
-		if r.Body != nil {
-			defer r.Body.Close()
-		}
-
-		switch r.Method {
-		case http.MethodPost:
-			createNamespace(client, w, r)
-		case http.MethodGet:
-			getNamespace(client, w, r)
-		case http.MethodDelete:
-			deleteNamespace(client, w, r)
-		case http.MethodPut:
-			updateNamespace(client, w, r)
-
-		default:
-			w.WriteHeader(http.StatusMethodNotAllowed)
-		}
-	}
-}
-
-func updateNamespace(client *containerd.Client, w http.ResponseWriter, r *http.Request) {
-	req, err := parseNamespaceRequest(r)
-	if err != nil {
-		http.Error(w, err.Error(), err.(*HttpError).Status)
-		return
-	}
-
-	namespaceExists, err := namespaceExists(r.Context(), client, req.Name)
-	if err != nil {
-		http.Error(w, err.Error(), http.StatusBadRequest)
-		return
-	}
-
-	if !namespaceExists {
-		http.Error(w, fmt.Sprintf("namespace %s not found", req.Name), http.StatusNotFound)
-		return
-	}
-
-	originalLabels, err := client.NamespaceService().Labels(r.Context(), req.Name)
-	if err != nil {
-		http.Error(w, err.Error(), http.StatusBadRequest)
-		return
-	}
-
-	if !hasOpenFaaSLabel(originalLabels) {
-		http.Error(w, fmt.Sprintf("namespace %s is not an openfaas namespace", req.Name), http.StatusBadRequest)
-		return
-	}
-
-	var exclusions []string
-
-	// build exclusions
-	for key, _ := range originalLabels {
-		if _, ok := req.Labels[key]; !ok {
-			exclusions = append(exclusions, key)
-		}
-	}
-
-	// Call SetLabel with empty string if label is to be removed
-	for _, key := range exclusions {
-		if err := client.NamespaceService().SetLabel(r.Context(), req.Name, key, ""); err != nil {
-			http.Error(w, err.Error(), http.StatusInternalServerError)
-			return
-		}
-	}
-
-	// Now add the new labels
-	for key, value := range req.Labels {
-		if err := client.NamespaceService().SetLabel(r.Context(), req.Name, key, value); err != nil {
-			http.Error(w, err.Error(), http.StatusInternalServerError)
-			return
-		}
-	}
-
-	w.WriteHeader(http.StatusAccepted)
-}
-
-func deleteNamespace(client *containerd.Client, w http.ResponseWriter, r *http.Request) {
-	req, err := parseNamespaceRequest(r)
-	if err != nil {
-		http.Error(w, err.Error(), err.(*HttpError).Status)
-		return
-	}
-
-	if err := client.NamespaceService().Delete(r.Context(), req.Name); err != nil {
-		if strings.Contains(err.Error(), "not found") {
-			http.Error(w, fmt.Sprintf("namespace %s not found", req.Name), http.StatusNotFound)
-			return
-		}
-
-		http.Error(w, err.Error(), http.StatusInternalServerError)
-		return
-	}
-
-	w.WriteHeader(http.StatusAccepted)
-}
-
-func namespaceExists(ctx context.Context, client *containerd.Client, name string) (bool, error) {
-	ns, err := client.NamespaceService().List(ctx)
-	if err != nil {
-		return false, err
-	}
-
-	found := false
-	for _, namespace := range ns {
-		if namespace == name {
-			found = true
-			break
-		}
-	}
-
-	return found, nil
-}
-
-func getNamespace(client *containerd.Client, w http.ResponseWriter, r *http.Request) {
-	req, err := parseNamespaceRequest(r)
-	if err != nil {
-		http.Error(w, err.Error(), err.(*HttpError).Status)
-		return
-	}
-
-	namespaceExists, err := namespaceExists(r.Context(), client, req.Name)
-	if err != nil {
-		http.Error(w, err.Error(), http.StatusBadRequest)
-		return
-	}
-
-	if !namespaceExists {
-		http.Error(w, fmt.Sprintf("namespace %s not found", req.Name), http.StatusNotFound)
-		return
-	}
-
-	labels, err := client.NamespaceService().Labels(r.Context(), req.Name)
-	if err != nil {
-		http.Error(w, err.Error(), http.StatusBadRequest)
-		return
-	}
-
-	if !hasOpenFaaSLabel(labels) {
-		http.Error(w, fmt.Sprintf("namespace %s not found", req.Name), http.StatusNotFound)
-		return
-	}
-
-	res := types.FunctionNamespace{
-		Name:   req.Name,
-		Labels: labels,
-	}
-
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(http.StatusOK)
-	if err := json.NewEncoder(w).Encode(res); err != nil {
-		log.Printf("Get Namespace error: %s", err)
-	}
-}
-
-func createNamespace(client *containerd.Client, w http.ResponseWriter, r *http.Request) {
-	req, err := parseNamespaceRequest(r)
-	if err != nil {
-		http.Error(w, err.Error(), err.(*HttpError).Status)
-		return
-	}
-
-	// Check if namespace exists, and it has the openfaas label
-	namespaces, err := client.NamespaceService().List(r.Context())
-	if err != nil {
-		http.Error(w, err.Error(), http.StatusBadRequest)
-		return
-	}
-
-	found := false
-	for _, namespace := range namespaces {
-		if namespace == req.Name {
-			found = true
-			break
-		}
-	}
-
-	if found {
-		http.Error(w, fmt.Sprintf("namespace %s already exists", req.Name), http.StatusConflict)
-		return
-	}
-
-	if err := client.NamespaceService().Create(r.Context(), req.Name, req.Labels); err != nil {
-		http.Error(w, err.Error(), http.StatusBadRequest)
-		return
-	}
-
-	w.WriteHeader(http.StatusCreated)
-}
-
-// getNamespace returns a namespace object or an error
-func parseNamespaceRequest(r *http.Request) (types.FunctionNamespace, error) {
-	var req types.FunctionNamespace
-
-	vars := mux.Vars(r)
-	namespaceInPath := vars["name"]
-
-	if r.Method == http.MethodGet {
-		if namespaceInPath == "" {
-			return req, &HttpError{
-				Err:    fmt.Errorf("namespace not specified in URL"),
-				Status: http.StatusBadRequest,
-			}
-		}
-
-		return types.FunctionNamespace{
-			Name: namespaceInPath,
-		}, nil
-	}
-
-	body, _ := io.ReadAll(r.Body)
-
-	if err := json.Unmarshal(body, &req); err != nil {
-		return req, &HttpError{
-			Err:    fmt.Errorf("error parsing request body: %s", err.Error()),
-			Status: http.StatusBadRequest,
-		}
-	}
-
-	if r.Method != http.MethodPost {
-		if namespaceInPath == "" {
-			return req, &HttpError{
-				Err:    fmt.Errorf("namespace not specified in URL"),
-				Status: http.StatusBadRequest,
-			}
-		}
-		if req.Name != namespaceInPath {
-			return req, &HttpError{
-				Err:    fmt.Errorf("namespace in request body does not match namespace in URL"),
-				Status: http.StatusBadRequest,
-			}
-		}
-	}
-
-	if req.Name == "" {
-		return req, &HttpError{
-			Err:    fmt.Errorf("namespace not specified in request body"),
-			Status: http.StatusBadRequest,
-		}
-	}
-
-	if ok := hasOpenFaaSLabel(req.Labels); !ok {
-		return req, &HttpError{
-			Err:    fmt.Errorf("request does not have openfaas=1 label"),
-			Status: http.StatusBadRequest,
-		}
-	}
-
-	return req, nil
-}
-
-func hasOpenFaaSLabel(labels map[string]string) bool {
-	if v, ok := labels["openfaas"]; ok && v == "1" {
-		return true
-	}
-
-	return false
-}
-
-type HttpError struct {
-	Err    error
-	Status int
-}
-
-func (e *HttpError) Error() string {
-	return e.Err.Error()
-}
--- a/pkg/provider/handlers/scale.go
+++ b/pkg/provider/handlers/scale.go
@ -13,7 +13,6 @@ import (
 	gocni "github.com/containerd/go-cni"

 	"github.com/openfaas/faas-provider/types"
-	"github.com/openfaas/faasd/pkg"
 )

 func MakeReplicaUpdateHandler(client *containerd.Client, cni gocni.CNI) func(w http.ResponseWriter, r *http.Request) {
@ -31,17 +30,16 @@ func MakeReplicaUpdateHandler(client *containerd.Client, cni gocni.CNI) func(w h
 		log.Printf("[Scale] request: %s\n", string(body))

 		req := types.ScaleServiceRequest{}
-		if err := json.Unmarshal(body, &req); err != nil {
+		err := json.Unmarshal(body, &req)
+
+		if err != nil {
 			log.Printf("[Scale] error parsing input: %s\n", err)
 			http.Error(w, err.Error(), http.StatusBadRequest)

 			return
 		}

-		namespace := req.Namespace
-		if namespace == "" {
-			namespace = pkg.DefaultFunctionNamespace
-		}
+		namespace := getRequestNamespace(readNamespaceFromQuery(r))

 		// Check if namespace exists, and it has the openfaas label
 		valid, err := validNamespace(client.NamespaceService(), namespace)
--- a/pkg/provider/handlers/update.go
+++ b/pkg/provider/handlers/update.go
@ -39,6 +39,7 @@ func MakeUpdateHandler(client *containerd.Client, cni gocni.CNI, secretMountPath

 			return
 		}
+
 		name := req.Service
 		namespace := getRequestNamespace(req.Namespace)

@ -64,8 +65,7 @@ func MakeUpdateHandler(client *containerd.Client, cni gocni.CNI, secretMountPath
 			return
 		}

-		err = validateSecrets(namespaceSecretMountPath, req.Secrets)
-		if err != nil {
+		if err = validateSecrets(namespaceSecretMountPath, req.Secrets); err != nil {
 			http.Error(w, err.Error(), http.StatusBadRequest)
 		}

@ -83,13 +83,15 @@ func MakeUpdateHandler(client *containerd.Client, cni gocni.CNI, secretMountPath
 			}
 		}

-		if err := service.Remove(ctx, client, name); err != nil {
+		killTimeout := getKillTimeout(function.annotations)
+
+		if err := service.Remove(ctx, client, name, killTimeout); err != nil {
 			log.Printf("[Update] error removing %s, %s\n", name, err)
 			http.Error(w, err.Error(), http.StatusInternalServerError)
 			return
 		}

-		// The pull has already been done in prepull, so we can force this pull to "false"
+		// The pull has already been done in pre-pull, so we can force this pull to "false"
 		pull := false

 		if err := deploy(ctx, req, client, cni, namespaceSecretMountPath, pull); err != nil {
--- a/pkg/provider/handlers/utils.go
+++ b/pkg/provider/handlers/utils.go
@ -39,8 +39,7 @@ func validNamespace(store provider.Labeller, namespace string) (bool, error) {
 		return false, err
 	}

-	// check for true to keep it backward compatible
-	if value, found := labels[pkg.NamespaceLabel]; found && (value == "true" || value == "1") {
+	if value, found := labels[pkg.NamespaceLabel]; found && value == "true" {
 		return true, nil
 	}

--- a/pkg/service/service.go
+++ b/pkg/service/service.go
@ -22,78 +22,84 @@ import (
 const dockerConfigDir = "/var/lib/faasd/.docker/"

 // Remove removes a container
-func Remove(ctx context.Context, client *containerd.Client, name string) error {
+func Remove(ctx context.Context, client *containerd.Client, name string, killTimeout time.Duration) error {

-	container, containerErr := client.LoadContainer(ctx, name)
-
-	if containerErr == nil {
-		taskFound := true
-		t, err := container.Task(ctx, nil)
-		if err != nil {
-			if errdefs.IsNotFound(err) {
-				taskFound = false
-			} else {
-				return fmt.Errorf("unable to get task %w: ", err)
-			}
-		}
-
-		if taskFound {
-			status, err := t.Status(ctx)
-			if err != nil {
-				log.Printf("Unable to get status for: %s, error: %s", name, err.Error())
-			} else {
-				log.Printf("Status of %s is: %s\n", name, status.Status)
-			}
-
-			log.Printf("Need to kill task: %s\n", name)
-			if err = killTask(ctx, t); err != nil {
-				return fmt.Errorf("error killing task %s, %s, %w", container.ID(), name, err)
-			}
-		}
-
-		if err := container.Delete(ctx, containerd.WithSnapshotCleanup); err != nil {
-			return fmt.Errorf("error deleting container %s, %s, %w", container.ID(), name, err)
-		}
-
-	} else {
+	container, err := client.LoadContainer(ctx, name)
+	if err != nil {
+		// Perhaps the container was already removed, but the snapshot is still there
 		service := client.SnapshotService("")
 		key := name + "snapshot"
+
+		// Don't return an error if the snapshot doesn't exist
 		if _, err := client.SnapshotService("").Stat(ctx, key); err == nil {
 			service.Remove(ctx, key)
 		}
+		return nil
 	}
+
+	taskFound := true
+	t, err := container.Task(ctx, nil)
+	if err != nil {
+		if errdefs.IsNotFound(err) {
+			taskFound = false
+		} else {
+			return fmt.Errorf("unable to get task %w: ", err)
+		}
+	}
+
+	if taskFound {
+		status, err := t.Status(ctx)
+		if err != nil {
+			log.Printf("Unable to get status for: %s, error: %s", name, err.Error())
+		} else {
+			log.Printf("Status of %s is: %s\n", name, status.Status)
+		}
+
+		if err = killTask(ctx, t, killTimeout); err != nil {
+			return fmt.Errorf("error killing task %s, %s, %w", container.ID(), name, err)
+		}
+	}
+
+	if err := container.Delete(ctx, containerd.WithSnapshotCleanup); err != nil {
+		return fmt.Errorf("error deleting container %s, %s, %w", container.ID(), name, err)
+	}
+
 	return nil
 }

-// Adapted from Stellar - https://github.com/stellar
-func killTask(ctx context.Context, task containerd.Task) error {
-
-	killTimeout := 30 * time.Second
+// Adapted from Stellar - https://github.com/stellarproject
+func killTask(ctx context.Context, task containerd.Task, killTimeout time.Duration) error {

 	wg := &sync.WaitGroup{}
 	wg.Add(1)
 	var err error

 	go func() {
+		id := task.ID()
+
 		defer wg.Done()
 		if task != nil {
 			wait, err := task.Wait(ctx)
 			if err != nil {
-				log.Printf("error waiting on task: %s", err)
+				log.Printf("error waiting on task: %s: %s", id, err)
 				return
 			}

 			if err := task.Kill(ctx, unix.SIGTERM, containerd.WithKillAll); err != nil {
-				log.Printf("error killing container task: %s", err)
+				log.Printf("error killing task: %s with SIGTERM: %s", id, err)
 			}

 			select {
 			case <-wait:
-				task.Delete(ctx)
+				_, err := task.Delete(ctx)
+				if err != nil {
+					log.Printf("error deleting task: %s: %s", id, err)
+				}
+
 				return
 			case <-time.After(killTimeout):
 				if err := task.Kill(ctx, unix.SIGKILL, containerd.WithKillAll); err != nil {
-					log.Printf("error force killing container task: %s", err)
+					log.Printf("error killing task: %s with SIGTERM: %s", id, err)
 				}
 				return
 			}
--- a/pkg/supervisor.go
+++ b/pkg/supervisor.go
@ -10,6 +10,7 @@ import (
 	"sort"
 	"strconv"
 	"strings"
+	"time"

 	"github.com/alexellis/arkade/pkg/env"
 	"github.com/compose-spec/compose-go/loader"
@ -32,6 +33,7 @@ import (
 const (
 	// workingDirectoryPermission user read/write/execute, group and others: read-only
 	workingDirectoryPermission = 0744
+	removalGracePeriod         = time.Second * 5
 )

 type Service struct {
@ -57,14 +59,8 @@ type ServicePort struct {
 }

 type Mount struct {
-	// Src relative to the working directory for faasd
-	Src string
-
-	// Dest is the absolute path within the container
+	Src  string
 	Dest string
-
-	// ReadOnly when set to true indicates the mount will be set to "ro" instead of "rw"
-	ReadOnly bool
 }

 type Supervisor struct {
@ -132,9 +128,11 @@ func (s *Supervisor) Start(svcs []Service) error {

 	for _, svc := range svcs {
 		fmt.Printf("Removing old container for: %s\n", svc.Name)
-		containerErr := service.Remove(ctx, s.client, svc.Name)
-		if containerErr != nil {
-			return containerErr
+		if err := service.Remove(ctx,
+			s.client,
+			svc.Name,
+			removalGracePeriod); err != nil {
+			return err
 		}
 	}

@ -157,18 +155,11 @@ func (s *Supervisor) Start(svcs []Service) error {
 		mounts := []specs.Mount{}
 		if len(svc.Mounts) > 0 {
 			for _, mnt := range svc.Mounts {
-				var options = []string{"rbind"}
-				if mnt.ReadOnly {
-					options = append(options, "ro")
-				} else {
-					options = append(options, "rw")
-				}
-
 				mounts = append(mounts, specs.Mount{
 					Source:      mnt.Src,
 					Destination: mnt.Dest,
 					Type:        "bind",
-					Options:     options,
+					Options:     []string{"rbind", "rw"},
 				})

 				// Only create directories, not files.
@ -299,8 +290,7 @@ func (s *Supervisor) Remove(svcs []Service) error {
 			return err
 		}

-		err = service.Remove(ctx, s.client, svc.Name)
-		if err != nil {
+		if err := service.Remove(ctx, s.client, svc.Name, removalGracePeriod); err != nil {
 			return err
 		}
 	}
@ -355,9 +345,8 @@ func ParseCompose(config *compose.Config) ([]Service, error) {
 				return nil, errors.Errorf("unsupported volume mount type '%s' when parsing service '%s'", v.Type, s.Name)
 			}
 			mounts = append(mounts, Mount{
-				Src:      v.Source,
-				Dest:     v.Target,
-				ReadOnly: v.ReadOnly,
+				Src:  v.Source,
+				Dest: v.Target,
 			})
 		}

--- a/pkg/supervisor_test.go
+++ b/pkg/supervisor_test.go
@ -180,7 +180,7 @@ func equalMountSlice(t *testing.T, want, found []Mount) {

 	for i := range want {
 		if !reflect.DeepEqual(want[i], found[i]) {
-			t.Fatalf("unexpected value at postition %d: want %v, got %v", i, want[i], found[i])
+			t.Fatalf("unexpected value at postition %d: want %s, got %s", i, want[i], found[i])
 		}
 	}
 }
--- a/pkg/systemd/systemd.go
+++ b/pkg/systemd/systemd.go
@ -2,23 +2,21 @@ package systemd

 import (
 	"bytes"
-	"context"
 	"fmt"
 	"os"
 	"path/filepath"
 	"text/template"

-	execute "github.com/alexellis/go-execute/v2"
+	execute "github.com/alexellis/go-execute/pkg/v1"
 )

 func Enable(unit string) error {
-	task := execute.ExecTask{
-		Command:     "systemctl",
+	task := execute.ExecTask{Command: "systemctl",
 		Args:        []string{"enable", unit},
 		StreamStdio: false,
 	}

-	res, err := task.Execute(context.Background())
+	res, err := task.Execute()
 	if err != nil {
 		return err
 	}
@ -31,13 +29,12 @@ func Enable(unit string) error {
 }

 func Start(unit string) error {
-	task := execute.ExecTask{
-		Command:     "systemctl",
+	task := execute.ExecTask{Command: "systemctl",
 		Args:        []string{"start", unit},
 		StreamStdio: false,
 	}

-	res, err := task.Execute(context.Background())
+	res, err := task.Execute()
 	if err != nil {
 		return err
 	}
@ -50,13 +47,12 @@ func Start(unit string) error {
 }

 func DaemonReload() error {
-	task := execute.ExecTask{
-		Command:     "systemctl",
+	task := execute.ExecTask{Command: "systemctl",
 		Args:        []string{"daemon-reload"},
 		StreamStdio: false,
 	}

-	res, err := task.Execute(context.Background())
+	res, err := task.Execute()
 	if err != nil {
 		return err
 	}
@ -75,20 +71,23 @@ func InstallUnit(name string, tokens map[string]string) error {

 	tmplName := "./hack/" + name + ".service"
 	tmpl, err := template.ParseFiles(tmplName)
+
 	if err != nil {
 		return fmt.Errorf("error loading template %s, error %s", tmplName, err)
 	}

 	var tpl bytes.Buffer

-	if err := tmpl.Execute(&tpl, tokens); err != nil {
+	err = tmpl.Execute(&tpl, tokens)
+	if err != nil {
 		return err
 	}

-	if err := writeUnit(name+".service", tpl.Bytes()); err != nil {
+	err = writeUnit(name+".service", tpl.Bytes())
+
+	if err != nil {
 		return err
 	}
-
 	return nil
 }

@ -97,12 +96,7 @@ func writeUnit(name string, data []byte) error {
 	if err != nil {
 		return err
 	}
-
 	defer f.Close()
-
-	if _, err := f.Write(data); err != nil {
-		return err
-	}
-
-	return nil
+	_, err = f.Write(data)
+	return err
 }
--- a/vendor/github.com/Microsoft/go-winio/.golangci.yml
+++ b/vendor/github.com/Microsoft/go-winio/.golangci.yml
@ -8,8 +8,12 @@ linters:
    - containedctx # struct contains a context
    - dupl # duplicate code
    - errname # erorrs are named correctly
+    - goconst # strings that should be constants
+    - godot # comments end in a period
+    - misspell
    - nolintlint # "//nolint" directives are properly explained
    - revive # golint replacement
+    - stylecheck # golint replacement, less configurable than revive
    - unconvert # unnecessary conversions
    - wastedassign

@ -19,7 +23,10 @@ linters:
    - exhaustive # check exhaustiveness of enum switch statements
    - gofmt # files are gofmt'ed
    - gosec # security
+    - nestif # deeply nested ifs
    - nilerr # returns nil even with non-nil error
+    - prealloc # slices that can be pre-allocated
+    - structcheck # unused struct fields
    - unparam # unused function params

 issues:
@ -35,18 +42,6 @@ issues:
      text: "^line-length-limit: "
      source: "^//(go:generate|sys) "

-    #TODO: remove after upgrading to go1.18
-    # ignore comment spacing for nolint and sys directives
-    - linters:
-        - revive
-      text: "^comment-spacings: no space between comment delimiter and comment text"
-      source: "//(cspell:|nolint:|sys |todo)"
-
-    # not on go 1.18 yet, so no any
-    - linters:
-        - revive
-      text: "^use-any: since GO 1.18 'interface{}' can be replaced by 'any'"
-
    # allow unjustified ignores of error checks in defer statements
    - linters:
        - nolintlint
@ -61,8 +56,6 @@ issues:


 linters-settings:
-  exhaustive:
-    default-signifies-exhaustive: true
  govet:
    enable-all: true
    disable:
@ -105,8 +98,6 @@ linters-settings:
        disabled: true
      - name: flag-parameter # excessive, and a common idiom we use
        disabled: true
-      - name: unhandled-error # warns over common fmt.Print* and io.Close; rely on errcheck instead
-        disabled: true
      # general config
      - name: line-length-limit
        arguments:
@ -147,3 +138,7 @@ linters-settings:
            - VPCI
            - WCOW
            - WIM
+  stylecheck:
+    checks:
+      - "all"
+      - "-ST1003" # use revive's var naming
--- a/vendor/github.com/Microsoft/go-winio/hvsock.go
+++ b/vendor/github.com/Microsoft/go-winio/hvsock.go
@ -23,7 +23,7 @@ import (
 const afHVSock = 34 // AF_HYPERV

 // Well known Service and VM IDs
-// https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/user-guide/make-integration-service#vmid-wildcards
+//https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/user-guide/make-integration-service#vmid-wildcards

 // HvsockGUIDWildcard is the wildcard VmId for accepting connections from all partitions.
 func HvsockGUIDWildcard() guid.GUID { // 00000000-0000-0000-0000-000000000000
@ -31,7 +31,7 @@ func HvsockGUIDWildcard() guid.GUID { // 00000000-0000-0000-0000-000000000000
 }

 // HvsockGUIDBroadcast is the wildcard VmId for broadcasting sends to all partitions.
-func HvsockGUIDBroadcast() guid.GUID { // ffffffff-ffff-ffff-ffff-ffffffffffff
+func HvsockGUIDBroadcast() guid.GUID { //ffffffff-ffff-ffff-ffff-ffffffffffff
 	return guid.GUID{
 		Data1: 0xffffffff,
 		Data2: 0xffff,
@ -246,7 +246,7 @@ func (l *HvsockListener) Accept() (_ net.Conn, err error) {
 	var addrbuf [addrlen * 2]byte

 	var bytes uint32
-	err = syscall.AcceptEx(l.sock.handle, sock.handle, &addrbuf[0], 0 /* rxdatalen */, addrlen, addrlen, &bytes, &c.o)
+	err = syscall.AcceptEx(l.sock.handle, sock.handle, &addrbuf[0], 0 /*rxdatalen*/, addrlen, addrlen, &bytes, &c.o)
 	if _, err = l.sock.asyncIO(c, nil, bytes, err); err != nil {
 		return nil, l.opErr("accept", os.NewSyscallError("acceptex", err))
 	}
--- a/vendor/github.com/Microsoft/go-winio/internal/fs/doc.go
+++ b/vendor/github.com/Microsoft/go-winio/internal/fs/doc.go
@ -1,2 +0,0 @@
-// This package contains Win32 filesystem functionality.
-package fs
--- a/vendor/github.com/Microsoft/go-winio/internal/fs/fs.go
+++ b/vendor/github.com/Microsoft/go-winio/internal/fs/fs.go
@ -1,202 +0,0 @@
-//go:build windows
-
-package fs
-
-import (
-	"golang.org/x/sys/windows"
-
-	"github.com/Microsoft/go-winio/internal/stringbuffer"
-)
-
-//go:generate go run github.com/Microsoft/go-winio/tools/mkwinsyscall -output zsyscall_windows.go fs.go
-
-// https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-createfilew
-//sys CreateFile(name string, access AccessMask, mode FileShareMode, sa *syscall.SecurityAttributes, createmode FileCreationDisposition, attrs FileFlagOrAttribute, templatefile windows.Handle) (handle windows.Handle, err error) [failretval==windows.InvalidHandle] = CreateFileW
-
-const NullHandle windows.Handle = 0
-
-// AccessMask defines standard, specific, and generic rights.
-//
-//	Bitmask:
-//	 3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1
-//	 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
-//	+---------------+---------------+-------------------------------+
-//	|G|G|G|G|Resvd|A| StandardRights|         SpecificRights        |
-//	|R|W|E|A|     |S|               |                               |
-//	+-+-------------+---------------+-------------------------------+
-//
-//	GR     Generic Read
-//	GW     Generic Write
-//	GE     Generic Exectue
-//	GA     Generic All
-//	Resvd  Reserved
-//	AS     Access Security System
-//
-// https://learn.microsoft.com/en-us/windows/win32/secauthz/access-mask
-//
-// https://learn.microsoft.com/en-us/windows/win32/secauthz/generic-access-rights
-//
-// https://learn.microsoft.com/en-us/windows/win32/fileio/file-access-rights-constants
-type AccessMask = windows.ACCESS_MASK
-
-//nolint:revive // SNAKE_CASE is not idiomatic in Go, but aligned with Win32 API.
-const (
-	// Not actually any.
-	//
-	// For CreateFile: "query certain metadata such as file, directory, or device attributes without accessing that file or device"
-	// https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-createfilew#parameters
-	FILE_ANY_ACCESS AccessMask = 0
-
-	// Specific Object Access
-	// from ntioapi.h
-
-	FILE_READ_DATA      AccessMask = (0x0001) // file & pipe
-	FILE_LIST_DIRECTORY AccessMask = (0x0001) // directory
-
-	FILE_WRITE_DATA AccessMask = (0x0002) // file & pipe
-	FILE_ADD_FILE   AccessMask = (0x0002) // directory
-
-	FILE_APPEND_DATA          AccessMask = (0x0004) // file
-	FILE_ADD_SUBDIRECTORY     AccessMask = (0x0004) // directory
-	FILE_CREATE_PIPE_INSTANCE AccessMask = (0x0004) // named pipe
-
-	FILE_READ_EA         AccessMask = (0x0008) // file & directory
-	FILE_READ_PROPERTIES AccessMask = FILE_READ_EA
-
-	FILE_WRITE_EA         AccessMask = (0x0010) // file & directory
-	FILE_WRITE_PROPERTIES AccessMask = FILE_WRITE_EA
-
-	FILE_EXECUTE  AccessMask = (0x0020) // file
-	FILE_TRAVERSE AccessMask = (0x0020) // directory
-
-	FILE_DELETE_CHILD AccessMask = (0x0040) // directory
-
-	FILE_READ_ATTRIBUTES AccessMask = (0x0080) // all
-
-	FILE_WRITE_ATTRIBUTES AccessMask = (0x0100) // all
-
-	FILE_ALL_ACCESS      AccessMask = (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x1FF)
-	FILE_GENERIC_READ    AccessMask = (STANDARD_RIGHTS_READ | FILE_READ_DATA | FILE_READ_ATTRIBUTES | FILE_READ_EA | SYNCHRONIZE)
-	FILE_GENERIC_WRITE   AccessMask = (STANDARD_RIGHTS_WRITE | FILE_WRITE_DATA | FILE_WRITE_ATTRIBUTES | FILE_WRITE_EA | FILE_APPEND_DATA | SYNCHRONIZE)
-	FILE_GENERIC_EXECUTE AccessMask = (STANDARD_RIGHTS_EXECUTE | FILE_READ_ATTRIBUTES | FILE_EXECUTE | SYNCHRONIZE)
-
-	SPECIFIC_RIGHTS_ALL AccessMask = 0x0000FFFF
-
-	// Standard Access
-	// from ntseapi.h
-
-	DELETE       AccessMask = 0x0001_0000
-	READ_CONTROL AccessMask = 0x0002_0000
-	WRITE_DAC    AccessMask = 0x0004_0000
-	WRITE_OWNER  AccessMask = 0x0008_0000
-	SYNCHRONIZE  AccessMask = 0x0010_0000
-
-	STANDARD_RIGHTS_REQUIRED AccessMask = 0x000F_0000
-
-	STANDARD_RIGHTS_READ    AccessMask = READ_CONTROL
-	STANDARD_RIGHTS_WRITE   AccessMask = READ_CONTROL
-	STANDARD_RIGHTS_EXECUTE AccessMask = READ_CONTROL
-
-	STANDARD_RIGHTS_ALL AccessMask = 0x001F_0000
-)
-
-type FileShareMode uint32
-
-//nolint:revive // SNAKE_CASE is not idiomatic in Go, but aligned with Win32 API.
-const (
-	FILE_SHARE_NONE        FileShareMode = 0x00
-	FILE_SHARE_READ        FileShareMode = 0x01
-	FILE_SHARE_WRITE       FileShareMode = 0x02
-	FILE_SHARE_DELETE      FileShareMode = 0x04
-	FILE_SHARE_VALID_FLAGS FileShareMode = 0x07
-)
-
-type FileCreationDisposition uint32
-
-//nolint:revive // SNAKE_CASE is not idiomatic in Go, but aligned with Win32 API.
-const (
-	// from winbase.h
-
-	CREATE_NEW        FileCreationDisposition = 0x01
-	CREATE_ALWAYS     FileCreationDisposition = 0x02
-	OPEN_EXISTING     FileCreationDisposition = 0x03
-	OPEN_ALWAYS       FileCreationDisposition = 0x04
-	TRUNCATE_EXISTING FileCreationDisposition = 0x05
-)
-
-// CreateFile and co. take flags or attributes together as one parameter.
-// Define alias until we can use generics to allow both
-
-// https://learn.microsoft.com/en-us/windows/win32/fileio/file-attribute-constants
-type FileFlagOrAttribute uint32
-
-//nolint:revive // SNAKE_CASE is not idiomatic in Go, but aligned with Win32 API.
-const ( // from winnt.h
-	FILE_FLAG_WRITE_THROUGH       FileFlagOrAttribute = 0x8000_0000
-	FILE_FLAG_OVERLAPPED          FileFlagOrAttribute = 0x4000_0000
-	FILE_FLAG_NO_BUFFERING        FileFlagOrAttribute = 0x2000_0000
-	FILE_FLAG_RANDOM_ACCESS       FileFlagOrAttribute = 0x1000_0000
-	FILE_FLAG_SEQUENTIAL_SCAN     FileFlagOrAttribute = 0x0800_0000
-	FILE_FLAG_DELETE_ON_CLOSE     FileFlagOrAttribute = 0x0400_0000
-	FILE_FLAG_BACKUP_SEMANTICS    FileFlagOrAttribute = 0x0200_0000
-	FILE_FLAG_POSIX_SEMANTICS     FileFlagOrAttribute = 0x0100_0000
-	FILE_FLAG_OPEN_REPARSE_POINT  FileFlagOrAttribute = 0x0020_0000
-	FILE_FLAG_OPEN_NO_RECALL      FileFlagOrAttribute = 0x0010_0000
-	FILE_FLAG_FIRST_PIPE_INSTANCE FileFlagOrAttribute = 0x0008_0000
-)
-
-type FileSQSFlag = FileFlagOrAttribute
-
-//nolint:revive // SNAKE_CASE is not idiomatic in Go, but aligned with Win32 API.
-const ( // from winbase.h
-	SECURITY_ANONYMOUS      FileSQSFlag = FileSQSFlag(SecurityAnonymous << 16)
-	SECURITY_IDENTIFICATION FileSQSFlag = FileSQSFlag(SecurityIdentification << 16)
-	SECURITY_IMPERSONATION  FileSQSFlag = FileSQSFlag(SecurityImpersonation << 16)
-	SECURITY_DELEGATION     FileSQSFlag = FileSQSFlag(SecurityDelegation << 16)
-
-	SECURITY_SQOS_PRESENT     FileSQSFlag = 0x00100000
-	SECURITY_VALID_SQOS_FLAGS FileSQSFlag = 0x001F0000
-)
-
-// GetFinalPathNameByHandle flags
-//
-// https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-getfinalpathnamebyhandlew#parameters
-type GetFinalPathFlag uint32
-
-//nolint:revive // SNAKE_CASE is not idiomatic in Go, but aligned with Win32 API.
-const (
-	GetFinalPathDefaultFlag GetFinalPathFlag = 0x0
-
-	FILE_NAME_NORMALIZED GetFinalPathFlag = 0x0
-	FILE_NAME_OPENED     GetFinalPathFlag = 0x8
-
-	VOLUME_NAME_DOS  GetFinalPathFlag = 0x0
-	VOLUME_NAME_GUID GetFinalPathFlag = 0x1
-	VOLUME_NAME_NT   GetFinalPathFlag = 0x2
-	VOLUME_NAME_NONE GetFinalPathFlag = 0x4
-)
-
-// getFinalPathNameByHandle facilitates calling the Windows API GetFinalPathNameByHandle
-// with the given handle and flags. It transparently takes care of creating a buffer of the
-// correct size for the call.
-//
-// https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-getfinalpathnamebyhandlew
-func GetFinalPathNameByHandle(h windows.Handle, flags GetFinalPathFlag) (string, error) {
-	b := stringbuffer.NewWString()
-	//TODO: can loop infinitely if Win32 keeps returning the same (or a larger) n?
-	for {
-		n, err := windows.GetFinalPathNameByHandle(h, b.Pointer(), b.Cap(), uint32(flags))
-		if err != nil {
-			return "", err
-		}
-		// If the buffer wasn't large enough, n will be the total size needed (including null terminator).
-		// Resize and try again.
-		if n > b.Cap() {
-			b.ResizeTo(n)
-			continue
-		}
-		// If the buffer is large enough, n will be the size not including the null terminator.
-		// Convert to a Go string and return.
-		return b.String(), nil
-	}
-}
--- a/vendor/github.com/Microsoft/go-winio/internal/fs/security.go
+++ b/vendor/github.com/Microsoft/go-winio/internal/fs/security.go
@ -1,12 +0,0 @@
-package fs
-
-// https://learn.microsoft.com/en-us/windows/win32/api/winnt/ne-winnt-security_impersonation_level
-type SecurityImpersonationLevel int32 // C default enums underlying type is `int`, which is Go `int32`
-
-// Impersonation levels
-const (
-	SecurityAnonymous      SecurityImpersonationLevel = 0
-	SecurityIdentification SecurityImpersonationLevel = 1
-	SecurityImpersonation  SecurityImpersonationLevel = 2
-	SecurityDelegation     SecurityImpersonationLevel = 3
-)
--- a/vendor/github.com/Microsoft/go-winio/internal/fs/zsyscall_windows.go
+++ b/vendor/github.com/Microsoft/go-winio/internal/fs/zsyscall_windows.go
@ -1,64 +0,0 @@
-//go:build windows
-
-// Code generated by 'go generate' using "github.com/Microsoft/go-winio/tools/mkwinsyscall"; DO NOT EDIT.
-
-package fs
-
-import (
-	"syscall"
-	"unsafe"
-
-	"golang.org/x/sys/windows"
-)
-
-var _ unsafe.Pointer
-
-// Do the interface allocations only once for common
-// Errno values.
-const (
-	errnoERROR_IO_PENDING = 997
-)
-
-var (
-	errERROR_IO_PENDING error = syscall.Errno(errnoERROR_IO_PENDING)
-	errERROR_EINVAL     error = syscall.EINVAL
-)
-
-// errnoErr returns common boxed Errno values, to prevent
-// allocations at runtime.
-func errnoErr(e syscall.Errno) error {
-	switch e {
-	case 0:
-		return errERROR_EINVAL
-	case errnoERROR_IO_PENDING:
-		return errERROR_IO_PENDING
-	}
-	// TODO: add more here, after collecting data on the common
-	// error values see on Windows. (perhaps when running
-	// all.bat?)
-	return e
-}
-
-var (
-	modkernel32 = windows.NewLazySystemDLL("kernel32.dll")
-
-	procCreateFileW = modkernel32.NewProc("CreateFileW")
-)
-
-func CreateFile(name string, access AccessMask, mode FileShareMode, sa *syscall.SecurityAttributes, createmode FileCreationDisposition, attrs FileFlagOrAttribute, templatefile windows.Handle) (handle windows.Handle, err error) {
-	var _p0 *uint16
-	_p0, err = syscall.UTF16PtrFromString(name)
-	if err != nil {
-		return
-	}
-	return _CreateFile(_p0, access, mode, sa, createmode, attrs, templatefile)
-}
-
-func _CreateFile(name *uint16, access AccessMask, mode FileShareMode, sa *syscall.SecurityAttributes, createmode FileCreationDisposition, attrs FileFlagOrAttribute, templatefile windows.Handle) (handle windows.Handle, err error) {
-	r0, _, e1 := syscall.Syscall9(procCreateFileW.Addr(), 7, uintptr(unsafe.Pointer(name)), uintptr(access), uintptr(mode), uintptr(unsafe.Pointer(sa)), uintptr(createmode), uintptr(attrs), uintptr(templatefile), 0, 0)
-	handle = windows.Handle(r0)
-	if handle == windows.InvalidHandle {
-		err = errnoErr(e1)
-	}
-	return
-}
--- a/vendor/github.com/Microsoft/go-winio/internal/socket/socket.go
+++ b/vendor/github.com/Microsoft/go-winio/internal/socket/socket.go
@ -100,8 +100,8 @@ func (f *runtimeFunc) Load() error {
 			(*byte)(unsafe.Pointer(&f.addr)),
 			uint32(unsafe.Sizeof(f.addr)),
 			&n,
-			nil, // overlapped
-			0,   // completionRoutine
+			nil, //overlapped
+			0,   //completionRoutine
 		)
 	})
 	return f.err
--- a/vendor/github.com/Microsoft/go-winio/internal/stringbuffer/wstring.go
+++ b/vendor/github.com/Microsoft/go-winio/internal/stringbuffer/wstring.go
@ -1,132 +0,0 @@
-package stringbuffer
-
-import (
-	"sync"
-	"unicode/utf16"
-)
-
-// TODO: worth exporting and using in mkwinsyscall?
-
-// Uint16BufferSize is the buffer size in the pool, chosen somewhat arbitrarily to accommodate
-// large path strings:
-// MAX_PATH (260) + size of volume GUID prefix (49) + null terminator = 310.
-const MinWStringCap = 310
-
-// use *[]uint16 since []uint16 creates an extra allocation where the slice header
-// is copied to heap and then referenced via pointer in the interface header that sync.Pool
-// stores.
-var pathPool = sync.Pool{ // if go1.18+ adds Pool[T], use that to store []uint16 directly
-	New: func() interface{} {
-		b := make([]uint16, MinWStringCap)
-		return &b
-	},
-}
-
-func newBuffer() []uint16 { return *(pathPool.Get().(*[]uint16)) }
-
-// freeBuffer copies the slice header data, and puts a pointer to that in the pool.
-// This avoids taking a pointer to the slice header in WString, which can be set to nil.
-func freeBuffer(b []uint16) { pathPool.Put(&b) }
-
-// WString is a wide string buffer ([]uint16) meant for storing UTF-16 encoded strings
-// for interacting with Win32 APIs.
-// Sizes are specified as uint32 and not int.
-//
-// It is not thread safe.
-type WString struct {
-	// type-def allows casting to []uint16 directly, use struct to prevent that and allow adding fields in the future.
-
-	// raw buffer
-	b []uint16
-}
-
-// NewWString returns a [WString] allocated from a shared pool with an
-// initial capacity of at least [MinWStringCap].
-// Since the buffer may have been previously used, its contents are not guaranteed to be empty.
-//
-// The buffer should be freed via [WString.Free]
-func NewWString() *WString {
-	return &WString{
-		b: newBuffer(),
-	}
-}
-
-func (b *WString) Free() {
-	if b.empty() {
-		return
-	}
-	freeBuffer(b.b)
-	b.b = nil
-}
-
-// ResizeTo grows the buffer to at least c and returns the new capacity, freeing the
-// previous buffer back into pool.
-func (b *WString) ResizeTo(c uint32) uint32 {
-	// allready sufficient (or n is 0)
-	if c <= b.Cap() {
-		return b.Cap()
-	}
-
-	if c <= MinWStringCap {
-		c = MinWStringCap
-	}
-	// allocate at-least double buffer size, as is done in [bytes.Buffer] and other places
-	if c <= 2*b.Cap() {
-		c = 2 * b.Cap()
-	}
-
-	b2 := make([]uint16, c)
-	if !b.empty() {
-		copy(b2, b.b)
-		freeBuffer(b.b)
-	}
-	b.b = b2
-	return c
-}
-
-// Buffer returns the underlying []uint16 buffer.
-func (b *WString) Buffer() []uint16 {
-	if b.empty() {
-		return nil
-	}
-	return b.b
-}
-
-// Pointer returns a pointer to the first uint16 in the buffer.
-// If the [WString.Free] has already been called, the pointer will be nil.
-func (b *WString) Pointer() *uint16 {
-	if b.empty() {
-		return nil
-	}
-	return &b.b[0]
-}
-
-// String returns the returns the UTF-8 encoding of the UTF-16 string in the buffer.
-//
-// It assumes that the data is null-terminated.
-func (b *WString) String() string {
-	// Using [windows.UTF16ToString] would require importing "golang.org/x/sys/windows"
-	// and would make this code Windows-only, which makes no sense.
-	// So copy UTF16ToString code into here.
-	// If other windows-specific code is added, switch to [windows.UTF16ToString]
-
-	s := b.b
-	for i, v := range s {
-		if v == 0 {
-			s = s[:i]
-			break
-		}
-	}
-	return string(utf16.Decode(s))
-}
-
-// Cap returns the underlying buffer capacity.
-func (b *WString) Cap() uint32 {
-	if b.empty() {
-		return 0
-	}
-	return b.cap()
-}
-
-func (b *WString) cap() uint32 { return uint32(cap(b.b)) }
-func (b *WString) empty() bool { return b == nil || b.cap() == 0 }
--- a/vendor/github.com/Microsoft/go-winio/pipe.go
+++ b/vendor/github.com/Microsoft/go-winio/pipe.go
@ -16,12 +16,11 @@ import (
 	"unsafe"

 	"golang.org/x/sys/windows"
-
-	"github.com/Microsoft/go-winio/internal/fs"
 )

 //sys connectNamedPipe(pipe syscall.Handle, o *syscall.Overlapped) (err error) = ConnectNamedPipe
 //sys createNamedPipe(name string, flags uint32, pipeMode uint32, maxInstances uint32, outSize uint32, inSize uint32, defaultTimeout uint32, sa *syscall.SecurityAttributes) (handle syscall.Handle, err error)  [failretval==syscall.InvalidHandle] = CreateNamedPipeW
+//sys createFile(name string, access uint32, mode uint32, sa *syscall.SecurityAttributes, createmode uint32, attrs uint32, templatefile syscall.Handle) (handle syscall.Handle, err error) [failretval==syscall.InvalidHandle] = CreateFileW
 //sys getNamedPipeInfo(pipe syscall.Handle, flags *uint32, outSize *uint32, inSize *uint32, maxInstances *uint32) (err error) = GetNamedPipeInfo
 //sys getNamedPipeHandleState(pipe syscall.Handle, state *uint32, curInstances *uint32, maxCollectionCount *uint32, collectDataTimeout *uint32, userName *uint16, maxUserNameSize uint32) (err error) = GetNamedPipeHandleStateW
 //sys localAlloc(uFlags uint32, length uint32) (ptr uintptr) = LocalAlloc
@ -164,21 +163,19 @@ func (s pipeAddress) String() string {
 }

 // tryDialPipe attempts to dial the pipe at `path` until `ctx` cancellation or timeout.
-func tryDialPipe(ctx context.Context, path *string, access fs.AccessMask) (syscall.Handle, error) {
+func tryDialPipe(ctx context.Context, path *string, access uint32) (syscall.Handle, error) {
 	for {
 		select {
 		case <-ctx.Done():
 			return syscall.Handle(0), ctx.Err()
 		default:
-			wh, err := fs.CreateFile(*path,
+			h, err := createFile(*path,
 				access,
-				0,   // mode
-				nil, // security attributes
-				fs.OPEN_EXISTING,
-				fs.FILE_FLAG_OVERLAPPED|fs.SECURITY_SQOS_PRESENT|fs.SECURITY_ANONYMOUS,
-				0, // template file handle
-			)
-			h := syscall.Handle(wh)
+				0,
+				nil,
+				syscall.OPEN_EXISTING,
+				windows.FILE_FLAG_OVERLAPPED|windows.SECURITY_SQOS_PRESENT|windows.SECURITY_ANONYMOUS,
+				0)
 			if err == nil {
 				return h, nil
 			}
@ -222,7 +219,7 @@ func DialPipeContext(ctx context.Context, path string) (net.Conn, error) {
 func DialPipeAccess(ctx context.Context, path string, access uint32) (net.Conn, error) {
 	var err error
 	var h syscall.Handle
-	h, err = tryDialPipe(ctx, &path, fs.AccessMask(access))
+	h, err = tryDialPipe(ctx, &path, access)
 	if err != nil {
 		return nil, err
 	}
@ -282,7 +279,6 @@ func makeServerPipeHandle(path string, sd []byte, c *PipeConfig, first bool) (sy
 	}
 	defer localFree(ntPath.Buffer)
 	oa.ObjectName = &ntPath
-	oa.Attributes = windows.OBJ_CASE_INSENSITIVE

 	// The security descriptor is only needed for the first pipe.
 	if first {
--- a/vendor/github.com/Microsoft/go-winio/tools/mkwinsyscall/mkwinsyscall.go
+++ b/vendor/github.com/Microsoft/go-winio/tools/mkwinsyscall/mkwinsyscall.go
@ -477,14 +477,15 @@ func newFn(s string) (*Fn, error) {
 		return nil, errors.New("Could not extract dll name from \"" + f.src + "\"")
 	}
 	s = trim(s[1:])
-	if i := strings.LastIndex(s, "."); i >= 0 {
-		f.dllname = s[:i]
-		f.dllfuncname = s[i+1:]
-	} else {
-		f.dllfuncname = s
-	}
-	if f.dllfuncname == "" {
-		return nil, fmt.Errorf("function name is not specified in %q", s)
+	a := strings.Split(s, ".")
+	switch len(a) {
+	case 1:
+		f.dllfuncname = a[0]
+	case 2:
+		f.dllname = a[0]
+		f.dllfuncname = a[1]
+	default:
+		return nil, errors.New("Could not extract dll name from \"" + f.src + "\"")
 	}
 	if n := f.dllfuncname; endsIn(n, '?') {
 		f.dllfuncname = n[:len(n)-1]
@ -501,23 +502,7 @@ func (f *Fn) DLLName() string {
 	return f.dllname
 }

-// DLLVar returns a valid Go identifier that represents DLLName.
-func (f *Fn) DLLVar() string {
-	id := strings.Map(func(r rune) rune {
-		switch r {
-		case '.', '-':
-			return '_'
-		default:
-			return r
-		}
-	}, f.DLLName())
-	if !token.IsIdentifier(id) {
-		panic(fmt.Errorf("could not create Go identifier for DLLName %q", f.DLLName()))
-	}
-	return id
-}
-
-// DLLFuncName returns DLL function name for function f.
+// DLLName returns DLL function name for function f.
 func (f *Fn) DLLFuncName() string {
 	if f.dllfuncname == "" {
 		return f.Name
@ -663,13 +648,6 @@ func (f *Fn) HelperName() string {
 	return "_" + f.Name
 }

-// DLL is a DLL's filename and a string that is valid in a Go identifier that should be used when
-// naming a variable that refers to the DLL.
-type DLL struct {
-	Name string
-	Var  string
-}
-
 // Source files and functions.
 type Source struct {
 	Funcs           []*Fn
@ -719,20 +697,18 @@ func ParseFiles(fs []string) (*Source, error) {
 }

 // DLLs return dll names for a source set src.
-func (src *Source) DLLs() []DLL {
+func (src *Source) DLLs() []string {
 	uniq := make(map[string]bool)
-	r := make([]DLL, 0)
+	r := make([]string, 0)
 	for _, f := range src.Funcs {
-		id := f.DLLVar()
-		if _, found := uniq[id]; !found {
-			uniq[id] = true
-			r = append(r, DLL{f.DLLName(), id})
+		name := f.DLLName()
+		if _, found := uniq[name]; !found {
+			uniq[name] = true
+			r = append(r, name)
 		}
 	}
 	if *sortdecls {
-		sort.Slice(r, func(i, j int) bool {
-			return r[i].Var < r[j].Var
-		})
+		sort.Strings(r)
 	}
 	return r
 }
@ -902,22 +878,6 @@ func (src *Source) Generate(w io.Writer) error {
 	return nil
 }

-func writeTempSourceFile(data []byte) (string, error) {
-	f, err := os.CreateTemp("", "mkwinsyscall-generated-*.go")
-	if err != nil {
-		return "", err
-	}
-	_, err = f.Write(data)
-	if closeErr := f.Close(); err == nil {
-		err = closeErr
-	}
-	if err != nil {
-		os.Remove(f.Name()) // best effort
-		return "", err
-	}
-	return f.Name(), nil
-}
-
 func usage() {
 	fmt.Fprintf(os.Stderr, "usage: mkwinsyscall [flags] [path ...]\n")
 	flag.PrintDefaults()
@ -944,12 +904,7 @@ func main() {

 	data, err := format.Source(buf.Bytes())
 	if err != nil {
-		log.Printf("failed to format source: %v", err)
-		f, err := writeTempSourceFile(buf.Bytes())
-		if err != nil {
-			log.Fatalf("failed to write unformatted source to file: %v", err)
-		}
-		log.Fatalf("for diagnosis, wrote unformatted source to %v", f)
+		log.Fatal(err)
 	}
 	if *filename == "" {
 		_, err = os.Stdout.Write(data)
@ -1015,10 +970,10 @@ var (

 {{/* help functions */}}

-{{define "dlls"}}{{range .DLLs}}	mod{{.Var}} = {{newlazydll .Name}}
+{{define "dlls"}}{{range .DLLs}}	mod{{.}} = {{newlazydll .}}
 {{end}}{{end}}

-{{define "funcnames"}}{{range .DLLFuncNames}}	proc{{.DLLFuncName}} = mod{{.DLLVar}}.NewProc("{{.DLLFuncName}}")
+{{define "funcnames"}}{{range .DLLFuncNames}}	proc{{.DLLFuncName}} = mod{{.DLLName}}.NewProc("{{.DLLFuncName}}")
 {{end}}{{end}}

 {{define "helperbody"}}
--- a/vendor/github.com/Microsoft/go-winio/zsyscall_windows.go
+++ b/vendor/github.com/Microsoft/go-winio/zsyscall_windows.go
@ -63,6 +63,7 @@ var (
 	procBackupWrite                                          = modkernel32.NewProc("BackupWrite")
 	procCancelIoEx                                           = modkernel32.NewProc("CancelIoEx")
 	procConnectNamedPipe                                     = modkernel32.NewProc("ConnectNamedPipe")
+	procCreateFileW                                          = modkernel32.NewProc("CreateFileW")
 	procCreateIoCompletionPort                               = modkernel32.NewProc("CreateIoCompletionPort")
 	procCreateNamedPipeW                                     = modkernel32.NewProc("CreateNamedPipeW")
 	procGetCurrentThread                                     = modkernel32.NewProc("GetCurrentThread")
@ -304,6 +305,24 @@ func connectNamedPipe(pipe syscall.Handle, o *syscall.Overlapped) (err error) {
 	return
 }

+func createFile(name string, access uint32, mode uint32, sa *syscall.SecurityAttributes, createmode uint32, attrs uint32, templatefile syscall.Handle) (handle syscall.Handle, err error) {
+	var _p0 *uint16
+	_p0, err = syscall.UTF16PtrFromString(name)
+	if err != nil {
+		return
+	}
+	return _createFile(_p0, access, mode, sa, createmode, attrs, templatefile)
+}
+
+func _createFile(name *uint16, access uint32, mode uint32, sa *syscall.SecurityAttributes, createmode uint32, attrs uint32, templatefile syscall.Handle) (handle syscall.Handle, err error) {
+	r0, _, e1 := syscall.Syscall9(procCreateFileW.Addr(), 7, uintptr(unsafe.Pointer(name)), uintptr(access), uintptr(mode), uintptr(unsafe.Pointer(sa)), uintptr(createmode), uintptr(attrs), uintptr(templatefile), 0, 0)
+	handle = syscall.Handle(r0)
+	if handle == syscall.InvalidHandle {
+		err = errnoErr(e1)
+	}
+	return
+}
+
 func createIoCompletionPort(file syscall.Handle, port syscall.Handle, key uintptr, threadCount uint32) (newport syscall.Handle, err error) {
 	r0, _, e1 := syscall.Syscall6(procCreateIoCompletionPort.Addr(), 4, uintptr(file), uintptr(port), uintptr(key), uintptr(threadCount), 0, 0)
 	newport = syscall.Handle(r0)
--- a/vendor/github.com/alexellis/arkade/pkg/env/env.go
+++ b/vendor/github.com/alexellis/arkade/pkg/env/env.go
@ -4,32 +4,26 @@
 package env

 import (
-	"context"
 	"log"
 	"os"
 	"path"
 	"strings"

-	execute "github.com/alexellis/go-execute/v2"
+	execute "github.com/alexellis/go-execute/pkg/v1"
 )

 // GetClientArch returns a pair of arch and os
 func GetClientArch() (arch string, os string) {
-	task := execute.ExecTask{
-		Command:     "uname",
-		Args:        []string{"-m"},
-		StreamStdio: false}
-	res, err := task.Execute(context.Background())
+	task := execute.ExecTask{Command: "uname", Args: []string{"-m"}, StreamStdio: false}
+	res, err := task.Execute()
 	if err != nil {
 		log.Println(err)
 	}

 	archResult := strings.TrimSpace(res.Stdout)

-	taskOS := execute.ExecTask{Command: "uname",
-		Args:        []string{"-s"},
-		StreamStdio: false}
-	resOS, errOS := taskOS.Execute(context.Background())
+	taskOS := execute.ExecTask{Command: "uname", Args: []string{"-s"}, StreamStdio: false}
+	resOS, errOS := taskOS.Execute()
 	if errOS != nil {
 		log.Println(errOS)
 	}
--- a/vendor/github.com/alexellis/go-execute/v2/LICENSE
+++ b/vendor/github.com/alexellis/go-execute/v2/LICENSE
@ -1,6 +1,6 @@
 MIT License

-Copyright (c) 2023 Alex Ellis
+Copyright (c) 2019 Inlets

 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
--- a/vendor/github.com/alexellis/go-execute/pkg/v1/exec.go
+++ b/vendor/github.com/alexellis/go-execute/pkg/v1/exec.go
@ -0,0 +1,134 @@
+package execute
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"strings"
+)
+
+type ExecTask struct {
+	Command string
+	Args    []string
+	Shell   bool
+	Env     []string
+	Cwd     string
+
+	// Stdin connect a reader to stdin for the command
+	// being executed.
+	Stdin io.Reader
+
+	// StreamStdio prints stdout and stderr directly to os.Stdout/err as
+	// the command runs.
+	StreamStdio bool
+
+	// PrintCommand prints the command before executing
+	PrintCommand bool
+}
+
+type ExecResult struct {
+	Stdout   string
+	Stderr   string
+	ExitCode int
+}
+
+func (et ExecTask) Execute() (ExecResult, error) {
+	argsSt := ""
+	if len(et.Args) > 0 {
+		argsSt = strings.Join(et.Args, " ")
+	}
+
+	if et.PrintCommand {
+		fmt.Println("exec: ", et.Command, argsSt)
+	}
+
+	var cmd *exec.Cmd
+
+	if et.Shell {
+		var args []string
+		if len(et.Args) == 0 {
+			startArgs := strings.Split(et.Command, " ")
+			script := strings.Join(startArgs, " ")
+			args = append([]string{"-c"}, fmt.Sprintf("%s", script))
+
+		} else {
+			script := strings.Join(et.Args, " ")
+			args = append([]string{"-c"}, fmt.Sprintf("%s %s", et.Command, script))
+
+		}
+
+		cmd = exec.Command("/bin/bash", args...)
+	} else {
+		if strings.Index(et.Command, " ") > 0 {
+			parts := strings.Split(et.Command, " ")
+			command := parts[0]
+			args := parts[1:]
+			cmd = exec.Command(command, args...)
+
+		} else {
+			cmd = exec.Command(et.Command, et.Args...)
+		}
+	}
+
+	cmd.Dir = et.Cwd
+
+	if len(et.Env) > 0 {
+		overrides := map[string]bool{}
+		for _, env := range et.Env {
+			key := strings.Split(env, "=")[0]
+			overrides[key] = true
+			cmd.Env = append(cmd.Env, env)
+		}
+
+		for _, env := range os.Environ() {
+			key := strings.Split(env, "=")[0]
+
+			if _, ok := overrides[key]; !ok {
+				cmd.Env = append(cmd.Env, env)
+			}
+		}
+	}
+	if et.Stdin != nil {
+		cmd.Stdin = et.Stdin
+	}
+
+	stdoutBuff := bytes.Buffer{}
+	stderrBuff := bytes.Buffer{}
+
+	var stdoutWriters io.Writer
+	var stderrWriters io.Writer
+
+	if et.StreamStdio {
+		stdoutWriters = io.MultiWriter(os.Stdout, &stdoutBuff)
+		stderrWriters = io.MultiWriter(os.Stderr, &stderrBuff)
+	} else {
+		stdoutWriters = &stdoutBuff
+		stderrWriters = &stderrBuff
+	}
+
+	cmd.Stdout = stdoutWriters
+	cmd.Stderr = stderrWriters
+
+	startErr := cmd.Start()
+
+	if startErr != nil {
+		return ExecResult{}, startErr
+	}
+
+	exitCode := 0
+	execErr := cmd.Wait()
+	if execErr != nil {
+		if exitError, ok := execErr.(*exec.ExitError); ok {
+
+			exitCode = exitError.ExitCode()
+		}
+	}
+
+	return ExecResult{
+		Stdout:   string(stdoutBuff.Bytes()),
+		Stderr:   string(stderrBuff.Bytes()),
+		ExitCode: exitCode,
+	}, nil
+}
--- a/vendor/github.com/alexellis/go-execute/v2/.DEREK.yml
+++ b/vendor/github.com/alexellis/go-execute/v2/.DEREK.yml
@ -1 +0,0 @@
-redirect: https://raw.githubusercontent.com/openfaas/faas/master/.DEREK.yml
--- a/vendor/github.com/alexellis/go-execute/v2/.gitignore
+++ b/vendor/github.com/alexellis/go-execute/v2/.gitignore
@ -1,2 +0,0 @@
-/go-execute
-main.go
--- a/vendor/github.com/alexellis/go-execute/v2/Makefile
+++ b/vendor/github.com/alexellis/go-execute/v2/Makefile
@ -1,2 +0,0 @@
-all:
-	go test -v ./...
--- a/vendor/github.com/alexellis/go-execute/v2/README.md
+++ b/vendor/github.com/alexellis/go-execute/v2/README.md
@ -1,143 +0,0 @@
-## go-execute
-
-A wrapper for Go's command execution packages.
-
-`go get github.com/alexellis/go-execute/v2`
-
-## Docs
-
-See docs at pkg.go.dev: [github.com/alexellis/go-execute](https://pkg.go.dev/github.com/alexellis/go-execute)
-
-## go-execute users
-
-[Used by dozens of projects as identified by GitHub](https://github.com/alexellis/go-execute/network/dependents), notably:
-
-* [alexellis/arkade](https://github.com/alexellis/arkade)
-* [openfaas/faas-cli](https://github.com/openfaas/faas-cli)
-* [inlets/inletsctl](https://github.com/inlets/inletsctl)
-* [inlets/cloud-provision](https://github.com/inlets/cloud-provision)
-* [alexellis/k3sup](https://github.com/alexellis/k3sup)
-* [openfaas/connector-sdk](https://github.com/openfaas/connector-sdk)
-* [openfaas-incubator/ofc-bootstrap](https://github.com/openfaas-incubator/ofc-bootstrap)
-
-Community examples:
-
-* [dokku/lambda-builder](https://github.com/dokku/lambda-builder)
-* [027xiguapi/pear-rec](https://github.com/027xiguapi/pear-rec)
-* [cnrancher/autok3s](https://github.com/cnrancher/autok3s)
-* [ainsleydev/hupi](https://github.com/ainsleydev/hupi)
-* [andiwork/andictl](https://github.com/andiwork/andictl)
-* [tonit/rekind](https://github.com/tonit/rekind)
-* [lucasrod16/ec2-k3s](https://github.com/lucasrod16/ec2-k3s)
-* [seaweedfs/seaweed-up](https://github.com/seaweedfs/seaweed-up)
-* [jsiebens/inlets-on-fly](https://github.com/jsiebens/inlets-on-fly)
-* [jsiebens/hashi-up](https://github.com/jsiebens/hashi-up)
-* [edgego/ecm](https://github.com/edgego/ecm)
-* [ministryofjustice/cloud-platform-terraform-upgrade](https://github.com/ministryofjustice/cloud-platform-terraform-upgrade)
-* [mattcanty/go-ffmpeg-transcode](https://github.com/mattcanty/go-ffmpeg-transcode)
-* [Popoola-Opeyemi/meeseeks](https://github.com/Popoola-Opeyemi/meeseeks)
-* [aidun/minicloud](https://github.com/aidun/minicloud)
-
-Feel free to add a link to your own projects in a PR.
-
-## Main options
-
-* `DisableStdioBuffer` - Discard Stdio, rather than buffering into memory
-* `StreamStdio` - Stream stderr and stdout to the console, useful for debugging and testing
-* `Shell` - Use bash as a shell to execute the command, rather than exec a binary directly
-* `StdOutWriter` - an additional writer for stdout, useful for mutating or filtering the output
-* `StdErrWriter` - an additional writer for stderr, useful for mutating or filtering the output
-* `PrintCommand` - print the command to stdout before executing it
-
-## Example of exec without streaming to STDIO
-
-This example captures the values from stdout and stderr without relaying to the console. This means the values can be inspected and used for automation.
-
-```golang
-package main
-
-import (
-	"fmt"
-
-	execute "github.com/alexellis/go-execute/v2"
-	"context"
-)
-
-func main() {
-	cmd := execute.ExecTask{
-		Command:     "docker",
-		Args:        []string{"version"},
-		StreamStdio: false,
-	}
-
-	res, err := cmd.Execute(context.Background())
-	if err != nil {
-		panic(err)
-	}
-
-	if res.ExitCode != 0 {
-		panic("Non-zero exit code: " + res.Stderr)
-	}
-
-	fmt.Printf("stdout: %s, stderr: %s, exit-code: %d\n", res.Stdout, res.Stderr, res.ExitCode)
-}
-```
-
-## Example with "shell" and exit-code 0
-
-```golang
-package main
-
-import (
-	"fmt"
-
-	execute "github.com/alexellis/go-execute/v2"
-	"context"
-)
-
-func main() {
-	ls := execute.ExecTask{
-		Command: "ls",
-		Args:    []string{"-l"},
-		Shell:   true,
-	}
-	res, err := ls.Execute(context.Background())
-	if err != nil {
-		panic(err)
-	}
-
-	fmt.Printf("stdout: %q, stderr: %q, exit-code: %d\n", res.Stdout, res.Stderr, res.ExitCode)
-}
-```
-
-## Example with "shell" and exit-code 1
-
-```golang
-package main
-
-import (
-	"fmt"
-
-	"context"
-	execute "github.com/alexellis/go-execute/v2"
-)
-
-func main() {
-	ls := execute.ExecTask{
-		Command: "exit 1",
-		Shell:   true,
-	}
-	res, err := ls.Execute(context.Background())
-	if err != nil {
-		panic(err)
-	}
-
-	fmt.Printf("stdout: %q, stderr: %q, exit-code: %d\n", res.Stdout, res.Stderr, res.ExitCode)
-}
-```
-
-## Contributing
-
-Commits must be signed off with `git commit -s`
-
-License: MIT
--- a/vendor/github.com/alexellis/go-execute/v2/exec.go
+++ b/vendor/github.com/alexellis/go-execute/v2/exec.go
@ -1,193 +0,0 @@
-package execute
-
-import (
-	"bytes"
-	"context"
-	"fmt"
-	"io"
-	"os"
-	"os/exec"
-	"strings"
-)
-
-type ExecTask struct {
-	// Command is the command to execute. This can be the path to an executable
-	// or the executable with arguments. The arguments are detected by looking for
-	// a space.
-	//
-	// Any arguments must be given via Args
-	Command string
-
-	// Args are the arguments to pass to the command. These are ignored if the
-	// Command contains arguments.
-	Args []string
-
-	// Shell run the command in a bash shell.
-	// Note that the system must have `bash` installed in the PATH or in /bin/bash
-	Shell bool
-
-	// Env is a list of environment variables to add to the current environment,
-	// these are used to override any existing environment variables.
-	Env []string
-
-	// Cwd is the working directory for the command
-	Cwd string
-
-	// Stdin connect a reader to stdin for the command
-	// being executed.
-	Stdin io.Reader
-
-	// PrintCommand prints the command before executing
-	PrintCommand bool
-
-	// StreamStdio prints stdout and stderr directly to os.Stdout/err as
-	// the command runs.
-	StreamStdio bool
-
-	// DisableStdioBuffer prevents any output from being saved in the
-	// TaskResult, which is useful for when the result is very large, or
-	// when you want to stream the output to another writer exclusively.
-	DisableStdioBuffer bool
-
-	// StdoutWriter when set will receive a copy of stdout from the command
-	StdOutWriter io.Writer
-
-	// StderrWriter when set will receive a copy of stderr from the command
-	StdErrWriter io.Writer
-}
-
-type ExecResult struct {
-	Stdout    string
-	Stderr    string
-	ExitCode  int
-	Cancelled bool
-}
-
-func (et ExecTask) Execute(ctx context.Context) (ExecResult, error) {
-	argsSt := ""
-	if len(et.Args) > 0 {
-		argsSt = strings.Join(et.Args, " ")
-	}
-
-	if et.PrintCommand {
-		fmt.Println("exec: ", et.Command, argsSt)
-	}
-
-	// don't try to run if the context is already cancelled
-	if ctx.Err() != nil {
-		return ExecResult{
-			// the exec package returns -1 for cancelled commands
-			ExitCode:  -1,
-			Cancelled: ctx.Err() == context.Canceled,
-		}, ctx.Err()
-	}
-
-	var command string
-	var commandArgs []string
-	if et.Shell {
-
-		// On a NixOS system, /bin/bash doesn't exist at /bin/bash
-		// the default behavior of exec.Command is to look for the
-		// executable in PATH.
-
-		command = "bash"
-		// There is a chance that PATH is not populate or propagated, therefore
-		// when bash cannot be resolved, set it to /bin/bash instead.
-		if _, err := exec.LookPath(command); err != nil {
-			command = "/bin/bash"
-		}
-
-		if len(et.Args) == 0 {
-			// use Split and Join to remove any extra whitespace?
-			startArgs := strings.Split(et.Command, " ")
-			script := strings.Join(startArgs, " ")
-			commandArgs = append([]string{"-c"}, script)
-
-		} else {
-			script := strings.Join(et.Args, " ")
-			commandArgs = append([]string{"-c"}, fmt.Sprintf("%s %s", et.Command, script))
-		}
-	} else {
-
-		command = et.Command
-		commandArgs = et.Args
-
-		// AE: This had to be removed to fix: #117 where Windows users
-		// have spaces in their paths, which are misinterpreted as
-		// arguments for the command.
-		// if strings.Contains(et.Command, " ") {
-		// 	parts := strings.Split(et.Command, " ")
-		// 	command = parts[0]
-		// 	commandArgs = parts[1:]
-		// }
-	}
-
-	cmd := exec.CommandContext(ctx, command, commandArgs...)
-	cmd.Dir = et.Cwd
-
-	if len(et.Env) > 0 {
-		overrides := map[string]bool{}
-		for _, env := range et.Env {
-			key := strings.Split(env, "=")[0]
-			overrides[key] = true
-			cmd.Env = append(cmd.Env, env)
-		}
-
-		for _, env := range os.Environ() {
-			key := strings.Split(env, "=")[0]
-
-			if _, ok := overrides[key]; !ok {
-				cmd.Env = append(cmd.Env, env)
-			}
-		}
-	}
-	if et.Stdin != nil {
-		cmd.Stdin = et.Stdin
-	}
-
-	stdoutBuff := bytes.Buffer{}
-	stderrBuff := bytes.Buffer{}
-
-	var stdoutWriters []io.Writer
-	var stderrWriters []io.Writer
-
-	if !et.DisableStdioBuffer {
-		stdoutWriters = append(stdoutWriters, &stdoutBuff)
-		stderrWriters = append(stderrWriters, &stderrBuff)
-	}
-
-	if et.StreamStdio {
-		stdoutWriters = append(stdoutWriters, os.Stdout)
-		stderrWriters = append(stderrWriters, os.Stderr)
-	}
-
-	if et.StdOutWriter != nil {
-		stdoutWriters = append(stdoutWriters, et.StdOutWriter)
-	}
-	if et.StdErrWriter != nil {
-		stderrWriters = append(stderrWriters, et.StdErrWriter)
-	}
-
-	cmd.Stdout = io.MultiWriter(stdoutWriters...)
-	cmd.Stderr = io.MultiWriter(stderrWriters...)
-
-	startErr := cmd.Start()
-	if startErr != nil {
-		return ExecResult{}, startErr
-	}
-
-	exitCode := 0
-	execErr := cmd.Wait()
-	if execErr != nil {
-		if exitError, ok := execErr.(*exec.ExitError); ok {
-			exitCode = exitError.ExitCode()
-		}
-	}
-
-	return ExecResult{
-		Stdout:    stdoutBuff.String(),
-		Stderr:    stderrBuff.String(),
-		ExitCode:  exitCode,
-		Cancelled: ctx.Err() == context.Canceled,
-	}, ctx.Err()
-}
--- a/vendor/github.com/cyphar/filepath-securejoin/.travis.yml
+++ b/vendor/github.com/cyphar/filepath-securejoin/.travis.yml
@ -0,0 +1,21 @@
+# Copyright (C) 2017 SUSE LLC. All rights reserved.
+# Use of this source code is governed by a BSD-style
+# license that can be found in the LICENSE file.
+
+language: go
+go:
+    - 1.13.x
+    - 1.16.x
+    - tip
+arch:
+    - AMD64
+    - ppc64le
+os:
+    - linux
+    - osx
+
+script:
+    - go test -cover -v ./...
+
+notifications:
+    email: false
--- a/vendor/github.com/cyphar/filepath-securejoin/README.md
+++ b/vendor/github.com/cyphar/filepath-securejoin/README.md
@ -1,6 +1,6 @@
 ## `filepath-securejoin` ##

-[![Build Status](https://github.com/cyphar/filepath-securejoin/actions/workflows/ci.yml/badge.svg)](https://github.com/cyphar/filepath-securejoin/actions/workflows/ci.yml)
+[![Build Status](https://travis-ci.org/cyphar/filepath-securejoin.svg?branch=master)](https://travis-ci.org/cyphar/filepath-securejoin)

 An implementation of `SecureJoin`, a [candidate for inclusion in the Go
 standard library][go#20126]. The purpose of this function is to be a "secure"
--- a/vendor/github.com/cyphar/filepath-securejoin/VERSION
+++ b/vendor/github.com/cyphar/filepath-securejoin/VERSION
@ -1 +1 @@
-0.2.4
+0.2.3
--- a/vendor/github.com/cyphar/filepath-securejoin/join.go
+++ b/vendor/github.com/cyphar/filepath-securejoin/join.go
@ -39,27 +39,17 @@ func IsNotExist(err error) bool {
 // components in the returned string are not modified (in other words are not
 // replaced with symlinks on the filesystem) after this function has returned.
 // Such a symlink race is necessarily out-of-scope of SecureJoin.
-//
-// Volume names in unsafePath are always discarded, regardless if they are
-// provided via direct input or when evaluating symlinks. Therefore:
-//
-// "C:\Temp" + "D:\path\to\file.txt" results in "C:\Temp\path\to\file.txt"
 func SecureJoinVFS(root, unsafePath string, vfs VFS) (string, error) {
 	// Use the os.* VFS implementation if none was specified.
 	if vfs == nil {
 		vfs = osVFS{}
 	}

-	unsafePath = filepath.FromSlash(unsafePath)
 	var path bytes.Buffer
 	n := 0
 	for unsafePath != "" {
 		if n > 255 {
-			return "", &os.PathError{Op: "SecureJoin", Path: root + string(filepath.Separator) + unsafePath, Err: syscall.ELOOP}
-		}
-
-		if v := filepath.VolumeName(unsafePath); v != "" {
-			unsafePath = unsafePath[len(v):]
+			return "", &os.PathError{Op: "SecureJoin", Path: root + "/" + unsafePath, Err: syscall.ELOOP}
 		}

 		// Next path component, p.
--- a/vendor/github.com/distribution/reference/.gitattributes
+++ b/vendor/github.com/distribution/reference/.gitattributes
@ -1 +0,0 @@
-*.go text eol=lf
--- a/vendor/github.com/distribution/reference/.gitignore
+++ b/vendor/github.com/distribution/reference/.gitignore
@ -1,2 +0,0 @@
-# Cover profiles
-*.out
--- a/vendor/github.com/distribution/reference/.golangci.yml
+++ b/vendor/github.com/distribution/reference/.golangci.yml
@ -1,18 +0,0 @@
-linters:
-  enable:
-    - bodyclose
-    - dupword # Checks for duplicate words in the source code
-    - gofmt
-    - goimports
-    - ineffassign
-    - misspell
-    - revive
-    - staticcheck
-    - unconvert
-    - unused
-    - vet
-  disable:
-    - errcheck
-
-run:
-  deadline: 2m
--- a/vendor/github.com/distribution/reference/CODE-OF-CONDUCT.md
+++ b/vendor/github.com/distribution/reference/CODE-OF-CONDUCT.md
@ -1,5 +0,0 @@
-# Code of Conduct
-
-We follow the [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/main/code-of-conduct.md).
-
-Please contact the [CNCF Code of Conduct Committee](mailto:conduct@cncf.io) in order to report violations of the Code of Conduct.
--- a/vendor/github.com/distribution/reference/CONTRIBUTING.md
+++ b/vendor/github.com/distribution/reference/CONTRIBUTING.md
@ -1,114 +0,0 @@
-# Contributing to the reference library
-
-## Community help
-
-If you need help, please ask in the [#distribution](https://cloud-native.slack.com/archives/C01GVR8SY4R) channel on CNCF community slack.
-[Click here for an invite to the CNCF community slack](https://slack.cncf.io/)
-
-## Reporting security issues
-
-The maintainers take security seriously. If you discover a security
-issue, please bring it to their attention right away!
-
-Please **DO NOT** file a public issue, instead send your report privately to
-[cncf-distribution-security@lists.cncf.io](mailto:cncf-distribution-security@lists.cncf.io).
-
-## Reporting an issue properly
-
-By following these simple rules you will get better and faster feedback on your issue.
-
- - search the bugtracker for an already reported issue
-
-### If you found an issue that describes your problem:
-
- - please read other user comments first, and confirm this is the same issue: a given error condition might be indicative of different problems - you may also find a workaround in the comments
- - please refrain from adding "same thing here" or "+1" comments
- - you don't need to comment on an issue to get notified of updates: just hit the "subscribe" button
- - comment if you have some new, technical and relevant information to add to the case
- - __DO NOT__ comment on closed issues or merged PRs. If you think you have a related problem, open up a new issue and reference the PR or issue.
-
-### If you have not found an existing issue that describes your problem:
-
- 1. create a new issue, with a succinct title that describes your issue:
-   - bad title: "It doesn't work with my docker"
-   - good title: "Private registry push fail: 400 error with E_INVALID_DIGEST"
- 2. copy the output of (or similar for other container tools):
-   - `docker version`
-   - `docker info`
-   - `docker exec <registry-container> registry --version`
- 3. copy the command line you used to launch your Registry
- 4. restart your docker daemon in debug mode (add `-D` to the daemon launch arguments)
- 5. reproduce your problem and get your docker daemon logs showing the error
- 6. if relevant, copy your registry logs that show the error
- 7. provide any relevant detail about your specific Registry configuration (e.g., storage backend used)
- 8. indicate if you are using an enterprise proxy, Nginx, or anything else between you and your Registry
-
-## Contributing Code
-
-Contributions should be made via pull requests. Pull requests will be reviewed
-by one or more maintainers or reviewers and merged when acceptable.
-
-You should follow the basic GitHub workflow:
-
- 1. Use your own [fork](https://help.github.com/en/articles/about-forks)
- 2. Create your [change](https://github.com/containerd/project/blob/master/CONTRIBUTING.md#successful-changes)
- 3. Test your code
- 4. [Commit](https://github.com/containerd/project/blob/master/CONTRIBUTING.md#commit-messages) your work, always [sign your commits](https://github.com/containerd/project/blob/master/CONTRIBUTING.md#commit-messages)
- 5. Push your change to your fork and create a [Pull Request](https://help.github.com/en/github/collaborating-with-issues-and-pull-requests/creating-a-pull-request-from-a-fork)
-
-Refer to [containerd's contribution guide](https://github.com/containerd/project/blob/master/CONTRIBUTING.md#successful-changes)
-for tips on creating a successful contribution.
-
-## Sign your work
-
-The sign-off is a simple line at the end of the explanation for the patch. Your
-signature certifies that you wrote the patch or otherwise have the right to pass
-it on as an open-source patch. The rules are pretty simple: if you can certify
-the below (from [developercertificate.org](http://developercertificate.org/)):
-
-```
-Developer Certificate of Origin
-Version 1.1
-
-Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
-660 York Street, Suite 102,
-San Francisco, CA 94110 USA
-
-Everyone is permitted to copy and distribute verbatim copies of this
-license document, but changing it is not allowed.
-
-Developer's Certificate of Origin 1.1
-
-By making a contribution to this project, I certify that:
-
-(a) The contribution was created in whole or in part by me and I
-    have the right to submit it under the open source license
-    indicated in the file; or
-
-(b) The contribution is based upon previous work that, to the best
-    of my knowledge, is covered under an appropriate open source
-    license and I have the right under that license to submit that
-    work with modifications, whether created in whole or in part
-    by me, under the same open source license (unless I am
-    permitted to submit under a different license), as indicated
-    in the file; or
-
-(c) The contribution was provided directly to me by some other
-    person who certified (a), (b) or (c) and I have not modified
-    it.
-
-(d) I understand and agree that this project and the contribution
-    are public and that a record of the contribution (including all
-    personal information I submit with it, including my sign-off) is
-    maintained indefinitely and may be redistributed consistent with
-    this project or the open source license(s) involved.
-```
-
-Then you just add a line to every git commit message:
-
-    Signed-off-by: Joe Smith <joe.smith@email.com>
-
-Use your real name (sorry, no pseudonyms or anonymous contributions.)
-
-If you set your `user.name` and `user.email` git configs, you can sign your
-commit automatically with `git commit -s`.
--- a/vendor/github.com/distribution/reference/GOVERNANCE.md
+++ b/vendor/github.com/distribution/reference/GOVERNANCE.md
@ -1,144 +0,0 @@
-# distribution/reference Project Governance
-
-Distribution [Code of Conduct](./CODE-OF-CONDUCT.md) can be found here.
-
-For specific guidance on practical contribution steps please
-see our [CONTRIBUTING.md](./CONTRIBUTING.md) guide.
-
-## Maintainership
-
-There are different types of maintainers, with different responsibilities, but
-all maintainers have 3 things in common:
-
-1) They share responsibility in the project's success.
-2) They have made a long-term, recurring time investment to improve the project.
-3) They spend that time doing whatever needs to be done, not necessarily what
-is the most interesting or fun.
-
-Maintainers are often under-appreciated, because their work is harder to appreciate.
-It's easy to appreciate a really cool and technically advanced feature. It's harder
-to appreciate the absence of bugs, the slow but steady improvement in stability,
-or the reliability of a release process. But those things distinguish a good
-project from a great one.
-
-## Reviewers
-
-A reviewer is a core role within the project.
-They share in reviewing issues and pull requests and their LGTM counts towards the
-required LGTM count to merge a code change into the project.
-
-Reviewers are part of the organization but do not have write access.
-Becoming a reviewer is a core aspect in the journey to becoming a maintainer.
-
-## Adding maintainers
-
-Maintainers are first and foremost contributors that have shown they are
-committed to the long term success of a project. Contributors wanting to become
-maintainers are expected to be deeply involved in contributing code, pull
-request review, and triage of issues in the project for more than three months.
-
-Just contributing does not make you a maintainer, it is about building trust
-with the current maintainers of the project and being a person that they can
-depend on and trust to make decisions in the best interest of the project.
-
-Periodically, the existing maintainers curate a list of contributors that have
-shown regular activity on the project over the prior months. From this list,
-maintainer candidates are selected and proposed in a pull request or a
-maintainers communication channel.
-
-After a candidate has been announced to the maintainers, the existing
-maintainers are given five business days to discuss the candidate, raise
-objections and cast their vote. Votes may take place on the communication
-channel or via pull request comment. Candidates must be approved by at least 66%
-of the current maintainers by adding their vote on the mailing list. The
-reviewer role has the same process but only requires 33% of current maintainers.
-Only maintainers of the repository that the candidate is proposed for are
-allowed to vote.
-
-If a candidate is approved, a maintainer will contact the candidate to invite
-the candidate to open a pull request that adds the contributor to the
-MAINTAINERS file. The voting process may take place inside a pull request if a
-maintainer has already discussed the candidacy with the candidate and a
-maintainer is willing to be a sponsor by opening the pull request. The candidate
-becomes a maintainer once the pull request is merged.
-
-## Stepping down policy
-
-Life priorities, interests, and passions can change. If you're a maintainer but
-feel you must remove yourself from the list, inform other maintainers that you
-intend to step down, and if possible, help find someone to pick up your work.
-At the very least, ensure your work can be continued where you left off.
-
-After you've informed other maintainers, create a pull request to remove
-yourself from the MAINTAINERS file.
-
-## Removal of inactive maintainers
-
-Similar to the procedure for adding new maintainers, existing maintainers can
-be removed from the list if they do not show significant activity on the
-project. Periodically, the maintainers review the list of maintainers and their
-activity over the last three months.
-
-If a maintainer has shown insufficient activity over this period, a neutral
-person will contact the maintainer to ask if they want to continue being
-a maintainer. If the maintainer decides to step down as a maintainer, they
-open a pull request to be removed from the MAINTAINERS file.
-
-If the maintainer wants to remain a maintainer, but is unable to perform the
-required duties they can be removed with a vote of at least 66% of the current
-maintainers. In this case, maintainers should first propose the change to
-maintainers via the maintainers communication channel, then open a pull request
-for voting. The voting period is five business days. The voting pull request
-should not come as a surpise to any maintainer and any discussion related to
-performance must not be discussed on the pull request.
-
-## How are decisions made?
-
-Docker distribution is an open-source project with an open design philosophy.
-This means that the repository is the source of truth for EVERY aspect of the
-project, including its philosophy, design, road map, and APIs. *If it's part of
-the project, it's in the repo. If it's in the repo, it's part of the project.*
-
-As a result, all decisions can be expressed as changes to the repository. An
-implementation change is a change to the source code. An API change is a change
-to the API specification. A philosophy change is a change to the philosophy
-manifesto, and so on.
-
-All decisions affecting distribution, big and small, follow the same 3 steps:
-
-* Step 1: Open a pull request. Anyone can do this.
-
-* Step 2: Discuss the pull request. Anyone can do this.
-
-* Step 3: Merge or refuse the pull request. Who does this depends on the nature
-of the pull request and which areas of the project it affects.
-
-## Helping contributors with the DCO
-
-The [DCO or `Sign your work`](./CONTRIBUTING.md#sign-your-work)
-requirement is not intended as a roadblock or speed bump.
-
-Some contributors are not as familiar with `git`, or have used a web
-based editor, and thus asking them to `git commit --amend -s` is not the best
-way forward.
-
-In this case, maintainers can update the commits based on clause (c) of the DCO.
-The most trivial way for a contributor to allow the maintainer to do this, is to
-add a DCO signature in a pull requests's comment, or a maintainer can simply
-note that the change is sufficiently trivial that it does not substantially
-change the existing contribution - i.e., a spelling change.
-
-When you add someone's DCO, please also add your own to keep a log.
-
-## I'm a maintainer. Should I make pull requests too?
-
-Yes. Nobody should ever push to master directly. All changes should be
-made through a pull request.
-
-## Conflict Resolution
-
-If you have a technical dispute that you feel has reached an impasse with a
-subset of the community, any contributor may open an issue, specifically
-calling for a resolution vote of the current core maintainers to resolve the
-dispute. The same voting quorums required (2/3) for adding and removing
-maintainers will apply to conflict resolution.
--- a/vendor/github.com/distribution/reference/LICENSE
+++ b/vendor/github.com/distribution/reference/LICENSE
@ -1,202 +0,0 @@
-Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "{}"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright {yyyy} {name of copyright owner}
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-
--- a/vendor/github.com/distribution/reference/MAINTAINERS
+++ b/vendor/github.com/distribution/reference/MAINTAINERS
@ -1,26 +0,0 @@
-# Distribution project maintainers & reviewers
-#
-# See GOVERNANCE.md for maintainer versus reviewer roles
-#
-# MAINTAINERS (cncf-distribution-maintainers@lists.cncf.io)
-# GitHub ID, Name, Email address
-"chrispat","Chris Patterson","chrispat@github.com"
-"clarkbw","Bryan Clark","clarkbw@github.com"
-"corhere","Cory Snider","csnider@mirantis.com"
-"deleteriousEffect","Hayley Swimelar","hswimelar@gitlab.com"
-"heww","He Weiwei","hweiwei@vmware.com"
-"joaodrp","João Pereira","jpereira@gitlab.com"
-"justincormack","Justin Cormack","justin.cormack@docker.com"
-"squizzi","Kyle Squizzato","ksquizzato@mirantis.com"
-"milosgajdos","Milos Gajdos","milosthegajdos@gmail.com"
-"sargun","Sargun Dhillon","sargun@sargun.me"
-"wy65701436","Wang Yan","wangyan@vmware.com"
-"stevelasker","Steve Lasker","steve.lasker@microsoft.com"
-#
-# REVIEWERS
-# GitHub ID, Name, Email address
-"dmcgowan","Derek McGowan","derek@mcgstyle.net"
-"stevvooe","Stephen Day","stevvooe@gmail.com"
-"thajeztah","Sebastiaan van Stijn","github@gone.nl"
-"DavidSpek", "David van der Spek", "vanderspek.david@gmail.com"
-"Jamstah", "James Hewitt", "james.hewitt@gmail.com"
--- a/vendor/github.com/distribution/reference/Makefile
+++ b/vendor/github.com/distribution/reference/Makefile
@ -1,25 +0,0 @@
-# Project packages.
-PACKAGES=$(shell go list ./...)
-
-# Flags passed to `go test`
-BUILDFLAGS ?= 
-TESTFLAGS ?= 
-
-.PHONY: all build test coverage
-.DEFAULT: all
-
-all: build
-
-build: ## no binaries to build, so just check compilation suceeds
-	go build ${BUILDFLAGS} ./...
-
-test: ## run tests
-	go test ${TESTFLAGS} ./...
-
-coverage: ## generate coverprofiles from the unit tests
-	rm -f coverage.txt
-	go test ${TESTFLAGS} -cover -coverprofile=cover.out ./...
-
-.PHONY: help
-help:
-	@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n  make \033[36m\033[0m\n"} /^[a-zA-Z_\/%-]+:.*?##/ { printf "  \033[36m%-27s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)
--- a/vendor/github.com/distribution/reference/README.md
+++ b/vendor/github.com/distribution/reference/README.md
@ -1,30 +0,0 @@
-# Distribution reference
-
-Go library to handle references to container images.
-
-<img src="/distribution-logo.svg" width="200px" />
-
-[![Build Status](https://github.com/distribution/reference/actions/workflows/test.yml/badge.svg?branch=main&event=push)](https://github.com/distribution/reference/actions?query=workflow%3ACI)
-[![GoDoc](https://img.shields.io/badge/go.dev-reference-007d9c?logo=go&logoColor=white&style=flat-square)](https://pkg.go.dev/github.com/distribution/reference)
-[![License: Apache-2.0](https://img.shields.io/badge/License-Apache--2.0-blue.svg)](LICENSE)
-[![codecov](https://codecov.io/gh/distribution/reference/branch/main/graph/badge.svg)](https://codecov.io/gh/distribution/reference)
-[![FOSSA Status](https://app.fossa.com/api/projects/custom%2B162%2Fgithub.com%2Fdistribution%2Freference.svg?type=shield)](https://app.fossa.com/projects/custom%2B162%2Fgithub.com%2Fdistribution%2Freference?ref=badge_shield)
-
-This repository contains a library for handling refrences to container images held in container registries. Please see [godoc](https://pkg.go.dev/github.com/distribution/reference) for details.
-
-## Contribution
-
-Please see [CONTRIBUTING.md](CONTRIBUTING.md) for details on how to contribute
-issues, fixes, and patches to this project.
-
-## Communication
-
-For async communication and long running discussions please use issues and pull requests on the github repo.
-This will be the best place to discuss design and implementation.
-
-For sync communication we have a #distribution channel in the [CNCF Slack](https://slack.cncf.io/)
-that everyone is welcome to join and chat about development.
-
-## Licenses
-
-The distribution codebase is released under the [Apache 2.0 license](LICENSE).
--- a/vendor/github.com/distribution/reference/SECURITY.md
+++ b/vendor/github.com/distribution/reference/SECURITY.md
@ -1,7 +0,0 @@
-# Security Policy
-
-## Reporting a Vulnerability
-
-The maintainers take security seriously. If you discover a security issue, please bring it to their attention right away!
-
-Please DO NOT file a public issue, instead send your report privately to cncf-distribution-security@lists.cncf.io.
--- a/vendor/github.com/distribution/reference/distribution-logo.svg
+++ b/vendor/github.com/distribution/reference/distribution-logo.svg
--- a/vendor/github.com/distribution/reference/regexp.go
+++ b/vendor/github.com/distribution/reference/regexp.go
@ -1,163 +0,0 @@
-package reference
-
-import (
-	"regexp"
-	"strings"
-)
-
-// DigestRegexp matches well-formed digests, including algorithm (e.g. "sha256:<encoded>").
-var DigestRegexp = regexp.MustCompile(digestPat)
-
-// DomainRegexp matches hostname or IP-addresses, optionally including a port
-// number. It defines the structure of potential domain components that may be
-// part of image names. This is purposely a subset of what is allowed by DNS to
-// ensure backwards compatibility with Docker image names. It may be a subset of
-// DNS domain name, an IPv4 address in decimal format, or an IPv6 address between
-// square brackets (excluding zone identifiers as defined by [RFC 6874] or special
-// addresses such as IPv4-Mapped).
-//
-// [RFC 6874]: https://www.rfc-editor.org/rfc/rfc6874.
-var DomainRegexp = regexp.MustCompile(domainAndPort)
-
-// IdentifierRegexp is the format for string identifier used as a
-// content addressable identifier using sha256. These identifiers
-// are like digests without the algorithm, since sha256 is used.
-var IdentifierRegexp = regexp.MustCompile(identifier)
-
-// NameRegexp is the format for the name component of references, including
-// an optional domain and port, but without tag or digest suffix.
-var NameRegexp = regexp.MustCompile(namePat)
-
-// ReferenceRegexp is the full supported format of a reference. The regexp
-// is anchored and has capturing groups for name, tag, and digest
-// components.
-var ReferenceRegexp = regexp.MustCompile(referencePat)
-
-// TagRegexp matches valid tag names. From [docker/docker:graph/tags.go].
-//
-// [docker/docker:graph/tags.go]: https://github.com/moby/moby/blob/v1.6.0/graph/tags.go#L26-L28
-var TagRegexp = regexp.MustCompile(tag)
-
-const (
-	// alphanumeric defines the alphanumeric atom, typically a
-	// component of names. This only allows lower case characters and digits.
-	alphanumeric = `[a-z0-9]+`
-
-	// separator defines the separators allowed to be embedded in name
-	// components. This allows one period, one or two underscore and multiple
-	// dashes. Repeated dashes and underscores are intentionally treated
-	// differently. In order to support valid hostnames as name components,
-	// supporting repeated dash was added. Additionally double underscore is
-	// now allowed as a separator to loosen the restriction for previously
-	// supported names.
-	separator = `(?:[._]|__|[-]+)`
-
-	// localhost is treated as a special value for domain-name. Any other
-	// domain-name without a "." or a ":port" are considered a path component.
-	localhost = `localhost`
-
-	// domainNameComponent restricts the registry domain component of a
-	// repository name to start with a component as defined by DomainRegexp.
-	domainNameComponent = `(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])`
-
-	// optionalPort matches an optional port-number including the port separator
-	// (e.g. ":80").
-	optionalPort = `(?::[0-9]+)?`
-
-	// tag matches valid tag names. From docker/docker:graph/tags.go.
-	tag = `[\w][\w.-]{0,127}`
-
-	// digestPat matches well-formed digests, including algorithm (e.g. "sha256:<encoded>").
-	//
-	// TODO(thaJeztah): this should follow the same rules as https://pkg.go.dev/github.com/opencontainers/go-digest@v1.0.0#DigestRegexp
-	// so that go-digest defines the canonical format. Note that the go-digest is
-	// more relaxed:
-	//   - it allows multiple algorithms (e.g. "sha256+b64:<encoded>") to allow
-	//     future expansion of supported algorithms.
-	//   - it allows the "<encoded>" value to use urlsafe base64 encoding as defined
-	//     in [rfc4648, section 5].
-	//
-	// [rfc4648, section 5]: https://www.rfc-editor.org/rfc/rfc4648#section-5.
-	digestPat = `[A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*[:][[:xdigit:]]{32,}`
-
-	// identifier is the format for a content addressable identifier using sha256.
-	// These identifiers are like digests without the algorithm, since sha256 is used.
-	identifier = `([a-f0-9]{64})`
-
-	// ipv6address are enclosed between square brackets and may be represented
-	// in many ways, see rfc5952. Only IPv6 in compressed or uncompressed format
-	// are allowed, IPv6 zone identifiers (rfc6874) or Special addresses such as
-	// IPv4-Mapped are deliberately excluded.
-	ipv6address = `\[(?:[a-fA-F0-9:]+)\]`
-)
-
-var (
-	// domainName defines the structure of potential domain components
-	// that may be part of image names. This is purposely a subset of what is
-	// allowed by DNS to ensure backwards compatibility with Docker image
-	// names. This includes IPv4 addresses on decimal format.
-	domainName = domainNameComponent + anyTimes(`\.`+domainNameComponent)
-
-	// host defines the structure of potential domains based on the URI
-	// Host subcomponent on rfc3986. It may be a subset of DNS domain name,
-	// or an IPv4 address in decimal format, or an IPv6 address between square
-	// brackets (excluding zone identifiers as defined by rfc6874 or special
-	// addresses such as IPv4-Mapped).
-	host = `(?:` + domainName + `|` + ipv6address + `)`
-
-	// allowed by the URI Host subcomponent on rfc3986 to ensure backwards
-	// compatibility with Docker image names.
-	domainAndPort = host + optionalPort
-
-	// anchoredTagRegexp matches valid tag names, anchored at the start and
-	// end of the matched string.
-	anchoredTagRegexp = regexp.MustCompile(anchored(tag))
-
-	// anchoredDigestRegexp matches valid digests, anchored at the start and
-	// end of the matched string.
-	anchoredDigestRegexp = regexp.MustCompile(anchored(digestPat))
-
-	// pathComponent restricts path-components to start with an alphanumeric
-	// character, with following parts able to be separated by a separator
-	// (one period, one or two underscore and multiple dashes).
-	pathComponent = alphanumeric + anyTimes(separator+alphanumeric)
-
-	// remoteName matches the remote-name of a repository. It consists of one
-	// or more forward slash (/) delimited path-components:
-	//
-	//	pathComponent[[/pathComponent] ...] // e.g., "library/ubuntu"
-	remoteName = pathComponent + anyTimes(`/`+pathComponent)
-	namePat    = optional(domainAndPort+`/`) + remoteName
-
-	// anchoredNameRegexp is used to parse a name value, capturing the
-	// domain and trailing components.
-	anchoredNameRegexp = regexp.MustCompile(anchored(optional(capture(domainAndPort), `/`), capture(remoteName)))
-
-	referencePat = anchored(capture(namePat), optional(`:`, capture(tag)), optional(`@`, capture(digestPat)))
-
-	// anchoredIdentifierRegexp is used to check or match an
-	// identifier value, anchored at start and end of string.
-	anchoredIdentifierRegexp = regexp.MustCompile(anchored(identifier))
-)
-
-// optional wraps the expression in a non-capturing group and makes the
-// production optional.
-func optional(res ...string) string {
-	return `(?:` + strings.Join(res, "") + `)?`
-}
-
-// anyTimes wraps the expression in a non-capturing group that can occur
-// any number of times.
-func anyTimes(res ...string) string {
-	return `(?:` + strings.Join(res, "") + `)*`
-}
-
-// capture wraps the expression in a capturing group.
-func capture(res ...string) string {
-	return `(` + strings.Join(res, "") + `)`
-}
-
-// anchored anchors the regular expression by adding start and end delimiters.
-func anchored(res ...string) string {
-	return `^` + strings.Join(res, "") + `$`
-}
--- a/vendor/github.com/distribution/reference/sort.go
+++ b/vendor/github.com/distribution/reference/sort.go
@ -1,75 +0,0 @@
-/*
-   Copyright The containerd Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package reference
-
-import (
-	"sort"
-)
-
-// Sort sorts string references preferring higher information references.
-//
-// The precedence is as follows:
-//
-//  1. [Named] + [Tagged] + [Digested] (e.g., "docker.io/library/busybox:latest@sha256:<digest>")
-//  2. [Named] + [Tagged]              (e.g., "docker.io/library/busybox:latest")
-//  3. [Named] + [Digested]            (e.g., "docker.io/library/busybo@sha256:<digest>")
-//  4. [Named]                         (e.g., "docker.io/library/busybox")
-//  5. [Digested]                      (e.g., "docker.io@sha256:<digest>")
-//  6. Parse error
-func Sort(references []string) []string {
-	var prefs []Reference
-	var bad []string
-
-	for _, ref := range references {
-		pref, err := ParseAnyReference(ref)
-		if err != nil {
-			bad = append(bad, ref)
-		} else {
-			prefs = append(prefs, pref)
-		}
-	}
-	sort.Slice(prefs, func(a, b int) bool {
-		ar := refRank(prefs[a])
-		br := refRank(prefs[b])
-		if ar == br {
-			return prefs[a].String() < prefs[b].String()
-		}
-		return ar < br
-	})
-	sort.Strings(bad)
-	var refs []string
-	for _, pref := range prefs {
-		refs = append(refs, pref.String())
-	}
-	return append(refs, bad...)
-}
-
-func refRank(ref Reference) uint8 {
-	if _, ok := ref.(Named); ok {
-		if _, ok = ref.(Tagged); ok {
-			if _, ok = ref.(Digested); ok {
-				return 1
-			}
-			return 2
-		}
-		if _, ok = ref.(Digested); ok {
-			return 3
-		}
-		return 4
-	}
-	return 5
-}
--- a/vendor/github.com/docker/cli/cli/config/configfile/file.go
+++ b/vendor/github.com/docker/cli/cli/config/configfile/file.go
@ -37,6 +37,7 @@ type ConfigFile struct {
 	PruneFilters         []string                     `json:"pruneFilters,omitempty"`
 	Proxies              map[string]ProxyConfig       `json:"proxies,omitempty"`
 	Experimental         string                       `json:"experimental,omitempty"`
+	StackOrchestrator    string                       `json:"stackOrchestrator,omitempty"` // Deprecated: swarm is now the default orchestrator, and this option is ignored.
 	CurrentContext       string                       `json:"currentContext,omitempty"`
 	CLIPluginsExtraDirs  []string                     `json:"cliPluginsExtraDirs,omitempty"`
 	Plugins              map[string]map[string]string `json:"plugins,omitempty"`
@ -94,9 +95,6 @@ func (configFile *ConfigFile) ContainsAuth() bool {

 // GetAuthConfigs returns the mapping of repo to auth configuration
 func (configFile *ConfigFile) GetAuthConfigs() map[string]types.AuthConfig {
-	if configFile.AuthConfigs == nil {
-		configFile.AuthConfigs = make(map[string]types.AuthConfig)
-	}
 	return configFile.AuthConfigs
 }

--- a/vendor/github.com/docker/cli/cli/config/credentials/file_store.go
+++ b/vendor/github.com/docker/cli/cli/config/credentials/file_store.go
@ -52,8 +52,7 @@ func (c *fileStore) GetAll() (map[string]types.AuthConfig, error) {

 // Store saves the given credentials in the file store.
 func (c *fileStore) Store(authConfig types.AuthConfig) error {
-	authConfigs := c.file.GetAuthConfigs()
-	authConfigs[authConfig.ServerAddress] = authConfig
+	c.file.GetAuthConfigs()[authConfig.ServerAddress] = authConfig
 	return c.file.Save()
 }

--- a/vendor/github.com/opencontainers/go-digest/digestset/set.go
+++ b/vendor/github.com/opencontainers/go-digest/digestset/set.go
@ -1,18 +1,3 @@
-// Copyright 2020, 2020 OCI Contributors
-// Copyright 2017 Docker, Inc.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
 package digestset

 import (
--- a/vendor/github.com/docker/distribution/reference/helpers.go
+++ b/vendor/github.com/docker/distribution/reference/helpers.go
@ -32,7 +32,7 @@ func FamiliarString(ref Reference) string {
 }

 // FamiliarMatch reports whether ref matches the specified pattern.
-// See [path.Match] for supported patterns.
+// See https://godoc.org/path#Match for supported patterns.
 func FamiliarMatch(pattern string, ref Reference) (bool, error) {
 	matched, err := path.Match(pattern, FamiliarString(ref))
 	if namedRef, isNamed := ref.(Named); isNamed && !matched {
--- a/vendor/github.com/docker/distribution/reference/helpers_deprecated.go
+++ b/vendor/github.com/docker/distribution/reference/helpers_deprecated.go
@ -1,34 +0,0 @@
-package reference
-
-import "github.com/distribution/reference"
-
-// IsNameOnly returns true if reference only contains a repo name.
-//
-// Deprecated: use [reference.IsNameOnly].
-func IsNameOnly(ref reference.Named) bool {
-	return reference.IsNameOnly(ref)
-}
-
-// FamiliarName returns the familiar name string
-// for the given named, familiarizing if needed.
-//
-// Deprecated: use [reference.FamiliarName].
-func FamiliarName(ref reference.Named) string {
-	return reference.FamiliarName(ref)
-}
-
-// FamiliarString returns the familiar string representation
-// for the given reference, familiarizing if needed.
-//
-// Deprecated: use [reference.FamiliarString].
-func FamiliarString(ref reference.Reference) string {
-	return reference.FamiliarString(ref)
-}
-
-// FamiliarMatch reports whether ref matches the specified pattern.
-// See [path.Match] for supported patterns.
-//
-// Deprecated: use [reference.FamiliarMatch].
-func FamiliarMatch(pattern string, ref reference.Reference) (bool, error) {
-	return reference.FamiliarMatch(pattern, ref)
-}
--- a/vendor/github.com/docker/distribution/reference/normalize.go
+++ b/vendor/github.com/docker/distribution/reference/normalize.go
@ -1,42 +1,19 @@
 package reference

 import (
+	"errors"
 	"fmt"
 	"strings"

+	"github.com/docker/distribution/digestset"
 	"github.com/opencontainers/go-digest"
 )

-const (
-	// legacyDefaultDomain is the legacy domain for Docker Hub (which was
-	// originally named "the Docker Index"). This domain is still used for
-	// authentication and image search, which were part of the "v1" Docker
-	// registry specification.
-	//
-	// This domain will continue to be supported, but there are plans to consolidate
-	// legacy domains to new "canonical" domains. Once those domains are decided
-	// on, we must update the normalization functions, but preserve compatibility
-	// with existing installs, clients, and user configuration.
+var (
 	legacyDefaultDomain = "index.docker.io"
-
-	// defaultDomain is the default domain used for images on Docker Hub.
-	// It is used to normalize "familiar" names to canonical names, for example,
-	// to convert "ubuntu" to "docker.io/library/ubuntu:latest".
-	//
-	// Note that actual domain of Docker Hub's registry is registry-1.docker.io.
-	// This domain will continue to be supported, but there are plans to consolidate
-	// legacy domains to new "canonical" domains. Once those domains are decided
-	// on, we must update the normalization functions, but preserve compatibility
-	// with existing installs, clients, and user configuration.
-	defaultDomain = "docker.io"
-
-	// officialRepoPrefix is the namespace used for official images on Docker Hub.
-	// It is used to normalize "familiar" names to canonical names, for example,
-	// to convert "ubuntu" to "docker.io/library/ubuntu:latest".
-	officialRepoPrefix = "library/"
-
-	// defaultTag is the default tag if no tag is provided.
-	defaultTag = "latest"
+	defaultDomain       = "docker.io"
+	officialRepoName    = "library"
+	defaultTag          = "latest"
 )

 // normalizedNamed represents a name which has been
@ -58,14 +35,14 @@ func ParseNormalizedNamed(s string) (Named, error) {
 		return nil, fmt.Errorf("invalid repository name (%s), cannot specify 64-byte hexadecimal strings", s)
 	}
 	domain, remainder := splitDockerDomain(s)
-	var remote string
+	var remoteName string
 	if tagSep := strings.IndexRune(remainder, ':'); tagSep > -1 {
-		remote = remainder[:tagSep]
+		remoteName = remainder[:tagSep]
 	} else {
-		remote = remainder
+		remoteName = remainder
 	}
-	if strings.ToLower(remote) != remote {
-		return nil, fmt.Errorf("invalid reference format: repository name (%s) must be lowercase", remote)
+	if strings.ToLower(remoteName) != remoteName {
+		return nil, errors.New("invalid reference format: repository name must be lowercase")
 	}

 	ref, err := Parse(domain + "/" + remainder)
@ -79,53 +56,41 @@ func ParseNormalizedNamed(s string) (Named, error) {
 	return named, nil
 }

-// namedTaggedDigested is a reference that has both a tag and a digest.
-type namedTaggedDigested interface {
-	NamedTagged
-	Digested
-}
-
-// ParseDockerRef normalizes the image reference following the docker convention,
-// which allows for references to contain both a tag and a digest. It returns a
-// reference that is either tagged or digested. For references containing both
-// a tag and a digest, it returns a digested reference. For example, the following
-// reference:
-//
-//	docker.io/library/busybox:latest@sha256:7cc4b5aefd1d0cadf8d97d4350462ba51c694ebca145b08d7d41b41acc8db5aa
-//
-// Is returned as a digested reference (with the ":latest" tag removed):
-//
-//	docker.io/library/busybox@sha256:7cc4b5aefd1d0cadf8d97d4350462ba51c694ebca145b08d7d41b41acc8db5aa
-//
-// References that are already "tagged" or "digested" are returned unmodified:
-//
-//	// Already a digested reference
-//	docker.io/library/busybox@sha256:7cc4b5aefd1d0cadf8d97d4350462ba51c694ebca145b08d7d41b41acc8db5aa
-//
-//	// Already a named reference
-//	docker.io/library/busybox:latest
+// ParseDockerRef normalizes the image reference following the docker convention. This is added
+// mainly for backward compatibility.
+// The reference returned can only be either tagged or digested. For reference contains both tag
+// and digest, the function returns digested reference, e.g. docker.io/library/busybox:latest@
+// sha256:7cc4b5aefd1d0cadf8d97d4350462ba51c694ebca145b08d7d41b41acc8db5aa will be returned as
+// docker.io/library/busybox@sha256:7cc4b5aefd1d0cadf8d97d4350462ba51c694ebca145b08d7d41b41acc8db5aa.
 func ParseDockerRef(ref string) (Named, error) {
 	named, err := ParseNormalizedNamed(ref)
 	if err != nil {
 		return nil, err
 	}
-	if canonical, ok := named.(namedTaggedDigested); ok {
-		// The reference is both tagged and digested; only return digested.
-		newNamed, err := WithName(canonical.Name())
-		if err != nil {
-			return nil, err
+	if _, ok := named.(NamedTagged); ok {
+		if canonical, ok := named.(Canonical); ok {
+			// The reference is both tagged and digested, only
+			// return digested.
+			newNamed, err := WithName(canonical.Name())
+			if err != nil {
+				return nil, err
+			}
+			newCanonical, err := WithDigest(newNamed, canonical.Digest())
+			if err != nil {
+				return nil, err
+			}
+			return newCanonical, nil
 		}
-		return WithDigest(newNamed, canonical.Digest())
 	}
 	return TagNameOnly(named), nil
 }

-// splitDockerDomain splits a repository name to domain and remote-name.
+// splitDockerDomain splits a repository name to domain and remotename string.
 // If no valid domain is found, the default domain is used. Repository name
 // needs to be already validated before.
 func splitDockerDomain(name string) (domain, remainder string) {
 	i := strings.IndexRune(name, '/')
-	if i == -1 || (!strings.ContainsAny(name[:i], ".:") && name[:i] != localhost && strings.ToLower(name[:i]) == name[:i]) {
+	if i == -1 || (!strings.ContainsAny(name[:i], ".:") && name[:i] != "localhost") {
 		domain, remainder = defaultDomain, name
 	} else {
 		domain, remainder = name[:i], name[i+1:]
@ -134,13 +99,13 @@ func splitDockerDomain(name string) (domain, remainder string) {
 		domain = defaultDomain
 	}
 	if domain == defaultDomain && !strings.ContainsRune(remainder, '/') {
-		remainder = officialRepoPrefix + remainder
+		remainder = officialRepoName + "/" + remainder
 	}
 	return
 }

 // familiarizeName returns a shortened version of the name familiar
-// to the Docker UI. Familiar names have the default domain
+// to to the Docker UI. Familiar names have the default domain
 // "docker.io" and "library/" repository prefix removed.
 // For example, "docker.io/library/redis" will have the familiar
 // name "redis" and "docker.io/dmcgowan/myapp" will be "dmcgowan/myapp".
@ -154,15 +119,8 @@ func familiarizeName(named namedRepository) repository {
 	if repo.domain == defaultDomain {
 		repo.domain = ""
 		// Handle official repositories which have the pattern "library/<official repo name>"
-		if strings.HasPrefix(repo.path, officialRepoPrefix) {
-			// TODO(thaJeztah): this check may be too strict, as it assumes the
-			//  "library/" namespace does not have nested namespaces. While this
-			//  is true (currently), technically it would be possible for Docker
-			//  Hub to use those (e.g. "library/distros/ubuntu:latest").
-			//  See https://github.com/distribution/distribution/pull/3769#issuecomment-1302031785.
-			if remainder := strings.TrimPrefix(repo.path, officialRepoPrefix); !strings.ContainsRune(remainder, '/') {
-				repo.path = remainder
-			}
+		if split := strings.Split(repo.path, "/"); len(split) == 2 && split[0] == officialRepoName {
+			repo.path = split[1]
 		}
 	}
 	return repo
@ -222,3 +180,20 @@ func ParseAnyReference(ref string) (Reference, error) {

 	return ParseNormalizedNamed(ref)
 }
+
+// ParseAnyReferenceWithSet parses a reference string as a possible short
+// identifier to be matched in a digest set, a full digest, or familiar name.
+func ParseAnyReferenceWithSet(ref string, ds *digestset.Set) (Reference, error) {
+	if ok := anchoredShortIdentifierRegexp.MatchString(ref); ok {
+		dgst, err := ds.Lookup(ref)
+		if err == nil {
+			return digestReference(dgst), nil
+		}
+	} else {
+		if dgst, err := digest.Parse(ref); err == nil {
+			return digestReference(dgst), nil
+		}
+	}
+
+	return ParseNormalizedNamed(ref)
+}
--- a/vendor/github.com/docker/distribution/reference/normalize_deprecated.go
+++ b/vendor/github.com/docker/distribution/reference/normalize_deprecated.go
@ -1,92 +0,0 @@
-package reference
-
-import (
-	"regexp"
-
-	"github.com/distribution/reference"
-	"github.com/opencontainers/go-digest"
-	"github.com/opencontainers/go-digest/digestset"
-)
-
-// ParseNormalizedNamed parses a string into a named reference
-// transforming a familiar name from Docker UI to a fully
-// qualified reference. If the value may be an identifier
-// use ParseAnyReference.
-//
-// Deprecated: use [reference.ParseNormalizedNamed].
-func ParseNormalizedNamed(s string) (reference.Named, error) {
-	return reference.ParseNormalizedNamed(s)
-}
-
-// ParseDockerRef normalizes the image reference following the docker convention,
-// which allows for references to contain both a tag and a digest.
-//
-// Deprecated: use [reference.ParseDockerRef].
-func ParseDockerRef(ref string) (reference.Named, error) {
-	return reference.ParseDockerRef(ref)
-}
-
-// TagNameOnly adds the default tag "latest" to a reference if it only has
-// a repo name.
-//
-// Deprecated: use [reference.TagNameOnly].
-func TagNameOnly(ref reference.Named) reference.Named {
-	return reference.TagNameOnly(ref)
-}
-
-// ParseAnyReference parses a reference string as a possible identifier,
-// full digest, or familiar name.
-//
-// Deprecated: use [reference.ParseAnyReference].
-func ParseAnyReference(ref string) (reference.Reference, error) {
-	return reference.ParseAnyReference(ref)
-}
-
-// Functions and types below have been removed in distribution v3 and
-// have not been ported to github.com/distribution/reference. See
-// https://github.com/distribution/distribution/pull/3774
-
-var (
-	// ShortIdentifierRegexp is the format used to represent a prefix
-	// of an identifier. A prefix may be used to match a sha256 identifier
-	// within a list of trusted identifiers.
-	//
-	// Deprecated: support for short-identifiers is deprecated, and will be removed in v3.
-	ShortIdentifierRegexp = regexp.MustCompile(shortIdentifier)
-
-	shortIdentifier = `([a-f0-9]{6,64})`
-
-	// anchoredShortIdentifierRegexp is used to check if a value
-	// is a possible identifier prefix, anchored at start and end
-	// of string.
-	anchoredShortIdentifierRegexp = regexp.MustCompile(`^` + shortIdentifier + `$`)
-)
-
-type digestReference digest.Digest
-
-func (d digestReference) String() string {
-	return digest.Digest(d).String()
-}
-
-func (d digestReference) Digest() digest.Digest {
-	return digest.Digest(d)
-}
-
-// ParseAnyReferenceWithSet parses a reference string as a possible short
-// identifier to be matched in a digest set, a full digest, or familiar name.
-//
-// Deprecated: support for short-identifiers is deprecated, and will be removed in v3.
-func ParseAnyReferenceWithSet(ref string, ds *digestset.Set) (Reference, error) {
-	if ok := anchoredShortIdentifierRegexp.MatchString(ref); ok {
-		dgst, err := ds.Lookup(ref)
-		if err == nil {
-			return digestReference(dgst), nil
-		}
-	} else {
-		if dgst, err := digest.Parse(ref); err == nil {
-			return digestReference(dgst), nil
-		}
-	}
-
-	return reference.ParseNormalizedNamed(ref)
-}
--- a/vendor/github.com/docker/distribution/reference/reference.go
+++ b/vendor/github.com/docker/distribution/reference/reference.go
@ -4,14 +4,11 @@
 // Grammar
 //
 //	reference                       := name [ ":" tag ] [ "@" digest ]
-//	name                            := [domain '/'] remote-name
-//	domain                          := host [':' port-number]
-//	host                            := domain-name | IPv4address | \[ IPv6address \]	; rfc3986 appendix-A
-//	domain-name                     := domain-component ['.' domain-component]*
+//	name                            := [domain '/'] path-component ['/' path-component]*
+//	domain                          := domain-component ['.' domain-component]* [':' port-number]
 //	domain-component                := /([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])/
 //	port-number                     := /[0-9]+/
 //	path-component                  := alpha-numeric [separator alpha-numeric]*
-//	path (or "remote-name")         := path-component ['/' path-component]*
 //	alpha-numeric                   := /[a-z0-9]+/
 //	separator                       := /[_.]|__|[-]*/
 //
@ -24,6 +21,7 @@
 //	digest-hex                      := /[0-9a-fA-F]{32,}/ ; At least 128 bit digest value
 //
 //	identifier                      := /[a-f0-9]{64}/
+//	short-identifier                := /[a-f0-9]{6,64}/
 package reference

 import (
@ -147,7 +145,7 @@ type namedRepository interface {
 	Path() string
 }

-// Domain returns the domain part of the [Named] reference.
+// Domain returns the domain part of the Named reference
 func Domain(named Named) string {
 	if r, ok := named.(namedRepository); ok {
 		return r.Domain()
@ -156,7 +154,7 @@ func Domain(named Named) string {
 	return domain
 }

-// Path returns the name without the domain part of the [Named] reference.
+// Path returns the name without the domain part of the Named reference
 func Path(named Named) (name string) {
 	if r, ok := named.(namedRepository); ok {
 		return r.Path()
@ -177,8 +175,7 @@ func splitDomain(name string) (string, string) {
 // hostname and name string. If no valid hostname is
 // found, the hostname is empty and the full value
 // is returned as name
-//
-// Deprecated: Use [Domain] or [Path].
+// DEPRECATED: Use Domain or Path
 func SplitHostname(named Named) (string, string) {
 	if r, ok := named.(namedRepository); ok {
 		return r.Domain(), r.Path()
@ -188,6 +185,7 @@ func SplitHostname(named Named) (string, string) {

 // Parse parses s and returns a syntactically valid Reference.
 // If an error was encountered it is returned, along with a nil Reference.
+// NOTE: Parse will not handle short digests.
 func Parse(s string) (Reference, error) {
 	matches := ReferenceRegexp.FindStringSubmatch(s)
 	if matches == nil {
@ -239,6 +237,7 @@ func Parse(s string) (Reference, error) {
 // the Named interface. The reference must have a name and be in the canonical
 // form, otherwise an error is returned.
 // If an error was encountered it is returned, along with a nil Reference.
+// NOTE: ParseNamed will not handle short digests.
 func ParseNamed(s string) (Named, error) {
 	named, err := ParseNormalizedNamed(s)
 	if err != nil {
@ -321,13 +320,11 @@ func WithDigest(name Named, digest digest.Digest) (Canonical, error) {

 // TrimNamed removes any tag or digest from the named reference.
 func TrimNamed(ref Named) Named {
-	repo := repository{}
-	if r, ok := ref.(namedRepository); ok {
-		repo.domain, repo.path = r.Domain(), r.Path()
-	} else {
-		repo.domain, repo.path = splitDomain(ref.Name())
+	domain, path := SplitHostname(ref)
+	return repository{
+		domain: domain,
+		path:   path,
 	}
-	return repo
 }

 func getBestReferenceType(ref reference) Reference {
--- a/vendor/github.com/docker/distribution/reference/reference_deprecated.go
+++ b/vendor/github.com/docker/distribution/reference/reference_deprecated.go
@ -1,172 +0,0 @@
-// Package reference is deprecated, and has moved to github.com/distribution/reference.
-//
-// Deprecated: use github.com/distribution/reference instead.
-package reference
-
-import (
-	"github.com/distribution/reference"
-	"github.com/opencontainers/go-digest"
-)
-
-const (
-	// NameTotalLengthMax is the maximum total number of characters in a repository name.
-	//
-	// Deprecated: use [reference.NameTotalLengthMax].
-	NameTotalLengthMax = reference.NameTotalLengthMax
-)
-
-var (
-	// ErrReferenceInvalidFormat represents an error while trying to parse a string as a reference.
-	//
-	// Deprecated: use [reference.ErrReferenceInvalidFormat].
-	ErrReferenceInvalidFormat = reference.ErrReferenceInvalidFormat
-
-	// ErrTagInvalidFormat represents an error while trying to parse a string as a tag.
-	//
-	// Deprecated: use [reference.ErrTagInvalidFormat].
-	ErrTagInvalidFormat = reference.ErrTagInvalidFormat
-
-	// ErrDigestInvalidFormat represents an error while trying to parse a string as a tag.
-	//
-	// Deprecated: use [reference.ErrDigestInvalidFormat].
-	ErrDigestInvalidFormat = reference.ErrDigestInvalidFormat
-
-	// ErrNameContainsUppercase is returned for invalid repository names that contain uppercase characters.
-	//
-	// Deprecated: use [reference.ErrNameContainsUppercase].
-	ErrNameContainsUppercase = reference.ErrNameContainsUppercase
-
-	// ErrNameEmpty is returned for empty, invalid repository names.
-	//
-	// Deprecated: use [reference.ErrNameEmpty].
-	ErrNameEmpty = reference.ErrNameEmpty
-
-	// ErrNameTooLong is returned when a repository name is longer than NameTotalLengthMax.
-	//
-	// Deprecated: use [reference.ErrNameTooLong].
-	ErrNameTooLong = reference.ErrNameTooLong
-
-	// ErrNameNotCanonical is returned when a name is not canonical.
-	//
-	// Deprecated: use [reference.ErrNameNotCanonical].
-	ErrNameNotCanonical = reference.ErrNameNotCanonical
-)
-
-// Reference is an opaque object reference identifier that may include
-// modifiers such as a hostname, name, tag, and digest.
-//
-// Deprecated: use [reference.Reference].
-type Reference = reference.Reference
-
-// Field provides a wrapper type for resolving correct reference types when
-// working with encoding.
-//
-// Deprecated: use [reference.Field].
-type Field = reference.Field
-
-// AsField wraps a reference in a Field for encoding.
-//
-// Deprecated: use [reference.AsField].
-func AsField(ref reference.Reference) reference.Field {
-	return reference.AsField(ref)
-}
-
-// Named is an object with a full name
-//
-// Deprecated: use [reference.Named].
-type Named = reference.Named
-
-// Tagged is an object which has a tag
-//
-// Deprecated: use [reference.Tagged].
-type Tagged = reference.Tagged
-
-// NamedTagged is an object including a name and tag.
-//
-// Deprecated: use [reference.NamedTagged].
-type NamedTagged reference.NamedTagged
-
-// Digested is an object which has a digest
-// in which it can be referenced by
-//
-// Deprecated: use [reference.Digested].
-type Digested reference.Digested
-
-// Canonical reference is an object with a fully unique
-// name including a name with domain and digest
-//
-// Deprecated: use [reference.Canonical].
-type Canonical reference.Canonical
-
-// Domain returns the domain part of the [Named] reference.
-//
-// Deprecated: use [reference.Domain].
-func Domain(named reference.Named) string {
-	return reference.Domain(named)
-}
-
-// Path returns the name without the domain part of the [Named] reference.
-//
-// Deprecated: use [reference.Path].
-func Path(named reference.Named) (name string) {
-	return reference.Path(named)
-}
-
-// SplitHostname splits a named reference into a
-// hostname and name string. If no valid hostname is
-// found, the hostname is empty and the full value
-// is returned as name
-//
-// Deprecated: Use [reference.Domain] or [reference.Path].
-func SplitHostname(named reference.Named) (string, string) {
-	return reference.SplitHostname(named)
-}
-
-// Parse parses s and returns a syntactically valid Reference.
-// If an error was encountered it is returned, along with a nil Reference.
-//
-// Deprecated: use [reference.Parse].
-func Parse(s string) (reference.Reference, error) {
-	return reference.Parse(s)
-}
-
-// ParseNamed parses s and returns a syntactically valid reference implementing
-// the Named interface. The reference must have a name and be in the canonical
-// form, otherwise an error is returned.
-// If an error was encountered it is returned, along with a nil Reference.
-//
-// Deprecated: use [reference.ParseNamed].
-func ParseNamed(s string) (reference.Named, error) {
-	return reference.ParseNamed(s)
-}
-
-// WithName returns a named object representing the given string. If the input
-// is invalid ErrReferenceInvalidFormat will be returned.
-//
-// Deprecated: use [reference.WithName].
-func WithName(name string) (reference.Named, error) {
-	return reference.WithName(name)
-}
-
-// WithTag combines the name from "name" and the tag from "tag" to form a
-// reference incorporating both the name and the tag.
-//
-// Deprecated: use [reference.WithTag].
-func WithTag(name reference.Named, tag string) (reference.NamedTagged, error) {
-	return reference.WithTag(name, tag)
-}
-
-// WithDigest combines the name from "name" and the digest from "digest" to form
-// a reference incorporating both the name and the digest.
-//
-// Deprecated: use [reference.WithDigest].
-func WithDigest(name reference.Named, digest digest.Digest) (reference.Canonical, error) {
-	return reference.WithDigest(name, digest)
-}
-
-// TrimNamed removes any tag or digest from the named reference.
-//
-// Deprecated: use [reference.TrimNamed].
-func TrimNamed(ref reference.Named) reference.Named {
-	return reference.TrimNamed(ref)
-}
--- a/vendor/github.com/docker/distribution/reference/regexp.go
+++ b/vendor/github.com/docker/distribution/reference/regexp.go
@ -0,0 +1,143 @@
+package reference
+
+import "regexp"
+
+var (
+	// alphaNumericRegexp defines the alpha numeric atom, typically a
+	// component of names. This only allows lower case characters and digits.
+	alphaNumericRegexp = match(`[a-z0-9]+`)
+
+	// separatorRegexp defines the separators allowed to be embedded in name
+	// components. This allow one period, one or two underscore and multiple
+	// dashes.
+	separatorRegexp = match(`(?:[._]|__|[-]*)`)
+
+	// nameComponentRegexp restricts registry path component names to start
+	// with at least one letter or number, with following parts able to be
+	// separated by one period, one or two underscore and multiple dashes.
+	nameComponentRegexp = expression(
+		alphaNumericRegexp,
+		optional(repeated(separatorRegexp, alphaNumericRegexp)))
+
+	// domainComponentRegexp restricts the registry domain component of a
+	// repository name to start with a component as defined by DomainRegexp
+	// and followed by an optional port.
+	domainComponentRegexp = match(`(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])`)
+
+	// DomainRegexp defines the structure of potential domain components
+	// that may be part of image names. This is purposely a subset of what is
+	// allowed by DNS to ensure backwards compatibility with Docker image
+	// names.
+	DomainRegexp = expression(
+		domainComponentRegexp,
+		optional(repeated(literal(`.`), domainComponentRegexp)),
+		optional(literal(`:`), match(`[0-9]+`)))
+
+	// TagRegexp matches valid tag names. From docker/docker:graph/tags.go.
+	TagRegexp = match(`[\w][\w.-]{0,127}`)
+
+	// anchoredTagRegexp matches valid tag names, anchored at the start and
+	// end of the matched string.
+	anchoredTagRegexp = anchored(TagRegexp)
+
+	// DigestRegexp matches valid digests.
+	DigestRegexp = match(`[A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*[:][[:xdigit:]]{32,}`)
+
+	// anchoredDigestRegexp matches valid digests, anchored at the start and
+	// end of the matched string.
+	anchoredDigestRegexp = anchored(DigestRegexp)
+
+	// NameRegexp is the format for the name component of references. The
+	// regexp has capturing groups for the domain and name part omitting
+	// the separating forward slash from either.
+	NameRegexp = expression(
+		optional(DomainRegexp, literal(`/`)),
+		nameComponentRegexp,
+		optional(repeated(literal(`/`), nameComponentRegexp)))
+
+	// anchoredNameRegexp is used to parse a name value, capturing the
+	// domain and trailing components.
+	anchoredNameRegexp = anchored(
+		optional(capture(DomainRegexp), literal(`/`)),
+		capture(nameComponentRegexp,
+			optional(repeated(literal(`/`), nameComponentRegexp))))
+
+	// ReferenceRegexp is the full supported format of a reference. The regexp
+	// is anchored and has capturing groups for name, tag, and digest
+	// components.
+	ReferenceRegexp = anchored(capture(NameRegexp),
+		optional(literal(":"), capture(TagRegexp)),
+		optional(literal("@"), capture(DigestRegexp)))
+
+	// IdentifierRegexp is the format for string identifier used as a
+	// content addressable identifier using sha256. These identifiers
+	// are like digests without the algorithm, since sha256 is used.
+	IdentifierRegexp = match(`([a-f0-9]{64})`)
+
+	// ShortIdentifierRegexp is the format used to represent a prefix
+	// of an identifier. A prefix may be used to match a sha256 identifier
+	// within a list of trusted identifiers.
+	ShortIdentifierRegexp = match(`([a-f0-9]{6,64})`)
+
+	// anchoredIdentifierRegexp is used to check or match an
+	// identifier value, anchored at start and end of string.
+	anchoredIdentifierRegexp = anchored(IdentifierRegexp)
+
+	// anchoredShortIdentifierRegexp is used to check if a value
+	// is a possible identifier prefix, anchored at start and end
+	// of string.
+	anchoredShortIdentifierRegexp = anchored(ShortIdentifierRegexp)
+)
+
+// match compiles the string to a regular expression.
+var match = regexp.MustCompile
+
+// literal compiles s into a literal regular expression, escaping any regexp
+// reserved characters.
+func literal(s string) *regexp.Regexp {
+	re := match(regexp.QuoteMeta(s))
+
+	if _, complete := re.LiteralPrefix(); !complete {
+		panic("must be a literal")
+	}
+
+	return re
+}
+
+// expression defines a full expression, where each regular expression must
+// follow the previous.
+func expression(res ...*regexp.Regexp) *regexp.Regexp {
+	var s string
+	for _, re := range res {
+		s += re.String()
+	}
+
+	return match(s)
+}
+
+// optional wraps the expression in a non-capturing group and makes the
+// production optional.
+func optional(res ...*regexp.Regexp) *regexp.Regexp {
+	return match(group(expression(res...)).String() + `?`)
+}
+
+// repeated wraps the regexp in a non-capturing group to get one or more
+// matches.
+func repeated(res ...*regexp.Regexp) *regexp.Regexp {
+	return match(group(expression(res...)).String() + `+`)
+}
+
+// group wraps the regexp in a non-capturing group.
+func group(res ...*regexp.Regexp) *regexp.Regexp {
+	return match(`(?:` + expression(res...).String() + `)`)
+}
+
+// capture wraps the expression in a capturing group.
+func capture(res ...*regexp.Regexp) *regexp.Regexp {
+	return match(`(` + expression(res...).String() + `)`)
+}
+
+// anchored anchors the regular expression by adding start and end delimiters.
+func anchored(res ...*regexp.Regexp) *regexp.Regexp {
+	return match(`^` + expression(res...).String() + `$`)
+}
--- a/vendor/github.com/docker/distribution/reference/regexp_deprecated.go
+++ b/vendor/github.com/docker/distribution/reference/regexp_deprecated.go
@ -1,50 +0,0 @@
-package reference
-
-import (
-	"github.com/distribution/reference"
-)
-
-// DigestRegexp matches well-formed digests, including algorithm (e.g. "sha256:<encoded>").
-//
-// Deprecated: use [reference.DigestRegexp].
-var DigestRegexp = reference.DigestRegexp
-
-// DomainRegexp matches hostname or IP-addresses, optionally including a port
-// number. It defines the structure of potential domain components that may be
-// part of image names. This is purposely a subset of what is allowed by DNS to
-// ensure backwards compatibility with Docker image names. It may be a subset of
-// DNS domain name, an IPv4 address in decimal format, or an IPv6 address between
-// square brackets (excluding zone identifiers as defined by [RFC 6874] or special
-// addresses such as IPv4-Mapped).
-//
-// Deprecated: use [reference.DomainRegexp].
-//
-// [RFC 6874]: https://www.rfc-editor.org/rfc/rfc6874.
-var DomainRegexp = reference.DigestRegexp
-
-// IdentifierRegexp is the format for string identifier used as a
-// content addressable identifier using sha256. These identifiers
-// are like digests without the algorithm, since sha256 is used.
-//
-// Deprecated: use [reference.IdentifierRegexp].
-var IdentifierRegexp = reference.IdentifierRegexp
-
-// NameRegexp is the format for the name component of references, including
-// an optional domain and port, but without tag or digest suffix.
-//
-// Deprecated: use [reference.NameRegexp].
-var NameRegexp = reference.NameRegexp
-
-// ReferenceRegexp is the full supported format of a reference. The regexp
-// is anchored and has capturing groups for name, tag, and digest
-// components.
-//
-// Deprecated: use [reference.ReferenceRegexp].
-var ReferenceRegexp = reference.ReferenceRegexp
-
-// TagRegexp matches valid tag names. From [docker/docker:graph/tags.go].
-//
-// Deprecated: use [reference.TagRegexp].
-//
-// [docker/docker:graph/tags.go]: https://github.com/moby/moby/blob/v1.6.0/graph/tags.go#L26-L28
-var TagRegexp = reference.TagRegexp
--- a/vendor/github.com/docker/distribution/reference/sort_deprecated.go
+++ b/vendor/github.com/docker/distribution/reference/sort_deprecated.go
@ -1,10 +0,0 @@
-package reference
-
-import "github.com/distribution/reference"
-
-// Sort sorts string references preferring higher information references.
-//
-// Deprecated: use [reference.Sort].
-func Sort(references []string) []string {
-	return reference.Sort(references)
-}
--- a/vendor/github.com/docker/docker-credential-helpers/client/client.go
+++ b/vendor/github.com/docker/docker-credential-helpers/client/client.go
@ -26,7 +26,7 @@ func isValidCredsMessage(msg string) error {

 // Store uses an external program to save credentials.
 func Store(program ProgramFunc, creds *credentials.Credentials) error {
-	cmd := program(credentials.ActionStore)
+	cmd := program("store")

 	buffer := new(bytes.Buffer)
 	if err := json.NewEncoder(buffer).Encode(creds); err != nil {
@ -50,7 +50,7 @@ func Store(program ProgramFunc, creds *credentials.Credentials) error {

 // Get executes an external program to get the credentials from a native store.
 func Get(program ProgramFunc, serverURL string) (*credentials.Credentials, error) {
-	cmd := program(credentials.ActionGet)
+	cmd := program("get")
 	cmd.Input(strings.NewReader(serverURL))

 	out, err := cmd.Output()
@ -81,7 +81,7 @@ func Get(program ProgramFunc, serverURL string) (*credentials.Credentials, error

 // Erase executes a program to remove the server credentials from the native store.
 func Erase(program ProgramFunc, serverURL string) error {
-	cmd := program(credentials.ActionErase)
+	cmd := program("erase")
 	cmd.Input(strings.NewReader(serverURL))
 	out, err := cmd.Output()
 	if err != nil {
@ -99,7 +99,7 @@ func Erase(program ProgramFunc, serverURL string) error {

 // List executes a program to list server credentials in the native store.
 func List(program ProgramFunc) (map[string]string, error) {
-	cmd := program(credentials.ActionList)
+	cmd := program("list")
 	cmd.Input(strings.NewReader("unused"))
 	out, err := cmd.Output()
 	if err != nil {
--- a/vendor/github.com/docker/docker-credential-helpers/client/command.go
+++ b/vendor/github.com/docker/docker-credential-helpers/client/command.go
@ -1,9 +1,11 @@
 package client

 import (
+	"fmt"
 	"io"
 	"os"
-	"os/exec"
+
+	exec "golang.org/x/sys/execabs"
 )

 // Program is an interface to execute external programs.
@ -29,26 +31,27 @@ func NewShellProgramFuncWithEnv(name string, env *map[string]string) ProgramFunc

 func createProgramCmdRedirectErr(commandName string, args []string, env *map[string]string) *exec.Cmd {
 	programCmd := exec.Command(commandName, args...)
+	programCmd.Env = os.Environ()
 	if env != nil {
 		for k, v := range *env {
-			programCmd.Env = append(programCmd.Environ(), k+"="+v)
+			programCmd.Env = append(programCmd.Env, fmt.Sprintf("%s=%s", k, v))
 		}
 	}
 	programCmd.Stderr = os.Stderr
 	return programCmd
 }

-// Shell invokes shell commands to talk with a remote credentials-helper.
+// Shell invokes shell commands to talk with a remote credentials helper.
 type Shell struct {
 	cmd *exec.Cmd
 }

-// Output returns responses from the remote credentials-helper.
+// Output returns responses from the remote credentials helper.
 func (s *Shell) Output() ([]byte, error) {
 	return s.cmd.Output()
 }

-// Input sets the input to send to a remote credentials-helper.
+// Input sets the input to send to a remote credentials helper.
 func (s *Shell) Input(in io.Reader) {
 	s.cmd.Stdin = in
 }
--- a/vendor/github.com/docker/docker-credential-helpers/credentials/credentials.go
+++ b/vendor/github.com/docker/docker-credential-helpers/credentials/credentials.go
@ -10,20 +10,6 @@ import (
 	"strings"
 )

-// Action defines the name of an action (sub-command) supported by a
-// credential-helper binary. It is an alias for "string", and mostly
-// for convenience.
-type Action = string
-
-// List of actions (sub-commands) supported by credential-helper binaries.
-const (
-	ActionStore   Action = "store"
-	ActionGet     Action = "get"
-	ActionErase   Action = "erase"
-	ActionList    Action = "list"
-	ActionVersion Action = "version"
-)
-
 // Credentials holds the information shared between docker and the credentials store.
 type Credentials struct {
 	ServerURL string
@ -57,52 +43,42 @@ func SetCredsLabel(label string) {
 	CredsLabel = label
 }

-// Serve initializes the credentials-helper and parses the action argument.
+// Serve initializes the credentials helper and parses the action argument.
 // This function is designed to be called from a command line interface.
 // It uses os.Args[1] as the key for the action.
 // It uses os.Stdin as input and os.Stdout as output.
 // This function terminates the program with os.Exit(1) if there is an error.
 func Serve(helper Helper) {
+	var err error
 	if len(os.Args) != 2 {
-		_, _ = fmt.Fprintln(os.Stdout, usage())
-		os.Exit(1)
+		err = fmt.Errorf("Usage: %s <store|get|erase|list|version>", os.Args[0])
 	}

-	switch os.Args[1] {
-	case "--version", "-v":
-		_ = PrintVersion(os.Stdout)
-		os.Exit(0)
-	case "--help", "-h":
-		_, _ = fmt.Fprintln(os.Stdout, usage())
-		os.Exit(0)
+	if err == nil {
+		err = HandleCommand(helper, os.Args[1], os.Stdin, os.Stdout)
 	}

-	if err := HandleCommand(helper, os.Args[1], os.Stdin, os.Stdout); err != nil {
-		_, _ = fmt.Fprintln(os.Stdout, err)
+	if err != nil {
+		fmt.Fprintf(os.Stdout, "%v\n", err)
 		os.Exit(1)
 	}
 }

-func usage() string {
-	return fmt.Sprintf("Usage: %s <store|get|erase|list|version>", Name)
-}
-
-// HandleCommand runs a helper to execute a credential action.
-func HandleCommand(helper Helper, action Action, in io.Reader, out io.Writer) error {
-	switch action {
-	case ActionStore:
+// HandleCommand uses a helper and a key to run a credential action.
+func HandleCommand(helper Helper, key string, in io.Reader, out io.Writer) error {
+	switch key {
+	case "store":
 		return Store(helper, in)
-	case ActionGet:
+	case "get":
 		return Get(helper, in, out)
-	case ActionErase:
+	case "erase":
 		return Erase(helper, in)
-	case ActionList:
+	case "list":
 		return List(helper, out)
-	case ActionVersion:
+	case "version":
 		return PrintVersion(out)
-	default:
-		return fmt.Errorf("%s: unknown action: %s", Name, action)
 	}
+	return fmt.Errorf("Unknown credential action `%s`", key)
 }

 // Store uses a helper and an input reader to save credentials.
@ -156,17 +132,18 @@ func Get(helper Helper, reader io.Reader, writer io.Writer) error {
 		return err
 	}

-	buffer.Reset()
-	err = json.NewEncoder(buffer).Encode(Credentials{
+	resp := Credentials{
 		ServerURL: serverURL,
 		Username:  username,
 		Secret:    secret,
-	})
-	if err != nil {
+	}
+
+	buffer.Reset()
+	if err := json.NewEncoder(buffer).Encode(resp); err != nil {
 		return err
 	}

-	_, _ = fmt.Fprint(writer, buffer.String())
+	fmt.Fprint(writer, buffer.String())
 	return nil
 }

@ -204,6 +181,6 @@ func List(helper Helper, writer io.Writer) error {

 // PrintVersion outputs the current version.
 func PrintVersion(writer io.Writer) error {
-	_, _ = fmt.Fprintf(writer, "%s (%s) %s\n", Name, Package, Version)
+	fmt.Fprintf(writer, "%s (%s) %s\n", Name, Package, Version)
 	return nil
 }
--- a/vendor/github.com/docker/docker-credential-helpers/credentials/error.go
+++ b/vendor/github.com/docker/docker-credential-helpers/credentials/error.go
@ -1,7 +1,5 @@
 package credentials

-import "errors"
-
 const (
 	// ErrCredentialsNotFound standardizes the not found error, so every helper returns
 	// the same message and docker can handle it properly.
@ -23,11 +21,6 @@ func (errCredentialsNotFound) Error() string {
 	return errCredentialsNotFoundMessage
 }

-// NotFound implements the [ErrNotFound][errdefs.ErrNotFound] interface.
-//
-// [errdefs.ErrNotFound]: https://pkg.go.dev/github.com/docker/docker@v24.0.1+incompatible/errdefs#ErrNotFound
-func (errCredentialsNotFound) NotFound() {}
-
 // NewErrCredentialsNotFound creates a new error
 // for when the credentials are not in the store.
 func NewErrCredentialsNotFound() error {
@ -37,8 +30,8 @@ func NewErrCredentialsNotFound() error {
 // IsErrCredentialsNotFound returns true if the error
 // was caused by not having a set of credentials in a store.
 func IsErrCredentialsNotFound(err error) bool {
-	var target errCredentialsNotFound
-	return errors.As(err, &target)
+	_, ok := err.(errCredentialsNotFound)
+	return ok
 }

 // IsErrCredentialsNotFoundMessage returns true if the error
@ -60,12 +53,6 @@ func (errCredentialsMissingServerURL) Error() string {
 	return errCredentialsMissingServerURLMessage
 }

-// InvalidParameter implements the [ErrInvalidParameter][errdefs.ErrInvalidParameter]
-// interface.
-//
-// [errdefs.ErrInvalidParameter]: https://pkg.go.dev/github.com/docker/docker@v24.0.1+incompatible/errdefs#ErrInvalidParameter
-func (errCredentialsMissingServerURL) InvalidParameter() {}
-
 // errCredentialsMissingUsername represents an error raised
 // when the credentials object has no username or when no
 // username is provided to a credentials operation requiring
@ -76,12 +63,6 @@ func (errCredentialsMissingUsername) Error() string {
 	return errCredentialsMissingUsernameMessage
 }

-// InvalidParameter implements the [ErrInvalidParameter][errdefs.ErrInvalidParameter]
-// interface.
-//
-// [errdefs.ErrInvalidParameter]: https://pkg.go.dev/github.com/docker/docker@v24.0.1+incompatible/errdefs#ErrInvalidParameter
-func (errCredentialsMissingUsername) InvalidParameter() {}
-
 // NewErrCredentialsMissingServerURL creates a new error for
 // errCredentialsMissingServerURL.
 func NewErrCredentialsMissingServerURL() error {
@ -97,8 +78,8 @@ func NewErrCredentialsMissingUsername() error {
 // IsCredentialsMissingServerURL returns true if the error
 // was an errCredentialsMissingServerURL.
 func IsCredentialsMissingServerURL(err error) bool {
-	var target errCredentialsMissingServerURL
-	return errors.As(err, &target)
+	_, ok := err.(errCredentialsMissingServerURL)
+	return ok
 }

 // IsCredentialsMissingServerURLMessage checks for an
@ -110,8 +91,8 @@ func IsCredentialsMissingServerURLMessage(err string) bool {
 // IsCredentialsMissingUsername returns true if the error
 // was an errCredentialsMissingUsername.
 func IsCredentialsMissingUsername(err error) bool {
-	var target errCredentialsMissingUsername
-	return errors.As(err, &target)
+	_, ok := err.(errCredentialsMissingUsername)
+	return ok
 }

 // IsCredentialsMissingUsernameMessage checks for an
--- a/vendor/github.com/docker/docker/AUTHORS
+++ b/vendor/github.com/docker/docker/AUTHORS
@ -29,7 +29,6 @@ Adam Pointer <adam.pointer@skybettingandgaming.com>
 Adam Singer <financeCoding@gmail.com>
 Adam Walz <adam@adamwalz.net>
 Adam Williams <awilliams@mirantis.com>
-AdamKorcz <adam@adalogics.com>
 Addam Hardy <addam.hardy@gmail.com>
 Aditi Rajagopal <arajagopal@us.ibm.com>
 Aditya <aditya@netroy.in>
@ -82,7 +81,6 @@ Alex Goodman <wagoodman@gmail.com>
 Alex Nordlund <alexander.nordlund@nasdaq.com>
 Alex Olshansky <i@creagenics.com>
 Alex Samorukov <samm@os2.kiev.ua>
-Alex Stockinger <alex@atomicjar.com>
 Alex Warhawk <ax.warhawk@gmail.com>
 Alexander Artemenko <svetlyak.40wt@gmail.com>
 Alexander Boyd <alex@opengroove.org>
@ -200,7 +198,6 @@ Anusha Ragunathan <anusha.ragunathan@docker.com>
 Anyu Wang <wanganyu@outlook.com>
 apocas <petermdias@gmail.com>
 Arash Deshmeh <adeshmeh@ca.ibm.com>
-arcosx <arcosx@outlook.com>
 ArikaChen <eaglesora@gmail.com>
 Arko Dasgupta <arko@tetrate.io>
 Arnaud Lefebvre <a.lefebvre@outlook.fr>
@ -244,7 +241,6 @@ Benjamin Atkin <ben@benatkin.com>
 Benjamin Baker <Benjamin.baker@utexas.edu>
 Benjamin Boudreau <boudreau.benjamin@gmail.com>
 Benjamin Böhmke <benjamin@boehmke.net>
-Benjamin Wang <wachao@vmware.com>
 Benjamin Yolken <yolken@stripe.com>
 Benny Ng <benny.tpng@gmail.com>
 Benoit Chesneau <bchesneau@gmail.com>
@ -638,7 +634,6 @@ Eng Zer Jun <engzerjun@gmail.com>
 Enguerran <engcolson@gmail.com>
 Eohyung Lee <liquidnuker@gmail.com>
 epeterso <epeterson@breakpoint-labs.com>
-er0k <er0k@er0k.net>
 Eric Barch <barch@tomesoftware.com>
 Eric Curtin <ericcurtin17@gmail.com>
 Eric G. Noriega <enoriega@vizuri.com>
@ -759,7 +754,6 @@ Félix Baylac-Jacqué <baylac.felix@gmail.com>
 Félix Cantournet <felix.cantournet@cloudwatt.com>
 Gabe Rosenhouse <gabe@missionst.com>
 Gabor Nagy <mail@aigeruth.hu>
-Gabriel Adrian Samfira <gsamfira@cloudbasesolutions.com>
 Gabriel Goller <gabrielgoller123@gmail.com>
 Gabriel L. Somlo <gsomlo@gmail.com>
 Gabriel Linder <linder.gabriel@gmail.com>
@ -861,7 +855,6 @@ Hongbin Lu <hongbin034@gmail.com>
 Hongxu Jia <hongxu.jia@windriver.com>
 Honza Pokorny <me@honza.ca>
 Hsing-Hui Hsu <hsinghui@amazon.com>
-Hsing-Yu (David) Chen <davidhsingyuchen@gmail.com>
 hsinko <21551195@zju.edu.cn>
 Hu Keping <hukeping@huawei.com>
 Hu Tao <hutao@cn.fujitsu.com>
@ -894,7 +887,6 @@ Igor Dolzhikov <bluesriverz@gmail.com>
 Igor Karpovich <i.karpovich@currencysolutions.com>
 Iliana Weller <iweller@amazon.com>
 Ilkka Laukkanen <ilkka@ilkka.io>
-Illia Antypenko <ilya@antipenko.pp.ua>
 Illo Abdulrahim <abdulrahim.illo@nokia.com>
 Ilya Dmitrichenko <errordeveloper@gmail.com>
 Ilya Gusev <mail@igusev.ru>
@ -946,7 +938,6 @@ Jamie Hannaford <jamie@limetree.org>
 Jamshid Afshar <jafshar@yahoo.com>
 Jan Breig <git@pygos.space>
 Jan Chren <dev.rindeal@gmail.com>
-Jan Garcia <github-public@n-garcia.com>
 Jan Götte <jaseg@jaseg.net>
 Jan Keromnes <janx@linux.com>
 Jan Koprowski <jan.koprowski@gmail.com>
@ -1215,7 +1206,6 @@ Kimbro Staken <kstaken@kstaken.com>
 Kir Kolyshkin <kolyshkin@gmail.com>
 Kiran Gangadharan <kiran.daredevil@gmail.com>
 Kirill SIbirev <l0kix2@gmail.com>
-Kirk Easterson <kirk.easterson@gmail.com>
 knappe <tyler.knappe@gmail.com>
 Kohei Tsuruta <coheyxyz@gmail.com>
 Koichi Shiraishi <k@zchee.io>
@ -1250,12 +1240,10 @@ Lars Kellogg-Stedman <lars@redhat.com>
 Lars R. Damerow <lars@pixar.com>
 Lars-Magnus Skog <ralphtheninja@riseup.net>
 Laszlo Meszaros <lacienator@gmail.com>
-Laura Brehm <laurabrehm@hey.com>
 Laura Frank <ljfrank@gmail.com>
 Laurent Bernaille <laurent.bernaille@datadoghq.com>
 Laurent Erignoux <lerignoux@gmail.com>
 Laurie Voss <github@seldo.com>
-Leandro Motta Barros <lmb@stackedboxes.org>
 Leandro Siqueira <leandro.siqueira@gmail.com>
 Lee Calcote <leecalcote@gmail.com>
 Lee Chao <932819864@qq.com>
@ -1575,7 +1563,6 @@ Nick Neisen <nwneisen@gmail.com>
 Nick Parker <nikaios@gmail.com>
 Nick Payne <nick@kurai.co.uk>
 Nick Russo <nicholasjamesrusso@gmail.com>
-Nick Santos <nick.santos@docker.com>
 Nick Stenning <nick.stenning@digital.cabinet-office.gov.uk>
 Nick Stinemates <nick@stinemates.org>
 Nick Wood <nwood@microsoft.com>
@ -1597,7 +1584,6 @@ NikolaMandic <mn080202@gmail.com>
 Nikolas Garofil <nikolas.garofil@uantwerpen.be>
 Nikolay Edigaryev <edigaryev@gmail.com>
 Nikolay Milovanov <nmil@itransformers.net>
-ningmingxiao <ning.mingxiao@zte.com.cn>
 Nirmal Mehta <nirmalkmehta@gmail.com>
 Nishant Totla <nishanttotla@gmail.com>
 NIWA Hideyuki <niwa.niwa@nifty.ne.jp>
@ -1629,7 +1615,6 @@ Omri Shiv <Omri.Shiv@teradata.com>
 Onur Filiz <onur.filiz@microsoft.com>
 Oriol Francès <oriolfa@gmail.com>
 Oscar Bonilla <6f6231@gmail.com>
-oscar.chen <2972789494@qq.com>
 Oskar Niburski <oskarniburski@gmail.com>
 Otto Kekäläinen <otto@seravo.fi>
 Ouyang Liduo <oyld0210@163.com>
@ -1837,7 +1822,6 @@ Rory Hunter <roryhunter2@gmail.com>
 Rory McCune <raesene@gmail.com>
 Ross Boucher <rboucher@gmail.com>
 Rovanion Luckey <rovanion.luckey@gmail.com>
-Roy Reznik <roy@wiz.io>
 Royce Remer <royceremer@gmail.com>
 Rozhnov Alexandr <nox73@ya.ru>
 Rudolph Gottesheim <r.gottesheim@loot.at>
@ -2287,7 +2271,6 @@ Xiaoyu Zhang <zhang.xiaoyu33@zte.com.cn>
 xichengliudui <1693291525@qq.com>
 xiekeyang <xiekeyang@huawei.com>
 Ximo Guanter Gonzálbez <joaquin.guantergonzalbez@telefonica.com>
-xin.li <xin.li@daocloud.io>
 Xinbo Weng <xihuanbo_0521@zju.edu.cn>
 Xinfeng Liu <xinfeng.liu@gmail.com>
 Xinzi Zhou <imdreamrunner@gmail.com>
@ -2299,7 +2282,6 @@ Yahya <ya7yaz@gmail.com>
 yalpul <yalpul@gmail.com>
 YAMADA Tsuyoshi <tyamada@minimum2scp.org>
 Yamasaki Masahide <masahide.y@gmail.com>
-Yamazaki Masashi <masi19bw@gmail.com>
 Yan Feng <yanfeng2@huawei.com>
 Yan Zhu <yanzhu@alauda.io>
 Yang Bai <hamo.by@gmail.com>
--- a/vendor/github.com/docker/docker/pkg/homedir/homedir_linux.go
+++ b/vendor/github.com/docker/docker/pkg/homedir/homedir_linux.go
@ -64,14 +64,13 @@ func stick(f string) error {

 // GetDataHome returns XDG_DATA_HOME.
 // GetDataHome returns $HOME/.local/share and nil error if XDG_DATA_HOME is not set.
-// If HOME and XDG_DATA_HOME are not set, getpwent(3) is consulted to determine the users home directory.
 //
 // See also https://standards.freedesktop.org/basedir-spec/latest/ar01s03.html
 func GetDataHome() (string, error) {
 	if xdgDataHome := os.Getenv("XDG_DATA_HOME"); xdgDataHome != "" {
 		return xdgDataHome, nil
 	}
-	home := Get()
+	home := os.Getenv("HOME")
 	if home == "" {
 		return "", errors.New("could not get either XDG_DATA_HOME or HOME")
 	}
@ -80,14 +79,13 @@ func GetDataHome() (string, error) {

 // GetConfigHome returns XDG_CONFIG_HOME.
 // GetConfigHome returns $HOME/.config and nil error if XDG_CONFIG_HOME is not set.
-// If HOME and XDG_CONFIG_HOME are not set, getpwent(3) is consulted to determine the users home directory.
 //
 // See also https://standards.freedesktop.org/basedir-spec/latest/ar01s03.html
 func GetConfigHome() (string, error) {
 	if xdgConfigHome := os.Getenv("XDG_CONFIG_HOME"); xdgConfigHome != "" {
 		return xdgConfigHome, nil
 	}
-	home := Get()
+	home := os.Getenv("HOME")
 	if home == "" {
 		return "", errors.New("could not get either XDG_CONFIG_HOME or HOME")
 	}
@ -95,9 +93,8 @@ func GetConfigHome() (string, error) {
 }

 // GetLibHome returns $HOME/.local/lib
-// If HOME is not set, getpwent(3) is consulted to determine the users home directory.
 func GetLibHome() (string, error) {
-	home := Get()
+	home := os.Getenv("HOME")
 	if home == "" {
 		return "", errors.New("could not get HOME")
 	}
--- a/vendor/github.com/go-logr/logr/.golangci.yaml
+++ b/vendor/github.com/go-logr/logr/.golangci.yaml
@ -6,6 +6,7 @@ linters:
  disable-all: true
  enable:
    - asciicheck
+    - deadcode
    - errcheck
    - forcetypeassert
    - gocritic
@ -17,8 +18,10 @@ linters:
    - misspell
    - revive
    - staticcheck
+    - structcheck
    - typecheck
    - unused
+    - varcheck

 issues:
  exclude-use-default: false
--- a/vendor/github.com/go-logr/logr/discard.go
+++ b/vendor/github.com/go-logr/logr/discard.go
@ -20,5 +20,35 @@ package logr
 // used whenever the caller is not interested in the logs.  Logger instances
 // produced by this function always compare as equal.
 func Discard() Logger {
-	return New(nil)
+	return Logger{
+		level: 0,
+		sink:  discardLogSink{},
+	}
+}
+
+// discardLogSink is a LogSink that discards all messages.
+type discardLogSink struct{}
+
+// Verify that it actually implements the interface
+var _ LogSink = discardLogSink{}
+
+func (l discardLogSink) Init(RuntimeInfo) {
+}
+
+func (l discardLogSink) Enabled(int) bool {
+	return false
+}
+
+func (l discardLogSink) Info(int, string, ...interface{}) {
+}
+
+func (l discardLogSink) Error(error, string, ...interface{}) {
+}
+
+func (l discardLogSink) WithValues(...interface{}) LogSink {
+	return l
+}
+
+func (l discardLogSink) WithName(string) LogSink {
+	return l
 }
--- a/vendor/github.com/go-logr/logr/funcr/funcr.go
+++ b/vendor/github.com/go-logr/logr/funcr/funcr.go
@ -21,13 +21,13 @@ limitations under the License.
 // github.com/go-logr/logr.LogSink with output through an arbitrary
 // "write" function.  See New and NewJSON for details.
 //
-// # Custom LogSinks
+// Custom LogSinks
 //
 // For users who need more control, a funcr.Formatter can be embedded inside
 // your own custom LogSink implementation. This is useful when the LogSink
 // needs to implement additional methods, for example.
 //
-// # Formatting
+// Formatting
 //
 // This will respect logr.Marshaler, fmt.Stringer, and error interfaces for
 // values which are being logged.  When rendering a struct, funcr will use Go's
@ -37,7 +37,6 @@ package funcr
 import (
 	"bytes"
 	"encoding"
-	"encoding/json"
 	"fmt"
 	"path/filepath"
 	"reflect"
@ -218,7 +217,7 @@ func newFormatter(opts Options, outfmt outputFormat) Formatter {
 		prefix:       "",
 		values:       nil,
 		depth:        0,
-		opts:         &opts,
+		opts:         opts,
 	}
 	return f
 }
@ -232,7 +231,7 @@ type Formatter struct {
 	values       []interface{}
 	valuesStr    string
 	depth        int
-	opts         *Options
+	opts         Options
 }

 // outputFormat indicates which outputFormat to use.
@ -448,7 +447,6 @@ func (f Formatter) prettyWithFlags(value interface{}, flags uint32, depth int) s
 		if flags&flagRawStruct == 0 {
 			buf.WriteByte('{')
 		}
-		printComma := false // testing i>0 is not enough because of JSON omitted fields
 		for i := 0; i < t.NumField(); i++ {
 			fld := t.Field(i)
 			if fld.PkgPath != "" {
@ -480,10 +478,9 @@ func (f Formatter) prettyWithFlags(value interface{}, flags uint32, depth int) s
 			if omitempty && isEmpty(v.Field(i)) {
 				continue
 			}
-			if printComma {
+			if i > 0 {
 				buf.WriteByte(',')
 			}
-			printComma = true // if we got here, we are rendering a field
 			if fld.Anonymous && fld.Type.Kind() == reflect.Struct && name == "" {
 				buf.WriteString(f.prettyWithFlags(v.Field(i).Interface(), flags|flagRawStruct, depth+1))
 				continue
@ -503,20 +500,6 @@ func (f Formatter) prettyWithFlags(value interface{}, flags uint32, depth int) s
 		}
 		return buf.String()
 	case reflect.Slice, reflect.Array:
-		// If this is outputing as JSON make sure this isn't really a json.RawMessage.
-		// If so just emit "as-is" and don't pretty it as that will just print
-		// it as [X,Y,Z,...] which isn't terribly useful vs the string form you really want.
-		if f.outputFormat == outputJSON {
-			if rm, ok := value.(json.RawMessage); ok {
-				// If it's empty make sure we emit an empty value as the array style would below.
-				if len(rm) > 0 {
-					buf.Write(rm)
-				} else {
-					buf.WriteString("null")
-				}
-				return buf.String()
-			}
-		}
 		buf.WriteByte('[')
 		for i := 0; i < v.Len(); i++ {
 			if i > 0 {
--- a/vendor/github.com/go-logr/logr/logr.go
+++ b/vendor/github.com/go-logr/logr/logr.go
@ -21,7 +21,7 @@ limitations under the License.
 // to back that API.  Packages in the Go ecosystem can depend on this package,
 // while callers can implement logging with whatever backend is appropriate.
 //
-// # Usage
+// Usage
 //
 // Logging is done using a Logger instance.  Logger is a concrete type with
 // methods, which defers the actual logging to a LogSink interface.  The main
@ -30,20 +30,16 @@ limitations under the License.
 // "structured logging".
 //
 // With Go's standard log package, we might write:
-//
-//	log.Printf("setting target value %s", targetValue)
+//   log.Printf("setting target value %s", targetValue)
 //
 // With logr's structured logging, we'd write:
-//
-//	logger.Info("setting target", "value", targetValue)
+//   logger.Info("setting target", "value", targetValue)
 //
 // Errors are much the same.  Instead of:
-//
-//	log.Printf("failed to open the pod bay door for user %s: %v", user, err)
+//   log.Printf("failed to open the pod bay door for user %s: %v", user, err)
 //
 // We'd write:
-//
-//	logger.Error(err, "failed to open the pod bay door", "user", user)
+//   logger.Error(err, "failed to open the pod bay door", "user", user)
 //
 // Info() and Error() are very similar, but they are separate methods so that
 // LogSink implementations can choose to do things like attach additional
@ -51,7 +47,7 @@ limitations under the License.
 // always logged, regardless of the current verbosity.  If there is no error
 // instance available, passing nil is valid.
 //
-// # Verbosity
+// Verbosity
 //
 // Often we want to log information only when the application in "verbose
 // mode".  To write log lines that are more verbose, Logger has a V() method.
@ -62,22 +58,20 @@ limitations under the License.
 // Error messages do not have a verbosity level and are always logged.
 //
 // Where we might have written:
-//
-//	if flVerbose >= 2 {
-//	    log.Printf("an unusual thing happened")
-//	}
+//   if flVerbose >= 2 {
+//       log.Printf("an unusual thing happened")
+//   }
 //
 // We can write:
+//   logger.V(2).Info("an unusual thing happened")
 //
-//	logger.V(2).Info("an unusual thing happened")
-//
-// # Logger Names
+// Logger Names
 //
 // Logger instances can have name strings so that all messages logged through
 // that instance have additional context.  For example, you might want to add
 // a subsystem name:
 //
-//	logger.WithName("compactor").Info("started", "time", time.Now())
+//   logger.WithName("compactor").Info("started", "time", time.Now())
 //
 // The WithName() method returns a new Logger, which can be passed to
 // constructors or other functions for further use.  Repeated use of WithName()
@ -88,27 +82,25 @@ limitations under the License.
 // joining operation (e.g. whitespace, commas, periods, slashes, brackets,
 // quotes, etc).
 //
-// # Saved Values
+// Saved Values
 //
 // Logger instances can store any number of key/value pairs, which will be
 // logged alongside all messages logged through that instance.  For example,
 // you might want to create a Logger instance per managed object:
 //
 // With the standard log package, we might write:
-//
-//	log.Printf("decided to set field foo to value %q for object %s/%s",
-//	    targetValue, object.Namespace, object.Name)
+//   log.Printf("decided to set field foo to value %q for object %s/%s",
+//       targetValue, object.Namespace, object.Name)
 //
 // With logr we'd write:
+//   // Elsewhere: set up the logger to log the object name.
+//   obj.logger = mainLogger.WithValues(
+//       "name", obj.name, "namespace", obj.namespace)
 //
-//	// Elsewhere: set up the logger to log the object name.
-//	obj.logger = mainLogger.WithValues(
-//	    "name", obj.name, "namespace", obj.namespace)
+//   // later on...
+//   obj.logger.Info("setting foo", "value", targetValue)
 //
-//	// later on...
-//	obj.logger.Info("setting foo", "value", targetValue)
-//
-// # Best Practices
+// Best Practices
 //
 // Logger has very few hard rules, with the goal that LogSink implementations
 // might have a lot of freedom to differentiate.  There are, however, some
@ -132,15 +124,15 @@ limitations under the License.
 // around. For cases where passing a logger is optional, a pointer to Logger
 // should be used.
 //
-// # Key Naming Conventions
+// Key Naming Conventions
 //
 // Keys are not strictly required to conform to any specification or regex, but
 // it is recommended that they:
-//   - be human-readable and meaningful (not auto-generated or simple ordinals)
-//   - be constant (not dependent on input data)
-//   - contain only printable characters
-//   - not contain whitespace or punctuation
-//   - use lower case for simple keys and lowerCamelCase for more complex ones
+//   * be human-readable and meaningful (not auto-generated or simple ordinals)
+//   * be constant (not dependent on input data)
+//   * contain only printable characters
+//   * not contain whitespace or punctuation
+//   * use lower case for simple keys and lowerCamelCase for more complex ones
 //
 // These guidelines help ensure that log data is processed properly regardless
 // of the log implementation.  For example, log implementations will try to
@ -149,54 +141,51 @@ limitations under the License.
 // While users are generally free to use key names of their choice, it's
 // generally best to avoid using the following keys, as they're frequently used
 // by implementations:
-//   - "caller": the calling information (file/line) of a particular log line
-//   - "error": the underlying error value in the `Error` method
-//   - "level": the log level
-//   - "logger": the name of the associated logger
-//   - "msg": the log message
-//   - "stacktrace": the stack trace associated with a particular log line or
-//     error (often from the `Error` message)
-//   - "ts": the timestamp for a log line
+//   * "caller": the calling information (file/line) of a particular log line
+//   * "error": the underlying error value in the `Error` method
+//   * "level": the log level
+//   * "logger": the name of the associated logger
+//   * "msg": the log message
+//   * "stacktrace": the stack trace associated with a particular log line or
+//                   error (often from the `Error` message)
+//   * "ts": the timestamp for a log line
 //
 // Implementations are encouraged to make use of these keys to represent the
 // above concepts, when necessary (for example, in a pure-JSON output form, it
 // would be necessary to represent at least message and timestamp as ordinary
 // named values).
 //
-// # Break Glass
+// Break Glass
 //
 // Implementations may choose to give callers access to the underlying
 // logging implementation.  The recommended pattern for this is:
-//
-//	// Underlier exposes access to the underlying logging implementation.
-//	// Since callers only have a logr.Logger, they have to know which
-//	// implementation is in use, so this interface is less of an abstraction
-//	// and more of way to test type conversion.
-//	type Underlier interface {
-//	    GetUnderlying() <underlying-type>
-//	}
+//   // Underlier exposes access to the underlying logging implementation.
+//   // Since callers only have a logr.Logger, they have to know which
+//   // implementation is in use, so this interface is less of an abstraction
+//   // and more of way to test type conversion.
+//   type Underlier interface {
+//       GetUnderlying() <underlying-type>
+//   }
 //
 // Logger grants access to the sink to enable type assertions like this:
-//
-//	func DoSomethingWithImpl(log logr.Logger) {
-//	    if underlier, ok := log.GetSink().(impl.Underlier); ok {
-//	       implLogger := underlier.GetUnderlying()
-//	       ...
-//	    }
-//	}
+//   func DoSomethingWithImpl(log logr.Logger) {
+//       if underlier, ok := log.GetSink()(impl.Underlier) {
+//          implLogger := underlier.GetUnderlying()
+//          ...
+//       }
+//   }
 //
 // Custom `With*` functions can be implemented by copying the complete
 // Logger struct and replacing the sink in the copy:
-//
-//	// WithFooBar changes the foobar parameter in the log sink and returns a
-//	// new logger with that modified sink.  It does nothing for loggers where
-//	// the sink doesn't support that parameter.
-//	func WithFoobar(log logr.Logger, foobar int) logr.Logger {
-//	   if foobarLogSink, ok := log.GetSink().(FoobarSink); ok {
-//	      log = log.WithSink(foobarLogSink.WithFooBar(foobar))
-//	   }
-//	   return log
-//	}
+//   // WithFooBar changes the foobar parameter in the log sink and returns a
+//   // new logger with that modified sink.  It does nothing for loggers where
+//   // the sink doesn't support that parameter.
+//   func WithFoobar(log logr.Logger, foobar int) logr.Logger {
+//      if foobarLogSink, ok := log.GetSink()(FoobarSink); ok {
+//         log = log.WithSink(foobarLogSink.WithFooBar(foobar))
+//      }
+//      return log
+//   }
 //
 // Don't use New to construct a new Logger with a LogSink retrieved from an
 // existing Logger. Source code attribution might not work correctly and
@ -212,14 +201,11 @@ import (
 )

 // New returns a new Logger instance.  This is primarily used by libraries
-// implementing LogSink, rather than end users.  Passing a nil sink will create
-// a Logger which discards all log lines.
+// implementing LogSink, rather than end users.
 func New(sink LogSink) Logger {
 	logger := Logger{}
 	logger.setSink(sink)
-	if sink != nil {
-		sink.Init(runtimeInfo)
-	}
+	sink.Init(runtimeInfo)
 	return logger
 }

@ -258,7 +244,7 @@ type Logger struct {
 // Enabled tests whether this Logger is enabled.  For example, commandline
 // flags might be used to set the logging verbosity and disable some info logs.
 func (l Logger) Enabled() bool {
-	return l.sink != nil && l.sink.Enabled(l.level)
+	return l.sink.Enabled(l.level)
 }

 // Info logs a non-error message with the given key/value pairs as context.
@ -268,9 +254,6 @@ func (l Logger) Enabled() bool {
 // information.  The key/value pairs must alternate string keys and arbitrary
 // values.
 func (l Logger) Info(msg string, keysAndValues ...interface{}) {
-	if l.sink == nil {
-		return
-	}
 	if l.Enabled() {
 		if withHelper, ok := l.sink.(CallStackHelperLogSink); ok {
 			withHelper.GetCallStackHelper()()
@ -290,9 +273,6 @@ func (l Logger) Info(msg string, keysAndValues ...interface{}) {
 // triggered this log line, if present. The err parameter is optional
 // and nil may be passed instead of an error instance.
 func (l Logger) Error(err error, msg string, keysAndValues ...interface{}) {
-	if l.sink == nil {
-		return
-	}
 	if withHelper, ok := l.sink.(CallStackHelperLogSink); ok {
 		withHelper.GetCallStackHelper()()
 	}
@ -304,9 +284,6 @@ func (l Logger) Error(err error, msg string, keysAndValues ...interface{}) {
 // level means a log message is less important.  Negative V-levels are treated
 // as 0.
 func (l Logger) V(level int) Logger {
-	if l.sink == nil {
-		return l
-	}
 	if level < 0 {
 		level = 0
 	}
@ -317,9 +294,6 @@ func (l Logger) V(level int) Logger {
 // WithValues returns a new Logger instance with additional key/value pairs.
 // See Info for documentation on how key/value pairs work.
 func (l Logger) WithValues(keysAndValues ...interface{}) Logger {
-	if l.sink == nil {
-		return l
-	}
 	l.setSink(l.sink.WithValues(keysAndValues...))
 	return l
 }
@ -330,9 +304,6 @@ func (l Logger) WithValues(keysAndValues ...interface{}) Logger {
 // contain only letters, digits, and hyphens (see the package documentation for
 // more information).
 func (l Logger) WithName(name string) Logger {
-	if l.sink == nil {
-		return l
-	}
 	l.setSink(l.sink.WithName(name))
 	return l
 }
@ -353,9 +324,6 @@ func (l Logger) WithName(name string) Logger {
 // WithCallDepth(1) because it works with implementions that support the
 // CallDepthLogSink and/or CallStackHelperLogSink interfaces.
 func (l Logger) WithCallDepth(depth int) Logger {
-	if l.sink == nil {
-		return l
-	}
 	if withCallDepth, ok := l.sink.(CallDepthLogSink); ok {
 		l.setSink(withCallDepth.WithCallDepth(depth))
 	}
@ -377,9 +345,6 @@ func (l Logger) WithCallDepth(depth int) Logger {
 // implementation does not support either of these, the original Logger will be
 // returned.
 func (l Logger) WithCallStackHelper() (func(), Logger) {
-	if l.sink == nil {
-		return func() {}, l
-	}
 	var helper func()
 	if withCallDepth, ok := l.sink.(CallDepthLogSink); ok {
 		l.setSink(withCallDepth.WithCallDepth(1))
@ -392,11 +357,6 @@ func (l Logger) WithCallStackHelper() (func(), Logger) {
 	return helper, l
 }

-// IsZero returns true if this logger is an uninitialized zero value
-func (l Logger) IsZero() bool {
-	return l.sink == nil
-}
-
 // contextKey is how we find Loggers in a context.Context.
 type contextKey struct{}

@ -482,7 +442,7 @@ type LogSink interface {
 	WithName(name string) LogSink
 }

-// CallDepthLogSink represents a LogSink that knows how to climb the call stack
+// CallDepthLogSink represents a Logger that knows how to climb the call stack
 // to identify the original call site and can offset the depth by a specified
 // number of frames.  This is useful for users who have helper functions
 // between the "real" call site and the actual calls to Logger methods.
@ -507,7 +467,7 @@ type CallDepthLogSink interface {
 	WithCallDepth(depth int) LogSink
 }

-// CallStackHelperLogSink represents a LogSink that knows how to climb
+// CallStackHelperLogSink represents a Logger that knows how to climb
 // the call stack to identify the original call site and can skip
 // intermediate helper functions if they mark themselves as
 // helper. Go's testing package uses that approach.
--- a/vendor/github.com/gorilla/mux/.editorconfig
+++ b/vendor/github.com/gorilla/mux/.editorconfig
@ -1,20 +0,0 @@
-; https://editorconfig.org/
-
-root = true
-
-[*]
-insert_final_newline = true
-charset = utf-8
-trim_trailing_whitespace = true
-indent_style = space
-indent_size = 2
-
-[{Makefile,go.mod,go.sum,*.go,.gitmodules}]
-indent_style = tab
-indent_size = 4
-
-[*.md]
-indent_size = 4
-trim_trailing_whitespace = false
-
-eclint_indent_style = unset
--- a/vendor/github.com/gorilla/mux/.gitignore
+++ b/vendor/github.com/gorilla/mux/.gitignore
@ -1 +0,0 @@
-coverage.coverprofile
--- a/vendor/github.com/gorilla/mux/AUTHORS
+++ b/vendor/github.com/gorilla/mux/AUTHORS
@ -0,0 +1,8 @@
+# This is the official list of gorilla/mux authors for copyright purposes.
+#
+# Please keep the list sorted.
+
+Google LLC (https://opensource.google.com/)
+Kamil Kisielk <kamil@kamilkisiel.net>
+Matt Silverlock <matt@eatsleeprepeat.net>
+Rodrigo Moraes (https://github.com/moraes)
--- a/vendor/github.com/gorilla/mux/LICENSE
+++ b/vendor/github.com/gorilla/mux/LICENSE
@ -1,4 +1,4 @@
-Copyright (c) 2023 The Gorilla Authors. All rights reserved.
+Copyright (c) 2012-2018 The Gorilla Authors. All rights reserved.

 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
--- a/vendor/github.com/gorilla/mux/Makefile
+++ b/vendor/github.com/gorilla/mux/Makefile
@ -1,34 +0,0 @@
-GO_LINT=$(shell which golangci-lint 2> /dev/null || echo '')
-GO_LINT_URI=github.com/golangci/golangci-lint/cmd/golangci-lint@latest
-
-GO_SEC=$(shell which gosec 2> /dev/null || echo '')
-GO_SEC_URI=github.com/securego/gosec/v2/cmd/gosec@latest
-
-GO_VULNCHECK=$(shell which govulncheck 2> /dev/null || echo '')
-GO_VULNCHECK_URI=golang.org/x/vuln/cmd/govulncheck@latest
-
-.PHONY: golangci-lint
-golangci-lint:
-	$(if $(GO_LINT), ,go install $(GO_LINT_URI))
-	@echo "##### Running golangci-lint"
-	golangci-lint run -v
-	
-.PHONY: gosec
-gosec:
-	$(if $(GO_SEC), ,go install $(GO_SEC_URI))
-	@echo "##### Running gosec"
-	gosec ./...
-
-.PHONY: govulncheck
-govulncheck:
-	$(if $(GO_VULNCHECK), ,go install $(GO_VULNCHECK_URI))
-	@echo "##### Running govulncheck"
-	govulncheck ./...
-
-.PHONY: verify
-verify: golangci-lint gosec govulncheck
-
-.PHONY: test
-test:
-	@echo "##### Running tests"
-	go test -race -cover -coverprofile=coverage.coverprofile -covermode=atomic -v ./...
--- a/vendor/github.com/gorilla/mux/README.md
+++ b/vendor/github.com/gorilla/mux/README.md
@ -1,12 +1,12 @@
 # gorilla/mux

-![testing](https://github.com/gorilla/mux/actions/workflows/test.yml/badge.svg)
-[![codecov](https://codecov.io/github/gorilla/mux/branch/main/graph/badge.svg)](https://codecov.io/github/gorilla/mux)
-[![godoc](https://godoc.org/github.com/gorilla/mux?status.svg)](https://godoc.org/github.com/gorilla/mux)
-[![sourcegraph](https://sourcegraph.com/github.com/gorilla/mux/-/badge.svg)](https://sourcegraph.com/github.com/gorilla/mux?badge)
+[![GoDoc](https://godoc.org/github.com/gorilla/mux?status.svg)](https://godoc.org/github.com/gorilla/mux)
+[![CircleCI](https://circleci.com/gh/gorilla/mux.svg?style=svg)](https://circleci.com/gh/gorilla/mux)
+[![Sourcegraph](https://sourcegraph.com/github.com/gorilla/mux/-/badge.svg)](https://sourcegraph.com/github.com/gorilla/mux?badge)

+![Gorilla Logo](https://cloud-cdn.questionable.services/gorilla-icon-64.png)

-![Gorilla Logo](https://github.com/gorilla/.github/assets/53367916/d92caabf-98e0-473e-bfbf-ab554ba435e5)
+https://www.gorillatoolkit.org/pkg/mux

 Package `gorilla/mux` implements a request router and dispatcher for matching incoming requests to
 their respective handler.
@ -247,25 +247,32 @@ type spaHandler struct {
 // file located at the index path on the SPA handler will be served. This
 // is suitable behavior for serving an SPA (single page application).
 func (h spaHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	// Join internally call path.Clean to prevent directory traversal
-	path := filepath.Join(h.staticPath, r.URL.Path)
-
-	// check whether a file exists or is a directory at the given path
-	fi, err := os.Stat(path)
-	if os.IsNotExist(err) || fi.IsDir() {
-		// file does not exist or path is a directory, serve index.html
-		http.ServeFile(w, r, filepath.Join(h.staticPath, h.indexPath))
+    // get the absolute path to prevent directory traversal
+	path, err := filepath.Abs(r.URL.Path)
+	if err != nil {
+        // if we failed to get the absolute path respond with a 400 bad request
+        // and stop
+		http.Error(w, err.Error(), http.StatusBadRequest)
 		return
 	}

-	if err != nil {
-		// if we got an error (that wasn't that the file doesn't exist) stating the
-		// file, return a 500 internal server error and stop
+    // prepend the path with the path to the static directory
+	path = filepath.Join(h.staticPath, path)
+
+    // check whether a file exists at the given path
+	_, err = os.Stat(path)
+	if os.IsNotExist(err) {
+		// file does not exist, serve index.html
+		http.ServeFile(w, r, filepath.Join(h.staticPath, h.indexPath))
+		return
+	} else if err != nil {
+        // if we got an error (that wasn't that the file doesn't exist) stating the
+        // file, return a 500 internal server error and stop
 		http.Error(w, err.Error(), http.StatusInternalServerError)
-        return
+		return
 	}

-	// otherwise, use http.FileServer to serve the static file
+    // otherwise, use http.FileServer to serve the static dir
 	http.FileServer(http.Dir(h.staticPath)).ServeHTTP(w, r)
 }

@ -368,19 +375,6 @@ url, err := r.Get("article").URL("subdomain", "news",
                                 "id", "42")
 ```

-To find all the required variables for a given route when calling `URL()`, the method `GetVarNames()` is available:
-```go
-r := mux.NewRouter()
-r.Host("{domain}").
-    Path("/{group}/{item_id}").
-    Queries("some_data1", "{some_data1}").
-    Queries("some_data2", "{some_data2}").
-    Name("article")
-
-// Will print [domain group item_id some_data1 some_data2] <nil>
-fmt.Println(r.Get("article").GetVarNames())
-
-```
 ### Walking Routes

 The `Walk` function on `mux.Router` can be used to visit all of the routes that are registered on a router. For example,
@ -578,7 +572,7 @@ func (amw *authenticationMiddleware) Middleware(next http.Handler) http.Handler
 r := mux.NewRouter()
 r.HandleFunc("/", handler)

-amw := authenticationMiddleware{tokenUsers: make(map[string]string)}
+amw := authenticationMiddleware{}
 amw.Populate()

 r.Use(amw.Middleware)
@ -764,8 +758,7 @@ func TestMetricsHandler(t *testing.T) {

        rr := httptest.NewRecorder()
 	
-	// To add the vars to the context, 
-	// we need to create a router through which we can pass the request.
+	// Need to create a router that we can pass the request through so that the vars will be added to the context
 	router := mux.NewRouter()
        router.HandleFunc("/metrics/{type}", MetricsHandler)
        router.ServeHTTP(rr, req)
--- a/vendor/github.com/gorilla/mux/doc.go
+++ b/vendor/github.com/gorilla/mux/doc.go
@ -10,18 +10,18 @@ http.ServeMux, mux.Router matches incoming requests against a list of
 registered routes and calls a handler for the route that matches the URL
 or other conditions. The main features are:

-  - Requests can be matched based on URL host, path, path prefix, schemes,
-    header and query values, HTTP methods or using custom matchers.
-  - URL hosts, paths and query values can have variables with an optional
-    regular expression.
-  - Registered URLs can be built, or "reversed", which helps maintaining
-    references to resources.
-  - Routes can be used as subrouters: nested routes are only tested if the
-    parent route matches. This is useful to define groups of routes that
-    share common conditions like a host, a path prefix or other repeated
-    attributes. As a bonus, this optimizes request matching.
-  - It implements the http.Handler interface so it is compatible with the
-    standard http.ServeMux.
+	* Requests can be matched based on URL host, path, path prefix, schemes,
+	  header and query values, HTTP methods or using custom matchers.
+	* URL hosts, paths and query values can have variables with an optional
+	  regular expression.
+	* Registered URLs can be built, or "reversed", which helps maintaining
+	  references to resources.
+	* Routes can be used as subrouters: nested routes are only tested if the
+	  parent route matches. This is useful to define groups of routes that
+	  share common conditions like a host, a path prefix or other repeated
+	  attributes. As a bonus, this optimizes request matching.
+	* It implements the http.Handler interface so it is compatible with the
+	  standard http.ServeMux.

 Let's start registering a couple of URL paths and handlers:

@ -301,5 +301,6 @@ A more complex authentication middleware, which maps session token to users, cou
 	r.Use(amw.Middleware)

 Note: The handler chain will be stopped if your middleware doesn't call `next.ServeHTTP()` with the corresponding parameters. This can be used to abort a request if the middleware writer wants to.
+
 */
 package mux
--- a/vendor/github.com/gorilla/mux/mux.go
+++ b/vendor/github.com/gorilla/mux/mux.go
@ -31,26 +31,24 @@ func NewRouter() *Router {
 // It implements the http.Handler interface, so it can be registered to serve
 // requests:
 //
-//	var router = mux.NewRouter()
+//     var router = mux.NewRouter()
 //
-//	func main() {
-//	    http.Handle("/", router)
-//	}
+//     func main() {
+//         http.Handle("/", router)
+//     }
 //
 // Or, for Google App Engine, register it in a init() function:
 //
-//	func init() {
-//	    http.Handle("/", router)
-//	}
+//     func init() {
+//         http.Handle("/", router)
+//     }
 //
 // This will send all incoming requests to the router.
 type Router struct {
 	// Configurable Handler to be used when no route matches.
-	// This can be used to render your own 404 Not Found errors.
 	NotFoundHandler http.Handler

 	// Configurable Handler to be used when the request method does not match the route.
-	// This can be used to render your own 405 Method Not Allowed errors.
 	MethodNotAllowedHandler http.Handler

 	// Routes to be matched, in order.
--- a/vendor/github.com/gorilla/mux/regexp.go
+++ b/vendor/github.com/gorilla/mux/regexp.go
@ -22,10 +22,10 @@ type routeRegexpOptions struct {
 type regexpType int

 const (
-	regexpTypePath regexpType = iota
-	regexpTypeHost
-	regexpTypePrefix
-	regexpTypeQuery
+	regexpTypePath   regexpType = 0
+	regexpTypeHost   regexpType = 1
+	regexpTypePrefix regexpType = 2
+	regexpTypeQuery  regexpType = 3
 )

 // newRouteRegexp parses a route template and returns a routeRegexp,
@ -195,7 +195,7 @@ func (r *routeRegexp) Match(req *http.Request, match *RouteMatch) bool {

 // url builds a URL part using the given values.
 func (r *routeRegexp) url(values map[string]string) (string, error) {
-	urlValues := make([]interface{}, len(r.varsN))
+	urlValues := make([]interface{}, len(r.varsN), len(r.varsN))
 	for k, v := range r.varsN {
 		value, ok := values[v]
 		if !ok {
--- a/vendor/github.com/gorilla/mux/route.go
+++ b/vendor/github.com/gorilla/mux/route.go
@ -64,18 +64,8 @@ func (r *Route) Match(req *http.Request, match *RouteMatch) bool {
 				match.MatchErr = nil
 			}

-			matchErr = nil // nolint:ineffassign
+			matchErr = nil
 			return false
-		} else {
-			// Multiple routes may share the same path but use different HTTP methods. For instance:
-			// Route 1: POST "/users/{id}".
-			// Route 2: GET "/users/{id}", parameters: "id": "[0-9]+".
-			//
-			// The router must handle these cases correctly. For a GET request to "/users/abc" with "id" as "-2",
-			// The router should return a "Not Found" error as no route fully matches this request.
-			if match.MatchErr == ErrMethodMismatch {
-				match.MatchErr = nil
-			}
 		}
 	}

@ -240,9 +230,9 @@ func (m headerMatcher) Match(r *http.Request, match *RouteMatch) bool {
 // Headers adds a matcher for request header values.
 // It accepts a sequence of key/value pairs to be matched. For example:
 //
-//	r := mux.NewRouter().NewRoute()
-//	r.Headers("Content-Type", "application/json",
-//	          "X-Requested-With", "XMLHttpRequest")
+//     r := mux.NewRouter()
+//     r.Headers("Content-Type", "application/json",
+//               "X-Requested-With", "XMLHttpRequest")
 //
 // The above route will only match if both request header values match.
 // If the value is an empty string, it will match any value if the key is set.
@ -265,9 +255,9 @@ func (m headerRegexMatcher) Match(r *http.Request, match *RouteMatch) bool {
 // HeadersRegexp accepts a sequence of key/value pairs, where the value has regex
 // support. For example:
 //
-//	r := mux.NewRouter().NewRoute()
-//	r.HeadersRegexp("Content-Type", "application/(text|json)",
-//	          "X-Requested-With", "XMLHttpRequest")
+//     r := mux.NewRouter()
+//     r.HeadersRegexp("Content-Type", "application/(text|json)",
+//               "X-Requested-With", "XMLHttpRequest")
 //
 // The above route will only match if both the request header matches both regular expressions.
 // If the value is an empty string, it will match any value if the key is set.
@ -293,10 +283,10 @@ func (r *Route) HeadersRegexp(pairs ...string) *Route {
 //
 // For example:
 //
-//	r := mux.NewRouter().NewRoute()
-//	r.Host("www.example.com")
-//	r.Host("{subdomain}.domain.com")
-//	r.Host("{subdomain:[a-z]+}.domain.com")
+//     r := mux.NewRouter()
+//     r.Host("www.example.com")
+//     r.Host("{subdomain}.domain.com")
+//     r.Host("{subdomain:[a-z]+}.domain.com")
 //
 // Variable names must be unique in a given route. They can be retrieved
 // calling mux.Vars(request).
@ -352,11 +342,11 @@ func (r *Route) Methods(methods ...string) *Route {
 //
 // For example:
 //
-//	r := mux.NewRouter().NewRoute()
-//	r.Path("/products/").Handler(ProductsHandler)
-//	r.Path("/products/{key}").Handler(ProductsHandler)
-//	r.Path("/articles/{category}/{id:[0-9]+}").
-//	  Handler(ArticleHandler)
+//     r := mux.NewRouter()
+//     r.Path("/products/").Handler(ProductsHandler)
+//     r.Path("/products/{key}").Handler(ProductsHandler)
+//     r.Path("/articles/{category}/{id:[0-9]+}").
+//       Handler(ArticleHandler)
 //
 // Variable names must be unique in a given route. They can be retrieved
 // calling mux.Vars(request).
@ -387,8 +377,8 @@ func (r *Route) PathPrefix(tpl string) *Route {
 // It accepts a sequence of key/value pairs. Values may define variables.
 // For example:
 //
-//	r := mux.NewRouter().NewRoute()
-//	r.Queries("foo", "bar", "id", "{id:[0-9]+}")
+//     r := mux.NewRouter()
+//     r.Queries("foo", "bar", "id", "{id:[0-9]+}")
 //
 // The above route will only match if the URL contains the defined queries
 // values, e.g.: ?foo=bar&id=42.
@ -483,11 +473,11 @@ func (r *Route) BuildVarsFunc(f BuildVarsFunc) *Route {
 //
 // It will test the inner routes only if the parent route matched. For example:
 //
-//	r := mux.NewRouter().NewRoute()
-//	s := r.Host("www.example.com").Subrouter()
-//	s.HandleFunc("/products/", ProductsHandler)
-//	s.HandleFunc("/products/{key}", ProductHandler)
-//	s.HandleFunc("/articles/{category}/{id:[0-9]+}"), ArticleHandler)
+//     r := mux.NewRouter()
+//     s := r.Host("www.example.com").Subrouter()
+//     s.HandleFunc("/products/", ProductsHandler)
+//     s.HandleFunc("/products/{key}", ProductHandler)
+//     s.HandleFunc("/articles/{category}/{id:[0-9]+}"), ArticleHandler)
 //
 // Here, the routes registered in the subrouter won't be tested if the host
 // doesn't match.
@ -507,36 +497,36 @@ func (r *Route) Subrouter() *Router {
 // It accepts a sequence of key/value pairs for the route variables. For
 // example, given this route:
 //
-//	r := mux.NewRouter()
-//	r.HandleFunc("/articles/{category}/{id:[0-9]+}", ArticleHandler).
-//	  Name("article")
+//     r := mux.NewRouter()
+//     r.HandleFunc("/articles/{category}/{id:[0-9]+}", ArticleHandler).
+//       Name("article")
 //
 // ...a URL for it can be built using:
 //
-//	url, err := r.Get("article").URL("category", "technology", "id", "42")
+//     url, err := r.Get("article").URL("category", "technology", "id", "42")
 //
 // ...which will return an url.URL with the following path:
 //
-//	"/articles/technology/42"
+//     "/articles/technology/42"
 //
 // This also works for host variables:
 //
-//	r := mux.NewRouter()
-//	r.HandleFunc("/articles/{category}/{id:[0-9]+}", ArticleHandler).
-//	  Host("{subdomain}.domain.com").
-//	  Name("article")
+//     r := mux.NewRouter()
+//     r.HandleFunc("/articles/{category}/{id:[0-9]+}", ArticleHandler).
+//       Host("{subdomain}.domain.com").
+//       Name("article")
 //
-//	// url.String() will be "http://news.domain.com/articles/technology/42"
-//	url, err := r.Get("article").URL("subdomain", "news",
-//	                                 "category", "technology",
-//	                                 "id", "42")
+//     // url.String() will be "http://news.domain.com/articles/technology/42"
+//     url, err := r.Get("article").URL("subdomain", "news",
+//                                      "category", "technology",
+//                                      "id", "42")
 //
 // The scheme of the resulting url will be the first argument that was passed to Schemes:
 //
-//	// url.String() will be "https://example.com"
-//	r := mux.NewRouter().NewRoute()
-//	url, err := r.Host("example.com")
-//	             .Schemes("https", "http").URL()
+//     // url.String() will be "https://example.com"
+//     r := mux.NewRouter()
+//     url, err := r.Host("example.com")
+//                  .Schemes("https", "http").URL()
 //
 // All variables defined in the route are required, and their values must
 // conform to the corresponding patterns.
@ -728,25 +718,6 @@ func (r *Route) GetHostTemplate() (string, error) {
 	return r.regexp.host.template, nil
 }

-// GetVarNames returns the names of all variables added by regexp matchers
-// These can be used to know which route variables should be passed into r.URL()
-func (r *Route) GetVarNames() ([]string, error) {
-	if r.err != nil {
-		return nil, r.err
-	}
-	var varNames []string
-	if r.regexp.host != nil {
-		varNames = append(varNames, r.regexp.host.varsN...)
-	}
-	if r.regexp.path != nil {
-		varNames = append(varNames, r.regexp.path.varsN...)
-	}
-	for _, regx := range r.regexp.queries {
-		varNames = append(varNames, regx.varsN...)
-	}
-	return varNames, nil
-}
-
 // prepareVars converts the route variable pairs into a map. If the route has a
 // BuildVarsFunc, it is invoked.
 func (r *Route) prepareVars(pairs ...string) (map[string]string, error) {
--- a/vendor/github.com/klauspost/compress/.goreleaser.yml
+++ b/vendor/github.com/klauspost/compress/.goreleaser.yml
@ -3,7 +3,7 @@
 before:
  hooks:
    - ./gen.sh
-    - go install mvdan.cc/garble@v0.10.1
+    - go install mvdan.cc/garble@v0.9.3

 builds:
  -
@ -92,7 +92,16 @@ builds:
 archives:
  -
    id: s2-binaries
-    name_template: "s2-{{ .Os }}_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}"
+    name_template: "s2-{{ .Os }}_{{ .Arch }}_{{ .Version }}"
+    replacements:
+      aix: AIX
+      darwin: OSX
+      linux: Linux
+      windows: Windows
+      386: i386
+      amd64: x86_64
+      freebsd: FreeBSD
+      netbsd: NetBSD
    format_overrides:
      - goos: windows
        format: zip
@ -116,7 +125,7 @@ changelog:

 nfpms:
  -
-    file_name_template: "s2_package__{{ .Os }}_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}"
+    file_name_template: "s2_package_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
    vendor: Klaus Post
    homepage: https://github.com/klauspost/compress
    maintainer: Klaus Post <klauspost@gmail.com>
@ -125,3 +134,8 @@ nfpms:
    formats:
      - deb
      - rpm
+    replacements:
+      darwin: Darwin
+      linux: Linux
+      freebsd: FreeBSD
+      amd64: x86_64
--- a/vendor/github.com/klauspost/compress/README.md
+++ b/vendor/github.com/klauspost/compress/README.md
@ -16,29 +16,6 @@ This package provides various compression algorithms.

 # changelog

-* July 1st, 2023 - [v1.16.7](https://github.com/klauspost/compress/releases/tag/v1.16.7)
-	* zstd: Fix default level first dictionary encode https://github.com/klauspost/compress/pull/829
-	* s2: add GetBufferCapacity() method by @GiedriusS in https://github.com/klauspost/compress/pull/832
-
-* June 13, 2023 - [v1.16.6](https://github.com/klauspost/compress/releases/tag/v1.16.6)
-	* zstd: correctly ignore WithEncoderPadding(1) by @ianlancetaylor in https://github.com/klauspost/compress/pull/806
-	* zstd: Add amd64 match length assembly https://github.com/klauspost/compress/pull/824
-	* gzhttp: Handle informational headers by @rtribotte in https://github.com/klauspost/compress/pull/815
-	* s2: Improve Better compression slightly https://github.com/klauspost/compress/pull/663
-
-* Apr 16, 2023 - [v1.16.5](https://github.com/klauspost/compress/releases/tag/v1.16.5)
-	* zstd: readByte needs to use io.ReadFull by @jnoxon in https://github.com/klauspost/compress/pull/802
-	* gzip: Fix WriterTo after initial read https://github.com/klauspost/compress/pull/804
-
-* Apr 5, 2023 - [v1.16.4](https://github.com/klauspost/compress/releases/tag/v1.16.4)
-	* zstd: Improve zstd best efficiency by @greatroar and @klauspost in https://github.com/klauspost/compress/pull/784
-	* zstd: Respect WithAllLitEntropyCompression https://github.com/klauspost/compress/pull/792
-	* zstd: Fix amd64 not always detecting corrupt data https://github.com/klauspost/compress/pull/785
-	* zstd: Various minor improvements by @greatroar in https://github.com/klauspost/compress/pull/788 https://github.com/klauspost/compress/pull/794 https://github.com/klauspost/compress/pull/795
-	* s2: Fix huge block overflow https://github.com/klauspost/compress/pull/779
-	* s2: Allow CustomEncoder fallback https://github.com/klauspost/compress/pull/780
-	* gzhttp: Suppport ResponseWriter Unwrap() in gzhttp handler by @jgimenez in https://github.com/klauspost/compress/pull/799
-
 * Mar 13, 2023 - [v1.16.1](https://github.com/klauspost/compress/releases/tag/v1.16.1)
 	* zstd: Speed up + improve best encoder by @greatroar in https://github.com/klauspost/compress/pull/776
 	* gzhttp: Add optional [BREACH mitigation](https://github.com/klauspost/compress/tree/master/gzhttp#breach-mitigation). https://github.com/klauspost/compress/pull/762 https://github.com/klauspost/compress/pull/768 https://github.com/klauspost/compress/pull/769 https://github.com/klauspost/compress/pull/770 https://github.com/klauspost/compress/pull/767
@ -54,9 +31,6 @@ This package provides various compression algorithms.
 	* s2: Support io.ReaderAt in ReadSeeker. https://github.com/klauspost/compress/pull/747
 	* s2c/s2sx: Use concurrent decoding. https://github.com/klauspost/compress/pull/746

-<details>
-	<summary>See changes to v1.15.x</summary>
-	
 * Jan 21st, 2023 (v1.15.15)
 	* deflate: Improve level 7-9 by @klauspost in https://github.com/klauspost/compress/pull/739
 	* zstd: Add delta encoding support by @greatroar in https://github.com/klauspost/compress/pull/728
@ -183,8 +157,6 @@ Stream decompression is now faster on asynchronous, since the goroutine allocati

 While the release has been extensively tested, it is recommended to testing when upgrading.

-</details>
-
 <details>
 	<summary>See changes to v1.14.x</summary>
 	
@ -643,9 +615,6 @@ Here are other packages of good quality and pure Go (no cgo wrappers or autoconv
 * [github.com/pierrec/lz4](https://github.com/pierrec/lz4) - strong multithreaded LZ4 compression.
 * [github.com/cosnicolaou/pbzip2](https://github.com/cosnicolaou/pbzip2) - multithreaded bzip2 decompression.
 * [github.com/dsnet/compress](https://github.com/dsnet/compress) - brotli decompression, bzip2 writer.
-* [github.com/ronanh/intcomp](https://github.com/ronanh/intcomp) - Integer compression.
-* [github.com/spenczar/fpc](https://github.com/spenczar/fpc) - Float compression.
-* [github.com/minio/zipindex](https://github.com/minio/zipindex) - External ZIP directory index.

 # license

--- a/vendor/github.com/klauspost/compress/SECURITY.md
+++ b/vendor/github.com/klauspost/compress/SECURITY.md
@ -1,25 +0,0 @@
-# Security Policy
-
-## Supported Versions
-
-Security updates are applied only to the latest release.
-
-## Vulnerability Definition
-
-A security vulnerability is a bug that with certain input triggers a crash or an infinite loop. Most calls will have varying execution time and only in rare cases will slow operation be considered a security vulnerability.
-
-Corrupted output generally is not considered a security vulnerability, unless independent operations are able to affect each other. Note that not all functionality is re-entrant and safe to use concurrently.
-
-Out-of-memory crashes only applies if the en/decoder uses an abnormal amount of memory, with appropriate options applied, to limit maximum window size, concurrency, etc. However, if you are in doubt you are welcome to file a security issue.
-
-It is assumed that all callers are trusted, meaning internal data exposed through reflection or inspection of returned data structures is not considered a vulnerability.
-
-Vulnerabilities resulting from compiler/assembler errors should be reported upstream. Depending on the severity this package may or may not implement a workaround.
-
-## Reporting a Vulnerability
-
-If you have discovered a security vulnerability in this project, please report it privately. **Do not disclose it as a public issue.** This gives us time to work with you to fix the issue before public exposure, reducing the chance that the exploit will be used before a patch is released.
-
-Please disclose it at [security advisory](https://github.com/klauspost/compress/security/advisories/new). If possible please provide a minimal reproducer. If the issue only applies to a single platform, it would be helpful to provide access to that.
-
-This project is maintained by a team of volunteers on a reasonable-effort basis. As such, vulnerabilities will be disclosed in a best effort base.
--- a/vendor/github.com/klauspost/compress/fse/bitwriter.go
+++ b/vendor/github.com/klauspost/compress/fse/bitwriter.go
@ -152,11 +152,12 @@ func (b *bitWriter) flushAlign() {

 // close will write the alignment bit and write the final byte(s)
 // to the output.
-func (b *bitWriter) close() {
+func (b *bitWriter) close() error {
 	// End mark
 	b.addBits16Clean(1, 1)
 	// flush until next byte.
 	b.flushAlign()
+	return nil
 }

 // reset and continue writing by appending to out.
--- a/vendor/github.com/klauspost/compress/fse/compress.go
+++ b/vendor/github.com/klauspost/compress/fse/compress.go
@ -199,8 +199,7 @@ func (s *Scratch) compress(src []byte) error {
 	c2.flush(s.actualTableLog)
 	c1.flush(s.actualTableLog)

-	s.bw.close()
-	return nil
+	return s.bw.close()
 }

 // writeCount will write the normalized histogram count to header.
--- a/vendor/github.com/klauspost/compress/huff0/bitwriter.go
+++ b/vendor/github.com/klauspost/compress/huff0/bitwriter.go
@ -13,6 +13,14 @@ type bitWriter struct {
 	out          []byte
 }

+// bitMask16 is bitmasks. Has extra to avoid bounds check.
+var bitMask16 = [32]uint16{
+	0, 1, 3, 7, 0xF, 0x1F,
+	0x3F, 0x7F, 0xFF, 0x1FF, 0x3FF, 0x7FF,
+	0xFFF, 0x1FFF, 0x3FFF, 0x7FFF, 0xFFFF, 0xFFFF,
+	0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF,
+	0xFFFF, 0xFFFF} /* up to 16 bits */
+
 // addBits16Clean will add up to 16 bits. value may not contain more set bits than indicated.
 // It will not check if there is space for them, so the caller must ensure that it has flushed recently.
 func (b *bitWriter) addBits16Clean(value uint16, bits uint8) {
@ -94,9 +102,10 @@ func (b *bitWriter) flushAlign() {

 // close will write the alignment bit and write the final byte(s)
 // to the output.
-func (b *bitWriter) close() {
+func (b *bitWriter) close() error {
 	// End mark
 	b.addBits16Clean(1, 1)
 	// flush until next byte.
 	b.flushAlign()
+	return nil
 }
--- a/vendor/github.com/klauspost/compress/huff0/compress.go
+++ b/vendor/github.com/klauspost/compress/huff0/compress.go
@ -227,10 +227,10 @@ func EstimateSizes(in []byte, s *Scratch) (tableSz, dataSz, reuseSz int, err err
 }

 func (s *Scratch) compress1X(src []byte) ([]byte, error) {
-	return s.compress1xDo(s.Out, src), nil
+	return s.compress1xDo(s.Out, src)
 }

-func (s *Scratch) compress1xDo(dst, src []byte) []byte {
+func (s *Scratch) compress1xDo(dst, src []byte) ([]byte, error) {
 	var bw = bitWriter{out: dst}

 	// N is length divisible by 4.
@ -260,8 +260,8 @@ func (s *Scratch) compress1xDo(dst, src []byte) []byte {
 			bw.encTwoSymbols(cTable, tmp[1], tmp[0])
 		}
 	}
-	bw.close()
-	return bw.out
+	err := bw.close()
+	return bw.out, err
 }

 var sixZeros [6]byte
@ -283,8 +283,12 @@ func (s *Scratch) compress4X(src []byte) ([]byte, error) {
 		}
 		src = src[len(toDo):]

+		var err error
 		idx := len(s.Out)
-		s.Out = s.compress1xDo(s.Out, toDo)
+		s.Out, err = s.compress1xDo(s.Out, toDo)
+		if err != nil {
+			return nil, err
+		}
 		if len(s.Out)-idx > math.MaxUint16 {
 			// We cannot store the size in the jump table
 			return nil, ErrIncompressible
@ -311,6 +315,7 @@ func (s *Scratch) compress4Xp(src []byte) ([]byte, error) {

 	segmentSize := (len(src) + 3) / 4
 	var wg sync.WaitGroup
+	var errs [4]error
 	wg.Add(4)
 	for i := 0; i < 4; i++ {
 		toDo := src
@ -321,12 +326,15 @@ func (s *Scratch) compress4Xp(src []byte) ([]byte, error) {

 		// Separate goroutine for each block.
 		go func(i int) {
-			s.tmpOut[i] = s.compress1xDo(s.tmpOut[i][:0], toDo)
+			s.tmpOut[i], errs[i] = s.compress1xDo(s.tmpOut[i][:0], toDo)
 			wg.Done()
 		}(i)
 	}
 	wg.Wait()
 	for i := 0; i < 4; i++ {
+		if errs[i] != nil {
+			return nil, errs[i]
+		}
 		o := s.tmpOut[i]
 		if len(o) > math.MaxUint16 {
 			// We cannot store the size in the jump table
--- a/vendor/github.com/klauspost/compress/huff0/decompress.go
+++ b/vendor/github.com/klauspost/compress/huff0/decompress.go
@ -253,7 +253,7 @@ func (d *Decoder) decompress1X8Bit(dst, src []byte) ([]byte, error) {

 	switch d.actualTableLog {
 	case 8:
-		const shift = 0
+		const shift = 8 - 8
 		for br.off >= 4 {
 			br.fillFast()
 			v := dt[uint8(br.value>>(56+shift))]
--- a/vendor/github.com/klauspost/compress/internal/snapref/encode_other.go
+++ b/vendor/github.com/klauspost/compress/internal/snapref/encode_other.go
@ -87,6 +87,18 @@ func emitCopy(dst []byte, offset, length int) int {
 	return i + 2
 }

+// extendMatch returns the largest k such that k <= len(src) and that
+// src[i:i+k-j] and src[j:k] have the same contents.
+//
+// It assumes that:
+//
+//	0 <= i && i < j && j <= len(src)
+func extendMatch(src []byte, i, j int) int {
+	for ; j < len(src) && src[i] == src[j]; i, j = i+1, j+1 {
+	}
+	return j
+}
+
 func hash(u, shift uint32) uint32 {
 	return (u * 0x1e35a7bd) >> shift
 }
--- a/vendor/github.com/klauspost/compress/zstd/README.md
+++ b/vendor/github.com/klauspost/compress/zstd/README.md
@ -304,7 +304,7 @@ import "github.com/klauspost/compress/zstd"

 // Create a reader that caches decompressors.
 // For this operation type we supply a nil Reader.
-var decoder, _ = zstd.NewReader(nil, zstd.WithDecoderConcurrency(0))
+var decoder, _ = zstd.NewReader(nil, WithDecoderConcurrency(0))

 // Decompress a buffer. We don't supply a destination buffer,
 // so it will be allocated by the decoder.
--- a/vendor/github.com/klauspost/compress/zstd/bitreader.go
+++ b/vendor/github.com/klauspost/compress/zstd/bitreader.go
@ -17,6 +17,7 @@ import (
 // for aligning the input.
 type bitReader struct {
 	in       []byte
+	off      uint   // next byte to read is at in[off - 1]
 	value    uint64 // Maybe use [16]byte, but shifting is awkward.
 	bitsRead uint8
 }
@ -27,6 +28,7 @@ func (b *bitReader) init(in []byte) error {
 		return errors.New("corrupt stream: too short")
 	}
 	b.in = in
+	b.off = uint(len(in))
 	// The highest bit of the last byte indicates where to start
 	v := in[len(in)-1]
 	if v == 0 {
@ -67,19 +69,21 @@ func (b *bitReader) fillFast() {
 	if b.bitsRead < 32 {
 		return
 	}
-	v := b.in[len(b.in)-4:]
-	b.in = b.in[:len(b.in)-4]
+	// 2 bounds checks.
+	v := b.in[b.off-4:]
+	v = v[:4]
 	low := (uint32(v[0])) | (uint32(v[1]) << 8) | (uint32(v[2]) << 16) | (uint32(v[3]) << 24)
 	b.value = (b.value << 32) | uint64(low)
 	b.bitsRead -= 32
+	b.off -= 4
 }

 // fillFastStart() assumes the bitreader is empty and there is at least 8 bytes to read.
 func (b *bitReader) fillFastStart() {
-	v := b.in[len(b.in)-8:]
-	b.in = b.in[:len(b.in)-8]
-	b.value = binary.LittleEndian.Uint64(v)
+	// Do single re-slice to avoid bounds checks.
+	b.value = binary.LittleEndian.Uint64(b.in[b.off-8:])
 	b.bitsRead = 0
+	b.off -= 8
 }

 // fill() will make sure at least 32 bits are available.
@ -87,25 +91,25 @@ func (b *bitReader) fill() {
 	if b.bitsRead < 32 {
 		return
 	}
-	if len(b.in) >= 4 {
-		v := b.in[len(b.in)-4:]
-		b.in = b.in[:len(b.in)-4]
+	if b.off >= 4 {
+		v := b.in[b.off-4:]
+		v = v[:4]
 		low := (uint32(v[0])) | (uint32(v[1]) << 8) | (uint32(v[2]) << 16) | (uint32(v[3]) << 24)
 		b.value = (b.value << 32) | uint64(low)
 		b.bitsRead -= 32
+		b.off -= 4
 		return
 	}
-
-	b.bitsRead -= uint8(8 * len(b.in))
-	for len(b.in) > 0 {
-		b.value = (b.value << 8) | uint64(b.in[len(b.in)-1])
-		b.in = b.in[:len(b.in)-1]
+	for b.off > 0 {
+		b.value = (b.value << 8) | uint64(b.in[b.off-1])
+		b.bitsRead -= 8
+		b.off--
 	}
 }

 // finished returns true if all bits have been read from the bit stream.
 func (b *bitReader) finished() bool {
-	return len(b.in) == 0 && b.bitsRead >= 64
+	return b.off == 0 && b.bitsRead >= 64
 }

 // overread returns true if more bits have been requested than is on the stream.
@ -115,7 +119,7 @@ func (b *bitReader) overread() bool {

 // remain returns the number of bits remaining.
 func (b *bitReader) remain() uint {
-	return 8*uint(len(b.in)) + 64 - uint(b.bitsRead)
+	return b.off*8 + 64 - uint(b.bitsRead)
 }

 // close the bitstream and returns an error if out-of-buffer reads occurred.
--- a/Show More
+++ b/Show More
				`@ -1 +0,0 @@`
				`redirect: https://raw.githubusercontent.com/openfaas/faas/master/.DEREK.yml`
 @ -1 +1 @@
 .2.4
 .2.3